@zq-silk/yui 0.8.1 → 0.8.3

package/dist/controller/fileSchedulerStoreAdapter.js

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
-import { activeLiveRoleAgentSession, bindTaskRoleProviderRuntime, bindTaskRoleRun, clearTaskRoleRun, createRoleSessionSet, markTaskRoleRunDelivered, markTaskRoleRunPushed, recordRoleAgentSession, recordTaskRoleTurnBoundary, rememberRoleAgentCompletedTurn, updateRoleAgentSessionStatus, updateTaskRoleProviderRuntime } from "../executor/agentExecutor.js";
-import { createProviderRuntimeBinding, endProviderActivation, startProviderActivation, updateProviderConversationRecoverability } from "../runtime/providerRuntimeIdentity.js";
+import { activeLiveRoleAgentSession, bindTaskRoleProviderRuntime, bindTaskRoleRun, clearTaskRoleRun, createRoleSessionSet, markTaskRoleRunDelivered, markTaskRoleRunPushed, prepareTaskRoleRunRedispatch, recordRoleAgentSession, recordTaskRoleTurnBoundary, rememberRoleAgentCompletedTurn, updateRoleAgentSessionStatus, updateTaskRoleProviderRuntime } from "../executor/agentExecutor.js";
+import { acceptProviderTurn, beginProviderTurn, createProviderRuntimeBinding, endProviderActivation, currentProviderActivation, currentProviderConversation, markProviderTurnDeliveryUnknown, rejectProviderTurn, settleProviderTurn, startProviderActivation, supersedeProviderConversation, updateProviderConversationRecoverability } from "../runtime/providerRuntimeIdentity.js";
+import { decideProviderRecovery } from "../runtime/providerRecoveryDecision.js";
 import { hasRecentTurnId } from "../executor/turnCompletion.js";
 import { createTaskEvent } from "../event/taskEvent.js";
 import { buildTaskWakeEnvelope } from "../context/wakeNotification.js";
@@ -40,6 +41,12 @@ import { RUNTIME_OBSERVATION_TASK_EVENT, createRuntimeObservation, runtimeObserv
 import { projectRuntimeTaskEvents } from "../runtime/runtimeProjection.js";
 import { contextSnapshotRef } from "../context/contextSnapshot.js";
 import { contextSnapshotDeltaRefIds, freezeRunContextSnapshot } from "../context/runContextPack.js";
+export class AgentHostProviderTurnFenceError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AgentHostProviderTurnFenceError";
+    }
+}
 /** Maps the authoritative FileTaskStore records to the scheduler's narrow port. */
 export class FileSchedulerStoreAdapter {
     store;
@@ -145,7 +152,8 @@ export class FileSchedulerStoreAdapter {
                         nativeSessionId: input.fence.nativeSessionId,
                         turnId: input.fence.nativeTurnId,
                         runId: input.fence.runId,
-                        summary: input.payload.summary ?? `Provider Turn failed: ${failureEvidence.code}.`
+                        summary: input.payload.summary ?? `Provider Turn failed: ${failureEvidence.code}.`,
+                        providerStatus: "failed"
                     }, now);
                     outcome = boundary.disposition === "obsolete" ? "obsolete" : "applied";
                     break;
@@ -812,42 +820,129 @@ export class FileSchedulerStoreAdapter {
         const sessions = this.store.getTaskRoleSessionSet(taskId, roleName);
         return sessions !== null && sessions.inFlight !== null;
     }
-    getActiveProviderTurnFence(input) {
-        const observations = this.store.listEvents(input.taskId)
-            .map(runtimeObservationFromTaskEvent)
-            .filter((entry) => entry !== null
-            && entry.fence.runId === input.runId
-            && entry.fence.roleName === input.roleName
-            && entry.fence.agentId === input.agentId
-            && entry.fence.launchId === input.launchId
-            && entry.fence.nativeSessionId === input.nativeSessionId
-            && entry.fence.nativeTurnId !== undefined)
-            .sort((left, right) => (left.receivedAt.localeCompare(right.receivedAt)
-            || (left.sequence ?? -1) - (right.sequence ?? -1)
-            || (left.ordinal ?? -1) - (right.ordinal ?? -1)
-            || left.semanticKey.localeCompare(right.semanticKey)));
-        const state = new Map();
-        const fences = new Map();
-        for (const observation of observations) {
-            const turnId = observation.fence.nativeTurnId;
-            if (observation.kind === "turn.accepted" || observation.kind === "input.accepted") {
-                state.set(turnId, "active");
-                fences.set(turnId, observation);
-            }
-            else if (["turn.completed", "turn.failed", "turn.cancelled"].includes(observation.kind)) {
-                state.set(turnId, "terminal");
-            }
-        }
-        const active = [...state.entries()].filter(([, status]) => status === "active");
-        if (active.length !== 1)
+    beginAgentHostProviderTurn(input) {
+        this.store.transaction((store) => {
+            const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+            const session = sessions?.sessions[input.agentId];
+            const binding = sessions?.providerBinding;
+            if (sessions === null || sessions === undefined
+                || binding === null || binding === undefined
+                || sessions.inFlight?.runId !== input.runId
+                || binding.runId !== input.runId
+                || session?.launchId !== input.launchId
+                || session.nativeSessionId !== input.nativeSessionId
+                || currentProviderConversation(binding).conversationId !== input.nativeSessionId
+                || binding.authority.owner !== input.authorityOwner
+                || binding.authority.epoch !== input.authorityEpoch
+                || binding.authority.holderId !== input.holderId) {
+                throw new AgentHostProviderTurnFenceError("Agent Host Provider Turn carries a stale durable writer fence. Release and reacquire Provider authority before retrying input.");
+            }
+            const exactReplay = binding.turn?.attemptId === input.attemptId
+                && binding.turn.authorityEpoch === input.authorityEpoch
+                && binding.turn.status === "submitting";
+            if (!exactReplay && binding.turn !== null
+                && ["submitting", "accepted", "running", "delivery-unknown"]
+                    .includes(binding.turn.status)) {
+                throw new AgentHostProviderTurnFenceError("Provider Conversation already has an unsettled Turn.");
+            }
+            store.saveTaskRoleSessionSet(updateTaskRoleProviderRuntime(sessions, beginProviderTurn(binding, {
+                attemptId: input.attemptId,
+                authorityEpoch: input.authorityEpoch,
+                submittedAt: input.now.toISOString()
+            }), input.now));
+        });
+    }
+    resolveAgentHostProviderTurnSubmission(input) {
+        this.store.transaction((store) => {
+            const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+            const binding = sessions?.providerBinding;
+            if (sessions === null || sessions === undefined
+                || binding === null || binding === undefined
+                || binding.runId !== input.runId
+                || binding.turn?.attemptId !== input.attemptId
+                || binding.turn.status !== "submitting") {
+                throw new Error("Agent Host Provider Turn submission is no longer current.");
+            }
+            const updated = input.status === "delivery-unknown"
+                ? markProviderTurnDeliveryUnknown(binding, {
+                    attemptId: input.attemptId,
+                    observedAt: input.now.toISOString(),
+                    reason: input.reason
+                })
+                : rejectProviderTurn(binding, {
+                    attemptId: input.attemptId,
+                    rejectedAt: input.now.toISOString(),
+                    reason: input.reason
+                });
+            store.saveTaskRoleSessionSet(updateTaskRoleProviderRuntime(sessions, updated, input.now));
+        });
+    }
+    getProviderAuthorityFence(input) {
+        const sessions = this.store.getTaskRoleSessionSet(input.taskId, input.roleName);
+        const session = sessions?.sessions[input.agentId];
+        const binding = sessions?.providerBinding;
+        if (binding === null || binding === undefined
+            || binding.runId !== input.runId
+            || session?.launchId !== input.launchId
+            || session.nativeSessionId !== input.nativeSessionId
+            || currentProviderConversation(binding).conversationId !== input.nativeSessionId)
+            return null;
+        const activation = currentProviderActivation(binding);
+        if (activation === null)
             return null;
-        const observation = fences.get(active[0][0]);
         return {
-            conversationId: observation.fence.conversationId ?? input.nativeSessionId,
-            activationId: observation.fence.activationId ?? input.launchId,
-            nativeTurnId: active[0][0]
+            conversationId: currentProviderConversation(binding).conversationId,
+            activationId: activation.activationId,
+            ...binding.authority
         };
     }
+    beginRoleRunProviderTurn(input) {
+        return this.store.transaction((store) => {
+            const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+            const session = sessions?.sessions[input.agentId];
+            const binding = sessions?.providerBinding;
+            if (sessions === null || sessions === undefined
+                || binding === null || binding === undefined
+                || sessions.inFlight?.runId !== input.runId
+                || binding.runId !== input.runId
+                || session?.launchId !== input.launchId
+                || session.nativeSessionId !== input.nativeSessionId
+                || currentProviderConversation(binding).conversationId !== input.nativeSessionId
+                || binding.authority.owner !== "controller")
+                return false;
+            store.saveTaskRoleSessionSet(updateTaskRoleProviderRuntime(sessions, beginProviderTurn(binding, {
+                attemptId: input.attemptId,
+                authorityEpoch: binding.authority.epoch,
+                submittedAt: input.now.toISOString()
+            }), input.now));
+            return true;
+        });
+    }
+    resolveRoleRunProviderSubmission(input) {
+        return this.store.transaction((store) => {
+            const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+            const binding = sessions?.providerBinding;
+            if (sessions === null || sessions === undefined
+                || binding === null || binding === undefined
+                || binding.runId !== input.runId
+                || binding.turn?.attemptId !== input.attemptId
+                || binding.turn.status !== "submitting")
+                return false;
+            const updated = input.status === "delivery-unknown"
+                ? markProviderTurnDeliveryUnknown(binding, {
+                    attemptId: input.attemptId,
+                    observedAt: input.now.toISOString(),
+                    reason: input.reason
+                })
+                : rejectProviderTurn(binding, {
+                    attemptId: input.attemptId,
+                    rejectedAt: input.now.toISOString(),
+                    reason: input.reason
+                });
+            store.saveTaskRoleSessionSet(updateTaskRoleProviderRuntime(sessions, updated, input.now));
+            return true;
+        });
+    }
     isRoleGenerationProviderReady(input) {
         // A session.ready observation for this exact generation is the durable
         // pre-input fence. This reads folded Driver truth
@@ -971,6 +1066,31 @@ export class FileSchedulerStoreAdapter {
                 executionRef: input.executionRef,
                 providerFence: input.providerFence
             });
+            if (input.target.kind === "role"
+                && input.executionRef.type === "run"
+                && input.executionRef.taskId === input.target.taskId) {
+                const sessions = store.getTaskRoleSessionSet(input.target.taskId, input.target.roleName);
+                const binding = sessions?.providerBinding;
+                if (sessions === null || sessions === undefined
+                    || binding === null || binding === undefined
+                    || binding.runId !== input.executionRef.id
+                    || binding.authority.owner !== "controller") {
+                    throw new Error("Controller does not own the Provider writer authority.");
+                }
+                const conversation = currentProviderConversation(binding);
+                const activation = currentProviderActivation(binding);
+                if (input.providerFence === undefined
+                    || conversation.conversationId !== input.providerFence.conversationId
+                    || activation?.activationId !== input.providerFence.activationId) {
+                    throw new Error("Provider input claim carries a stale Conversation/Activation fence.");
+                }
+                const next = beginProviderTurn(binding, {
+                    attemptId: input.attemptId,
+                    authorityEpoch: binding.authority.epoch,
+                    submittedAt: input.now.toISOString()
+                });
+                store.saveTaskRoleSessionSet(updateTaskRoleProviderRuntime(sessions, next, input.now));
+            }
             store.saveWorkMailbox(claimed);
             return { status: "claimed", delivery: claimed.inputDelivery };
         });
@@ -1009,20 +1129,22 @@ export class FileSchedulerStoreAdapter {
             return true;
         });
     }
-    releaseInputDelivery(target, attemptId) {
+    releaseInputDelivery(target, attemptId, now) {
         return this.store.transaction((store) => {
             const mailbox = store.getWorkMailbox(target);
             if (mailbox?.inputDelivery?.attemptId !== attemptId)
                 return false;
+            rejectSubmittingProviderTurn(store, target, mailbox.inputDelivery, now, "Provider write was not attempted.");
             store.saveWorkMailbox(releaseMailboxInputDelivery(mailbox, attemptId));
             return true;
         });
     }
-    resolveInputDeliveryNotAccepted(target, attemptId) {
+    resolveInputDeliveryNotAccepted(target, attemptId, now) {
         return this.store.transaction((store) => {
             const mailbox = store.getWorkMailbox(target);
             if (mailbox?.inputDelivery?.attemptId !== attemptId)
                 return false;
+            rejectSubmittingProviderTurn(store, target, mailbox.inputDelivery, now, "Provider returned an exact negative acknowledgement.");
             store.saveWorkMailbox(resolveMailboxInputDeliveryNotAccepted(mailbox, attemptId));
             return true;
         });
@@ -1033,6 +1155,7 @@ export class FileSchedulerStoreAdapter {
             if (mailbox?.inputDelivery?.attemptId !== attemptId)
                 return false;
             const unknown = markMailboxInputDeliveryUnknown(mailbox, attemptId, reason, now);
+            markSubmittingProviderTurnUnknown(store, target, mailbox.inputDelivery, now, reason);
             store.saveWorkMailbox(unknown);
             const taskId = target.kind === "role" ? target.taskId : undefined;
             if (taskId !== undefined) {
@@ -1872,6 +1995,7 @@ export class FileSchedulerStoreAdapter {
                     : sessions.inFlight === null ? idleStatus : "running",
                 effective
             }, now);
+            sessions = settleStructuredProviderTurn(sessions, input.turnId, input.providerStatus ?? "completed", now);
             if (sessions.inFlight === null) {
                 sessions = rememberRoleAgentCompletedTurn(sessions, input.agentId, input.nativeSessionId, input.turnId, now);
                 store.saveTaskRoleSessionSet(sessions);
@@ -2137,16 +2261,9 @@ export class FileSchedulerStoreAdapter {
         }
         const retry = retryDecision.retry;
         store.saveAgentRun(withProviderRetry(run, retry));
-        // Clear the in-flight fence so the original Session can be re-bound and
-        const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
-        // re-pushed by the delivery path; the Session itself stays alive.
-        if (sessions !== null && sessions.inFlight !== null) {
-            store.saveTaskRoleSessionSet(clearTaskRoleRun(sessions, {
-                agentId: input.agentId,
-                runId: input.runId,
-                receiptId: agentRunDeliveryReceiptId(run)
-            }, now));
-        }
+        // The in-flight fence and Provider Conversation stay bound while the
+        // retry waits. resolveDueProviderRetries advances only the delivery
+        // receipt immediately before the exact redispatch.
         // Settle the delivery claim so the retry push can re-claim the mailbox.
         const target = runtimeLifecycleTarget({
             scope: "task",
@@ -2387,7 +2504,61 @@ export class FileSchedulerStoreAdapter {
                     || !providerRetryIsDue(run.providerRetry, now)) {
                     return;
                 }
-                const sessions = store.getTaskRoleSessionSet(entry.taskId, entry.roleName);
+                let sessions = store.getTaskRoleSessionSet(entry.taskId, entry.roleName);
+                const providerBinding = sessions?.providerBinding;
+                let recoveryMode = "resume";
+                if (providerBinding === null || providerBinding === undefined) {
+                    deferUnprovenProviderRecovery(store, run, entry.roleName, "Provider Conversation identity is missing; automatic recovery is fenced.", now);
+                    return;
+                }
+                const conversation = currentProviderConversation(providerBinding);
+                const roleMailbox = store.getWorkMailbox({
+                    kind: "role",
+                    taskId: entry.taskId,
+                    roleName: entry.roleName
+                });
+                const activeTurnId = providerBinding.turn !== null
+                    && ["accepted", "running"].includes(providerBinding.turn.status)
+                    ? providerBinding.turn.turnId
+                    : undefined;
+                const recovery = decideProviderRecovery({
+                    binding: providerBinding,
+                    probe: {
+                        state: conversation.recoverability === "recoverable"
+                            ? "exists"
+                            : conversation.recoverability === "unrecoverable" ? "missing" : "unknown",
+                        conversationId: conversation.conversationId,
+                        ...(activeTurnId === undefined ? {} : { activeTurnId })
+                    },
+                    unsettledInputDelivery: roleMailbox?.inputDelivery != null
+                });
+                if (recovery.action === "attention") {
+                    deferUnprovenProviderRecovery(store, run, entry.roleName, recovery.reason, now);
+                    return;
+                }
+                if (recovery.action === "observe-active-turn") {
+                    const deferred = deferProviderRetry(run.providerRetry, now);
+                    if (deferred === null) {
+                        finalizeProviderRetryDeadline(store, run, `Provider Turn ${recovery.turnId} remained active through the bounded recovery deadline.`, "provider-progress-timeout", now);
+                    }
+                    else {
+                        store.saveAgentRun(withProviderRetry(run, deferred));
+                    }
+                    return;
+                }
+                if (recovery.action === "replace") {
+                    if (conversation.recoverability !== "unrecoverable") {
+                        deferUnprovenProviderRecovery(store, run, entry.roleName, "Provider replacement lacks an exact missing-Conversation observation.", now);
+                        return;
+                    }
+                    recoveryMode = "new";
+                    const currentSession = sessions?.sessions[run.effective.agentId];
+                    if (sessions !== null && currentSession !== undefined
+                        && currentSession.status !== "broken") {
+                        sessions = updateRoleAgentSessionStatus(sessions, run.effective.agentId, "broken", now);
+                        store.saveTaskRoleSessionSet(sessions);
+                    }
+                }
                 const session = sessions?.sessions[run.effective.agentId];
                 const identityMatches = session !== undefined
                     && session.adapterId === run.effective.adapterId
@@ -2432,7 +2603,15 @@ export class FileSchedulerStoreAdapter {
                 // Reopen the Run on its original Session: reset transport markers,
                 // switch to resume, and mark the projection in-flight. The delivery
                 // pass re-pushes the exact same input in this same pass.
-                store.saveAgentRun(reopenRunForProviderRetry(run, `provider-retry-${run.providerRetry.episodeId}-${run.providerRetry.dispatchedRetries + 1}`, now));
+                const reopenedRun = reopenRunForProviderRetry(run, `provider-retry-${run.providerRetry.episodeId}-${run.providerRetry.dispatchedRetries + 1}`, now, recoveryMode);
+                store.saveAgentRun(reopenedRun);
+                if (sessions !== null && sessions.inFlight !== null) {
+                    store.saveTaskRoleSessionSet(prepareTaskRoleRunRedispatch(sessions, {
+                        agentId: run.effective.agentId,
+                        runId: run.id,
+                        receiptId: agentRunDeliveryReceiptId(reopenedRun)
+                    }, now));
+                }
                 // The retry decision settled the original delivery claim; re-queue the
                 // Role mailbox so the delivery pass can claim and re-push the Run.
                 enqueueWork(store, { kind: "role", taskId: entry.taskId, roleName: entry.roleName }, "provider-retry-repush", now, [{ type: "run", taskId: entry.taskId, id: run.id }]);
@@ -2451,7 +2630,7 @@ export class FileSchedulerStoreAdapter {
             const sessions = store.getTaskRoleSessionSet(taskId, input.fence.roleName);
             const run = store.getAgentRun(taskId, input.fence.runId);
             if (sessions === null || sessions.providerBinding === null || run === null
-                || run.id !== sessions.inFlight?.runId
+                || sessions.providerBinding.runId !== input.fence.runId
                 || input.fence.conversationId === undefined) {
                 recordCanonicalObservationObsolete(store, input, "provider-binding-missing", now);
                 return "obsolete";
@@ -2539,16 +2718,7 @@ export class FileSchedulerStoreAdapter {
                             status: "running",
                             effective: run.effective
                         }, now);
-                        const withProvider = bound.providerBinding !== null || bound.inFlight === null
-                            ? bound
-                            : bindTaskRoleProviderRuntime(bound, createProviderRuntimeBinding({
-                                providerNamespace: input.fence.driverId,
-                                accountScope: input.fence.agentId,
-                                runId: bound.inFlight.runId,
-                                conversationId: input.fence.conversationId ?? decision.outcome.nativeSessionId,
-                                activationId: input.fence.activationId ?? input.fence.launchId,
-                                startedAt: bound.inFlight.preparedAt
-                            }), now);
+                        const withProvider = bindOrSupersedeProviderRuntime(bound, input, now);
                         store.saveTaskRoleSessionSet(withProvider);
                         const driver = this.drivers.require(input.fence.driverId);
                         if (driver.capabilities.observation.sessionBootstrap === "discovered"
@@ -2563,17 +2733,9 @@ export class FileSchedulerStoreAdapter {
                     const current = store.getTaskRoleSessionSet(input.fence.taskId, input.fence.roleName);
                     const currentSession = current?.sessions[input.fence.agentId];
                     if (current !== null && current !== undefined
-                        && current.providerBinding === null
                         && current.inFlight !== null
                         && currentSession?.nativeSessionId === input.fence.nativeSessionId) {
-                        store.saveTaskRoleSessionSet(bindTaskRoleProviderRuntime(current, createProviderRuntimeBinding({
-                            providerNamespace: input.fence.driverId,
-                            accountScope: input.fence.agentId,
-                            runId: current.inFlight.runId,
-                            conversationId: input.fence.conversationId ?? input.fence.nativeSessionId,
-                            activationId: input.fence.activationId ?? input.fence.launchId,
-                            startedAt: current.inFlight.preparedAt
-                        }), now));
+                        store.saveTaskRoleSessionSet(bindOrSupersedeProviderRuntime(current, input, now));
                     }
                     return "applied";
                 }
@@ -2598,6 +2760,32 @@ export class FileSchedulerStoreAdapter {
                 && inputDelivery.executionRef.taskId === input.fence.taskId
                 && inputDelivery.executionRef.id === input.fence.runId
                 && inputDelivery.attemptId !== formatAgentRunReceiptId(input.fence.taskId, input.fence.runId);
+            const humanAttemptId = input.fence.receiptId;
+            if (humanAttemptId !== undefined && humanAttemptId.startsWith("human:")) {
+                const active = store.getActiveAgentRun(input.fence.taskId, input.fence.roleName);
+                const sessions = store.getTaskRoleSessionSet(input.fence.taskId, input.fence.roleName);
+                const session = sessions?.sessions[input.fence.agentId];
+                const binding = sessions?.providerBinding;
+                if (active === null || active.id !== input.fence.runId
+                    || sessions === null || sessions === undefined
+                    || binding === null || binding === undefined
+                    || binding.authority.owner !== "human"
+                    || !humanAttemptId.startsWith(`human:${binding.authority.holderId}:`)
+                    || binding.turn?.attemptId !== humanAttemptId
+                    || session?.launchId !== input.fence.launchId
+                    || session.nativeSessionId !== input.fence.nativeSessionId) {
+                    recordCanonicalObservationObsolete(store, input, "human-turn-fence-mismatch", now);
+                    return "obsolete";
+                }
+                store.saveTaskRoleSessionSet(recordStructuredProviderAcceptance(updateRoleAgentSessionStatus(sessions, input.fence.agentId, "running", now), input, now));
+                store.saveEvent(input.fence.taskId, createTaskEvent(store.nextEventId(input.fence.taskId), input.fence.taskId, "run.human-input-delivered", {
+                    attemptId: humanAttemptId,
+                    runId: active.id,
+                    authorityEpoch: String(binding.authority.epoch),
+                    nativeTurnId: input.fence.nativeTurnId
+                }, now));
+                return "applied";
+            }
             if (continuation) {
                 const active = store.getActiveAgentRun(input.fence.taskId, input.fence.roleName);
                 const sessions = store.getTaskRoleSessionSet(input.fence.taskId, input.fence.roleName);
@@ -2612,7 +2800,7 @@ export class FileSchedulerStoreAdapter {
                     recordCanonicalObservationObsolete(store, input, "continuation-fence-mismatch", now);
                     return "obsolete";
                 }
-                store.saveTaskRoleSessionSet(updateRoleAgentSessionStatus(sessions, input.fence.agentId, "running", now));
+                store.saveTaskRoleSessionSet(recordStructuredProviderAcceptance(updateRoleAgentSessionStatus(sessions, input.fence.agentId, "running", now), input, now));
                 const role = store.getRole(input.fence.taskId, input.fence.roleName);
                 if (role !== null && role.status !== "running") {
                     store.saveRole(input.fence.taskId, updateRoleStatus(role, "running", now));
@@ -2659,6 +2847,10 @@ export class FileSchedulerStoreAdapter {
                 recordCanonicalObservationObsolete(store, input, "role-missing", now);
                 return "obsolete";
             }
+            const sessions = store.getTaskRoleSessionSet(input.fence.taskId, input.fence.roleName);
+            if (sessions !== null) {
+                store.saveTaskRoleSessionSet(recordStructuredProviderAcceptance(sessions, input, now));
+            }
             const progressed = clearProviderRetryOnProgress(active);
             if (progressed !== active) {
                 store.saveAgentRun(progressed);
@@ -3648,6 +3840,133 @@ function compactedRuntimeObservationIds(events, incoming) {
     };
     return existing.filter(remove).map(({ event }) => event.id);
 }
+function recordStructuredProviderAcceptance(sessions, input, now) {
+    const current = sessions.providerBinding;
+    const attemptId = input.fence.receiptId;
+    const turnId = input.fence.nativeTurnId;
+    if (current === null || attemptId === undefined || turnId === undefined)
+        return sessions;
+    if (current.turn?.attemptId === attemptId
+        && current.turn.turnId === turnId
+        && ["accepted", "running", "completed", "failed", "cancelled"].includes(current.turn.status))
+        return sessions;
+    const binding = acceptProviderTurn(current, {
+        attemptId,
+        turnId,
+        acceptedAt: input.observedAt ?? input.receivedAt
+    });
+    return updateTaskRoleProviderRuntime(sessions, binding, now);
+}
+function bindOrSupersedeProviderRuntime(sessions, input, now) {
+    if (sessions.inFlight === null)
+        return sessions;
+    const conversationId = input.fence.conversationId ?? input.fence.nativeSessionId;
+    const activationId = input.fence.activationId ?? input.fence.launchId;
+    if (sessions.providerBinding === null) {
+        return bindTaskRoleProviderRuntime(sessions, createProviderRuntimeBinding({
+            providerNamespace: input.fence.driverId,
+            accountScope: input.fence.agentId,
+            runId: sessions.inFlight.runId,
+            conversationId,
+            activationId,
+            startedAt: sessions.inFlight.preparedAt
+        }), now);
+    }
+    const current = currentProviderConversation(sessions.providerBinding);
+    if (current.conversationId === conversationId) {
+        const active = currentProviderActivation(sessions.providerBinding);
+        if (active?.activationId === activationId)
+            return sessions;
+        if (active !== null) {
+            throw new Error("Provider Conversation cannot start a second Activation while the current one is active.");
+        }
+        return updateTaskRoleProviderRuntime(sessions, startProviderActivation(sessions.providerBinding, {
+            activationId,
+            startedAt: input.observedAt ?? input.receivedAt
+        }), now);
+    }
+    const turn = sessions.providerBinding.turn;
+    const noUnsettledInputDelivery = turn === null
+        || ["completed", "failed", "cancelled", "rejected"].includes(turn.status);
+    return updateTaskRoleProviderRuntime(sessions, supersedeProviderConversation(sessions.providerBinding, {
+        conversationId,
+        activationId,
+        switchedAt: input.observedAt ?? input.receivedAt,
+        noUnsettledInputDelivery
+    }), now);
+}
+function rejectSubmittingProviderTurn(store, target, delivery, now, reason) {
+    if (target.kind !== "role"
+        || delivery.executionRef.type !== "run"
+        || delivery.executionRef.taskId !== target.taskId)
+        return;
+    const sessions = store.getTaskRoleSessionSet(target.taskId, target.roleName);
+    const binding = sessions?.providerBinding;
+    if (sessions === null || sessions === undefined
+        || binding === null || binding === undefined
+        || binding.runId !== delivery.executionRef.id
+        || binding.turn?.attemptId !== delivery.attemptId
+        || (binding.turn.status !== "submitting"
+            && binding.turn.status !== "delivery-unknown"))
+        return;
+    store.saveTaskRoleSessionSet(updateTaskRoleProviderRuntime(sessions, rejectProviderTurn(binding, {
+        attemptId: delivery.attemptId,
+        rejectedAt: now.toISOString(),
+        reason
+    }), now));
+}
+function deferUnprovenProviderRecovery(store, run, roleName, reason, now) {
+    if (run.providerRetry === undefined)
+        return;
+    const deferred = deferProviderRetry(run.providerRetry, now);
+    if (deferred === null) {
+        finalizeProviderRetryDeadline(store, run, reason, "native-resume-unproven", now);
+        return;
+    }
+    store.saveAgentRun(withProviderRetry(run, deferred));
+    store.saveEvent(run.taskId, createTaskEvent(store.nextEventId(run.taskId), run.taskId, "runtime.provider-recovery-attention", {
+        runId: run.id,
+        roleName,
+        reason,
+        nextAttemptAt: deferred.nextAttemptAt ?? ""
+    }, now));
+    enqueueWork(store, { kind: "operator" }, "provider-recovery-attention", now, [
+        { type: "task", id: run.taskId },
+        { type: "run", taskId: run.taskId, id: run.id }
+    ]);
+}
+function markSubmittingProviderTurnUnknown(store, target, delivery, now, reason) {
+    if (target.kind !== "role"
+        || delivery.executionRef.type !== "run"
+        || delivery.executionRef.taskId !== target.taskId)
+        return;
+    const sessions = store.getTaskRoleSessionSet(target.taskId, target.roleName);
+    const binding = sessions?.providerBinding;
+    if (sessions === null || sessions === undefined
+        || binding === null || binding === undefined
+        || binding.runId !== delivery.executionRef.id
+        || binding.turn?.attemptId !== delivery.attemptId
+        || binding.turn.status !== "submitting")
+        return;
+    store.saveTaskRoleSessionSet(updateTaskRoleProviderRuntime(sessions, markProviderTurnDeliveryUnknown(binding, {
+        attemptId: delivery.attemptId,
+        observedAt: now.toISOString(),
+        reason
+    }), now));
+}
+function settleStructuredProviderTurn(sessions, turnId, status, now) {
+    const binding = sessions.providerBinding;
+    if (binding === null || binding.turn === null || binding.turn.turnId !== turnId) {
+        return sessions;
+    }
+    if (["completed", "failed", "cancelled"].includes(binding.turn.status))
+        return sessions;
+    return updateTaskRoleProviderRuntime(sessions, settleProviderTurn(binding, {
+        turnId,
+        status,
+        settledAt: now.toISOString()
+    }), now);
+}
 function confirmedUsageActivityObservation(events, incoming) {
     const usage = incoming.payload.usage;
     if (incoming.kind !== "activity.observed" || usage === undefined)

package/dist/controller/resourceInventory.js

@@ -113,16 +113,17 @@ export function buildControllerResourceInventory(facts) {
             for (const process of paneProcesses)
                 claimed.add(process.pid);
             const role = findRole(homeFact.roles, pane);
-            const archived = role?.taskStatus === "archived";
+            const terminalIsolation = role?.taskStatus === "retired"
+                || role?.taskStatus === "archived";
             resources.push(processResource({
                 kind: "agent-session",
                 state: pane.dead ? "dead" : role === undefined ? "orphaned" : "running",
                 disposition: role === undefined
                     ? pane.dead ? "safe" : "review"
-                    : archived ? "safe" : "protected",
+                    : terminalIsolation ? "safe" : "protected",
                 reasonCode: role === undefined
                     ? pane.dead ? "dead-orphan-pane" : "orphan-pane"
-                    : archived ? "archived-task-pane" : "owned-role-pane",
+                    : terminalIsolation ? `${role.taskStatus}-task-pane` : "owned-role-pane",
                 yuiHome,
                 owner: role === undefined ? { kind: "none" } : roleOwner(role),
                 processes: paneProcesses,
@@ -359,7 +360,10 @@ function artifactResource(artifact, yuiHome, domain, homeId) {
         ...(domain === undefined ? {} : { domain })
     };
 }
-function domainDisposition(base, _reason, domain, target) {
+function domainDisposition(base, reason, domain, target) {
+    if (reason === "retired-task-pane" || reason === "archived-task-pane") {
+        return "safe";
+    }
     if (domain === undefined)
         return base;
     if (domain.disposition === "safe") {
@@ -377,7 +381,7 @@ function domainDisposition(base, _reason, domain, target) {
             // A tmux server with panes is protected until the pane resources have
             // been removed and a later bounded pass can revalidate the empty
             // server. This avoids killing a server while a target race is in flight.
-            if (base === "protected" && _reason === "owned-tmux-server")
+            if (base === "protected" && reason === "owned-tmux-server")
                 return "protected";
             // `report-only` is deliberately reserved for an unrecognized process;
             // the YUI_HOME environment alone is not a cleanup ownership proof.