@zq-silk/yui 0.15.12 → 0.16.0

package/dist/task/taskSubmission.js

@@ -131,21 +131,10 @@ export function decideSubmissionRouting(input) {
 /**
  * Normalize a possibly-absent submission intent to its effective value.
  *
- * An absent intent is `discuss` (task-32 §2.5: "默认/旧客户端都按 discuss"), so
- * every old client and every message saved before the field existed keeps its
- * historical Leader-waking behaviour. Body text is never inspected.
- *
- * A legacy `--wake-policy none` carried the "save only, do not wake" meaning that
- * `record` now names, so a caller that supplied only that older signal maps to
- * `record` rather than silently becoming a Leader-waking `discuss`. An explicit
- * intent always wins over the wake-policy shorthand.
+ * The current default is `discuss`. Body text is never inspected.
  */
-export function normalizeSubmissionIntent(intent, wakePolicy) {
-    if (intent !== undefined)
-        return intent;
-    if (wakePolicy === "none")
-        return "record";
-    return "discuss";
+export function normalizeSubmissionIntent(intent) {
+    return intent ?? "discuss";
 }
 /**
  * Whether a retry aims at the same target the key was first bound to (§2.3). An

package/dist/telemetry/sqliteTelemetryBatch.js

@@ -0,0 +1,29 @@
+/** Runs on the existing persistence worker's connection, never the ingress
+ * thread. Telemetry keeps its existing idempotent keys and aggregate triggers;
+ * it neither bumps Task revisions nor creates durable RPC outbox records.
+ */
+export function writeTelemetryBatch(db, entries, runCap) {
+    if (!Number.isSafeInteger(runCap) || runCap < 1 || entries.length > 256) {
+        throw new Error("Telemetry batch exceeds its bounded write contract.");
+    }
+    const upsert = db.prepare(`INSERT INTO telemetry (task_id, role_name, turn_id, progress_id, sequence, payload, received_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(task_id, role_name, turn_id, progress_id) DO UPDATE SET
+       sequence = excluded.sequence, payload = excluded.payload, received_at = excluded.received_at
+     WHERE excluded.received_at >= telemetry.received_at`);
+    const cap = db.prepare(`DELETE FROM telemetry WHERE task_id = ? AND turn_id = ?
+     AND (task_id, role_name, turn_id, progress_id) NOT IN (
+       SELECT task_id, role_name, turn_id, progress_id FROM telemetry
+       WHERE task_id = ? AND turn_id = ?
+       ORDER BY received_at DESC, COALESCE(sequence, -1) DESC, progress_id ASC LIMIT ?
+     )`);
+    db.transaction(() => {
+        const runs = new Map();
+        for (const entry of entries) {
+            upsert.run(entry.taskId, entry.roleName, entry.runId, entry.progressId, entry.sequence ?? null, JSON.stringify(entry.payload), entry.receivedAt);
+            runs.set(`${entry.taskId}\0${entry.runId}`, entry);
+        }
+        for (const { taskId, runId } of runs.values())
+            cap.run(taskId, runId, taskId, runId, runCap);
+    })();
+}

package/dist/telemetry/sqliteTelemetryStore.js

@@ -1,15 +1,17 @@
+import Database from "better-sqlite3";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import Database from "better-sqlite3";
-import { DEFAULT_RUN_CAP, DEFAULT_TERMINAL_KEEP } from "./telemetryConfig.js";
-import { migrateSqliteSchema } from "../storage/sqliteSchema.js";
 import { CURRENT_DATABASE_FILENAME as COMMITTED_DATABASE_FILENAME } from "../storage/currentTaskStore.js";
+import { migrateSqliteSchema } from "../storage/sqliteSchema.js";
+import { AsyncTaskStoreClient } from "../storage/storeRpc.js";
+import { DEFAULT_RUN_CAP, DEFAULT_TERMINAL_KEEP } from "./telemetryConfig.js";
 /**
  * Default sidecar implementation: the telemetry tables live inside the Home's
  * authoritative `yui.db`, so a Home has one durable database
  * has one file to manage, back up, and migrate. The store opens its own
- * connection to that file: the write path is a single serialized writer (the
- * "WAL worker") and stays isolated from the business store's connection.
+ * connection for cold synchronous reads/explicit retention. Ingestion writes
+ * use the existing persistence-worker RPC, shared with the Controller when
+ * available; standalone consumers lazily own and close their own client.
  *
  * Writes are best-effort and never block the Controller event loop: `observe`
  * only merges into a bounded in-memory queue; a background flush drains it in
@@ -28,6 +30,10 @@ export class SqliteTelemetryStore {
     #terminalKeep;
     #turnCap;
     #maxPending;
+    #home;
+    #writer;
+    #ownedWriter;
+    #flushing;
     #db = null;
     #failed = false;
     #lastError = null;
@@ -39,6 +45,8 @@ export class SqliteTelemetryStore {
     #closed = false;
     constructor(home, options = {}) {
         this.mode = options.mode ?? "on";
+        this.#home = home;
+        this.#writer = options.writer;
         this.#path = join(home, COMMITTED_DATABASE_FILENAME);
         this.#terminalKeep = options.terminalKeep ?? DEFAULT_TERMINAL_KEEP;
         this.#turnCap = options.runCap ?? DEFAULT_RUN_CAP;
@@ -48,8 +56,7 @@ export class SqliteTelemetryStore {
     observe(entry) {
         if (this.#closed)
             return;
-        const db = this.#ensureDb();
-        if (db === null) {
+        if (this.#failed) {
             this.#dropped++;
             return;
         }
@@ -84,9 +91,14 @@ export class SqliteTelemetryStore {
         if (this.#closed)
             return;
         this.#closed = true;
-        await this.#flushPending();
-        this.#db?.close();
-        this.#db = null;
+        try {
+            await this.#flushPending();
+        }
+        finally {
+            await this.#ownedWriter?.close();
+            this.#db?.close();
+            this.#db = null;
+        }
     }
     // -- TelemetryReader -----------------------------------------------------------
     count(taskId, runId) {
@@ -230,6 +242,7 @@ export class SqliteTelemetryStore {
             return this.#db;
         if (this.#failed || this.#closed)
             return null;
+        let opening;
         try {
             // The telemetry tables live in the Home's authoritative database; the
             // store never creates `yui.db` itself. Wiring fails closed on Homes
@@ -237,17 +250,19 @@ export class SqliteTelemetryStore {
             if (!existsSync(this.#path)) {
                 throw new Error(`Telemetry database not found: ${this.#path}`);
             }
-            const db = new Database(this.#path);
+            const db = opening = new Database(this.#path);
             db.pragma("journal_mode = WAL");
             db.pragma("synchronous = FULL");
             db.pragma("foreign_keys = ON");
-            db.pragma("busy_timeout = 5000");
+            // Cold diagnostic reads/retention must not wait behind a semantic writer.
+            db.pragma("busy_timeout = 0");
             db.pragma("wal_autocheckpoint = 1000");
             migrateSqliteSchema(db, { mode: "validate" });
             this.#db = db;
             return db;
         }
         catch (error) {
+            opening?.close();
             this.#failed = true;
             this.#lastError = error instanceof Error ? error.message : String(error);
             return null;
@@ -263,43 +278,28 @@ export class SqliteTelemetryStore {
         });
         handle.unref?.();
     }
-    async #flushPending() {
-        if (this.#pending.size === 0)
-            return;
-        const db = this.#ensureDb();
-        if (db === null) {
-            this.#dropped += this.#pending.size;
-            this.#pending.clear();
-            return;
-        }
-        const batch = new Map(this.#pending);
-        this.#pending.clear();
-        const upsert = db.prepare(`INSERT INTO telemetry (task_id, role_name, turn_id, progress_id, sequence, payload, received_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT(task_id, role_name, turn_id, progress_id) DO UPDATE SET
-         sequence = excluded.sequence,
-         payload = excluded.payload,
-         received_at = excluded.received_at
-       WHERE excluded.received_at >= telemetry.received_at`);
-        try {
-            const touchedRuns = new Map();
-            db.transaction(() => {
-                for (const entry of batch.values()) {
-                    upsert.run(entry.taskId, entry.roleName, entry.runId, entry.progressId, entry.sequence ?? null, JSON.stringify(entry.payload), entry.receivedAt);
-                    touchedRuns.set(`${entry.taskId}\0${entry.runId}`, {
-                        taskId: entry.taskId,
-                        runId: entry.runId
-                    });
-                }
-                for (const { taskId, runId } of touchedRuns.values()) {
-                    this.capRun(taskId, runId);
-                }
-            })();
-            this.#applied += batch.size;
-        }
-        catch (error) {
-            this.#lastError = error instanceof Error ? error.message : String(error);
-            this.#dropped += batch.size;
+    #flushPending() {
+        this.#flushing ??= this.#drain().finally(() => { this.#flushing = undefined; });
+        return this.#flushing;
+    }
+    async #drain() {
+        while (this.#pending.size > 0) {
+            const batch = [];
+            for (const [key, entry] of this.#pending) {
+                this.#pending.delete(key);
+                batch.push(entry);
+                if (batch.length === 256)
+                    break;
+            }
+            try {
+                const writer = this.#writer ?? (this.#ownedWriter ??= new AsyncTaskStoreClient(this.#home, { readPoolSize: 1 }));
+                await writer.flushTelemetry(batch, this.#turnCap);
+                this.#applied += batch.length;
+            }
+            catch (error) {
+                this.#lastError = error instanceof Error ? error.message : String(error);
+                this.#dropped += batch.length;
+            }
         }
     }
 }

package/dist/telemetry/telemetryWiring.js

@@ -1,16 +1,16 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { resolveRunCap, resolveTerminalKeep } from "./telemetryConfig.js";
 import { resolveTelemetryEnabled } from "../config/yuiConfig.js";
-import { SqliteTelemetryStore } from "./sqliteTelemetryStore.js";
 import { CURRENT_DATABASE_FILENAME as COMMITTED_DATABASE_FILENAME } from "../storage/currentTaskStore.js";
+import { SqliteTelemetryStore } from "./sqliteTelemetryStore.js";
+import { resolveRunCap, resolveTerminalKeep } from "./telemetryConfig.js";
 /**
  * Open optional telemetry from the current Home's authoritative `yui.db`.
  * Disabled telemetry performs no database work. Once opened, telemetry fails
  * isolated: a broken sink increments its dropped counter without blocking the
  * semantic lane.
  */
-export function openSchedulerTelemetry(home, config) {
+export function openSchedulerTelemetry(home, config, writer) {
     if (!resolveTelemetryEnabled(config.telemetryEnabled))
         return null;
     const mode = "on";
@@ -21,6 +21,7 @@ export function openSchedulerTelemetry(home, config) {
     }
     const store = new SqliteTelemetryStore(home, {
         mode,
+        writer,
         terminalKeep: resolveTerminalKeep(config.telemetryTerminalKeep),
         runCap: resolveRunCap(config.telemetryRunCap)
     });

package/dist/tmux/tmuxManager.js

@@ -509,7 +509,9 @@ export class TmuxManager {
         let output;
         try {
             output = this.run([
-                "list-panes", "-s", "-t", this.sessionName(taskId), "-F",
+                // list-panes takes a pane target: the colon keeps this an exact
+                // session lookup instead of falling back to a similarly named one.
+                "list-panes", "-s", "-t", `=${this.sessionName(taskId)}:`, "-F",
                 `#{window_name}${formatSeparator}#{pane_dead}${formatSeparator}#{pane_dead_status}${formatSeparator}#{pane_pid}${formatSeparator}#{pane_current_command}`
             ]);
         }
@@ -865,7 +867,7 @@ export class TmuxManager {
         this.recordTaskTargets(taskId);
         for (const session of [...sessions.filter((name) => name !== taskSession), taskSession]) {
             try {
-                this.run(["kill-session", "-t", session]);
+                this.run(["kill-session", "-t", `=${session}`]);
             }
             catch (error) {
                 if (!isExplicitlyAbsentTmuxSession(error))
@@ -882,7 +884,7 @@ export class TmuxManager {
         await this.recordTaskTargetsAsync(taskId);
         for (const session of [...sessions.filter((name) => name !== taskSession), taskSession]) {
             try {
-                await this.runAsync(["kill-session", "-t", session]);
+                await this.runAsync(["kill-session", "-t", `=${session}`]);
             }
             catch (error) {
                 if (!isExplicitlyAbsentTmuxSession(error))
@@ -897,11 +899,23 @@ export class TmuxManager {
     }
     killRole(taskId, roleName) {
         this.recordRoleTarget(taskId, roleName);
-        this.run(["kill-window", "-t", this.target(taskId, roleName)]);
+        try {
+            this.run(["kill-window", "-t", this.exactTarget(taskId, roleName)]);
+        }
+        catch (error) {
+            if (!isExplicitlyAbsentTmuxSession(error))
+                throw error;
+        }
     }
     async killRoleAsync(taskId, roleName) {
         this.recordRoleTarget(taskId, roleName);
-        await this.runAsync(["kill-window", "-t", this.target(taskId, roleName)]);
+        try {
+            await this.runAsync(["kill-window", "-t", this.exactTarget(taskId, roleName)]);
+        }
+        catch (error) {
+            if (!isExplicitlyAbsentTmuxSession(error))
+                throw error;
+        }
     }
     renameRole(taskId, oldRoleName, newRoleName) {
         const target = this.target(taskId, oldRoleName);
@@ -916,7 +930,7 @@ export class TmuxManager {
     }
     hasSession(taskId) {
         try {
-            this.run(["has-session", "-t", this.sessionName(taskId)]);
+            this.run(["has-session", "-t", `=${this.sessionName(taskId)}`]);
             return true;
         }
         catch (error) {
@@ -927,7 +941,7 @@ export class TmuxManager {
     }
     async hasSessionAsync(taskId) {
         try {
-            await this.runAsync(["has-session", "-t", this.sessionName(taskId)]);
+            await this.runAsync(["has-session", "-t", `=${this.sessionName(taskId)}`]);
             return true;
         }
         catch (error) {
@@ -941,7 +955,7 @@ export class TmuxManager {
             return [];
         try {
             return this.run([
-                "list-windows", "-t", this.sessionName(taskId), "-F", "#{window_name}"
+                "list-windows", "-t", `=${this.sessionName(taskId)}`, "-F", "#{window_name}"
             ]).split("\n").map((name) => name.trim()).filter(Boolean);
         }
         catch (error) {
@@ -953,7 +967,7 @@ export class TmuxManager {
     async sessionWindowNamesAsync(taskId) {
         try {
             const names = (await this.runAsync([
-                "list-windows", "-t", this.sessionName(taskId), "-F", "#{window_name}"
+                "list-windows", "-t", `=${this.sessionName(taskId)}`, "-F", "#{window_name}"
             ])).split("\n").map((name) => name.trim()).filter(Boolean);
             return { exists: true, names };
         }
@@ -1141,16 +1155,12 @@ function writableClientSessionPrefix(roleName) {
 function writableLeaseMatchesRole(sessionName, roleName) {
     if (!sessionName.startsWith(WRITABLE_CLIENT_SESSION_PREFIX))
         return false;
-    if (roleName === undefined)
-        return true;
-    if (sessionName.startsWith(HOST_WRITABLE_CLIENT_SESSION_PREFIX))
+    if (/^yui-writer-host-[a-f0-9]{24}$/u.test(sessionName))
         return true;
-    if (sessionName.startsWith(ROLE_WRITABLE_CLIENT_SESSION_PREFIX)) {
-        return sessionName.startsWith(writableClientSessionPrefix(roleName));
+    if (/^yui-writer-role-[a-f0-9]{24}-[a-f0-9]{24}$/u.test(sessionName)) {
+        return roleName === undefined || sessionName.startsWith(writableClientSessionPrefix(roleName));
     }
-    // Conservative compatibility for writer leases created before Role-scoped
-    // lease names existed.
-    return true;
+    throw runtimeError(`Unverified tmux writer lease: ${sessionName}. Preserve it and inspect its owner before retrying.`);
 }
 function writableClientRowsContainMatch(clients, taskSession, roleName, excludedLease, formatSeparator, encodedSeparator) {
     return clients.split("\n").some((line) => {
@@ -1169,9 +1179,8 @@ function writableClientRowsContainMatch(clients, taskSession, roleName, excluded
             || readOnly !== "0") {
             return false;
         }
-        // Current Yui clients publish a lease before attach. A direct or legacy
-        // writable tmux client has no Role identity, so conservatively fence every
-        // Role in that host.
+        // A direct writable tmux client has no Role identity and fences the host.
+        // A Yui lease must instead prove its exact current scope.
         return !sessionName.startsWith(WRITABLE_CLIENT_SESSION_PREFIX)
             || writableLeaseMatchesRole(sessionName, roleName);
     });

package/dist/verification/gateArtifact.js

@@ -4,10 +4,11 @@ import { requireIdentity, requirePositiveInteger, requireText, requireTimestamp
 /**
  * Issue 08: the reusable exact-SHA gate evidence record.
  *
- * A GateArtifact binds one gate run to its full identity tuple: Project,
+ * A GateArtifact is the latest cached proof for its full identity tuple: Project,
  * candidate commit, VerificationPlan digest, toolchain digest, and (for L2)
- * the source/base/target boundary. The same tuple reuses the same successful
- * artifact; any tuple change invalidates it. Artifacts are stored in the
+ * the source/base/target boundary. Fresh execution withdraws the previous
+ * success; a failed or incomplete latest result is not reusable. Job and
+ * Integration records own execution history. Artifacts are stored in the
  * SQLite `gate_artifacts` / `gate_artifact_logs` tables, backend-neutral
  * through the GateArtifactStorePort.
  */
@@ -40,12 +41,11 @@ export function createGateArtifact(identity, metadata, now) {
         planVersion: requireText(metadata.planVersion, "GateArtifact planVersion"),
         planDigest: identity.planDigest,
         toolchainDigest: identity.toolchainDigest,
-        ...(identity.boundary === undefined ? {} : { boundary: identity.boundary }),
+        boundary: identity.boundary,
         steps: Object.freeze([]),
         generator: requireText(metadata.generator, "GateArtifact generator"),
         status: "incomplete",
         outcome: "unknown",
-        potentialReuseCount: 0,
         reuseCount: 0,
         createdAt: timestamp,
         lastUsedAt: timestamp
@@ -67,16 +67,7 @@ export function completeGateArtifact(artifact, steps, outcome, now) {
         lastUsedAt: timestamp
     });
 }
-/** Record a shadow potential-reuse observation (record mode). */
-export function recordGateArtifactPotentialReuse(artifact, now) {
-    validateGateArtifact(artifact);
-    return validateGateArtifact({
-        ...artifact,
-        potentialReuseCount: artifact.potentialReuseCount + 1,
-        lastUsedAt: now.toISOString()
-    });
-}
-/** Record an actual reuse (reuse/enforce mode). */
+/** Record an actual reuse of complete successful evidence. */
 export function recordGateArtifactReuse(artifact, now) {
     validateGateArtifact(artifact);
     if (artifact.status !== "complete" || artifact.outcome !== "succeeded") {
@@ -93,7 +84,7 @@ export function validateGateArtifact(artifact) {
         throw new Error(`GateArtifact must use schemaVersion ${GATE_ARTIFACT_SCHEMA_VERSION}.`);
     }
     requireIdentity(artifact.projectId, "GateArtifact projectId");
-    if (artifact.level !== "L1" && artifact.level !== "L2") {
+    if (artifact.level !== "L2") {
         throw new Error(`GateArtifact level is invalid: ${String(artifact.level)}.`);
     }
     requireCommit(artifact.commit, "GateArtifact commit");
@@ -106,17 +97,15 @@ export function validateGateArtifact(artifact) {
         commit: artifact.commit,
         planDigest: artifact.planDigest,
         toolchainDigest: artifact.toolchainDigest,
-        ...(artifact.boundary === undefined ? {} : { boundary: artifact.boundary })
+        boundary: artifact.boundary
     })) {
         throw new Error("GateArtifact key does not match its identity tuple.");
     }
-    if (artifact.level === "L2" && artifact.boundary === undefined) {
+    if (artifact.boundary === undefined) {
         throw new Error("An L2 GateArtifact requires a target boundary.");
     }
-    if (artifact.boundary !== undefined) {
-        requireText(artifact.boundary.targetRef, "GateArtifact boundary targetRef");
-        requireCommit(artifact.boundary.baseHead, "GateArtifact boundary baseHead");
-    }
+    requireText(artifact.boundary.targetRef, "GateArtifact boundary targetRef");
+    requireCommit(artifact.boundary.baseHead, "GateArtifact boundary baseHead");
     if (!["incomplete", "complete"].includes(artifact.status)) {
         throw new Error(`GateArtifact status is invalid: ${String(artifact.status)}.`);
     }
@@ -150,7 +139,8 @@ export function validateGateArtifact(artifact) {
             throw new Error(`GateArtifact step ${step.name} logBytes is invalid.`);
         }
     }
-    requirePositiveInteger(artifact.potentialReuseCount + 1, "GateArtifact potentialReuseCount");
+    if (Object.hasOwn(artifact, "potentialReuseCount"))
+        throw new Error("GateArtifact contains retired shadow metrics.");
     requirePositiveInteger(artifact.reuseCount + 1, "GateArtifact reuseCount");
     requireTimestamp(artifact.createdAt, "GateArtifact createdAt");
     requireTimestamp(artifact.lastUsedAt, "GateArtifact lastUsedAt");
@@ -185,7 +175,8 @@ export function verifyGateArtifactLogs(artifact, logs) {
     });
 }
 export function isReusableGateArtifact(artifact) {
-    return artifact.status === "complete" && artifact.outcome === "succeeded";
+    return artifact.status === "complete" && artifact.outcome === "succeeded"
+        && artifact.steps.length > 0 && artifact.steps.every(step => step.outcome === "passed" && step.exitCode === 0 && step.signal === null && !step.timedOut);
 }
 function requireCommit(value, label) {
     const normalized = requireText(value, label).toLowerCase();

package/dist/verification/gateArtifactStore.js

@@ -30,19 +30,26 @@ export function findGateArtifact(store, identity) {
  * commit, plan digest, toolchain digest, and target ref.  Unlike
  * {@link findGateArtifact} the base head is not part of the match: a release
  * consumes the gate that proved the exact frozen tree, regardless of which
- * base it integrated onto.  Logs are verified before returning.
+ * base it integrated onto. The newest recorded matching result governs:
+ * failure/incompleteness/corruption must not fall through to an older success.
+ * Logs are verified before returning.
  */
 export async function findL2ArtifactForCommit(store, query) {
-    const artifacts = store.findL2GateArtifactsForCommit(query);
-    for (const artifact of artifacts) {
+    const recordedAt = (artifact) => Date.parse(artifact.completedAt ?? artifact.createdAt);
+    const artifacts = [...store.findL2GateArtifactsForCommit(query)]
+        .sort((left, right) => recordedAt(right) - recordedAt(left));
+    const latest = artifacts[0];
+    if (latest === undefined)
+        return null;
+    for (const artifact of artifacts.filter(value => recordedAt(value) === recordedAt(latest))) {
         if (!isReusableGateArtifact(artifact))
-            continue;
+            return null;
         const logs = store.getGateArtifactLogs(artifact.key);
         const verification = verifyGateArtifactLogs(artifact, logs);
-        if (verification.ok)
-            return artifact;
+        if (!verification.ok)
+            return null;
     }
-    return null;
+    return latest;
 }
 /**
  * Read each step's source log, hash it, and return the completed step