@zq-silk/yui 0.15.3 → 0.15.6

package/dist/core/controllerServer.js

@@ -14,6 +14,7 @@ import { YUI_VERSION, yuiVersionIdentity } from "../version.js";
 import { resolveStoreWorkerEnabledForHome } from "../storage/storeRpc.js";
 import { resolveTaskStoreBackendForHome } from "../storage/sqliteStore.js";
 import { CommandExecutionError } from "../tmux/commandExecutor.js";
+import { redactAgentErrorText } from "../runtime/agentError.js";
 import { detectRunningRelease, readActiveReleasePointer, readHandoverFence, verifyReleaseIntegrity, writeHandoverFence, writeRuntimeIdentity } from "../release/runtimeRelease.js";
 import { isBuiltinControllerMethod, ControllerCommandObserver, ControllerEventLoopDelay } from "./controllerTelemetry.js";
 import { parseLinuxProcessStartIdentity, removeEphemeralDomainIdentity, readEphemeralDomainIdentity, writeEphemeralDomainIdentity } from "../controller/domainIdentity.js";
@@ -838,11 +839,13 @@ function safeApplicationErrorCode(code) {
     }
 }
 function safeErrorMessage(message) {
-    const safe = message
+    const safe = redactAgentErrorText(message)
         .replace(/[\r\n\u2028\u2029]+/gu, " ")
-        .trim()
-        .slice(0, 512);
-    return safe.length === 0 ? undefined : safe;
+        .trim();
+    if (safe.length === 0)
+        return undefined;
+    const marker = "…[truncated]";
+    return safe.length <= 512 ? safe : `${safe.slice(0, 512 - marker.length)}${marker}`;
 }
 export async function acquireHomeLifecycleLock(home, options = {}) {
     const lockPath = homeLifecycleLockPath(home);

package/dist/domain/agentResultTransport.js

@@ -17,7 +17,7 @@ export function transportAgentResult(value) {
         return {
             status: "failed",
             diagnostic: "Provider terminal event included an Agent result with an invalid NUL byte.",
-            failureReason: "missing-result"
+            failureReason: "runtime-failed"
         };
     }
     if (value.trim().length === 0) {
@@ -32,7 +32,7 @@ export function transportAgentResult(value) {
         return {
             status: "failed",
             diagnostic: `Provider Agent result is ${bytes} bytes and exceeds the ${MAX_TURN_RESULT_OUTPUT_BYTES}-byte durable result limit; the result was not stored.`,
-            failureReason: "missing-result"
+            failureReason: "runtime-failed"
         };
     }
     return { status: "completed", output: value };

package/dist/executor/agentExecutor.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { hasRecentTurnId, rememberRecentTurnId, validateRecentTurnIds } from "../runtime/recentTurnIds.js";
 import { roleSessionMayContinue, validateEffectiveLaunchSnapshot } from "./effectiveLaunch.js";
-import { currentProviderActivation, endProviderActivation, settleProviderTurn, settleProviderTurnSubmission, validateProviderRuntimeBinding } from "../runtime/providerRuntimeIdentity.js";
+import { currentProviderActivation, endProviderActivation, validateProviderRuntimeBinding } from "../runtime/providerRuntimeIdentity.js";
 import { builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 export function createRoleSessionSet(owner, activeAgentId, now) {
     const base = {
@@ -264,26 +264,28 @@ export function roleAgentSessionResumeMode(set, agentId, desired) {
     const session = set.sessions[requireSafeIdentity(agentId, "Agent id")];
     if (session === undefined)
         return "new";
-    // A restored opaque host can be inspected/recovered only through its exact
-    // launch fence. It cannot be resumed or silently rebound to a new launch
-    // without a provider-native identity; an explicit verified stop still
-    // permits the normal fresh-generation path.
+    // A Host status cannot supply a missing native Conversation identity.
+    // Replacement remains an explicit operation even after that Host ended.
     if (typeof session.nativeSessionId !== "string"
         || session.nativeSessionId.trim().length === 0) {
-        if (session.status === "active") {
-            throw new Error(`Role Agent session has no native Session identity: ${agentId}. `
-                + "Restore the exact native Session or explicitly stop it before starting a fresh Session.");
-        }
-        return "new";
-    }
-    if (session.status === "ended") {
-        return "new";
+        throw new Error(`Role Agent session has no native Session identity: ${agentId}. `
+            + "Restore the exact native Session or explicitly select a new Session.");
+    }
+    // An ended Host attachment is not evidence that the native Conversation
+    // vanished. Resume the exact identity; only an explicit new-Session action
+    // may replace it. A known unrecoverable Conversation needs that decision.
+    const conversation = set.owner.scope === "task"
+        ? set.providerBinding?.conversations.find((entry) => entry.conversationId === session.nativeSessionId)
+        : undefined;
+    if (conversation?.recoverability === "unrecoverable") {
+        throw new Error(`Role Agent native Session is not recoverable: ${agentId}/${session.nativeSessionId}. `
+            + "Explicitly select a new Session to continue; existing input attempts are not replayed.");
     }
     if (roleSessionMayContinue(session.effective, desired))
         return "resume";
     throw new Error(`Role Agent session cannot continue under the next launch: ${agentId}. `
-        + "Its Agent, adapter or physical workspace changed; stop the existing native "
-        + "process before starting a fresh Session.");
+        + "Its Agent, adapter or physical workspace changed. Explicitly select a new Session "
+        + "after resolving existing execution and resource ownership.");
 }
 export function bindTaskRoleProviderRuntime(set, binding, updatedAt) {
     validateRoleSessionSet(set);
@@ -325,7 +327,7 @@ export function detachRoleAgentSessionHost(set, now) {
         return set;
     const timestamp = requireDate(now, "Role Host detach timestamp");
     const { runtimeGenerationId: _runtimeGenerationId, endReason: _endReason, ...session } = active;
-    let updated = validateRoleSessionSet({
+    const updated = validateRoleSessionSet({
         ...set,
         sessions: {
             ...set.sessions,
@@ -340,28 +342,10 @@ export function detachRoleAgentSessionHost(set, now) {
     if (updated.owner.scope !== "task")
         return updated;
     let taskSet = updated;
-    let binding = taskSet.providerBinding;
-    const turn = binding?.turn;
-    if (binding !== null && binding !== undefined && turn !== null && turn !== undefined
-        && turn.status === "accepted") {
-        binding = settleProviderTurn(binding, {
-            nativeTurnId: turn.nativeTurnId,
-            status: "cancelled",
-            settledAt: timestamp,
-            reason: "runtime-physical-exit"
-        });
-        taskSet = updateTaskRoleProviderRuntime(taskSet, binding, now);
-    }
-    else if (binding !== null && binding !== undefined && turn !== null && turn !== undefined
-        && ["submitting", "delivery-unknown"].includes(turn.status)) {
-        binding = settleProviderTurnSubmission(binding, {
-            attemptId: turn.attemptId,
-            status: "rejected",
-            resolvedAt: timestamp,
-            reason: "runtime-physical-exit"
-        });
-        taskSet = updateTaskRoleProviderRuntime(taskSet, binding, now);
-    }
+    const binding = taskSet.providerBinding;
+    // Losing the attachment proves neither cancellation nor non-submission.
+    // Preserve the exact input and its acceptance/unknown facts. Only a native
+    // terminal or an explicit submission resolution may settle that attempt.
     const activation = binding === null
         ? null
         : currentProviderActivation(binding);

package/dist/executor/executorRegistry.js

@@ -158,20 +158,20 @@ export class ExecutorRegistry {
                     createdAt: new Date()
                 })
             });
-            if (outcome === "delivered") {
+            if (outcome.result === "delivered") {
                 this.#prepared.delete(input.delivery.prepared.deliveryId);
             }
-            return outcome === "delivered" ? "sent" : outcome;
+            return deliveryReport(outcome);
         }
         const outcome = this.tmux.sendRoleInputOnce(input.delivery.prepared.taskId, input.delivery.prepared.roleName, input.receiptId, input.text, this.readiness(input.delivery.prepared.adapterId));
         if (outcome === "sent" || outcome === "already-sent") {
             this.#prepared.delete(input.delivery.prepared.deliveryId);
         }
-        return outcome;
+        return { status: outcome };
     }
     async steerOnce(input) {
         if (this.runtimePorts === undefined)
-            return "unavailable";
+            return { status: "unavailable" };
         const outcome = await this.runtimePorts.promptPush.trySteer({
             owner: { scope: "task", taskId: input.taskId, roleName: input.roleName },
             runtimeGenerationId: input.runtimeGenerationId,
@@ -187,7 +187,7 @@ export class ExecutorRegistry {
                 createdAt: new Date()
             })
         });
-        return outcome === "delivered" ? "sent" : outcome;
+        return deliveryReport(outcome);
     }
     async notifyOperatorInputOnce(input) {
         const probe = this.readiness(input.adapterId, "operator");
@@ -334,6 +334,17 @@ function activeTurnId(receiptId) {
         throw new Error("Turn steer receipt is invalid.");
     return decodeURIComponent(match[1]);
 }
+/**
+ * Maps a runtime push outcome onto the Scheduler's delivery vocabulary while
+ * keeping the Host's structured cause attached. Only the word for success
+ * differs between the two layers; the failure record is forwarded unchanged.
+ */
+function deliveryReport(outcome) {
+    return {
+        status: outcome.result === "delivered" ? "sent" : outcome.result,
+        ...(outcome.failure === undefined ? {} : { failure: outcome.failure })
+    };
+}
 export function agentProcessReadinessProbe(adapterId, _surface = "role") {
     if (adapterId !== "codex" && adapterId !== "claude") {
         throw new Error(`No tmux readiness probe is registered for Agent adapter: ${adapterId}.`);

package/dist/executor/fileRoleLaunchPlanner.js

@@ -16,13 +16,11 @@ import { nativeSessionIdForLaunch } from "../runtime/preallocatedNativeSession.j
 import { classifyWorkspacePreflight, formatWorkspacePreflightError } from "./workspacePreflightClassification.js";
 import { activeLiveRoleAgentSession } from "./agentExecutor.js";
 import { roleSessionMayContinue, effectiveRoleForLaunch, resolveEffectiveLaunch } from "./effectiveLaunch.js";
-import { YUI_CONTROL_PLANE_DESCRIPTOR, createExactControlPlaneDescriptor, serializeExactDescriptor } from "../runtime/exactControlPlane.js";
-import { detectRunningRelease } from "../release/runtimeRelease.js";
 import { parseTaskRuntimeIsolationDescriptor, taskRuntimeIsolationEnvironment } from "../runtime/taskRuntimeIsolation.js";
 import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
 import { builtinAgentDriverRegistry, builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 import { managedRuntimeAdmission } from "../runtime/agentDriver.js";
-import { currentProviderActivation } from "../runtime/providerRuntimeIdentity.js";
+import { assertProviderConversationReplaceable, currentProviderActivation } from "../runtime/providerRuntimeIdentity.js";
 import { assertCodexLaunchOverridesAvailable, inspectCodexLaunchConfig } from "./codexConfigConflict.js";
 /** Builds managed native Agent launches from the authoritative Task records. */
 export class FileRoleLaunchPlanner {
@@ -34,7 +32,7 @@ export class FileRoleLaunchPlanner {
     #createNativeSessionId;
     #cliPath;
     #inspectWorkspacePhysicalState;
-    #controlPlane;
+    #entryPoint;
     #resourceRegistrarValue;
     constructor(home, store, options = {}) {
         this.home = home;
@@ -54,21 +52,10 @@ export class FileRoleLaunchPlanner {
             ?? inspectWorkspacePhysicalState;
         this.#cliPath = canonicalPath(options.cliPath
             ?? fileURLToPath(new URL("../cli.js", import.meta.url)));
-        // Internal callbacks retain one exact command identity for receipt fencing.
-        // Interactive Role commands use ordinary `yui`; their continuity is the
-        // Session Manifest plus protocol/storage and durable runtime identity.
-        const runningRelease = detectRunningRelease(this.#cliPath);
-        this.#controlPlane = createExactControlPlaneDescriptor({
-            executable: process.execPath,
-            cliEntry: this.#cliPath,
-            yuiHome: this.home,
-            ...(runningRelease === null
-                ? {}
-                : {
-                    buildId: runningRelease.manifest.buildId,
-                    activeReleaseDigest: runningRelease.manifest.packageDigest
-                })
-        });
+        // Where a managed Session's commands run. Continuity is the Session
+        // Manifest plus protocol/storage and durable runtime identity, so no
+        // package or build identity belongs in this entry point.
+        this.#entryPoint = { executable: process.execPath, cliEntry: this.#cliPath };
     }
     #resourceRegistrar() {
         return this.#resourceRegistrarValue ??= new ResourceRegistrar(this.home);
@@ -184,6 +171,13 @@ export class FileRoleLaunchPlanner {
             && activeLiveRoleAgentSession(sessionSet) !== null) {
             throw new Error(`Task Role still has a live Session: ${task.id}/${role.name}.`);
         }
+        if (input.mode === "new" && sessionSet?.providerBinding !== null
+            && sessionSet?.providerBinding !== undefined) {
+            // Planning precedes broker tickets, Provider processes and native
+            // Conversation creation. An ended Host is not proof that its input
+            // attempt was rejected, cancelled, or completed.
+            assertProviderConversationReplaceable(sessionSet.providerBinding);
+        }
         return this.#compile(role, input, { scope: "task", taskId: task.id }, resolveTaskRoleSessionTitle(input.mode === "resume" ? existing?.title : undefined, task, role.name), input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, runWorkspace, effective, {
             purpose: activeTurn?.purpose ?? "execution"
         });
@@ -267,7 +261,7 @@ export class FileRoleLaunchPlanner {
             owner,
             roleKind: roleSessionKind(launchRole, owner, sessionPolicy.purpose),
             skills: baseSessionContext.skills,
-            controlPlane: this.#controlPlane
+            entryPoint: this.#entryPoint
         });
         if (effective.contextProtocolVersion !== bootstrap.manifest.schemaVersion
             || effective.sessionManifestCompatibilityDigest
@@ -349,8 +343,7 @@ export class FileRoleLaunchPlanner {
         for (const path of [
             bootstrap.manifestPath,
             bootstrap.sessionCliPath,
-            bootstrap.roleProfilePath,
-            bootstrap.descriptorPath
+            bootstrap.roleProfilePath
         ]) {
             this.#resourceRegistrar().registerSessionContext(path, {
                 home: resolve(this.home),
@@ -361,7 +354,11 @@ export class FileRoleLaunchPlanner {
         let args = [...compiled.argv];
         let command = configured.command;
         let session;
-        if (binding.adapterId === "claude" && (managedControl || owner.scope === "global")) {
+        // Managed Claude owns a serialized stream with exact attempt correlation.
+        // Its native Hooks carry no such request fence and must not compete with
+        // the Host for acceptance, completion, or attachment lifecycle facts.
+        // Provider tool permissions remain in compiled config, not this observer.
+        if (binding.adapterId === "claude" && owner.scope === "global") {
             args.push("--plugin-dir", ensureClaudeLifecyclePlugin(this.home, this.#cliPath));
         }
         if (binding.adapterId === "codex") {
@@ -476,11 +473,6 @@ export class FileRoleLaunchPlanner {
                     ? { YUI_AGENT_BASE_ARGS: JSON.stringify(configured.baseArgs) }
                     : {}),
                 ...(jobCallerKey === undefined ? {} : { YUI_JOB_CALLER_KEY: jobCallerKey }),
-                ...(owner.scope !== "task"
-                    ? {}
-                    : {
-                        [YUI_CONTROL_PLANE_DESCRIPTOR]: serializeExactDescriptor(this.#controlPlane)
-                    }),
                 ...(sessionTitle === undefined
                     ? {}
                     : {
@@ -716,6 +708,8 @@ function managedClaudeControlPlaneConfig(config, taskId, workItemId, turnId) {
 function isManagedYuiBashRule(rule) {
     const normalized = rule.trim();
     return /^Bash\(yui(?:\s|:\*|\*|\))/u.test(normalized)
+        // Yui no longer writes a control-plane digest into a managed rule; this
+        // shape only clears one an earlier release left in a Provider config.
         || /^Bash\(.*\s--yui-control\s/u.test(normalized);
 }
 function canonicalPath(path) {

package/dist/lifecycle/exactTurnTerminalization.js

@@ -389,9 +389,9 @@ function settleLaunchReservation(store, sessions, input) {
     const mailbox = store.getWorkMailbox(target);
     const reservation = mailbox?.processing;
     const session = sessions?.sessions[input.agentId];
-    const runtimeGenerationId = input.nativeSessionId === undefined
-        ? input.runtimeGenerationId ?? session?.runtimeGenerationId
-        : session?.runtimeGenerationId;
+    // A late result releases only its original launch, never a successor's
+    // reservation merely because both Turns reused the same native Session.
+    const runtimeGenerationId = input.runtimeGenerationId ?? session?.runtimeGenerationId;
     if (runtimeGenerationId === undefined || !isRuntimeLaunchReservation(reservation, runtimeGenerationId))
         return;
     const settled = completeProcessing(mailbox, reservation.batchId);

package/dist/observability/executionAudit.js

@@ -149,6 +149,10 @@ function classifyTerminalSessionTurnRelation(turns, roleName, session, counts) {
 function ok(data) {
     return { status: "ok", data };
 }
+/** Keeps only the payload keys the record actually carries. */
+function definedAuditFields(fields) {
+    return Object.fromEntries(Object.entries(fields).filter((entry) => entry[1] !== undefined));
+}
 function failed(error) {
     return {
         status: "error",
@@ -583,6 +587,14 @@ export function runExecutionAudit(home, options = {}, ports = createProductionEx
                         raw: event.payload.raw ?? "",
                         inputDisposition: event.payload.inputDisposition ?? "unknown",
                         sessionDisposition: event.payload.sessionDisposition ?? "unknown",
+                        ...definedAuditFields({
+                            registrationDisposition: event.payload.registrationDisposition,
+                            errorName: event.payload.errorName,
+                            causeName: event.payload.causeName,
+                            expectedRuntimeGenerationId: event.payload.expectedRuntimeGenerationId,
+                            observedRuntimeGenerationId: event.payload.observedRuntimeGenerationId,
+                            attemptId: event.payload.attemptId
+                        }),
                         createdAt: event.createdAt
                     });
                 }

package/dist/repository/executionLaneGitSnapshot.js

@@ -2,9 +2,8 @@ import { execFileSync } from "node:child_process";
 import { isDeepStrictEqual } from "node:util";
 /**
  * Freeze the exact committed heads of a durable managed Lane workspace at the
- * synchronous runtime-terminalization boundary. Runtime event folds are
- * synchronous inside the SQLite aggregate transaction, so this small Git read
- * cannot use the asynchronous workspace-preparation port.
+ * synchronous runtime-terminalization boundary, before opening the result
+ * transaction. The committing fold revalidates durable workspace ownership.
  */
 export function snapshotExecutionLaneWorkspaceSync(store, workspace) {
     if (workspace.owner.type !== "execution-lane") {
@@ -71,6 +70,8 @@ function git(cwd, args) {
         return execFileSync("git", args, {
             cwd,
             encoding: "utf8",
+            timeout: 5_000,
+            maxBuffer: 512 * 1024,
             stdio: ["ignore", "pipe", "pipe"]
         }).trim();
     }

package/dist/repository/taskWorkspacePreparer.js

@@ -11,7 +11,7 @@ import { activateTask, bindTaskProjectCommits, bindTaskWorkspaceIdentity, synchr
 import { validateDraftTaskForActivation } from "../task/draftPlan.js";
 import { createTaskEvent } from "../event/taskEvent.js";
 import { enqueueWork } from "../coordination/workMailboxQueue.js";
-import { createCandidateGitSnapshot, createDirectTaskMainSnapshot, workItemExecutionGroupById, recordWorkItemWorkspaceDisposition } from "../workItem/workItem.js";
+import { createCandidateGitSnapshot, createDirectTaskMainSnapshot, workItemExecutionGroupById, currentWorkItemExecutionGroup, recordWorkItemWorkspaceDisposition } from "../workItem/workItem.js";
 import { createManagedWorkspace, isTaskOwnedWorkspace, managedWorkspaceKey, managedWorktreeName, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
 import { NodeGitWorkspace, worktreeIdentity } from "./gitWorkspace.js";
 import { acquireProjectMaintenanceLocks } from "./projectMaintenanceLock.js";
@@ -473,19 +473,27 @@ export class FileTaskWorkspacePreparer {
                     // durable WorkItem or ReviewRound workspace owns that cwd; Task-main
                     // preparation must not move a Reviewer Session out from under an
                     // active or retained ReviewRound. Other Roles use Task main.
-                    // Prefer the active Turn's exact WorkItem for this Role; fall back
-                    // to the first queued WorkItem only when no active Turn owns the Role.
+                    // Prefer the active Turn's exact WorkItem, then a retained direct
+                    // WorkItem owning this cwd, before considering queued assignments.
                     const activeRoleTurn = tx.getActiveTurn(task.id, role.name);
                     const activeTurnItem = activeRoleTurn !== null
                         && activeRoleTurn.purpose === "execution"
                         && activeRoleTurn.workItemId !== undefined
                         ? tx.getWorkItem(task.id, activeRoleTurn.workItemId)
                         : null;
+                    // Rejection ends an execution iteration, not its workspace ownership.
+                    // Preserve this direct WorkItem's existing cwd while dispatch prepares
+                    // the Task before atomically reopening the failed WorkItem. Merely
+                    // reading Task context must not migrate its resumable Worker either.
+                    const retainedItem = tx.listWorkItems(task.id).find((candidate) => (candidate.assignee === role.name
+                        && candidate.status === "failed"
+                        && currentWorkItemExecutionGroup(candidate) === undefined
+                        && tx.getWorkItemWorkspace(task.id, candidate.id)?.root === role.workspace));
                     const assignedItem = activeTurnItem !== null
                         && activeTurnItem.assignee === role.name
                         && !["completed", "failed", "retired"].includes(activeTurnItem.status)
                         ? activeTurnItem
-                        : tx.listWorkItems(task.id).find((candidate) => (candidate.assignee === role.name
+                        : retainedItem ?? tx.listWorkItems(task.id).find((candidate) => (candidate.assignee === role.name
                             && !["completed", "failed", "retired"]
                                 .includes(candidate.status)));
                     const assignedWorkspace = assignedItem === undefined

package/dist/review/taskFinalReviewContract.js

@@ -1,27 +1,21 @@
-import { createHash } from "node:crypto";
 import { requireIdentity } from "../domain/validation.js";
 export const TASK_FINAL_REVIEW_ARGUMENT = "--yui-task-final-review";
 export function createTaskFinalReviewContract(input) {
     const taskId = requireIdentity(input.taskId, "Task final-review contract Task id");
     const reviewerRoleName = requireIdentity(input.reviewerRoleName, "Task final-review contract Reviewer Role");
-    const controlPlaneDigest = requireDigest(input.controlPlaneDigest, "Task final-review contract control-plane digest");
     return Object.freeze({
-        schemaVersion: 1,
         taskId,
-        reviewerRoleName,
-        controlPlaneDigest,
-        digest: contractDigest(taskId, reviewerRoleName, controlPlaneDigest)
+        reviewerRoleName
     });
 }
 export function validateTaskFinalReviewContract(value) {
-    if (typeof value !== "object" || value === null || value.schemaVersion !== 1) {
-        throw new Error("Task final-review contract must use schemaVersion 1.");
-    }
-    const expected = createTaskFinalReviewContract(value);
-    const digest = requireDigest(value.digest, "Task final-review contract digest");
-    if (digest !== expected.digest) {
-        throw new Error("Task final-review contract digest does not match its immutable fields.");
+    if (typeof value !== "object" || value === null) {
+        throw new Error("Task final-review contract must be a record.");
     }
+    // A contract recorded by an earlier release also carried a version tag and the
+    // runtime that established it. Those fields are historical evidence and are
+    // never read again; the required fields below are the whole contract.
+    createTaskFinalReviewContract(value);
     return value;
 }
 export function taskFinalReviewConfig(contract) {
@@ -31,13 +25,15 @@ export function taskFinalReviewConfig(contract) {
 export function sameTaskFinalReviewContract(left, right) {
     if (left === undefined || right === undefined)
         return left === right;
-    return validateTaskFinalReviewContract(left).digest
-        === validateTaskFinalReviewContract(right).digest;
+    const first = validateTaskFinalReviewContract(left);
+    const second = validateTaskFinalReviewContract(right);
+    return first.taskId === second.taskId
+        && first.reviewerRoleName === second.reviewerRoleName;
 }
 /**
  * The contract switch is an exact CLI prefix, never an environment variable.
- * It must immediately follow `--yui-control <digest>` so the preflight can
- * bind it to the one verified Task runtime before opening mutable storage.
+ * It must be the first CLI argument so the preflight can bind it to the
+ * Leader's managed Session before opening mutable storage.
  */
 export function extractTaskFinalReviewRequest(args) {
     const index = args.indexOf(TASK_FINAL_REVIEW_ARGUMENT);
@@ -73,18 +69,3 @@ export function extractTaskFinalReviewRequest(args) {
         };
     }
 }
-function contractDigest(taskId, reviewerRoleName, controlPlaneDigest) {
-    return createHash("sha256").update(JSON.stringify([
-        "yui-task-final-review",
-        1,
-        taskId,
-        reviewerRoleName,
-        controlPlaneDigest
-    ])).digest("hex");
-}
-function requireDigest(value, label) {
-    if (typeof value !== "string" || !/^[a-f0-9]{64}$/u.test(value)) {
-        throw new Error(`${label} is invalid.`);
-    }
-    return value;
-}