@zq-silk/yui 0.11.3 → 0.12.1

package/dist/controller/runtime.js

@@ -7,7 +7,7 @@ import { AGENT_OPERATIONAL_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, YUI_M
 import { hasRuntimeCleanupObligation, runtimeLifecycleSignalKey, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { agentProcessReadinessProbe, ExecutorRegistry } from "../executor/executorRegistry.js";
 import { activeLiveRoleAgentSession, roleAgentSessionResumeMode } from "../executor/agentExecutor.js";
-import { effectiveLaunchSnapshotsCompatible, effectiveLaunchSnapshotsCompatibleForTaskMain, effectiveLaunchConfig, resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
+import { effectiveLaunchSnapshotsCompatible, effectiveLaunchSnapshotsCompatibleForTaskSession, effectiveLaunchConfig, resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
 import { AgentConfigurationCatalogService, validateAgentLaunchConfiguration } from "../executor/agentConfigurationCatalog.js";
 import { isTaskOwnedWorkspace, managedWorkspaceIdentity, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
 import { FileRoleLaunchPlanner } from "../executor/fileRoleLaunchPlanner.js";
@@ -36,6 +36,7 @@ import { createRuntimeResourceActivityTracker } from "./resourceInventory.js";
 import { SessionOwnerReconciliation } from "./sessionOwnerReconciliation.js";
 import { launchBrokerForHome } from "../runtime/launchBroker.js";
 import { classifyRuntimeProcessExit, validateRuntimeProcessExitObservation } from "../runtime/processExitObservation.js";
+import { replayRuntimeProcessExitOutbox } from "../runtime/processExitOutbox.js";
 import { appendGlobalProcessExitObservation } from "../runtime/globalProcessExitStore.js";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
 import { createRuntimeObservation, runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
@@ -385,6 +386,12 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             environment: options.environment
         });
     const lifecycleDispatcher = createRuntimeLifecycleDispatcher(store, schedulerStore, sessionHost, options.dispatcher, signalRuntimeCleanup, launchCoordinator, planner);
+    // Process-exit observations are persisted by the Agent Host before socket
+    // delivery. Drain them while this Controller is still the only storage
+    // writer and before it begins accepting new work after a handover.
+    await replayRuntimeProcessExitOutbox(home, async (observation) => {
+        await lifecycleDispatcher("runtime.process-exit-observe", observation);
+    });
     // f7/rr5: This same inbox feeds the supervisor's terminal channel and the
     // runtime event processor. When a Job reaches a terminal state, the
     // supervisor enqueues a durable-job-terminal event; the processor drains it
@@ -577,6 +584,11 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
             }
             return { recorded: true };
         }
+        if (method === "runtime.conversation-switch-detach") {
+            const value = conversationSwitchDetachParams(params);
+            const outcome = schedulerStore.detachAgentHostProviderForConversationSwitch(value);
+            return { recorded: outcome === "detached", outcome };
+        }
         if (method === "runtime.provider-turn-submission-resolve") {
             const value = providerTurnControlParams(params);
             const status = params.status;
@@ -671,6 +683,8 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                 || !Number.isSafeInteger(hostPid) || hostPid <= 0) {
                 throw applicationError("INVALID_PARAMS", "Launch redemption identity is invalid.");
             }
+            // The launch payload is validated at reservation time and every member
+            // of its discriminated Provider-control union is JSON serializable.
             return launchBrokerForHome(store.rootDirectory()).redeem(launchId, ticket);
         }
         if (method === "runtime.replace-agent-environment") {
@@ -735,6 +749,9 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
             const activeRun = request.scope === "task"
                 ? store.getActiveAgentRun(request.taskId, request.roleName)
                 : null;
+            if (request.scope === "task" && activeRun === null) {
+                throw applicationError("INVALID_PARAMS", "Task Role runtime attachment requires an admitted active Run; it cannot create an empty Provider Conversation.");
+            }
             const managedWorkspace = request.scope === "task"
                 ? activeRun?.workspace
                     ?? currentDesiredManagedWorkspace(store, request.taskId, request.roleName)
@@ -754,8 +771,21 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                 throw applicationError("INVALID_PARAMS", `Configured Agent does not match Role: ${effective.agentId}.`);
             }
             validateLifecycleEnvironment(request.environment, agent);
-            const mode = roleAgentSessionResumeMode(sessions, effective.agentId, effective, managedWorkspace);
             const session = sessions?.sessions[effective.agentId];
+            const managedTurnDispatch = activeRun !== null && (activeRun.pushedAt === undefined
+                || activeRun.providerRetry?.state === "dispatching"
+                || activeRun.controlRequest?.state === "dispatching");
+            // An ensure call may reattach the already-admitted Run to its existing
+            // Conversation, but it may not manufacture a fresh Conversation without a
+            // pending managed Turn. Fresh replacement remains owned by Run dispatch.
+            const mode = activeRun === null
+                ? roleAgentSessionResumeMode(sessions, effective.agentId, effective)
+                : managedTurnDispatch ? activeRun.mode : "resume";
+            if (request.scope === "task" && mode === "resume"
+                && (session?.nativeSessionId === undefined
+                    || session.nativeSessionId.trim().length === 0)) {
+                throw applicationError("INVALID_PARAMS", "Task Role runtime attachment cannot resume because its Provider Conversation identity is missing.");
+            }
             const owner = request.scope === "task"
                 ? { scope: "task", taskId: request.taskId, roleName: request.roleName }
                 : { scope: "global", roleName: request.roleName };
@@ -878,7 +908,7 @@ function assertRuntimeLaunchRequestCurrent(store, request) {
             throw new Error(`Native session changed: ${request.owner.roleName}.`);
         }
         const sessionEffectiveCompatible = request.owner.scope === "task"
-            ? effectiveLaunchSnapshotsCompatibleForTaskMain(session.effective, request.effective, request.managedWorkspace)
+            ? effectiveLaunchSnapshotsCompatibleForTaskSession(session.effective, request.effective)
             : effectiveLaunchSnapshotsCompatible(session.effective, request.effective);
         if (!sessionEffectiveCompatible) {
             throw new Error(`Native session effective launch changed: ${request.owner.roleName}.`);
@@ -1105,6 +1135,31 @@ function providerTurnControlParams(params) {
         now: new Date(observedAt)
     };
 }
+function conversationSwitchDetachParams(params) {
+    if (typeof params !== "object" || params === null || Array.isArray(params)) {
+        throw applicationError("INVALID_PARAMS", "Provider Conversation detachment params are invalid.");
+    }
+    const value = params;
+    const nextAuthorityEpoch = value.nextAuthorityEpoch;
+    const observedAt = requiredParam(value.observedAt);
+    if (!Number.isSafeInteger(nextAuthorityEpoch) || nextAuthorityEpoch < 1
+        || !Number.isFinite(Date.parse(observedAt))) {
+        throw applicationError("INVALID_PARAMS", "Provider Conversation detachment fence is invalid.");
+    }
+    return {
+        taskId: requiredParam(value.taskId),
+        roleName: requiredParam(value.roleName),
+        runId: requiredParam(value.runId),
+        agentId: requiredParam(value.agentId),
+        launchId: requiredParam(value.launchId),
+        previousConversationId: requiredParam(value.previousConversationId),
+        previousNativeSessionId: requiredParam(value.previousNativeSessionId),
+        previousActivationId: requiredParam(value.previousActivationId),
+        nextAuthorityEpoch: nextAuthorityEpoch,
+        nextAuthorityHolderId: requiredParam(value.nextAuthorityHolderId),
+        now: new Date(observedAt)
+    };
+}
 function abortableDelay(milliseconds, signal) {
     return new Promise((resolve, reject) => {
         const timer = setTimeout(() => {

package/dist/controller/runtimeEventInbox.js

@@ -2,7 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { closeSync, constants, existsSync, fchmodSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { withUpgradeCoordinationLock } from "../storage/upgradeCoordination.js";
-import { createRuntimeObservation } from "../runtime/runtimeObservation.js";
+import { createRuntimeObservation, isRuntimeTokenEvidence } from "../runtime/runtimeObservation.js";
 export const MAX_RUNTIME_TURN_SUMMARY_BYTES = 32 * 1024;
 export const MAX_RUNTIME_EVENT_FILE_BYTES = 16 * 1024 * 1024;
 const RUNTIME_EVENT_DIRECTORY = join("runtime", "inbox");
@@ -41,7 +41,7 @@ export class FileRuntimeEventInbox {
         return this.publish(event);
     }
     enqueueTurnCompleted(input) {
-        const normalized = normalizeCodexInput(input);
+        const normalized = normalizeNativeTurnCompletedInput(input);
         return this.publish(Object.freeze({
             schemaVersion: 1,
             id: runtimeEventId("native-turn-completed", normalized),
@@ -163,6 +163,15 @@ export class FileRuntimeEventInbox {
         // UpgradeFenceError after the cutover holder releases the lock.
         return withUpgradeCoordinationLock(this.home, () => {
             this.hooks.afterAdmission?.();
+            if (event.type === "runtime-observation"
+                && isRuntimeTokenEvidence(event.observation)) {
+                const existing = this.list().find((candidate) => (candidate.type === "runtime-observation"
+                    && candidate.taskId === event.taskId
+                    && candidate.observation.eventId === event.observation.eventId));
+                if (existing !== undefined) {
+                    return { event: existing, created: false };
+                }
+            }
             return this.publishUnlocked(event);
         });
     }
@@ -281,7 +290,7 @@ function runtimeEventId(type, input) {
     ];
     return `turn-${createHash("sha256").update(JSON.stringify(common)).digest("hex")}`;
 }
-function normalizeCodexInput(input) {
+function normalizeNativeTurnCompletedInput(input) {
     const scope = input.scope;
     if (scope !== "task" && scope !== "global")
         throw invalidEvent();
@@ -305,7 +314,8 @@ function normalizeCodexInput(input) {
             : { title: requireIdentityText(input.title, "Session title") }),
         summary: truncateUtf8(input.summary.trim(), MAX_RUNTIME_TURN_SUMMARY_BYTES)
     };
-    if (common.adapterId !== "codex" || common.summary.length === 0)
+    if ((common.adapterId !== "codex" && common.adapterId !== "claude")
+        || common.summary.length === 0)
         throw invalidEvent();
     return scope === "task"
         ? { ...common, taskId: requireIdentityText(input.taskId, "Task id") }
@@ -333,7 +343,7 @@ function parseRuntimeEvent(value) {
         throw invalidEvent();
     switch (value.type) {
         case "runtime-observation": return parseRuntimeObservationEvent(value);
-        case "native-turn-completed": return parseCodexEvent(value);
+        case "native-turn-completed": return parseNativeTurnCompletedEvent(value);
         case "durable-job-terminal": return parseDurableJobTerminalEvent(value);
         default: throw invalidEvent();
     }
@@ -378,7 +388,7 @@ function parseDurableJobTerminalEvent(value) {
         ...normalized
     });
 }
-function parseCodexEvent(value) {
+function parseNativeTurnCompletedEvent(value) {
     const scope = value.scope;
     const expected = scope === "task"
         ? [
@@ -400,7 +410,7 @@ function parseCodexEvent(value) {
         || !hasExactKeys(value, expected))
         throw invalidEvent();
     const receivedAt = requireTimestamp(value.receivedAt);
-    const normalized = normalizeCodexInput({
+    const normalized = normalizeNativeTurnCompletedInput({
         scope,
         ...(scope === "task" ? { taskId: value.taskId } : {}),
         roleName: value.roleName,

package/dist/controller/runtimeEventProcessor.js

@@ -1,3 +1,4 @@
+import { isRuntimeTokenEvidence } from "../runtime/runtimeObservation.js";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
 const DEFAULT_MAX_RUNTIME_EVENTS_PER_DRAIN = 64;
 /** Folds immutable Hook facts in one bounded transaction before acknowledging them. */
@@ -111,7 +112,7 @@ export class FileRuntimeEventProcessor {
         const event = candidate.event;
         let outcome = "applied";
         if (event.type === "native-turn-completed") {
-            outcome = this.applyCodex(event, now);
+            outcome = this.applyNativeTurnCompleted(event, now);
         }
         else if (event.type === "runtime-observation") {
             outcome = this.applyRuntimeObservation(event, now);
@@ -199,7 +200,7 @@ export class FileRuntimeEventProcessor {
         // transaction as the terminal transition.
         void event;
     }
-    applyCodex(event, now) {
+    applyNativeTurnCompleted(event, now) {
         if (event.scope === "task") {
             const task = this.observer.getTask(event.taskId);
             const input = {
@@ -315,17 +316,10 @@ export function coalesceRuntimeProgress(events, instrumentation = {}) {
         }
         const representedByIndex = new Map();
         for (const indices of indicesByStream.values()) {
-            const hasUsage = segment[indices[0]].observation.payload.usage !== undefined;
-            const retainedPositions = hasUsage ? [0] : [];
-            if (hasUsage) {
-                for (let position = 1; position < indices.length; position += 1) {
-                    const previous = segment[indices[position - 1]].observation.payload.usage;
-                    const current = segment[indices[position]].observation.payload.usage;
-                    if (runtimeUsageTotal(current) < runtimeUsageTotal(previous)) {
-                        retainedPositions.push(position);
-                    }
-                }
-            }
+            const hasUsage = isRuntimeTokenEvidence(segment[indices[0]].observation);
+            // Usage facts and incomplete boundaries are authoritative history for
+            // read-only Session token projection, so ingress never coalesces them.
+            const retainedPositions = hasUsage ? indices.map((_, position) => position) : [];
             const lastPosition = indices.length - 1;
             if (retainedPositions.at(-1) !== lastPosition)
                 retainedPositions.push(lastPosition);
@@ -424,12 +418,9 @@ function progressStreamKey(event) {
         fence.nativeSessionId ?? null,
         fence.runId ?? null,
         payload.activity,
-        payload.usage === undefined ? "signal" : "usage"
+        isRuntimeTokenEvidence(event.observation) ? "usage" : "signal"
     ]);
 }
-function runtimeUsageTotal(usage) {
-    return usage.inputTokens + usage.outputTokens;
-}
 function isRuntimeActivityEvent(event) {
     return event.type === "runtime-observation"
         && event.observation.kind === "activity.observed";
@@ -536,6 +527,8 @@ export function createAsyncRuntimeObserver(invoke) {
         observeRuntimeObservation: (input, now) => withNow("observeRuntimeObservation", input, now),
         observeRuntimeTurnCompleted: (input, now) => withNow("observeRuntimeTurnCompleted", input, now),
         observeGlobalRuntimeTurnCompleted: (input, now) => withNow("observeGlobalRuntimeTurnCompleted", input, now),
+        classifyRuntimeTurnCompleted: (input) => call("classifyRuntimeTurnCompleted", [input]),
+        classifyGlobalRuntimeTurnCompleted: (input) => call("classifyGlobalRuntimeTurnCompleted", [input]),
         observeObsoleteRuntimeEvent: (input, now) => withNow("observeObsoleteRuntimeEvent", input, now)
     };
 }
@@ -581,7 +574,7 @@ export class AsyncRuntimeEventProcessor {
             try {
                 let outcome = "applied";
                 if (event.type === "native-turn-completed") {
-                    outcome = await this.applyCodex(event, now);
+                    outcome = await this.applyNativeTurnCompleted(event, now);
                 }
                 else if (event.type === "runtime-observation") {
                     outcome = await this.applyRuntimeObservation(event, now);
@@ -652,7 +645,7 @@ export class AsyncRuntimeEventProcessor {
         }
         return outcome;
     }
-    async applyCodex(event, now) {
+    async applyNativeTurnCompleted(event, now) {
         if (event.scope === "task") {
             const task = await this.observer.getTask(event.taskId);
             const input = {

package/dist/controller/runtimeHookRunFence.js

@@ -4,6 +4,7 @@ import { nativeSessionIdForLaunch } from "../runtime/preallocatedNativeSession.j
 import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
 import { YUI_CONTROL_PLANE_DESCRIPTOR, YUI_TASK_RUNTIME_DESCRIPTOR, assertExactTaskRuntimeEnvironment, exactControlPlaneDigest, parseExactControlPlaneDescriptor, refreshReusedTaskRuntimeDescriptorSource } from "../runtime/exactControlPlane.js";
 import { agentRunDeliveryReceiptId } from "../run/agentRun.js";
+import { conversationReplacementBasis } from "../runtime/conversationSwitch.js";
 /**
  * Resolves turn identity from the current durable in-flight fence. The one
  * exception is a Driver-declared startup Session Hook, which can arrive before
@@ -101,14 +102,27 @@ export function resolveRuntimeHookRunFence(environment, adapterId, payloadNative
     const startupRun = startupRunId === undefined
         ? null
         : store.getAgentRun(taskId, startupRunId);
+    const replacementStartup = options.startupSession !== undefined
+        && session !== undefined
+        && sessions !== null
+        && startupReservation
+        && startupRun?.mode === "new"
+        && conversationReplacementBasis({
+            sessions,
+            events: store.listEvents(taskId),
+            mailbox: roleMailbox,
+            roleName,
+            runId: startupRun.id,
+            runMode: startupRun.mode
+        }) !== null;
     const preallocatedStartup = options.startupSession === "preallocated"
         && expectedNativeSessionId !== undefined
-        && session === undefined
+        && (session === undefined || replacementStartup)
         && startupReservation
         && nativeSessionId === nativeSessionIdForLaunch(home, launchId, agentId, adapterId);
     const discoveredStartup = options.startupSession === "discovered"
         && expectedNativeSessionId === undefined
-        && session === undefined
+        && (session === undefined || replacementStartup)
         && startupReservation;
     const terminalRunId = options.terminal === true && acceptedBinding === null
         ? requireIdentity(environment.YUI_RUN_ID ?? runtime?.runId, "Run id")
@@ -154,6 +168,7 @@ export function resolveRuntimeHookRunFence(environment, adapterId, payloadNative
     if (acceptedBinding === null
         && runtime !== undefined
         && session !== undefined
+        && !replacementStartup
         && sessionLaunchId !== undefined
         && typeof runtimeSource === "string"
         && !runtimeSource.trimStart().startsWith("{")
@@ -187,7 +202,7 @@ export function resolveRuntimeHookRunFence(environment, adapterId, payloadNative
     if (run.effective.workspace.root !== workspace) {
         throw new Error("Runtime observation Hook workspace does not match the durable Run snapshot.");
     }
-    if (session !== undefined && acceptedBinding === null) {
+    if (session !== undefined && acceptedBinding === null && !replacementStartup) {
         if (session.adapterId !== adapterId
             || session.launchId !== effectiveLaunchId
             || session.nativeSessionId !== nativeSessionId
@@ -195,7 +210,7 @@ export function resolveRuntimeHookRunFence(environment, adapterId, payloadNative
             throw new Error("Runtime observation Hook Session does not match its durable generation.");
         }
     }
-    else if (session === undefined && acceptedBinding === null) {
+    else if (acceptedBinding === null && (session === undefined || replacementStartup)) {
         if (!discoveredStartup && !preallocatedStartup) {
             throw new Error("Runtime observation Hook launch is not durably reserved.");
         }

package/dist/controller/runtimeObservationHook.js

@@ -12,6 +12,10 @@ import { resolveRuntimeHookRunFence } from "./runtimeHookRunFence.js";
  * provider-independent RuntimeObservation with an exact generation/Run fence.
  */
 export async function runRuntimeObservationHookCommand(stdinJson, environment = process.env, call = callController, now = new Date(), dependencies = {}) {
+    if (environment.YUI_SESSION_SCOPE === "global") {
+        await runGlobalRuntimeTurnHook(stdinJson, environment, call, now, dependencies);
+        return;
+    }
     const parsed = parseRuntimeObservationHook(stdinJson, environment, now, dependencies);
     const inbox = new FileRuntimeEventInbox(parsed.home);
     for (const observation of parsed.observations)
@@ -26,6 +30,47 @@ export async function runRuntimeObservationHookCommand(stdinJson, environment =
         })
     }, { timeoutMs: 100 }).catch(() => { });
 }
+async function runGlobalRuntimeTurnHook(stdinJson, environment, call, now, dependencies) {
+    const payload = parseObject(stdinJson);
+    const hookEventName = requireIdentity(payload.hook_event_name, "Agent Driver Hook event name");
+    if (hookEventName !== "Stop" && hookEventName !== "StopFailure")
+        return;
+    const driverId = requireIdentity(environment.YUI_DRIVER_ID, "Agent Driver id");
+    const driver = (dependencies.drivers ?? builtinAgentDriverRegistry()).require(driverId);
+    if (driver.adapterId !== "claude" || environment.YUI_ADAPTER_ID !== driver.adapterId) {
+        throw new Error("Global runtime Hook requires the Claude adapter.");
+    }
+    const occurrenceId = `${now.toISOString()}:${(dependencies.sequence ?? monotonicSequence)()}`;
+    const nativeHook = Object.freeze({ hookEventName, payload, occurrenceId });
+    const nativeSessionId = requireIdentity(driver.runtime.nativeSessionId(nativeHook), "Agent Driver native Session id");
+    if (nativeSessionId !== requireIdentity(environment.YUI_NATIVE_SESSION_ID, "YUI native session id")) {
+        throw new Error("Global runtime Hook native Session does not match its launch envelope.");
+    }
+    const home = requireIdentity(environment.YUI_HOME, "YUI_HOME");
+    const roleName = requireIdentity(environment.YUI_ROLE, "Role name");
+    new FileRuntimeEventInbox(home, () => now).enqueueTurnCompleted({
+        scope: "global",
+        roleName,
+        agentId: requireIdentity(environment.YUI_AGENT_ID, "Agent id"),
+        adapterId: "claude",
+        launchId: requireIdentity(environment.YUI_LAUNCH_ID, "Launch id"),
+        nativeSessionId,
+        turnId: optionalIdentity(driver.runtime.nativeTurnId(nativeHook)) ?? occurrenceId,
+        ...(environment.YUI_SESSION_TITLE === undefined
+            ? {}
+            : { title: requireIdentity(environment.YUI_SESSION_TITLE, "Session title") }),
+        summary: globalHookSummary(payload, hookEventName)
+    });
+    await call(home, "scheduler.signal", { key: runtimeLifecycleSignalKey({ scope: "global", roleName }) }, { timeoutMs: 100 }).catch(() => { });
+}
+function globalHookSummary(payload, hookEventName) {
+    for (const field of ["last_assistant_message", "summary", "message", "error"]) {
+        const value = payload[field];
+        if (typeof value === "string" && value.trim().length > 0)
+            return value.trim();
+    }
+    return hookEventName === "Stop" ? "Native Turn completed." : "Native Turn failed.";
+}
 export function parseRuntimeObservationHook(stdinJson, environment, now = new Date(), dependencies = {}) {
     const payload = parseObject(stdinJson);
     const drivers = dependencies.drivers ?? builtinAgentDriverRegistry();

package/dist/controller/structuredProviderObservation.js

@@ -3,6 +3,7 @@ import { callController } from "../core/controllerClient.js";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
 import { createRuntimeObservation, runtimeObservationSemanticKey } from "../runtime/runtimeObservation.js";
 import { runtimeLifecycleSignalKey } from "../runtime/lifecycleReservation.js";
+import { isForeignHandoverLockHeld } from "../release/runtimeRelease.js";
 import { FileRuntimeEventInbox } from "./runtimeEventInbox.js";
 import { resolveRuntimeHookRunFence } from "./runtimeHookRunFence.js";
 let structuredSequence = 0;
@@ -256,10 +257,26 @@ async function persistAndApply(home, observations, taskId, roleName) {
     const inbox = new FileRuntimeEventInbox(home);
     for (const entry of observations)
         inbox.enqueueObservation(entry);
+    // The immutable inbox is authoritative. During a release/update handover the
+    // old Controller is draining and the replacement is not ready yet; leave the
+    // entries for normal inbox replay instead of turning a healthy Provider Turn
+    // into a transport failure.
+    if (isForeignHandoverLockHeld(home))
+        return;
     for (const entry of observations) {
-        const result = await callController(home, "runtime.observation-apply", entry, {
-            timeoutMs: 10_000
-        });
+        let result;
+        try {
+            result = await callController(home, "runtime.observation-apply", entry, {
+                timeoutMs: 10_000
+            });
+        }
+        catch (error) {
+            // Close the race where the handover begins after the first check but
+            // before this socket call. The durable entry remains pending for replay.
+            if (isForeignHandoverLockHeld(home))
+                return;
+            throw error;
+        }
         // A fast Provider can accept the initial Turn before the scheduler call
         // that launched this Host has returned and committed `run.pushed`. The
         // immutable inbox entry already makes that exact fenced fact durable;

package/dist/core/controllerClient.js

@@ -14,6 +14,15 @@ export class ControllerClientError extends Error {
         this.name = "ControllerClientError";
     }
 }
+/** The Controller may have committed the request before this client lost its acknowledgement. */
+export function controllerCallMayHaveApplied(error) {
+    return error instanceof ControllerClientError
+        && [
+            "CONTROLLER_TIMEOUT",
+            "CONTROLLER_UNAVAILABLE",
+            "INVALID_RESPONSE"
+        ].includes(error.code);
+}
 export async function readControllerDiscovery(home) {
     const discoveryPath = join(home, CONTROLLER_DISCOVERY_PATH);
     try {
@@ -210,6 +219,7 @@ function exchange(socketPath, requestLine, expectedId, timeoutMs) {
         const socket = createConnection(socketPath);
         let buffer = Buffer.alloc(0);
         let settled = false;
+        let deliveryStarted = false;
         const timer = setTimeout(() => {
             fail(new ControllerClientError("CONTROLLER_TIMEOUT", "Controller request timed out."));
         }, timeoutMs);
@@ -229,7 +239,13 @@ function exchange(socketPath, requestLine, expectedId, timeoutMs) {
             socket.destroy();
             reject(error);
         };
-        socket.on("connect", () => socket.write(requestLine));
+        socket.on("connect", () => {
+            // Once write begins, a missing response cannot prove that the Controller
+            // did not commit the request. Callers must use their domain identity to
+            // decide whether an explicit retry is safe.
+            deliveryStarted = true;
+            socket.write(requestLine);
+        });
         socket.on("data", (chunk) => {
             if (settled)
                 return;
@@ -260,7 +276,9 @@ function exchange(socketPath, requestLine, expectedId, timeoutMs) {
                 fail(invalidResponse());
         });
         socket.on("error", () => {
-            fail(new ControllerClientError("CONTROLLER_UNAVAILABLE", "Controller is unavailable."));
+            fail(deliveryStarted
+                ? new ControllerClientError("CONTROLLER_DELIVERY_UNKNOWN", "Controller request delivery is unknown.")
+                : new ControllerClientError("CONTROLLER_UNAVAILABLE", "Controller is unavailable."));
         });
     });
 }

package/dist/core/controllerServer.js

@@ -833,6 +833,7 @@ function safeApplicationErrorCode(code) {
         case "METHOD_NOT_FOUND":
         case "NOT_FOUND":
         case "UNAUTHORIZED":
+        case "CONTROLLER_DRAINING":
             return code;
         default:
             return undefined;

package/dist/execution/resourceBroker.js

@@ -3,9 +3,13 @@ import { requireIdentity, requireText, requireTimestamp } from "../domain/valida
 import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
 import { validateExecutionGroup } from "./executionGroup.js";
 export const RESOURCE_BROKER_POLICY_SCHEMA_VERSION = 1;
+/** Compatibility/display default; observed tokens never close execution spend. */
+export const DEFAULT_EXECUTION_STAGE_TOKEN_BUDGET_PER_LANE = 120_000;
 /** One shared hard-stop predicate for admission, recovery, and Leader routing. */
 export function executionStageSpendClosed(resources) {
-    return resources.deadlineReached || resources.exhaustedBudgets.length > 0;
+    return resources.deadlineReached
+        || resources.exhaustedBudgets.includes("tool-calls")
+        || resources.exhaustedBudgets.includes("wall-clock");
 }
 const DEFAULT_ACTIVE_LANES = 4;
 const DEFAULT_ACTIVE_LANES_PER_TASK = 2;
@@ -147,9 +151,6 @@ export function projectExecutionStageResources(input) {
     const tokensObservable = input.usage.tokensObservable ?? true;
     const toolCallsObservable = input.usage.toolCallsObservable ?? true;
     const exhaustedBudgets = [];
-    if (stage?.budget.maxTokens !== undefined
-        && tokens >= stage.budget.maxTokens)
-        exhaustedBudgets.push("tokens");
     if (toolCallsObservable && stage?.budget.maxToolCalls !== undefined
         && toolCalls >= stage.budget.maxToolCalls)
         exhaustedBudgets.push("tool-calls");