@zq-silk/yui 0.16.2 → 1.0.0-alpha.1

package/README.md

@@ -34,8 +34,9 @@ not from terminal windows you juggle or details you have to remember.
 - **Isolated by default** — repository work happens in managed Git worktrees;
   the stable checkout stays read-only.
 
-> **Status:** pre-1.0 (0.15.x). CLI surfaces and configuration may still change
-> between releases; each upgrade migrates valid existing Homes.
+> **Status:** 1.0.0-alpha.1, with a clean storage 1.0 baseline. Default updates
+> support only declared minor upgrades within one storage major. Existing v37
+> Homes require the separate [one-time conversion](docs/storage-baseline.md).
 
 [Quick start](#quick-start) · [Working through conversation](#working-through-conversation) · [Architecture](#architecture) · [Design principles](#design-principles)
 
@@ -383,8 +384,9 @@ npm users do not need to compile it.
 
 To exercise your checkout, run `make install-local`, then use the absolute
 `<checkout>/output/dev/bin/yui` launcher. It defaults to an isolated Home under
-that checkout; run its `setup` before stateful use. Do not use the global `yui`
-or `make link` to validate local changes. Live-model, paid or shared-resource
+that checkout; run its `setup` before stateful use. Development tooling does not
+manage global installations; do not use the global `yui` to validate local changes.
+Live-model, paid or shared-resource
 tests require an explicit request for those resources.
 
 ## Community and support

package/dist/agent/agent.js

@@ -9,7 +9,7 @@ export function createConfiguredAgent(id, adapterId, command, baseArgs, environm
     validateAgentBaseArguments(adapterId, baseArgs);
     const timestamp = now.toISOString();
     return {
-        schemaVersion: 3,
+        schemaVersion: 1,
         id: normalizedId,
         // An unnamed component resolves from the plan, which for ACP means the
         // unidentified entry rather than a guess at which product is installed.
@@ -45,18 +45,13 @@ export function resolveAgentEnvironment(agent, processEnvironment = process.env)
     }));
 }
 export function validateConfiguredAgent(agent) {
-    if (agent.schemaVersion !== 3)
+    if (agent.schemaVersion !== 1)
         throw new Error("Agent schema version is invalid.");
     requireSafeIdentity(agent.id, "Agent id");
     if (!isAgentAdapterId(agent.adapterId))
         throw new Error(`Agent adapter is unsupported: ${agent.adapterId}.`);
-    // A schema 3 record always carries a component: storage 10 backfilled every
-    // stored Agent, and the constructor resolves one for every new Agent. So an
-    // absent value here is a corrupt record, not an old one, and resolving it to
-    // the plan default would invent a product identity for data that never lost
-    // one. That default belongs to the constructor, where an operator naming
-    // only a plan is a real and supported request — this validator reads records
-    // that were already written, where the same silence means something else.
+    // Creation resolves an omitted component before persistence. Reading a
+    // stored record must not invent a missing product identity.
     if (agent.component === undefined) {
         throw new Error(`Agent is missing its execution component: ${agent.id}.`);
     }

package/dist/agent/executionComponents.js

@@ -138,10 +138,10 @@ export function displayExecutionComponent(adapterId, componentId) {
 /**
  * Resolve the component for a connection plan, given what the caller stated.
  *
- * An absent component is not an error: it means the caller named only the plan,
- * which is how every binding made before this axis existed reads. It resolves
- * to the plan's default, which for ACP is the unidentified entry — the value is
- * never inferred from a command, an argument or an environment variable.
+ * Creation may name only a connection plan. Resolve its default before
+ * persistence; current stored Agents and bindings require an explicit component.
+ * ACP defaults to the unidentified entry, never a product inferred from command,
+ * arguments or environment.
  */
 export function resolveAgentExecutionComponent(adapterId, componentId) {
     if (componentId === undefined)

package/dist/agentRun/agentRun.js

@@ -36,7 +36,7 @@ export function createRun(id, taskId, roleName, mode, input, now, context) {
     if (snapshot.taskId !== taskId)
         throw new Error("AgentRun Context Snapshot belongs to another Task.");
     return {
-        schemaVersion: 5,
+        schemaVersion: 1,
         id: requireSafeIdentity(id, "AgentRun id"),
         taskId: requireSafeIdentity(taskId, "Task id"),
         roleName: requireSafeIdentity(roleName, "Role name"),
@@ -132,8 +132,8 @@ export function validateRun(run) {
         "createdAt",
         "updatedAt"
     ], "AgentRun");
-    if (run.schemaVersion !== 5)
-        throw new Error("AgentRun must use schemaVersion 5.");
+    if (run.schemaVersion !== 1)
+        throw new Error("AgentRun must use schemaVersion 1.");
     validateTaskRecordReference({ taskId: run.taskId, localId: run.id }, "run");
     requireSafeIdentity(run.roleName, "Role name");
     if (run.mode !== "new" && run.mode !== "resume") {
@@ -283,8 +283,8 @@ export function validateRun(run) {
         throw new Error("Execution AgentRun cannot carry Review effective provenance.");
     }
     for (const record of run.inputs) {
-        // Structural validation keeps historical records and observed subsequent
-        // inputs readable. Creation/submission require the initial frozen Snapshot.
+        // Validate readable evidence, not readiness to execute. A missing Snapshot
+        // must still allow inspection, failure settlement and explicit retirement.
         createRunInputEnvelope(runEnvelopeContext(run), record.input);
     }
     if (!["active", "completed", "failed"].includes(run.status)) {
@@ -335,7 +335,7 @@ function finishRun(run, status, output, now, failureReason, provider, systemEvid
         ...run,
         status,
         result: {
-            schemaVersion: 2,
+            schemaVersion: 1,
             ...(output === undefined ? {} : { output: requireResultText(output, "AgentRun result output") }),
             ...(diagnostic === undefined
                 ? {}
@@ -352,8 +352,8 @@ function finishRun(run, status, output, now, failureReason, provider, systemEvid
     return validateRun(terminal);
 }
 function validateRunResult(result) {
-    if (result === undefined || result.schemaVersion !== 2) {
-        throw new Error("A terminal AgentRun requires AgentRunResult schemaVersion 2.");
+    if (result === undefined || result.schemaVersion !== 1) {
+        throw new Error("A terminal AgentRun requires AgentRunResult schemaVersion 1.");
     }
     rejectUnknownFields(result, [
         "schemaVersion",

package/dist/artifacts/managedGit.js

@@ -1,4 +1,4 @@
-import { execFile, execFileSync } from "node:child_process";
+import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 const executeFile = promisify(execFile);
 /**
@@ -259,8 +259,8 @@ function isExternalProgramConfigKey(key) {
  * list of repo-local keys that can execute an external program. Empty means the
  * repository's own config is within the managed boundary.
  *
- * PURE: no I/O. Callers (sync migration and async runtime) read the config with
- * their own managed runner and pass the bytes here, so the security policy lives
+ * PURE: no I/O. Callers read the config with the managed runner and pass the
+ * bytes here, so the security policy lives
  * in exactly one testable place. Reading `--local` deliberately excludes the
  * command-line `-c` hardening flags (which are safe and not persisted) and the
  * null-device'd global/system config; it sees only what is written in the repo.
@@ -277,56 +277,3 @@ export function externalProgramConfigViolations(localConfigListZ) {
     }
     return [...offending].sort();
 }
-/**
- * SYNCHRONOUS managed invocation, used ONLY where an async runner is
- * structurally impossible: a storage `migrateData(db)` step runs inside
- * `db.transaction(...)`, which better-sqlite3 requires to be synchronous, yet
- * the 18->19 migration must build per-Task artifact repositories on disk. This
- * shares the SAME hardening as {@link spawnManagedGit} — identical argument
- * refusal, identical scrubbed environment, identical prepended flags — so the
- * synchronous path never weakens the trust boundary. It is not exported for
- * ordinary runtime use; the async runner remains the only production write path.
- */
-function spawnManagedGitSync(repoPath, args, options) {
-    assertSafeArguments(args);
-    const env = managedGitEnvironment();
-    if (options?.commitDates !== undefined) {
-        // Deterministic history: fixed author/committer dates make a rebuild of the
-        // same source data reproduce the same commit ids. This only sets metadata.
-        env.GIT_AUTHOR_DATE = options.commitDates.author;
-        env.GIT_COMMITTER_DATE = options.commitDates.committer;
-    }
-    try {
-        const stdout = execFileSync("git", [...HARDENING_FLAGS, "-C", repoPath, ...args], {
-            encoding: "buffer",
-            env,
-            maxBuffer: options?.maxBuffer ?? 16 * 1024 * 1024,
-            timeout: options?.timeoutMs ?? 30_000,
-            windowsHide: true
-        });
-        return { stdout: stdout, stderr: Buffer.alloc(0) };
-    }
-    catch (error) {
-        throw new ManagedGitError([...args], readErrorStream(error), error);
-    }
-}
-/** Synchronous counterpart to {@link managedGit}; returns trimmed UTF-8 stdout. */
-export function managedGitSync(repoPath, args, options) {
-    return spawnManagedGitSync(repoPath, args, options).stdout.toString("utf8");
-}
-/** Synchronous counterpart to {@link managedGitBuffer}; returns raw stdout bytes. */
-export function managedGitSyncBuffer(repoPath, args, options) {
-    return spawnManagedGitSync(repoPath, args, options).stdout;
-}
-/** Synchronous counterpart to {@link managedGitSucceeds}; never throws on non-zero exit. */
-export function managedGitSyncSucceeds(repoPath, args, options) {
-    try {
-        spawnManagedGitSync(repoPath, args, options);
-        return true;
-    }
-    catch (error) {
-        if (error instanceof ManagedGitError)
-            return false;
-        throw error;
-    }
-}

package/dist/brief/taskBrief.js

@@ -1,6 +1,6 @@
 export function createTaskBrief(input, now) {
     return {
-        schemaVersion: 2,
+        schemaVersion: 1,
         objective: requireText(input.objective, "Task objective"),
         boundaries: normalizeBoundaries(input.boundaries),
         technicalApproach: optionalText(input.technicalApproach, "Task technical approach"),
@@ -22,8 +22,8 @@ export function updateTaskBrief(brief, patch, updatedBy, now) {
     }, now);
 }
 export function validateTaskBrief(brief) {
-    if (brief.schemaVersion !== 2) {
-        throw new Error("Task Brief requires schemaVersion 2.");
+    if (brief.schemaVersion !== 1) {
+        throw new Error("Task Brief requires schemaVersion 1.");
     }
     if (!Array.isArray(brief.boundaries) || typeof brief.technicalApproach !== "string"
         || typeof brief.updatedAt !== "string" || !Number.isFinite(Date.parse(brief.updatedAt))) {

package/dist/cli/updateOrchestrator.js

@@ -7,6 +7,7 @@
  * verified before the Controller is restarted.
  */
 import { UpdateControllerReconciliationError } from "../controller/updateReconciliation.js";
+import { isControllerIdentity } from "../core/controllerIdentity.js";
 export function runUpdate(ports, options) {
     let staged;
     try {
@@ -61,8 +62,6 @@ function runStagedUpdate(ports, staged, home) {
             action: preflight.action,
             recoverable: true,
             version: staged.version,
-            ...(preflight.blockers === undefined ? {} : { blockers: preflight.blockers }),
-            ...(preflight.retryCommand === undefined ? {} : { retryCommand: preflight.retryCommand }),
             ...(preflight.sceneUnchanged === true ? { sceneUnchanged: true } : {})
         };
     }
@@ -159,8 +158,7 @@ function runCoordinatedUpdate(ports, staged, home) {
         return restoreControllerOrReport(ports, home, captured.lifecycle, {
             outcome: "aborted", phase: "preflight",
             message: fencedPreflight.message, action: fencedPreflight.action,
-            recoverable: true, version: staged.version,
-            ...(fencedPreflight.blockers === undefined ? {} : { blockers: fencedPreflight.blockers })
+            recoverable: true, version: staged.version
         });
     }
     return activateAndVerify(ports, staged, home, captured.lifecycle, fencedPreflight);
@@ -391,15 +389,6 @@ function isStorageMigrationResult(value) {
 function isPositivePid(value) {
     return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
 }
-function isControllerIdentity(value) {
-    return isRecord(value)
-        && typeof value.executablePath === "string"
-        && value.executablePath.length > 0
-        && Array.isArray(value.args)
-        && value.args.every((arg) => typeof arg === "string")
-        && typeof value.version === "string"
-        && value.version.length > 0;
-}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/dist/cli/updatePorts.js

@@ -25,11 +25,13 @@
  *    mismatch fails closed.
  */
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { accessSync, constants, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { runtimeError } from "../errors/cliError.js";
 import { isConcreteVersion } from "../domain/validation.js";
+import { parseControllerIdentity } from "../core/controllerIdentity.js";
+import { isMinorStorageUpgrade, isStorageVersion, storageVersionParts } from "../storage/storageVersions.js";
 import { STORAGE_DOCTOR_CHECK_NAMES } from "../doctor/doctor.js";
 import { acquireHandoverLock } from "../release/runtimeRelease.js";
 import { updateStagingRoot } from "../storage/homeLayout.js";
@@ -507,18 +509,16 @@ function restoreControllerIdentity(home, identity, environment, spawn) {
         "const { spawn } = require('node:child_process');",
         "const values = process.argv.slice(1);",
         "const handoverOwnerPid = Number(values.pop());",
-        "const version = values.pop();",
-        "const args = JSON.parse(values.pop());",
-        "const executable = values.pop();",
+        "const identity = JSON.parse(values.pop());",
         "const home = values.pop();",
         "const runtimeModule = values.pop();",
         "(async () => {",
         "  const { ensureFileTaskControllerIdentity } = await import(runtimeModule);",
-        "  await ensureFileTaskControllerIdentity(home, { executablePath: executable, args, version }, {",
+        "  await ensureFileTaskControllerIdentity(home, identity, {",
         "    environment: process.env,",
         "    handoverOwnerPid,",
         "    spawnController: (_home, launchEnv) => {",
-        "      const child = spawn(executable, args, { detached: true, stdio: 'ignore', env: launchEnv });",
+        "      const child = spawn(identity.executablePath, identity.args, { detached: true, stdio: 'ignore', env: launchEnv });",
         "      child.unref();",
         "    }",
         "  });",
@@ -529,9 +529,7 @@ function restoreControllerIdentity(home, identity, environment, spawn) {
         helper,
         UPDATE_CLIENT_RUNTIME_PATH,
         home,
-        identity.executablePath,
-        JSON.stringify(identity.args),
-        identity.version,
+        JSON.stringify(parseControllerIdentity(identity)),
         String(process.pid)
     ], { cwd: process.cwd(), env: launchEnvironment, shell: false, stdio: "pipe" });
     assertSpawnOk(result, "restore the previously running Controller identity");
@@ -656,21 +654,6 @@ function structuredErrorMessage(result) {
     }
     return undefined;
 }
-function parseControllerIdentity(value) {
-    if (typeof value.executablePath !== "string"
-        || value.executablePath.length === 0
-        || !Array.isArray(value.args)
-        || value.args.some((arg) => typeof arg !== "string")
-        || typeof value.version !== "string"
-        || value.version.length === 0) {
-        throw new Error("Authenticated Controller identity is malformed; treating ownership as unknown-active.");
-    }
-    return {
-        executablePath: value.executablePath,
-        args: value.args,
-        version: value.version
-    };
-}
 function controllerErrorCodeFromResult(result) {
     for (const buffer of [result.stdout, result.stderr]) {
         try {
@@ -775,23 +758,22 @@ function assertActivatedControllerIdentity(identity, activatedBinary, activatedV
  * entrypoint derivation as the production startup identity check (P1-1, rr23).
  */
 export function activatedControllerEntrypoint(activatedBinary) {
-    let resolvedBinary;
-    try {
-        resolvedBinary = realpathSync(activatedBinary);
-    }
-    catch {
-        // `verify` already checked existsSync. Keep the fallback deterministic for
-        // test seams and fail closed later if the identity does not match it.
-        resolvedBinary = resolve(activatedBinary);
-    }
+    const resolvedBinary = realpathSync(activatedBinary);
     const direct = join(dirname(resolvedBinary), "controller", "controllerMain.js");
-    if (existsSync(direct))
-        return direct;
     // npm may expose a non-symlink launcher under <prefix>/bin. Resolve the
     // package's canonical global layout when it is present.
     const prefix = resolve(dirname(resolvedBinary), "..");
     const packageEntrypoint = join(prefix, "lib", "node_modules", PACKAGE_NAME, "dist", "controller", "controllerMain.js");
-    return existsSync(packageEntrypoint) ? packageEntrypoint : direct;
+    for (const candidate of [direct, packageEntrypoint]) {
+        if (!existsSync(candidate))
+            continue;
+        const entrypoint = realpathSync(candidate);
+        if (!statSync(entrypoint).isFile()) {
+            throw runtimeError(`Controller entrypoint is not a regular file: ${entrypoint}.`);
+        }
+        return entrypoint;
+    }
+    throw runtimeError(`Controller entrypoint is missing for the activated binary: ${resolvedBinary}.`);
 }
 function interpretPreflight(result) {
     // Require a valid `{ ok:true, data }` success envelope before trusting any
@@ -841,7 +823,6 @@ function interpretPreflight(result) {
             action: "Use a staged binary that supports the update-preflight contract; do not force the update."
         };
     }
-    const blockers = parseUpdateBlockers(data.blockers);
     return {
         status: "blocked",
         stage: typeof data.stage === "string" ? data.stage : "preflight",
@@ -849,8 +830,6 @@ function interpretPreflight(result) {
         action: typeof data.action === "string"
             ? data.action
             : "Resolve the reported condition and retry.",
-        ...(blockers === undefined ? {} : { blockers }),
-        ...(typeof data.retryCommand === "string" ? { retryCommand: data.retryCommand } : {}),
         ...(data.sceneUnchanged === true ? { sceneUnchanged: true } : {})
     };
 }
@@ -864,9 +843,13 @@ function parseUpdatePreflightResult(data) {
     const homeClassification = data.classification;
     if (!isRecord(homeClassification) || !isRecord(homeClassification.classification))
         return null;
+    const from = homeClassification.storageVersion;
+    const to = homeClassification.currentStorageVersion;
+    if (!isStorageVersion(from) || !isStorageVersion(to))
+        return null;
     const classification = homeClassification.classification;
     if (data.status === "already-current") {
-        if (data.stepCount !== 0
+        if (data.stepCount !== 0 || from !== to
             || classification.verdict !== "USABLE"
             || classification.status !== "current")
             return null;
@@ -875,8 +858,17 @@ function parseUpdatePreflightResult(data) {
     if (data.stepCount <= 0
         || classification.verdict !== "MIGRATABLE"
         || classification.status !== "migration-ready"
+        || !isMinorStorageUpgrade(from, to)
         || !data.steps.every(isStorageMigrationStep))
         return null;
+    let previous = from;
+    for (const step of data.steps) {
+        if (step.fromVersion !== previous)
+            return null;
+        previous = step.toVersion;
+    }
+    if (previous !== to)
+        return null;
     return { status: "migration-ready", stepCount: data.stepCount };
 }
 function interpretStorageMigration(result) {
@@ -912,38 +904,13 @@ function interpretStorageMigration(result) {
 }
 function isStorageMigrationStep(value) {
     return isRecord(value)
-        && Number.isSafeInteger(value.fromVersion)
-        && Number.isSafeInteger(value.toVersion)
-        && value.toVersion === value.fromVersion + 1
+        && isStorageVersion(value.fromVersion)
+        && isStorageVersion(value.toVersion)
+        && isMinorStorageUpgrade(value.fromVersion, value.toVersion)
+        && storageVersionParts(value.toVersion).minor === storageVersionParts(value.fromVersion).minor + 1
         && typeof value.name === "string"
         && value.name.length > 0;
 }
-function parseUpdateBlockers(value) {
-    if (value === undefined)
-        return undefined;
-    if (!Array.isArray(value))
-        return undefined;
-    const parsed = [];
-    for (const item of value) {
-        if (!isRecord(item) || typeof item.reason !== "string" || item.reason.length === 0) {
-            return undefined;
-        }
-        const optional = ["taskId", "roleName", "runId", "nativeSessionId"];
-        if (optional.some((key) => item[key] !== undefined && typeof item[key] !== "string")) {
-            return undefined;
-        }
-        parsed.push({
-            ...(typeof item.taskId === "string" ? { taskId: item.taskId } : {}),
-            ...(typeof item.roleName === "string" ? { roleName: item.roleName } : {}),
-            ...(typeof item.runId === "string" ? { runId: item.runId } : {}),
-            ...(typeof item.nativeSessionId === "string"
-                ? { nativeSessionId: item.nativeSessionId }
-                : {}),
-            reason: item.reason
-        });
-    }
-    return parsed;
-}
 /**
  * Extract the validated `data` object from a spawn result's `{ ok: true, data }`
  * JSON envelope, or `null` when the result is not a trustworthy success envelope.

package/dist/cli/upgradeCommand.js

@@ -1,6 +1,7 @@
 /** `yui upgrade` plans or applies the supported linear storage migration chain. */
 import { runStorageUpgrade } from "../storage/upgrade/upgradeOrchestrator.js";
 import { ensureFileTaskController, ensureFileTaskControllerIdentity, stopFileTaskController } from "../controller/clientRuntime.js";
+import { parseControllerIdentity } from "../core/controllerIdentity.js";
 import { callController, ControllerClientError } from "../core/controllerClient.js";
 import { spawn } from "node:child_process";
 import { runtimeError, usageError } from "../errors/cliError.js";
@@ -99,16 +100,11 @@ async function captureUpgradeController(home) {
             return undefined;
         throw error;
     }
-    const identity = value;
-    if (!Number.isSafeInteger(identity.pid) || identity.pid < 1
-        || typeof identity.executablePath !== "string" || !identity.executablePath
-        || !Array.isArray(identity.args) || identity.args.some(arg => typeof arg !== "string")
-        || typeof identity.version !== "string" || !identity.version) {
+    const pid = value?.pid;
+    if (!Number.isSafeInteger(pid) || pid < 1) {
         throw runtimeError("Cannot capture the exact Controller for a reversible upgrade preflight.");
     }
-    return { pid: identity.pid, identity: {
-            executablePath: identity.executablePath, args: identity.args, version: identity.version
-        } };
+    return { pid: pid, identity: parseControllerIdentity(value) };
 }
 async function runUpdateOwnedUpgrade(home, environment) {
     const ownerText = environment.YUI_UPDATE_HANDOVER_OWNER_PID;

package/dist/cli.js

@@ -100,7 +100,7 @@ import { requireManagedTaskCaller, resolveManagedTaskReader } from "./runtime/ma
 import { assertRuntimeCoherence } from "./runtime/runtimeCoherence.js";
 import { runSetupCommand, validateSetupInvocation } from "./setup/setupCommand.js";
 import { openCurrentTaskStore, validateCurrentTaskStore } from "./storage/currentTaskStore.js";
-import { SqliteSchemaMigrationError } from "./storage/sqliteSchema.js";
+import { SqliteSchemaError } from "./storage/sqliteSchema.js";
 import { inspectStorageSchema } from "./storage/storageSchema.js";
 import { resolveYuiHome } from "./storage/taskStore.js";
 import { renderArchiveDiagnostics, taskArchiveDiagnostics } from "./task/archiveDiagnostics.js";
@@ -141,7 +141,7 @@ void main().catch((error) => {
 });
 function runtimeFailureMessage(error) {
     const message = error instanceof Error ? error.message : String(error);
-    if (!(error instanceof SqliteSchemaMigrationError))
+    if (!(error instanceof SqliteSchemaError))
         return message;
     try {
         return `${message}\n${describeCliHomeInvocation({
@@ -542,12 +542,9 @@ export async function main() {
             validateCurrentTaskStore(home);
         const controllerMethod = method;
         const updateHandoverOwner = process.env.YUI_UPDATE_HANDOVER_OWNER_PID;
-        // A pre-fix updater cannot pass the owner environment variable to the
-        // activated restart child, but it remains that child's direct parent while
-        // holding the exact handover lock. Inherit only that OS-backed relationship;
-        // every unrelated live lock still compares foreign and fails closed.
+        // Maintenance children must explicitly name their exact lock owner.
         const updateHandoverOwnerPid = updateHandoverOwner === undefined
-            ? (Number.isSafeInteger(process.ppid) && process.ppid > 0 ? process.ppid : undefined)
+            ? undefined
             : Number(updateHandoverOwner);
         if (updateHandoverOwnerPid !== undefined
             && (!Number.isSafeInteger(updateHandoverOwnerPid) || updateHandoverOwnerPid < 1)) {

package/dist/commands/controllerCommands.js

@@ -49,7 +49,7 @@ export function renderControllerResourceStatus(snapshot, verbose, width = defaul
             { header: "Reason", minWidth: 12, maxWidth: 30 }
         ], visibleDomains.map((domain) => [
             domain.yuiHome,
-            domain.domainKind ?? "legacy",
+            domain.domainKind ?? "unmarked",
             domain.liveness === undefined
                 ? "—"
                 : `${domain.liveness}/${domain.disposition ?? "review"}`,

package/dist/commands/taskCommands.js

@@ -4916,7 +4916,14 @@ function retryRunOperation(args, store, options) {
     const now = clock(options);
     const previous = store.transaction((tx) => {
         const run = requireRun(tx, args[0], options);
-        readRunContextSnapshot(tx, run);
+        // Review, synthesis and bounded automatic recovery reuse exact evidence.
+        // Explicit ordinary retries below
+        // create a new Run and Snapshot from current authorized facts; missing old
+        // evidence must not prevent that explicit recovery.
+        if (run.purpose === "review" || run.sourceExecutionGroupId !== undefined
+            || options.providerRetryChainId !== undefined) {
+            readRunContextSnapshot(tx, run);
+        }
         return run;
     });
     if (previous.purpose === "review") {

package/dist/commands/taskRoleRuntimeStatus.js

@@ -446,7 +446,7 @@ function projectTaskRoleRuntime(run, session, tmux, events, _mailbox, store, tas
     const fence = { ...basicFence, ...(nativeTurnId === undefined ? {} : { nativeTurnId }) };
     let projection = projectRuntimeTaskEvents(fence, createdAt, events);
     projection = projectRuntimeObservation(projection, createRuntimeObservation({
-        schemaVersion: 4,
+        schemaVersion: 1,
         eventId: `runtime-host-${receiptId}`,
         semanticKey: `runtime-host-${receiptId}`,
         kind: "host.observed",

package/dist/context/runInputContract.js

@@ -36,7 +36,7 @@ export function validateRunInput(value) {
 /** Execution must never substitute current Task facts for missing frozen evidence. */
 export function requireRunContextSnapshotRef(input) {
     if (input.contextSnapshotRef === undefined) {
-        throw new Error("AgentRun Context Snapshot is required for execution; the record remains audit-only.");
+        throw new Error("AgentRun Context Snapshot is required for this execution. Inspect the Run and retire or explicitly retry it; original evidence is never reconstructed.");
     }
     return validateContextSnapshotRef(input.contextSnapshotRef);
 }

package/dist/controller/agentRuntimeObserver.js

@@ -102,7 +102,7 @@ export class AgentRuntimeObserver {
                         ? tokenObservationIdentity("baseline", fence, source.sourceId, baselineKey)
                         : usageObservationIdentity(fence, source.sourceId, latestOccurrence);
                     this.inbox.enqueueObservation(createRuntimeObservation({
-                        schemaVersion: 4,
+                        schemaVersion: 1,
                         eventId: identity.eventId,
                         semanticKey: identity.semanticKey,
                         kind: "activity.observed",
@@ -137,7 +137,7 @@ export class AgentRuntimeObserver {
             const health = JSON.stringify([sample.status, sample.detail ?? null]);
             if (state.health !== health) {
                 this.inbox.enqueueObservation(createRuntimeObservation({
-                    schemaVersion: 4,
+                    schemaVersion: 1,
                     eventId: observationId("health", fence, source.sourceId, health),
                     semanticKey: observationId("health", fence, source.sourceId, health),
                     kind: "observer.health",
@@ -183,7 +183,7 @@ export class AgentRuntimeObserver {
             usages.forEach((occurrence, usageIndex) => {
                 const identity = usageObservationIdentity(fence, source.sourceId, occurrence);
                 this.inbox.enqueueObservation(createRuntimeObservation({
-                    schemaVersion: 4,
+                    schemaVersion: 1,
                     eventId: identity.eventId,
                     semanticKey: identity.semanticKey,
                     kind: "activity.observed",
@@ -213,7 +213,7 @@ export class AgentRuntimeObserver {
             });
             if (activityChanged && state.cursor !== undefined) {
                 this.inbox.enqueueObservation(createRuntimeObservation({
-                    schemaVersion: 4,
+                    schemaVersion: 1,
                     eventId: observationId("activity", fence, source.sourceId, sample.activityId),
                     semanticKey: observationId("activity", fence, source.sourceId, sample.activityId),
                     kind: "activity.observed",