@zq-silk/yui 0.7.0 → 0.8.1

package/dist/controller/controller.js

@@ -4,7 +4,7 @@ import { pendingWakeupsMatch } from "../scheduler/pendingWakeup.js";
 import { processActiveRoleRunDeliveries } from "../scheduler/activeRoleRunDelivery.js";
 import { selectedActiveSchedulerTasks, selectedSchedulerRoles, selectedSchedulerTasks } from "../scheduler/ports.js";
 import { reconcileExitedRoleRuns } from "../scheduler/roleRunLiveness.js";
-import { DEFAULT_STALL_WINDOW_MS, reconcileStalledRoleRuns } from "../scheduler/roleRunStall.js";
+import { DEFAULT_STALL_WINDOW_MS, DEFAULT_WORKFLOW_STALL_CANDIDATE_AGE_MS, reconcileStalledRoleRuns } from "../scheduler/roleRunStall.js";
 import { repairOrphanedActiveTasks } from "../scheduler/activeTaskProgress.js";
 import { processOperatorInputNotifications } from "../scheduler/operatorInputNotificationProcessor.js";
 import { startControllerServer } from "../core/controllerServer.js";
@@ -22,6 +22,7 @@ const DEFAULT_SIGNAL_WINDOW_MS = 100;
 const DEFAULT_RUNTIME_OBSERVER_INTERVAL_MS = 1_000;
 const DEFAULT_DELIVERY_RETRY_MS = 250;
 const DEFAULT_DELIVERY_RETRY_LIMIT = 60;
+const DEFAULT_DELIVERY_TIMEOUT_MS = 120_000;
 const DEFAULT_TASK_ORCHESTRATION_RETRY_LIMIT = 2;
 const DEFAULT_TASK_CONCURRENCY = 4;
 const MAX_TASK_CONCURRENCY = 32;
@@ -44,7 +45,7 @@ const ZERO_DRAIN_METRICS = Object.freeze({
  * Runs one lean scheduler pass. Due native Turn completions are folded before
  * liveness, so a valid Hook boundary fences destructive process reconciliation.
  */
-export async function runControllerSchedulerPass(store, delivery, now, workspacePreparer, scope = { kind: "full" }, includeOperator = true, runtimeCleanupOutcomes = [], lifecycleHost, stallWindowMs = DEFAULT_STALL_WINDOW_MS, maintenanceFence, onMaintenanceFenceDefer, blockedTaskIds = new Set(), inputDeliveryRecoveryCutoff) {
+export async function runControllerSchedulerPass(store, delivery, now, workspacePreparer, scope = { kind: "full" }, includeOperator = true, runtimeCleanupOutcomes = [], lifecycleHost, stallWindowMs = DEFAULT_STALL_WINDOW_MS, maintenanceFence, onMaintenanceFenceDefer, blockedTaskIds = new Set(), inputDeliveryRecoveryCutoff, diagnosticAfterMs = DEFAULT_WORKFLOW_STALL_CANDIDATE_AGE_MS) {
     const compiledSelection = compileReconcileSelection(scope);
     const selection = includeOperator
         ? { ...compiledSelection, blockedTaskIds }
@@ -112,7 +113,7 @@ export async function runControllerSchedulerPass(store, delivery, now, workspace
         const resourceEvidence = new Map();
         const failedRunRefs = await reconcileExitedRoleRuns(store, delivery, now, roleSelection, unsettledRunRefs, liveStatuses, resourceEvidence, scope.kind === "dirty");
         await controlEventLoopTurn();
-        await reconcileStalledRoleRuns(store, delivery, now, roleSelection, stallWindowMs, liveStatuses, resourceEvidence);
+        await reconcileStalledRoleRuns(store, delivery, now, roleSelection, stallWindowMs, liveStatuses, resourceEvidence, diagnosticAfterMs);
         await controlEventLoopTurn();
         await reconcileDormantRuntimeOwners(store, delivery, lifecycleHost, scope, now, selection.blockedTaskIds);
         const selectedInputTaskIds = selectedTaskIdsForBoundedPass(store, selection);
@@ -794,9 +795,12 @@ export class FileTaskController {
     #workspacePreparer;
     #deliveryRetryMs;
     #deliveryRetryLimit;
+    #mailboxDeliveryRetryLimit;
+    #deliveryTimeoutMs;
     #taskOrchestrationRetryLimit;
     #taskConcurrency;
     #stallWindowMs;
+    #diagnosticAfterMs;
     #runtimeEventProcessor;
     #runtimeObserver;
     #runtimeObserverIntervalMs;
@@ -845,9 +849,14 @@ export class FileTaskController {
         this.#workspacePreparer = options.workspacePreparer;
         this.#deliveryRetryMs = positiveInteger(options.deliveryRetryMs, DEFAULT_DELIVERY_RETRY_MS, "Controller delivery retry delay");
         this.#deliveryRetryLimit = positiveInteger(options.deliveryRetryLimit, DEFAULT_DELIVERY_RETRY_LIMIT, "Controller delivery retry limit");
+        this.#deliveryTimeoutMs = positiveInteger(options.deliveryTimeoutMs, DEFAULT_DELIVERY_TIMEOUT_MS, "Controller delivery timeout");
+        this.#mailboxDeliveryRetryLimit = options.deliveryRetryLimit === undefined
+            ? Math.max(this.#deliveryRetryLimit, Math.ceil(this.#deliveryTimeoutMs / this.#deliveryRetryMs) + 2)
+            : this.#deliveryRetryLimit;
         this.#taskOrchestrationRetryLimit = positiveInteger(options.taskOrchestrationRetryLimit, DEFAULT_TASK_ORCHESTRATION_RETRY_LIMIT, "Controller Task orchestration retry limit");
         this.#taskConcurrency = boundedPositiveInteger(options.taskConcurrency, DEFAULT_TASK_CONCURRENCY, MAX_TASK_CONCURRENCY, "Controller Task concurrency");
         this.#stallWindowMs = positiveInteger(options.stallWindowMs, DEFAULT_STALL_WINDOW_MS, "Controller Run stall window");
+        this.#diagnosticAfterMs = positiveInteger(options.diagnosticAfterMs, DEFAULT_WORKFLOW_STALL_CANDIDATE_AGE_MS, "Controller Run diagnostic threshold");
         this.#runtimeEventProcessor = options.runtimeEventProcessor;
         this.#runtimeObserver = options.runtimeObserver;
         this.#runtimeObserverIntervalMs = positiveInteger(options.runtimeObserverIntervalMs, DEFAULT_RUNTIME_OBSERVER_INTERVAL_MS, "Controller runtime observer interval");
@@ -1109,7 +1118,7 @@ export class FileTaskController {
                     // processes Leader wakeups.
                     this.#jobSupervisor?.reconcile(this.#now());
                     if (scope.kind === "full") {
-                        result = await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, scope, false, runtimeCleanupOutcomes, this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, runtimeFailedTaskIds, this.#startedAt);
+                        result = await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, scope, false, runtimeCleanupOutcomes, this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, runtimeFailedTaskIds, this.#startedAt, this.#diagnosticAfterMs);
                     }
                     else {
                         const dirtyPass = await this.#runDirtySchedulerPass(scope, runtimeCleanupOutcomes, runtimeFailedTaskIds);
@@ -1207,7 +1216,7 @@ export class FileTaskController {
         const taskScopes = partition.taskScopes.filter((taskScope) => (!blockedTaskIds.has(taskScope.taskId)));
         const orderedResults = [];
         if (partition.globalKeys.length > 0) {
-            orderedResults.push(await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, { kind: "dirty", keys: partition.globalKeys }, false, runtimeCleanupOutcomes, this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, blockedTaskIds, this.#startedAt));
+            orderedResults.push(await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, { kind: "dirty", keys: partition.globalKeys }, false, runtimeCleanupOutcomes, this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, blockedTaskIds, this.#startedAt, this.#diagnosticAfterMs));
         }
         if (taskScopes.length === 0
             || this.#stopped
@@ -1240,7 +1249,7 @@ export class FileTaskController {
                     if (this.#stopped || this.#pendingFull)
                         continue;
                     try {
-                        taskResults[selected.index] = await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, { kind: "dirty", keys: selected.taskScope.keys }, false, taskCleanupOutcomes[selected.index], this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, blockedTaskIds, this.#startedAt);
+                        taskResults[selected.index] = await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, { kind: "dirty", keys: selected.taskScope.keys }, false, taskCleanupOutcomes[selected.index], this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, blockedTaskIds, this.#startedAt, this.#diagnosticAfterMs);
                         this.#clearTaskPassRetry(selected.taskScope.taskId);
                     }
                     catch (error) {
@@ -1576,10 +1585,12 @@ export class FileTaskController {
             return;
         }
         const attempts = previous?.attempts ?? 0;
+        const startedAtMs = previous?.startedAtMs ?? this.#now().getTime();
         const retryLimit = key.startsWith("task:")
             ? this.#taskOrchestrationRetryLimit
-            : this.#deliveryRetryLimit;
-        if (attempts >= retryLimit) {
+            : this.#mailboxDeliveryRetryLimit;
+        const remainingMs = this.#deliveryTimeoutMs - (this.#now().getTime() - startedAtMs);
+        if (attempts >= retryLimit || remainingMs <= 0) {
             if (key === "operator")
                 this.#operatorStartupRetryArmed = false;
             this.#terminalizePreparedAfterRetryExhaustion(key, identity, stableTerminalFailure);
@@ -1588,11 +1599,12 @@ export class FileTaskController {
         this.#deliveryRetryAttempts.set(key, {
             identity,
             attempts: attempts + 1,
+            startedAtMs,
             ...(stableTerminalFailure === undefined
                 ? {}
                 : { terminalFailure: stableTerminalFailure })
         });
-        const delayMs = Math.min(2_000, this.#deliveryRetryMs * (2 ** Math.min(attempts, 3)));
+        const delayMs = Math.min(remainingMs, 2_000, this.#deliveryRetryMs * (2 ** Math.min(attempts, 3)));
         const timer = setTimeout(() => {
             this.#deliveryRetryTimers.delete(key);
             if (!this.#stopped)

package/dist/controller/fileSchedulerStoreAdapter.js

@@ -505,7 +505,14 @@ export class FileSchedulerStoreAdapter {
         });
         if (this.telemetry !== null && input.fence.runId !== undefined) {
             try {
-                this.telemetry.sink.observe(runtimeObservationTelemetryEntry(input));
+                const entry = runtimeObservationTelemetryEntry(input);
+                this.telemetry.sink.observe(entry);
+                const run = this.store.getAgentRun(entry.taskId, input.fence.runId);
+                if (run !== null && run.status !== "active") {
+                    void this.telemetry.retention.flush().then(() => {
+                        this.telemetry?.retention.pruneGeneration(entry.taskId, entry.roleName, entry.runId, entry.generation);
+                    }).catch(() => undefined);
+                }
             }
             catch {
                 // Runtime telemetry is diagnostic; the compact durable state snapshot
@@ -2084,7 +2091,7 @@ export class FileSchedulerStoreAdapter {
                     failedNativeTurnId: input.nativeTurnId,
                     lastErrorSummary: summary,
                     scheduleNextAttempt: false
-                }, now);
+                }, now, configuredProviderRetryPolicy(store));
                 if (blocked.outcome === "exhausted")
                     return null;
                 store.saveAgentRun(withProviderRetry(run, blocked.retry));
@@ -2110,7 +2117,7 @@ export class FileSchedulerStoreAdapter {
             failedNativeTurnId: input.nativeTurnId,
             lastErrorSummary: summary,
             ...(input.retryAfterMs === undefined ? {} : { retryAfterMs: input.retryAfterMs })
-        }, now);
+        }, now, configuredProviderRetryPolicy(store));
         if (retryDecision.outcome === "exhausted") {
             this.recordProviderRetryClassified(store, input, classification.errorClass, {
                 wouldRetry: "false",
@@ -2122,10 +2129,10 @@ export class FileSchedulerStoreAdapter {
             if (run.providerRetry === undefined)
                 return null;
             const finalized = finalizeProviderRetryDeadline(store, run, retryDecision.reason === "attempts"
-                ? "Provider retry failed after all three in-Session continuation attempts."
+                ? `Provider retry failed after all ${config.delaysMs.length} in-Session continuation attempts.`
                 : retryDecision.reason === "retry-after-window"
-                    ? "Provider Retry-After exceeded the bounded 600-second episode window."
-                    : "Provider retry did not recover within the bounded 600-second episode window.", retryDecision.reason === "attempts" ? "attempts-exhausted" : "episode-window-exhausted", now);
+                    ? `Provider Retry-After exceeded the bounded ${config.maxWindowMs / 1_000}-second episode window.`
+                    : `Provider retry did not recover within the bounded ${config.maxWindowMs / 1_000}-second episode window.`, retryDecision.reason === "attempts" ? "attempts-exhausted" : "episode-window-exhausted", now);
             return finalized ? { disposition: "applied", runId: input.runId } : null;
         }
         const retry = retryDecision.retry;
@@ -2183,7 +2190,7 @@ export class FileSchedulerStoreAdapter {
             failedNativeTurnId: input.nativeTurnId,
             lastErrorSummary: summary,
             scheduleNextAttempt: false
-        }, now);
+        }, now, configuredProviderRetryPolicy(store));
         if (retryDecision.outcome === "exhausted")
             return null;
         store.saveAgentRun(withProviderRetry(run, retryDecision.retry));
@@ -2223,7 +2230,7 @@ export class FileSchedulerStoreAdapter {
             failedNativeTurnId: input.nativeTurnId,
             lastErrorSummary: summary,
             scheduleNextAttempt: false
-        }, now);
+        }, now, configuredProviderRetryPolicy(store));
         if (decision.outcome === "exhausted")
             return null;
         store.saveAgentRun(withProviderRetry(run, decision.retry));
@@ -2262,7 +2269,7 @@ export class FileSchedulerStoreAdapter {
             failedNativeTurnId: input.nativeTurnId,
             lastErrorSummary: summary,
             scheduleNextAttempt: false
-        }, now);
+        }, now, configuredProviderRetryPolicy(store));
         if (decision.outcome === "exhausted")
             return null;
         store.saveAgentRun(withProviderRetry(run, decision.retry));
@@ -3695,3 +3702,7 @@ function compareCanonicalObservationOrder(left, right) {
         || (left.ordinal ?? -1) - (right.ordinal ?? -1)
         || left.eventId.localeCompare(right.eventId);
 }
+function configuredProviderRetryPolicy(store) {
+    const config = providerRetryConfig(store.getConfig());
+    return { delaysMs: config.delaysMs, maxWindowMs: config.maxWindowMs };
+}

package/dist/controller/runtime.js

@@ -1,4 +1,4 @@
-import { reconciliationIntervalMilliseconds, resolveTmuxBin } from "../config/yuiConfig.js";
+import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveRuntimeHealth, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
 import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
@@ -92,6 +92,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             ? new SqliteTaskStore(home)
             : openCompatibleFileTaskStore(home));
     const homeId = store.getHomeIdentity().homeId;
+    const durableConfig = store.getConfig();
     // When the worker backend is active, the db-touching observer folds run in
     // the worker (off the main event loop). The client is closed on shutdown.
     const asyncStoreClient = useWorker
@@ -113,8 +114,9 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     const planner = options.planner ?? new FileRoleLaunchPlanner(home, store, {
         environment: options.environment
     });
-    const tmux = options.tmux ?? new TmuxManager(resolveTmuxBin(store.getConfig().tmuxBin), new NodeCommandExecutor(), {
+    const tmux = options.tmux ?? new TmuxManager(resolveTmuxBin(durableConfig.tmuxBin), new NodeCommandExecutor(), {
         yuiHome: home,
+        historyLimit: resolveTmuxHistoryLimit(durableConfig.tmuxHistoryLimit),
         ...(domainIdentity === undefined
             ? {}
             : {
@@ -181,8 +183,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             }
             throw new Error("Native session discovery was aborted.");
         },
-        inactivityTimeoutMs: positiveIntegerOption(options.environment?.YUI_LAUNCH_INACTIVITY_TIMEOUT_MS
-            ?? process.env.YUI_LAUNCH_INACTIVITY_TIMEOUT_MS, 300_000),
+        inactivityTimeoutMs: resolveAgentLaunchInactivityTimeoutSeconds(durableConfig.agentLaunchInactivityTimeoutSeconds) * 1_000,
         onHostCreated: ({ binding, pane }) => {
             sessionOwners.recordHostOwner({
                 owner: binding.owner,
@@ -438,9 +439,16 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         intervalMs: options.intervalMs
             ?? reconciliationIntervalMilliseconds(store.getConfig().reconciliationIntervalSeconds),
         signalWindowMs: options.signalWindowMs,
-        taskConcurrency: options.taskConcurrency,
+        taskConcurrency: options.taskConcurrency
+            ?? resolveControllerTaskConcurrency(durableConfig.controllerTaskConcurrency),
         deliveryRetryMs: options.deliveryRetryMs,
         deliveryRetryLimit: options.deliveryRetryLimit,
+        deliveryTimeoutMs: options.deliveryTimeoutMs
+            ?? resolveDeliveryTimeoutSeconds(durableConfig.deliveryTimeoutSeconds) * 1_000,
+        stallWindowMs: options.stallWindowMs
+            ?? resolveRuntimeHealth(durableConfig.runtimeHealth).stallWindowMs,
+        diagnosticAfterMs: options.diagnosticAfterMs
+            ?? resolveRuntimeHealth(durableConfig.runtimeHealth).diagnosticAfterMs,
         now: options.now,
         onError: options.onError,
         lifecycleHost,
@@ -497,13 +505,28 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     catch (error) {
         (options.onError ?? (() => undefined))(error);
     }
+    let resourceClose;
+    const closeResources = () => {
+        resourceClose ??= Promise.all([
+            asyncStoreClient?.close() ?? Promise.resolve(),
+            inventoryClient?.close() ?? Promise.resolve()
+        ]).then(() => undefined);
+        return resourceClose;
+    };
+    const closed = running.closed.then(closeResources);
     return {
         ...running,
+        closed,
         close: async () => {
-            await running.close();
-            // Release the worker's database connections when the worker backend is active.
-            await asyncStoreClient?.close();
-            await inventoryClient?.close();
+            try {
+                await running.close();
+            }
+            finally {
+                // RPC-driven Controller stops resolve `running.closed` without calling
+                // this wrapper. Share one cleanup promise so both lifecycle paths
+                // release the worker connections before the process can linger.
+                await closeResources();
+            }
         },
         store,
         schedulerStore,
@@ -1026,15 +1049,6 @@ function abortableDelay(milliseconds, signal) {
         signal.addEventListener("abort", onAbort, { once: true });
     });
 }
-function positiveIntegerOption(value, fallback) {
-    if (value === undefined || value.trim().length === 0)
-        return fallback;
-    const parsed = Number(value);
-    if (!Number.isSafeInteger(parsed) || parsed <= 0) {
-        throw new Error(`Invalid native session discovery timeout: ${value}`);
-    }
-    return parsed;
-}
 function applicationError(code, message) {
     const error = Object.assign(new Error(message), { code });
     error.name = "CoreApplicationError";

package/dist/coordination/workMailbox.js

@@ -121,22 +121,26 @@ function appendUnique(existing, incoming, keyOf) {
     }
     return result;
 }
-function mergeBatches(earlier, later) {
+function mergeBatches(left, right) {
     const merged = {
-        fromSequence: earlier.fromSequence,
-        toSequence: later.toSequence,
-        reasons: appendUnique(earlier.reasons, later.reasons, (reason) => reason),
-        refs: appendUnique(earlier.refs, later.refs, mailboxEntityRefKey),
-        requestCount: earlier.requestCount + later.requestCount,
-        firstQueuedAt: earlier.firstQueuedAt,
-        lastQueuedAt: later.lastQueuedAt,
-        sources: appendUnique(earlier.sources, later.sources, (source) => source),
-        dedupeKeys: appendUnique(earlier.dedupeKeys, later.dedupeKeys, (key) => key),
-        deliveryModes: appendUnique(earlier.deliveryModes, later.deliveryModes, (mode) => mode),
-        ...((earlier.highestFactRevision ?? later.highestFactRevision) === undefined
+        fromSequence: Math.min(left.fromSequence, right.fromSequence),
+        toSequence: Math.max(left.toSequence, right.toSequence),
+        reasons: appendUnique(left.reasons, right.reasons, (reason) => reason),
+        refs: appendUnique(left.refs, right.refs, mailboxEntityRefKey),
+        requestCount: left.requestCount + right.requestCount,
+        firstQueuedAt: Date.parse(left.firstQueuedAt) <= Date.parse(right.firstQueuedAt)
+            ? left.firstQueuedAt
+            : right.firstQueuedAt,
+        lastQueuedAt: Date.parse(left.lastQueuedAt) >= Date.parse(right.lastQueuedAt)
+            ? left.lastQueuedAt
+            : right.lastQueuedAt,
+        sources: appendUnique(left.sources, right.sources, (source) => source),
+        dedupeKeys: appendUnique(left.dedupeKeys, right.dedupeKeys, (key) => key),
+        deliveryModes: appendUnique(left.deliveryModes, right.deliveryModes, (mode) => mode),
+        ...((left.highestFactRevision ?? right.highestFactRevision) === undefined
             ? {}
             : {
-                highestFactRevision: Math.max(earlier.highestFactRevision ?? 0, later.highestFactRevision ?? 0)
+                highestFactRevision: Math.max(left.highestFactRevision ?? 0, right.highestFactRevision ?? 0)
             })
     };
     return merged;
@@ -196,17 +200,16 @@ export function validateWorkMailbox(value) {
         pending.userCorrection,
         inputDelivery?.batch
     ].filter((batch) => batch !== null && batch !== undefined);
+    const activeDedupeKeys = new Set();
     for (const batch of batches) {
         if (batch.toSequence >= nextSequence) {
             throw new Error("WorkMailbox batch sequence must be lower than nextSequence");
         }
-    }
-    const ranges = batches
-        .map((batch) => [batch.fromSequence, batch.toSequence])
-        .sort((left, right) => left[0] - right[0]);
-    for (let index = 1; index < ranges.length; index += 1) {
-        if (ranges[index - 1][1] >= ranges[index][0]) {
-            throw new Error("WorkMailbox batch sequences overlap");
+        for (const dedupeKey of batch.dedupeKeys) {
+            if (activeDedupeKeys.has(dedupeKey)) {
+                throw new Error("WorkMailbox active batches share a dedupe key");
+            }
+            activeDedupeKeys.add(dedupeKey);
         }
     }
     if (inputDelivery !== null && target.kind !== "role" && target.kind !== "operator") {
@@ -304,8 +307,8 @@ function parseBatch(value, label) {
     const fromSequence = requireInteger(batch.fromSequence, 1, `${label} fromSequence`);
     const toSequence = requireInteger(batch.toSequence, fromSequence, `${label} toSequence`);
     const requestCount = requireInteger(batch.requestCount, 1, `${label} requestCount`);
-    if (requestCount !== toSequence - fromSequence + 1) {
-        throw new Error(`${label} requestCount does not match its sequence range`);
+    if (requestCount > toSequence - fromSequence + 1) {
+        throw new Error(`${label} requestCount exceeds its sequence envelope`);
     }
     const reasons = requireStringArray(batch.reasons, `${label} reasons`);
     if (reasons.length === 0)

package/dist/doctor/doctor.js

@@ -16,7 +16,7 @@ import { inspectStorageSchema } from "../storage/storageSchema.js";
 import { resolveTaskStoreBackendForHome } from "../storage/sqliteStore.js";
 import { resolveStoreWorkerEnabledForHome } from "../storage/storeRpc.js";
 import { classifyHome } from "../storage/upgrade/homeClassification.js";
-import { resolveGitBin, resolveTmuxBin } from "../config/yuiConfig.js";
+import { resolveTmuxBin } from "../config/yuiConfig.js";
 import { readMigrationReceipt } from "../storage/upgrade/migrationReceipt.js";
 import { latestStorageVersionState } from "../storage/upgrade/recordVersions.js";
 import { COMMITTED_DATABASE_FILENAME } from "../storage/upgrade/sqliteStateMigration.js";
@@ -985,7 +985,7 @@ function readDurableConfigSafely(home, storageOptions) {
         const config = store.getConfig();
         return {
             tmuxBin: resolveTmuxBin(config.tmuxBin),
-            gitBin: resolveGitBin(config.gitBin)
+            gitBin: "git"
         };
     }
     catch {

package/dist/resources/autoResourceGc.js

@@ -11,7 +11,7 @@
  * sources) applies identically.
  */
 import { applyResourceGc, planResourceGc } from "./resourceGc.js";
-import { resolveResourcesGcAutoQuarantine, resolveResourcesGcMode } from "../config/yuiConfig.js";
+import { resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours } from "../config/yuiConfig.js";
 /**
  * Create the Controller's automatic Resource GC hook. The hook self-skips
  * unless `resourcesGcMode=quarantine` and `resourcesGcAutoQuarantine=true`.
@@ -35,6 +35,7 @@ export function createResourceAutoGc(options) {
             taskStatusById,
             mode: "quarantine",
             now,
+            quarantineTtlHours: resolveResourcesQuarantineTtlHours(config.resourcesQuarantineTtlHours),
             environment,
             activeWorkspaceOwnerPaths: collectActiveWorkspaceOwnerPaths(store)
         };
@@ -75,6 +76,7 @@ export async function runAutoResourceGc(store, options = {}) {
         taskStatusById,
         mode: "quarantine",
         now,
+        quarantineTtlHours: resolveResourcesQuarantineTtlHours(config.resourcesQuarantineTtlHours),
         activeWorkspaceOwnerPaths: collectActiveWorkspaceOwnerPaths(store)
     };
     const plan = await planResourceGc(input);

package/dist/review/reviewConfig.js

@@ -11,8 +11,6 @@ export const REVIEW_DELTA_RECHECK_MODES = ["enabled", "disabled"];
 /** Issue 07: conservative defaults for whether a delta attempt is allowed. */
 export const DEFAULT_DELTA_RECHECK_MAX_CHANGED_LINES = 200;
 export const DEFAULT_DELTA_RECHECK_MAX_CHANGED_FILES = 5;
-/** The Reviewer Role seeded in a new Home by `yui setup`. */
-export const DEFAULT_REVIEWER_ROLE = "reviewer";
 export function validateReviewConfig(config) {
     requireIdentity(config.roleName, "Review Role");
     if (!REVIEW_TRIGGERS.includes(config.trigger)) {

package/dist/run/providerRetry.js

@@ -1,24 +1,22 @@
 import { createHash } from "node:crypto";
+import { DEFAULT_PROVIDER_RETRY_DELAYS_SECONDS, DEFAULT_PROVIDER_RETRY_MAX_WINDOW_SECONDS, MAX_PROVIDER_RETRY_ATTEMPTS } from "../config/yuiConfig.js";
 import { requireIdentity, requireText, requireTimestamp } from "../domain/validation.js";
-export const PROVIDER_RETRY_DELAYS_MS = Object.freeze([2_000, 5_000, 15_000]);
-export const PROVIDER_RETRY_MAX_DISPATCHES = PROVIDER_RETRY_DELAYS_MS.length;
-export const PROVIDER_RETRY_EPISODE_WINDOW_MS = 600_000;
-/** Durable configuration keeps the historical name for compatibility. */
-export const PROVIDER_RETRY_MAX_WINDOW_MS = PROVIDER_RETRY_EPISODE_WINDOW_MS;
-export function nextProviderRetryDelayMs(retryIndex) {
+export const PROVIDER_RETRY_DELAYS_MS = Object.freeze(DEFAULT_PROVIDER_RETRY_DELAYS_SECONDS.map((seconds) => seconds * 1_000));
+export const PROVIDER_RETRY_EPISODE_WINDOW_MS = DEFAULT_PROVIDER_RETRY_MAX_WINDOW_SECONDS * 1_000;
+export function nextProviderRetryDelayMs(retryIndex, delaysMs = PROVIDER_RETRY_DELAYS_MS) {
     if (!Number.isSafeInteger(retryIndex)
         || retryIndex < 1
-        || retryIndex > PROVIDER_RETRY_MAX_DISPATCHES) {
+        || retryIndex > delaysMs.length) {
         throw new Error(`Provider retry index is out of range: ${String(retryIndex)}.`);
     }
-    return PROVIDER_RETRY_DELAYS_MS[retryIndex - 1];
+    return delaysMs[retryIndex - 1];
 }
 /**
  * True when the retry lineage has used its total wall-clock budget. The
  * budget is measured from the first classified failure, so repeated failures
  * never extend it.
  */
-export function providerRetryBudgetExhausted(value, now, maxWindowMs = PROVIDER_RETRY_MAX_WINDOW_MS) {
+export function providerRetryBudgetExhausted(value, now, maxWindowMs = PROVIDER_RETRY_EPISODE_WINDOW_MS) {
     if (!Number.isSafeInteger(maxWindowMs) || maxWindowMs <= 0) {
         throw new Error(`Provider retry max window must be a positive integer: ${String(maxWindowMs)}.`);
     }
@@ -43,7 +41,9 @@ export function validateAgentRunProviderRetry(value) {
         || value.dispatchedRetries > value.maxRetries) {
         throw new Error("Agent run providerRetry dispatchedRetries is invalid.");
     }
-    if (value.maxRetries !== PROVIDER_RETRY_MAX_DISPATCHES) {
+    if (!Number.isSafeInteger(value.maxRetries)
+        || value.maxRetries < 1
+        || value.maxRetries > MAX_PROVIDER_RETRY_ATTEMPTS) {
         throw new Error("Agent run providerRetry maxRetries is invalid.");
     }
     requireTimestamp(value.firstFailureAt, "Agent run providerRetry firstFailureAt");
@@ -83,18 +83,22 @@ export function validateAgentRunProviderRetry(value) {
     return value;
 }
 /** Advance one failure episode without ever changing the native Session. */
-export function scheduleProviderRetry(previous, input, now) {
+export function scheduleProviderRetry(previous, input, now, policy = {
+    delaysMs: PROVIDER_RETRY_DELAYS_MS,
+    maxWindowMs: PROVIDER_RETRY_EPISODE_WINDOW_MS
+}) {
+    validateRetrySchedulePolicy(policy);
     const at = now.toISOString();
     const firstFailureAt = previous?.firstFailureAt ?? at;
     const episodeDeadlineAt = previous?.episodeDeadlineAt
-        ?? new Date(now.getTime() + PROVIDER_RETRY_EPISODE_WINDOW_MS).toISOString();
+        ?? new Date(now.getTime() + policy.maxWindowMs).toISOString();
     if (now.getTime() >= Date.parse(episodeDeadlineAt)) {
         return Object.freeze({ outcome: "exhausted", reason: "window" });
     }
     const consecutiveFailures = (previous?.consecutiveFailures ?? 0) + 1;
     const dispatchedRetries = previous?.dispatchedRetries ?? 0;
     const schedule = input.scheduleNextAttempt ?? true;
-    if (schedule && dispatchedRetries >= PROVIDER_RETRY_MAX_DISPATCHES) {
+    if (schedule && dispatchedRetries >= policy.delaysMs.length) {
         return Object.freeze({ outcome: "exhausted", reason: "attempts" });
     }
     const state = schedule ? "scheduled" : "blocked";
@@ -103,7 +107,7 @@ export function scheduleProviderRetry(previous, input, now) {
         throw new Error("Provider retry Retry-After must be a positive safe integer.");
     }
     const delayMs = schedule
-        ? Math.max(nextProviderRetryDelayMs(dispatchedRetries + 1), retryAfterMs ?? 0)
+        ? Math.max(nextProviderRetryDelayMs(dispatchedRetries + 1, policy.delaysMs), retryAfterMs ?? 0)
         : undefined;
     const nextAttemptAt = delayMs === undefined
         ? undefined
@@ -125,7 +129,7 @@ export function scheduleProviderRetry(previous, input, now) {
         errorClass: input.errorClass,
         consecutiveFailures,
         dispatchedRetries,
-        maxRetries: PROVIDER_RETRY_MAX_DISPATCHES,
+        maxRetries: policy.delaysMs.length,
         firstFailureAt,
         lastFailureAt: at,
         episodeDeadlineAt,
@@ -139,6 +143,15 @@ export function scheduleProviderRetry(previous, input, now) {
     });
     return Object.freeze({ outcome: schedule ? "scheduled" : "blocked", retry });
 }
+function validateRetrySchedulePolicy(policy) {
+    if (!Number.isSafeInteger(policy.maxWindowMs) || policy.maxWindowMs < 1) {
+        throw new Error("Provider retry max window must be a positive safe integer.");
+    }
+    if (policy.delaysMs.length < 1 || policy.delaysMs.length > MAX_PROVIDER_RETRY_ATTEMPTS
+        || policy.delaysMs.some((delay) => !Number.isSafeInteger(delay) || delay < 1)) {
+        throw new Error(`Provider retry delay schedule must contain 1-${MAX_PROVIDER_RETRY_ATTEMPTS} positive safe integers.`);
+    }
+}
 /** Mark that one short continuation request was dispatched and now awaits any correlated progress. */
 export function prepareProviderRetryDispatch(value, receiptId, now) {
     if (value.state !== "scheduled" || value.nextAttemptAt === undefined)
@@ -203,7 +216,7 @@ export function serializeProviderRetryEnvelope(input) {
     return [
         "Yui managed in-Session continuation retry.",
         `task=${requireIdentity(input.taskId, "Provider retry task id")} run=${requireIdentity(input.runId, "Provider retry run id")} role=${requireIdentity(input.roleName, "Provider retry role")}`,
-        `episode=${input.retry.episodeId} retry=${retryOrdinal}/${PROVIDER_RETRY_MAX_DISPATCHES} receipt=${input.retry.lastRetryReceiptId ?? "pending"}`,
+        `episode=${input.retry.episodeId} retry=${retryOrdinal}/${input.retry.maxRetries} receipt=${input.retry.lastRetryReceiptId ?? "pending"}`,
         `failureEvent=${input.retry.failureEventId}`,
         ...(input.retry.failedNativeTurnId === undefined
             ? []

package/dist/run/providerRetryConfig.js

@@ -1,4 +1,4 @@
-import { resolveProviderRetryAdapters, resolveProviderRetryMaxWindowMs, resolveProviderRetryMode, resolveYieldReceiptReplay } from "../config/yuiConfig.js";
+import { resolveProviderRetryAdapters, resolveProviderRetryDelaysSeconds, resolveProviderRetryMaxWindowSeconds, resolveProviderRetryMode } from "../config/yuiConfig.js";
 /**
  * Resolves the retry flags from the durable Yui config. Homes without the
  * fields get the safe defaults: enforce mode, all supported adapters, receipt
@@ -10,8 +10,10 @@ export function providerRetryConfig(config) {
     return {
         mode: adapters.length === 0 ? "off" : mode,
         adapters,
-        yieldReceiptReplay: resolveYieldReceiptReplay(config.yieldReceiptReplay),
-        maxWindowMs: resolveProviderRetryMaxWindowMs(config.providerRetryMaxWindowMs)
+        delaysMs: resolveProviderRetryDelaysSeconds(config.providerRetryDelaysSeconds)
+            .map((seconds) => seconds * 1_000),
+        maxWindowMs: resolveProviderRetryMaxWindowSeconds(config.providerRetryMaxWindowSeconds)
+            * 1_000
     };
 }
 /** Whether the adapter has in-place retry enabled in the given mode. */

package/dist/runtime/launchDiagnostics.js

@@ -138,7 +138,7 @@ function launchHint(kind, agentId) {
         case "config":
             return agentId === undefined
                 ? "Verify the Provider model and effort configuration."
-                : `Verify custom model/effort with yui agent capabilities ${agentId}.`;
+                : `Verify custom model/effort with yui config agent capabilities ${agentId}.`;
         case "auth":
             return "Verify Provider authentication and the Agent environment.";
         case "executable":