@zq-silk/yui 0.13.8 → 0.13.9

package/dist/storage/taskStore.js

@@ -6,7 +6,7 @@ import { validateConfiguredAgent } from "../agent/agent.js";
 import { validateCapabilityGrant } from "../grant/capabilityGrant.js";
 import { validateReleaseWorkflow } from "../release/releaseWorkflow.js";
 import { publicationExternalKey, validatePublicationReference } from "../task/publicationReference.js";
-import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveContextBudget, resolveDeliveryTimeoutSeconds, resolveLeaderNextActionMode, resolveLeaderSemanticBudgetTurns, resolveProviderRetryAdapters, resolveProviderRetryDelaysSeconds, resolveProviderRetryMaxWindowSeconds, resolveProviderRetryMode, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryRunCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
+import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveContextBudget, resolveDeliveryTimeoutSeconds, resolveLeaderNextActionMode, resolveLeaderSemanticBudgetTurns, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryRunCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
 import { resolveTimeZone } from "../output/timePresentation.js";
 import { mailboxBatches, consumePendingBatch, mailboxHasWork, mailboxTargetKey, pendingLane, validateWorkMailbox } from "../coordination/workMailbox.js";
 import { validateContextSnapshot } from "../context/contextSnapshot.js";
@@ -15,7 +15,6 @@ import { validateInputRequest } from "../input/inputRequest.js";
 import { validateRoleSessionSet } from "../executor/agentExecutor.js";
 import { validateTaskMessage } from "../message/message.js";
 import { agentRunDeliveryReceiptId, validateAgentRun } from "../run/agentRun.js";
-import { providerRetryWakeAt } from "../run/providerRetry.js";
 import { compareRuntimeSessionCandidates, projectRuntimeSessionCandidate } from "../runtime/runtimeSessionCandidate.js";
 import { FileSessionOwnerRegistry } from "../runtime/sessionOwnerRegistry.js";
 import { validateReviewConfig } from "../review/reviewConfig.js";
@@ -45,7 +44,7 @@ import { CURRENT_AGGREGATE_SCHEMA_VERSION, requireCompatibleStorageSchema, requi
 export const STORAGE_STATE_FILE = "state.json";
 /** The root StorageState schema is the persisted aggregate document version. */
 export const CURRENT_STORAGE_STATE_SCHEMA_VERSION = CURRENT_AGGREGATE_SCHEMA_VERSION;
-export const CURRENT_CONFIG_SCHEMA_VERSION = 3;
+export const CURRENT_CONFIG_SCHEMA_VERSION = 4;
 export const CURRENT_HOME_IDENTITY_SCHEMA_VERSION = 1;
 export const CURRENT_ACTIVE_RUN_POINTER_SCHEMA_VERSION = 3;
 /**
@@ -60,7 +59,7 @@ export const CURRENT_CONFIGURED_AGENT_SCHEMA_VERSION = 2;
 export const CURRENT_PROJECT_SCHEMA_VERSION = 5;
 export const CURRENT_AGENT_PROFILE_SCHEMA_VERSION = 2;
 export const CURRENT_GLOBAL_ROLE_SCHEMA_VERSION = 3;
-export const CURRENT_GLOBAL_ROLE_SESSION_SET_SCHEMA_VERSION = 3;
+export const CURRENT_GLOBAL_ROLE_SESSION_SET_SCHEMA_VERSION = 4;
 export const CURRENT_TASK_SCHEMA_VERSION = 6;
 export const CURRENT_TASK_BRIEF_SCHEMA_VERSION = 2;
 export const CURRENT_CONTEXT_SNAPSHOT_SCHEMA_VERSION = 1;
@@ -77,9 +76,9 @@ export const CURRENT_MILESTONE_SCHEMA_VERSION = 2;
 export const CURRENT_EVENT_SCHEMA_VERSION = 2;
 export const CURRENT_CAPABILITY_GRANT_SCHEMA_VERSION = 1;
 export const CURRENT_RELEASE_WORKFLOW_SCHEMA_VERSION = 1;
-export const CURRENT_WORK_MAILBOX_SCHEMA_VERSION = 2;
+export const CURRENT_WORK_MAILBOX_SCHEMA_VERSION = 3;
 export const CURRENT_PUBLICATION_REFERENCE_SCHEMA_VERSION = 1;
-export const CURRENT_ROLE_AGENT_SESSION_SCHEMA_VERSION = 3;
+export const CURRENT_ROLE_AGENT_SESSION_SCHEMA_VERSION = 4;
 export const CURRENT_PENDING_WAKEUP_SCHEMA_VERSION = 1;
 const STORAGE_LOCK_DIRECTORY = ".state.lock";
 const LOCK_TIMEOUT_MS = 5_000;
@@ -118,13 +117,13 @@ export const CURRENT_STORED_TASK_SCHEMA_VERSION = 18;
  * Keep these named at the storage boundary so the upgrade record-axis map can
  * assert it is classifying the same bytes the store reads and writes.
  */
-export const CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION = 7;
+export const CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION = 8;
 /**
  * v7 combines optional Issue 04 retry/receipt fields and Issue 05 Leader
  * actionability fields. All are optional, so the v6→v7 migration is a
  * version-only rewrite.
  */
-export const CURRENT_AGENT_RUN_SCHEMA_VERSION = 9;
+export const CURRENT_AGENT_RUN_SCHEMA_VERSION = 10;
 export const CURRENT_INTEGRATION_QUEUE_SCHEMA_VERSION = 1;
 export class FileTaskStore {
     rootDir;
@@ -991,29 +990,6 @@ export class FileTaskStore {
     }
     getAgentRun(taskId, id) { return optional(this.#state().tasks[taskId]?.agentRuns[id]); }
     listAgentRuns(taskId) { return values(this.#requireTask(taskId).agentRuns, "id"); }
-    listPendingProviderRetries(taskIds) {
-        // The legacy File store can answer the empty case without a scan fallback.
-        // If durable retry state exists, the db-only capability must fail closed
-        // instead of silently losing the Controller's wake deadline.
-        const tasks = taskIds === undefined
-            ? this.listTasks()
-            : [...new Set(taskIds)].sort(numericCompare).flatMap((taskId) => {
-                const task = this.getTask(taskId);
-                return task === null ? [] : [task];
-            });
-        for (const task of tasks) {
-            if (task.status !== "active")
-                continue;
-            for (const run of this.listAgentRuns(task.id)) {
-                if (run.status === "active"
-                    && run.providerRetry !== undefined
-                    && providerRetryWakeAt(run.providerRetry) !== null) {
-                    throw new StorageRecordError("Provider retry in place requires the SQLite backend; run `yui update` to migrate this Home.");
-                }
-            }
-        }
-        return [];
-    }
     saveAgentRun(run) {
         const stored = identified(run, CURRENT_AGENT_RUN_SCHEMA_VERSION, "id", run.id, "Agent run");
         validateAgentRun(stored);
@@ -2498,10 +2474,6 @@ export function validateYuiConfig(config) {
         resolveResourcesGcMode(config.resourcesGcMode);
         resolveResourcesGcAutoQuarantine(config.resourcesGcAutoQuarantine);
         resolveResourcesQuarantineTtlHours(config.resourcesQuarantineTtlHours);
-        resolveProviderRetryMode(config.providerRetryMode);
-        resolveProviderRetryAdapters(config.providerRetryAdapters);
-        resolveProviderRetryDelaysSeconds(config.providerRetryDelaysSeconds);
-        resolveProviderRetryMaxWindowSeconds(config.providerRetryMaxWindowSeconds);
         resolveRuntimeHealth(config.runtimeHealth);
         resolveControllerTaskConcurrency(config.controllerTaskConcurrency);
         resolveAgentLaunchInactivityTimeoutSeconds(config.agentLaunchInactivityTimeoutSeconds);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.13.8",
+  "version": "0.13.9",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -122,8 +122,8 @@ or yield merely to preserve that native wait.
 Before the first durable Leader action, Yui observes fresh native generations
 that produce no WorkItem, Review, Integration, or Leader-attributed durable
 event. Two such generations create a non-blocking orchestration advisory for
-Leader and Operator judgment; they do not fail the Role, reduce the configured
-Provider retry policy, or prevent another useful generation. Read the evidence
+Leader and Operator judgment; they do not fail the Role or prevent another
+useful generation. Read the evidence
 before retrying, then choose whether to continue, change the configured Leader,
 or perform direct maintenance without manufacturing protocol records merely to
 silence the advisory.
@@ -703,13 +703,35 @@ newer WorkItem. If the original execution Session cannot be resumed, surface
 the recovery decision to the user; do not silently discard its context by
 creating a replacement.
 
-If a native Role Session disappears, run `yui task reconcile <task-id>`,
-inspect the Run and partial work, then retry only a confirmed failed Run:
+For a Role runtime failure, inspect the exact error and runtime identities first:
 
 ```sh
-yui task run retry <run-id>
+yui task event show <task> <agent-error-event>
+yui task role session inspect <task> <role>
 ```
 
+When a Provider-accepted Turn fails with availability, `429`, capacity, or a
+recoverable transport error and the Session remains usable, retain the Run and
+Session; a recovery action adds a new Turn on that same native Session. A
+Session preparation failure or Driver rejection before input acceptance fails
+the exact Run once; inspect its error and explicitly retry that failed Run when
+another attempt is useful. Core will not redispatch it on a scheduler tick.
+
+If the Driver proves that the Session cannot continue, settle or retire the
+exact active Run, stop only that Role Session, then retry the failed Run so the
+next dispatch starts a new Session:
+
+```sh
+yui task role session stop <task> <role> --reason "<error decision>"
+yui task run retry <task>/<failed-run>
+```
+
+The new Run context contains the prior Agent, adapter, Run, Host activation,
+native Session/Turn identities, and complete raw error through the referenced
+Task event. Inspect recent `runtime.agent-error` events before another fresh
+Session; after repeated fresh-Session failures, report the evidence and bounded
+options to the user instead of inventing another automatic loop.
+
 ## Request a decision
 
 When a real user choice, new authority, or unavailable external fact is
@@ -789,8 +811,8 @@ yui task complete <task-id> --summary "<outcome, validation, and remaining risks
 
 Retire obsolete WorkItems with `yui task work retire <task>/<work> --summary
 "..."`, optionally using `--replacement`. If the current Provider Conversation
-cannot continue, request a bounded switch with
-`yui task role session switch <task> <role> --reason "..."`; the current
-Conversation remains authoritative until Yui safely binds the replacement. Archiving is a
+cannot continue, settle its Run and stop the exact idle Session with
+`yui task role session stop`; the next explicit Run dispatch creates the
+replacement. Archiving is a
 separate global Operator lifecycle action. It performs the final Task-owned
 runtime and clean-worktree teardown, including this Leader.

package/skills/yui-operator/SKILL.md

@@ -349,12 +349,20 @@ the workflow without claiming that version was delivered.
   treat it as a permission boundary. The Operator may make code, semantic,
   requirement, acceptance, recovery, and integration decisions and must leave
   the real actor and rationale in durable Task state.
-- Reconcile a disappeared native Session with `task reconcile`; inspect the Run
-  before retrying a confirmed failure.
-- If the current Provider Conversation cannot continue, use
-  `yui task role session switch <task> <role> --reason "..."`. The request is
-  audited, and Yui keeps the old Conversation authoritative until the exact
-  replacement bind succeeds; never reconstruct identities from terminal text.
+- Inspect `runtime.agent-error` and `yui task role session inspect` before a
+  recovery. When a Provider-accepted Turn fails with availability, `429`,
+  capacity, or a recoverable transport error and the Session remains usable,
+  add a new Turn to that Session. A Session preparation failure or Driver
+  rejection before input acceptance fails the exact Run once; explicitly retry
+  that failed Run when another attempt is useful. Core does not redispatch it
+  on a scheduler tick. If the Driver proves the Session cannot continue, settle
+  or retire its exact Run, stop that one idle Session with `yui task role
+  session stop <task> <role> --reason "..."`, then retry the failed Run. The
+  replacement Run receives the old Agent, adapter, Run, Host, Session, Turn,
+  and complete raw-error facts through Task context.
+- Inspect recent errors before creating another fresh Session. After repeated
+  fresh-Session failures, summarize the evidence and bounded options to the
+  user; do not hide them behind an automatic replacement counter or loop.
 - Retry only an explicitly failed recovery Job.
 - When a Leader first-progress advisory is reported, inspect its native
   generations and absence of durable progress. It is cost evidence rather than

package/skills/yui-runtime/SKILL.md

@@ -61,7 +61,9 @@ supported checkpoint/yield command as the final control-plane action, then stop
 immediately. If that direct command is denied or stale, report the blocker once
 and stop; do not wrap, retry, broaden permissions, or target another Run.
 
-For a transient Provider retry Envelope, continue the failed Turn in the same
-native Session. Do not replay the original Assignment or reload unrelated Task
-content. Process/child replacement does not by itself authorize a new Yui
-generation or native conversation.
+After a failed Provider Turn, read the referenced `runtime.agent-error` fact.
+The failed Turn is immutable; a recovery is always a new Turn. Continue on the
+same native Session when it remains recoverable, and load only the current Run
+delta instead of replaying its original Assignment. A new Host process does not
+imply a new Session, and a new Session must never be substituted silently for
+the persisted native Session id.

package/dist/lifecycle/providerErrorClass.js

@@ -1,152 +0,0 @@
-/**
- * Issue 04 — Provider error classification.
- *
- * Provider failures arrive at the driver boundary as opaque free text (Claude
- * StopFailure `error`/`errorDetails`, Codex turn-completion summaries). Each
- * driver parses its own Provider's format into a structured
- * {@link ProviderErrorCode} at the driver boundary. This module maps those
- * codes to provider-neutral error classes by lookup, falling back to text
- * matching only when the driver could not produce a structured code.
- *
- * The retry-in-place coordinator needs a stable, provider-neutral error class
- * before it can decide whether the original Session may be retried.
- *
- * Classes (Issue 04 §2):
- * - `transient-provider`   — 500/502/504, connection reset, backend capacity;
- *                            the original Session is retried in place.
- * - `transport-uncertain`  — the request may have been accepted but the
- *                            response was lost; native facts are consulted
- *                            before any resend.
- * - `policy-denied`        — cyber_policy / permission boundary; never retried
- *                            automatically, never worked around by switching
- *                            Session or widening permission.
- * - `session-dead`         — the process/tmux/native identity is gone; in-place
- *                            retry stops and a replacement blocker is raised.
- * - `invalid-request`      — deterministic parameter/protocol error; fail fast,
- *                            never call the Provider again.
- * - `unclassified`         — no conservative match; behaves like
- *                            `invalid-request` for retry purposes (old
- *                            terminalize-immediately behavior) while remaining
- *                            observable in shadow metrics.
- */
-import { PROVIDER_ERROR_CODE_CLASS } from "../runtime/providerErrorCodes.js";
-/** Classes for which the original Session may be retried in place. */
-export const RETRYABLE_PROVIDER_ERROR_CLASSES = [
-    "transient-provider",
-    "transport-uncertain"
-];
-export function isRetryableProviderErrorClass(errorClass) {
-    return RETRYABLE_PROVIDER_ERROR_CLASSES.includes(errorClass);
-}
-/**
- * Ordered pattern tables. The first class whose pattern matches wins, so the
- * table order is the precedence order. Patterns are matched case-insensitively
- * against the concatenation of every available text field.
- */
-const SESSION_DEAD_PATTERNS = [
-    { pattern: /session not found/iu, label: "session-not-found" },
-    { pattern: /no such (session|thread)/iu, label: "no-such-session" },
-    { pattern: /thread not found/iu, label: "thread-not-found" },
-    { pattern: /session (has )?expired/iu, label: "session-expired" },
-    { pattern: /session (has )?ended/iu, label: "session-ended" },
-    { pattern: /session (is )?dead/iu, label: "session-dead" },
-    { pattern: /session terminated/iu, label: "session-terminated" },
-];
-const CONTEXT_CAPACITY_PATTERNS = [
-    { pattern: /maximum context length/iu, label: "maximum-context-length" },
-    { pattern: /context length exceeded/iu, label: "context-length-exceeded" },
-    { pattern: /context window (is )?(full|exceeded)/iu, label: "context-window-exceeded" },
-    { pattern: /prompt (is )?too long/iu, label: "prompt-too-long" },
-    { pattern: /too many tokens/iu, label: "too-many-tokens" }
-];
-const POLICY_DENIED_PATTERNS = [
-    { pattern: /cyber[_-]?policy/iu, label: "cyber-policy" },
-    { pattern: /policy[_-]?violation/iu, label: "policy-violation" },
-    { pattern: /usage[_-]?policy/iu, label: "usage-policy" },
-    { pattern: /content[_-]?policy/iu, label: "content-policy" },
-    { pattern: /safety[_-]?policy/iu, label: "safety-policy" },
-    { pattern: /policy denial/iu, label: "policy-denial" }
-];
-const INVALID_REQUEST_PATTERNS = [
-    { pattern: /invalid[_-]?request/iu, label: "invalid-request" },
-    { pattern: /validation error/iu, label: "validation-error" },
-    { pattern: /bad request/iu, label: "bad-request" },
-    { pattern: /\b400\b/u, label: "http-400" },
-    { pattern: /unknown (flag|tool|argument)/iu, label: "unknown-argument" },
-    { pattern: /unexpected argument/iu, label: "unexpected-argument" },
-    { pattern: /invalid schema/iu, label: "invalid-schema" }
-];
-const TRANSIENT_PROVIDER_PATTERNS = [
-    { pattern: /\b50[024]\b/u, label: "http-5xx" },
-    { pattern: /server[\s_-]?error/iu, label: "server-error" },
-    { pattern: /internal server error/iu, label: "internal-server-error" },
-    // HTTP/2 RST_STREAM / gRPC status carried by Claude Code and Codex streams
-    // (Task-27: "stream error: stream ID …; INTERNAL_ERROR; received from peer").
-    { pattern: /\binternal[\s_-]?error\b/iu, label: "internal-error" },
-    { pattern: /connection lost/iu, label: "connection-lost" },
-    { pattern: /connection reset/iu, label: "connection-reset" },
-    { pattern: /econnreset/iu, label: "econnreset" },
-    { pattern: /socket hang up/iu, label: "socket-hang-up" },
-    { pattern: /kv[_-]?cache[_-]?allocate[_-]?failed/iu, label: "kv-cache-allocate-failed" },
-    { pattern: /overloaded/iu, label: "overloaded" },
-    { pattern: /\b429\b/u, label: "http-429" },
-    { pattern: /rate[_-]?limit/iu, label: "rate-limit" },
-    { pattern: /upstream/iu, label: "upstream" },
-    { pattern: /bad gateway/iu, label: "bad-gateway" },
-    { pattern: /gateway timeout/iu, label: "gateway-timeout" },
-    { pattern: /service unavailable/iu, label: "service-unavailable" },
-    { pattern: /temporarily unavailable/iu, label: "temporarily-unavailable" },
-    { pattern: /try again/iu, label: "try-again" }
-];
-const TRANSPORT_UNCERTAIN_PATTERNS = [
-    { pattern: /timed?[ -]?out/iu, label: "timeout" },
-    { pattern: /etimedout/iu, label: "etimedout" },
-    { pattern: /response lost/iu, label: "response-lost" },
-    { pattern: /lost response/iu, label: "lost-response" },
-    // A stream-level failure means the response may have been cut mid-turn;
-    // the retry path consults durable completion facts before any resend.
-    { pattern: /stream error/iu, label: "stream-error" },
-    { pattern: /stream interrupted/iu, label: "stream-interrupted" },
-    { pattern: /interrupted function/iu, label: "interrupted-function" },
-    { pattern: /controller timeout/iu, label: "controller-timeout" },
-    { pattern: /delivery (unconfirmed|uncertain|not confirmed)/iu, label: "delivery-unconfirmed" },
-    { pattern: /unconfirmed delivery/iu, label: "unconfirmed-delivery" },
-    { pattern: /no response/iu, label: "no-response" }
-];
-const CLASS_TABLE = [
-    { errorClass: "session-dead", patterns: SESSION_DEAD_PATTERNS },
-    { errorClass: "policy-denied", patterns: POLICY_DENIED_PATTERNS },
-    { errorClass: "context-capacity", patterns: CONTEXT_CAPACITY_PATTERNS },
-    { errorClass: "invalid-request", patterns: INVALID_REQUEST_PATTERNS },
-    { errorClass: "transient-provider", patterns: TRANSIENT_PROVIDER_PATTERNS },
-    { errorClass: "transport-uncertain", patterns: TRANSPORT_UNCERTAIN_PATTERNS }
-];
-/**
- * Classifies one provider failure. When the driver produced a structured
- * {@link ProviderErrorCode}, the class is looked up directly. Otherwise the
- * raw text fields are matched against the fallback pattern tables. Every
- * available text field is concatenated so a class can be recognized
- * regardless of which field carried it.
- */
-export function classifyProviderError(input) {
-    // Structured path: the driver already parsed the Provider's error format.
-    if (input.errorCode !== undefined) {
-        const errorClass = PROVIDER_ERROR_CODE_CLASS[input.errorCode];
-        if (errorClass !== undefined) {
-            return { errorClass, matched: input.errorCode, basis: "structured" };
-        }
-    }
-    // Text fallback: for drivers that cannot yet produce a structured code.
-    const text = [input.error, input.errorDetails, input.summary]
-        .filter((value) => typeof value === "string" && value.length > 0)
-        .join("\n");
-    if (text.length === 0)
-        return { errorClass: "unclassified", matched: "none", basis: "text" };
-    for (const { errorClass, patterns } of CLASS_TABLE) {
-        for (const { pattern, label } of patterns) {
-            if (pattern.test(text))
-                return { errorClass, matched: label, basis: "text" };
-        }
-    }
-    return { errorClass: "unclassified", matched: "none", basis: "text" };
-}

package/dist/run/providerRetry.js

@@ -1,226 +0,0 @@
-import { createHash } from "node:crypto";
-import { DEFAULT_PROVIDER_RETRY_DELAYS_SECONDS, DEFAULT_PROVIDER_RETRY_MAX_WINDOW_SECONDS, MAX_PROVIDER_RETRY_ATTEMPTS } from "../config/yuiConfig.js";
-import { requireIdentity, requireText, requireTimestamp } from "../domain/validation.js";
-export const PROVIDER_RETRY_DELAYS_MS = Object.freeze(DEFAULT_PROVIDER_RETRY_DELAYS_SECONDS.map((seconds) => seconds * 1_000));
-export const PROVIDER_RETRY_EPISODE_WINDOW_MS = DEFAULT_PROVIDER_RETRY_MAX_WINDOW_SECONDS * 1_000;
-export function nextProviderRetryDelayMs(retryIndex, delaysMs = PROVIDER_RETRY_DELAYS_MS) {
-    if (!Number.isSafeInteger(retryIndex)
-        || retryIndex < 1
-        || retryIndex > delaysMs.length) {
-        throw new Error(`Provider retry index is out of range: ${String(retryIndex)}.`);
-    }
-    return delaysMs[retryIndex - 1];
-}
-/**
- * True when the retry lineage has used its total wall-clock budget. The
- * budget is measured from the first classified failure, so repeated failures
- * never extend it.
- */
-export function providerRetryBudgetExhausted(value, now, maxWindowMs = PROVIDER_RETRY_EPISODE_WINDOW_MS) {
-    if (!Number.isSafeInteger(maxWindowMs) || maxWindowMs <= 0) {
-        throw new Error(`Provider retry max window must be a positive integer: ${String(maxWindowMs)}.`);
-    }
-    return Math.min(Date.parse(value.episodeDeadlineAt), Date.parse(value.firstFailureAt) + maxWindowMs) <= now.getTime();
-}
-export function validateAgentRunProviderRetry(value) {
-    if (value.schemaVersion !== 2) {
-        throw new Error("Agent run providerRetry must use schemaVersion 2.");
-    }
-    if (!["scheduled", "dispatching", "awaiting-progress", "blocked"].includes(value.state)) {
-        throw new Error("Agent run providerRetry state is invalid.");
-    }
-    requireIdentity(value.episodeId, "Agent run providerRetry episodeId");
-    requireIdentity(value.failureEventId, "Agent run providerRetry failureEventId");
-    if (value.policyVersion !== 1)
-        throw new Error("Provider retry policy version is invalid.");
-    if (!Number.isSafeInteger(value.consecutiveFailures) || value.consecutiveFailures < 1) {
-        throw new Error("Agent run providerRetry consecutiveFailures must be positive.");
-    }
-    if (!Number.isSafeInteger(value.dispatchedRetries)
-        || value.dispatchedRetries < 0
-        || value.dispatchedRetries > value.maxRetries) {
-        throw new Error("Agent run providerRetry dispatchedRetries is invalid.");
-    }
-    if (!Number.isSafeInteger(value.maxRetries)
-        || value.maxRetries < 1
-        || value.maxRetries > MAX_PROVIDER_RETRY_ATTEMPTS) {
-        throw new Error("Agent run providerRetry maxRetries is invalid.");
-    }
-    requireTimestamp(value.firstFailureAt, "Agent run providerRetry firstFailureAt");
-    requireTimestamp(value.lastFailureAt, "Agent run providerRetry lastFailureAt");
-    requireTimestamp(value.episodeDeadlineAt, "Agent run providerRetry episodeDeadlineAt");
-    if (Date.parse(value.lastFailureAt) < Date.parse(value.firstFailureAt)) {
-        throw new Error("Agent run providerRetry lastFailureAt precedes firstFailureAt.");
-    }
-    if (Date.parse(value.episodeDeadlineAt) <= Date.parse(value.firstFailureAt)) {
-        throw new Error("Agent run providerRetry deadline must follow firstFailureAt.");
-    }
-    if ((value.state === "scheduled") !== (value.nextAttemptAt !== undefined)) {
-        throw new Error("Only a scheduled providerRetry may carry nextAttemptAt.");
-    }
-    if (value.nextAttemptAt !== undefined) {
-        requireTimestamp(value.nextAttemptAt, "Agent run providerRetry nextAttemptAt");
-        if (Date.parse(value.nextAttemptAt) > Date.parse(value.episodeDeadlineAt)) {
-            throw new Error("Agent run providerRetry next attempt exceeds its episode deadline.");
-        }
-    }
-    if ((value.state === "dispatching" || value.state === "awaiting-progress")
-        !== (value.lastRetryReceiptId !== undefined)) {
-        throw new Error("An in-flight providerRetry requires one retry receipt identity.");
-    }
-    if (value.lastRetryReceiptId !== undefined) {
-        requireIdentity(value.lastRetryReceiptId, "Agent run providerRetry receipt id");
-    }
-    if (value.launchId !== undefined)
-        requireIdentity(value.launchId, "Agent run providerRetry launchId");
-    if (value.nativeSessionId !== undefined) {
-        requireIdentity(value.nativeSessionId, "Agent run providerRetry nativeSessionId");
-    }
-    if (value.failedNativeTurnId !== undefined) {
-        requireIdentity(value.failedNativeTurnId, "Agent run providerRetry failed native Turn id");
-    }
-    requireText(value.lastErrorSummary, "Agent run providerRetry lastErrorSummary");
-    return value;
-}
-/** Advance one failure episode without ever changing the native Session. */
-export function scheduleProviderRetry(previous, input, now, policy = {
-    delaysMs: PROVIDER_RETRY_DELAYS_MS,
-    maxWindowMs: PROVIDER_RETRY_EPISODE_WINDOW_MS
-}) {
-    validateRetrySchedulePolicy(policy);
-    const at = now.toISOString();
-    const firstFailureAt = previous?.firstFailureAt ?? at;
-    const episodeDeadlineAt = previous?.episodeDeadlineAt
-        ?? new Date(now.getTime() + policy.maxWindowMs).toISOString();
-    if (now.getTime() >= Date.parse(episodeDeadlineAt)) {
-        return Object.freeze({ outcome: "exhausted", reason: "window" });
-    }
-    const consecutiveFailures = (previous?.consecutiveFailures ?? 0) + 1;
-    const dispatchedRetries = previous?.dispatchedRetries ?? 0;
-    const schedule = input.scheduleNextAttempt ?? true;
-    if (schedule && dispatchedRetries >= policy.delaysMs.length) {
-        return Object.freeze({ outcome: "exhausted", reason: "attempts" });
-    }
-    const state = schedule ? "scheduled" : "blocked";
-    const retryAfterMs = input.retryAfterMs;
-    if (retryAfterMs !== undefined && (!Number.isSafeInteger(retryAfterMs) || retryAfterMs <= 0)) {
-        throw new Error("Provider retry Retry-After must be a positive safe integer.");
-    }
-    const delayMs = schedule
-        ? Math.max(nextProviderRetryDelayMs(dispatchedRetries + 1, policy.delaysMs), retryAfterMs ?? 0)
-        : undefined;
-    const nextAttemptAt = delayMs === undefined
-        ? undefined
-        : new Date(now.getTime() + delayMs).toISOString();
-    if (nextAttemptAt !== undefined && Date.parse(nextAttemptAt) > Date.parse(episodeDeadlineAt)) {
-        return Object.freeze({
-            outcome: "exhausted",
-            reason: retryAfterMs === undefined ? "window" : "retry-after-window"
-        });
-    }
-    const retry = validateAgentRunProviderRetry({
-        schemaVersion: 2,
-        episodeId: previous?.episodeId ?? createHash("sha256")
-            .update(`${firstFailureAt}\0${input.nativeSessionId ?? "unknown"}\0${input.launchId ?? "unknown"}`)
-            .digest("hex"),
-        failureEventId: requireIdentity(input.failureEventId, "Provider failure event id"),
-        policyVersion: 1,
-        state,
-        errorClass: input.errorClass,
-        consecutiveFailures,
-        dispatchedRetries,
-        maxRetries: policy.delaysMs.length,
-        firstFailureAt,
-        lastFailureAt: at,
-        episodeDeadlineAt,
-        ...(nextAttemptAt === undefined ? {} : { nextAttemptAt }),
-        ...(input.launchId === undefined ? {} : { launchId: input.launchId }),
-        ...(input.nativeSessionId === undefined ? {} : { nativeSessionId: input.nativeSessionId }),
-        ...(input.failedNativeTurnId === undefined
-            ? {}
-            : { failedNativeTurnId: input.failedNativeTurnId }),
-        lastErrorSummary: input.lastErrorSummary
-    });
-    return Object.freeze({ outcome: schedule ? "scheduled" : "blocked", retry });
-}
-function validateRetrySchedulePolicy(policy) {
-    if (!Number.isSafeInteger(policy.maxWindowMs) || policy.maxWindowMs < 1) {
-        throw new Error("Provider retry max window must be a positive safe integer.");
-    }
-    if (policy.delaysMs.length < 1 || policy.delaysMs.length > MAX_PROVIDER_RETRY_ATTEMPTS
-        || policy.delaysMs.some((delay) => !Number.isSafeInteger(delay) || delay < 1)) {
-        throw new Error(`Provider retry delay schedule must contain 1-${MAX_PROVIDER_RETRY_ATTEMPTS} positive safe integers.`);
-    }
-}
-/** Mark that one short continuation request was dispatched and now awaits any correlated progress. */
-export function prepareProviderRetryDispatch(value, receiptId, now) {
-    if (value.state !== "scheduled" || value.nextAttemptAt === undefined)
-        return value;
-    if (now.getTime() > Date.parse(value.episodeDeadlineAt)) {
-        throw new Error("Provider retry episode expired before dispatch.");
-    }
-    const { nextAttemptAt: _nextAttemptAt, ...rest } = value;
-    return validateAgentRunProviderRetry({
-        ...rest,
-        state: "dispatching",
-        lastRetryReceiptId: requireIdentity(receiptId, "Provider retry receipt id")
-    });
-}
-export function markProviderRetryDispatched(value) {
-    if (value.state !== "dispatching")
-        return value;
-    return validateAgentRunProviderRetry({
-        ...value,
-        state: "awaiting-progress",
-        dispatchedRetries: value.dispatchedRetries + 1
-    });
-}
-export function providerRetryIsDue(value, now) {
-    return value.state === "scheduled"
-        && value.nextAttemptAt !== undefined
-        && Date.parse(value.nextAttemptAt) <= now.getTime();
-}
-/**
- * Next Controller wake for an active automatic retry episode. Scheduled
- * retries wake to dispatch; an in-flight retry wakes only at the episode
- * deadline so silence cannot strand the Run forever. Blocked states are
- * intentionally excluded because they require native/user evidence rather
- * than an automatic lifecycle transition.
- */
-export function providerRetryWakeAt(value) {
-    if (value.state === "scheduled")
-        return value.nextAttemptAt ?? null;
-    if (value.state === "dispatching" || value.state === "awaiting-progress") {
-        return value.episodeDeadlineAt;
-    }
-    return null;
-}
-/** Delay a control-plane recovery gap without changing either failure counter. */
-export function deferProviderRetry(value, now) {
-    const deadline = Date.parse(value.episodeDeadlineAt);
-    if (now.getTime() >= deadline)
-        return null;
-    const { lastRetryReceiptId: _receipt, nextAttemptAt: _next, ...rest } = value;
-    return validateAgentRunProviderRetry({
-        ...rest,
-        state: "scheduled",
-        nextAttemptAt: new Date(Math.min(now.getTime() + 15_000, deadline)).toISOString()
-    });
-}
-/** Short recovery instruction; it cannot repeat the Task Assignment body. */
-export function serializeProviderRetryEnvelope(input) {
-    validateAgentRunProviderRetry(input.retry);
-    const retryOrdinal = input.retry.state === "dispatching"
-        ? input.retry.dispatchedRetries + 1
-        : input.retry.dispatchedRetries;
-    return [
-        "Yui managed in-Session continuation retry.",
-        `task=${requireIdentity(input.taskId, "Provider retry task id")} run=${requireIdentity(input.runId, "Provider retry run id")} role=${requireIdentity(input.roleName, "Provider retry role")}`,
-        `episode=${input.retry.episodeId} retry=${retryOrdinal}/${input.retry.maxRetries} receipt=${input.retry.lastRetryReceiptId ?? "pending"}`,
-        `failureEvent=${input.retry.failureEventId}`,
-        ...(input.retry.failedNativeTurnId === undefined
-            ? []
-            : [`retryOfTurn=${input.retry.failedNativeTurnId}`]),
-        "Continue the existing native conversation from its latest accepted state. Do not repeat completed work; load exact Run deltas if needed."
-    ].join("\n");
-}

package/dist/run/providerRetryConfig.js

@@ -1,27 +0,0 @@
-import { resolveProviderRetryAdapters, resolveProviderRetryDelaysSeconds, resolveProviderRetryMaxWindowSeconds, resolveProviderRetryMode } from "../config/yuiConfig.js";
-/**
- * Resolves the retry flags from the durable Yui config. Homes without the
- * fields get the safe defaults: enforce mode, all supported adapters, receipt
- * replay on, 10-minute budget.
- */
-export function providerRetryConfig(config) {
-    const mode = resolveProviderRetryMode(config.providerRetryMode);
-    const adapters = resolveProviderRetryAdapters(config.providerRetryAdapters);
-    return {
-        mode: adapters.length === 0 ? "off" : mode,
-        adapters,
-        delaysMs: resolveProviderRetryDelaysSeconds(config.providerRetryDelaysSeconds)
-            .map((seconds) => seconds * 1_000),
-        maxWindowMs: resolveProviderRetryMaxWindowSeconds(config.providerRetryMaxWindowSeconds)
-            * 1_000
-    };
-}
-/** Whether the adapter has in-place retry enabled in the given mode. */
-export function providerRetryEnabledForAdapter(config, adapterId, mode) {
-    return config.mode === mode
-        && providerRetryAdapterEnabled(config, adapterId);
-}
-/** Default admission is capability-driven, not a hard-coded Provider list. */
-export function providerRetryAdapterEnabled(config, adapterId) {
-    return config.adapters === "all-capable" || config.adapters.includes(adapterId);
-}