@zq-silk/yui 0.15.7 → 0.15.8

package/dist/storage/storageVersions.js

@@ -13,4 +13,4 @@
  * intermediate Yui releases.
  */
 export const MIN_SUPPORTED_STORAGE_VERSION = 1;
-export const CURRENT_STORAGE_VERSION = 3;
+export const CURRENT_STORAGE_VERSION = 18;

package/dist/storage/storeRpc.js

@@ -28,6 +28,9 @@ import { StorageCancelledError, StorageConflictError, StorageRecordError } from
  * else is routed to the writer connection.
  */
 const READ_ONLY_STORE_METHODS = new Set([
+    "getPluginIntent", "listPluginIntents",
+    "getPluginValidation", "getArtifact", "listArtifacts", "getLocalResource", "listLocalResources",
+    "getEnvironmentPreparation", "listEnvironmentPreparations",
     "rootDirectory",
     "getConfig",
     "getHomeIdentity",
@@ -48,6 +51,8 @@ const READ_ONLY_STORE_METHODS = new Set([
     "readNextActionFacts",
     "readCompletionReadinessFacts",
     "listActiveTaskIds",
+    "listPlanningDraftTaskIds",
+    "listPendingActivationRequestTaskIds",
     "getTaskBrief",
     "listChangeSets",
     "getChangeSet",
@@ -70,13 +75,13 @@ const READ_ONLY_STORE_METHODS = new Set([
     "getRoleSession",
     "getWorkItem",
     "listWorkItems",
-    "getTurn",
-    "listTurns",
+    "getRun",
+    "listRuns",
     "listPendingProviderRetries",
-    "peekNextTurnId",
+    "peekNextRunId",
     "getReviewRound",
-    "getActiveTurn",
-    "getActiveExecutionLaneTurn",
+    "getActiveRun",
+    "getActiveExecutionLaneRun",
     "listMessages",
     "getInputRequest",
     "listInputRequests",

package/dist/storage/taskStore.js

@@ -5,14 +5,14 @@ import { isDeepStrictEqual } from "node:util";
 import { validateCapabilityGrant } from "../grant/capabilityGrant.js";
 import { validateReleaseWorkflow } from "../release/releaseWorkflow.js";
 import { validatePublicationReference } from "../task/publicationReference.js";
-import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveLeaderNextActionMode, resolveLeaderSemanticBudgetTurns, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryTurnCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
+import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveLeaderNextActionMode, resolveLeaderSemanticBudgetRuns, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryRunCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
 import { resolveTimeZone } from "../output/timePresentation.js";
 import { validateReviewConfig } from "../review/reviewConfig.js";
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
 export const CURRENT_CONFIG_SCHEMA_VERSION = 6;
 /** Current SQLite payload-family versions owned by this storage boundary. */
 export const CURRENT_CONFIGURED_AGENT_SCHEMA_VERSION = 2;
-export const CURRENT_PROJECT_SCHEMA_VERSION = 5;
+export const CURRENT_PROJECT_SCHEMA_VERSION = 6;
 export const CURRENT_AGENT_PROFILE_SCHEMA_VERSION = 3;
 export const CURRENT_GLOBAL_ROLE_SCHEMA_VERSION = 3;
 export const CURRENT_GLOBAL_ROLE_SESSION_SET_SCHEMA_VERSION = 5;
@@ -42,13 +42,13 @@ export const COMPLETION_SHELLS = ["bash", "zsh", "fish"];
  * makes the two key spaces disjoint even for legal Role names such as
  * `lane:worker:1`.
  */
-export function executionLaneActiveTurnKey(executionGroupId, executionLaneId) {
+export function executionLaneActiveRunKey(executionGroupId, executionLaneId) {
     return `/execution-lane/${encodeLaneKeyPart(executionGroupId)}:${encodeLaneKeyPart(executionLaneId)}`;
 }
 function encodeLaneKeyPart(value) {
     return encodeURIComponent(value).replace(/:/gu, "%3A");
 }
-export function executionLaneActiveTurnKeyParts(key) {
+export function executionLaneActiveRunKeyParts(key) {
     const match = /^\/execution-lane\/([^:]+):([^:]+)$/u.exec(key);
     if (match === null)
         return null;
@@ -66,7 +66,7 @@ export function executionLaneActiveTurnKeyParts(key) {
  * Nested-record versions consumed by the current SQLite payload validators.
  */
 export const CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION = 12;
-export const CURRENT_TURN_SCHEMA_VERSION = 5;
+export const CURRENT_RUN_SCHEMA_VERSION = 5;
 export const CURRENT_INTEGRATION_QUEUE_SCHEMA_VERSION = 1;
 export class StorageRecordError extends Error {
     constructor(message) { super(message); this.name = "StorageRecordError"; }
@@ -156,13 +156,13 @@ export function validateYuiConfig(config) {
             "controllerTaskConcurrency",
             "agentLaunchInactivityTimeoutSeconds",
             "deliveryTimeoutSeconds",
-            "leaderSemanticBudgetTurns",
+            "leaderSemanticBudgetRuns",
             "resourcesQuarantineTtlHours",
             "tmuxBin",
             "tmuxHistoryLimit",
             "telemetryEnabled",
             "telemetryTerminalKeep",
-            "telemetryTurnCap",
+            "telemetryRunCap",
             "completionInstallations"
         ];
         exact(config, [
@@ -184,12 +184,12 @@ export function validateYuiConfig(config) {
         resolveControllerTaskConcurrency(config.controllerTaskConcurrency);
         resolveAgentLaunchInactivityTimeoutSeconds(config.agentLaunchInactivityTimeoutSeconds);
         resolveDeliveryTimeoutSeconds(config.deliveryTimeoutSeconds);
-        resolveLeaderSemanticBudgetTurns(config.leaderSemanticBudgetTurns);
+        resolveLeaderSemanticBudgetRuns(config.leaderSemanticBudgetRuns);
         resolveTmuxBin(config.tmuxBin);
         resolveTmuxHistoryLimit(config.tmuxHistoryLimit);
         resolveTelemetryEnabled(config.telemetryEnabled);
         resolveTelemetryTerminalKeep(config.telemetryTerminalKeep);
-        resolveTelemetryTurnCap(config.telemetryTurnCap);
+        resolveTelemetryRunCap(config.telemetryRunCap);
     }
     catch (error) {
         throw new StorageRecordError(error instanceof Error ? error.message : "Yui reconciliation interval is invalid.");
@@ -350,7 +350,8 @@ export function isValidCapabilityGrantTransition(existing, candidate) {
     }
     // A use record must advance the counter (compare-and-swap): a stale equal
     // increment from a concurrent reader is rejected, so two workflows cannot
-    // spend the same maxUses slot. Reservations are append-only, one per use.
+    // spend the same maxUses slot. Existing reservations are append-only;
+    // non-resumable uses may advance the counter without adding a reservation.
     return candidate.usesUsed > existing.usesUsed
         && reservationsAppendOnly(existing.useReservations, candidate.useReservations)
         && Date.parse(candidate.updatedAt) >= Date.parse(existing.updatedAt);
@@ -702,7 +703,8 @@ function assertJsonValue(value, label, seen = new Set()) {
 }
 function clone(value) { assertJsonValue(value, "Stored value"); return JSON.parse(JSON.stringify(value)); }
 export function pendingWakeupProjection(mailbox) {
-    const pending = mailbox?.processing?.owner.startsWith("leader-steer:") === true
+    const pending = (mailbox?.processing?.owner.startsWith("leader-steer:") === true
+        || mailbox?.processing?.owner.startsWith("leader-notification:") === true)
         ? mailbox.processing.batch
         : mailbox?.pending ?? null;
     if (mailbox === null || mailbox.target.kind !== "role" || mailbox.target.roleName !== "leader"

package/dist/storage/upgrade/upgradeOrchestrator.js

@@ -6,7 +6,7 @@ import { RUNTIME_PROCESS_EXIT_TASK_EVENT, validateRuntimeProcessExitObservation
 import { validateAgentProfile } from "../../profile/agentProfile.js";
 import { validateRoleSessionSet } from "../../executor/agentExecutor.js";
 import { validateReviewRound } from "../../review/reviewRound.js";
-import { validateTurn } from "../../turn/turn.js";
+import { validateRun } from "../../agentRun/agentRun.js";
 import { validateDurableJob } from "../../job/durableJob.js";
 import { validateWorkItem } from "../../workItem/workItem.js";
 import { SqliteTaskStore } from "../sqliteStore.js";
@@ -185,10 +185,8 @@ function validateCurrentStore(home) {
             validateRoleSessionSet(sessions);
         }
         for (const owner of store.listSessionOwners()) {
-            if (owner.schemaVersion !== 2
-                || typeof owner.runtimeGenerationId !== "string"
-                || Object.hasOwn(owner, "launchId")) {
-                throw new Error("Session owner runtime generation identity is invalid.");
+            if (owner.schemaVersion !== 2 || Object.hasOwn(owner, "launchId")) {
+                throw new Error("Session owner runtime identity is invalid.");
             }
         }
         for (const taskId of store.listTasks().map(({ id }) => id)) {
@@ -198,8 +196,8 @@ function validateCurrentStore(home) {
                 validateWorkItem(item);
             for (const round of store.listReviewRounds(taskId))
                 validateReviewRound(round);
-            for (const turn of store.listTurns(taskId))
-                validateTurn(turn);
+            for (const run of store.listRuns(taskId))
+                validateRun(run);
             for (const sessions of store.listRoleSessionSets(taskId)) {
                 validateRoleSessionSet(sessions);
             }

package/dist/surface/surfaceContributions.js

@@ -0,0 +1,102 @@
+/** A fresh authorized view, not a second directory or instance ledger.
+ * Capabilities naturally contribute CLI commands; queries also get the known
+ * JSON renderer unless the provider supplies a controlled panel descriptor. */
+export class SurfaceContributions {
+    registry;
+    constructor(registry) {
+        this.registry = registry;
+    }
+    listCommands(context) {
+        return this.registry.search(context).map((entry) => ({
+            ...reference(entry), name: entry.surfaces?.cli?.name ?? entry.name,
+            help: entry.surfaces?.cli?.help ?? entry.summary, effect: entry.effect,
+            ...(entry.unavailable === undefined ? {} : { unavailable: entry.unavailable })
+        }));
+    }
+    listPanels(context) {
+        return this.registry.search(context).flatMap((entry) => {
+            const panel = entry.surfaces?.panel
+                ?? (entry.effect === "query" ? { kind: "data", title: entry.summary, renderer: "json" } : undefined);
+            return panel ? [{
+                    ...reference(entry), panel, inputSchema: entry.inputSchema,
+                    ...(entry.unavailable === undefined ? {} : { unavailable: entry.unavailable })
+                }] : [];
+        });
+    }
+    /** Query entry used by the Controller-owned Web server. Resolve the current
+     * descriptor and exact generation again; the browser never supplies code. */
+    readPanel(context, selected, input) {
+        const resolved = this.registry.describe(context, {
+            name: selected.capability, contractVersion: selected.contractVersion, providerId: selected.provider.id
+        });
+        if (resolved.kind !== "value")
+            return Promise.resolve(resolved);
+        const descriptor = resolved.value;
+        if (descriptor.provider.generation !== selected.provider.generation || descriptor.effect !== "query") {
+            return Promise.resolve({ kind: "unavailable", effect: "none", operations: [],
+                detail: "Panel changed or is not a query. Reload current panels." });
+        }
+        const panel = descriptor.surfaces?.panel;
+        if (panel !== undefined && panel.kind !== "data")
+            return Promise.resolve({ ...resolved, value: panel });
+        return this.registry.call(context, {
+            name: descriptor.name, contractVersion: descriptor.contractVersion,
+            providerId: descriptor.provider.id, input
+        });
+    }
+}
+/** Called before a complete capability generation is published. Restrict the
+ * entire accepted shape so unchecked HTML or executable fields cannot sneak
+ * into the browser's descriptor payload. */
+export function checkSurfaceDescriptors(entry) {
+    if (entry.surfaces === undefined)
+        return;
+    const surfaces = record(entry.surfaces, ["cli", "panel"]);
+    if (surfaces.cli !== undefined) {
+        const cli = record(surfaces.cli, ["name", "help"]);
+        // Command names are the capability's existing namespace, not root commands
+        // or a second alias-resolution policy.
+        if (cli.name !== entry.name || !text(cli.help))
+            throw new Error("Invalid CLI contribution.");
+    }
+    if (surfaces.panel !== undefined) {
+        const panel = record(surfaces.panel, ["kind", "title", "text", "href", "renderer"]);
+        if (!text(panel.title))
+            throw new Error("Invalid panel title.");
+        switch (panel.kind) {
+            case "text":
+                record(panel, ["kind", "title", "text"]);
+                if (typeof panel.text !== "string")
+                    throw new Error("Invalid text panel.");
+                break;
+            case "link": {
+                record(panel, ["kind", "title", "href"]);
+                if (!text(panel.href))
+                    throw new Error("Invalid link panel.");
+                const url = new URL(panel.href);
+                if (!["https:", "http:"].includes(url.protocol) || url.username || url.password) {
+                    throw new Error("Panel links require an HTTP(S) URL without credentials.");
+                }
+                break;
+            }
+            case "data":
+                record(panel, ["kind", "title", "renderer"]);
+                if (entry.effect !== "query" || panel.renderer !== "json")
+                    throw new Error("Invalid data panel.");
+                break;
+            default: throw new Error("Unknown panel kind.");
+        }
+    }
+}
+function reference(entry) {
+    return { capability: entry.name, contractVersion: entry.contractVersion, provider: entry.provider };
+}
+function text(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function record(value, keys) {
+    if (!value || typeof value !== "object" || Array.isArray(value)
+        || Object.keys(value).some((key) => !keys.includes(key)))
+        throw new Error("Invalid surface descriptor.");
+    return value;
+}

package/dist/task/completionReadiness.js

@@ -1,4 +1,24 @@
 import { governingWorkItemDeliveries, integrationAttemptRequiresSettlement, workItemDeliverySettled } from "../integration/deliveryObligation.js";
+import { operationalTaskRecords } from "./taskRecordRetirement.js";
+/** Mailbox refs locate original durable user intent. No separate acknowledgement
+ * state is introduced: finish the current native turn and let the existing
+ * notification delivery present the new input before declaring completion. */
+export function pendingCompletionMessages(store, taskId) {
+    const mailbox = store.getWorkMailbox({ kind: "role", taskId, roleName: "leader" });
+    const refs = [...(mailbox?.pending?.refs ?? [])];
+    const processing = mailbox?.processing;
+    if (processing?.owner.startsWith("leader-notification:")) {
+        const native = store.getTaskRoleSessionSet(taskId, "leader")?.providerBinding?.run;
+        if (native?.attemptId !== processing.batchId
+            || !["accepted", "completed", "failed", "cancelled"].includes(native.status)) {
+            refs.push(...processing.batch.refs);
+        }
+    }
+    const ids = new Set(refs.filter(ref => ref.type === "message" && ref.taskId === taskId).map(ref => ref.id));
+    return operationalTaskRecords(store.listMessages(taskId), store.listEvents(taskId), "message")
+        .filter(message => ids.has(message.id)
+        && (message.kind === "user" || message.kind === "operator") && message.wakePolicy !== "none");
+}
 const ACTIVE_JOB_STATUSES = new Set([
     "queued",
     "running",
@@ -15,6 +35,14 @@ export function projectCompletionReadiness(facts) {
     const blockers = [];
     const advisories = [];
     const { task } = facts;
+    for (const message of facts.pendingUserMessages ?? []) {
+        blockers.push({
+            code: "pending-user-input",
+            ref: ref("message", message.id),
+            reason: `User message ${message.id} is still awaiting Leader delivery.`,
+            fix: `finish the current native turn, read the next notification and message ${message.id}, then reconsider completion`
+        });
+    }
     // A pending/running Task-final Review must be resumed or blocked first.
     for (const round of facts.reviewRounds) {
         if ((round.scope ?? "work-item") !== "task")
@@ -27,7 +55,7 @@ export function projectCompletionReadiness(facts) {
             reason: `Task-final ReviewRound ${round.id} is ${round.status}.`,
             fix: round.status === "pending"
                 ? `yui task review retry ${task.id}/${round.id}`
-                : `wait for Reviewer Turn on ${round.id} to finish`
+                : `wait for Reviewer AgentRun on ${round.id} to finish`
         });
     }
     // Open Input requests block protocol convergence.
@@ -41,15 +69,13 @@ export function projectCompletionReadiness(facts) {
     }
     // Every Work Item must be terminal (completed or retired).
     for (const item of facts.workItems) {
-        if (item.status === "completed" || item.status === "retired")
+        if (item.status === "accepted" || item.status === "retired")
             continue;
         blockers.push({
             code: "incomplete-work-item",
             ref: ref("work-item", item.id),
             reason: `Work Item ${item.id} is ${item.status}.`,
-            fix: item.status === "failed"
-                ? `yui task work update ${task.id}/${item.id} running`
-                : `complete or retire Work Item ${item.id}`
+            fix: `accept or retire Work Item ${item.id}`
         });
     }
     // Active DurableJobs (integration checks, etc.) must settle.
@@ -152,7 +178,7 @@ function workspaceCompletionDisposition(facts, taskId, workspace) {
                 reason: `Work Item ${owner.workItemId} has an isolated workspace that is not disposed.`,
                 fix: `yui task work cleanup ${taskId}/${owner.workItemId} --integrated|--abandon`
             };
-            return item !== undefined && (item.status === "completed" || item.status === "retired")
+            return item !== undefined && (item.status === "accepted" || item.status === "retired")
                 ? { kind: "advisory", value }
                 : { kind: "blocker", value };
         }

package/dist/task/deliveryGuard.js

@@ -1,5 +1,5 @@
-import { isCompletedTaskReviewEvidenceFromTurns } from "../review/reviewAcceptance.js";
-const OPEN_WORK_ITEM_STATUSES = new Set(["pending", "running", "awaiting_acceptance"]);
+import { isCompletedTaskReviewEvidenceFromRuns } from "../review/reviewAcceptance.js";
+const OPEN_WORK_ITEM_STATUSES = new Set(["open"]);
 export function detectDeliveryDuplicates(facts, intent) {
     switch (intent.kind) {
         case "create-work-item":
@@ -59,7 +59,7 @@ function detectWorkItemDuplicates(facts, scope) {
             });
             continue;
         }
-        if (sameScope && item.status === "completed") {
+        if (sameScope && item.status === "accepted") {
             duplicates.push({
                 severity: "suspected",
                 reason: `Work Item ${item.id} already delivered the identical scope; re-creating it may be a duplicate successor`,
@@ -127,7 +127,7 @@ function detectReviewDuplicates(facts, intent) {
         if (!sameCandidate)
             continue;
         const ref = { kind: "review-round", id: round.id };
-        if (isCompletedTaskReviewEvidenceFromTurns(round, facts.reviewOutcomeEvidence?.turns ?? [])) {
+        if (isCompletedTaskReviewEvidenceFromRuns(round, facts.reviewOutcomeEvidence?.runs ?? [])) {
             duplicates.push({
                 severity: "exact",
                 reason: `Task-final Review ${round.id} already attests this exact head`,
@@ -174,29 +174,29 @@ function overlap(left, right) {
  * Default number of consecutive completed Leader turns that must produce no
  * durable delivery change before the budget is exhausted.
  */
-export const DEFAULT_SEMANTIC_BUDGET_TURNS = 3;
+export const DEFAULT_SEMANTIC_BUDGET_RUNS = 3;
 /**
  * Evaluate the semantic-progress budget from existing records only. The
- * budget is exhausted when the last `turns` Leader Turns all completed and no
+ * budget is exhausted when the last `runs` Leader AgentRuns all completed and no
  * WorkItem/ChangeSet/Integration/Review record changed at or after the first
- * of those Turns. Active execution (any Turn) never exhausts the budget: a
+ * of those AgentRuns. Active execution (any AgentRun) never exhausts the budget: a
  * slow but progressing Worker or Leader is never interrupted.
  */
-export function evaluateSemanticBudget(facts, turns = DEFAULT_SEMANTIC_BUDGET_TURNS) {
-    if (facts.activeTurns.length > 0) {
+export function evaluateSemanticBudget(facts, runs = DEFAULT_SEMANTIC_BUDGET_RUNS) {
+    if (facts.activeRuns.length > 0) {
         return {
             exhausted: false,
-            reason: "Active execution is in flight; the budget never interrupts a progressing Turn.",
-            evidence: facts.activeTurns.map((run) => run.id)
+            reason: "Active execution is in flight; the budget never interrupts a progressing AgentRun.",
+            evidence: facts.activeRuns.map((run) => run.id)
         };
     }
-    const recentLeaderRuns = facts.leaderTurns
+    const recentLeaderRuns = facts.leaderRuns
         .filter((run) => run.status === "completed")
-        .slice(-turns);
-    if (recentLeaderRuns.length < turns) {
+        .slice(-runs);
+    if (recentLeaderRuns.length < runs) {
         return {
             exhausted: false,
-            reason: `Fewer than ${turns} consecutive completed Leader turns.`,
+            reason: `Fewer than ${runs} consecutive completed Leader runs.`,
             evidence: recentLeaderRuns.map((run) => run.id)
         };
     }
@@ -211,7 +211,7 @@ export function evaluateSemanticBudget(facts, turns = DEFAULT_SEMANTIC_BUDGET_TU
     }
     return {
         exhausted: true,
-        reason: `${turns} consecutive Leader turns produced no durable delivery change; record a diagnosis and wait for new facts instead of creating more records.`,
+        reason: `${runs} consecutive Leader runs produced no durable delivery change; record a diagnosis and wait for new facts instead of creating more records.`,
         evidence: recentLeaderRuns.map((run) => run.id)
     };
 }

package/dist/task/draftPlan.js

@@ -1,3 +1,25 @@
+import { RUNTIME_OBSERVATION_TASK_EVENT } from "../runtime/runtimeObservation.js";
+import { SYSTEM_LEADER_ROLE } from "../role/systemRoles.js";
+/**
+ * Runtime Task-event types that are emitted with a Role but no Turn in their
+ * payload. Each one is still only exempted when its `roleName` resolves to the
+ * Leader — the `runtime.` prefix is never exempted, and a type absent from this
+ * set keeps disqualifying the Draft.
+ *
+ * Turn lifecycle events are deliberately not listed: they use one generic type
+ * per transition and name the Turn in their payload, so the guard resolves that
+ * Turn's own purpose instead of trusting the type. Listing invented
+ * `turn.planning-*` types would have exempted nothing while silently
+ * disqualifying every Draft that ever held a planning conversation.
+ */
+export const PLANNING_ROLE_EVENT_TYPES = new Set([
+    "runtime.session-stop-requested",
+    "runtime.session-termination",
+    // Written by the liveness/host-exit paths, which admit a Draft planning Turn.
+    // Its payload carries the Role and embeds the Turn only inside the serialized
+    // observation, so it is resolved as Role-scoped rather than by that blob.
+    "runtime.process-exit-observed"
+]);
 export function assertDraftTaskExecutionFree(store, task) {
     if (task.status !== "draft") {
         throw new Error(`Task is not a Draft: ${task.id}/${task.status}.`);
@@ -109,13 +131,21 @@ function assertDraftWorkItemDependencyGraph(workItems, onlyItem) {
 function firstDraftExecutionFact(store, task) {
     if (task.workspaceIdentity !== undefined || task.cwd !== undefined)
         return "Task workspace";
-    const hostOwner = store.listSessionOwners().find(({ owner }) => (owner.scope === "task" && owner.taskId === task.id));
+    // Draft planning is a first-class Leader conversation, so its Turns, its
+    // Session and its Host are ordinary planning facts rather than execution
+    // history. Anything that could only exist after delivery still disqualifies
+    // the Draft, and a planning Turn can never carry a WorkItem, ReviewRound,
+    // Lane or workspace (validateTurn enforces that), so this stays a narrow
+    // exemption rather than a hole.
+    const run = store.listRuns(task.id).find(({ purpose }) => purpose !== "planning");
+    if (run !== undefined)
+        return `AgentRun ${run.id}/${run.purpose}`;
+    const hostOwner = store.listSessionOwners().find(({ owner }) => (owner.scope === "task" && owner.taskId === task.id && owner.roleName !== SYSTEM_LEADER_ROLE));
     if (hostOwner !== undefined)
-        return `Host owner (${hostOwner.runtimeGenerationId})`;
-    if (store.listTurns(task.id).length > 0)
-        return "Turn";
-    if (store.listRoleSessionSets(task.id).length > 0)
-        return "Role Session";
+        return `Host process (${hostOwner.providerRoot.pid})`;
+    const sessionSet = store.listRoleSessionSets(task.id).find(({ owner }) => owner.roleName !== SYSTEM_LEADER_ROLE);
+    if (sessionSet !== undefined)
+        return `Role Session (${sessionSet.owner.roleName})`;
     if (store.listDurableJobs(task.id).length > 0)
         return "DurableJob";
     if (store.listManagedWorkspaces(task.id).length > 0)
@@ -130,13 +160,43 @@ function firstDraftExecutionFact(store, task) {
         || item.currentExecutionGroupId !== undefined
         || item.candidates.length > 0
         || item.workspaceDisposition !== undefined
-        || !["pending", "retired"].includes(item.status)));
+        || !["open", "retired"].includes(item.status)));
     if (itemWithExecution !== undefined) {
         return `Work Item execution (${itemWithExecution.id})`;
     }
-    const runtimeEvent = store.listEvents(task.id).find(({ type }) => (type.startsWith("runtime.")
-        || type.startsWith("turn.")
-        || type.startsWith("review.")
-        || type.startsWith("integration.")));
-    return runtimeEvent === undefined ? undefined : `event ${runtimeEvent.id}/${runtimeEvent.type}`;
+    // Runtime observations support planning; they are not a competing source
+    // of delivery authority. The domain records above own delivery facts.
+    return undefined;
+}
+/**
+ * Whether one runtime/Turn Task event belongs to this Draft's own planning
+ * conversation.
+ *
+ * The binding the event carries decides this, never its type prefix:
+ *
+ * - it names a Turn → that Turn must exist on this Task and be `planning`;
+ * - it names no Turn → its exact type must be Role-scoped by construction and
+ *   its `roleName` must be the Leader, the only Role a Draft may run.
+ *
+ * Everything else stays disqualifying, so an unrecognized type, a foreign Role
+ * or a Turn reference that cannot be resolved fails closed.
+ */
+function isDraftPlanningEvent(store, task, event) {
+    // Several emitters write an absent Turn as an empty string, so only a
+    // non-empty id counts as a reference worth resolving.
+    const runId = event.payload["runId"];
+    if (typeof runId === "string" && runId !== "") {
+        return store.getRun(task.id, runId)?.purpose === "planning";
+    }
+    // A canonical runtime observation is the event normal delivery writes for
+    // session.started/conversation.observed/turn.accepted and every terminal. It
+    // names its Turn in the same payload field as everything else and was
+    // resolved above; only an unfenced host-level observation reaches here, where
+    // the Role still has to prove it. Admitting this one type by its own binding
+    // is not the same as admitting the `runtime.` prefix.
+    if (event.type !== RUNTIME_OBSERVATION_TASK_EVENT
+        && !PLANNING_ROLE_EVENT_TYPES.has(event.type)) {
+        return false;
+    }
+    return event.payload["roleName"] === SYSTEM_LEADER_ROLE;
 }