@zq-silk/yui 2.21.0 → 2.23.0

package/dist/controlPlaneCli.js

@@ -4,6 +4,7 @@ import { randomUUID } from "node:crypto";
 import { readFileSync, realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
+import { isatty } from "node:tty";
 import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 import { agentAdapterLabel as adapterLabel } from "./agent/adapterCatalog.js";
@@ -11,14 +12,14 @@ import { recordTaskInterruptResult } from "./message/taskInterrupt.js";
 import { nativeAgentEnvironmentNames } from "./agent/launchEnvironment.js";
 import { listArtifactsCapability, readArtifactCapability, saveArtifactCapability } from "./artifacts/artifactCapability.js";
 import { renderAgentConfigurationResolutionNotice } from "./cli/agentConfigurationPicker.js";
-import { describeCommandTree, findCommandNode } from "./cli/commandCatalog.js";
+import { describeCommandHelp, describeCommandTree, findCommandNode } from "./cli/commandCatalog.js";
 import { discoveryCommandTree } from "./cli/commandDiscovery.js";
 import { callerDiscoveryAudience } from "./cli/callerDiscovery.js";
 import { assertTaskReadable } from "./context/taskContext.js";
 import { renderCompletion } from "./cli/completion.js";
 import { runCompletionWizard } from "./cli/completionWizard.js";
 import { resolveCompletionCandidates } from "./cli/dynamicCompletion.js";
-import { renderCommandHelp } from "./cli/helpRenderer.js";
+import { renderCommandHelp, renderCommandPathHint } from "./cli/helpRenderer.js";
 import { allowsInteractiveSelection, resolveInteractiveArguments } from "./cli/interactiveSelection.js";
 import { routeInvocation } from "./cli/invocationRouter.js";
 import { operatorOfflineCommand, isTaskReadCommand } from "./cli/managedDiagnostics.js";
@@ -202,7 +203,7 @@ export async function main() {
         return;
     }
     if (args.length === 0) {
-        emit(renderCommandHelp(discovery, VERSION), false, jsonOutput ? describeCommandTree(discovery) : undefined);
+        emit(renderCommandHelp(discovery, VERSION), false, jsonOutput ? describeCommandHelp(discovery) : undefined);
         return;
     }
     if (args[0] === "version" && args.length === 1) {
@@ -211,11 +212,19 @@ export async function main() {
     }
     const invocation = routeInvocation(args, discovery);
     if (invocation.kind === "help") {
-        emit(renderCommandHelp(invocation.node, VERSION), true, jsonOutput ? describeCommandTree(invocation.node) : undefined);
+        if (invocation.recursive && !jsonOutput)
+            throw usageError("Recursive help requires --json.");
+        emit(renderCommandHelp(invocation.node, VERSION), true, jsonOutput
+            ? invocation.recursive ? describeCommandTree(invocation.node) : describeCommandHelp(invocation.node)
+            : undefined);
         return;
     }
     if (invocation.kind === "path-error") {
-        throw usageError(`Unknown command: ${invocation.typedPath}`, renderCommandHelp(invocation.helpNode, VERSION));
+        throw usageError(invocation.discoveryOnly
+            ? `Command not listed in the current caller's help view: ${invocation.typedPath}. `
+                + "Help is filtered discovery, not an execution or permission check. "
+                + "Follow current instructions and exact read links; execution still validates authority."
+            : `Unknown command: ${invocation.typedPath}`, renderCommandPathHint(invocation.helpNode));
     }
     if (invocation.kind === "incomplete") {
         throw usageError(`Command required after: ${invocation.typedPath}`, renderCommandHelp(invocation.helpNode, VERSION));
@@ -660,7 +669,6 @@ export async function main() {
     const tmux = new TmuxManager(resolveTmuxBin(store.getConfig().tmuxBin), executor, {
         yuiHome: home,
         historyLimit: resolveTmuxHistoryLimit(store.getConfig().tmuxHistoryLimit),
-        terminalInput: process.stdin,
         onWarning: (message) => writeCliWarning(message)
     });
     const telemetry = openSchedulerTelemetry(home, store.getConfig());
@@ -2750,7 +2758,9 @@ function completionShell(value) {
     throw usageError("Completion shell must be one of bash, zsh, fish.");
 }
 async function resolveTerminalArguments(commandArgs, node, store, catalogs) {
-    const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
+    // Probe the descriptor without constructing a stdin stream: Node makes
+    // pipes nonblocking on stream creation, breaking later --body-file - reads.
+    const interactive = isatty(0) && process.stdout.isTTY === true;
     if (!interactive || !allowsInteractiveSelection(commandArgs, jsonOutput)) {
         return [...commandArgs];
     }

package/dist/controller/agentRuntimeObserver.js

@@ -15,14 +15,45 @@ export class AgentRuntimeObserver {
     #states = new Map();
     #maxConcurrentSamples;
     #sequence = 0;
+    #samples = 0;
+    #sources = 0;
+    #published = 0;
+    #usagePublications = 0;
+    #failed = 0;
     constructor(store, inbox, drivers = builtinAgentDriverRegistry(), options = {}) {
         this.store = store;
         this.inbox = inbox;
         this.drivers = drivers;
         this.#maxConcurrentSamples = sampleConcurrency(options.maxConcurrentSamples);
     }
-    async sample(now = new Date()) {
-        const active = this.activeSources();
+    async sample(now = new Date(), phases) {
+        this.#samples++;
+        const finishDiscovery = phases?.start("runtime-sample-discovery", "home");
+        let active;
+        try {
+            active = this.activeSources();
+            finishDiscovery?.();
+        }
+        catch (error) {
+            finishDiscovery?.(true);
+            throw error;
+        }
+        this.#sources += active.length;
+        const publish = async (observation) => {
+            try {
+                const result = await (phases === undefined
+                    ? this.inbox.enqueueObservationAsync(observation)
+                    : phases.observe(observation.payload.usage === undefined ? "runtime-sample-publish" : "runtime-usage-publish", undefined, () => this.inbox.enqueueObservationAsync(observation)));
+                this.#published++;
+                if (observation.payload.usage !== undefined)
+                    this.#usagePublications++;
+                return result;
+            }
+            catch (error) {
+                this.#failed++;
+                throw error;
+            }
+        };
         const activeKeys = new Set(active.map(({ key }) => key));
         for (const key of this.#states.keys()) {
             if (!activeKeys.has(key))
@@ -37,7 +68,10 @@ export class AgentRuntimeObserver {
             // usage/activity baseline is durable. Rehydrate it after Controller
             // restart so rereading the bounded transcript tail cannot manufacture a
             // fresh activity edge from tokens that were already observed.
-            const state = existingState ?? { ...persistedState };
+            // Commit process-local state only when every fact from this sample is
+            // durable. A failed later publication must leave the old cursor usable;
+            // retry deduplicates any already-persisted prefix.
+            const state = { ...(existingState ?? persistedState) };
             const restoredUsageEventId = existingState === undefined
                 ? persistedState.usageEventId
                 : undefined;
@@ -63,7 +97,6 @@ export class AgentRuntimeObserver {
                     detail: error instanceof Error ? error.message : String(error)
                 });
             }
-            state.cursor = sample.cursor;
             const at = now.toISOString();
             // Reserve sequence numbers in source-key order before sampling. Provider
             // latency can change completion order without changing observation
@@ -101,7 +134,7 @@ export class AgentRuntimeObserver {
                     const identity = completeHistory
                         ? tokenObservationIdentity("baseline", fence, source.sourceId, baselineKey)
                         : usageObservationIdentity(fence, source.sourceId, latestOccurrence);
-                    this.inbox.enqueueObservation(createRuntimeObservation({
+                    await publish(createRuntimeObservation({
                         schemaVersion: 1,
                         eventId: identity.eventId,
                         semanticKey: identity.semanticKey,
@@ -136,7 +169,7 @@ export class AgentRuntimeObserver {
             }
             const health = JSON.stringify([sample.status, sample.detail ?? null]);
             if (state.health !== health) {
-                this.inbox.enqueueObservation(createRuntimeObservation({
+                await publish(createRuntimeObservation({
                     schemaVersion: 1,
                     eventId: observationId("health", fence, source.sourceId, health),
                     semanticKey: observationId("health", fence, source.sourceId, health),
@@ -180,9 +213,9 @@ export class AgentRuntimeObserver {
                         : Object.freeze({ ...occurrence, observationQuality: "partial" })));
                 }
             }
-            usages.forEach((occurrence, usageIndex) => {
+            for (const [usageIndex, occurrence] of usages.entries()) {
                 const identity = usageObservationIdentity(fence, source.sourceId, occurrence);
-                this.inbox.enqueueObservation(createRuntimeObservation({
+                await publish(createRuntimeObservation({
                     schemaVersion: 1,
                     eventId: identity.eventId,
                     semanticKey: identity.semanticKey,
@@ -210,9 +243,9 @@ export class AgentRuntimeObserver {
                     state.usageOccurrenceId = occurrence.occurrenceId;
                     state.usageOccurrenceCheckpoint = occurrence.resumeCheckpoint;
                 }
-            });
-            if (activityChanged && state.cursor !== undefined) {
-                this.inbox.enqueueObservation(createRuntimeObservation({
+            }
+            if (activityChanged && sample.cursor !== undefined) {
+                await publish(createRuntimeObservation({
                     schemaVersion: 1,
                     eventId: observationId("activity", fence, source.sourceId, sample.activityId),
                     semanticKey: observationId("activity", fence, source.sourceId, sample.activityId),
@@ -232,10 +265,17 @@ export class AgentRuntimeObserver {
             }
             if (sample.activityId !== undefined)
                 state.activityId = sample.activityId;
+            state.cursor = sample.cursor;
             this.#states.set(key, state);
         });
         return Object.freeze([...dirty].sort(numericCompare));
     }
+    /** Counts successful durable admissions (including duplicates), not tokens or
+     * provider content. Phase observations carry discovery/publication duration. */
+    metrics() {
+        return { samples: this.#samples, sources: this.#sources, published: this.#published,
+            usagePublications: this.#usagePublications, failed: this.#failed };
+    }
     activeSources() {
         const result = [];
         const activeTasks = [...new Set(this.store.listActiveTaskIds())]
@@ -354,13 +394,18 @@ export class AgentRuntimeObserver {
 async function forEachConcurrent(values, limit, visit) {
     let nextIndex = 0;
     const workers = Math.min(limit, values.length);
-    await Promise.all(Array.from({ length: workers }, async () => {
+    const results = await Promise.allSettled(Array.from({ length: workers }, async () => {
         while (nextIndex < values.length) {
             const index = nextIndex;
             nextIndex += 1;
             await visit(values[index], index);
         }
     }));
+    // An admission failure must not release the Controller's in-flight sample
+    // guard while another source can still commit state from that sample.
+    const failure = results.find(result => result.status === "rejected");
+    if (failure?.status === "rejected")
+        throw failure.reason;
 }
 function sampleConcurrency(value) {
     const resolved = value ?? DEFAULT_MAX_CONCURRENT_SAMPLES;

package/dist/controller/clientRuntime.js

@@ -2,7 +2,8 @@ import { spawn } from "node:child_process";
 import { jobCleanupBlocker } from "../job/jobCleanupInspection.js";
 import { describeCliFailure } from "../errors/cliFailure.js";
 import { fileURLToPath } from "node:url";
-import { findLiveControllerProcessForHome, inspectLiveControllerProcess } from "../core/controllerProcessIdentity.js";
+import { findLiveControllerProcessForHome } from "../core/controllerProcessIdentity.js";
+import { processGenerationIsLive } from "../core/fileLockOwner.js";
 import { readHomeFilesystemId } from "../core/homeFilesystemIdentity.js";
 import { parseControllerIdentity } from "../core/controllerIdentity.js";
 import { AGENT_OPERATIONAL_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, operationalAgentEnvironment, selectEnvironment, YUI_MANAGED_RUNTIME_ENVIRONMENT_NAMES } from "../agent/launchEnvironment.js";
@@ -12,6 +13,7 @@ import { isForeignHandoverLockHeld } from "../release/runtimeRelease.js";
 import { WorkspaceCleanupBlockedError } from "../repository/taskWorkspacePreparer.js";
 import { hasRuntimeLifecycleWork } from "../runtime/lifecycleReservation.js";
 import { assertControllerStatusIdentity } from "../runtime/runtimeCoherence.js";
+import { readLinuxProcessIdentity } from "../runtime/sessionOwnerIdentity.js";
 import { CONTROLLER_SHUTDOWN_TIMEOUT_MS, LIFECYCLE_REQUEST_TIMEOUT_MS } from "../runtime/runtimeDeadlines.js";
 import { openCurrentTaskStore } from "../storage/currentTaskStore.js";
 import { yuiVersionIdentity } from "../version.js";
@@ -57,21 +59,31 @@ export async function assertFileTaskControllerStorageCompatible(home, options =
 export async function ensureFileTaskController(home, options = {}) {
     const call = options.call ?? callController;
     await waitForForeignHandover(home, options);
-    try {
-        const status = await call(home, "controller.status", {});
-        assertCompatibleControllerStatus(status, options.expectedIdentity);
-        return status;
-    }
-    catch (error) {
-        if (!isUnavailable(error))
-            throw error;
+    const timeoutMs = positive(options.startupTimeoutMs, STARTUP_TIMEOUT_MS, "startupTimeoutMs");
+    const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
+    const probeDeadline = Date.now() + timeoutMs;
+    for (;;) {
+        try {
+            const status = await call(home, "controller.status", {});
+            assertCompatibleControllerStatus(status, options.expectedIdentity);
+            return status;
+        }
+        catch (error) {
+            if (isUnavailable(error))
+                break;
+            // A closing endpoint may reset a read even after its owner exited.
+            // Retry only this observation: ambiguity never authorizes a spawn.
+            if (!(error instanceof ControllerClientError)
+                || error.code !== "CONTROLLER_DELIVERY_UNKNOWN"
+                || Date.now() >= probeDeadline)
+                throw error;
+        }
+        await delay(pollMs);
     }
     // A handover may have started after the first lock check and before the
     // failed discovery/socket call. Re-check before spawning so a managed
     // Session can never resurrect the old Controller during an update.
     await waitForForeignHandover(home, options);
-    const timeoutMs = positive(options.startupTimeoutMs, STARTUP_TIMEOUT_MS, "startupTimeoutMs");
-    const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
     const spawnController = options.spawnController ?? spawnDetachedFileTaskController;
     // A readiness timeout is not exit evidence. Reuse the observable startup
     // process for this exact Home rather than multiplying unready Controllers.
@@ -169,13 +181,27 @@ export async function stopFileTaskController(home, options = {}) {
     await waitForForeignHandover(home, options);
     const physical = options.call === undefined
         ? findLiveControllerProcessForHome(readHomeFilesystemId(home)) : undefined;
-    const expectedPid = options.expectedPid ?? physical?.pid;
+    // A protected, Home-validated discovery can retain the generation fence
+    // even if the optional /proc ownership inventory is currently unreadable.
+    // It is not signal authority; physical recovery still revalidates ownership.
+    let captured = physical;
+    if (captured === undefined && options.call === undefined) {
+        try {
+            const discovery = await readControllerDiscovery(home);
+            captured = { pid: discovery.pid, processStartIdentity: discovery.processStartIdentity };
+        }
+        catch (error) {
+            if (!isDefinitelyNotRunning(error))
+                throw error;
+        }
+    }
+    const expectedPid = options.expectedPid ?? captured?.pid;
     const bounded = { ...options, requestTimeoutMs: options.requestTimeoutMs ?? 2000,
         ...(expectedPid === undefined ? {} : { expectedPid }) };
     try {
         const result = await stopControllerGracefully(home, bounded);
-        if (result.stopped && physical !== undefined) {
-            await waitForControllerProcessExit(home, physical, options);
+        if (result.stopped && captured !== undefined) {
+            await waitForControllerProcessExit(captured, options);
         }
         if (result.stopped || options.call !== undefined)
             return result;
@@ -185,16 +211,38 @@ export async function stopFileTaskController(home, options = {}) {
             throw error;
     }
     const stopped = await stopOrphanedFileTaskController(home, options.shutdownTimeoutMs ?? CONTROLLER_SHUTDOWN_TIMEOUT_MS, { force: true, ...(expectedPid === undefined ? {} : { expectedPid }),
-        ...(physical === undefined ? {} : { expectedProcessStartIdentity: physical.processStartIdentity }) });
+        ...(captured === undefined ? {} : { expectedProcessStartIdentity: captured.processStartIdentity }) });
+    // No match is not exit proof: /proc ownership inspection may have become
+    // unreadable after we captured this exact generation. Physical recovery
+    // cannot authorize a successor until that original generation is gone.
+    if (captured !== undefined)
+        await waitForControllerProcessExit(captured, options);
     return stopped === undefined ? { stopped: false, alreadyStopped: true } : { stopped: true, pid: stopped.pid };
 }
-async function waitForControllerProcessExit(home, controller, options) {
+async function waitForControllerProcessExit(controller, options) {
     const timeoutMs = positive(options.shutdownTimeoutMs, CONTROLLER_SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
     const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
-    const homeFilesystemId = readHomeFilesystemId(home);
     const deadline = Date.now() + timeoutMs;
-    while (inspectLiveControllerProcess(controller.pid, homeFilesystemId, controller.processStartIdentity) !== undefined) {
+    for (;;) {
+        let observationError;
+        try {
+            if (!processGenerationIsLive(controller.pid, controller.processStartIdentity))
+                return;
+            if (process.platform === "linux") {
+                const observed = readLinuxProcessIdentity(controller.pid);
+                // An exact zombie has exited even before its parent reaps it.
+                if (observed?.startIdentity === controller.processStartIdentity && observed.state === "Z")
+                    return;
+            }
+        }
+        catch (error) {
+            // OS identity can disappear before kill(pid, 0) reports absence.
+            // Keep observing within the existing stop budget, never infer exit.
+            observationError = error;
+        }
         if (Date.now() >= deadline) {
+            if (observationError !== undefined)
+                throw observationError;
             throw new ControllerClientError("CONTROLLER_TIMEOUT", `Controller process ${controller.pid} did not exit within ${timeoutMs} ms.`);
         }
         await delay(pollMs);

package/dist/controller/controller.js

@@ -14,7 +14,7 @@ import { KeyedWorkQueue } from "../coordination/keyedWorkQueue.js";
 import { MailboxScheduler } from "../coordination/mailboxScheduler.js";
 import { nearestDeadlineBatch } from "../coordination/deadlineScheduler.js";
 import { mailboxHasWork, nextPendingBatch } from "../coordination/workMailbox.js";
-import { hasRuntimeCleanupObligation } from "../runtime/lifecycleReservation.js";
+import { hasRuntimeCleanupObligation, runtimeCleanupDisposition } from "../runtime/lifecycleReservation.js";
 import { formatTaskRecordReference } from "../task/taskRecordReference.js";
 import { parseDurableJobAcknowledgeParams, parseDurableJobCancelParams, parseDurableJobRefParams, parseDurableJobStartParams } from "./jobControl.js";
 const DEFAULT_RECONCILIATION_INTERVAL_MS = reconciliationIntervalMilliseconds();
@@ -211,6 +211,12 @@ async function processSelectedRoleRuntimeCleanups(store, delivery, lifecycleHost
         const owner = runtimeOwner(target);
         const batchId = runtimeLifecycleBatchIdentity(target, mailbox);
         if (hasRuntimeCleanupObligation(mailbox)) {
+            // Upgrade is a graceful, exact-identity operation, never the destructive
+            // cleanup path. Its coordinator owns drain/restore; retain backpressure.
+            if (runtimeCleanupDisposition(mailbox) === "upgrade-host") {
+                markFailedRuntimeTarget(failedRoles, target);
+                continue;
+            }
             try {
                 if (lifecycleHost === undefined) {
                     throw new Error("Role runtime cleanup host is unavailable.");
@@ -698,6 +704,7 @@ export class FileTaskController {
     #providerRetry;
     #continuationReconciler;
     #hostTerminalRecovery;
+    #lifecycleChecks;
     #persistenceMetrics;
     #diagnosticMetrics;
     #current;
@@ -754,6 +761,7 @@ export class FileTaskController {
         this.#schedules = options.schedules;
         this.#continuationReconciler = options.continuationReconciler;
         this.#hostTerminalRecovery = options.hostTerminalRecovery;
+        this.#lifecycleChecks = options.lifecycleChecks;
         this.#globalInputDelivery = options.globalInputDelivery;
         this.#messageHealth = options.messageHealth;
         this.#providerRetry = options.providerRetry;
@@ -792,6 +800,7 @@ export class FileTaskController {
     runtimeMetrics() {
         const metrics = this.#lastRuntimeDrain?.metrics ?? ZERO_DRAIN_METRICS;
         return {
+            sampler: this.#runtimeObserver?.metrics?.() ?? null,
             messageHealth: this.#lastMessageHealth,
             diagnostics: this.#diagnosticMetrics?.() ?? null,
             phases: this.#phases.snapshot(),
@@ -841,6 +850,7 @@ export class FileTaskController {
             return;
         if (this.#stopped)
             throw new Error("Controller runtime is stopped.");
+        this.#lifecycleChecks?.notify("startup");
         this.#requestBackgroundPump();
         this.#requestRuntimeObservation();
         // Arm the Operator lane once for work that was already pending when the
@@ -861,6 +871,7 @@ export class FileTaskController {
     }
     stop() {
         this.#stopped = true;
+        this.#lifecycleChecks?.close();
         this.#workspaceWaitAbort.abort(new Error("Controller stopped while waiting for Project maintenance."));
         this.#signalScheduler.stop();
         this.#operatorSignalScheduler.stop();
@@ -904,6 +915,7 @@ export class FileTaskController {
         if (this.#stopped)
             throw new Error("Controller runtime is stopped.");
         parseMailboxKey(key);
+        this.#lifecycleChecks?.notify("signal");
         if (key === "operator") {
             // Main lane owns durable Hook folding; the Operator lane is the sole
             // consumer of the Operator delivery mailbox.
@@ -920,7 +932,7 @@ export class FileTaskController {
         if (this.#stopped || this.#runtimeObserver === undefined
             || this.#runtimeObserverCurrent !== undefined)
             return;
-        const running = this.#runtimeObserver.sample(this.#now()).then((keys) => {
+        const running = this.#phases.observe("runtime-sample", "home", () => this.#runtimeObserver.sample(this.#now(), this.#phases)).then((keys) => {
             if (this.#stopped)
                 return;
             for (const key of keys)
@@ -1016,6 +1028,8 @@ export class FileTaskController {
                         }
                     }
                     const firstRuntimeDrain = await this.#phases.observe("runtime-drain", "home", () => this.#drainRuntimeEvents());
+                    if (scope.kind === "full")
+                        this.#lifecycleChecks?.notify("periodic");
                     if (scope.kind === "full" && this.#hostTerminalRecovery !== undefined) {
                         await this.#observeMaintenance("Host terminal recovery", this.#hostTerminalRecovery);
                     }
@@ -1257,6 +1271,8 @@ export class FileTaskController {
             ? await processor.drainAsync(this.#now())
             : processor.drain(this.#now());
         this.#lastRuntimeDrain = result;
+        if (result.acknowledgedEventIds.length > 0)
+            this.#lifecycleChecks?.notify("events-persisted");
         this.#runtimeDrainPasses += 1;
         const metrics = result.metrics ?? ZERO_DRAIN_METRICS;
         this.#runtimeListedEvents += metrics.listedEventCount;
@@ -1779,6 +1795,7 @@ export async function startFileTaskController(home, store, delivery, dispatcher,
         await runtime.shutdownAndDrain();
     }, {
         domainIdentity: options.domainIdentity,
+        onRequestDiagnostic: options.onRequestDiagnostic,
         status: ({ commandObserver, eventLoopDelay }) => ({
             ...runtime.runtimeMetrics(),
             commands: {

package/dist/controller/diagnosticJournal.js

@@ -13,13 +13,15 @@ const NUMERIC_KEYS = new Set([
     "completed", "failed", "received", "inFlight", "maximumMs", "maximumLagMs",
     "maximumObservedAtMs", "oldestInFlightAgeMs", "startedAtMs", "elapsedMs",
     "ageMs", "depth", "semanticDepth", "progressDepth", "pendingKeys", "queueDepth",
-    "hits", "rebuilds", "invalidations", "passes", "listedEvents", "selectedEvents"
+    "hits", "rebuilds", "invalidations", "passes", "listedEvents", "selectedEvents",
+    "acceptedAtMs", "receivedAtMs", "routedAtMs", "handlerCompletedAtMs", "flushCompletedAtMs",
+    "handlerFailed", "flushFailed", "samples", "sources", "published", "usagePublications"
 ]);
 const CONTAINER_KEYS = new Set([
     "commands", "observations", "routes", "eventLoopDelay", "phases", "reads",
     "persistence", "main", "worker", "database", "roundTrips", "work", "body",
     "lock", "commit", "payloadReads", "inbox", "scheduler", "projectionCache",
-    "active", "recent", "slowest", "latest"
+    "active", "recent", "slowest", "latest", "transport", "sampler"
 ]);
 const ERROR_CODES = new Set([
     "SQLITE_BUSY", "SQLITE_LOCKED", "SQLITE_IOERR", "SQLITE_FULL", "SQLITE_READONLY",
@@ -101,6 +103,12 @@ export class ControllerDiagnosticJournal {
     error(error) {
         this.#enqueue("error", { error: errorEvidence(error) });
     }
+    /** Completion-driven evidence bypasses the periodic recent-array/sample
+     * window, but uses the same allowlist, queue/record/file bounds and async I/O.
+     * Disk failure, queue pressure and force-kill remain explicit evidence gaps. */
+    request(record) {
+        this.#enqueue("request", { request: safeSnapshot(record) });
+    }
     sample(snapshot, lagMs) {
         const now = monotonicMilliseconds();
         if (now - this.#lastSampleAt < 1000) {