@zq-silk/yui 2.6.0 → 2.8.0

package/dist/controller/globalInputDelivery.js

@@ -1,17 +1,17 @@
-import { sendAgentHostRunControl, AGENT_HOST_CONTROL_PROTOCOL } from "../runtime/agentHost.js";
+import { sendAgentHostRunControl, reconcileAgentHostTurn, AGENT_HOST_CONTROL_PROTOCOL } from "../runtime/agentHost.js";
 import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
 import { hasRuntimeCleanupObligation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { markGlobalRoleMessageNotDelivered } from "../message/message.js";
 import { providerRetryPending } from "../runtime/providerRetry.js";
 import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 import { globalMessagePresentation } from "../interaction/notificationPresentation.js";
+import { recordGlobalRuntimeAttention, recordGlobalRuntimeRecovery } from "./globalRuntimeAttention.js";
 /** Messages are the only queue. Host's atomic begin arbitrates native writers. */
-export async function deliverGlobalInputs(home, store, ensure, onError) {
+export async function deliverGlobalInputs(home, store, ensure, onError, options = {}) {
     for (const role of store.listGlobalRoles()) {
         try {
-            let pending = store.listGlobalRoleMessages(role.name).filter(message => message.delivery === undefined && message.notDelivered === undefined
-                && (message.inputControl?.action === "queue" || message.interruptThen !== undefined));
-            if (pending.length === 0 || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name }))))
+            let pending = store.queryGlobalRoleMessages(role.name, { pending: true, limit: 64 }).messages;
+            if (hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name }))))
                 continue;
             let sessions = store.getGlobalRoleSessionSet(role.name);
             // A detached Host keeps an active Session and may reconnect. An explicit
@@ -20,15 +20,82 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
                 continue;
             if (sessions?.providerBinding?.retry !== undefined && !providerRetryPending(sessions.providerBinding)) {
                 store.transaction(tx => settleGlobalRetryInput(tx, role.name, tx.getGlobalRoleSessionSet(role.name)?.providerBinding, new Date()));
-                pending = store.listGlobalRoleMessages(role.name).filter(message => message.delivery === undefined && message.notDelivered === undefined
-                    && (message.inputControl?.action === "queue" || message.interruptThen !== undefined));
+                pending = store.queryGlobalRoleMessages(role.name, { pending: true, limit: 64 }).messages;
                 if (pending.length === 0)
                     continue;
             }
             if (providerRetryPending(sessions?.providerBinding))
                 continue;
-            const current = sessions?.providerBinding?.run;
-            const obsolete = pending.filter(message => {
+            let current = sessions?.providerBinding?.run;
+            const bindingBefore = sessions?.providerBinding;
+            if (options.reconcile && current != null
+                && ["submitting", "accepted", "delivery-unknown"].includes(current.status)
+                && bindingBefore?.authority.owner === "controller" && bindingBefore.authority.holderId !== undefined) {
+                const ownedTurn = current;
+                // Only ask the original Host to republish evidence it already holds.
+                // Busy, unknown, unavailable and older Hosts never authorize replay,
+                // Session creation, native reads through another client, or timeout settlement.
+                let observed;
+                try {
+                    observed = await reconcileAgentHostTurn({
+                        home, scope: "global", roleName: role.name,
+                        control: { protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "reconcile-turn",
+                            nativeSessionId: currentProviderConversation(bindingBefore).conversationId,
+                            attemptId: current.attemptId, nativeTurnId: current.nativeTurnId,
+                            authority: { epoch: bindingBefore.authority.epoch, owner: "controller",
+                                holderId: bindingBefore.authority.holderId } }
+                    });
+                    if (observed.reconciliation === "unsupported") {
+                        throw new Error("Host does not advertise reconcile-turn. Preserve the accepted input and original Host; consume retained Inbox evidence or use an explicitly authorized, quiescence-verified refresh.");
+                    }
+                    if (observed.outcome === "rejected" || ["idle", "failed", "exited"].includes(observed.snapshot.state)
+                        && observed.reconciliation !== "terminal-republished") {
+                        throw new Error(observed.failure?.detail ?? observed.snapshot.detail ?? "Host cannot reconcile this exact terminal.");
+                    }
+                    if (observed.reconciliation === "terminal-republished") {
+                        store.transaction(tx => recordGlobalRuntimeRecovery(tx, role.name, `terminal-reconcile:${ownedTurn.attemptId}`, {
+                            nativeSessionId: currentProviderConversation(bindingBefore).conversationId,
+                            reason: "host-terminal-unobservable", evidence: "exact-terminal-republished"
+                        }, options.now ?? new Date()));
+                    }
+                }
+                catch (error) {
+                    store.transaction(tx => recordGlobalRuntimeAttention(tx, role.name, `terminal-reconcile:${currentProviderConversation(bindingBefore).conversationId}:${ownedTurn.attemptId}`, { attemptId: ownedTurn.attemptId, nativeTurnId: ownedTurn.nativeTurnId,
+                        nativeSessionId: currentProviderConversation(bindingBefore).conversationId,
+                        reason: "host-terminal-unobservable",
+                        cause: observed === undefined ? "host-control-unavailable"
+                            : observed.reconciliation === "unsupported" ? "host-control-unsupported"
+                                : observed.outcome === "rejected" ? "host-control-rejected" : "exact-terminal-not-retained",
+                        hostState: observed?.snapshot.state ?? null,
+                        endpointImplementation: observed?.snapshot.endpointImplementation ?? null,
+                        hostImplementation: observed?.snapshot.hostImplementation ?? null,
+                        controlCapabilities: observed?.snapshot.controlCapabilities ?? null,
+                        eventDelivery: observed?.snapshot.eventDelivery ?? null,
+                        // Endpoint generation is not a loaded Host/package version.
+                        inputKind: ownedTurn.attemptId.startsWith("direct:") ? "direct" : "managed",
+                        detail: error instanceof Error ? error.message : String(error),
+                        recovery: "Inspect the original Host, Session, input and raw Inbox. Controller restart preserves live Hosts; it does not upgrade their loaded observation code. Restore the supported observation path, or explicitly stop/replace with exact native quiescence evidence. Missing eventDelivery means unreported, not healthy. Do not resend unknown input.",
+                        confirmed: ownedTurn.status, unknown: "Native terminal and remaining writer ownership." }, options.now ?? new Date()));
+                    continue;
+                }
+                sessions = store.getGlobalRoleSessionSet(role.name);
+                current = sessions?.providerBinding?.run;
+                if (sessions?.sessions[sessions.activeAgentId]?.status !== "active"
+                    || providerRetryPending(sessions?.providerBinding)
+                    || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name }))))
+                    continue;
+                pending = store.queryGlobalRoleMessages(role.name, { pending: true, limit: 64 }).messages;
+                if (pending.length === 0)
+                    continue;
+            }
+            if (store.queryGlobalRoleMessages(role.name, { handling: true, limit: 0 }).count > 0)
+                continue;
+            // Interrupt-then reserves the next legal slot even behind a large queue.
+            const reservedPage = store.queryGlobalRoleMessages(role.name, {
+                pending: true, interruptThen: true, limit: 64
+            });
+            const reserved = reservedPage.messages;
+            const obsolete = reserved.filter(message => {
                 const claim = message.interruptThen;
                 return claim !== undefined && (sessions?.activeAgentId !== claim.targetAgentId
                     || sessions.sessions[claim.targetAgentId]?.nativeSessionId !== claim.targetNativeSessionId
@@ -37,15 +104,18 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             });
             for (const message of obsolete)
                 store.updateGlobalRoleMessage(markGlobalRoleMessageNotDelivered(message, "native-session-or-authority-changed", new Date()));
-            pending = pending.filter(message => !obsolete.includes(message));
+            const obsoleteIds = new Set(obsolete.map(message => message.id));
+            pending = pending.filter(message => !obsoleteIds.has(message.id));
             if (pending.length === 0)
                 continue;
+            if (reservedPage.count > reserved.length && obsolete.length === reserved.length)
+                continue;
             if (current != null && ["submitting", "accepted", "delivery-unknown"].includes(current.status))
                 continue;
             const matchesTarget = (message) => message.deliveryTarget === undefined
                 || sessions?.activeAgentId === message.deliveryTarget.agentId
                     && sessions.sessions[message.deliveryTarget.agentId]?.nativeSessionId === message.deliveryTarget.nativeSessionId;
-            const claims = pending.filter(message => message.interruptThen !== undefined);
+            const claims = reserved.filter(message => !obsolete.includes(message));
             let next;
             if (claims.length > 0) {
                 next = claims.find(message => {
@@ -76,7 +146,7 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
                     return false;
                 });
             }
-            if (next === undefined)
+            if (next === undefined || next.inbox !== undefined)
                 continue;
             const attemptId = `global-input:${role.name}/${next.id}`;
             if (current?.attemptId === attemptId)
@@ -96,8 +166,8 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             if (binding == null || binding.authority.owner !== "controller")
                 continue;
             const nativeSessionId = currentProviderConversation(binding).conversationId;
-            const persisted = store.listGlobalRoleMessages(role.name).find(message => message.id === next.id);
-            if (persisted === undefined || JSON.stringify(persisted) !== JSON.stringify(next))
+            const persisted = store.queryGlobalRoleMessages(role.name, { id: next.id, limit: 1 }).messages[0];
+            if (persisted === undefined || persisted.inbox !== undefined || JSON.stringify(persisted) !== JSON.stringify(next))
                 continue;
             const claim = next.interruptThen;
             if (!matchesTarget(next) || claim !== undefined
@@ -125,8 +195,8 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             });
             if (result.outcome === "rejected") {
                 store.transaction(tx => {
-                    const latest = tx.listGlobalRoleMessages(role.name).find(message => message.id === next.id);
-                    if (latest === undefined || latest.delivery !== undefined || latest.notDelivered !== undefined)
+                    const latest = tx.queryGlobalRoleMessages(role.name, { id: next.id, limit: 1 }).messages[0];
+                    if (latest === undefined || latest.inbox !== undefined || latest.delivery !== undefined || latest.notDelivered !== undefined)
                         return;
                     const turn = tx.getGlobalRoleSessionSet(role.name)?.providerBinding?.run;
                     if (providerRetryPending(tx.getGlobalRoleSessionSet(role.name)?.providerBinding))

package/dist/controller/globalRuntimeAttention.js

@@ -1,14 +1,115 @@
 import { createHash } from "node:crypto";
 import { createGlobalRoleMessage } from "../message/message.js";
-import { serializeAgentErrorRaw } from "../runtime/agentError.js";
+import { redactAgentErrorText, serializeAgentErrorRaw } from "../runtime/agentError.js";
+import { summaryMetadata, summaryText } from "../output/boundedRead.js";
+const FAILURE_HEADER = "Yui Global failure evidence ";
+const RECOVERY_HEADER = "Yui Global recovery evidence ";
+const hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+/** This is a projection of original Message documents, never a persisted
+ * aggregate or a new handling/recovery state. Exact observations remain in the
+ * existing record-only Message history. Polling the same identity is a no-op. */
+function diagnosticIdentity(store, roleName, identity, facts) {
+    const value = object(facts), fence = object(value.fence);
+    const failure = object(value.failure), retry = object(value.retry);
+    const error = object(failure.error ?? value.error ?? retry.error);
+    const sessions = store.getGlobalRoleSessionSet(roleName);
+    const binding = sessions?.providerBinding;
+    const nativeSessionId = value.nativeSessionId ?? fence.nativeSessionId ?? retry.nativeSessionId
+        ?? sessions?.sessions[sessions.activeAgentId]?.nativeSessionId;
+    const source = {
+        roleName, nativeSessionId,
+        host: binding?.authority.holderId,
+        endpointImplementation: value.endpointImplementation,
+        hostImplementation: value.hostImplementation,
+        controlCapabilities: value.controlCapabilities,
+        driverId: fence.driverId ?? binding?.providerNamespace,
+        source: error.source,
+        phase: error.phase,
+        reason: value.reason, cause: value.cause,
+        agentId: fence.agentId ?? sessions?.activeAgentId, providerNamespace: binding?.providerNamespace,
+        accountScope: binding?.accountScope
+    };
+    const classified = typeof nativeSessionId === "string" && (typeof error.code === "string" && error.code !== "unknown"
+        || value.reason === "host-terminal-unobservable" && typeof value.cause === "string");
+    const classification = {
+        ...source, category: error.category, code: error.code, cause: value.cause,
+        detail: value.reason === "host-terminal-unobservable" ? hash(value.detail ?? null) : undefined,
+        // Explicit impact, not Turn IDs or free-form provider text.
+        inputDisposition: error.inputDisposition ?? failure.inputDisposition,
+        sessionDisposition: error.sessionDisposition ?? failure.sessionDisposition,
+        confirmed: ["submitting", "accepted", "delivery-unknown", "completed", "failed", "cancelled"].includes(value.confirmed)
+            ? value.confirmed : undefined,
+        status: value.status,
+        // Unclassified failures must never be guessed equivalent.
+        unclassified: classified ? undefined : identity
+    };
+    return { key: hash(classification), source, summary: summaryText(redactAgentErrorText(String(error.message ?? value.detail ?? value.reason ?? "Runtime failure; inspect original evidence"))
+            .replace(/[\u0000-\u001f\u007f]/gu, " ")) };
+}
+function evidence(message) {
+    if (message.kind !== "system" || ![FAILURE_HEADER, RECOVERY_HEADER].some(header => message.body.startsWith(header)))
+        return;
+    try {
+        return object(JSON.parse(message.body.slice(message.body.indexOf("\n") + 1)));
+    }
+    catch {
+        return;
+    }
+}
+export function runtimeDiagnosticGroups(messages) {
+    const groups = [];
+    const active = new Map();
+    for (const message of messages) {
+        const value = evidence(message);
+        if (!value)
+            continue;
+        if (message.body.startsWith(RECOVERY_HEADER)) {
+            for (const [key, group] of active) {
+                if (group.source.nativeSessionId !== value.nativeSessionId || group.source.host !== value.host
+                    || value.reason !== undefined && group.source.reason !== value.reason
+                    || value.reason === undefined && group.source.phase !== "turn-execute"
+                        && group.source.phase !== "turn-submit")
+                    continue;
+                group.recoveredAt = message.createdAt;
+                group.recoveryEvidence = message.id;
+                active.delete(key);
+            }
+            continue;
+        }
+        const diagnostic = value.diagnostic;
+        if (typeof diagnostic?.key !== "string")
+            continue; // Old evidence remains in ordinary history.
+        const existing = active.get(diagnostic.key);
+        if (existing) {
+            existing.count++;
+            existing.lastAt = message.createdAt;
+            existing.latestEvidence = message.id;
+        }
+        else {
+            const group = { ...diagnostic, episode: message.id, count: 1,
+                firstAt: message.createdAt, lastAt: message.createdAt,
+                firstEvidence: message.id, latestEvidence: message.id };
+            groups.push(group);
+            active.set(diagnostic.key, group);
+        }
+    }
+    return groups;
+}
+export function runtimeDiagnosticEvidence(messages, key) {
+    return messages.filter(message => evidence(message)?.diagnostic?.key === key);
+}
 /** Global observations have no Task event history. Keep original failed
  * attempts as ordinary record-only Messages before replacing the live binding. */
 export function recordGlobalRuntimeFailure(store, roleName, identity, facts, now) {
-    const header = `Yui Global failure evidence ${createHash("sha256").update(identity).digest("hex")}\n`;
+    const diagnostic = diagnosticIdentity(store, roleName, identity, facts);
+    const header = `${FAILURE_HEADER}${hash([identity, diagnostic.key])}\n`;
     const previous = store.listGlobalRoleMessages(roleName).find(message => message.kind === "system" && message.body.startsWith(header));
     if (previous !== undefined)
         return `${roleName}/${previous.id}`;
-    const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), roleName, header + serializeAgentErrorRaw(facts), "system", { type: "system" }, now);
+    const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), roleName, header + redactAgentErrorText(JSON.stringify({
+        ...object(facts), diagnostic
+    })), "system", { type: "system" }, now);
     store.saveGlobalRoleMessage(message);
     return `${roleName}/${message.id}`;
 }
@@ -18,17 +119,46 @@ export function recordGlobalRuntimeAttention(store, roleName, identity, facts, n
     // A Home may have a custom Global Role without an Operator. Keep its own
     // diagnostic readable; never create a Role or launch a substitute Agent.
     const recipient = store.getGlobalRole("operator") === null ? roleName : "operator";
-    const requestId = `runtime-attention:${createHash("sha256").update(`${roleName}\0${identity}`).digest("hex")}`;
-    if (store.listGlobalRoleMessages(recipient).some(message => message.inputControl?.requestId === requestId))
+    const failureRef = recordGlobalRuntimeFailure(store, roleName, identity, facts, now);
+    const diagnostic = diagnosticIdentity(store, roleName, identity, facts);
+    const group = runtimeDiagnosticGroups(store.listGlobalRoleMessages(roleName))
+        .reverse().find(group => group.key === diagnostic.key && group.recoveredAt === undefined);
+    const requestId = `runtime-attention:${hash([roleName, diagnostic.key, group?.episode ?? identity])}`;
+    if (store.queryGlobalRoleMessages(recipient, { requestId, limit: 1 }).messages.length > 0)
         return;
     const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), recipient, [
+        `Yui-Summary: ${diagnostic.summary}`,
         `Global Role ${roleName} needs attention. No recovery or new authority is implied.`,
         "Inspect the exact Session and original input before choosing a next action; unknown effects must not be replayed.",
         `Original failed attempts remain in Role ${roleName}'s record-only failure Messages; failureRef names the latest evidence.`,
-        serializeAgentErrorRaw(facts)
+        redactAgentErrorText(JSON.stringify({ diagnosticKey: diagnostic.key, source: summaryMetadata(diagnostic.source), failureRef,
+            read: `yui role message list ${roleName} --diagnostic ${diagnostic.key}` }))
     ].join("\n"), "system", { type: "system" }, now, { inputControl: { action: "queue", requestId } });
     store.saveGlobalRoleMessage(recipient === roleName ? {
         ...message,
         notDelivered: { reason: "runtime-needs-attention; retained for user or successor inspection", at: now.toISOString() }
     } : message);
 }
+/** Called only on an established exact successful observation. A diagnostic
+ * recovery says nothing about Message handling, prior effects or Task outcome. */
+export function recordGlobalRuntimeRecovery(store, roleName, identity, facts, now) {
+    const messages = store.listGlobalRoleMessages(roleName);
+    const host = store.getGlobalRoleSessionSet(roleName)?.providerBinding?.authority.holderId;
+    const active = runtimeDiagnosticGroups(messages).filter(group => !group.recoveredAt
+        && group.source.nativeSessionId === facts.nativeSessionId && group.source.host === host
+        && (facts.reason !== undefined ? group.source.reason === facts.reason
+            : ["turn-execute", "turn-submit"].includes(group.source.phase)));
+    if (active.length === 0)
+        return;
+    const header = `${RECOVERY_HEADER}${hash(identity)}\n`;
+    if (messages.some(message => message.body.startsWith(header)))
+        return;
+    const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), roleName, header + serializeAgentErrorRaw({ ...facts, host }), "system", { type: "system" }, now);
+    store.saveGlobalRoleMessage(message);
+    const recipient = store.getGlobalRole("operator") === null ? roleName : "operator";
+    const notice = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), recipient, `Yui-Summary: Global Role ${roleName} has new runtime recovery evidence; no input handling or Task completion is implied.\n`
+        + JSON.stringify({ evidence: `${roleName}/${message.id}`, recoveredGroups: active.length }), "system", { type: "system" }, now, { inputControl: { action: "queue", requestId: `runtime-recovery:${hash([roleName, identity])}` } });
+    store.saveGlobalRoleMessage(recipient === roleName ? { ...notice,
+        notDelivered: { reason: "runtime-recovery; retained for user or successor inspection", at: now.toISOString() }
+    } : notice);
+}

package/dist/controller/operatorNotification.js

@@ -8,7 +8,7 @@ import { createGlobalRoleMessage } from "../message/message.js";
 export function queueOperatorNotification(store, input, now = new Date()) {
     return store.transaction(tx => {
         const requestId = `operator-notice:${encodeURIComponent(input.receiptId)}`;
-        const previous = tx.listGlobalRoleMessages("operator").find(entry => (entry.inputControl ?? entry.interruptThen?.reusedInput)?.requestId === requestId);
+        const previous = tx.queryGlobalRoleMessages("operator", { requestId, limit: 1 }).messages[0];
         const mailbox = tx.getWorkMailbox({ kind: "operator" });
         const claimed = mailbox?.processing?.batchId === input.batchId;
         if (previous !== undefined) {
@@ -18,6 +18,11 @@ export function queueOperatorNotification(store, input, now = new Date()) {
         }
         if (!claimed)
             throw new Error(`Operator notification claim changed: ${input.batchId}`);
+        // At most one unsent engineering notice. New facts coalesce in the existing
+        // mailbox while busy, without rewriting originals or overtaking user input.
+        if (tx.queryGlobalRoleMessages("operator", { pending: true, operatorNotice: true, limit: 1 }).count > 0) {
+            return { status: "deferred" };
+        }
         const sessions = tx.getGlobalRoleSessionSet("operator");
         const session = sessions?.sessions[sessions.activeAgentId];
         if (session?.status !== "active" || sessions?.providerBinding == null)

package/dist/controller/providerRetryDelivery.js

@@ -1,6 +1,6 @@
 import { performance } from "node:perf_hooks";
 import { runTaskCommand } from "../commands/taskCommands.js";
-import { enqueueWork } from "../coordination/workMailboxQueue.js";
+import { routeRoleEvent } from "../scheduler/operatorEvent.js";
 import { createTaskEvent } from "../event/taskEvent.js";
 import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 import { redactAgentErrorText } from "../runtime/agentError.js";
@@ -57,8 +57,7 @@ export function createProviderRetryHooks(home, store, ports = {}) {
                     roleName: owner.roleName, chainId: binding.retry.chainId, reason
                 }, new Date(at));
                 store.saveEvent(owner.taskId, event);
-                enqueueWork(store, owner.roleName === "leader" ? { kind: "operator" }
-                    : { kind: "role", taskId: owner.taskId, roleName: "leader" }, "provider-retry-needs-attention", new Date(at), [{ type: "event", taskId: owner.taskId, id: event.id }]);
+                routeRoleEvent(store, event, owner.roleName, "provider-retry-needs-attention", new Date(at));
             }
         });
     };
@@ -142,8 +141,7 @@ export function createProviderRetryHooks(home, store, ports = {}) {
                                         roleName: owner.roleName, attemptId: retry.currentAttemptId, nativeSessionId: retry.nativeSessionId, detail
                                     }, new Date(at));
                                     store.saveEvent(owner.taskId, event);
-                                    enqueueWork(store, owner.roleName === "leader" ? { kind: "operator" }
-                                        : { kind: "role", taskId: owner.taskId, roleName: "leader" }, "provider-retry-needs-attention", new Date(at), [{ type: "event", taskId: owner.taskId, id: event.id }]);
+                                    routeRoleEvent(store, event, owner.roleName, "provider-retry-needs-attention", new Date(at));
                                 }
                             });
                         }

package/dist/controller/runtime.js

@@ -40,8 +40,10 @@ import { createWebTaskSurface } from "../web/webTaskSurface.js";
 import { createWebConversationSurface } from "../web/webConversation.js";
 import { WebRequestRejected } from "../web/webMutation.js";
 import { inspectAgentHost, sendAgentHostNativeControl, AGENT_HOST_CONTROL_PROTOCOL } from "../runtime/agentHost.js";
+import { recoverTaskHostTerminals } from "./taskHostTerminalRecovery.js";
 import { archiveOrdinaryTask } from "../task/ordinaryArchive.js";
 import { createWebSettings } from "../web/webSettings.js";
+import { createModelManagement } from "../models/modelManagement.js";
 import { createWebSkills } from "../web/webSkills.js";
 import { isTaskOwnedWorkspace, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
 import { AgentRuntimeObserver } from "./agentRuntimeObserver.js";
@@ -410,6 +412,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         const web = createControllerWeb(store, {
             previews: () => createTaskPreviews(store, home),
             skills: createWebSkills(store),
+            models: createModelManagement(store),
             settings: createWebSettings(store, {
                 environment: options.environment ?? process.env, catalogs,
                 refreshConfiguration: () => {
@@ -560,9 +563,10 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
                 }
             }),
             jobSupervisor,
-            globalInputDelivery: () => deliverGlobalInputs(home, store, async (roleName) => {
+            hostTerminalRecovery: () => recoverTaskHostTerminals(home, store, options.onError ?? (() => undefined)),
+            globalInputDelivery: (deliveryOptions) => deliverGlobalInputs(home, store, async (roleName) => {
                 await lifecycleDispatcher("runtime.ensure-role-session", { scope: "global", roleName });
-            }, options.onError ?? (() => undefined)),
+            }, options.onError ?? (() => undefined), deliveryOptions),
             jobControl,
             capabilityDispatcher: createCapabilityDispatcher(kernel.capabilities),
             ...(continuationReconciler === undefined ? {} : { continuationReconciler }),

package/dist/controller/structuredProviderObservation.js

@@ -10,10 +10,15 @@ import { FileRuntimeEventInbox } from "./runtimeEventInbox.js";
 import { AGENT_HOST_EVENT_PROTOCOL } from "../runtime/agentHostProtocol.js";
 import { redactAgentErrorText } from "../runtime/agentError.js";
 let structuredSequence = 0;
-let deliveryFailure;
+const deliveryFailures = new Map();
 // Only live diagnostics for this process's immutable files, not another queue.
 // No payload, retry, or authoritative delivery state is kept in this map.
 const emittedEvents = new Map();
+// Only facts whose immutable Inbox write has not succeeded. The original
+// process must retain these bytes during a filesystem fault: another direct
+// native turn can arrive without Yui admission and replace a last-turn cache.
+// No new durable queue or execution retry; discard only after durable enqueue.
+const unpersistedEvents = new Map();
 /** Retained in the existing Host Inbox; it never settles a Turn or a resource. */
 export async function publishStructuredProviderDiagnostic(input) {
     const diagnostic = input.diagnostic;
@@ -44,6 +49,7 @@ export async function publishStructuredProviderDiagnostic(input) {
 /** A live transport observation, independent of Provider state and Run truth. */
 export function structuredProviderEventDelivery(home, environment, nativeSessionId) {
     try {
+        const deliveryFailure = deliveryFailures.get(deliveryKey(home, environment));
         const inbox = new FileRuntimeEventInbox(home);
         const pending = [];
         for (const [id, entry] of emittedEvents) {
@@ -57,16 +63,39 @@ export function structuredProviderEventDelivery(home, environment, nativeSession
                 && (nativeSessionId === undefined || entry.nativeSessionId === nativeSessionId))
                 pending.push(entry);
         }
+        const retained = pendingPersistence(home, environment);
         return {
-            pending: pending.length,
-            pendingTerminals: pending.filter(event => event.terminal).length,
+            pending: pending.length + retained.length,
+            unpersisted: retained.length,
+            pendingTerminals: pending.filter(event => event.terminal).length
+                + retained.filter(event => ["turn.completed", "turn.failed", "turn.cancelled"].includes(event.observation.kind)).length,
             ...(deliveryFailure === undefined ? {} : { failure: deliveryFailure })
         };
     }
     catch (error) {
-        return { pending: 0, pendingTerminals: 0, failure: deliveryFault("persistence", error) };
+        const retained = pendingPersistence(home, environment);
+        return {
+            pending: retained.length, unpersisted: retained.length,
+            pendingTerminals: retained.filter(event => ["turn.completed", "turn.failed", "turn.cancelled"].includes(event.observation.kind)).length,
+            failure: deliveryFault("persistence", error)
+        };
     }
 }
+function deliveryKey(home, environment) {
+    return JSON.stringify([home, environment.YUI_TASK_ID, environment.YUI_ROLE, environment.YUI_AGENT_ID]);
+}
+function pendingPersistence(home, environment) {
+    return [...unpersistedEvents.values()].filter(event => event.home === home
+        && event.observation.fence.taskId === environment.YUI_TASK_ID
+        && event.observation.fence.roleName === environment.YUI_ROLE
+        && event.observation.fence.agentId === environment.YUI_AGENT_ID);
+}
+/** Retry only original native facts, under the original Host's control fence. */
+export async function replayStructuredProviderPersistence(home, environment) {
+    const retained = pendingPersistence(home, environment).map(event => event.observation);
+    await persistAndApply(home, [], environment);
+    return retained;
+}
 function deliveryFault(stage, error) {
     return {
         stage, detail: redactAgentErrorText(error instanceof Error ? error.message : String(error)),
@@ -412,28 +441,35 @@ function requireIdentity(value, label) {
 }
 async function persistAndApply(home, observations, environment, connection, startupRunId) {
     const inbox = new FileRuntimeEventInbox(home);
+    const key = deliveryKey(home, environment);
     const host = {
         protocol: AGENT_HOST_EVENT_PROTOCOL,
         adapterId: requireIdentity(environment.YUI_ADAPTER_ID, "Agent adapter id"),
         workspace: requireIdentity(environment.YUI_WORKSPACE, "Yui workspace"),
         ...(connection === undefined ? {} : { connection })
     };
-    let events;
+    const source = { ...host, ...(startupRunId === undefined ? {} : { startupRunId }) };
+    for (const observation of observations) {
+        unpersistedEvents.set(observation.eventId, { home, observation, host: source });
+    }
+    const events = [];
     try {
         structuredProviderEventDelivery(home, environment); // prune ACKed local diagnostics
-        events = observations.map(entry => inbox.enqueueObservation(entry, {
-            ...host,
-            ...(startupRunId === undefined ? {} : { startupRunId })
-        }).event);
-        for (const event of events)
+        for (const retained of pendingPersistence(home, environment)) {
+            const event = inbox.enqueueObservation(retained.observation, retained.host).event;
+            events.push(event);
+            unpersistedEvents.delete(retained.observation.eventId);
             emittedEvents.set(event.id, {
                 home, taskId: event.taskId, roleName: event.observation.fence.roleName,
                 nativeSessionId: event.observation.fence.nativeSessionId,
                 terminal: ["turn.completed", "turn.failed", "turn.cancelled"].includes(event.observation.kind)
             });
+        }
+        if (deliveryFailures.get(key)?.stage === "persistence")
+            deliveryFailures.delete(key);
     }
     catch (error) {
-        deliveryFailure = deliveryFault("persistence", error);
+        deliveryFailures.set(key, deliveryFault("persistence", error));
         throw error;
     }
     // The immutable inbox is authoritative. During a release/update handover the
@@ -463,7 +499,7 @@ async function persistAndApply(home, observations, environment, connection, star
                 return;
             // The native fact is already durable. An incompatible/refusing
             // Controller is a reporting fault, not Provider execution failure.
-            deliveryFailure = deliveryFault("controller", error);
+            deliveryFailures.set(key, deliveryFault("controller", error));
             return;
         }
         // A fast Provider can accept the initial AgentRun before the scheduler call
@@ -472,12 +508,12 @@ async function persistAndApply(home, observations, environment, connection, star
         // `deferred` therefore means "retained for replay", not delivery failure.
         // The signal below schedules the replay after the transport transaction.
         if (result.outcome !== "applied" && result.outcome !== "deferred") {
-            deliveryFailure = deliveryFault("controller", `Structured Provider observation was rejected: ${result.outcome ?? "unknown"}. Event: ${entry.id}`);
+            deliveryFailures.set(key, deliveryFault("controller", `Structured Provider observation was rejected: ${result.outcome ?? "unknown"}. Event: ${entry.id}`));
             return;
         }
     }
-    if (deliveryFailure?.stage === "controller")
-        deliveryFailure = undefined;
+    if (events.length > 0 && deliveryFailures.get(key)?.stage === "controller")
+        deliveryFailures.delete(key);
     await signalController(home, hostTaskId(environment), requireIdentity(environment.YUI_ROLE, "Role"));
 }
 /** Capture only identities the Host actually received; the current Controller

package/dist/controller/taskHostTerminalRecovery.js

@@ -0,0 +1,33 @@
+import { AGENT_HOST_CONTROL_PROTOCOL, reconcileAgentHostTurn } from "../runtime/agentHost.js";
+import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
+import { providerRetryPending } from "../runtime/providerRetry.js";
+/** Existing full reconciliation pass only; no new timer, input or Session. */
+export async function recoverTaskHostTerminals(home, store, onError, reconcile = reconcileAgentHostTurn) {
+    for (const candidate of store.listRuntimeSessionCandidates({ scope: "task" })) {
+        const owner = candidate.owner;
+        if (owner.scope !== "task")
+            continue;
+        const binding = store.getTaskRoleSessionSet(owner.taskId, owner.roleName)?.providerBinding;
+        const turn = binding?.run;
+        if (binding === undefined || binding === null || turn == null || providerRetryPending(binding)
+            || !["submitting", "accepted", "delivery-unknown"].includes(turn.status)
+            || binding.authority.owner !== "controller" || binding.authority.holderId === undefined)
+            continue;
+        try {
+            const result = await reconcile({ home, ...owner, control: {
+                    protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "reconcile-turn",
+                    nativeSessionId: currentProviderConversation(binding).conversationId,
+                    attemptId: turn.attemptId, nativeTurnId: turn.nativeTurnId,
+                    authority: { epoch: binding.authority.epoch, owner: "controller", holderId: binding.authority.holderId }
+                } });
+            if (result.outcome === "rejected" || result.reconciliation === "unsupported") {
+                throw new Error(result.failure?.detail
+                    ?? "Host terminal reconciliation is unsupported; retain the original input and inspect Host/Inbox evidence.");
+            }
+        }
+        catch (error) {
+            onError(new Error(`Task Host terminal recovery ${owner.taskId}/${owner.roleName}/${turn.attemptId}: `
+                + `${error instanceof Error ? error.message : String(error)} No input was replayed.`, { cause: error }));
+        }
+    }
+}