@zq-silk/yui 0.16.2 → 1.0.0-alpha.1

package/dist/controller/clientRuntime.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { findLiveControllerProcessForHome, inspectLiveControllerProcess } from "../core/controllerProcessIdentity.js";
 import { readHomeFilesystemId } from "../core/homeFilesystemIdentity.js";
+import { parseControllerIdentity } from "../core/controllerIdentity.js";
 import { AGENT_OPERATIONAL_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, operationalAgentEnvironment, selectEnvironment, YUI_MANAGED_RUNTIME_ENVIRONMENT_NAMES } from "../agent/launchEnvironment.js";
 import { callController, ControllerClientError, readControllerDiscovery, stopOrphanedFileTaskController } from "../core/controllerClient.js";
 import { FILE_TASK_CONTROLLER_PROTOCOL_VERSION } from "../core/protocol.js";
@@ -53,7 +54,7 @@ export async function ensureFileTaskController(home, options = {}) {
     await waitForForeignHandover(home, options);
     try {
         const status = await call(home, "controller.status", {});
-        assertCompatibleControllerStatus(status, options.expectedVersion);
+        assertCompatibleControllerStatus(status, options.expectedIdentity);
         return status;
     }
     catch (error) {
@@ -78,7 +79,7 @@ export async function ensureFileTaskController(home, options = {}) {
     for (;;) {
         try {
             const status = await call(home, "controller.status", {});
-            assertCompatibleControllerStatus(status, options.expectedVersion);
+            assertCompatibleControllerStatus(status, options.expectedIdentity);
             return status;
         }
         catch (error) {
@@ -95,10 +96,10 @@ export async function ensureFileTaskController(home, options = {}) {
 }
 /** Start and await readiness for a captured Controller identity. */
 export async function ensureFileTaskControllerIdentity(home, identity, options = {}) {
-    assertExpectedControllerRuntimeProcessIdentity(identity);
+    const captured = parseControllerIdentity(identity);
     const status = await ensureFileTaskController(home, {
         ...options,
-        expectedVersion: identity.version
+        expectedIdentity: captured
     });
     // A same-version status is not an identity proof: another Controller binary
     // may own the Home after a restart or a stale discovery race. Authenticate
@@ -109,39 +110,24 @@ export async function ensureFileTaskControllerIdentity(home, identity, options =
     const actual = await call(home, "controller.identity", {}, {
         timeoutMs: options.requestTimeoutMs
     });
-    assertControllerRuntimeProcessIdentity(actual, identity);
+    assertControllerRuntimeProcessIdentity(actual, captured);
     return status;
 }
-function assertExpectedControllerRuntimeProcessIdentity(identity) {
-    if (typeof identity.executablePath !== "string"
-        || identity.executablePath.length === 0
-        || !Array.isArray(identity.args)
-        || identity.args.some((arg) => typeof arg !== "string")
-        || typeof identity.version !== "string"
-        || identity.version.length === 0) {
-        throw new Error("Expected Controller runtime identity is malformed; refusing to start or accept a Controller.");
-    }
-}
-function assertControllerRuntimeProcessIdentity(actual, expected) {
-    if (!isJsonRecord(actual)) {
-        throw new Error("Authenticated Controller runtime identity is malformed; refusing to accept readiness.");
-    }
+function assertControllerRuntimeProcessIdentity(value, expected) {
+    const actual = parseControllerIdentity(value);
     const actualArgs = actual.args;
-    if (typeof actual.executablePath !== "string"
-        || !Array.isArray(actualArgs)
-        || actualArgs.some((arg) => typeof arg !== "string")
-        || typeof actual.version !== "string") {
-        throw new Error("Authenticated Controller runtime identity is malformed; refusing to accept readiness.");
-    }
     const argsMatch = actualArgs.length === expected.args.length
         && actualArgs.every((arg, index) => arg === expected.args[index]);
     if (actual.executablePath !== expected.executablePath
         || !argsMatch
-        || actual.version !== expected.version) {
-        throw new Error("Authenticated Controller runtime identity does not match the captured executable, argv, and version; refusing readiness.");
+        || actual.version !== expected.version
+        || actual.controllerProtocolVersion !== expected.controllerProtocolVersion
+        || actual.storageVersion !== expected.storageVersion
+        || actual.minimumStorageVersion !== expected.minimumStorageVersion) {
+        throw new Error("Authenticated Controller runtime identity does not match the captured executable, argv, package, protocol and storage versions; refusing readiness.");
     }
 }
-function assertCompatibleControllerStatus(status, expectedVersion) {
+function assertCompatibleControllerStatus(status, expectedIdentity) {
     const statusRecord = isJsonRecord(status) && status.running === true ? status : null;
     const actual = statusRecord?.protocolVersion;
     if (statusRecord === null || actual !== FILE_TASK_CONTROLLER_PROTOCOL_VERSION) {
@@ -149,22 +135,11 @@ function assertCompatibleControllerStatus(status, expectedVersion) {
             + "Run `yui controller restart` before writing new task records.");
     }
     const actualVersion = statusRecord.version;
-    if (expectedVersion !== undefined && actualVersion !== expectedVersion) {
-        throw new Error(`Controller version is incompatible (expected ${expectedVersion}, found ${typeof actualVersion === "string" ? actualVersion : "unknown"}). `
-            + "Run `yui controller restart` before writing new task records.");
-    }
-    // Ordinary callers must authenticate the complete control-plane identity.
-    // An update/upgrade restore instead targets a previously captured Controller
-    // binary, which may predate the current storage-layout status fields; that
-    // path authenticates its executable, argv, and version immediately after
-    // readiness in ensureFileTaskControllerIdentity.
-    if (expectedVersion === undefined) {
-        const identity = yuiVersionIdentity();
-        assertControllerStatusIdentity(status, {
-            ...identity,
-            version: typeof actualVersion === "string" ? actualVersion : identity.version
-        });
-    }
+    const current = yuiVersionIdentity();
+    assertControllerStatusIdentity(status, expectedIdentity === undefined ? {
+        ...current,
+        version: typeof actualVersion === "string" ? actualVersion : current.version
+    } : parseControllerIdentity(expectedIdentity));
 }
 function spawnDetachedFileTaskController(_home, environment) {
     const child = spawn(process.execPath, [fileURLToPath(new URL("./controllerMain.js", import.meta.url))], {

package/dist/controller/controller.js

@@ -948,6 +948,18 @@ export class FileTaskController {
     #requestBackgroundPump() {
         void this.pump().catch(this.#onError);
     }
+    /** Optional maintenance is not execution admission. Keep its failure visible
+     * without bypassing the scheduler's own ownership and delivery fences. */
+    async #observeMaintenance(phase, action) {
+        try {
+            return await action();
+        }
+        catch (error) {
+            this.#onError(new Error(`${phase} failed: ${error instanceof Error ? error.message : String(error)}. `
+                + "No successful cleanup or quiescence is inferred; inspect the original failure.", { cause: error }));
+            return undefined;
+        }
+    }
     async #runCoalesced() {
         let result = emptyControllerSchedulerResult();
         let pendingRuntimeDrain = false;
@@ -966,15 +978,15 @@ export class FileTaskController {
                     if (scope.kind === "full")
                         this.reloadReconciliationInterval();
                     if (scope.kind === "full" && this.#resourceReaper !== undefined) {
-                        const reap = await this.#resourceReaper();
-                        for (const failure of reap.failed) {
+                        const reap = await this.#observeMaintenance("Ephemeral runtime reap", this.#resourceReaper);
+                        for (const failure of reap?.failed ?? []) {
                             this.#onError(new Error(`Ephemeral runtime reap failed for ${failure.id}: ${failure.message}`));
                         }
                         // The reaper owns the exact resource fences. Once a whole expired
                         // domain converges, let the detached Controller close itself on a
                         // later turn; never close while this reconciliation pass is still
                         // the in-flight server request.
-                        if (reap.failed.length === 0 && (reap.expiredDomains?.length ?? 0) > 0) {
+                        if (reap !== undefined && reap.failed.length === 0 && (reap.expiredDomains?.length ?? 0) > 0) {
                             for (const domain of reap.expiredDomains ?? []) {
                                 queueMicrotask(() => {
                                     this.#onExpiredEphemeralDomain?.(domain);
@@ -992,7 +1004,7 @@ export class FileTaskController {
                     // full pass. It queries only identities already present in Task
                     // facts and cannot start a model AgentRun or scan unknown children.
                     if (scope.kind === "full" && this.#continuationReconciler !== undefined) {
-                        await this.#continuationReconciler.reconcile(this.#now());
+                        await this.#observeMaintenance("Continuation reconciliation", () => this.#continuationReconciler.reconcile(this.#now()));
                     }
                     // DurableJob reconciliation runs before the scheduler pass so a
                     // terminal job's Leader wakeup is enqueued in the same pass that

package/dist/controller/fileSchedulerStoreAdapter.js

@@ -635,7 +635,7 @@ export class FileSchedulerStoreAdapter {
                 const key = providerContinuationKey(continuation.identity);
                 const identityDigest = createHash("sha256").update(key).digest("hex");
                 const detached = createRuntimeObservation({
-                    schemaVersion: 4,
+                    schemaVersion: 1,
                     eventId: `derived-continuation-detached:${identityDigest}`,
                     semanticKey: `continuation-detached:${identityDigest}`,
                     kind: "continuation.started",
@@ -724,7 +724,7 @@ export class FileSchedulerStoreAdapter {
                         .update(`${input.semanticKey}\u0000${identityKey}`)
                         .digest("hex");
                     const settled = createRuntimeObservation({
-                        schemaVersion: 4,
+                        schemaVersion: 1,
                         eventId: `native-snapshot-settled:${digest}`,
                         semanticKey: `native-snapshot-settled:${digest}`,
                         kind: "continuation.settled",
@@ -2271,7 +2271,7 @@ export class FileSchedulerStoreAdapter {
                 && event.payload.observationId === observationId)))
                 return;
             const observation = validateRuntimeProcessExitObservation({
-                schemaVersion: 2,
+                schemaVersion: 1,
                 observationId,
                 hostSequence: 1,
                 hostInstanceId: `tmux-${input.roleName}`,
@@ -2720,7 +2720,7 @@ export class FileSchedulerStoreAdapter {
             // this Global Role, settle it to the observed terminal so the scope-generic
             // resolver and the interrupt-then gate see the real stop on the live binding
             // — the same edge Task settles via settleStructuredProviderTurn. This is a
-            // strict guarded no-op for an older unmanaged Session or a
+            // strict guarded no-op for a Session without a controlled binding or a
             // binding holding a different/already-terminal Turn, and the
             // durable native terminal recorded just above remains the proof of record.
             current = settleGlobalRoleRuntimeTurn(current, input.nativeTurnId, input.providerStatus, now);
@@ -3483,12 +3483,12 @@ function settleStructuredProviderTurn(sessions, runId, status, now, attemptId) {
  * It is a strict guarded no-op unless a controller-owned Turn with that exact
  * native id is bound and still in flight (`accepted`) — an absent binding, a
  * different/only-submitting Turn, or an already-terminal one is left untouched, so
- * an older unmanaged Session without a controlled binding settles nothing
+ * a Session without a controlled binding settles nothing
  * and the durable `recentCompletedTurnIds` terminal remains the proof of record.
  */
 function settleGlobalRoleRuntimeTurn(sessions, nativeTurnId, status, now) {
     const binding = sessions.providerBinding;
-    if (binding === null || binding === undefined || binding.run === null
+    if (binding === null || binding.run === null
         || binding.run.nativeTurnId !== nativeTurnId
         || binding.run.status !== "accepted") {
         return sessions;

package/dist/controller/globalInputDelivery.js

@@ -147,7 +147,9 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             }
         }
         catch (error) {
-            onError(error);
+            onError(new Error(`Global input delivery failed for ${role.name}: `
+                + `${error instanceof Error ? error.message : String(error)}. `
+                + "Inspect the persisted Message and attempt before retrying; delivery is not inferred.", { cause: error }));
         }
     }
 }

package/dist/controller/jobSupervisor.js

@@ -50,9 +50,9 @@ export class DurableJobSupervisor {
                 this.#reconcileJob(job, now);
             }
             catch (error) {
-                this.#onError(error instanceof Error
-                    ? error
-                    : new Error(`DurableJob supervision failed for ${job.id}: ${String(error)}`));
+                this.#onError(new Error(`DurableJob supervision failed for ${job.taskId}/${job.id}: `
+                    + `${error instanceof Error ? error.message : String(error)}. `
+                    + "Inspect retained process/artifact evidence before retry or cancellation; effects remain unconfirmed.", { cause: error }));
             }
         }
     }

package/dist/controller/providerRetryDelivery.js

@@ -90,134 +90,144 @@ export function createProviderRetryHooks(home, store, ports = {}) {
                     inspectedUnknown.delete(id);
             for (const set of current) {
                 const owner = set.owner;
-                const binding = set.providerBinding;
-                const retry = binding.retry;
-                const at = now(retry);
-                const scoped = { ...(owner.scope === "task" ? { taskId: owner.taskId } : {}), roleName: owner.roleName };
-                const session = set.sessions[set.activeAgentId];
-                const blocker = retryIntentBlocker(store, scoped, retry);
-                if (blocker !== undefined && blocker !== "background-work-unsettled") {
-                    stop(set, blocker, at);
-                    continue;
-                }
-                if (binding.retryDisabled && retry.successorAutomatic !== false || binding.authority.owner !== "controller"
-                    || binding.authority.epoch !== retry.authorityEpoch
-                    || currentProviderConversation(binding).conversationId !== retry.nativeSessionId
-                    || session?.status !== "active" || session.nativeSessionId !== retry.nativeSessionId
-                    || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget(owner)))) {
-                    stop(set, "session-or-authority-changed", at);
-                    continue;
-                }
-                // Never replay an admitted attempt. Existing exact runtime queries and
-                // terminal ingress resolve it, even across Controller restart.
-                if (retry.status === "in-flight") {
-                    if (binding.run?.status === "delivery-unknown" && retry.currentAttemptId !== undefined
-                        && !inspectedUnknown.has(retry.currentAttemptId)) {
-                        inspectedUnknown.add(retry.currentAttemptId);
-                        let detail;
-                        try {
-                            const host = await inspect({ home, ...scoped, scope: owner.scope });
-                            detail = host.nativeSessionId === retry.nativeSessionId && host.attemptId === retry.currentAttemptId
-                                ? `Exact Host query: ${host.state}; awaiting original canonical Provider evidence.`
-                                : "Host query did not prove the original Session/input identity; no replay.";
-                        }
-                        catch (error) {
-                            detail = `Original Host query unavailable; no replay: ${redactAgentErrorText(error instanceof Error ? error.message : String(error))}`;
-                        }
-                        store.transaction(() => {
-                            const latest = load(owner);
-                            if (latest === null || latest.providerBinding == null || latest.providerBinding.run === null
-                                || latest.providerBinding.run.attemptId !== retry.currentAttemptId
-                                || latest.providerBinding.run.status !== "delivery-unknown")
-                                return;
-                            save({ ...latest, providerBinding: { ...latest.providerBinding,
-                                    retry: { ...latest.providerBinding.retry, reason: detail } } });
-                            if (owner.scope === "global") {
-                                recordGlobalRuntimeAttention(store, owner.roleName, `${retry.currentAttemptId}:unconfirmed`, providerRetryProjection(load(owner)?.providerBinding), new Date(at));
+                try {
+                    const binding = set.providerBinding;
+                    const retry = binding.retry;
+                    const at = now(retry);
+                    const scoped = { ...(owner.scope === "task" ? { taskId: owner.taskId } : {}), roleName: owner.roleName };
+                    const session = set.sessions[set.activeAgentId];
+                    const blocker = retryIntentBlocker(store, scoped, retry);
+                    if (blocker !== undefined && blocker !== "background-work-unsettled") {
+                        stop(set, blocker, at);
+                        continue;
+                    }
+                    if (binding.retryDisabled && retry.successorAutomatic !== false || binding.authority.owner !== "controller"
+                        || binding.authority.epoch !== retry.authorityEpoch
+                        || currentProviderConversation(binding).conversationId !== retry.nativeSessionId
+                        || session?.status !== "active" || session.nativeSessionId !== retry.nativeSessionId
+                        || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget(owner)))) {
+                        stop(set, "session-or-authority-changed", at);
+                        continue;
+                    }
+                    // Never replay an admitted attempt. Existing exact runtime queries and
+                    // terminal ingress resolve it, even across Controller restart.
+                    if (retry.status === "in-flight") {
+                        if (binding.run?.status === "delivery-unknown" && retry.currentAttemptId !== undefined
+                            && !inspectedUnknown.has(retry.currentAttemptId)) {
+                            inspectedUnknown.add(retry.currentAttemptId);
+                            let detail;
+                            try {
+                                const host = await inspect({ home, ...scoped, scope: owner.scope });
+                                detail = host.nativeSessionId === retry.nativeSessionId && host.attemptId === retry.currentAttemptId
+                                    ? `Exact Host query: ${host.state}; awaiting original canonical Provider evidence.`
+                                    : "Host query did not prove the original Session/input identity; no replay.";
                             }
-                            if (owner.scope === "task") {
-                                const event = createTaskEvent(store.nextEventId(owner.taskId), owner.taskId, "provider.retry-unconfirmed", {
-                                    roleName: owner.roleName, attemptId: retry.currentAttemptId, nativeSessionId: retry.nativeSessionId, detail
-                                }, new Date(at));
-                                store.saveEvent(owner.taskId, event);
-                                enqueueWork(store, owner.roleName === "leader" ? { kind: "operator" }
-                                    : { kind: "role", taskId: owner.taskId, roleName: "leader" }, "provider-retry-needs-attention", new Date(at), [{ type: "event", taskId: owner.taskId, id: event.id }]);
+                            catch (error) {
+                                detail = `Original Host query unavailable; no replay: ${redactAgentErrorText(error instanceof Error ? error.message : String(error))}`;
                             }
-                        });
-                    }
-                    continue;
-                }
-                if (retry.successorAutomatic !== false && at >= Date.parse(retry.deadline)) {
-                    stop(set, "deadline-exhausted", at, true);
-                    continue;
-                }
-                if (at < Date.parse(retry.nextEligibleAt) || blocker !== undefined || binding.goal?.status === "active")
-                    continue;
-                if (binding.run?.attemptId !== retry.failedAttemptId) {
-                    stop(set, "superseded-input", at);
-                    continue;
-                }
-                try {
-                    if (owner.scope === "task" && retry.previousRunId !== undefined) {
-                        if (retry.successorRunId !== undefined || retry.successorReviewRoundId !== undefined)
-                            continue;
-                        const previous = store.getRun(owner.taskId, retry.previousRunId);
-                        if (previous?.status === "active")
-                            continue; // ordinary rejected-delivery terminal fold
-                        if (previous?.status !== "failed") {
-                            stop(set, "run-no-longer-failed", at);
-                            continue;
-                        }
-                        const actualTaskReviewCandidate = await ports.snapshotTaskCandidate?.(previous);
-                        store.transaction(() => {
-                            const latest = load(owner)?.providerBinding?.retry;
-                            if (latest?.chainId !== retry.chainId || latest.failedAttemptId !== retry.failedAttemptId
-                                || latest.status !== "waiting")
-                                return;
-                            const reason = retryIntentBlocker(store, scoped, latest);
-                            if (reason !== undefined)
-                                throw new Error(reason);
-                            runTaskCommand(["run", "retry", `${owner.taskId}/${previous.id}`], store, {
-                                now: () => new Date(at), environment: {}, providerRetryChainId: retry.chainId,
-                                ...(actualTaskReviewCandidate === undefined ? {} : { actualTaskReviewCandidate })
+                            store.transaction(() => {
+                                const latest = load(owner);
+                                if (latest === null || latest.providerBinding == null || latest.providerBinding.run === null
+                                    || latest.providerBinding.run.attemptId !== retry.currentAttemptId
+                                    || latest.providerBinding.run.status !== "delivery-unknown")
+                                    return;
+                                save({ ...latest, providerBinding: { ...latest.providerBinding,
+                                        retry: { ...latest.providerBinding.retry, reason: detail } } });
+                                if (owner.scope === "global") {
+                                    recordGlobalRuntimeAttention(store, owner.roleName, `${retry.currentAttemptId}:unconfirmed`, providerRetryProjection(load(owner)?.providerBinding), new Date(at));
+                                }
+                                if (owner.scope === "task") {
+                                    const event = createTaskEvent(store.nextEventId(owner.taskId), owner.taskId, "provider.retry-unconfirmed", {
+                                        roleName: owner.roleName, attemptId: retry.currentAttemptId, nativeSessionId: retry.nativeSessionId, detail
+                                    }, new Date(at));
+                                    store.saveEvent(owner.taskId, event);
+                                    enqueueWork(store, owner.roleName === "leader" ? { kind: "operator" }
+                                        : { kind: "role", taskId: owner.taskId, roleName: "leader" }, "provider-retry-needs-attention", new Date(at), [{ type: "event", taskId: owner.taskId, id: event.id }]);
+                                }
                             });
-                        });
+                        }
+                        continue;
+                    }
+                    if (retry.successorAutomatic !== false && at >= Date.parse(retry.deadline)) {
+                        stop(set, "deadline-exhausted", at, true);
+                        continue;
                     }
-                    else {
-                        const original = retry.input.kind === "text" ? retry.input.text
-                            : retry.input.kind === "wake"
-                                ? `Yui Task notification: task=${retry.input.taskId} wake=${retry.input.wakeId}.\nRead current Task context and that fixed wake window, including original Messages in full. This is not an execution assignment.`
-                                : retry.input.kind === "message"
-                                    ? `Yui Global Message: role=${retry.input.roleName} message=${retry.input.messageId}.\nRead your Session Context and referenced original Message in full.`
-                                    : undefined;
-                        if (original === undefined) {
-                            stop(set, "original-input-unavailable", at);
-                            continue;
+                    if (at < Date.parse(retry.nextEligibleAt) || blocker !== undefined || binding.goal?.status === "active")
+                        continue;
+                    if (binding.run?.attemptId !== retry.failedAttemptId) {
+                        stop(set, "superseded-input", at);
+                        continue;
+                    }
+                    try {
+                        if (owner.scope === "task" && retry.previousRunId !== undefined) {
+                            if (retry.successorRunId !== undefined || retry.successorReviewRoundId !== undefined)
+                                continue;
+                            const previous = store.getRun(owner.taskId, retry.previousRunId);
+                            if (previous?.status === "active")
+                                continue; // ordinary rejected-delivery terminal fold
+                            if (previous?.status !== "failed") {
+                                stop(set, "run-no-longer-failed", at);
+                                continue;
+                            }
+                            const actualTaskReviewCandidate = await ports.snapshotTaskCandidate?.(previous);
+                            store.transaction(() => {
+                                const latest = load(owner)?.providerBinding?.retry;
+                                if (latest?.chainId !== retry.chainId || latest.failedAttemptId !== retry.failedAttemptId
+                                    || latest.status !== "waiting")
+                                    return;
+                                const reason = retryIntentBlocker(store, scoped, latest);
+                                if (reason !== undefined)
+                                    throw new Error(reason);
+                                runTaskCommand(["run", "retry", `${owner.taskId}/${previous.id}`], store, {
+                                    now: () => new Date(at), environment: {}, providerRetryChainId: retry.chainId,
+                                    ...(actualTaskReviewCandidate === undefined ? {} : { actualTaskReviewCandidate })
+                                });
+                            });
                         }
-                        const result = await (ports.submit ?? sendAgentHostRunControl)({
-                            home, ...scoped, scope: owner.scope,
-                            control: {
-                                protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "submit-turn", nativeSessionId: retry.nativeSessionId,
-                                authority: { epoch: binding.authority.epoch, owner: "controller", holderId: binding.authority.holderId },
-                                run: { attemptId: providerRetryAttemptId(retry), boundedText: original }
+                        else {
+                            const original = retry.input.kind === "text" ? retry.input.text
+                                : retry.input.kind === "wake"
+                                    ? `Yui Task notification: task=${retry.input.taskId} wake=${retry.input.wakeId}.\nRead current Task context and that fixed wake window, including original Messages in full. This is not an execution assignment.`
+                                    : retry.input.kind === "message"
+                                        ? `Yui Global Message: role=${retry.input.roleName} message=${retry.input.messageId}.\nRead your Session Context and referenced original Message in full.`
+                                        : undefined;
+                            if (original === undefined) {
+                                stop(set, "original-input-unavailable", at);
+                                continue;
+                            }
+                            const result = await (ports.submit ?? sendAgentHostRunControl)({
+                                home, ...scoped, scope: owner.scope,
+                                control: {
+                                    protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "submit-turn", nativeSessionId: retry.nativeSessionId,
+                                    authority: { epoch: binding.authority.epoch, owner: "controller", holderId: binding.authority.holderId },
+                                    run: { attemptId: providerRetryAttemptId(retry), boundedText: original }
+                                }
+                            });
+                            // Durable settlement belongs to Host/Controller ingress. In
+                            // particular a lost response is never a reason to replay.
+                            if (result.outcome === "rejected" && result.failure?.registrationDisposition === "not-committed"
+                                && result.failure.errorName !== "ProviderTurnBusyError") {
+                                stop(set, result.failure.detail, at);
                             }
-                        });
-                        // Durable settlement belongs to Host/Controller ingress. In
-                        // particular a lost response is never a reason to replay.
-                        if (result.outcome === "rejected" && result.failure?.registrationDisposition === "not-committed"
-                            && result.failure.errorName !== "ProviderTurnBusyError") {
-                            stop(set, result.failure.detail, at);
                         }
                     }
+                    catch (error) {
+                        // A send failure may have applied. A durable submitting/unknown
+                        // identity fences it; do not manufacture a successor to uncertainty.
+                        const latest = load(owner);
+                        if (latest?.providerBinding?.run?.attemptId === retry.failedAttemptId) {
+                            stop(set, error instanceof Error ? error.message : String(error), at);
+                        }
+                        throw error;
+                    }
                 }
                 catch (error) {
-                    // A send failure may have applied. A durable submitting/unknown
-                    // identity fences it; do not manufacture a successor to uncertainty.
-                    const latest = load(owner);
-                    if (latest?.providerBinding?.run?.attemptId === retry.failedAttemptId) {
-                        stop(set, error instanceof Error ? error.message : String(error), at);
-                    }
-                    ports.onError?.(error);
+                    const failure = new Error(`Provider retry failed for ${owner.scope === "task" ? owner.taskId : "global"}/${owner.roleName}: `
+                        + `${error instanceof Error ? error.message : String(error)}. `
+                        + "Inspect the current attempt; failed observation does not authorize replay.", { cause: error });
+                    if (ports.onError === undefined)
+                        throw failure;
+                    ports.onError(failure);
                 }
             }
         }

package/dist/controller/runtime.js

@@ -431,7 +431,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         const jobControl = kernel.jobs;
         const continuationReconciler = options.continuationMetadata === undefined
             ? undefined
-            : new ProviderContinuationReconciliationService(store, schedulerStore, options.continuationMetadata);
+            : new ProviderContinuationReconciliationService(store, schedulerStore, options.continuationMetadata, options.onError);
         const running = await startFileTaskController(home, schedulerStore, delivery, (method, params) => method === "task.role-capabilities"
             ? readTaskAgentCapabilities(store, catalogs, params)
             : method === "web.start" || method === "web.stop" || method === "web.status"

package/dist/controller/structuredProviderObservation.js

@@ -381,7 +381,7 @@ function observation(input) {
         payload: input.payload ?? {}
     };
     return createRuntimeObservation({
-        schemaVersion: 4,
+        schemaVersion: 1,
         eventId,
         semanticKey: runtimeObservationSemanticKey(partial),
         kind: input.kind,

package/dist/coordination/workMailbox.js

@@ -2,7 +2,7 @@ import { validateTaskRecordReference } from "../task/taskRecordReference.js";
 const RECENT_DEDUPE_KEY_LIMIT = 256;
 export function createWorkMailbox(target) {
     return {
-        schemaVersion: 5,
+        schemaVersion: 1,
         target: copyTarget(target),
         nextSequence: 1,
         processing: null,
@@ -13,8 +13,8 @@ export function createWorkMailbox(target) {
 export function validateWorkMailbox(value) {
     const mailbox = record(value, "WorkMailbox");
     exact(mailbox, ["schemaVersion", "target", "nextSequence", "processing", "pending", "recentDedupeKeys"], "WorkMailbox");
-    if (mailbox.schemaVersion !== 5)
-        throw new Error("WorkMailbox must use schemaVersion 5");
+    if (mailbox.schemaVersion !== 1)
+        throw new Error("WorkMailbox must use schemaVersion 1");
     const target = parseTarget(mailbox.target);
     const nextSequence = requireInteger(mailbox.nextSequence, 1, "WorkMailbox nextSequence");
     const processing = mailbox.processing === null ? null : parseProcessing(mailbox.processing);
@@ -38,7 +38,7 @@ export function validateWorkMailbox(value) {
         }
     }
     return {
-        schemaVersion: 5,
+        schemaVersion: 1,
         target,
         nextSequence,
         processing,

package/dist/core/controllerIdentity.js

@@ -0,0 +1,25 @@
+import { compareStorageVersions, isStorageVersion } from "../storage/storageVersions.js";
+export function isControllerIdentity(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const record = value;
+    return typeof record.executablePath === "string" && record.executablePath.length > 0
+        && Array.isArray(record.args) && record.args.every(arg => typeof arg === "string")
+        && typeof record.version === "string" && record.version.length > 0
+        && Number.isSafeInteger(record.controllerProtocolVersion) && record.controllerProtocolVersion > 0
+        && isStorageVersion(record.storageVersion) && isStorageVersion(record.minimumStorageVersion)
+        && compareStorageVersions(record.minimumStorageVersion, record.storageVersion) <= 0;
+}
+export function parseControllerIdentity(value) {
+    if (!isControllerIdentity(value)) {
+        throw new Error("Controller identity must include the exact executable, argv, package, protocol and storage versions.");
+    }
+    return {
+        executablePath: value.executablePath,
+        args: [...value.args],
+        version: value.version,
+        controllerProtocolVersion: value.controllerProtocolVersion,
+        storageVersion: value.storageVersion,
+        minimumStorageVersion: value.minimumStorageVersion
+    };
+}

package/dist/core/controllerProcessIdentity.js

@@ -1,7 +1,7 @@
 import { readFileSync, readdirSync } from "node:fs";
 import { readLinuxProcessStartIdentity } from "../controller/domainIdentity.js";
 import { readHomeFilesystemId, validateHomeFilesystemId } from "./homeFilesystemIdentity.js";
-/** Exact live-process fence used only at Controller startup and v3 handoff. */
+/** Exact live-process fence used at Controller startup and handover. */
 export function inspectLiveControllerProcess(pid, homeFilesystemId, expectedProcessStartIdentity) {
     if (!Number.isSafeInteger(pid) || pid < 1 || pid === process.pid)
         return undefined;
@@ -39,7 +39,7 @@ export function inspectLiveControllerProcess(pid, homeFilesystemId, expectedProc
         return undefined;
     }
 }
-/** Finds an older/current Controller whose discovery record was lost. */
+/** Finds a Controller whose discovery record was lost. */
 export function findLiveControllerProcessForHome(homeFilesystemId) {
     validateHomeFilesystemId(homeFilesystemId);
     if (process.platform !== "linux")