@zq-silk/yui 0.15.9 → 0.15.11

package/dist/message/message.js

@@ -14,6 +14,13 @@ export const TASK_MESSAGE_KINDS = ["user", "operator", "role-result", "system"];
  * so an internal Agent report cannot acquire develop authority.
  */
 export const TASK_SUBMISSION_INTENTS = ["record", "discuss", "develop"];
+/** The two durable input actions an authorized caller can choose (decision-3).
+ * `interrupt` is a control operation, not a persisted Message action, so it is
+ * absent here. */
+export const TASK_MESSAGE_INPUT_ACTIONS = ["queue", "steer"];
+/** The recordable outcomes of a steer's one live control attempt (message-5 gap
+ * D). `not-submitted` is not here: it is the absence of a record, not a value. */
+export const TASK_MESSAGE_INPUT_CONTROL_OUTCOMES = ["pending", "accepted", "rejected", "delivery-unknown"];
 export function createTaskMessage(id, taskId, body, kind, author, now, context = {}) {
     validateKindAndAuthor(kind, author);
     const message = {
@@ -32,6 +39,38 @@ export function createTaskMessage(id, taskId, body, kind, author, now, context =
         ...(context.submissionKey === undefined
             ? {}
             : { submissionKey: requireText(context.submissionKey, "Message submission key") }),
+        ...(context.inputControl === undefined
+            ? {}
+            : { inputControl: {
+                    action: context.inputControl.action,
+                    requestId: requireSafeIdentity(context.inputControl.requestId, "Message input requestId"),
+                    ...(context.inputControl.expectedTarget === undefined
+                        ? {} : { expectedTarget: requireText(context.inputControl.expectedTarget, "Message input expectedTarget") })
+                } }),
+        ...(context.interruptThen === undefined
+            ? {}
+            : { interruptThen: {
+                    requestId: requireSafeIdentity(context.interruptThen.requestId, "Message interrupt requestId"),
+                    targetAttemptId: requireText(context.interruptThen.targetAttemptId, "Message interrupt targetAttemptId"),
+                    targetRoleName: context.interruptThen.targetRoleName,
+                    targetAgentId: context.interruptThen.targetAgentId,
+                    targetAdapterId: context.interruptThen.targetAdapterId,
+                    targetNativeSessionId: context.interruptThen.targetNativeSessionId,
+                    targetAuthorityEpoch: context.interruptThen.targetAuthorityEpoch,
+                    targetAuthorityHolderId: context.interruptThen.targetAuthorityHolderId,
+                    ...(context.interruptThen.targetNativeTurnId === undefined ? {} : {
+                        targetNativeTurnId: context.interruptThen.targetNativeTurnId
+                    }),
+                    ...(context.interruptThen.notDeliveredReason === undefined ? {} : {
+                        notDeliveredReason: context.interruptThen.notDeliveredReason
+                    }),
+                    ...(context.interruptThen.targetRunId === undefined
+                        ? {} : { targetRunId: context.interruptThen.targetRunId }),
+                    ...(context.interruptThen.reusedInput === undefined ? {} : { reusedInput: {
+                            action: context.interruptThen.reusedInput.action,
+                            requestId: requireSafeIdentity(context.interruptThen.reusedInput.requestId, "Reused input requestId")
+                        } })
+                } }),
         ...(context.runId === undefined
             ? {}
             : { runId: requireSafeIdentity(context.runId, "Message AgentRun id") }),
@@ -49,6 +88,69 @@ export function createTaskMessage(id, taskId, body, kind, author, now, context =
 export function taskMessageAuthorLabel(author) {
     return author.type === "role" ? author.roleName : author.type;
 }
+/**
+ * The four visible states a later reader distinguishes for a steer input
+ * (message-5 gap D): the absence of any live attempt is `not-submitted`, and a
+ * recorded attempt reports its own observed outcome. A non-steer Message has no
+ * control state and returns `undefined`. This is the single reader other CLI
+ * invocations, the Web surface, and the Leader's Context read all use, so no
+ * consumer reconstructs the state from raw fields.
+ */
+export function taskMessageInputControlState(message) {
+    const wasSteer = message.inputControl?.action === "steer"
+        || message.interruptThen?.reusedInput?.action === "steer";
+    if (!wasSteer)
+        return undefined;
+    return message.control?.outcome ?? "not-submitted";
+}
+/**
+ * Record the observed disposition of a steer's one live control attempt as an
+ * independent, idempotent, monotonic control op (decision-3 §3/§8, message-5 gap
+ * D). The op is keyed by the exact `receiptId` fence and the steer's own
+ * `requestId`; a record naming a different Message's receipt or a different
+ * input identity is refused, so an outcome can never be folded onto the wrong
+ * Message or fork a second op. Terminals never rewind to `pending` and never
+ * overwrite a different terminal — a repeated or out-of-order live/Host record
+ * is absorbed, never a conflicting second write. The frozen business
+ * {@link TaskMessageInputControl} intent is left untouched.
+ */
+export function recordTaskMessageControlOutcome(message, record) {
+    const inputRequestId = message.inputControl?.requestId ?? message.interruptThen?.reusedInput?.requestId;
+    const wasSteer = message.inputControl?.action === "steer"
+        || message.interruptThen?.reusedInput?.action === "steer";
+    if (!wasSteer || inputRequestId === undefined) {
+        throw new Error("Only a steer input Message records a live control outcome.");
+    }
+    if (record.requestId !== inputRequestId) {
+        throw new Error("Control outcome requestId must match the steer input identity.");
+    }
+    const existing = message.control;
+    if (existing !== undefined && existing.receiptId !== record.receiptId) {
+        throw new Error("Control outcome receiptId cannot name another control op.");
+    }
+    // Monotonic freeze (decision-3 §8, message-5 gap D). Once any terminal is
+    // proven it is final: a later `pending` never rewinds it and a different
+    // terminal never overwrites it — the first proven terminal wins. While still
+    // `pending`, an identical repeat is idempotent. Each frozen/absorbed case
+    // returns the Message unchanged so a fold can persist without a second write.
+    if (existing !== undefined) {
+        if (existing.outcome === "accepted" || existing.outcome === "rejected")
+            return message;
+        if (record.outcome === "pending" || record.outcome === existing.outcome)
+            return message;
+    }
+    const updated = {
+        ...message,
+        control: {
+            requestId: requireSafeIdentity(record.requestId, "Message control requestId"),
+            receiptId: requireText(record.receiptId, "Message control receiptId"),
+            outcome: record.outcome,
+            observedAt: record.observedAt.toISOString()
+        }
+    };
+    validateTaskMessage(updated);
+    return updated;
+}
 /** A role-result reference never duplicates the execution's report body. */
 export function expandTaskMessageResult(message, getRun) {
     if (message.resultRef === undefined)
@@ -130,6 +232,72 @@ export function validateTaskMessage(message) {
     if (message.submissionReceipt !== undefined && message.submissionKey === undefined) {
         throw new Error("Message submission receipt requires a submission key.");
     }
+    if (message.inputControl !== undefined) {
+        if (!TASK_MESSAGE_INPUT_ACTIONS.includes(message.inputControl.action)) {
+            throw new Error(`Message input action is invalid: ${String(message.inputControl.action)}.`);
+        }
+        requireSafeIdentity(message.inputControl.requestId, "Message input requestId");
+        if (message.inputControl.expectedTarget !== undefined) {
+            requireText(message.inputControl.expectedTarget, "Message input expectedTarget");
+            if (message.inputControl.action !== "steer") {
+                throw new Error("Only a steer input binds an expectedTarget.");
+            }
+        }
+    }
+    if (message.interruptThen !== undefined) {
+        requireSafeIdentity(message.interruptThen.requestId, "Message interrupt requestId");
+        requireText(message.interruptThen.targetAttemptId, "Message interrupt targetAttemptId");
+        requireSafeIdentity(message.interruptThen.targetRoleName, "Message interrupt target Role");
+        requireSafeIdentity(message.interruptThen.targetAgentId, "Message interrupt target Agent");
+        requireSafeIdentity(message.interruptThen.targetAdapterId, "Message interrupt target Adapter");
+        requireText(message.interruptThen.targetNativeSessionId, "Message interrupt target Session");
+        requireText(message.interruptThen.targetAuthorityHolderId, "Message interrupt authority holder");
+        if (message.interruptThen.notDeliveredReason !== undefined) {
+            requireText(message.interruptThen.notDeliveredReason, "Message interrupt nondelivery reason");
+        }
+        if (!Number.isSafeInteger(message.interruptThen.targetAuthorityEpoch)
+            || message.interruptThen.targetAuthorityEpoch < 1)
+            throw new Error("Invalid interrupt authority epoch.");
+        if (message.interruptThen.targetRunId !== undefined) {
+            validateTaskRecordReference({ taskId: message.taskId, localId: message.interruptThen.targetRunId }, "run");
+        }
+        if (message.interruptThen.reusedInput !== undefined) {
+            if (!TASK_MESSAGE_INPUT_ACTIONS.includes(message.interruptThen.reusedInput.action)) {
+                throw new Error(`Reused input action is invalid: ${String(message.interruptThen.reusedInput.action)}.`);
+            }
+            requireSafeIdentity(message.interruptThen.reusedInput.requestId, "Reused input requestId");
+        }
+        // A then-handoff is an explicit deliverable Message, never an auto-queued
+        // steer: the two intents are mutually exclusive by construction. The prior
+        // steer identity, when one existed, is preserved as reusedInput provenance
+        // rather than left live on inputControl.
+        if (message.inputControl?.action === "steer") {
+            throw new Error("An interrupt-then handoff cannot also be a steer input.");
+        }
+    }
+    if (message.control !== undefined) {
+        requireSafeIdentity(message.control.requestId, "Message control requestId");
+        requireText(message.control.receiptId, "Message control receiptId");
+        if (!TASK_MESSAGE_INPUT_CONTROL_OUTCOMES.includes(message.control.outcome)) {
+            throw new Error(`Message control outcome is invalid: ${String(message.control.outcome)}.`);
+        }
+        if (typeof message.control.observedAt !== "string" || Number.isNaN(Date.parse(message.control.observedAt))) {
+            throw new Error("Message control observedAt is invalid.");
+        }
+        // A recorded control outcome is the disposition of a live steer attempt; it
+        // only exists for a steer input, or for the reused-steer provenance a
+        // handoff preserved. It is never fabricated on a plain queue or a Message
+        // that never carried a steer (decision-3 §3, message-5 gap D).
+        const inputRequestId = message.inputControl?.requestId ?? message.interruptThen?.reusedInput?.requestId;
+        const wasSteer = message.inputControl?.action === "steer"
+            || message.interruptThen?.reusedInput?.action === "steer";
+        if (!wasSteer || inputRequestId === undefined) {
+            throw new Error("Only a steer input Message records a live control outcome.");
+        }
+        if (message.control.requestId !== inputRequestId) {
+            throw new Error("Message control requestId must match the steer input identity.");
+        }
+    }
     if (message.runId !== undefined)
         requireSafeIdentity(message.runId, "Message AgentRun id");
     if (message.recipient !== undefined) {
@@ -186,6 +354,205 @@ export function validateTaskMessage(message) {
         throw new Error("Message createdAt is invalid.");
     }
 }
+/**
+ * The author kinds a Global Role input can carry. A Global Role has no Task
+ * Assignment, so a `role-result` (which references a Task AgentRun) is not one
+ * of them; user/operator/system inputs are (decision-3 §9/§11).
+ */
+export const GLOBAL_ROLE_MESSAGE_KINDS = ["user", "operator", "system", "agent"];
+export function createGlobalRoleMessage(id, roleName, body, kind, author, now, context = {}) {
+    validateGlobalKindAndAuthor(kind, author);
+    const message = {
+        schemaVersion: 1,
+        id: validateGlobalRoleMessageId(id),
+        roleName: requireSafeIdentity(roleName, "Global message Role name"),
+        kind,
+        author: { type: author.type },
+        body: requireBody(body),
+        ...(context.inputControl === undefined
+            ? {}
+            : { inputControl: {
+                    action: context.inputControl.action,
+                    requestId: requireSafeIdentity(context.inputControl.requestId, "Message input requestId"),
+                    ...(context.inputControl.expectedTarget === undefined
+                        ? {} : { expectedTarget: requireText(context.inputControl.expectedTarget, "Message input expectedTarget") })
+                } }),
+        createdAt: now.toISOString()
+    };
+    validateGlobalRoleMessage(message);
+    return message;
+}
+export function validateGlobalRoleMessage(message) {
+    if (message.schemaVersion !== 1)
+        throw new Error("Global Role Message must use schemaVersion 1.");
+    validateGlobalRoleMessageId(message.id);
+    requireSafeIdentity(message.roleName, "Global message Role name");
+    requireBody(message.body);
+    validateGlobalKindAndAuthor(message.kind, message.author);
+    if (message.deliveryTarget !== undefined) {
+        requireText(message.deliveryTarget.agentId, "Global input Agent");
+        requireText(message.deliveryTarget.nativeSessionId, "Global input Session");
+    }
+    if (message.control !== undefined) {
+        requireSafeIdentity(message.control.requestId, "Global input requestId");
+        requireText(message.control.receiptId, "Global input receiptId");
+        if (!TASK_MESSAGE_INPUT_CONTROL_OUTCOMES.includes(message.control.outcome)
+            || !Number.isFinite(Date.parse(message.control.observedAt)))
+            throw new Error("Global input disposition is invalid.");
+    }
+    if (message.inputControl !== undefined) {
+        if (!TASK_MESSAGE_INPUT_ACTIONS.includes(message.inputControl.action)) {
+            throw new Error(`Message input action is invalid: ${String(message.inputControl.action)}.`);
+        }
+        requireSafeIdentity(message.inputControl.requestId, "Message input requestId");
+        if (message.inputControl.expectedTarget !== undefined) {
+            requireText(message.inputControl.expectedTarget, "Message input expectedTarget");
+            if (message.inputControl.action !== "steer") {
+                throw new Error("Only a steer input binds an expectedTarget.");
+            }
+        }
+    }
+    if (message.delivery !== undefined) {
+        if (message.delivery.via !== "provider" && message.delivery.via !== "transport") {
+            throw new Error(`Global message delivery via is invalid: ${String(message.delivery.via)}.`);
+        }
+        if (typeof message.delivery.deliveredAt !== "string"
+            || Number.isNaN(Date.parse(message.delivery.deliveredAt))) {
+            throw new Error("Global message delivery deliveredAt is invalid.");
+        }
+        // Receipt evidence is shared by queue, explicit then and native steer.
+        if (message.inputControl === undefined && message.interruptThen === undefined) {
+            throw new Error("Only a durable Global input records Provider delivery.");
+        }
+    }
+    if (message.interruptThen !== undefined) {
+        requireSafeIdentity(message.interruptThen.requestId, "Global message interrupt requestId");
+        requireText(message.interruptThen.targetAttemptId, "Global message interrupt targetAttemptId");
+        requireText(message.interruptThen.targetNativeSessionId, "Global interrupt target Session");
+        requireText(message.interruptThen.targetAgentId, "Global interrupt target Agent");
+        requireText(message.interruptThen.targetAuthorityHolderId, "Global interrupt writer");
+        if (!Number.isSafeInteger(message.interruptThen.targetAuthorityEpoch)
+            || message.interruptThen.targetAuthorityEpoch < 1)
+            throw new Error("Global interrupt epoch is invalid.");
+        if (message.interruptThen.targetNativeTurnId !== undefined) {
+            requireText(message.interruptThen.targetNativeTurnId, "Global message interrupt targetNativeTurnId");
+        }
+        if (message.interruptThen.reusedInput !== undefined) {
+            if (!TASK_MESSAGE_INPUT_ACTIONS.includes(message.interruptThen.reusedInput.action)) {
+                throw new Error(`Reused input action is invalid: ${String(message.interruptThen.reusedInput.action)}.`);
+            }
+            requireSafeIdentity(message.interruptThen.reusedInput.requestId, "Reused input requestId");
+        }
+    }
+    if (message.notDelivered !== undefined) {
+        requireText(message.notDelivered.reason, "Global message nondelivery reason");
+        if (typeof message.notDelivered.at !== "string"
+            || Number.isNaN(Date.parse(message.notDelivered.at))) {
+            throw new Error("Global message nondelivery timestamp is invalid.");
+        }
+        // A delivered Message is a settled positive fact; a not-delivered fact is its
+        // visible negative twin. The two are mutually exclusive on one Message.
+        if (message.delivery !== undefined) {
+            throw new Error("A Global message cannot be both delivered and not-delivered.");
+        }
+        if (message.inputControl?.action !== "queue" && message.interruptThen === undefined) {
+            throw new Error("Only a queued or interrupt-then Global message records a nondelivery.");
+        }
+    }
+    if (typeof message.createdAt !== "string" || Number.isNaN(Date.parse(message.createdAt))) {
+        throw new Error("Message createdAt is invalid.");
+    }
+}
+/** A Global message local id is `global-message-<n>`; it carries no Task id. */
+export function validateGlobalRoleMessageId(localId) {
+    const normalized = requireSafeIdentity(localId, "Global message id");
+    if (!/^global-message-[1-9]\d*$/.test(normalized)) {
+        throw new Error(`Global message id is invalid: ${localId}.`);
+    }
+    return normalized;
+}
+/**
+ * Return a copy of a queued Global Message marked delivered at its next legal
+ * opportunity — the Role's own authorized Context read (decision-3 §9). Only a
+ * `queue` input may be consumed this way and only once: a Message that already
+ * carries a delivery is returned unchanged, so a repeated self-read is
+ * idempotent and never re-delivers. A steer/interrupt Message, which targets the
+ * exact current Turn rather than a queued next opportunity, is never delivered
+ * here.
+ */
+export function markGlobalRoleMessageDelivered(message, now, via = "provider") {
+    if (message.inputControl === undefined && message.interruptThen === undefined) {
+        throw new Error("Only a durable Global input is delivered by a Provider.");
+    }
+    if (message.delivery?.via === "provider" || message.delivery?.via === via)
+        return message;
+    const delivered = {
+        ...message,
+        ...(message.control === undefined ? {} : { control: {
+                ...message.control, outcome: via === "provider" ? "accepted" : "pending", observedAt: now.toISOString()
+            } }),
+        delivery: { deliveredAt: now.toISOString(), via }
+    };
+    validateGlobalRoleMessage(delivered);
+    return delivered;
+}
+/**
+ * Return a copy of an already-saved durable Global Message that claims the single
+ * interrupt-then continuation of an exact interrupted native Turn (decision-3
+ * §4). The original input identity, when the Message carried one, is preserved as
+ * `reusedInput` provenance rather than erased, so a replay of that requestId
+ * keeps resolving to this same Message and never creates a second input.
+ */
+export function claimGlobalRoleMessageInterruptThen(message, claim) {
+    const { inputControl, notDelivered: _priorNondelivery, ...rest } = message;
+    const claimed = {
+        ...rest,
+        interruptThen: {
+            requestId: requireSafeIdentity(claim.requestId, "Global message interrupt requestId"),
+            targetAttemptId: requireText(claim.targetAttemptId, "Global message interrupt targetAttemptId"),
+            targetNativeSessionId: claim.targetNativeSessionId,
+            targetAgentId: claim.targetAgentId,
+            targetAuthorityEpoch: claim.targetAuthorityEpoch,
+            targetAuthorityHolderId: claim.targetAuthorityHolderId,
+            ...(claim.targetNativeTurnId === undefined
+                ? {}
+                : { targetNativeTurnId: requireText(claim.targetNativeTurnId, "Global message interrupt targetNativeTurnId") }),
+            ...(inputControl === undefined ? {} : { reusedInput: inputControl })
+        }
+    };
+    validateGlobalRoleMessage(claimed);
+    return claimed;
+}
+/**
+ * Return a copy of a durable Global Message marked visibly not-delivered
+ * (decision-3 §5/§10), the Global twin of the Task {@link markNotDelivered}. An
+ * ordinary queue entry or a claimed interrupt-then handoff whose target can never
+ * prove a safe boundary fails here and stops holding the Role's pending set,
+ * rather than silently wedging it. It is idempotent for the same reason — a
+ * Message already carrying this exact reason is returned unchanged — and a
+ * delivered Message is never overwritten with a nondelivery.
+ */
+export function markGlobalRoleMessageNotDelivered(message, reason, now) {
+    if (message.delivery !== undefined) {
+        throw new Error("A delivered Global message cannot be marked not-delivered.");
+    }
+    if (message.notDelivered?.reason === reason)
+        return message;
+    const marked = {
+        ...message,
+        notDelivered: { reason: requireText(reason, "Global message nondelivery reason"), at: now.toISOString() }
+    };
+    validateGlobalRoleMessage(marked);
+    return marked;
+}
+function validateGlobalKindAndAuthor(kind, author) {
+    if (!GLOBAL_ROLE_MESSAGE_KINDS.includes(kind)) {
+        throw new Error(`Global message kind is invalid: ${String(kind)}.`);
+    }
+    if (author?.type !== kind) {
+        throw new Error(`Global message kind ${kind} requires a ${kind} author.`);
+    }
+}
 function validateKindAndAuthor(kind, author) {
     if (!TASK_MESSAGE_KINDS.includes(kind))
         throw new Error(`Message kind is invalid: ${String(kind)}.`);

package/dist/message/messageContinuation.js

@@ -8,6 +8,7 @@ import { createTaskEvent } from "../event/taskEvent.js";
 import { validateExactRunReviewRound } from "../lifecycle/exactRunTerminalization.js";
 import { sourceRunContextValue } from "../context/sourceRunContext.js";
 import { requireManagedTaskCaller } from "../runtime/managedCaller.js";
+import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
 export function resolveMessageRecipient(store, taskId, roleName, scope) {
     if (scope.reviewRoundId !== undefined) {
         const round = store.getReviewRound(taskId, scope.reviewRoundId);
@@ -95,12 +96,104 @@ export function messageContinuationBlocker(store, message) {
     }
     return undefined;
 }
+/**
+ * The one gate that decides when a claimed interrupt-then handoff may be
+ * delivered (decision-3 §4). It is keyed on the exact interrupted native Turn —
+ * not on the recipient's owner Assignment and not on a Run's business status —
+ * so the terminal proof is about the Turn that was actually cancelled:
+ * - `ready`   — the native Turn stopped and its cancel outcome is knowable; the
+ *               handoff may deliver.
+ * - `waiting` — the native Turn is still in flight; hold silently until it stops.
+ * - `unknown` — the cancel outcome is unprovable (delivery-unknown); the handoff
+ *               is never released or replayed across that boundary.
+ * - `missing` — the target can never prove its terminal.
+ * A plain queued Message (no claim) is always `ready` here; its own delivery
+ * gates live in messageContinuationBlocker.
+ *
+ * The proof is composite by necessity (message-5 gap C). Native execution
+ * termination is read from the live ProviderTurn, re-verified by attemptId,
+ * because a Run's business status can flip to failed while its native Turn is
+ * still running — the old AgentRun-only gate could release across a Turn that had
+ * not actually stopped. When the live binding no longer holds that exact Turn, the
+ * proof falls back to the durable native terminal observation keyed by the target
+ * attemptId — never to the AgentRun's business status and never to a replacement
+ * Turn's existence, both of which can be true while the target's native execution
+ * has not stopped (decision-3 §4/§8, "requested != stopped"). The cancel's
+ * *outcome* (clean vs delivery-unknown) lives on the owning AgentRun's
+ * failureReason when a Run owns the Turn, because a settled ProviderTurn — or a
+ * durable native terminal — preserves only completed/failed/cancelled and cannot
+ * itself carry delivery-unknown.
+ */
+export function interruptThenTerminalState(store, message) {
+    const claim = message.interruptThen;
+    if (claim === undefined)
+        return "ready";
+    const roleName = claim.targetRoleName;
+    const sessions = store.getTaskRoleSessionSet(message.taskId, roleName);
+    const session = sessions?.sessions[sessions.activeAgentId];
+    const binding = sessions?.providerBinding;
+    if (session?.status !== "active" || session.nativeSessionId !== claim.targetNativeSessionId
+        || session.agentId !== claim.targetAgentId || session.adapterId !== claim.targetAdapterId
+        || binding?.authority.owner !== "controller"
+        || binding.authority.epoch !== claim.targetAuthorityEpoch
+        || binding.authority.holderId !== claim.targetAuthorityHolderId)
+        return "missing";
+    const turn = binding.run;
+    const owner = claim.targetRunId === undefined ? null : store.getRun(message.taskId, claim.targetRunId);
+    if (claim.targetRunId !== undefined && owner === null)
+        return "missing";
+    // Primary proof: the exact interrupted native Turn, identity re-verified by
+    // attemptId. While it is still present — in flight (submitting/accepted) or its
+    // own acceptance unproven (delivery-unknown) — the native execution has not
+    // stopped, so the handoff waits no matter what the Run's status claims.
+    if (turn !== null && turn.attemptId === claim.targetAttemptId) {
+        if (["submitting", "accepted", "delivery-unknown"].includes(turn.status))
+            return "waiting";
+        // The native Turn stopped. Its cancel outcome may still be unprovable; that
+        // is recorded on the owning AgentRun, never on the settled ProviderTurn.
+        return ["completed", "failed", "cancelled"].includes(turn.status)
+            && owner?.result?.failureReason !== "delivery-unknown" ? "ready" : "unknown";
+    }
+    // The live binding no longer holds the target native Turn — a later Turn
+    // occupies it, or the binding's run pointer is gone. decision-3 §4/§8: a
+    // replacement Turn's mere existence is NOT proof the target's native execution
+    // stopped ("requested != stopped"; native quiescence is never inferred from a
+    // new Turn's existence, and never from the owning AgentRun's business status).
+    // The only protocol-proven stop is the durable, immutable native terminal
+    // observation keyed by the exact target attemptId, written when the Provider
+    // Host observed the Turn actually terminate.
+    const nativeStopped = store.listEvents(message.taskId)
+        .map(runtimeObservationFromTaskEvent)
+        .some((observation) => observation !== null
+        && (observation.kind === "turn.completed" || observation.kind === "turn.failed"
+            || observation.kind === "turn.cancelled")
+        && observation.fence.roleName === roleName
+        && observation.fence.nativeSessionId === claim.targetNativeSessionId
+        && (claim.targetNativeTurnId === undefined || observation.fence.nativeTurnId === claim.targetNativeTurnId)
+        && observation.fence.receiptId === claim.targetAttemptId);
+    if (nativeStopped) {
+        // Proven stopped. Its cancel outcome (clean vs delivery-unknown) is recorded on
+        // the owning AgentRun, never on the settled native terminal itself — the same
+        // composite the primary path reads once native termination is proven.
+        return owner?.result?.failureReason === "delivery-unknown" ? "unknown" : "ready";
+    }
+    // No durable proof the target native Turn stopped. Hold silently while an owning
+    // Run could still produce that terminal; a later business-terminal or a
+    // replacement Turn must never release it. With nothing owning the Turn and no
+    // durable terminal, its stop is unobservable and the claim can never prove a
+    // safe boundary — never released or replayed either way.
+    return owner !== null ? "waiting" : "missing";
+}
 /** Called in the Controller's ordinary reconciliation transaction. Messages
  * remain the pending authority; Mailbox is only the existing scheduling hint.
  * Reserving inputs and creating the next Run is one atomic effect. */
 export function prepareMessageContinuations(store, taskId, now, roleName) {
     const pending = store.listMessages(taskId).filter((message) => message.recipient?.roleName === roleName && message.recipient.ownerRunId !== undefined
-        && message.continuation?.runId === undefined);
+        && message.continuation?.runId === undefined
+        // A steer targets the exact current native turn, never a queued next Run.
+        // If its live attempt did not submit, the message stays saved for the
+        // Leader to re-choose (§1/§8); Core never silently turns it into a queue.
+        && message.inputControl?.action !== "steer");
     for (const message of pending) {
         const recipient = message.recipient;
         const blocker = messageContinuationBlocker(store, message);
@@ -138,8 +231,38 @@ export function prepareMessageContinuations(store, taskId, now, roleName) {
                 ? "owner-session-unobserved" : "owner-session-changed");
             continue;
         }
-        const batch = pending.filter((entry) => isDeepStrictEqual(entry.recipient, recipient)
-            && messageContinuationBlocker(store, entry) === undefined).slice(0, 16);
+        // decision-3 §4 ordering. Split this recipient's deliverable Messages into
+        // the explicit interrupt-then handoffs and the ordinary queue. A handoff is
+        // released only after its exact interrupted AgentRun reaches a proven
+        // terminal, and the ordinary queue must never preempt a live handoff.
+        const recipientPending = pending.filter((entry) => isDeepStrictEqual(entry.recipient, recipient)
+            && messageContinuationBlocker(store, entry) === undefined);
+        const thenClaims = recipientPending.filter((entry) => entry.interruptThen !== undefined);
+        let handoffWaiting = false;
+        const readyThen = [];
+        for (const claim of thenClaims) {
+            const state = interruptThenTerminalState(store, claim);
+            if (state === "ready")
+                readyThen.push(claim);
+            else if (state === "waiting")
+                handoffWaiting = true;
+            // A claim whose target can never prove its terminal fails visibly and
+            // stops holding the queue; it is never released or replayed.
+            else
+                markNotDelivered(store, claim, state === "unknown"
+                    ? "interrupt-then-target-delivery-unknown" : "interrupt-then-target-missing");
+        }
+        // Hold the entire recipient — including the ordinary queue — while any
+        // handoff still awaits its interrupted Turn's proven terminal.
+        if (handoffWaiting)
+            continue;
+        // A ready handoff delivers in its own round ahead of the ordinary queue, so
+        // the old queue only follows once the handoff has been delivered.
+        const batch = (readyThen.length > 0
+            ? readyThen
+            : recipientPending.filter((entry) => entry.interruptThen === undefined)).slice(0, 16);
+        if (batch.length === 0)
+            continue;
         const previous = store.listRuns(taskId).filter((run) => run.roleName === owner.roleName
             && run.workItemId === owner.workItemId && run.reviewRoundId === owner.reviewRoundId).at(-1);
         const baselineRef = previous.inputs[0]?.input.contextSnapshotRef;

package/dist/message/taskInterrupt.js

@@ -0,0 +1,34 @@
+import { createTaskEvent } from "../event/taskEvent.js";
+/** Interrupt attempts are execution evidence, not a second message queue. */
+export function findTaskInterrupt(store, taskId, requestId) {
+    return store.listEvents(taskId).find(event => event.type === "input.interrupt-requested" && event.payload.requestId === requestId);
+}
+export function reserveTaskInterrupt(store, taskId, requestId, fingerprint, target, thenMessageId, now) {
+    const receiptId = `interrupt:${taskId}/${requestId}`;
+    store.saveEvent(taskId, createTaskEvent(store.nextEventId(taskId), taskId, "input.interrupt-requested", {
+        requestId, receiptId, fingerprint, roleName: target.roleName,
+        nativeSessionId: target.nativeSessionId, attemptId: target.attemptId,
+        target: JSON.stringify(target),
+        ...(thenMessageId === undefined ? {} : { thenMessageId })
+    }, now));
+    return receiptId;
+}
+export function recordTaskInterruptResult(store, taskId, receiptId, receipt, now = new Date()) {
+    store.transaction(tx => {
+        const requested = tx.listEvents(taskId).find(event => event.type === "input.interrupt-requested" && event.payload.receiptId === receiptId);
+        if (requested === undefined)
+            throw new Error("Interrupt receipt has no original request.");
+        if (tx.listEvents(taskId).some(event => event.type === "input.interrupt-result" && event.payload.receiptId === receiptId))
+            return;
+        tx.saveEvent(taskId, createTaskEvent(tx.nextEventId(taskId), taskId, "input.interrupt-result", { receiptId, receipt: JSON.stringify(receipt) }, now));
+    });
+}
+export function taskInterruptReceipt(store, taskId, receiptId) {
+    const event = store.listEvents(taskId).find(entry => entry.type === "input.interrupt-result" && entry.payload.receiptId === receiptId);
+    return event === undefined ? { state: "interrupt-unknown", receiptId }
+        : JSON.parse(event.payload.receipt);
+}
+export function taskInterruptWasRejected(store, taskId, receiptId) {
+    const receipt = taskInterruptReceipt(store, taskId, receiptId);
+    return receipt.outcome === "rejected" && receipt.state === "interrupt-unavailable";
+}

package/dist/observability/orchestrationMetrics.js

@@ -135,7 +135,7 @@ function terminalWorkspaceCount(facts) {
     }).length;
 }
 function terminalStatus(status) {
-    return status !== undefined && !["pending", "running", "awaiting_acceptance", "blocked", "validating"].includes(status);
+    return status !== undefined && !["pending", "running", "awaiting_acceptance", "blocked", "conflicted", "validating"].includes(status);
 }
 function counts(values) {
     const result = {};

package/dist/release/releaseHandover.js

@@ -121,6 +121,28 @@ async function activateLocked(ports, locked) {
         };
     }
     void beginResult;
+    try {
+        ports.runPreflight(releaseDir, home);
+    }
+    catch (error) {
+        try {
+            await ports.call(home, "controller.rollback-handover", { handoverId });
+        }
+        catch (rollbackError) {
+            return {
+                outcome: "aborted", phase: "preflight",
+                message: `Host compatibility failed: ${messageOf(error)}; rollback failed: ${messageOf(rollbackError)}`,
+                action: "No candidate was started and the release pointer is unchanged. Preserve the fence and inspect the old Controller.",
+                recoverable: true
+            };
+        }
+        return {
+            outcome: "aborted", phase: "preflight",
+            message: `Fenced compatibility preflight failed: ${messageOf(error)}`,
+            action: "The old Controller is serving again; the active release and Home are unchanged.",
+            recoverable: true
+        };
+    }
     // 5) Start the candidate and wait for its identity read-back.
     ports.spawnCandidate(home, releaseDir, handoverId);
     const candidateReady = await waitForCandidateReady(ports, home, manifest, locked.candidateReadyTimeoutMs, locked.pollIntervalMs);