@zq-silk/yui 0.15.12 → 0.16.0

package/dist/runtime/agentHost.js

@@ -1,30 +1,30 @@
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, mkdirSync, rmSync } from "node:fs";
-import { tmpdir, homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
 import { createConnection, createServer } from "node:net";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { withSessionContextPointer } from "../context/sessionBootstrapManifest.js";
+import { publishStructuredConversationRecoverability, publishStructuredProviderAccepted, publishStructuredProviderActivity, publishStructuredProviderAttachmentExit, publishStructuredProviderConnection, publishStructuredProviderGoal, publishStructuredProviderInputObserved, publishStructuredProviderInputSettlement, publishStructuredProviderOpened, publishStructuredProviderStarted, publishStructuredProviderTerminal, structuredProviderEventDelivery } from "../controller/structuredProviderObservation.js";
 import { callController, controllerCallMayHaveApplied, ControllerClientError } from "../core/controllerClient.js";
 import { readHomeFilesystemId } from "../core/homeFilesystemIdentity.js";
+import { FILE_TASK_CONTROLLER_PROTOCOL_VERSION } from "../core/protocol.js";
 import { isForeignHandoverLockHeld } from "../release/runtimeRelease.js";
-import { publishStructuredProviderAccepted, publishStructuredProviderAttachmentExit, publishStructuredProviderActivity, publishStructuredProviderInputSettlement, publishStructuredProviderInputObserved, publishStructuredProviderGoal, publishStructuredConversationRecoverability, publishStructuredProviderOpened, publishStructuredProviderStarted, publishStructuredProviderTerminal, publishStructuredProviderConnection, structuredProviderEventDelivery } from "../controller/structuredProviderObservation.js";
-import { validateAgentHostLaunchPayload } from "./launchBroker.js";
-import { ProviderDeliveryUnknownError, ProviderConversationMissingError, ProviderTurnBusyError, ProviderTurnRejectedError } from "./structuredProviderHost.js";
+import { yuiTmuxServerName, yuiTmuxSessionName } from "../tmux/tmuxManager.js";
+import { tmuxSocketDirectory } from "../tmux/tmuxSocketEndpoint.js";
 import { createAgentEndpointOwner } from "./agentEndpointOwnership.js";
-import { sameProviderAuthorityFence, validateProviderAuthorityFence } from "./providerAuthorityFence.js";
+import { providerDeliveryFailure, providerDeliveryFailureFrom, redactAgentErrorText, serializeAgentErrorRaw } from "./agentError.js";
+import { AGENT_HOST_CONTROL_PROTOCOL, AGENT_HOST_EVENT_PROTOCOL } from "./agentHostProtocol.js";
+import { readAgentRunConfigurationObservation, unknownAgentRunConfiguration } from "./agentRunConfiguration.js";
+import { CodexPreSubmissionError } from "./codexAppServerRuntime.js";
+import { runCodexInteractiveHost } from "./codexInteractiveHost.js";
+import { validateAgentHostLaunchPayload } from "./launchBroker.js";
 import { validateRuntimeProcessExitObservation } from "./processExitObservation.js";
 import { persistRuntimeProcessExitObservation, replayRuntimeProcessExitOutbox } from "./processExitOutbox.js";
+import { sameProviderAuthorityFence, validateProviderAuthorityFence } from "./providerAuthorityFence.js";
+import { ProviderConversationMissingError, ProviderDeliveryUnknownError, ProviderTurnBusyError, ProviderTurnRejectedError } from "./providerErrors.js";
 import { AGENT_HOST_CLIENT_EXIT_GRACE_MS, AGENT_HOST_CONTROL_TIMEOUT_MS, AGENT_HOST_READY_TIMEOUT_MS, ENDPOINT_DRAIN_TIMEOUT_MS, PROVIDER_ACCEPT_TIMEOUT_MS } from "./runtimeDeadlines.js";
-import { providerDeliveryFailure, providerDeliveryFailureFrom, redactAgentErrorText, serializeAgentErrorRaw } from "./agentError.js";
-import { runCodexInteractiveHost } from "./codexInteractiveHost.js";
-import { CodexPreSubmissionError } from "./codexAppServerRuntime.js";
-import { readAgentRunConfigurationObservation, unknownAgentRunConfiguration } from "./agentRunConfiguration.js";
 import { createSessionOwnerIdentity, readLinuxProcessIdentity } from "./sessionOwnerIdentity.js";
-import { yuiTmuxServerName, yuiTmuxSessionName } from "../tmux/tmuxManager.js";
-import { tmuxSocketDirectory } from "../tmux/tmuxSocketEndpoint.js";
-import { AGENT_HOST_CONTROL_PROTOCOL, AGENT_HOST_EVENT_PROTOCOL } from "./agentHostProtocol.js";
-import { FILE_TASK_CONTROLLER_PROTOCOL_VERSION } from "../core/protocol.js";
 export { AGENT_HOST_CONTROL_PROTOCOL } from "./agentHostProtocol.js";
 const HOST_CONTROL_MAX_BYTES = 32 * 1024;
 const CODEX_CLIENT_STABLE_MS = 5_000;
@@ -77,7 +77,7 @@ export async function runAgentHost(input) {
     if (payload.environment.YUI_SESSION_SCOPE === "global"
         && payload.environment.YUI_ADAPTER_ID === "codex"
         && payload.providerControl === undefined) {
-        return runCodexInteractiveHost(input.home, payload);
+        return runCodexInteractiveHost(input.home, payload, openAgentHostControl);
     }
     let session;
     // This process really holds the Endpoint code its Session runs on. The lease

package/dist/runtime/codexInteractiveHost.js

@@ -2,7 +2,7 @@ import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { once } from "node:events";
 import WebSocket, { WebSocketServer } from "ws";
-import { AGENT_HOST_CONTROL_PROTOCOL, openAgentHostControl } from "./agentHost.js";
+import { AGENT_HOST_CONTROL_PROTOCOL } from "./agentHostProtocol.js";
 import { openCodexInteractiveConnection } from "./structuredProviderHost.js";
 /**
  * Keep the native TUI and its transparent App Server attachment in one pane.
@@ -13,7 +13,7 @@ import { openCodexInteractiveConnection } from "./structuredProviderHost.js";
  * until its first message. Observing the TUI's own startup avoids creating a
  * second Thread or manufacturing a bootstrap message to materialize history.
  */
-export async function runCodexInteractiveHost(home, payload) {
+export async function runCodexInteractiveHost(home, payload, openAgentHostControl) {
     const environment = payload.environment;
     if (environment.YUI_SESSION_SCOPE !== "global" || environment.YUI_ADAPTER_ID !== "codex"
         || payload.providerControl !== undefined) {

package/dist/runtime/index.js

@@ -9,7 +9,6 @@ export { promptPushOutcome, RuntimeHostContentionError, RuntimeHostUnavailableEr
 export { AgentHostPromptPushAdapter, TmuxSessionHost } from "./tmuxAdapters.js";
 export { FileTaskRuntimeIsolation, YUI_TASK_RUNTIME_ISOLATION_DESCRIPTOR, YUI_TASK_RUNTIME_SERVICE_NAMESPACE, assertTaskRuntimeIsolationPreflight, createTaskRuntimeIsolationDescriptor, parseTaskRuntimeIsolationDescriptor, planTaskRuntimeCleanup, taskRuntimeIsolationEnvironment, taskRuntimeIsolationFingerprint } from "./taskRuntimeIsolation.js";
 export { createSessionOwnerIdentity, isLinuxProcessLive, listOwnedProcessTree, readLinuxProcessIdentity } from "./sessionOwnerIdentity.js";
-export { FileSessionOwnerRegistry } from "./sessionOwnerRegistry.js";
 export { formatRuntimeLaunchDiagnostic, redactLaunchArgument, redactLaunchText, RuntimeLaunchFailure, toRuntimeLaunchFailure } from "./launchDiagnostics.js";
 export { DEFAULT_FORCED_GRACE_MS, DEFAULT_GRACEFUL_GRACE_MS, terminateSessionOwners } from "./sessionTerminationGuard.js";
 export { ProviderContinuationReconciliationService } from "./providerContinuationReconciliationService.js";

package/dist/runtime/managedCaller.js

@@ -2,6 +2,26 @@ import { activeRoleAgentBinding } from "../role/role.js";
 import { currentProviderConversation } from "./providerRuntimeIdentity.js";
 /** Native Session identity supplied by the Agent transport. */
 export const MANAGED_NATIVE_SESSION_ENV = "YUI_NATIVE_SESSION_ID";
+/** Global writes use the same command-time native identity as Task writes.
+ * A Manifest locates context; it is not continuing mutation authority. */
+export function requireManagedGlobalCaller(store, env) {
+    const name = identity(env.YUI_ROLE);
+    const role = name === undefined ? null : store.getGlobalRole(name);
+    const binding = role?.agentBindings[role.activeAgentId];
+    const set = name === undefined ? null : store.getGlobalRoleSessionSet(name);
+    const session = set?.sessions[set.activeAgentId];
+    const nativeSessionId = identity(binding?.adapterId === "codex"
+        ? env.CODEX_THREAD_ID ?? env.YUI_NATIVE_SESSION_ID : env.YUI_NATIVE_SESSION_ID);
+    if (env.YUI_SESSION_SCOPE !== "global" || env.YUI_TASK_ID !== undefined
+        || !role || !binding || !set || !session || session.status !== "active"
+        || set.activeAgentId !== role.activeAgentId || session.agentId !== binding.agentId
+        || session.adapterId !== binding.adapterId || nativeSessionId !== session.nativeSessionId
+        || (env.YUI_AGENT_ID !== undefined && env.YUI_AGENT_ID !== session.agentId)
+        || (env.YUI_ADAPTER_ID !== undefined && env.YUI_ADAPTER_ID !== session.adapterId)) {
+        throw new ManagedRuntimeDriftError("This command requires the current managed global native Session; the previous Session has no write authority.");
+    }
+    return { roleName: role.name, agentId: session.agentId, adapterId: session.adapterId, nativeSessionId };
+}
 /**
  * A managed Session presented valid self-identity but is no longer the current
  * runtime of its Task Role. This is a bounded diagnosis rather than a bare
@@ -119,7 +139,7 @@ function requireCurrentRuntime(store, self) {
         throw new ManagedRuntimeDriftError(`This managed Session carries no native session id, so it cannot be recognized `
             + `as the current runtime of ${self.taskId}/${self.roleName}.`);
     }
-    if (role.name === "leader" && store.listEvents(self.taskId).some((event) => event.type === "role.agent-bound" && event.payload.role === role.name
+    if (role.name === "leader" && store.listEventsByType(self.taskId, ["role.agent-bound"]).some((event) => event.type === "role.agent-bound" && event.payload.role === role.name
         && event.payload.revokedNativeSessionId === self.nativeSessionId)) {
         throw new ManagedRuntimeDriftError("This Leader native Session's management authority was explicitly revoked.");
     }

package/dist/runtime/providerErrors.js

@@ -0,0 +1,38 @@
+export class ProviderDeliveryUnknownError extends Error {
+    attemptId;
+    name = "ProviderDeliveryUnknownError";
+    constructor(message, attemptId, 
+    // Wrapping must not become the end of the causal chain: the original
+    // transport or Controller failure is the reason a reader needs.
+    options) {
+        super(message, options);
+        this.attemptId = attemptId;
+    }
+}
+export class ProviderTurnRejectedError extends Error {
+    attemptId;
+    name = "ProviderTurnRejectedError";
+    constructor(message, attemptId, options) {
+        super(message, options);
+        this.attemptId = attemptId;
+    }
+}
+/** Another ordinary client currently owns the thread's active Turn. */
+export class ProviderTurnBusyError extends Error {
+    attemptId;
+    activeTurnId;
+    name = "ProviderTurnBusyError";
+    constructor(message, attemptId, activeTurnId) {
+        super(message);
+        this.attemptId = attemptId;
+        this.activeTurnId = activeTurnId;
+    }
+}
+export class ProviderConversationMissingError extends Error {
+    conversationId;
+    name = "ProviderConversationMissingError";
+    constructor(conversationId, message) {
+        super(message);
+        this.conversationId = conversationId;
+    }
+}

package/dist/runtime/runtimeObservation.js

@@ -547,11 +547,6 @@ function requireTimestamp(value, label) {
         throw new Error(`${label} is invalid.`);
     return timestamp;
 }
-function requireNonNegativeInteger(value, minimum, label) {
-    if (!Number.isSafeInteger(value) || value < minimum)
-        throw new Error(`${label} is invalid.`);
-    return value;
-}
 function requireIdentity(value, label) {
     const identity = requireText(value, label);
     if (identity.includes("/../") || identity === "__proto__")

package/dist/runtime/runtimeSessionCandidate.js

@@ -18,11 +18,10 @@ export function projectRuntimeSessionCandidate(sessions) {
         sessionUpdatedAt: active.updatedAt
     };
 }
-/** Deterministic owner order shared by all storage backends. */
+/** Deterministic owner order for current runtime discovery. */
 export function compareRuntimeSessionCandidates(left, right) {
     if (left.owner.scope !== right.owner.scope) {
-        // Preserve the historical adapter contract: Task owners precede the
-        // bounded global Role set.
+        // Task owners precede the bounded global Role set.
         return left.owner.scope === "task" ? -1 : 1;
     }
     if (left.owner.scope === "task" && right.owner.scope === "task") {

package/dist/runtime/sessionOwnerIdentity.js

@@ -17,7 +17,7 @@ export function createSessionOwnerIdentity(input) {
         throw new TypeError("Global session owner must not carry a task id.");
     }
     const providerRoot = input.providerRoot;
-    if (!["launch-env", "pane-pid", "owned-child"].includes(providerRoot.attribution)) {
+    if (!["pane-pid", "owned-child"].includes(providerRoot.attribution)) {
         throw new TypeError("Session owner process attribution is invalid.");
     }
     if (!Number.isSafeInteger(providerRoot.pid) || providerRoot.pid <= 0) {

package/dist/runtime/structuredProviderHost.js

@@ -2,13 +2,14 @@ import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { Duplex } from "node:stream";
 import { fileURLToPath } from "node:url";
+import { ProviderConversationMissingError, ProviderDeliveryUnknownError, ProviderTurnBusyError, ProviderTurnRejectedError } from "./providerErrors.js";
 import WebSocket from "ws";
-import { CodexAppServerRequestError, CodexAppServerRuntime, codexClientInitialization, codexGoalNotification, codexAppServerErrorIsMissing, codexTurnInput, codexTurnOutput } from "./codexAppServerRuntime.js";
-import { serializeAgentErrorRaw } from "./agentError.js";
+import { YUI_VERSION } from "../version.js";
 import { AcpStructuredProviderSession } from "./acpSession.js";
 import { acpDesiredSessionConfiguration } from "./acpSessionConfiguration.js";
+import { serializeAgentErrorRaw } from "./agentError.js";
 import { unsupportedAgentRunConfiguration } from "./agentRunConfiguration.js";
-import { YUI_VERSION } from "../version.js";
+import { codexAppServerErrorIsMissing, CodexAppServerRequestError, CodexAppServerRuntime, codexClientInitialization, codexGoalNotification, codexTurnInput, codexTurnOutput } from "./codexAppServerRuntime.js";
 import { JsonLineChannel, PROVIDER_MESSAGE_MAX_BYTES, terminateProcessGroup } from "./jsonLineChannel.js";
 import { PROVIDER_ACCEPT_TIMEOUT_MS } from "./runtimeDeadlines.js";
 const CODEX_PROXY_HANDSHAKE_TIMEOUT_MS = 10_000;
@@ -18,44 +19,6 @@ const CODEX_PROXY_HANDSHAKE_TIMEOUT_MS = 10_000;
  */
 const CODEX_RUN_CONFIGURATION = unsupportedAgentRunConfiguration("The Codex app-server protocol");
 const CLAUDE_RUN_CONFIGURATION = unsupportedAgentRunConfiguration("Claude Code's stream-json interface");
-export class ProviderDeliveryUnknownError extends Error {
-    attemptId;
-    name = "ProviderDeliveryUnknownError";
-    constructor(message, attemptId, 
-    // Wrapping must not become the end of the causal chain: the original
-    // transport or Controller failure is the reason a reader needs.
-    options) {
-        super(message, options);
-        this.attemptId = attemptId;
-    }
-}
-export class ProviderTurnRejectedError extends Error {
-    attemptId;
-    name = "ProviderTurnRejectedError";
-    constructor(message, attemptId, options) {
-        super(message, options);
-        this.attemptId = attemptId;
-    }
-}
-/** Another ordinary client currently owns the thread's active Turn. */
-export class ProviderTurnBusyError extends Error {
-    attemptId;
-    activeTurnId;
-    name = "ProviderTurnBusyError";
-    constructor(message, attemptId, activeTurnId) {
-        super(message);
-        this.attemptId = attemptId;
-        this.activeTurnId = activeTurnId;
-    }
-}
-export class ProviderConversationMissingError extends Error {
-    conversationId;
-    name = "ProviderConversationMissingError";
-    constructor(conversationId, message) {
-        super(message);
-        this.conversationId = conversationId;
-    }
-}
 export async function startStructuredProviderSession(payload, input = {}) {
     const control = payload.providerControl;
     if (control === undefined) {

package/dist/runtime/tmuxAdapters.js

@@ -1,14 +1,14 @@
 import { randomUUID } from "node:crypto";
-import { fileURLToPath } from "node:url";
 import { resolve } from "node:path";
-import { createRuntimeBinding } from "./runtimeBinding.js";
-import { normalizeRuntimeOwner } from "./runtimeOwner.js";
-import { RuntimeHostContentionError, RuntimeHostUnavailableError, promptPushOutcome } from "./ports.js";
+import { fileURLToPath } from "node:url";
 import { providerDeliveryFailureFrom } from "./agentError.js";
+import { AGENT_HOST_CONTROL_PROTOCOL, sendAgentHostLaunchControl, sendAgentHostRunControl, sendAgentHostSteerControl, waitForAgentHostLaunchAck } from "./agentHost.js";
+import { launchBrokerForHome } from "./launchBroker.js";
 import { toRuntimeLaunchFailure } from "./launchDiagnostics.js";
+import { RuntimeHostContentionError, RuntimeHostUnavailableError, promptPushOutcome } from "./ports.js";
+import { createRuntimeBinding } from "./runtimeBinding.js";
+import { normalizeRuntimeOwner } from "./runtimeOwner.js";
 import { requireSafeIdentity } from "./validation.js";
-import { launchBrokerForHome } from "./launchBroker.js";
-import { AGENT_HOST_CONTROL_PROTOCOL, sendAgentHostLaunchControl, sendAgentHostRunControl, sendAgentHostSteerControl, waitForAgentHostLaunchAck } from "./agentHost.js";
 const DEFAULT_INACTIVITY_TIMEOUT_MS = 300_000;
 /**
  * Runtime lifecycle adapter for the current tmux host. The returned hostRef is
@@ -656,8 +656,6 @@ async function killRole(tmux, hostId, roleName) {
     await tmux.killRoleAsync(hostId, roleName);
 }
 async function stopExactRole(tmux, hostId, roleName) {
-    if (await probeRoleStatus(tmux, hostId, roleName) !== "running")
-        return;
     try {
         await killRole(tmux, hostId, roleName);
     }

package/dist/scheduler/activeRoleRunDelivery.js

@@ -25,7 +25,7 @@ export async function processActiveRoleRunDeliveries(store, delivery, now, selec
     for (const task of selectedActiveSchedulerTasks(store, selection, {
         includePlanningDrafts: true
     })) {
-        store.prepareMessageContinuations?.(task.id, now);
+        store.prepareMessageContinuations(task.id, now);
         for (const role of selectedSchedulerRoles(store, task.id, selection)) {
             const run = store.getActiveRun(task.id, role.name);
             if (run === null)
@@ -49,7 +49,7 @@ async function deliverActiveRun(store, delivery, task, role, run, now) {
         roleName: role.name,
         runId: run.id
     });
-    const sessionSet = store.getTaskRoleSessionSet?.(task.id, role.name) ?? null;
+    const sessionSet = store.getTaskRoleSessionSet(task.id, role.name);
     const binding = sessionSet?.providerBinding ?? null;
     if (binding?.retry !== undefined && (binding.retry.successorRunId === run.id
         || binding.retry.successorReviewRoundId !== undefined && binding.retry.successorReviewRoundId === run.reviewRoundId)
@@ -97,7 +97,7 @@ async function deliverActiveRun(store, delivery, task, role, run, now) {
         // report. Keep the exact input fenced; never submit it again.
         return { ...base, status: "skipped", reason: "delivery-uncertain", error: reason };
     }
-    const lastSubmitError = (store.listEvents?.(task.id) ?? []).filter((event) => event.type === "runtime.agent-error" && event.payload.runId === run.id
+    const lastSubmitError = store.listEvents(task.id).filter((event) => event.type === "runtime.agent-error" && event.payload.runId === run.id
         && event.payload.roleName === role.name && event.payload.phase === "turn-submit").at(-1);
     if (currentProviderTurn === null && lastSubmitError?.payload.inputDisposition === "unknown") {
         return { ...base, status: "skipped", reason: "delivery-uncertain", error: lastSubmitError.payload.message };
@@ -114,7 +114,7 @@ async function deliverActiveRun(store, delivery, task, role, run, now) {
     // The first attempted admission may already have opened this fixed native
     // Session. A busy retry resumes it; it does not repeat the original launch.
     const preparedHere = existingSession?.nativeSessionId !== undefined
-        && (store.listEvents?.(task.id) ?? []).some((event) => event.type === "run.session-prepared"
+        && store.listEvents(task.id).some((event) => event.type === "run.session-prepared"
             && event.payload.runId === run.id && event.payload.nativeSessionId === existingSession.nativeSessionId);
     const mode = (currentProviderTurn?.status === "deferred" || preparedHere) && existingSession?.nativeSessionId !== undefined
         ? "resume" : run.mode;
@@ -183,7 +183,7 @@ async function deliverActiveRun(store, delivery, task, role, run, now) {
         }
         if (outcome.status === "busy" || outcome.status === "unavailable") {
             if (outcome.status === "busy" && outcome.failure?.inputDisposition === "not-accepted") {
-                store.recordAgentError?.({ taskId: task.id, roleName: role.name, runId: run.id,
+                store.recordAgentError({ taskId: task.id, roleName: role.name, runId: run.id,
                     source: "host", phase: "turn-submit", message: outcome.failure.detail,
                     raw: outcome.failure.raw ?? serializeAgentErrorRaw(outcome.failure),
                     inputDisposition: "not-accepted", ...providerDeliveryFailureFacts(outcome.failure),
@@ -208,7 +208,7 @@ async function deliverActiveRun(store, delivery, task, role, run, now) {
                 : formatProviderDeliveryFailure(failure);
             // This path is the common Provider write failure and previously left no
             // durable fact at all, so the cause was unrecoverable after the fact.
-            store.recordAgentError?.({
+            store.recordAgentError({
                 taskId: task.id,
                 roleName: role.name,
                 runId: run.id,
@@ -238,7 +238,7 @@ async function deliverActiveRun(store, delivery, task, role, run, now) {
         const message = error instanceof Error ? error.message : String(error);
         // Preserve the structured cause alongside the readable diagnosis.
         const causeName = innermostCauseName(error);
-        store.recordAgentError?.({
+        store.recordAgentError({
             taskId: task.id,
             roleName: role.name,
             runId: run.id,

package/dist/scheduler/leaderWakeupProcessor.js

@@ -4,6 +4,9 @@ import { isSchedulerTaskWorkspaceReady } from "./ports.js";
 import { taskOwnsManagedWorkspace } from "../task/task.js";
 import { hasImmediateWakeReason } from "./wakeReason.js";
 import { providerRetryPending } from "../runtime/providerRetry.js";
+import { RuntimeLaunchError } from "../runtime/ports.js";
+import { RuntimeLifecycleBusyError } from "../runtime/lifecycleReservation.js";
+import { redactAgentErrorText } from "../runtime/agentError.js";
 export const LEADER_WAKE_AGGREGATION_MS = 60_000;
 /** Deliver a durable mailbox notification, not an implicit execution assignment.
  * Acceptance settles only its claimed batch; no Agent report is required.
@@ -29,11 +32,11 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
             results.push({ ...base, status: "skipped", reason: "aggregating" });
             continue;
         }
-        if (task.status === "draft" && store.prepareDraftPlanning?.(task.id, now)) {
+        if (task.status === "draft" && store.prepareDraftPlanning(task.id, now)) {
             results.push({ ...base, status: "skipped", reason: "not-ready" });
             continue;
         }
-        const sessions = store.getTaskRoleSessionSet?.(task.id, role.name) ?? null;
+        const sessions = store.getTaskRoleSessionSet(task.id, role.name);
         const provider = sessions?.providerBinding;
         if (providerRetryPending(provider)) {
             results.push({ ...base, status: "skipped", reason: "not-ready" });
@@ -55,13 +58,17 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
                 ...(notification.disposition === "unknown" ? {
                     error: `Notification acceptance is unknown; the fixed wake is retained and will not be replayed. `
                         + `After establishing native quiescence, release only this claim with yui task wake resolve ${task.id} ${notification.wakeId} --reason <evidence>.`
+                } : notification.disposition === "rejected" ? {
+                    error: `Notification was rejected; inspect yui task wake show ${task.id} ${notification.wakeId}. `
+                        + `After correcting the cause, retry with yui task wake retry ${task.id} ${notification.wakeId} --reason <correction>.`
                 } : {}) });
             continue;
         }
         let attempted = false;
+        let effective = role.effective;
         try {
             const session = store.getRoleSession(task.id, role.name, role.effective.agentId);
-            const effective = session?.status === "active" ? session.effective : role.effective;
+            effective = session?.status === "active" ? session.effective : role.effective;
             if (session?.status === "active" && !roleSessionMayContinue(session.effective, role.effective)) {
                 throw new Error("Leader Session configuration changed; explicitly apply it before notification delivery.");
             }
@@ -96,12 +103,18 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
                     : outcome.status === "rejected" ? "rejected"
                         : outcome.status === "pending" ? null : "deferred";
             if (disposition !== null)
-                store.settleLeaderNotification(task.id, notification.attemptId, disposition, now, outcome.failure?.detail);
+                store.settleLeaderNotification(task.id, notification.attemptId, disposition, now, outcome.failure?.detail, { effective, raw: outcome.failure?.raw ?? outcome.failure?.detail ?? `Notification ${disposition}.`,
+                    phase: "turn-submit" });
             results.push({ ...base, status: accepted ? "dispatched" : "skipped", reason: accepted ? undefined : "not-ready" });
         }
         catch (error) {
-            const detail = error instanceof Error ? error.message : String(error);
-            store.settleLeaderNotification(task.id, notification.attemptId, attempted ? "unknown" : "deferred", now, detail);
+            const detail = redactAgentErrorText(error instanceof Error ? error.message : String(error));
+            // Match explicit AgentRun admission: only positive, typed backpressure
+            // permits another automatic launch. A config/auth/executable failure
+            // needs correction; an exception after submit cannot authorize replay.
+            const retryable = error instanceof RuntimeLifecycleBusyError
+                || (error instanceof RuntimeLaunchError && error.retryable);
+            store.settleLeaderNotification(task.id, notification.attemptId, attempted ? "unknown" : retryable ? "deferred" : "rejected", now, detail, { effective, raw: detail, phase: attempted ? "turn-submit" : "session-start" });
             results.push({ ...base, status: "failed", reason: "not-ready", error: detail });
         }
         finally {

package/dist/scheduler/operatorEvent.js

@@ -1,31 +1,23 @@
 import { enqueueWork } from "../coordination/workMailboxQueue.js";
 import { createTaskEvent } from "../event/taskEvent.js";
-import { queueLeaderWakeup } from "./wakeupQueue.js";
 export const LEADER_ATTENTION_REQUIRED_EVENT = "leader.attention-required";
-/** The sole Task-event boundary into the global Operator mailbox. */
-export function enqueueOperatorEvent(store, event, reason, now) {
-    if (store.getTask?.(event.taskId)?.status === "archived")
+/** One event, one supervisor signal; the Leader wake is this mailbox's projection. */
+export function enqueueSupervisorEvent(store, event, recipient, reason, now) {
+    if (store.getTask(event.taskId)?.status === "archived")
         return;
-    enqueueWork(store, { kind: "operator" }, reason, now, [
+    const target = recipient === "operator" ? { kind: "operator" }
+        : { kind: "role", taskId: event.taskId, roleName: "leader" };
+    enqueueWork(store, target, reason, now, [
         { type: "event", taskId: event.taskId, id: event.id }
-    ], {
-        source: "task-event",
-        dedupeKey: `operator-event:${event.taskId}:${event.id}`
-    });
+    ], { source: "task-event", dedupeKey: `${recipient}-event:${event.taskId}:${event.id}` });
+}
+/** The sole Task-event boundary into the global Operator mailbox. */
+export function enqueueOperatorEvent(store, event, reason, now) {
+    enqueueSupervisorEvent(store, event, "operator", reason, now);
 }
 /** Routes one Role fact to its supervisor without exposing Provider details to Operator code. */
 export function routeRoleEvent(store, event, roleName, reason, now) {
-    if (store.getTask?.(event.taskId)?.status === "archived")
-        return;
-    if (roleName === "leader") {
-        enqueueOperatorEvent(store, event, reason, now);
-        return;
-    }
-    enqueueWork(store, { kind: "role", taskId: event.taskId, roleName: "leader" }, reason, now, [{ type: "event", taskId: event.taskId, id: event.id }], {
-        source: "task-event",
-        dedupeKey: `leader-event:${event.taskId}:${event.id}`
-    });
-    queueLeaderWakeup(store, event.taskId, reason, now);
+    enqueueSupervisorEvent(store, event, roleName === "leader" ? "operator" : "leader", reason, now);
 }
 /** Records the semantic boundary used when a Leader can no longer continue. */
 export function recordLeaderAttentionRequired(store, input) {

package/dist/scheduler/operatorInputNotificationProcessor.js

@@ -26,7 +26,7 @@ export async function processOperatorInputNotifications(store, delivery, selecti
                 ? [{ kind: "input", request }]
                 : [];
         }
-        if (ref.type !== "event" || store.listEvents === undefined)
+        if (ref.type !== "event")
             return [];
         const event = store.listEvents(ref.taskId).find(({ id }) => id === ref.id);
         return event === undefined ? [] : [{ kind: "event", event }];

package/dist/scheduler/ports.js

@@ -1,5 +1,5 @@
-import { isTaskOwnedWorkspace } from "../worktree/managedWorkspace.js";
 import { taskOwnsManagedWorkspace } from "../task/task.js";
+import { isTaskOwnedWorkspace } from "../worktree/managedWorkspace.js";
 /**
  * Whether the Task's workspace state admits a launch.
  *
@@ -72,14 +72,11 @@ export function selectedActiveSchedulerTasks(store, selection, options) {
         return planningDrafts && hasActivePlanningRun(store, task);
     };
     if (selection === undefined || selection.full) {
-        const indexedTaskIds = store.listActiveTaskIds?.();
-        if (indexedTaskIds === undefined) {
-            return store.listTasks().filter((task) => (admits(task) && !selection?.blockedTaskIds?.has(task.id)));
-        }
+        const indexedTaskIds = store.listActiveTaskIds();
         // The active index is bounded and authoritative for active Tasks; planning
         // Drafts come from their own bounded index rather than a full-history scan.
         const taskIds = planningDrafts
-            ? [...indexedTaskIds, ...(store.listPlanningDraftTaskIds?.() ?? [])]
+            ? [...indexedTaskIds, ...store.listPlanningDraftTaskIds()]
             : [...indexedTaskIds];
         const seen = new Set();
         return taskIds.flatMap((taskId) => {
@@ -106,9 +103,9 @@ export function selectedActiveSchedulerTasks(store, selection, options) {
 function hasActivePlanningRun(store, task) {
     if (task.status !== "draft")
         return false;
-    const roles = store.listRoles?.(task.id) ?? [];
+    const roles = store.listRoles(task.id);
     return roles.some((role) => {
-        const run = store.getActiveRun?.(task.id, role.name) ?? null;
+        const run = store.getActiveRun(task.id, role.name);
         return run !== null
             && run.status === "active"
             && isSchedulerPlanningDraft(task, run.purpose);

package/dist/scheduler/roleRunLiveness.js

@@ -1,6 +1,6 @@
-import { selectedSchedulerRoles, selectedActiveSchedulerTasks } from "./ports.js";
-import { formatTaskRecordReference } from "../task/taskRecordReference.js";
 import { runPurposeAdmitsTaskState } from "../agentRun/agentRun.js";
+import { formatTaskRecordReference } from "../task/taskRecordReference.js";
+import { selectedActiveSchedulerTasks, selectedSchedulerRoles } from "./ports.js";
 import { currentRoleRunProgressAt, DEFAULT_WORKFLOW_STALL_CANDIDATE_AGE_MS } from "./roleRunStall.js";
 /**
  * Lightweight liveness only. Pane/process loss is runtime-health evidence,
@@ -85,7 +85,7 @@ export async function reconcileExitedRoleRuns(store, delivery, now, selection, e
             }
         }
     }
-    for (const { task, role, run, session, inspection } of eligible) {
+    for (const { task, role, run, session } of eligible) {
         const status = batchSnapshot.statuses.get(`${task.id}\0${role.name}`);
         if (status === undefined)
             throw new Error("Role liveness snapshot is incomplete.");
@@ -93,7 +93,7 @@ export async function reconcileExitedRoleRuns(store, delivery, now, selection, e
             continue;
         const hostExit = batchSnapshot.hostExits.get(`${task.id}\0${role.name}`);
         if (hostExit !== undefined) {
-            store.saveRoleHostExitObservation?.({
+            store.saveRoleHostExitObservation({
                 taskId: task.id,
                 roleName: role.name,
                 runId: run.id,