@zq-silk/yui 0.15.11 → 0.16.0

package/dist/controller/runtime.js

@@ -1,57 +1,60 @@
-import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveRuntimeHealth, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
 import { isDeepStrictEqual } from "node:util";
-import { controllerSocketPath } from "../core/controllerEndpoint.js";
 import { AGENT_OPERATIONAL_ENVIRONMENT_NAMES, NATIVE_AGENT_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, YUI_MANAGED_RUNTIME_ENVIRONMENT_NAMES } from "../agent/launchEnvironment.js";
-import { hasRuntimeCleanupObligation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
-import { agentProcessReadinessProbe, ExecutorRegistry } from "../executor/executorRegistry.js";
-import { activeLiveRoleAgentSession, roleAgentSessionResumeMode } from "../executor/agentExecutor.js";
-import { roleSessionMayContinue, effectiveLaunchConfig, resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
+import { runPurposeAdmitsTaskState } from "../agentRun/agentRun.js";
+import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveRuntimeHealth, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
+import { controllerSocketPath } from "../core/controllerEndpoint.js";
+import { createTaskEvent } from "../event/taskEvent.js";
 import { AgentConfigurationCatalogService, validateAgentLaunchConfiguration } from "../executor/agentConfigurationCatalog.js";
-import { isTaskOwnedWorkspace, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
+import { activeLiveRoleAgentSession, roleAgentSessionResumeMode } from "../executor/agentExecutor.js";
+import { effectiveLaunchConfig, resolveEffectiveLaunch, roleSessionMayContinue } from "../executor/effectiveLaunch.js";
+import { agentProcessReadinessProbe, ExecutorRegistry } from "../executor/executorRegistry.js";
 import { FileRoleLaunchPlanner } from "../executor/fileRoleLaunchPlanner.js";
+import { createKernelPorts } from "../kernel/kernelPorts.js";
+import { createGlobalRoleMessage } from "../message/message.js";
+import { FileTaskWorkspacePreparer } from "../repository/taskWorkspacePreparer.js";
+import { createResourceAutoGc } from "../resources/autoResourceGc.js";
+import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
+import { assertExecutionEnvironmentCurrent } from "../runtime/executionEnvironment.js";
+import { appendGlobalProcessExitObservation } from "../runtime/globalProcessExitStore.js";
+import { AgentHostPromptPushAdapter, FileTaskRuntimeIsolation, ProviderContinuationReconciliationService, TmuxSessionHost } from "../runtime/index.js";
+import { launchBrokerForHome } from "../runtime/launchBroker.js";
+import { hasRuntimeCleanupObligation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
+import { classifyRuntimeProcessExit, validateRuntimeProcessExitObservation } from "../runtime/processExitObservation.js";
+import { replayRuntimeProcessExitOutbox } from "../runtime/processExitOutbox.js";
+import { providerRetryPrompt } from "../runtime/providerRetry.js";
+import { createRuntimeObservation, runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
 import { openCurrentTaskStore } from "../storage/currentTaskStore.js";
 import { managedRuntimeRoot } from "../storage/homeLayout.js";
 import { SqliteTaskStore } from "../storage/sqliteStore.js";
 import { AsyncTaskStoreClient, resolveStoreWorkerEnabledForHome } from "../storage/storeRpc.js";
-import { FileTaskWorkspacePreparer } from "../repository/taskWorkspacePreparer.js";
+import { SurfaceContributions } from "../surface/surfaceContributions.js";
+import { taskOwnsManagedWorkspace } from "../task/task.js";
+import { openSchedulerTelemetry } from "../telemetry/telemetryWiring.js";
 import { NodeCommandExecutor } from "../tmux/commandExecutor.js";
 import { TmuxManager, yuiTmuxServerName } from "../tmux/tmuxManager.js";
-import { AgentHostPromptPushAdapter, FileTaskRuntimeIsolation, TmuxSessionHost, ProviderContinuationReconciliationService } from "../runtime/index.js";
-import { startFileTaskController } from "./controller.js";
-import { AgentHostProviderTurnFenceError, AgentHostProviderSessionBusyError, FileSchedulerStoreAdapter } from "./fileSchedulerStoreAdapter.js";
-import { openSchedulerTelemetry } from "../telemetry/telemetryWiring.js";
-import { createFileArtifactPort, createLinuxProcessPort, DurableJobSupervisor } from "./jobSupervisor.js";
-import { authorizeJobStart } from "./jobControl.js";
-import { createKernelPorts } from "../kernel/kernelPorts.js";
-import { createCapabilityDispatcher } from "./capabilityBridge.js";
 import { createControllerWeb } from "../web/controllerWeb.js";
-import { createWebTaskSurface } from "../web/webTaskSurface.js";
-import { SurfaceContributions } from "../surface/surfaceContributions.js";
 import { TmuxWebTerminalService } from "../web/tmuxWebTerminal.js";
-import { FileTaskWorkflowRuntime } from "./clientRuntime.js";
-import { FileRuntimeEventInbox } from "./runtimeEventInbox.js";
+import { createWebTaskSurface } from "../web/webTaskSurface.js";
+import { isTaskOwnedWorkspace, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
 import { AgentRuntimeObserver } from "./agentRuntimeObserver.js";
-import { AsyncRuntimeEventProcessor, FileRuntimeEventProcessor, createAsyncRuntimeObserver } from "./runtimeEventProcessor.js";
-import { RuntimeLaunchCoordinator } from "./runtimeLaunchCoordinator.js";
+import { createCapabilityDispatcher } from "./capabilityBridge.js";
+import { FileTaskWorkflowRuntime } from "./clientRuntime.js";
+import { startFileTaskController } from "./controller.js";
 import { ephemeralDomainFromEnvironment, recordEphemeralTmuxTarget } from "./domainIdentity.js";
 import { createEphemeralResourceReaper } from "./ephemeralResourceReaper.js";
+import { AgentHostProviderSessionBusyError, AgentHostProviderTurnFenceError, FileSchedulerStoreAdapter } from "./fileSchedulerStoreAdapter.js";
+import { deliverGlobalInputs } from "./globalInputDelivery.js";
+import { authorizeJobStart } from "./jobControl.js";
+import { createFileArtifactPort, createLinuxProcessPort, DurableJobSupervisor } from "./jobSupervisor.js";
+import { createProviderRetryHooks } from "./providerRetryDelivery.js";
+import { createRuntimeResourceActivityTracker } from "./resourceInventory.js";
 import { scanControllerResourceInventory } from "./resourceInventoryLinux.js";
 import { ResourceInventoryClient } from "./resourceInventoryRpc.js";
-import { createResourceAutoGc } from "../resources/autoResourceGc.js";
-import { createRuntimeResourceActivityTracker } from "./resourceInventory.js";
+import { FileRuntimeEventInbox } from "./runtimeEventInbox.js";
+import { AsyncRuntimeEventProcessor, createAsyncRuntimeObserver, FileRuntimeEventProcessor } from "./runtimeEventProcessor.js";
+import { RuntimeLaunchCoordinator } from "./runtimeLaunchCoordinator.js";
 import { SessionOwnerReconciliation } from "./sessionOwnerReconciliation.js";
-import { launchBrokerForHome } from "../runtime/launchBroker.js";
-import { assertExecutionEnvironmentCurrent } from "../runtime/executionEnvironment.js";
-import { classifyRuntimeProcessExit, validateRuntimeProcessExitObservation } from "../runtime/processExitObservation.js";
-import { replayRuntimeProcessExitOutbox } from "../runtime/processExitOutbox.js";
-import { appendGlobalProcessExitObservation } from "../runtime/globalProcessExitStore.js";
-import { deliverGlobalInputs } from "./globalInputDelivery.js";
-import { createGlobalRoleMessage } from "../message/message.js";
-import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
-import { createRuntimeObservation, runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
-import { createTaskEvent } from "../event/taskEvent.js";
-import { runPurposeAdmitsTaskState } from "../agentRun/agentRun.js";
-import { taskOwnsManagedWorkspace } from "../task/task.js";
+import { readTaskAgentCapabilities } from "./agentCapabilities.js";
 /** Production composition root for the current SQLite TaskStore + tmux Controller. */
 export async function startFileTaskControllerRuntime(home, options = {}) {
     // The current Home always uses SQLite. The persistence worker is enabled by
@@ -84,9 +87,13 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         : undefined;
     let closeKernel = async () => { };
     let closeWeb = async () => { };
+    let closeTelemetry = async () => { };
     try {
+        const telemetry = options.schedulerStore === undefined
+            ? openSchedulerTelemetry(home, store.getConfig(), asyncStoreClient) : null;
+        closeTelemetry = () => telemetry?.sink.close() ?? Promise.resolve();
         const schedulerStore = options.schedulerStore
-            ?? new FileSchedulerStoreAdapter(store, openSchedulerTelemetry(home, store.getConfig()));
+            ?? new FileSchedulerStoreAdapter(store, telemetry);
         const domainIdentity = options.domainIdentity
             ?? ephemeralDomainFromEnvironment(options.environment ?? process.env);
         const planner = options.planner ?? new FileRoleLaunchPlanner(home, store, {
@@ -385,7 +392,6 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             environment: options.environment ?? process.env, onError: options.onError
         });
         const webSurface = createWebTaskSurface(store, { runtime: {
-                notifyStateChanged: (taskId) => runningRuntime?.signal(`task:${taskId}`),
                 notifyMailboxChanged: (target) => {
                     if (target.kind === "role")
                         runningRuntime?.signal(`role:${target.taskId}/${target.roleName}`);
@@ -452,8 +458,10 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         const continuationReconciler = options.continuationMetadata === undefined
             ? undefined
             : new ProviderContinuationReconciliationService(store, schedulerStore, options.continuationMetadata);
-        const running = await startFileTaskController(home, schedulerStore, delivery, (method, params) => method === "web.start" || method === "web.stop" || method === "web.status"
-            ? web.dispatch(method, params) : lifecycleDispatcher(method, params), {
+        const running = await startFileTaskController(home, schedulerStore, delivery, (method, params) => method === "task.role-capabilities"
+            ? readTaskAgentCapabilities(store, catalogs, params)
+            : method === "web.start" || method === "web.stop" || method === "web.status"
+                ? web.dispatch(method, params) : lifecycleDispatcher(method, params), {
             intervalMs: options.intervalMs
                 ?? reconciliationIntervalMilliseconds(store.getConfig().reconciliationIntervalSeconds),
             signalWindowMs: options.signalWindowMs,
@@ -470,6 +478,26 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             now: options.now,
             onError: options.onError,
             lifecycleHost,
+            providerRetry: createProviderRetryHooks(home, store, {
+                now: options.now,
+                onError: options.onError,
+                snapshotTaskCandidate: async (run) => {
+                    if (run.purpose !== "review" || run.reviewRoundId === undefined)
+                        return undefined;
+                    const round = store.getReviewRound(run.taskId, run.reviewRoundId);
+                    if (round?.scope !== "task")
+                        return undefined;
+                    const task = store.getTask(run.taskId);
+                    const workspace = store.getTaskWorkspace(run.taskId);
+                    if (task === null || workspace === null || !(workspacePreparer instanceof FileTaskWorkspacePreparer)) {
+                        throw new Error("Task-final retry requires an observable authoritative Task workspace.");
+                    }
+                    const snapshot = await workspacePreparer.snapshotDirectTaskMain(workspace, task.projectBindings.map(p => p.projectId));
+                    return { schemaVersion: 1, projects: snapshot.projects.map(p => ({
+                            projectId: p.projectId, commit: p.headCommit
+                        })) };
+                }
+            }),
             jobSupervisor,
             globalInputDelivery: () => deliverGlobalInputs(home, store, async (roleName) => {
                 await lifecycleDispatcher("runtime.ensure-role-session", { scope: "global", roleName });
@@ -521,12 +549,12 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         }
         let resourceClose;
         const closeResources = () => {
-            resourceClose ??= Promise.all([
+            resourceClose ??= closeTelemetry().finally(() => Promise.all([
                 web.close(),
                 kernel.close(),
                 asyncStoreClient?.close() ?? Promise.resolve(),
                 inventoryClient?.close() ?? Promise.resolve()
-            ]).then(() => undefined).finally(() => {
+            ])).then(() => undefined).finally(() => {
                 ownedStore?.close();
             });
             return resourceClose;
@@ -561,6 +589,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     catch (error) {
         // The socket may never have opened. Startup failure must still release
         // this attempt's workers/instances instead of leaving an uncallable process.
+        await closeTelemetry().catch(() => undefined);
         await Promise.allSettled([
             closeWeb(),
             closeKernel(),
@@ -617,6 +646,8 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                     authorityEpoch: value.authorityEpoch,
                     authorityOwner: value.authorityOwner,
                     holderId: value.holderId,
+                    boundedText: value.boundedText,
+                    retrySupported: value.retrySupported,
                     now: value.now
                 });
             }
@@ -628,7 +659,15 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                 }
                 throw error;
             }
-            return { recorded: true };
+            const binding = (value.taskId === undefined
+                ? store.getGlobalRoleSessionSet(value.roleName)
+                : store.getTaskRoleSessionSet(value.taskId, value.roleName))?.providerBinding;
+            const retry = binding?.retry;
+            return { recorded: true, ...(retry?.currentAttemptId === value.attemptId && value.boundedText !== undefined
+                    ? { retryInput: {
+                            text: providerRetryPrompt(retry, value.boundedText),
+                            ...(retry.failedNativeTurnId === undefined ? {} : { expectedFailedNativeTurnId: retry.failedNativeTurnId })
+                        } } : {}) };
         }
         if (method === "runtime.provider-turn-submission-resolve") {
             const value = providerTurnControlParams(params);
@@ -648,6 +687,7 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                 status,
                 reason,
                 raw,
+                noProviderWrite: params.providerWrite === "not-issued",
                 now: value.now
             });
             return { recorded: true };
@@ -1207,6 +1247,8 @@ function providerTurnControlParams(params) {
         authorityEpoch: authorityEpoch,
         authorityOwner,
         holderId: requiredParam(value.holderId),
+        ...(value.boundedText === undefined ? {} : { boundedText: requiredParam(value.boundedText) }),
+        ...(value.retrySupport === undefined ? {} : { retrySupported: value.retrySupport === "codex-failed-turn-v1" }),
         now: new Date(observedAt)
     };
 }

package/dist/controller/runtimeEventProcessor.js

@@ -1,18 +1,15 @@
 import { isRuntimeTokenEvidence } from "../runtime/runtimeObservation.js";
-import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
 const DEFAULT_MAX_RUNTIME_EVENTS_PER_DRAIN = 64;
 /** Folds immutable Hook facts in one bounded transaction before acknowledging them. */
 export class FileRuntimeEventProcessor {
     inbox;
     observer;
     options;
-    drivers;
     drainLaneCursor = 0;
     constructor(inbox, observer, options = {}) {
         this.inbox = inbox;
         this.observer = observer;
         this.options = options;
-        this.drivers = options.drivers ?? builtinAgentDriverRegistry();
     }
     drain(now) {
         const acknowledgedEventIds = [];
@@ -540,13 +537,11 @@ export class AsyncRuntimeEventProcessor {
     inbox;
     observer;
     options;
-    drivers;
     drainLaneCursor = 0;
     constructor(inbox, observer, options = {}) {
         this.inbox = inbox;
         this.observer = observer;
         this.options = options;
-        this.drivers = options.drivers ?? builtinAgentDriverRegistry();
     }
     async drainAsync(now) {
         const acknowledgedEventIds = [];

package/dist/controller/sessionOwnerReconciliation.js

@@ -132,6 +132,11 @@ export class SessionOwnerReconciliation {
         }
         const result = await terminateSessionOwners(owner, records, this.#terminationPorts(), options);
         if (result.outcome === "stop-confirmed") {
+            // A signalled Host exits into a retained tmux pane. Explicit release
+            // removes that window too, after physical exit proof, not on observation.
+            if (records.length > 0) {
+                this.#tmux?.killRole(owner.scope === "task" ? owner.taskId : "operator", owner.roleName);
+            }
             for (const record of result.confirmed) {
                 this.#store.removeSessionOwner(sessionOwnerProcessKey(record));
             }

package/dist/controller/taskAgentError.js

@@ -0,0 +1,35 @@
+import { createTaskEvent } from "../event/taskEvent.js";
+import { redactAgentErrorText } from "../runtime/agentError.js";
+import { captureAgentFailureContext } from "../runtime/agentFailureContext.js";
+/** One persistence boundary. Ingress owns Provider classification, execution
+ * fences and routing; this writer never invents an execution or recovery plan. */
+export function recordTaskAgentError(store, input, now) {
+    return store.transaction(tx => {
+        const error = input.error;
+        const payload = {
+            ...Object.fromEntries(Object.entries(input.evidence ?? {}).filter((entry) => typeof entry[1] === "string" && (entry[0] === "lastOutput" || entry[1].trim().length > 0))),
+            sourceEventId: input.sourceEventId, roleName: input.roleName,
+            agentId: input.agentId, adapterId: input.adapterId, driverId: input.driverId,
+            source: error.source, phase: error.phase, category: error.category, code: error.code,
+            message: redactAgentErrorText(error.message), raw: redactAgentErrorText(error.raw),
+            inputDisposition: error.inputDisposition, sessionDisposition: error.sessionDisposition,
+            ...(error.retryAfterMs === undefined ? {} : { retryAfterMs: String(error.retryAfterMs) })
+        };
+        const identity = ["sourceEventId", "roleName", "agentId", "adapterId", "driverId",
+            "source", "phase", "category", "code", "inputDisposition", "sessionDisposition",
+            "runId", "attemptId", "nativeSessionId", "nativeTurnId", "observationEventId",
+            "message", "errorName", "causeName", "hostState", "registrationDisposition",
+            "retryAfterMs", "lastOutput", ...(payload.attemptId === undefined ? ["raw"] : [])];
+        const duplicate = [...tx.listEventsByType(input.taskId, ["runtime.agent-error"])].reverse().find(event => identity.every(key => event.payload[key] === payload[key]));
+        // Keep the first original raw cause/configuration for a fixed failure.
+        // Changed normalized facts are distinct evidence, not a replay.
+        if (duplicate !== undefined)
+            return { event: duplicate, created: false };
+        const event = createTaskEvent(tx.nextEventId(input.taskId), input.taskId, "runtime.agent-error", {
+            ...payload,
+            capabilityContext: captureAgentFailureContext(input.effective, input.effective === undefined ? null : tx.getConfiguredAgent(input.effective.agentId))
+        }, now);
+        tx.saveEvent(input.taskId, event);
+        return { event, created: true };
+    });
+}

package/dist/coordination/workMailboxQueue.js

@@ -1,18 +1,11 @@
 import { completeProcessing, consumePendingBatch, createWorkMailbox, enqueueSignal, mailboxBatches, mailboxEntityRefKey } from "./workMailbox.js";
-const LEGACY_ROLE_RUN_DISPATCH_REASONS = new Set([
-    "turn-dispatched",
-    "turn-retried",
-    "review-requested",
-    "workitem-synthesis-ready",
-    "review-synthesis-ready"
-]);
 /** Atomically useful when called inside the caller's TaskStore transaction. */
 export function enqueueWork(store, target, reason, occurredAt, refs = [], metadata = {}) {
     const mailbox = store.getWorkMailbox(target) ?? createWorkMailbox(target);
     // Archive is an admission boundary, not an acknowledgement of old input.
     // Runtime cleanup mailboxes remain usable for exact-owner recovery.
     if ((target.kind === "task" || target.kind === "role")
-        && store.getTask?.(target.taskId)?.status === "archived")
+        && store.getTask(target.taskId)?.status === "archived")
         return mailbox;
     const queued = enqueueSignal(mailbox, {
         reason,
@@ -79,26 +72,11 @@ export function captureRoleRunDispatch(mailbox, input) {
             };
         }
     }
-    // Valid earlier dispatches used sequence-generated dedupe keys and could
-    // include a companion WorkItem ref. Consume that complete legacy batch once
-    // the exact AgentRun reaches an accepted or terminal boundary.
-    if (pending.requestCount === 1
-        && pending.sources.length === 1
-        && pending.sources[0] === "yui"
-        && pending.reasons.some((reason) => LEGACY_ROLE_RUN_DISPATCH_REASONS.has(reason))
-        && pending.refs.some((ref) => (mailboxEntityRefKey(ref) === mailboxEntityRefKey(exactRef)))) {
-        return {
-            kind: "pending",
-            fromSequence: pending.fromSequence,
-            toSequence: pending.toSequence
-        };
-    }
     return null;
 }
 /**
  * Settles one exact ordinary Role AgentRun dispatch. Provider acceptance is the
- * normal boundary; terminalization calls the same operation for conclusively
- * unaccepted and valid earlier dispatches.
+ * normal boundary; terminalization uses the same exact dispatch identity.
  */
 export function settleRoleRunDispatch(store, input, expected) {
     if (expected === null)

package/dist/core/controllerClient.js

@@ -2,10 +2,10 @@ import { randomUUID } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
 import { createConnection } from "node:net";
 import { join } from "node:path";
-import { CONTROLLER_DISCOVERY_PATH, FILE_TASK_CONTROLLER_PROTOCOL_VERSION, MAX_CONTROLLER_MESSAGE_BYTES, ControllerProtocolError, encodeControllerRequest, parseControllerDiscovery, parseControllerResponse } from "./protocol.js";
 import { isControllerSocketPathForHome } from "./controllerEndpoint.js";
-import { readHomeFilesystemId } from "./homeFilesystemIdentity.js";
 import { findLiveControllerProcessForHome, inspectLiveControllerProcess } from "./controllerProcessIdentity.js";
+import { readHomeFilesystemId } from "./homeFilesystemIdentity.js";
+import { CONTROLLER_DISCOVERY_PATH, ControllerProtocolError, encodeControllerRequest, FILE_TASK_CONTROLLER_PROTOCOL_VERSION, MAX_CONTROLLER_MESSAGE_BYTES, parseControllerDiscovery, parseControllerResponse } from "./protocol.js";
 export class ControllerClientError extends Error {
     code;
     constructor(code, message) {

package/dist/core/fileLockOwner.js

@@ -0,0 +1,74 @@
+import { lstatSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+/** One process generation, shared by file-lock producers and reclaim checks. */
+export function currentFileLockOwner() {
+    return `${process.pid}:${readProcessStart(process.pid)}`;
+}
+/**
+ * False requires proof of absence or a different process generation.
+ * Missing publication, invalid identity and unavailable OS evidence are not
+ * dead owners: callers retain the lock and report the bounded diagnosis.
+ */
+export function fileLockOwnerIsLive(lock) {
+    let owner;
+    try {
+        owner = readFileSync(join(lock, "owner"), "utf8").trim();
+    }
+    catch (error) {
+        if (hasCode(error, "ENOENT")) {
+            try {
+                lstatSync(lock);
+            }
+            catch (statError) {
+                if (hasCode(statError, "ENOENT"))
+                    return false;
+            }
+        }
+        throw unverified(lock);
+    }
+    const match = /^([1-9][0-9]*):(0|[1-9][0-9]{0,31})$/u.exec(owner);
+    const pid = Number(match?.[1]);
+    if (match === null || !Number.isSafeInteger(pid))
+        throw unverified(lock);
+    try {
+        return processGenerationIsLive(pid, match[2]);
+    }
+    catch {
+        throw unverified(lock);
+    }
+}
+/** A known generation is live, provably gone, or unverified (throws). */
+export function processGenerationIsLive(pid, startIdentity) {
+    if (!Number.isSafeInteger(pid) || pid < 1 || !/^(0|[1-9][0-9]{0,31})$/u.test(startIdentity)) {
+        throw new Error(`Unverified process generation for PID ${pid}.`);
+    }
+    try {
+        return readProcessStart(pid) === startIdentity;
+    }
+    catch {
+        // PID liveness can prove a process is gone, never prove its generation.
+        try {
+            process.kill(pid, 0);
+        }
+        catch (error) {
+            if (hasCode(error, "ESRCH"))
+                return false;
+        }
+        throw new Error(`Unverified process generation for PID ${pid}; OS identity could not be read.`);
+    }
+}
+function readProcessStart(pid) {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    const close = stat.lastIndexOf(")");
+    const start = close < 0 ? undefined : stat.slice(close + 2).trim().split(/\s+/u)[19];
+    if (start === undefined || !/^(0|[1-9][0-9]{0,31})$/u.test(start)) {
+        throw new Error(`Process start identity is unavailable for PID ${pid}.`);
+    }
+    return start;
+}
+function unverified(lock) {
+    return new Error(`Unverified lock owner identity: ${lock}. Preserve the lock and inspect its owner before cleanup.`);
+}
+function hasCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}

package/dist/decision/decision.js

@@ -1,4 +1,21 @@
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
+import { requireTimestamp } from "../domain/validation.js";
+export function validateDecision(decision) {
+    if (decision.schemaVersion !== 1)
+        throw new Error("Decision must use schemaVersion 1.");
+    validateTaskRecordReference({ taskId: decision.taskId, localId: decision.id }, "decision");
+    requireText(decision.title, "Decision title");
+    requireText(decision.rationale, "Decision rationale");
+    requireTimestamp(decision.createdAt, "Decision createdAt");
+    requireTimestamp(decision.updatedAt, "Decision updatedAt");
+    if (decision.status !== "active" && decision.status !== "superseded")
+        throw new Error("Decision status is invalid.");
+    if (decision.status === "superseded") {
+        requireText(decision.supersededReason, "Decision supersede reason");
+        requireTimestamp(decision.supersededAt, "Decision supersededAt");
+    }
+    return decision;
+}
 export function createDecision(id, taskId, title, rationale, now) {
     const timestamp = now.toISOString();
     return {

package/dist/doctor/doctor.js

@@ -3,20 +3,20 @@ import { isAbsolute, join } from "node:path";
 import Database from "better-sqlite3";
 import { configuredAgentToDefinition, resolveAgentEnvironment } from "../agent/agent.js";
 import { operationalAgentEnvironment } from "../agent/launchEnvironment.js";
+import { resolveTmuxBin } from "../config/yuiConfig.js";
+import { compileRoleSessionContext } from "../context/roleSessionContext.js";
+import { EPHEMERAL_DOMAIN_GRACE_MS, readEphemeralDomainIdentity, readLinuxProcessStartIdentity } from "../controller/domainIdentity.js";
+import { usageError } from "../errors/cliError.js";
 import { inspectAgentCapabilities, resolveAgentAdapter } from "../executor/agentAdapter.js";
 import { assertCodexLaunchOverridesAvailable, inspectCodexLaunchConfig } from "../executor/codexConfigConflict.js";
-import { nativeAdditionalDirectories, nativeAgentWorkspace, withNativeProjectDirectories } from "../executor/fileRoleLaunchPlanner.js";
 import { resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
-import { compileRoleSessionContext } from "../context/roleSessionContext.js";
-import { usageError } from "../errors/cliError.js";
+import { nativeAdditionalDirectories, nativeAgentWorkspace, withNativeProjectDirectories } from "../executor/fileRoleLaunchPlanner.js";
 import { defaultTableWidth, renderTable } from "../output/table.js";
-import { resolveYuiHome } from "../storage/taskStore.js";
 import { CURRENT_DATABASE_FILENAME, openCurrentTaskStore } from "../storage/currentTaskStore.js";
 import { inspectStorageSchema } from "../storage/storageSchema.js";
 import { resolveStoreWorkerEnabledForHome } from "../storage/storeRpc.js";
-import { resolveTmuxBin } from "../config/yuiConfig.js";
+import { resolveYuiHome } from "../storage/taskStore.js";
 import { CommandExecutionError } from "../tmux/commandExecutor.js";
-import { EPHEMERAL_DOMAIN_GRACE_MS, readEphemeralDomainIdentity, readLinuxProcessStartIdentity } from "../controller/domainIdentity.js";
 /**
  * The storage-relevant doctor checks, in the order they are produced. Post-update
  * verification (P1-3) keys off exactly these: a green `yui doctor` for the update
@@ -243,7 +243,7 @@ function checkSchema(state) {
     }
 }
 /** Diagnose admission to the exact current storage contract without repair. */
-function inspectCompatibility(home, homeCheck, schema) {
+function inspectCompatibility(_home, homeCheck, schema) {
     const name = "storage compatibility";
     if (homeCheck.status !== "ok") {
         return { check: { name, status: homeCheck.status, detail: homeCheck.detail } };
@@ -311,8 +311,10 @@ function inspectState(home, homeCheck, schema, compatibility) {
     if (!existsSync(databasePath)) {
         return blockedStorage("invalid", "Current storage is incomplete: yui.db is missing.");
     }
+    let ownedStore;
     try {
-        const store = openCurrentTaskStore(home);
+        const store = ownedStore = openCurrentTaskStore(home);
+        store.validateCurrentRecords();
         const config = store.getConfig();
         const agents = store.listConfiguredAgents();
         const tasks = store.listTasks();
@@ -346,6 +348,9 @@ function inspectState(home, homeCheck, schema, compatibility) {
     catch (error) {
         return blockedStorage("invalid", errorMessage(error));
     }
+    finally {
+        ownedStore?.close();
+    }
 }
 function storageBlockerDetail(check) {
     const corruptionPrefix = "unsupported (CORRUPTED): ";
@@ -755,8 +760,9 @@ function errorMessage(error) {
  * the Home store cannot be opened (the doctor must still run on broken Homes).
  */
 function readDurableConfigSafely(home) {
+    let ownedStore;
     try {
-        const store = openCurrentTaskStore(home);
+        const store = ownedStore = openCurrentTaskStore(home);
         const config = store.getConfig();
         return {
             tmuxBin: resolveTmuxBin(config.tmuxBin),
@@ -766,4 +772,7 @@ function readDurableConfigSafely(home) {
     catch {
         return { tmuxBin: "tmux", gitBin: "git" };
     }
+    finally {
+        ownedStore?.close();
+    }
 }

package/dist/event/taskEvent.js

@@ -1,4 +1,5 @@
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
+import { requireTimestamp } from "../domain/validation.js";
 export function createTaskEvent(id, taskId, type, payload, now) {
     const event = {
         schemaVersion: 2,
@@ -8,7 +9,18 @@ export function createTaskEvent(id, taskId, type, payload, now) {
         payload: normalizePayload(payload),
         createdAt: now.toISOString()
     };
+    return validateTaskEvent(event);
+}
+export function validateTaskEvent(event) {
+    if (event.schemaVersion !== 2)
+        throw new Error("Task Event must use schemaVersion 2.");
     validateTaskRecordReference({ taskId: event.taskId, localId: event.id }, "event");
+    requireText(event.type, "Task event type");
+    if (event.payload === null || typeof event.payload !== "object" || Array.isArray(event.payload)) {
+        throw new Error("Task event payload must be an object.");
+    }
+    normalizePayload(event.payload);
+    requireTimestamp(event.createdAt, "Task event createdAt");
     return event;
 }
 /**

package/dist/execution/workItemExecutionProjection.js

@@ -1,5 +1,5 @@
-import { governingWorkItemCandidate, currentWorkItemExecutionGroup } from "../workItem/workItem.js";
 import { synthesisSourceRunIds } from "../context/runContextPack.js";
+import { currentWorkItemExecutionGroup, governingWorkItemCandidate } from "../workItem/workItem.js";
 export function projectWorkItemExecution(item, runs, sessionSets = [], sourceStore) {
     const group = currentWorkItemExecutionGroup(item);
     const relevantRuns = runs.filter((run) => run.workItemId === item.id);
@@ -164,7 +164,7 @@ function projectMainRun(item, group, runs, sessionsByRole) {
         observation: run.result === undefined ? "unobserved" : "observed"
     });
 }
-function projectSynthesis(group, lanes, mainRun) {
+function projectSynthesis(group, _lanes, mainRun) {
     if (group === undefined) {
         return Object.freeze({
             status: "not-applicable",

package/dist/executor/agentCapabilityConfig.js

@@ -0,0 +1,43 @@
+import { isAbsolute } from "node:path";
+import { isAgentAdapterId } from "../agent/adapterCatalog.js";
+/** Project an existing Role/launch config without changing its native values. */
+export function projectAgentCapabilityConfig(config) {
+    return validateAgentCapabilityConfig({
+        adapterId: config.adapterId,
+        ...(config.model === undefined ? {} : { model: config.model }),
+        ...(config.effort === undefined ? {} : { effort: config.effort }),
+        ...(config.adapterId !== "codex" || config.profile === undefined ? {} : { profile: config.profile }),
+        ...(config.adapterId !== "claude" || config.settingsFile === undefined ? {} : { settingsFile: config.settingsFile }),
+        ...(config.adapterId !== "claude" || config.settingsSources === undefined ? {} : { settingsSources: [...config.settingsSources] })
+    });
+}
+export function validateAgentCapabilityConfig(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Agent capability configuration is invalid.");
+    }
+    const config = value;
+    if (!isAgentAdapterId(config.adapterId))
+        throw new Error("Agent capability adapter is invalid.");
+    const keys = ["adapterId", "model", "effort",
+        ...(config.adapterId === "codex" ? ["profile"] : []),
+        ...(config.adapterId === "claude" ? ["settingsFile", "settingsSources"] : [])];
+    if (Object.keys(config).some(key => !keys.includes(key))) {
+        throw new Error("Agent capability configuration contains execution-only or unsupported fields.");
+    }
+    for (const key of ["model", "effort", "profile", "settingsFile"]) {
+        const field = config[key];
+        if (field !== undefined && (typeof field !== "string" || field.trim().length === 0 || field.includes("\0"))) {
+            throw new Error(`Agent capability ${key} is invalid.`);
+        }
+    }
+    if (config.settingsFile !== undefined && !isAbsolute(config.settingsFile)) {
+        throw new Error("Agent capability settings file must be absolute.");
+    }
+    const sources = config.settingsSources;
+    if (sources !== undefined && (!Array.isArray(sources)
+        || sources.some(source => typeof source !== "string" || source.trim().length === 0 || source.includes("\0"))
+        || new Set(sources).size !== sources.length)) {
+        throw new Error("Agent capability settings sources are invalid.");
+    }
+    return config;
+}