@zq-silk/yui 0.6.2 → 0.6.4

package/dist/scheduler/roleRunStall.js

@@ -5,22 +5,17 @@ import { selectedSchedulerRoles, selectedSchedulerTasks } from "./ports.js";
  * is simply slow keeps its structured checkpoint fresh and never crosses it.
  */
 export const DEFAULT_STALL_WINDOW_MS = 30 * 60_000;
-/** Cheap execution-stall candidate filter; the real threshold remains 30m. */
-export const DEFAULT_EXECUTION_STALL_CANDIDATE_AGE_MS = 10 * 60_000;
-/** Resource activity may postpone attention only within this semantic gap. */
-export const DEFAULT_RESOURCE_ONLY_SEMANTIC_GAP_MS = 90 * 60_000;
+/** Cheap workflow-stall candidate filter; the real threshold remains 30m. */
+export const DEFAULT_WORKFLOW_STALL_CANDIDATE_AGE_MS = 10 * 60_000;
 export const RUN_PROGRESS_EVENT = "run.progress";
 export const RUN_STALLED_EVENT = "run.stalled";
 export const RUN_RECOVERED_EVENT = "run.recovered";
-/** Durable one-shot advisory resource evidence; never a progress fact. */
-export const RUN_RESOURCE_SUPPRESSED_EVENT = "run.resource-suppressed";
 /** Structured, non-Message recovery evidence written by an explicit Leader. */
 export const RUN_RECOVERY_REQUESTED_EVENT = "run.recovery-requested";
 export const RUN_RECOVERY_APPLIED_EVENT = "run.recovery-applied";
-/** Event types that count as Run activity for the durable progress clock. */
+/** Workflow-semantic events that count for the durable progress clock. */
 const ACTIVITY_EVENT_TYPES = new Set([
     RUN_PROGRESS_EVENT,
-    "runtime.provider-turn-progress",
     "message.sent",
     "input.answered",
     "input.auto-answered",
@@ -48,10 +43,9 @@ export function clearMatchingLeaderStallAttention(store, taskId, runId) {
     return true;
 }
 /**
- * One pure projection used by every Role. Resource activity can suppress a
- * false positive only together with a live host and matching native Session
- * or launch generation;
- * it never changes the durable progress clock or authorizes recovery.
+ * One pure projection used by every Role. Resource activity is retained only
+ * as exact-generation diagnostic evidence; it never changes the durable
+ * progress clock, suppresses workflow attention, or authorizes recovery.
  */
 export function projectRoleRunHealth(input) {
     const windowMs = input.windowMs ?? DEFAULT_STALL_WINDOW_MS;
@@ -69,7 +63,7 @@ export function projectRoleRunHealth(input) {
     const candidate = Number.isFinite(candidateAge)
         && (input.deliveredAt === undefined
             ? candidateAge >= windowMs
-            : candidateAge >= DEFAULT_EXECUTION_STALL_CANDIDATE_AGE_MS);
+            : candidateAge >= DEFAULT_WORKFLOW_STALL_CANDIDATE_AGE_MS);
     const providerAcceptance = input.providerAcceptance
         ?? (input.deliveredAt === undefined ? "ambiguous" : "accepted");
     const hostLiveness = input.hostLiveness;
@@ -99,14 +93,13 @@ export function projectRoleRunHealth(input) {
     // evidence is still actionable in that case.  Only an explicit stopped or
     // broken Session blocks the projection; identity mismatches are fenced by
     // reconcileStalledRoleRuns below before this projection is routed.
-    const executionStall = candidate
+    const workflowStall = candidate
         && evaluation.stalled
         && hostLiveness === "present"
         && nativeSession !== "stopped"
         && nativeSession !== "broken"
-        && providerAcceptance !== "ambiguous"
-        && !resourceActivity;
-    const stalled = executionStall
+        && providerAcceptance !== "ambiguous";
+    const stalled = workflowStall
         && !waitingUser
         && !waitingOnWorkers;
     const classification = waitingUser
@@ -151,9 +144,9 @@ export function evaluateRoleRunStall(input) {
 }
 /**
  * Latest durable progress timestamp for an active Run. Provider acceptance
- * (deliveredAt), explicit structured checkpoints, and semantic Run-scoped
- * activity all count as progress; bookkeeping-only Run/Session timestamps are
- * intentionally excluded. CPU/memory are never inputs here.
+ * (deliveredAt), explicit workflow checkpoints, and semantic domain activity
+ * count as progress. Provider operations, tokens, CPU/memory and bookkeeping
+ * timestamps are intentionally excluded.
  */
 export function latestDurableProgressAt(input) {
     const candidates = [
@@ -170,15 +163,10 @@ export function latestDurableProgressAt(input) {
 export function latestRunProgressAt(events, runId) {
     let latest;
     for (const event of events) {
-        if (event.type !== RUN_PROGRESS_EVENT
-            && event.type !== "runtime.provider-turn-progress")
+        if (event.type !== RUN_PROGRESS_EVENT)
             continue;
         if (event.payload.runId !== runId)
             continue;
-        if (event.type === "runtime.provider-turn-progress"
-            && (typeof event.payload.progressAt !== "string"
-                || !Number.isFinite(Date.parse(event.payload.progressAt))))
-            continue;
         const progressAt = typeof event.payload.progressAt === "string"
             && Number.isFinite(Date.parse(event.payload.progressAt))
             ? event.payload.progressAt
@@ -320,12 +308,7 @@ export function latestRunActivityAt(events, runId) {
             || event.type === RUN_STALLED_EVENT
             || event.type === RUN_RECOVERED_EVENT)
             continue;
-        if (event.type === "runtime.provider-turn-progress"
-            && (typeof event.payload.progressAt !== "string"
-                || !Number.isFinite(Date.parse(event.payload.progressAt))))
-            continue;
-        const activityAt = (event.type === RUN_PROGRESS_EVENT
-            || event.type === "runtime.provider-turn-progress")
+        const activityAt = event.type === RUN_PROGRESS_EVENT
             && typeof event.payload.progressAt === "string"
             && Number.isFinite(Date.parse(event.payload.progressAt))
             ? event.payload.progressAt
@@ -386,13 +369,10 @@ export function foldRunProgressFacts(events) {
             byRun.set(runId, facts);
         }
         const type = event.type;
-        const isProgress = type === RUN_PROGRESS_EVENT
-            || type === "runtime.provider-turn-progress";
+        const isProgress = type === RUN_PROGRESS_EVENT;
         if (isProgress) {
             const validProgress = typeof event.payload.progressAt === "string"
                 && Number.isFinite(Date.parse(event.payload.progressAt));
-            if (type === "runtime.provider-turn-progress" && !validProgress)
-                continue;
             const progressAt = validProgress
                 ? event.payload.progressAt
                 : event.createdAt;
@@ -400,9 +380,7 @@ export function foldRunProgressFacts(events) {
                 || Date.parse(progressAt) > Date.parse(facts.latestCheckpointAt)) {
                 facts.latestCheckpointAt = progressAt;
             }
-            // Both progress event types are activity events; the stall/recovered
-            // exclusion in latestRunActivityAt is structural here because a progress
-            // event can never be either type.
+            // Workflow checkpoints are also semantic activity.
             if (facts.latestActivityAt === undefined
                 || Date.parse(progressAt) > Date.parse(facts.latestActivityAt)) {
                 facts.latestActivityAt = progressAt;
@@ -444,34 +422,59 @@ function yieldEventLoop() {
  * projection the runtime-health view reads to surface needs-attention.
  */
 export function isRoleRunStalled(events, runId) {
-    const stalledAt = latestRunEventTime(events, RUN_STALLED_EVENT, runId);
-    if (stalledAt === undefined)
+    let stalled;
+    let recoveredAt;
+    let progressAt;
+    for (const event of events) {
+        if (event.payload.runId !== runId)
+            continue;
+        if (event.type === RUN_STALLED_EVENT) {
+            if (stalled === undefined
+                || Date.parse(event.createdAt) > Date.parse(stalled.createdAt)) {
+                stalled = event;
+            }
+            continue;
+        }
+        if (event.type === RUN_RECOVERED_EVENT) {
+            if (recoveredAt === undefined
+                || Date.parse(event.createdAt) > Date.parse(recoveredAt)) {
+                recoveredAt = event.createdAt;
+            }
+            continue;
+        }
+        if (event.type !== RUN_PROGRESS_EVENT)
+            continue;
+        const candidate = typeof event.payload.progressAt === "string"
+            && Number.isFinite(Date.parse(event.payload.progressAt))
+            ? event.payload.progressAt
+            : event.createdAt;
+        if (progressAt === undefined || Date.parse(candidate) > Date.parse(progressAt)) {
+            progressAt = candidate;
+        }
+    }
+    if (stalled === undefined)
         return false;
-    const stalled = [...events]
-        .filter((event) => event.type === RUN_STALLED_EVENT && event.payload.runId === runId)
-        .sort((left, right) => Date.parse(right.createdAt) - Date.parse(left.createdAt))[0];
-    const stalledProgressAt = typeof stalled?.payload.progressAt === "string"
+    const stalledAt = stalled.createdAt;
+    const stalledProgressAt = typeof stalled.payload.progressAt === "string"
         && Number.isFinite(Date.parse(stalled.payload.progressAt))
         ? stalled.payload.progressAt
         : stalledAt;
-    const recoveredAt = latestRunEventTime(events, RUN_RECOVERED_EVENT, runId);
     if (recoveredAt !== undefined && Date.parse(recoveredAt) > Date.parse(stalledAt)) {
         return false;
     }
-    const progressAt = latestRunProgressAt(events, runId);
     return progressAt === undefined || Date.parse(progressAt) <= Date.parse(stalledProgressAt);
 }
 /**
  * Low-frequency health pass for active Task Role Runs. An unaccepted Run is
  * watched as delivery-stalled after the reasonable delivery window; an
- * accepted Run enters the execution-stall candidate scan after ten minutes,
+ * accepted Run enters the workflow-stall candidate scan after ten minutes,
  * while the actual no-progress threshold remains thirty minutes.
  * Leader Runs are only persisted when classification reaches truly-stalled —
  * healthy downstream work, open user input, and recent own progress remain
  * structured waiting/working facts. No branch sends terminal bytes, retries,
  * replaces a Session, or changes Run status.
  */
-export async function reconcileStalledRoleRuns(store, delivery, now, selection, windowMs = DEFAULT_STALL_WINDOW_MS, liveStatuses, resourceEvidence, resourceSuppressionKeys) {
+export async function reconcileStalledRoleRuns(store, delivery, now, selection, windowMs = DEFAULT_STALL_WINDOW_MS, liveStatuses, resourceEvidence) {
     // Dirty mailbox passes are intentionally not a second scheduler. Full
     // reconcile owns the all-active-Run scan; dirty passes may still route the
     // existing mailbox work without manufacturing another episode.
@@ -655,15 +658,13 @@ export async function reconcileStalledRoleRuns(store, delivery, now, selection,
                     : { launchId: candidate.session.launchId })
             };
         const resourceSnapshot = resourceForRun(resourceEvidence, candidate.task.id, candidate.role.name, candidate.run.id);
-        const resourceCanSuppress = live === "present"
+        const resourceIsCurrent = live === "present"
             && sessionMatchesRun
             && sessionUsable
             && expectedResourceIdentity !== undefined
             && resourceEvidenceMatchesCurrentRun(resourceSnapshot, expectedResourceIdentity, progressAt)
             && resourceEvidenceIsFresh(resourceSnapshot, now, windowMs);
-        const resource = resourceCanSuppress
-            ? await consumeResourceEvidence(store, resourceEvidence, candidate.task.id, candidate.role.name, candidate.run.id, progressAt, expectedResourceIdentity, resourceSuppressionKeys, now)
-            : undefined;
+        const resource = resourceIsCurrent ? resourceSnapshot : undefined;
         const health = projectRoleRunHealth({
             progressAt,
             createdAt: candidate.run.createdAt,
@@ -682,8 +683,7 @@ export async function reconcileStalledRoleRuns(store, delivery, now, selection,
         });
         // Delivery-stalled Runs retain the existing delivery clock and immediate
         // provider-uncertainty path. Accepted execution Runs use the shared
-        // projection, including its exact Session/host and advisory resource
-        // conditions.
+        // projection. Exact Session/host resource evidence remains diagnostic.
         const resourceActivity = health.resourceActivity;
         const stalled = candidate.run.deliveredAt === undefined
             ? evaluation.stalled && live === "present"
@@ -693,9 +693,8 @@ export async function reconcileStalledRoleRuns(store, delivery, now, selection,
             live,
             progressAt,
             idleMs: evaluation.idleMs,
-            // Resource activity is advisory: with a live, matching native Session it
-            // keeps a long inference/remote-IO Run in the working projection, but it
-            // never advances progress or creates a recovered event by itself.
+            // Resource activity is advisory and never advances workflow progress or
+            // suppresses a workflow-not-progressing episode.
             stalled,
             resourceActivity,
             evidence: [
@@ -728,7 +727,7 @@ export async function reconcileStalledRoleRuns(store, delivery, now, selection,
         }
         const kind = candidate.run.deliveredAt === undefined
             ? "delivery-stalled"
-            : "execution-stalled";
+            : "workflow-not-progressing";
         const classification = candidate.role.name === "leader"
             ? classifyLeaderStall(store, candidate.task.id, observed, now, windowMs)
             : "truly-stalled";
@@ -806,10 +805,10 @@ function isStallCandidate(run, now, windowMs) {
     if (!Number.isFinite(ageMs))
         return false;
     // Undelivered Runs are watched for a delivery stall on the same reasonable
-    // window, but they never enter execution-stall candidate filtering.
+    // window, but they never enter workflow-stall candidate filtering.
     return run.deliveredAt === undefined
         ? ageMs >= windowMs
-        : ageMs >= DEFAULT_EXECUTION_STALL_CANDIDATE_AGE_MS;
+        : ageMs >= DEFAULT_WORKFLOW_STALL_CANDIDATE_AGE_MS;
 }
 function classifyLeaderStall(store, taskId, observed, now, windowMs) {
     if (store.hasOpenInputRequest(taskId))
@@ -850,7 +849,6 @@ function classifyLeaderStall(store, taskId, observed, now, windowMs) {
 }
 const LEADER_ACTION_PROGRESS_TYPES = new Set([
     RUN_PROGRESS_EVENT,
-    "runtime.provider-turn-progress",
     "input.answered",
     "input.auto-answered",
     "input.cancelled",
@@ -884,8 +882,7 @@ function latestLeaderActionProgressAt(store, taskId, runId, startedAt, batch, no
             || createdMs < startedMs
             || createdMs > now.getTime())
             continue;
-        const value = (event.type === RUN_PROGRESS_EVENT
-            || event.type === "runtime.provider-turn-progress")
+        const value = event.type === RUN_PROGRESS_EVENT
             && typeof event.payload.progressAt === "string"
             && Number.isFinite(Date.parse(event.payload.progressAt))
             ? event.payload.progressAt
@@ -996,55 +993,6 @@ function resourceEvidenceMatchesCurrentRun(resource, expected, progressAt) {
 function hasResourceIdentityText(value) {
     return typeof value === "string" && value.trim().length > 0;
 }
-/** Persist the first advisory sample and keep it bounded by the semantic gap. */
-async function consumeResourceEvidence(store, snapshot, taskId, roleName, runId, progressAt, expectedIdentity, suppressionKeys, now) {
-    const resource = resourceForRun(snapshot, taskId, roleName, runId);
-    if (resource === undefined)
-        return undefined;
-    if (!resourceEvidenceMatchesCurrentRun(resource, expectedIdentity, progressAt)) {
-        return resource;
-    }
-    if (resource.active !== true || resource.changed !== true)
-        return resource;
-    const key = `${taskId}\0${roleName}\0${runId}\0${progressAt}`;
-    if (store.recordRoleRunResourceSuppression !== undefined) {
-        const persisted = store.recordRoleRunResourceSuppression({
-            taskId,
-            roleName,
-            runId,
-            agentId: expectedIdentity.agentId,
-            adapterId: expectedIdentity.adapterId,
-            ...(expectedIdentity.nativeSessionId === undefined
-                ? {}
-                : { nativeSessionId: expectedIdentity.nativeSessionId }),
-            ...(expectedIdentity.launchId === undefined
-                ? {}
-                : { launchId: expectedIdentity.launchId }),
-            progressAt,
-            observedAt: resource.observedAt,
-            now
-        });
-        if (persisted === "recorded" || persisted === "already-recorded") {
-            return resourceFallsWithinSemanticGap(progressAt, now)
-                ? resource
-                : { ...resource, active: false, changed: false };
-        }
-        // A concurrent Run/session change invalidates this sample. Do not let the
-        // stale changed bit suppress the current Run's attention episode.
-        return { ...resource, active: false, changed: false };
-    }
-    if (suppressionKeys === undefined || !suppressionKeys.has(key)) {
-        suppressionKeys?.add(key);
-        return resource;
-    }
-    return { ...resource, active: false, changed: false };
-}
-function resourceFallsWithinSemanticGap(progressAt, now) {
-    const progressMs = Date.parse(progressAt);
-    return Number.isFinite(progressMs)
-        && progressMs <= now.getTime()
-        && now.getTime() - progressMs < DEFAULT_RESOURCE_ONLY_SEMANTIC_GAP_MS;
-}
 function resourceEvidenceIsFresh(evidence, now, windowMs) {
     if (evidence === undefined)
         return false;
@@ -1053,5 +1001,5 @@ function resourceEvidenceIsFresh(evidence, now, windowMs) {
         return false;
     // A sample from an earlier scheduler window is not a current health signal.
     return observedAt <= now.getTime()
-        && now.getTime() - observedAt < Math.max(windowMs, DEFAULT_EXECUTION_STALL_CANDIDATE_AGE_MS);
+        && now.getTime() - observedAt < Math.max(windowMs, DEFAULT_WORKFLOW_STALL_CANDIDATE_AGE_MS);
 }

package/dist/storage/migration/productionRegistry.js

@@ -8,6 +8,8 @@ const FINAL_REVIEW_AGGREGATE_FROM_VERSION = 16;
 const FINAL_REVIEW_AGGREGATE_TO_VERSION = 17;
 const HOME_IDENTITY_AGGREGATE_FROM_VERSION = 17;
 const HOME_IDENTITY_AGGREGATE_TO_VERSION = 18;
+const RUNTIME_OBSERVATION_AGGREGATE_FROM_VERSION = 18;
+const RUNTIME_OBSERVATION_AGGREGATE_TO_VERSION = 19;
 const SQLITE_LAYOUT_FROM_VERSION = 6;
 const SQLITE_LAYOUT_TO_VERSION = 7;
 const PROJECT_FROM_VERSION = 2;
@@ -87,6 +89,14 @@ export function createProductionStorageRegistry() {
         preconditions: requireAggregateV17Snapshot,
         transform: migrateAggregateV17ToV18,
         declaredEffects: []
+    })
+        .registerOfflineMigration({
+        axis: "aggregate",
+        fromVersion: RUNTIME_OBSERVATION_AGGREGATE_FROM_VERSION,
+        toVersion: RUNTIME_OBSERVATION_AGGREGATE_TO_VERSION,
+        preconditions: requireAggregateV18Snapshot,
+        transform: migrateAggregateV18ToV19,
+        declaredEffects: []
     })
         .registerOfflineMigration(projectOwnershipStep())
         .registerOfflineMigration(taskWorkspaceIdentityStep())
@@ -1290,6 +1300,81 @@ function requireAggregateV17Snapshot(snapshot) {
         throw new Error("Aggregate 17->18 migration requires state.json schemaVersion 17 to match schema.json.");
     }
 }
+/**
+ * Runtime state is now projected exclusively from canonical
+ * `runtime.observation` events. Offline upgrade inventory proves there are no
+ * active Runs or live Sessions. A retired Task has also explicitly abandoned
+ * its runtime, so its stored runtime inconsistencies no longer block the Home;
+ * the anomalous records themselves remain available as history. Non-retired
+ * Tasks still fail closed and receive the supported retirement command.
+ */
+function migrateAggregateV18ToV19(snapshot) {
+    requireAggregateV18Snapshot(snapshot);
+    const schemaManifest = {
+        ...snapshot.schemaManifest,
+        aggregateSchemaVersion: RUNTIME_OBSERVATION_AGGREGATE_TO_VERSION
+    };
+    if (snapshot.state === null)
+        return { schemaManifest, state: null };
+    const tasks = asObject(snapshot.state.tasks, "state tasks");
+    const nextTasks = {};
+    for (const [taskId, rawStoredTask] of Object.entries(tasks)) {
+        const storedTask = asObject(rawStoredTask, `Task aggregate ${taskId}`);
+        const rawTask = storedTask.task;
+        const task = rawTask !== null && typeof rawTask === "object" && !Array.isArray(rawTask)
+            ? rawTask
+            : undefined;
+        if (task?.status === "retired") {
+            nextTasks[taskId] = { ...storedTask };
+            continue;
+        }
+        requireResolvableActiveRunPointers(taskId, storedTask);
+        nextTasks[taskId] = { ...storedTask };
+    }
+    return {
+        schemaManifest,
+        state: {
+            ...snapshot.state,
+            schemaVersion: RUNTIME_OBSERVATION_AGGREGATE_TO_VERSION,
+            tasks: nextTasks
+        }
+    };
+}
+function requireResolvableActiveRunPointers(taskId, storedTask) {
+    if (storedTask.activeRuns === undefined)
+        return;
+    const activeRuns = asObject(storedTask.activeRuns, `activeRunPointer map ${taskId}`);
+    if (Object.keys(activeRuns).length === 0)
+        return;
+    const agentRuns = asObject(storedTask.agentRuns, `agentRun map ${taskId}`);
+    for (const [pointer, rawActiveRun] of Object.entries(activeRuns)) {
+        const activeRun = asObject(rawActiveRun, `Active run ${taskId}/${pointer}`);
+        const runId = typeof activeRun.runId === "string" ? activeRun.runId.trim() : "";
+        if (runId.length === 0) {
+            throw new Error(`Active run pointer ${taskId}/${pointer} has an invalid runId. `
+                + taskRetirementUpgradeHint(taskId));
+        }
+        if (agentRuns[runId] === undefined) {
+            throw new Error(`Active run pointer ${taskId}/${pointer} references missing agent run ${runId}. `
+                + taskRetirementUpgradeHint(taskId));
+        }
+    }
+}
+function taskRetirementUpgradeHint(taskId) {
+    return `Retire Task ${taskId} with `
+        + `\`yui task retire ${taskId} --summary "abandon inconsistent runtime state"\`, `
+        + "then retry `yui update`.";
+}
+function requireAggregateV18Snapshot(snapshot) {
+    if (snapshot.schemaManifest.aggregateSchemaVersion
+        !== RUNTIME_OBSERVATION_AGGREGATE_FROM_VERSION) {
+        throw new Error("Aggregate 18->19 migration requires schema.json aggregateSchemaVersion 18.");
+    }
+    if (snapshot.state !== null
+        && snapshot.state.schemaVersion !== RUNTIME_OBSERVATION_AGGREGATE_FROM_VERSION) {
+        throw new Error("Aggregate 18->19 migration requires state.json schemaVersion 18 to match schema.json.");
+    }
+}
 /**
  * Project ownership is a new required field. Every pre-v3 Project is a
  * user-registered checkout, so the historical binding is `external`; a managed

package/dist/storage/sqliteStore.js

@@ -25,8 +25,8 @@
  *
  * Records are stored as full versioned JSON in `payload` columns, with typed
  * columns for the fields that are queried/filtered/used-for-CAS (§4). A
- * high-frequency `runtime.provider-turn-progress` event is a single-row
- * upsert into `telemetry` scoped by its primary key — it never rewrites global
+ * high-frequency runtime telemetry observation is a single-row upsert into
+ * `telemetry` scoped by its primary key — it never rewrites global
  * state and never touches another Task's rows (§4.4).
  *
  * The in-process store is phase 1 of §6. It does not re-run the heavy record
@@ -1542,7 +1542,7 @@ export class SqliteTaskStore {
     /**
      * Upsert one progress row. The PK is (task_id, role_name, run_id, generation,
      * progress_id): a repeated progress id updates in place, so a high-frequency
-     * `runtime.provider-turn-progress` event is a single-row write that never
+     * runtime telemetry observation is a single-row write that never
      * rewrites global state or another Task's rows.
      */
     upsertTelemetryProgress(entry) {

package/dist/storage/storageVersions.js

@@ -15,4 +15,4 @@
  */
 export const CURRENT_STORAGE_LAYOUT_VERSION = 7;
 /** Version of the authoritative aggregate stored in `state.json`. */
-export const CURRENT_AGGREGATE_SCHEMA_VERSION = 18;
+export const CURRENT_AGGREGATE_SCHEMA_VERSION = 19;

package/dist/storage/upgrade/sqliteRecordMigrationTarget.js

@@ -37,7 +37,7 @@ import { planMigration } from "../migration/planner.js";
 import { AmbiguousSwitchError } from "../migration/index.js";
 import { describeActiveRuntime, homeRuntimeIsActive, inspectHomeRuntime, inspectSourceVersionState, inspectSnapshotVersionState } from "./homeMigrationTarget.js";
 import { writeSwitchProgress } from "./switchProgress.js";
-import { COMMITTED_DATABASE_FILENAME, STAGED_DATABASE_FILENAME, computeDbFamilyChecksums, computeStateFamilyChecksums, populateSqliteFromState, readStateFromSqlite } from "./sqliteStateMigration.js";
+import { COMMITTED_DATABASE_FILENAME, STAGED_DATABASE_FILENAME, copySqlitePassthroughState, computeDbFamilyChecksums, computeStateFamilyChecksums, populateSqliteFromState, readStateFromSqlite } from "./sqliteStateMigration.js";
 /** Build the SQLite-backed record-migration target. */
 export function createSqliteRecordMigrationTarget(options) {
     const home = options.home;
@@ -92,6 +92,7 @@ export function createSqliteRecordMigrationTarget(options) {
                 updatedAt: now().toISOString()
             };
             populateSqliteFromState(home, snapshot.state ?? {}, STAGED_DATABASE_FILENAME);
+            copySqlitePassthroughState(home, COMMITTED_DATABASE_FILENAME, STAGED_DATABASE_FILENAME);
         },
         rebuildDerivedState(effects) {
             // The SQLite database is fully normalised by populateSqliteFromState;

package/dist/storage/upgrade/sqliteStateMigration.js

@@ -33,6 +33,90 @@ import { CURRENT_STORED_TASK_SCHEMA_VERSION } from "../taskStore.js";
 export const STAGED_DATABASE_FILENAME = "yui.db.staged";
 /** The committed database filename. */
 export const COMMITTED_DATABASE_FILENAME = "yui.db";
+/**
+ * Preserve SQLite-owned durable state that intentionally sits outside the
+ * state.json-shaped Task aggregate snapshot. Volatile coordination locks and
+ * derived projections are rebuilt or dropped at the offline boundary.
+ */
+export function copySqlitePassthroughState(home, sourceDatabaseFilename, targetDatabaseFilename) {
+    if (sourceDatabaseFilename === targetDatabaseFilename) {
+        throw new Error("SQLite passthrough copy requires distinct source and target databases.");
+    }
+    const source = new Database(join(home, sourceDatabaseFilename), { readonly: true });
+    const target = new Database(join(home, targetDatabaseFilename));
+    try {
+        target.pragma("foreign_keys = ON");
+        target.transaction(() => {
+            mergeGlobalSequences(source, target);
+            copyTableRows(source, target, "outbox");
+            copyMailboxSignals(source, target);
+            copyTableRows(source, target, "work_item_candidates");
+            copyTableRows(source, target, "review_findings");
+            copyTableRows(source, target, "telemetry");
+            if (sqliteTableExists(source, "telemetry_aggregate")) {
+                target.exec("DELETE FROM telemetry_aggregate");
+                copyTableRows(source, target, "telemetry_aggregate");
+            }
+            copyTableRows(source, target, "session_owners");
+            copyTableRows(source, target, "resource_registry");
+            copyTableRows(source, target, "gate_artifacts");
+            copyTableRows(source, target, "gate_artifact_logs");
+        })();
+    }
+    finally {
+        source.close();
+        target.close();
+    }
+}
+function mergeGlobalSequences(source, target) {
+    if (!sqliteTableExists(source, "global_sequences"))
+        return;
+    const rows = source.prepare("SELECT name, high_water FROM global_sequences").all();
+    const merge = target.prepare(`INSERT INTO global_sequences (name, high_water) VALUES (?, ?)
+     ON CONFLICT(name) DO UPDATE SET
+       high_water = MAX(global_sequences.high_water, excluded.high_water)`);
+    for (const row of rows)
+        merge.run(row.name, row.high_water);
+}
+function copyMailboxSignals(source, target) {
+    if (!sqliteTableExists(source, "mailbox_signals"))
+        return;
+    const rows = source.prepare(`SELECT m.target_key, s.sequence, s.reason, s.ref_type, s.ref_task_id,
+            s.ref_id, s.occurred_at, s.request_id
+       FROM mailbox_signals s
+       JOIN mailboxes m ON m.mailbox_id = s.mailbox_id
+      ORDER BY m.target_key, s.sequence`).iterate();
+    const findMailbox = target.prepare("SELECT mailbox_id FROM mailboxes WHERE target_key = ?");
+    const insert = target.prepare(`INSERT INTO mailbox_signals
+       (mailbox_id, sequence, reason, ref_type, ref_task_id, ref_id, occurred_at, request_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`);
+    for (const row of rows) {
+        const mailbox = findMailbox.get(row.target_key);
+        if (mailbox === undefined) {
+            throw new Error(`SQLite migration cannot preserve signals for missing mailbox ${row.target_key}.`);
+        }
+        insert.run(mailbox.mailbox_id, row.sequence, row.reason, row.ref_type, row.ref_task_id, row.ref_id, row.occurred_at, row.request_id);
+    }
+}
+function copyTableRows(source, target, table) {
+    if (!sqliteTableExists(source, table) || !sqliteTableExists(target, table))
+        return;
+    const columns = source.prepare(`PRAGMA table_info(${quoteSqliteIdentifier(table)})`).all().map((row) => row.name);
+    if (columns.length === 0)
+        return;
+    const quotedColumns = columns.map(quoteSqliteIdentifier);
+    const rows = source.prepare(`SELECT ${quotedColumns.join(", ")} FROM ${quoteSqliteIdentifier(table)}`).iterate();
+    const insert = target.prepare(`INSERT INTO ${quoteSqliteIdentifier(table)} (${quotedColumns.join(", ")}) `
+        + `VALUES (${columns.map(() => "?").join(", ")})`);
+    for (const row of rows)
+        insert.run(...columns.map((column) => row[column]));
+}
+function sqliteTableExists(db, table) {
+    return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) !== undefined;
+}
+function quoteSqliteIdentifier(value) {
+    return `"${value.replaceAll("\"", "\"\"")}"`;
+}
 // ---------------------------------------------------------------------------
 // Canonical JSON and hashing
 // ---------------------------------------------------------------------------
@@ -157,6 +241,7 @@ function tasksOf(state) {
  * sidecar database file.
  */
 export function populateSqliteFromState(home, state, databaseFilename) {
+    const retiredActiveRuns = [];
     const store = new SqliteTaskStore(home, { databaseFilename, migration: true });
     try {
         store.transaction(() => {
@@ -234,6 +319,17 @@ export function populateSqliteFromState(home, state, databaseFilename) {
                 // Active-run pointers: the document stores { schemaVersion, runId }
                 // keyed by pointer; the store derives the pointer from the Run.
                 for (const [pointer, value] of Object.entries(stored.activeRuns)) {
+                    if (stored.task.status === "retired") {
+                        retiredActiveRuns.push({
+                            taskId,
+                            pointer,
+                            value,
+                            updatedAt: typeof stored.task.updatedAt === "string"
+                                ? stored.task.updatedAt
+                                : new Date().toISOString()
+                        });
+                        continue;
+                    }
                     const run = stored.agentRuns[value.runId];
                     if (run === undefined) {
                         throw new Error(`Active run pointer ${taskId}/${pointer} references missing agent run ${value.runId}.`);
@@ -291,6 +387,33 @@ export function populateSqliteFromState(home, state, databaseFilename) {
     finally {
         store.close();
     }
+    persistRetiredActiveRunPointers(home, databaseFilename, retiredActiveRuns);
+}
+/**
+ * A retired Task is an explicit isolation boundary. Its active-run rows are
+ * retained byte-for-byte at the logical record level even when their Run is
+ * missing; normal Tasks continue through the referentially strict store path.
+ */
+function persistRetiredActiveRunPointers(home, databaseFilename, pointers) {
+    if (pointers.length === 0)
+        return;
+    const db = new Database(join(home, databaseFilename));
+    try {
+        const insert = db.prepare(`INSERT INTO active_runs (task_id, pointer, run_id, payload, updated_at)
+       VALUES (?, ?, ?, ?, ?)`);
+        db.transaction(() => {
+            for (const entry of pointers) {
+                if (typeof entry.value.runId !== "string") {
+                    throw new Error(`Retired Task active run pointer ${entry.taskId}/${entry.pointer} `
+                        + "cannot be represented because runId is not a string.");
+                }
+                insert.run(entry.taskId, entry.pointer, entry.value.runId, JSON.stringify(entry.value), entry.updatedAt);
+            }
+        })();
+    }
+    finally {
+        db.close();
+    }
 }
 /**
  * Seed `global_sequences` from the numeric suffixes of existing task and