@zq-silk/yui 0.15.12 → 0.16.0

package/ARCHITECTURE.md

@@ -93,8 +93,9 @@ meaning of the report. See [result consumption](docs/agent-result-consumption.md
 ## Planning, workspaces and resources
 
 Draft contains planning facts and Project bindings, not an adopted delivery
-workspace. Its private planning directory is outside the control Home and
-delivery trees. Planning Sessions capture `planning` authority. The Leader can
+workspace. Its private planning directory is under
+`<YUI_HOME>/runtime/task-runtimes/planning`, separate from durable control data
+and delivery trees. Planning Sessions capture `planning` authority. The Leader can
 persist an activation request during a Run or ordinary discussion and return;
 native quiescence releases the intent for current-authority and resource checks.
 

package/ARCHITECTURE.zh-CN.md

@@ -72,8 +72,9 @@ Reviewer 输出留在那个 Run 上。审查策略和显式的 Task-final 合同
 
 ## 规划、工作区与资源
 
-Draft 包含规划事实和 Project 绑定，而不是一个已采用的交付工作区。它私有的规划目录在
-控制 Home 和交付树之外。规划 Session 捕获 `planning` 权限。Leader 可以在一个 Run 或
+Draft 包含规划事实和 Project 绑定，而不是一个已采用的交付工作区。它私有的规划目录位于
+`<YUI_HOME>/runtime/task-runtimes/planning`，与持久控制数据和交付树分开。
+规划 Session 捕获 `planning` 权限。Leader 可以在一个 Run 或
 普通讨论中持久化一个激活请求并返回；原生静止会把该意图释放出来，进行当前权限和资源
 检查。
 

package/dist/artifacts/artifactCommitLock.js

@@ -1,5 +1,6 @@
 import { mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { currentFileLockOwner, fileLockOwnerIsLive } from "../core/fileLockOwner.js";
 /**
  * Short per-Task commit fence for artifact repositories.
  *
@@ -9,9 +10,9 @@ import { join } from "node:path";
  * into the wrong commit, or race the expected-HEAD check. This fence serializes
  * the commit critical section for one Task.
  *
- * Unlike the Project maintenance fence (which guards long operations and fails
- * fast so the CLI is not blocked), an artifact save is a short operation, so a
- * contended fence briefly RETRIES before giving up. It is otherwise the same
+ * The Project maintenance fence waits asynchronously for longer operations.
+ * An artifact save is short, so this synchronous critical section briefly
+ * retries a contended fence before giving up. It otherwise shares the same
  * crash-safe design: an exclusive directory under the Home's `locks/` area
  * (O_EXCL via mkdir), an owner file recording PID + process start time so a
  * recycled PID can never pass for the original holder, and reclaim of a stale
@@ -47,12 +48,13 @@ export function artifactCommitLockPath(home, taskId) {
  */
 export function acquireArtifactCommitLock(home, taskId) {
     const lock = artifactCommitLockPath(home, taskId);
+    const ownerIdentity = currentFileLockOwner();
     mkdirSync(join(home, "locks", "task-artifacts"), { recursive: true, mode: 0o700 });
     const deadline = Date.now() + ARTIFACT_COMMIT_LOCK_TIMEOUT_MS;
     while (true) {
         try {
             mkdirSync(lock, { mode: 0o700 });
-            const ownerIdentity = writeOwnerIdentity(lock);
+            writeOwnerIdentity(lock, ownerIdentity);
             let released = false;
             return () => {
                 if (released)
@@ -72,8 +74,7 @@ export function acquireArtifactCommitLock(home, taskId) {
     }
 }
 /** Write this process's owner identity and return the exact bytes recorded. */
-function writeOwnerIdentity(lock) {
-    const identity = `${process.pid}:${processStartIdentity() ?? ""}`;
+function writeOwnerIdentity(lock, identity = currentFileLockOwner()) {
     writeFileSync(join(lock, "owner"), `${identity}\n`, { mode: 0o600 });
     return identity;
 }
@@ -109,8 +110,8 @@ function reclaimStaleArtifactCommitLock(lock) {
     catch (error) {
         if (!isEnoent(error))
             throw error;
-        // Ownerless lock: a crash between mkdir and owner publication. Reclaim only
-        // when old enough that the creator is not still initializing.
+        // Allow publication its initial grace period; an older missing owner is
+        // diagnosed as unverified below, never treated as a dead creator.
         try {
             if (Date.now() - statSync(lock).mtimeMs < STALE_ARTIFACT_COMMIT_LOCK_AGE_MS)
                 return;
@@ -131,7 +132,7 @@ function reclaimStaleArtifactCommitLock(lock) {
             return;
         throw error;
     }
-    if (expectedOwner !== null && lockOwnerIsAlive(lock))
+    if (fileLockOwnerIsLive(lock))
         return;
     const reclaimLock = `${lock}.reclaim`;
     for (let attempt = 0; attempt < 2; attempt += 1) {
@@ -171,7 +172,7 @@ function reclaimStaleArtifactCommitLock(lock) {
             }
             if (currentOwner !== expectedOwner)
                 return;
-            if (currentOwner !== null && lockOwnerIsAlive(lock))
+            if (fileLockOwnerIsLive(lock))
                 return;
             rmSync(lock, { recursive: true, force: true });
         }
@@ -182,63 +183,23 @@ function reclaimStaleArtifactCommitLock(lock) {
     }
 }
 /**
- * Reclaim a reclaim-lock directory only when provably orphaned: dead (or
- * unrecorded) owner AND older than the age bound. Returns true when it removed
+ * Reclaim a reclaim-lock directory only with a proven dead generation and
+ * after the age bound. Returns true when it removed
  * the lock (caller retries), false otherwise.
  */
 function reclaimOrphanedReclaimLock(reclaimLock) {
     try {
         if (Date.now() - statSync(reclaimLock).mtimeMs < STALE_ARTIFACT_COMMIT_LOCK_AGE_MS)
             return false;
-        if (lockOwnerIsAlive(reclaimLock))
+        if (fileLockOwnerIsLive(reclaimLock))
             return false;
         rmSync(reclaimLock, { recursive: true, force: true });
         return true;
     }
-    catch (error) {
-        return isEnoent(error);
-    }
-}
-function lockOwnerIsAlive(lock) {
-    let owner;
-    try {
-        owner = readFileSync(join(lock, "owner"), "utf8").trim();
-    }
     catch (error) {
         if (isEnoent(error))
-            return false;
-        return true; // Unreadable owner fails closed: treat the fence as held.
-    }
-    const separator = owner.indexOf(":");
-    const pid = Number.parseInt(separator < 0 ? owner : owner.slice(0, separator), 10);
-    if (!Number.isInteger(pid) || pid <= 0)
-        return false;
-    const recordedIdentity = separator < 0 ? "" : owner.slice(separator + 1);
-    const currentIdentity = processStartIdentity(pid);
-    if (currentIdentity !== undefined) {
-        return recordedIdentity !== "" && currentIdentity === recordedIdentity;
-    }
-    return processIsAlive(pid);
-}
-/** Linux process start time (clock ticks since boot) for a PID; undefined off /proc. */
-function processStartIdentity(pid = process.pid) {
-    try {
-        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
-        const close = stat.lastIndexOf(")");
-        const fields = stat.slice(close + 2).split(" ");
-        return fields[19] ?? "0"; // field 22: starttime
-    }
-    catch {
-        return undefined;
-    }
-}
-function processIsAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error instanceof Error && "code" in error && error.code === "EPERM";
+            return true;
+        throw error;
     }
 }
 function isEnoent(error) {

package/dist/artifacts/taskArtifactRepository.js

@@ -1,10 +1,10 @@
-import { mkdir, writeFile } from "node:fs/promises";
-import { existsSync } from "node:fs";
 import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
-import { ManagedGitError, externalProgramConfigViolations, managedGit, managedGitBuffer, managedGitSucceeds, requireCommitId } from "./managedGit.js";
 import { acquireArtifactCommitLock } from "./artifactCommitLock.js";
 import { resolveContainedArtifactPath, safeRelativeArtifactPath, taskArtifactRepoPath } from "./artifactPaths.js";
+import { ManagedGitError, externalProgramConfigViolations, managedGit, managedGitBuffer, managedGitSucceeds, requireCommitId } from "./managedGit.js";
 /**
  * Per-Task local-only Git artifact repository.
  *

package/dist/cli/agentConfigurationPicker.js

@@ -106,7 +106,7 @@ export async function selectAgentPermission(resolved, io, current) {
 export function renderAgentConfigurationResolutionNotice(resolved) {
     const lines = [];
     if (resolved.source === "cache") {
-        lines.push(`! Runtime capability request failed (${resolved.failure?.message ?? "unknown failure"}). `
+        lines.push((resolved.failure === undefined ? "" : `! Runtime capability request failed (${resolved.failure.message}). `)
             + `Showing cached options from ${resolved.fetchedAt ?? "an earlier request"}; they may be stale.`);
     }
     else if (resolved.source === "fallback") {

package/dist/cli/commandCatalog.js

@@ -116,7 +116,8 @@ const agentChildren = [
     {
         name: "capabilities",
         summary: "Probe one Agent CLI for runtime configuration options.",
-        usage: "yui config agent capabilities <id>"
+        usage: "yui config agent capabilities <id> [--refresh]",
+        options: ["--refresh"]
     },
     {
         name: "update",
@@ -293,7 +294,7 @@ const taskChildren = [
             "--type": ["feature", "bugfix"]
         }
     },
-    { name: "activate", summary: "Activate a Draft Task.", usage: "yui task activate <id>" },
+    { name: "activate", summary: "Adopt an existing Activation request for a Draft Task.", usage: "yui task activate <id>" },
     {
         name: "activation",
         summary: "Request, cancel or inspect explicit Task Activation.",
@@ -378,9 +379,9 @@ const taskChildren = [
     },
     {
         name: "list",
-        summary: "List Task overviews or a bounded discovery catalog.",
-        usage: "yui task list [--all] [--verbose] | --view compact [--all] [--status <status>] [--project <id>] [--search <text>] [--attention <category>] [--limit <1..100>] [--cursor <cursor>]",
-        options: ["--all", "--verbose", "--view", "--status", "--project", "--search", "--attention", "--limit", "--cursor"]
+        summary: "Discover Tasks through a bounded, filterable catalog.",
+        usage: "yui task list [--all] [--status <status>] [--project <id>] [--search <text>] [--attention <category>] [--limit <1..100>] [--cursor <cursor>]",
+        options: ["--all", "--status", "--project", "--search", "--attention", "--limit", "--cursor"]
     },
     { name: "show", summary: "Show a Task.", usage: "yui task show <id>" },
     {
@@ -432,8 +433,8 @@ const taskChildren = [
             {
                 name: "integrate",
                 summary: "Rebase Task changes onto the remote development head through Integration.",
-                usage: "yui task upstream integrate <task> (--latest|--project <project>) [--check <command> ...]",
-                options: ["--latest", "--project", "--check"]
+                usage: "yui task upstream integrate <task> (--latest|--project <project>) [--check <command> ...] [--rerun-checks]",
+                options: ["--latest", "--project", "--check", "--rerun-checks"]
             }
         ]
     },
@@ -457,18 +458,17 @@ const taskChildren = [
             {
                 name: "send",
                 summary: "Send a Task message. An unaddressed user/operator message carries a submission intent (record|discuss|develop) and an optional idempotency key.",
-                usage: "yui task message send <id> (<body>|--body-file <path|->) [--intent record|discuss|develop] [--request-id <key>] [--wake-policy leader|none] [--to <role> --work-item <id>|--review-round <id>]",
-                options: ["--body-file", "--intent", "--request-id", "--wake-policy", "--to", "--work-item", "--review-round"],
+                usage: "yui task message send <id> (<body>|--body-file <path|->) [--intent record|discuss|develop] [--request-id <key>] [--to <role> --work-item <id>|--review-round <id>]",
+                options: ["--body-file", "--intent", "--request-id", "--to", "--work-item", "--review-round"],
                 optionValues: {
-                    "--intent": ["record", "discuss", "develop"],
-                    "--wake-policy": ["leader", "none"]
+                    "--intent": ["record", "discuss", "develop"]
                 },
                 fileOptions: ["--body-file"]
             },
             {
                 name: "queue",
-                summary: "Queue an input for delivery at the recipient's next legal opportunity (idempotent by request id).",
-                usage: "yui task message queue <id> (<body>|--body-file <path|->) --request-id <id> [--to <role> --work-item <id>|--review-round <id>]",
+                summary: "Queue ordinary Leader input without --to; an explicit Role requires an existing WorkItem/ReviewRound Assignment. Idempotent by request id.",
+                usage: "yui task message queue <id> (<body>|--body-file <path|->) --request-id <id> [--to <role> (--work-item <id>|--review-round <id>)]",
                 options: ["--body-file", "--request-id", "--to", "--work-item", "--review-round"],
                 fileOptions: ["--body-file"]
             },
@@ -492,12 +492,9 @@ const taskChildren = [
             },
             {
                 name: "update",
-                summary: "Replace the mutable body and wake policy of a Draft user/operator Message.",
-                usage: "yui task message update <task>/<message> (<body>|--body-file <path|->) [--wake-policy leader|none]",
-                options: ["--body-file", "--wake-policy"],
-                optionValues: {
-                    "--wake-policy": ["leader", "none"]
-                },
+                summary: "Edit unkeyed Draft context without changing intent; inputs with request identities require a new Message.",
+                usage: "yui task message update <task>/<message> (<body>|--body-file <path|->)",
+                options: ["--body-file"],
                 fileOptions: ["--body-file"]
             },
             {
@@ -659,7 +656,7 @@ const taskChildren = [
         summary: "Manage Roles within a Task.",
         sections: [{ id: "manage", title: "Commands", entries: [
                     "add", "list", "status", "show", "update", "remove", "bind", "unbind",
-                    "session", "interrupt", "view", "takeover", "release"
+                    "capabilities", "session", "interrupt", "view", "takeover", "release"
                 ] }],
         children: [
             {
@@ -676,6 +673,9 @@ const taskChildren = [
                 usage: "yui task role status <task> <role>"
             },
             { name: "show", summary: "Show one Task Role.", usage: "yui task role show <task> <role>" },
+            { name: "capabilities", summary: "Read native options using this Role's desired or exact failed launch configuration.",
+                usage: "yui task role capabilities <task> <role> [--error <event-id>] [--refresh]",
+                options: ["--error", "--refresh"] },
             {
                 name: "update",
                 summary: "Update a Task Role; Agent settings target the named or active binding without switching it.",
@@ -947,13 +947,13 @@ const taskChildren = [
     {
         name: "integration",
         summary: "Integrate WorkItem results and upstream commits with Leader-owned decisions.",
-        sections: [{ id: "manage", title: "Commands", entries: ["start", "continue", "resolve", "abort", "supersede", "list", "show", "cleanup", "queue"] }],
+        sections: [{ id: "manage", title: "Commands", entries: ["start", "continue", "resolve", "abort", "supersede", "list", "show", "cleanup"] }],
         children: [
             {
                 name: "start",
                 summary: "Build, validate, and CAS-commit an integration candidate.",
-                usage: "yui task integration start <task> --work-item <id> --strategy <ff|cherry-pick|merge|manual> [--project <project>] [--target <ref>] [--check <command> ...]",
-                options: ["--work-item", "--strategy", "--project", "--target", "--check"],
+                usage: "yui task integration start <task> --work-item <id> --strategy <ff|cherry-pick|merge|manual> [--project <project>] [--target <ref>] [--check <command> ...] [--rerun-checks]",
+                options: ["--work-item", "--strategy", "--project", "--target", "--check", "--rerun-checks"],
                 optionValues: { "--strategy": ["ff", "cherry-pick", "merge", "manual"] }
             },
             {
@@ -982,21 +982,7 @@ const taskChildren = [
             },
             { name: "list", summary: "List Integration Attempts.", usage: "yui task integration list <task>" },
             { name: "show", summary: "Show one Integration Attempt.", usage: "yui task integration show <task>/<integration>" },
-            { name: "cleanup", summary: "Remove a terminal Integration worktree and branch.", usage: "yui task integration cleanup <task>/<integration>" },
-            {
-                name: "queue",
-                summary: "Manage the serialized integration queue.",
-                sections: [{ id: "queue", title: "Commands", entries: ["enqueue", "list", "show", "process", "supersede", "requeue", "reconcile"] }],
-                children: [
-                    { name: "enqueue", summary: "Enqueue a ChangeSet for serialized integration.", usage: "yui task integration queue enqueue <task> --project <project> --change-set <id> [--target <ref>] [--check <command> ...]", options: ["--project", "--change-set", "--target", "--check"] },
-                    { name: "list", summary: "List integration queue entries.", usage: "yui task integration queue list <task> [--project <project>]", options: ["--project"] },
-                    { name: "show", summary: "Show one integration queue entry.", usage: "yui task integration queue show <task>/<entry>" },
-                    { name: "process", summary: "Process queued integration entries.", usage: "yui task integration queue process <task> [--project <project>] [--limit <n>]", options: ["--project", "--limit"] },
-                    { name: "supersede", summary: "Supersede a queued entry.", usage: "yui task integration queue supersede <task>/<entry> --reason <text>", options: ["--reason"] },
-                    { name: "requeue", summary: "Requeue a conflicted entry.", usage: "yui task integration queue requeue <task>/<entry>" },
-                    { name: "reconcile", summary: "Reconcile a blocked entry.", usage: "yui task integration queue reconcile <task>/<entry>" }
-                ]
-            }
+            { name: "cleanup", summary: "Remove a terminal Integration worktree and branch.", usage: "yui task integration cleanup <task>/<integration>" }
         ]
     },
     {
@@ -1085,10 +1071,12 @@ const taskChildren = [
     {
         name: "wake",
         summary: "Inspect the durable Leader wake ledger and its delta content.",
-        sections: [{ id: "manage", title: "Commands", entries: ["list", "show", "resolve"] }],
+        sections: [{ id: "manage", title: "Commands", entries: ["list", "show", "retry", "resolve"] }],
         children: [
             { name: "list", summary: "List recorded Leader wakes.", usage: "yui task wake list <task>" },
             { name: "show", summary: "Show one wake and its delta content.", usage: "yui task wake show <task> <wake>" },
+            { name: "retry", summary: "Retry a rejected notification after correcting its cause; preserve original input.",
+                usage: "yui task wake retry <task> <wake> --reason <correction>", options: ["--reason"] },
             { name: "resolve", summary: "Release an unknown notification claim after explicit quiescence evidence, without replay.",
                 usage: "yui task wake resolve <task> <wake> --reason <quiescence-evidence>", options: ["--reason"] }
         ]
@@ -1117,13 +1105,41 @@ export const ROOT_COMMAND = buildNode({
         { id: "general", title: "General", entries: [
                 "help", "version", "update", "upgrade", "setup", "doctor"
             ] },
-        { id: "workflow", title: "Workflow", entries: ["operator", "project", "task"] },
+        { id: "workflow", title: "Workflow", entries: ["operator", "role", "project", "task"] },
         { id: "configuration", title: "Configuration", entries: ["config"] },
         { id: "operations", title: "Operations", entries: ["web", "controller", "session", "execution", "capability", "job", "jobs", "telemetry", "release"] },
         { id: "resources", title: "Resources", entries: ["resources"] },
         { id: "internal", title: "Internal", entries: ["internal"] }
     ],
     children: [
+        {
+            name: "role",
+            summary: "Queue input or control an exact current Global Role Turn.",
+            sections: [{ id: "input", title: "Input control", entries: ["message", "interrupt"] }],
+            children: [
+                {
+                    name: "message", summary: "Send durable input to a Global Role.",
+                    sections: [{ id: "input", title: "Input control", entries: ["queue", "steer"] }],
+                    children: [
+                        {
+                            name: "queue", summary: "Queue input for the next legal delivery opportunity.",
+                            usage: "yui role message queue <role> (<text>|--body-file <path|->) --request-id <id>",
+                            options: ["--request-id", "--body-file"], fileOptions: ["--body-file"]
+                        },
+                        {
+                            name: "steer", summary: "Steer the exact current native Turn.",
+                            usage: "yui role message steer <role> (<text>|--body-file <path|->) --request-id <id> --expected-target <turn>",
+                            options: ["--request-id", "--expected-target", "--body-file"], fileOptions: ["--body-file"]
+                        }
+                    ]
+                },
+                {
+                    name: "interrupt", summary: "Request cancellation of the exact current native Turn.",
+                    usage: "yui role interrupt <role> --expected-target <turn> [--request-id <id>] [--then-message <message>]",
+                    options: ["--request-id", "--expected-target", "--then-message"]
+                }
+            ]
+        },
         { name: "help", summary: "Show root or scoped command help.", usage: "yui help [command ...]", commandPathArguments: true },
         { name: "version", summary: "Print the installed Yui version." },
         { name: "update", summary: "Install the latest published Yui package globally." },
@@ -1540,7 +1556,7 @@ export const ROOT_COMMAND = buildNode({
             summary: "Start, inspect, cancel, or acknowledge a Controller-managed DurableJob.",
             sections: [{ id: "manage", title: "Commands", entries: ["start", "get", "cancel", "acknowledge"] }],
             children: [
-                { name: "start", summary: "Start a DurableJob for build, test, package, or Integration checks.", usage: "yui job start --task <id> --project <project> --head <sha> --workspace <dir> --step <name>=<command> [--step ...] [--owner task|work-item:<id>|integration-attempt:<id>] [--env <k=v>...]" },
+                { name: "start", summary: "Start a DurableJob under an explicit request identity.", usage: "yui job start --request-id <id> --task <id> --project <project> --head <sha> --workspace <dir> --step <name>=<command> [--step ...] [--owner task|work-item:<id>|integration-attempt:<id>] [--env <k=v>...]" },
                 { name: "get", summary: "Show a DurableJob record and its terminal result.", usage: "yui job get --task <id> --job <job-id>" },
                 { name: "cancel", summary: "Request cancellation of a running or queued DurableJob.", usage: "yui job cancel --task <id> --job <job-id>" },
                 { name: "acknowledge", summary: "Acknowledge an unknown-needs-attention DurableJob so Task lifecycle gates can proceed.", usage: "yui job acknowledge --task <id> --job <job-id>" }

package/dist/cli/completion.js

@@ -1,11 +1,11 @@
 import { ROOT_COMMAND, listPublicCommandPaths, orderedImmediateTokens, visibleChildren } from "./commandCatalog.js";
 import { findInteractionPolicy } from "./interactionPolicy.js";
-export function renderCompletion(shell, identity = "yui") {
+export function renderCompletion(shell) {
     const entries = collectEntries(ROOT_COMMAND);
     switch (shell) {
-        case "bash": return renderBash(entries, identity);
-        case "zsh": return renderZsh(entries, identity);
-        case "fish": return renderFish(entries, identity);
+        case "bash": return renderBash(entries);
+        case "zsh": return renderZsh(entries);
+        case "fish": return renderFish(entries);
         default: throw new Error("Completion shell must be one of bash, zsh, fish.");
     }
 }
@@ -30,8 +30,8 @@ function collectEntries(root) {
 function manifest(prefix) {
     return listPublicCommandPaths().map((path) => `${prefix} ${path}`).join("\n");
 }
-function renderBash(entries, identity) {
-    const functionName = identity === "yui" ? "_yui" : "_yui_dev";
+function renderBash(entries) {
+    const functionName = "_yui";
     return `${manifest("# yui command:")}
 ${functionName}() {
   local current path previous dynamic_candidate dynamic=false
@@ -55,7 +55,7 @@ ${bashDynamicOptionCases(entries)}
   if [[ "$dynamic" == true ]]; then
     while IFS= read -r dynamic_candidate; do
       [[ -n "$dynamic_candidate" ]] && dynamic_candidates+=("$dynamic_candidate")
-    done < <(command ${identity} config completion candidates "$current" -- "\${COMP_WORDS[@]:1:COMP_CWORD-1}" 2>/dev/null)
+    done < <(command yui config completion candidates "$current" -- "\${COMP_WORDS[@]:1:COMP_CWORD-1}" 2>/dev/null)
     candidates=("\${dynamic_candidates[@]}")
   elif [[ "$current" == -* ]]; then
     case "$path" in
@@ -70,11 +70,11 @@ ${entries.map((entry) => `      ${bashPattern(entry.path)}) candidates=(${[...en
   fi
   COMPREPLY=( $(compgen -W "\${candidates[*]}" -- "$current") )
 }
-complete -F ${functionName} ${identity}
+complete -F ${functionName} yui
 `;
 }
-function renderZsh(entries, identity) {
-    return `#compdef ${identity}
+function renderZsh(entries) {
+    return `#compdef yui
 ${manifest("# yui command:")}
 local current command_path previous dynamic_output dynamic=false
 local -a candidates
@@ -95,7 +95,7 @@ ${zshDynamicOptionCases(entries)}
   esac
 fi
 if [[ "$dynamic" == true ]]; then
-  dynamic_output="$(command ${identity} config completion candidates "$current" -- "\${(@)words[2,CURRENT-1]}" 2>/dev/null)"
+  dynamic_output="$(command yui config completion candidates "$current" -- "\${(@)words[2,CURRENT-1]}" 2>/dev/null)"
   candidates=("\${(@f)dynamic_output}")
 elif [[ "$current" == -* ]]; then
   case "$command_path" in
@@ -111,8 +111,8 @@ fi
 (( \${#candidates[@]} > 0 )) && compadd -- "$candidates[@]"
 `;
 }
-function renderFish(entries, identity) {
-    const prefix = `__${identity.replaceAll("-", "_")}`;
+function renderFish(entries) {
+    const prefix = "__yui";
     const lines = [
         manifest("# yui command:"),
         `function ${prefix}_at_path`,
@@ -151,17 +151,17 @@ function renderFish(entries, identity) {
         "end",
         `function ${prefix}_dynamic`,
         "  set -l words (commandline -opc)",
-        `  ${identity} config completion candidates (commandline -ct) -- $words[2..-1] 2>/dev/null`,
+        "  yui config completion candidates (commandline -ct) -- $words[2..-1] 2>/dev/null",
         "end"
     ];
     for (const entry of entries) {
         for (const argument of entry.dynamicArguments) {
             const condition = `${prefix}_needs_dynamic argument ${argument} ${fishPath(entry.path)}`;
-            lines.push(`complete -c ${identity} -f -n ${fishQuote(condition)} -a '(${prefix}_dynamic)'`);
+            lines.push(`complete -c yui -f -n ${fishQuote(condition)} -a '(${prefix}_dynamic)'`);
         }
         for (const option of entry.dynamicOptions) {
             const condition = `${prefix}_needs_dynamic option ${option} ${fishPath(entry.path)}`;
-            lines.push(`complete -c ${identity} -f -n ${fishQuote(condition)} -a '(${prefix}_dynamic)'`);
+            lines.push(`complete -c yui -f -n ${fishQuote(condition)} -a '(${prefix}_dynamic)'`);
         }
     }
     for (const entry of entries) {
@@ -169,13 +169,13 @@ function renderFish(entries, identity) {
             const condition = entry.path.length === 0
                 ? "__fish_use_subcommand"
                 : `${prefix}_at_path ${fishPath(entry.path)}${fishInitialDynamicExclusion(entry, prefix)}`;
-            lines.push(`complete -c ${identity} -f -n ${fishQuote(condition)} -a '${escapeSingle(entry.immediate.join(" "))}'`);
+            lines.push(`complete -c yui -f -n ${fishQuote(condition)} -a '${escapeSingle(entry.immediate.join(" "))}'`);
         }
         if (entry.options.length > 0) {
             const path = fishPath(entry.path);
             const exact = `${prefix}_at_path ${path}${fishInitialDynamicExclusion(entry, prefix)}`;
             const condition = `begin; ${exact}; end; or ${prefix}_at_command_options ${path}`;
-            lines.push(`complete -c ${identity} -f -n ${fishQuote(condition)} -a '${escapeSingle(entry.options.join(" "))}'`);
+            lines.push(`complete -c yui -f -n ${fishQuote(condition)} -a '${escapeSingle(entry.options.join(" "))}'`);
         }
     }
     return `${lines.join("\n")}\n`;

package/dist/cli/completionWizard.js

@@ -41,7 +41,7 @@ export async function runCompletionWizard(port, io, options = {}) {
     let activate = false;
     let activationReady = automatic;
     if (!automatic) {
-        const activationAnswer = normalize(await io.question(`${activationBlock(state.shell, installation, overview.identity)}\n`
+        const activationAnswer = normalize(await io.question(`${activationBlock(state.shell, installation)}\n`
             + `Update ${installation.activationPath} with this managed Yui block? [Y/n]: `));
         if (activationAnswer !== ""
             && activationAnswer !== "y"

package/dist/cli/dynamicCompletion.js

@@ -2,7 +2,7 @@ import { findChild, ROOT_COMMAND, visibleChildren } from "./commandCatalog.js";
 import { getSelectionCandidates } from "./interactionCandidates.js";
 import { findInteractionPolicy } from "./interactionPolicy.js";
 export async function resolveCompletionCandidates(input) {
-    const words = input.words[0] === "yui" || input.words[0] === "yui-dev"
+    const words = input.words[0] === "yui"
         ? input.words.slice(1)
         : [...input.words];
     const { node, consumed } = resolveCommand(words);

package/dist/cli/interactionPolicy.js

@@ -223,7 +223,10 @@ export const INTERACTION_POLICIES = Object.freeze([
     {
         commandPath: ["task", "list"],
         selectors: [],
-        trailingOptions: { "--all": "flag", "--verbose": "flag" }
+        trailingOptions: {
+            "--all": "flag", "--status": "value", "--project": "value",
+            "--search": "value", "--attention": "value", "--limit": "value", "--cursor": "value"
+        }
     },
     {
         ...taskTarget("remote-delivery"),
@@ -276,7 +279,7 @@ export const INTERACTION_POLICIES = Object.freeze([
                 provider: "messages",
                 actionTarget: true
             }],
-        trailingOptions: { "--body-file": "value", "--wake-policy": "value" }
+        trailingOptions: { "--body-file": "value" }
     },
     {
         commandPath: ["task", "message", "retire"],
@@ -554,7 +557,8 @@ export const INTERACTION_POLICIES = Object.freeze([
             "--strategy": "value",
             "--project": "value",
             "--target": "value",
-            "--check": "value"
+            "--check": "value",
+            "--rerun-checks": "flag"
         }
     },
     {

package/dist/cli/invocationAuthority.js

@@ -0,0 +1,64 @@
+import { usageError } from "../errors/cliError.js";
+import { requireManagedGlobalCaller } from "../runtime/managedCaller.js";
+import { routeInvocation } from "./invocationRouter.js";
+import { findInteractionPolicy } from "./interactionPolicy.js";
+import { TASK_RECORD_ID_PREFIXES } from "../task/taskRecordReference.js";
+import { taskDiagnosticTarget } from "./managedDiagnostics.js";
+/** Configuration reads remain available; every Home configuration mutation
+ * has one owner, irrespective of which config subcommand parses its flags. */
+export function assertConfigurationAuthority(args, store, env) {
+    const configurationWrite = args[0] === "config"
+        && !["show", "describe"].includes(args[1] ?? "")
+        && !["show", "list", "capabilities", "status", "candidates"].includes(args[2] ?? "");
+    const resourceWrite = args[0] === "resources" && args.some(arg => ["--apply", "--purge", "--restore"].includes(arg));
+    if (!configurationWrite && !resourceWrite)
+        return;
+    if (env.YUI_SESSION_SCOPE === "global" && env.YUI_ROLE === "operator") {
+        requireManagedGlobalCaller(store, env);
+        return;
+    }
+    if (env.YUI_SESSION_SCOPE !== undefined || env.YUI_ROLE !== undefined
+        || env.YUI_AGENT_ID !== undefined || env.YUI_NATIVE_SESSION_ID !== undefined) {
+        throw usageError("Home configuration and resource mutations require the user or current Operator, not a Task Assignment.");
+    }
+}
+/** The parsed command path identifies the first target argument, never a
+ * string found in a body/flag value. Record-local references retain their
+ * normal command-specific parser; an explicit foreign Task cannot pass it. */
+export function assertTaskInvocationScope(args, env) {
+    if (env.YUI_SESSION_SCOPE !== "task")
+        return;
+    if (args[0] === "jobs" || (args[0] === "task" && ["create", "overlap"].includes(args[1] ?? ""))) {
+        throw usageError("This global operation is outside the caller's Task; use its scoped Context.");
+    }
+    if (args[0] !== "task" || args[1] === "list")
+        return;
+    const diagnostic = taskDiagnosticTarget(args);
+    if (diagnostic !== undefined) {
+        if (diagnostic !== env.YUI_TASK_ID)
+            throw usageError("Command target is outside the caller's Task.");
+        return;
+    }
+    const invocation = routeInvocation([...args]);
+    if (invocation.kind !== "execute")
+        return;
+    let targetIndex = invocation.node.path.length - 1;
+    const optionSyntax = findInteractionPolicy(invocation.node)?.trailingOptions;
+    while (args[targetIndex]?.startsWith("--")) {
+        // Reuse known option arity, not any picker/confirmation authority. An
+        // unclassified prefix cannot turn a missing target into permission.
+        const kind = optionSyntax?.[args[targetIndex]];
+        if (kind === undefined)
+            throw usageError("Place this command's Task target before its options so its scope is explicit.");
+        targetIndex += kind === "flag" ? 1 : 2;
+    }
+    const target = args[targetIndex];
+    if (target === undefined)
+        return; // The domain parser still requires its target.
+    const taskId = target.split("/")[0];
+    const local = !target.includes("/") && Object.values(TASK_RECORD_ID_PREFIXES)
+        .some(prefix => target.startsWith(`${prefix}-`));
+    if (!local && taskId !== env.YUI_TASK_ID) {
+        throw usageError("Command target is outside the caller's Task.");
+    }
+}

package/dist/cli/managedDiagnostics.js

@@ -4,7 +4,7 @@ export function taskDiagnosticTarget(args) {
     if (args[0] !== "task")
         return undefined;
     if (["show", "context", "next-action", "archive-preflight"].includes(args[1] ?? "")) {
-        return args[1] === "context" && ["inspect", "delta"].includes(args[2] ?? "")
+        return args[1] === "context" && ["read", "inspect", "delta"].includes(args[2] ?? "")
             ? args[3] : args[2];
     }
     if (args[1] === "role" && ["list", "status", "show"].includes(args[2] ?? ""))