@zq-silk/yui 0.15.9 → 0.15.12

package/dist/controller/globalInputDelivery.js

@@ -0,0 +1,132 @@
+import { sendAgentHostRunControl, AGENT_HOST_CONTROL_PROTOCOL } from "../runtime/agentHost.js";
+import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
+import { hasRuntimeCleanupObligation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
+import { markGlobalRoleMessageNotDelivered } from "../message/message.js";
+import { providerRetryPending } from "../runtime/providerRetry.js";
+import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
+/** Messages are the only queue. Host's atomic begin arbitrates native writers. */
+export async function deliverGlobalInputs(home, store, ensure, onError) {
+    for (const role of store.listGlobalRoles()) {
+        try {
+            let pending = store.listGlobalRoleMessages(role.name).filter(message => message.delivery === undefined && message.notDelivered === undefined
+                && (message.inputControl?.action === "queue" || message.interruptThen !== undefined));
+            if (pending.length === 0 || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name }))))
+                continue;
+            let sessions = store.getGlobalRoleSessionSet(role.name);
+            if (sessions?.providerBinding?.retry !== undefined && !providerRetryPending(sessions.providerBinding)) {
+                store.transaction(tx => settleGlobalRetryInput(tx, role.name, tx.getGlobalRoleSessionSet(role.name)?.providerBinding, new Date()));
+                pending = store.listGlobalRoleMessages(role.name).filter(message => message.delivery === undefined && message.notDelivered === undefined
+                    && (message.inputControl?.action === "queue" || message.interruptThen !== undefined));
+                if (pending.length === 0)
+                    continue;
+            }
+            if (providerRetryPending(sessions?.providerBinding))
+                continue;
+            const current = sessions?.providerBinding?.run;
+            const obsolete = pending.filter(message => {
+                const claim = message.interruptThen;
+                return claim !== undefined && (sessions?.activeAgentId !== claim.targetAgentId
+                    || sessions.sessions[claim.targetAgentId]?.nativeSessionId !== claim.targetNativeSessionId
+                    || sessions.providerBinding?.authority.epoch !== claim.targetAuthorityEpoch
+                    || sessions.providerBinding.authority.holderId !== claim.targetAuthorityHolderId);
+            });
+            for (const message of obsolete)
+                store.updateGlobalRoleMessage(markGlobalRoleMessageNotDelivered(message, "native-session-or-authority-changed", new Date()));
+            pending = pending.filter(message => !obsolete.includes(message));
+            if (pending.length === 0)
+                continue;
+            if (current != null && ["submitting", "accepted", "delivery-unknown"].includes(current.status))
+                continue;
+            const claims = pending.filter(message => message.interruptThen !== undefined);
+            let next;
+            if (claims.length > 0) {
+                next = claims.find(message => {
+                    const claim = message.interruptThen;
+                    const binding = sessions?.providerBinding;
+                    return current?.attemptId === claim.targetAttemptId
+                        && ["completed", "failed", "cancelled"].includes(current.status)
+                        && sessions?.activeAgentId === claim.targetAgentId
+                        && sessions.sessions[claim.targetAgentId]?.nativeSessionId === claim.targetNativeSessionId
+                        && binding?.authority.owner === "controller"
+                        && binding.authority.epoch === claim.targetAuthorityEpoch
+                        && binding.authority.holderId === claim.targetAuthorityHolderId;
+                });
+                if (next === undefined)
+                    continue;
+            }
+            else
+                next = pending[0];
+            const attemptId = `global-input:${role.name}/${next.id}`;
+            if (current?.attemptId === attemptId)
+                continue;
+            if (next.control !== undefined && next.control.outcome !== "rejected")
+                continue;
+            const matchesTarget = () => next.deliveryTarget === undefined
+                || sessions?.activeAgentId === next.deliveryTarget.agentId
+                    && sessions.sessions[next.deliveryTarget.agentId]?.nativeSessionId === next.deliveryTarget.nativeSessionId;
+            if (!matchesTarget()) {
+                store.updateGlobalRoleMessage(markGlobalRoleMessageNotDelivered(next, "native-session-changed", new Date()));
+                continue;
+            }
+            await ensure(role.name);
+            sessions = store.getGlobalRoleSessionSet(role.name);
+            const binding = sessions?.providerBinding;
+            if (binding == null || binding.authority.owner !== "controller")
+                continue;
+            const nativeSessionId = currentProviderConversation(binding).conversationId;
+            const persisted = store.listGlobalRoleMessages(role.name).find(message => message.id === next.id);
+            if (persisted === undefined || JSON.stringify(persisted) !== JSON.stringify(next))
+                continue;
+            const claim = next.interruptThen;
+            if (!matchesTarget() || claim !== undefined
+                && (sessions?.activeAgentId !== claim.targetAgentId
+                    || nativeSessionId !== claim.targetNativeSessionId
+                    || binding.authority.epoch !== claim.targetAuthorityEpoch
+                    || binding.authority.holderId !== claim.targetAuthorityHolderId
+                    || binding.run?.attemptId !== claim.targetAttemptId
+                    || !["completed", "failed", "cancelled"].includes(binding.run.status))) {
+                store.updateGlobalRoleMessage(markGlobalRoleMessageNotDelivered(next, "native-session-changed", new Date()));
+                continue;
+            }
+            if (next.deliveryTarget === undefined) {
+                next = { ...next, deliveryTarget: { agentId: sessions.activeAgentId, nativeSessionId } };
+                store.updateGlobalRoleMessage(next);
+            }
+            const result = await sendAgentHostRunControl({
+                home, scope: "global", roleName: role.name,
+                control: {
+                    protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "submit-turn", nativeSessionId,
+                    authority: { epoch: binding.authority.epoch, owner: "controller",
+                        holderId: binding.authority.holderId },
+                    run: { attemptId, boundedText: [
+                            `Yui Global Message: role=${role.name} message=${next.id}.`,
+                            "Read your Session Context and the referenced Message in full, then act on its durable input."
+                        ].join("\n") }
+                }
+            });
+            if (result.outcome === "rejected") {
+                store.transaction(tx => {
+                    const latest = tx.listGlobalRoleMessages(role.name).find(message => message.id === next.id);
+                    if (latest === undefined || latest.delivery !== undefined || latest.notDelivered !== undefined)
+                        return;
+                    const turn = tx.getGlobalRoleSessionSet(role.name)?.providerBinding?.run;
+                    if (providerRetryPending(tx.getGlobalRoleSessionSet(role.name)?.providerBinding))
+                        return;
+                    // A later canonical acceptance wins over transport diagnostics.
+                    if (turn?.attemptId === attemptId && ["accepted", "completed", "failed", "cancelled"].includes(turn.status))
+                        return;
+                    const unknown = result.failure?.inputDisposition === "unknown" || result.snapshot.state === "delivery-unknown";
+                    const updated = { ...latest, control: {
+                            requestId: latest.inputControl?.requestId ?? latest.interruptThen.requestId,
+                            receiptId: attemptId, outcome: unknown ? "delivery-unknown" : "rejected",
+                            observedAt: new Date().toISOString()
+                        } };
+                    tx.updateGlobalRoleMessage(unknown ? updated : markGlobalRoleMessageNotDelivered(updated, result.failure?.detail ?? result.snapshot.detail ?? "provider-input-rejected", new Date()));
+                });
+            }
+        }
+        catch (error) {
+            onError(error);
+        }
+    }
+}

package/dist/controller/jobControl.js

@@ -253,10 +253,14 @@ function validateJobTarget(store, params) {
         if (attempt === null) {
             throw jobDomainError(`Integration Attempt not found: ${params.taskId}/${params.owner.integrationAttemptId}.`);
         }
-        if (attempt.status === "committed" || attempt.status === "failed") {
-            throw jobDomainError(`DurableJob owner Integration Attempt is terminal: `
+        if (attempt.status !== "running") {
+            throw jobDomainError(`DurableJob owner Integration Attempt must be running: `
                 + `${params.taskId}/${params.owner.integrationAttemptId} is ${attempt.status}.`);
         }
+        if (attempt.candidateCommit !== params.head || attempt.checkInputDigest === undefined
+            || attempt.checkInputDigest !== durableJobIdempotencyKey(params)) {
+            throw jobDomainError("Integration Job has no matching admitted candidate/check specification.");
+        }
     }
     const project = store.getProject(params.projectId);
     if (project === null) {

package/dist/controller/providerRetryAdmission.js

@@ -0,0 +1,100 @@
+import { admitProviderRetry, cancelProviderRetry, providerRetryAttemptId, providerRetryPending } from "../runtime/providerRetry.js";
+import { blockingProviderContinuations } from "../runtime/runtimeContinuationProjection.js";
+import { validateExactRunReviewRound } from "../lifecycle/exactRunTerminalization.js";
+import { isDeepStrictEqual } from "node:util";
+export function ownedProviderInput(input) {
+    if (input.runId !== undefined && input.taskId !== undefined) {
+        return { kind: "run", taskId: input.taskId, runId: input.runId };
+    }
+    const wake = /^notification:([^/]+)\/([^/]+)\//u.exec(input.attemptId);
+    if (wake !== null && wake[1] === input.taskId) {
+        return { kind: "wake", taskId: wake[1], wakeId: wake[2] };
+    }
+    const message = /^global-input:([^/]+)\/([^/]+)$/u.exec(input.attemptId);
+    if (message !== null && message[1] === input.roleName && input.taskId === undefined) {
+        return { kind: "message", roleName: input.roleName, messageId: message[2] };
+    }
+    return input.boundedText === undefined ? undefined : { kind: "text", text: input.boundedText };
+}
+export function retryIntentBlocker(store, input, retry) {
+    if (input.taskId === undefined) {
+        const role = store.getGlobalRole(input.roleName);
+        const sessions = store.getGlobalRoleSessionSet(input.roleName);
+        if (role === null || sessions?.activeAgentId !== role.activeAgentId)
+            return "role-changed";
+        if (sessions.sessions[sessions.activeAgentId]?.effective.sourceDesiredRevision !== role.launchRevision)
+            return "role-configuration-changed";
+        if (store.listGlobalRoleMessages(input.roleName).some(message => Date.parse(message.createdAt) > Date.parse(retry.intentAt)
+            && message.delivery === undefined && message.notDelivered === undefined))
+            return "new-user-input";
+        return undefined;
+    }
+    const task = store.getTask(input.taskId);
+    if (task === null || !["active", "draft"].includes(task.status)
+        || task.executionGate.state !== "enabled")
+        return "task-execution-stopped";
+    const role = store.getRole(input.taskId, input.roleName);
+    const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+    if (role === null || sessions?.activeAgentId !== role.activeAgentId)
+        return "role-changed";
+    if (sessions.sessions[sessions.activeAgentId]?.effective.sourceDesiredRevision !== role.launchRevision)
+        return "role-configuration-changed";
+    if (store.listMessages(input.taskId).some(message => (message.kind === "operator" || message.kind === "user")
+        && Date.parse(message.createdAt) > Date.parse(retry.intentAt)))
+        return "new-user-input";
+    if (blockingProviderContinuations(store.listEvents(input.taskId)).some(c => c.roleName === input.roleName && c.identity.conversationId === retry.nativeSessionId)) {
+        return "background-work-unsettled";
+    }
+    return undefined;
+}
+/** Shared by automatic recovery and every ordinary Host submit. The native
+ * writer CAS remains the only grant; a scheduled successor is not a grant. */
+export function admitOwnedProviderInput(store, binding, input) {
+    const retry = binding.retry;
+    const sameReviewSuccessor = retry?.successorReviewRoundId !== undefined && input.taskId !== undefined && input.runId !== undefined
+        && store.getRun(input.taskId, input.runId)?.reviewRoundId === retry.successorReviewRoundId;
+    if (retry !== undefined && !providerRetryPending(binding)
+        && (input.attemptId.startsWith("provider-retry:") || input.runId !== undefined && input.runId === retry.successorRunId
+            || sameReviewSuccessor)) {
+        throw new Error(`Provider retry is ${retry.status}; this scheduled successor cannot regain admission.`);
+    }
+    if (!providerRetryPending(binding) || retry === undefined)
+        return binding;
+    const automatic = input.attemptId === providerRetryAttemptId(retry)
+        || input.runId !== undefined && input.runId === retry.successorRunId
+        || input.runId !== undefined && input.taskId !== undefined && retry.successorReviewRoundId !== undefined
+            && store.getRun(input.taskId, input.runId)?.reviewRoundId === retry.successorReviewRoundId
+        || retry.status === "in-flight" && input.attemptId === retry.currentAttemptId;
+    if (!automatic)
+        return cancelProviderRetry(binding, "superseded-by-explicit-input", input.now.getTime());
+    const blocker = retryIntentBlocker(store, input, retry);
+    if (blocker !== undefined)
+        throw new Error(`Provider retry admission stopped: ${blocker}.`);
+    if (input.retrySupported !== true)
+        throw new Error("This Host cannot prove safe same-Session recovery; use explicit recovery.");
+    if (binding.goal?.status === "active")
+        throw new Error("Provider still owns an autonomous Goal; inspect its exact continuation.");
+    if (input.taskId !== undefined && input.runId !== undefined) {
+        const run = store.getRun(input.taskId, input.runId);
+        const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+        if (run === null || run.status !== "active"
+            || !isDeepStrictEqual(run.effective, sessions?.sessions[input.agentId]?.effective)) {
+            throw new Error("Retry execution no longer matches its fixed native Session.");
+        }
+        if (run.workspace !== undefined && !isDeepStrictEqual(store.getManagedWorkspace(run.workspace.owner), run.workspace)) {
+            throw new Error("Retry workspace authority changed.");
+        }
+        if (run.workItemId !== undefined) {
+            const item = store.getWorkItem(input.taskId, run.workItemId);
+            if (item?.status !== "open" || run.purpose !== "review" && run.executionLaneId === undefined
+                && item.assignee !== run.roleName)
+                throw new Error("Retry WorkItem responsibility changed.");
+        }
+        if (validateExactRunReviewRound(store, run).disposition !== "applied") {
+            throw new Error("Retry Review no longer matches its exact Round and frozen candidate.");
+        }
+    }
+    const admitted = admitProviderRetry(binding, { attemptId: input.attemptId, at: input.now.getTime() });
+    return input.runId === undefined ? admitted
+        : { ...admitted, retry: { ...admitted.retry, successorRunId: input.runId } };
+}

package/dist/controller/providerRetryDelivery.js

@@ -0,0 +1,218 @@
+import { performance } from "node:perf_hooks";
+import { runTaskCommand } from "../commands/taskCommands.js";
+import { retryIntentBlocker } from "./providerRetryAdmission.js";
+import { cancelProviderRetry, providerRetryAttemptId, providerRetryPending } from "../runtime/providerRetry.js";
+import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
+import { runtimeLifecycleTarget, hasRuntimeCleanupObligation } from "../runtime/lifecycleReservation.js";
+import { sendAgentHostRunControl, inspectAgentHostSocket, agentHostControlSocketPath, AGENT_HOST_CONTROL_PROTOCOL } from "../runtime/agentHost.js";
+import { redactAgentErrorText } from "../runtime/agentError.js";
+import { createTaskEvent } from "../event/taskEvent.js";
+import { enqueueWork } from "../coordination/workMailboxQueue.js";
+import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
+/** Hooks in the existing Controller pass and nearest-deadline timer. SQLite's
+ * current Provider input is the only pending intent; nothing is queued here. */
+export function createProviderRetryHooks(home, store, ports = {}) {
+    const anchors = new Map();
+    const inspectedUnknown = new Set();
+    const inspect = ports.inspect ?? ((target) => inspectAgentHostSocket(agentHostControlSocketPath(target), 250));
+    const now = (retry) => {
+        const wall = (ports.now ?? (() => new Date()))().getTime();
+        const monotonic = (ports.monotonicNow ?? (() => performance.now()))();
+        let anchor = anchors.get(retry.chainId);
+        if (anchor === undefined) {
+            anchor = { wall: Math.max(wall, Date.parse(retry.updatedAt)), monotonic };
+            anchors.set(retry.chainId, anchor);
+        }
+        return Math.max(wall, anchor.wall + Math.max(0, monotonic - anchor.monotonic));
+    };
+    const load = (owner) => owner.scope === "task"
+        ? store.getTaskRoleSessionSet(owner.taskId, owner.roleName) : store.getGlobalRoleSessionSet(owner.roleName);
+    const save = (set) => {
+        if (set.owner.scope === "task")
+            store.saveTaskRoleSessionSet(set);
+        else
+            store.saveGlobalRoleSessionSet(set);
+    };
+    const stop = (set, reason, at, exhausted = false) => {
+        store.transaction(() => {
+            const current = load(set.owner);
+            if (current === null || current.providerBinding?.retry?.chainId !== set.providerBinding?.retry?.chainId)
+                return;
+            const binding = current.providerBinding;
+            if (!providerRetryPending(binding))
+                return;
+            const cancelled = cancelProviderRetry(binding, reason, at);
+            save({ ...current, providerBinding: exhausted
+                    ? { ...cancelled, retry: { ...cancelled.retry, status: "exhausted" } } : cancelled });
+            const owner = set.owner;
+            if (owner.scope === "global")
+                settleGlobalRetryInput(store, owner.roleName, load(owner)?.providerBinding, new Date(at));
+            if (owner.scope === "task") {
+                const event = createTaskEvent(store.nextEventId(owner.taskId), owner.taskId, "provider.retry-stopped", {
+                    roleName: owner.roleName, chainId: binding.retry.chainId, reason
+                }, new Date(at));
+                store.saveEvent(owner.taskId, event);
+                enqueueWork(store, owner.roleName === "leader" ? { kind: "operator" }
+                    : { kind: "role", taskId: owner.taskId, roleName: "leader" }, "provider-retry-needs-attention", new Date(at), [{ type: "event", taskId: owner.taskId, id: event.id }]);
+            }
+        });
+    };
+    const key = (set) => set.owner.scope === "task"
+        ? `role:${encodeURIComponent(set.owner.taskId)}/${encodeURIComponent(set.owner.roleName)}`
+        : `global-role:${encodeURIComponent(set.owner.roleName)}`;
+    return {
+        deadlines() {
+            return store.listProviderRetrySessions().flatMap(set => {
+                const retry = set.providerBinding.retry;
+                if (retry.status !== "waiting")
+                    return [];
+                // Busy or already-queued work awaits the next ordinary pass without a
+                // zero-delay timer loop. Waiting never consumes an execution attempt.
+                const wall = (ports.now ?? (() => new Date()))().getTime();
+                const effective = now(retry);
+                return [{ key: key(set), at: wall + Math.max(250, (retry.successorAutomatic === false ? Date.parse(retry.nextEligibleAt)
+                            : Math.min(Date.parse(retry.nextEligibleAt), Date.parse(retry.deadline))) - effective) }];
+            });
+        },
+        async reconcile() {
+            const current = store.listProviderRetrySessions();
+            const activeChains = new Set(current.map(set => set.providerBinding.retry.chainId));
+            for (const id of anchors.keys())
+                if (!activeChains.has(id))
+                    anchors.delete(id);
+            const pendingAttempts = new Set(current.map(set => set.providerBinding.retry.currentAttemptId));
+            for (const id of inspectedUnknown)
+                if (!pendingAttempts.has(id))
+                    inspectedUnknown.delete(id);
+            for (const set of current) {
+                const owner = set.owner;
+                const binding = set.providerBinding;
+                const retry = binding.retry;
+                const at = now(retry);
+                const scoped = { ...(owner.scope === "task" ? { taskId: owner.taskId } : {}), roleName: owner.roleName };
+                const session = set.sessions[set.activeAgentId];
+                const blocker = retryIntentBlocker(store, scoped, retry);
+                if (blocker !== undefined && blocker !== "background-work-unsettled") {
+                    stop(set, blocker, at);
+                    continue;
+                }
+                if (binding.retryDisabled && retry.successorAutomatic !== false || binding.authority.owner !== "controller"
+                    || binding.authority.epoch !== retry.authorityEpoch
+                    || currentProviderConversation(binding).conversationId !== retry.nativeSessionId
+                    || session?.status !== "active" || session.nativeSessionId !== retry.nativeSessionId
+                    || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget(owner)))) {
+                    stop(set, "session-or-authority-changed", at);
+                    continue;
+                }
+                // Never replay an admitted attempt. Existing exact runtime queries and
+                // terminal ingress resolve it, even across Controller restart.
+                if (retry.status === "in-flight") {
+                    if (binding.run?.status === "delivery-unknown" && retry.currentAttemptId !== undefined
+                        && !inspectedUnknown.has(retry.currentAttemptId)) {
+                        inspectedUnknown.add(retry.currentAttemptId);
+                        let detail;
+                        try {
+                            const host = await inspect({ home, ...scoped, scope: owner.scope });
+                            detail = host.nativeSessionId === retry.nativeSessionId && host.attemptId === retry.currentAttemptId
+                                ? `Exact Host query: ${host.state}; awaiting original canonical Provider evidence.`
+                                : "Host query did not prove the original Session/input identity; no replay.";
+                        }
+                        catch (error) {
+                            detail = `Original Host query unavailable; no replay: ${redactAgentErrorText(error instanceof Error ? error.message : String(error))}`;
+                        }
+                        store.transaction(() => {
+                            const latest = load(owner);
+                            if (latest === null || latest.providerBinding == null || latest.providerBinding.run === null
+                                || latest.providerBinding.run.attemptId !== retry.currentAttemptId
+                                || latest.providerBinding.run.status !== "delivery-unknown")
+                                return;
+                            save({ ...latest, providerBinding: { ...latest.providerBinding,
+                                    retry: { ...latest.providerBinding.retry, reason: detail } } });
+                            if (owner.scope === "task") {
+                                const event = createTaskEvent(store.nextEventId(owner.taskId), owner.taskId, "provider.retry-unconfirmed", {
+                                    roleName: owner.roleName, attemptId: retry.currentAttemptId, nativeSessionId: retry.nativeSessionId, detail
+                                }, new Date(at));
+                                store.saveEvent(owner.taskId, event);
+                                enqueueWork(store, owner.roleName === "leader" ? { kind: "operator" }
+                                    : { kind: "role", taskId: owner.taskId, roleName: "leader" }, "provider-retry-needs-attention", new Date(at), [{ type: "event", taskId: owner.taskId, id: event.id }]);
+                            }
+                        });
+                    }
+                    continue;
+                }
+                if (retry.successorAutomatic !== false && at >= Date.parse(retry.deadline)) {
+                    stop(set, "deadline-exhausted", at, true);
+                    continue;
+                }
+                if (at < Date.parse(retry.nextEligibleAt) || blocker !== undefined || binding.goal?.status === "active")
+                    continue;
+                if (binding.run?.attemptId !== retry.failedAttemptId) {
+                    stop(set, "superseded-input", at);
+                    continue;
+                }
+                try {
+                    if (owner.scope === "task" && retry.previousRunId !== undefined) {
+                        if (retry.successorRunId !== undefined || retry.successorReviewRoundId !== undefined)
+                            continue;
+                        const previous = store.getRun(owner.taskId, retry.previousRunId);
+                        if (previous?.status === "active")
+                            continue; // ordinary rejected-delivery terminal fold
+                        if (previous?.status !== "failed") {
+                            stop(set, "run-no-longer-failed", at);
+                            continue;
+                        }
+                        const actualTaskReviewCandidate = await ports.snapshotTaskCandidate?.(previous);
+                        store.transaction(() => {
+                            const latest = load(owner)?.providerBinding?.retry;
+                            if (latest?.chainId !== retry.chainId || latest.failedAttemptId !== retry.failedAttemptId
+                                || latest.status !== "waiting")
+                                return;
+                            const reason = retryIntentBlocker(store, scoped, latest);
+                            if (reason !== undefined)
+                                throw new Error(reason);
+                            runTaskCommand(["run", "retry", `${owner.taskId}/${previous.id}`], store, {
+                                now: () => new Date(at), environment: {}, providerRetryChainId: retry.chainId,
+                                ...(actualTaskReviewCandidate === undefined ? {} : { actualTaskReviewCandidate })
+                            });
+                        });
+                    }
+                    else {
+                        const original = retry.input.kind === "text" ? retry.input.text
+                            : retry.input.kind === "wake"
+                                ? `Yui Task notification: task=${retry.input.taskId} wake=${retry.input.wakeId}.\nRead current Task context and that fixed wake window, including original Messages in full. This is not an execution assignment.`
+                                : retry.input.kind === "message"
+                                    ? `Yui Global Message: role=${retry.input.roleName} message=${retry.input.messageId}.\nRead your Session Context and referenced original Message in full.`
+                                    : undefined;
+                        if (original === undefined) {
+                            stop(set, "original-input-unavailable", at);
+                            continue;
+                        }
+                        const result = await (ports.submit ?? sendAgentHostRunControl)({
+                            home, ...scoped, scope: owner.scope,
+                            control: {
+                                protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "submit-turn", nativeSessionId: retry.nativeSessionId,
+                                authority: { epoch: binding.authority.epoch, owner: "controller", holderId: binding.authority.holderId },
+                                run: { attemptId: providerRetryAttemptId(retry), boundedText: original }
+                            }
+                        });
+                        // Durable settlement belongs to Host/Controller ingress. In
+                        // particular a lost response is never a reason to replay.
+                        if (result.outcome === "rejected" && result.failure?.registrationDisposition === "not-committed"
+                            && result.failure.errorName !== "ProviderTurnBusyError") {
+                            stop(set, result.failure.detail, at);
+                        }
+                    }
+                }
+                catch (error) {
+                    // A send failure may have applied. A durable submitting/unknown
+                    // identity fences it; do not manufacture a successor to uncertainty.
+                    const latest = load(owner);
+                    if (latest?.providerBinding?.run?.attemptId === retry.failedAttemptId) {
+                        stop(set, error instanceof Error ? error.message : String(error), at);
+                    }
+                    ports.onError?.(error);
+                }
+            }
+        }
+    };
+}

package/dist/controller/resourceInventory.js

@@ -1,4 +1,11 @@
 import { resolve } from "node:path";
+/** Archiving may retain execution; a Task lifecycle label is not exit proof. */
+export function runtimeRoleProtectsDomain(role) {
+    return (role.ownerKind === "task-role"
+        && (role.taskStatus === "active" || role.taskStatus === "archived"))
+        // Global Roles have no Task lifecycle; require a current native Session.
+        || (role.ownerKind === "global-role" && role.nativeSessionId !== undefined);
+}
 export function createRuntimeResourceActivityTracker() {
     const previous = new Map();
     return (identity, resource) => {
@@ -112,8 +119,7 @@ export function buildControllerResourceInventory(facts) {
             for (const process of paneProcesses)
                 claimed.add(process.pid);
             const role = findRole(homeFact.roles, pane);
-            const terminalIsolation = (role?.taskStatus === "cancelled" && role.taskRetirementIsolated === true)
-                || role?.taskStatus === "archived";
+            const terminalIsolation = role?.taskStatus === "cancelled" && role.taskRetirementIsolated === true;
             resources.push(processResource({
                 kind: "agent-session",
                 state: pane.dead ? "dead" : role === undefined ? "orphaned" : "running",
@@ -122,7 +128,8 @@ export function buildControllerResourceInventory(facts) {
                     : terminalIsolation ? "safe" : "protected",
                 reasonCode: role === undefined
                     ? pane.dead ? "dead-orphan-pane" : "orphan-pane"
-                    : terminalIsolation ? (role.taskStatus === "cancelled" ? "retired-task-pane" : "archived-task-pane") : "owned-role-pane",
+                    : terminalIsolation ? "retired-task-pane"
+                        : role.taskStatus === "archived" ? "archived-task-pane" : "owned-role-pane",
                 yuiHome,
                 owner: role === undefined ? { kind: "none" } : roleOwner(role),
                 processes: paneProcesses,
@@ -358,7 +365,10 @@ function artifactResource(artifact, yuiHome, domain, homeId) {
     };
 }
 function domainDisposition(base, reason, domain, target) {
-    if (reason === "retired-task-pane" || reason === "archived-task-pane") {
+    // Even an expired test domain cannot authorize deleting retained execution.
+    if (reason === "archived-task-pane")
+        return "protected";
+    if (reason === "retired-task-pane") {
         return "safe";
     }
     if (domain === undefined)

package/dist/controller/resourceInventoryLinux.js

@@ -11,7 +11,7 @@ import { readControllerDiscovery } from "../core/controllerClient.js";
 import { CONTROLLER_DISCOVERY_PATH } from "../core/protocol.js";
 import { controllerSocketPath } from "../core/controllerEndpoint.js";
 import { readHomeFilesystemId } from "../core/homeFilesystemIdentity.js";
-import { buildControllerResourceInventory } from "./resourceInventory.js";
+import { buildControllerResourceInventory, runtimeRoleProtectsDomain } from "./resourceInventory.js";
 import { CONTROLLER_DOMAIN_PATH, EPHEMERAL_DOMAIN_GRACE_MS, ephemeralDomainFingerprint, readEphemeralDomainIdentity, readLinuxProcessStartIdentity } from "./domainIdentity.js";
 const LINUX_PROCESS_SCAN_BATCH_SIZE = 64;
 export const INVENTORY_EVENT_LOOP_RUN_BUDGET_MS = 25;
@@ -518,11 +518,7 @@ function inspectRuntimeDomain(home, processes, roles, storageStatus, now) {
             graceMs: EPHEMERAL_DOMAIN_GRACE_MS
         };
     }
-    const activeRole = roles.some((role) => ((role.ownerKind === "task-role" && role.taskStatus === "active")
-        // Global Roles have no Task status. Only a live native Session is a
-        // durable liveness fact for that scope; stopped/broken history must not
-        // protect an expired disposable domain merely because it has an ID.
-        || (role.ownerKind === "global-role" && role.nativeSessionId !== undefined)));
+    const activeRole = roles.some(runtimeRoleProtectsDomain);
     if (!storageSafe) {
         return {
             kind: "ephemeral-test",