@zq-silk/yui 0.12.3 → 0.13.0

package/dist/lifecycle/exactRunTerminalization.js

@@ -9,7 +9,7 @@ import { finishReviewRound, updateReviewExecutionGroup } from "../review/reviewR
 import { reconcileReviewFindingsAfterReview } from "../review/reviewFindingLedger.js";
 import { agentRunDeliveryReceiptId, failAgentRun, withYieldReceipt, yieldAgentRun } from "../run/agentRun.js";
 import { createYieldReceipt } from "../run/yieldReceipt.js";
-import { recordExecutionLaneResult } from "../execution/executionGroup.js";
+import { recordExecutionLaneResult, resolveExecutionGroup } from "../execution/executionGroup.js";
 import { isRuntimeLaunchReservation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { runOwnsBlockingProviderContinuation } from "../runtime/runtimeContinuationProjection.js";
 import { runHasActiveRuntimeOperations } from "../runtime/runtimeObservation.js";
@@ -145,7 +145,7 @@ export function terminalizeExactRunReviewRound(store, input, now) {
         return validation;
     }
     const reviewRound = validation.round;
-    const groupedRound = input.run.executionGroupId !== undefined
+    let groupedRound = input.run.executionGroupId !== undefined
         && input.run.executionLaneId !== undefined
         && reviewRound.executionGroup !== undefined
         ? updateReviewExecutionGroup(reviewRound, recordExecutionLaneResult(reviewRound.executionGroup, input.run.executionLaneId, {
@@ -174,10 +174,25 @@ export function terminalizeExactRunReviewRound(store, input, now) {
                 : { gitSnapshot: input.reviewResult.gitSnapshot })
         }, input.outcome.status === "yielded" ? "completed" : "failed", now))
         : reviewRound;
+    if (input.settleFailedExecutionGroup === true
+        && input.outcome.status === "failed"
+        && groupedRound.executionGroup !== undefined
+        && groupedRound.executionGroup.resolution === undefined
+        && groupedRound.executionGroup.lanes.every((lane) => (lane.status === "yielded"
+            || lane.status === "completed"
+            || lane.status === "failed"
+            || lane.status === "skipped"))) {
+        groupedRound = updateReviewExecutionGroup(groupedRound, resolveExecutionGroup(groupedRound.executionGroup, {
+            decision: "blocked",
+            summary: input.outcome.summary
+        }, now));
+    }
     const groupedMultiLane = groupedRound.executionGroup !== undefined
         && (groupedRound.executionGroup.lanes.length > 1
             || groupedRound.executionGroup.strategy.mode === "adaptive");
-    if (groupedMultiLane && groupedRound.executionGroup !== undefined) {
+    if (groupedMultiLane
+        && groupedRound.executionGroup !== undefined
+        && groupedRound.executionGroup.resolution === undefined) {
         // A panel Lane only contributes evidence.  The Leader must see every
         // terminal Lane and explicitly resolve the Group before this ReviewRound
         // can become terminal.
@@ -193,6 +208,108 @@ export function terminalizeExactRunReviewRound(store, input, now) {
     }
     return { disposition: "applied", round: terminal };
 }
+/**
+ * Retire one stranded active Run only after its exact Provider Turn is
+ * terminal and every durable execution fence is quiet. The caller owns the
+ * surrounding aggregate transaction so the Run, ReviewRound/Lane, mailbox,
+ * Session, and append-only retirement record commit together.
+ */
+export function retireExactActiveAgentRun(store, input, now) {
+    const current = store.getAgentRun(input.taskId, input.runId);
+    const stateChanged = (reason) => ({
+        disposition: "state-changed",
+        run: current,
+        ...(current === null ? {} : { progressAt: latestRunDurableProgressAt(store, input.taskId, input.roleName, input.runId)?.progressAt }),
+        reason
+    });
+    const task = store.getTask(input.taskId);
+    if (task === null)
+        return stateChanged("task-missing");
+    if (task.status !== "active")
+        return stateChanged("task-terminal");
+    if (current === null)
+        return stateChanged("run-missing");
+    if (current.status !== "active")
+        return stateChanged("run-terminal");
+    if (current.taskId !== input.taskId || current.roleName !== input.roleName) {
+        return stateChanged("run-owner-mismatch");
+    }
+    if (current.effective.agentId !== input.agentId
+        || current.effective.adapterId !== input.adapterId) {
+        return stateChanged("run-launch-identity-mismatch");
+    }
+    const active = current.executionGroupId !== undefined && current.executionLaneId !== undefined
+        ? store.getActiveExecutionLaneRun(input.taskId, current.executionGroupId, current.executionLaneId)
+        : store.getActiveAgentRun(input.taskId, input.roleName);
+    if (active?.id !== current.id)
+        return stateChanged("active-run-mismatch");
+    const progress = latestRunDurableProgressAt(store, input.taskId, input.roleName, input.runId);
+    if (progress === null)
+        return stateChanged("progress-unavailable");
+    if (progress.progressAt !== input.expectedProgressAt) {
+        return { ...stateChanged("progress-fence-mismatch"), progressAt: progress.progressAt };
+    }
+    if (!matchesRecoverySessionFence(store, {
+        ...input,
+        action: "terminate",
+        providerAcceptance: current.deliveredAt === undefined ? "rejected" : "accepted",
+        now
+    }))
+        return stateChanged("session-or-launch-fence-mismatch");
+    const blocker = exactRecoveryExecutionBlocker(store, current);
+    if (blocker !== null) {
+        return {
+            disposition: "blocked",
+            run: current,
+            progressAt: progress.progressAt,
+            reason: blocker
+        };
+    }
+    const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+    const session = sessions?.sessions[input.agentId];
+    const providerBinding = sessions?.providerBinding;
+    const providerTurn = providerBinding?.turn;
+    const providerSettled = providerBinding?.runId === current.id
+        && (providerTurn?.status === "completed"
+            || providerTurn?.status === "failed"
+            || providerTurn?.status === "cancelled"
+            || providerTurn?.status === "rejected");
+    if (session?.status !== "stopped" && session?.status !== "broken" && !providerSettled) {
+        return {
+            disposition: "blocked",
+            run: current,
+            progressAt: progress.progressAt,
+            reason: "runtime-not-terminal"
+        };
+    }
+    const terminal = terminalizeExactTaskRun(store, {
+        taskId: input.taskId,
+        roleName: input.roleName,
+        agentId: input.agentId,
+        runId: input.runId,
+        receiptId: agentRunDeliveryReceiptId(current),
+        ...(input.nativeSessionId === undefined ? {} : { nativeSessionId: input.nativeSessionId }),
+        ...(input.launchId === undefined ? {} : { launchId: input.launchId }),
+        settleFailedExecutionGroup: true,
+        outcome: { status: "failed", summary: input.reason }
+    }, now);
+    if (terminal.disposition !== "applied" || terminal.run === null) {
+        return stateChanged(terminal.reason ?? "terminalization-fence-mismatch");
+    }
+    if (terminal.run.purpose === "execution" && terminal.run.workItemId !== undefined) {
+        const item = store.getWorkItem(input.taskId, terminal.run.workItemId);
+        if (item !== null
+            && !["completed", "failed", "retired"].includes(item.status)
+            && !workItemOwnsUnresolvedExecutionLane(item, terminal.run.executionGroupId, terminal.run.executionLaneId)) {
+            store.saveWorkItem(input.taskId, updateWorkItemStatus(item, "failed", now, input.reason));
+        }
+    }
+    return {
+        disposition: "applied",
+        run: terminal.run,
+        progressAt: progress.progressAt
+    };
+}
 /**
  * Applies one exact application-level terminal fact inside the caller's
  * FileTaskStore transaction. All caller-owned outcome records can therefore
@@ -279,7 +396,10 @@ export function terminalizeExactTaskRun(store, input, now) {
         taskId: input.taskId,
         run,
         outcome: input.outcome,
-        reviewResult: input.reviewResult
+        reviewResult: input.reviewResult,
+        ...(input.settleFailedExecutionGroup === undefined
+            ? {}
+            : { settleFailedExecutionGroup: input.settleFailedExecutionGroup })
     }, now);
     if (reviewRoundTerminalization.disposition !== "applied") {
         return obsolete(run, reviewRoundTerminalization.reason ?? "review-round-mismatch");
@@ -313,7 +433,7 @@ export function terminalizeExactTaskRun(store, input, now) {
             ? undefined
             : workItemExecutionGroupById(item, run.executionGroupId);
         if (item !== null && group !== undefined) {
-            const grouped = recordExecutionLaneResult(group, run.executionLaneId, {
+            let grouped = recordExecutionLaneResult(group, run.executionLaneId, {
                 summary: input.outcome.summary,
                 ...(input.reviewResult?.report === undefined ? {} : { report: input.reviewResult.report }),
                 ...(input.reviewResult?.checks === undefined ? {} : { checks: input.reviewResult.checks }),
@@ -322,6 +442,18 @@ export function terminalizeExactTaskRun(store, input, now) {
                 ...(input.reviewResult?.evidenceCommit === undefined ? {} : { evidenceCommit: input.reviewResult.evidenceCommit }),
                 ...(input.reviewResult?.gitSnapshot === undefined ? {} : { gitSnapshot: input.reviewResult.gitSnapshot })
             }, input.outcome.status === "yielded" ? "completed" : "failed", now);
+            if (input.settleFailedExecutionGroup === true
+                && input.outcome.status === "failed"
+                && grouped.resolution === undefined
+                && grouped.lanes.every((lane) => (lane.status === "yielded"
+                    || lane.status === "completed"
+                    || lane.status === "failed"
+                    || lane.status === "skipped"))) {
+                grouped = resolveExecutionGroup(grouped, {
+                    decision: "blocked",
+                    summary: input.outcome.summary
+                }, now);
+            }
             store.saveWorkItem(input.taskId, updateWorkItemExecutionGroup(item, grouped, now));
         }
     }
@@ -643,6 +775,12 @@ function matchesSessionFence(sessions, input) {
         && inFlight.receiptId === input.receiptId);
 }
 function matchesLaunchFence(store, sessions, input) {
+    // A resumed Run shares the native Provider Session whose process environment
+    // was created for an earlier Run. Once that exact native Session has passed
+    // matchesSessionFence, its immutable per-launch environment is not a second
+    // Run identity. Opaque hosts still require the launch fence below.
+    if (input.nativeSessionId !== undefined)
+        return true;
     if (input.launchId === undefined)
         return true;
     const session = sessions?.sessions[input.agentId];
@@ -664,7 +802,9 @@ function settleLaunchReservation(store, sessions, input) {
     const mailbox = store.getWorkMailbox(target);
     const reservation = mailbox?.processing;
     const session = sessions?.sessions[input.agentId];
-    const launchId = input.launchId ?? session?.launchId;
+    const launchId = input.nativeSessionId === undefined
+        ? input.launchId ?? session?.launchId
+        : session?.launchId;
     if (launchId === undefined || !isRuntimeLaunchReservation(reservation, launchId))
         return;
     const settled = completeProcessing(mailbox, reservation.batchId);

package/dist/milestone/milestone.js

@@ -1,15 +1,21 @@
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
-export function createMilestone(id, taskId, title, summary, now) {
+export function createMilestone(id, taskId, title, summary, createdBy, now) {
     return {
-        schemaVersion: 1,
+        schemaVersion: 2,
         id: validateTaskRecordReference({ taskId, localId: id }, "milestone").localId,
         taskId: requireSafeIdentity(taskId, "Task id"),
         title: requireText(title, "Milestone title"),
         summary: requireText(summary, "Milestone summary"),
-        createdBy: "leader",
+        createdBy: requireTaskControlActor(createdBy),
         createdAt: now.toISOString()
     };
 }
+function requireTaskControlActor(value) {
+    if (value !== "user" && value !== "operator" && value !== "leader") {
+        throw new Error(`Milestone createdBy is invalid: ${String(value)}.`);
+    }
+    return value;
+}
 function requireSafeIdentity(value, label) {
     const normalized = requireText(value, label);
     if (["__proto__", "prototype", "constructor", ".", ".."].includes(normalized)

package/dist/review/deltaRecheck.js

@@ -127,7 +127,7 @@ export function buildDeltaRecheckDispatchContext(input) {
         "- finding: the diff introduces a material problem; report it as a finding.",
         "- requires-full-review: you cannot prove equivalence (uncertainty, cross-scope,",
         "  semantic change, evidence doubt). This is the safe default.",
-        "Yui verified only the technical delta boundary; the Leader selected this mode.",
+        "Yui verified only the technical delta boundary; a Task-control Agent selected this mode.",
         `Previous accepted ReviewRound: ${previousRound.id}@${record.previousBaseCommit}`,
         `Previous acceptance summary: ${compact(previousRound.summary ?? previousRound.report ?? "")}`,
         ...(round.taskCandidate?.projects.map((project) => {

package/dist/review/reviewFinding.js

@@ -6,8 +6,8 @@ export const BLOCKING_FINDING_DISPOSITIONS = [
     "open",
     "fixed-pending-review"
 ];
-/** Dispositions the Leader may set explicitly. */
-export const LEADER_FINDING_DISPOSITIONS = [
+/** Dispositions a Task-control Agent may set explicitly. */
+export const TASK_CONTROL_FINDING_DISPOSITIONS = [
     "fixed-pending-review",
     "verified-fixed",
     "accepted-risk",
@@ -86,7 +86,7 @@ export function createReviewFinding(id, taskId, input, now) {
  */
 export function disposeReviewFinding(finding, input) {
     validateReviewFinding(finding);
-    if (!LEADER_FINDING_DISPOSITIONS.includes(input.disposition)) {
+    if (!TASK_CONTROL_FINDING_DISPOSITIONS.includes(input.disposition)) {
         throw new Error(`ReviewFinding disposition is not a Leader decision: ${input.disposition}.`);
     }
     if (finding.disposition !== "open" && finding.disposition !== "fixed-pending-review") {

package/dist/review/reviewRound.js

@@ -5,7 +5,7 @@ import { validateManagedWorkspace } from "../worktree/managedWorkspace.js";
 import { assertExecutionGroupTransition, resetReviewExecutionLane, validateExecutionGroup } from "../execution/executionGroup.js";
 export function createReviewRound(id, taskId, workItemId, candidateId, reviewerRoleName, requestedBy, reviewBaseCommit, now, executionGroup) {
     return validateReviewRound({
-        schemaVersion: 5,
+        schemaVersion: 6,
         id: requireIdentity(id, "ReviewRound id"),
         taskId: requireIdentity(taskId, "Task id"),
         workItemId: requireIdentity(workItemId, "Work Item id"),
@@ -21,7 +21,7 @@ export function createReviewRound(id, taskId, workItemId, candidateId, reviewerR
 export function createTaskReviewRound(id, taskId, reviewerRoleName, requestedBy, taskCandidate, now, taskFinalReviewContract, executionGroup) {
     const candidate = validateTaskReviewCandidate(taskCandidate);
     return validateReviewRound({
-        schemaVersion: 5,
+        schemaVersion: 6,
         id: requireIdentity(id, "ReviewRound id"),
         taskId: requireIdentity(taskId, "Task id"),
         reviewerRoleName: requireIdentity(reviewerRoleName, "Reviewer Role"),
@@ -47,7 +47,7 @@ export function createTaskReviewRound(id, taskId, reviewerRoleName, requestedBy,
 export function createTaskDeltaReviewRound(id, taskId, reviewerRoleName, requestedBy, taskCandidate, deltaRecheck, now, taskFinalReviewContract, executionGroup) {
     const candidate = validateTaskReviewCandidate(taskCandidate);
     return validateReviewRound({
-        schemaVersion: 5,
+        schemaVersion: 6,
         id: requireIdentity(id, "ReviewRound id"),
         taskId: requireIdentity(taskId, "Task id"),
         reviewerRoleName: requireIdentity(reviewerRoleName, "Reviewer Role"),
@@ -138,7 +138,7 @@ export function finishReviewRound(round, status, summary, now, result = {}) {
  * returns to pending so infrastructure retries do not manufacture a new
  * semantic ReviewRound or duplicate findings.
  */
-export function retryTaskReviewRound(round, executionLaneId) {
+export function retryTaskReviewRound(round, requestedBy, executionLaneId) {
     validateReviewRound(round);
     if ((round.scope ?? "work-item") !== "task") {
         throw new Error(`Only a Task-final ReviewRound can be retried in place: ${round.id}.`);
@@ -180,7 +180,7 @@ export function retryTaskReviewRound(round, executionLaneId) {
         // Keep the historical attempt Group and Lane addressable from AgentRun
         // history while resetting the Lane for another dispatch attempt.
         ...(retryExecutionGroup === undefined ? {} : { executionGroup: retryExecutionGroup }),
-        requestedBy: "leader",
+        requestedBy: validateReviewRequestSource(requestedBy),
         status: "pending",
         ...(round.workspace === undefined ? {} : { workspace: round.workspace }),
         createdAt: round.createdAt
@@ -359,8 +359,8 @@ export function updateReviewExecutionGroup(round, executionGroup) {
     return validateReviewRound({ ...round, executionGroup });
 }
 export function validateReviewRound(round) {
-    if (round.schemaVersion !== 5)
-        throw new Error("ReviewRound must use schemaVersion 5.");
+    if (round.schemaVersion !== 6)
+        throw new Error("ReviewRound must use schemaVersion 6.");
     validateTaskRecordReference({ taskId: round.taskId, localId: round.id }, "reviewRound");
     requireIdentity(round.reviewerRoleName, "Reviewer Role");
     requireCommit(round.reviewBaseCommit, "Review base commit");
@@ -637,7 +637,10 @@ function requireCommit(value, label) {
     return commit;
 }
 function validateReviewRequestSource(source) {
-    if (source !== "policy" && source !== "leader") {
+    if (source !== "policy"
+        && source !== "user"
+        && source !== "operator"
+        && source !== "leader") {
         throw new Error(`Review request source is invalid: ${String(source)}.`);
     }
     return source;

package/dist/run/rejectedYieldAttempt.js

@@ -0,0 +1,221 @@
+import { contextContentDigest, validateContextSnapshotRef } from "../context/contextSnapshot.js";
+import { computeYieldOutcomeDigest } from "./yieldReceipt.js";
+export const RUN_YIELD_REJECTED_EVENT = "run.yield-rejected";
+const MAX_SUMMARY_CHARACTERS = 2_000;
+const MAX_REPORT_CHARACTERS = 8_000;
+const MAX_CHECKS = 16;
+const MAX_FINDINGS = 16;
+const MAX_EVIDENCE = 16;
+const MAX_LABEL_CHARACTERS = 128;
+const MAX_DETAILS_CHARACTERS = 512;
+const MAX_EVIDENCE_CHARACTERS = 512;
+/**
+ * Creates the bounded diagnostic projection persisted when a Reviewer report
+ * cannot cross the exact terminalization fence. The full validated submission
+ * participates in the immutable digest, while only known, size-bounded fields
+ * are retained as non-authoritative evidence.
+ */
+export function createRejectedYieldAttempt(input) {
+    const reviewResult = input.reviewResult;
+    const fullReport = reviewResult?.report ?? input.summary;
+    const contentDigest = computeYieldOutcomeDigest({
+        status: "yielded",
+        summary: input.summary,
+        ...(reviewResult === undefined ? {} : { reviewResult })
+    });
+    const summary = boundedText(input.summary, MAX_SUMMARY_CHARACTERS);
+    const report = boundedText(fullReport, MAX_REPORT_CHARACTERS);
+    const checks = (reviewResult?.checks ?? []).slice(0, MAX_CHECKS).map((check) => ({
+        name: boundedText(check.name, MAX_LABEL_CHARACTERS),
+        outcome: check.outcome,
+        ...(check.details === undefined
+            ? {}
+            : { details: boundedText(check.details, MAX_DETAILS_CHARACTERS) })
+    }));
+    const findings = (reviewResult?.findings ?? []).slice(0, MAX_FINDINGS).map((finding) => ({
+        id: boundedText(finding.id, MAX_LABEL_CHARACTERS),
+        severity: finding.severity,
+        status: finding.status,
+        summary: boundedText(finding.summary, MAX_DETAILS_CHARACTERS)
+    }));
+    const evidence = (reviewResult?.evidence ?? []).slice(0, MAX_EVIDENCE)
+        .map((entry) => boundedText(entry, MAX_EVIDENCE_CHARACTERS));
+    const deltaReasoning = reviewResult?.deltaReasoning === undefined
+        ? undefined
+        : boundedText(reviewResult.deltaReasoning, MAX_DETAILS_CHARACTERS);
+    const projectionTruncated = summary !== input.summary
+        || report !== fullReport
+        || checks.length !== (reviewResult?.checks?.length ?? 0)
+        || checks.some((check, index) => (check.name !== reviewResult?.checks?.[index]?.name
+            || check.details !== reviewResult?.checks?.[index]?.details))
+        || findings.length !== (reviewResult?.findings?.length ?? 0)
+        || findings.some((finding, index) => (finding.id !== reviewResult?.findings?.[index]?.id
+            || finding.summary !== reviewResult?.findings?.[index]?.summary))
+        || evidence.length !== (reviewResult?.evidence?.length ?? 0)
+        || evidence.some((entry, index) => entry !== reviewResult?.evidence?.[index])
+        || deltaReasoning !== reviewResult?.deltaReasoning
+        || reviewResult?.gitSnapshot !== undefined;
+    const observed = Object.freeze({
+        nativeSessionId: input.nativeSessionId ?? null,
+        launchId: input.launchId ?? null,
+        durableNativeSessionId: input.durableNativeSessionId ?? null,
+        durableLaunchId: input.durableLaunchId ?? null,
+        inFlightRunId: input.inFlightRunId ?? null,
+        inFlightReceiptId: input.inFlightReceiptId ?? null,
+        activeRunId: input.activeRun?.id ?? null,
+        activeReceiptId: input.activeRun?.receiptId ?? null,
+        contextSnapshot: input.contextSnapshot ?? null,
+        activeContextSnapshot: input.activeRun?.contextSnapshot ?? null
+    });
+    const attemptDigest = contextContentDigest({
+        taskId: input.taskId,
+        runId: input.runId,
+        reviewRoundId: input.reviewRoundId,
+        receiptId: input.receiptId,
+        rejectionReason: input.rejectionReason,
+        contentDigest,
+        observed
+    });
+    return Object.freeze({
+        schemaVersion: 1,
+        authority: "unaccepted",
+        semanticStatus: "diagnostic-only",
+        taskId: input.taskId,
+        runId: input.runId,
+        roleName: input.roleName,
+        purpose: "review",
+        reviewRoundId: input.reviewRoundId,
+        receiptId: input.receiptId,
+        rejectionReason: input.rejectionReason,
+        summary,
+        report,
+        checks: Object.freeze(checks),
+        findings: Object.freeze(findings),
+        evidence: Object.freeze(evidence),
+        ...(reviewResult?.evidenceCommit === undefined
+            ? {}
+            : { evidenceCommit: reviewResult.evidenceCommit }),
+        ...(reviewResult?.deltaDisposition === undefined
+            ? {}
+            : { deltaDisposition: reviewResult.deltaDisposition }),
+        ...(deltaReasoning === undefined ? {} : { deltaReasoning }),
+        projectionTruncated,
+        observed,
+        attemptedAt: input.attemptedAt.toISOString(),
+        contentDigest,
+        attemptDigest
+    });
+}
+export function rejectedYieldAttemptEventPayload(attempt) {
+    return {
+        runId: attempt.runId,
+        roleName: attempt.roleName,
+        reviewRoundId: attempt.reviewRoundId,
+        receiptId: attempt.receiptId,
+        rejectionReason: attempt.rejectionReason,
+        authority: attempt.authority,
+        semanticStatus: attempt.semanticStatus,
+        contentDigest: attempt.contentDigest,
+        attemptDigest: attempt.attemptDigest,
+        attempt: JSON.stringify(attempt)
+    };
+}
+/** Reads only canonical records emitted by rejectedYieldAttemptEventPayload. */
+export function rejectedYieldAttemptFromTaskEvent(event) {
+    if (event.type !== RUN_YIELD_REJECTED_EVENT)
+        return null;
+    try {
+        const parsed = JSON.parse(event.payload.attempt ?? "");
+        if (!isRejectedYieldAttempt(parsed))
+            return null;
+        const expectedAttemptDigest = contextContentDigest({
+            taskId: parsed.taskId,
+            runId: parsed.runId,
+            reviewRoundId: parsed.reviewRoundId,
+            receiptId: parsed.receiptId,
+            rejectionReason: parsed.rejectionReason,
+            contentDigest: parsed.contentDigest,
+            observed: parsed.observed
+        });
+        if (parsed.schemaVersion !== 1
+            || parsed.authority !== "unaccepted"
+            || parsed.semanticStatus !== "diagnostic-only"
+            || parsed.purpose !== "review"
+            || parsed.taskId !== event.taskId
+            || parsed.runId !== event.payload.runId
+            || parsed.roleName !== event.payload.roleName
+            || parsed.reviewRoundId !== event.payload.reviewRoundId
+            || parsed.receiptId !== event.payload.receiptId
+            || parsed.rejectionReason !== event.payload.rejectionReason
+            || parsed.contentDigest !== event.payload.contentDigest
+            || parsed.attemptDigest !== event.payload.attemptDigest
+            || parsed.attemptDigest !== expectedAttemptDigest
+            || parsed.attemptedAt !== event.createdAt
+            || !/^[a-f0-9]{64}$/u.test(parsed.contentDigest)) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function isRejectedYieldAttempt(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const attempt = value;
+    const observed = attempt.observed;
+    if (typeof observed !== "object" || observed === null || Array.isArray(observed))
+        return false;
+    const nullableObserved = [
+        observed.nativeSessionId,
+        observed.launchId,
+        observed.durableNativeSessionId,
+        observed.durableLaunchId,
+        observed.inFlightRunId,
+        observed.inFlightReceiptId,
+        observed.activeRunId,
+        observed.activeReceiptId
+    ];
+    if (nullableObserved.some((entry) => entry !== null && typeof entry !== "string")) {
+        return false;
+    }
+    if (observed.contextSnapshot !== null)
+        validateContextSnapshotRef(observed.contextSnapshot);
+    if (observed.activeContextSnapshot !== null) {
+        validateContextSnapshotRef(observed.activeContextSnapshot);
+    }
+    return typeof attempt.taskId === "string"
+        && typeof attempt.runId === "string"
+        && typeof attempt.roleName === "string"
+        && typeof attempt.reviewRoundId === "string"
+        && typeof attempt.receiptId === "string"
+        && typeof attempt.rejectionReason === "string"
+        && typeof attempt.summary === "string"
+        && typeof attempt.report === "string"
+        && typeof attempt.projectionTruncated === "boolean"
+        && typeof attempt.attemptedAt === "string"
+        && typeof attempt.contentDigest === "string"
+        && typeof attempt.attemptDigest === "string"
+        && Array.isArray(attempt.checks)
+        && attempt.checks.every((check) => (typeof check === "object" && check !== null
+            && typeof check.name === "string"
+            && ["passed", "failed", "skipped"].includes(check.outcome)
+            && (check.details === undefined || typeof check.details === "string")))
+        && Array.isArray(attempt.findings)
+        && attempt.findings.every((finding) => (typeof finding === "object" && finding !== null
+            && typeof finding.id === "string"
+            && typeof finding.summary === "string"))
+        && Array.isArray(attempt.evidence)
+        && attempt.evidence.every((entry) => typeof entry === "string");
+}
+function boundedText(value, maximum) {
+    const safe = value
+        .replaceAll(/\u001B\][^\u0007]*(?:\u0007|\u001B\\|\u009C)/gu, " ")
+        .replaceAll(/\u001B\[[0-?]*[ -/]*[@-~]/gu, " ")
+        .replaceAll(/[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/gu, " ");
+    const characters = Array.from(safe);
+    if (characters.length <= maximum)
+        return safe;
+    return `${characters.slice(0, maximum - 1).join("")}…`;
+}

package/dist/runtime/tmuxAdapters.js

@@ -183,9 +183,18 @@ export class TmuxSessionHost {
                 : { environment: request.environment }),
             ...(request.mode === "resume" ? { nativeSessionId: request.nativeSessionId } : {})
         };
-        const planned = request.owner.scope === "task"
-            ? this.planner.plan({ taskId: request.owner.taskId, ...input })
-            : this.planner.planGlobalRole(input);
+        let planned;
+        try {
+            planned = request.owner.scope === "task"
+                ? this.planner.plan({ taskId: request.owner.taskId, ...input })
+                : this.planner.planGlobalRole(input);
+        }
+        catch (error) {
+            throw toRuntimeLaunchFailure(error, "validation", {
+                cwd: request.workspace,
+                agentId: request.agentId
+            });
+        }
         if (planned.role.name !== request.owner.roleName) {
             throw new Error("Planned Role does not match the runtime owner.");
         }

package/dist/scheduler/activeRoleRunDelivery.js

@@ -304,6 +304,9 @@ export async function processActiveRoleRunDeliveries(store, delivery, now, selec
                             run,
                             session: existingSession,
                             summary: error.message,
+                            leaderRecovery: role.name === "leader" && error.diagnostic.kind === "config"
+                                ? "blocked"
+                                : "automatic",
                             now
                         });
                         results.push({
@@ -375,6 +378,7 @@ export async function processActiveRoleRunDeliveries(store, delivery, now, selec
                         run,
                         session: existingSession,
                         summary: `Role Run could not start: ${message}`,
+                        leaderRecovery: "automatic",
                         now
                     });
                     results.push({

package/dist/storage/migration/productionRegistry.js

@@ -57,6 +57,8 @@ const REVIEW_ROUND_GIT_SNAPSHOT_FROM_VERSION = 3;
 const REVIEW_ROUND_GIT_SNAPSHOT_TO_VERSION = 4;
 const REVIEW_ROUND_TASK_ANCHOR_FROM_VERSION = 4;
 const REVIEW_ROUND_TASK_ANCHOR_TO_VERSION = 5;
+const REVIEW_ROUND_ACTOR_FROM_VERSION = 5;
+const REVIEW_ROUND_ACTOR_TO_VERSION = 6;
 const ACTIVE_RUN_POINTER_FROM_VERSION = 1;
 const ACTIVE_RUN_POINTER_TO_VERSION = 2;
 const ACTIVE_RUN_POINTER_NAMESPACE_FROM_VERSION = 2;
@@ -69,6 +71,10 @@ const INTEGRATION_ATTEMPT_FROM_VERSION = 2;
 const INTEGRATION_ATTEMPT_TO_VERSION = 3;
 const INTEGRATION_ATTEMPT_GATE_IDENTITY_FROM_VERSION = 3;
 const INTEGRATION_ATTEMPT_GATE_IDENTITY_TO_VERSION = 4;
+const INTEGRATION_ATTEMPT_ACTOR_FROM_VERSION = 4;
+const INTEGRATION_ATTEMPT_ACTOR_TO_VERSION = 5;
+const MILESTONE_ACTOR_FROM_VERSION = 1;
+const MILESTONE_ACTOR_TO_VERSION = 2;
 const INTEGRATION_QUEUE_FROM_VERSION = 0;
 const INTEGRATION_QUEUE_TO_VERSION = 1;
 const CONTEXT_SNAPSHOT_FROM_VERSION = 0;
@@ -174,12 +180,15 @@ export function createProductionStorageRegistry() {
         .registerOfflineMigration(recordFamilyStep("reviewRound", REVIEW_ROUND_FROM_VERSION, REVIEW_ROUND_TO_VERSION, "reviewRounds"))
         .registerOfflineMigration(recordFamilyStep("reviewRound", REVIEW_ROUND_GIT_SNAPSHOT_FROM_VERSION, REVIEW_ROUND_GIT_SNAPSHOT_TO_VERSION, "reviewRounds"))
         .registerOfflineMigration(reviewRoundTaskAnchorStep())
+        .registerOfflineMigration(recordFamilyStep("reviewRound", REVIEW_ROUND_ACTOR_FROM_VERSION, REVIEW_ROUND_ACTOR_TO_VERSION, "reviewRounds"))
         .registerOfflineMigration(recordFamilyStep("activeRunPointer", ACTIVE_RUN_POINTER_FROM_VERSION, ACTIVE_RUN_POINTER_TO_VERSION, "activeRuns"))
         .registerOfflineMigration(managedWorkspaceFamilyStep())
         .registerOfflineMigration(activeRunPointerNamespaceStep())
         .registerOfflineMigration(changeSetManifestStep())
         .registerOfflineMigration(integrationAttemptSupersededStep())
         .registerOfflineMigration(recordFamilyStep("integrationAttempt", INTEGRATION_ATTEMPT_GATE_IDENTITY_FROM_VERSION, INTEGRATION_ATTEMPT_GATE_IDENTITY_TO_VERSION, "integrationAttempts"))
+        .registerOfflineMigration(recordFamilyStep("integrationAttempt", INTEGRATION_ATTEMPT_ACTOR_FROM_VERSION, INTEGRATION_ATTEMPT_ACTOR_TO_VERSION, "integrationAttempts"))
+        .registerOfflineMigration(recordFamilyStep("milestone", MILESTONE_ACTOR_FROM_VERSION, MILESTONE_ACTOR_TO_VERSION, "milestones"))
         .registerOfflineMigration(integrationQueueIntroductionStep())
         .registerOfflineMigration(contextSnapshotIntroductionStep())
         .registerCompatible(storedTaskDurableJobsStep())