@zq-silk/yui 0.15.11 → 0.16.0

package/docs/task-discovery.zh-CN.md

@@ -0,0 +1,85 @@
+<p align="right"><a href="./task-discovery.md">English</a> | <strong>简体中文</strong></p>
+
+# 有界任务发现
+
+Agent 使用 `yui task list --json` 发现候选任务，再读取目标
+Task Context 和原始 Message。目录是当前事实的只读视图，不是摘要数据库、
+Context 快照、消息确认、执行判断或验收结论。
+
+目录是唯一列表契约，不再提供 `--view` 选择或 `--verbose` 全历史列表。
+交互选择器保持完整的 `{id,title,status}` 数组，只读取这些窄字段。
+Web 通过 `GET /api/dashboard` 使用同一查询；单个 Task 的详情接口继续保留
+执行、观测、用量和远端交付字段。目录查询本身不改变持久记录。
+
+## 查询和分页合同
+
+```sh
+yui task list --project project-1 --status active --limit 20 --json
+yui task list --attention openInputs --json
+yui task list --search "候选标题" --json
+yui task context task-1 --json
+yui task context inspect task-1 --store task --ref task-1 --digest <digest> --json
+yui task message show task-1/message-1 --json
+```
+
+`--project` 接受精确 Project ID。搜索按 SQLite 子串匹配 ID、标题、标签和
+Project 名称：ASCII 不区分大小写，非 ASCII 字符按字面比较。缺省范围排除
+归档 Task；`--all` 或 `--status archived` 纳入归档。计数明确属于该范围，
+不泄漏不可见的全局总数。状态、搜索、Project 和关注分类只筛选 `total`
+及任务行，不缩小范围内的关注汇总。
+
+缺省每页 20 项，最多 100 项。成功 JSON 响应连同 CLI envelope 不超过
+32 KiB；摘要最多 512 UTF-8 字节，标题最多 256 字节，裁剪明确标记。
+ID、digest 和 cursor 不裁剪。必要元数据过长时返回有界错误，不成功返回
+无法前进的空页。Brief 缺失会明确显示。
+
+顺序是 `(createdAt,id)` 升序，ID 按 SQLite binary 排序。后续请求带
+`--cursor <nextCursor>`，并保留全部筛选参数和 limit。null cursor 表示结束；
+字节预算可能使实际条数少于 limit。首页固定最大匹配创建键，较新创建键
+留到刷新后读取。各页仍读取当前状态：生命周期和筛选成员变化可能影响枚举；
+这不是冻结快照，不会因为无关运行时事件而作废游标。
+
+每个任务和关注样本携带真实 Task Context ref：
+`taskId,store,refId,revision,digest`。digest 覆盖原 Task，不是裁剪预览或
+Brief。当前 Brief 通过 Task Context 读取；Context inspect 可校验 digest
+后展开原文。digest 变化会拒绝旧引用；引用不赋予权限，也不表示需求已读。
+
+## 不扫描全历史也不遗漏关注入口
+
+每页（包括筛选后无匹配的空页）都返回同一授权目录范围的当前关注事实。
+每类包括记录/信号数量、涉及 Task 数量、最多四个精确 Task ref、
+省略的 Task ref 数量，以及枚举全部相关 Task 的筛选入口：
+
+启动该关注查询时清除先前的状态、搜索、Project 筛选，并保留其 `all` 标记，
+从而保持声明的目录范围，包括此前明确纳入的归档任务。
+
+| 分类 | 当前存储事实 |
+| --- | --- |
+| `openInputs` | 未解决 InputRequest |
+| `pendingOperations` | queued/running durable Job |
+| `unknownOperations` | unknown-needs-attention Job |
+| `executionSignals` | active/draft Task 中的活跃 Run、open WorkItem 或仍含当前复制执行组的 accepted WorkItem、未解决或失败 Integration、pending/running/failed Review、Leader failure、pending/processing Leader mailbox |
+
+`executionSignals` 是保守的发现入口，**不是**详情的执行状态分类器。
+健康的活跃工作也会被包括，从而不会因为分页而藏住运行身份、停滞、
+工作失败或恢复相关的关注入口，也不必先扫描所有 Task 历史 Event。
+这些计数不是失败计数；请打开任务读取精确执行状态和来源记录。
+不解析报告正文推导状态。Web 明确标示这些事实并提供分类导航。
+已选详情不因分页、筛选或刷新而丢失；只有详情读取可以确认目标不存在。
+
+Task Leader Session 只能发现自己的 Task。Assignment-scoped Worker 和
+Reviewer 使用既有授权 Run Context，目录会在计数前拒绝其全 Task 发现请求。
+非 Operator 的 Global Session 和不完整的受管身份也会被拒绝。
+历史 Leader 的诊断读取保持原 Task 范围。游标绑定范围及参数，不是凭证。
+读取不会消费 Message、确认 Job、唤醒 Role 或查询外部 provider。
+
+## 成本边界
+
+SQLite 在现有目录及状态索引上聚合窄事实，再选取当前页。
+不会在 JavaScript 中解码全部 Task 正文、Run、Message、Event，不会先
+构造所有重型 Overview 再删字段，也不逐 Task 构造 Context。
+仅当前页和有界关注样本会解码原 Task，并计算精确 ref。
+
+输出和物化行有界；数据库工作量仍随授权 Task 和相关索引行增加，
+搜索可能在 SQLite 内检查 Task/Project JSON。精确引用仍需承担选中
+Task 原正文大小的成本。这些是本机成本边界，不是恒定时间或模型效果承诺。

package/docs/testing/verification-levels.md

@@ -25,20 +25,45 @@ and incident-specific scripts temporary. Remove their harnesses after the
 change, preserving useful reports. Real-resource results do not replace fast
 regressions, and fast regressions do not establish real-model behavior.
 
+## Coverage, not test count
+
+Keep three complementary kinds of evidence: a few normal paths through real
+entry points and component wiring; critical regressions for durable intent,
+idempotency, authority, isolation and historical storage; and cheap pure-logic
+checks for meaningful branching. A passing suite proves its assertions, not
+the absence of every bug.
+
+Pin constants that are persisted or public contracts (event names, protocol
+identifiers, historical encodings), with an independent literal expectation.
+Where possible, also prove the current reader understands migrated data.
+Do not derive expected and actual values from the same constant, or lock an
+internal default merely because it is a constant.
+
+Merge tests only when each assertion has an identified surviving scenario.
+Identical constant checks and repeated setup can be consolidated; similar
+names do not make Task and Global authority boundaries interchangeable.
+Do not target a particular test count or delete safety checks to hit a time
+budget. A temporary deliberate fault can confirm that a critical check detects
+its intended regression; no permanent mutation service or broad fault matrix
+is required.
+
 ## Permanent core smoke
 
 `npm test` and `npm run test:core` build the checkout and run one permanent suite:
 
-1. the packaged CLI starts and exposes setup/update/upgrade/Task commands;
+1. the built CLI starts and its catalog exposes setup/update/upgrade/Task commands;
 2. one normal SQLite Task and Message survive a reopen;
 3. a supported historical Home migrates through the linear storage chain to current;
 4. the built-in Codex and Claude Drivers are registered;
 5. one independent declarative plugin is created, validated, called and disabled
    through authenticated ingress, with its selection and validation preserved.
 6. a Task starts from durable Operator input, exposes planning Context and enters
-   delivery with its original intent and captured planning authority preserved.
+   delivery with its original intent and captured planning authority preserved;
+   scratch workspace release does not require a fabricated Git identity.
 7. Session replacement preserves pending original Messages and independent work;
-   old Sessions keep scoped reads but cannot regain write authority;
+   cleanup blocks new notification claims, and successor acceptance cannot
+   settle an old wake or later queued input. Old Sessions keep scoped reads
+   but cannot regain write authority;
 8. InputRequests survive Session replacement without a synthetic AgentRun;
 9. late native terminals cannot settle successor input or invent acceptance;
 10. remote Operator startup carries its reserved workspace, Role instructions
@@ -61,6 +86,9 @@ regressions, and fast regressions do not establish real-model behavior.
 16. explicit force archive commits before cleanup and preserves uncertain
     delivery/runtime evidence; partial cleanup and late results remain traceable,
     while archived runtime resources never become automatically safe to delete.
+    Archive preflight preserves durable records and the Git index, distinguishes
+    frozen-result differences, and cleanup rechecks moved heads, owner branches
+    and new dirt. Read-only Git status never executes configured clean filters.
 17. Host facts reach the existing Inbox even when its compiled store cannot
     read the Home; Controller-side fencing, ACK-loss replay, and legacy-Host
     upgrade refusal preserve the original execution. A frozen independent v1
@@ -73,16 +101,117 @@ regressions, and fast regressions do not establish real-model behavior.
     pre-fix released Hosts can be hot-patched.
     Archive racing Host ingress retains the complete source envelope without
     reopening the Task or settling original uncertain input.
+18. Project maintenance waiters yield to the holder, use a shared 60-second
+    monotonic budget with independent 200–500ms jitter, and cancel on Controller
+    stop without losing activation intent. Disposable lock/SQLite/Git fixtures
+    cover exclusion, partial release and under-lock revalidation; injected time
+    checks the minute-long deadline without sleeping for a minute. Competing
+    activations each adopt their own workspace without replaying Git work.
+19. Task usage distinguishes zero, partial and unknown across exact requests,
+    cumulative baselines, Session replacement and native child overlap. A small
+    event fixture checks direct Leader/parallel time semantics and the shared
+    CLI/Web/audit lifetime projection without collecting Provider data.
+20. explicit cleanup releases retained terminals without affecting other Tasks
+    or claiming that live resources are gone; Controller replacement waits for
+    the old process to exit.
+21. structured verification preserves argv, explicit shell failure, environment
+    and workspace-relative cwd through the actual RPC parser and both local
+    executors. Corrected execution semantics invalidate old gate reuse without
+    rewriting historical artifacts or migrations.
+22. concurrent resource registration preserves unrelated rows and rejects
+    stale same-record writes; GC closes owned connections on success/failure.
+23. Context counts, exact inspection and bounded event deltas work without
+    materializing complete history or acquiring a writer lock. Telemetry
+    ingestion yields to the event loop and drains its worker on close.
+24. Release resume re-queries uncertain effects, retains confirmed work and
+    refuses exhausted grants, using disposable SQLite and fake external ports.
+    These checks do not claim validation of real release services.
+25. The pre-1.0 contract cleanup normalizes old singleton dispatches only through
+    explicit storage migration. Unsupported CLI/ACP input, unregistered development
+    links, unpinned release identities and unsupported quarantine receipts are
+    refused without inventing acceptance or discarding evidence. Current link,
+    configuration and quarantine operations remain usable.
+26. Activation refuses absent intent before resource adoption and still honors
+    planning deferral and cancellation. Retiring the integration queue preserves
+    exact records and active attempts in one rollback-safe migration, without
+    inventing delivery. Conflicted Integrations remain completion blockers.
+27. Unknown lock ownership stays fenced, including unavailable OS evidence.
+    PR lookup distinguishes absence, malformed/ambiguous results and transport
+    failure through injected ports. Receipt-free Git operations remain unchanged,
+    while normal receipt-backed continuation still works. Notification-only
+    migration preserves current delivery and audit history and refuses live links.
+28. SQLite admission ignores unrelated side files but refuses a non-empty Home
+    without its database. Default CLI/HTTP discovery stays bounded and retains
+    off-page Task detail; unknown writer leases diagnose without mutation.
+    Review migration preserves candidate evidence while making scope explicit.
+29. Missing authoritative readers fail before Provider preparation or queue
+    admission instead of becoming empty evidence. WorkItem history retirement
+    preserves the original payload and current work, advances event IDs safely,
+    and refuses unknown old shapes without advancing the migration ledger.
+30. WorkItem overlap is a read-only advisory; exact permission/dependency guards
+    remain. Real local verification proves default reuse, explicit rerun failure,
+    incomplete evidence and stale-consumer rejection through the current proof path.
+    An Integration rerun cannot bypass an equivalent unfinished gate. Policy
+    migration preserves historical execution and blocks an admitted old gate.
+31. Message edits preserve submission intent and immutable request identity;
+    no-op edits do not enqueue work, and an edited develop request cannot create
+    a planning Run. Unkeyed discussions still plan after activation is resolved.
+    Queue identity remains frozen through an interrupt-then handoff; completion sees explicitly
+    queued input. Input migration preserves raw audit evidence, refuses to
+    auto-authorize old pending immediate activations and keeps the prior ledger.
+    The actual Controller continues admitted requests but not cancellations.
+    Required Store reads fail before config mutation or full-scan fallback.
+    Explicit Job requests replay one operation and reject changed or missing keys.
+32. Worker Job admission/management and the pre-spawn gate reject a different
+    owner/workspace; legitimate Worker and Leader Jobs remain usable. Candidate
+    mutation blocks publication of reusable success, including after explicit
+    abort/retry. Upstream wiring returns its admitted Job and continuation IDs.
+    Plugin replacement retains delayed old-generation cleanup errors without
+    undoing a newer selection. A shared validator rejects bad record writes,
+    ordinary/Context reads and full-Home health checks without repairing data.
+33. Built CLI calls refuse replaced Operator writes, Task-owned Home mutations
+    and foreign-Task queries while retaining legitimate reads and current
+    Operator actions. Job reads enforce Context scope at the Controller port.
+    Real local runtime directories move once through quarantine/restore/purge;
+    current durable ownership overrides a stale cleanup plan and prevents
+    purging a reopened Task.
+34. Current CLI rejects `task turn`; completion has one identity and preserves
+    unrelated shell content through install/uninstall. GC protects exact live
+    SQLite Session custody without consulting old JSON. The 34→35 cutover
+    preserves raw retired payloads/log bytes and identity counters, blocks
+    unsettled gates/custody, and rolls back malformed conversions.
+35. Native model aliases/resolved IDs and open custom-model fields retain their
+    distinct contracts; configuration errors display the observed choices.
+    Rejected Leader startup stays quiet across Store reopen and repeated passes,
+    preserves original/later input and blocks premature completion. Explicit
+    retry requeues the exact rejected claim once without rewriting its history;
+    typed contention remains retryable and unknown acceptance cannot be replayed.
+36. Failure-scoped capability reads preserve the recorded model/workspace/settings
+    selection after Role edits, reject changed Agent bindings, honor explicit
+    metadata refresh and identify cached fallback. The Controller supplies native
+    account context without accepting caller credentials. Task/Role/record reads
+    stay fenced. Runless startup and native rejection reuse one error/notification.
+    Migration 35→36 preserves historical error bytes and the earlier ledger while
+    marking absent historical configuration unavailable, never reconstructing it.
+37. Narrow failure context survives independently of execution/Review/Session
+    protocols; 36→37 preserves the original snapshot in audit. Repeated native
+    submission rejection creates one error and one supervisor notice through
+    the shared writer. A small injected cache proves completed-result eviction,
+    pending-request coalescing, explicit refresh and truthful cache provenance.
 
 Keep the test phase seconds-scale; measure TypeScript build separately. Record
 incremental runtime when adding a critical regression. The seven recovery boundary
 cases initially add about 0.4 seconds of test bodies (about 0.6 seconds standalone,
-including module startup) on the development host. Avoid sleep-based checks or
-mandatory model/daemon launches in the permanent suite.
+including module startup) on the development host. Keep real-model launches out
+of this suite. Real tmux/CLI lifecycle checks belong to the bounded package smoke
+below, not a second core daemon matrix.
 The Integration continuation regressions use disposable Git repositories,
 SQLite and fake Jobs, without a provider or shared Home. Their test bodies
 take about 3 seconds on the development host; validation settlement adds
 about 1.4 seconds to the initial 1.5-second coverage.
+Archive preflight adds three small disposable Git/SQLite scenarios (about
+one second of test bodies); broader owner/diagnostic combinations remain
+temporary validation evidence, not a second permanent matrix.
 
 ## Skill and instruction changes
 
@@ -99,10 +228,25 @@ do not add prose-matching tests or claim model validation from static checks.
 
 ## CI and release
 
-`ci.yml` runs the core smoke plus one package-assembly/start check. It does not
-run a second lint pass or a separate broad regression suite. `publish.yml` reuses that
-exact gated commit and adds only tag, artifact, install, and provenance checks
-that are unique to publishing.
+`ci.yml` builds once and runs core plus one assembled-package normal-path smoke
+on every PR, without another lint or broad regression suite.
+`node scripts/smoke-runtime-package.mjs --assembled .release-stage` exercises
+the actual CLI/Controller/Host/SQLite and isolated tmux, replacing only the
+external Provider with a deterministic fixture. It covers setup, durable input
+and idempotency across restart, scratch activation, native result ingestion,
+completion preserving the conversation, and archive releasing live/dead panes
+and grouped viewers without affecting a similarly named neighboring session.
+The fixture owns a fresh Home and its PATH, installs cleanup before setup,
+and never calls an installed model Agent.
+
+`publish.yml` runs the same smoke against the freshly installed package through
+`YUI_INSTALLED_ROOT`, adding actual npm-bin, dependency, supported Node version,
+artifact and provenance boundaries. This validates runtime integration, not
+real-model behavior. Pure contract and safety tests remain in `test/core`;
+production wiring is exercised here rather than only through mocked ports.
+The package smoke also checks unconditional status identity and update-owned
+resource/identity capture through the assembled package, without an installation
+or publication effect.
 
 Configured Agents acting as developers or reviewers are ordinary execution
 resources. Using a live provider or model as the subject of validation is
@@ -110,3 +254,11 @@ different: paid APIs, shared Homes, production systems, real account quota, and
 other non-disposable external effects are never implied by a request to test or
 validate. They require an explicit user request for the exact resource and
 effect boundary.
+
+For authorized real-model probes, distinguish native acceptance, exact Turn
+completion and independently checked work (files, tests, commits and Task
+facts). A missing echo marker is not a functional failure. After Session
+replacement, verify the successor read the original input and correlate its
+own terminal; do not require every historical wake to receive that terminal.
+Check normal completion/archive before stopping execution, since stop/cancel
+cleanup is a different path. Preserve these evidence distinctions in the report.

package/docs/testing/verification-levels.zh-CN.md

@@ -18,19 +18,34 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 完成后移除它们的 harness，并保留有用的报告。真实资源结果不替代快速回归，快速回归也
 不确立真实模型行为。
 
+## 关注覆盖，而不是测试数量
+
+保留三类互补证据：经过真实入口和组件组装的少量正常链路；保护持久意图、幂等、权限、
+隔离和历史存储的关键回归；覆盖有意义分支的低成本纯逻辑检查。全绿证明断言成立，
+不证明不存在任何缺陷。
+
+持久化或公开契约中的常量值得固定，例如事件名、协议标识和历史编码；保留独立字面值
+期望，并尽量证明当前读取逻辑能理解迁移后的数据。不要让预期值和实际值都来自同一个
+常量，也不因内部默认值是常量就锁死它。
+
+合并测试前，明确每项断言由哪个保留场景继续保护。相同常量检查和重复初始化可以合并，
+但名称相似不代表 Task 与 Global 权限边界可互相替代。不以数量为目标，也不为耗时
+预算删除安全检查。可临时引入明确错误来确认关键检查能拦截对应回归，无需永久变异
+测试服务或宽泛故障矩阵。
+
 ## 永久 core smoke
 
 `npm test` 和 `npm run test:core` 构建 checkout 并运行一个永久套件：
 
-1. 打包后的 CLI 能启动，并暴露 setup/update/upgrade/Task 命令；
+1. 构建后的 CLI 能启动，命令目录暴露 setup/update/upgrade/Task 命令；
 2. 一个普通的 SQLite Task 和 Message 能在重开后存活；
 3. 一个受支持的历史 Home 沿线性存储链迁移到当前版本；
 4. 内置的 Codex 与 Claude Driver 已注册；
 5. 一个独立的声明式插件通过认证入口被创建、验证、调用和停用，其选择和验证被保留。
 6. 一个 Task 从持久的 Operator 输入启动，暴露规划 Context，并在原始意图和捕获的
-   planning 权限被保留的情况下进入交付。
-7. Session 替换保留待处理的原始 Message 和独立工作；旧 Session 保留范围受限的读取，
-   但不能重获写权限；
+   planning 权限被保留的情况下进入交付；scratch 工作区释放不要求虚构 Git 身份。
+7. Session 替换保留待处理的原始 Message 和独立工作；清理期间不领取新通知，后继接受
+   不会结算旧 wake 或后到输入。旧 Session 保留范围受限的读取，但不能重获写权限；
 8. InputRequest 在没有合成 AgentRun 的情况下经受 Session 替换；
 9. 迟到的原生终态不能结算后继输入或编造接受；
 10. 远程 Operator 启动携带其保留工作区、Role 指令和范围受限的 CLI 身份，同时离线
@@ -46,7 +61,9 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 15. 普通 Integration 冲突可直接继续；准确 Git 与 Job 证据恢复中断交付，
     不重放已执行的步骤，也不把已发生的 CAS 与新的验证条件混为一谈。
 16. 明确授权的 force archive 先提交归档，再独立记录清理；不确定输入与晚到
-    结果仍可追溯，归档不使保留资源自动变得可删除。
+    结果仍可追溯，归档不使保留资源自动变得可删除。归档预检不改变持久记录或
+    Git index，区分冻结结果差异；清理重查 HEAD、owner 分支和新增脏状态。
+    只读 Git 状态检查不执行配置的 clean filter。
 17. 即使 Host 编译版本的存储代码无法读取 Home，事实仍先进入现有 Inbox；
     Controller 侧归属校验、ACK 丢失重放和 legacy Host 升级拒绝保护原始执行。
     独立冻结的 v1 协议生产者在真实 19→22 迁移前后保持同一进程，通过新 discovery
@@ -54,10 +71,84 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
     在不向 Session 环境导出 Run ID 的前提下保留 scoped 启动证据。该 fixture 代表最低
     支持的新线协议，不声称已发布的修复前 Host 可以原地热更新。
     归档与 Host 消费交错时保留完整来源 envelope，不重新打开 Task 或结算原不确定输入。
+18. Project 维护锁等待不阻塞持锁者，使用共享的 60 秒单调时钟预算与每次独立的
+    200–500ms 随机间隔；Controller 停止时取消等待，不丢失激活意图。
+    可丢弃锁、SQLite 和 Git fixture 覆盖排他、部分锁释放及取锁后重校验，
+    注入时钟验证一分钟截止逻辑，不实际等待一分钟；竞争激活各自采用工作区，
+    不重放 Git 操作。
+19. Task 用量在精确请求、累计基线、Session 替换和原生子执行重叠下区分真实零、
+    部分与未知。小型事件 fixture 覆盖直接 Leader/并行耗时，以及 CLI/Web/audit
+    共享的全生命周期投影，不采集 Provider 数据。
+20. 明确清理释放保留终端、不影响其他 Task、不把存活资源报告为已释放；
+    Controller 替换确认旧进程退出。
+21. 结构化验证经过实际 RPC 解析器和两种本地执行器，保持 argv、显式 Shell 失败、
+    环境和工作区相对 cwd 的语义。修正执行契约后不再复用旧结果，不重写历史证据或迁移。
+22. 并发资源登记保留无关记录、拒绝覆盖已变化的同一记录；GC 在成功和失败时关闭自有连接。
+23. Context 计数、原文查阅和事件分页不全量加载历史、不获取写锁；遥测写入让出事件循环，
+    关闭时排空自有 Worker。
+24. Release 使用临时 SQLite 和 fake 外部端口检查不确定效果查询、已确认步骤复用、
+    grant 次数耗尽；不宣称真实发布服务已验证。
+25. 1.0 前的契约清理只通过显式迁移规范化旧单条调度批次；拒绝旧 CLI/ACP 输入、
+    未登记开发链接、未固定 release 身份与不受支持的 quarantine 回执，不编造接受或
+    丢弃证据。当前链接、配置和隔离资源恢复仍可用。
+26. 激活在资源采用前拒绝缺失请求，仍保留规划延后与取消边界。集成队列退役通过可回滚的
+    单次迁移保留完整记录及活动尝试，不编造交付；冲突中的 Integration 仍阻止完成。
+27. owner 或 OS 身份不明时锁仍保持围栏；PR 查询通过注入端口区分不存在、格式错误、
+    歧义及传输失败。无回执的 Git 操作保持原样，正常回执续作仍可用。通知格式迁移保留
+    当前投递和审计历史，并拒绝活动执行引用。
+28. SQLite 准入不受无关旁路文件覆盖，缺少数据库的非空 Home 仍拒绝初始化。
+    CLI／HTTP 默认目录有界，页外详情继续可读；未知 writer lease 只诊断不修改。
+    Review 迁移保留候选证据并显式写入 scope。
+29. 核心读取缺失时，在 Provider 准备及消息入队前失败，不将缺失接口当作空证据。
+    WorkItem 历史状态退役保留完整原文和当前工作，安全递增 Event ID，
+    未知旧形态不推进迁移账本。
+30. WorkItem 重叠仅作只读建议，权限和依赖保护不变。实际本地检查验证默认复用、
+    显式重跑失败、未完成证据与过期消费者拒绝，覆盖现行证明路径；
+    Integration 重跑不能绕过等价未完成验证。模式迁移保留历史执行，并阻止切换
+    已接纳的旧验证。
+31. Message 编辑保留提交意图和不可变请求身份；相同正文更新不排队，develop 编辑
+    不创建 planning Run。激活解除后，未绑定请求身份的讨论仍可进入规划；queue 请求
+    身份在 interrupt-then 交接后仍冻结。完成检查仍能看到显式排队的输入。输入迁移保留
+    原始审计证据和旧账本，不擅自授权旧 pending immediate 激活。实际 Controller
+    接纳当前已授权请求，但不恢复已取消请求。缺失 Store 读取在配置写入或全量扫描
+    前失败。显式 Job 请求复用同一操作，拒绝不同输入和缺失请求键。
+32. Worker Job 的准入、管理和启动前检查拒绝其他 owner／工作区，同时保留合法
+    Worker 与 Leader 操作。候选被改写时不能发布可复用成功，显式放弃后重试也不
+    借用旧绿灯。Upstream 返回已接纳 Job 和精确续作 ID。插件多次替换后仍记录迟到的
+    旧实例清理失败，不回滚新选择。共享校验拒绝无效写入、普通／Context 读取和全
+    Home 健康检查，不自动修补数据。
 
 把测试阶段保持在秒级；单独度量 TypeScript 构建。新增一个关键回归时记录其增量运行
 时长。这七个恢复边界用例在开发主机上最初约增加 0.4 秒的测试体（独立运行约 0.6 秒，
-含模块启动）。避免在永久套件中使用基于 sleep 的检查或强制的模型/daemon 启动。
+含模块启动）。真实模型调用不进入该套件；真实 tmux/CLI 生命周期由下面有界的
+package smoke 覆盖，不在 core 中维护第二套 daemon 矩阵。
+归档预检新增三个可丢弃 Git/SQLite 场景，测试体约一秒；更广的 owner/诊断组合
+保留为临时验证证据，不形成第二套永久矩阵。
+
+新增的入口与 GC 回归还验证：实际 CLI 拒绝旧 Operator 写入、Task 角色修改
+Home 设置和跨 Task 查询，同时保留正常读取与当前 Operator 操作；
+Job 读取在 Controller 入口执行 Context 范围检查。真实本地 runtime 目录
+只移动一次，隔离、恢复与清除可闭环；最新持久所有权优先于旧清理计划，
+Task 重新打开后不能被 purge。
+
+当前合同回归还覆盖：拒绝 `task turn`，单一补全身份在安装／卸载后保留无关
+shell 内容；GC 读取精确的 SQLite Session 归属而不读取旧 JSON；`34→35` 保留
+退休 payload、日志字节和身份计数，阻止未结算 gate／旧归属，并完整回滚无效转换。
+
+启动回归验证原生模型别名、实际 ID 与开放自定义模型字段各自的合同，并在模型配置
+拒绝时显示观测到的选项。Leader 启动被拒绝后，多次调度与重开 Store 不再产生尝试，
+原始及后续输入保留并阻止提前完成；显式重试仅将精确拒绝批次重新排队，不改写历史。
+明确的资源争用仍可重试；已接受或接受状态未知的通知不能重放。
+
+失败配置查询在 Role 修改后仍保留原模型、工作区与 settings 选择，拒绝已改变的
+Agent 绑定，支持显式刷新并标明缓存。Controller 提供原生账户环境，不接收调用方
+凭据；Task、Role 与具体错误记录的读权限仍受约束。无 Run 启动失败与原生拒绝
+复用一份错误和通知。`35→36` 保留历史错误字节和旧账本，把未记录配置标为不可用，
+不猜测补齐。
+
+精简失败上下文不再依赖执行、Review 或 Session 协议；`36→37` 把原快照留在审计中。
+重复原生提交拒绝通过共同写入入口只产生一个错误和一条上级通知。小容量注入测试
+验证结果淘汰、进行中查询合并、显式刷新以及真实的缓存来源标记。
 
 ## Skill 与指令变更
 
@@ -71,10 +162,26 @@ package-start 检查跟随已安装树中的本地 Skill 引用，包括跨 Role
 
 ## CI 与发布
 
-`ci.yml` 运行 core smoke 加一个包装配/启动检查。它不运行第二遍 lint，也不运行单独的
-宽泛回归套件。`publish.yml` 复用那个确切的、已过门的提交，只增加发布独有的 tag、
-产物、安装和 provenance 检查。
+`ci.yml` 在每个 PR 上构建一次，运行 core 及一个组装包正常链路检查，不重复 lint，
+也不增加宽泛回归套件。
+`node scripts/smoke-runtime-package.mjs --assembled .release-stage` 经过真实
+CLI/Controller/Host/SQLite 与隔离 tmux，仅用确定性夹具替换外部 Provider。它验证
+setup、输入跨重启持久化及幂等、scratch 激活、原生结果入库、完成后保留会话，以及
+归档释放活/死 pane 和附属查看 session，且不影响相似名称的相邻 session。
+夹具拥有新建 Home 和独立 PATH，在 setup 前建立清理责任，不调用安装的真实模型 Agent。
+
+`publish.yml` 通过 `YUI_INSTALLED_ROOT` 对刚安装的包执行同一个 smoke，增加真实
+npm bin、依赖、受支持 Node 版本、产物和 provenance 边界。这证明运行时集成，不证明
+真实模型行为。纯契约与安全检查保留在 `test/core`，生产组件组装在这里验证，
+不只依赖模拟端口。
+组装包检查还验证固定身份输出，以及升级侧通过组装包采集资源和精确 Controller 身份，
+不执行安装或发布效果。
 
 作为开发者或审查者的已配置 Agent 是普通执行资源。把一个真实 provider 或模型作为验证
 对象则不同：付费 API、共享 Home、生产系统、真实账号额度以及其他不可丢弃的外部效果，
 绝不由一个测试或验证请求隐含。它们需要用户就确切的资源和效果边界提出显式请求。
+
+获授权的真实模型检查应区分原生接受、精确 Turn 完成，以及独立核验的文件、测试、
+提交和 Task 事实。缺少固定回显标记不是功能失败。Session 替换后，核验新会话读取
+原输入，并关联它自己的终态，不要求每个历史 wake 都收到该终态。正常完成与归档
+应在停止执行之前检查，stop/cancel 清理是另一条路径。报告须保留这些证据区别。

package/i18n/README.zh-CN.md

@@ -27,7 +27,7 @@ Yui 是面向编程 Agent 的本地控制面。你只需用自然语言把目标
 - **自带 Agent** —— Codex CLI、Claude Code CLI 和 ACP 通过统一边界接入，
   可替换而不丢失 Task。
 - **本地优先、私有** —— 一切运行在你自己的机器上，面向单个受信任用户；
-  Web 视图仅本地回环、只读。
+  Web 仅本地回环，包含只读视图和经认证的用户控制。
 - **默认隔离** —— 仓库改动发生在受管 Git worktree 中，稳定 checkout 保持只读。
 
 > **状态：** 尚未发布 1.0（0.15.x）。CLI 与配置在版本之间仍可能变化；每次升级
@@ -122,7 +122,10 @@ Agent 可以重新读取任务上下文，继续兼容的 Session，或在必要
 进程失败不会抹掉任务，结果不确定的投递也不会被静默重复。
 
 想直观看进展，可以在另一个终端运行 `yui web`。本地 Web 展示同一份任务与
-待回答问题，不是另一套需要同步的任务系统。
+待回答问题，也允许发送消息、回答问题，以及显式 queue、steer 或 interrupt Task 输入。
+这些经认证的 Task 控制复用 CLI 的相同操作，不是另一套需要同步的任务系统。
+详见 [Web 权限](../docs/architecture/capabilities-and-resources.zh-CN.md#cli-与-web)
+和[输入时机](../docs/managed-turn-and-session-runtime.zh-CN.md#输入时机queuesteer-与-interrupt)。
 
 ## 架构
 
@@ -225,7 +228,7 @@ Yui 为你组织的东西 —— 是持久对象，而不是进程：
      它负责搬运工作、记录事实——但从不判断回答好坏
 
   Agent 在 Project 中工作：只读 checkout + 隔离 worktree。
-  Web 视图（yui web）：对存储的本地回环、只读投影。
+  Web（yui web）：本地回环视图 + 经认证的用户控制。
 ```
 
 ### 分层设计
@@ -234,7 +237,7 @@ Yui 为你组织的东西 —— 是持久对象，而不是进程：
 
 ```text
   体验层 Experience   —  你如何交互
-    CLI（Operator）· Web（本地回环、只读）· 原生 Agent 会话
+    CLI（Operator）· Web（本地回环、经认证）· 原生 Agent 会话
     采集输入 · 展示事实 · 确认操作 · 调用能力
         ▼
   决策层 Intelligence —  谁来决定
@@ -270,9 +273,12 @@ Yui 为你组织的东西 —— 是持久对象，而不是进程：
   WorkItem  open ─▶ accepted ─▶ retired
 
   Draft 只保存规划；激活后才采用交付工作区。
-  归档需要工作已了结、worktree 干净，且不可重新打开。
+  普通归档需要工作已了结、worktree 干净，且不可重新打开。
 ```
 
+明确授权的 force 归档可以保留未解决证据与不安全资源；它不证明交付，也不授权删除
+这些资源。详见[归档合同](../docs/task-delivery.zh-CN.md#归档)。
+
 ## 设计原则
 
 ### Agent 做判断，Yui 保存工作事实
@@ -321,8 +327,8 @@ Yui 面向一个受信任本地用户，不是 OS 沙箱，也不是远程多用
 
 ## 深入了解
 
-[总体架构](../ARCHITECTURE.md)介绍端到端设计，
-[文档导航](../docs/architecture/README.md)提供配置、执行、交付、存储和插件的
+[总体架构](../ARCHITECTURE.zh-CN.md)介绍端到端设计，
+[文档导航](../docs/architecture/README.zh-CN.md)提供配置、执行、交付、存储和插件的
 当前合同。想直接操作 CLI 时，使用 `yui --help` 查看命令。
 
 Yui 默认将控制面数据保存在 `~/.yui`，通过 `YUI_HOME` 选择另一个实例。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.15.11",
+  "version": "0.16.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -47,6 +47,11 @@ These are instruction routes, not new lifecycle states or a scheduling
 protocol. Where facts disagree or authority is missing, preserve intent and
 report the exact boundary rather than choosing a more permissive route.
 
+Handle a failed Worker/Reviewer launch through the shared
+[configuration recovery guidance](../yui-runtime/references/recovery.md#configuration-and-model-name-failures).
+Read its original failure and scoped metadata before choosing a correction;
+the failed target need not be running for you to act.
+
 ## Maintain useful durable context
 
 The DB Brief is the current summary, not a full plan or a history of messages.

package/skills/yui-leader/references/execution.md

@@ -327,8 +327,9 @@ reachable issues to the original execution owner. Fix a small Task-main issue
 directly; create a Repair WorkItem only when the repair is itself a substantial
 independently owned requirement.
 
-A failed ReviewRound is an execution failure, not an automatic retry or repair
-wave. Inspect its exact Round, AgentRun, candidate, Core failure, and
+A failed ReviewRound is an execution failure, not a repair wave. First read
+its Provider retry projection: bounded infrastructure recovery may already own
+the successor. Otherwise inspect its exact Round, AgentRun, candidate, Core failure, and
 `task next-action` facts, then choose the smallest recovery that preserves the
 frozen boundary. Do not invent a retry loop or silently replace the Reviewer
 Session. For replicated execution, choose whether to retry a failed Producer,

package/skills/yui-leader/references/integration.md

@@ -5,11 +5,10 @@ notification. Inspect the original result, diff, checks and exact Candidate.
 If insufficient, return bounded feedback to the owning WorkItem/Role while
 its scope remains valid.
 
-For acceptable isolated Git changes, capture and integrate the latest Candidate
-before acceptance:
+For acceptable isolated Git changes, inspect the latest Candidate's committed
+Git snapshot and integrate it before acceptance:
 
 ```sh
-yui task work capture <work-id>
 yui task integration start <task> --project <project> \
   --work-item <work-id> --strategy <ff|cherry-pick|merge|manual> \
   --check "<Project Policy command>"
@@ -17,6 +16,11 @@ yui task work accept <work-id> --summary "<decision and evidence>"
 ```
 
 These are distinct decisions; confirm Integration succeeded before acceptance.
+ChangeSet capture is optional diff evidence, not a prerequisite for this operation.
+Choose the order and strategy for each result from current Task facts, then call
+one Integration at a time for the same target. There is no ChangeSet merge queue
+or queue processor. Core checks the exact source, checks and target update;
+the Agent owns sequencing and recovery decisions.
 Preserve each managed workspace's owner and the Task's recorded base. Do not
 silently advance that base because a remote branch moved.
 
@@ -45,8 +49,8 @@ the final target update. Read the terminal result, then use:
 yui task integration continue <task>/<integration>
 ```
 
-This also applies when no manual conflict resolution was needed. Do not start
-a duplicate Integration or wait for an empty queue to finalize it.
+This also applies when no manual conflict resolution was needed. Continue the
+same attempt; do not start a duplicate Integration to consume its Job result.
 
 Resume interrupted Git/Job work on this attempt when its source/candidate and
 Job identities can be proved. A clean HEAD, leftover REBASE_HEAD or successful

package/skills/yui-leader/references/planning.md

@@ -51,9 +51,15 @@ and historical Runs/Sessions count even when no Session is currently busy.
 “Manual activation” means an explicit user action, not that the user must type
 CLI commands: an authorized Operator can perform the mechanical operation.
 
-With that authorization, use the formal supported activation operation
-(`task activate <task-id>`) within the caller's authority, or have the Operator
-perform it. Inspect the observable result. Preserve a busy or unknown
+With that authorization, inspect any existing activation request before creating
+one with `task activation request <task-id> --request-id <id> --environment <plan>`.
+Choose the plan from the authorized resources; retain the request id for retries.
+The Controller adopts an eligible request. `task activate <task-id>` is the
+foreground adoption operation for an existing request, not a request-free shortcut.
+A planning Session requests activation and finishes its turn; it must not
+synchronously wait for its own native turn to become quiescent.
+
+Inspect the observable result. Preserve a busy or unknown
 operation's exact request and follow
 [Runtime recovery](../../yui-runtime/references/recovery.md); do not
 self-dispatch, interrupt, kill or replace a Session to bypass the handoff.