@zq-silk/yui 2.16.0 → 2.18.0

package/dist/cli/commandCatalog.js

@@ -176,13 +176,15 @@ const roleChildren = [
     },
     { name: "list", discovery: { surface: "public", audiences: ["public", "operator", "leader", "assignment", "global"] }, summary: "List global Roles." },
     { name: "show", discovery: { surface: "public", audiences: ["public", "operator", "leader", "assignment", "global"] }, summary: "Show one global Role.", usage: "yui config role show <name>" },
+    { name: "enable", discovery: { surface: "public", audiences: ["public", "operator"] }, summary: "Enable new execution and template selection; does not start a Session.", usage: "yui config role enable <name>" },
+    { name: "disable", discovery: { surface: "public", audiences: ["public", "operator"] }, summary: "Disable new execution and template selection; keeps running Sessions and input.", usage: "yui config role disable <name>" },
     {
         name: "update", discovery: { surface: "public", audiences: ["public", "operator"] },
         summary: "Update a global Role.",
         usage: "yui config role update <name> [profile options] [clear options]",
-        options: ["--agent", "--workspace", ...roleProfileOptions, ...roleAgentOptions,
+        options: ["--enabled", "--agent", "--workspace", ...roleProfileOptions, ...roleAgentOptions,
             ...roleProfileClearOptions, ...roleAgentClearOptions, "--yes"],
-        optionValues: roleAgentOptionValues,
+        optionValues: { ...roleAgentOptionValues, "--enabled": ["true", "false"] },
         fileOptions: ["--workspace"]
     },
     { name: "remove", discovery: { surface: "public", audiences: ["public", "operator"] }, summary: "Remove a global Role.", usage: "yui config role remove <name>" },
@@ -238,17 +240,19 @@ const profileChildren = [
         name: "add", discovery: { surface: "public", audiences: ["public", "operator"] },
         summary: "Add a reusable Agent Profile that inherits Worker runtime or selects one explicit Agent.",
         usage: "yui config profile add <id> [--access <read|write>] [--inherit-worker | --agent <id> [--model <model>] [--effort <effort>]] [Profile settings]",
-        options: ["--access", ...agentProfileOptions],
-        optionValues: { "--access": ["read", "write"] }
+        options: ["--enabled", "--access", ...agentProfileOptions],
+        optionValues: { "--enabled": ["true", "false"], "--access": ["read", "write"] }
     },
     { name: "list", discovery: { surface: "public", audiences: ["public", "operator", "leader", "assignment", "global"] }, summary: "List Agent Profiles." },
     { name: "show", discovery: { surface: "public", audiences: ["public", "operator", "leader", "assignment", "global"] }, summary: "Show one Agent Profile.", usage: "yui config profile show <id>" },
+    { name: "enable", discovery: { surface: "public", audiences: ["public", "operator"] }, summary: "Enable new Profile applications; existing Task bindings are unchanged.", usage: "yui config profile enable <id>" },
+    { name: "disable", discovery: { surface: "public", audiences: ["public", "operator"] }, summary: "Disable new Profile applications without deleting configuration.", usage: "yui config profile disable <id>" },
     {
         name: "update", discovery: { surface: "public", audiences: ["public", "operator"] },
         summary: "Update an Agent Profile's behavior or runtime source.",
         usage: "yui config profile update <id> [--access <read|write>] [--inherit-worker | [--agent <id>] [--model <model>|--clear-model] [--effort <effort>|--clear-effort]] [Profile settings]",
-        options: ["--access", ...agentProfileOptions, ...agentProfileClearOptions],
-        optionValues: { "--access": ["read", "write"] }
+        options: ["--enabled", "--access", ...agentProfileOptions, ...agentProfileClearOptions],
+        optionValues: { "--enabled": ["true", "false"], "--access": ["read", "write"] }
     },
     { name: "remove", discovery: { surface: "public", audiences: ["public", "operator"] }, summary: "Remove a custom Agent Profile.", usage: "yui config profile remove <id>" },
     { name: "reset", discovery: { surface: "public", audiences: ["public", "operator"] }, summary: "Reset all built-in Agent Profiles." }
@@ -688,7 +692,7 @@ const taskChildren = [
         name: "role", discovery: { surface: "managed", audiences: ["operator", "leader"] },
         summary: "Manage Roles within a Task.",
         sections: [{ id: "manage", title: "Commands", entries: [
-                    "add", "list", "status", "show", "update", "remove", "bind", "unbind",
+                    "add", "list", "status", "show", "update", "enable", "disable", "remove", "bind", "unbind",
                     "capabilities", "session", "interrupt", "view", "takeover", "release"
                 ] }],
         children: [
@@ -707,6 +711,8 @@ const taskChildren = [
                 options: ["--cursor"]
             },
             { name: "show", discovery: { surface: "managed", audiences: ["operator", "leader"] }, summary: "Show one Task Role.", usage: "yui task role show <task> <role> [--cursor <cursor>]", options: ["--cursor"] },
+            { name: "enable", discovery: { surface: "managed", audiences: ["operator", "leader"] }, summary: "Enable this Task Role; does not change Task execution authority.", usage: "yui task role enable <task> <role>" },
+            { name: "disable", discovery: { surface: "managed", audiences: ["operator", "leader"] }, summary: "Block new execution of this Task Role without stopping its current Run.", usage: "yui task role disable <task> <role>" },
             { name: "capabilities", discovery: { surface: "managed", audiences: ["operator", "leader"] }, summary: "Read native options using this Role's desired or exact failed launch configuration.",
                 usage: "yui task role capabilities <task> <role> [--error <event-id>] [--refresh]",
                 options: ["--error", "--refresh"] },
@@ -714,9 +720,9 @@ const taskChildren = [
                 name: "update", discovery: { surface: "managed", audiences: ["operator", "leader"] },
                 summary: "Update a Task Role; Agent settings target the named or active binding without switching it.",
                 usage: "yui task role update <task> <role> [--profile <id>] [--agent <id>] [--environment <preparation-id> | --managed-environment] [Role and Agent settings]",
-                options: ["--profile", "--agent", "--environment", "--managed-environment", ...roleProfileOptions, ...roleAgentOptions,
+                options: ["--enabled", "--profile", "--agent", "--environment", "--managed-environment", ...roleProfileOptions, ...roleAgentOptions,
                     ...roleProfileClearOptions, ...roleAgentClearOptions, "--yes"],
-                optionValues: roleAgentOptionValues
+                optionValues: { ...roleAgentOptionValues, "--enabled": ["true", "false"] }
             },
             { name: "remove", discovery: { surface: "managed", audiences: ["operator", "leader"] }, summary: "Remove a Task Role.", usage: "yui task role remove <task> <role>" },
             { name: "bind", discovery: { surface: "managed", audiences: ["operator", "leader"] }, summary: "Bind and activate an Agent for a Task Role.", usage: "yui task role bind <task> <role> <agent-id>" },
@@ -1394,7 +1400,7 @@ export const ROOT_COMMAND = buildNode({
                     examples: ["yui config profile list", "yui config profile show implementer"],
                     sections: [
                         { id: "inspect", title: "Inspect", entries: ["list", "show"] },
-                        { id: "manage", title: "Manage", entries: ["add", "update", "remove", "reset"] }
+                        { id: "manage", title: "Manage", entries: ["add", "update", "enable", "disable", "remove", "reset"] }
                     ],
                     children: profileChildren
                 },
@@ -1404,7 +1410,7 @@ export const ROOT_COMMAND = buildNode({
                     examples: ["yui config role list", "yui config role show operator"],
                     sections: [
                         { id: "inspect", title: "Inspect", entries: ["list", "show"] },
-                        { id: "manage", title: "Manage", entries: ["add", "update", "remove", "bind", "unbind"] }
+                        { id: "manage", title: "Manage", entries: ["add", "update", "enable", "disable", "remove", "bind", "unbind"] }
                     ],
                     children: roleChildren
                 },
@@ -1690,7 +1696,8 @@ export const ROOT_COMMAND = buildNode({
                                 : name === "run-delegation" ? "Read the exact execution Task/WorkItem and attention projection; never a grant."
                                     : `${name} a stable Job or exact Run.`,
                     usage: `yui job ${name} (--task <id>|--global)${name === "list" ? "" : " --job <id>"}`
-                        + (name === "define" || name === "update" ? " --title <text> --input <configuration-json>" : "")
+                        + (name === "define" ? " --title <text> (--input <json>|--input-file <file>|--command <shell>) [--script <path=local-file> ...]" : "")
+                        + (name === "update" ? " [--title <text>] [--input <json>|--input-file <file>|--command <shell>] [--script <path=local-file> ...]" : "")
                         + (name === "update" ? " --revision <current>" : "")
                         + (name === "run" ? " --request-id <key> [--retry-of <run-id>]" : "")
                         + (["run-get", "run-result", "run-evidence", "run-confirm", "run-delegation", "logs", "run-cancel", "run-acknowledge"].includes(name) ? " --run <run-id>" : "")

package/dist/cli/interactionCandidates.js

@@ -21,9 +21,22 @@ export async function getSelectionCandidates(selector, ports, args) {
             return { ...set, defaultValue };
         }
         case "agent-profiles":
-            return entities("Agent Profile", "Select Agent Profile", await list(ports, "profile.list", {}), ["id", "revision", "defaultAccess", "agentId"]);
-        case "global-roles":
-            return entities("global role", "Select global Role", await list(ports, "role.list", {}), ["name", "activeAgentId", "workspace"]);
+            return entities("Agent Profile", "Select Agent Profile", (await list(ports, "profile.list", {}))
+                .filter(p => selector.actionTarget || p.enabled !== false
+                && p.effectiveRuntime?.status !== "unavailable")
+                .map(p => ({ ...p, availability: p.enabled === false ? "disabled" : "enabled" })), ["id", "availability", "revision", "defaultAccess", "agentId"]);
+        case "global-roles": {
+            let roles = await list(ports, "role.list", {});
+            // Review uses a Task-local binding first; a disabled same-named template
+            // must not hide an independently enabled existing Reviewer (or vice versa).
+            if (args[0] === "task" && args[1] === "review" && args[2] === "request" && args[3] !== undefined) {
+                const local = await list(ports, "task.role.list", { taskId: args[3] });
+                roles = [...roles.filter(r => !local.some(t => t.name === r.name)), ...local];
+            }
+            return entities("global role", "Select global Role", roles
+                .filter(r => selector.actionTarget && !(args[0] === "session" && args[1] === "enter") || r.enabled !== false)
+                .map(r => ({ ...r, availability: r.enabled === false ? "disabled" : "enabled" })), ["name", "availability", "activeAgentId", "workspace"]);
+        }
         case "jobs":
             return entities("job", "Select job", await list(ports, "jobs.list", {}), ["id", "type", "status"]);
         case "input-requests": {
@@ -41,9 +54,11 @@ export async function getSelectionCandidates(selector, ports, args) {
             const taskId = dependencyValue(selector, args);
             if (taskId === undefined)
                 return null;
-            const roles = orderRoleOptions(await list(ports, "task.role.list", { taskId }));
+            const roles = orderRoleOptions((await list(ports, "task.role.list", { taskId }))
+                .filter(r => selector.actionTarget || r.enabled !== false))
+                .map(r => ({ ...r, availability: r.enabled === false ? "disabled" : "enabled" }));
             return entities("task role", `Select Task role: ${taskId}`, roles, [
-                "name", "kind", "activeAgentId"
+                "name", "availability", "kind", "activeAgentId"
             ]);
         }
         case "task-decisions": {

package/dist/cli/interactionPolicy.js

@@ -92,7 +92,7 @@ export const INTERACTION_POLICIES = Object.freeze([
             "--search": "value"
         }
     },
-    ...["show", "update", "remove", "enter", "context"].map((command) => ({
+    ...["show", "update", "remove", "enable", "disable", "enter", "context"].map((command) => ({
         commandPath: command === "enter" || command === "context"
             ? ["session", command]
             : ["config", "role", command],
@@ -129,12 +129,13 @@ export const INTERACTION_POLICIES = Object.freeze([
         commandPath: ["config", "profile", "add"],
         selectors: [],
         trailingOptions: {
+            "--enabled": "value",
             "--description": "value", "--instructions": "value",
             "--skill": "value", "--agent": "value", "--model": "value",
             "--effort": "value", "--access": "value", "--inherit-worker": "flag"
         }
     },
-    ...["show", "update", "remove"].map((command) => ({
+    ...["show", "update", "remove", "enable", "disable"].map((command) => ({
         commandPath: ["config", "profile", command],
         selectors: [{
                 argumentIndex: 3,
@@ -145,7 +146,7 @@ export const INTERACTION_POLICIES = Object.freeze([
         ...(command === "update"
             ? {
                 trailingOptions: {
-                    "--description": "option-like-value",
+                    "--enabled": "value", "--description": "option-like-value",
                     "--instructions": "option-like-value", "--skill": "value",
                     "--agent": "value", "--inherit-worker": "flag",
                     "--model": "option-like-value", "--effort": "option-like-value",
@@ -380,7 +381,7 @@ export const INTERACTION_POLICIES = Object.freeze([
         commandPath: ["task", "role", "list"],
         selectors: [{ argumentIndex: 3, entity: "task", provider: "tasks", actionTarget: true }]
     },
-    ...["show", "status", "update", "remove"].map((command) => ({
+    ...["show", "status", "update", "remove", "enable", "disable"].map((command) => ({
         commandPath: ["task", "role", command],
         selectors: [
             { argumentIndex: 3, entity: "task", provider: "tasks", actionTarget: true },

package/dist/cli/roleWizard.js

@@ -281,6 +281,7 @@ async function settingsSection(title, io, taskRole) {
 }
 async function updateRoleSettings(args, role, ports, io, taskRole) {
     const fields = [
+        { value: "enabled", cells: ["Enabled (not Session state)", role.enabled === false ? "false" : "true"] },
         profileChoice("description", "Description", role.description),
         profileChoice("responsibilities", "Responsibilities", role.responsibilities),
         profileChoice("constraints", "Constraints", role.constraints),
@@ -292,6 +293,11 @@ async function updateRoleSettings(args, role, ports, io, taskRole) {
     const field = await choose("Role settings", fields, [TEXT_COLUMN, { header: "Current", minWidth: 12, maxWidth: 52 }], io, undefined, "field");
     if (field === undefined)
         return { kind: "cancelled", args };
+    if (field === "enabled") {
+        const value = await choose("Allow new execution; running Sessions are not stopped", [{ value: "true", cells: ["Enabled"] }, { value: "false", cells: ["Disabled"] }], [TEXT_COLUMN], io, role.enabled === false ? "false" : "true", "enabled");
+        return value === undefined ? { kind: "cancelled", args }
+            : { kind: "resolved", args: [...args, "--enabled", value] };
+    }
     if (field === "active-agent") {
         const target = await selectActiveAgent(role, ports, io);
         if (target === undefined)
@@ -672,6 +678,7 @@ function asRole(value) {
     }));
     return {
         name,
+        enabled: input.enabled !== false,
         activeAgentId,
         agentBindings,
         ...(stringField(input, "workspace") === undefined ? {} : { workspace: stringField(input, "workspace") }),

package/dist/commands/controllerCommands.js

@@ -161,10 +161,9 @@ export function parseControllerRuntimeSnapshot(result, droppedEvents) {
     const drain = runtime.drain;
     const commands = runtime.commands;
     const routes = commands?.routes;
-    const dispatcher = commands?.dispatcher;
     const eventLoopDelay = commands?.eventLoopDelay;
-    const queueDepth = (typeof routes?.inFlight === "number" ? routes.inFlight : 0)
-        + (typeof dispatcher?.inFlight === "number" ? dispatcher.inFlight : 0);
+    // Dispatcher work is a subset of authenticated routes, not another queue.
+    const queueDepth = typeof routes?.inFlight === "number" ? routes.inFlight : undefined;
     return {
         source: "controller.status",
         pid: typeof record.pid === "number" ? record.pid : undefined,
@@ -182,6 +181,16 @@ export function parseControllerRuntimeSnapshot(result, droppedEvents) {
             ? drain.progressEventsCoalesced
             : undefined,
         droppedEvents,
+        observations: {
+            commands: (runtime.commands ?? null),
+            phases: (runtime.phases ?? null),
+            reads: (runtime.reads ?? null),
+            persistence: (runtime.persistence ?? null),
+            diagnostics: (runtime.diagnostics ?? null),
+            scheduler: (runtime.scheduler ?? null),
+            preRoutingWait: "unmeasured; event-loop lag is sampled, not per-request queue time",
+            clock: "process-monotonic milliseconds; target/request labels are sha256 prefixes"
+        },
         queueDepth,
         oldestInFlightAgeMs: typeof routes?.oldestInFlightAgeMs === "number"
             ? routes.oldestInFlightAgeMs
@@ -210,7 +219,7 @@ export function renderRuntimeIdentitySection(input) {
     }
     lines.push(`  Health          ${health.status === "ok" ? "ok" : health.status === "degraded" ? "DEGRADED (needs-repair above)" : "FAIL (contradictions above)"}`, `  Controller      ${runtime.source === "controller.status" && runtime.pid !== undefined
         ? `PID ${runtime.pid}${runtime.uptimeMs === undefined ? "" : `, up ${formatDuration(runtime.uptimeMs)}`}${runtime.protocolVersion === undefined ? "" : `, protocol ${runtime.protocolVersion}`}`
-        : "not running (unsupported)"}`, `  Controller RSS  ${runtime.rssBytes !== undefined ? formatBytes(runtime.rssBytes) : UNSUPPORTED} (inventory ${formatBytes(inventoryRssBytes)})`, `  Command queue   depth ${runtime.queueDepth ?? UNSUPPORTED} · oldest ${runtime.oldestInFlightAgeMs === undefined
+        : "not running (unsupported)"}`, `  Controller RSS  ${runtime.rssBytes !== undefined ? formatBytes(runtime.rssBytes) : UNSUPPORTED} (inventory ${formatBytes(inventoryRssBytes)})`, `  Commands        in flight ${runtime.queueDepth ?? UNSUPPORTED} · oldest ${runtime.oldestInFlightAgeMs === undefined
         ? UNSUPPORTED
         : runtime.oldestInFlightAgeMs === null
             ? "—"

package/dist/commands/durableJobCommands.js

@@ -4,6 +4,7 @@ import { callFileTaskController } from "../controller/clientRuntime.js";
 import { acknowledgeDurableJob, cancelDurableJob, getDurableJob, startDurableJob } from "../controller/jobClient.js";
 import { resolveJobCaller, taskLocalActor } from "../task/taskAuthority.js";
 import { boundedJobArtifactPayload } from "../artifacts/jobArtifactTransport.js";
+import { readFileSync, statSync } from "node:fs";
 /**
  * The textual `--owner` forms accepted by `job start`. The public help text in
  * the command catalog must document exactly these forms.
@@ -38,9 +39,25 @@ export async function runDurableJobCommand(args, options) {
 }
 async function definitionCommand(command, args, options) {
     const flags = new Map();
+    const scripts = [];
+    const readText = (path) => {
+        if (!statSync(path).isFile() || statSync(path).size > 512 * 1024)
+            throw usageError("Job input files must be text files up to 512 KiB.");
+        return readFileSync(path, "utf8");
+    };
     for (let i = 0; i < args.length; i++) {
         const flag = args[i];
-        if (!["--global", "--task", "--job", "--title", "--input", "--revision", "--request-id", "--retry-of", "--run", "--artifact", "--reference", "--offset", "--result", "--expected-session", "--expected-attempt"].includes(flag)
+        if (flag === "--script") {
+            const value = args[++i] ?? "", separator = value.indexOf("=");
+            if (separator < 1 || separator === value.length - 1)
+                throw usageError("--script requires relative-path=local-file.");
+            const path = value.slice(0, separator);
+            if (scripts.some(file => file.path === path))
+                throw usageError("Repeated script path.");
+            scripts.push({ path, content: readText(value.slice(separator + 1)) });
+            continue;
+        }
+        if (!["--global", "--task", "--job", "--title", "--input", "--input-file", "--command", "--revision", "--request-id", "--retry-of", "--run", "--artifact", "--reference", "--offset", "--result", "--expected-session", "--expected-attempt"].includes(flag)
             || flags.has(flag))
             throw usageError(`Unknown or repeated Job flag: ${flag}.`);
         if (flag === "--global") {
@@ -61,14 +78,44 @@ async function definitionCommand(command, args, options) {
         ?? (executionRead ? options.environment?.YUI_TASK_ID : undefined) ?? "");
     const scope = taskId === undefined ? { kind: "global" } : { kind: "task", taskId };
     let configuration;
-    if (flags.has("--input")) {
+    if (flags.has("--input") && flags.has("--input-file"))
+        throw usageError("Choose --input or --input-file.");
+    if (flags.has("--input") || flags.has("--input-file")) {
         try {
-            configuration = JSON.parse(flags.get("--input"));
+            configuration = JSON.parse(flags.has("--input-file") ? readText(flags.get("--input-file")) : flags.get("--input"));
         }
         catch {
             throw usageError("--input must be a JSON Job configuration.");
         }
     }
+    if ((flags.has("--command") || scripts.length || flags.has("--input-file")) && !["define", "update"].includes(command)) {
+        throw usageError("Command and script edits require job define or update.");
+    }
+    if (flags.has("--command") || scripts.length) {
+        if (taskId !== undefined || configuration !== undefined)
+            throw usageError("--command/--script are global Shell shortcuts; use --input for a complete configuration.");
+        let shell = { kind: "shell", env: {}, steps: [], files: [] };
+        if (command === "update") {
+            const existing = await callFileTaskController(options.home, "job.definition", {
+                op: "show", scope, caller, id: flags.get("--job")
+            }, { environment: options.environment });
+            if (existing.revision !== Number(flags.get("--revision")))
+                throw usageError("Job revision changed; inspect before editing.");
+            if (existing.configuration.kind !== "shell")
+                throw usageError("Changing executor requires a new Job.");
+            shell = existing.configuration;
+            if (!flags.has("--title"))
+                flags.set("--title", existing.title);
+        }
+        if (flags.has("--command")) {
+            if (shell.steps.length > 1)
+                throw usageError("Use --input-file to edit a multi-step Job without discarding steps.");
+            shell = { ...shell, steps: [{ ...shell.steps[0], name: shell.steps[0]?.name ?? "run", command: flags.get("--command") }] };
+            // The command shortcut intentionally selects shell execution, not stale argv.
+            delete shell.steps[0].argv;
+        }
+        configuration = { ...shell, files: [...shell.files.filter(file => !scripts.some(next => next.path === file.path)), ...scripts] };
+    }
     const requestId = flags.get("--request-id");
     const parseObject = (flag) => {
         if (!flags.has(flag))

package/dist/commands/globalRoleCommands.js

@@ -2,7 +2,8 @@ import { roleNotFound, usageError } from "../errors/cliError.js";
 import { hasManagedIdentity } from "../runtime/managedIdentity.js";
 import { requireManagedGlobalCaller } from "../runtime/managedCaller.js";
 import { boundedDocument, recordPage, readOptions, readDigest, messageReceipt, summaryText, summaryMetadata } from "../output/boundedRead.js";
-import { controlProviderRetry, providerRetryProjection, providerRetrySummary, renderProviderRetry } from "../runtime/providerRetry.js";
+import { controlProviderRetry, providerRetryProjection, renderProviderRetry } from "../runtime/providerRetry.js";
+import { globalSessionHealth } from "../runtime/globalSessionHealth.js";
 import { pendingGlobalInboxMessages, inboxHandlingState, globalInboxDeliveryState } from "../message/inboxReceipt.js";
 import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 import { globalInputBacklog } from "../message/globalInputBacklog.js";
@@ -10,6 +11,7 @@ import { inboxEntryCategory } from "../message/inboxTurn.js";
 import { checkCurrentSkills, SKILL_REUSE_RULE } from "../context/currentSkills.js";
 import { runtimeDiagnosticGroups, runtimeDiagnosticEvidence } from "../controller/globalRuntimeAttention.js";
 import { roleSkillIds } from "../context/roleSessionContext.js";
+import { isEnabled } from "../role/availability.js";
 import { createRoleSessionSet, recordRoleAgentSession } from "../executor/agentExecutor.js";
 import { resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
 import { managedGlobalRoleWorkspace } from "../storage/homeLayout.js";
@@ -96,6 +98,12 @@ export function runGlobalRoleCommand(args, store, options = {}) {
         case "show": return showRole(rest, store);
         case "context": return roleContext(rest, store, options);
         case "update": return updateRole(rest, store, options);
+        case "enable":
+        case "disable": {
+            if (rest.length !== 1)
+                throw usageError(`Usage: yui config role ${command} <role>`);
+            return updateRole([rest[0], "--enabled", String(command === "enable")], store, options);
+        }
         case "remove": return removeRole(rest, store);
         case "bind": return bindRole(rest, store);
         case "unbind": return unbindRole(rest, store);
@@ -127,6 +135,7 @@ function roleContext(args, store, options) {
     const effective = resolveEffectiveLaunch({ role, purpose: "execution" });
     const sessions = store.getGlobalRoleSessionSet(name);
     const session = sessions?.sessions[role.activeAgentId];
+    const health = globalSessionHealth(role, sessions);
     const currentSkills = checkCurrentSkills(options.yuiHome ?? environment.YUI_HOME, roleSkillIds(session?.effective.context ?? role, role.name === "operator" ? "operator" : "global"));
     // Native delivery and explicit Agent handling settle the same queued input
     // through distinct receipts; a context read does neither.
@@ -157,7 +166,9 @@ function roleContext(args, store, options) {
             agentId: binding.agentId,
             adapterId: binding.adapterId,
             workspace: role.workspace,
-            effectiveRevision: role.launchRevision,
+            desiredRevision: health.desiredRevision,
+            effectiveRevision: health.effectiveRevision,
+            configurationDrift: health.configurationDrift,
             ...(session?.nativeSessionId === undefined
                 ? {}
                 : { nativeSessionId: session.nativeSessionId })
@@ -173,7 +184,7 @@ function roleContext(args, store, options) {
         authority: {
             view: role.name === "operator" ? "operator" : "global",
             taskImplementation: false,
-            writableProjectIds: effective.writeProjectIds,
+            writableProjectIds: (session?.effective ?? effective).writeProjectIds,
             allowedActions: role.name === "operator"
                 ? ["route-request", "inspect-catalog", "answer-user-boundary"]
                 : ["perform-global-role-request"]
@@ -189,17 +200,14 @@ function roleContext(args, store, options) {
             diagnostics: `role message list ${name} --diagnostics`,
             retry: `session retry ${name} show`
         },
-        nativeTurn: sessions?.providerBinding?.run == null ? null : {
-            attemptId: sessions.providerBinding.run.attemptId,
-            nativeTurnId: sessions.providerBinding.run.nativeTurnId,
-            status: sessions.providerBinding.run.status
-        },
+        nativeTurn: health.nativeTurn,
+        health,
         ...(role.jobOwner === undefined ? {} : { job: {
                 owner: role.jobOwner,
                 read: `yui job show ${role.jobOwner.scope.kind === "global" ? "--global" : `--task ${role.jobOwner.scope.taskId}`} --job ${role.jobOwner.jobId} --json`,
                 boundary: "Job execution only. This Role is not Operator and owns no Task delivery authority. Read the exact Run from its original message."
             } }),
-        retry: providerRetrySummary(sessions?.providerBinding),
+        retry: health.retry,
         // Historical interrupt receipts are available through Session inspection;
         // only this Turn's exact identity is required at entry.
         sessionManifestPath: environment.YUI_SESSION_MANIFEST,
@@ -292,7 +300,7 @@ function listRoles(args, store) {
     for (const name of SYSTEM_ROLE_NAMES) {
         const role = store.getGlobalRole(name);
         rows.set(name, role === null
-            ? [name, "system", "?", "?", "?", "?"]
+            ? [name, "system", "?", "?", "?", "?", "?"]
             : roleListRow(role, "system"));
     }
     for (const role of store.listGlobalRoles()) {
@@ -305,6 +313,7 @@ function listRoles(args, store) {
     return `${renderTable("Roles", [
         { header: "Role", minWidth: 4, maxWidth: 24 },
         { header: "Kind", minWidth: 6, maxWidth: 8 },
+        { header: "Enabled", minWidth: 7, maxWidth: 8 },
         { header: "Active Agent", minWidth: 8, maxWidth: 20 },
         { header: "Model", minWidth: 8, maxWidth: 22 },
         { header: "Effort", minWidth: 8, maxWidth: 14 },
@@ -344,6 +353,9 @@ function updateRole(args, store, options) {
     const workspace = trimmed(parsed.one("--workspace"));
     const next = store.transaction((tx) => {
         const role = requireRole(name, tx);
+        if (parsed.seen.size === 1 && parsed.has("--enabled")
+            && isEnabled(role) === roleProfilePatch(parsed).enabled)
+            return role;
         const changesLaunchContext = hasRoleLaunchContextOptions(parsed);
         const changesAgentConfig = hasAgentConfigOptions(parsed);
         if (changesLaunchContext || changesAgentConfig) {
@@ -499,7 +511,7 @@ function roleSession(args, store, options) {
             throw usageError("Usage: yui session retry <role> [show|cancel|disable|enable]");
         }
         return store.transaction(tx => {
-            requireRole(name, tx);
+            const role = requireRole(name, tx);
             const sessions = tx.getGlobalRoleSessionSet(name);
             let binding = sessions?.providerBinding ?? null;
             if (action !== "show") {
@@ -509,9 +521,14 @@ function roleSession(args, store, options) {
                 tx.saveGlobalRoleSessionSet({ ...sessions, providerBinding: binding });
                 settleGlobalRetryInput(tx, name, binding, new Date());
             }
+            const health = globalSessionHealth(role, sessions);
+            const historical = binding?.retry !== undefined && health.retry === null;
             return options.jsonOutput ? JSON.stringify({
-                roleName: name, retry: providerRetryProjection(binding), disabled: binding?.retryDisabled ?? false
-            }) + "\n" : renderProviderRetry(binding) + "\n";
+                roleName: name, retry: providerRetryProjection(binding), disabled: binding?.retryDisabled ?? false,
+                selectedNativeSessionId: health.nativeSessionId,
+                retryScope: historical ? "historical-session" : "current-session"
+            }) + "\n" : (historical ? "Historical Session evidence (not the selected Session's current failure): " : "")
+                + renderProviderRetry(binding) + "\n";
         });
     }
     if (command !== "record" && command !== "replace") {
@@ -971,7 +988,7 @@ function presentRole(title, role, store) {
 }
 function roleListRow(role, kind) {
     const summary = activeRoleSummary(role);
-    return [role.name, kind, summary.agent, summary.model, summary.effort, role.workspace];
+    return [role.name, kind, String(isEnabled(role)), summary.agent, summary.model, summary.effort, role.workspace];
 }
 function renderMissingSystemRole(name) {
     return [

package/dist/commands/inboxCommands.js

@@ -322,6 +322,7 @@ export function runInboxCommand(args, store, env, now = new Date()) {
                 if (message.inbox?.ack || message.delivery !== undefined || message.interruptThen !== undefined
                     || message.control !== undefined && message.control.outcome !== "rejected"
                     || turn?.attemptId === `global-input:${current.roleName}/${message.id}`
+                        && turn.status !== "rejected"
                     || !foreignTarget && message.notDelivered === undefined) {
                     throw new Error("Retirement requires obsolete, proven-unsubmitted input; unknown/accepted/interrupt-owned input must retain its exact handling path.");
                 }

package/dist/commands/operatorCommands.js

@@ -1,4 +1,6 @@
 import { agentAdapterLabel as adapterLabel } from "../agent/adapterCatalog.js";
+import { assertRoleEnabled } from "../role/availability.js";
+import { globalSessionHealth } from "../runtime/globalSessionHealth.js";
 import { usageError } from "../errors/cliError.js";
 import { createRoleSessionSet } from "../executor/agentExecutor.js";
 import { TASK_SUBMISSION_INTENTS } from "../message/message.js";
@@ -31,7 +33,11 @@ function status(args, store, options) {
     if (activeBinding === undefined) {
         throw usageError(`Operator active Agent is not bound: ${role.activeAgentId}.`);
     }
-    const projection = projectOperatorStatus(store.getGlobalRoleSessionSet(role.name), role.activeAgentId, activeBinding.adapterId);
+    const sessions = store.getGlobalRoleSessionSet(role.name);
+    const projection = {
+        ...projectOperatorStatus(sessions, role.activeAgentId, activeBinding.adapterId),
+        health: globalSessionHealth(role, sessions)
+    };
     const writer = projection.writer;
     const writerLines = [
         "Operator status",
@@ -41,7 +47,10 @@ function status(args, store, options) {
         `  Adapter: ${adapterLabel(writer.adapterId)}`,
         `  Conversation: ${writer.sessionRef ?? "-"}`,
         `  Native session: ${writer.nativeSessionId ?? "-"}`,
-        `  Session state: ${writer.sessionStatus ?? "-"}`
+        `  Session state: ${writer.sessionStatus ?? "-"}`,
+        `  Configuration: desired r${projection.health.desiredRevision}, effective r${projection.health.effectiveRevision ?? "unknown"}`,
+        `  Host observation: ${projection.health.hostObservation}`,
+        `  ${projection.health.note}`
     ];
     const history = projection.historicalConversations;
     const historyOutput = history.length === 0
@@ -222,6 +231,7 @@ function resumeSession(args, store) {
 export function applyOperatorSessionControl(control, store, now = new Date()) {
     return store.transaction((tx) => {
         const role = requireOperator(tx);
+        assertRoleEnabled(role);
         const binding = role.agentBindings[control.targetAgentId];
         if (binding === undefined) {
             throw usageError(`Operator Agent is not bound: ${control.targetAgentId}.`);

package/dist/commands/profileCommands.js

@@ -1,4 +1,5 @@
 import { usageError } from "../errors/cliError.js";
+import { isEnabled, parseEnabled } from "../role/availability.js";
 import { defaultTableWidth, renderTable } from "../output/table.js";
 import { BUILTIN_PROFILE_IDS, builtinAgentProfileInputs, createAgentProfile, updateAgentProfile } from "../profile/agentProfile.js";
 import { resolveAgentProfileRuntime, resolveAgentProfileView } from "../profile/agentProfileRuntime.js";
@@ -35,7 +36,7 @@ export function previewProfileAgentConfigurationMutation(args, store) {
     else {
         return undefined;
     }
-    const runtime = resolveAgentProfileRuntime(profile, store);
+    const runtime = resolveAgentProfileRuntime(profile, store, { configurationOnly: true });
     if (runtime.status === "unavailable")
         throw usageError(runtime.reason);
     return {
@@ -51,6 +52,11 @@ export function runProfileCommand(args, store, now = () => new Date(), options =
         case "list": return listProfiles(rest, store);
         case "show": return showProfile(rest, store);
         case "update": return updateProfile(rest, store, now(), options);
+        case "enable":
+        case "disable": {
+            const id = oneArg(rest, `Usage: yui config profile ${command} <id>`);
+            return updateProfile([id, "--enabled", String(command === "enable")], store, now(), options);
+        }
         case "remove": return removeProfile(rest, store);
         case "reset": return resetProfiles(rest, store, now());
         default:
@@ -68,6 +74,7 @@ function addProfile(args, store, now, options) {
     assertOptionPairs(parsed);
     const profile = createAgentProfile({
         id,
+        ...(parsed.has("--enabled") ? { enabled: parseEnabled(parsed.one("--enabled")) } : {}),
         defaultAccess: parseAccess(parsed.one("--access") ?? "read"),
         ...profileValues(parsed),
         runtime: addedRuntime(parsed, usage)
@@ -91,6 +98,7 @@ function listProfiles(args, store) {
         ? "No Agent Profiles found.\n"
         : `${renderTable("Agent Profiles", [
             { header: "Profile", minWidth: 7, maxWidth: 24 },
+            { header: "Enabled", minWidth: 7, maxWidth: 8 },
             { header: "Revision", minWidth: 8, maxWidth: 10 },
             { header: "Access", minWidth: 6, maxWidth: 8 },
             { header: "Runtime", minWidth: 9, maxWidth: 14 },
@@ -109,6 +117,7 @@ function showProfile(args, store) {
     return {
         output: `${[
             `Agent Profile: ${profile.id}`,
+            `Enabled: ${isEnabled(profile)}`,
             `Revision: ${profile.revision}`,
             `Default access: ${profile.defaultAccess}`,
             `Description: ${profile.description ?? "-"}`,
@@ -140,8 +149,14 @@ function updateProfile(args, store, now, options) {
         throw usageError("At least one Profile option is required.", usage);
     assertOptionPairs(parsed);
     const current = requireProfile(store, id);
+    if (parsed.seen.size === 1 && parsed.has("--enabled")
+        && isEnabled(current) === parseEnabled(parsed.one("--enabled"))) {
+        return { output: `Agent Profile ${id} is already ${isEnabled(current) ? "enabled" : "disabled"}\n`,
+            data: resolveAgentProfileView(current, store) };
+    }
     const runtime = updatedRuntime(current, parsed, usage);
     const updated = updateAgentProfile(current, {
+        ...(parsed.has("--enabled") ? { enabled: parseEnabled(parsed.one("--enabled")) } : {}),
         ...(parsed.has("--access") ? { defaultAccess: parseAccess(parsed.one("--access")) } : {}),
         ...profilePatch(parsed),
         ...(runtime === undefined ? {} : { runtime })
@@ -187,6 +202,7 @@ function resetProfiles(args, store, now) {
     };
 }
 const BASE_OPTIONS = [
+    ["--enabled", "value"],
     ["--access", "value"],
     ["--description", "value"],
     ["--instructions", "value"],
@@ -307,7 +323,7 @@ function assertRuntimeSourceOptions(parsed, usage) {
 function validateExplicitRuntime(profile, store, options) {
     if (profile.runtime.source !== "explicit")
         return;
-    const runtime = resolveAgentProfileRuntime(profile, store);
+    const runtime = resolveAgentProfileRuntime(profile, store, { configurationOnly: true });
     if (runtime.status === "unavailable")
         throw usageError(runtime.reason);
     options.validateAgentConfiguration?.({
@@ -320,6 +336,7 @@ function profileListRow(view) {
     const { profile, runtime } = view;
     return [
         profile.id,
+        String(isEnabled(profile)),
         String(profile.revision),
         profile.defaultAccess,
         runtime.source,