@zq-silk/yui 0.8.3 → 0.8.6

package/dist/commands/taskCompletionGate.js

@@ -2,13 +2,16 @@ import { usageError } from "../errors/cliError.js";
 import { GitIntegrationService } from "../integration/gitIntegrationService.js";
 import { createIntegrationAttempt } from "../integration/integrationAttempt.js";
 import { NodeGitWorkspace } from "../repository/gitWorkspace.js";
+import { taskDeliveryPath } from "../task/task.js";
 import { publicationExternalKey } from "../task/publicationReference.js";
+import { isSemanticReviewRound } from "../review/reviewOutcomeClassifier.js";
 import { workspaceProjectEntry } from "../worktree/managedWorkspace.js";
 /**
  * Verify the one supported ancestry waiver before `task complete` mutates any
  * durable state. The explicit Publication must be the current verified merged
- * record, bind the exact reviewed physical Task head, and name an
- * ancestry-divergent commit with the exact same Git tree.
+ * record, bind the exact physical Task head (and, for integrated delivery, its
+ * completed final Review), and name an ancestry-divergent commit with the
+ * exact same Git tree.
  */
 export async function verifyTaskCompletionPublishedTree(taskId, publicationId, store, options = {}) {
     const task = store.getTask(taskId);
@@ -27,10 +30,11 @@ export async function verifyTaskCompletionPublishedTree(taskId, publicationId, s
         throw usageError(`Publication ${publication.id} must record exact local and remote commits.`);
     }
     const workspace = requireTaskWorkspace(store, task);
-    const latestReview = latestTaskFinalReview(store, task.id);
-    if (latestReview === undefined
-        || latestReview.status !== "completed"
-        || latestReview.taskCandidate === undefined) {
+    const integrated = taskDeliveryPath(task) === "integrated";
+    const latestReview = integrated ? latestTaskFinalReview(store, task.id) : undefined;
+    if (integrated && (latestReview === undefined
+        || !isSemanticReviewRound(latestReview, store)
+        || latestReview.taskCandidate === undefined)) {
         throw usageError(`Task ${task.id} requires a latest completed Task-final Review before accepting a published tree.`);
     }
     const git = options.git ?? new NodeGitWorkspace();
@@ -40,18 +44,21 @@ export async function verifyTaskCompletionPublishedTree(taskId, publicationId, s
         if (entry === undefined || entry.access !== "write") {
             throw usageError(`Task ${task.id} has no writable managed main workspace for Project ${taskBinding.projectId}.`);
         }
-        const reviewedCommit = latestReview.taskCandidate.projects.find(({ projectId }) => (projectId === taskBinding.projectId))?.commit;
-        if (reviewedCommit === undefined) {
-            throw usageError(`Task-final Review ${latestReview.id} omitted Project ${taskBinding.projectId}.`);
-        }
         const actualCommit = (await git.inspect(entry.path, "HEAD")).baseCommit;
-        if (actualCommit !== reviewedCommit) {
-            throw usageError(`Task-final Review ${latestReview.id} does not match Task head `
-                + `${taskBinding.projectId}@${actualCommit}.`);
+        if (latestReview !== undefined) {
+            const reviewedCommit = latestReview.taskCandidate.projects.find(({ projectId }) => (projectId === taskBinding.projectId))?.commit;
+            if (reviewedCommit === undefined) {
+                throw usageError(`Task-final Review ${latestReview.id} omitted Project ${taskBinding.projectId}.`);
+            }
+            if (actualCommit !== reviewedCommit) {
+                throw usageError(`Task-final Review ${latestReview.id} does not match Task head `
+                    + `${taskBinding.projectId}@${actualCommit}.`);
+            }
         }
         actualHeads.set(taskBinding.projectId, actualCommit);
     }
-    if (actualHeads.size !== latestReview.taskCandidate.projects.length) {
+    if (latestReview !== undefined
+        && actualHeads.size !== latestReview.taskCandidate.projects.length) {
         throw usageError(`Task-final Review ${latestReview.id} Project set does not match Task ${task.id}.`);
     }
     const entry = workspaceProjectEntry(workspace, publication.projectId);
@@ -94,7 +101,7 @@ export async function verifyTaskCompletionPublishedTree(taskId, publicationId, s
         taskId: task.id,
         projectId: publication.projectId,
         publicationId: publication.id,
-        reviewRoundId: latestReview.id,
+        ...(latestReview === undefined ? {} : { reviewRoundId: latestReview.id }),
         localCommit,
         remoteCommit,
         tree: localTree
@@ -115,13 +122,18 @@ export function assertTaskCompletionPublishedTreeProof(store, task, publicationI
         || publication.remoteCommit !== proof.remoteCommit) {
         throw usageError(`Publication evidence changed before Task completion: ${publication.id}.`);
     }
-    const latestReview = latestTaskFinalReview(store, task.id);
-    if (latestReview === undefined
-        || latestReview.id !== proof.reviewRoundId
-        || latestReview.status !== "completed"
-        || latestReview.taskCandidate === undefined
-        || !sameTaskCandidate(latestReview.taskCandidate, actualCandidate)) {
-        throw usageError(`Task-final Review evidence changed before published-tree completion: ${task.id}.`);
+    if (taskDeliveryPath(task) === "integrated") {
+        const latestReview = latestTaskFinalReview(store, task.id);
+        if (latestReview === undefined
+            || latestReview.id !== proof.reviewRoundId
+            || !isSemanticReviewRound(latestReview, store)
+            || latestReview.taskCandidate === undefined
+            || !sameTaskCandidate(latestReview.taskCandidate, actualCandidate)) {
+            throw usageError(`Task-final Review evidence changed before published-tree completion: ${task.id}.`);
+        }
+    }
+    else if (proof.reviewRoundId !== undefined) {
+        throw usageError(`Direct published-tree proof unexpectedly binds a final Review: ${task.id}.`);
     }
     const actualCommit = actualCandidate.projects.find(({ projectId }) => (projectId === proof.projectId))?.commit;
     if (actualCommit !== proof.localCommit) {
@@ -321,7 +333,7 @@ async function hasCompletedTaskFinalReviewForCurrentCandidate(store, task, works
         .filter((round) => (round.scope ?? "work-item") === "task")
         .sort((left, right) => left.id.localeCompare(right.id, undefined, { numeric: true }));
     const latest = rounds.at(-1);
-    if (latest === undefined || latest.status !== "completed")
+    if (latest === undefined || !isSemanticReviewRound(latest, store))
         return false;
     if (latest.taskCandidate === undefined)
         return false;
@@ -354,7 +366,7 @@ function latestCommittedIntegration(store, taskId, projectId) {
 function hasFrozenTaskBaseline(store, taskId, projectId, currentCommit) {
     return store.listReviewRounds(taskId)
         .some((round) => ((round.scope ?? "work-item") === "task"
-        && round.status === "completed"
+        && isSemanticReviewRound(round, store)
         && round.taskCandidate !== undefined
         && round.taskCandidate.projects.some((entry) => (entry.projectId === projectId && entry.commit === currentCommit))));
 }

package/dist/commands/taskContextCommand.js

@@ -4,6 +4,7 @@ import { formatTimestamp } from "../output/timePresentation.js";
 import { isRoleRunStalled, latestStallProgressAt } from "../scheduler/roleRunStall.js";
 import { buildTaskExecutionProjection } from "../scheduler/taskExecutionProjection.js";
 import { projectNextAction } from "../task/nextAction.js";
+import { taskDeliveryPath } from "../task/task.js";
 import { inspectTaskRoleSessionRecovery } from "./taskRoleRuntimeStatus.js";
 import { summarizeExecutionGroup } from "../execution/executionGroup.js";
 import { currentWorkItemExecutionGroup } from "../workItem/workItem.js";
@@ -51,6 +52,7 @@ export function runTaskContextCommand(args, store) {
         }
         return {
             task,
+            deliveryPath: taskDeliveryPath(task),
             execution,
             reviewConfig: reader.getReviewConfig(),
             brief: reader.getTaskBrief(task.id),
@@ -137,9 +139,12 @@ export function runTaskContextCommand(args, store) {
         ...(managedWorkspaces.length === 0
             ? ["  None."]
             : managedWorkspaces.map((workspace) => (`  ${managedWorkspaceLabel(workspace)}: ${workspace.root} (${workspace.entries.filter(({ access }) => access === "write").length} writable / ${workspace.entries.length} Projects)`))),
+        `Delivery: ${taskDeliveryPath(task)}`,
         `Completion evidence: ${task.requireIntegration
             ? "WorkItem, ChangeSet, and committed Integration required"
-            : "delivery integration not required"}`,
+            : task.projectBindings.length > 0
+                ? "clean committed Task main required"
+                : "no Project evidence required"}`,
         `Global review: ${reviewConfig === null
             ? "disabled"
             : `${reviewConfig.roleName} (${reviewConfig.trigger})`}`,

package/dist/commands/taskInputCommands.js

@@ -8,6 +8,8 @@ import { agentRunDeliveryReceiptId } from "../run/agentRun.js";
 import { enqueueWork } from "../coordination/workMailboxQueue.js";
 import { clearMatchingLeaderStallAttention, isRoleRunStalled, RUN_RECOVERED_EVENT } from "../scheduler/roleRunStall.js";
 import { terminalizeExactTaskRun } from "../lifecycle/exactRunTerminalization.js";
+import { hasRuntimeCleanupObligation, isRuntimeLaunchReservation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
+import { isLinuxProcessLive, listOwnedProcessTree } from "../runtime/sessionOwnerIdentity.js";
 import { resolveTaskRecordReference } from "../task/taskRecordReference.js";
 const LEADER_ROLE = "leader";
 export function runTaskInputCommand(args, store, options) {
@@ -270,16 +272,33 @@ export function isCurrentGlobalOperator(store, environment) {
     const role = store.getGlobalRole("operator");
     if (role === null)
         return false;
-    const sessions = store.getGlobalRoleSessionSet(role.name);
-    const session = activeLiveRoleAgentSession(sessions);
-    if (sessions === null || session === null || sessions.activeAgentId !== role.activeAgentId) {
-        return false;
-    }
     const agentId = exactIdentity(environment.YUI_AGENT_ID);
     const adapterId = exactIdentity(environment.YUI_ADAPTER_ID);
     const launchId = exactIdentity(environment.YUI_LAUNCH_ID);
     const nativeSessionId = exactIdentity(environment.YUI_NATIVE_SESSION_ID);
     const binding = role.agentBindings[role.activeAgentId];
+    if (agentId === undefined
+        || adapterId === undefined
+        || launchId === undefined
+        || binding === undefined
+        || binding.agentId !== agentId
+        || binding.adapterId !== adapterId)
+        return false;
+    const sessions = store.getGlobalRoleSessionSet(role.name);
+    const session = activeLiveRoleAgentSession(sessions);
+    if (sessions === null || session === null || sessions.activeAgentId !== role.activeAgentId) {
+        // Codex learns its native Session ID only after the first Turn. During
+        // that narrow bootstrap window, authenticate against the durable launch
+        // reservation and its strongly attributed live process owner instead.
+        return nativeSessionId === undefined
+            && binding.adapterId === "codex"
+            && currentProcessBelongsToReservedGlobalLaunch(store, {
+                roleName: role.name,
+                agentId,
+                adapterId,
+                launchId
+            });
+    }
     // A fresh Codex launch discovers its native Session asynchronously. Its
     // launch envelope therefore cannot carry YUI_NATIVE_SESSION_ID, but the
     // durable Session still binds that provider identity to the exact launch
@@ -292,11 +311,7 @@ export function isCurrentGlobalOperator(store, environment) {
             && session.adapterId === "codex"
             && session.launchId !== undefined
             && session.launchId === launchId));
-    return agentId !== undefined
-        && adapterId !== undefined
-        && launchId !== undefined
-        && binding !== undefined
-        && binding.agentId === session.agentId
+    return binding.agentId === session.agentId
         && binding.adapterId === session.adapterId
         && session.agentId === agentId
         && session.adapterId === adapterId
@@ -304,6 +319,29 @@ export function isCurrentGlobalOperator(store, environment) {
         && session.launchId === launchId
         && nativeSessionMatches;
 }
+function currentProcessBelongsToReservedGlobalLaunch(store, input) {
+    if (store.getSessionOwner === undefined || store.getWorkMailbox === undefined)
+        return false;
+    const mailbox = store.getWorkMailbox(runtimeLifecycleTarget({
+        scope: "global",
+        roleName: input.roleName
+    }));
+    if (!isRuntimeLaunchReservation(mailbox?.processing, input.launchId)
+        || hasRuntimeCleanupObligation(mailbox))
+        return false;
+    const owner = store.getSessionOwner(input.launchId);
+    if (owner === null
+        || owner.owner.scope !== "global"
+        || owner.owner.roleName !== input.roleName
+        || owner.agentId !== input.agentId
+        || owner.adapterId !== input.adapterId
+        || owner.launchId !== input.launchId
+        || owner.providerRoot.attribution !== "launch-env"
+        || !isLinuxProcessLive(owner.providerRoot.pid, owner.providerRoot.startIdentity)) {
+        return false;
+    }
+    return listOwnedProcessTree(owner.providerRoot.pid, owner.providerRoot.processGroupId).some(({ pid }) => pid === process.pid);
+}
 function inputAnswerer(environment) {
     const env = environment ?? {};
     if (env.YUI_SESSION_SCOPE === undefined && env.YUI_ROLE === undefined)

package/dist/commands/taskNextActionCommand.js

@@ -2,6 +2,8 @@ import { taskNotFound, usageError } from "../errors/cliError.js";
 import { projectNextAction } from "../task/nextAction.js";
 import { projectCompletionReadiness } from "../task/completionReadiness.js";
 import { extractReviewFindings, planRepairWave } from "../task/repairWave.js";
+import { taskDeliveryPath } from "../task/task.js";
+import { projectTaskOrchestration } from "../observability/orchestrationMetrics.js";
 /**
  * Issue 07 (Leader convergence): read-only `yui task next-action <task>`.
  * Folds the existing durable records into exactly one protocol-level next
@@ -55,7 +57,29 @@ export function runTaskNextActionCommand(args, store) {
                 throw taskNotFound(taskId);
             completionReadiness = projectCompletionReadiness(readinessFacts);
         }
-        return { action, repairWave, completionReadiness, knowledgeProposals };
+        const orchestration = projectTaskOrchestration({
+            task: reader.getTask(taskId),
+            runs: reader.listAgentRuns(taskId),
+            roleSessionSets: reader.listRoleSessionSets(taskId),
+            workItems: reader.listWorkItems(taskId),
+            changeSets: reader.listChangeSets(taskId),
+            reviewRounds: reader.listReviewRounds(taskId),
+            reviewFindings: reader.listReviewFindings(taskId),
+            integrations: reader.listIntegrationAttempts(taskId),
+            durableJobs: reader.listDurableJobs(taskId),
+            publications: reader.listPublicationReferences(taskId),
+            decisions: reader.listDecisions(taskId),
+            events: reader.listEvents(taskId),
+            managedWorkspaces: reader.listManagedWorkspaces(taskId)
+        });
+        return {
+            deliveryPath: taskDeliveryPath(facts.task),
+            action,
+            repairWave,
+            completionReadiness,
+            knowledgeProposals,
+            orchestration
+        };
     });
     if (asJson) {
         return {
@@ -66,7 +90,7 @@ export function runTaskNextActionCommand(args, store) {
     }
     return {
         kind: "output",
-        output: renderNextAction(data.action, data.repairWave, data.completionReadiness, data.knowledgeProposals),
+        output: renderNextAction(data.action, data.deliveryPath, data.repairWave, data.completionReadiness, data.knowledgeProposals, data.orchestration.advisories),
         data
     };
 }
@@ -84,9 +108,10 @@ function repairWaveFor(action, facts) {
         return null;
     return planRepairWave(round.id, findings);
 }
-function renderNextAction(action, repairWave, completionReadiness, knowledgeProposals) {
+function renderNextAction(action, deliveryPath, repairWave, completionReadiness, knowledgeProposals, orchestrationAdvisories) {
     const lines = [
         `Task: ${action.taskId}`,
+        `Delivery: ${deliveryPath}`,
         `Next action: ${action.kind}`,
         `Reason: ${action.reason}`,
         ...(action.refs.length === 0
@@ -131,6 +156,10 @@ function renderNextAction(action, repairWave, completionReadiness, knowledgeProp
             lines.push(`Completion readiness: ${completionReadiness.blockers.length} blocker(s)`, ...completionReadiness.blockers.map((blocker) => `  ${blocker.code} (${blocker.ref.kind} ${blocker.ref.id}): ${blocker.reason}`
                 + ` — fix: ${blocker.fix}`));
         }
+        if (completionReadiness.advisories.length > 0) {
+            lines.push(`Completion advisories (non-blocking): ${completionReadiness.advisories.length}`, ...completionReadiness.advisories.map((advisory) => `  ${advisory.code} (${advisory.ref.kind} ${advisory.ref.id}): ${advisory.reason}`
+                + ` — fix before archive: ${advisory.fix}`));
+        }
     }
     if (repairWave !== null) {
         lines.push(`Repair wave (${repairWave.openFindingCount} open finding(s), ${repairWave.groups.length} group(s)):`, ...repairWave.groups.map((group) => `  ${group.id}: findings ${group.findingIds.join(", ")}`
@@ -141,5 +170,9 @@ function renderNextAction(action, repairWave, completionReadiness, knowledgeProp
         lines.push(`Knowledge proposals (non-blocking): ${knowledgeProposals.length} pending`, ...knowledgeProposals.map((proposal) => `  ${proposal.projectId}/${proposal.proposalId}: ${proposal.title}`
             + ` — review: yui project knowledge proposals list ${proposal.projectId}`));
     }
+    if (orchestrationAdvisories.length > 0) {
+        lines.push(`Orchestration advisories (non-blocking): ${orchestrationAdvisories.length}`, ...orchestrationAdvisories.map((advisory) => `  ${advisory.code}: ${advisory.reason}`
+            + (advisory.refs.length === 0 ? "" : ` — refs ${advisory.refs.join(", ")}`)));
+    }
     return `${lines.join("\n")}\n`;
 }

package/dist/context/sessionBootstrapManifest.js

@@ -1,10 +1,79 @@
 import { createHash } from "node:crypto";
-import { chmodSync } from "node:fs";
+import { chmodSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { exactControlPlaneCommandPrefix, exactControlPlaneDigest, serializeExactDescriptor } from "../runtime/exactControlPlane.js";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
 import { SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION, SESSION_CONTEXT_PROTOCOL, sessionManifestCompatibilityDigest } from "./sessionProtocolIdentity.js";
 export { SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION, SESSION_CONTEXT_PROTOCOL, sessionManifestCompatibilityDigest } from "./sessionProtocolIdentity.js";
+/** Read back one immutable Session Manifest and verify its content digest. */
+export function readSessionBootstrapManifest(path) {
+    const source = resolve(path);
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(source, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`Session Manifest is unreadable: ${source}.`, { cause: error });
+    }
+    if (parsed === null || typeof parsed !== "object") {
+        throw new Error("Session Manifest is invalid.");
+    }
+    const record = parsed;
+    const claimedDigest = requireDigest(record.digest, "Session Manifest digest");
+    const { digest: _digest, ...body } = record;
+    if (digest(body) !== claimedDigest) {
+        throw new Error("Session Manifest digest does not match its immutable content.");
+    }
+    if (record.schemaVersion !== SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION
+        || record.protocol !== SESSION_CONTEXT_PROTOCOL
+        || record.owner === null
+        || typeof record.owner !== "object"
+        || (record.owner.scope !== "global"
+            && record.owner.scope !== "task")
+        || typeof record.effectiveRevision !== "number"
+        || !Number.isSafeInteger(record.effectiveRevision)
+        || record.effectiveRevision < 1
+        || (record.roleKind !== "operator"
+            && record.roleKind !== "global"
+            && record.roleKind !== "leader"
+            && record.roleKind !== "worker"
+            && record.roleKind !== "reviewer")
+        || record.controlPlane === null
+        || typeof record.controlPlane !== "object"
+        || !Array.isArray(record.skills)
+        || record.roleProfileRef === null
+        || typeof record.roleProfileRef !== "object"
+        || record.contextProtocol === null
+        || typeof record.contextProtocol !== "object") {
+        throw new Error("Session Manifest shape is invalid.");
+    }
+    const owner = record.owner;
+    if (owner.scope === "task" && typeof owner.taskId !== "string") {
+        throw new Error("Task Session Manifest owner is invalid.");
+    }
+    const control = record.controlPlane;
+    requireText(control.descriptorPath, "Session Manifest control descriptor path");
+    requireText(control.sessionCliPath, "Session Manifest CLI path");
+    requireDigest(control.digest, "Session Manifest control-plane digest");
+    for (const skill of record.skills) {
+        if (skill === null || typeof skill !== "object") {
+            throw new Error("Session Manifest Skill entry is invalid.");
+        }
+        const entry = skill;
+        requireText(entry.id, "Session Manifest Skill id");
+        requireText(entry.path, "Session Manifest Skill path");
+        requireDigest(entry.digest, "Session Manifest Skill digest");
+    }
+    const profile = record.roleProfileRef;
+    requireDigest(profile.digest, "Session Manifest Role Profile digest");
+    requireText(profile.path, "Session Manifest Role Profile path");
+    const protocol = record.contextProtocol;
+    requireText(protocol.loadCommand, "Session Manifest Context load command");
+    if (protocol.expandCommand !== undefined) {
+        requireText(protocol.expandCommand, "Session Manifest Context expand command");
+    }
+    return Object.freeze(parsed);
+}
 export function materializeSessionBootstrap(input) {
     const home = resolve(input.yuiHome);
     const controlDigest = exactControlPlaneDigest(input.controlPlane);
@@ -79,3 +148,15 @@ function digest(value) {
     const bytes = typeof value === "string" ? value : JSON.stringify(value);
     return createHash("sha256").update(bytes).digest("hex");
 }
+function requireDigest(value, label) {
+    if (typeof value !== "string" || !/^[a-f0-9]{64}$/u.test(value)) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return value;
+}
+function requireText(value, label) {
+    if (typeof value !== "string" || value.trim().length === 0 || value.includes("\0")) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return value.trim();
+}

package/dist/controller/clientRuntime.js

@@ -10,12 +10,9 @@ import { EPHEMERAL_DOMAIN_ENVIRONMENT_NAMES } from "./domainIdentity.js";
 import { YUI_VERSION, yuiVersionIdentity } from "../version.js";
 import { SessionOwnerReconciliation } from "./sessionOwnerReconciliation.js";
 import { WorkspaceCleanupBlockedError } from "../repository/taskWorkspacePreparer.js";
+import { CONTROLLER_SHUTDOWN_TIMEOUT_MS, LIFECYCLE_REQUEST_TIMEOUT_MS } from "../runtime/runtimeDeadlines.js";
 const STARTUP_TIMEOUT_MS = 5_000;
-// A lifecycle RPC may legitimately occupy the Controller for 30 seconds.
-// Restart must allow that request to drain before deciding shutdown is stuck.
-const SHUTDOWN_TIMEOUT_MS = 45_000;
 const POLL_INTERVAL_MS = 50;
-const LIFECYCLE_REQUEST_TIMEOUT_MS = 30_000;
 const ENVIRONMENT_REFRESH_TIMEOUT_MS = 500;
 const CONFIGURATION_REFRESH_TIMEOUT_MS = 500;
 const CONTROLLER_OPERATIONAL_ENVIRONMENT = [
@@ -168,7 +165,7 @@ function spawnDetachedFileTaskController(home, environment) {
 /** Stops the per-home Controller and waits until its owned discovery is gone. */
 export async function stopFileTaskController(home, options = {}) {
     const call = options.call ?? callController;
-    const shutdownTimeoutMs = positive(options.shutdownTimeoutMs, SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
+    const shutdownTimeoutMs = positive(options.shutdownTimeoutMs, CONTROLLER_SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
     const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
     const expectedPid = options.expectedPid === undefined
         ? undefined
@@ -224,7 +221,7 @@ export async function stopFileTaskController(home, options = {}) {
 /** Restarts only the per-home Controller process; managed tmux sessions remain untouched. */
 export async function restartFileTaskController(home, options = {}) {
     const call = options.call ?? callController;
-    const shutdownTimeoutMs = positive(options.shutdownTimeoutMs, SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
+    const shutdownTimeoutMs = positive(options.shutdownTimeoutMs, CONTROLLER_SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
     const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
     let current = null;
     let previousPid;
@@ -529,7 +526,10 @@ export class FileTaskWorkflowRuntime {
             && this.workspacePreparer !== undefined) {
             await this.workspacePreparer.prepareTaskWorkspace(taskId);
         }
-        await callFileTaskController(this.home, "scheduler.scan", {}, this.clientOptions);
+        await callFileTaskController(this.home, "scheduler.scan", {}, {
+            ...this.clientOptions,
+            requestTimeoutMs: LIFECYCLE_REQUEST_TIMEOUT_MS
+        });
     }
 }
 const MANAGED_RUNTIME_ENVIRONMENT = new Set(YUI_MANAGED_RUNTIME_ENVIRONMENT_NAMES);

package/dist/controller/controller.js

@@ -10,6 +10,7 @@ import { processOperatorInputNotifications } from "../scheduler/operatorInputNot
 import { startControllerServer } from "../core/controllerServer.js";
 import { monotonicMilliseconds } from "../core/controllerTelemetry.js";
 import { isProjectMaintenanceFenced } from "../repository/projectMaintenanceLock.js";
+import { isHandoverLockHeld } from "../release/runtimeRelease.js";
 import { KeyedWorkQueue } from "../coordination/keyedWorkQueue.js";
 import { MailboxScheduler } from "../coordination/mailboxScheduler.js";
 import { nearestDeadlineBatch } from "../coordination/deadlineScheduler.js";
@@ -45,7 +46,7 @@ const ZERO_DRAIN_METRICS = Object.freeze({
  * Runs one lean scheduler pass. Due native Turn completions are folded before
  * liveness, so a valid Hook boundary fences destructive process reconciliation.
  */
-export async function runControllerSchedulerPass(store, delivery, now, workspacePreparer, scope = { kind: "full" }, includeOperator = true, runtimeCleanupOutcomes = [], lifecycleHost, stallWindowMs = DEFAULT_STALL_WINDOW_MS, maintenanceFence, onMaintenanceFenceDefer, blockedTaskIds = new Set(), inputDeliveryRecoveryCutoff, diagnosticAfterMs = DEFAULT_WORKFLOW_STALL_CANDIDATE_AGE_MS) {
+export async function runControllerSchedulerPass(store, delivery, now, workspacePreparer, scope = { kind: "full" }, includeOperator = true, runtimeCleanupOutcomes = [], lifecycleHost, stallWindowMs = DEFAULT_STALL_WINDOW_MS, maintenanceFence, onMaintenanceFenceDefer, blockedTaskIds = new Set(), inputDeliveryRecoveryCutoff, diagnosticAfterMs = DEFAULT_WORKFLOW_STALL_CANDIDATE_AGE_MS, leaderWakeFence) {
     const compiledSelection = compileReconcileSelection(scope);
     const selection = includeOperator
         ? { ...compiledSelection, blockedTaskIds }
@@ -58,7 +59,9 @@ export async function runControllerSchedulerPass(store, delivery, now, workspace
     await controlEventLoopTurn();
     const failedCleanupRoles = await processSelectedRoleRuntimeCleanups(store, delivery, lifecycleHost, scope, now, runtimeCleanupOutcomes, blockedTaskIds);
     const roleSelection = selectionWithoutFailedCleanupRoles(store, selection, failedCleanupRoles);
-    const wakeupSelection = selectionWithoutFailedLeaderCleanupTasks(store, selection, failedCleanupRoles);
+    const availableWakeupSelection = () => (leaderWakeFence?.() === true
+        ? exactTaskSelection(new Set())
+        : selectionWithoutFailedLeaderCleanupTasks(store, selection, failedCleanupRoles));
     if (selection.full)
         repairOrphanedActiveTasks(store, now, selection);
     const claimedTaskMailboxes = claimSelectedTaskMailboxes(store, selection, now);
@@ -66,7 +69,7 @@ export async function runControllerSchedulerPass(store, delivery, now, workspace
         // Durable Leader work that already has a ready Task workspace belongs to
         // the control path. Dispatch it before any unrelated Task workspace I/O;
         // the processor itself retains the fail-closed workspace-ready guard.
-        const initialWakeups = selectedPendingWakeups(store, wakeupSelection);
+        const initialWakeups = selectedPendingWakeups(store, availableWakeupSelection());
         const initialWakeupResults = await processLeaderWakeups(store, delivery, now, exactTaskSelection(new Set(initialWakeups.keys())));
         // Preserve ready-Leader-first ordering, then bound the repeated state
         // projections that follow it in this pass.
@@ -134,7 +137,8 @@ export async function runControllerSchedulerPass(store, delivery, now, workspace
             && workspacePreparation.ready.has(result.taskId)
             ? [result.taskId]
             : [])));
-        const laterWakeupTaskIds = new Set([...selectedPendingWakeups(store, wakeupSelection)].flatMap(([taskId, wakeup]) => {
+        const laterWakeupTaskIds = new Set([...selectedPendingWakeups(store, availableWakeupSelection())]
+            .flatMap(([taskId, wakeup]) => {
             const initial = initialWakeups.get(taskId);
             return initial === undefined
                 || !pendingWakeupsMatch(initial, wakeup)
@@ -823,6 +827,7 @@ export class FileTaskController {
     #onExpiredEphemeralDomain;
     #maintenanceFence;
     #onMaintenanceFenceDefer;
+    #leaderWakeFence;
     #jobSupervisor;
     #continuationReconciler;
     #current;
@@ -867,6 +872,7 @@ export class FileTaskController {
         this.#onExpiredEphemeralDomain = options.onExpiredEphemeralDomain;
         this.#maintenanceFence = options.maintenanceFence;
         this.#onMaintenanceFenceDefer = options.onMaintenanceFenceDefer;
+        this.#leaderWakeFence = options.leaderWakeFence;
         this.#jobSupervisor = options.jobSupervisor;
         this.#continuationReconciler = options.continuationReconciler;
         this.#signalScheduler = new MailboxScheduler(async (keys) => { await this.#requestPass({ kind: "dirty", keys }); }, {
@@ -1118,7 +1124,7 @@ export class FileTaskController {
                     // processes Leader wakeups.
                     this.#jobSupervisor?.reconcile(this.#now());
                     if (scope.kind === "full") {
-                        result = await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, scope, false, runtimeCleanupOutcomes, this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, runtimeFailedTaskIds, this.#startedAt, this.#diagnosticAfterMs);
+                        result = await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, scope, false, runtimeCleanupOutcomes, this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, runtimeFailedTaskIds, this.#startedAt, this.#diagnosticAfterMs, this.#leaderWakeFence);
                     }
                     else {
                         const dirtyPass = await this.#runDirtySchedulerPass(scope, runtimeCleanupOutcomes, runtimeFailedTaskIds);
@@ -1216,7 +1222,7 @@ export class FileTaskController {
         const taskScopes = partition.taskScopes.filter((taskScope) => (!blockedTaskIds.has(taskScope.taskId)));
         const orderedResults = [];
         if (partition.globalKeys.length > 0) {
-            orderedResults.push(await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, { kind: "dirty", keys: partition.globalKeys }, false, runtimeCleanupOutcomes, this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, blockedTaskIds, this.#startedAt, this.#diagnosticAfterMs));
+            orderedResults.push(await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, { kind: "dirty", keys: partition.globalKeys }, false, runtimeCleanupOutcomes, this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, blockedTaskIds, this.#startedAt, this.#diagnosticAfterMs, this.#leaderWakeFence));
         }
         if (taskScopes.length === 0
             || this.#stopped
@@ -1249,7 +1255,7 @@ export class FileTaskController {
                     if (this.#stopped || this.#pendingFull)
                         continue;
                     try {
-                        taskResults[selected.index] = await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, { kind: "dirty", keys: selected.taskScope.keys }, false, taskCleanupOutcomes[selected.index], this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, blockedTaskIds, this.#startedAt, this.#diagnosticAfterMs);
+                        taskResults[selected.index] = await runControllerSchedulerPass(this.store, this.delivery, this.#now(), this.#workspacePreparer, { kind: "dirty", keys: selected.taskScope.keys }, false, taskCleanupOutcomes[selected.index], this.#lifecycleHost, this.#stallWindowMs, this.#maintenanceFence, this.#onMaintenanceFenceDefer, blockedTaskIds, this.#startedAt, this.#diagnosticAfterMs, this.#leaderWakeFence);
                         this.#clearTaskPassRetry(selected.taskScope.taskId);
                     }
                     catch (error) {
@@ -1676,7 +1682,9 @@ export async function startFileTaskController(home, store, delivery, dispatcher,
     const runtime = new FileTaskController(store, delivery, {
         ...options,
         maintenanceFence: options.maintenanceFence
-            ?? ((projectId) => isProjectMaintenanceFenced(home, projectId))
+            ?? ((projectId) => isProjectMaintenanceFenced(home, projectId)),
+        leaderWakeFence: options.leaderWakeFence
+            ?? (() => isHandoverLockHeld(home))
     });
     let stopping = false;
     const lifecycleRequests = new Set();