@zq-silk/yui 0.16.0 → 0.16.2

package/dist/cli/updateOrchestrator.js

@@ -6,10 +6,11 @@
  * then activated, any required storage migration is applied, and the result is
  * verified before the Controller is restarted.
  */
+import { UpdateControllerReconciliationError } from "../controller/updateReconciliation.js";
 export function runUpdate(ports, options) {
     let staged;
     try {
-        staged = ports.stage();
+        staged = ports.stage(options.version);
     }
     catch (error) {
         return {
@@ -33,7 +34,9 @@ export function runUpdate(ports, options) {
             cleanupWarning = `Staging cleanup could not be completed: ${messageOf(error)}`;
         }
     }
-    return cleanupWarning === undefined ? result : { ...result, cleanupWarning };
+    return cleanupWarning === undefined ? result : {
+        ...result, cleanupWarning: [result.cleanupWarning, cleanupWarning].filter(Boolean).join(" ")
+    };
 }
 function runStagedUpdate(ports, staged, home) {
     let preflight;
@@ -97,38 +100,70 @@ function runStagedUpdate(ports, staged, home) {
             version: staged.version
         };
     }
+    let result;
+    let cleanupWarning;
     try {
-        const captured = captureControllerLifecycle(ports, staged.version, home);
-        if ("outcome" in captured)
-            return captured;
-        // An older Controller can finish a launch between preflight and drain.
-        // Recheck after its exact stop, before changing the install or storage.
-        let fencedPreflight;
+        result = reconcileAndUpdate(ports, staged, home);
+    }
+    finally {
         try {
-            fencedPreflight = ports.preflight(staged, home);
+            releaseHandover?.();
         }
         catch (error) {
-            return restoreControllerOrReport(ports, home, captured.lifecycle, {
-                outcome: "aborted", phase: "preflight",
-                message: `Quiesced compatibility preflight failed: ${messageOf(error)}`,
-                action: "The install and storage are unchanged; inspect the compatibility failure before retrying.",
-                recoverable: true, version: staged.version
-            });
+            cleanupWarning = `Controller handover lock release failed for ${home}: ${messageOf(error)}`;
         }
-        if (fencedPreflight.status === "blocked") {
-            return restoreControllerOrReport(ports, home, captured.lifecycle, {
-                outcome: "aborted", phase: "preflight",
-                message: fencedPreflight.message, action: fencedPreflight.action,
-                recoverable: true, version: staged.version,
-                ...(fencedPreflight.blockers === undefined ? {} : { blockers: fencedPreflight.blockers }),
-                ...(fencedPreflight.sceneUnchanged === true ? { sceneUnchanged: true } : {})
-            });
-        }
-        return activateAndVerify(ports, staged, home, captured.lifecycle, fencedPreflight);
     }
-    finally {
-        releaseHandover?.();
+    return cleanupWarning === undefined ? result : { ...result, cleanupWarning };
+}
+function reconcileAndUpdate(ports, staged, home) {
+    let reconciliation;
+    try {
+        reconciliation = ports.reconcileController?.(home);
+    }
+    catch (error) {
+        const evidence = error instanceof UpdateControllerReconciliationError ? error.result : undefined;
+        const unknown = evidence === undefined || evidence.observationError !== undefined
+            || evidence.lockReleaseError !== undefined || evidence.attempts.some(attempt => attempt.outcome === "unknown");
+        return {
+            outcome: "aborted", phase: "coordination", version: staged.version,
+            message: `Controller reconciliation failed: ${messageOf(error)}`,
+            action: "Inspect the reported current-Home targets and partial effects; binary activation was not attempted.",
+            recoverable: !unknown,
+            ...(evidence === undefined ? {} : { controllerReconciliation: evidence }),
+            ...(unknown ? { controllerOwnershipUnknown: true } : {})
+        };
     }
+    const coordinated = runCoordinatedUpdate(ports, staged, home);
+    return reconciliation === undefined ? coordinated : { ...coordinated, controllerReconciliation: reconciliation };
+}
+function runCoordinatedUpdate(ports, staged, home) {
+    const captured = captureControllerLifecycle(ports, staged.version, home);
+    if ("outcome" in captured)
+        return captured;
+    // Storage can change before the Controller drains. Recheck after its
+    // exact stop, before changing the install or storage. Its sceneUnchanged
+    // verdict does not describe the preceding runtime cleanup/stop/restore.
+    let fencedPreflight;
+    try {
+        fencedPreflight = ports.preflight(staged, home);
+    }
+    catch (error) {
+        return restoreControllerOrReport(ports, home, captured.lifecycle, {
+            outcome: "aborted", phase: "preflight",
+            message: `Quiesced storage preflight failed: ${messageOf(error)}`,
+            action: "The install and storage are unchanged; inspect the storage failure before retrying.",
+            recoverable: true, version: staged.version
+        });
+    }
+    if (fencedPreflight.status === "blocked") {
+        return restoreControllerOrReport(ports, home, captured.lifecycle, {
+            outcome: "aborted", phase: "preflight",
+            message: fencedPreflight.message, action: fencedPreflight.action,
+            recoverable: true, version: staged.version,
+            ...(fencedPreflight.blockers === undefined ? {} : { blockers: fencedPreflight.blockers })
+        });
+    }
+    return activateAndVerify(ports, staged, home, captured.lifecycle, fencedPreflight);
 }
 function activateAndVerify(ports, staged, home, lifecycle, preflight) {
     try {
@@ -256,7 +291,8 @@ function captureControllerLifecycle(ports, version, home) {
             phase: "preflight",
             message: `Controller status could not be verified: ${messageOf(error)}`,
             action: "Inspect Controller ownership and retry after its status is known.",
-            recoverable: true,
+            recoverable: false,
+            controllerOwnershipUnknown: true,
             version
         };
     }
@@ -279,7 +315,8 @@ function captureControllerLifecycle(ports, version, home) {
             phase: "preflight",
             message: `Controller stop/drain failed: ${messageOf(error)}`,
             action: "Inspect the captured Controller before retrying; binary activation was not attempted.",
-            recoverable: true,
+            recoverable: false,
+            controllerOwnershipUnknown: true,
             version
         };
     }
@@ -300,7 +337,8 @@ function malformedControllerResult(version, message) {
         phase: "preflight",
         message,
         action: "Refusing an unfenced Controller handoff; inspect ownership and retry.",
-        recoverable: true,
+        recoverable: false,
+        controllerOwnershipUnknown: true,
         version
     };
 }
@@ -309,14 +347,16 @@ function restoreControllerOrReport(ports, home, lifecycle, failure) {
         return failure;
     try {
         ports.restoreController(home, lifecycle.identity);
-        return failure;
+        return { ...failure, controllerRestore: { identity: lifecycle.identity, outcome: "restored" } };
     }
     catch (error) {
         return {
             ...failure,
             message: `${failure.message} Captured Controller restore failed: ${messageOf(error)}.`,
-            action: `${failure.action} Keep the Home quiesced and resolve the restore failure.`,
-            recoverable: false
+            action: `${failure.action} Controller liveness after the failed restore is unknown; inspect its exact identity before further action.`,
+            recoverable: false,
+            controllerOwnershipUnknown: true,
+            controllerRestore: { identity: lifecycle.identity, outcome: "unknown", error: messageOf(error) }
         };
     }
 }

package/dist/cli/updatePorts.js

@@ -34,6 +34,7 @@ import { STORAGE_DOCTOR_CHECK_NAMES } from "../doctor/doctor.js";
 import { acquireHandoverLock } from "../release/runtimeRelease.js";
 import { updateStagingRoot } from "../storage/homeLayout.js";
 import { resolveYuiHome } from "../storage/taskStore.js";
+import { UpdateControllerReconciliationError } from "../controller/updateReconciliation.js";
 const PACKAGE_NAME = "@zq-silk/yui";
 const PACKAGE_SPEC = `${PACKAGE_NAME}@latest`;
 function resolveExecutable(command, environmentPath) {
@@ -90,20 +91,20 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
         beginControllerHandover(home) {
             return acquireHandoverLock(home).release;
         },
-        stage(version) {
+        stage(requestedVersion) {
             // A caller that names a version (the release workflow, which freezes the
             // exact version in its plan) installs THAT version — never a moving
             // `latest` that could resolve to a different build than the one the
             // plan authorized. A non-concrete value fails closed rather than being
             // interpolated into an install spec. An omitted version keeps the
             // interactive `yui update` behavior of staging latest.
-            const spec = version === undefined
+            const spec = requestedVersion === undefined
                 ? PACKAGE_SPEC
-                : isConcreteVersion(version)
-                    ? `${PACKAGE_NAME}@${version.trim()}`
+                : isConcreteVersion(requestedVersion)
+                    ? `${PACKAGE_NAME}@${requestedVersion.trim()}`
                     : null;
             if (spec === null) {
-                throw runtimeError(`Refusing to stage a non-concrete version (${String(version)}): only an exact `
+                throw runtimeError(`Refusing to stage a non-concrete version (${String(requestedVersion)}): only an exact `
                     + "major.minor.patch version can be pinned for an update.");
             }
             // The Home staging parent may not exist yet on a Home that has never
@@ -126,6 +127,10 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
                         + "nor `yui --json version` returned a concrete version). Refusing to proceed with a "
                         + "`@latest` fallback that could promote a different build than the one preflighted.");
                 }
+                if (requestedVersion !== undefined && version !== requestedVersion.trim()) {
+                    throw runtimeError(`Requested Yui ${requestedVersion.trim()}, but staged Yui ${version}. `
+                        + "Refusing to activate a different release; the install and storage are unchanged.");
+                }
                 // Successful staging transfers cleanup ownership to runUpdate's finally
                 // block. Every assertion, spawn, npm/network, or version-resolution
                 // failure before that handoff removes the throwaway prefix here.
@@ -196,10 +201,9 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
                     + `but the staged/verified artifact was ${staged.version}. Refusing to trust a `
                     + "different build than the one that passed preflight.");
             }
-            // Existing managed Sessions may have been created by an earlier release.
-            // Retarget those authenticated, Manifest-referenced wrappers to the
-            // activated control plane before the replacement Controller starts so
-            // the update cannot strand a live Session.
+            // Retarget current Manifest-referenced wrappers to the activated
+            // installation before the replacement Controller starts. This relocates
+            // the current shell form; it does not convert historical Session wrappers.
             const sessionCliRefresh = run(activeBinary, ["--json", "internal", "session-cli-refresh"], { cwd: process.cwd(), env: { ...environment, YUI_HOME: home }, shell: false });
             assertSpawnOk(sessionCliRefresh, "refresh managed Session CLI wrappers");
             // Retain the exact path used by both doctor and version verification. The
@@ -214,13 +218,15 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
         },
         // `runUpdate` is intentionally synchronous because the npm/staged-binary
         // ports use spawnSync. A short-lived child owns the async, exactly fenced
-        // reconciliation first; lifecycle capture then uses structured live
+        // reconciliation explicitly; lifecycle capture uses only structured live
         // Controller commands. Tests can replace these seams with deterministic
         // fakes without touching a real Controller.
         controllerStatus(home) {
-            reconcileControllerResourcesForUpdate(home, environment, spawn);
             return readControllerLifecycle(home, environment, spawn);
         },
+        reconcileController(home) {
+            return reconcileControllerResourcesForUpdate(home, environment, spawn);
+        },
         stopController(home, expectedPid) {
             return stopControllerForUpdate(home, expectedPid, environment, spawn);
         },
@@ -355,6 +361,7 @@ function stopReplacementControllerForUpdate(home, expectedPid, environment, spaw
 function runSchemaIndependentControllerStop(home, environment, spawn, expectedPid) {
     const helper = [
         "const values = process.argv.slice(1);",
+        "const handoverOwnerPid = Number(values.pop());",
         "const expectedPid = values.length === 3 ? Number(values.pop()) : undefined;",
         "const home = values.pop();",
         "const runtimeModule = values.pop();",
@@ -362,6 +369,7 @@ function runSchemaIndependentControllerStop(home, environment, spawn, expectedPi
         "  const { stopFileTaskController } = await import(runtimeModule);",
         "  const data = await stopFileTaskController(home, {",
         "    environment: process.env,",
+        "    handoverOwnerPid,",
         "    ...(expectedPid === undefined ? {} : { expectedPid })",
         "  });",
         "  process.stdout.write(JSON.stringify({ ok: true, data }));",
@@ -377,7 +385,10 @@ function runSchemaIndependentControllerStop(home, environment, spawn, expectedPi
         helper,
         UPDATE_CLIENT_RUNTIME_PATH,
         home,
-        ...(expectedPid === undefined ? [] : [String(expectedPid)])
+        ...(expectedPid === undefined ? [] : [String(expectedPid)]),
+        // The runtime validates the existing lock owner; the child must identify
+        // its owning updater instead of waiting on the parent's lock as foreign.
+        String(process.pid)
     ], { cwd: process.cwd(), env: { ...environment, YUI_HOME: home }, shell: false });
     if (result.error !== undefined || result.status !== 0) {
         const detail = result.stderr.toString("utf8").trim();
@@ -491,10 +502,11 @@ function restoreControllerIdentity(home, identity, environment, spawn) {
     // Spawn a detached child through a short-lived Node helper so the synchronous
     // update process can still use the authenticated, bounded readiness handshake
     // shared by Controller startup. No retry, sleep, or new identity inference is
-    // hidden here.
+    // hidden here. Restoration participates in the same parent-owned lock.
     const helper = [
         "const { spawn } = require('node:child_process');",
         "const values = process.argv.slice(1);",
+        "const handoverOwnerPid = Number(values.pop());",
         "const version = values.pop();",
         "const args = JSON.parse(values.pop());",
         "const executable = values.pop();",
@@ -504,6 +516,7 @@ function restoreControllerIdentity(home, identity, environment, spawn) {
         "  const { ensureFileTaskControllerIdentity } = await import(runtimeModule);",
         "  await ensureFileTaskControllerIdentity(home, { executablePath: executable, args, version }, {",
         "    environment: process.env,",
+        "    handoverOwnerPid,",
         "    spawnController: (_home, launchEnv) => {",
         "      const child = spawn(executable, args, { detached: true, stdio: 'ignore', env: launchEnv });",
         "      child.unref();",
@@ -518,7 +531,8 @@ function restoreControllerIdentity(home, identity, environment, spawn) {
         home,
         identity.executablePath,
         JSON.stringify(identity.args),
-        identity.version
+        identity.version,
+        String(process.pid)
     ], { cwd: process.cwd(), env: launchEnvironment, shell: false, stdio: "pipe" });
     assertSpawnOk(result, "restore the previously running Controller identity");
 }
@@ -585,14 +599,23 @@ function reconcileControllerResourcesForUpdate(home, environment, spawn) {
         "  process.stdout.write(JSON.stringify({ ok: true, data }));",
         "})().catch((error) => {",
         "  const message = error instanceof Error ? error.message : String(error);",
-        "  process.stderr.write(JSON.stringify({ ok: false, code: 'RUNTIME_ERROR', message }));",
+        "  process.stderr.write(JSON.stringify({ ok: false, code: 'RUNTIME_ERROR', message, result: error.result }));",
         "  process.exitCode = 5;",
         "});"
     ].join(" ");
     const result = spawn(process.execPath, ["-e", helper, UPDATE_CONTROLLER_RECONCILIATION_PATH, home], { cwd: process.cwd(), env: { ...environment, YUI_HOME: home }, shell: false });
     if (result.error !== undefined || result.status !== 0) {
         const detail = structuredErrorMessage(result) ?? result.stderr.toString("utf8").trim();
-        throw new Error(`Controller reconciliation failed (exit ${result.status ?? "null"})${detail.length === 0 ? "." : `: ${detail}`}`);
+        const message = `Controller reconciliation failed (exit ${result.status ?? "null"})${detail.length === 0 ? "." : `: ${detail}`}`;
+        let evidence;
+        try {
+            evidence = JSON.parse(result.stderr.toString("utf8")).result;
+        }
+        catch { /* Unknown child effects are reported below, never retried here. */ }
+        if (isReconciliationResult(evidence, home)) {
+            throw new UpdateControllerReconciliationError(message, evidence);
+        }
+        throw new Error(`${message} Cleanup effects are unknown; inspect the exact Home ${home} before retrying.`);
     }
     let parsed;
     try {
@@ -605,11 +628,19 @@ function reconcileControllerResourcesForUpdate(home, environment, spawn) {
     }
     if (!isRecord(parsed)
         || parsed.ok !== true
-        || !isRecord(parsed.data)
-        || !Array.isArray(parsed.data.cleaned)
-        || parsed.data.cleaned.some((id) => typeof id !== "string")) {
+        || !isReconciliationResult(parsed.data, home)) {
         throw new Error("Controller reconciliation returned an invalid structured result.");
     }
+    return parsed.data;
+}
+function isReconciliationResult(value, home) {
+    return isRecord(value) && value.home === resolve(home)
+        && Array.isArray(value.cleaned) && value.cleaned.every(id => typeof id === "string")
+        && Array.isArray(value.attempts) && value.attempts.every(attempt => (isRecord(attempt) && isRecord(attempt.resource) && typeof attempt.resource.id === "string"
+        && ["cleaned", "absent", "unknown"].includes(String(attempt.outcome))
+        && (attempt.error === undefined || typeof attempt.error === "string")))
+        && Array.isArray(value.remaining) && value.remaining.every(resource => (isRecord(resource) && typeof resource.id === "string"))
+        && ["observedAt", "observationError", "lockReleaseError"].every(key => (value[key] === undefined || typeof value[key] === "string"));
 }
 function structuredErrorMessage(result) {
     for (const buffer of [result.stderr, result.stdout]) {
@@ -779,7 +810,7 @@ function interpretPreflight(result) {
     }
     const outcome = typeof data.outcome === "string" ? data.outcome : undefined;
     // EXIT/OUTCOME CONSISTENCY (P1-2): the one success-class internal preflight
-    // outcome must exit 0. A user dry-run, legacy direct classification outcome,
+    // outcome must exit 0. A user dry-run, a direct classification outcome,
     // or any other spelling is not this contract and is never promoted to green.
     if (outcome === "update-preflight" && result.status !== 0) {
         return {

package/dist/cli.js

@@ -45,7 +45,7 @@ import { assertTaskDeliveryAuthority, taskLocalActor } from "./task/taskAuthorit
 import { runTaskBaseStatusCommand } from "./commands/taskBaseCommands.js";
 import { runTaskChangeSetCommand } from "./commands/taskChangeSetCommands.js";
 import { assertWorkItemDependenciesCompletedForCommand, dispatchPreparedReviewRound, failPendingReviewRound, parseTaskArchiveArguments, parseTaskCompletionRequest, planReplicatedWorkItemLanes, preflightTaskCompletion, preserveReviewRoundWorkspace, previewTaskRoleAgentConfigurationMutation, requireWorkItemAssignee, runTaskCommand, validateTaskArchiveRequest } from "./commands/taskCommands.js";
-import { reconcileTaskRemoteBaselines, verifyTaskCompletionPublishedTree } from "./commands/taskCompletionGate.js";
+import { verifyTaskCompletionPublishedTree } from "./commands/taskCompletionGate.js";
 import { finalizeStoppedTaskExecution, parseTaskExecutionStartRequest, parseTaskExecutionStopRequest, startTaskExecutionCommand, stopTaskExecutionCommand } from "./commands/taskExecutionCommands.js";
 import { runTaskIntegrationCommand } from "./commands/taskIntegrationCommands.js";
 import { runTaskOverlapCommand } from "./commands/taskOverlapCommands.js";
@@ -225,9 +225,7 @@ export async function main() {
     if (args[0] === "update") {
         if (jsonOutput)
             throw usageError("Update does not support --json.");
-        if (args.length !== 1)
-            throw usageError("Update usage: yui update");
-        process.exitCode = runUpdateCommand();
+        process.exitCode = runUpdateCommand(args.slice(1));
         return;
     }
     if (args[0] === "release") {
@@ -1384,6 +1382,8 @@ export async function main() {
             }
             let completionSummary;
             let completionPublishedTreeProof;
+            let completionBaseFreshness;
+            let completionWarnings = [];
             if (resolved[1] === "base" && resolved[2] === "status") {
                 const result = await runTaskBaseStatusCommand(resolved.slice(3), store);
                 emit(result.output, false, result.data);
@@ -1400,8 +1400,8 @@ export async function main() {
             if (resolved[1] === "complete" && resolved[2] !== undefined) {
                 const completionRequest = parseTaskCompletionRequest(resolved.slice(2));
                 completionSummary = completionRequest.summary;
-                const refreshRemote = resolved.includes("--refresh-remote");
-                const completion = preflightTaskCompletion(resolved[2], store, {
+                const refreshRemote = completionRequest.refreshRemote;
+                const completion = preflightTaskCompletion(completionRequest.taskId, store, {
                     environment: process.env,
                     ...(taskFinalReviewContract === undefined
                         ? {}
@@ -1412,34 +1412,25 @@ export async function main() {
                     // Publication proof resolves its exact commit. Without the flag the
                     // command remains offline and preserves the existing proof-first path.
                     const refreshedFreshness = refreshRemote
-                        ? await inspectTaskBaseFreshness(resolved[2], store, { refresh: true })
+                        ? await inspectTaskBaseFreshness(completionRequest.taskId, store, { refresh: true })
                         : undefined;
                     if (completionRequest.acceptedPublishedTreePublicationId !== undefined) {
                         completionPublishedTreeProof = await verifyTaskCompletionPublishedTree(completionRequest.taskId, completionRequest.acceptedPublishedTreePublicationId, store);
                     }
-                    const freshness = refreshedFreshness
-                        ?? await inspectTaskBaseFreshness(resolved[2], store);
-                    for (const warning of assertTaskBaseFreshnessForCompletion(freshness, {
+                    completionBaseFreshness = refreshedFreshness
+                        ?? await inspectTaskBaseFreshness(completionRequest.taskId, store);
+                    completionWarnings = assertTaskBaseFreshnessForCompletion(completionBaseFreshness, {
                         ...(completionPublishedTreeProof === undefined
                             ? {}
                             : {
                                 acceptedPublishedTreeProjectId: completionPublishedTreeProof.projectId
                             })
-                    })) {
+                    });
+                    for (const warning of completionWarnings) {
                         process.stderr.write(`Warning: ${warning}\n`);
                     }
-                    // Keep completion offline by default. An explicit refresh is the only
-                    // path that may fetch and reconcile a moved remote baseline.
-                    if (refreshRemote) {
-                        const reconciled = await reconcileTaskRemoteBaselines(resolved[2], store, home, { environment: process.env, jobPort: createControllerIntegrationJobPort(home, { environment: process.env }) });
-                        if (reconciled.length > 0) {
-                            const updates = reconciled.map((entry) => (`${entry.projectId}: ${entry.fromCommit} -> ${entry.toCommit} `
-                                + `(Integration ${entry.integrationId})`)).join("; ");
-                            throw usageError(`Remote baseline reconciliation advanced Task ${resolved[2]} (${updates}). `
-                                + "The Task remains active so the Leader can inspect the new authoritative head, "
-                                + "decide how prior Review evidence applies, and retry task complete.");
-                        }
-                    }
+                    // Refresh observes remote objects only. Choosing and executing an
+                    // upstream Integration belongs to its explicit command, never completion.
                 }
             }
             let releaseReviewHandoverLock;
@@ -1628,9 +1619,24 @@ export async function main() {
                         emitControlFailure(result.output, failureCode, result.data);
                         return;
                     }
-                    emit(`${result.output}${reviewOutput}`, false, reviewData === undefined
+                    const commandData = reviewData === undefined
                         ? result.data
-                        : { command: result.data, ...reviewData });
+                        : { command: result.data, ...reviewData };
+                    const completionData = resolved[1] === "complete" ? {
+                        // Review dispatch may have advanced or failed after the command
+                        // prepared its Round. Report that observed stage, not preparation.
+                        ...(reviewData === undefined ? {} : {
+                            stage: reviewRoundFromCommandData(reviewData)?.status === "running"
+                                ? "review-running"
+                                : "review-blocked",
+                            projectHeads: result.data.projectHeads
+                        }),
+                        baseFreshness: completionBaseFreshness ?? null,
+                        warnings: completionWarnings
+                    } : undefined;
+                    emit(`${result.output}${reviewOutput}`, false, completionData === undefined
+                        ? commandData
+                        : { ...commandData, ...completionData });
                     return;
                 }
                 if (jsonOutput && result.kind !== "session-stop"
@@ -2431,7 +2437,10 @@ async function executeOperatorSessionControl(control, home, store, runtime, tmux
     await ensureFileTaskController(home, { environment: process.env });
     if (paneRunning
         || (active !== undefined
-            && active.status === "active")) {
+            && active.status === "active")
+        || (sessionSet?.providerBinding?.run != null
+            && ["submitting", "accepted", "delivery-unknown"].includes(sessionSet.providerBinding.run.status))
+        || (sessionSet?.providerBinding?.goal != null && sessionSet.providerBinding.goal.status !== "complete")) {
         await runtime.stopGlobalRoleSession(role.name);
     }
     applyOperatorSessionControl(control, store);

package/dist/commands/controllerCommands.js

@@ -202,7 +202,7 @@ export function renderRuntimeIdentitySection(input) {
         `  Source commit   ${build.sourceCommit}`,
         `  Node            ${build.nodeVersion} (${build.platform})`,
         `  Storage         version ${storage.storageVersion} (status ${storage.storageStatus}, minimum ${storage.minimumStorageVersion}) · backend ${storage.configuredBackend} · worker ${storage.workerEnabled ? "on" : "off"}`,
-        `  Store files     state.json ${storage.physicalStateJson.present ? "present" : "absent"} · yui.db ${storage.physicalDatabase.present ? "present" : "absent"}${storage.physicalDatabase.wal ? " +WAL" : ""}${storage.physicalDatabase.present && storage.physicalDatabase.health !== UNSUPPORTED ? ` (${storage.physicalDatabase.health})` : ""}`
+        `  Store files     yui.db ${storage.physicalDatabase.present ? "present" : "absent"}${storage.physicalDatabase.wal ? " +WAL" : ""}${storage.physicalDatabase.present && storage.physicalDatabase.health !== UNSUPPORTED ? ` (${storage.physicalDatabase.health})` : ""}`
     ];
     for (const finding of storage.findings) {
         lines.push(`  ! ${finding.severity === "contradiction" ? "CONTRADICTION" : finding.severity === "needs-repair" ? "NEEDS-REPAIR" : "warning"} ${finding.code}: ${finding.message}`, `    remediation: ${finding.remediation}`);

package/dist/commands/executionAuditCommands.js

@@ -258,8 +258,8 @@ export function renderExecutionAudit(report, width = defaultTableWidth()) {
     }
     if (report.storage.status === "ok" && report.storage.data !== undefined) {
         const storage = report.storage.data;
-        lines.push("", `Storage: backend ${storage.backend} · state.json ${formatBytes(storage.stateJsonBytes)} · yui.db ${formatBytes(storage.databaseBytes)}`
-            + ` · runtime/ ${formatBytes(storage.runtimeDirBytes)} · deployments ${formatBytes(storage.deploymentsBytes)}`);
+        lines.push("", `Storage: backend ${storage.backend} · yui.db ${formatBytes(storage.databaseBytes)}`
+            + ` · runtime/ ${formatBytes(storage.runtimeDirBytes)}`);
     }
     else {
         lines.push("", ...sectionError("storage", report));

package/dist/commands/projectCommands.js

@@ -238,7 +238,7 @@ async function cloneProject(args, store, options) {
     // A remote-URL binding is Home-managed by default: its canonical repository
     // lives below the persistent Home, so the runtime never depends on a
     // user-controlled checkout path. --external is an explicit opt-in to the
-    // legacy clone-inside-the-workspace mode.
+    // user-owned clone-inside-the-workspace mode.
     let destination;
     let ownership;
     if (parsed.external) {

package/dist/commands/releaseCommands.js

@@ -341,55 +341,26 @@ export function createReleaseActivatePorts(overrides = {}) {
             }),
         runPreflight: overrides.runPreflight ?? ((releaseDir, home) => {
             const cli = join(releaseDir, "dist", "cli.js");
-            const result = spawnSync(process.execPath, [cli, "doctor", "--json"], {
+            // The target owns current-record and database integrity validation.
+            // Activation never migrates; a valid but older Home still blocks here.
+            const result = spawnSync(process.execPath, [cli, "--json", "upgrade", "--update-preflight"], {
                 env: { ...process.env, YUI_HOME: home, NO_COLOR: "1" },
                 encoding: "utf8",
                 timeout: 60_000
             });
             let report;
             try {
-                const envelope = JSON.parse(result.stdout);
-                report = envelope.data;
+                report = JSON.parse(result.stdout);
             }
             catch (error) {
                 throw new Error(`Release preflight produced no JSON (exit ${result.status}): `
                     + `${messageOf(error)} ${result.stderr.trim()}`);
             }
-            // The handover preflight must prove the exact current Home contract.
-            // Older, newer, malformed, or incomplete Homes all fail closed and are
-            // never normalized by release activation.
-            const checks = report?.checks;
-            if (!Array.isArray(checks)) {
-                throw new Error("Release preflight report has no storage checks.");
-            }
-            const required = ["storage compatibility"];
-            const failed = required.filter((name) => {
-                const check = checks.find((candidate) => candidate !== null
-                    && typeof candidate === "object"
-                    && candidate.name === name);
-                return check === undefined
-                    || check.status !== "ok";
-            });
-            if (failed.length > 0) {
-                throw new Error(`Release preflight storage compatibility checks failed: ${failed.join(", ")}.`);
-            }
-            // Doctor proves the target's storage, not the pinned code in existing
-            // Hosts. Ask the target's upgrade boundary for its independent Host
-            // protocol proof as well; release activation itself still never migrates.
-            const hostCheck = spawnSync(process.execPath, [cli, "--json", "upgrade", "--update-preflight"], {
-                env: { ...process.env, YUI_HOME: home, NO_COLOR: "1" },
-                encoding: "utf8", timeout: 60_000
-            });
-            let preflight;
-            try {
-                preflight = JSON.parse(hostCheck.stdout).data;
-            }
-            catch {
-                throw new Error(`Release Host preflight produced no JSON: ${hostCheck.stderr.trim()}`);
-            }
-            if (hostCheck.status !== 0 || preflight?.outcome !== "update-preflight"
-                || preflight.status !== "already-current") {
-                throw new Error(`Release Host compatibility preflight failed: ${preflight?.message ?? preflight?.status ?? "unknown"}. ${preflight?.action ?? ""}`);
+            if (result.status !== 0 || report?.ok !== true
+                || report.data?.outcome !== "update-preflight"
+                || report.data.status !== "already-current") {
+                throw new Error(`Release storage preflight failed: ${report?.data?.message ?? report?.data?.status ?? "invalid response"}. `
+                    + `${report?.data?.action ?? result.stderr.trim()}`);
             }
         }),
         killOwnedProcess: overrides.killOwnedProcess ?? ((owner) => {