@zq-silk/yui 0.15.12 → 0.16.0

package/docs/task-discovery.zh-CN.md

@@ -2,22 +2,21 @@
 
 # 有界任务发现
 
-Agent 使用 `yui task list --view compact --json` 发现候选任务，再读取目标
+Agent 使用 `yui task list --json` 发现候选任务，再读取目标
 Task Context 和原始 Message。目录是当前事实的只读视图，不是摘要数据库、
 Context 快照、消息确认、执行判断或验收结论。
 
-显式 compact 视图不改变既有 `task list --json`、`--verbose` 详细输出。
-内建 Operator 采用 compact；交互选择器保持完整的 `{id,title,status}` 数组，
-只读取这些窄字段。Web 通过 `GET /api/dashboard?view=compact` 使用同一查询；
-原 dashboard 和 Task 详情接口保留执行、观测、用量和远端交付字段。
-本功能不改变持久 schema，无需迁移。
+目录是唯一列表契约，不再提供 `--view` 选择或 `--verbose` 全历史列表。
+交互选择器保持完整的 `{id,title,status}` 数组，只读取这些窄字段。
+Web 通过 `GET /api/dashboard` 使用同一查询；单个 Task 的详情接口继续保留
+执行、观测、用量和远端交付字段。目录查询本身不改变持久记录。
 
 ## 查询和分页合同
 
 ```sh
-yui task list --view compact --project project-1 --status active --limit 20 --json
-yui task list --view compact --attention openInputs --json
-yui task list --view compact --search "候选标题" --json
+yui task list --project project-1 --status active --limit 20 --json
+yui task list --attention openInputs --json
+yui task list --search "候选标题" --json
 yui task context task-1 --json
 yui task context inspect task-1 --store task --ref task-1 --digest <digest> --json
 yui task message show task-1/message-1 --json

package/docs/testing/verification-levels.md

@@ -25,20 +25,45 @@ and incident-specific scripts temporary. Remove their harnesses after the
 change, preserving useful reports. Real-resource results do not replace fast
 regressions, and fast regressions do not establish real-model behavior.
 
+## Coverage, not test count
+
+Keep three complementary kinds of evidence: a few normal paths through real
+entry points and component wiring; critical regressions for durable intent,
+idempotency, authority, isolation and historical storage; and cheap pure-logic
+checks for meaningful branching. A passing suite proves its assertions, not
+the absence of every bug.
+
+Pin constants that are persisted or public contracts (event names, protocol
+identifiers, historical encodings), with an independent literal expectation.
+Where possible, also prove the current reader understands migrated data.
+Do not derive expected and actual values from the same constant, or lock an
+internal default merely because it is a constant.
+
+Merge tests only when each assertion has an identified surviving scenario.
+Identical constant checks and repeated setup can be consolidated; similar
+names do not make Task and Global authority boundaries interchangeable.
+Do not target a particular test count or delete safety checks to hit a time
+budget. A temporary deliberate fault can confirm that a critical check detects
+its intended regression; no permanent mutation service or broad fault matrix
+is required.
+
 ## Permanent core smoke
 
 `npm test` and `npm run test:core` build the checkout and run one permanent suite:
 
-1. the packaged CLI starts and exposes setup/update/upgrade/Task commands;
+1. the built CLI starts and its catalog exposes setup/update/upgrade/Task commands;
 2. one normal SQLite Task and Message survive a reopen;
 3. a supported historical Home migrates through the linear storage chain to current;
 4. the built-in Codex and Claude Drivers are registered;
 5. one independent declarative plugin is created, validated, called and disabled
    through authenticated ingress, with its selection and validation preserved.
 6. a Task starts from durable Operator input, exposes planning Context and enters
-   delivery with its original intent and captured planning authority preserved.
+   delivery with its original intent and captured planning authority preserved;
+   scratch workspace release does not require a fabricated Git identity.
 7. Session replacement preserves pending original Messages and independent work;
-   old Sessions keep scoped reads but cannot regain write authority;
+   cleanup blocks new notification claims, and successor acceptance cannot
+   settle an old wake or later queued input. Old Sessions keep scoped reads
+   but cannot regain write authority;
 8. InputRequests survive Session replacement without a synthetic AgentRun;
 9. late native terminals cannot settle successor input or invent acceptance;
 10. remote Operator startup carries its reserved workspace, Role instructions
@@ -86,12 +111,100 @@ regressions, and fast regressions do not establish real-model behavior.
     cumulative baselines, Session replacement and native child overlap. A small
     event fixture checks direct Leader/parallel time semantics and the shared
     CLI/Web/audit lifetime projection without collecting Provider data.
+20. explicit cleanup releases retained terminals without affecting other Tasks
+    or claiming that live resources are gone; Controller replacement waits for
+    the old process to exit.
+21. structured verification preserves argv, explicit shell failure, environment
+    and workspace-relative cwd through the actual RPC parser and both local
+    executors. Corrected execution semantics invalidate old gate reuse without
+    rewriting historical artifacts or migrations.
+22. concurrent resource registration preserves unrelated rows and rejects
+    stale same-record writes; GC closes owned connections on success/failure.
+23. Context counts, exact inspection and bounded event deltas work without
+    materializing complete history or acquiring a writer lock. Telemetry
+    ingestion yields to the event loop and drains its worker on close.
+24. Release resume re-queries uncertain effects, retains confirmed work and
+    refuses exhausted grants, using disposable SQLite and fake external ports.
+    These checks do not claim validation of real release services.
+25. The pre-1.0 contract cleanup normalizes old singleton dispatches only through
+    explicit storage migration. Unsupported CLI/ACP input, unregistered development
+    links, unpinned release identities and unsupported quarantine receipts are
+    refused without inventing acceptance or discarding evidence. Current link,
+    configuration and quarantine operations remain usable.
+26. Activation refuses absent intent before resource adoption and still honors
+    planning deferral and cancellation. Retiring the integration queue preserves
+    exact records and active attempts in one rollback-safe migration, without
+    inventing delivery. Conflicted Integrations remain completion blockers.
+27. Unknown lock ownership stays fenced, including unavailable OS evidence.
+    PR lookup distinguishes absence, malformed/ambiguous results and transport
+    failure through injected ports. Receipt-free Git operations remain unchanged,
+    while normal receipt-backed continuation still works. Notification-only
+    migration preserves current delivery and audit history and refuses live links.
+28. SQLite admission ignores unrelated side files but refuses a non-empty Home
+    without its database. Default CLI/HTTP discovery stays bounded and retains
+    off-page Task detail; unknown writer leases diagnose without mutation.
+    Review migration preserves candidate evidence while making scope explicit.
+29. Missing authoritative readers fail before Provider preparation or queue
+    admission instead of becoming empty evidence. WorkItem history retirement
+    preserves the original payload and current work, advances event IDs safely,
+    and refuses unknown old shapes without advancing the migration ledger.
+30. WorkItem overlap is a read-only advisory; exact permission/dependency guards
+    remain. Real local verification proves default reuse, explicit rerun failure,
+    incomplete evidence and stale-consumer rejection through the current proof path.
+    An Integration rerun cannot bypass an equivalent unfinished gate. Policy
+    migration preserves historical execution and blocks an admitted old gate.
+31. Message edits preserve submission intent and immutable request identity;
+    no-op edits do not enqueue work, and an edited develop request cannot create
+    a planning Run. Unkeyed discussions still plan after activation is resolved.
+    Queue identity remains frozen through an interrupt-then handoff; completion sees explicitly
+    queued input. Input migration preserves raw audit evidence, refuses to
+    auto-authorize old pending immediate activations and keeps the prior ledger.
+    The actual Controller continues admitted requests but not cancellations.
+    Required Store reads fail before config mutation or full-scan fallback.
+    Explicit Job requests replay one operation and reject changed or missing keys.
+32. Worker Job admission/management and the pre-spawn gate reject a different
+    owner/workspace; legitimate Worker and Leader Jobs remain usable. Candidate
+    mutation blocks publication of reusable success, including after explicit
+    abort/retry. Upstream wiring returns its admitted Job and continuation IDs.
+    Plugin replacement retains delayed old-generation cleanup errors without
+    undoing a newer selection. A shared validator rejects bad record writes,
+    ordinary/Context reads and full-Home health checks without repairing data.
+33. Built CLI calls refuse replaced Operator writes, Task-owned Home mutations
+    and foreign-Task queries while retaining legitimate reads and current
+    Operator actions. Job reads enforce Context scope at the Controller port.
+    Real local runtime directories move once through quarantine/restore/purge;
+    current durable ownership overrides a stale cleanup plan and prevents
+    purging a reopened Task.
+34. Current CLI rejects `task turn`; completion has one identity and preserves
+    unrelated shell content through install/uninstall. GC protects exact live
+    SQLite Session custody without consulting old JSON. The 34→35 cutover
+    preserves raw retired payloads/log bytes and identity counters, blocks
+    unsettled gates/custody, and rolls back malformed conversions.
+35. Native model aliases/resolved IDs and open custom-model fields retain their
+    distinct contracts; configuration errors display the observed choices.
+    Rejected Leader startup stays quiet across Store reopen and repeated passes,
+    preserves original/later input and blocks premature completion. Explicit
+    retry requeues the exact rejected claim once without rewriting its history;
+    typed contention remains retryable and unknown acceptance cannot be replayed.
+36. Failure-scoped capability reads preserve the recorded model/workspace/settings
+    selection after Role edits, reject changed Agent bindings, honor explicit
+    metadata refresh and identify cached fallback. The Controller supplies native
+    account context without accepting caller credentials. Task/Role/record reads
+    stay fenced. Runless startup and native rejection reuse one error/notification.
+    Migration 35→36 preserves historical error bytes and the earlier ledger while
+    marking absent historical configuration unavailable, never reconstructing it.
+37. Narrow failure context survives independently of execution/Review/Session
+    protocols; 36→37 preserves the original snapshot in audit. Repeated native
+    submission rejection creates one error and one supervisor notice through
+    the shared writer. A small injected cache proves completed-result eviction,
+    pending-request coalescing, explicit refresh and truthful cache provenance.
 
 Keep the test phase seconds-scale; measure TypeScript build separately. Record
 incremental runtime when adding a critical regression. The seven recovery boundary
 cases initially add about 0.4 seconds of test bodies (about 0.6 seconds standalone,
-including module startup) on the development host. Avoid sleep-based checks or
-mandatory model/daemon launches in the permanent suite.
+including module startup) on the development host. Keep real-model launches out
+of this suite. Real tmux/CLI lifecycle checks belong to the bounded package smoke
+below, not a second core daemon matrix.
 The Integration continuation regressions use disposable Git repositories,
 SQLite and fake Jobs, without a provider or shared Home. Their test bodies
 take about 3 seconds on the development host; validation settlement adds
@@ -115,10 +228,25 @@ do not add prose-matching tests or claim model validation from static checks.
 
 ## CI and release
 
-`ci.yml` runs the core smoke plus one package-assembly/start check. It does not
-run a second lint pass or a separate broad regression suite. `publish.yml` reuses that
-exact gated commit and adds only tag, artifact, install, and provenance checks
-that are unique to publishing.
+`ci.yml` builds once and runs core plus one assembled-package normal-path smoke
+on every PR, without another lint or broad regression suite.
+`node scripts/smoke-runtime-package.mjs --assembled .release-stage` exercises
+the actual CLI/Controller/Host/SQLite and isolated tmux, replacing only the
+external Provider with a deterministic fixture. It covers setup, durable input
+and idempotency across restart, scratch activation, native result ingestion,
+completion preserving the conversation, and archive releasing live/dead panes
+and grouped viewers without affecting a similarly named neighboring session.
+The fixture owns a fresh Home and its PATH, installs cleanup before setup,
+and never calls an installed model Agent.
+
+`publish.yml` runs the same smoke against the freshly installed package through
+`YUI_INSTALLED_ROOT`, adding actual npm-bin, dependency, supported Node version,
+artifact and provenance boundaries. This validates runtime integration, not
+real-model behavior. Pure contract and safety tests remain in `test/core`;
+production wiring is exercised here rather than only through mocked ports.
+The package smoke also checks unconditional status identity and update-owned
+resource/identity capture through the assembled package, without an installation
+or publication effect.
 
 Configured Agents acting as developers or reviewers are ordinary execution
 resources. Using a live provider or model as the subject of validation is
@@ -126,3 +254,11 @@ different: paid APIs, shared Homes, production systems, real account quota, and
 other non-disposable external effects are never implied by a request to test or
 validate. They require an explicit user request for the exact resource and
 effect boundary.
+
+For authorized real-model probes, distinguish native acceptance, exact Turn
+completion and independently checked work (files, tests, commits and Task
+facts). A missing echo marker is not a functional failure. After Session
+replacement, verify the successor read the original input and correlate its
+own terminal; do not require every historical wake to receive that terminal.
+Check normal completion/archive before stopping execution, since stop/cancel
+cleanup is a different path. Preserve these evidence distinctions in the report.

package/docs/testing/verification-levels.zh-CN.md

@@ -18,19 +18,34 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 完成后移除它们的 harness，并保留有用的报告。真实资源结果不替代快速回归，快速回归也
 不确立真实模型行为。
 
+## 关注覆盖，而不是测试数量
+
+保留三类互补证据：经过真实入口和组件组装的少量正常链路；保护持久意图、幂等、权限、
+隔离和历史存储的关键回归；覆盖有意义分支的低成本纯逻辑检查。全绿证明断言成立，
+不证明不存在任何缺陷。
+
+持久化或公开契约中的常量值得固定，例如事件名、协议标识和历史编码；保留独立字面值
+期望，并尽量证明当前读取逻辑能理解迁移后的数据。不要让预期值和实际值都来自同一个
+常量，也不因内部默认值是常量就锁死它。
+
+合并测试前，明确每项断言由哪个保留场景继续保护。相同常量检查和重复初始化可以合并，
+但名称相似不代表 Task 与 Global 权限边界可互相替代。不以数量为目标，也不为耗时
+预算删除安全检查。可临时引入明确错误来确认关键检查能拦截对应回归，无需永久变异
+测试服务或宽泛故障矩阵。
+
 ## 永久 core smoke
 
 `npm test` 和 `npm run test:core` 构建 checkout 并运行一个永久套件：
 
-1. 打包后的 CLI 能启动，并暴露 setup/update/upgrade/Task 命令；
+1. 构建后的 CLI 能启动，命令目录暴露 setup/update/upgrade/Task 命令；
 2. 一个普通的 SQLite Task 和 Message 能在重开后存活；
 3. 一个受支持的历史 Home 沿线性存储链迁移到当前版本；
 4. 内置的 Codex 与 Claude Driver 已注册；
 5. 一个独立的声明式插件通过认证入口被创建、验证、调用和停用，其选择和验证被保留。
 6. 一个 Task 从持久的 Operator 输入启动，暴露规划 Context，并在原始意图和捕获的
-   planning 权限被保留的情况下进入交付。
-7. Session 替换保留待处理的原始 Message 和独立工作；旧 Session 保留范围受限的读取，
-   但不能重获写权限；
+   planning 权限被保留的情况下进入交付；scratch 工作区释放不要求虚构 Git 身份。
+7. Session 替换保留待处理的原始 Message 和独立工作；清理期间不领取新通知，后继接受
+   不会结算旧 wake 或后到输入。旧 Session 保留范围受限的读取，但不能重获写权限；
 8. InputRequest 在没有合成 AgentRun 的情况下经受 Session 替换；
 9. 迟到的原生终态不能结算后继输入或编造接受；
 10. 远程 Operator 启动携带其保留工作区、Role 指令和范围受限的 CLI 身份，同时离线
@@ -64,13 +79,77 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 19. Task 用量在精确请求、累计基线、Session 替换和原生子执行重叠下区分真实零、
     部分与未知。小型事件 fixture 覆盖直接 Leader/并行耗时，以及 CLI/Web/audit
     共享的全生命周期投影，不采集 Provider 数据。
+20. 明确清理释放保留终端、不影响其他 Task、不把存活资源报告为已释放；
+    Controller 替换确认旧进程退出。
+21. 结构化验证经过实际 RPC 解析器和两种本地执行器，保持 argv、显式 Shell 失败、
+    环境和工作区相对 cwd 的语义。修正执行契约后不再复用旧结果，不重写历史证据或迁移。
+22. 并发资源登记保留无关记录、拒绝覆盖已变化的同一记录；GC 在成功和失败时关闭自有连接。
+23. Context 计数、原文查阅和事件分页不全量加载历史、不获取写锁；遥测写入让出事件循环，
+    关闭时排空自有 Worker。
+24. Release 使用临时 SQLite 和 fake 外部端口检查不确定效果查询、已确认步骤复用、
+    grant 次数耗尽；不宣称真实发布服务已验证。
+25. 1.0 前的契约清理只通过显式迁移规范化旧单条调度批次；拒绝旧 CLI/ACP 输入、
+    未登记开发链接、未固定 release 身份与不受支持的 quarantine 回执，不编造接受或
+    丢弃证据。当前链接、配置和隔离资源恢复仍可用。
+26. 激活在资源采用前拒绝缺失请求，仍保留规划延后与取消边界。集成队列退役通过可回滚的
+    单次迁移保留完整记录及活动尝试，不编造交付；冲突中的 Integration 仍阻止完成。
+27. owner 或 OS 身份不明时锁仍保持围栏；PR 查询通过注入端口区分不存在、格式错误、
+    歧义及传输失败。无回执的 Git 操作保持原样，正常回执续作仍可用。通知格式迁移保留
+    当前投递和审计历史，并拒绝活动执行引用。
+28. SQLite 准入不受无关旁路文件覆盖，缺少数据库的非空 Home 仍拒绝初始化。
+    CLI／HTTP 默认目录有界，页外详情继续可读；未知 writer lease 只诊断不修改。
+    Review 迁移保留候选证据并显式写入 scope。
+29. 核心读取缺失时，在 Provider 准备及消息入队前失败，不将缺失接口当作空证据。
+    WorkItem 历史状态退役保留完整原文和当前工作，安全递增 Event ID，
+    未知旧形态不推进迁移账本。
+30. WorkItem 重叠仅作只读建议，权限和依赖保护不变。实际本地检查验证默认复用、
+    显式重跑失败、未完成证据与过期消费者拒绝，覆盖现行证明路径；
+    Integration 重跑不能绕过等价未完成验证。模式迁移保留历史执行，并阻止切换
+    已接纳的旧验证。
+31. Message 编辑保留提交意图和不可变请求身份；相同正文更新不排队，develop 编辑
+    不创建 planning Run。激活解除后，未绑定请求身份的讨论仍可进入规划；queue 请求
+    身份在 interrupt-then 交接后仍冻结。完成检查仍能看到显式排队的输入。输入迁移保留
+    原始审计证据和旧账本，不擅自授权旧 pending immediate 激活。实际 Controller
+    接纳当前已授权请求，但不恢复已取消请求。缺失 Store 读取在配置写入或全量扫描
+    前失败。显式 Job 请求复用同一操作，拒绝不同输入和缺失请求键。
+32. Worker Job 的准入、管理和启动前检查拒绝其他 owner／工作区，同时保留合法
+    Worker 与 Leader 操作。候选被改写时不能发布可复用成功，显式放弃后重试也不
+    借用旧绿灯。Upstream 返回已接纳 Job 和精确续作 ID。插件多次替换后仍记录迟到的
+    旧实例清理失败，不回滚新选择。共享校验拒绝无效写入、普通／Context 读取和全
+    Home 健康检查，不自动修补数据。
 
 把测试阶段保持在秒级；单独度量 TypeScript 构建。新增一个关键回归时记录其增量运行
 时长。这七个恢复边界用例在开发主机上最初约增加 0.4 秒的测试体（独立运行约 0.6 秒，
-含模块启动）。避免在永久套件中使用基于 sleep 的检查或强制的模型/daemon 启动。
+含模块启动）。真实模型调用不进入该套件；真实 tmux/CLI 生命周期由下面有界的
+package smoke 覆盖，不在 core 中维护第二套 daemon 矩阵。
 归档预检新增三个可丢弃 Git/SQLite 场景，测试体约一秒；更广的 owner/诊断组合
 保留为临时验证证据，不形成第二套永久矩阵。
 
+新增的入口与 GC 回归还验证：实际 CLI 拒绝旧 Operator 写入、Task 角色修改
+Home 设置和跨 Task 查询，同时保留正常读取与当前 Operator 操作；
+Job 读取在 Controller 入口执行 Context 范围检查。真实本地 runtime 目录
+只移动一次，隔离、恢复与清除可闭环；最新持久所有权优先于旧清理计划，
+Task 重新打开后不能被 purge。
+
+当前合同回归还覆盖：拒绝 `task turn`，单一补全身份在安装／卸载后保留无关
+shell 内容；GC 读取精确的 SQLite Session 归属而不读取旧 JSON；`34→35` 保留
+退休 payload、日志字节和身份计数，阻止未结算 gate／旧归属，并完整回滚无效转换。
+
+启动回归验证原生模型别名、实际 ID 与开放自定义模型字段各自的合同，并在模型配置
+拒绝时显示观测到的选项。Leader 启动被拒绝后，多次调度与重开 Store 不再产生尝试，
+原始及后续输入保留并阻止提前完成；显式重试仅将精确拒绝批次重新排队，不改写历史。
+明确的资源争用仍可重试；已接受或接受状态未知的通知不能重放。
+
+失败配置查询在 Role 修改后仍保留原模型、工作区与 settings 选择，拒绝已改变的
+Agent 绑定，支持显式刷新并标明缓存。Controller 提供原生账户环境，不接收调用方
+凭据；Task、Role 与具体错误记录的读权限仍受约束。无 Run 启动失败与原生拒绝
+复用一份错误和通知。`35→36` 保留历史错误字节和旧账本，把未记录配置标为不可用，
+不猜测补齐。
+
+精简失败上下文不再依赖执行、Review 或 Session 协议；`36→37` 把原快照留在审计中。
+重复原生提交拒绝通过共同写入入口只产生一个错误和一条上级通知。小容量注入测试
+验证结果淘汰、进行中查询合并、显式刷新以及真实的缓存来源标记。
+
 ## Skill 与指令变更
 
 一并审阅共享的 Runtime 合同和受影响的 Role/Project Skill。用几个相关场景检查指令
@@ -83,10 +162,26 @@ package-start 检查跟随已安装树中的本地 Skill 引用，包括跨 Role
 
 ## CI 与发布
 
-`ci.yml` 运行 core smoke 加一个包装配/启动检查。它不运行第二遍 lint，也不运行单独的
-宽泛回归套件。`publish.yml` 复用那个确切的、已过门的提交，只增加发布独有的 tag、
-产物、安装和 provenance 检查。
+`ci.yml` 在每个 PR 上构建一次，运行 core 及一个组装包正常链路检查，不重复 lint，
+也不增加宽泛回归套件。
+`node scripts/smoke-runtime-package.mjs --assembled .release-stage` 经过真实
+CLI/Controller/Host/SQLite 与隔离 tmux，仅用确定性夹具替换外部 Provider。它验证
+setup、输入跨重启持久化及幂等、scratch 激活、原生结果入库、完成后保留会话，以及
+归档释放活/死 pane 和附属查看 session，且不影响相似名称的相邻 session。
+夹具拥有新建 Home 和独立 PATH，在 setup 前建立清理责任，不调用安装的真实模型 Agent。
+
+`publish.yml` 通过 `YUI_INSTALLED_ROOT` 对刚安装的包执行同一个 smoke，增加真实
+npm bin、依赖、受支持 Node 版本、产物和 provenance 边界。这证明运行时集成，不证明
+真实模型行为。纯契约与安全检查保留在 `test/core`，生产组件组装在这里验证，
+不只依赖模拟端口。
+组装包检查还验证固定身份输出，以及升级侧通过组装包采集资源和精确 Controller 身份，
+不执行安装或发布效果。
 
 作为开发者或审查者的已配置 Agent 是普通执行资源。把一个真实 provider 或模型作为验证
 对象则不同：付费 API、共享 Home、生产系统、真实账号额度以及其他不可丢弃的外部效果，
 绝不由一个测试或验证请求隐含。它们需要用户就确切的资源和效果边界提出显式请求。
+
+获授权的真实模型检查应区分原生接受、精确 Turn 完成，以及独立核验的文件、测试、
+提交和 Task 事实。缺少固定回显标记不是功能失败。Session 替换后，核验新会话读取
+原输入，并关联它自己的终态，不要求每个历史 wake 都收到该终态。正常完成与归档
+应在停止执行之前检查，stop/cancel 清理是另一条路径。报告须保留这些证据区别。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.15.12",
+  "version": "0.16.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -47,6 +47,11 @@ These are instruction routes, not new lifecycle states or a scheduling
 protocol. Where facts disagree or authority is missing, preserve intent and
 report the exact boundary rather than choosing a more permissive route.
 
+Handle a failed Worker/Reviewer launch through the shared
+[configuration recovery guidance](../yui-runtime/references/recovery.md#configuration-and-model-name-failures).
+Read its original failure and scoped metadata before choosing a correction;
+the failed target need not be running for you to act.
+
 ## Maintain useful durable context
 
 The DB Brief is the current summary, not a full plan or a history of messages.

package/skills/yui-leader/references/integration.md

@@ -5,11 +5,10 @@ notification. Inspect the original result, diff, checks and exact Candidate.
 If insufficient, return bounded feedback to the owning WorkItem/Role while
 its scope remains valid.
 
-For acceptable isolated Git changes, capture and integrate the latest Candidate
-before acceptance:
+For acceptable isolated Git changes, inspect the latest Candidate's committed
+Git snapshot and integrate it before acceptance:
 
 ```sh
-yui task work capture <work-id>
 yui task integration start <task> --project <project> \
   --work-item <work-id> --strategy <ff|cherry-pick|merge|manual> \
   --check "<Project Policy command>"
@@ -17,6 +16,11 @@ yui task work accept <work-id> --summary "<decision and evidence>"
 ```
 
 These are distinct decisions; confirm Integration succeeded before acceptance.
+ChangeSet capture is optional diff evidence, not a prerequisite for this operation.
+Choose the order and strategy for each result from current Task facts, then call
+one Integration at a time for the same target. There is no ChangeSet merge queue
+or queue processor. Core checks the exact source, checks and target update;
+the Agent owns sequencing and recovery decisions.
 Preserve each managed workspace's owner and the Task's recorded base. Do not
 silently advance that base because a remote branch moved.
 
@@ -45,8 +49,8 @@ the final target update. Read the terminal result, then use:
 yui task integration continue <task>/<integration>
 ```
 
-This also applies when no manual conflict resolution was needed. Do not start
-a duplicate Integration or wait for an empty queue to finalize it.
+This also applies when no manual conflict resolution was needed. Continue the
+same attempt; do not start a duplicate Integration to consume its Job result.
 
 Resume interrupted Git/Job work on this attempt when its source/candidate and
 Job identities can be proved. A clean HEAD, leftover REBASE_HEAD or successful

package/skills/yui-leader/references/planning.md

@@ -51,9 +51,15 @@ and historical Runs/Sessions count even when no Session is currently busy.
 “Manual activation” means an explicit user action, not that the user must type
 CLI commands: an authorized Operator can perform the mechanical operation.
 
-With that authorization, use the formal supported activation operation
-(`task activate <task-id>`) within the caller's authority, or have the Operator
-perform it. Inspect the observable result. Preserve a busy or unknown
+With that authorization, inspect any existing activation request before creating
+one with `task activation request <task-id> --request-id <id> --environment <plan>`.
+Choose the plan from the authorized resources; retain the request id for retries.
+The Controller adopts an eligible request. `task activate <task-id>` is the
+foreground adoption operation for an existing request, not a request-free shortcut.
+A planning Session requests activation and finishes its turn; it must not
+synchronously wait for its own native turn to become quiescent.
+
+Inspect the observable result. Preserve a busy or unknown
 operation's exact request and follow
 [Runtime recovery](../../yui-runtime/references/recovery.md); do not
 self-dispatch, interrupt, kill or replace a Session to bypass the handoff.

package/skills/yui-operator/SKILL.md

@@ -38,12 +38,12 @@ Inspect current Projects, Tasks, and relevant Task context before routing:
 
 ```sh
 yui project list
-yui task list --view compact --json
+yui task list --json
 yui task context <candidate-task-id>
 ```
 
-Use the bounded catalog for discovery, not the detailed legacy list or an
-unconditional traversal of every page. Filter by Project/status/search when
+Task listing is a bounded catalog. Do not unconditionally traverse every page.
+Filter by Project/status/search when
 useful; follow `nextCursor` with the same filters only when more candidates
 are needed. Attention counts cover the authorized catalog before ordinary
 filters and pagination. Follow a category's `--attention` query to enumerate
@@ -52,7 +52,6 @@ its affected Tasks, clearing ordinary filters and retaining its `all` flag.
 candidates (including live Runs and open work), not a computed failure or
 execution status. Inspect the selected Task's Context and original Messages
 before routing or deciding; a summary/ref is not the requirement or report.
-The existing detailed list remains available to explicit legacy consumers.
 
 Route new input to an existing Task when it advances, corrects, narrows, or
 extends the same bounded outcome and shares final acceptance, delivery, or
@@ -75,14 +74,18 @@ yui operator submit "<related request and delta>" --task <task-id> --intent disc
 yui task create "<independent outcome>" \
   --project <project> --base <project>=<ref>
 yui operator submit "<request and routing context>" --task <new-task-id> --intent develop
-yui task activate <new-task-id>
+yui task activation request <new-task-id> --request-id <id> --environment <plan>
 ```
 
+Inspect an existing request before creating another. `task activate <task-id>`
+can adopt an eligible request in the foreground; it never activates a Draft
+without a recorded request and environment plan.
+
 Choose the submission intent explicitly; it is never inferred from the message
-text. `discuss` (the default, and what an old client sends) routes the Draft to
+text. `discuss` (the default) routes the Draft to
 planning; `record` saves the message without waking the Leader; `develop` asks an
 unplanned Draft to activate now, and reports the exact next step when it cannot
-(already planned → activate manually; execution stopped → start it first). Pass
+(already planned → request activation explicitly; execution stopped → start it first). Pass
 `--request-id <key>` to make a submission idempotent: retrying the same key
 returns the original message and routing instead of creating a duplicate, and the
 same key with different text is refused as a conflict.
@@ -139,9 +142,11 @@ For Agent-dependent settings, also read:
 yui --json config agent capabilities <agent-id>
 ```
 
-Use the live or cached capability catalog as authority for model, effort,
-permission, settings source, search, and service-tier values. Do not invent a
-provider value from memory.
+For a Task Role or a reported launch failure, use the scoped query from
+[runtime recovery](../yui-runtime/references/recovery.md#configuration-and-model-name-failures)
+instead of the global defaults above. The catalog reports native options and
+whether custom values are allowed; it is not a complete service-side whitelist.
+Distinguish current and cached metadata, and do not invent provider values from memory.
 
 A Profile combines portable behavior with either a dynamic Global Worker
 runtime source or an explicit Agent with optional model and effort. Applying it

package/skills/yui-runtime/SKILL.md

@@ -93,12 +93,12 @@ invent a Task AgentRun identity for a GlobalRole.
 
 A GlobalRole's durable input uses the same three actions as a Task Role,
 addressed by the Role's own name instead of a Task. The local-user Web surface
-exposes this contract. The current public CLI catalog does not register the
-top-level `role` path, even though its handlers implement `yui role message
-queue|steer` and `yui role interrupt`; CLI routing rejects these commands as
-unknown. Report this availability gap when it prevents authorized work. Do not
-invent another command, fabricate Task/Run ownership or borrow the browser's
-user authority to bypass a managed Session boundary.
+exposes this contract. Use `yui role message queue|steer <role> <text>` or
+`yui role interrupt <role>` through the public CLI. Queue/steer require a stable
+`--request-id`; steer/interrupt require the exact `--expected-target`.
+Configuration remains under `config role` and lifecycle under `session`.
+Do not fabricate Task/Run ownership or borrow the browser's user authority to
+bypass a managed Session boundary.
 
 Queue and steer
 save an owned Message; bare interrupt records a control request, not a new

package/skills/yui-runtime/references/recovery.md

@@ -12,6 +12,53 @@ affected WorkItem, ReviewRound or Integration. Use `task next-action` and
 `execution audit` as decision support, not as an automatic plan.
 Active or quiet observations are not a Task-wide lock or proof of failure.
 
+### Configuration and model-name failures
+
+The already-running caller handles a failed launch: Worker/Reviewer failures
+go to their Leader, and an unavailable Leader's failure goes to the existing
+Operator channel. A target that did not start cannot repair itself. Read the
+referenced error once; do not create a recovery Agent, a polling loop or a new
+Task merely to handle it.
+
+Use the error's capability-query pointer to inspect native metadata with the
+recorded failed configuration:
+
+```sh
+yui task event show <task> <error-event>
+yui task role capabilities <task> <role> --error <error-event> --refresh
+```
+
+The query uses the Controller's Provider environment, not your own Agent's
+possibly different account variables, and requires that Controller to be running.
+It preserves the requested model, workspace, profile/settings selection and
+configured Agent identity. Native settings files and credentials are still read
+currently, not copied into error history. A historical error without a recorded
+configuration, or a changed Agent command/bindings, returns a diagnosis instead
+of borrowing today's Role configuration. To inspect the desired next launch
+explicitly, omit `--error`. Distinguish live, cached and unavailable metadata.
+Do not treat an alias list as a complete Provider whitelist.
+
+Reconcile the original user requirement with exact native IDs and alias
+mappings. Correcting the name of the same authorized model is routine recovery;
+selecting another model, account, permission or cost boundary is not. If there
+is no proven equivalent, preserve the failure and report the missing choice.
+Do not guess names, select a similarly named variant, or silently fall back.
+
+After correcting only the intended configuration, choose the existing operation
+that matches current facts. A rejected notification retains its input:
+
+```sh
+yui task wake show <task> <wake>
+yui task wake retry <task> <wake> --reason "<correction and evidence>"
+```
+
+Retry does not replace a Session or change its immutable effective configuration.
+If an existing Session must adopt changed settings, use the deliberate Session
+replacement operation below; an assigned Run uses its own legal retry operation.
+Accepted or uncertain input cannot be replayed through notification retry.
+Configuration failure is not transient infrastructure recovery, and unchanged
+configuration does not justify another attempt.
+
 ### Bounded infrastructure retry
 
 The Controller, not the Agent, counts and schedules qualifying transient

package/dist/agent/agentRegistry.js

@@ -1,10 +0,0 @@
-import { configuredAgentToDefinition } from "./agent.js";
-export function resolveAgent(id, agents = []) {
-    return listAgentDefinitions(agents).find((agent) => agent.id === id) ?? null;
-}
-export function listAgentDefinitions(agents = []) {
-    return agents.map(configuredAgentToDefinition);
-}
-export function supportedAgentIds(agents = []) {
-    return listAgentDefinitions(agents).map((agent) => agent.id);
-}

package/dist/agentRun/runIdentity.js

@@ -1,22 +0,0 @@
-import { MAX_SESSION_TITLE_LENGTH } from "../runtime/sessionTitle.js";
-/**
- * Prefixes managed launch input with its session title. The bootstrap body
- * exposes the exact current AgentRun identity to the Agent, while structured
- * delivery metadata and control hooks retain the delivery fence.
- */
-export function prefixYuiTitleInput(input, title) {
-    const text = input.replace(/\r/g, "").trim();
-    if (text.length === 0)
-        throw new Error("Managed input body is required.");
-    return `${requireRunTitle(title)}\n\n${text}`;
-}
-function requireRunTitle(value) {
-    const title = value.trim();
-    if (title.length === 0
-        || title.length > MAX_SESSION_TITLE_LENGTH
-        || /[\r\n\0]/u.test(title)
-        || !title.startsWith("Yui ")) {
-        throw new Error("AgentRun title is invalid.");
-    }
-    return title;
-}