@zq-silk/yui 0.16.1 → 1.0.0-alpha

package/docs/storage-baseline.zh-CN.md

@@ -0,0 +1,106 @@
+# 存储基线 1.0
+
+Yui 1.0.0-alpha 是纯净运行基线。软件版本 `1.0.0-alpha`、Home 存储版本 `1.0`、
+记录格式版本 `1`、Controller 协议版本 `1` 各有职责。后续 `1.0.0` 软件包
+复用最终已验证的预发布存储契约，不再重置。首个 alpha 发布后如需修改
+持久化契约，必须声明显式的小版本迁移。
+
+## 当前运行包
+
+- `storage_schema` 的单行记录是唯一存储版本权威，包含格式、主版本、小版本、
+  Schema 摘要与创建时间。JSON 中版本采用 `"1.0"` 字符串，不用浮点数。
+- 新 Home 一次创建最终 DDL，不执行旧 v1→v37 链。普通读取只校验当前身份、
+  物理结构和类型化记录，不转换数据。
+- 显式 `upgrade/update` 默认也只允许同主版本内连续的小版本升级。
+  首个 `1.0` 尚无小版本升级步骤。跨主版本、降级、未知格式、旧整数版本
+  都会在激活前拒绝；指定软件版本不等于授权跨存储主版本。
+- Yui 自有记录格式从 1 开始。Host 控制采用独立的
+  `yui-agent-host-control/v1`，不会误认历史 `yui-agent-host/v1`。
+  原本为 v1 的 Context、Run、Host 事件和 Driver 协议保持 v1。
+  外部 Provider 协议和依赖版本不重置。
+- 业务 revision、授权 epoch、ID、事件序号、原生数据和冻结 Context
+  不是 Schema 版本，不能重置。
+- `storage_migration_archive` 只保留不透明审计证据，不解释旧格式来执行工作。
+  其中的旧版本数字与原始字节保持不变。
+- Candidate 的当前权威只有所属 WorkItem 的候选数组。基线不再创建无用的
+  `work_item_candidates`、`coordination_locks` 表或废弃的 `idx_input_open` 索引。
+
+运行 tarball 不包含历史迁移模块，也不包含独立转换器。旧 tag 和发布包用于
+显式诊断，不构成运行时回退。
+
+## 从 0.16.2 一次性转换
+
+独立 `yui-baseline-cutover` 压缩包只接受精确的 0.16.2 结构和完整 v37 账本。
+更旧 Home 必须先通过 0.16.2 升级；转换器本身不执行整条旧迁移链。
+准入依据是精确的存储结构与账本，不是当前安装的软件版本号；
+已经满足该 v37 契约的 Home 不需要为了改软件编号而重写数据。
+
+本次尚未发布的 v37 → 1.0 转换保留缺少可选 Snapshot 引用的 Run、原始引用和结果。
+记录可以读取不代表它必须能执行：证据缺失不应阻断整个 Home 转换。
+Leader／Operator 可以查看、废弃异常 Run；显式普通重试根据当前授权事实创建
+新的 Run 和 Snapshot，不改写旧证据。Review／结果汇总若要复用确切冻结证据，
+仍需满足该操作的前提。未知格式、结构损坏和未结算外部效果仍是独立的转换阻塞条件。
+
+1. 使用 0.16.2 结算活动 Run、Job、已认领通知、在途重试和未知外部效果。
+   保留排队意图，不伪造完成。停止受管 Session 和 Controller。
+   `session stop --all` 会拒绝忙碌 Session，不是强停或丢弃工作的授权。
+2. 将已发布的 1.0.0-alpha 暂存在独立安装前缀中，安装所需原生依赖。
+   不先覆盖全局 CLI，不让新 Controller 打开旧 Home。
+3. 核验转换包校验和并解压，调用入口。以下路径均为**占位示例**：
+
+```sh
+node /absolute/converter/cli.mjs \
+  --home /absolute/home --runtime /absolute/staged/package
+
+node /absolute/converter/cli.mjs \
+  --home /absolute/home --runtime /absolute/staged/package \
+  --apply --backup-dir /absolute/new-backup-directory
+```
+
+`--runtime` 指包含 `package.json`、`dist/` 和可用依赖的软件包目录，
+不是 `bin/yui`。默认仅检查。`--apply` 要求 Home 外一个不存在的新备份目录，
+其父目录必须存在且为规范物理路径。从外部 Operator shell 执行，不在受管
+Task 或正在转换的 Session 内执行。
+
+工具拒绝活动持久执行、待应用 outbox、活动 Session、仍存活的登记进程、
+可观测到引用此 Home/数据库的进程、待消费的原生 Inbox 文件，以及未完成的
+Controller 交接或发现记录。登记所有者身份不可验证时仍阻塞；不会接管或
+终止无关用户进程。也应停止非受管写入者及外部工作区编辑器：普通文件复制
+不是文件系统快照。维护锁和 SQL 写事务保护实际转换。
+
+变更前复制整个 Home，并生成带校验和的独立 SQLite 备份。转换只处理明确的
+Yui 记录封装及活动类型化验证计划，将每个改写前的原始负载和旧账本保存在审计中。
+用户文本、原生负载、冻结 Context、Git 数据、未提交文件、ID、计数和 Task
+结果保持原样。
+删除两张旧表之前，每一行原始内容都写入审计的
+`baseline-v37/retired-table/<table>` 分类，不把其中的负载当作活动记录规范化。
+回执以 `retiredRows` 单独报告归档行数。
+
+旧 `active-release.json` 和 `runtime-identity.json` 归档到
+`retired-runtime/`，不改写成新运行事实。工具不恢复旧 Host、不改全局安装、
+不启动 Controller、不提交模型输入。转换成功后，再由暂存的 1.0.0-alpha CLI
+安装精确版本并启动新运行环境；通过正常显式生命周期创建新 Session，
+历史记录不代表活动授权。
+
+声明的运行资源目录中的隔离所有者标记也会先验证旧摘要，再转换格式并重算
+相应指纹，原文件保存在归档中。资源路径、namespace 和端口分配不变。
+未知标记或符号链接直接阻塞，不猜测接管。
+
+## 证据与恢复
+
+成功结果为 `outcome: converted`、目标 `1.0` 及精确备份路径。
+对有效新 Home 重复运行返回 `already-current`，不再次备份或改写。
+
+- `backup/home/` 保留 Home 树；`backup/yui.db` 是一致的独立数据库快照；
+  `receipt.json` 记录来源、目标、摘要及转换结果；`retired-runtime/` 保存旧绑定。
+- 校验失败时回滚 SQL，并恢复本次移动的运行绑定。若恢复无法确认，错误会指出
+  保留文件；Home 应继续保持停止。
+- 崩溃或回执写入失败不证明数据库仍是旧版。先检查实际格式与备份，再选择恢复；
+  没有自动修复 worker 或猜测性重放。
+- 回滚前停止新写入者、另存失败或新 Home，再将旧 Home 树和独立 `yui.db`
+  恢复到**原来的同一路径**，不能混入新 WAL/SHM。只使用 0.16.2；
+  按精确进程身份检查快照中转换器自己的维护锁。
+- 一旦新版产生业务写入，恢复旧备份会丢失这些新写入，必须明确处理，不能自动恢复。
+
+真实 Home 转换和发布需要另外获得用户授权。隔离样本通过不等于生产 Home
+已经满足转换条件。

package/docs/task-delivery.md

@@ -83,7 +83,7 @@ how the Agent ordered them.
 A configured VerificationPlan reuses only complete, successful, log-verified
 evidence for the exact Project, commit, plan, toolchain and target/base boundary.
 A plan with no reusable evidence executes normally. Plans require
-`schemaVersion: 2` and contain no `l1` or `record/reuse/enforce` mode.
+`schemaVersion: 1` and contain no `l1` or `record/reuse/enforce` mode.
 Storage 34→35 preserves the original Project declarations, L1 artifacts and
 binary logs in migration audit storage, outside current execution and cache
 lookup. Historical `historical-change-sets` Integrations must be settled and
@@ -109,7 +109,7 @@ Unstructured checks do not search historical Jobs for a substitute result.
 Fresh execution withdraws the old success before starting. Failure is recorded
 as failure; interruption, missing logs or a mutated candidate leave no reusable
 success. Both Job and local execution verify the exact clean candidate before
-publishing successful proof. The v5 L2-only execution digest excludes older proof without
+publishing successful proof. The baseline-v1 L2-only execution digest excludes older proof without
 deleting its history. A stale
 cache consumer cannot restore an older result. Release lookup considers the
 newest recorded matching proof rather than searching past a failure for an
@@ -143,6 +143,33 @@ infer that unrecorded WorkItems mean direct execution was requested.
 
 ## Completion and remote delivery
 
+`task complete` is offline by default and never integrates upstream commits or
+changes Git HEAD. `--refresh-remote` only fetches remote objects in Task-owned
+repositories to report freshness; it does not rebase, start Integration checks,
+or update the stable Project checkout. A behind/diverged/unknown remote remains
+an advisory for local completion, not a claim of remote delivery. Refresh failure
+is reported as unknown with its error and never as fresh success. To inspect
+without completing or preparing Review, use `task base status <task> [--refresh]`.
+
+Choose any necessary upstream integration explicitly before completion.
+`task upstream integrate <task> (--latest|--project <project>)` requests a fixed
+rebase/check/CAS sequence. It returns each Integration and admitted Job, separating
+the candidate from the committed HEAD. A blocked batch preserves prior results,
+the failing Project/phase, any uncertain attempt and unattempted Projects; inspect
+and continue exact attempts instead of replaying the whole batch. It neither
+requests Review nor completes the Task.
+
+Completion still prepares/dispatches an already-established final Review without
+another approval. Without that contract it does not create a Reviewer.
+JSON `stage` distinguishes `completed`, `already-completed`, `review-pending`,
+`review-running`, and `review-blocked`; Review stages leave the Task active.
+`projectHeads` identifies the inspected heads, and the ReviewRound carries its
+separate frozen candidate and exact Run reference. After dispatch, the top-level
+stage reflects its result while `command` retains the earlier preparation result.
+`baseFreshness` and `warnings` expose the observation and its limitations;
+freshness is null when skipped for a completed Task or existing Review.
+An already-completed response does not re-observe or invent delivery heads.
+
 Completion checks the current WorkItems, latest captured/integrated results,
 applicable Review contract and exact clean committed Task-main snapshot.
 It also refuses completion while a new user/Operator message is still awaiting
@@ -201,6 +228,67 @@ Cancelled intent does not prove the runtime stopped. User/Operator may reopen
 cancelled Tasks; Leader may reopen completed Tasks. Reopening requires fresh
 explicit input/work selection and never replays previous delivery requests.
 
+### Route follow-up delivery to the owning Leader
+
+Development, local acceptance, PR/MR submission, merge and ordinary corrections
+are normally stages of the same result, not reasons for new Tasks. The Operator
+routes the authorized request to the owning Leader, verifies evidence and reports
+to the user. For several serial deliveries, inspect each Task's original request,
+current authority, Publication and dependencies; send only the current Leader its
+repository/target branch, authorized effects, limits and expected proof. That
+Leader synchronizes and validates in its own legal managed workspace, performs
+the authorized delivery, and records Publication there. Advance the next Leader
+only after verifying the exact merge and accepted-result coverage. Do not default
+to a common delivery Task, Global implementation, or duplicate PR registration
+across Tasks. Submission acceptance, a Run terminal and Task completion are not
+merge evidence.
+
+For an active, execution-enabled Task, use
+`operator submit "<request>" --task <task> --intent develop --request-id <id>` or
+unaddressed `task message send <task> "<request>" --intent develop --request-id <id>`.
+Choose one and retain its receipt. Ordinary Leader input omits `--to leader`;
+explicit recipients require an existing WorkItem/ReviewRound Assignment.
+External-effect authorization must be explicit: development does not grant
+push/PR/merge, and merge does not grant release, production update or archive.
+
+When the user explicitly requests further implementation or delivery of the same
+completed, unarchived result, the Operator may perform the necessary
+`task reopen <task>` before submitting the new scoped request. The user need not
+add a mechanical “reopen” confirmation. These existing operations suffice; no
+auto-reopen option or post-completion execution protocol is needed. Ordinary
+send/queue/submit, including `--intent develop`, still refuses a completed Task
+before saving new input. Queries, record-only input and discussion do not grant
+reopening authority.
+
+Reopen returns the Task to active and clears current completion metadata while
+preserving original events, fixed heads/reports and Publication history. The
+Leader separately verifies and accepts the new result; old validation does not
+automatically cover it. Reopen preserves an independent execution stop: only the
+authorized `task execution start` path can lift that gate after cleanup.
+Cancelled intent requires separate restoration authority; archived Tasks cannot
+reopen, and retained workspaces or Session replacement do not bypass lifecycle.
+
+Reopening and submitting are two atomic operations with separate outcomes.
+Inspect the lifecycle result and saved/queued receipt; if submission fails,
+read current state and continue only the unapplied step within the same authority.
+Keep the same key for a matching submission retry, never replay unknown effects,
+and do not reopen again merely to retry after another completion or cancellation.
+The reopen notification can arrive before the new Message: the Leader waits for
+the actual request, without rerunning accepted work or immediately completing
+again. Once the request arrives, it proceeds without another “continue.”
+
+Publication upsert, diff/adopt and verify remain separate, authorized atomic
+operations for completed, unarchived results. They need no reopening when no new
+execution is requested. After reopened work, record its new completion without
+rewriting the earlier baseline, then apply the existing candidate adoption and
+verification rules where relevant.
+
+An independently acceptable, deliverable and reversible new outcome, or an
+explicit user request for a new Task, can justify a new Task; explain that reason.
+Completed status, revalidation, shared files or the need for a PR alone cannot.
+Configuration, authorized lifecycle actions and urgent safety interventions
+remain Operator responsibilities and do not each require a new Task.
+
 ## Archive
 
 Archive requires independent user/Operator authorization for an exact completed
@@ -276,6 +364,26 @@ Task or new durable owner prevents quarantine/deletion; uncertainty retains the
 resource with a diagnosis. Reopened quarantined resources can be restored.
 This adds neither a retry worker nor another persistent ownership protocol.
 
+Current Resource records are read strictly: required safety fields, enum values,
+and every active reference must be valid. A malformed record or mismatched
+SQLite/payload identity is reported without supplying defaults, dropping refs,
+or rewriting stored evidence. This enforces the current storage 1.0 record contract.
+
+Failed preparation compensates only its unadopted resources. Standalone Task
+clones use exact clone identity/cleanliness checks before direct deletion;
+linked worktrees use their captured path, branch, commit and own Git common
+directory. A Git error (including a lock) never falls through to recursive
+deletion. Same-operation temporary clone cleanup first proves its reserved
+directory identity. Already-adopted workspaces remain outside compensation.
+Failures preserve the original error, completed removals and exact remaining
+targets, whose failed-command effects may be unknown.
+
+An Agent may still choose direct `rm` for an exact resource within its existing
+authority after inspecting ownership and contents, including when Git metadata
+is unavailable. That is an explicit recovery choice, not a generic automatic
+fallback or a new approval workflow. Keep Task records, other owners' resources
+and unknown live processes outside that deletion.
+
 `yui task archive-preflight <task> (--integrated|--abandon) [--force] [--json]`
 reads current admission, delivery and exact-owner cleanup checks in one report.
 It is available before and after archive, including to the Task's authorized

package/docs/task-delivery.zh-CN.md

@@ -70,7 +70,7 @@ Integration 在候选 worktree 中套用固定来源提交，运行已配置的
 `historical-change-sets` Integration 必须先结算且不存在执行／交付引用，才能将
 完整 payload 转为 `integration.source-retired` Task 事件；旧 ID 不会复用。
 无匹配证据时正常执行。
-计划必须提供 `schemaVersion: 2`，不再包含 `l1` 或 `record/reuse/enforce` 模式。
+计划必须提供 `schemaVersion: 1`，不再包含 `l1` 或 `record/reuse/enforce` 模式。
 
 新建操作时显式要求重跑：
 
@@ -88,7 +88,7 @@ yui task upstream integrate <task> --project <project> --rerun-checks
 
 新执行开始前撤下旧成功。失败如实记录；中断、缺失日志或候选被改写时，
 不会保留可复用成功。Job 和本地执行在发布成功证据前，共同检查候选的精确提交、
-分支和干净状态。v5 L2-only 执行摘要隔离旧证据，不删除原有历史。
+分支和干净状态。baseline-v1 L2-only 执行摘要隔离旧证据，不删除原有历史。
 过期的缓存使用者不能恢复旧结果。发布查询查看最新匹配证据，不跳过失败去找旧绿灯。
 缓存只表示当前可复用证据，不充当 Task 执行历史；原 Job 和 Integration 记录独立保留。
 
@@ -113,6 +113,27 @@ Reviewer Run 持有报告；执行成功不等于语义通过。验收归 Leader
 
 ## 完成与远程交付
 
+`task complete` 默认离线，绝不集成上游提交或改变 Git HEAD。
+`--refresh-remote` 仅在 Task 自有仓库中获取远端对象并报告新鲜度，不会 rebase、
+启动 Integration 检查或更新稳定 Project checkout。远端落后、分叉或未知仍是本地
+完成的提示，不是远端交付证明；刷新失败返回 unknown 和原始错误，不伪装成最新成功。
+只想查询而不完成或准备 Review 时，使用 `task base status <task> [--refresh]`。
+
+需要上游集成时，由 Agent 在完成前显式选择。
+`task upstream integrate <task> (--latest|--project <project>)` 请求固定的
+rebase／检查／CAS 步骤，返回每个 Integration 和已接纳的 Job，并区分候选与已提交
+HEAD。批处理中途受阻仍保留先前结果、失败的 Project／阶段、效果需查证的尝试以及
+尚未尝试的 Project；应检查和续作确切尝试，不重放整个批次。此命令既不请求 Review，
+也不完成 Task。
+
+完成仍会按已建立的 final Review 合同准备／派发 Review，不要求重复批准；
+没有该合同时不会创建 Reviewer。JSON 的 `stage` 区分 `completed`、
+`already-completed`、`review-pending`、`review-running` 和 `review-blocked`，
+Review 阶段保持 Task active。`projectHeads` 标明本次检查的 head，ReviewRound
+独立携带冻结候选及确切 Run 引用。派发后顶层阶段反映实际结果，`command` 保留先前
+准备阶段的部分结果。`baseFreshness` 和 `warnings` 暴露观察与限制；已完成或已有
+Review 时跳过刷新，该新鲜度字段为 null。重复完成不重新观察或补造交付 head。
+
 完成会检查当前的 WorkItem、最新捕获/集成的结果、适用的 Review 合同以及确切的、
 干净且已提交的 Task-main 快照。当有一条新的 user/Operator 消息仍在等待 Leader
 投递时，它也会拒绝完成。当前原生轮次必须结束，待处理的通知才能到达；随后 Leader
@@ -155,6 +176,51 @@ CLI、当前 Leader Context 和 Web 从同一组事实推导覆盖，不联网
 取消意图不证明运行时已停止。user/Operator 可以重开已取消的 Task；Leader 可以重开
 已完成的 Task。重开需要全新的显式输入/工作选择，绝不重放先前的交付请求。
 
+### 后续交付路由给原 Task Leader
+
+开发、本地验收、提交 PR/MR、合并和普通修正，通常是同一成果的不同阶段，不是
+新建 Task 的理由。Operator 将获授权的请求交给原 Task Leader，核验结果并向用户
+汇报。多个 Task 串行交付时，先读各自原始请求、当前权限、Publication 与依赖，
+只给当前那一个 Leader 发送仓库/目标分支、授权效果、边界和预期证据。Leader 在自己
+合法的受管工作区同步、验证、执行获授权交付，并在原 Task 记录 Publication。
+核实精确合并与已验收成果覆盖后，才推进下一个 Leader。不要默认新建统一交付 Task、
+由 Global 接管实现，或跨 Task 重复登记同一 PR。投递接受、Run 终态与 Task 完成
+都不等于合并证据。
+
+对于 active 且 execution enabled 的 Task，使用
+`operator submit "<请求>" --task <task> --intent develop --request-id <id>` 或
+不带收件人的 `task message send <task> "<请求>" --intent develop --request-id <id>`。
+二选一并保留回执。普通 Leader 输入省略 `--to leader`；显式收件人要求已有
+WorkItem/ReviewRound Assignment。外部效果必须明确获授权：开发不授予
+push/PR/merge，合并不授予发版、生产升级或归档。
+
+用户明确要求继续同一个已完成、未归档成果的实现或交付时，Operator 可以先执行必要的
+`task reopen <task>`，再提交这次有界请求。用户无需机械地额外确认“重开”。
+现有两步即可满足目标，不需要自动重开开关或后完成执行协议。普通 send/queue/submit
+（包括 `--intent develop`）仍会在保存新输入前拒绝 completed Task；只读查询、
+record-only 输入和讨论本身不授予重开权限。
+
+重开回到 active，撤下当前完成元数据，同时保留原事件、固定 head/报告和 Publication
+历史。Leader 对新结果单独验证与验收，不能把旧验证直接宣称为新结果的证据。
+重开保留独立的执行停止决定；只有获授权且完成清理的 `task execution start` 路径
+可以解除 gate。恢复 cancelled 意图需要单独明确授权；archived Task 不能重开，
+保留工作区或 Session 替换都不能绕过生命周期。
+
+重开与提交是两个有独立结果的原子操作。分别检查生命周期结果和 saved/queued 回执；
+提交失败时读取当前状态，仅在权限未变时继续尚未生效的那一步。相同提交重试保留原 key，
+不重放效果未知的操作，也不因重试而再次重开已经重新完成或取消的 Task。
+重开通知可能先于新 Message 到达：Leader 等待具体新请求，不重跑已验收工作，
+也不立即再次 complete；请求到达后不再要求额外“继续”。
+
+Publication upsert、diff/adopt、verify 仍是未归档已完成成果的独立授权原子操作，
+没有新执行请求时不必重开。重开后的工作记录自己的新完成证据，不改写旧基线，
+再按需应用现有 candidate 采用与验证规则。
+
+真正可独立验收、交付、回滚的新成果，或用户明确要求新建 Task，可以成为例外，
+但应说明实质理由。仅因 completed、重新验证、共用文件或需要 PR 都不成立。
+配置、获授权的生命周期动作与紧急安全干预仍由 Operator 负责，不要求每个原子管理
+操作都新建 Task。
+
 ## 归档
 
 归档需要针对确切的 completed 或 cancelled（retired）Task 获得独立的 user/Operator
@@ -214,6 +280,20 @@ Session 进程归属只读取 SQLite `session_owners`，并校验存活 PID 和
 保留资源并给出原因。已经隔离、随后重新打开的资源可以恢复。
 不增加后台重试 worker 或第二套持久所有权协议。
 
+当前 Resource 记录严格验证必需安全字段、枚举和每条活动引用。损坏记录或 SQLite
+主键与 payload 身份不符会明确报错，不补默认值、不丢弃坏引用、不改写原始证据。
+这是执行当前存储 1.0 的记录合同。
+
+准备失败只补偿未采用的资源：独立 Task clone 经精确身份、干净状态检查后直接
+删除；linked worktree 使用准备时捕获的路径、分支、提交和自身 Git common directory。
+任何 Git 错误（包括锁定）都不会自动转为递归删除。同一次 clone 的临时补偿先验证
+预留目录身份；已采用工作区不进入补偿。失败保留原始错误、已完成删除和剩余精确
+目标，失败命令的效果可能仍未知。
+
+Agent 仍可在既有授权内，检查归属和内容后主动选择对精确资源执行 `rm`，包括 Git
+元数据已不可用的情况。这是显式恢复选择，不是通用自动回退，也不新增审批流程。
+Task 记录、其他 owner 的资源和存活状态不明的进程不因此获得处置授权。
+
 `yui task archive-preflight <task> (--integrated|--abandon) [--force] [--json]`
 一次读取归档条件、交付覆盖与各精确 owner 的清理检查。归档前后都可用，获授权的
 Task Leader reader 也可读取。这里的 `--force` 仅选择要检查的行为，不会归档、

package/docs/task-discovery.md

@@ -14,6 +14,15 @@ same query at `GET /api/dashboard`. The per-Task detail endpoint retains
 execution, observability, usage and remote-delivery fields. Discovery itself
 does not change persistent records.
 
+Web labels catalog-wide attention separately from filtered/page-local lists.
+Native Session activity is an explicit optional read at
+`GET /api/dashboard/sessions` with the same compact page parameters. It observes
+only that returned page, includes direct inputs without AgentRuns and shows its
+own read time. It is not part of the compact query or its 32 KiB budget, and never
+claims a global running-Session count. Changing page membership clears this
+observation. Task status counts and raw signals remain separate from activity
+and semantic progress.
+
 ## Query and page contract
 
 ```sh

package/docs/task-discovery.zh-CN.md

@@ -11,6 +11,12 @@ Context 快照、消息确认、执行判断或验收结论。
 Web 通过 `GET /api/dashboard` 使用同一查询；单个 Task 的详情接口继续保留
 执行、观测、用量和远端交付字段。目录查询本身不改变持久记录。
 
+Web 将目录级关注计数与过滤后／当前页列表明确区分。原生会话活动通过
+`GET /api/dashboard/sessions` 携带相同紧凑页参数显式按需读取，只观察该返回页，
+包含无 AgentRun 的直接输入，并标注独立读取时间。该观察不进入紧凑查询及其
+32 KiB 预算，不冒充全局运行会话数；页成员变化时清除观察。Task 状态数量、
+原始执行信号仍与活动和实质进展分开。
+
 ## 查询和分页合同
 
 ```sh

package/docs/testing/verification-levels.md

@@ -49,169 +49,46 @@ is required.
 
 ## Permanent core smoke
 
-`npm test` and `npm run test:core` build the checkout and run one permanent suite:
-
-1. the built CLI starts and its catalog exposes setup/update/upgrade/Task commands;
-2. one normal SQLite Task and Message survive a reopen;
-3. a supported historical Home migrates through the linear storage chain to current;
-4. the built-in Codex and Claude Drivers are registered;
-5. one independent declarative plugin is created, validated, called and disabled
-   through authenticated ingress, with its selection and validation preserved.
-6. a Task starts from durable Operator input, exposes planning Context and enters
-   delivery with its original intent and captured planning authority preserved;
-   scratch workspace release does not require a fabricated Git identity.
-7. Session replacement preserves pending original Messages and independent work;
-   cleanup blocks new notification claims, and successor acceptance cannot
-   settle an old wake or later queued input. Old Sessions keep scoped reads
-   but cannot regain write authority;
-8. InputRequests survive Session replacement without a synthetic AgentRun;
-9. late native terminals cannot settle successor input or invent acceptance;
-10. remote Operator startup carries its reserved workspace, Role instructions
-    and scoped CLI identity, while offline diagnostics/recovery remain reachable.
-11. durably queued native results survive Controller outages and replay without
-    poisoning the Host; known terminal inputs do not become active merely by aging;
-12. Task-final review can use its Task-local Reviewer without a global template.
-13. a native error label permits replacement only with latest-Turn terminal
-    evidence and drained background execution; a wrong native account cannot
-    authorize cleanup.
-14. Claude receives its native environment and settings paths without injected
-    authentication helpers, rewritten approval records, or secrets forwarded
-    to unrelated adapters; native authentication selection stays with Claude. Environment refresh
-    removes revoked keys and keeps values out of durable Task/Role records.
-15. ordinary Integration conflicts continue without a decision gate; exact Git
-    receipts and an admitted Job resume interrupted delivery without replay.
-    Validation settlement distinguishes current check conditions from an
-    already-applied CAS. Migration preserves provable old bound FF Jobs and
-    classifies old conflicts without inventing successful checks.
-16. explicit force archive commits before cleanup and preserves uncertain
-    delivery/runtime evidence; partial cleanup and late results remain traceable,
-    while archived runtime resources never become automatically safe to delete.
-    Archive preflight preserves durable records and the Git index, distinguishes
-    frozen-result differences, and cleanup rechecks moved heads, owner branches
-    and new dirt. Read-only Git status never executes configured clean filters.
-17. Host facts reach the existing Inbox even when its compiled store cannot
-    read the Home; Controller-side fencing, ACK-loss replay, and legacy-Host
-    upgrade refusal preserve the original execution. A frozen independent v1
-    protocol producer remains the same process across a real 19→22 migration,
-    authenticates RPCs to both Controllers through refreshed discovery, and
-    retains facts during the disconnected window. Production launch planning
-    also preserves scoped startup evidence before native Session adoption
-    without exporting a Run ID into the Session environment.
-    This fixture is the minimum supported new wire contract, not a claim that
-    pre-fix released Hosts can be hot-patched.
-    Archive racing Host ingress retains the complete source envelope without
-    reopening the Task or settling original uncertain input.
-18. Project maintenance waiters yield to the holder, use a shared 60-second
-    monotonic budget with independent 200–500ms jitter, and cancel on Controller
-    stop without losing activation intent. Disposable lock/SQLite/Git fixtures
-    cover exclusion, partial release and under-lock revalidation; injected time
-    checks the minute-long deadline without sleeping for a minute. Competing
-    activations each adopt their own workspace without replaying Git work.
-19. Task usage distinguishes zero, partial and unknown across exact requests,
-    cumulative baselines, Session replacement and native child overlap. A small
-    event fixture checks direct Leader/parallel time semantics and the shared
-    CLI/Web/audit lifetime projection without collecting Provider data.
-20. explicit cleanup releases retained terminals without affecting other Tasks
-    or claiming that live resources are gone; Controller replacement waits for
-    the old process to exit.
-21. structured verification preserves argv, explicit shell failure, environment
-    and workspace-relative cwd through the actual RPC parser and both local
-    executors. Corrected execution semantics invalidate old gate reuse without
-    rewriting historical artifacts or migrations.
-22. concurrent resource registration preserves unrelated rows and rejects
-    stale same-record writes; GC closes owned connections on success/failure.
-23. Context counts, exact inspection and bounded event deltas work without
-    materializing complete history or acquiring a writer lock. Telemetry
-    ingestion yields to the event loop and drains its worker on close.
-24. Release resume re-queries uncertain effects, retains confirmed work and
-    refuses exhausted grants, using disposable SQLite and fake external ports.
-    These checks do not claim validation of real release services.
-25. The pre-1.0 contract cleanup normalizes old singleton dispatches only through
-    explicit storage migration. Unsupported CLI/ACP input, unregistered development
-    links, unpinned release identities and unsupported quarantine receipts are
-    refused without inventing acceptance or discarding evidence. Current link,
-    configuration and quarantine operations remain usable.
-26. Activation refuses absent intent before resource adoption and still honors
-    planning deferral and cancellation. Retiring the integration queue preserves
-    exact records and active attempts in one rollback-safe migration, without
-    inventing delivery. Conflicted Integrations remain completion blockers.
-27. Unknown lock ownership stays fenced, including unavailable OS evidence.
-    PR lookup distinguishes absence, malformed/ambiguous results and transport
-    failure through injected ports. Receipt-free Git operations remain unchanged,
-    while normal receipt-backed continuation still works. Notification-only
-    migration preserves current delivery and audit history and refuses live links.
-28. SQLite admission ignores unrelated side files but refuses a non-empty Home
-    without its database. Default CLI/HTTP discovery stays bounded and retains
-    off-page Task detail; unknown writer leases diagnose without mutation.
-    Review migration preserves candidate evidence while making scope explicit.
-29. Missing authoritative readers fail before Provider preparation or queue
-    admission instead of becoming empty evidence. WorkItem history retirement
-    preserves the original payload and current work, advances event IDs safely,
-    and refuses unknown old shapes without advancing the migration ledger.
-30. WorkItem overlap is a read-only advisory; exact permission/dependency guards
-    remain. Real local verification proves default reuse, explicit rerun failure,
-    incomplete evidence and stale-consumer rejection through the current proof path.
-    An Integration rerun cannot bypass an equivalent unfinished gate. Policy
-    migration preserves historical execution and blocks an admitted old gate.
-31. Message edits preserve submission intent and immutable request identity;
-    no-op edits do not enqueue work, and an edited develop request cannot create
-    a planning Run. Unkeyed discussions still plan after activation is resolved.
-    Queue identity remains frozen through an interrupt-then handoff; completion sees explicitly
-    queued input. Input migration preserves raw audit evidence, refuses to
-    auto-authorize old pending immediate activations and keeps the prior ledger.
-    The actual Controller continues admitted requests but not cancellations.
-    Required Store reads fail before config mutation or full-scan fallback.
-    Explicit Job requests replay one operation and reject changed or missing keys.
-32. Worker Job admission/management and the pre-spawn gate reject a different
-    owner/workspace; legitimate Worker and Leader Jobs remain usable. Candidate
-    mutation blocks publication of reusable success, including after explicit
-    abort/retry. Upstream wiring returns its admitted Job and continuation IDs.
-    Plugin replacement retains delayed old-generation cleanup errors without
-    undoing a newer selection. A shared validator rejects bad record writes,
-    ordinary/Context reads and full-Home health checks without repairing data.
-33. Built CLI calls refuse replaced Operator writes, Task-owned Home mutations
-    and foreign-Task queries while retaining legitimate reads and current
-    Operator actions. Job reads enforce Context scope at the Controller port.
-    Real local runtime directories move once through quarantine/restore/purge;
-    current durable ownership overrides a stale cleanup plan and prevents
-    purging a reopened Task.
-34. Current CLI rejects `task turn`; completion has one identity and preserves
-    unrelated shell content through install/uninstall. GC protects exact live
-    SQLite Session custody without consulting old JSON. The 34→35 cutover
-    preserves raw retired payloads/log bytes and identity counters, blocks
-    unsettled gates/custody, and rolls back malformed conversions.
-35. Native model aliases/resolved IDs and open custom-model fields retain their
-    distinct contracts; configuration errors display the observed choices.
-    Rejected Leader startup stays quiet across Store reopen and repeated passes,
-    preserves original/later input and blocks premature completion. Explicit
-    retry requeues the exact rejected claim once without rewriting its history;
-    typed contention remains retryable and unknown acceptance cannot be replayed.
-36. Failure-scoped capability reads preserve the recorded model/workspace/settings
-    selection after Role edits, reject changed Agent bindings, honor explicit
-    metadata refresh and identify cached fallback. The Controller supplies native
-    account context without accepting caller credentials. Task/Role/record reads
-    stay fenced. Runless startup and native rejection reuse one error/notification.
-    Migration 35→36 preserves historical error bytes and the earlier ledger while
-    marking absent historical configuration unavailable, never reconstructing it.
-37. Narrow failure context survives independently of execution/Review/Session
-    protocols; 36→37 preserves the original snapshot in audit. Repeated native
-    submission rejection creates one error and one supervisor notice through
-    the shared writer. A small injected cache proves completed-result eviction,
-    pending-request coalescing, explicit refresh and truthful cache provenance.
-
-Keep the test phase seconds-scale; measure TypeScript build separately. Record
-incremental runtime when adding a critical regression. The seven recovery boundary
-cases initially add about 0.4 seconds of test bodies (about 0.6 seconds standalone,
-including module startup) on the development host. Keep real-model launches out
-of this suite. Real tmux/CLI lifecycle checks belong to the bounded package smoke
-below, not a second core daemon matrix.
-The Integration continuation regressions use disposable Git repositories,
-SQLite and fake Jobs, without a provider or shared Home. Their test bodies
-take about 3 seconds on the development host; validation settlement adds
-about 1.4 seconds to the initial 1.5-second coverage.
-Archive preflight adds three small disposable Git/SQLite scenarios (about
-one second of test bodies); broader owner/diagnostic combinations remain
-temporary validation evidence, not a second permanent matrix.
+`npm test` and `npm run test:core` build the checkout and run the maintained suite.
+The baseline cutover retires tests owned solely by the removed v1..v37
+implementation. Their source/evidence remains in the frozen 0.16.2 release;
+mixed tests retain current behavior, such as Review scope and Integration
+completion boundaries.
+
+Current coverage includes:
+
+1. Fresh storage 1.0, exact schema/record validation, no initialization over
+   unknown data, and rejection of old integer formats without mutation.
+2. Independent v37 conversion: original intent/audit/counters, nested Session
+   envelopes, opaque Context, rollback on invalid input, offline backup and
+   repeat-call idempotence. The CLI fixture uses a disposable Home; it never
+   converts a real account. The converter is not part of the runtime tarball.
+3. Exact-version staging, mismatched-target refusal, same-major contiguous
+   minor preflight, explicit maintenance-owner identity across handover, and
+   restoration against captured protocol/storage identity rather than omitted fields.
+4. Durable Task/Message/Decision context, draft activation authority, mailbox
+   claims, notification idempotence, Session replacement and exact late results.
+5. Integration/Job request identity, immutable candidate proofs, conflict
+   continuation, Review scope and final acceptance without fabricated delivery.
+6. Runtime/Host isolation, Provider protocol parsing and bounded retry using
+   fake producers, current configuration provenance and native-account boundaries.
+7. Workspace/GC authority, archive cleanup, resource CAS, telemetry, Web
+   projections and authorized release recovery without real external effects.
+8. Idempotent per-checkout launcher installation, exact argument/Home forwarding,
+   refusal to overwrite unrelated files, and rejection of removed global-link
+   commands before side effects. Development Home reset retains its independent
+   identity checks and backup behavior.
+9. Failure isolation for optional Controller maintenance, individual retry
+   Sessions and Task continuation observation, with scoped errors and no
+   fabricated delivery, cancellation or quiescence.
+
+Keep the test phase seconds-scale and measure build separately. Use the
+existing assembled-package smoke for actual CLI/Controller/Host/tmux wiring,
+not a second daemon matrix. Converter schema fixtures preserve one frozen
+endpoint; do not reconstruct the entire historical chain in the new suite.
+Real-model or real-Home checks require explicit authorization.
+Current envelope checks reject arbitrary unknown fields, rather than maintaining
+a blacklist of retired field names.
 
 ## Skill and instruction changes
 
@@ -234,7 +111,8 @@ on every PR, without another lint or broad regression suite.
 the actual CLI/Controller/Host/SQLite and isolated tmux, replacing only the
 external Provider with a deterministic fixture. It covers setup, durable input
 and idempotency across restart, scratch activation, native result ingestion,
-completion preserving the conversation, and archive releasing live/dead panes
+completion preserving the conversation, explicit reopen followed by one
+idempotent Operator request and its exact native result, and archive releasing live/dead panes
 and grouped viewers without affecting a similarly named neighboring session.
 The fixture owns a fresh Home and its PATH, installs cleanup before setup,
 and never calls an installed model Agent.