@zq-silk/yui 0.15.1 → 0.15.2

package/dist/cli.js

@@ -1614,7 +1614,9 @@ async function preflightManagedTaskControlPlane() {
 }
 async function preflightManagedGlobalControlPlane(digest) {
     if (process.env.YUI_SESSION_SCOPE !== "global") {
-        throw new Error("Exact Task control-plane invocation requires its frozen runtime descriptors.");
+        throw new Error("A control-plane digest was supplied outside a managed Session runtime. "
+            + "Run the command through the Role's own Session entry point, or use the "
+            + "ordinary yui command.");
     }
     if (taskFinalReviewInvocation.request !== undefined) {
         throw new Error("Task final-review contract establishment requires a verified exact Task control-plane invocation.");

package/dist/context/sessionBootstrapManifest.js

@@ -1,15 +1,23 @@
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
-import { exactControlPlaneCommandPrefix, exactControlPlaneDigest, serializeExactDescriptor } from "../runtime/exactControlPlane.js";
+import { exactControlPlaneDigest, serializeExactDescriptor } from "../runtime/exactControlPlane.js";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
 import { SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION, SESSION_CONTEXT_PROTOCOL, sessionManifestCompatibilityDigest } from "./sessionProtocolIdentity.js";
 export { SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION, SESSION_CONTEXT_PROTOCOL, sessionManifestCompatibilityDigest } from "./sessionProtocolIdentity.js";
 const ordinarySessionCli = ["#!/bin/sh", "exec yui \"$@\"", ""].join("\n");
+/**
+ * A managed Session wrapper answers exactly one question: which installation
+ * runs this command. It therefore carries only the resolved entry point, never
+ * a package or build identity. Version identity changes on every release while
+ * a Session legitimately outlives it, so embedding it here would turn an
+ * ordinary update into a broken Session.
+ */
 function renderSessionCli(controlPlane) {
     return [
         "#!/bin/sh",
-        `exec ${exactControlPlaneCommandPrefix(controlPlane)} \"$@\"`,
+        `exec ${quoteShellWord(controlPlane.executable)} `
+            + `${quoteShellWord(controlPlane.cliEntry)} \"$@\"`,
         ""
     ].join("\n");
 }
@@ -88,9 +96,10 @@ export function materializeSessionBootstrap(input) {
     const descriptorPath = resolve(join(home, "runtime", "control-plane", `${controlDigest}.json`));
     writeImmutableText(descriptorPath, `${serializeExactDescriptor(input.controlPlane)}\n`);
     // Provider command runners may rebuild PATH independently of the managed
-    // process environment. Keep the Session entry point deterministic; the
-    // existing continuity preflight accepts compatible package replacement at
-    // this path without treating package version as Session identity.
+    // process environment, so a bare `yui` could resolve to another install or
+    // Home. The wrapper pins the resolved entry point instead. Package identity
+    // stays out of it: the compatible continuity preflight and the Session's
+    // caller key already authorize the command.
     const sessionCliContent = renderSessionCli(input.controlPlane);
     const sessionCliDigest = digest(sessionCliContent);
     const sessionCliPath = resolve(join(home, "runtime", "session-cli", `yui-${sessionCliDigest}.sh`));
@@ -168,7 +177,9 @@ function quoteShellWord(value) {
 /**
  * Retargets known managed wrappers to the current resolved control plane after
  * a compatible update. Only a valid Session Manifest may nominate a wrapper,
- * and only Yui's ordinary or exact two-line wrapper shapes are changed.
+ * and only Yui's own two-line wrapper shapes are changed. A wrapper written by
+ * an earlier release may still pin a control-plane digest; retargeting it here
+ * is what removes that stale pin from a live Home.
  */
 export function refreshManagedSessionCliWrappers(homeInput, controlPlane) {
     const home = resolve(homeInput);
@@ -213,7 +224,7 @@ export function refreshManagedSessionCliWrappers(homeInput, controlPlane) {
             current += 1;
             continue;
         }
-        if (content !== ordinarySessionCli && !isExactSessionCli(content)) {
+        if (content !== ordinarySessionCli && !isManagedSessionCli(content)) {
             skipped += 1;
             continue;
         }
@@ -223,8 +234,12 @@ export function refreshManagedSessionCliWrappers(homeInput, controlPlane) {
     }
     return Object.freeze({ refreshed, current, skipped });
 }
-function isExactSessionCli(content) {
-    return /^#!\/bin\/sh\nexec [^\n]+ '--yui-control' '[a-f0-9]{64}' "\$@"\n$/u.test(content);
+/**
+ * Both wrapper shapes Yui has written: the current entry-point-only form and
+ * the earlier form that also pinned a control-plane digest.
+ */
+function isManagedSessionCli(content) {
+    return /^#!\/bin\/sh\nexec [^\n]+(?: '--yui-control' '[a-f0-9]{64}')? "\$@"\n$/u.test(content);
 }
 function writeImmutableText(path, content) {
     writeTextFileAtomically(path, content);

package/dist/controller/jobClient.js

@@ -77,6 +77,7 @@ export function createControllerIntegrationJobPort(home, clientOptions = {}) {
             const caller = resolveJobCaller(clientOptions.environment, input.taskId);
             const { job } = await startDurableJob(home, {
                 taskId: input.taskId,
+                requestId: `integration:${input.integrationId}`,
                 owner,
                 projectId: input.projectId,
                 head: input.head,

package/dist/controller/jobControl.js

@@ -12,7 +12,10 @@ import { createHash } from "node:crypto";
 import { resolve, sep } from "node:path";
 import { acknowledgeUnknownDurableJob, createDurableJob, durableJobIdempotencyKey, isDurableJobTerminal, requestDurableJobCancel, retryDurableJobIdempotencyKey } from "../job/durableJob.js";
 import { activeLiveRoleAgentSession } from "../executor/agentExecutor.js";
+import { CallAuthority } from "../kernel/callAuthority.js";
+import { redactLaunchText } from "../runtime/launchDiagnostics.js";
 export function createDurableJobControl(store) {
+    const authority = createJobCallAuthority(store);
     return {
         startJob(params, now) {
             // rr4/finding-3: The entire create path — validation, idempotency
@@ -20,7 +23,8 @@ export function createDurableJobControl(store) {
             // between the idempotency check and the save lets a concurrent
             // startJob with the same key create a duplicate job.
             return store.transaction((tx) => {
-                validateStartParams(tx, params);
+                const context = authority.authenticate(Object.freeze({ ...params.caller }), params.taskId);
+                assertNonSecretJobInput(params);
                 const baseKey = durableJobIdempotencyKey({
                     owner: params.owner,
                     projectId: params.projectId,
@@ -29,12 +33,48 @@ export function createDurableJobControl(store) {
                     workspace: params.workspace,
                     env: params.env
                 });
-                const key = params.retryOf === undefined
+                const inputDigest = params.retryOf === undefined
                     ? baseKey
                     : retryDurableJobIdempotencyKey(baseKey, params.retryOf);
+                const requestId = params.requestId === undefined ? inputDigest
+                    : requiredId(params.requestId, "job.start requestId");
+                // An IntegrationAttempt already is a durable operation identity.
+                // Recovery by another authorized Role must find its original Job,
+                // including the window before Integration persisted the returned id.
+                if (params.owner.kind === "integration-attempt") {
+                    const integrationId = params.owner.integrationAttemptId;
+                    const owned = tx.listDurableJobs(params.taskId).filter((job) => (job.owner.kind === "integration-attempt"
+                        && job.owner.integrationAttemptId === integrationId));
+                    if (owned.length > 1) {
+                        throw jobDomainError("IntegrationAttempt has multiple Jobs; inspect its existing records.");
+                    }
+                    const original = owned[0];
+                    if (original !== undefined) {
+                        if (original.operation.inputDigest !== inputDigest
+                            || original.operation.targetId !== params.workspace) {
+                            throw jobDomainError(`Integration Job input conflicts with its original request: ${original.id}.`);
+                        }
+                        return { job: original, created: false };
+                    }
+                }
+                const key = createHash("sha256").update(JSON.stringify([
+                    context.actorId, requestId
+                ])).digest("hex");
                 const existing = tx.findDurableJobByIdempotencyKey(params.taskId, key);
-                if (existing !== null)
+                if (existing !== null) {
+                    if (existing.operation.inputDigest !== inputDigest || existing.operation.targetId !== params.workspace) {
+                        throw jobDomainError(`Job request identity conflicts with its original input: ${existing.id}.`);
+                    }
                     return { job: existing, created: false };
+                }
+                // A historical content-addressed request has no attributable caller.
+                // Do not silently execute it again under a newly attributed identity.
+                const historical = tx.findDurableJobByIdempotencyKey(params.taskId, inputDigest);
+                if (params.requestId === undefined && historical !== null) {
+                    throw jobDomainError(`Historical request already exists: ${historical.id}; inspect it or select an explicit new requestId.`);
+                }
+                authority.authorize(context, params.taskId);
+                validateStartParams(tx, params);
                 const id = tx.nextDurableJobId(params.taskId);
                 const job = createDurableJob({
                     id,
@@ -45,6 +85,10 @@ export function createDurableJobControl(store) {
                     workspace: params.workspace,
                     env: params.env,
                     steps: params.steps,
+                    operation: {
+                        requestId, inputDigest, actorId: context.actorId,
+                        authorityRef: jobAuthorityBinding(tx, params.caller.scope, params.caller.role, params.taskId)
+                    },
                     artifactsLocator: `artifacts/jobs/${params.taskId}/${id}`,
                     ...(params.retryOf === undefined ? {} : { retryOf: params.retryOf })
                 }, now);
@@ -83,6 +127,78 @@ export function createDurableJobControl(store) {
         }
     };
 }
+/** T02 ingress adapter. The existing Job boundary remains the authority and
+ * semantic writer; this does not authorize arbitrary plugin or resource work.
+ */
+export function createJobCallAuthority(store) {
+    return new CallAuthority((caller, taskId) => {
+        assertCallerAuthorized(store, caller, taskId);
+        return caller.scope === "task"
+            ? `task:${taskId}/role:${caller.role}`
+            : `global:${caller.role}`;
+    });
+}
+/** The collector does not use this gate: late results belong to the original
+ * Job even when its management binding is revoked. Only a new spawn checks it.
+ */
+export function authorizeJobStart(store, job) {
+    const taskPrefix = `task:${job.taskId}/role:`;
+    const actor = job.operation.actorId;
+    const scope = actor.startsWith(taskPrefix) ? "task" : actor.startsWith("global:") ? "global" : undefined;
+    if (scope === undefined)
+        throw jobDomainError("Job caller binding is unavailable; no execution was started.");
+    const role = actor.slice(scope === "task" ? taskPrefix.length : "global:".length);
+    if (jobAuthorityBinding(store, scope, role, job.taskId) !== job.operation.authorityRef) {
+        throw jobDomainError("Job caller binding was revoked; no execution was started.");
+    }
+    validateJobTarget(store, job);
+}
+function jobAuthorityBinding(store, scope, roleName, taskId) {
+    // A Host detach/reattach preserves the native Session and its queued work.
+    // Authenticate the live launch at ingress, but bind accepted Jobs to the
+    // caller's durable Session identity, not its disposable Host generation.
+    if (scope === "task") {
+        const role = store.getRole(taskId, roleName);
+        const sessions = store.getTaskRoleSessionSet(taskId, roleName);
+        const session = activeLiveRoleAgentSession(sessions);
+        const hash = role === null ? null : store.getJobCallerKeyHash(taskId, roleName, role.activeAgentId);
+        if (hash === null || role === null || sessions?.activeAgentId !== role.activeAgentId
+            || session === null || session.agentId !== role.activeAgentId) {
+            throw jobDomainError("Current Job caller Session is unavailable.");
+        }
+        return createHash("sha256").update(JSON.stringify([
+            hash, session.agentId, session.adapterId, session.nativeSessionId
+        ])).digest("hex");
+    }
+    const role = store.getGlobalRole(roleName);
+    const session = activeLiveRoleAgentSession(store.getGlobalRoleSessionSet(roleName));
+    if (role === null || session === null)
+        throw jobDomainError("Current Job caller binding is unavailable.");
+    return createHash("sha256").update(JSON.stringify([
+        role.activeAgentId, session.agentId, session.nativeSessionId
+    ])).digest("hex");
+}
+function assertNonSecretJobInput(params) {
+    // Existing Jobs persist commands and environments. This boundary accepts
+    // non-secret executable specifications only; credential resolution is not a
+    // Job feature. Never hash a known secret then call the digest sanitized.
+    const secretKey = /api[_-]?key|private[_-]?key|token|secret|password|passwd|cookie|credential|authorization/i;
+    for (const env of [params.env, ...params.steps.map((step) => step.env ?? {})]) {
+        if (Object.keys(env).some((key) => secretKey.test(key))) {
+            throw jobDomainError("Job input cannot persist credentials; use a non-secret specification.");
+        }
+    }
+    const input = JSON.stringify({
+        env: params.env, steps: params.steps, requestId: params.requestId
+    });
+    // Reject recognizable key material regardless of the parameter name, and
+    // URL userinfo before either hashing or persisting the specification.
+    const privateKey = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/;
+    const urlCredential = /[a-z][a-z0-9+.-]*:\/\/[^\s/"<>]+:[^\s/"<>]*@/i;
+    if (privateKey.test(input) || urlCredential.test(input) || redactLaunchText(input) !== input) {
+        throw jobDomainError("Job input cannot persist credentials; use a non-secret specification.");
+    }
+}
 /**
  * Persisted-boundary validation for `job.start`. The owner must resolve to a
  * live Task record, the Task must be active, the workspace must be the exact
@@ -94,6 +210,10 @@ export function createDurableJobControl(store) {
  * managed workspace, verifies write access, and requires an active Task.
  */
 function validateStartParams(store, params) {
+    validateJobTarget(store, params);
+    assertCallerAuthorized(store, params.caller, params.taskId);
+}
+function validateJobTarget(store, params) {
     // The Task must be active — a terminal Task cannot run jobs.
     const task = store.getTask(params.taskId);
     if (task === null) {
@@ -179,10 +299,6 @@ function validateStartParams(store, params) {
             throw jobDomainError(`Retry original job must be terminal: ${params.retryOf} is ${original.status}.`);
         }
     }
-    // rr8: Bind the declared owner to the caller's managed identity. A
-    // Role is not an authorization boundary. Scope and exact managed Session
-    // identity are verified independently below.
-    assertCallerAuthorized(store, params.caller, params.taskId);
 }
 /**
  * rr8/rr12: Bind the declared job owner to the caller's managed identity. The
@@ -262,9 +378,17 @@ function assertCallerAuthorized(store, caller, taskId) {
     // frozen environment, and its own claim would add nothing the store does
     // not already own.
     const run = caller.role === undefined ? null : store.getActiveTurn(taskId, caller.role);
-    if (run === null || run.status !== "active") {
+    const currentRole = caller.role === undefined ? null : store.getRole(taskId, caller.role);
+    if (run === null || run.status !== "active" || currentRole === null
+        || currentRole.activeAgentId !== run.effective.agentId) {
         throw jobControlError("UNAUTHORIZED", "A managed Task Session's Role is not bound to an active Turn.");
     }
+    const sessions = store.getTaskRoleSessionSet(taskId, currentRole.name);
+    const session = activeLiveRoleAgentSession(sessions);
+    if (sessions?.activeAgentId !== currentRole.activeAgentId || session === null
+        || session.agentId !== run.effective.agentId || session.adapterId !== run.effective.adapterId) {
+        throw jobControlError("UNAUTHORIZED", "DurableJob control requires the current live Task Session.");
+    }
     // rr13: Verify the non-replayable per-Session caller key. The key is injected
     // at native Session launch and never persisted in plaintext; only its SHA-256
     // hash is durable. A client with database read access can see the hash but cannot
@@ -272,7 +396,7 @@ function assertCallerAuthorized(store, caller, taskId) {
     if (caller.callerKey === undefined) {
         throw jobControlError("UNAUTHORIZED", "job.start/job.cancel requires a managed Session caller key.");
     }
-    const expectedHash = store.getJobCallerKeyHash(taskId, caller.role ?? "", run.effective.agentId);
+    const expectedHash = store.getJobCallerKeyHash(taskId, caller.role ?? "", currentRole.activeAgentId);
     if (expectedHash === null) {
         throw jobControlError("UNAUTHORIZED", "The managed Session has no durable caller key; it must be relaunched.");
     }
@@ -337,7 +461,7 @@ export function parseDurableJobStartParams(value) {
     const record = value;
     const allowed = new Set([
         "taskId", "owner", "projectId", "head", "workspace", "env", "steps",
-        "retryOf", "caller"
+        "retryOf", "caller", "requestId"
     ]);
     for (const key of Object.keys(record)) {
         if (!allowed.has(key)) {
@@ -367,6 +491,9 @@ export function parseDurableJobStartParams(value) {
         env,
         steps,
         caller,
+        ...(record.requestId === undefined ? {} : {
+            requestId: requiredId(record.requestId, "job.start requestId")
+        }),
         ...(retryOf === undefined ? {} : { retryOf })
     };
 }

package/dist/controller/jobSupervisor.js

@@ -16,9 +16,10 @@ import { chmodSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, st
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
-import { cancelQueuedDurableJob, completeDurableJob, isDurableJobTerminal, markDurableJobUnknown, markDurableJobWakeupNotified, startDurableJob, touchDurableJobHeartbeat } from "../job/durableJob.js";
+import { cancelQueuedDurableJob, completeDurableJob, isDurableJobTerminal, markDurableJobUnknown, markDurableJobWakeupNotified, rejectQueuedDurableJob, startDurableJob, touchDurableJobHeartbeat } from "../job/durableJob.js";
 import { readLinuxProcessStartIdentity } from "./domainIdentity.js";
 import { wakeReason } from "../scheduler/wakeReason.js";
+import { recordOperationEvidence } from "../kernel/operationFacts.js";
 const DEFAULT_STEP_TIMEOUT_MS = 30 * 60_000;
 const HEARTBEAT_STALE_MS = 2 * 60_000;
 const SIGKILL_GRACE_MS = 30_000;
@@ -29,6 +30,7 @@ export class DurableJobSupervisor {
     #terminalEvents;
     #wake;
     #onError;
+    #authorizeStart;
     // f5: Composite key (taskId/jobId) because job IDs are Task-local — every
     // Task has a job-1, so a Task-local key would cross-kill healthy runners.
     #sigkillAt = new Map();
@@ -39,6 +41,7 @@ export class DurableJobSupervisor {
         this.#terminalEvents = options.terminalEvents;
         this.#wake = options.wake ?? (() => undefined);
         this.#onError = options.onError ?? (() => undefined);
+        this.#authorizeStart = options.authorizeStart;
     }
     reconcile(now) {
         const jobs = this.#store.listActiveDurableJobs();
@@ -67,90 +70,42 @@ export class DurableJobSupervisor {
     #sigkillKey(job) {
         return `${job.taskId}/${job.id}`;
     }
-    /**
-     * Reconcile a queued job.
-     *
-     * f4: A queued job with a cancel request converges to `cancelled` without
-     * spawning a runner — but only if no runner was already spawned. If a
-     * start marker proves a runner exists (real pid, or pending marker +
-     * ready.json), the job is adopted to running first; the running-cancel
-     * path then fences and signals it. Cancelling a spawned job from queued
-     * would orphan the runner.
-     *
-     * f3: The normal path writes a pending start marker, spawns the runner, and
-     * lets the runner's own `ready.json` handshake prove it started before any
-     * side effect. On recovery the supervisor adopts queued→running first
-     * (harvest/unknown require `running`), then harvests exit or handles a
-     * dead process — never calling complete/unknown directly from `queued`.
-     */
+    /** Adopt observed execution, preserve unknown, or start an unattempted request. */
     #reconcileQueued(job, now) {
         const marker = this.#artifacts.readStartMarker(job.taskId, job.id);
-        // f1/rr5: A cancel request on a queued job must not orphan an already-
-        // spawned runner. Check spawn evidence before converging to cancelled.
+        const spawned = this.#spawnedProcessFromEvidence(job, marker);
         if (job.cancelRequestedAt !== undefined) {
             this.#artifacts.writeCancelFence(job.taskId, job.id);
-            const spawnedProcess = this.#spawnedProcessFromEvidence(job, marker);
-            if (spawnedProcess !== null) {
-                // f1/rr5: A runner was spawned. Signal it in THIS reconcile pass —
-                // not adopt to running and wait for the next pass. The signal is
-                // sent before the adoption so the runner begins draining
-                // immediately; the adoption preserves evidence (exit.json / dead-
-                // process handling converges the job on this or the next pass).
-                this.#process.signalIfOwned(spawnedProcess.pid, spawnedProcess.startIdentity, "SIGTERM");
-                this.#adoptAndContinue(job, spawnedProcess, now);
-                return;
+            if (spawned !== null) {
+                this.#process.signalIfOwned(spawned.pid, spawned.startIdentity, "SIGTERM");
             }
-            if (marker !== null) {
-                // f1/rr5: Ambiguous spawn — a pending marker exists but ready.json
-                // does not. The runner may be starting (slow to write ready.json)
-                // or may never have started. Do NOT terminalize without signaling.
-                // Re-spawn: the new runner writes ready.json, observes the cancel
-                // fence, and exits as cancelled without side effects. The next
-                // pass harvests the cancelled exit.json.
-                this.#startJob(job, now);
-                return;
-            }
-            // No spawn attempted — safe to cancel from queued.
-            // f6/rr5: The terminal transition and the Leader wakeup must be
-            // atomic (same transaction). Compose cancel + wakeupNotified and
-            // pass the wakeup param so the adapter enqueues the Leader mailbox
-            // entry in the same transaction.
-            const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(cancelQueuedDurableJob(current, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
-            this.#deliverTerminalEvent(terminal);
+        }
+        if (spawned !== null) {
+            this.#adoptAndContinue(job, spawned, now);
             return;
         }
-        if (marker === null) {
-            this.#startJob(job, now);
+        if (job.operation.effect !== "none") {
+            // A send intent was committed but no acceptance can be proved. Absence
+            // of a file is not proof of no external effect. Never respawn unknown.
+            const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(markDurableJobUnknown(current, "runner acceptance is unknown; inspect the original request", current.checkpoint?.completedSteps ?? [], now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+            this.#deliverTerminalEvent(terminal);
             return;
         }
-        // f3: A pending marker means the Controller died after writing the marker
-        // but before the runner proved it started. Check the runner's ready file.
-        if (marker.startIdentity === "pending") {
-            const ready = this.#artifacts.readReadyFile(job.taskId, job.id);
-            if (ready === null) {
-                // The runner either never started or died before writing ready.
-                // No side effects could have occurred — re-spawn safely.
-                this.#startJob(job, now);
-                return;
-            }
-            // Runner proved it started: adopt and continue from evidence.
-            // rr4/finding-4: Use the runner's own startIdentity from ready.json,
-            // not a fresh /proc read (which could return a reused PID's identity).
-            this.#adoptAndContinue(job, { pid: ready.pid, startIdentity: ready.startIdentity }, now);
+        if (job.cancelRequestedAt !== undefined) {
+            // No effect attempted. Cancellation and its wake commit atomically.
+            const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(cancelQueuedDurableJob(current, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+            this.#deliverTerminalEvent(terminal);
             return;
         }
-        // Marker with a real pid (already spawned). Adopt and continue.
-        // f3/rr5: ready.json is authoritative when both exist.
-        const spawned = this.#spawnedProcessFromEvidence(job, marker);
-        this.#adoptAndContinue(job, spawned ?? { pid: marker.pid, startIdentity: marker.startIdentity }, now);
+        if (marker !== null)
+            throw new Error("Job start marker contradicts its unattempted operation.");
+        this.#startJob(job, now);
     }
     /**
      * Determine whether a runner was spawned for this job, based on durable
      * evidence. Returns the process identity if spawned, null otherwise.
      */
     #spawnedProcessFromEvidence(job, marker) {
-        if (marker === null)
-            return null;
         // f3/rr5: ready.json is the runner's own record of its actual OS start.
         // When both the start marker and ready.json exist, ready.json is
         // authoritative: the marker is the Controller's declared intent (written
@@ -161,7 +116,7 @@ export class DurableJobSupervisor {
         if (ready !== null) {
             return { pid: ready.pid, startIdentity: ready.startIdentity };
         }
-        if (marker.startIdentity !== "pending") {
+        if (marker !== null && marker.startIdentity !== "pending") {
             // Real start marker with a pid — the runner was spawned.
             return { pid: marker.pid, startIdentity: marker.startIdentity };
         }
@@ -170,8 +125,7 @@ export class DurableJobSupervisor {
     }
     /**
      * f3: Adopt a queued job to running, then harvest exit or handle a dead
-     * process. This is the only legal path from queued to a terminal state —
-     * complete/unknown require `running`.
+     * process. A request with unobserved acceptance instead stays unknown.
      */
     #adoptAndContinue(job, process, now) {
         this.#store.transitionDurableJob(job.taskId, job.id, (current) => startDurableJob(current, process, now), now);
@@ -190,6 +144,13 @@ export class DurableJobSupervisor {
         }
     }
     #startJob(job, now) {
+        try {
+            this.#authorizeStart(job);
+        }
+        catch (error) {
+            this.#rejectStart(job, error, now);
+            return;
+        }
         const spec = {
             jobId: job.id,
             taskId: job.taskId,
@@ -201,9 +162,28 @@ export class DurableJobSupervisor {
             head: job.head
         };
         const specPath = this.#artifacts.writeSpec(job.taskId, job.id, spec);
-        // f3: Write a pending start marker BEFORE spawning. If the Controller dies
-        // between this write and the spawn, the next pass sees the pending marker
-        // and re-spawns safely (no side effects without a ready file).
+        let attempted;
+        try {
+            attempted = this.#store.transitionDurableJob(job.taskId, job.id, (current) => {
+                if (current.status !== "queued" || current.operation.effect !== "none") {
+                    throw new Error("Job already attempted; inspect the original request.");
+                }
+                this.#authorizeStart(current);
+                return {
+                    ...current,
+                    operation: recordOperationEvidence(current.operation, { effect: "possible" }),
+                    updatedAt: now.toISOString()
+                };
+            }, now);
+        }
+        catch (error) {
+            this.#rejectStart(job, error, now);
+            return;
+        }
+        if (attempted === null)
+            return;
+        // Both the request and possible-effect boundary precede spawn. A missing
+        // acceptance after this point is unknown, never permission to respawn.
         this.#artifacts.writeStartMarker(job.taskId, job.id, {
             pid: 0,
             startIdentity: "pending",
@@ -229,6 +209,14 @@ export class DurableJobSupervisor {
         spawned.onExit?.(() => this.#wake(job.taskId));
         this.#wake(job.taskId);
     }
+    #rejectStart(job, error, now) {
+        // Only an explicit domain refusal is a known failure. Storage/CAS/runtime
+        // errors still propagate; never infer rejection from an unavailable read.
+        if (!(error instanceof Error) || error.name !== "CoreJobError")
+            throw error;
+        const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(rejectQueuedDurableJob(current, error.message, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+        this.#deliverTerminalEvent(terminal);
+    }
     #superviseRunning(job, now) {
         // 1. Harvest exit.json if present.
         const exit = this.#artifacts.readExitJson(job.taskId, job.id);
@@ -278,6 +266,19 @@ export class DurableJobSupervisor {
         }
     }
     #harvestExit(job, exit, now) {
+        // Persist the original receipt locator before interpreting its output.
+        // A bad schema cannot erase evidence of an already executed runner.
+        this.#store.transitionDurableJob(job.taskId, job.id, (current) => ({
+            ...current,
+            operation: recordOperationEvidence(current.operation, {
+                effect: "confirmed",
+                receiptRefs: [`${current.artifactsLocator}/exit.json`],
+                partialResultRefs: Array.isArray(exit.steps)
+                    ? exit.steps.flatMap((step) => typeof step?.logPath === "string" && step.logPath.trim()
+                        ? [step.logPath] : []) : []
+            }),
+            updatedAt: now.toISOString()
+        }), now);
         const result = {
             outcome: exit.outcome,
             exitCode: exit.exitCode,
@@ -291,7 +292,20 @@ export class DurableJobSupervisor {
         // the adapter enqueues the Leader mailbox entry in the same transaction.
         // A separate #notifyWakeup pass would lose the wakeup if the Controller
         // died between the terminal write and the flag flip.
-        const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(completeDurableJob(current, result, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+        const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => {
+            let completed;
+            try {
+                completed = completeDurableJob(current, result, now);
+            }
+            catch {
+                completed = completeDurableJob(current, {
+                    outcome: "failed", exitCode: null, signal: null,
+                    unknownReason: "runner output is invalid; original receipt is retained",
+                    steps: []
+                }, now);
+            }
+            return markDurableJobWakeupNotified(completed, now);
+        }, now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
         this.#deliverTerminalEvent(terminal);
         this.#sigkillAt.delete(this.#sigkillKey(job));
     }

package/dist/controller/runtime.js

@@ -21,7 +21,8 @@ import { startFileTaskController } from "./controller.js";
 import { AgentHostProviderTurnFenceError, FileSchedulerStoreAdapter } from "./fileSchedulerStoreAdapter.js";
 import { openSchedulerTelemetry } from "../telemetry/telemetryWiring.js";
 import { createFileArtifactPort, createLinuxProcessPort, DurableJobSupervisor } from "./jobSupervisor.js";
-import { createDurableJobControl } from "./jobControl.js";
+import { authorizeJobStart } from "./jobControl.js";
+import { createKernelPorts } from "../kernel/kernelPorts.js";
 import { FileRuntimeEventInbox } from "./runtimeEventInbox.js";
 import { AgentRuntimeObserver } from "./agentRuntimeObserver.js";
 import { AsyncRuntimeEventProcessor, FileRuntimeEventProcessor, createAsyncRuntimeObserver, } from "./runtimeEventProcessor.js";
@@ -355,10 +356,12 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     // supervisor enqueues a durable-job-terminal event; the processor drains it
     // on the next pass, waking the Controller immediately instead of waiting for
     // the poll interval.
+    const kernel = createKernelPorts(store, createLinuxProcessPort());
     const jobSupervisor = new DurableJobSupervisor({
         store: schedulerStore,
-        process: createLinuxProcessPort(),
+        process: kernel.runner,
         artifacts: createFileArtifactPort(home),
+        authorizeStart: (job) => authorizeJobStart(store, job),
         // rr6/f1: Bounded supervision wake. The supervisor signals the Controller
         // after spawning a runner (queued→running adoption) and when a runner
         // exits (terminal harvest), so a quick job converges without waiting for
@@ -393,7 +396,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         },
         onError: options.onError
     });
-    const jobControl = createDurableJobControl(store);
+    const jobControl = kernel.jobs;
     const continuationReconciler = options.continuationMetadata === undefined
         ? undefined
         : new ProviderContinuationReconciliationService(store, schedulerStore, options.continuationMetadata);
@@ -462,6 +465,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     let resourceClose;
     const closeResources = () => {
         resourceClose ??= Promise.all([
+            kernel.close(),
             asyncStoreClient?.close() ?? Promise.resolve(),
             inventoryClient?.close() ?? Promise.resolve()
         ]).then(() => undefined);
@@ -470,6 +474,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     const closed = running.closed.then(closeResources);
     return {
         ...running,
+        kernel,
         closed,
         close: async () => {
             try {

package/dist/core/boundedRpc.js

@@ -33,7 +33,9 @@ export function serializeError(error) {
             ...(error.stack === undefined ? {} : { stack: error.stack }),
             ...("code" in error && typeof error.code === "string"
                 ? { code: error.code }
-                : {})
+                : {}),
+            ...("currentRevision" in error && typeof error.currentRevision === "number"
+                ? { currentRevision: error.currentRevision } : {})
         };
     }
     return { name: "Error", message: String(error) };

package/dist/job/durableJob.js

@@ -1,7 +1,9 @@
 import { createHash } from "node:crypto";
 import { requireIdentity, requirePositiveInteger, requireText, requireTimestamp } from "../domain/validation.js";
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
-export const CURRENT_DURABLE_JOB_SCHEMA_VERSION = 1;
+import { recordOperationEvidence, validateOperationFacts } from "../kernel/operationFacts.js";
+export const CURRENT_DURABLE_JOB_SCHEMA_VERSION = 2;
+export const JOB_RUNNER_IMPLEMENTATION = Object.freeze({ id: "yui:job-runner", generation: "1" });
 export const DURABLE_JOB_TERMINAL_STATUSES = [
     "succeeded",
     "failed",
@@ -14,7 +16,7 @@ export function isDurableJobTerminal(status) {
 }
 export function createDurableJob(input, now) {
     const timestamp = now.toISOString();
-    const idempotencyKey = input.retryOf === undefined
+    const contentKey = input.retryOf === undefined
         ? durableJobIdempotencyKey({
             owner: input.owner,
             projectId: input.projectId,
@@ -31,6 +33,10 @@ export function createDurableJob(input, now) {
             workspace: input.workspace,
             env: input.env
         }), input.retryOf);
+    const idempotencyKey = input.operation === undefined ? contentKey
+        : createHash("sha256").update(JSON.stringify([
+            input.operation.actorId, input.operation.requestId
+        ])).digest("hex");
     return validateDurableJob({
         schemaVersion: CURRENT_DURABLE_JOB_SCHEMA_VERSION,
         id: input.id,
@@ -42,6 +48,18 @@ export function createDurableJob(input, now) {
         env: { ...input.env },
         steps: input.steps.map((step) => ({ ...step })),
         idempotencyKey,
+        operation: {
+            requestId: input.operation?.requestId ?? idempotencyKey,
+            inputDigest: input.operation?.inputDigest ?? idempotencyKey,
+            actorId: input.operation?.actorId ?? "internal:job",
+            authorityRef: input.operation?.authorityRef ?? "internal:job",
+            targetId: input.workspace,
+            capability: "job.start",
+            implementation: JOB_RUNNER_IMPLEMENTATION,
+            effect: "none",
+            receiptRefs: [],
+            partialResultRefs: []
+        },
         status: "queued",
         artifactsLocator: input.artifactsLocator,
         createdAt: timestamp,
@@ -58,6 +76,10 @@ export function startDurableJob(job, process, now) {
     return validateDurableJob({
         ...job,
         status: "running",
+        operation: recordOperationEvidence(job.operation, {
+            effect: "confirmed",
+            receiptRefs: [`${job.artifactsLocator}/start.json`]
+        }),
         process: { ...process },
         startedAt: timestamp,
         heartbeatAt: timestamp,
@@ -87,20 +109,46 @@ export function completeDurableJob(job, result, now) {
     return validateDurableJob({
         ...job,
         status: result.outcome,
+        operation: recordOperationEvidence(job.operation, {
+            partialResultRefs: result.steps.map((step) => step.logPath),
+            receiptRefs: result.evidenceSource === undefined ? []
+                : [`${job.artifactsLocator}/${result.evidenceSource === "checkpoint" ? "checkpoint.json" : "exit.json"}`]
+        }),
         result: normalizeDurableJobResult(result),
         terminalAt: timestamp,
         updatedAt: timestamp
     });
 }
+/** A refused, unattempted request has a known failed outcome, not an unknown effect. */
+export function rejectQueuedDurableJob(job, reason, now) {
+    validateDurableJob(job);
+    if (job.status !== "queued" || job.operation.effect !== "none") {
+        throw new Error("Only an unattempted queued Job can be rejected.");
+    }
+    const timestamp = now.toISOString();
+    return validateDurableJob({
+        ...job,
+        status: "failed",
+        result: {
+            outcome: "failed", exitCode: null, signal: null,
+            unknownReason: requireText(reason, "DurableJob rejection reason"), steps: []
+        },
+        terminalAt: timestamp,
+        updatedAt: timestamp
+    });
+}
 export function markDurableJobUnknown(job, unknownReason, completedSteps, now) {
     validateDurableJob(job);
-    if (job.status !== "running") {
-        throw new Error(`DurableJob can only be marked unknown from running: ${job.status}.`);
+    if (job.status !== "running" && !(job.status === "queued" && job.operation.effect !== "none")) {
+        throw new Error(`DurableJob can only be marked unknown after an attempted effect: ${job.status}.`);
     }
     const timestamp = now.toISOString();
     return validateDurableJob({
         ...job,
         status: "unknown-needs-attention",
+        operation: recordOperationEvidence(job.operation, {
+            partialResultRefs: completedSteps.map((step) => step.logPath)
+        }),
         result: {
             outcome: "unknown-needs-attention",
             exitCode: null,
@@ -205,6 +253,7 @@ export function validateDurableJob(job) {
     if (job.schemaVersion !== CURRENT_DURABLE_JOB_SCHEMA_VERSION) {
         throw new Error(`DurableJob must use schemaVersion ${CURRENT_DURABLE_JOB_SCHEMA_VERSION}.`);
     }
+    validateOperationFacts(job.operation);
     validateTaskRecordReference({
         taskId: job.taskId,
         localId: job.id
@@ -326,7 +375,15 @@ export function validDurableJobTransition(before, after) {
         || before.createdAt !== after.createdAt
         || !isDeepStrictEqual(before.owner, after.owner)
         || !isDeepStrictEqual(before.env, after.env)
-        || !isDeepStrictEqual(before.steps, after.steps))
+        || !isDeepStrictEqual(before.steps, after.steps)
+        || before.operation.requestId !== after.operation.requestId
+        || before.operation.inputDigest !== after.operation.inputDigest
+        || before.operation.actorId !== after.operation.actorId
+        || before.operation.authorityRef !== after.operation.authorityRef
+        || before.operation.targetId !== after.operation.targetId
+        || before.operation.capability !== after.operation.capability
+        || !isDeepStrictEqual(before.operation.implementation, after.operation.implementation)
+        || !isDeepStrictEqual(recordOperationEvidence(before.operation, after.operation), after.operation))
         return false;
     if (isDurableJobTerminal(before.status)) {
         // A terminal job is immutable except for two one-way flags:
@@ -340,12 +397,17 @@ export function validDurableJobTransition(before, after) {
             && after.acknowledgedAt !== undefined;
         return before.status === after.status
             && isDeepStrictEqual(before.result, after.result)
+            && isDeepStrictEqual(before.operation, after.operation)
             && before.terminalAt === after.terminalAt
             && (before.wakeupNotified === after.wakeupNotified || wakeupFlip)
             && (before.acknowledgedAt === after.acknowledgedAt || acknowledgeFlip);
     }
     const allowed = {
-        queued: ["queued", "running", "cancelled"],
+        queued: [
+            "queued", "running", "cancelled", "unknown-needs-attention",
+            ...(before.operation.effect === "none" && after.operation.effect === "none"
+                ? ["failed"] : [])
+        ],
         running: [
             "running",
             "succeeded",

package/dist/kernel/callAuthority.js

@@ -0,0 +1,24 @@
+export class CallAuthority {
+    authenticateCurrent;
+    #credentials = new WeakMap();
+    constructor(authenticateCurrent) {
+        this.authenticateCurrent = authenticateCurrent;
+    }
+    authenticate(credential, targetId) {
+        const actorId = this.authenticateCurrent(credential, targetId);
+        const context = Object.freeze({ actorId, targetId });
+        this.#credentials.set(context, credential);
+        return context;
+    }
+    /** Reauthenticate at each new action; a context or implementation handle is
+     * not a permanent grant. Domain-specific authorization remains in its owner.
+     */
+    authorize(context, targetId) {
+        if (!this.#credentials.has(context) || context.targetId !== targetId) {
+            throw new Error("Untrusted or out-of-scope call context.");
+        }
+        const actorId = this.authenticateCurrent(this.#credentials.get(context), targetId);
+        if (actorId !== context.actorId)
+            throw new Error("Call authority changed.");
+    }
+}

package/dist/kernel/instanceHost.js

@@ -0,0 +1,97 @@
+export class InstanceHost {
+    #instances = new Map();
+    #closed = false;
+    attach(implementation, value, ownedDisposers = []) {
+        if (this.#closed)
+            throw new Error("Instance Host is closed.");
+        const key = implementationKey(implementation);
+        if (this.#instances.has(key))
+            throw new Error(`Implementation already attached: ${key}.`);
+        let resolve;
+        let reject;
+        const drained = new Promise((yes, no) => { resolve = yes; reject = no; });
+        // A disposer can fail before detach's caller starts awaiting the drain.
+        void drained.catch(() => undefined);
+        const ref = Object.freeze({ ...implementation });
+        this.#instances.set(key, {
+            implementation: ref, value, references: 0, detached: false,
+            disposers: [...ownedDisposers], drained, resolve, reject
+        });
+        return ref;
+    }
+    acquire(implementation) {
+        const instance = this.#instances.get(implementationKey(implementation));
+        if (this.#closed || instance === undefined || instance.detached) {
+            throw new Error("Implementation unavailable.");
+        }
+        instance.references += 1;
+        let released = false;
+        return Object.freeze({
+            implementation: instance.implementation,
+            value: instance.value,
+            release: async () => {
+                if (released)
+                    return;
+                released = true;
+                instance.references -= 1;
+                if (instance.detached && instance.references === 0)
+                    await this.#dispose(instance);
+            }
+        });
+    }
+    async use(implementation, call) {
+        const handle = this.acquire(implementation);
+        try {
+            return await call(handle.value, handle.implementation);
+        }
+        finally {
+            await handle.release();
+        }
+    }
+    /** Stops acquisition immediately. Resolves only after all calls/Sessions release. */
+    detach(implementation) {
+        const instance = this.#instances.get(implementationKey(implementation));
+        if (instance === undefined)
+            throw new Error("Implementation is not attached.");
+        instance.detached = true;
+        if (instance.references === 0)
+            void this.#dispose(instance).catch(() => undefined);
+        return instance.drained;
+    }
+    async close() {
+        this.#closed = true;
+        const results = await Promise.allSettled([...this.#instances.values()].map((instance) => this.detach(instance.implementation)));
+        const errors = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+        if (errors.length)
+            throw new AggregateError(errors, "Instance cleanup failed.");
+    }
+    #dispose(instance) {
+        instance.disposal ??= (async () => {
+            const errors = [];
+            for (const dispose of [...instance.disposers].reverse()) {
+                try {
+                    await dispose();
+                }
+                catch (error) {
+                    errors.push(error);
+                }
+            }
+            // Keep the identity reserved for this Host's lifetime, including failures.
+            // Re-attaching a generation must not resurrect an old reference.
+            instance.value = undefined;
+            instance.disposers = [];
+            if (errors.length)
+                throw new AggregateError(errors, "Instance cleanup failed.");
+        })();
+        void instance.disposal.then(instance.resolve, instance.reject);
+        return instance.disposal;
+    }
+}
+function implementationKey(ref) {
+    for (const value of [ref.id, ref.generation]) {
+        if (typeof value !== "string" || !value.trim() || value.includes("\0")) {
+            throw new Error("Implementation identity is invalid.");
+        }
+    }
+    return JSON.stringify([ref.id, ref.generation]);
+}

package/dist/kernel/kernelPorts.js

@@ -0,0 +1,44 @@
+import { createDurableJobControl } from "../controller/jobControl.js";
+import { JOB_RUNNER_IMPLEMENTATION } from "../job/durableJob.js";
+import { InstanceHost } from "./instanceHost.js";
+/** Called once by the existing Controller root. Does not open a Store, start
+ * another Controller, or provide arbitrary persistence to plugin code.
+ * T02 registers contributions on this Host and wraps this same Job control.
+ */
+export function createKernelPorts(store, runner) {
+    const host = new InstanceHost();
+    const runnerImplementation = host.attach(JOB_RUNNER_IMPLEMENTATION, runner);
+    const runnerHandle = host.acquire(runnerImplementation);
+    const jobImplementation = host.attach({ id: "yui:job-control", generation: "1" }, createDurableJobControl(store));
+    // The Controller is a long-lived consumer of this exact implementation.
+    const jobHandle = host.acquire(jobImplementation);
+    return {
+        host,
+        jobImplementation,
+        runnerImplementation,
+        runner: runnerHandle.value,
+        jobs: jobHandle.value,
+        close: async () => {
+            const drain = host.close();
+            await jobHandle.release();
+            await runnerHandle.release();
+            await drain;
+        }
+    };
+}
+/** A read model over the one Job, never separately persisted.
+ * confirmed means the selected runner was observed, not that every action
+ * performed by an arbitrary command succeeded. Inspect original step receipts.
+ */
+export function inspectJobOperation(job) {
+    return {
+        operationRef: { taskId: job.taskId, jobId: job.id },
+        ...job.operation,
+        state: job.status === "queued" ? "pending"
+            : job.status === "running" ? "running"
+                : job.status === "unknown-needs-attention" ? "unknown" : "finished",
+        outcome: job.result?.outcome,
+        result: job.result,
+        checkpoint: job.checkpoint
+    };
+}

package/dist/kernel/operationFacts.js

@@ -0,0 +1,32 @@
+export function validateOperationFacts(facts) {
+    for (const value of [
+        facts?.requestId, facts?.actorId, facts?.authorityRef, facts?.targetId, facts?.capability,
+        facts?.implementation?.id, facts?.implementation?.generation
+    ]) {
+        if (typeof value !== "string" || !value.trim() || value.includes("\0")) {
+            throw new Error("Operation identity is invalid.");
+        }
+    }
+    if (!/^[a-f0-9]{64}$/u.test(facts.inputDigest))
+        throw new Error("Operation input digest is invalid.");
+    if (!["none", "possible", "confirmed"].includes(facts.effect))
+        throw new Error("Operation effect is invalid.");
+    for (const refs of [facts.receiptRefs, facts.partialResultRefs]) {
+        if (!Array.isArray(refs) || refs.some((ref) => typeof ref !== "string" || !ref.trim())) {
+            throw new Error("Operation evidence references are invalid.");
+        }
+    }
+}
+/** Effects only accumulate. Later output failure or cancellation cannot erase evidence. */
+export function recordOperationEvidence(facts, evidence) {
+    const rank = { none: 0, possible: 1, confirmed: 2 };
+    const next = {
+        ...facts,
+        effect: evidence.effect !== undefined && rank[evidence.effect] > rank[facts.effect]
+            ? evidence.effect : facts.effect,
+        receiptRefs: [...new Set([...facts.receiptRefs, ...(evidence.receiptRefs ?? [])])],
+        partialResultRefs: [...new Set([...facts.partialResultRefs, ...(evidence.partialResultRefs ?? [])])]
+    };
+    validateOperationFacts(next);
+    return next;
+}

package/dist/runtime/exactControlPlane.js

@@ -44,14 +44,6 @@ export function parseExactControlPlaneDescriptor(value) {
 export function exactControlPlaneDigest(descriptor) {
     return createHash("sha256").update(serializeExactDescriptor(descriptor)).digest("hex");
 }
-export function exactControlPlaneCommandPrefix(descriptor) {
-    return [
-        descriptor.executable,
-        descriptor.cliEntry,
-        EXACT_CONTROL_ARGUMENT,
-        exactControlPlaneDigest(descriptor)
-    ].map(shellQuote).join(" ");
-}
 export function extractExactControlArgument(args) {
     const later = args.indexOf(EXACT_CONTROL_ARGUMENT);
     if (later < 0)
@@ -80,8 +72,14 @@ export function extractExactControlArgument(args) {
  */
 export async function assertExactControlPlanePreflight(input, options = {}) {
     const descriptor = parseExactControlPlaneDescriptor(input.serializedDescriptor);
-    if (exactControlPlaneDigest(descriptor) !== requireDigest(input.digest)) {
-        throw new Error("Exact control-plane digest does not match its frozen descriptor.");
+    const frozenDigest = exactControlPlaneDigest(descriptor);
+    const requestedDigest = requireDigest(input.digest);
+    if (frozenDigest !== requestedDigest) {
+        throw new Error("Exact control-plane invocation names another runtime than this Session's frozen "
+            + `descriptor (requested ${requestedDigest}, Session ${frozenDigest}). `
+            + "Yui no longer pins package identity into a Session entry point: invoke the "
+            + "ordinary command for this Session, or start a new Session when the Session "
+            + "itself must move to a different runtime.");
     }
     assertSamePath(descriptor.executable, input.actualExecutable, "Control-plane executable");
     assertSamePath(descriptor.cliEntry, input.actualCliEntry, "Control-plane CLI entry");

package/dist/storage/sqliteSchema.js

@@ -660,6 +660,34 @@ const MIGRATIONS = Object.freeze([
         name: "v0.15.0-baseline",
         introducedIn: "0.15.0",
         sql: MIGRATION_1_SQL
+    },
+    {
+        version: 2,
+        name: "job-operation-facts",
+        introducedIn: "0.15.2",
+        // Historical records never carried caller identity or external effect
+        // evidence. Preserve that uncertainty rather than inventing attribution.
+        // No old executable implementation or runtime dual-read is needed.
+        sql: `
+UPDATE durable_jobs SET payload = json_set(payload,
+  '$.schemaVersion', 2,
+  '$.operation', json_object(
+    'requestId', json_extract(payload, '$.idempotencyKey'),
+    'inputDigest', json_extract(payload, '$.idempotencyKey'),
+    'actorId', 'historical:unrecorded',
+    'authorityRef', 'historical:unrecorded',
+    'targetId', json_extract(payload, '$.workspace'),
+    'capability', 'job.start',
+    'implementation', json_object('id', 'yui:job-runner', 'generation', '1'),
+    'effect', 'possible',
+    'receiptRefs', json('[]'),
+    'partialResultRefs', json('[]')
+  )
+);
+CREATE UNIQUE INDEX idx_durable_jobs_request
+ON durable_jobs(task_id, json_extract(payload, '$.operation.actorId'),
+  json_extract(payload, '$.operation.requestId'));
+`
     }
 ]);
 for (let index = 0; index < MIGRATIONS.length; index += 1) {

package/dist/storage/sqliteStore.js

@@ -314,13 +314,18 @@ export class SqliteTaskStore {
      * and the increment happen in the same write transaction.
      */
     transactionWithRevisionCas(expectedRevision, execute, options) {
-        if (this.#inTransaction)
+        if (this.#inTransaction) {
+            const current = this.getRevision();
+            if (current !== expectedRevision) {
+                throw new StorageConflictError(`Storage revision conflict (expected ${expectedRevision}, found ${current}).`, current);
+            }
             return execute(this);
+        }
         this.#begin();
         try {
             const current = this.getRevision();
             if (current !== expectedRevision) {
-                throw new StorageConflictError(`Storage revision conflict (expected ${expectedRevision}, found ${current}).`);
+                throw new StorageConflictError(`Storage revision conflict (expected ${expectedRevision}, found ${current}).`, current);
             }
             const result = execute(this);
             if (this.#dirty) {
@@ -363,6 +368,9 @@ export class SqliteTaskStore {
         if (this.#inTransaction) {
             // Nested inside a synchronous transaction: run without yielding (the
             // caller already holds the write lock).
+            if (options.expectedRevision !== undefined && this.getRevision() !== options.expectedRevision) {
+                throw new StorageConflictError("Storage revision conflict.", this.getRevision());
+            }
             return commands.map((command) => this.#executeCommand(command.op, command.args));
         }
         this.#begin();
@@ -372,7 +380,7 @@ export class SqliteTaskStore {
             if (options.expectedRevision !== undefined) {
                 const current = this.getRevision();
                 if (current !== options.expectedRevision) {
-                    throw new StorageConflictError(`Storage revision conflict (expected ${options.expectedRevision}, found ${current}).`);
+                    throw new StorageConflictError(`Storage revision conflict (expected ${options.expectedRevision}, found ${current}).`, current);
                 }
             }
             const results = [];

package/dist/storage/storageVersions.js

@@ -13,4 +13,4 @@
  * intermediate Yui releases.
  */
 export const MIN_SUPPORTED_STORAGE_VERSION = 1;
-export const CURRENT_STORAGE_VERSION = 1;
+export const CURRENT_STORAGE_VERSION = 2;

package/dist/storage/storeRpc.js

@@ -105,7 +105,7 @@ function isReadOnlyMethod(method) {
 function deserializeError(serialized) {
     const { name, message } = serialized;
     if (name === "StorageConflictError")
-        return new StorageConflictError(message);
+        return new StorageConflictError(message, serialized.currentRevision);
     if (name === "StorageRecordError")
         return new StorageRecordError(message);
     if (name === "StorageCancelledError" || name === "AbortError") {

package/dist/storage/taskStore.js

@@ -72,7 +72,12 @@ export class StorageRecordError extends Error {
     constructor(message) { super(message); this.name = "StorageRecordError"; }
 }
 export class StorageConflictError extends Error {
-    constructor(message) { super(message); this.name = "StorageConflictError"; }
+    currentRevision;
+    constructor(message, currentRevision) {
+        super(message);
+        this.currentRevision = currentRevision;
+        this.name = "StorageConflictError";
+    }
 }
 /**
  * Raised by the persistence worker when an `AbortSignal` cancels an in-flight

package/dist/storage/upgrade/upgradeOrchestrator.js

@@ -7,6 +7,7 @@ import { validateAgentProfile } from "../../profile/agentProfile.js";
 import { validateRoleSessionSet } from "../../executor/agentExecutor.js";
 import { validateReviewRound } from "../../review/reviewRound.js";
 import { validateTurn } from "../../turn/turn.js";
+import { validateDurableJob } from "../../job/durableJob.js";
 import { validateWorkItem } from "../../workItem/workItem.js";
 import { SqliteTaskStore } from "../sqliteStore.js";
 import { migrateSqliteSchema, storageMigrationPlan } from "../sqliteSchema.js";
@@ -191,6 +192,8 @@ function validateCurrentStore(home) {
             }
         }
         for (const taskId of store.listTasks().map(({ id }) => id)) {
+            for (const job of store.listDurableJobs(taskId))
+                validateDurableJob(job);
             for (const item of store.listWorkItems(taskId))
                 validateWorkItem(item);
             for (const round of store.listReviewRounds(taskId))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.15.1",
+  "version": "0.15.2",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,