@zq-silk/yui 0.16.1 → 1.0.0-alpha

package/dist/cli/updatePorts.js

@@ -25,15 +25,18 @@
  *    mismatch fails closed.
  */
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { accessSync, constants, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { runtimeError } from "../errors/cliError.js";
 import { isConcreteVersion } from "../domain/validation.js";
+import { parseControllerIdentity } from "../core/controllerIdentity.js";
+import { isMinorStorageUpgrade, isStorageVersion, storageVersionParts } from "../storage/storageVersions.js";
 import { STORAGE_DOCTOR_CHECK_NAMES } from "../doctor/doctor.js";
 import { acquireHandoverLock } from "../release/runtimeRelease.js";
 import { updateStagingRoot } from "../storage/homeLayout.js";
 import { resolveYuiHome } from "../storage/taskStore.js";
+import { UpdateControllerReconciliationError } from "../controller/updateReconciliation.js";
 const PACKAGE_NAME = "@zq-silk/yui";
 const PACKAGE_SPEC = `${PACKAGE_NAME}@latest`;
 function resolveExecutable(command, environmentPath) {
@@ -90,20 +93,20 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
         beginControllerHandover(home) {
             return acquireHandoverLock(home).release;
         },
-        stage(version) {
+        stage(requestedVersion) {
             // A caller that names a version (the release workflow, which freezes the
             // exact version in its plan) installs THAT version — never a moving
             // `latest` that could resolve to a different build than the one the
             // plan authorized. A non-concrete value fails closed rather than being
             // interpolated into an install spec. An omitted version keeps the
             // interactive `yui update` behavior of staging latest.
-            const spec = version === undefined
+            const spec = requestedVersion === undefined
                 ? PACKAGE_SPEC
-                : isConcreteVersion(version)
-                    ? `${PACKAGE_NAME}@${version.trim()}`
+                : isConcreteVersion(requestedVersion)
+                    ? `${PACKAGE_NAME}@${requestedVersion.trim()}`
                     : null;
             if (spec === null) {
-                throw runtimeError(`Refusing to stage a non-concrete version (${String(version)}): only an exact `
+                throw runtimeError(`Refusing to stage a non-concrete version (${String(requestedVersion)}): only an exact `
                     + "major.minor.patch version can be pinned for an update.");
             }
             // The Home staging parent may not exist yet on a Home that has never
@@ -126,6 +129,10 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
                         + "nor `yui --json version` returned a concrete version). Refusing to proceed with a "
                         + "`@latest` fallback that could promote a different build than the one preflighted.");
                 }
+                if (requestedVersion !== undefined && version !== requestedVersion.trim()) {
+                    throw runtimeError(`Requested Yui ${requestedVersion.trim()}, but staged Yui ${version}. `
+                        + "Refusing to activate a different release; the install and storage are unchanged.");
+                }
                 // Successful staging transfers cleanup ownership to runUpdate's finally
                 // block. Every assertion, spawn, npm/network, or version-resolution
                 // failure before that handoff removes the throwaway prefix here.
@@ -196,10 +203,9 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
                     + `but the staged/verified artifact was ${staged.version}. Refusing to trust a `
                     + "different build than the one that passed preflight.");
             }
-            // Existing managed Sessions may have been created by an earlier release.
-            // Retarget those authenticated, Manifest-referenced wrappers to the
-            // activated control plane before the replacement Controller starts so
-            // the update cannot strand a live Session.
+            // Retarget current Manifest-referenced wrappers to the activated
+            // installation before the replacement Controller starts. This relocates
+            // the current shell form; it does not convert historical Session wrappers.
             const sessionCliRefresh = run(activeBinary, ["--json", "internal", "session-cli-refresh"], { cwd: process.cwd(), env: { ...environment, YUI_HOME: home }, shell: false });
             assertSpawnOk(sessionCliRefresh, "refresh managed Session CLI wrappers");
             // Retain the exact path used by both doctor and version verification. The
@@ -214,13 +220,15 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
         },
         // `runUpdate` is intentionally synchronous because the npm/staged-binary
         // ports use spawnSync. A short-lived child owns the async, exactly fenced
-        // reconciliation first; lifecycle capture then uses structured live
+        // reconciliation explicitly; lifecycle capture uses only structured live
         // Controller commands. Tests can replace these seams with deterministic
         // fakes without touching a real Controller.
         controllerStatus(home) {
-            reconcileControllerResourcesForUpdate(home, environment, spawn);
             return readControllerLifecycle(home, environment, spawn);
         },
+        reconcileController(home) {
+            return reconcileControllerResourcesForUpdate(home, environment, spawn);
+        },
         stopController(home, expectedPid) {
             return stopControllerForUpdate(home, expectedPid, environment, spawn);
         },
@@ -501,18 +509,16 @@ function restoreControllerIdentity(home, identity, environment, spawn) {
         "const { spawn } = require('node:child_process');",
         "const values = process.argv.slice(1);",
         "const handoverOwnerPid = Number(values.pop());",
-        "const version = values.pop();",
-        "const args = JSON.parse(values.pop());",
-        "const executable = values.pop();",
+        "const identity = JSON.parse(values.pop());",
         "const home = values.pop();",
         "const runtimeModule = values.pop();",
         "(async () => {",
         "  const { ensureFileTaskControllerIdentity } = await import(runtimeModule);",
-        "  await ensureFileTaskControllerIdentity(home, { executablePath: executable, args, version }, {",
+        "  await ensureFileTaskControllerIdentity(home, identity, {",
         "    environment: process.env,",
         "    handoverOwnerPid,",
         "    spawnController: (_home, launchEnv) => {",
-        "      const child = spawn(executable, args, { detached: true, stdio: 'ignore', env: launchEnv });",
+        "      const child = spawn(identity.executablePath, identity.args, { detached: true, stdio: 'ignore', env: launchEnv });",
         "      child.unref();",
         "    }",
         "  });",
@@ -523,9 +529,7 @@ function restoreControllerIdentity(home, identity, environment, spawn) {
         helper,
         UPDATE_CLIENT_RUNTIME_PATH,
         home,
-        identity.executablePath,
-        JSON.stringify(identity.args),
-        identity.version,
+        JSON.stringify(parseControllerIdentity(identity)),
         String(process.pid)
     ], { cwd: process.cwd(), env: launchEnvironment, shell: false, stdio: "pipe" });
     assertSpawnOk(result, "restore the previously running Controller identity");
@@ -593,14 +597,23 @@ function reconcileControllerResourcesForUpdate(home, environment, spawn) {
         "  process.stdout.write(JSON.stringify({ ok: true, data }));",
         "})().catch((error) => {",
         "  const message = error instanceof Error ? error.message : String(error);",
-        "  process.stderr.write(JSON.stringify({ ok: false, code: 'RUNTIME_ERROR', message }));",
+        "  process.stderr.write(JSON.stringify({ ok: false, code: 'RUNTIME_ERROR', message, result: error.result }));",
         "  process.exitCode = 5;",
         "});"
     ].join(" ");
     const result = spawn(process.execPath, ["-e", helper, UPDATE_CONTROLLER_RECONCILIATION_PATH, home], { cwd: process.cwd(), env: { ...environment, YUI_HOME: home }, shell: false });
     if (result.error !== undefined || result.status !== 0) {
         const detail = structuredErrorMessage(result) ?? result.stderr.toString("utf8").trim();
-        throw new Error(`Controller reconciliation failed (exit ${result.status ?? "null"})${detail.length === 0 ? "." : `: ${detail}`}`);
+        const message = `Controller reconciliation failed (exit ${result.status ?? "null"})${detail.length === 0 ? "." : `: ${detail}`}`;
+        let evidence;
+        try {
+            evidence = JSON.parse(result.stderr.toString("utf8")).result;
+        }
+        catch { /* Unknown child effects are reported below, never retried here. */ }
+        if (isReconciliationResult(evidence, home)) {
+            throw new UpdateControllerReconciliationError(message, evidence);
+        }
+        throw new Error(`${message} Cleanup effects are unknown; inspect the exact Home ${home} before retrying.`);
     }
     let parsed;
     try {
@@ -613,11 +626,19 @@ function reconcileControllerResourcesForUpdate(home, environment, spawn) {
     }
     if (!isRecord(parsed)
         || parsed.ok !== true
-        || !isRecord(parsed.data)
-        || !Array.isArray(parsed.data.cleaned)
-        || parsed.data.cleaned.some((id) => typeof id !== "string")) {
+        || !isReconciliationResult(parsed.data, home)) {
         throw new Error("Controller reconciliation returned an invalid structured result.");
     }
+    return parsed.data;
+}
+function isReconciliationResult(value, home) {
+    return isRecord(value) && value.home === resolve(home)
+        && Array.isArray(value.cleaned) && value.cleaned.every(id => typeof id === "string")
+        && Array.isArray(value.attempts) && value.attempts.every(attempt => (isRecord(attempt) && isRecord(attempt.resource) && typeof attempt.resource.id === "string"
+        && ["cleaned", "absent", "unknown"].includes(String(attempt.outcome))
+        && (attempt.error === undefined || typeof attempt.error === "string")))
+        && Array.isArray(value.remaining) && value.remaining.every(resource => (isRecord(resource) && typeof resource.id === "string"))
+        && ["observedAt", "observationError", "lockReleaseError"].every(key => (value[key] === undefined || typeof value[key] === "string"));
 }
 function structuredErrorMessage(result) {
     for (const buffer of [result.stderr, result.stdout]) {
@@ -633,21 +654,6 @@ function structuredErrorMessage(result) {
     }
     return undefined;
 }
-function parseControllerIdentity(value) {
-    if (typeof value.executablePath !== "string"
-        || value.executablePath.length === 0
-        || !Array.isArray(value.args)
-        || value.args.some((arg) => typeof arg !== "string")
-        || typeof value.version !== "string"
-        || value.version.length === 0) {
-        throw new Error("Authenticated Controller identity is malformed; treating ownership as unknown-active.");
-    }
-    return {
-        executablePath: value.executablePath,
-        args: value.args,
-        version: value.version
-    };
-}
 function controllerErrorCodeFromResult(result) {
     for (const buffer of [result.stdout, result.stderr]) {
         try {
@@ -752,23 +758,22 @@ function assertActivatedControllerIdentity(identity, activatedBinary, activatedV
  * entrypoint derivation as the production startup identity check (P1-1, rr23).
  */
 export function activatedControllerEntrypoint(activatedBinary) {
-    let resolvedBinary;
-    try {
-        resolvedBinary = realpathSync(activatedBinary);
-    }
-    catch {
-        // `verify` already checked existsSync. Keep the fallback deterministic for
-        // test seams and fail closed later if the identity does not match it.
-        resolvedBinary = resolve(activatedBinary);
-    }
+    const resolvedBinary = realpathSync(activatedBinary);
     const direct = join(dirname(resolvedBinary), "controller", "controllerMain.js");
-    if (existsSync(direct))
-        return direct;
     // npm may expose a non-symlink launcher under <prefix>/bin. Resolve the
     // package's canonical global layout when it is present.
     const prefix = resolve(dirname(resolvedBinary), "..");
     const packageEntrypoint = join(prefix, "lib", "node_modules", PACKAGE_NAME, "dist", "controller", "controllerMain.js");
-    return existsSync(packageEntrypoint) ? packageEntrypoint : direct;
+    for (const candidate of [direct, packageEntrypoint]) {
+        if (!existsSync(candidate))
+            continue;
+        const entrypoint = realpathSync(candidate);
+        if (!statSync(entrypoint).isFile()) {
+            throw runtimeError(`Controller entrypoint is not a regular file: ${entrypoint}.`);
+        }
+        return entrypoint;
+    }
+    throw runtimeError(`Controller entrypoint is missing for the activated binary: ${resolvedBinary}.`);
 }
 function interpretPreflight(result) {
     // Require a valid `{ ok:true, data }` success envelope before trusting any
@@ -787,7 +792,7 @@ function interpretPreflight(result) {
     }
     const outcome = typeof data.outcome === "string" ? data.outcome : undefined;
     // EXIT/OUTCOME CONSISTENCY (P1-2): the one success-class internal preflight
-    // outcome must exit 0. A user dry-run, legacy direct classification outcome,
+    // outcome must exit 0. A user dry-run, a direct classification outcome,
     // or any other spelling is not this contract and is never promoted to green.
     if (outcome === "update-preflight" && result.status !== 0) {
         return {
@@ -818,7 +823,6 @@ function interpretPreflight(result) {
             action: "Use a staged binary that supports the update-preflight contract; do not force the update."
         };
     }
-    const blockers = parseUpdateBlockers(data.blockers);
     return {
         status: "blocked",
         stage: typeof data.stage === "string" ? data.stage : "preflight",
@@ -826,8 +830,6 @@ function interpretPreflight(result) {
         action: typeof data.action === "string"
             ? data.action
             : "Resolve the reported condition and retry.",
-        ...(blockers === undefined ? {} : { blockers }),
-        ...(typeof data.retryCommand === "string" ? { retryCommand: data.retryCommand } : {}),
         ...(data.sceneUnchanged === true ? { sceneUnchanged: true } : {})
     };
 }
@@ -841,9 +843,13 @@ function parseUpdatePreflightResult(data) {
     const homeClassification = data.classification;
     if (!isRecord(homeClassification) || !isRecord(homeClassification.classification))
         return null;
+    const from = homeClassification.storageVersion;
+    const to = homeClassification.currentStorageVersion;
+    if (!isStorageVersion(from) || !isStorageVersion(to))
+        return null;
     const classification = homeClassification.classification;
     if (data.status === "already-current") {
-        if (data.stepCount !== 0
+        if (data.stepCount !== 0 || from !== to
             || classification.verdict !== "USABLE"
             || classification.status !== "current")
             return null;
@@ -852,8 +858,17 @@ function parseUpdatePreflightResult(data) {
     if (data.stepCount <= 0
         || classification.verdict !== "MIGRATABLE"
         || classification.status !== "migration-ready"
+        || !isMinorStorageUpgrade(from, to)
         || !data.steps.every(isStorageMigrationStep))
         return null;
+    let previous = from;
+    for (const step of data.steps) {
+        if (step.fromVersion !== previous)
+            return null;
+        previous = step.toVersion;
+    }
+    if (previous !== to)
+        return null;
     return { status: "migration-ready", stepCount: data.stepCount };
 }
 function interpretStorageMigration(result) {
@@ -889,38 +904,13 @@ function interpretStorageMigration(result) {
 }
 function isStorageMigrationStep(value) {
     return isRecord(value)
-        && Number.isSafeInteger(value.fromVersion)
-        && Number.isSafeInteger(value.toVersion)
-        && value.toVersion === value.fromVersion + 1
+        && isStorageVersion(value.fromVersion)
+        && isStorageVersion(value.toVersion)
+        && isMinorStorageUpgrade(value.fromVersion, value.toVersion)
+        && storageVersionParts(value.toVersion).minor === storageVersionParts(value.fromVersion).minor + 1
         && typeof value.name === "string"
         && value.name.length > 0;
 }
-function parseUpdateBlockers(value) {
-    if (value === undefined)
-        return undefined;
-    if (!Array.isArray(value))
-        return undefined;
-    const parsed = [];
-    for (const item of value) {
-        if (!isRecord(item) || typeof item.reason !== "string" || item.reason.length === 0) {
-            return undefined;
-        }
-        const optional = ["taskId", "roleName", "runId", "nativeSessionId"];
-        if (optional.some((key) => item[key] !== undefined && typeof item[key] !== "string")) {
-            return undefined;
-        }
-        parsed.push({
-            ...(typeof item.taskId === "string" ? { taskId: item.taskId } : {}),
-            ...(typeof item.roleName === "string" ? { roleName: item.roleName } : {}),
-            ...(typeof item.runId === "string" ? { runId: item.runId } : {}),
-            ...(typeof item.nativeSessionId === "string"
-                ? { nativeSessionId: item.nativeSessionId }
-                : {}),
-            reason: item.reason
-        });
-    }
-    return parsed;
-}
 /**
  * Extract the validated `data` object from a spawn result's `{ ok: true, data }`
  * JSON envelope, or `null` when the result is not a trustworthy success envelope.

package/dist/cli/upgradeCommand.js

@@ -1,6 +1,7 @@
 /** `yui upgrade` plans or applies the supported linear storage migration chain. */
 import { runStorageUpgrade } from "../storage/upgrade/upgradeOrchestrator.js";
 import { ensureFileTaskController, ensureFileTaskControllerIdentity, stopFileTaskController } from "../controller/clientRuntime.js";
+import { parseControllerIdentity } from "../core/controllerIdentity.js";
 import { callController, ControllerClientError } from "../core/controllerClient.js";
 import { spawn } from "node:child_process";
 import { runtimeError, usageError } from "../errors/cliError.js";
@@ -99,16 +100,11 @@ async function captureUpgradeController(home) {
             return undefined;
         throw error;
     }
-    const identity = value;
-    if (!Number.isSafeInteger(identity.pid) || identity.pid < 1
-        || typeof identity.executablePath !== "string" || !identity.executablePath
-        || !Array.isArray(identity.args) || identity.args.some(arg => typeof arg !== "string")
-        || typeof identity.version !== "string" || !identity.version) {
+    const pid = value?.pid;
+    if (!Number.isSafeInteger(pid) || pid < 1) {
         throw runtimeError("Cannot capture the exact Controller for a reversible upgrade preflight.");
     }
-    return { pid: identity.pid, identity: {
-            executablePath: identity.executablePath, args: identity.args, version: identity.version
-        } };
+    return { pid: pid, identity: parseControllerIdentity(value) };
 }
 async function runUpdateOwnedUpgrade(home, environment) {
     const ownerText = environment.YUI_UPDATE_HANDOVER_OWNER_PID;

package/dist/cli.js

@@ -45,7 +45,7 @@ import { assertTaskDeliveryAuthority, taskLocalActor } from "./task/taskAuthorit
 import { runTaskBaseStatusCommand } from "./commands/taskBaseCommands.js";
 import { runTaskChangeSetCommand } from "./commands/taskChangeSetCommands.js";
 import { assertWorkItemDependenciesCompletedForCommand, dispatchPreparedReviewRound, failPendingReviewRound, parseTaskArchiveArguments, parseTaskCompletionRequest, planReplicatedWorkItemLanes, preflightTaskCompletion, preserveReviewRoundWorkspace, previewTaskRoleAgentConfigurationMutation, requireWorkItemAssignee, runTaskCommand, validateTaskArchiveRequest } from "./commands/taskCommands.js";
-import { reconcileTaskRemoteBaselines, verifyTaskCompletionPublishedTree } from "./commands/taskCompletionGate.js";
+import { verifyTaskCompletionPublishedTree } from "./commands/taskCompletionGate.js";
 import { finalizeStoppedTaskExecution, parseTaskExecutionStartRequest, parseTaskExecutionStopRequest, startTaskExecutionCommand, stopTaskExecutionCommand } from "./commands/taskExecutionCommands.js";
 import { runTaskIntegrationCommand } from "./commands/taskIntegrationCommands.js";
 import { runTaskOverlapCommand } from "./commands/taskOverlapCommands.js";
@@ -100,7 +100,7 @@ import { requireManagedTaskCaller, resolveManagedTaskReader } from "./runtime/ma
 import { assertRuntimeCoherence } from "./runtime/runtimeCoherence.js";
 import { runSetupCommand, validateSetupInvocation } from "./setup/setupCommand.js";
 import { openCurrentTaskStore, validateCurrentTaskStore } from "./storage/currentTaskStore.js";
-import { SqliteSchemaMigrationError } from "./storage/sqliteSchema.js";
+import { SqliteSchemaError } from "./storage/sqliteSchema.js";
 import { inspectStorageSchema } from "./storage/storageSchema.js";
 import { resolveYuiHome } from "./storage/taskStore.js";
 import { renderArchiveDiagnostics, taskArchiveDiagnostics } from "./task/archiveDiagnostics.js";
@@ -141,7 +141,7 @@ void main().catch((error) => {
 });
 function runtimeFailureMessage(error) {
     const message = error instanceof Error ? error.message : String(error);
-    if (!(error instanceof SqliteSchemaMigrationError))
+    if (!(error instanceof SqliteSchemaError))
         return message;
     try {
         return `${message}\n${describeCliHomeInvocation({
@@ -225,9 +225,7 @@ export async function main() {
     if (args[0] === "update") {
         if (jsonOutput)
             throw usageError("Update does not support --json.");
-        if (args.length !== 1)
-            throw usageError("Update usage: yui update");
-        process.exitCode = runUpdateCommand();
+        process.exitCode = runUpdateCommand(args.slice(1));
         return;
     }
     if (args[0] === "release") {
@@ -544,12 +542,9 @@ export async function main() {
             validateCurrentTaskStore(home);
         const controllerMethod = method;
         const updateHandoverOwner = process.env.YUI_UPDATE_HANDOVER_OWNER_PID;
-        // A pre-fix updater cannot pass the owner environment variable to the
-        // activated restart child, but it remains that child's direct parent while
-        // holding the exact handover lock. Inherit only that OS-backed relationship;
-        // every unrelated live lock still compares foreign and fails closed.
+        // Maintenance children must explicitly name their exact lock owner.
         const updateHandoverOwnerPid = updateHandoverOwner === undefined
-            ? (Number.isSafeInteger(process.ppid) && process.ppid > 0 ? process.ppid : undefined)
+            ? undefined
             : Number(updateHandoverOwner);
         if (updateHandoverOwnerPid !== undefined
             && (!Number.isSafeInteger(updateHandoverOwnerPid) || updateHandoverOwnerPid < 1)) {
@@ -1384,6 +1379,8 @@ export async function main() {
             }
             let completionSummary;
             let completionPublishedTreeProof;
+            let completionBaseFreshness;
+            let completionWarnings = [];
             if (resolved[1] === "base" && resolved[2] === "status") {
                 const result = await runTaskBaseStatusCommand(resolved.slice(3), store);
                 emit(result.output, false, result.data);
@@ -1400,8 +1397,8 @@ export async function main() {
             if (resolved[1] === "complete" && resolved[2] !== undefined) {
                 const completionRequest = parseTaskCompletionRequest(resolved.slice(2));
                 completionSummary = completionRequest.summary;
-                const refreshRemote = resolved.includes("--refresh-remote");
-                const completion = preflightTaskCompletion(resolved[2], store, {
+                const refreshRemote = completionRequest.refreshRemote;
+                const completion = preflightTaskCompletion(completionRequest.taskId, store, {
                     environment: process.env,
                     ...(taskFinalReviewContract === undefined
                         ? {}
@@ -1412,34 +1409,25 @@ export async function main() {
                     // Publication proof resolves its exact commit. Without the flag the
                     // command remains offline and preserves the existing proof-first path.
                     const refreshedFreshness = refreshRemote
-                        ? await inspectTaskBaseFreshness(resolved[2], store, { refresh: true })
+                        ? await inspectTaskBaseFreshness(completionRequest.taskId, store, { refresh: true })
                         : undefined;
                     if (completionRequest.acceptedPublishedTreePublicationId !== undefined) {
                         completionPublishedTreeProof = await verifyTaskCompletionPublishedTree(completionRequest.taskId, completionRequest.acceptedPublishedTreePublicationId, store);
                     }
-                    const freshness = refreshedFreshness
-                        ?? await inspectTaskBaseFreshness(resolved[2], store);
-                    for (const warning of assertTaskBaseFreshnessForCompletion(freshness, {
+                    completionBaseFreshness = refreshedFreshness
+                        ?? await inspectTaskBaseFreshness(completionRequest.taskId, store);
+                    completionWarnings = assertTaskBaseFreshnessForCompletion(completionBaseFreshness, {
                         ...(completionPublishedTreeProof === undefined
                             ? {}
                             : {
                                 acceptedPublishedTreeProjectId: completionPublishedTreeProof.projectId
                             })
-                    })) {
+                    });
+                    for (const warning of completionWarnings) {
                         process.stderr.write(`Warning: ${warning}\n`);
                     }
-                    // Keep completion offline by default. An explicit refresh is the only
-                    // path that may fetch and reconcile a moved remote baseline.
-                    if (refreshRemote) {
-                        const reconciled = await reconcileTaskRemoteBaselines(resolved[2], store, home, { environment: process.env, jobPort: createControllerIntegrationJobPort(home, { environment: process.env }) });
-                        if (reconciled.length > 0) {
-                            const updates = reconciled.map((entry) => (`${entry.projectId}: ${entry.fromCommit} -> ${entry.toCommit} `
-                                + `(Integration ${entry.integrationId})`)).join("; ");
-                            throw usageError(`Remote baseline reconciliation advanced Task ${resolved[2]} (${updates}). `
-                                + "The Task remains active so the Leader can inspect the new authoritative head, "
-                                + "decide how prior Review evidence applies, and retry task complete.");
-                        }
-                    }
+                    // Refresh observes remote objects only. Choosing and executing an
+                    // upstream Integration belongs to its explicit command, never completion.
                 }
             }
             let releaseReviewHandoverLock;
@@ -1628,9 +1616,24 @@ export async function main() {
                         emitControlFailure(result.output, failureCode, result.data);
                         return;
                     }
-                    emit(`${result.output}${reviewOutput}`, false, reviewData === undefined
+                    const commandData = reviewData === undefined
                         ? result.data
-                        : { command: result.data, ...reviewData });
+                        : { command: result.data, ...reviewData };
+                    const completionData = resolved[1] === "complete" ? {
+                        // Review dispatch may have advanced or failed after the command
+                        // prepared its Round. Report that observed stage, not preparation.
+                        ...(reviewData === undefined ? {} : {
+                            stage: reviewRoundFromCommandData(reviewData)?.status === "running"
+                                ? "review-running"
+                                : "review-blocked",
+                            projectHeads: result.data.projectHeads
+                        }),
+                        baseFreshness: completionBaseFreshness ?? null,
+                        warnings: completionWarnings
+                    } : undefined;
+                    emit(`${result.output}${reviewOutput}`, false, completionData === undefined
+                        ? commandData
+                        : { ...commandData, ...completionData });
                     return;
                 }
                 if (jsonOutput && result.kind !== "session-stop"
@@ -2431,7 +2434,10 @@ async function executeOperatorSessionControl(control, home, store, runtime, tmux
     await ensureFileTaskController(home, { environment: process.env });
     if (paneRunning
         || (active !== undefined
-            && active.status === "active")) {
+            && active.status === "active")
+        || (sessionSet?.providerBinding?.run != null
+            && ["submitting", "accepted", "delivery-unknown"].includes(sessionSet.providerBinding.run.status))
+        || (sessionSet?.providerBinding?.goal != null && sessionSet.providerBinding.goal.status !== "complete")) {
         await runtime.stopGlobalRoleSession(role.name);
     }
     applyOperatorSessionControl(control, store);

package/dist/commands/controllerCommands.js

@@ -49,7 +49,7 @@ export function renderControllerResourceStatus(snapshot, verbose, width = defaul
             { header: "Reason", minWidth: 12, maxWidth: 30 }
         ], visibleDomains.map((domain) => [
             domain.yuiHome,
-            domain.domainKind ?? "legacy",
+            domain.domainKind ?? "unmarked",
             domain.liveness === undefined
                 ? "—"
                 : `${domain.liveness}/${domain.disposition ?? "review"}`,
@@ -202,7 +202,7 @@ export function renderRuntimeIdentitySection(input) {
         `  Source commit   ${build.sourceCommit}`,
         `  Node            ${build.nodeVersion} (${build.platform})`,
         `  Storage         version ${storage.storageVersion} (status ${storage.storageStatus}, minimum ${storage.minimumStorageVersion}) · backend ${storage.configuredBackend} · worker ${storage.workerEnabled ? "on" : "off"}`,
-        `  Store files     state.json ${storage.physicalStateJson.present ? "present" : "absent"} · yui.db ${storage.physicalDatabase.present ? "present" : "absent"}${storage.physicalDatabase.wal ? " +WAL" : ""}${storage.physicalDatabase.present && storage.physicalDatabase.health !== UNSUPPORTED ? ` (${storage.physicalDatabase.health})` : ""}`
+        `  Store files     yui.db ${storage.physicalDatabase.present ? "present" : "absent"}${storage.physicalDatabase.wal ? " +WAL" : ""}${storage.physicalDatabase.present && storage.physicalDatabase.health !== UNSUPPORTED ? ` (${storage.physicalDatabase.health})` : ""}`
     ];
     for (const finding of storage.findings) {
         lines.push(`  ! ${finding.severity === "contradiction" ? "CONTRADICTION" : finding.severity === "needs-repair" ? "NEEDS-REPAIR" : "warning"} ${finding.code}: ${finding.message}`, `    remediation: ${finding.remediation}`);

package/dist/commands/executionAuditCommands.js

@@ -258,8 +258,8 @@ export function renderExecutionAudit(report, width = defaultTableWidth()) {
     }
     if (report.storage.status === "ok" && report.storage.data !== undefined) {
         const storage = report.storage.data;
-        lines.push("", `Storage: backend ${storage.backend} · state.json ${formatBytes(storage.stateJsonBytes)} · yui.db ${formatBytes(storage.databaseBytes)}`
-            + ` · runtime/ ${formatBytes(storage.runtimeDirBytes)} · deployments ${formatBytes(storage.deploymentsBytes)}`);
+        lines.push("", `Storage: backend ${storage.backend} · yui.db ${formatBytes(storage.databaseBytes)}`
+            + ` · runtime/ ${formatBytes(storage.runtimeDirBytes)}`);
     }
     else {
         lines.push("", ...sectionError("storage", report));

package/dist/commands/projectCommands.js

@@ -238,7 +238,7 @@ async function cloneProject(args, store, options) {
     // A remote-URL binding is Home-managed by default: its canonical repository
     // lives below the persistent Home, so the runtime never depends on a
     // user-controlled checkout path. --external is an explicit opt-in to the
-    // legacy clone-inside-the-workspace mode.
+    // user-owned clone-inside-the-workspace mode.
     let destination;
     let ownership;
     if (parsed.external) {

package/dist/commands/releaseCommands.js

@@ -341,55 +341,26 @@ export function createReleaseActivatePorts(overrides = {}) {
             }),
         runPreflight: overrides.runPreflight ?? ((releaseDir, home) => {
             const cli = join(releaseDir, "dist", "cli.js");
-            const result = spawnSync(process.execPath, [cli, "doctor", "--json"], {
+            // The target owns current-record and database integrity validation.
+            // Activation never migrates; a valid but older Home still blocks here.
+            const result = spawnSync(process.execPath, [cli, "--json", "upgrade", "--update-preflight"], {
                 env: { ...process.env, YUI_HOME: home, NO_COLOR: "1" },
                 encoding: "utf8",
                 timeout: 60_000
             });
             let report;
             try {
-                const envelope = JSON.parse(result.stdout);
-                report = envelope.data;
+                report = JSON.parse(result.stdout);
             }
             catch (error) {
                 throw new Error(`Release preflight produced no JSON (exit ${result.status}): `
                     + `${messageOf(error)} ${result.stderr.trim()}`);
             }
-            // The handover preflight must prove the exact current Home contract.
-            // Older, newer, malformed, or incomplete Homes all fail closed and are
-            // never normalized by release activation.
-            const checks = report?.checks;
-            if (!Array.isArray(checks)) {
-                throw new Error("Release preflight report has no storage checks.");
-            }
-            const required = ["storage compatibility"];
-            const failed = required.filter((name) => {
-                const check = checks.find((candidate) => candidate !== null
-                    && typeof candidate === "object"
-                    && candidate.name === name);
-                return check === undefined
-                    || check.status !== "ok";
-            });
-            if (failed.length > 0) {
-                throw new Error(`Release preflight storage compatibility checks failed: ${failed.join(", ")}.`);
-            }
-            // Doctor proves the target's storage, not the pinned code in existing
-            // Hosts. Ask the target's upgrade boundary for its independent Host
-            // protocol proof as well; release activation itself still never migrates.
-            const hostCheck = spawnSync(process.execPath, [cli, "--json", "upgrade", "--update-preflight"], {
-                env: { ...process.env, YUI_HOME: home, NO_COLOR: "1" },
-                encoding: "utf8", timeout: 60_000
-            });
-            let preflight;
-            try {
-                preflight = JSON.parse(hostCheck.stdout).data;
-            }
-            catch {
-                throw new Error(`Release Host preflight produced no JSON: ${hostCheck.stderr.trim()}`);
-            }
-            if (hostCheck.status !== 0 || preflight?.outcome !== "update-preflight"
-                || preflight.status !== "already-current") {
-                throw new Error(`Release Host compatibility preflight failed: ${preflight?.message ?? preflight?.status ?? "unknown"}. ${preflight?.action ?? ""}`);
+            if (result.status !== 0 || report?.ok !== true
+                || report.data?.outcome !== "update-preflight"
+                || report.data.status !== "already-current") {
+                throw new Error(`Release storage preflight failed: ${report?.data?.message ?? report?.data?.status ?? "invalid response"}. `
+                    + `${report?.data?.action ?? result.stderr.trim()}`);
             }
         }),
         killOwnedProcess: overrides.killOwnedProcess ?? ((owner) => {