@zq-silk/yui 0.16.0 → 0.16.2

package/dist/controller/fileSchedulerStoreAdapter.js

@@ -5,17 +5,17 @@ import { freezeRunContextSnapshot } from "../context/runContextPack.js";
 import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 import { interruptThenTerminalState, prepareMessageContinuations } from "../message/messageContinuation.js";
 import { assertExecutionEnvironmentCurrent } from "../runtime/executionEnvironment.js";
-import { deferProviderRetry, providerRetryPending, recordProviderFailure } from "../runtime/providerRetry.js";
+import { deferProviderRetry, providerRetryPending, providerRetryProjection, recordProviderFailure } from "../runtime/providerRetry.js";
 import { AgentHostObservationDeferred, recordAgentHostConnection, resolveAgentHostObservation } from "./agentHostObservation.js";
 import { admitOwnedProviderInput, ownedProviderInput } from "./providerRetryAdmission.js";
 import { RuntimeHookRunFenceError } from "./runtimeHookRunFence.js";
-import { appendRunInput, createRun, runPurposeAdmitsTaskState, withRunContextSnapshot } from "../agentRun/agentRun.js";
+import { appendRunInput, createRun, runPurposeAdmitsTaskState } from "../agentRun/agentRun.js";
 import { createRunInput } from "../context/runInputContract.js";
 import { bindExecution, claimPending, completeProcessing, consumePendingBatch, mailboxHasWork, releaseProcessing } from "../coordination/workMailbox.js";
 import { enqueueWork, settleRoleRunDispatch as settleRoleRunDispatchMailbox } from "../coordination/workMailboxQueue.js";
 import { transportAgentResult } from "../domain/agentResultTransport.js";
 import { createTaskEvent } from "../event/taskEvent.js";
-import { activeLiveRoleAgentSession, bindGlobalRoleProviderRuntime, bindTaskRoleProviderRuntime, createRoleSessionSet, detachRoleAgentSessionHost, recordRoleAgentSession, recordTaskRoleNativeTurnBoundary, rememberRoleAgentCompletedTurn, replaceTaskRoleAgentSession, selectNewTaskRoleSession, taskRoleControlTarget, updateGlobalRoleProviderRuntime, updateRoleAgentSessionStatus, updateTaskRoleProviderRuntime } from "../executor/agentExecutor.js";
+import { activeLiveRoleAgentSession, bindGlobalRoleProviderRuntime, bindTaskRoleProviderRuntime, createRoleSessionSet, detachRoleAgentSessionHost, recordRoleAgentSession, recordTaskRoleNativeTurnBoundary, rememberRoleAgentCompletedTurn, replaceTaskRoleAgentSession, selectNewTaskRoleSession, roleSessionControlTarget, updateGlobalRoleProviderRuntime, updateRoleAgentSessionStatus, updateTaskRoleProviderRuntime } from "../executor/agentExecutor.js";
 import { effectiveLaunchWithTaskMainWorkspace, resolveEffectiveLaunch, roleSessionMayContinue, validateEffectiveLaunchSnapshot } from "../executor/effectiveLaunch.js";
 import { answerInputRequest } from "../input/inputRequest.js";
 import { createCanonicalLifecycleEvent, foldCanonicalLifecycleEvent } from "../lifecycle/canonicalLifecycleEvent.js";
@@ -26,6 +26,8 @@ import { activeRoleAgentBinding } from "../role/role.js";
 import { SYSTEM_OPERATOR_ROLE } from "../role/systemRoles.js";
 import { standardAgentError } from "../runtime/agentError.js";
 import { recordTaskAgentError } from "./taskAgentError.js";
+import { recordGlobalRuntimeAttention, recordGlobalRuntimeFailure } from "./globalRuntimeAttention.js";
+import { queueOperatorNotification } from "./operatorNotification.js";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
 import { RUNTIME_CLEANUP_REQUIRED_REASON, RUNTIME_HOST_DETACH_REQUIRED_REASON, RUNTIME_LIFECYCLE_OWNER, hasRuntimeCleanupObligation, hasRuntimeLifecycleWork, isRuntimeCleanupReason, runtimeCleanupDisposition, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { classifyRuntimeProcessExit, validateRuntimeProcessExitObservation } from "../runtime/processExitObservation.js";
@@ -384,6 +386,16 @@ export class FileSchedulerStoreAdapter {
             const matches = receipt !== undefined && binding.run?.attemptId === receipt
                 && (fence.nativeTurnId === undefined || binding.run.nativeTurnId === undefined
                     || binding.run.nativeTurnId === fence.nativeTurnId);
+            if ((input.kind === "observer.health" || input.kind === "conversation.observed") && input.payload.failure !== undefined) {
+                if (receipt !== undefined && !matches)
+                    return "obsolete";
+                recordGlobalRuntimeAttention(store, fence.roleName, input.eventId, {
+                    fence, failure: input.payload.failure,
+                    confirmed: binding.run?.status ?? "no-owned-input",
+                    unknown: "Native execution outcome and resource quiescence are not proven by this diagnostic."
+                }, now);
+                return "applied";
+            }
             if (input.kind === "turn.accepted") {
                 if (input.authority === "transport" && matches) {
                     const message = store.listGlobalRoleMessages(fence.roleName).find(entry => receipt === `global-input:${fence.roleName}/${entry.id}`);
@@ -456,12 +468,27 @@ export class FileSchedulerStoreAdapter {
                 binding = updateProviderConversationRecoverability(binding, input.payload.recoverability);
             }
             if (input.kind === "turn.failed" && matches && input.payload.failure !== undefined) {
+                const failureRef = recordGlobalRuntimeFailure(store, fence.roleName, input.eventId, {
+                    fence, failure: input.payload.failure,
+                    chainId: binding.retry?.chainId ?? receipt,
+                    attempts: binding.retry?.attempts ?? 0,
+                    confirmed: "Native Turn failed. Prior side effects are not undone.",
+                    unknown: "External effects and remaining unfinished work."
+                }, now);
                 binding = recordProviderFailure(binding, {
-                    error: input.payload.failure.error, failureRef: input.eventId, at: now.getTime()
+                    error: input.payload.failure.error, failureRef, at: now.getTime()
                 });
             }
             store.saveGlobalRoleSessionSet(updateGlobalRoleProviderRuntime(sessions, binding, now));
             settleGlobalRetryInput(store, fence.roleName, binding, now);
+            if (input.kind === "turn.failed" && matches && input.payload.failure !== undefined
+                && !providerRetryPending(binding)) {
+                recordGlobalRuntimeAttention(store, fence.roleName, input.eventId, {
+                    fence, failure: input.payload.failure, retry: providerRetryProjection(binding),
+                    confirmed: "Native Turn failed; this does not prove absence of prior side effects.",
+                    unknown: "External effects must be inspected before continuing."
+                }, now);
+            }
             return "applied";
         });
     }
@@ -518,11 +545,19 @@ export class FileSchedulerStoreAdapter {
                     && (native.nativeTurnId === undefined || native.nativeTurnId === input.fence.nativeTurnId)
                     ? "applied" : "obsolete";
             }
-            const knownContinuation = input.kind.startsWith("continuation.") && projectProviderContinuations(store.listEvents(input.fence.taskId)).some((entry) => (entry.runId === input.fence.runId
-                && entry.identity.providerNamespace === input.fence.driverId
-                && entry.identity.accountScope === input.fence.agentId
-                && entry.identity.conversationId === input.fence.conversationId
-                && entry.identity.continuationId === input.fence.continuationId));
+            const knownContinuation = (input.kind.startsWith("continuation.") || input.kind === "observer.health")
+                && projectProviderContinuations(store.listEvents(input.fence.taskId)).some((entry) => (entry.runId === input.fence.runId
+                    && entry.identity.providerNamespace === input.fence.driverId
+                    && entry.identity.accountScope === input.fence.agentId
+                    && entry.identity.conversationId === input.fence.conversationId
+                    && entry.identity.continuationId === input.fence.continuationId));
+            if (input.kind === "observer.health" && input.payload.failure !== undefined) {
+                const native = sessions?.providerBinding?.run;
+                return knownContinuation || session?.nativeSessionId === input.fence.nativeSessionId
+                    && (input.fence.receiptId === undefined || native?.attemptId === input.fence.receiptId
+                        && (input.fence.nativeTurnId === undefined || native.nativeTurnId === input.fence.nativeTurnId))
+                    ? "applied" : "obsolete";
+            }
             const requiresCurrentRuntime = input.kind !== "turn.cancelled" && !knownContinuation;
             const valid = run !== null && (!requiresCurrentRuntime || (run.status === "active" && active?.id === run.id)) && run.roleName === input.fence.roleName && run.effective.agentId === input.fence.agentId && this.drivers.requireByAdapterId(run.effective.adapterId).id === input.fence.driverId && (knownContinuation || (session !== undefined && session.nativeSessionId === input.fence.nativeSessionId)) && runtimeReceiptBelongsToRun(store, input);
             if (!valid) {
@@ -733,7 +768,7 @@ export class FileSchedulerStoreAdapter {
                     ? "provider-goal-cleared"
                     : `provider-goal-${input.payload.goalStatus}`, now);
             }
-            if (input.kind === "turn.failed" && input.payload.failure !== undefined) {
+            if (["turn.failed", "observer.health", "conversation.observed"].includes(input.kind) && input.payload.failure !== undefined) {
                 const failure = input.payload.failure;
                 const error = failure.error;
                 const run = input.fence.runId === undefined
@@ -753,10 +788,12 @@ export class FileSchedulerStoreAdapter {
                         runId: input.fence.runId,
                         nativeSessionId: input.fence.nativeSessionId,
                         nativeTurnId: input.fence.nativeTurnId,
+                        attemptId: input.fence.receiptId,
                         lastOutput: failure.lastOutput
                     },
                 }, now);
-                if (created && !providerRetryPending(store.getTaskRoleSessionSet(taskId, input.fence.roleName)?.providerBinding))
+                if (created && (input.kind !== "turn.failed"
+                    || !providerRetryPending(store.getTaskRoleSessionSet(taskId, input.fence.roleName)?.providerBinding)))
                     routeRoleEvent(store, errorEvent, input.fence.roleName, wakeReason("agent-error", errorEvent.id), now);
             }
             if ((input.kind === "operation.completed" || input.kind === "operation.failed")
@@ -857,6 +894,9 @@ export class FileSchedulerStoreAdapter {
     getActiveRun(taskId, roleName) {
         return this.store.getActiveRun(taskId, roleName);
     }
+    getContextSnapshot(taskId, snapshotId) {
+        return this.store.getContextSnapshot(taskId, snapshotId);
+    }
     hasOpenInputRequest(taskId) {
         return this.store.listOpenInputRequests([taskId]).length > 0;
     }
@@ -879,8 +919,8 @@ export class FileSchedulerStoreAdapter {
             adapterId: effectiveSession.effective.adapterId
         };
     }
-    markOperatorRunStarted(now) {
-        void now;
+    queueOperatorNotification(input, now) {
+        return queueOperatorNotification(this.store, input, now);
     }
     resolveExpiredInputRecommendations(now, taskIds) {
         return this.store.transaction((store) => {
@@ -1224,8 +1264,26 @@ export class FileSchedulerStoreAdapter {
                 let resolved = settleProviderTurnSubmission(binding, { attemptId: input.attemptId, status: input.status,
                     reason: input.reason, resolvedAt: input.now.toISOString() });
                 resolved = this.retrySubmissionResolution(resolved, input, sessions.sessions[sessions.activeAgentId]?.adapterId);
+                if (input.status !== "deferred" && resolved.run?.failure !== undefined) {
+                    const failureRef = recordGlobalRuntimeFailure(store, input.roleName, `${input.attemptId}:submission`, {
+                        nativeSessionId: currentProviderConversation(resolved).conversationId,
+                        attemptId: input.attemptId, status: input.status, failure: resolved.run.failure,
+                        chainId: resolved.retry?.chainId ?? input.attemptId, attempts: resolved.retry?.attempts ?? 0
+                    }, input.now);
+                    resolved = { ...resolved, run: { ...resolved.run, failure: { ...resolved.run.failure, ref: failureRef } },
+                        ...(resolved.retry?.failedAttemptId === input.attemptId
+                            ? { retry: { ...resolved.retry, failureRef } } : {}) };
+                }
                 store.saveGlobalRoleSessionSet(updateGlobalRoleProviderRuntime(sessions, resolved, input.now));
                 settleGlobalRetryInput(store, input.roleName, resolved, input.now);
+                if (input.status !== "deferred" && !providerRetryPending(resolved)) {
+                    recordGlobalRuntimeAttention(store, input.roleName, `${input.attemptId}:submission`, {
+                        nativeSessionId: currentProviderConversation(resolved).conversationId,
+                        attemptId: input.attemptId, status: input.status,
+                        failure: resolved.run?.failure, retry: providerRetryProjection(resolved),
+                        unknown: "External effects are not established by submission settlement."
+                    }, input.now);
+                }
                 const message = store.listGlobalRoleMessages(input.roleName).find(entry => input.attemptId === `global-input:${input.roleName}/${entry.id}`);
                 if (message !== undefined && message.delivery?.via !== "provider") {
                     const outcome = input.status === "delivery-unknown" ? "delivery-unknown" : "rejected";
@@ -1681,15 +1739,17 @@ export class FileSchedulerStoreAdapter {
             const mailbox = store.getWorkMailbox(target);
             if (mailbox?.pending == null || mailbox.processing !== null)
                 return false;
+            const snapshot = freezeRunContextSnapshot(store, {
+                taskId, roleName: "leader", purpose: "planning"
+            }, now);
             const run = createRun(store.nextRunId(taskId), taskId, "leader", "new", createRunInput({ source: { type: "yui", channel: "task-dispatch" },
                 directive: `Plan Task ${taskId} with the user. Persist requirements and decisions. Request activation explicitly; planning grants no delivery authority.`,
+                contextSnapshotRef: contextSnapshotRef(snapshot),
                 deltaRefIds: [] }), now, {
                 purpose: "planning", effective: resolveEffectiveLaunch({ role, purpose: "planning" })
             });
-            const snapshot = freezeRunContextSnapshot(store, run, now);
-            const frozen = withRunContextSnapshot(run, contextSnapshotRef(snapshot));
-            store.saveRun(frozen);
-            store.saveActiveRun(frozen);
+            store.saveRun(run);
+            store.saveActiveRun(run);
             // Freeze the initial notification prefix against this planning Run.
             // Later messages remain pending; acceptance or an exact terminal settles
             // only this batch, so a failed initial launch cannot replay it forever.
@@ -2256,6 +2316,13 @@ export class FileSchedulerStoreAdapter {
                 recordCanonicalObservationObsolete(store, input, "provider-conversation-mismatch", now);
                 return "obsolete";
             }
+            if (input.payload.failure !== undefined) {
+                // A diagnostic without an owned Turn describes this exact connection,
+                // not a new recoverability observation or proof of resource release.
+                return sessions.activeAgentId === input.fence.agentId
+                    && sessions.sessions[input.fence.agentId]?.nativeSessionId === input.fence.nativeSessionId
+                    ? "applied" : "obsolete";
+            }
             try {
                 if (input.kind === "conversation.observed") {
                     binding = updateProviderConversationRecoverability(binding, input.payload.recoverability);
@@ -2864,7 +2931,7 @@ function dormantRuntimeCandidateIsCurrent(store, candidate, allowActiveRun = fal
     }
     const sessions = runtimeOwnerSessionSet(store, owner);
     const active = allowActiveRun && owner.scope === "task"
-        ? taskRoleControlTarget(store.getTaskRoleSessionSet(owner.taskId, owner.roleName))
+        ? roleSessionControlTarget(store.getTaskRoleSessionSet(owner.taskId, owner.roleName))
         : sessions?.sessions[sessions.activeAgentId];
     return active !== undefined && active.agentId === candidate.agentId && active.adapterId === candidate.adapterId
         && active.nativeSessionId === candidate.nativeSessionId && (allowActiveRun || active.updatedAt === candidate.sessionUpdatedAt);

package/dist/controller/globalInputDelivery.js

@@ -13,6 +13,10 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             if (pending.length === 0 || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name }))))
                 continue;
             let sessions = store.getGlobalRoleSessionSet(role.name);
+            // A detached Host keeps an active Session and may reconnect. An explicit
+            // Session stop/switch must not be undone by background notification work.
+            if (sessions !== null && sessions.sessions[sessions.activeAgentId]?.status !== "active")
+                continue;
             if (sessions?.providerBinding?.retry !== undefined && !providerRetryPending(sessions.providerBinding)) {
                 store.transaction(tx => settleGlobalRetryInput(tx, role.name, tx.getGlobalRoleSessionSet(role.name)?.providerBinding, new Date()));
                 pending = store.listGlobalRoleMessages(role.name).filter(message => message.delivery === undefined && message.notDelivered === undefined
@@ -37,6 +41,9 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
                 continue;
             if (current != null && ["submitting", "accepted", "delivery-unknown"].includes(current.status))
                 continue;
+            const matchesTarget = (message) => message.deliveryTarget === undefined
+                || sessions?.activeAgentId === message.deliveryTarget.agentId
+                    && sessions.sessions[message.deliveryTarget.agentId]?.nativeSessionId === message.deliveryTarget.nativeSessionId;
             const claims = pending.filter(message => message.interruptThen !== undefined);
             let next;
             if (claims.length > 0) {
@@ -54,22 +61,36 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
                 if (next === undefined)
                     continue;
             }
-            else
-                next = pending[0];
+            else {
+                // Retain each stale original with its exact failure, but do not spend
+                // one reconciliation interval per unsent notice before reaching user
+                // input for the successor. An existing attempt/uncertain control still
+                // fences the queue; target mismatch alone is not non-acceptance.
+                next = pending.find(message => {
+                    if (matchesTarget(message)
+                        || current?.attemptId === `global-input:${role.name}/${message.id}`
+                        || message.control !== undefined && message.control.outcome !== "rejected")
+                        return true;
+                    store.updateGlobalRoleMessage(markGlobalRoleMessageNotDelivered(message, "native-session-changed", new Date()));
+                    return false;
+                });
+            }
+            if (next === undefined)
+                continue;
             const attemptId = `global-input:${role.name}/${next.id}`;
             if (current?.attemptId === attemptId)
                 continue;
             if (next.control !== undefined && next.control.outcome !== "rejected")
                 continue;
-            const matchesTarget = () => next.deliveryTarget === undefined
-                || sessions?.activeAgentId === next.deliveryTarget.agentId
-                    && sessions.sessions[next.deliveryTarget.agentId]?.nativeSessionId === next.deliveryTarget.nativeSessionId;
-            if (!matchesTarget()) {
+            if (!matchesTarget(next)) {
                 store.updateGlobalRoleMessage(markGlobalRoleMessageNotDelivered(next, "native-session-changed", new Date()));
                 continue;
             }
             await ensure(role.name);
             sessions = store.getGlobalRoleSessionSet(role.name);
+            if (hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name })))
+                || sessions?.sessions[sessions.activeAgentId]?.status !== "active")
+                continue;
             const binding = sessions?.providerBinding;
             if (binding == null || binding.authority.owner !== "controller")
                 continue;
@@ -78,7 +99,7 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             if (persisted === undefined || JSON.stringify(persisted) !== JSON.stringify(next))
                 continue;
             const claim = next.interruptThen;
-            if (!matchesTarget() || claim !== undefined
+            if (!matchesTarget(next) || claim !== undefined
                 && (sessions?.activeAgentId !== claim.targetAgentId
                     || nativeSessionId !== claim.targetNativeSessionId
                     || binding.authority.epoch !== claim.targetAuthorityEpoch

package/dist/controller/globalRuntimeAttention.js

@@ -0,0 +1,34 @@
+import { createHash } from "node:crypto";
+import { createGlobalRoleMessage } from "../message/message.js";
+import { serializeAgentErrorRaw } from "../runtime/agentError.js";
+/** Global observations have no Task event history. Keep original failed
+ * attempts as ordinary record-only Messages before replacing the live binding. */
+export function recordGlobalRuntimeFailure(store, roleName, identity, facts, now) {
+    const header = `Yui Global failure evidence ${createHash("sha256").update(identity).digest("hex")}\n`;
+    const previous = store.listGlobalRoleMessages(roleName).find(message => message.kind === "system" && message.body.startsWith(header));
+    if (previous !== undefined)
+        return `${roleName}/${previous.id}`;
+    const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), roleName, header + serializeAgentErrorRaw(facts), "system", { type: "system" }, now);
+    store.saveGlobalRoleMessage(message);
+    return `${roleName}/${message.id}`;
+}
+/** Reuse the Global Message inbox for an exact failure, not a recovery queue.
+ * A failed Operator cannot be asked to retry its own diagnostic automatically. */
+export function recordGlobalRuntimeAttention(store, roleName, identity, facts, now) {
+    // A Home may have a custom Global Role without an Operator. Keep its own
+    // diagnostic readable; never create a Role or launch a substitute Agent.
+    const recipient = store.getGlobalRole("operator") === null ? roleName : "operator";
+    const requestId = `runtime-attention:${createHash("sha256").update(`${roleName}\0${identity}`).digest("hex")}`;
+    if (store.listGlobalRoleMessages(recipient).some(message => message.inputControl?.requestId === requestId))
+        return;
+    const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), recipient, [
+        `Global Role ${roleName} needs attention. No recovery or new authority is implied.`,
+        "Inspect the exact Session and original input before choosing a next action; unknown effects must not be replayed.",
+        `Original failed attempts remain in Role ${roleName}'s record-only failure Messages; failureRef names the latest evidence.`,
+        serializeAgentErrorRaw(facts)
+    ].join("\n"), "system", { type: "system" }, now, { inputControl: { action: "queue", requestId } });
+    store.saveGlobalRoleMessage(recipient === roleName ? {
+        ...message,
+        notDelivered: { reason: "runtime-needs-attention; retained for user or successor inspection", at: now.toISOString() }
+    } : message);
+}

package/dist/controller/operatorNotification.js

@@ -0,0 +1,31 @@
+import { completeProcessing } from "../coordination/workMailbox.js";
+import { createGlobalRoleMessage } from "../message/message.js";
+/**
+ * Transfer one exact attention claim to the Global Message queue atomically.
+ * Queue ownership is not Provider acceptance or Agent acknowledgement. A failed
+ * or uncertain Message retains its identity/evidence; it is never reissued here.
+ */
+export function queueOperatorNotification(store, input, now = new Date()) {
+    return store.transaction(tx => {
+        const requestId = `operator-notice:${encodeURIComponent(input.receiptId)}`;
+        const previous = tx.listGlobalRoleMessages("operator").find(entry => (entry.inputControl ?? entry.interruptThen?.reusedInput)?.requestId === requestId);
+        const mailbox = tx.getWorkMailbox({ kind: "operator" });
+        const claimed = mailbox?.processing?.batchId === input.batchId;
+        if (previous !== undefined) {
+            if (claimed)
+                tx.saveWorkMailbox(completeProcessing(mailbox, input.batchId));
+            return { status: "already-queued", messageId: previous.id };
+        }
+        if (!claimed)
+            throw new Error(`Operator notification claim changed: ${input.batchId}`);
+        const sessions = tx.getGlobalRoleSessionSet("operator");
+        const session = sessions?.sessions[sessions.activeAgentId];
+        if (session?.status !== "active" || sessions?.providerBinding == null)
+            return { status: "unavailable" };
+        const created = { ...createGlobalRoleMessage(tx.nextGlobalRoleMessageId(), "operator", input.text, "system", { type: "system" }, now, { inputControl: { action: "queue", requestId } }),
+            deliveryTarget: { agentId: session.agentId, nativeSessionId: session.nativeSessionId } };
+        tx.saveGlobalRoleMessage(created);
+        tx.saveWorkMailbox(completeProcessing(mailbox, input.batchId));
+        return { status: "queued", messageId: created.id };
+    });
+}

package/dist/controller/providerRetryAdmission.js

@@ -24,7 +24,9 @@ export function retryIntentBlocker(store, input, retry) {
             return "role-changed";
         if (sessions.sessions[sessions.activeAgentId]?.effective.sourceDesiredRevision !== role.launchRevision)
             return "role-configuration-changed";
-        if (store.listGlobalRoleMessages(input.roleName).some(message => Date.parse(message.createdAt) > Date.parse(retry.intentAt)
+        if (store.listGlobalRoleMessages(input.roleName).some(message => (message.kind === "user" || message.kind === "operator"
+            || message.inputControl !== undefined || message.interruptThen !== undefined)
+            && Date.parse(message.createdAt) > Date.parse(retry.intentAt)
             && message.delivery === undefined && message.notDelivered === undefined))
             return "new-user-input";
         return undefined;

package/dist/controller/providerRetryDelivery.js

@@ -6,9 +6,10 @@ import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 import { redactAgentErrorText } from "../runtime/agentError.js";
 import { AGENT_HOST_CONTROL_PROTOCOL, agentHostControlSocketPath, inspectAgentHostSocket, sendAgentHostRunControl } from "../runtime/agentHost.js";
 import { hasRuntimeCleanupObligation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
-import { cancelProviderRetry, providerRetryAttemptId, providerRetryPending } from "../runtime/providerRetry.js";
+import { cancelProviderRetry, providerRetryAttemptId, providerRetryPending, providerRetryProjection } from "../runtime/providerRetry.js";
 import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
 import { retryIntentBlocker } from "./providerRetryAdmission.js";
+import { recordGlobalRuntimeAttention } from "./globalRuntimeAttention.js";
 /** Hooks in the existing Controller pass and nearest-deadline timer. SQLite's
  * current Provider input is the only pending intent; nothing is queued here. */
 export function createProviderRetryHooks(home, store, ports = {}) {
@@ -45,8 +46,11 @@ export function createProviderRetryHooks(home, store, ports = {}) {
             save({ ...current, providerBinding: exhausted
                     ? { ...cancelled, retry: { ...cancelled.retry, status: "exhausted" } } : cancelled });
             const owner = set.owner;
-            if (owner.scope === "global")
-                settleGlobalRetryInput(store, owner.roleName, load(owner)?.providerBinding, new Date(at));
+            if (owner.scope === "global") {
+                const stopped = load(owner)?.providerBinding;
+                settleGlobalRetryInput(store, owner.roleName, stopped, new Date(at));
+                recordGlobalRuntimeAttention(store, owner.roleName, `${binding.retry.chainId}:stopped`, providerRetryProjection(stopped), new Date(at));
+            }
             if (owner.scope === "task") {
                 const event = createTaskEvent(store.nextEventId(owner.taskId), owner.taskId, "provider.retry-stopped", {
                     roleName: owner.roleName, chainId: binding.retry.chainId, reason
@@ -128,6 +132,9 @@ export function createProviderRetryHooks(home, store, ports = {}) {
                                 return;
                             save({ ...latest, providerBinding: { ...latest.providerBinding,
                                     retry: { ...latest.providerBinding.retry, reason: detail } } });
+                            if (owner.scope === "global") {
+                                recordGlobalRuntimeAttention(store, owner.roleName, `${retry.currentAttemptId}:unconfirmed`, providerRetryProjection(load(owner)?.providerBinding), new Date(at));
+                            }
                             if (owner.scope === "task") {
                                 const event = createTaskEvent(store.nextEventId(owner.taskId), owner.taskId, "provider.retry-unconfirmed", {
                                     roleName: owner.roleName, attemptId: retry.currentAttemptId, nativeSessionId: retry.nativeSessionId, detail

package/dist/controller/runtime.js

@@ -10,7 +10,6 @@ import { effectiveLaunchConfig, resolveEffectiveLaunch, roleSessionMayContinue }
 import { agentProcessReadinessProbe, ExecutorRegistry } from "../executor/executorRegistry.js";
 import { FileRoleLaunchPlanner } from "../executor/fileRoleLaunchPlanner.js";
 import { createKernelPorts } from "../kernel/kernelPorts.js";
-import { createGlobalRoleMessage } from "../message/message.js";
 import { FileTaskWorkspacePreparer } from "../repository/taskWorkspacePreparer.js";
 import { createResourceAutoGc } from "../resources/autoResourceGc.js";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
@@ -117,7 +116,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             store,
             environment: options.environment,
             tmux,
-            nativeConnection: (taskId, roleName) => planner.planNativeControl(taskId, roleName),
+            nativeConnection: (owner) => planner.planNativeControl(owner),
             onWarning: options.onError
         });
         // The runtime inbox is also the low-latency discovery source during a
@@ -252,31 +251,6 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             sessionHost,
             promptPush,
             launchCoordinator,
-            notifyOperatorInputOnce: async (input) => {
-                // The original attention mailbox remains pending until this one
-                // Global Message has an actual Provider receipt. Never inject keys
-                // into a busy Host console and mistake that for accepted attention.
-                const message = store.transaction(tx => {
-                    const requestId = `operator-notice:${encodeURIComponent(input.receiptId)}`;
-                    const previous = tx.listGlobalRoleMessages("operator").find(entry => (entry.inputControl ?? entry.interruptThen?.reusedInput)?.requestId === requestId);
-                    if (previous !== undefined)
-                        return previous;
-                    const sessions = tx.getGlobalRoleSessionSet("operator");
-                    const session = sessions?.sessions[sessions.activeAgentId];
-                    if (session?.status !== "active" || sessions?.providerBinding == null)
-                        return null;
-                    const created = { ...createGlobalRoleMessage(tx.nextGlobalRoleMessageId(), "operator", input.text, "system", { type: "system" }, new Date(), { inputControl: { action: "queue", requestId } }),
-                        deliveryTarget: { agentId: session.agentId, nativeSessionId: session.nativeSessionId } };
-                    tx.saveGlobalRoleMessage(created);
-                    return created;
-                });
-                if (message === null)
-                    return "unavailable";
-                if (message.delivery?.via === "provider")
-                    return "already-sent";
-                runningRuntime?.signal("global-role:operator");
-                return "not-ready";
-            },
             roleResourceInventory: async (panes, inputs) => {
                 const inventory = await scanInventory(panes);
                 return inventory.resources.flatMap((resource) => {

package/dist/controller/sessionOwnerReconciliation.js

@@ -1,11 +1,12 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { createTaskEvent } from "../event/taskEvent.js";
+import { createGlobalRoleMessage } from "../message/message.js";
 import { createSessionOwnerIdentity, isLinuxProcessLive, listOwnedProcessTree, readLinuxProcessIdentity, reconcileSessionOwners, terminateSessionOwners } from "../runtime/index.js";
 import { sessionOwnerProcessKey } from "../runtime/sessionOwnerIdentity.js";
 import { AGENT_HOST_CONTROL_PROTOCOL, sendAgentHostCancelControl } from "../runtime/agentHost.js";
 import { settleProviderTurn, cancelQuiescentProviderInput, clearProviderGoal } from "../runtime/providerRuntimeIdentity.js";
-import { updateTaskRoleProviderRuntime, taskRoleControlTarget } from "../executor/agentExecutor.js";
+import { updateTaskRoleProviderRuntime, updateGlobalRoleProviderRuntime, roleSessionControlTarget } from "../executor/agentExecutor.js";
 import { FileRoleLaunchPlanner } from "../executor/fileRoleLaunchPlanner.js";
 import { stopCodexNativeSession } from "../runtime/nativeSessionControl.js";
 import { routeRoleEvent } from "../scheduler/operatorEvent.js";
@@ -34,8 +35,8 @@ export class SessionOwnerReconciliation {
         this.#tmux = deps.tmux;
         this.#onWarning = deps.onWarning ?? (() => undefined);
         this.#cancelInput = deps.cancelInput ?? sendAgentHostCancelControl;
-        this.#nativeConnection = deps.nativeConnection ?? ((taskId, roleName) => new FileRoleLaunchPlanner(this.#home, this.#store, { environment: this.#environment })
-            .planNativeControl(taskId, roleName));
+        this.#nativeConnection = deps.nativeConnection ?? ((owner) => new FileRoleLaunchPlanner(this.#home, this.#store, { environment: this.#environment })
+            .planNativeControl(owner));
         this.#stopNative = deps.stopNative ?? stopCodexNativeSession;
     }
     /**
@@ -173,33 +174,36 @@ export class SessionOwnerReconciliation {
         };
     }
     async #quiesceInput(owner) {
-        if (owner.scope !== "task")
-            return;
-        if (runtimeCleanupDisposition(this.#store.getWorkMailbox(runtimeLifecycleTarget(owner))) === "detach-host")
+        const disposition = runtimeCleanupDisposition(this.#store.getWorkMailbox(runtimeLifecycleTarget(owner)));
+        if (disposition === "detach-host")
             return;
-        const set = this.#store.getTaskRoleSessionSet(owner.taskId, owner.roleName);
+        const set = owner.scope === "task"
+            ? this.#store.getTaskRoleSessionSet(owner.taskId, owner.roleName)
+            : this.#store.getGlobalRoleSessionSet(owner.roleName);
         const binding = set?.providerBinding;
         const input = binding?.run;
         const unsettled = input != null && ["submitting", "accepted", "delivery-unknown"].includes(input.status);
         const hasGoal = binding?.goal != null && binding.goal.status !== "complete";
-        const selected = taskRoleControlTarget(set);
+        const selected = roleSessionControlTarget(set);
         if (set == null || (!unsettled && !hasGoal && selected?.adapterId !== "codex"))
             return;
         if (selected === undefined) {
             throw new Error("Cannot identify the native execution to stop.");
         }
-        const request = this.#store.listEvents(owner.taskId).filter(event => ["runtime.session-replacement-requested", "runtime.session-stop-requested"].includes(event.type)
+        const request = owner.scope === "task" ? this.#store.listEvents(owner.taskId).filter(event => ["runtime.session-replacement-requested", "runtime.session-stop-requested"].includes(event.type)
             && event.payload.roleName === owner.roleName
-            && event.payload.nativeSessionId === selected.nativeSessionId).at(-1);
-        const operatorStop = this.#store.getTask(owner.taskId)?.executionGate.state === "stopped"
-            || (request !== undefined && ["user", "operator"].includes(request.payload.requestedBy));
+            && event.payload.nativeSessionId === selected.nativeSessionId).at(-1) : undefined;
+        const operatorStop = owner.scope === "global"
+            ? disposition === "end-session" || disposition === "replace-session"
+            : this.#store.getTask(owner.taskId)?.executionGate.state === "stopped"
+                || (request !== undefined && ["user", "operator"].includes(request.payload.requestedBy));
         if (binding?.authority.owner === "human" && !operatorStop) {
             throw new Error("This native Session is under human control; Operator/user must request its stop or replacement.");
         }
         let terminal;
         try {
             const result = unsettled && binding?.authority.owner === "controller" && binding.authority.holderId !== undefined ? await this.#cancelInput({
-                home: this.#home, scope: "task", taskId: owner.taskId, roleName: owner.roleName,
+                home: this.#home, ...owner,
                 control: {
                     protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "cancel",
                     nativeSessionId: selected.nativeSessionId,
@@ -220,7 +224,7 @@ export class SessionOwnerReconciliation {
         }
         if (terminal === undefined || hasGoal || selected.adapterId === "codex") {
             if (selected.adapterId === "codex") {
-                await this.#stopNative(this.#nativeConnection(owner.taskId, owner.roleName), {
+                await this.#stopNative(this.#nativeConnection(owner), {
                     conversationId: selected.nativeSessionId,
                     nativeTurnId: unsettled && terminal === undefined ? input?.nativeTurnId : undefined,
                     clearGoal: true
@@ -237,7 +241,7 @@ export class SessionOwnerReconciliation {
                 }
                 else if (selected.status !== "ended"
                     || records.some(ownerRootIsLive)
-                    || this.#tmux?.probeRoleStatus(owner.taskId, owner.roleName) !== "exited") {
+                    || this.#tmux?.probeRoleStatus(owner.scope === "task" ? owner.taskId : "operator", owner.roleName) !== "exited") {
                     throw new Error("Native process custody is unavailable; inspect the exact local execution before reusing its workspace.");
                 }
             }
@@ -246,9 +250,12 @@ export class SessionOwnerReconciliation {
             }
         }
         this.#store.transaction(tx => {
-            const current = tx.getTaskRoleSessionSet(owner.taskId, owner.roleName);
+            const current = owner.scope === "task"
+                ? tx.getTaskRoleSessionSet(owner.taskId, owner.roleName)
+                : tx.getGlobalRoleSessionSet(owner.roleName);
             const provider = current?.providerBinding;
             if (current == null || provider?.run?.attemptId !== input?.attemptId
+                || provider?.run?.nativeTurnId !== input?.nativeTurnId
                 || (selected.fromBinding
                     ? current.providerBinding?.conversations.find(entry => entry.status === "current")?.conversationId
                     : current.sessions[current.activeAgentId]?.nativeSessionId) !== selected.nativeSessionId
@@ -268,15 +275,26 @@ export class SessionOwnerReconciliation {
                 }
                 if (hasGoal || selected.adapterId === "codex")
                     stopped = clearProviderGoal(stopped);
-                tx.saveTaskRoleSessionSet(updateTaskRoleProviderRuntime(current, stopped, now));
-                tx.saveEvent(owner.taskId, createTaskEvent(tx.nextEventId(owner.taskId), owner.taskId, "runtime.input-stop-confirmed", {
-                    roleName: owner.roleName, ...(input == null ? {} : { attemptId: input.attemptId }),
-                    nativeSessionId: selected.nativeSessionId, status: stopped.run?.status ?? "quiescent",
-                    evidence: terminal === undefined ? "native-resource-inspection" : "native-terminal",
-                    ...(input?.nativeTurnId === undefined ? {} : { nativeTurnId: input.nativeTurnId })
-                }, now));
+                if (owner.scope === "global") {
+                    tx.saveGlobalRoleSessionSet(updateGlobalRoleProviderRuntime(current, stopped, now));
+                    if (unsettled || hasGoal)
+                        tx.saveGlobalRoleMessage(createGlobalRoleMessage(tx.nextGlobalRoleMessageId(), owner.roleName, `Explicit Session stop confirmed: ${JSON.stringify({
+                            nativeSessionId: selected.nativeSessionId, attemptId: input?.attemptId,
+                            nativeTurnId: input?.nativeTurnId, status: stopped.run?.status ?? "quiescent",
+                            evidence: terminal === undefined ? "native-resource-inspection" : "native-terminal"
+                        })}`, "system", { type: "system" }, now));
+                }
+                else {
+                    tx.saveTaskRoleSessionSet(updateTaskRoleProviderRuntime(current, stopped, now));
+                    tx.saveEvent(owner.taskId, createTaskEvent(tx.nextEventId(owner.taskId), owner.taskId, "runtime.input-stop-confirmed", {
+                        roleName: owner.roleName, ...(input == null ? {} : { attemptId: input.attemptId }),
+                        nativeSessionId: selected.nativeSessionId, status: stopped.run?.status ?? "quiescent",
+                        evidence: terminal === undefined ? "native-resource-inspection" : "native-terminal",
+                        ...(input?.nativeTurnId === undefined ? {} : { nativeTurnId: input.nativeTurnId })
+                    }, now));
+                }
             }
-            else if (selected.adapterId === "codex") {
+            else if (selected.adapterId === "codex" && owner.scope === "task") {
                 tx.saveEvent(owner.taskId, createTaskEvent(tx.nextEventId(owner.taskId), owner.taskId, "runtime.input-stop-confirmed", {
                     roleName: owner.roleName, nativeSessionId: selected.nativeSessionId,
                     status: "quiescent", evidence: "native-resource-inspection"