@zq-silk/yui 0.15.11 → 0.16.0

package/dist/controller/globalInputDelivery.js

@@ -2,6 +2,8 @@ import { sendAgentHostRunControl, AGENT_HOST_CONTROL_PROTOCOL } from "../runtime
 import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
 import { hasRuntimeCleanupObligation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { markGlobalRoleMessageNotDelivered } from "../message/message.js";
+import { providerRetryPending } from "../runtime/providerRetry.js";
+import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 /** Messages are the only queue. Host's atomic begin arbitrates native writers. */
 export async function deliverGlobalInputs(home, store, ensure, onError) {
     for (const role of store.listGlobalRoles()) {
@@ -11,6 +13,15 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             if (pending.length === 0 || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name }))))
                 continue;
             let sessions = store.getGlobalRoleSessionSet(role.name);
+            if (sessions?.providerBinding?.retry !== undefined && !providerRetryPending(sessions.providerBinding)) {
+                store.transaction(tx => settleGlobalRetryInput(tx, role.name, tx.getGlobalRoleSessionSet(role.name)?.providerBinding, new Date()));
+                pending = store.listGlobalRoleMessages(role.name).filter(message => message.delivery === undefined && message.notDelivered === undefined
+                    && (message.inputControl?.action === "queue" || message.interruptThen !== undefined));
+                if (pending.length === 0)
+                    continue;
+            }
+            if (providerRetryPending(sessions?.providerBinding))
+                continue;
             const current = sessions?.providerBinding?.run;
             const obsolete = pending.filter(message => {
                 const claim = message.interruptThen;
@@ -99,6 +110,8 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
                     if (latest === undefined || latest.delivery !== undefined || latest.notDelivered !== undefined)
                         return;
                     const turn = tx.getGlobalRoleSessionSet(role.name)?.providerBinding?.run;
+                    if (providerRetryPending(tx.getGlobalRoleSessionSet(role.name)?.providerBinding))
+                        return;
                     // A later canonical acceptance wins over transport diagnostics.
                     if (turn?.attemptId === attemptId && ["accepted", "completed", "failed", "cancelled"].includes(turn.status))
                         return;

package/dist/controller/jobClient.js

@@ -1,4 +1,4 @@
-import { resolveJobCaller } from "../commands/taskActor.js";
+import { resolveJobCaller } from "../task/taskAuthority.js";
 import { callFileTaskController } from "./clientRuntime.js";
 export async function startDurableJob(home, params, clientOptions = {}) {
     // rr6/f2: Route through callFileTaskController so an Integration-issued
@@ -7,8 +7,8 @@ export async function startDurableJob(home, params, clientOptions = {}) {
     const result = await callFileTaskController(home, "job.start", params, clientOptions);
     return parseStartResult(result);
 }
-export async function getDurableJob(home, taskId, jobId, clientOptions = {}) {
-    const result = await callFileTaskController(home, "job.get", { taskId, jobId }, clientOptions);
+export async function getDurableJob(home, taskId, jobId, caller, clientOptions = {}) {
+    const result = await callFileTaskController(home, "job.get", { taskId, jobId, caller }, clientOptions);
     return parseJobResult(result);
 }
 export async function acknowledgeDurableJob(home, taskId, jobId, caller, clientOptions = {}) {
@@ -89,7 +89,7 @@ export function createControllerIntegrationJobPort(home, clientOptions = {}) {
             return job;
         },
         async getJob(taskId, jobId) {
-            return getDurableJob(home, taskId, jobId, clientOptions);
+            return getDurableJob(home, taskId, jobId, resolveJobCaller(clientOptions.environment, taskId), clientOptions);
         },
         async cancelJob(taskId, jobId) {
             // rr8/rr12: Bind the cancel request to the caller's managed identity.

package/dist/controller/jobControl.js

@@ -3,18 +3,22 @@
  * record is created or cancel-requested. The Controller socket layer calls
  * this port for `job.*` requests; nothing else writes queued jobs.
  *
- * Creation is idempotent per (owner, project, head, steps, workspace, env):
- * a repeated `job.start` with the same inputs returns the existing job with
- * `created: false`, so a Leader retry can never spawn duplicate runners.
+ * Creation is idempotent per authenticated actor and explicit request ID.
+ * Repeating that request with identical inputs returns the original Job;
+ * changing its input is a conflict. Integration owner identity additionally
+ * preserves its admitted Job across authorized Session replacement.
  */
 import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { resolve, sep } from "node:path";
-import { acknowledgeUnknownDurableJob, createDurableJob, durableJobIdempotencyKey, isDurableJobTerminal, requestDurableJobCancel, retryDurableJobIdempotencyKey } from "../job/durableJob.js";
 import { activeLiveRoleAgentSession } from "../executor/agentExecutor.js";
+import { acknowledgeUnknownDurableJob, createDurableJob, durableJobIdempotencyKey, isDurableJobTerminal, requestDurableJobCancel, retryDurableJobIdempotencyKey } from "../job/durableJob.js";
 import { CallAuthority } from "../kernel/callAuthority.js";
 import { redactLaunchText } from "../runtime/launchDiagnostics.js";
-import { requireManagedTaskCaller } from "../runtime/managedCaller.js";
+import { requireManagedTaskCaller, ManagedRuntimeDriftError } from "../runtime/managedCaller.js";
+import { CliError } from "../errors/cliError.js";
+import { assertJobAssignmentScope, JobAssignmentScopeError } from "../job/jobAssignmentScope.js";
+import { assertContextRecordReadable } from "../context/taskContext.js";
 export function createDurableJobControl(store) {
     const authority = createJobCallAuthority(store);
     return {
@@ -25,6 +29,7 @@ export function createDurableJobControl(store) {
             // startJob with the same key create a duplicate job.
             return store.transaction((tx) => {
                 const context = authority.authenticate(Object.freeze({ ...params.caller }), params.taskId);
+                requireJobAssignment(tx, params, params.caller);
                 assertNonSecretJobInput(params);
                 const baseKey = durableJobIdempotencyKey({
                     owner: params.owner,
@@ -37,8 +42,7 @@ export function createDurableJobControl(store) {
                 const inputDigest = params.retryOf === undefined
                     ? baseKey
                     : retryDurableJobIdempotencyKey(baseKey, params.retryOf);
-                const requestId = params.requestId === undefined ? inputDigest
-                    : requiredId(params.requestId, "job.start requestId");
+                const requestId = requiredId(params.requestId, "job.start requestId");
                 // An IntegrationAttempt already is a durable operation identity.
                 // Recovery by another authorized Role must find its original Job,
                 // including the window before Integration persisted the returned id.
@@ -68,12 +72,6 @@ export function createDurableJobControl(store) {
                     }
                     return { job: existing, created: false };
                 }
-                // A historical content-addressed request has no attributable caller.
-                // Do not silently execute it again under a newly attributed identity.
-                const historical = tx.findDurableJobByIdempotencyKey(params.taskId, inputDigest);
-                if (params.requestId === undefined && historical !== null) {
-                    throw jobDomainError(`Historical request already exists: ${historical.id}; inspect it or select an explicit new requestId.`);
-                }
                 authority.authorize(context, params.taskId);
                 validateStartParams(tx, params);
                 const id = tx.nextDurableJobId(params.taskId);
@@ -97,7 +95,21 @@ export function createDurableJobControl(store) {
                 return { job, created: true };
             });
         },
-        getJob(taskId, jobId) {
+        getJob(taskId, jobId, caller) {
+            if (caller === undefined)
+                throw jobControlError("UNAUTHORIZED", "Job reads require an explicit caller.");
+            try {
+                assertContextRecordReadable(store, taskId, "job", jobId, caller.scope === "user" ? {} : {
+                    YUI_SESSION_SCOPE: caller.scope, YUI_TASK_ID: caller.taskId, YUI_ROLE: caller.role,
+                    YUI_AGENT_ID: caller.agentId, YUI_ADAPTER_ID: caller.adapterId, YUI_NATIVE_SESSION_ID: caller.nativeSessionId
+                });
+            }
+            catch (error) {
+                if (error instanceof ManagedRuntimeDriftError || (error instanceof CliError && error.code === "USAGE_ERROR")) {
+                    throw jobControlError("UNAUTHORIZED", error.message);
+                }
+                throw error;
+            }
             return store.getDurableJob(taskId, jobId);
         },
         cancelJob(taskId, jobId, now, caller) {
@@ -108,6 +120,7 @@ export function createDurableJobControl(store) {
                 // rr8: Bind the cancel request to the caller's managed identity. The
                 // same rules as job.start apply, checked against the job's owner.
                 assertCallerAuthorized(tx, caller, taskId);
+                requireJobAssignment(tx, current, caller);
                 const next = requestDurableJobCancel(current, now);
                 if (next !== current)
                     tx.saveDurableJob(taskId, next);
@@ -120,6 +133,7 @@ export function createDurableJobControl(store) {
                 if (current === null)
                     return null;
                 assertCallerAuthorized(tx, caller, taskId);
+                requireJobAssignment(tx, current, caller);
                 const next = acknowledgeUnknownDurableJob(current, now);
                 if (next !== current)
                     tx.saveDurableJob(taskId, next);
@@ -152,8 +166,19 @@ export function authorizeJobStart(store, job) {
     if (jobAuthorityBinding(store, scope, role, job.taskId) !== job.operation.authorityRef) {
         throw jobDomainError("Job caller binding was revoked; no execution was started.");
     }
+    requireJobAssignment(store, job, { scope, role });
     validateJobTarget(store, job);
 }
+function requireJobAssignment(store, target, caller) {
+    try {
+        assertJobAssignmentScope(store, target, caller);
+    }
+    catch (error) {
+        if (error instanceof JobAssignmentScopeError)
+            throw jobControlError("UNAUTHORIZED", error.message);
+        throw error;
+    }
+}
 function jobAuthorityBinding(store, scope, roleName, taskId) {
     // A Host detach/reattach preserves the native Session and its queued work.
     // Authenticate the live launch at ingress, but bind accepted Jobs to the
@@ -328,8 +353,8 @@ function validateJobTarget(store, params) {
  * - `task` + mismatched taskId: rejected.
  * - A non-Leader Task caller requires its current active Assignment.
  * - A Leader Task caller requires its current, unrevoked native Session.
- * - `task`: authority inside the matching Task after current Session and
- *   native Session verification; Role does not narrow it.
+ * - Non-Leader Task callers additionally pass the shared exact Assignment
+ *   check for every Job operation and before a queued Job starts.
  */
 /**
  * Verify the caller's current native Session and Task scope. This local Home
@@ -470,28 +495,26 @@ export function parseDurableJobStartParams(value) {
         env,
         steps,
         caller,
-        ...(record.requestId === undefined ? {} : {
-            requestId: requiredId(record.requestId, "job.start requestId")
-        }),
+        requestId: requiredId(record.requestId, "job.start requestId"),
         ...(retryOf === undefined ? {} : { retryOf })
     };
 }
 export function parseDurableJobRefParams(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)
-        || Object.keys(value).length !== 2) {
+        || Object.keys(value).length !== 3) {
         throw jobControlError("INVALID_PARAMS", "DurableJob ref params are invalid.");
     }
     const record = value;
     return {
         taskId: requiredId(record.taskId, "DurableJob taskId"),
-        jobId: requiredId(record.jobId, "DurableJob jobId")
+        jobId: requiredId(record.jobId, "DurableJob jobId"),
+        caller: parseCaller(record.caller)
     };
 }
 /**
  * rr8: `job.cancel` params carry the caller identity so the Controller can
- * bind the cancel request to the caller's managed scope. Distinct from
- * `parseDurableJobRefParams` (used by `job.get`) because cancel requires the
- * third `caller` key.
+ * bind the cancel request to the caller's managed scope. Reads also carry
+ * an explicit caller but use Context's read authority rather than write authority.
  */
 export function parseDurableJobCancelParams(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)
@@ -551,7 +574,7 @@ function parseSteps(value) {
             throw jobControlError("INVALID_PARAMS", "job.start steps are invalid.");
         }
         const record = entry;
-        const allowed = new Set(["name", "command", "timeoutMs"]);
+        const allowed = new Set(["name", "command", "argv", "cwd", "env", "timeoutMs"]);
         for (const key of Object.keys(record)) {
             if (!allowed.has(key)) {
                 throw jobControlError("INVALID_PARAMS", "job.start steps are invalid.");
@@ -559,6 +582,15 @@ function parseSteps(value) {
         }
         const name = requiredId(record.name, "job.start step name");
         const command = requiredId(record.command, "job.start step command");
+        const argv = record.argv === undefined ? undefined : record.argv;
+        if (argv !== undefined && (!Array.isArray(argv) || argv.length === 0
+            || argv.some(value => typeof value !== "string" || value.length === 0 || value.includes("\0")))) {
+            throw jobControlError("INVALID_PARAMS", `job.start step argv is invalid: ${name}.`);
+        }
+        const cwd = record.cwd === undefined ? undefined : requiredId(record.cwd, "job.start step cwd");
+        if (cwd !== undefined && !cwd.startsWith("/")) {
+            throw jobControlError("INVALID_PARAMS", `job.start step cwd must be absolute: ${name}.`);
+        }
         if (names.has(name)) {
             throw jobControlError("INVALID_PARAMS", `job.start step names must be unique: ${name}.`);
         }
@@ -572,6 +604,9 @@ function parseSteps(value) {
         const step = {
             name,
             command,
+            ...(argv === undefined ? {} : { argv: argv }),
+            ...(cwd === undefined ? {} : { cwd }),
+            ...(record.env === undefined ? {} : { env: parseStringMap(record.env, "job.start step env") }),
             ...(record.timeoutMs === undefined ? {} : { timeoutMs: record.timeoutMs })
         };
         steps.push(step);

package/dist/controller/jobSupervisor.js

@@ -12,14 +12,14 @@
  *  cancelRequestedAt -> write cancel fence + SIGTERM
  */
 import { spawn } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, statSync } from "node:fs";
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { writeTextFileAtomically } from "../storage/durableFile.js";
 import { cancelQueuedDurableJob, completeDurableJob, isDurableJobTerminal, markDurableJobUnknown, markDurableJobWakeupNotified, rejectQueuedDurableJob, startDurableJob, touchDurableJobHeartbeat } from "../job/durableJob.js";
-import { readLinuxProcessStartIdentity } from "./domainIdentity.js";
-import { wakeReason } from "../scheduler/wakeReason.js";
 import { recordOperationEvidence } from "../kernel/operationFacts.js";
+import { wakeReason } from "../scheduler/wakeReason.js";
+import { writeTextFileAtomically } from "../storage/durableFile.js";
+import { readLinuxProcessStartIdentity } from "./domainIdentity.js";
 const DEFAULT_STEP_TIMEOUT_MS = 30 * 60_000;
 const HEARTBEAT_STALE_MS = 2 * 60_000;
 const SIGKILL_GRACE_MS = 30_000;

package/dist/controller/providerRetryAdmission.js

@@ -0,0 +1,100 @@
+import { admitProviderRetry, cancelProviderRetry, providerRetryAttemptId, providerRetryPending } from "../runtime/providerRetry.js";
+import { blockingProviderContinuations } from "../runtime/runtimeContinuationProjection.js";
+import { validateExactRunReviewRound } from "../lifecycle/exactRunTerminalization.js";
+import { isDeepStrictEqual } from "node:util";
+export function ownedProviderInput(input) {
+    if (input.runId !== undefined && input.taskId !== undefined) {
+        return { kind: "run", taskId: input.taskId, runId: input.runId };
+    }
+    const wake = /^notification:([^/]+)\/([^/]+)\//u.exec(input.attemptId);
+    if (wake !== null && wake[1] === input.taskId) {
+        return { kind: "wake", taskId: wake[1], wakeId: wake[2] };
+    }
+    const message = /^global-input:([^/]+)\/([^/]+)$/u.exec(input.attemptId);
+    if (message !== null && message[1] === input.roleName && input.taskId === undefined) {
+        return { kind: "message", roleName: input.roleName, messageId: message[2] };
+    }
+    return input.boundedText === undefined ? undefined : { kind: "text", text: input.boundedText };
+}
+export function retryIntentBlocker(store, input, retry) {
+    if (input.taskId === undefined) {
+        const role = store.getGlobalRole(input.roleName);
+        const sessions = store.getGlobalRoleSessionSet(input.roleName);
+        if (role === null || sessions?.activeAgentId !== role.activeAgentId)
+            return "role-changed";
+        if (sessions.sessions[sessions.activeAgentId]?.effective.sourceDesiredRevision !== role.launchRevision)
+            return "role-configuration-changed";
+        if (store.listGlobalRoleMessages(input.roleName).some(message => Date.parse(message.createdAt) > Date.parse(retry.intentAt)
+            && message.delivery === undefined && message.notDelivered === undefined))
+            return "new-user-input";
+        return undefined;
+    }
+    const task = store.getTask(input.taskId);
+    if (task === null || !["active", "draft"].includes(task.status)
+        || task.executionGate.state !== "enabled")
+        return "task-execution-stopped";
+    const role = store.getRole(input.taskId, input.roleName);
+    const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+    if (role === null || sessions?.activeAgentId !== role.activeAgentId)
+        return "role-changed";
+    if (sessions.sessions[sessions.activeAgentId]?.effective.sourceDesiredRevision !== role.launchRevision)
+        return "role-configuration-changed";
+    if (store.listMessages(input.taskId).some(message => (message.kind === "operator" || message.kind === "user")
+        && Date.parse(message.createdAt) > Date.parse(retry.intentAt)))
+        return "new-user-input";
+    if (blockingProviderContinuations(store.listEvents(input.taskId)).some(c => c.roleName === input.roleName && c.identity.conversationId === retry.nativeSessionId)) {
+        return "background-work-unsettled";
+    }
+    return undefined;
+}
+/** Shared by automatic recovery and every ordinary Host submit. The native
+ * writer CAS remains the only grant; a scheduled successor is not a grant. */
+export function admitOwnedProviderInput(store, binding, input) {
+    const retry = binding.retry;
+    const sameReviewSuccessor = retry?.successorReviewRoundId !== undefined && input.taskId !== undefined && input.runId !== undefined
+        && store.getRun(input.taskId, input.runId)?.reviewRoundId === retry.successorReviewRoundId;
+    if (retry !== undefined && !providerRetryPending(binding)
+        && (input.attemptId.startsWith("provider-retry:") || input.runId !== undefined && input.runId === retry.successorRunId
+            || sameReviewSuccessor)) {
+        throw new Error(`Provider retry is ${retry.status}; this scheduled successor cannot regain admission.`);
+    }
+    if (!providerRetryPending(binding) || retry === undefined)
+        return binding;
+    const automatic = input.attemptId === providerRetryAttemptId(retry)
+        || input.runId !== undefined && input.runId === retry.successorRunId
+        || input.runId !== undefined && input.taskId !== undefined && retry.successorReviewRoundId !== undefined
+            && store.getRun(input.taskId, input.runId)?.reviewRoundId === retry.successorReviewRoundId
+        || retry.status === "in-flight" && input.attemptId === retry.currentAttemptId;
+    if (!automatic)
+        return cancelProviderRetry(binding, "superseded-by-explicit-input", input.now.getTime());
+    const blocker = retryIntentBlocker(store, input, retry);
+    if (blocker !== undefined)
+        throw new Error(`Provider retry admission stopped: ${blocker}.`);
+    if (input.retrySupported !== true)
+        throw new Error("This Host cannot prove safe same-Session recovery; use explicit recovery.");
+    if (binding.goal?.status === "active")
+        throw new Error("Provider still owns an autonomous Goal; inspect its exact continuation.");
+    if (input.taskId !== undefined && input.runId !== undefined) {
+        const run = store.getRun(input.taskId, input.runId);
+        const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+        if (run === null || run.status !== "active"
+            || !isDeepStrictEqual(run.effective, sessions?.sessions[input.agentId]?.effective)) {
+            throw new Error("Retry execution no longer matches its fixed native Session.");
+        }
+        if (run.workspace !== undefined && !isDeepStrictEqual(store.getManagedWorkspace(run.workspace.owner), run.workspace)) {
+            throw new Error("Retry workspace authority changed.");
+        }
+        if (run.workItemId !== undefined) {
+            const item = store.getWorkItem(input.taskId, run.workItemId);
+            if (item?.status !== "open" || run.purpose !== "review" && run.executionLaneId === undefined
+                && item.assignee !== run.roleName)
+                throw new Error("Retry WorkItem responsibility changed.");
+        }
+        if (validateExactRunReviewRound(store, run).disposition !== "applied") {
+            throw new Error("Retry Review no longer matches its exact Round and frozen candidate.");
+        }
+    }
+    const admitted = admitProviderRetry(binding, { attemptId: input.attemptId, at: input.now.getTime() });
+    return input.runId === undefined ? admitted
+        : { ...admitted, retry: { ...admitted.retry, successorRunId: input.runId } };
+}

package/dist/controller/providerRetryDelivery.js

@@ -0,0 +1,218 @@
+import { performance } from "node:perf_hooks";
+import { runTaskCommand } from "../commands/taskCommands.js";
+import { enqueueWork } from "../coordination/workMailboxQueue.js";
+import { createTaskEvent } from "../event/taskEvent.js";
+import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
+import { redactAgentErrorText } from "../runtime/agentError.js";
+import { AGENT_HOST_CONTROL_PROTOCOL, agentHostControlSocketPath, inspectAgentHostSocket, sendAgentHostRunControl } from "../runtime/agentHost.js";
+import { hasRuntimeCleanupObligation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
+import { cancelProviderRetry, providerRetryAttemptId, providerRetryPending } from "../runtime/providerRetry.js";
+import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
+import { retryIntentBlocker } from "./providerRetryAdmission.js";
+/** Hooks in the existing Controller pass and nearest-deadline timer. SQLite's
+ * current Provider input is the only pending intent; nothing is queued here. */
+export function createProviderRetryHooks(home, store, ports = {}) {
+    const anchors = new Map();
+    const inspectedUnknown = new Set();
+    const inspect = ports.inspect ?? ((target) => inspectAgentHostSocket(agentHostControlSocketPath(target), 250));
+    const now = (retry) => {
+        const wall = (ports.now ?? (() => new Date()))().getTime();
+        const monotonic = (ports.monotonicNow ?? (() => performance.now()))();
+        let anchor = anchors.get(retry.chainId);
+        if (anchor === undefined) {
+            anchor = { wall: Math.max(wall, Date.parse(retry.updatedAt)), monotonic };
+            anchors.set(retry.chainId, anchor);
+        }
+        return Math.max(wall, anchor.wall + Math.max(0, monotonic - anchor.monotonic));
+    };
+    const load = (owner) => owner.scope === "task"
+        ? store.getTaskRoleSessionSet(owner.taskId, owner.roleName) : store.getGlobalRoleSessionSet(owner.roleName);
+    const save = (set) => {
+        if (set.owner.scope === "task")
+            store.saveTaskRoleSessionSet(set);
+        else
+            store.saveGlobalRoleSessionSet(set);
+    };
+    const stop = (set, reason, at, exhausted = false) => {
+        store.transaction(() => {
+            const current = load(set.owner);
+            if (current === null || current.providerBinding?.retry?.chainId !== set.providerBinding?.retry?.chainId)
+                return;
+            const binding = current.providerBinding;
+            if (!providerRetryPending(binding))
+                return;
+            const cancelled = cancelProviderRetry(binding, reason, at);
+            save({ ...current, providerBinding: exhausted
+                    ? { ...cancelled, retry: { ...cancelled.retry, status: "exhausted" } } : cancelled });
+            const owner = set.owner;
+            if (owner.scope === "global")
+                settleGlobalRetryInput(store, owner.roleName, load(owner)?.providerBinding, new Date(at));
+            if (owner.scope === "task") {
+                const event = createTaskEvent(store.nextEventId(owner.taskId), owner.taskId, "provider.retry-stopped", {
+                    roleName: owner.roleName, chainId: binding.retry.chainId, reason
+                }, new Date(at));
+                store.saveEvent(owner.taskId, event);
+                enqueueWork(store, owner.roleName === "leader" ? { kind: "operator" }
+                    : { kind: "role", taskId: owner.taskId, roleName: "leader" }, "provider-retry-needs-attention", new Date(at), [{ type: "event", taskId: owner.taskId, id: event.id }]);
+            }
+        });
+    };
+    const key = (set) => set.owner.scope === "task"
+        ? `role:${encodeURIComponent(set.owner.taskId)}/${encodeURIComponent(set.owner.roleName)}`
+        : `global-role:${encodeURIComponent(set.owner.roleName)}`;
+    return {
+        deadlines() {
+            return store.listProviderRetrySessions().flatMap(set => {
+                const retry = set.providerBinding.retry;
+                if (retry.status !== "waiting")
+                    return [];
+                // Busy or already-queued work awaits the next ordinary pass without a
+                // zero-delay timer loop. Waiting never consumes an execution attempt.
+                const wall = (ports.now ?? (() => new Date()))().getTime();
+                const effective = now(retry);
+                return [{ key: key(set), at: wall + Math.max(250, (retry.successorAutomatic === false ? Date.parse(retry.nextEligibleAt)
+                            : Math.min(Date.parse(retry.nextEligibleAt), Date.parse(retry.deadline))) - effective) }];
+            });
+        },
+        async reconcile() {
+            const current = store.listProviderRetrySessions();
+            const activeChains = new Set(current.map(set => set.providerBinding.retry.chainId));
+            for (const id of anchors.keys())
+                if (!activeChains.has(id))
+                    anchors.delete(id);
+            const pendingAttempts = new Set(current.map(set => set.providerBinding.retry.currentAttemptId));
+            for (const id of inspectedUnknown)
+                if (!pendingAttempts.has(id))
+                    inspectedUnknown.delete(id);
+            for (const set of current) {
+                const owner = set.owner;
+                const binding = set.providerBinding;
+                const retry = binding.retry;
+                const at = now(retry);
+                const scoped = { ...(owner.scope === "task" ? { taskId: owner.taskId } : {}), roleName: owner.roleName };
+                const session = set.sessions[set.activeAgentId];
+                const blocker = retryIntentBlocker(store, scoped, retry);
+                if (blocker !== undefined && blocker !== "background-work-unsettled") {
+                    stop(set, blocker, at);
+                    continue;
+                }
+                if (binding.retryDisabled && retry.successorAutomatic !== false || binding.authority.owner !== "controller"
+                    || binding.authority.epoch !== retry.authorityEpoch
+                    || currentProviderConversation(binding).conversationId !== retry.nativeSessionId
+                    || session?.status !== "active" || session.nativeSessionId !== retry.nativeSessionId
+                    || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget(owner)))) {
+                    stop(set, "session-or-authority-changed", at);
+                    continue;
+                }
+                // Never replay an admitted attempt. Existing exact runtime queries and
+                // terminal ingress resolve it, even across Controller restart.
+                if (retry.status === "in-flight") {
+                    if (binding.run?.status === "delivery-unknown" && retry.currentAttemptId !== undefined
+                        && !inspectedUnknown.has(retry.currentAttemptId)) {
+                        inspectedUnknown.add(retry.currentAttemptId);
+                        let detail;
+                        try {
+                            const host = await inspect({ home, ...scoped, scope: owner.scope });
+                            detail = host.nativeSessionId === retry.nativeSessionId && host.attemptId === retry.currentAttemptId
+                                ? `Exact Host query: ${host.state}; awaiting original canonical Provider evidence.`
+                                : "Host query did not prove the original Session/input identity; no replay.";
+                        }
+                        catch (error) {
+                            detail = `Original Host query unavailable; no replay: ${redactAgentErrorText(error instanceof Error ? error.message : String(error))}`;
+                        }
+                        store.transaction(() => {
+                            const latest = load(owner);
+                            if (latest === null || latest.providerBinding == null || latest.providerBinding.run === null
+                                || latest.providerBinding.run.attemptId !== retry.currentAttemptId
+                                || latest.providerBinding.run.status !== "delivery-unknown")
+                                return;
+                            save({ ...latest, providerBinding: { ...latest.providerBinding,
+                                    retry: { ...latest.providerBinding.retry, reason: detail } } });
+                            if (owner.scope === "task") {
+                                const event = createTaskEvent(store.nextEventId(owner.taskId), owner.taskId, "provider.retry-unconfirmed", {
+                                    roleName: owner.roleName, attemptId: retry.currentAttemptId, nativeSessionId: retry.nativeSessionId, detail
+                                }, new Date(at));
+                                store.saveEvent(owner.taskId, event);
+                                enqueueWork(store, owner.roleName === "leader" ? { kind: "operator" }
+                                    : { kind: "role", taskId: owner.taskId, roleName: "leader" }, "provider-retry-needs-attention", new Date(at), [{ type: "event", taskId: owner.taskId, id: event.id }]);
+                            }
+                        });
+                    }
+                    continue;
+                }
+                if (retry.successorAutomatic !== false && at >= Date.parse(retry.deadline)) {
+                    stop(set, "deadline-exhausted", at, true);
+                    continue;
+                }
+                if (at < Date.parse(retry.nextEligibleAt) || blocker !== undefined || binding.goal?.status === "active")
+                    continue;
+                if (binding.run?.attemptId !== retry.failedAttemptId) {
+                    stop(set, "superseded-input", at);
+                    continue;
+                }
+                try {
+                    if (owner.scope === "task" && retry.previousRunId !== undefined) {
+                        if (retry.successorRunId !== undefined || retry.successorReviewRoundId !== undefined)
+                            continue;
+                        const previous = store.getRun(owner.taskId, retry.previousRunId);
+                        if (previous?.status === "active")
+                            continue; // ordinary rejected-delivery terminal fold
+                        if (previous?.status !== "failed") {
+                            stop(set, "run-no-longer-failed", at);
+                            continue;
+                        }
+                        const actualTaskReviewCandidate = await ports.snapshotTaskCandidate?.(previous);
+                        store.transaction(() => {
+                            const latest = load(owner)?.providerBinding?.retry;
+                            if (latest?.chainId !== retry.chainId || latest.failedAttemptId !== retry.failedAttemptId
+                                || latest.status !== "waiting")
+                                return;
+                            const reason = retryIntentBlocker(store, scoped, latest);
+                            if (reason !== undefined)
+                                throw new Error(reason);
+                            runTaskCommand(["run", "retry", `${owner.taskId}/${previous.id}`], store, {
+                                now: () => new Date(at), environment: {}, providerRetryChainId: retry.chainId,
+                                ...(actualTaskReviewCandidate === undefined ? {} : { actualTaskReviewCandidate })
+                            });
+                        });
+                    }
+                    else {
+                        const original = retry.input.kind === "text" ? retry.input.text
+                            : retry.input.kind === "wake"
+                                ? `Yui Task notification: task=${retry.input.taskId} wake=${retry.input.wakeId}.\nRead current Task context and that fixed wake window, including original Messages in full. This is not an execution assignment.`
+                                : retry.input.kind === "message"
+                                    ? `Yui Global Message: role=${retry.input.roleName} message=${retry.input.messageId}.\nRead your Session Context and referenced original Message in full.`
+                                    : undefined;
+                        if (original === undefined) {
+                            stop(set, "original-input-unavailable", at);
+                            continue;
+                        }
+                        const result = await (ports.submit ?? sendAgentHostRunControl)({
+                            home, ...scoped, scope: owner.scope,
+                            control: {
+                                protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "submit-turn", nativeSessionId: retry.nativeSessionId,
+                                authority: { epoch: binding.authority.epoch, owner: "controller", holderId: binding.authority.holderId },
+                                run: { attemptId: providerRetryAttemptId(retry), boundedText: original }
+                            }
+                        });
+                        // Durable settlement belongs to Host/Controller ingress. In
+                        // particular a lost response is never a reason to replay.
+                        if (result.outcome === "rejected" && result.failure?.registrationDisposition === "not-committed"
+                            && result.failure.errorName !== "ProviderTurnBusyError") {
+                            stop(set, result.failure.detail, at);
+                        }
+                    }
+                }
+                catch (error) {
+                    // A send failure may have applied. A durable submitting/unknown
+                    // identity fences it; do not manufacture a successor to uncertainty.
+                    const latest = load(owner);
+                    if (latest?.providerBinding?.run?.attemptId === retry.failedAttemptId) {
+                        stop(set, error instanceof Error ? error.message : String(error), at);
+                    }
+                    ports.onError?.(error);
+                }
+            }
+        }
+    };
+}