@zq-silk/yui 0.13.4 → 0.13.6

package/dist/scheduler/ports.js

@@ -25,13 +25,14 @@ export function selectedActiveSchedulerTasks(store, selection) {
         const indexedTaskIds = store.listActiveTaskIds?.();
         if (indexedTaskIds === undefined) {
             return store.listTasks().filter((task) => (task.status === "active"
+                && task.executionGate.state === "enabled"
                 && !selection?.blockedTaskIds?.has(task.id)));
         }
         return [...indexedTaskIds].flatMap((taskId) => {
             if (selection?.blockedTaskIds?.has(taskId))
                 return [];
             const task = store.getTask(taskId);
-            return task?.status === "active" ? [task] : [];
+            return task?.status === "active" && task.executionGate.state === "enabled" ? [task] : [];
         });
     }
     const taskIds = selection.taskIds;
@@ -39,7 +40,7 @@ export function selectedActiveSchedulerTasks(store, selection) {
         if (selection.blockedTaskIds?.has(taskId))
             return [];
         const task = store.getTask(taskId);
-        return task?.status === "active" ? [task] : [];
+        return task?.status === "active" && task.executionGate.state === "enabled" ? [task] : [];
     });
 }
 /** Resolves either every Role in a selected Task or only explicit Role keys. */

package/dist/scheduler/roleRunLiveness.js

@@ -196,7 +196,10 @@ function exactBatchInventory(batch, candidates) {
     return { statuses, resources, hostExits };
 }
 function isResourceCandidate(task, run, now) {
-    if (task.status !== "active" || run.status !== "active" || run.deliveredAt === undefined) {
+    if (task.status !== "active"
+        || task.executionGate.state !== "enabled"
+        || run.status !== "active"
+        || run.deliveredAt === undefined) {
         return false;
     }
     const deliveredAt = Date.parse(run.deliveredAt);

package/dist/scheduler/roleRunStall.js

@@ -14,8 +14,6 @@ export const RUN_STALLED_EVENT = "run.stalled";
 export const RUN_RECOVERED_EVENT = "run.recovered";
 export const RUN_DIAGNOSTIC_FINISHED_EVENT = "runtime.diagnostic-finished";
 /** Structured, non-Message recovery evidence written by an explicit Leader. */
-export const RUN_RECOVERY_REQUESTED_EVENT = "run.recovery-requested";
-export const RUN_RECOVERY_APPLIED_EVENT = "run.recovery-applied";
 /** Workflow-semantic events that count for the durable progress clock. */
 const ACTIVITY_EVENT_TYPES = new Set([
     RUN_PROGRESS_EVENT,

package/dist/scheduler/taskExecutionProjection.js

@@ -132,12 +132,29 @@ export function projectTaskExecution(facts) {
         ...(run.executionGroupId === undefined ? {} : { executionGroupId: run.executionGroupId }),
         ...(run.executionLaneId === undefined ? {} : { executionLaneId: run.executionLaneId })
     }));
-    const monitoring = task.status === "completed"
+    const monitoring = task.executionGate.state === "stopped"
+        || task.status === "completed"
         || task.status === "retired"
         || task.status === "archived"
         ? "stopped"
         : "active";
     if (monitoring === "stopped") {
+        if (task.executionGate.state === "stopped" && task.status === "active") {
+            return render({
+                task,
+                status: "stopped",
+                owner: "operator",
+                action: "start-execution",
+                summary: `Task ${task.id} execution is stopped; durable progress is preserved.`,
+                reason: "execution-stopped",
+                monitoring,
+                failClosed: false,
+                activeRuns: activeRunViews,
+                attention: [],
+                blockers: [],
+                pendingWakeup
+            });
+        }
         const stoppedStatus = task.status;
         return render({
             task,

package/dist/scheduler/wakeupQueue.js

@@ -11,7 +11,8 @@ export function queueLeaderWakeup(store, taskId, reason, now) {
 export function queueLeaderWakeupAfterYield(store, task, run, now) {
     if (run.taskId !== task.id)
         throw new Error(`AgentRun belongs to another Task: ${run.taskId}.`);
-    if (task.status !== "active" || run.roleName === "leader")
+    if (task.status !== "active" || task.executionGate.state !== "enabled" || run.roleName === "leader") {
         return null;
+    }
     return queueLeaderWakeup(store, task.id, wakeReason("role-result"), now);
 }

package/dist/storage/migration/productionRegistry.js

@@ -24,6 +24,8 @@ const TASK_FROM_VERSION = 3;
 const TASK_TO_VERSION = 4;
 const TASK_INTENT_FROM_VERSION = 4;
 const TASK_INTENT_TO_VERSION = 5;
+const TASK_EXECUTION_GATE_FROM_VERSION = 5;
+const TASK_EXECUTION_GATE_TO_VERSION = 6;
 const WORK_ITEM_FROM_VERSION = 6;
 const WORK_ITEM_TO_VERSION = 7;
 const WORK_ITEM_GIT_SNAPSHOT_FROM_VERSION = 7;
@@ -161,6 +163,7 @@ export function createProductionStorageRegistry() {
         .registerCompatible(projectLifecycleStep())
         .registerOfflineMigration(taskWorkspaceIdentityStep())
         .registerOfflineMigration(taskIntentStep())
+        .registerOfflineMigration(taskExecutionGateStep())
         .registerOfflineMigration(recordFamilyStep("workItem", WORK_ITEM_FROM_VERSION, WORK_ITEM_TO_VERSION, "workItems"))
         .registerOfflineMigration(recordFamilyStep("workItem", WORK_ITEM_GIT_SNAPSHOT_FROM_VERSION, WORK_ITEM_GIT_SNAPSHOT_TO_VERSION, "workItems"))
         .registerOfflineMigration(workItemExecutionGroupHistoryStep())
@@ -3375,6 +3378,68 @@ function migrateTaskV4ToV5(snapshot) {
         state: { ...snapshot.state, tasks: nextTasks }
     };
 }
+/** Task v6 separates semantic lifecycle from the current execution admission gate. */
+function taskExecutionGateStep() {
+    return {
+        axis: "record",
+        recordKind: "task",
+        fromVersion: TASK_EXECUTION_GATE_FROM_VERSION,
+        toVersion: TASK_EXECUTION_GATE_TO_VERSION,
+        preconditions: requireTaskV5Family,
+        transform: migrateTaskV5ToV6,
+        declaredEffects: []
+    };
+}
+function requireTaskV5Family(snapshot) {
+    const manifestVersions = asObject(snapshot.schemaManifest.recordVersions, "schema manifest recordVersions");
+    if (manifestVersions.task !== TASK_EXECUTION_GATE_FROM_VERSION) {
+        throw new Error(`Record task migration requires manifest version ${TASK_EXECUTION_GATE_FROM_VERSION}.`);
+    }
+    if (snapshot.state === null)
+        return;
+    const tasks = asObject(snapshot.state.tasks, "state tasks");
+    for (const [taskId, rawTask] of Object.entries(tasks)) {
+        const aggregate = asObject(rawTask, `Task aggregate ${taskId}`);
+        if (aggregate.task === undefined)
+            continue;
+        const record = asObject(aggregate.task, `Task ${taskId}`);
+        if (record.schemaVersion !== TASK_EXECUTION_GATE_FROM_VERSION) {
+            throw new Error(`Task ${taskId} must use schemaVersion ${TASK_EXECUTION_GATE_FROM_VERSION}.`);
+        }
+    }
+}
+function migrateTaskV5ToV6(snapshot) {
+    requireTaskV5Family(snapshot);
+    const manifestVersions = asObject(snapshot.schemaManifest.recordVersions, "schema manifest recordVersions");
+    const schemaManifest = {
+        ...snapshot.schemaManifest,
+        recordVersions: { ...manifestVersions, task: TASK_EXECUTION_GATE_TO_VERSION }
+    };
+    if (snapshot.state === null)
+        return { schemaManifest, state: null };
+    const tasks = asObject(snapshot.state.tasks, "state tasks");
+    const nextTasks = {};
+    for (const [taskId, rawTask] of Object.entries(tasks)) {
+        const aggregate = asObject(rawTask, `Task aggregate ${taskId}`);
+        if (aggregate.task === undefined) {
+            nextTasks[taskId] = { ...aggregate };
+            continue;
+        }
+        const task = asObject(aggregate.task, `Task ${taskId}`);
+        nextTasks[taskId] = {
+            ...aggregate,
+            task: {
+                ...task,
+                schemaVersion: TASK_EXECUTION_GATE_TO_VERSION,
+                executionGate: { state: "enabled" }
+            }
+        };
+    }
+    return {
+        schemaManifest,
+        state: { ...snapshot.state, tasks: nextTasks }
+    };
+}
 /**
  * A version bump is deliverable only when the shared planner resolves the full
  * adjacent path. This also covers target-only record families as explicit 0->1

package/dist/storage/sqliteStore.js

@@ -773,7 +773,7 @@ export class SqliteTaskStore {
                 if (found === undefined)
                     throw new StorageRecordError(`Task Project not found: ${binding.projectId}`);
             }
-            const isActive = task.status === "active" ? 1 : 0;
+            const isActive = task.status === "active" && task.executionGate.state === "enabled" ? 1 : 0;
             // The catalog projection is inserted first because task_records FKs it.
             this.#db.prepare(`INSERT INTO tasks_catalog (task_id, status, lifecycle, is_active, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?)
@@ -807,6 +807,7 @@ export class SqliteTaskStore {
             task: {
                 id: task.id,
                 status: task.status,
+                executionGate: task.executionGate,
                 projectBindings: task.projectBindings,
                 type: task.type
             },
@@ -835,7 +836,6 @@ export class SqliteTaskStore {
         return {
             ...base,
             agentRuns: operationalTaskRecords(this.listAgentRuns(taskId), this.listEvents(taskId), "agent-run"),
-            roleSessionSets: this.listRoleSessionSets(taskId),
             managedWorkspaces: this.#sortById(this.#listPayload("managed_workspaces", "task_id = ?", [taskId]), (workspace) => managedWorkspaceKey(workspace.owner)),
             durableJobs: this.#sortById(this.#listPayload("durable_jobs", "task_id = ?", [taskId]), (job) => job.id),
             integrationQueueEntries: this.#sortById(this.#listPayload("integration_queue", "task_id = ?", [taskId]), (entry) => entry.id),
@@ -1754,6 +1754,10 @@ export class SqliteTaskStore {
             return;
         }
         this.transaction((store) => {
+            const task = store.getTask(run.taskId);
+            if (task === null || task.status !== "active" || task.executionGate.state !== "enabled") {
+                throw new StorageRecordError(`Task execution is not enabled: ${run.taskId}.`);
+            }
             this.#assertActiveRunForWrite(run);
             const current = store.getActiveAgentRun(run.taskId, run.roleName);
             if (current !== null && current.id !== run.id) {
@@ -1796,6 +1800,10 @@ export class SqliteTaskStore {
             throw new StorageRecordError(`Active execution-lane run requires group and lane ids: ${run.id}`);
         }
         this.transaction((store) => {
+            const task = store.getTask(run.taskId);
+            if (task === null || task.status !== "active" || task.executionGate.state !== "enabled") {
+                throw new StorageRecordError(`Task execution is not enabled: ${run.taskId}.`);
+            }
             const key = executionLaneActiveRunKey(run.executionGroupId, run.executionLaneId);
             this.#assertActiveRunForWrite(run, {
                 executionGroupId: run.executionGroupId,

package/dist/storage/taskStore.js

@@ -61,7 +61,7 @@ export const CURRENT_PROJECT_SCHEMA_VERSION = 5;
 export const CURRENT_AGENT_PROFILE_SCHEMA_VERSION = 2;
 export const CURRENT_GLOBAL_ROLE_SCHEMA_VERSION = 3;
 export const CURRENT_GLOBAL_ROLE_SESSION_SET_SCHEMA_VERSION = 3;
-export const CURRENT_TASK_SCHEMA_VERSION = 5;
+export const CURRENT_TASK_SCHEMA_VERSION = 6;
 export const CURRENT_TASK_BRIEF_SCHEMA_VERSION = 2;
 export const CURRENT_CONTEXT_SNAPSHOT_SCHEMA_VERSION = 1;
 export const CURRENT_TASK_ROLE_SCHEMA_VERSION = 3;
@@ -431,7 +431,7 @@ export class FileTaskStore {
         // The file rollback backend has no catalog index, so it filters the loaded
         // aggregate. Layout-7 Controller hot paths use SQLite's bounded selector.
         return this.listTasks()
-            .filter((task) => task.status === "active")
+            .filter((task) => task.status === "active" && task.executionGate.state === "enabled")
             .map((task) => task.id);
     }
     getStateRevision() { return this.#state().revision; }
@@ -446,6 +446,7 @@ export class FileTaskStore {
             task: {
                 id: aggregate.task.id,
                 status: aggregate.task.status,
+                executionGate: aggregate.task.executionGate,
                 projectBindings: aggregate.task.projectBindings,
                 type: aggregate.task.type
             },
@@ -485,7 +486,6 @@ export class FileTaskStore {
         return {
             ...base,
             agentRuns: operationalTaskRecords(this.listAgentRuns(taskId), values(aggregate.events, "id"), "agent-run"),
-            roleSessionSets: this.listRoleSessionSets(taskId),
             managedWorkspaces: values(aggregate.managedWorkspaces, (workspace) => managedWorkspaceKey(workspace.owner)),
             durableJobs: values(aggregate.durableJobs, "id"),
             integrationQueueEntries: values(aggregate.integrationQueue, "id"),
@@ -1116,6 +1116,10 @@ export class FileTaskStore {
         if (run.status !== "active")
             throw new StorageRecordError(`Active Agent run must have active status: ${run.id}`);
         this.transaction((store) => {
+            const task = store.getTask(run.taskId);
+            if (task === null || task.status !== "active" || task.executionGate.state !== "enabled") {
+                throw new StorageRecordError(`Task execution is not enabled: ${run.taskId}.`);
+            }
             const current = store.getActiveAgentRun(run.taskId, run.roleName);
             if (current !== null && current.id !== run.id) {
                 throw new StorageRecordError(`Role already has an active Agent run: ${run.taskId}/${run.roleName}`);
@@ -1177,6 +1181,10 @@ export class FileTaskStore {
             throw new StorageRecordError(`Lane active Agent run requires execution lineage: ${run.id}`);
         }
         this.transaction((store) => {
+            const task = store.getTask(run.taskId);
+            if (task === null || task.status !== "active" || task.executionGate.state !== "enabled") {
+                throw new StorageRecordError(`Task execution is not enabled: ${run.taskId}.`);
+            }
             const key = executionLaneActiveRunKey(run.executionGroupId, run.executionLaneId);
             const current = store.getActiveExecutionLaneRun(run.taskId, run.executionGroupId, run.executionLaneId);
             if (current !== null && current.id !== run.id) {

package/dist/task/completionReadiness.js

@@ -5,7 +5,6 @@ import { isSemanticReviewRound } from "../review/reviewOutcomeClassifier.js";
 import { reviewFindingLedgerWriteFailedFromEvents } from "../review/reviewFindingLedger.js";
 import { resolveRecordedTaskFinalReviewContract } from "../review/taskFinalReviewContractRebind.js";
 import { sameTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
-import { blockingProviderContinuations } from "../runtime/runtimeContinuationProjection.js";
 const ACTIVE_JOB_STATUSES = new Set([
     "queued",
     "running",
@@ -160,19 +159,6 @@ export function projectCompletionReadiness(facts, options = {}) {
             fix: `settle integration queue entry ${entry.id} (continue or supersede)`
         });
     }
-    // Provider continuations that may still write the Workspace.
-    for (const continuation of blockingProviderContinuations(facts.events)) {
-        if (!providerContinuationBlocksCompletion(continuation, facts))
-            continue;
-        const identity = continuation.identity;
-        blockers.push({
-            code: "blocking-provider-continuation",
-            ref: ref("provider-continuation", identity.continuationId),
-            reason: `Provider continuation ${identity.continuationId} (run ${continuation.runId}) `
-                + "may still write the Workspace or has an identity conflict.",
-            fix: `wait for or recover the Provider turn on run ${continuation.runId}`
-        });
-    }
     // Terminal child workspaces are cleanup advisories: Task completion is the
     // semantic delivery boundary, while archive remains the fail-closed resource
     // reclamation boundary. Missing/non-terminal ownership stays conservative.
@@ -183,18 +169,6 @@ export function projectCompletionReadiness(facts, options = {}) {
         if (disposition?.kind === "advisory")
             advisories.push(disposition.value);
     }
-    // Active non-Leader Runs must finish.  The Leader's own Run is terminalized
-    // by the completion transaction itself, so it is not a readiness blocker.
-    for (const run of facts.activeRuns) {
-        if (run.roleName === "leader")
-            continue;
-        blockers.push({
-            code: "active-run",
-            ref: ref("agent-run", run.id),
-            reason: `Role ${run.roleName} has an active Run ${run.id}.`,
-            fix: `wait for Run ${run.id} to yield or fail`
-        });
-    }
     // Review finding ledger gate (enforce mode only).
     // The transactional completion path runs this gate after final-review
     // preparation: a pending/running Task-final Review is expected to resolve
@@ -248,47 +222,6 @@ export function projectCompletionReadiness(facts, options = {}) {
         advisories: sortedAdvisories
     };
 }
-/**
- * A terminal Run releases only its completion blocker, never its immutable
- * continuation audit. Missing or inconsistent ownership remains ambiguous and
- * therefore fail-closed. A live exact native Session can still deliver or
- * write for a terminal Run, so it retains the blocker until that Session is
- * stopped, broken, or replaced by another Conversation identity.
- */
-function providerContinuationBlocksCompletion(continuation, facts) {
-    if (continuation.identityConflict)
-        return true;
-    const ownerRun = facts.agentRuns.find(({ id }) => id === continuation.runId);
-    if (ownerRun === undefined
-        || ownerRun.taskId !== continuation.taskId
-        || ownerRun.roleName !== continuation.roleName
-        || ownerRun.effective.agentId !== continuation.identity.accountScope) {
-        return true;
-    }
-    if (ownerRun.status !== "failed" && ownerRun.status !== "yielded")
-        return true;
-    const sessions = facts.roleSessionSets.find(({ owner }) => (owner.taskId === continuation.taskId && owner.roleName === continuation.roleName));
-    const session = sessions?.sessions[continuation.identity.accountScope];
-    if (session !== undefined
-        && session.status !== "stopped"
-        && session.status !== "broken"
-        && session.nativeSessionId === continuation.identity.conversationId) {
-        return true;
-    }
-    const binding = sessions?.providerBinding;
-    if (binding === undefined || binding === null
-        || binding.providerNamespace !== continuation.identity.providerNamespace
-        || binding.accountScope !== continuation.identity.accountScope) {
-        return false;
-    }
-    const conversationIsCurrent = binding.conversations.some((conversation) => (conversation.conversationId === continuation.identity.conversationId
-        && conversation.epoch === binding.currentConversationEpoch
-        && conversation.status === "current"));
-    const activationIsLive = binding.activations.some((activation) => (activation.activationId === continuation.identity.activationId
-        && activation.conversationId === continuation.identity.conversationId
-        && activation.status === "active"));
-    return conversationIsCurrent && activationIsLive;
-}
 function workspaceCompletionDisposition(facts, taskId, workspace) {
     const owner = workspace.owner;
     switch (owner.type) {

package/dist/task/nextAction.js

@@ -22,6 +22,17 @@ export function projectNextAction(facts) {
             ]
         });
     }
+    if (task.status === "active" && task.executionGate.state === "stopped") {
+        return buildAction(facts, {
+            kind: "start-task-execution",
+            reason: `Task ${task.id} execution is stopped; durable progress is preserved.`,
+            refs: [ref("task", task.id)],
+            preconditions: [
+                { fact: "Task execution is stopped", satisfied: true, ref: ref("task", task.id) }
+            ],
+            recommendedCommand: `yui task execution start ${task.id}`
+        });
+    }
     const openInput = facts.openInputRequests[0];
     if (openInput !== undefined) {
         return buildAction(facts, {
@@ -597,42 +608,15 @@ function buildExecutionLaneRecoveryAction(facts, lane) {
         ref("execution-lane", lane.laneId),
         ref("agent-run", lane.runId)
     ];
-    if (lane.recovery === "retry-new-agent-run") {
-        return buildAction(facts, {
-            kind: "recover-execution-lane",
-            reason: `Execution Lane ${lane.laneId} is durably failed; retry only exact Run ${lane.runId} and retain sibling results.`,
-            refs,
-            preconditions: [
-                { fact: "Execution Lane is failed and unresolved", satisfied: true, ref: refs[1] },
-                { fact: "Exact failed AgentRun is retained", satisfied: true, ref: refs[2] }
-            ],
-            recommendedCommand: `yui task run retry ${facts.task.id}/${lane.runId}`
-        });
-    }
-    const action = lane.recovery === "diagnose" ? "diagnose" : "terminate";
-    const recovery = facts.runRecoveries?.find(({ runId }) => runId === lane.runId);
-    const plan = recovery?.actions.find((candidate) => candidate.action === action);
     return buildAction(facts, {
-        kind: "recover-execution-lane",
-        reason: lane.recovery === "diagnose"
-            ? `Execution Lane ${lane.laneId} needs bounded diagnostics for exact Run ${lane.runId}.`
-            : `Execution Lane ${lane.laneId} has confirmed death evidence; terminate exact Run ${lane.runId}.`,
+        kind: "retry-execution-lane",
+        reason: `Execution Lane ${lane.laneId} is durably failed; retry only exact Run ${lane.runId} and retain sibling results.`,
         refs,
         preconditions: [
-            { fact: `Lane recovery is ${lane.recovery}`, satisfied: true, ref: refs[1] },
-            {
-                fact: `Exact Run exposes a current ${action} recovery plan`,
-                satisfied: plan !== undefined,
-                ref: refs[2]
-            }
+            { fact: "Execution Lane is failed and unresolved", satisfied: true, ref: refs[1] },
+            { fact: "Exact failed AgentRun is retained", satisfied: true, ref: refs[2] }
         ],
-        ...(plan === undefined ? {} : { recommendedCommand: plan.command }),
-        ...(plan !== undefined && recovery?.judgmentRequired === undefined
-            ? {}
-            : {
-                judgmentRequired: recovery?.judgmentRequired
-                    ?? `Inspect yui task run show ${facts.task.id}/${lane.runId}; its exact recovery fence is unavailable.`
-            })
+        recommendedCommand: `yui task run retry ${facts.task.id}/${lane.runId}`
     });
 }
 function exhaustedExplorationReason(item, executionGroups) {

package/dist/task/task.js

@@ -2,11 +2,12 @@ import { validateTaskWorkspaceIdentity } from "../repository/taskWorkspaceIdenti
 export function createTask(id, title, now, metadata = {}) {
     const timestamp = now.toISOString();
     return {
-        schemaVersion: 5,
+        schemaVersion: 6,
         id: requireSafeIdentity(id, "Task id"),
         title: requireText(title, "Task title"),
         ...cloneMetadata(metadata),
         status: "draft",
+        executionGate: { state: "enabled" },
         createdAt: timestamp,
         updatedAt: timestamp
     };
@@ -169,9 +170,38 @@ export function updateTaskWorkspace(task, cwd, now) {
 export function isTaskArchived(task) {
     return task.status === "archived";
 }
+export function isTaskExecutionEnabled(task) {
+    return task.executionGate.state === "enabled";
+}
+export function stopTaskExecution(task, now) {
+    validateTask(task);
+    if (task.status !== "active") {
+        throw new Error(`Only an active Task can be stopped: ${task.id}.`);
+    }
+    if (task.executionGate.state === "stopped")
+        return task;
+    return validateTask({
+        ...task,
+        executionGate: { state: "stopped" },
+        updatedAt: now.toISOString()
+    });
+}
+export function startTaskExecution(task, now) {
+    validateTask(task);
+    if (task.status !== "active") {
+        throw new Error(`Only an active Task can be started: ${task.id}.`);
+    }
+    if (task.executionGate.state === "enabled")
+        return task;
+    return validateTask({
+        ...task,
+        executionGate: { state: "enabled" },
+        updatedAt: now.toISOString()
+    });
+}
 export function validateTask(task) {
-    if (task.schemaVersion !== 5)
-        throw new Error("Task must use schemaVersion 5.");
+    if (task.schemaVersion !== 6)
+        throw new Error("Task must use schemaVersion 6.");
     requireSafeIdentity(task.id, "Task id");
     requireText(task.title, "Task title");
     if (task.type !== undefined)
@@ -179,6 +209,11 @@ export function validateTask(task) {
     if (!["draft", "active", "completed", "retired", "archived"].includes(task.status)) {
         throw new Error(`Task status is invalid: ${String(task.status)}.`);
     }
+    if (task.executionGate === null
+        || typeof task.executionGate !== "object"
+        || !["enabled", "stopped"].includes(task.executionGate.state)) {
+        throw new Error(`Task execution state is invalid: ${String(task.executionGate?.state)}.`);
+    }
     requireTimestamp(task.createdAt, "Task createdAt");
     requireTimestamp(task.updatedAt, "Task updatedAt");
     if (Date.parse(task.updatedAt) < Date.parse(task.createdAt)) {

package/dist/web/assets/client/i18n.js

@@ -86,8 +86,6 @@ const messages = {
     "detail.focus": "Current focus",
     "detail.runtimeHealth": "Runtime health",
     "detail.lastProgress": "Last semantic progress",
-    "detail.recoveryFence": "Canonical recovery fence (Yui durable)",
-    "detail.recoveryProviderObserved": "Provider observation (evidence only)",
     "input.freeText": "Type your answer",
     "input.answered": "Input answered.",
     "input.new": "A new input needs your attention.",
@@ -424,8 +422,6 @@ const messages = {
     "detail.focus": "当前重点",
     "detail.runtimeHealth": "运行健康",
     "detail.lastProgress": "最近语义进展",
-    "detail.recoveryFence": "规范恢复 fence（Yui 持久）",
-    "detail.recoveryProviderObserved": "Provider 观测（仅证据）",
     "input.freeText": "输入回答",
     "input.answered": "输入已回答。",
     "input.new": "有新的输入请求需要处理。",

package/dist/web/assets/client/view.js

@@ -345,24 +345,6 @@ export function renderTaskDetail(detail, data, t, locale, actions) {
         node("p", "record-copy", (run.kind || "workflow-not-progressing") + " · " + (run.classification || "truly-stalled")),
         node("small", "", t("detail.lastProgress") + " · " + formatDateTime(run.progressAt, locale))
       );
-      // Issue 08: the same canonical recovery projection as the CLI. The
-      // durable fence and the Provider observation stay clearly separated;
-      // the exact recovery actions live in "yui task run show".
-      if (run.recovery) {
-        if (run.recovery.canonicalProgressAt) {
-          card.append(node("small", "",
-            t("detail.recoveryFence") + " · " + formatDateTime(run.recovery.canonicalProgressAt, locale)));
-        }
-        if (run.recovery.provider && run.recovery.provider.observedAt) {
-          card.append(node("small", "",
-            t("detail.recoveryProviderObserved") + " · " + run.recovery.provider.observationKind
-            + " " + formatDateTime(run.recovery.provider.observedAt, locale)));
-        }
-        if (run.recovery.recoverable) {
-          card.append(node("small", "record-copy",
-            "yui task run show " + task.id + "/" + run.runId));
-        }
-      }
       runtimeHealthBody.append(card);
     });
     scaffold.append(anchorSection(

package/dist/web/webSnapshot.js

@@ -2,7 +2,6 @@ import { isRoleRunStalled, latestRunDurableProgressAt } from "../scheduler/roleR
 import { buildTaskExecutionProjection } from "../scheduler/taskExecutionProjection.js";
 import { summarizeExecutionGroup } from "../execution/executionGroup.js";
 import { currentWorkItemExecutionGroup } from "../workItem/workItem.js";
-import { projectRunRecovery, readRunRecoveryFacts } from "../run/recoveryProjection.js";
 import { classifyRuntimeHealth, projectRuntimeTaskEvents } from "../runtime/runtimeProjection.js";
 import { builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 import { formatAgentRunReceiptId } from "../task/taskRecordReference.js";
@@ -73,18 +72,13 @@ export function buildWebTaskDetail(store, taskId, now = new Date()) {
         const events = reader.listEvents?.(taskId) ?? [];
         const needsAttentionRuns = runs
             .filter((run) => run.status === "active" && isRoleRunStalled(events, run.id))
-            .map((run) => {
-            const facts = readRunRecoveryFacts(reader, taskId, run.id);
-            return {
-                runId: run.id,
-                roleName: run.roleName,
-                progressAt: latestStallProgress(events, run.id),
-                kind: latestStallField(events, run.id, "kind") ?? "workflow-not-progressing",
-                classification: latestStallField(events, run.id, "classification") ?? "truly-stalled",
-                // Issue 08: the same canonical recovery projection the CLI exposes.
-                ...(facts === null ? {} : { recovery: projectRunRecovery(facts) })
-            };
-        });
+            .map((run) => ({
+            runId: run.id,
+            roleName: run.roleName,
+            progressAt: latestStallProgress(events, run.id),
+            kind: latestStallField(events, run.id, "kind") ?? "workflow-not-progressing",
+            classification: latestStallField(events, run.id, "classification") ?? "truly-stalled"
+        }));
         const activeRuns = new Map(runs
             .filter((run) => run.status === "active")
             .map((run) => [run.roleName, run]));

package/i18n/README.zh-CN.md

@@ -510,9 +510,9 @@ Task 生命周期的交互选择只展示有效来源状态：activate 只展示
 
 ## Session 与 tmux
 
-受管理的 Provider 会话仍然是普通用户会话。Yui 只添加对应的 Role Skill 与 Session Manifest 指针，并通过 Provider 原生结构化协议提交 Task 工作；Yui 不接管完整对话历史。受管理输入绝不会作为终端按键、粘贴文本或启动 argv 发送。Codex 通过 `app-server proxy` 在共享 App Server daemon 上创建或恢复普通 thread；proxy 断开时 Host 会保留逻辑 Activation，重新连接并用原生 thread 历史核对 Yui 已持有的 Turn。Claude 继续使用独立的持久 stream-json 进程，并以精确回放的 user message 作为接收确认。
+受管理的 Provider 会话仍然是普通用户会话。Yui 只添加对应的 Role Skill 与 Session Manifest 指针，并通过 Provider 原生结构化协议提交 Task 工作；Yui 不接管完整对话历史。受管理输入绝不会作为终端按键、粘贴文本或启动 argv 发送。Codex 由每个存活的 Role Runtime 启动并持有独立的 `app-server` 子进程；Task execution stop 会终止 Agent Host 及其 Provider 进程组，start 会创建新的受控运行时，不再依赖共享 Codex daemon。原生 thread 历史仍由 Codex 保留，Task、WorkItem、代码与持久消息仍由 Yui 保留。Claude 继续使用独立的持久 stream-json 进程，并以精确回放的 user message 作为接收确认。
 
-Run、Conversation、Activation 与 Turn 是四个独立身份。Conversation 可以跨多个 Run 和客户端连接；Activation 只代表 Yui 当前的连接，而不是对 Provider thread 的独占所有权；Turn 在写入前先持久化。写入超时或结果不明确会进入 `delivery-unknown`，不会自动重发。用户在 Desktop 直接发起的 active Turn 只会让 Yui 暂时等待，不会导致 Yui Run 失败。
+Run、Conversation、Activation 与 Turn 是四个独立身份。Conversation 可以跨多个 Run 和客户端连接；Activation 只代表 Yui 当前的连接，而不是对 Provider thread 的独占所有权；Turn 在写入前先持久化。写入超时或结果不明确会进入 `delivery-unknown`，不会自动重发。已经存在的原生 active Turn 只会让 Yui 暂时等待，不会导致 Yui Run 失败；存活的受管理 Role 应通过 Yui 的 view/takeover 边界进行人工控制，避免其他客户端并发写入。
 
 Task Role 使用以下显式入口：
 
@@ -524,7 +524,7 @@ yui task role takeover <task-id> <role>
 yui task role release <task-id> <role>
 ```
 
-Codex Role thread 可以直接在 Desktop 中打开和交互，不需要执行 `takeover`；Yui 不写入全局 Hook/config。Yui 可以幂等启动尚未运行的共享 daemon，但不会因 thread 错误停止或重启它。`view`、`takeover`、`release` 继续作为独立进程型 Provider 的显式 PTY 输入网关。Global Operator 与 global Role 继续使用原生交互式 CLI，不属于受管理 Task Provider 协议。
+Codex Role thread 仍可在 Desktop 中查看，但存活的受管理 Role 应通过 `view`、`takeover`、`release` 进行人工控制；若要从其他客户端恢复该 thread，应先停止 Task execution。Yui 不写入全局 Hook/config，也不依赖或控制共享 Codex daemon。Global Operator 与 global Role 继续使用原生交互式 CLI，不属于受管理 Task Provider 协议。
 
 当新版本需要离线迁移 Home 时，应等待当前 Turn/Run 完成，然后从普通 shell
 执行 `yui session stop --all`，再重新执行 `yui update`。停止命令会先整体预检：
@@ -560,7 +560,7 @@ state、receipt 与 pane fence。Yui 不会解析 prompt glyph、进度文本、
 或其他 Agent 终端输出来推断 ready 或 success。`captureRole()` 只用于显式的人类
 transcript 查看，不具备生命周期权威。
 
-稳定的 Role 上下文不会创建额外的 bootstrap Turn。Task execution Run 按角色使用通用 Leader 或 Worker Skill，review Run 则按持久 Run purpose 使用通用 Reviewer Skill；Provider 可以通过安全的追加式原生上下文通道携带 Skill，也可以在普通 Task 投递中指向它。这些都只是 Yui 自己拥有的可移植编排规则。Project Skills 始终是 Project 中正常版本化的文件，由 Agent 通过自身项目机制发现、选择并按需加载；Yui 不扫描、不解析、不复制，也不注入 Project Skills。Managed Codex 保留用户原有的 developer instructions；普通 Task 消息会携带精简的 Session Manifest 绝对路径，Manifest 再指向对应的 Yui Role Skill，供 Codex 按需读取。Role 选择的 model、effort、permission、workspace 与 shell 设置通过共享 App Server daemon，作为线程级 `thread/start` 或 `thread/resume` 配置传入。Codex 原生 config profile 不能隔离到共享 daemon 的单个 thread，因此 Managed Codex 会拒绝这个设置并提示使用 Yui Agent Profile；其他非 Yui 或交互式 Codex 会话不受影响。其他 Codex 线程继续使用原有的用户、profile、Project 和 system 配置，Yui 不修改底层配置文件。App Server 原生通知是 Managed Codex 线程的生命周期权威；Yui 不为它安装 Hook，也不占用 `notify`。交互式 Codex Session 仍可使用 Yui 的结构化 `notify` callback，Doctor 会报告最终生效的配置冲突。`skills.config` 只负责启停已发现 Skill，Yui 不会误用它。Claude 从 Yui 管理的私有 `0600` context 文件读取同一份 Yui Role Skill 内容，不再把大段或敏感文本放进 argv；重试和 resume 会复用按 purpose 区分的稳定路径。非 Operator 的 global Role 保持中性，不会注入 Task 编排 Skill。因此 Operator 会停在空白的原生 composer，用户输入仍是第一条 user message；Leader wake、Worker 和 Reviewer Run assignment 仍是邮箱投递的真实工作消息。
+稳定的 Role 上下文不会创建额外的 bootstrap Turn。Task execution Run 按角色使用通用 Leader 或 Worker Skill，review Run 则按持久 Run purpose 使用通用 Reviewer Skill；Provider 可以通过安全的追加式原生上下文通道携带 Skill，也可以在普通 Task 投递中指向它。这些都只是 Yui 自己拥有的可移植编排规则。Project Skills 始终是 Project 中正常版本化的文件，由 Agent 通过自身项目机制发现、选择并按需加载；Yui 不扫描、不解析、不复制，也不注入 Project Skills。Managed Codex 保留用户原有的 developer instructions；普通 Task 消息会携带精简的 Session Manifest 绝对路径，Manifest 再指向对应的 Yui Role Skill，供 Codex 按需读取。每个存活 Role 的 Yui-owned App Server 进程会加载所选 Codex 原生 config profile；model、effort、permission、workspace 与 shell 设置作为线程级 `thread/start` 或 `thread/resume` 配置传入，Yui 不修改底层 Codex 配置文件。App Server 原生通知是 Managed Codex 线程的生命周期权威；Yui 不为它安装 Hook，也不占用 `notify`。交互式 Codex Session 仍可使用 Yui 的结构化 `notify` callback，Doctor 会报告最终生效的配置冲突。`skills.config` 只负责启停已发现 Skill，Yui 不会误用它。Claude 从 Yui 管理的私有 `0600` context 文件读取同一份 Yui Role Skill 内容，不再把大段或敏感文本放进 argv；重试和 resume 会复用按 purpose 区分的稳定路径。非 Operator 的 global Role 保持中性，不会注入 Task 编排 Skill。因此 Operator 会停在空白的原生 composer，用户输入仍是第一条 user message；Leader wake、Worker 和 Reviewer Run assignment 仍是邮箱投递的真实工作消息。
 
 ## Controller 与失败处理
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.13.4",
+  "version": "0.13.6",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,