@zq-silk/yui 0.13.7 → 0.13.9

package/dist/storage/sqliteStore.js

@@ -1150,7 +1150,7 @@ export class SqliteTaskStore {
             ? ""
             : ` WHERE ${predicates.join(" AND ")}`;
         const rows = this.#db.prepare(`SELECT scope, task_id, role_name, agent_id, adapter_id,
-              native_session_id, launch_id, status, session_updated_at,
+              native_session_id, launch_id, session_updated_at,
               cleanup_required
        FROM runtime_session_candidates${where}`).all(...parameters);
         const candidates = rows.map((row) => ({
@@ -1161,7 +1161,6 @@ export class SqliteTaskStore {
             adapterId: row.adapter_id,
             nativeSessionId: row.native_session_id,
             ...(row.launch_id === null ? {} : { launchId: row.launch_id }),
-            status: row.status,
             sessionUpdatedAt: row.session_updated_at,
             cleanupRequired: row.cleanup_required === 1
         })).sort(compareRuntimeSessionCandidates);
@@ -1217,14 +1216,14 @@ export class SqliteTaskStore {
            json_extract(active_session, '$.adapterId') AS adapter_id,
            json_extract(active_session, '$.nativeSessionId') AS native_session_id,
            json_extract(active_session, '$.launchId') AS launch_id,
-           json_extract(active_session, '$.status') AS status,
+           CASE
+             WHEN json_extract(active_session, '$.status') = 'active'
+             THEN 1 ELSE 0
+           END AS is_active,
            json_extract(active_session, '$.updatedAt') AS session_updated_at,
            CASE
-             WHEN json_extract(active_session, '$.status') NOT IN ('stopped','broken')
-               AND (
-                 json_extract(active_session, '$.status') = 'running'
-                 OR json_type(active_session, '$.launchId') = 'text'
-               )
+             WHEN json_extract(active_session, '$.status') = 'active'
+               AND json_type(active_session, '$.launchId') = 'text'
              THEN 1 ELSE 0
            END AS cleanup_required
          FROM active`).get(...source.parameters);
@@ -1245,7 +1244,7 @@ export class SqliteTaskStore {
             && row.adapter_id === candidate.adapterId
             && row.native_session_id === candidate.nativeSessionId
             && (row.launch_id ?? undefined) === candidate.launchId
-            && row.status === candidate.status
+            && row.is_active === 1
             && row.session_updated_at === candidate.sessionUpdatedAt
             && row.cleanup_required === (candidate.cleanupRequired ? 1 : 0);
     }
@@ -1277,16 +1276,15 @@ export class SqliteTaskStore {
         const taskId = candidate.owner.scope === "task" ? candidate.owner.taskId : "";
         this.#db.prepare(`INSERT INTO runtime_session_candidates (
          scope, task_id, role_name, agent_id, adapter_id, native_session_id,
-         launch_id, status, session_updated_at, cleanup_required
-       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         launch_id, session_updated_at, cleanup_required
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
        ON CONFLICT(scope, task_id, role_name) DO UPDATE SET
          agent_id = excluded.agent_id,
          adapter_id = excluded.adapter_id,
          native_session_id = excluded.native_session_id,
          launch_id = excluded.launch_id,
-         status = excluded.status,
          session_updated_at = excluded.session_updated_at,
-         cleanup_required = excluded.cleanup_required`).run(candidate.owner.scope, taskId, candidate.owner.roleName, candidate.agentId, candidate.adapterId, candidate.nativeSessionId, candidate.launchId ?? null, candidate.status, candidate.sessionUpdatedAt, candidate.cleanupRequired ? 1 : 0);
+         cleanup_required = excluded.cleanup_required`).run(candidate.owner.scope, taskId, candidate.owner.roleName, candidate.agentId, candidate.adapterId, candidate.nativeSessionId, candidate.launchId ?? null, candidate.sessionUpdatedAt, candidate.cleanupRequired ? 1 : 0);
     }
     #deleteRuntimeSessionCandidate(owner) {
         this.#db.prepare(`DELETE FROM runtime_session_candidates
@@ -1585,37 +1583,6 @@ export class SqliteTaskStore {
            payload = excluded.payload, updated_at = excluded.updated_at`).run(run.taskId, run.id, run.roleName, run.status, this.#json(run), this.#now());
         });
     }
-    /**
-     * Issue 04: SQLite-native pending retry query.  A single indexed scan
-     * replaces the adapter's per-Task in-memory sweep, so Controller deadline
-     * arming no longer materializes every Task and Run in JavaScript.
-     */
-    listPendingProviderRetries(taskIds) {
-        const selectedTaskIds = taskIds === undefined
-            ? undefined
-            : [...new Set(taskIds)].sort(numericCompare);
-        if (selectedTaskIds?.length === 0)
-            return [];
-        const taskPredicate = selectedTaskIds === undefined
-            ? ""
-            : ` AND tc.task_id IN (${selectedTaskIds.map(() => "?").join(", ")})`;
-        const rows = this.#db.prepare(`SELECT DISTINCT ar.task_id AS taskId, ar.run_id AS runId, ar.role_name AS roleName,
-              json_extract(ar.payload, '$.providerRetry.state') AS state,
-              CASE json_extract(ar.payload, '$.providerRetry.state')
-                WHEN 'scheduled' THEN json_extract(ar.payload, '$.providerRetry.nextAttemptAt')
-                ELSE json_extract(ar.payload, '$.providerRetry.episodeDeadlineAt')
-              END AS dueAt
-       FROM tasks_catalog tc INDEXED BY idx_tasks_active
-       JOIN active_runs ap ON ap.task_id = tc.task_id
-       JOIN agent_runs ar ON ar.task_id = ap.task_id AND ar.run_id = ap.run_id
-       WHERE tc.is_active = 1
-         AND ar.status = 'active'
-         AND json_extract(ar.payload, '$.providerRetry.state') IN
-           ('scheduled', 'dispatching', 'awaiting-progress')${taskPredicate}`).all(...(selectedTaskIds ?? []));
-        return rows.sort((left, right) => (numericCompare(left.taskId, right.taskId)
-            || numericCompare(left.roleName, right.roleName)
-            || numericCompare(left.runId, right.runId)));
-    }
     // -- review rounds ----------------------------------------------------------
     nextReviewRoundId(taskId) { return this.#nextTaskRecordId(taskId, "reviewRound"); }
     getReviewRound(taskId, reviewRoundId) {

package/dist/storage/taskStore.js

@@ -6,7 +6,7 @@ import { validateConfiguredAgent } from "../agent/agent.js";
 import { validateCapabilityGrant } from "../grant/capabilityGrant.js";
 import { validateReleaseWorkflow } from "../release/releaseWorkflow.js";
 import { publicationExternalKey, validatePublicationReference } from "../task/publicationReference.js";
-import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveContextBudget, resolveDeliveryTimeoutSeconds, resolveLeaderNextActionMode, resolveLeaderSemanticBudgetTurns, resolveProviderRetryAdapters, resolveProviderRetryDelaysSeconds, resolveProviderRetryMaxWindowSeconds, resolveProviderRetryMode, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryRunCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
+import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveContextBudget, resolveDeliveryTimeoutSeconds, resolveLeaderNextActionMode, resolveLeaderSemanticBudgetTurns, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryRunCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
 import { resolveTimeZone } from "../output/timePresentation.js";
 import { mailboxBatches, consumePendingBatch, mailboxHasWork, mailboxTargetKey, pendingLane, validateWorkMailbox } from "../coordination/workMailbox.js";
 import { validateContextSnapshot } from "../context/contextSnapshot.js";
@@ -15,7 +15,6 @@ import { validateInputRequest } from "../input/inputRequest.js";
 import { validateRoleSessionSet } from "../executor/agentExecutor.js";
 import { validateTaskMessage } from "../message/message.js";
 import { agentRunDeliveryReceiptId, validateAgentRun } from "../run/agentRun.js";
-import { providerRetryWakeAt } from "../run/providerRetry.js";
 import { compareRuntimeSessionCandidates, projectRuntimeSessionCandidate } from "../runtime/runtimeSessionCandidate.js";
 import { FileSessionOwnerRegistry } from "../runtime/sessionOwnerRegistry.js";
 import { validateReviewConfig } from "../review/reviewConfig.js";
@@ -45,7 +44,7 @@ import { CURRENT_AGGREGATE_SCHEMA_VERSION, requireCompatibleStorageSchema, requi
 export const STORAGE_STATE_FILE = "state.json";
 /** The root StorageState schema is the persisted aggregate document version. */
 export const CURRENT_STORAGE_STATE_SCHEMA_VERSION = CURRENT_AGGREGATE_SCHEMA_VERSION;
-export const CURRENT_CONFIG_SCHEMA_VERSION = 3;
+export const CURRENT_CONFIG_SCHEMA_VERSION = 4;
 export const CURRENT_HOME_IDENTITY_SCHEMA_VERSION = 1;
 export const CURRENT_ACTIVE_RUN_POINTER_SCHEMA_VERSION = 3;
 /**
@@ -60,11 +59,11 @@ export const CURRENT_CONFIGURED_AGENT_SCHEMA_VERSION = 2;
 export const CURRENT_PROJECT_SCHEMA_VERSION = 5;
 export const CURRENT_AGENT_PROFILE_SCHEMA_VERSION = 2;
 export const CURRENT_GLOBAL_ROLE_SCHEMA_VERSION = 3;
-export const CURRENT_GLOBAL_ROLE_SESSION_SET_SCHEMA_VERSION = 3;
+export const CURRENT_GLOBAL_ROLE_SESSION_SET_SCHEMA_VERSION = 4;
 export const CURRENT_TASK_SCHEMA_VERSION = 6;
 export const CURRENT_TASK_BRIEF_SCHEMA_VERSION = 2;
 export const CURRENT_CONTEXT_SNAPSHOT_SCHEMA_VERSION = 1;
-export const CURRENT_TASK_ROLE_SCHEMA_VERSION = 3;
+export const CURRENT_TASK_ROLE_SCHEMA_VERSION = 4;
 export const CURRENT_MANAGED_WORKSPACE_SCHEMA_VERSION = 2;
 export const CURRENT_WORK_ITEM_SCHEMA_VERSION = 12;
 export const CURRENT_REVIEW_ROUND_SCHEMA_VERSION = 6;
@@ -77,9 +76,9 @@ export const CURRENT_MILESTONE_SCHEMA_VERSION = 2;
 export const CURRENT_EVENT_SCHEMA_VERSION = 2;
 export const CURRENT_CAPABILITY_GRANT_SCHEMA_VERSION = 1;
 export const CURRENT_RELEASE_WORKFLOW_SCHEMA_VERSION = 1;
-export const CURRENT_WORK_MAILBOX_SCHEMA_VERSION = 2;
+export const CURRENT_WORK_MAILBOX_SCHEMA_VERSION = 3;
 export const CURRENT_PUBLICATION_REFERENCE_SCHEMA_VERSION = 1;
-export const CURRENT_ROLE_AGENT_SESSION_SCHEMA_VERSION = 3;
+export const CURRENT_ROLE_AGENT_SESSION_SCHEMA_VERSION = 4;
 export const CURRENT_PENDING_WAKEUP_SCHEMA_VERSION = 1;
 const STORAGE_LOCK_DIRECTORY = ".state.lock";
 const LOCK_TIMEOUT_MS = 5_000;
@@ -118,13 +117,13 @@ export const CURRENT_STORED_TASK_SCHEMA_VERSION = 18;
  * Keep these named at the storage boundary so the upgrade record-axis map can
  * assert it is classifying the same bytes the store reads and writes.
  */
-export const CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION = 6;
+export const CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION = 8;
 /**
  * v7 combines optional Issue 04 retry/receipt fields and Issue 05 Leader
  * actionability fields. All are optional, so the v6→v7 migration is a
  * version-only rewrite.
  */
-export const CURRENT_AGENT_RUN_SCHEMA_VERSION = 9;
+export const CURRENT_AGENT_RUN_SCHEMA_VERSION = 10;
 export const CURRENT_INTEGRATION_QUEUE_SCHEMA_VERSION = 1;
 export class FileTaskStore {
     rootDir;
@@ -991,29 +990,6 @@ export class FileTaskStore {
     }
     getAgentRun(taskId, id) { return optional(this.#state().tasks[taskId]?.agentRuns[id]); }
     listAgentRuns(taskId) { return values(this.#requireTask(taskId).agentRuns, "id"); }
-    listPendingProviderRetries(taskIds) {
-        // The legacy File store can answer the empty case without a scan fallback.
-        // If durable retry state exists, the db-only capability must fail closed
-        // instead of silently losing the Controller's wake deadline.
-        const tasks = taskIds === undefined
-            ? this.listTasks()
-            : [...new Set(taskIds)].sort(numericCompare).flatMap((taskId) => {
-                const task = this.getTask(taskId);
-                return task === null ? [] : [task];
-            });
-        for (const task of tasks) {
-            if (task.status !== "active")
-                continue;
-            for (const run of this.listAgentRuns(task.id)) {
-                if (run.status === "active"
-                    && run.providerRetry !== undefined
-                    && providerRetryWakeAt(run.providerRetry) !== null) {
-                    throw new StorageRecordError("Provider retry in place requires the SQLite backend; run `yui update` to migrate this Home.");
-                }
-            }
-        }
-        return [];
-    }
     saveAgentRun(run) {
         const stored = identified(run, CURRENT_AGENT_RUN_SCHEMA_VERSION, "id", run.id, "Agent run");
         validateAgentRun(stored);
@@ -2498,10 +2474,6 @@ export function validateYuiConfig(config) {
         resolveResourcesGcMode(config.resourcesGcMode);
         resolveResourcesGcAutoQuarantine(config.resourcesGcAutoQuarantine);
         resolveResourcesQuarantineTtlHours(config.resourcesQuarantineTtlHours);
-        resolveProviderRetryMode(config.providerRetryMode);
-        resolveProviderRetryAdapters(config.providerRetryAdapters);
-        resolveProviderRetryDelaysSeconds(config.providerRetryDelaysSeconds);
-        resolveProviderRetryMaxWindowSeconds(config.providerRetryMaxWindowSeconds);
         resolveRuntimeHealth(config.runtimeHealth);
         resolveControllerTaskConcurrency(config.controllerTaskConcurrency);
         resolveAgentLaunchInactivityTimeoutSeconds(config.agentLaunchInactivityTimeoutSeconds);

package/dist/web/webSnapshot.js

@@ -92,6 +92,9 @@ export function buildWebTaskDetail(store, taskId, now = new Date()) {
             const effectiveLaunch = activeRun?.effective ?? activeSession?.effective ?? null;
             return {
                 ...role,
+                // Presentation only: workflow activity is derived from AgentRun; the
+                // native Session contributes lifecycle detail when no Run is active.
+                status: activeRun === undefined ? activeSession?.status ?? "idle" : "running",
                 sessionTokens: projectSessionTokenMetrics(events, resolveSessionTokenIdentity(activeSession === undefined
                     ? null
                     : { taskId, roleName: role.name, ...activeSession })),

package/i18n/README.zh-CN.md

@@ -2,9 +2,15 @@
 
 # Yui
 
-Yui 是面向持久 Codex/Claude 工作的本地控制平面。用户只需和 Operator
-对话；Operator 将不同 Project 的需求、Bug、审查和问题咨询路由到对应
-Task，Leader 再负责拆解、执行选择、验收和安全集成。
+Yui 是面向智能 Codex/Claude Agent 的本地控制平面。它持久保存用户意图、
+Project Knowledge、Task、交接和结果，并提供上下文、消息、委派、工作区、
+Session、审查和集成等小而原子的能力。Agent 组合这些能力，自主决定规划、
+顺序、委派、重试和恢复。
+
+Yui 不把 Agent 的判断固化成确定性的工作流引擎。核心只负责持久身份、用户
+授权、工作区隔离和原子状态变更；Provider Session 与运行时观测用于执行和
+连续性，但不是 Task 事实的另一套来源。用户只需和 Operator 对话，Operator
+负责路由，Leader 负责目标拆解、执行选择、验收和集成。
 
 当前实现保留实用的 Role/Agent/session 与 CLI 框架，不恢复后期膨胀的数据维护、租约、定时调度和恢复账本体系。
 
@@ -514,6 +520,8 @@ Task 生命周期的交互选择只展示有效来源状态：activate 只展示
 
 Run、Conversation、Activation 与 Turn 是四个独立身份。Conversation 可以跨多个 Run 和客户端连接；Activation 只代表 Yui 当前的连接，而不是对 Provider thread 的独占所有权；Turn 在写入前先持久化。写入超时或结果不明确会进入 `delivery-unknown`，不会自动重发。Codex 已存在的原生 active Turn 只会让 Yui 暂时等待，不会导致 Yui Run 失败；Claude 等独立进程 Provider 继续通过 Yui 的 view/takeover 边界进行人工控制。
 
+AgentRun 是 Role 是否有工作正在执行的唯一持久调度状态。Conversation 不再维护另一份 current Run；Provider Turn 中的 Run id 只用于关联接收回执和终态事件。TaskRole 本身只保存身份和期望启动配置，不再保存可写的运行状态；CLI/Web 展示的 Role 状态由活动 AgentRun 派生，并叠加 Session/Driver 生命周期事实用于诊断。Agent 可以在 Provider 终态到达前声明旧 Run 的语义结果，下一批 mailbox 工作也可以先形成新的 AgentRun；Agent Host 仍会串行等待旧 Turn 结束，再投递被保留的新输入，不回滚事件，也不把旧 Conversation 强行换绑到新 Run。
+
 Task Role 使用以下显式入口：
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.13.7",
+  "version": "0.13.9",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -122,8 +122,8 @@ or yield merely to preserve that native wait.
 Before the first durable Leader action, Yui observes fresh native generations
 that produce no WorkItem, Review, Integration, or Leader-attributed durable
 event. Two such generations create a non-blocking orchestration advisory for
-Leader and Operator judgment; they do not fail the Role, reduce the configured
-Provider retry policy, or prevent another useful generation. Read the evidence
+Leader and Operator judgment; they do not fail the Role or prevent another
+useful generation. Read the evidence
 before retrying, then choose whether to continue, change the configured Leader,
 or perform direct maintenance without manufacturing protocol records merely to
 silence the advisory.
@@ -703,13 +703,35 @@ newer WorkItem. If the original execution Session cannot be resumed, surface
 the recovery decision to the user; do not silently discard its context by
 creating a replacement.
 
-If a native Role Session disappears, run `yui task reconcile <task-id>`,
-inspect the Run and partial work, then retry only a confirmed failed Run:
+For a Role runtime failure, inspect the exact error and runtime identities first:
 
 ```sh
-yui task run retry <run-id>
+yui task event show <task> <agent-error-event>
+yui task role session inspect <task> <role>
 ```
 
+When a Provider-accepted Turn fails with availability, `429`, capacity, or a
+recoverable transport error and the Session remains usable, retain the Run and
+Session; a recovery action adds a new Turn on that same native Session. A
+Session preparation failure or Driver rejection before input acceptance fails
+the exact Run once; inspect its error and explicitly retry that failed Run when
+another attempt is useful. Core will not redispatch it on a scheduler tick.
+
+If the Driver proves that the Session cannot continue, settle or retire the
+exact active Run, stop only that Role Session, then retry the failed Run so the
+next dispatch starts a new Session:
+
+```sh
+yui task role session stop <task> <role> --reason "<error decision>"
+yui task run retry <task>/<failed-run>
+```
+
+The new Run context contains the prior Agent, adapter, Run, Host activation,
+native Session/Turn identities, and complete raw error through the referenced
+Task event. Inspect recent `runtime.agent-error` events before another fresh
+Session; after repeated fresh-Session failures, report the evidence and bounded
+options to the user instead of inventing another automatic loop.
+
 ## Request a decision
 
 When a real user choice, new authority, or unavailable external fact is
@@ -789,8 +811,8 @@ yui task complete <task-id> --summary "<outcome, validation, and remaining risks
 
 Retire obsolete WorkItems with `yui task work retire <task>/<work> --summary
 "..."`, optionally using `--replacement`. If the current Provider Conversation
-cannot continue, request a bounded switch with
-`yui task role session switch <task> <role> --reason "..."`; the current
-Conversation remains authoritative until Yui safely binds the replacement. Archiving is a
+cannot continue, settle its Run and stop the exact idle Session with
+`yui task role session stop`; the next explicit Run dispatch creates the
+replacement. Archiving is a
 separate global Operator lifecycle action. It performs the final Task-owned
 runtime and clean-worktree teardown, including this Leader.

package/skills/yui-operator/SKILL.md

@@ -349,12 +349,20 @@ the workflow without claiming that version was delivered.
   treat it as a permission boundary. The Operator may make code, semantic,
   requirement, acceptance, recovery, and integration decisions and must leave
   the real actor and rationale in durable Task state.
-- Reconcile a disappeared native Session with `task reconcile`; inspect the Run
-  before retrying a confirmed failure.
-- If the current Provider Conversation cannot continue, use
-  `yui task role session switch <task> <role> --reason "..."`. The request is
-  audited, and Yui keeps the old Conversation authoritative until the exact
-  replacement bind succeeds; never reconstruct identities from terminal text.
+- Inspect `runtime.agent-error` and `yui task role session inspect` before a
+  recovery. When a Provider-accepted Turn fails with availability, `429`,
+  capacity, or a recoverable transport error and the Session remains usable,
+  add a new Turn to that Session. A Session preparation failure or Driver
+  rejection before input acceptance fails the exact Run once; explicitly retry
+  that failed Run when another attempt is useful. Core does not redispatch it
+  on a scheduler tick. If the Driver proves the Session cannot continue, settle
+  or retire its exact Run, stop that one idle Session with `yui task role
+  session stop <task> <role> --reason "..."`, then retry the failed Run. The
+  replacement Run receives the old Agent, adapter, Run, Host, Session, Turn,
+  and complete raw-error facts through Task context.
+- Inspect recent errors before creating another fresh Session. After repeated
+  fresh-Session failures, summarize the evidence and bounded options to the
+  user; do not hide them behind an automatic replacement counter or loop.
 - Retry only an explicitly failed recovery Job.
 - When a Leader first-progress advisory is reported, inspect its native
   generations and absence of durable progress. It is cost evidence rather than

package/skills/yui-runtime/SKILL.md

@@ -12,10 +12,11 @@ workspace layout, native transcript, or an earlier Run.
 For every managed Task Run:
 
 1. Read the exact Run identity from the newest Bootstrap Envelope.
-2. Before acting, load its authorized pack with the ordinary Yui CLI command:
+2. Before acting, load its authorized pack with the Session CLI named by the
+   current Session Manifest:
 
    ```sh
-   yui task run context "$YUI_TASK_ID/<run-id>" --json
+   "$YUI_SESSION_CLI" task run context "$YUI_TASK_ID/<run-id>" --json
    ```
 
 3. Verify that the returned Task, Run, Role, purpose, Snapshot digest, workspace,
@@ -27,7 +28,7 @@ For every managed Task Run:
    `refId`:
 
    ```sh
-   yui task run context expand "$YUI_TASK_ID/<run-id>" <ref-id> --store <store> --mode full --json
+   "$YUI_SESSION_CLI" task run context expand "$YUI_TASK_ID/<run-id>" <ref-id> --store <store> --mode full --json
    ```
 
    A bare `<ref-id>` remains supported only when it identifies exactly one
@@ -46,7 +47,7 @@ For a global Operator or custom GlobalRole Session, load the stable authorized v
 before routing or acting:
 
 ```sh
-yui session context "$YUI_ROLE" --json
+"$YUI_SESSION_CLI" session context "$YUI_ROLE" --json
 ```
 
 Global context grants no Task implementation workspace. Read a Task only after
@@ -60,7 +61,9 @@ supported checkpoint/yield command as the final control-plane action, then stop
 immediately. If that direct command is denied or stale, report the blocker once
 and stop; do not wrap, retry, broaden permissions, or target another Run.
 
-For a transient Provider retry Envelope, continue the failed Turn in the same
-native Session. Do not replay the original Assignment or reload unrelated Task
-content. Process/child replacement does not by itself authorize a new Yui
-generation or native conversation.
+After a failed Provider Turn, read the referenced `runtime.agent-error` fact.
+The failed Turn is immutable; a recovery is always a new Turn. Continue on the
+same native Session when it remains recoverable, and load only the current Run
+delta instead of replaying its original Assignment. A new Host process does not
+imply a new Session, and a new Session must never be substituted silently for
+the persisted native Session id.

package/dist/lifecycle/providerErrorClass.js

@@ -1,152 +0,0 @@
-/**
- * Issue 04 — Provider error classification.
- *
- * Provider failures arrive at the driver boundary as opaque free text (Claude
- * StopFailure `error`/`errorDetails`, Codex turn-completion summaries). Each
- * driver parses its own Provider's format into a structured
- * {@link ProviderErrorCode} at the driver boundary. This module maps those
- * codes to provider-neutral error classes by lookup, falling back to text
- * matching only when the driver could not produce a structured code.
- *
- * The retry-in-place coordinator needs a stable, provider-neutral error class
- * before it can decide whether the original Session may be retried.
- *
- * Classes (Issue 04 §2):
- * - `transient-provider`   — 500/502/504, connection reset, backend capacity;
- *                            the original Session is retried in place.
- * - `transport-uncertain`  — the request may have been accepted but the
- *                            response was lost; native facts are consulted
- *                            before any resend.
- * - `policy-denied`        — cyber_policy / permission boundary; never retried
- *                            automatically, never worked around by switching
- *                            Session or widening permission.
- * - `session-dead`         — the process/tmux/native identity is gone; in-place
- *                            retry stops and a replacement blocker is raised.
- * - `invalid-request`      — deterministic parameter/protocol error; fail fast,
- *                            never call the Provider again.
- * - `unclassified`         — no conservative match; behaves like
- *                            `invalid-request` for retry purposes (old
- *                            terminalize-immediately behavior) while remaining
- *                            observable in shadow metrics.
- */
-import { PROVIDER_ERROR_CODE_CLASS } from "../runtime/providerErrorCodes.js";
-/** Classes for which the original Session may be retried in place. */
-export const RETRYABLE_PROVIDER_ERROR_CLASSES = [
-    "transient-provider",
-    "transport-uncertain"
-];
-export function isRetryableProviderErrorClass(errorClass) {
-    return RETRYABLE_PROVIDER_ERROR_CLASSES.includes(errorClass);
-}
-/**
- * Ordered pattern tables. The first class whose pattern matches wins, so the
- * table order is the precedence order. Patterns are matched case-insensitively
- * against the concatenation of every available text field.
- */
-const SESSION_DEAD_PATTERNS = [
-    { pattern: /session not found/iu, label: "session-not-found" },
-    { pattern: /no such (session|thread)/iu, label: "no-such-session" },
-    { pattern: /thread not found/iu, label: "thread-not-found" },
-    { pattern: /session (has )?expired/iu, label: "session-expired" },
-    { pattern: /session (has )?ended/iu, label: "session-ended" },
-    { pattern: /session (is )?dead/iu, label: "session-dead" },
-    { pattern: /session terminated/iu, label: "session-terminated" },
-];
-const CONTEXT_CAPACITY_PATTERNS = [
-    { pattern: /maximum context length/iu, label: "maximum-context-length" },
-    { pattern: /context length exceeded/iu, label: "context-length-exceeded" },
-    { pattern: /context window (is )?(full|exceeded)/iu, label: "context-window-exceeded" },
-    { pattern: /prompt (is )?too long/iu, label: "prompt-too-long" },
-    { pattern: /too many tokens/iu, label: "too-many-tokens" }
-];
-const POLICY_DENIED_PATTERNS = [
-    { pattern: /cyber[_-]?policy/iu, label: "cyber-policy" },
-    { pattern: /policy[_-]?violation/iu, label: "policy-violation" },
-    { pattern: /usage[_-]?policy/iu, label: "usage-policy" },
-    { pattern: /content[_-]?policy/iu, label: "content-policy" },
-    { pattern: /safety[_-]?policy/iu, label: "safety-policy" },
-    { pattern: /policy denial/iu, label: "policy-denial" }
-];
-const INVALID_REQUEST_PATTERNS = [
-    { pattern: /invalid[_-]?request/iu, label: "invalid-request" },
-    { pattern: /validation error/iu, label: "validation-error" },
-    { pattern: /bad request/iu, label: "bad-request" },
-    { pattern: /\b400\b/u, label: "http-400" },
-    { pattern: /unknown (flag|tool|argument)/iu, label: "unknown-argument" },
-    { pattern: /unexpected argument/iu, label: "unexpected-argument" },
-    { pattern: /invalid schema/iu, label: "invalid-schema" }
-];
-const TRANSIENT_PROVIDER_PATTERNS = [
-    { pattern: /\b50[024]\b/u, label: "http-5xx" },
-    { pattern: /server[\s_-]?error/iu, label: "server-error" },
-    { pattern: /internal server error/iu, label: "internal-server-error" },
-    // HTTP/2 RST_STREAM / gRPC status carried by Claude Code and Codex streams
-    // (Task-27: "stream error: stream ID …; INTERNAL_ERROR; received from peer").
-    { pattern: /\binternal[\s_-]?error\b/iu, label: "internal-error" },
-    { pattern: /connection lost/iu, label: "connection-lost" },
-    { pattern: /connection reset/iu, label: "connection-reset" },
-    { pattern: /econnreset/iu, label: "econnreset" },
-    { pattern: /socket hang up/iu, label: "socket-hang-up" },
-    { pattern: /kv[_-]?cache[_-]?allocate[_-]?failed/iu, label: "kv-cache-allocate-failed" },
-    { pattern: /overloaded/iu, label: "overloaded" },
-    { pattern: /\b429\b/u, label: "http-429" },
-    { pattern: /rate[_-]?limit/iu, label: "rate-limit" },
-    { pattern: /upstream/iu, label: "upstream" },
-    { pattern: /bad gateway/iu, label: "bad-gateway" },
-    { pattern: /gateway timeout/iu, label: "gateway-timeout" },
-    { pattern: /service unavailable/iu, label: "service-unavailable" },
-    { pattern: /temporarily unavailable/iu, label: "temporarily-unavailable" },
-    { pattern: /try again/iu, label: "try-again" }
-];
-const TRANSPORT_UNCERTAIN_PATTERNS = [
-    { pattern: /timed?[ -]?out/iu, label: "timeout" },
-    { pattern: /etimedout/iu, label: "etimedout" },
-    { pattern: /response lost/iu, label: "response-lost" },
-    { pattern: /lost response/iu, label: "lost-response" },
-    // A stream-level failure means the response may have been cut mid-turn;
-    // the retry path consults durable completion facts before any resend.
-    { pattern: /stream error/iu, label: "stream-error" },
-    { pattern: /stream interrupted/iu, label: "stream-interrupted" },
-    { pattern: /interrupted function/iu, label: "interrupted-function" },
-    { pattern: /controller timeout/iu, label: "controller-timeout" },
-    { pattern: /delivery (unconfirmed|uncertain|not confirmed)/iu, label: "delivery-unconfirmed" },
-    { pattern: /unconfirmed delivery/iu, label: "unconfirmed-delivery" },
-    { pattern: /no response/iu, label: "no-response" }
-];
-const CLASS_TABLE = [
-    { errorClass: "session-dead", patterns: SESSION_DEAD_PATTERNS },
-    { errorClass: "policy-denied", patterns: POLICY_DENIED_PATTERNS },
-    { errorClass: "context-capacity", patterns: CONTEXT_CAPACITY_PATTERNS },
-    { errorClass: "invalid-request", patterns: INVALID_REQUEST_PATTERNS },
-    { errorClass: "transient-provider", patterns: TRANSIENT_PROVIDER_PATTERNS },
-    { errorClass: "transport-uncertain", patterns: TRANSPORT_UNCERTAIN_PATTERNS }
-];
-/**
- * Classifies one provider failure. When the driver produced a structured
- * {@link ProviderErrorCode}, the class is looked up directly. Otherwise the
- * raw text fields are matched against the fallback pattern tables. Every
- * available text field is concatenated so a class can be recognized
- * regardless of which field carried it.
- */
-export function classifyProviderError(input) {
-    // Structured path: the driver already parsed the Provider's error format.
-    if (input.errorCode !== undefined) {
-        const errorClass = PROVIDER_ERROR_CODE_CLASS[input.errorCode];
-        if (errorClass !== undefined) {
-            return { errorClass, matched: input.errorCode, basis: "structured" };
-        }
-    }
-    // Text fallback: for drivers that cannot yet produce a structured code.
-    const text = [input.error, input.errorDetails, input.summary]
-        .filter((value) => typeof value === "string" && value.length > 0)
-        .join("\n");
-    if (text.length === 0)
-        return { errorClass: "unclassified", matched: "none", basis: "text" };
-    for (const { errorClass, patterns } of CLASS_TABLE) {
-        for (const { pattern, label } of patterns) {
-            if (pattern.test(text))
-                return { errorClass, matched: label, basis: "text" };
-        }
-    }
-    return { errorClass: "unclassified", matched: "none", basis: "text" };
-}