@zq-silk/yui 0.13.4 → 0.13.5

package/dist/runtime/agentHost.js

@@ -14,7 +14,7 @@ import { ProviderDeliveryUnknownError, ProviderConversationMissingError, Provide
 import { sameProviderAuthorityFence, validateProviderAuthorityFence } from "./providerAuthorityFence.js";
 import { validateRuntimeProcessExitObservation } from "./processExitObservation.js";
 import { persistRuntimeProcessExitObservation, replayRuntimeProcessExitOutbox } from "./processExitOutbox.js";
-import { readRuntimeStopReceipt, removeRuntimeStopReceipt, writeRuntimeStopReceipt } from "./runtimeStopReceipt.js";
+import { readRuntimeStopReceipt, removeRuntimeStopReceipt } from "./runtimeStopReceipt.js";
 import { AGENT_HOST_CONTROL_TIMEOUT_MS, AGENT_HOST_READY_TIMEOUT_MS } from "./runtimeDeadlines.js";
 export const AGENT_HOST_CONTROL_PROTOCOL = "yui-agent-host/v2";
 const HOST_CONTROL_MAX_BYTES = 32 * 1024;
@@ -34,7 +34,6 @@ export async function runAgentHost(input) {
     let activeNativeTurnId;
     let codexClientAttachedAt;
     let consecutiveCodexDisconnects = 0;
-    const switchDetachedSessions = new WeakSet();
     let activationId;
     let conversationRecoverability = "unknown";
     let authority;
@@ -228,8 +227,7 @@ export async function runAgentHost(input) {
             const reconnectableCodexClient = ownsCurrentSession
                 && providerSession.adapterId === "codex"
                 && !hostStopRequested
-                && stopReceipt === null
-                && !switchDetachedSessions.has(providerSession);
+                && stopReceipt === null;
             if (reconnectableCodexClient) {
                 session = undefined;
                 if (codexClientAttachedAt !== undefined
@@ -274,21 +272,19 @@ export async function runAgentHost(input) {
             hostSequence += 1;
             const observedAt = new Date().toISOString();
             const failures = [];
-            if (!switchDetachedSessions.has(providerSession)) {
-                try {
-                    await publishStructuredProviderActivationTerminal({
-                        home: input.home,
-                        environment: currentPayload.environment,
-                        conversationId: providerSession.conversationId,
-                        nativeSessionId: providerSession.nativeSessionId,
-                        activationId: currentActivationId,
-                        status: stopReceipt !== null || hostStopRequested ? "ended" : "failed",
-                        observedAt
-                    });
-                }
-                catch (error) {
-                    failures.push(`activation terminal: ${errorText(error)}`);
-                }
+            try {
+                await publishStructuredProviderActivationTerminal({
+                    home: input.home,
+                    environment: currentPayload.environment,
+                    conversationId: providerSession.conversationId,
+                    nativeSessionId: providerSession.nativeSessionId,
+                    activationId: currentActivationId,
+                    status: stopReceipt !== null || hostStopRequested ? "ended" : "failed",
+                    observedAt
+                });
+            }
+            catch (error) {
+                failures.push(`activation terminal: ${errorText(error)}`);
             }
             let exitPersisted = false;
             try {
@@ -357,10 +353,12 @@ export async function runAgentHost(input) {
         }
         const requestedAuthority = validateProviderAuthorityFence(providerControl.authority);
         const replacesCurrentConversation = session !== undefined && providerControl.kind === "new";
-        if (!replacesCurrentConversation && authority === undefined)
+        if (replacesCurrentConversation) {
+            throw new Error("Agent Host cannot replace a live Provider Session; stop it before starting a fresh Session.");
+        }
+        if (authority === undefined)
             authority = requestedAuthority;
-        else if (!replacesCurrentConversation
-            && authority !== undefined
+        else if (authority !== undefined
             && !sameProviderAuthorityFence(authority, requestedAuthority)) {
             throw new Error("Agent Host launch carries a stale Provider authority fence.");
         }
@@ -380,43 +378,6 @@ export async function runAgentHost(input) {
         let providerAcceptedAttemptId;
         let durableInitialTurn;
         try {
-            if (replacesCurrentConversation) {
-                const previousSession = session;
-                const previousPayload = sessionPayload;
-                const previousActivationId = activationId ?? previousPayload?.launchId;
-                if (previousPayload === undefined || previousActivationId === undefined
-                    || authority?.owner !== "controller") {
-                    throw new Error("Agent Host cannot detach an inexact Provider Activation.");
-                }
-                await detachDurableProviderForConversationSwitch(input.home, {
-                    taskId: requiredEnvironment(next.environment.YUI_TASK_ID, "Task id"),
-                    roleName: requiredEnvironment(next.environment.YUI_ROLE, "Role name"),
-                    runId: requiredEnvironment(next.environment.YUI_RUN_ID, "Run id"),
-                    agentId: requiredEnvironment(next.environment.YUI_AGENT_ID, "Agent id"),
-                    launchId: next.launchId,
-                    previousConversationId: previousSession.conversationId,
-                    previousNativeSessionId: previousSession.nativeSessionId,
-                    previousActivationId,
-                    nextAuthorityEpoch: requestedAuthority.epoch,
-                    nextAuthorityHolderId: requestedAuthority.holderId,
-                    observedAt: new Date().toISOString()
-                });
-                switchDetachedSessions.add(previousSession);
-                // The persistent Provider child belongs to the Activation that first
-                // created it, not to the most recent resume Run payload. The exit
-                // observer carries that Activation launch id, so the stop receipt must
-                // use the same identity or the expected switch detach is misclassified
-                // as an abnormal child exit and generic cleanup can kill the Host.
-                writeRuntimeStopReceipt(input.home, previousActivationId, new Date());
-                authority = undefined;
-                await terminateProviderSessionForConversationSwitch(previousSession);
-                if (session === previousSession)
-                    session = undefined;
-                sessionPayload = undefined;
-                activationId = undefined;
-                conversationRecoverability = "unknown";
-                authority = requestedAuthority;
-            }
             if (session !== undefined) {
                 if (session.adapterId !== providerControl.adapterId
                     || providerControl.mode !== "resume"
@@ -1123,9 +1084,6 @@ async function beginDurableProviderTurn(home, durableTurn) {
         throw error;
     }
 }
-async function detachDurableProviderForConversationSwitch(home, request) {
-    await callControllerIdempotently(home, "runtime.conversation-switch-detach", request);
-}
 async function callControllerIdempotently(home, method, request) {
     try {
         await callAgentController(home, method, request);
@@ -1152,24 +1110,6 @@ async function callControllerIdempotently(home, method, request) {
 class ControllerAcknowledgementUnknownError extends Error {
     name = "ControllerAcknowledgementUnknownError";
 }
-async function terminateProviderSessionForConversationSwitch(providerSession) {
-    providerSession.terminate("SIGTERM");
-    const forceKill = setTimeout(() => providerSession.terminate("SIGKILL"), 3_000);
-    forceKill.unref();
-    let hardTimeout;
-    const timeout = new Promise((_resolve, reject) => {
-        hardTimeout = setTimeout(() => reject(new Error("Old Provider Activation did not exit after its switch authority was revoked.")), 8_000);
-        hardTimeout.unref();
-    });
-    try {
-        await Promise.race([providerSession.waitForExit(), timeout]);
-    }
-    finally {
-        clearTimeout(forceKill);
-        if (hardTimeout !== undefined)
-            clearTimeout(hardTimeout);
-    }
-}
 async function resolveProviderTurnSubmission(home, durableTurn, error) {
     const attemptId = durableTurn.attemptId;
     if (typeof attemptId !== "string") {

package/dist/runtime/exactControlPlane.js

@@ -268,7 +268,9 @@ export function assertExactTaskRuntimeEnvironment(runtimeSource, environment, ex
 /** Fences a descriptor to the one currently active durable Task runtime. */
 export function assertExactTaskRuntimeState(runtime, store, options = {}) {
     const task = store.getTask(runtime.taskId);
-    if (task === null || task.status !== "active") {
+    if (task === null
+        || task.status !== "active"
+        || task.executionGate.state !== "enabled") {
         throw new Error("Exact Task runtime Task is not current and active.");
     }
     const role = store.getRole(runtime.taskId, runtime.roleName);
@@ -304,17 +306,21 @@ export function assertExactTaskRuntimeState(runtime, store, options = {}) {
         && session?.launchId === runtime.launchId;
     const executionRef = lifecycleMailbox?.processing?.executionRef;
     const preallocated = options.preallocatedDriverSessionReservation;
-    const exactPreallocatedReservation = preallocated !== undefined
-        && runtime.adapterId === preallocated.adapterId
-        && runtime.runId !== undefined
+    const exactRunLaunchReservation = runtime.runId !== undefined
         && runtime.launchId !== undefined
-        && runtime.nativeSessionId !== undefined
-        && session === undefined
         && reservation
         && !hasRuntimeCleanupObligation(lifecycleMailbox)
         && executionRef?.type === "run"
         && executionRef.taskId === runtime.taskId
-        && executionRef.id === runtime.runId
+        && executionRef.id === runtime.runId;
+    const terminalSessionReplacementReservation = exactRunLaunchReservation
+        && session !== undefined
+        && (session.status === "stopped" || session.status === "broken");
+    const exactPreallocatedReservation = preallocated !== undefined
+        && runtime.adapterId === preallocated.adapterId
+        && exactRunLaunchReservation
+        && runtime.nativeSessionId !== undefined
+        && (session === undefined || terminalSessionReplacementReservation)
         && runtime.nativeSessionId === nativeSessionIdForLaunch(preallocated.yuiHome, runtime.launchId, runtime.agentId, runtime.adapterId);
     const preallocatedBeforeInFlightProjection = exactPreallocatedReservation
         && (sessions?.inFlight === null || sessions?.inFlight === undefined);
@@ -327,11 +333,11 @@ export function assertExactTaskRuntimeState(runtime, store, options = {}) {
         throw new Error("Exact Task runtime launch fence is not current.");
     }
     if (runtime.nativeSessionId === undefined) {
-        if (session !== undefined) {
+        if (session !== undefined && !terminalSessionReplacementReservation) {
             throw new Error("Exact Task runtime native Session fence is missing.");
         }
     }
-    else if (session === undefined) {
+    else if (session === undefined || terminalSessionReplacementReservation) {
         if (!exactPreallocatedReservation) {
             throw new Error("Exact Task runtime native Session fence is not current.");
         }

package/dist/runtime/providerContinuationReconciliationService.js

@@ -20,7 +20,7 @@ export class ProviderContinuationReconciliationService {
     }
     async reconcile(now) {
         const changedTaskIds = new Set();
-        for (const task of this.store.listTasks().filter((entry) => entry.status === "active")) {
+        for (const task of this.store.listTasks().filter((entry) => (entry.status === "active" && entry.executionGate.state === "enabled"))) {
             const events = this.store.listEvents(task.id);
             const groups = groupDetachedContinuations(projectProviderContinuations(events), events.map(runtimeObservationFromTaskEvent)
                 .filter((entry) => entry !== null));

package/dist/runtime/providerRecoveryDecision.js

@@ -47,7 +47,7 @@ export function decideProviderRecovery(input) {
             reason: "Provider Conversation is missing but its Activation writer has not ended."
         };
     }
-    return { action: "replace", conversationId: conversation.conversationId };
+    return { action: "restart-run", conversationId: conversation.conversationId };
 }
 function providerTurnIsUnsettled(binding) {
     return binding.turn !== null

package/dist/runtime/providerRuntimeIdentity.js

@@ -294,21 +294,30 @@ export function updateProviderConversationRecoverability(raw, recoverability) {
 export function supersedeProviderConversation(raw, input) {
     const binding = validateProviderRuntimeBinding(raw);
     const current = currentProviderConversation(binding);
-    const basis = input.basis ?? "exact-unrecoverable";
-    if (basis !== "actor-request" && basis !== "exact-unrecoverable") {
-        throw new Error("Provider Conversation switch basis is invalid.");
+    const basis = input.basis;
+    if (basis !== "terminal-session") {
+        throw new Error("Provider Conversation replacement basis is invalid.");
     }
-    if (basis === "exact-unrecoverable" && current.recoverability !== "unrecoverable") {
-        throw new Error("Current Provider Conversation is not exactly unrecoverable.");
-    }
-    if (!input.noUnsettledInputDelivery) {
-        throw new Error("Cannot replace a Provider Conversation with unsettled input delivery.");
-    }
-    if (binding.authority.owner !== "none" || currentProviderActivation(binding) !== null) {
-        throw new Error("Cannot replace a Provider Conversation while its writer umbrella is owned.");
-    }
-    const switchedAt = timestamp(input.switchedAt, "Provider Conversation switch timestamp");
+    const switchedAt = timestamp(input.switchedAt, "Provider Conversation replacement timestamp");
     const epoch = current.epoch + 1;
+    const terminalReason = "terminal-session-replaced";
+    const activations = binding.activations.map((entry) => entry.status === "active"
+        ? {
+            ...entry,
+            status: "failed",
+            endedAt: switchedAt,
+            terminalReason
+        }
+        : entry);
+    const turn = binding.turn !== null
+        && ["submitting", "accepted", "running", "delivery-unknown"].includes(binding.turn.status)
+        ? {
+            ...binding.turn,
+            status: binding.turn.turnId === undefined ? "rejected" : "failed",
+            updatedAt: switchedAt,
+            terminalReason
+        }
+        : binding.turn;
     return validateProviderRuntimeBinding({
         ...binding,
         currentConversationEpoch: epoch,
@@ -324,7 +333,7 @@ export function supersedeProviderConversation(raw, input) {
                 createdAt: switchedAt
             }
         ],
-        activations: [...binding.activations, {
+        activations: [...activations, {
                 activationId: identity(input.activationId, "Provider Activation id"),
                 conversationId: input.conversationId,
                 generation: 1,
@@ -336,7 +345,8 @@ export function supersedeProviderConversation(raw, input) {
             owner: "controller",
             holderId: input.activationId,
             changedAt: switchedAt
-        }
+        },
+        turn
     });
 }
 export function validateProviderRuntimeBinding(value) {

package/dist/scheduler/activeRoleRunDelivery.js

@@ -8,7 +8,7 @@ import { RuntimeLaunchFailure } from "../runtime/launchDiagnostics.js";
 import { mailboxHasWork, nextPendingBatch } from "../coordination/workMailbox.js";
 import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
 import { projectProviderContinuations } from "../runtime/runtimeContinuationProjection.js";
-import { hasRuntimeLifecycleWork, RuntimeLifecycleBusyError, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
+import { RuntimeLifecycleBusyError } from "../runtime/lifecycleReservation.js";
 /**
  * Delivers durable Work AgentRuns before liveness reconciliation. Task command
  * handlers only record intent; this Controller path is the sole automated
@@ -48,24 +48,6 @@ export async function processActiveRoleRunDeliveries(store, delivery, now, selec
                 });
                 continue;
             }
-            // Single-flight: a Role runtime lifecycle lane that already holds a
-            // launch reservation or cleanup obligation must not be entered by a
-            // second delivery. The Run stays active-unpushed and is retried after
-            // the lane settles; the contention is never terminalized as a failure.
-            if (hasRuntimeLifecycleWork(store.getWorkMailbox(runtimeLifecycleTarget({
-                scope: "task",
-                taskId: task.id,
-                roleName: role.name
-            })))) {
-                results.push({
-                    taskId: task.id,
-                    roleName: role.name,
-                    runId: run.id,
-                    status: "skipped",
-                    reason: "runtime-unavailable"
-                });
-                continue;
-            }
             const existingSession = store.getRoleSession(task.id, role.name, run.effective.agentId);
             const receiptId = agentRunDeliveryReceiptId(run);
             const target = { kind: "role", taskId: task.id, roleName: role.name };

package/dist/scheduler/leaderWakeupProcessor.js

@@ -2,11 +2,11 @@ import { createAgentRun } from "../run/agentRun.js";
 import { createRunAssignment } from "../context/runContextContract.js";
 import { formatAgentRunReceiptId } from "../task/taskRecordReference.js";
 import { effectiveLaunchSnapshotsCompatible, effectiveLaunchSnapshotsCompatibleForTaskSession } from "../executor/effectiveLaunch.js";
-import { hasRuntimeLifecycleWork, RuntimeLifecycleBusyError, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
+import { roleAgentSessionResumeMode } from "../executor/agentExecutor.js";
+import { RuntimeLifecycleBusyError } from "../runtime/lifecycleReservation.js";
 import { recordLeaderFailure } from "./leaderFailure.js";
 import { isSchedulerTaskWorkspaceReady } from "./ports.js";
 import { RuntimeLaunchError } from "../runtime/ports.js";
-import { roleSessionDispatchModeWithConversationSwitch } from "../runtime/conversationSwitch.js";
 export async function processLeaderWakeups(store, delivery, now, selection) {
     const results = [];
     const wakeups = selection === undefined || selection.full
@@ -20,7 +20,10 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
     for (const wakeup of wakeups) {
         const task = store.getTask(wakeup.taskId);
         const role = store.getRole(wakeup.taskId, "leader");
-        if (task === null || task.status !== "active" || role === null) {
+        if (task === null
+            || task.status !== "active"
+            || task.executionGate.state !== "enabled"
+            || role === null) {
             results.push({ taskId: wakeup.taskId, status: "skipped", reason: "unavailable" });
             continue;
         }
@@ -29,10 +32,6 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
             results.push({ taskId: task.id, status: "skipped", reason: "workspace-not-ready" });
             continue;
         }
-        if (store.getLeaderFailure(task.id) !== null) {
-            results.push({ taskId: task.id, status: "skipped", reason: "recovery-blocked" });
-            continue;
-        }
         if (store.hasOpenInputRequest(task.id)) {
             results.push({ taskId: task.id, status: "skipped", reason: "waiting-input" });
             continue;
@@ -48,20 +47,6 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
             results.push({ taskId: task.id, status: "skipped", reason: "busy" });
             continue;
         }
-        // Single-flight: a Role runtime lifecycle lane that already holds a
-        // launch reservation or cleanup obligation must not be entered by a
-        // second wake. The wake stays durable (pendingWakeup is not consumed) and
-        // is retried after the lane settles; the suppression is recorded for the
-        // audit instead of manufacturing a failed Run.
-        if (hasRuntimeLifecycleWork(store.getWorkMailbox(runtimeLifecycleTarget({
-            scope: "task",
-            taskId: task.id,
-            roleName: role.name
-        })))) {
-            store.recordWakeSuppression?.(task.id, "lifecycle-busy", now);
-            results.push({ taskId: task.id, status: "skipped", reason: "recovery-blocked" });
-            continue;
-        }
         const reopening = wakeup.reasons.includes("task-reopened");
         let existingSession = store.getRoleSession(task.id, role.name, reopening ? undefined : role.effective.agentId);
         let effectiveSession = existingSession;
@@ -71,43 +56,6 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
         let prepared;
         let preStartFencePersisted = false;
         try {
-            if (existingSession !== null && !hasNativeSession(existingSession)) {
-                const sessionIsTerminal = existingSession.status === "stopped"
-                    || existingSession.status === "broken";
-                if (!sessionIsTerminal) {
-                    // An opaque live Session has no provider identity that can be safely
-                    // rebound. A host absence observation is not a verified stop; keep
-                    // the wake durable until an explicit exact cleanup/reset settles it.
-                    if (existingSession.launchId !== undefined) {
-                        await delivery.inspectRole({
-                            taskId: task.id,
-                            roleName: role.name,
-                            agentId: existingSession.agentId,
-                            adapterId: existingSession.adapterId
-                        });
-                    }
-                    results.push({
-                        taskId: task.id,
-                        status: "skipped",
-                        reason: "recovery-blocked"
-                    });
-                    continue;
-                }
-                if (hasRuntimeLifecycleWork(store.getWorkMailbox(runtimeLifecycleTarget({
-                    scope: "task",
-                    taskId: task.id,
-                    roleName: role.name
-                })))) {
-                    // A stopped/broken Session is eligible for a fresh mode only after
-                    // its exact runtime cleanup/reservation lane has settled.
-                    results.push({
-                        taskId: task.id,
-                        status: "skipped",
-                        reason: "recovery-blocked"
-                    });
-                    continue;
-                }
-            }
             const compatibleSession = existingSession !== null
                 && (reopening
                     ? effectiveLaunchSnapshotsCompatible(existingSession.effective, role.effective)
@@ -123,15 +71,14 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
             const resumableSession = hasNativeSession(existingSession)
                 && existingSession.status !== "stopped"
                 && existingSession.status !== "broken";
-            // A failed or quiet Run is not proof that its Provider Conversation is
-            // unusable. Keep resuming the same identity unless an explicit switch
-            // request (or exact terminal/missing evidence) authorizes a fresh one.
+            // Reuse a healthy Session. A terminal Session is disposable and the next
+            // Run starts fresh without consulting historical recovery records.
             const sessionSet = store.getTaskRoleSessionSet?.(task.id, role.name) ?? null;
             const mode = reopenIdentityDrift
                 ? "new"
                 : sessionSet === null
                     ? resumableSession && compatibleSession ? "resume" : "new"
-                    : roleSessionDispatchModeWithConversationSwitch(sessionSet, store.listEvents?.(task.id) ?? [], store.getWorkMailbox({ kind: "role", taskId: task.id, roleName: role.name }), role.name, role.effective.agentId, role.effective);
+                    : roleAgentSessionResumeMode(sessionSet, role.effective.agentId, role.effective);
             const runId = store.peekNextAgentRunId(task.id);
             const wakeEnvelope = resolveLeaderWakeEnvelope(store, task.id);
             const contextSnapshot = store.freezeLeaderContextSnapshot?.(task.id, role.name, now);
@@ -226,7 +173,9 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
                 || ready.prepared.turnAcceptedDuringLaunch === true
                 || ready.prepared.turnDeliveryUnknownDuringLaunch === true;
             const latestTask = store.getTask(task.id);
-            if (latestTask === null || latestTask.status !== "active") {
+            if (latestTask === null
+                || latestTask.status !== "active"
+                || latestTask.executionGate.state !== "enabled") {
                 delivery.forgetPrepared?.({
                     taskId: task.id,
                     roleName: role.name,

package/dist/scheduler/ports.js

@@ -25,13 +25,14 @@ export function selectedActiveSchedulerTasks(store, selection) {
         const indexedTaskIds = store.listActiveTaskIds?.();
         if (indexedTaskIds === undefined) {
             return store.listTasks().filter((task) => (task.status === "active"
+                && task.executionGate.state === "enabled"
                 && !selection?.blockedTaskIds?.has(task.id)));
         }
         return [...indexedTaskIds].flatMap((taskId) => {
             if (selection?.blockedTaskIds?.has(taskId))
                 return [];
             const task = store.getTask(taskId);
-            return task?.status === "active" ? [task] : [];
+            return task?.status === "active" && task.executionGate.state === "enabled" ? [task] : [];
         });
     }
     const taskIds = selection.taskIds;
@@ -39,7 +40,7 @@ export function selectedActiveSchedulerTasks(store, selection) {
         if (selection.blockedTaskIds?.has(taskId))
             return [];
         const task = store.getTask(taskId);
-        return task?.status === "active" ? [task] : [];
+        return task?.status === "active" && task.executionGate.state === "enabled" ? [task] : [];
     });
 }
 /** Resolves either every Role in a selected Task or only explicit Role keys. */

package/dist/scheduler/roleRunLiveness.js

@@ -196,7 +196,10 @@ function exactBatchInventory(batch, candidates) {
     return { statuses, resources, hostExits };
 }
 function isResourceCandidate(task, run, now) {
-    if (task.status !== "active" || run.status !== "active" || run.deliveredAt === undefined) {
+    if (task.status !== "active"
+        || task.executionGate.state !== "enabled"
+        || run.status !== "active"
+        || run.deliveredAt === undefined) {
         return false;
     }
     const deliveredAt = Date.parse(run.deliveredAt);

package/dist/scheduler/roleRunStall.js

@@ -14,8 +14,6 @@ export const RUN_STALLED_EVENT = "run.stalled";
 export const RUN_RECOVERED_EVENT = "run.recovered";
 export const RUN_DIAGNOSTIC_FINISHED_EVENT = "runtime.diagnostic-finished";
 /** Structured, non-Message recovery evidence written by an explicit Leader. */
-export const RUN_RECOVERY_REQUESTED_EVENT = "run.recovery-requested";
-export const RUN_RECOVERY_APPLIED_EVENT = "run.recovery-applied";
 /** Workflow-semantic events that count for the durable progress clock. */
 const ACTIVITY_EVENT_TYPES = new Set([
     RUN_PROGRESS_EVENT,

package/dist/scheduler/taskExecutionProjection.js

@@ -132,12 +132,29 @@ export function projectTaskExecution(facts) {
         ...(run.executionGroupId === undefined ? {} : { executionGroupId: run.executionGroupId }),
         ...(run.executionLaneId === undefined ? {} : { executionLaneId: run.executionLaneId })
     }));
-    const monitoring = task.status === "completed"
+    const monitoring = task.executionGate.state === "stopped"
+        || task.status === "completed"
         || task.status === "retired"
         || task.status === "archived"
         ? "stopped"
         : "active";
     if (monitoring === "stopped") {
+        if (task.executionGate.state === "stopped" && task.status === "active") {
+            return render({
+                task,
+                status: "stopped",
+                owner: "operator",
+                action: "start-execution",
+                summary: `Task ${task.id} execution is stopped; durable progress is preserved.`,
+                reason: "execution-stopped",
+                monitoring,
+                failClosed: false,
+                activeRuns: activeRunViews,
+                attention: [],
+                blockers: [],
+                pendingWakeup
+            });
+        }
         const stoppedStatus = task.status;
         return render({
             task,

package/dist/scheduler/wakeupQueue.js

@@ -11,7 +11,8 @@ export function queueLeaderWakeup(store, taskId, reason, now) {
 export function queueLeaderWakeupAfterYield(store, task, run, now) {
     if (run.taskId !== task.id)
         throw new Error(`AgentRun belongs to another Task: ${run.taskId}.`);
-    if (task.status !== "active" || run.roleName === "leader")
+    if (task.status !== "active" || task.executionGate.state !== "enabled" || run.roleName === "leader") {
         return null;
+    }
     return queueLeaderWakeup(store, task.id, wakeReason("role-result"), now);
 }

package/dist/storage/migration/productionRegistry.js

@@ -24,6 +24,8 @@ const TASK_FROM_VERSION = 3;
 const TASK_TO_VERSION = 4;
 const TASK_INTENT_FROM_VERSION = 4;
 const TASK_INTENT_TO_VERSION = 5;
+const TASK_EXECUTION_GATE_FROM_VERSION = 5;
+const TASK_EXECUTION_GATE_TO_VERSION = 6;
 const WORK_ITEM_FROM_VERSION = 6;
 const WORK_ITEM_TO_VERSION = 7;
 const WORK_ITEM_GIT_SNAPSHOT_FROM_VERSION = 7;
@@ -161,6 +163,7 @@ export function createProductionStorageRegistry() {
         .registerCompatible(projectLifecycleStep())
         .registerOfflineMigration(taskWorkspaceIdentityStep())
         .registerOfflineMigration(taskIntentStep())
+        .registerOfflineMigration(taskExecutionGateStep())
         .registerOfflineMigration(recordFamilyStep("workItem", WORK_ITEM_FROM_VERSION, WORK_ITEM_TO_VERSION, "workItems"))
         .registerOfflineMigration(recordFamilyStep("workItem", WORK_ITEM_GIT_SNAPSHOT_FROM_VERSION, WORK_ITEM_GIT_SNAPSHOT_TO_VERSION, "workItems"))
         .registerOfflineMigration(workItemExecutionGroupHistoryStep())
@@ -3375,6 +3378,68 @@ function migrateTaskV4ToV5(snapshot) {
         state: { ...snapshot.state, tasks: nextTasks }
     };
 }
+/** Task v6 separates semantic lifecycle from the current execution admission gate. */
+function taskExecutionGateStep() {
+    return {
+        axis: "record",
+        recordKind: "task",
+        fromVersion: TASK_EXECUTION_GATE_FROM_VERSION,
+        toVersion: TASK_EXECUTION_GATE_TO_VERSION,
+        preconditions: requireTaskV5Family,
+        transform: migrateTaskV5ToV6,
+        declaredEffects: []
+    };
+}
+function requireTaskV5Family(snapshot) {
+    const manifestVersions = asObject(snapshot.schemaManifest.recordVersions, "schema manifest recordVersions");
+    if (manifestVersions.task !== TASK_EXECUTION_GATE_FROM_VERSION) {
+        throw new Error(`Record task migration requires manifest version ${TASK_EXECUTION_GATE_FROM_VERSION}.`);
+    }
+    if (snapshot.state === null)
+        return;
+    const tasks = asObject(snapshot.state.tasks, "state tasks");
+    for (const [taskId, rawTask] of Object.entries(tasks)) {
+        const aggregate = asObject(rawTask, `Task aggregate ${taskId}`);
+        if (aggregate.task === undefined)
+            continue;
+        const record = asObject(aggregate.task, `Task ${taskId}`);
+        if (record.schemaVersion !== TASK_EXECUTION_GATE_FROM_VERSION) {
+            throw new Error(`Task ${taskId} must use schemaVersion ${TASK_EXECUTION_GATE_FROM_VERSION}.`);
+        }
+    }
+}
+function migrateTaskV5ToV6(snapshot) {
+    requireTaskV5Family(snapshot);
+    const manifestVersions = asObject(snapshot.schemaManifest.recordVersions, "schema manifest recordVersions");
+    const schemaManifest = {
+        ...snapshot.schemaManifest,
+        recordVersions: { ...manifestVersions, task: TASK_EXECUTION_GATE_TO_VERSION }
+    };
+    if (snapshot.state === null)
+        return { schemaManifest, state: null };
+    const tasks = asObject(snapshot.state.tasks, "state tasks");
+    const nextTasks = {};
+    for (const [taskId, rawTask] of Object.entries(tasks)) {
+        const aggregate = asObject(rawTask, `Task aggregate ${taskId}`);
+        if (aggregate.task === undefined) {
+            nextTasks[taskId] = { ...aggregate };
+            continue;
+        }
+        const task = asObject(aggregate.task, `Task ${taskId}`);
+        nextTasks[taskId] = {
+            ...aggregate,
+            task: {
+                ...task,
+                schemaVersion: TASK_EXECUTION_GATE_TO_VERSION,
+                executionGate: { state: "enabled" }
+            }
+        };
+    }
+    return {
+        schemaManifest,
+        state: { ...snapshot.state, tasks: nextTasks }
+    };
+}
 /**
  * A version bump is deliverable only when the shared planner resolves the full
  * adjacent path. This also covers target-only record families as explicit 0->1