@zq-silk/yui 0.6.16 → 0.7.0

package/dist/controller/fileSchedulerStoreAdapter.js

@@ -12,10 +12,12 @@ import { answerInputRequest } from "../input/inputRequest.js";
 import { activeRoleAgentBinding, updateRoleStatus } from "../role/role.js";
 import { effectiveLaunchWithTaskMainWorkspace, effectiveLaunchSnapshotsCompatible, effectiveLaunchSnapshotsCompatibleForTaskMain, resolveEffectiveLaunch, validateEffectiveLaunchSnapshot } from "../executor/effectiveLaunch.js";
 import { SYSTEM_OPERATOR_ROLE } from "../role/systemRoles.js";
-import { failAgentRun, markAgentRunDelivered, markAgentRunPushed, reopenRunForProviderRetry, withProviderRetry } from "../run/agentRun.js";
+import { failAgentRun, markAgentRunDelivered, markAgentRunPushed, reopenRunForProviderRetry, clearProviderRetryOnProgress, agentRunDeliveryReceiptId, withProviderRetry } from "../run/agentRun.js";
+import { markWorkflowOutcomeRequestDispatched } from "../run/runControlRequest.js";
 import { classifyProviderError, isRetryableProviderErrorClass } from "../lifecycle/providerErrorClass.js";
-import { providerRetryBudgetExhausted, providerRetryIsDue, scheduleProviderRetry } from "../run/providerRetry.js";
-import { providerRetryConfig } from "../run/providerRetryConfig.js";
+import { deferProviderRetry, markProviderRetryDispatched, providerRetryIsDue, scheduleProviderRetry } from "../run/providerRetry.js";
+import { providerRetryAdapterEnabled, providerRetryConfig } from "../run/providerRetryConfig.js";
+import { classifyRuntimeProcessExit, validateRuntimeProcessExitObservation } from "../runtime/processExitObservation.js";
 import { terminalizeExactTaskRun } from "../lifecycle/exactRunTerminalization.js";
 import { createCanonicalLifecycleEvent, foldCanonicalLifecycleEvent } from "../lifecycle/canonicalLifecycleEvent.js";
 import { recordLeaderFailure } from "../scheduler/leaderFailure.js";
@@ -36,6 +38,8 @@ import { nativeSessionIdForLaunch } from "../runtime/preallocatedNativeSession.j
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
 import { RUNTIME_OBSERVATION_TASK_EVENT, createRuntimeObservation, runtimeObservationFenceMatches, runtimeObservationFromTaskEvent, runtimeObservationRunFenceMatches, runtimeObservationTaskEventPayload } from "../runtime/runtimeObservation.js";
 import { projectRuntimeTaskEvents } from "../runtime/runtimeProjection.js";
+import { contextSnapshotRef } from "../context/contextSnapshot.js";
+import { contextSnapshotDeltaRefIds, freezeRunContextSnapshot } from "../context/runContextPack.js";
 /** Maps the authoritative FileTaskStore records to the scheduler's narrow port. */
 export class FileSchedulerStoreAdapter {
     store;
@@ -47,6 +51,19 @@ export class FileSchedulerStoreAdapter {
         this.telemetry = telemetry;
         this.drivers = drivers;
     }
+    freezeLeaderContextSnapshot(taskId, roleName, now) {
+        return this.store.transaction((tx) => {
+            const snapshot = freezeRunContextSnapshot(tx, {
+                taskId,
+                roleName,
+                purpose: "execution"
+            }, now);
+            return Object.freeze({
+                ref: contextSnapshotRef(snapshot),
+                deltaRefIds: contextSnapshotDeltaRefIds(tx, snapshot)
+            });
+        });
+    }
     /**
      * Sole provider-independent ingress for structured runtime state. Driver
      * mapping has already happened before this boundary; this method validates
@@ -142,6 +159,7 @@ export class FileSchedulerStoreAdapter {
                     adapterId,
                     launchId: input.fence.launchId,
                     nativeSessionId: input.fence.nativeSessionId,
+                    nativeTurnId: input.fence.nativeTurnId,
                     runId: input.fence.runId,
                     ...(failureEvidence.errorCode === undefined
                         ? {}
@@ -152,7 +170,10 @@ export class FileSchedulerStoreAdapter {
                         : { errorDetails: failureEvidence.details }),
                     ...(failureEvidence.lastOutput === undefined
                         ? {}
-                        : { lastAssistantMessage: failureEvidence.lastOutput })
+                        : { lastAssistantMessage: failureEvidence.lastOutput }),
+                    ...(failureEvidence.retryAfterMs === undefined
+                        ? {}
+                        : { retryAfterMs: failureEvidence.retryAfterMs })
                 };
                 if (this.classifyRuntimeTurnFailed(failure) !== "apply")
                     return "obsolete";
@@ -191,6 +212,11 @@ export class FileSchedulerStoreAdapter {
             default:
                 outcome = "obsolete";
         }
+        if (outcome === "applied"
+            && input.kind === "activity.observed"
+            && input.payload.activityId !== undefined) {
+            this.clearProviderRetryForProgress(input, "correlated-activity", now);
+        }
         if (outcome === "applied")
             this.persistRuntimeObservation(input, now);
         return outcome;
@@ -1226,19 +1252,46 @@ export class FileSchedulerStoreAdapter {
             if (active === null || active.id !== input.run.id) {
                 throw new Error(`Active Agent run changed before delivery was persisted: ${input.run.id}.`);
             }
+            let deliveryRun = active;
+            if (active.providerRetry?.state === "dispatching") {
+                deliveryRun = withProviderRetry(active, markProviderRetryDispatched(active.providerRetry));
+                store.saveAgentRun(deliveryRun);
+                store.saveEvent(task.id, createTaskEvent(store.nextEventId(task.id), task.id, "runtime.provider-retry-dispatched", {
+                    runId: active.id,
+                    roleName: active.roleName,
+                    episodeId: active.providerRetry.episodeId,
+                    receiptId: active.providerRetry.lastRetryReceiptId ?? "",
+                    dispatchedRetries: String(active.providerRetry.dispatchedRetries + 1)
+                }, input.now));
+            }
+            if (active.controlRequest?.state === "dispatching") {
+                deliveryRun = {
+                    ...active,
+                    controlRequest: markWorkflowOutcomeRequestDispatched(active.controlRequest)
+                };
+                store.saveAgentRun(deliveryRun);
+                store.saveEvent(task.id, createTaskEvent(store.nextEventId(task.id), task.id, "runtime.workflow-outcome-request-dispatched", {
+                    runId: active.id,
+                    roleName: active.roleName,
+                    requestId: active.controlRequest.requestId,
+                    receiptId: active.controlRequest.receiptId,
+                    nativeTurnId: active.controlRequest.nativeTurnId
+                }, input.now));
+            }
             // Transport success records prompt-pushed ONLY. Acceptance (deliveredAt)
             // is written exclusively by an exact provider-accepted fold, never by the
             // transport receipt — that removes the transport-to-delivered false path.
-            if (active.pushedAt === undefined) {
-                store.saveAgentRun(markAgentRunPushed(active, input.now));
-                markTaskRoleRunPushedInFlight(store, role, input.run, input.now);
-                store.saveEvent(task.id, createTaskEvent(store.nextEventId(task.id), task.id, "run.pushed", runLaunchEventPayload(active), input.now));
+            if (deliveryRun.pushedAt === undefined) {
+                const pushed = markAgentRunPushed(deliveryRun, input.now);
+                store.saveAgentRun(pushed);
+                markTaskRoleRunPushedInFlight(store, role, pushed, input.now);
+                store.saveEvent(task.id, createTaskEvent(store.nextEventId(task.id), task.id, "run.pushed", runLaunchEventPayload(pushed), input.now));
             }
             else {
                 const sessions = store.getTaskRoleSessionSet(input.task.id, input.role.name);
                 if (sessions?.inFlight?.runId === input.run.id
                     && sessions.inFlight.pushedAt === undefined) {
-                    markTaskRoleRunPushedInFlight(store, role, input.run, input.now);
+                    markTaskRoleRunPushedInFlight(store, role, deliveryRun, input.now);
                 }
             }
             if (role.status !== "running") {
@@ -1317,7 +1370,7 @@ export class FileSchedulerStoreAdapter {
                 || mailbox.processing.executionRef?.type !== "run"
                 || mailbox.processing.executionRef.taskId !== input.taskId
                 || mailbox.processing.executionRef.id !== input.runId
-                || !preparedDeliveryFailureSessionFenceMatches(sessions, session, input)
+                || !preparedDeliveryFailureSessionFenceMatches(sessions, session, input, agentRunDeliveryReceiptId(active))
                 || !preparedReservationMatches(runtimeMailbox, input.taskId, input.runId, input.launchId)) {
                 return "state-changed";
             }
@@ -1327,7 +1380,7 @@ export class FileSchedulerStoreAdapter {
                 roleName: input.roleName,
                 agentId: input.agentId,
                 runId: input.runId,
-                receiptId: formatAgentRunReceiptId(input.taskId, input.runId),
+                receiptId: agentRunDeliveryReceiptId(active),
                 ...(session?.nativeSessionId === undefined
                     ? {}
                     : { nativeSessionId: session.nativeSessionId }),
@@ -1441,7 +1494,7 @@ export class FileSchedulerStoreAdapter {
                 && sessions !== null
                 && (sessions.inFlight.agentId !== currentRun.effective.agentId
                     || sessions.inFlight.runId !== currentRun.id
-                    || sessions.inFlight.receiptId !== formatAgentRunReceiptId(task.id, currentRun.id))) {
+                    || sessions.inFlight.receiptId !== agentRunDeliveryReceiptId(currentRun))) {
                 return "state-changed";
             }
             // Review launch failure uses the aggregate exact-terminalization path.
@@ -1463,7 +1516,7 @@ export class FileSchedulerStoreAdapter {
                     roleName: role.name,
                     agentId: currentRun.effective.agentId,
                     runId: currentRun.id,
-                    receiptId: formatAgentRunReceiptId(task.id, currentRun.id),
+                    receiptId: agentRunDeliveryReceiptId(currentRun),
                     ...(input.session?.nativeSessionId === undefined
                         ? {}
                         : { nativeSessionId: input.session.nativeSessionId }),
@@ -1870,7 +1923,7 @@ export class FileSchedulerStoreAdapter {
             || session.launchId !== input.launchId
             || sessions.inFlight?.agentId !== input.agentId
             || sessions.inFlight.runId !== input.runId
-            || sessions.inFlight.receiptId !== `agent-run:${input.taskId}/${input.runId}`)
+            || sessions.inFlight.receiptId !== agentRunDeliveryReceiptId(run))
             return "obsolete";
         return "apply";
     }
@@ -1892,7 +1945,7 @@ export class FileSchedulerStoreAdapter {
                 roleName: input.roleName,
                 agentId: input.agentId,
                 runId: input.runId,
-                receiptId: `agent-run:${input.taskId}/${input.runId}`,
+                receiptId: agentRunDeliveryReceiptId(before),
                 nativeSessionId: input.nativeSessionId,
                 launchId: input.launchId,
                 outcome: {
@@ -1962,7 +2015,7 @@ export class FileSchedulerStoreAdapter {
             errorDetails: input.errorDetails,
             summary: input.lastAssistantMessage
         });
-        const adapterEnabled = config.adapters.includes(input.adapterId);
+        const adapterEnabled = providerRetryAdapterEnabled(config, input.adapterId);
         const retryable = adapterEnabled
             && isRetryableProviderErrorClass(classification.errorClass);
         const shadow = config.mode === "shadow";
@@ -1981,31 +2034,101 @@ export class FileSchedulerStoreAdapter {
                 if (blocked !== null)
                     return blocked;
             }
+            if (!shadow && classification.errorClass === "context-capacity") {
+                const blocked = this.applyContextCapacityBlock(store, input, summary, now);
+                if (blocked !== null)
+                    return blocked;
+            }
+            if (!shadow && classification.errorClass === "session-dead") {
+                const run = store.getAgentRun(input.taskId, input.runId);
+                if (run !== null && run.status === "active" && run.mode === "resume") {
+                    // A structured failure on the exact resume launch is the only Core
+                    // evidence that native continuation is unrecoverable. The normal
+                    // terminal path below may now request a fresh managed generation.
+                    store.saveEvent(input.taskId, createTaskEvent(store.nextEventId(input.taskId), input.taskId, "runtime.native-resume-unrecoverable", {
+                        eventId: input.eventId,
+                        runId: input.runId,
+                        roleName: input.roleName,
+                        launchId: input.launchId,
+                        nativeSessionId: input.nativeSessionId,
+                        ...(run.assignment.contextSnapshotRef === undefined
+                            ? {}
+                            : {
+                                contextSnapshotId: run.assignment.contextSnapshotRef.id,
+                                contextSnapshotDigest: run.assignment.contextSnapshotRef.digest
+                            })
+                    }, now));
+                }
+                else {
+                    const blocked = this.applyNativeSessionRecoverabilityBlock(store, input, summary, now);
+                    if (blocked !== null)
+                        return blocked;
+                }
+            }
             return null;
         }
+        // transport-uncertain: the Provider may have accepted the turn. If a
+        // native completion is already durable, the completion path owns the
+        // yield; do not resend.
+        if (classification.errorClass === "transport-uncertain") {
+            const driver = this.drivers.requireByAdapterId(input.adapterId);
+            if (driver.capabilities.lifecycle.deliveryDeduplication !== "exact") {
+                const run = store.getAgentRun(input.taskId, input.runId);
+                if (run === null || run.status !== "active")
+                    return null;
+                const blocked = scheduleProviderRetry(run.providerRetry, {
+                    failureEventId: input.eventId,
+                    errorClass: classification.errorClass,
+                    launchId: input.launchId,
+                    nativeSessionId: input.nativeSessionId,
+                    failedNativeTurnId: input.nativeTurnId,
+                    lastErrorSummary: summary,
+                    scheduleNextAttempt: false
+                }, now);
+                if (blocked.outcome === "exhausted")
+                    return null;
+                store.saveAgentRun(withProviderRetry(run, blocked.retry));
+                this.recordProviderRetryClassified(store, input, classification.errorClass, {
+                    wouldRetry: "false",
+                    shadow: "false",
+                    note: "delivery-deduplication-unproven"
+                }, now);
+                enqueueWork(store, input.roleName === "leader"
+                    ? { kind: "operator" }
+                    : { kind: "role", taskId: input.taskId, roleName: "leader" }, "provider-delivery-uncertain", now, [{ type: "run", taskId: input.taskId, id: input.runId }]);
+                return { disposition: "applied", runId: input.runId };
+            }
+        }
         const run = store.getAgentRun(input.taskId, input.runId);
         if (run === null || run.status !== "active")
             return null;
-        // A retry lineage that has used its total budget terminalizes with one
-        // structured failure instead of looping. The Run falls through to the
-        // normal terminalization path below.
-        if (run.providerRetry !== undefined
-            && providerRetryBudgetExhausted(run.providerRetry, now, config.maxWindowMs)) {
+        const retryDecision = scheduleProviderRetry(run.providerRetry, {
+            failureEventId: input.eventId,
+            errorClass: classification.errorClass,
+            launchId: input.launchId,
+            nativeSessionId: input.nativeSessionId,
+            failedNativeTurnId: input.nativeTurnId,
+            lastErrorSummary: summary,
+            ...(input.retryAfterMs === undefined ? {} : { retryAfterMs: input.retryAfterMs })
+        }, now);
+        if (retryDecision.outcome === "exhausted") {
             this.recordProviderRetryClassified(store, input, classification.errorClass, {
                 wouldRetry: "false",
                 shadow: "false",
-                basis: classification.basis,
-                note: "retry-budget-exhausted",
-                attempt: String(run.providerRetry.attempt)
+                note: `episode-exhausted-${retryDecision.reason}`,
+                consecutiveFailures: String(run.providerRetry?.consecutiveFailures ?? 0),
+                dispatchedRetries: String(run.providerRetry?.dispatchedRetries ?? 0)
             }, now);
-            return null;
+            if (run.providerRetry === undefined)
+                return null;
+            const finalized = finalizeProviderRetryDeadline(store, run, retryDecision.reason === "attempts"
+                ? "Provider retry failed after all three in-Session continuation attempts."
+                : retryDecision.reason === "retry-after-window"
+                    ? "Provider Retry-After exceeded the bounded 600-second episode window."
+                    : "Provider retry did not recover within the bounded 600-second episode window.", retryDecision.reason === "attempts" ? "attempts-exhausted" : "episode-window-exhausted", now);
+            return finalized ? { disposition: "applied", runId: input.runId } : null;
         }
-        const retry = scheduleProviderRetry(run.providerRetry, {
-            errorClass: classification.errorClass,
-            launchId: input.launchId,
-            nativeSessionId: input.nativeSessionId,
-            lastErrorSummary: summary
-        }, now);
+        const retry = retryDecision.retry;
         store.saveAgentRun(withProviderRetry(run, retry));
         // Clear the in-flight fence so the original Session can be re-bound and
         const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
@@ -2014,7 +2137,7 @@ export class FileSchedulerStoreAdapter {
             store.saveTaskRoleSessionSet(clearTaskRoleRun(sessions, {
                 agentId: input.agentId,
                 runId: input.runId,
-                receiptId: `agent-run:${input.taskId}/${input.runId}`
+                receiptId: agentRunDeliveryReceiptId(run)
             }, now));
         }
         // Settle the delivery claim so the retry push can re-claim the mailbox.
@@ -2036,8 +2159,8 @@ export class FileSchedulerStoreAdapter {
         this.recordProviderRetryClassified(store, input, classification.errorClass, {
             wouldRetry: "true",
             shadow: "false",
-            basis: classification.basis,
-            attempt: String(retry.attempt),
+            consecutiveFailures: String(retry.consecutiveFailures),
+            dispatchedRetries: String(retry.dispatchedRetries),
             nextAttemptAt: retry.nextAttemptAt
         }, now);
         return { disposition: "applied", runId: input.runId };
@@ -2052,14 +2175,18 @@ export class FileSchedulerStoreAdapter {
         const run = store.getAgentRun(input.taskId, input.runId);
         if (run === null || run.status !== "active")
             return null;
-        const retry = scheduleProviderRetry(run.providerRetry, {
+        const retryDecision = scheduleProviderRetry(run.providerRetry, {
+            failureEventId: input.eventId,
             errorClass: "policy-denied",
             launchId: input.launchId,
             nativeSessionId: input.nativeSessionId,
+            failedNativeTurnId: input.nativeTurnId,
             lastErrorSummary: summary,
             scheduleNextAttempt: false
         }, now);
-        store.saveAgentRun(withProviderRetry(run, retry));
+        if (retryDecision.outcome === "exhausted")
+            return null;
+        store.saveAgentRun(withProviderRetry(run, retryDecision.retry));
         this.recordProviderRetryClassified(store, input, "policy-denied", {
             wouldRetry: "false",
             shadow: "false",
@@ -2078,6 +2205,80 @@ export class FileSchedulerStoreAdapter {
         }
         return { disposition: "applied", runId: input.runId };
     }
+    /**
+     * Exact Provider capacity failures never trigger a token-threshold rollover.
+     * Keep the native lineage intact and surface the Driver's explicit native
+     * compaction/resume capability; unsupported/unknown capabilities fail safe
+     * for Leader/Operator action instead of forcing a fresh generation.
+     */
+    applyContextCapacityBlock(store, input, summary, now) {
+        const run = store.getAgentRun(input.taskId, input.runId);
+        if (run === null || run.status !== "active")
+            return null;
+        const decision = scheduleProviderRetry(run.providerRetry, {
+            failureEventId: input.eventId,
+            errorClass: "context-capacity",
+            launchId: input.launchId,
+            nativeSessionId: input.nativeSessionId,
+            failedNativeTurnId: input.nativeTurnId,
+            lastErrorSummary: summary,
+            scheduleNextAttempt: false
+        }, now);
+        if (decision.outcome === "exhausted")
+            return null;
+        store.saveAgentRun(withProviderRetry(run, decision.retry));
+        const driver = this.drivers.requireByAdapterId(input.adapterId);
+        store.saveEvent(input.taskId, createTaskEvent(store.nextEventId(input.taskId), input.taskId, "runtime.context-capacity-failure", {
+            eventId: input.eventId,
+            runId: input.runId,
+            roleName: input.roleName,
+            nativeSessionId: input.nativeSessionId,
+            launchId: input.launchId,
+            compactionCapability: driver.capabilities.lifecycle.compaction,
+            nativeResumeCapability: driver.capabilities.lifecycle.nativeConversationResume,
+            action: driver.capabilities.lifecycle.compaction === "native-explicit"
+                ? "native-explicit-compaction-required"
+                : "await-provider-native-recovery"
+        }, now));
+        this.recordProviderRetryClassified(store, input, "context-capacity", {
+            wouldRetry: "false",
+            shadow: "false",
+            note: "provider-native-capacity-recovery-only"
+        }, now);
+        enqueueWork(store, input.roleName === "leader"
+            ? { kind: "operator" }
+            : { kind: "role", taskId: input.taskId, roleName: "leader" }, "provider-context-capacity-recovery-required", now, [{ type: "run", taskId: input.taskId, id: input.runId }]);
+        return { disposition: "applied", runId: input.runId };
+    }
+    applyNativeSessionRecoverabilityBlock(store, input, summary, now) {
+        const run = store.getAgentRun(input.taskId, input.runId);
+        if (run === null || run.status !== "active")
+            return null;
+        const decision = scheduleProviderRetry(run.providerRetry, {
+            failureEventId: input.eventId,
+            errorClass: "session-dead",
+            launchId: input.launchId,
+            nativeSessionId: input.nativeSessionId,
+            failedNativeTurnId: input.nativeTurnId,
+            lastErrorSummary: summary,
+            scheduleNextAttempt: false
+        }, now);
+        if (decision.outcome === "exhausted")
+            return null;
+        store.saveAgentRun(withProviderRetry(run, decision.retry));
+        store.saveEvent(input.taskId, createTaskEvent(store.nextEventId(input.taskId), input.taskId, "runtime.native-session-recoverability-unproven", {
+            eventId: input.eventId,
+            runId: input.runId,
+            roleName: input.roleName,
+            launchId: input.launchId,
+            nativeSessionId: input.nativeSessionId,
+            requiredEvidence: "exact-native-resume-outcome"
+        }, now));
+        enqueueWork(store, input.roleName === "leader"
+            ? { kind: "operator" }
+            : { kind: "role", taskId: input.taskId, roleName: "leader" }, "native-session-recoverability-unproven", now, [{ type: "run", taskId: input.taskId, id: input.runId }]);
+        return { disposition: "applied", runId: input.runId };
+    }
     recordProviderRetryClassified(store, input, errorClass, extra, now) {
         store.saveEvent(input.taskId, createTaskEvent(store.nextEventId(input.taskId), input.taskId, "runtime.provider-retry-classified", {
             eventId: input.eventId,
@@ -2095,6 +2296,54 @@ export class FileSchedulerStoreAdapter {
     listPendingProviderRetries(taskIds) {
         return this.store.listPendingProviderRetries(taskIds);
     }
+    saveRoleHostExitObservation(input) {
+        this.store.transaction((store) => {
+            const identity = [
+                input.taskId,
+                input.roleName,
+                input.runId,
+                input.launchId ?? "unknown-launch",
+                String(input.deadStatus ?? "unknown-status")
+            ].join("\0");
+            const observationId = `tmux-host-exit-${createHash("sha256").update(identity).digest("hex")}`;
+            const events = store.listEvents(input.taskId);
+            if (events.some((event) => (event.type === "runtime.process-exit-observed"
+                && event.payload.observationId === observationId)))
+                return;
+            const stopReceipt = [...events].reverse().find((event) => (event.type === "runtime.session-termination"
+                && event.payload.roleName === input.roleName
+                && (input.launchId === undefined || event.payload.launchId === input.launchId)
+                && ["stop-requested", "graceful-stop", "forced-stop", "stop-confirmed"]
+                    .includes(event.payload.outcome ?? "")));
+            const observation = validateRuntimeProcessExitObservation({
+                schemaVersion: 1,
+                observationId,
+                hostSequence: 1,
+                hostInstanceId: `tmux-${input.launchId ?? input.roleName}`,
+                taskId: input.taskId,
+                roleName: input.roleName,
+                runId: input.runId,
+                launchId: input.launchId ?? `unknown-${input.runId}`,
+                ...(input.nativeSessionId === undefined
+                    ? {}
+                    : { nativeSessionId: input.nativeSessionId }),
+                processKind: "agent-host",
+                ...(input.deadStatus === undefined ? {} : { exitCode: input.deadStatus }),
+                ...(stopReceipt === undefined ? {} : { stopReceiptId: stopReceipt.id }),
+                observedAt: input.observedAt.toISOString()
+            });
+            const classification = classifyRuntimeProcessExit(observation, {});
+            store.saveEvent(input.taskId, createTaskEvent(store.nextEventId(input.taskId), input.taskId, "runtime.process-exit-observed", {
+                observationId,
+                processKind: "agent-host",
+                roleName: input.roleName,
+                launchId: observation.launchId,
+                observedAt: observation.observedAt,
+                classification,
+                observation: JSON.stringify(observation)
+            }, input.observedAt));
+        });
+    }
     /**
      * Issue 04: reopens each due retry on its original Native Session. A Run
      * whose Session is proven dead terminalizes with an exact replacement
@@ -2105,129 +2354,78 @@ export class FileSchedulerStoreAdapter {
         const selectedTaskIds = taskIds === undefined
             ? undefined
             : [...taskIds].sort((left, right) => (left.localeCompare(right, undefined, { numeric: true })));
-        const due = this.listPendingProviderRetries(selectedTaskIds).filter((entry) => Date.parse(entry.nextAttemptAt) <= now.getTime());
+        const due = this.listPendingProviderRetries(selectedTaskIds).filter((entry) => Date.parse(entry.dueAt) <= now.getTime());
         const reopened = [];
-        const config = providerRetryConfig(this.store.getConfig());
         for (const entry of due) {
             this.store.transaction((store) => {
                 const run = store.getAgentRun(entry.taskId, entry.runId);
                 if (run === null
                     || run.status !== "active"
-                    || run.providerRetry === undefined
+                    || run.providerRetry === undefined) {
+                    return;
+                }
+                if (run.providerRetry.state === "dispatching"
+                    || run.providerRetry.state === "awaiting-progress") {
+                    if (now.getTime() < Date.parse(run.providerRetry.episodeDeadlineAt))
+                        return;
+                    finalizeProviderRetryDeadline(store, run, run.providerRetry.state === "dispatching"
+                        ? "Provider retry delivery outcome remained uncertain through the bounded episode deadline; no correlated Provider progress was observed."
+                        : "Provider retry produced no correlated Provider input/output progress before the bounded episode deadline.", run.providerRetry.state === "dispatching"
+                        ? "retry-delivery-outcome-uncertain"
+                        : "provider-progress-timeout", now);
+                    return;
+                }
+                if (run.providerRetry.state !== "scheduled"
                     || run.providerRetry.nextAttemptAt === undefined
                     || !providerRetryIsDue(run.providerRetry, now)) {
                     return;
                 }
                 const sessions = store.getTaskRoleSessionSet(entry.taskId, entry.roleName);
                 const session = sessions?.sessions[run.effective.agentId];
-                // Budget exhausted: one structured terminal failure, never a loop.
-                if (providerRetryBudgetExhausted(run.providerRetry, now, config.maxWindowMs)) {
-                    const summary = `Provider retry budget exhausted after ${run.providerRetry.attempt} attempt(s) `
-                        + `(run ${run.id}, error class ${run.providerRetry.errorClass}, `
-                        + `last error: ${run.providerRetry.lastErrorSummary}). `
-                        + `The original Session requires an explicit Leader recovery decision.`;
-                    const result = terminalizeExactTaskRun(store, {
-                        taskId: entry.taskId,
-                        roleName: entry.roleName,
-                        agentId: run.effective.agentId,
-                        runId: run.id,
-                        receiptId: formatAgentRunReceiptId(entry.taskId, run.id),
-                        ...(run.providerRetry.nativeSessionId === undefined
-                            ? {}
-                            : { nativeSessionId: run.providerRetry.nativeSessionId }),
-                        ...(run.providerRetry.launchId === undefined
-                            ? {}
-                            : { launchId: run.providerRetry.launchId }),
-                        outcome: { status: "failed", summary }
-                    }, now);
-                    if (result.disposition !== "applied")
-                        return;
-                    store.saveEvent(entry.taskId, createTaskEvent(store.nextEventId(entry.taskId), entry.taskId, "runtime.provider-retry-budget-exhausted", {
-                        runId: run.id,
-                        attempt: String(run.providerRetry.attempt),
-                        errorClass: run.providerRetry.errorClass
-                    }, now));
-                    enqueueWork(store, { kind: "role", taskId: entry.taskId, roleName: "leader" }, "role-run-failed", now, [{ type: "run", taskId: entry.taskId, id: run.id }]);
-                    return;
-                }
                 const identityMatches = session !== undefined
                     && session.adapterId === run.effective.adapterId
                     && (run.providerRetry.nativeSessionId === undefined
                         || session.nativeSessionId === run.providerRetry.nativeSessionId)
                     && (run.providerRetry.launchId === undefined
                         || session.launchId === run.providerRetry.launchId);
-                const sessionAlive = identityMatches
-                    && session.status !== "stopped"
-                    && session.status !== "broken";
-                if (sessionAlive) {
-                    // The CLI process is still alive. Enter a grace period: let the
-                    // Provider reconnect and finish the turn itself instead of sending
-                    // a duplicate prompt. Reschedule with the next backoff; a late
-                    // completion is attributed to this Run by observeRuntimeTurnCompleted.
-                    const retry = scheduleProviderRetry(run.providerRetry, {
-                        errorClass: run.providerRetry.errorClass,
-                        ...(run.providerRetry.launchId === undefined
-                            ? {}
-                            : { launchId: run.providerRetry.launchId }),
-                        ...(run.providerRetry.nativeSessionId === undefined
-                            ? {}
-                            : { nativeSessionId: run.providerRetry.nativeSessionId }),
-                        lastErrorSummary: run.providerRetry.lastErrorSummary
-                    }, now);
-                    store.saveAgentRun(withProviderRetry(run, retry));
-                    store.saveEvent(entry.taskId, createTaskEvent(store.nextEventId(entry.taskId), entry.taskId, "runtime.provider-retry-waiting", {
-                        runId: run.id,
-                        attempt: String(retry.attempt),
-                        ...(retry.nextAttemptAt === undefined
-                            ? {}
-                            : { nextAttemptAt: retry.nextAttemptAt })
-                    }, now));
+                if (!identityMatches || session?.nativeSessionId === undefined) {
+                    // Local Session projection loss is not native-session-dead evidence.
+                    // Preserve the Run and episode for explicit same-generation recovery;
+                    // only an exact Provider-native resume response may terminalize it as
+                    // unrecoverable.
+                    const deferred = deferProviderRetry(run.providerRetry, now);
+                    if (deferred === null) {
+                        finalizeProviderRetryDeadline(store, run, "Provider retry safety could not be re-established before the bounded episode deadline; native Session recoverability remains unproven.", "native-resume-unproven", now);
+                        return;
+                    }
+                    store.saveAgentRun(withProviderRetry(run, deferred));
+                    if (!store.listEvents(entry.taskId).some((event) => (event.type === "runtime.provider-retry-native-resume-unproven"
+                        && event.payload.runId === run.id))) {
+                        store.saveEvent(entry.taskId, createTaskEvent(store.nextEventId(entry.taskId), entry.taskId, "runtime.provider-retry-native-resume-unproven", {
+                            runId: run.id,
+                            consecutiveFailures: String(run.providerRetry.consecutiveFailures),
+                            dispatchedRetries: String(run.providerRetry.dispatchedRetries)
+                        }, now));
+                    }
+                    enqueueWork(store, { kind: "operator" }, "provider-retry-native-resume-unproven", now, [
+                        { type: "task", id: entry.taskId },
+                        { type: "run", taskId: entry.taskId, id: run.id }
+                    ]);
                     return;
                 }
-                // The process is gone. If the adapter supports resume and the
-                // projection carries a native Session id, relaunch with resume: the
-                // conversation identity stays the same, only the launch generation
-                // changes. Otherwise terminalize with a precise replacement blocker.
-                const canResume = run.providerRetry.nativeSessionId !== undefined
-                    && this.drivers.requireByAdapterId(run.effective.adapterId)
-                        .capabilities.control.resume;
-                if (!canResume) {
-                    const summary = `Provider retry stopped: the original Session is gone `
-                        + `and the adapter cannot resume it `
-                        + `(run ${run.id}, attempt ${run.providerRetry.attempt}, `
-                        + `last error: ${run.providerRetry.lastErrorSummary}). `
-                        + `A replacement Session requires an explicit Leader recovery decision.`;
-                    const result = terminalizeExactTaskRun(store, {
-                        taskId: entry.taskId,
-                        roleName: entry.roleName,
-                        agentId: run.effective.agentId,
-                        runId: run.id,
-                        receiptId: formatAgentRunReceiptId(entry.taskId, run.id),
-                        ...(run.providerRetry.nativeSessionId === undefined
-                            ? {}
-                            : { nativeSessionId: run.providerRetry.nativeSessionId }),
-                        ...(run.providerRetry.launchId === undefined
-                            ? {}
-                            : { launchId: run.providerRetry.launchId }),
-                        outcome: { status: "failed", summary }
-                    }, now);
-                    if (result.disposition !== "applied")
+                if (hasUnsettledRuntimeOperations(store, entry.taskId, run.id)) {
+                    const deferred = deferProviderRetry(run.providerRetry, now);
+                    if (deferred === null) {
+                        finalizeProviderRetryDeadline(store, run, "Provider retry stopped because tool/subagent outcome remained uncertain through the bounded episode deadline.", "operation-outcome-uncertain", now);
                         return;
-                    store.saveEvent(entry.taskId, createTaskEvent(store.nextEventId(entry.taskId), entry.taskId, "runtime.provider-retry-session-dead", { runId: run.id, attempt: String(run.providerRetry.attempt) }, now));
-                    enqueueWork(store, { kind: "role", taskId: entry.taskId, roleName: "leader" }, "role-run-failed", now, [{ type: "run", taskId: entry.taskId, id: run.id }]);
+                    }
+                    store.saveAgentRun(withProviderRetry(run, deferred));
                     return;
                 }
-                // Resume relaunch: reopen the Run in resume mode on the same native
-                // Session. The delivery pass relaunches the process with resume and
-                // re-pushes the exact same input; only the launch generation changes.
-                store.saveAgentRun(reopenRunForProviderRetry(run, now));
-                store.saveEvent(entry.taskId, createTaskEvent(store.nextEventId(entry.taskId), entry.taskId, "runtime.provider-retry-resume", {
-                    runId: run.id,
-                    attempt: String(run.providerRetry.attempt),
-                    ...(run.providerRetry.nativeSessionId === undefined
-                        ? {}
-                        : { nativeSessionId: run.providerRetry.nativeSessionId })
-                }, now));
+                // Reopen the Run on its original Session: reset transport markers,
+                // switch to resume, and mark the projection in-flight. The delivery
+                // pass re-pushes the exact same input in this same pass.
+                store.saveAgentRun(reopenRunForProviderRetry(run, `provider-retry-${run.providerRetry.episodeId}-${run.providerRetry.dispatchedRetries + 1}`, now));
                 // The retry decision settled the original delivery claim; re-queue the
                 // Role mailbox so the delivery pass can claim and re-push the Run.
                 enqueueWork(store, { kind: "role", taskId: entry.taskId, roleName: entry.roleName }, "provider-retry-repush", now, [{ type: "run", taskId: entry.taskId, id: run.id }]);
@@ -2422,6 +2620,9 @@ export class FileSchedulerStoreAdapter {
                         : { nativeTurnId: input.fence.nativeTurnId })
                 }, now));
                 store.saveWorkMailbox(completeMailboxInputDelivery(mailbox, inputDelivery.attemptId, now));
+                if (active.providerRetry !== undefined) {
+                    this.clearProviderRetryProjection(store, active, input, "provider-accepted", now);
+                }
                 return "applied";
             }
             const event = createCanonicalLifecycleEvent({
@@ -2451,8 +2652,24 @@ export class FileSchedulerStoreAdapter {
                 recordCanonicalObservationObsolete(store, input, "role-missing", now);
                 return "obsolete";
             }
-            if (active.deliveredAt === undefined) {
-                const delivered = markAgentRunDelivered(active, now);
+            const progressed = clearProviderRetryOnProgress(active);
+            if (progressed !== active) {
+                store.saveAgentRun(progressed);
+                store.saveEvent(input.fence.taskId, createTaskEvent(store.nextEventId(input.fence.taskId), input.fence.taskId, "runtime.provider-retry-recovered", {
+                    runId: active.id,
+                    roleName: active.roleName,
+                    evidence: "provider-accepted",
+                    nativeSessionId: input.fence.nativeSessionId ?? "",
+                    episodeId: active.providerRetry?.episodeId ?? "",
+                    consecutiveFailures: String(active.providerRetry?.consecutiveFailures ?? 0),
+                    dispatchedRetries: String(active.providerRetry?.dispatchedRetries ?? 0),
+                    recoveryLatencyMs: String(active.providerRetry === undefined
+                        ? 0
+                        : Math.max(0, now.getTime() - Date.parse(active.providerRetry.firstFailureAt)))
+                }, now));
+            }
+            if (progressed.deliveredAt === undefined) {
+                const delivered = markAgentRunDelivered(progressed, now);
                 store.saveAgentRun(delivered);
                 markTaskRoleRunDeliveredInFlight(store, role, delivered, now);
                 store.saveEvent(input.fence.taskId, createTaskEvent(store.nextEventId(input.fence.taskId), input.fence.taskId, "run.delivered", runLaunchEventPayload(delivered), now));
@@ -2467,6 +2684,35 @@ export class FileSchedulerStoreAdapter {
             return "applied";
         });
     }
+    clearProviderRetryForProgress(input, evidence, now) {
+        this.store.transaction((store) => {
+            const taskId = input.fence.taskId;
+            const runId = input.fence.runId;
+            if (taskId === undefined || runId === undefined)
+                return;
+            const run = store.getAgentRun(taskId, runId);
+            if (run === null || run.status !== "active" || run.providerRetry === undefined)
+                return;
+            this.clearProviderRetryProjection(store, run, input, evidence, now);
+        });
+    }
+    clearProviderRetryProjection(store, run, input, evidence, now) {
+        const retry = run.providerRetry;
+        if (retry === undefined)
+            return;
+        store.saveAgentRun(clearProviderRetryOnProgress(run));
+        store.saveEvent(run.taskId, createTaskEvent(store.nextEventId(run.taskId), run.taskId, "runtime.provider-retry-recovered", {
+            runId: run.id,
+            roleName: input.fence.roleName,
+            evidence,
+            episodeId: retry.episodeId,
+            consecutiveFailures: String(retry.consecutiveFailures),
+            dispatchedRetries: String(retry.dispatchedRetries),
+            recoveryLatencyMs: String(Math.max(0, now.getTime() - Date.parse(retry.firstFailureAt))),
+            nativeSessionId: input.fence.nativeSessionId ?? "",
+            activityId: input.payload.activityId ?? ""
+        }, now));
+    }
     foldRuntimeLifecycleEvent(store, event, observation) {
         const expectation = this.projectRunExpectation(store, event.fence, observation.fence.runId);
         if (expectation === null) {
@@ -2632,6 +2878,14 @@ export class FileSchedulerStoreAdapter {
         return "apply";
     }
 }
+function hasUnsettledRuntimeOperations(store, taskId, runId) {
+    return store.listEvents(taskId).some((event) => {
+        const observation = runtimeObservationFromTaskEvent(event);
+        return observation !== null
+            && observation.fence.runId === runId
+            && observation.kind === "operation.started";
+    });
+}
 function runtimeTurnFailureSummary(input) {
     return [
         "Agent runtime turn failed.",
@@ -2781,7 +3035,7 @@ function preallocatedRuntimeReadyAwaitingProjection(store, observation, drivers)
         || run.status !== "active"
         || run.effective.agentId !== observation.fence.agentId
         || run.effective.adapterId !== driver.adapterId
-        || observation.fence.receiptId !== formatAgentRunReceiptId(taskId, runId)
+        || observation.fence.receiptId !== agentRunDeliveryReceiptId(run)
         || (sessions?.inFlight !== null && sessions?.inFlight !== undefined)
         || sessions?.sessions[observation.fence.agentId] !== undefined)
         return false;
@@ -2898,7 +3152,54 @@ function preparedSessionMatches(session, agentId, adapterId, nativeSessionId, la
         ? session.launchId === undefined
         : session.launchId === launchId;
 }
-function preparedDeliveryFailureSessionFenceMatches(sessions, session, input) {
+function finalizeProviderRetryDeadline(store, run, summary, reason, now) {
+    const retry = run.providerRetry;
+    if (retry === undefined)
+        return false;
+    const terminalization = terminalizeExactTaskRun(store, {
+        taskId: run.taskId,
+        roleName: run.roleName,
+        agentId: run.effective.agentId,
+        runId: run.id,
+        receiptId: agentRunDeliveryReceiptId(run),
+        outcome: { status: "failed", summary }
+    }, now);
+    if (terminalization.disposition !== "applied" || terminalization.run === null)
+        return false;
+    const terminal = terminalization.run;
+    store.saveEvent(run.taskId, createTaskEvent(store.nextEventId(run.taskId), run.taskId, "runtime.provider-retry-exhausted", {
+        runId: run.id,
+        roleName: run.roleName,
+        episodeId: retry.episodeId,
+        reason,
+        consecutiveFailures: String(retry.consecutiveFailures),
+        dispatchedRetries: String(retry.dispatchedRetries),
+        elapsedMs: String(Math.max(0, now.getTime() - Date.parse(retry.firstFailureAt)))
+    }, now));
+    if (terminal.purpose === "execution" && terminal.workItemId !== undefined) {
+        const item = store.getWorkItem(run.taskId, terminal.workItemId);
+        if (item !== null && !["completed", "failed", "retired"].includes(item.status)) {
+            store.saveWorkItem(run.taskId, updateWorkItemStatus(item, "failed", now, summary));
+        }
+    }
+    const role = store.getRole(run.taskId, run.roleName);
+    if (role !== null) {
+        store.saveRole(run.taskId, updateRoleStatus(role, run.roleName === "leader" ? "failed" : "idle", now));
+    }
+    if (run.roleName === "leader") {
+        store.saveLeaderFailure(recordLeaderFailure(run.taskId, retry.nativeSessionId ?? "(unproven)", summary, now, store.getLeaderFailure(run.taskId)));
+        store.saveOperatorNotification(createLeaderRecoveryNotification(run.taskId, summary, now, store.getOperatorNotification(run.taskId)));
+        enqueueWork(store, { kind: "operator" }, "provider-retry-exhausted", now, [
+            { type: "task", id: run.taskId },
+            { type: "run", taskId: run.taskId, id: run.id }
+        ]);
+    }
+    else {
+        enqueueWork(store, { kind: "role", taskId: run.taskId, roleName: "leader" }, "provider-retry-exhausted", now, [{ type: "run", taskId: run.taskId, id: run.id }]);
+    }
+    return true;
+}
+function preparedDeliveryFailureSessionFenceMatches(sessions, session, input, expectedReceiptId) {
     if (sessions === null)
         return input.nativeSessionId === undefined;
     if (sessions.activeAgentId !== input.agentId)
@@ -2909,7 +3210,7 @@ function preparedDeliveryFailureSessionFenceMatches(sessions, session, input) {
     }
     return sessions.inFlight.agentId === input.agentId
         && sessions.inFlight.runId === input.runId
-        && sessions.inFlight.receiptId === formatAgentRunReceiptId(input.taskId, input.runId)
+        && sessions.inFlight.receiptId === expectedReceiptId
         && sessions.inFlight.pushedAt === undefined
         && preparedSessionMatches(session, input.agentId, input.adapterId, input.nativeSessionId, input.launchId);
 }
@@ -3158,7 +3459,7 @@ function bindTaskRoleRunInFlight(store, role, run, now) {
     const updated = bindTaskRoleRun(current, {
         agentId,
         runId: run.id,
-        receiptId: formatAgentRunReceiptId(role.taskId, run.id)
+        receiptId: agentRunDeliveryReceiptId(run)
     }, now);
     store.saveRoleSessionSet(updated);
 }
@@ -3170,7 +3471,7 @@ function markTaskRoleRunPushedInFlight(store, role, run, now) {
     const updated = markTaskRoleRunPushed(current, {
         agentId: run.effective.agentId,
         runId: run.id,
-        receiptId: formatAgentRunReceiptId(role.taskId, run.id)
+        receiptId: agentRunDeliveryReceiptId(run)
     }, now);
     store.saveRoleSessionSet(updated);
 }
@@ -3182,7 +3483,7 @@ function markTaskRoleRunDeliveredInFlight(store, role, run, now) {
     const updated = markTaskRoleRunDelivered(current, {
         agentId: run.effective.agentId,
         runId: run.id,
-        receiptId: formatAgentRunReceiptId(role.taskId, run.id)
+        receiptId: agentRunDeliveryReceiptId(run)
     }, now);
     store.saveRoleSessionSet(updated);
 }
@@ -3195,7 +3496,7 @@ function clearTaskRoleRunInFlight(store, role, run, now) {
     const updated = clearTaskRoleRun(current, {
         agentId: run.effective.agentId,
         runId: run.id,
-        receiptId: formatAgentRunReceiptId(role.taskId, run.id)
+        receiptId: agentRunDeliveryReceiptId(run)
     }, now);
     store.saveRoleSessionSet(updated);
 }