@zq-silk/yui 0.16.1 → 1.0.0-alpha

package/dist/controller/controller.js

@@ -143,7 +143,7 @@ export async function runControllerSchedulerPass(store, delivery, now, workspace
         }));
         const laterWakeups = await processLeaderWakeups(store, delivery, now, exactTaskSelection(laterWakeupTaskIds));
         const inputNotifications = includeOperator
-            ? await processOperatorInputNotifications(store, delivery, selection, now)
+            ? await processOperatorInputNotifications(store, selection, now)
             : [];
         return {
             activeRunDeliveries,
@@ -948,6 +948,18 @@ export class FileTaskController {
     #requestBackgroundPump() {
         void this.pump().catch(this.#onError);
     }
+    /** Optional maintenance is not execution admission. Keep its failure visible
+     * without bypassing the scheduler's own ownership and delivery fences. */
+    async #observeMaintenance(phase, action) {
+        try {
+            return await action();
+        }
+        catch (error) {
+            this.#onError(new Error(`${phase} failed: ${error instanceof Error ? error.message : String(error)}. `
+                + "No successful cleanup or quiescence is inferred; inspect the original failure.", { cause: error }));
+            return undefined;
+        }
+    }
     async #runCoalesced() {
         let result = emptyControllerSchedulerResult();
         let pendingRuntimeDrain = false;
@@ -966,15 +978,15 @@ export class FileTaskController {
                     if (scope.kind === "full")
                         this.reloadReconciliationInterval();
                     if (scope.kind === "full" && this.#resourceReaper !== undefined) {
-                        const reap = await this.#resourceReaper();
-                        for (const failure of reap.failed) {
+                        const reap = await this.#observeMaintenance("Ephemeral runtime reap", this.#resourceReaper);
+                        for (const failure of reap?.failed ?? []) {
                             this.#onError(new Error(`Ephemeral runtime reap failed for ${failure.id}: ${failure.message}`));
                         }
                         // The reaper owns the exact resource fences. Once a whole expired
                         // domain converges, let the detached Controller close itself on a
                         // later turn; never close while this reconciliation pass is still
                         // the in-flight server request.
-                        if (reap.failed.length === 0 && (reap.expiredDomains?.length ?? 0) > 0) {
+                        if (reap !== undefined && reap.failed.length === 0 && (reap.expiredDomains?.length ?? 0) > 0) {
                             for (const domain of reap.expiredDomains ?? []) {
                                 queueMicrotask(() => {
                                     this.#onExpiredEphemeralDomain?.(domain);
@@ -992,7 +1004,7 @@ export class FileTaskController {
                     // full pass. It queries only identities already present in Task
                     // facts and cannot start a model AgentRun or scan unknown children.
                     if (scope.kind === "full" && this.#continuationReconciler !== undefined) {
-                        await this.#continuationReconciler.reconcile(this.#now());
+                        await this.#observeMaintenance("Continuation reconciliation", () => this.#continuationReconciler.reconcile(this.#now()));
                     }
                     // DurableJob reconciliation runs before the scheduler pass so a
                     // terminal job's Leader wakeup is enqueued in the same pass that
@@ -1407,18 +1419,20 @@ export class FileTaskController {
             else if (wakeup.status === "dispatched")
                 settled.add(key);
         }
-        const operatorRetries = result.inputNotifications.filter((notification) => notification.reason === "operator-not-ready"
-            || (notification.reason === "operator-unavailable"
-                && this.#operatorStartupRetryArmed));
+        const operatorRetries = result.inputNotifications.filter((notification) => notification.reason === "operator-unavailable"
+            && this.#operatorStartupRetryArmed);
         if (operatorRetries.length > 0) {
             retry.set("operator", {
                 identity: operatorRetries.map((notification) => (`${notification.sourceKind}:${notification.taskId}:${notification.sourceId}`)).join("|")
             });
         }
-        else if (result.inputNotifications.some((notification) => notification.status === "sent"
-            || notification.status === "already-sent")) {
+        else if (result.inputNotifications.some((notification) => notification.status === "queued"
+            || notification.status === "already-queued")) {
             this.#operatorStartupRetryArmed = false;
             settled.add("operator");
+            // The Global queue owns delivery now. Request its next pass without
+            // retaining a second attention retry loop while the Provider is busy.
+            resignal.add("global-role:operator");
         }
         for (const key of settled)
             this.#clearDeliveryRetry(key);

package/dist/controller/fileSchedulerStoreAdapter.js

@@ -5,17 +5,17 @@ import { freezeRunContextSnapshot } from "../context/runContextPack.js";
 import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 import { interruptThenTerminalState, prepareMessageContinuations } from "../message/messageContinuation.js";
 import { assertExecutionEnvironmentCurrent } from "../runtime/executionEnvironment.js";
-import { deferProviderRetry, providerRetryPending, recordProviderFailure } from "../runtime/providerRetry.js";
+import { deferProviderRetry, providerRetryPending, providerRetryProjection, recordProviderFailure } from "../runtime/providerRetry.js";
 import { AgentHostObservationDeferred, recordAgentHostConnection, resolveAgentHostObservation } from "./agentHostObservation.js";
 import { admitOwnedProviderInput, ownedProviderInput } from "./providerRetryAdmission.js";
 import { RuntimeHookRunFenceError } from "./runtimeHookRunFence.js";
-import { appendRunInput, createRun, runPurposeAdmitsTaskState, withRunContextSnapshot } from "../agentRun/agentRun.js";
+import { appendRunInput, createRun, runPurposeAdmitsTaskState } from "../agentRun/agentRun.js";
 import { createRunInput } from "../context/runInputContract.js";
 import { bindExecution, claimPending, completeProcessing, consumePendingBatch, mailboxHasWork, releaseProcessing } from "../coordination/workMailbox.js";
 import { enqueueWork, settleRoleRunDispatch as settleRoleRunDispatchMailbox } from "../coordination/workMailboxQueue.js";
 import { transportAgentResult } from "../domain/agentResultTransport.js";
 import { createTaskEvent } from "../event/taskEvent.js";
-import { activeLiveRoleAgentSession, bindGlobalRoleProviderRuntime, bindTaskRoleProviderRuntime, createRoleSessionSet, detachRoleAgentSessionHost, recordRoleAgentSession, recordTaskRoleNativeTurnBoundary, rememberRoleAgentCompletedTurn, replaceTaskRoleAgentSession, selectNewTaskRoleSession, taskRoleControlTarget, updateGlobalRoleProviderRuntime, updateRoleAgentSessionStatus, updateTaskRoleProviderRuntime } from "../executor/agentExecutor.js";
+import { activeLiveRoleAgentSession, bindGlobalRoleProviderRuntime, bindTaskRoleProviderRuntime, createRoleSessionSet, detachRoleAgentSessionHost, recordRoleAgentSession, recordTaskRoleNativeTurnBoundary, rememberRoleAgentCompletedTurn, replaceTaskRoleAgentSession, selectNewTaskRoleSession, roleSessionControlTarget, updateGlobalRoleProviderRuntime, updateRoleAgentSessionStatus, updateTaskRoleProviderRuntime } from "../executor/agentExecutor.js";
 import { effectiveLaunchWithTaskMainWorkspace, resolveEffectiveLaunch, roleSessionMayContinue, validateEffectiveLaunchSnapshot } from "../executor/effectiveLaunch.js";
 import { answerInputRequest } from "../input/inputRequest.js";
 import { createCanonicalLifecycleEvent, foldCanonicalLifecycleEvent } from "../lifecycle/canonicalLifecycleEvent.js";
@@ -26,6 +26,8 @@ import { activeRoleAgentBinding } from "../role/role.js";
 import { SYSTEM_OPERATOR_ROLE } from "../role/systemRoles.js";
 import { standardAgentError } from "../runtime/agentError.js";
 import { recordTaskAgentError } from "./taskAgentError.js";
+import { recordGlobalRuntimeAttention, recordGlobalRuntimeFailure } from "./globalRuntimeAttention.js";
+import { queueOperatorNotification } from "./operatorNotification.js";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
 import { RUNTIME_CLEANUP_REQUIRED_REASON, RUNTIME_HOST_DETACH_REQUIRED_REASON, RUNTIME_LIFECYCLE_OWNER, hasRuntimeCleanupObligation, hasRuntimeLifecycleWork, isRuntimeCleanupReason, runtimeCleanupDisposition, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { classifyRuntimeProcessExit, validateRuntimeProcessExitObservation } from "../runtime/processExitObservation.js";
@@ -384,6 +386,16 @@ export class FileSchedulerStoreAdapter {
             const matches = receipt !== undefined && binding.run?.attemptId === receipt
                 && (fence.nativeTurnId === undefined || binding.run.nativeTurnId === undefined
                     || binding.run.nativeTurnId === fence.nativeTurnId);
+            if ((input.kind === "observer.health" || input.kind === "conversation.observed") && input.payload.failure !== undefined) {
+                if (receipt !== undefined && !matches)
+                    return "obsolete";
+                recordGlobalRuntimeAttention(store, fence.roleName, input.eventId, {
+                    fence, failure: input.payload.failure,
+                    confirmed: binding.run?.status ?? "no-owned-input",
+                    unknown: "Native execution outcome and resource quiescence are not proven by this diagnostic."
+                }, now);
+                return "applied";
+            }
             if (input.kind === "turn.accepted") {
                 if (input.authority === "transport" && matches) {
                     const message = store.listGlobalRoleMessages(fence.roleName).find(entry => receipt === `global-input:${fence.roleName}/${entry.id}`);
@@ -456,12 +468,27 @@ export class FileSchedulerStoreAdapter {
                 binding = updateProviderConversationRecoverability(binding, input.payload.recoverability);
             }
             if (input.kind === "turn.failed" && matches && input.payload.failure !== undefined) {
+                const failureRef = recordGlobalRuntimeFailure(store, fence.roleName, input.eventId, {
+                    fence, failure: input.payload.failure,
+                    chainId: binding.retry?.chainId ?? receipt,
+                    attempts: binding.retry?.attempts ?? 0,
+                    confirmed: "Native Turn failed. Prior side effects are not undone.",
+                    unknown: "External effects and remaining unfinished work."
+                }, now);
                 binding = recordProviderFailure(binding, {
-                    error: input.payload.failure.error, failureRef: input.eventId, at: now.getTime()
+                    error: input.payload.failure.error, failureRef, at: now.getTime()
                 });
             }
             store.saveGlobalRoleSessionSet(updateGlobalRoleProviderRuntime(sessions, binding, now));
             settleGlobalRetryInput(store, fence.roleName, binding, now);
+            if (input.kind === "turn.failed" && matches && input.payload.failure !== undefined
+                && !providerRetryPending(binding)) {
+                recordGlobalRuntimeAttention(store, fence.roleName, input.eventId, {
+                    fence, failure: input.payload.failure, retry: providerRetryProjection(binding),
+                    confirmed: "Native Turn failed; this does not prove absence of prior side effects.",
+                    unknown: "External effects must be inspected before continuing."
+                }, now);
+            }
             return "applied";
         });
     }
@@ -518,11 +545,19 @@ export class FileSchedulerStoreAdapter {
                     && (native.nativeTurnId === undefined || native.nativeTurnId === input.fence.nativeTurnId)
                     ? "applied" : "obsolete";
             }
-            const knownContinuation = input.kind.startsWith("continuation.") && projectProviderContinuations(store.listEvents(input.fence.taskId)).some((entry) => (entry.runId === input.fence.runId
-                && entry.identity.providerNamespace === input.fence.driverId
-                && entry.identity.accountScope === input.fence.agentId
-                && entry.identity.conversationId === input.fence.conversationId
-                && entry.identity.continuationId === input.fence.continuationId));
+            const knownContinuation = (input.kind.startsWith("continuation.") || input.kind === "observer.health")
+                && projectProviderContinuations(store.listEvents(input.fence.taskId)).some((entry) => (entry.runId === input.fence.runId
+                    && entry.identity.providerNamespace === input.fence.driverId
+                    && entry.identity.accountScope === input.fence.agentId
+                    && entry.identity.conversationId === input.fence.conversationId
+                    && entry.identity.continuationId === input.fence.continuationId));
+            if (input.kind === "observer.health" && input.payload.failure !== undefined) {
+                const native = sessions?.providerBinding?.run;
+                return knownContinuation || session?.nativeSessionId === input.fence.nativeSessionId
+                    && (input.fence.receiptId === undefined || native?.attemptId === input.fence.receiptId
+                        && (input.fence.nativeTurnId === undefined || native.nativeTurnId === input.fence.nativeTurnId))
+                    ? "applied" : "obsolete";
+            }
             const requiresCurrentRuntime = input.kind !== "turn.cancelled" && !knownContinuation;
             const valid = run !== null && (!requiresCurrentRuntime || (run.status === "active" && active?.id === run.id)) && run.roleName === input.fence.roleName && run.effective.agentId === input.fence.agentId && this.drivers.requireByAdapterId(run.effective.adapterId).id === input.fence.driverId && (knownContinuation || (session !== undefined && session.nativeSessionId === input.fence.nativeSessionId)) && runtimeReceiptBelongsToRun(store, input);
             if (!valid) {
@@ -600,7 +635,7 @@ export class FileSchedulerStoreAdapter {
                 const key = providerContinuationKey(continuation.identity);
                 const identityDigest = createHash("sha256").update(key).digest("hex");
                 const detached = createRuntimeObservation({
-                    schemaVersion: 4,
+                    schemaVersion: 1,
                     eventId: `derived-continuation-detached:${identityDigest}`,
                     semanticKey: `continuation-detached:${identityDigest}`,
                     kind: "continuation.started",
@@ -689,7 +724,7 @@ export class FileSchedulerStoreAdapter {
                         .update(`${input.semanticKey}\u0000${identityKey}`)
                         .digest("hex");
                     const settled = createRuntimeObservation({
-                        schemaVersion: 4,
+                        schemaVersion: 1,
                         eventId: `native-snapshot-settled:${digest}`,
                         semanticKey: `native-snapshot-settled:${digest}`,
                         kind: "continuation.settled",
@@ -733,7 +768,7 @@ export class FileSchedulerStoreAdapter {
                     ? "provider-goal-cleared"
                     : `provider-goal-${input.payload.goalStatus}`, now);
             }
-            if (input.kind === "turn.failed" && input.payload.failure !== undefined) {
+            if (["turn.failed", "observer.health", "conversation.observed"].includes(input.kind) && input.payload.failure !== undefined) {
                 const failure = input.payload.failure;
                 const error = failure.error;
                 const run = input.fence.runId === undefined
@@ -753,10 +788,12 @@ export class FileSchedulerStoreAdapter {
                         runId: input.fence.runId,
                         nativeSessionId: input.fence.nativeSessionId,
                         nativeTurnId: input.fence.nativeTurnId,
+                        attemptId: input.fence.receiptId,
                         lastOutput: failure.lastOutput
                     },
                 }, now);
-                if (created && !providerRetryPending(store.getTaskRoleSessionSet(taskId, input.fence.roleName)?.providerBinding))
+                if (created && (input.kind !== "turn.failed"
+                    || !providerRetryPending(store.getTaskRoleSessionSet(taskId, input.fence.roleName)?.providerBinding)))
                     routeRoleEvent(store, errorEvent, input.fence.roleName, wakeReason("agent-error", errorEvent.id), now);
             }
             if ((input.kind === "operation.completed" || input.kind === "operation.failed")
@@ -857,6 +894,9 @@ export class FileSchedulerStoreAdapter {
     getActiveRun(taskId, roleName) {
         return this.store.getActiveRun(taskId, roleName);
     }
+    getContextSnapshot(taskId, snapshotId) {
+        return this.store.getContextSnapshot(taskId, snapshotId);
+    }
     hasOpenInputRequest(taskId) {
         return this.store.listOpenInputRequests([taskId]).length > 0;
     }
@@ -879,8 +919,8 @@ export class FileSchedulerStoreAdapter {
             adapterId: effectiveSession.effective.adapterId
         };
     }
-    markOperatorRunStarted(now) {
-        void now;
+    queueOperatorNotification(input, now) {
+        return queueOperatorNotification(this.store, input, now);
     }
     resolveExpiredInputRecommendations(now, taskIds) {
         return this.store.transaction((store) => {
@@ -1224,8 +1264,26 @@ export class FileSchedulerStoreAdapter {
                 let resolved = settleProviderTurnSubmission(binding, { attemptId: input.attemptId, status: input.status,
                     reason: input.reason, resolvedAt: input.now.toISOString() });
                 resolved = this.retrySubmissionResolution(resolved, input, sessions.sessions[sessions.activeAgentId]?.adapterId);
+                if (input.status !== "deferred" && resolved.run?.failure !== undefined) {
+                    const failureRef = recordGlobalRuntimeFailure(store, input.roleName, `${input.attemptId}:submission`, {
+                        nativeSessionId: currentProviderConversation(resolved).conversationId,
+                        attemptId: input.attemptId, status: input.status, failure: resolved.run.failure,
+                        chainId: resolved.retry?.chainId ?? input.attemptId, attempts: resolved.retry?.attempts ?? 0
+                    }, input.now);
+                    resolved = { ...resolved, run: { ...resolved.run, failure: { ...resolved.run.failure, ref: failureRef } },
+                        ...(resolved.retry?.failedAttemptId === input.attemptId
+                            ? { retry: { ...resolved.retry, failureRef } } : {}) };
+                }
                 store.saveGlobalRoleSessionSet(updateGlobalRoleProviderRuntime(sessions, resolved, input.now));
                 settleGlobalRetryInput(store, input.roleName, resolved, input.now);
+                if (input.status !== "deferred" && !providerRetryPending(resolved)) {
+                    recordGlobalRuntimeAttention(store, input.roleName, `${input.attemptId}:submission`, {
+                        nativeSessionId: currentProviderConversation(resolved).conversationId,
+                        attemptId: input.attemptId, status: input.status,
+                        failure: resolved.run?.failure, retry: providerRetryProjection(resolved),
+                        unknown: "External effects are not established by submission settlement."
+                    }, input.now);
+                }
                 const message = store.listGlobalRoleMessages(input.roleName).find(entry => input.attemptId === `global-input:${input.roleName}/${entry.id}`);
                 if (message !== undefined && message.delivery?.via !== "provider") {
                     const outcome = input.status === "delivery-unknown" ? "delivery-unknown" : "rejected";
@@ -1681,15 +1739,17 @@ export class FileSchedulerStoreAdapter {
             const mailbox = store.getWorkMailbox(target);
             if (mailbox?.pending == null || mailbox.processing !== null)
                 return false;
+            const snapshot = freezeRunContextSnapshot(store, {
+                taskId, roleName: "leader", purpose: "planning"
+            }, now);
             const run = createRun(store.nextRunId(taskId), taskId, "leader", "new", createRunInput({ source: { type: "yui", channel: "task-dispatch" },
                 directive: `Plan Task ${taskId} with the user. Persist requirements and decisions. Request activation explicitly; planning grants no delivery authority.`,
+                contextSnapshotRef: contextSnapshotRef(snapshot),
                 deltaRefIds: [] }), now, {
                 purpose: "planning", effective: resolveEffectiveLaunch({ role, purpose: "planning" })
             });
-            const snapshot = freezeRunContextSnapshot(store, run, now);
-            const frozen = withRunContextSnapshot(run, contextSnapshotRef(snapshot));
-            store.saveRun(frozen);
-            store.saveActiveRun(frozen);
+            store.saveRun(run);
+            store.saveActiveRun(run);
             // Freeze the initial notification prefix against this planning Run.
             // Later messages remain pending; acceptance or an exact terminal settles
             // only this batch, so a failed initial launch cannot replay it forever.
@@ -2211,7 +2271,7 @@ export class FileSchedulerStoreAdapter {
                 && event.payload.observationId === observationId)))
                 return;
             const observation = validateRuntimeProcessExitObservation({
-                schemaVersion: 2,
+                schemaVersion: 1,
                 observationId,
                 hostSequence: 1,
                 hostInstanceId: `tmux-${input.roleName}`,
@@ -2256,6 +2316,13 @@ export class FileSchedulerStoreAdapter {
                 recordCanonicalObservationObsolete(store, input, "provider-conversation-mismatch", now);
                 return "obsolete";
             }
+            if (input.payload.failure !== undefined) {
+                // A diagnostic without an owned Turn describes this exact connection,
+                // not a new recoverability observation or proof of resource release.
+                return sessions.activeAgentId === input.fence.agentId
+                    && sessions.sessions[input.fence.agentId]?.nativeSessionId === input.fence.nativeSessionId
+                    ? "applied" : "obsolete";
+            }
             try {
                 if (input.kind === "conversation.observed") {
                     binding = updateProviderConversationRecoverability(binding, input.payload.recoverability);
@@ -2653,7 +2720,7 @@ export class FileSchedulerStoreAdapter {
             // this Global Role, settle it to the observed terminal so the scope-generic
             // resolver and the interrupt-then gate see the real stop on the live binding
             // — the same edge Task settles via settleStructuredProviderTurn. This is a
-            // strict guarded no-op for an older unmanaged Session or a
+            // strict guarded no-op for a Session without a controlled binding or a
             // binding holding a different/already-terminal Turn, and the
             // durable native terminal recorded just above remains the proof of record.
             current = settleGlobalRoleRuntimeTurn(current, input.nativeTurnId, input.providerStatus, now);
@@ -2864,7 +2931,7 @@ function dormantRuntimeCandidateIsCurrent(store, candidate, allowActiveRun = fal
     }
     const sessions = runtimeOwnerSessionSet(store, owner);
     const active = allowActiveRun && owner.scope === "task"
-        ? taskRoleControlTarget(store.getTaskRoleSessionSet(owner.taskId, owner.roleName))
+        ? roleSessionControlTarget(store.getTaskRoleSessionSet(owner.taskId, owner.roleName))
         : sessions?.sessions[sessions.activeAgentId];
     return active !== undefined && active.agentId === candidate.agentId && active.adapterId === candidate.adapterId
         && active.nativeSessionId === candidate.nativeSessionId && (allowActiveRun || active.updatedAt === candidate.sessionUpdatedAt);
@@ -3416,12 +3483,12 @@ function settleStructuredProviderTurn(sessions, runId, status, now, attemptId) {
  * It is a strict guarded no-op unless a controller-owned Turn with that exact
  * native id is bound and still in flight (`accepted`) — an absent binding, a
  * different/only-submitting Turn, or an already-terminal one is left untouched, so
- * an older unmanaged Session without a controlled binding settles nothing
+ * a Session without a controlled binding settles nothing
  * and the durable `recentCompletedTurnIds` terminal remains the proof of record.
  */
 function settleGlobalRoleRuntimeTurn(sessions, nativeTurnId, status, now) {
     const binding = sessions.providerBinding;
-    if (binding === null || binding === undefined || binding.run === null
+    if (binding === null || binding.run === null
         || binding.run.nativeTurnId !== nativeTurnId
         || binding.run.status !== "accepted") {
         return sessions;

package/dist/controller/globalInputDelivery.js

@@ -13,6 +13,10 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             if (pending.length === 0 || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name }))))
                 continue;
             let sessions = store.getGlobalRoleSessionSet(role.name);
+            // A detached Host keeps an active Session and may reconnect. An explicit
+            // Session stop/switch must not be undone by background notification work.
+            if (sessions !== null && sessions.sessions[sessions.activeAgentId]?.status !== "active")
+                continue;
             if (sessions?.providerBinding?.retry !== undefined && !providerRetryPending(sessions.providerBinding)) {
                 store.transaction(tx => settleGlobalRetryInput(tx, role.name, tx.getGlobalRoleSessionSet(role.name)?.providerBinding, new Date()));
                 pending = store.listGlobalRoleMessages(role.name).filter(message => message.delivery === undefined && message.notDelivered === undefined
@@ -37,6 +41,9 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
                 continue;
             if (current != null && ["submitting", "accepted", "delivery-unknown"].includes(current.status))
                 continue;
+            const matchesTarget = (message) => message.deliveryTarget === undefined
+                || sessions?.activeAgentId === message.deliveryTarget.agentId
+                    && sessions.sessions[message.deliveryTarget.agentId]?.nativeSessionId === message.deliveryTarget.nativeSessionId;
             const claims = pending.filter(message => message.interruptThen !== undefined);
             let next;
             if (claims.length > 0) {
@@ -54,22 +61,36 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
                 if (next === undefined)
                     continue;
             }
-            else
-                next = pending[0];
+            else {
+                // Retain each stale original with its exact failure, but do not spend
+                // one reconciliation interval per unsent notice before reaching user
+                // input for the successor. An existing attempt/uncertain control still
+                // fences the queue; target mismatch alone is not non-acceptance.
+                next = pending.find(message => {
+                    if (matchesTarget(message)
+                        || current?.attemptId === `global-input:${role.name}/${message.id}`
+                        || message.control !== undefined && message.control.outcome !== "rejected")
+                        return true;
+                    store.updateGlobalRoleMessage(markGlobalRoleMessageNotDelivered(message, "native-session-changed", new Date()));
+                    return false;
+                });
+            }
+            if (next === undefined)
+                continue;
             const attemptId = `global-input:${role.name}/${next.id}`;
             if (current?.attemptId === attemptId)
                 continue;
             if (next.control !== undefined && next.control.outcome !== "rejected")
                 continue;
-            const matchesTarget = () => next.deliveryTarget === undefined
-                || sessions?.activeAgentId === next.deliveryTarget.agentId
-                    && sessions.sessions[next.deliveryTarget.agentId]?.nativeSessionId === next.deliveryTarget.nativeSessionId;
-            if (!matchesTarget()) {
+            if (!matchesTarget(next)) {
                 store.updateGlobalRoleMessage(markGlobalRoleMessageNotDelivered(next, "native-session-changed", new Date()));
                 continue;
             }
             await ensure(role.name);
             sessions = store.getGlobalRoleSessionSet(role.name);
+            if (hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name })))
+                || sessions?.sessions[sessions.activeAgentId]?.status !== "active")
+                continue;
             const binding = sessions?.providerBinding;
             if (binding == null || binding.authority.owner !== "controller")
                 continue;
@@ -78,7 +99,7 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             if (persisted === undefined || JSON.stringify(persisted) !== JSON.stringify(next))
                 continue;
             const claim = next.interruptThen;
-            if (!matchesTarget() || claim !== undefined
+            if (!matchesTarget(next) || claim !== undefined
                 && (sessions?.activeAgentId !== claim.targetAgentId
                     || nativeSessionId !== claim.targetNativeSessionId
                     || binding.authority.epoch !== claim.targetAuthorityEpoch
@@ -126,7 +147,9 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             }
         }
         catch (error) {
-            onError(error);
+            onError(new Error(`Global input delivery failed for ${role.name}: `
+                + `${error instanceof Error ? error.message : String(error)}. `
+                + "Inspect the persisted Message and attempt before retrying; delivery is not inferred.", { cause: error }));
         }
     }
 }

package/dist/controller/globalRuntimeAttention.js

@@ -0,0 +1,34 @@
+import { createHash } from "node:crypto";
+import { createGlobalRoleMessage } from "../message/message.js";
+import { serializeAgentErrorRaw } from "../runtime/agentError.js";
+/** Global observations have no Task event history. Keep original failed
+ * attempts as ordinary record-only Messages before replacing the live binding. */
+export function recordGlobalRuntimeFailure(store, roleName, identity, facts, now) {
+    const header = `Yui Global failure evidence ${createHash("sha256").update(identity).digest("hex")}\n`;
+    const previous = store.listGlobalRoleMessages(roleName).find(message => message.kind === "system" && message.body.startsWith(header));
+    if (previous !== undefined)
+        return `${roleName}/${previous.id}`;
+    const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), roleName, header + serializeAgentErrorRaw(facts), "system", { type: "system" }, now);
+    store.saveGlobalRoleMessage(message);
+    return `${roleName}/${message.id}`;
+}
+/** Reuse the Global Message inbox for an exact failure, not a recovery queue.
+ * A failed Operator cannot be asked to retry its own diagnostic automatically. */
+export function recordGlobalRuntimeAttention(store, roleName, identity, facts, now) {
+    // A Home may have a custom Global Role without an Operator. Keep its own
+    // diagnostic readable; never create a Role or launch a substitute Agent.
+    const recipient = store.getGlobalRole("operator") === null ? roleName : "operator";
+    const requestId = `runtime-attention:${createHash("sha256").update(`${roleName}\0${identity}`).digest("hex")}`;
+    if (store.listGlobalRoleMessages(recipient).some(message => message.inputControl?.requestId === requestId))
+        return;
+    const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), recipient, [
+        `Global Role ${roleName} needs attention. No recovery or new authority is implied.`,
+        "Inspect the exact Session and original input before choosing a next action; unknown effects must not be replayed.",
+        `Original failed attempts remain in Role ${roleName}'s record-only failure Messages; failureRef names the latest evidence.`,
+        serializeAgentErrorRaw(facts)
+    ].join("\n"), "system", { type: "system" }, now, { inputControl: { action: "queue", requestId } });
+    store.saveGlobalRoleMessage(recipient === roleName ? {
+        ...message,
+        notDelivered: { reason: "runtime-needs-attention; retained for user or successor inspection", at: now.toISOString() }
+    } : message);
+}

package/dist/controller/jobSupervisor.js

@@ -50,9 +50,9 @@ export class DurableJobSupervisor {
                 this.#reconcileJob(job, now);
             }
             catch (error) {
-                this.#onError(error instanceof Error
-                    ? error
-                    : new Error(`DurableJob supervision failed for ${job.id}: ${String(error)}`));
+                this.#onError(new Error(`DurableJob supervision failed for ${job.taskId}/${job.id}: `
+                    + `${error instanceof Error ? error.message : String(error)}. `
+                    + "Inspect retained process/artifact evidence before retry or cancellation; effects remain unconfirmed.", { cause: error }));
             }
         }
     }

package/dist/controller/operatorNotification.js

@@ -0,0 +1,31 @@
+import { completeProcessing } from "../coordination/workMailbox.js";
+import { createGlobalRoleMessage } from "../message/message.js";
+/**
+ * Transfer one exact attention claim to the Global Message queue atomically.
+ * Queue ownership is not Provider acceptance or Agent acknowledgement. A failed
+ * or uncertain Message retains its identity/evidence; it is never reissued here.
+ */
+export function queueOperatorNotification(store, input, now = new Date()) {
+    return store.transaction(tx => {
+        const requestId = `operator-notice:${encodeURIComponent(input.receiptId)}`;
+        const previous = tx.listGlobalRoleMessages("operator").find(entry => (entry.inputControl ?? entry.interruptThen?.reusedInput)?.requestId === requestId);
+        const mailbox = tx.getWorkMailbox({ kind: "operator" });
+        const claimed = mailbox?.processing?.batchId === input.batchId;
+        if (previous !== undefined) {
+            if (claimed)
+                tx.saveWorkMailbox(completeProcessing(mailbox, input.batchId));
+            return { status: "already-queued", messageId: previous.id };
+        }
+        if (!claimed)
+            throw new Error(`Operator notification claim changed: ${input.batchId}`);
+        const sessions = tx.getGlobalRoleSessionSet("operator");
+        const session = sessions?.sessions[sessions.activeAgentId];
+        if (session?.status !== "active" || sessions?.providerBinding == null)
+            return { status: "unavailable" };
+        const created = { ...createGlobalRoleMessage(tx.nextGlobalRoleMessageId(), "operator", input.text, "system", { type: "system" }, now, { inputControl: { action: "queue", requestId } }),
+            deliveryTarget: { agentId: session.agentId, nativeSessionId: session.nativeSessionId } };
+        tx.saveGlobalRoleMessage(created);
+        tx.saveWorkMailbox(completeProcessing(mailbox, input.batchId));
+        return { status: "queued", messageId: created.id };
+    });
+}

package/dist/controller/providerRetryAdmission.js

@@ -24,7 +24,9 @@ export function retryIntentBlocker(store, input, retry) {
             return "role-changed";
         if (sessions.sessions[sessions.activeAgentId]?.effective.sourceDesiredRevision !== role.launchRevision)
             return "role-configuration-changed";
-        if (store.listGlobalRoleMessages(input.roleName).some(message => Date.parse(message.createdAt) > Date.parse(retry.intentAt)
+        if (store.listGlobalRoleMessages(input.roleName).some(message => (message.kind === "user" || message.kind === "operator"
+            || message.inputControl !== undefined || message.interruptThen !== undefined)
+            && Date.parse(message.createdAt) > Date.parse(retry.intentAt)
             && message.delivery === undefined && message.notDelivered === undefined))
             return "new-user-input";
         return undefined;