@zq-silk/yui 0.16.2 → 1.0.0-alpha

package/dist/worktree/managedWorkspace.js

@@ -34,7 +34,7 @@ export function isTaskOwnedWorkspace(workspace, taskId, taskRoot, bindings) {
 export function createManagedWorkspace(input, now) {
     const timestamp = now.toISOString();
     return validateManagedWorkspace({
-        schemaVersion: 2,
+        schemaVersion: 1,
         owner: validateOwner(input.owner),
         root: resolve(requireText(input.root, "Managed workspace root")),
         entries: normalizeEntries(input.entries),
@@ -43,8 +43,8 @@ export function createManagedWorkspace(input, now) {
     });
 }
 export function validateManagedWorkspace(workspace) {
-    if (workspace.schemaVersion !== 2) {
-        throw new Error("Managed workspace must use schemaVersion 2.");
+    if (workspace.schemaVersion !== 1) {
+        throw new Error("Managed workspace must use schemaVersion 1.");
     }
     validateOwner(workspace.owner);
     if (resolve(requireText(workspace.root, "Managed workspace root")) !==

package/docs/managed-turn-and-session-runtime.md

@@ -61,13 +61,28 @@ Writable Projects come from the Run's captured effective authority; live
 activity is a separate observation, not part of the frozen contract.
 Expansion always requires both `store` and `refId`, even for a unique id.
 
-Historical Run records without a Snapshot remain readable through `run show`
-for audit, but cannot supply execution Context, be submitted or retried.
-Missing/drifted Snapshot evidence fails explicitly; it is never synthesized
-from today's Task. Subsequent observed/steered input records may legitimately
-omit their own Snapshot because they do not establish a new Assignment.
-No stored layout or payload changes: storage remains 37 with the complete
-1→37 migration chain unchanged.
+New Task execution requires an initial Snapshot. Missing evidence does not make
+a retained Run unreadable: inspection, failure settlement and explicit retirement
+remain available to Leader/Operator, and unrelated work can proceed. Submission
+and exact frozen-context reads fail locally when that evidence is absent or has
+drifted. An explicit ordinary retry creates a new Run and Snapshot from current
+authorized facts, without reconstructing the old snapshot; Review and synthesis
+reuse still require exact frozen evidence. Subsequent observed/steered input may
+omit its own Snapshot because it does not establish a new Assignment.
+Storage uses the 1.0 baseline; the independent converter preserves these records
+without making missing optional execution evidence a Home-wide blocker.
+
+Operational failures are scoped to their owner, not treated as proof that the
+whole Controller must stop. Optional resource reaping and continuation metadata
+checks report failures without blocking normal scheduling. Provider retry
+admission is isolated per Session; continuation observation is isolated per Task.
+Job and Global input errors identify their Task/Job or Role and retain the
+original cause. Committed observations stay committed; failed observations do
+not acknowledge input, imply quiescence, or authorize another send or deletion.
+Use the existing status, stop/cancel, retire, acknowledge and explicit retry
+operations for the affected owner. Structural storage corruption, authority
+failure and unconfirmed external effects still require diagnosis at their
+respective boundaries, not a catch-all default or synthetic successful result.
 
 Current Task reads also expose untargeted user/Operator messages to the Task's
 current Worker and Reviewer Sessions, including requirements added after their
@@ -148,13 +163,10 @@ channel once; Worker/Reviewer failures use the existing Leader channel. No new
 recovery Agent is started, and there need not be a Run or Session to record the
 failure.
 
-Storage 35→36 archives original historical error payloads and marks their
-unrecorded launch configuration as unavailable. It never reconstructs old model,
-account or settings choices from current Roles.
-
-Storage 36→37 narrows that context to native metadata selectors and the requested
-model/effort. Full old snapshots remain in migration audit, not in the active
-reader. Reading a failure's model options does not validate Task permissions,
+Failure context records native metadata selectors and the requested model/effort.
+Unrecorded configuration stays unavailable; it is never reconstructed from current
+Roles. Opaque audit bytes are not read as current configuration.
+Reading a failure's model options does not validate Task permissions,
 Review state, workspace entries or the current Session bootstrap protocol.
 The three failure ingresses retain their native fencing/classification, while
 record creation and deduplication share one writer and supervisor notices use

package/docs/managed-turn-and-session-runtime.zh-CN.md

@@ -50,11 +50,21 @@ Task 记录。聚合执行从该 Snapshot 读取已选择的 Producer 结果；
 Run 捕获的生效授权。当前活动状态仍是独立观察，不属于冻结合同。
 展开引用必须同时指定 `store` 与 `refId`，即使 id 唯一也不能省略 store。
 
-缺少 Snapshot 的历史 Run 仍可通过 `run show` 审计，但不能提供执行 Context、
-提交给 Provider 或用于重试。Snapshot 缺失或漂移时明确失败，不用今天的 Task
-事实补造历史。后续观察到的原生输入或 steer 记录可以没有独立 Snapshot，因为
-它们不建立新的 Assignment。本次不改变存储布局或记录载荷：storage 仍为 37，
-完整的 1→37 迁移链保持不变。
+新的 Task 执行需要首个 Snapshot。保留的 Run 缺失执行证据时，仍可供
+Leader／Operator 查看、结算失败或显式废弃，无关工作继续推进。提交执行和读取
+确切冻结上下文在证据缺失、漂移时局部失败。显式普通重试根据当前授权事实创建
+新的 Run 和 Snapshot，不补造旧快照；Review／结果汇总的确切复用仍需冻结证据。
+后续原生输入或 steer 可以没有独立 Snapshot，因为它们不建立新的 Assignment。
+存储采用 1.0 基线；独立转换器保留这些记录，不把可选执行证据缺失扩大为
+整个 Home 的转换阻塞。
+
+运行异常按所属对象限制影响，不等同于整个 Controller 必须停摆。可选的资源回收
+和 continuation 元数据检查失败会报告诊断，不阻断正常调度；Provider 重试准入
+按 Session 隔离，continuation 观察按 Task 隔离。Job 和全局输入错误包含
+Task／Job 或 Role 身份，并保留原始原因。已提交的观察仍然有效，失败的观察不代表
+输入已确认、进程已停止，也不授权再次发送或删除。对受影响对象使用既有的查看、
+停止／取消、废弃、确认和显式重试入口。存储结构损坏、权限失败及未知外部效果，
+仍在各自边界明确诊断，不用统一兜底值或伪造成功绕过。
 
 当前 Task 读取也会把无定向目标的 user/Operator 消息暴露给该 Task 当前的 Worker 和
 Reviewer Session，包括在它们 Run 快照冻结之后新增的需求。用 `task message list/show`
@@ -122,11 +132,9 @@ retry 把被拒绝批次及后续排队输入交回现有 mailbox，不把旧 wa
 错误通过既有 Operator 通道通知一次；Worker／Reviewer 仍通知 Leader。不启动新的
 恢复 Agent，也不为了记录错误制造 Run 或 Session。
 
-存储 `35→36` 迁移保留历史错误原始 payload，并将当时未记录的启动配置标为不可用，
-不会从当前 Role 猜测过去的模型、账户或 settings 选择。
-
-存储 `36→37` 将该上下文收窄为原生元数据查询选项和请求的模型／effort。旧完整快照
-留在迁移审计中，不由运行时双读。查看模型选项不再校验 Task 权限、Review 状态、
+错误上下文记录原生元数据查询选项和请求的模型／effort。未记录的配置保持不可用，
+不会从当前 Role 猜测过去的选择，也不会把不透明审计字节当作当前配置读取。
+查看模型选项不校验 Task 权限、Review 状态、
 工作区条目或当前 Session 引导协议。三类错误入口保留各自的原生身份检查与分类，
 错误创建、去重统一一个写入入口，上级通知统一使用事件路由边界。
 

package/docs/release-workflow.md

@@ -27,301 +27,54 @@ system sits behind `ReleaseWorkflowPorts`
 external ports exercise recovery without real GitHub, npm, git, Controller,
 or model effects.
 
-## Final historical bridge: 0.16.2
-
-| Release | Home storage | Responsibility |
-| --- | --- | --- |
-| **0.16.2** | Historical v37, supported floor v1 | Last complete historical upgrade chain (v1 through v37). |
-| **1.0.0-alpha.1** (planned) | A distinct new 1.0 baseline | Publish an independent, explicit offline converter from verified historical v37. |
-| **1.0.0** (planned) | The same verified 1.x contract as the final prerelease | Remove converter source after durable publication; never reset storage again. |
-
-0.16.2 supersedes the 0.99.0 release designation without reverting its functional
-changes or Git history. Both use the same v37 endpoint. Publish and verify this
-replacement before withdrawing the 0.99.0 registry version, Release and tag.
-Do not automatically downgrade a local installation or change its Home.
-Stable releases explicitly publish to npm `latest`; prereleases publish to
-`next`, so the new baseline is opt-in.
-
-0.16.2 freezes the historical endpoint at **37**. It does not append a no-op
-migration, rewrite released SQL/data migrations, reset record-local schema or
-protocol versions, or reinterpret historical evidence. Fresh and upgraded Homes
-use the same contract. Ordinary opens still reject historical formats; only
-explicit `upgrade` / `update` may migrate them.
-
-### Select the bridge explicitly
-
-In 0.16.2, `yui update --version 0.16.2` selects an exact published
-package; no argument still selects `latest`. Tags and ranges are not accepted
-as explicit selectors. The actual staged version must equal the requested
-version before preflight or Controller handover. A mismatch cleans only the
-owned staging prefix, leaving the installed binary and database unchanged.
-
-Older CLIs do not acquire this option until updated. Once 0.16.2 is published,
-use a separately staged, exact 0.16.2 CLI to drive the update against an explicit
-`YUI_HOME`. For example, npm can stage it without replacing the global install:
-
-```sh
-YUI_HOME=/absolute/path/to/home npm exec --yes --package=@zq-silk/yui@0.16.2 -- \
-  yui update --version 0.16.2
-```
-
-Do not replace the live global binary first or assume `latest` will continue
-to select the bridge. Preserve target-owned `upgrade --update-preflight` /
-`--update-apply`: refusal happens before activation, and preflight is repeated
-under the handover fence after draining the exact Controller. The older-updater
-recovery guidance below still applies when invoking an older updater.
-
-### Inspect and preserve the old endpoint
-
-With the published 0.16.2 CLI and the intended `YUI_HOME`, use the existing
-`yui --json version`, `yui --json upgrade --dry-run`, `yui --json doctor`,
-`yui --json controller status`, and `yui session reconcile --report` reads.
-After the old-chain upgrade, the upgrade report must be `already-current` at
-storage 37; `upgrade-plan` only describes pending migrations. Neither report
-proves physical quiescence or readiness for the new storage 1.0 cutover.
-Do not add a durable "ready for 1.0" flag or a second version authority.
-
-Before the later offline cutover, settle active work using its original
-contract. `yui session stop --all` explicitly stops idle managed Sessions and
-the Controller; it is not a force stop or proof that detached Jobs and unknown
-resources have exited. Inspect exact ownership and pending effects. Never mark
-Tasks complete, acknowledge uncertain work, or delete resources just to pass an
-upgrade. The future converter must recheck quiescence under its fence.
-
-Retain the **exact published 0.16.2 package**, its existing release manifest,
-registry integrity, tag/source commit, and this guide as the historical bridge.
-The existing package inventory pins compiled migrations and their helpers;
-an expiring CI artifact alone is not a long-term distribution. This release
-introduces no additional Home metadata or migration registry.
-
-The 1.0.0-alpha.1 converter must preserve old ledger/audit bytes, Home identity,
-business IDs, records, Knowledge, workspaces (including dirty files), and
-unconfirmed external effects. A database-only backup cannot fully roll back old
-layout migrations with filesystem/Git effects. Unknown or malformed old formats
-remain blockers. New storage 1.0 must have a distinct baseline identity, never the old
-`v0.15.0-baseline`. Its SQL/fingerprint and final conversion tool belong to
-1.0.0-alpha.1, **not this release**; it accepts verified old v37 rather than carrying
-the complete old chain.
-
-The new storage uses major.minor versions; default upgrades allow only explicit,
-contiguous minor steps within the same major. Any persistent change during
-prereleases must declare a new minor transition, never silently rewrite a
-published baseline. The stable release reuses the final verified contract.
-Publish the converter and checksum as durable prerelease attachments before
-removing their source. Never include conversion code in the runtime tarball or imports, retaining current
-initialization, validation, unknown-format rejection, exact runtime identity and
-normal safety/recovery. Users skipping the bridge must still use the frozen
-tools; 1.0.0 must never guess an old format.
-
-## Controller handover fix in 0.16.1
-
-Controller status and storage preflight are observations, not cleanup. The
-authorized updater explicitly runs its bounded current-Home reconciliation
-under the handover fence before capture/stop. It retains the existing four-pass
-rule and process-start/inode checks, preserving current Controllers and excluding
-Agent/tmux/app/foreign-Home resources.
-
-Update results and release-step logs retain reconciliation targets, completed
-actions, original cleanup errors, the last inventory with its observation time,
-and failed observations or lock release. Captured-identity restoration reports
-success or unknown effects separately. An uncertain cleanup/restore is not a
-stopped Controller or replayable failure; inspect the exact resource before
-choosing recovery. No new recovery worker or persistent protocol is introduced.
-The staged `--update-preflight` / `--update-apply` contract is unchanged.
-
-The updater's stop and exact-identity restoration children now explicitly receive
-the parent updater's handover-lock owner identity. They no longer wait on their
-own parent's lock; unrelated callers remain fenced. Storage remains at version 37.
-
-An already-installed older updater, including 0.15.12 or 0.16.0, cannot gain this
-fix merely by staging the new package. If it reports `CONTROLLER_HANDOVER_TIMEOUT`
-before activation, inspect the original Controller and lock ownership. Once the
-failed updater has released its own lock and the original Controller is confirmed
-healthy, normally stop it with that installed release's `yui controller stop`,
-then retry `yui update`. This preserves managed Agent Sessions and retains the
-normal preflight, backup, migration and verification boundaries. Do not delete
-an active lock or force-kill a Controller to bypass the failure.
-
-## Pre-1.0 contract cleanup
-
-Version 0.16.0 retires runtime compatibility before the final
-1.0 baseline cutover. It does not reset storage numbering.
-Storage 27→28 normalizes only provable singleton Role dispatch dedupe keys;
-the old migration ledger, Messages, Task results and unconfirmed effects remain
-unchanged. Ordinary opens require storage 37. Existing Homes advance only through
-the explicit upgrade boundary; no runtime dual-reader is added.
-
-This is a breaking pre-1.0 change:
-
-- `message send` uses `--intent`; `--wake-policy` is no longer accepted by the
-  CLI or capability API. Draft edits preserve intent.
-- Internal command integrations implement `notifyMailboxChanged`; the Task-only
-  notification adapter has been removed with its callers updated.
-- ACP peers must report `configOptions`; there is no `modes`/`set_mode` path.
-- Release recovery requires a pinned Home and installation prefix. Unpinned
-  identities remain unknown, and incomplete handover locks remain fenced.
-- Development link/unlink requires the current registry. It does not discover
-  or adopt older NVM registrations or reconstruct orphan links.
-- GC no longer discovers retired deployment layouts or reconstructs removed
-  worktrees. Unsupported quarantine evidence is retained, never purged as if
-  it were a current move receipt.
-- `task activate` consumes an existing request; no request means no resource
-  adoption. Request creation, deferred admission and atomic workspace adoption
-  remain separate, using the same current boundary.
-- `task integration queue` and its state machine are removed. The Agent chooses
-  each WorkItem result's order and strategy and calls the atomic Integration
-  operations; exact checks, target CAS and completion obligations remain.
-
-Storage 28→29 preserves every former queue payload verbatim in a Task event
-`integration.queue-retired`, with its original queue ID, before dropping the
-active table. Event IDs advance past both the stored counter and existing
-history. This does not accept delivery, generate an Integration or replay work.
-Existing Integrations and Jobs stay intact. Inspect `task event list <task>`
-and the referenced WorkItem/Integration before deciding what remains to do;
-retiring the queue does not settle an unfinished Integration.
-
-Storage 29→30 retires Run-linked wakes into `wake.run-link-retired` Task events
-with the complete original payload. Current notification IDs, delivery status
-and references remain intact, using wake schema 2; Run termination no longer
-consumes notifications. Live Runs, owned retries and unresolved claims referring
-to a retiring wake block both preflight and migration. The migration does not
-stop execution or fabricate acceptance. Global Session sets use an explicit
-`providerBinding: null` when no controlled binding exists.
-
-Storage 30→31 makes every Review's scope explicit. Missing/null scope in a valid
-older WorkItem Review becomes `work-item`; Task-final candidate evidence and
-the old ledger are unchanged. New and retried Reviews always write their scope.
-
-Storage 31→32 removes WorkItem `historicalState` from the current record.
-Before removal, the entire original payload is preserved verbatim in a
-`work-item.execution-state-retired` Task event. Current status, scope, Candidates
-and execution groups are unchanged; no Run or acceptance is created. Unrecognized
-historical shapes fail without changing the record or advancing the ledger.
-
-Storage 32→33 retires the Leader rollout/budget settings and VerificationPlan
-rollout modes. Active plan bodies gain an explicit schema version; their checks
-remain unchanged, while retired Knowledge bodies are preserved. Integration
-records gain explicit `rerunChecks: false`, and shadow reuse counters are removed
-from cached artifacts. Original settings remain recoverable from the explicit
-upgrade backup. This is an approved behavior change, not an assertion that
-`record`, `reuse` and `enforce` meant the same thing.
-
-Admitted `running`/`validating` plan gates block preflight and migration; settle
-them with the old release first. No in-flight Job is relabelled under the new
-proof contract. That cutover's v3 verification-plan digest excluded older cache entries from
-automatic reuse without rewriting historical Job/Integration results or deleting
-their logs. Historical plan interpretation is frozen inside the migration
-directory so earlier migrations keep their original semantics.
-
-The current clean-candidate proof uses a v5 L2-only execution digest. Both local and
-Job-backed verification check candidate cleanliness, branch and exact HEAD
-before publishing reusable success; older cache identities cannot silently pass
-this boundary. Existing records/logs remain readable and admitted Jobs are not
-relabeled under a new digest. Settle old attempts with their matching contract,
-or explicitly abandon them before starting another operation.
-
-The L1 runner, selector and current plan/artifact type branches are removed.
-Storage 34→35 archives the original Project plan payloads and L1 artifacts/logs
-in `storage_migration_archive`, then adopts VerificationPlan schema 2 without L1.
-The archive is raw audit data, not an alternate execution reader or cache.
-Settled historical ChangeSet-source Integrations become full-payload Task Events;
-live workspaces, unsettled Jobs and adoption references block their retirement.
-The complete earlier migration ledger remains unchanged.
-
-Session custody now has one source, SQLite. Legacy `launch-env` owner rows or
-files in `runtime/session-owners` block this cutover: use the old release to
-inspect and settle their exact resources, then explicitly archive obsolete
-files outside the active Home. The migration does not kill, infer ownership,
-repair malformed records or rewrite immutable Session Manifests.
-
-Storage 35→36 preserves historical Agent errors and explicitly marks missing
-failure configuration as unavailable. Storage 36→37 narrows recorded failure
-context to native metadata-query inputs, preserving the original snapshot and
-empty optional identity placeholders in migration audit. Current error readers
-do not depend on the execution snapshot protocol or reconstruct missing history.
-Configuration rejection preserves input without automatic retry; an authorized
-Agent can inspect failure-scoped model capabilities, correct the intended
-configuration, and explicitly retry the rejected notification.
-
-`task turn` and the `yui-dev` completion identity are no longer supported.
-Before rollout, replace Sessions whose old Manifest still names `task turn`,
-and explicitly remove/archive old `yui-dev` completion blocks before installing
-current `yui` completion. User shell files are never rewritten by storage migration.
-Current Host control/event validation and updater handover safety remain enforced.
-
-Storage 33→34 removes Message `wakePolicy` and activation `origin` from current
-records, preserving their original representations in audit Events. Historical
-save-only Messages become `intent: record`; other user/operator Messages without
-intent become `discuss`. Runtime readers never infer a missing stored intent.
-Editing record-only context does not wake the Leader. Completion reads actual
-pending message references, including an explicit handoff of previously saved context.
-
-Draft editing also preserves request identity: messages bound to submission,
-queue/steer or handoff requests cannot change body in place. Use a new Message
-and request ID; identical-body updates are no-ops. Unkeyed discussion edits
-honor pending/failed activation, while develop edits never start planning or
-create/retry activation. These are operation-boundary fixes, not a new storage
-format or a repair of previously edited historical content.
-
-An origin-less pending immediate Draft activation blocks preflight and migration,
-including on a stopped Task. Activate or cancel it explicitly with the old release
-first. An admitted current request needs no second origin gate: cancellation,
-planning deferral, execution state and exact Session authority remain enforced.
-Old origin metadata, including settled-request history, remains in
-`task.activation-origin-retired` Events; this never fabricates authorization.
-
-New `job start` calls require `--request-id`; RPC callers supply `requestId`, and
-the capability boundary supplies its invocation identity. There is no implicit
-content-addressed request or anonymous Job constructor. Existing Jobs retain
-their operation evidence and remain addressable by ID. Retrying the same explicit
-request is idempotent, changed input conflicts, and Integration recovery still
-finds its original Job across Session replacement. Choosing a new request ID is
-an explicit new operation, not recovery of an uncertain earlier result.
-
-Core Scheduler readers and persistence operations are required ports. A missing
-Session/event reader cannot be interpreted as empty evidence or skipped error
-persistence. Task execution and Web projections read the current store directly;
-queue admission requires its Task lifecycle read. Exact dispatch settlement
-remains separate and does not gain an archive gate that could lose late evidence.
-Observer, config, Knowledge and workspace-cleanup Store readers are also required;
-test doubles implement those contracts rather than selecting production fallbacks.
-
-Task listing and `/api/dashboard` now expose only the bounded catalog; remove
-`--view compact` from callers and use per-Task reads for detail. Scheduler
-catalog projections are required internal ports, not optional full-scan adapters.
-Extra `schema.json`/`state.json` files cannot override SQLite's version or be
-used to reset a development Home; upgrades leave unrelated files untouched.
-A missing database in a non-empty Home remains a refusal to initialize.
-Unrecognized writer leases are diagnosed without adoption or deletion.
-
-`controller status` always reports identity and retains the nonzero health exit
-for contradictory storage. `YUI_STATUS_IDENTITY` no longer selects another
-contract. Update-owned lifecycle capture uses the same resource collector
-directly, without requiring the old Home to pass current-schema health.
-
-Additional current boundaries:
-
-- Project/artifact file locks and handover locks require exact process-generation
-  evidence. Missing/invalid owners or unreadable OS identity remain fenced;
-  age alone never proves a creator exited. No PID-only positive fallback remains.
-- PR head lookup uses one `gh pr list --head ... --state open` query. Only an
-  empty, valid array proves absence. Transport errors, malformed identities and
-  multiple matches fail without attempting creation.
-- Existing Git operations cannot be adopted without the Integration's original
-  progress receipt. Preserve their files and diagnose explicitly; current
-  receipt-backed conflict/Job continuation remains supported.
-
-Before rollout, settle old executions and use explicit cleanup for unsupported
-locks, links or quarantines. Preserve those records until their owner and
-disposition are established; the runtime does not choose recovery for them.
-
-The later baseline cutover must first establish a verified bridge/export to the
-chosen current format, then replace the old initialization/migration chain with
-one clean baseline. Only then remove pre-baseline migrations and their historical
-fixtures. Reset the storage baseline once; do not reset it again when tagging
-1.0.0. Keep unknown-version rejection, exact process/Host identity checks and
-durable audit evidence. Version tags and real migration/publication effects
-require their separate release authorization.
+## Clean baseline release: 1.0.0-alpha
+
+0.16.2 remains the frozen historical bridge. The 1.0.0-alpha runtime starts the
+distinct storage **1.0** baseline and carries no old migration chain or
+conversion tool. Package 1.0.0 will reuse the final verified prerelease storage
+contract without another reset.
+
+Storage versions have two levels. Default updates may advance only contiguous
+minor versions within the same major; pinning a package does not authorize a
+cross-major conversion. Current Yui-owned envelopes and protocols start at 1,
+without resetting business revisions, epochs or audit evidence.
+Any persistent change after an alpha is published requires an explicit new
+minor transition; published schema definitions must not be silently replaced.
+Current bounded automatic recovery, lock waiting, transactions, replay
+protection and valid exact-identity caches remain normal runtime behavior.
+
+Use the exact package version `1.0.0-alpha` to opt into this baseline. Stable
+releases use npm `latest`; prereleases use `next`, never the stable default.
+
+The old-v37 converter is a separate archive. Its source/target verification,
+offline boundary, full backup, original-payload audit, cold startup and rollback
+are specified in [Storage baseline 1.0](./storage-baseline.md).
+Publish its archive and checksum as durable 1.0.0-alpha release attachments alongside
+the exact tested runtime package. Expiring CI artifacts alone are insufficient.
+The alpha-only `baseline-release` job runs after npm publication, uploads missing
+attachments to a draft without overwriting existing files, downloads and compares
+every attachment against the tested artifact, then publishes the prerelease.
+A retry verifies matching existing attachments; a different byte or an incomplete
+already-published Release is an error, not permission to replace release evidence.
+If this job fails after npm publication, resume only this job with the same
+retained artifacts rather than republishing or rebuilding the package.
+The runtime tarball must contain neither tools/ nor dist/storage/migrations/.
+
+Use `yui update --version <exact-version>` for an exact published package.
+Staged metadata must match the requested version, and target-owned storage
+preflight runs before activation and again under the maintenance fence.
+An unsupported Home remains unchanged; use the independent converter rather
+than replacing the global CLI first. Current update/activation children must
+explicitly identify their handover-lock owner.
+
+Restoration checks the captured executable/argv, package version, Controller
+protocol and both storage-version bounds against status and live identity.
+Missing contract fields are errors, not an older-Controller exception.
+
+The converter source, frozen endpoint fixture and converter-specific tests are
+release-only deliverables for 1.0.0-alpha. Remove them from the 1.0.0 development line
+only after the 1.0.0-alpha release attachments and checksums are durably available
+and verified. Do not delete the only conversion path before publication.
 
 ## Authorization model
 
@@ -384,8 +137,8 @@ the long-lived Session environment. This preserves pre-adoption evidence even
 when the frozen Run workspace differs from the Role's default; later activity
 and terminal facts still resolve solely by their own native input identities.
 
-The current Host boundary is control `yui-agent-host/v5`, event source
-`yui-agent-host-events/v1`, and Controller RPC version 4. Hosts do not open the
+The current Host boundary is control `yui-agent-host-control/v1`, event source
+`yui-agent-host-events/v1`, and Controller RPC version 1. Hosts do not open the
 Home database, including for process custody, native account locations, or
 execution-environment checks. Only the Controller owns storage and resolves
 durable facts; malformed current input fails at its normal protocol boundary.
@@ -398,9 +151,8 @@ kill resources of uncertain ownership. Current Controller restart, exact
 process-generation checks, handover locks, Session authority and event replay
 protection remain enforced.
 
-Storage migration is separate: the complete 1..37 chain and updater
-`--update-preflight` / `--update-apply` contract remain. Storage preflight is
-rechecked at the fenced/quiesced boundary; no published migration is rewritten.
+Storage upgrades are limited to the current major's explicit minor steps.
+Cross-major conversion is independently authorized and is not a runtime fallback.
 Session CLI refresh only retargets the current two-argument quoted wrapper
 named by a valid Manifest. It does not convert retired wrapper forms. Runtime
 diagnostics do not interpret `schema.json`, `state.json`, or a whole-map release