@zq-silk/yui 0.7.1 → 0.8.2

package/dist/storage/compatibleTaskStore.js

@@ -6,19 +6,23 @@ import { FileTaskStore, STORAGE_STATE_FILE, stateFileFingerprint, StorageRecordE
 import { readSqliteHomeIdentity, SqliteTaskStore } from "./sqliteStore.js";
 import { COMMITTED_DATABASE_FILENAME } from "./upgrade/sqliteStateMigration.js";
 import { validateHomeIdentity } from "../repository/homeIdentity.js";
-import { ensureStorageSchema, inspectStorageSchema, readStorageSchemaManifest, STORAGE_SCHEMA_FILE } from "./storageSchema.js";
+import { CURRENT_STORAGE_LAYOUT_VERSION, ensureStorageSchema, inspectStorageSchema, readStorageSchemaManifest, STORAGE_SCHEMA_FILE } from "./storageSchema.js";
 import { classifyHome } from "./upgrade/homeClassification.js";
 import { inspectSnapshotVersionState } from "./upgrade/homeMigrationTarget.js";
 import { latestStorageVersionState } from "./upgrade/recordVersions.js";
 export { createProductionStorageRegistry } from "./migration/productionRegistry.js";
 /**
- * Initialize a brand-new Home, or open an existing Home through the same
- * compatibility classification as every ordinary command. Setup is the one
- * ordinary flow that is also responsible for creating the initial manifest.
+ * Initialize a brand-new Home with the current authoritative backend, or open
+ * an existing Home through the same compatibility classification as every
+ * ordinary command. Setup is the one ordinary flow that is also responsible
+ * for creating the initial manifest.
  */
-export function initializeCompatibleFileTaskStore(home, options = {}) {
+export function initializeCompatibleTaskStore(home, options = {}) {
     if (inspectStorageSchema(home).status === "uninitialized") {
         ensureStorageSchema(home);
+        if (CURRENT_STORAGE_LAYOUT_VERSION >= 7) {
+            return new SqliteTaskStore(home);
+        }
     }
     return openCompatibleFileTaskStore(home, options);
 }

package/dist/storage/migration/productionRegistry.js

@@ -79,8 +79,12 @@ const WORK_MAILBOX_FROM_VERSION = 1;
 const WORK_MAILBOX_TO_VERSION = 2;
 const TASK_ROLE_SESSION_SET_FROM_VERSION = 4;
 const TASK_ROLE_SESSION_SET_TO_VERSION = 5;
+const STRUCTURED_PROVIDER_SESSION_SET_FROM_VERSION = 5;
+const STRUCTURED_PROVIDER_SESSION_SET_TO_VERSION = 6;
 const PUBLICATION_REFERENCE_FROM_VERSION = 0;
 const PUBLICATION_REFERENCE_TO_VERSION = 1;
+const CONFIG_FROM_VERSION = 1;
+const CONFIG_TO_VERSION = 2;
 /**
  * Build the authoritative production graph. Transition intent and executable
  * transforms are registered together here; compatible loading and offline
@@ -129,6 +133,7 @@ export function createProductionStorageRegistry() {
         declaredEffects: []
     })
         .registerOfflineMigration(projectOwnershipStep())
+        .registerOfflineMigration(configV2Step())
         .registerCompatible(projectKnowledgeProposalsStep())
         .registerOfflineMigration(taskWorkspaceIdentityStep())
         .registerOfflineMigration(recordFamilyStep("workItem", WORK_ITEM_FROM_VERSION, WORK_ITEM_TO_VERSION, "workItems"))
@@ -158,10 +163,66 @@ export function createProductionStorageRegistry() {
         .registerOfflineMigration(releaseWorkflowIntroductionStep())
         .registerOfflineMigration(workMailboxV2Step())
         .registerOfflineMigration(taskRoleSessionSetV5Step())
+        .registerOfflineMigration(structuredProviderSessionSetV6Step())
         .registerOfflineMigration(publicationReferenceIntroductionStep());
     assertRegistryCoversBaselineToCurrent(registry);
     return registry;
 }
+function configV2Step() {
+    return {
+        axis: "record",
+        recordKind: "config",
+        fromVersion: CONFIG_FROM_VERSION,
+        toVersion: CONFIG_TO_VERSION,
+        preconditions: requireConfigV1,
+        transform: migrateConfigV1ToV2,
+        declaredEffects: []
+    };
+}
+function requireConfigV1(snapshot) {
+    const versions = asObject(snapshot.schemaManifest.recordVersions, "schema manifest recordVersions");
+    if (versions.config !== CONFIG_FROM_VERSION) {
+        throw new Error(`Record config migration requires manifest version ${CONFIG_FROM_VERSION}.`);
+    }
+    if (snapshot.state === null)
+        return;
+    const config = asObject(snapshot.state.config, "Yui config");
+    if (config.schemaVersion !== CONFIG_FROM_VERSION) {
+        throw new Error(`Yui config must use schemaVersion ${CONFIG_FROM_VERSION} before migration.`);
+    }
+}
+function migrateConfigV1ToV2(snapshot) {
+    requireConfigV1(snapshot);
+    const versions = asObject(snapshot.schemaManifest.recordVersions, "schema manifest recordVersions");
+    const schemaManifest = {
+        ...snapshot.schemaManifest,
+        recordVersions: { ...versions, config: CONFIG_TO_VERSION }
+    };
+    if (snapshot.state === null)
+        return { schemaManifest, state: null };
+    const config = asObject(snapshot.state.config, "Yui config");
+    const { providerRetryMaxWindowMs, yieldReceiptReplay: _yieldReceiptReplay, gitBin: _gitBin, telemetryMode, schemaVersion: _schemaVersion, ...retained } = config;
+    const providerRetryMaxWindowSeconds = typeof providerRetryMaxWindowMs === "number"
+        ? Math.ceil(providerRetryMaxWindowMs / 1_000)
+        : undefined;
+    const telemetryEnabled = telemetryMode === undefined
+        ? undefined
+        : telemetryMode === "dual" || telemetryMode === "bounded";
+    return {
+        schemaManifest,
+        state: {
+            ...snapshot.state,
+            config: {
+                ...retained,
+                schemaVersion: CONFIG_TO_VERSION,
+                ...(providerRetryMaxWindowSeconds === undefined
+                    ? {}
+                    : { providerRetryMaxWindowSeconds }),
+                ...(telemetryEnabled === undefined ? {} : { telemetryEnabled })
+            }
+        }
+    };
+}
 function workItemExecutionGroupHistoryStep() {
     return {
         axis: "record",
@@ -2167,6 +2228,114 @@ function taskRoleSessionSetV5Step() {
         declaredEffects: []
     };
 }
+/**
+ * v6 is a deliberate runtime cutover, not an emulation layer. Existing Task,
+ * Run, Conversation, and Session identities remain as audit evidence, while
+ * every pre-v6 managed process is terminalized locally. A new Agent Host must
+ * establish structured Provider evidence before any further write.
+ */
+function structuredProviderSessionSetV6Step() {
+    return {
+        axis: "record",
+        recordKind: "taskRoleSessionSet",
+        fromVersion: STRUCTURED_PROVIDER_SESSION_SET_FROM_VERSION,
+        toVersion: STRUCTURED_PROVIDER_SESSION_SET_TO_VERSION,
+        preconditions: requireTaskRoleSessionSetV5Family,
+        transform: migrateTaskRoleSessionSetV5ToV6,
+        declaredEffects: []
+    };
+}
+function requireTaskRoleSessionSetV5Family(snapshot) {
+    const versions = asObject(snapshot.schemaManifest.recordVersions, "schema manifest recordVersions");
+    if (versions.taskRoleSessionSet !== STRUCTURED_PROVIDER_SESSION_SET_FROM_VERSION) {
+        throw new Error(`Record taskRoleSessionSet migration requires manifest version ${STRUCTURED_PROVIDER_SESSION_SET_FROM_VERSION}.`);
+    }
+    if (snapshot.state === null)
+        return;
+    const tasks = asObject(snapshot.state.tasks, "state tasks");
+    for (const [taskId, rawAggregate] of Object.entries(tasks)) {
+        const aggregate = asObject(rawAggregate, `Task aggregate ${taskId}`);
+        const sets = asObject(aggregate.roleSessionSets, `Task Role session sets ${taskId}`);
+        for (const [roleName, rawSet] of Object.entries(sets)) {
+            const set = asObject(rawSet, `Task Role session set ${taskId}/${roleName}`);
+            if (set.schemaVersion !== STRUCTURED_PROVIDER_SESSION_SET_FROM_VERSION) {
+                throw new Error(`Task Role session set ${taskId}/${roleName} must use schemaVersion ${STRUCTURED_PROVIDER_SESSION_SET_FROM_VERSION}.`);
+            }
+        }
+    }
+}
+function migrateTaskRoleSessionSetV5ToV6(snapshot) {
+    requireTaskRoleSessionSetV5Family(snapshot);
+    const versions = asObject(snapshot.schemaManifest.recordVersions, "schema manifest recordVersions");
+    const schemaManifest = {
+        ...snapshot.schemaManifest,
+        recordVersions: {
+            ...versions,
+            taskRoleSessionSet: STRUCTURED_PROVIDER_SESSION_SET_TO_VERSION
+        }
+    };
+    if (snapshot.state === null)
+        return { schemaManifest, state: null };
+    const tasks = asObject(snapshot.state.tasks, "state tasks");
+    const nextTasks = {};
+    for (const [taskId, rawAggregate] of Object.entries(tasks)) {
+        const aggregate = asObject(rawAggregate, `Task aggregate ${taskId}`);
+        const rawSets = asObject(aggregate.roleSessionSets, `Task Role session sets ${taskId}`);
+        const nextSets = {};
+        for (const [roleName, rawSet] of Object.entries(rawSets)) {
+            const set = asObject(rawSet, `Task Role session set ${taskId}/${roleName}`);
+            const invalidatedAt = String(set.updatedAt);
+            const sessions = asObject(set.sessions, `Task Role sessions ${taskId}/${roleName}`);
+            const nextSessions = Object.fromEntries(Object.entries(sessions).map(([agentId, rawSession]) => {
+                const session = asObject(rawSession, `Task Role Session ${taskId}/${roleName}/${agentId}`);
+                return [agentId, session.status === "stopped" || session.status === "broken"
+                        ? session
+                        : { ...session, status: "broken", updatedAt: invalidatedAt }];
+            }));
+            nextSets[roleName] = {
+                ...set,
+                schemaVersion: STRUCTURED_PROVIDER_SESSION_SET_TO_VERSION,
+                sessions: nextSessions,
+                providerBinding: set.providerBinding === null
+                    ? null
+                    : invalidateLegacyProviderBinding(asObject(set.providerBinding, `Provider Binding ${taskId}/${roleName}`), invalidatedAt)
+            };
+        }
+        nextTasks[taskId] = { ...aggregate, roleSessionSets: nextSets };
+    }
+    return { schemaManifest, state: { ...snapshot.state, tasks: nextTasks } };
+}
+function invalidateLegacyProviderBinding(binding, invalidatedAt) {
+    if (binding.schemaVersion !== 1) {
+        throw new Error("Pre-v6 Provider Runtime Binding must use schemaVersion 1.");
+    }
+    const activations = Array.isArray(binding.activations) ? binding.activations : [];
+    return {
+        ...binding,
+        schemaVersion: 2,
+        conversations: (Array.isArray(binding.conversations) ? binding.conversations : []).map((rawConversation) => {
+            const conversation = asObject(rawConversation, "Provider Conversation");
+            return conversation.status === "current"
+                ? { ...conversation, recoverability: "unknown" }
+                : conversation;
+        }),
+        activations: activations.map((rawActivation) => {
+            const activation = asObject(rawActivation, "Provider Activation");
+            const { writerLease: _removed, ...withoutLease } = activation;
+            void _removed;
+            return activation.status === "active"
+                ? {
+                    ...withoutLease,
+                    status: "failed",
+                    endedAt: invalidatedAt,
+                    terminalReason: "legacy-managed-runtime-invalidated"
+                }
+                : withoutLease;
+        }),
+        authority: { epoch: 1, owner: "none", changedAt: invalidatedAt },
+        turn: null
+    };
+}
 function requireTaskRoleSessionSetV4Family(snapshot) {
     const versions = asObject(snapshot.schemaManifest.recordVersions, "schema manifest recordVersions");
     if (versions.taskRoleSessionSet !== TASK_ROLE_SESSION_SET_FROM_VERSION) {

package/dist/storage/taskStore.js

@@ -6,7 +6,7 @@ import { validateConfiguredAgent } from "../agent/agent.js";
 import { validateCapabilityGrant } from "../grant/capabilityGrant.js";
 import { validateReleaseWorkflow } from "../release/releaseWorkflow.js";
 import { publicationExternalKey, validatePublicationReference } from "../task/publicationReference.js";
-import { reconciliationIntervalMilliseconds, resolveLeaderNextActionMode, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode } from "../config/yuiConfig.js";
+import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveContextBudget, resolveDeliveryTimeoutSeconds, resolveLeaderNextActionMode, resolveLeaderSemanticBudgetTurns, resolveProviderRetryAdapters, resolveProviderRetryDelaysSeconds, resolveProviderRetryMaxWindowSeconds, resolveProviderRetryMode, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryRunCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
 import { resolveTimeZone } from "../output/timePresentation.js";
 import { mailboxBatches, consumePendingBatch, mailboxHasWork, mailboxTargetKey, pendingLane, validateWorkMailbox } from "../coordination/workMailbox.js";
 import { validateContextSnapshot } from "../context/contextSnapshot.js";
@@ -44,7 +44,7 @@ import { CURRENT_AGGREGATE_SCHEMA_VERSION, requireCompatibleStorageSchema, requi
 export const STORAGE_STATE_FILE = "state.json";
 /** The root StorageState schema is the persisted aggregate document version. */
 export const CURRENT_STORAGE_STATE_SCHEMA_VERSION = CURRENT_AGGREGATE_SCHEMA_VERSION;
-export const CURRENT_CONFIG_SCHEMA_VERSION = 1;
+export const CURRENT_CONFIG_SCHEMA_VERSION = 2;
 export const CURRENT_HOME_IDENTITY_SCHEMA_VERSION = 1;
 export const CURRENT_ACTIVE_RUN_POINTER_SCHEMA_VERSION = 3;
 /**
@@ -117,7 +117,7 @@ export const CURRENT_STORED_TASK_SCHEMA_VERSION = 17;
  * Keep these named at the storage boundary so the upgrade record-axis map can
  * assert it is classifying the same bytes the store reads and writes.
  */
-export const CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION = 5;
+export const CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION = 6;
 /**
  * v7 combines optional Issue 04 retry/receipt fields and Issue 05 Leader
  * actionability fields. All are optional, so the v6→v7 migration is a
@@ -2449,13 +2449,32 @@ function observeTaskRecordId(aggregate, kind, id) {
 }
 export function validateYuiConfig(config) {
     try {
+        if (config.schemaVersion !== CURRENT_CONFIG_SCHEMA_VERSION) {
+            throw new TypeError(`Yui config must use schemaVersion ${CURRENT_CONFIG_SCHEMA_VERSION}.`);
+        }
         reconciliationIntervalMilliseconds(config.reconciliationIntervalSeconds);
         resolveTimeZone(config.timeZone);
         if (config.review !== undefined)
             validateReviewConfig(config.review);
         resolveLeaderNextActionMode(config.leaderNextActionMode);
+        resolveContextBudget(config.contextBudget);
         resolveResourcesGcMode(config.resourcesGcMode);
         resolveResourcesGcAutoQuarantine(config.resourcesGcAutoQuarantine);
+        resolveResourcesQuarantineTtlHours(config.resourcesQuarantineTtlHours);
+        resolveProviderRetryMode(config.providerRetryMode);
+        resolveProviderRetryAdapters(config.providerRetryAdapters);
+        resolveProviderRetryDelaysSeconds(config.providerRetryDelaysSeconds);
+        resolveProviderRetryMaxWindowSeconds(config.providerRetryMaxWindowSeconds);
+        resolveRuntimeHealth(config.runtimeHealth);
+        resolveControllerTaskConcurrency(config.controllerTaskConcurrency);
+        resolveAgentLaunchInactivityTimeoutSeconds(config.agentLaunchInactivityTimeoutSeconds);
+        resolveDeliveryTimeoutSeconds(config.deliveryTimeoutSeconds);
+        resolveLeaderSemanticBudgetTurns(config.leaderSemanticBudgetTurns);
+        resolveTmuxBin(config.tmuxBin);
+        resolveTmuxHistoryLimit(config.tmuxHistoryLimit);
+        resolveTelemetryEnabled(config.telemetryEnabled);
+        resolveTelemetryTerminalKeep(config.telemetryTerminalKeep);
+        resolveTelemetryRunCap(config.telemetryRunCap);
     }
     catch (error) {
         throw new StorageRecordError(error instanceof Error ? error.message : "Yui reconciliation interval is invalid.");

package/dist/telemetry/sqliteTelemetryStore.js

@@ -38,7 +38,7 @@ export class SqliteTelemetryStore {
     #flushScheduled = false;
     #closed = false;
     constructor(home, options = {}) {
-        this.mode = options.mode ?? "dual";
+        this.mode = options.mode ?? "on";
         this.#path = join(home, COMMITTED_DATABASE_FILENAME);
         this.#terminalKeep = options.terminalKeep ?? DEFAULT_TERMINAL_KEEP;
         this.#runCap = options.runCap ?? DEFAULT_RUN_CAP;
@@ -286,9 +286,17 @@ export class SqliteTelemetryStore {
        WHERE COALESCE(excluded.sequence, -1) > COALESCE(telemetry.sequence, -1)
           OR (excluded.sequence IS telemetry.sequence AND excluded.received_at >= telemetry.received_at)`);
         try {
+            const touchedRuns = new Map();
             db.transaction(() => {
                 for (const entry of batch.values()) {
                     upsert.run(entry.taskId, entry.roleName, entry.runId, entry.generation, entry.progressId, entry.sequence ?? null, JSON.stringify(entry.payload), entry.receivedAt);
+                    touchedRuns.set(`${entry.taskId}\0${entry.runId}`, {
+                        taskId: entry.taskId,
+                        runId: entry.runId
+                    });
+                }
+                for (const { taskId, runId } of touchedRuns.values()) {
+                    this.capRun(taskId, runId);
                 }
             })();
             this.#applied += batch.size;

package/dist/telemetry/telemetryConfig.js

@@ -7,7 +7,7 @@
  * the schema's own constants (§4.4); the environment only overrides them.
  */
 import { TELEMETRY_KEEP_PER_GENERATION, TELEMETRY_RUN_CAP } from "../storage/sqliteSchema.js";
-export const DEFAULT_TELEMETRY_MODE = "legacy";
+export const DEFAULT_TELEMETRY_MODE = "off";
 /** Terminal Run/generation progress rows retained after prune. */
 export const DEFAULT_TERMINAL_KEEP = TELEMETRY_KEEP_PER_GENERATION;
 /** Hard cap of progress rows per Run while it is still active. */
@@ -18,23 +18,6 @@ export const DEFAULT_RUN_CAP = TELEMETRY_RUN_CAP;
  * rows (Tasks × Runs × cap).
  */
 export const MAX_RUN_CAP = 10_000_000;
-const TELEMETRY_MODES = ["legacy", "dual", "bounded"];
-/**
- * Resolve the telemetry mode from the durable config value (default `legacy`).
- * Only the three exact values (case-insensitive) are accepted; anything else
- * fails closed at startup instead of silently changing diagnostic retention.
- */
-export function resolveTelemetryMode(value) {
-    if (typeof value !== "string")
-        return DEFAULT_TELEMETRY_MODE;
-    const raw = value.trim().toLowerCase();
-    if (raw === undefined || raw === "")
-        return DEFAULT_TELEMETRY_MODE;
-    if (!TELEMETRY_MODES.includes(raw)) {
-        throw new TypeError(`telemetryMode must be one of ${TELEMETRY_MODES.join(", ")}; got ${JSON.stringify(raw)}.`);
-    }
-    return raw;
-}
 /**
  * Resolve the terminal-Run retention window from the durable config value
  * (default 200). Must be a positive integer.

package/dist/telemetry/telemetryStore.js

@@ -1,7 +1,7 @@
-/** No-op sink for `legacy` mode and for callers without a sidecar. */
+/** No-op sink for disabled telemetry and callers without a sidecar. */
 export class NullTelemetrySink {
     mode;
-    constructor(mode = "legacy") {
+    constructor(mode = "off") {
         this.mode = mode;
     }
     observe(_entry) { }

package/dist/telemetry/telemetryWiring.js

@@ -1,6 +1,7 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { resolveRunCap, resolveTelemetryMode, resolveTerminalKeep } from "./telemetryConfig.js";
+import { resolveRunCap, resolveTerminalKeep } from "./telemetryConfig.js";
+import { resolveTelemetryEnabled } from "../config/yuiConfig.js";
 import { SqliteTelemetryStore } from "./sqliteTelemetryStore.js";
 import { COMMITTED_DATABASE_FILENAME } from "../storage/upgrade/sqliteStateMigration.js";
 /**
@@ -16,12 +17,12 @@ import { COMMITTED_DATABASE_FILENAME } from "../storage/upgrade/sqliteStateMigra
  * and never blocks the semantic lane.
  */
 export function openSchedulerTelemetry(home, config) {
-    const mode = resolveTelemetryMode(config.telemetryMode);
-    if (mode === "legacy")
+    if (!resolveTelemetryEnabled(config.telemetryEnabled))
         return null;
+    const mode = "on";
     const dbPath = join(home, COMMITTED_DATABASE_FILENAME);
     if (!existsSync(dbPath)) {
-        throw new Error(`telemetryMode=${mode} requires SQLite storage, but ${dbPath} does not exist. `
+        throw new Error(`telemetryEnabled=true requires SQLite storage, but ${dbPath} does not exist. `
             + "Migrate this Home to the database backend first (yui upgrade).");
     }
     const store = new SqliteTelemetryStore(home, {
@@ -29,5 +30,5 @@ export function openSchedulerTelemetry(home, config) {
         terminalKeep: resolveTerminalKeep(config.telemetryTerminalKeep),
         runCap: resolveRunCap(config.telemetryRunCap)
     });
-    return { mode, sink: store, reader: store };
+    return { mode, sink: store, reader: store, retention: store };
 }

package/dist/tmux/tmuxManager.js

@@ -1025,7 +1025,7 @@ export class TmuxManager {
     /**
      * Pin the Role window to the largest attached client. The tmux default
      * `window-size latest` lets a later-attaching smaller client (e.g. the Web
-     * terminal or a second `task enter` from a smaller pane) shrink the shared
+     * terminal or a second Role viewer from a smaller pane) shrink the shared
      * Role window, leaving the primary viewer with a TUI pinned to the top of a
      * large terminal and no scrollback. `largest` keeps the window at the
      * biggest attached client so a compact viewer cannot compress it.

package/dist/web/webSnapshot.js

@@ -6,6 +6,7 @@ import { projectRunRecovery, readRunRecoveryFacts } from "../run/recoveryProject
 import { classifyRuntimeHealth, projectRuntimeTaskEvents } from "../runtime/runtimeProjection.js";
 import { builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 import { formatAgentRunReceiptId } from "../task/taskRecordReference.js";
+import { resolveRuntimeHealth } from "../config/yuiConfig.js";
 export function buildWebDashboardSnapshot(store, now = new Date()) {
     return store.transaction((reader) => {
         const statusCounts = {
@@ -88,7 +89,7 @@ export function buildWebTaskDetail(store, taskId, now = new Date()) {
             .map((run) => [run.roleName, run]));
         const activeRunHealth = runs
             .filter((run) => run.status === "active")
-            .map((run) => projectWebRunRuntimeHealth(reader, taskId, run, events, now));
+            .map((run) => projectWebRunRuntimeHealth(reader, taskId, run, events, now, resolveRuntimeHealth(reader.getConfig().runtimeHealth)));
         const roles = reader.listRoles(taskId).map((role) => {
             const activeRun = activeRuns.get(role.name);
             const sessions = reader.getTaskRoleSessionSet(taskId, role.name);
@@ -137,7 +138,7 @@ function latestStallProgress(events, runId) {
  * scheduler's durable `run.stalled` episode is surfaced as
  * `stalled-candidate`.
  */
-function projectWebRunRuntimeHealth(reader, taskId, run, events, now) {
+function projectWebRunRuntimeHealth(reader, taskId, run, events, now, policy) {
     const stalled = isRoleRunStalled(events, run.id);
     const sessions = reader.getTaskRoleSessionSet(taskId, run.roleName);
     const session = sessions?.sessions[run.effective.agentId];
@@ -193,7 +194,8 @@ function projectWebRunRuntimeHealth(reader, taskId, run, events, now) {
     const classification = classifyRuntimeHealth({
         projection,
         semanticProgressAt: semanticProgress.progressAt,
-        now
+        now,
+        policy
     });
     return {
         runId: run.id,

package/i18n/README.zh-CN.md

@@ -45,31 +45,34 @@ yui setup
 yui doctor
 ```
 
-`setup` 是交互式的：检测已安装的 Agent CLI，选择要配置的 Agent、默认
-Agent 和 Operator Agent，并实时探测所选 CLI 当前支持的模型。它先配置
-Leader 和 Operator，再说明全局 Worker 配置会复制到新建的 Task Role，
-让用户选择 Worker 复用 Leader 配置还是单独配置。模型选择后只展示该模型
-支持的思考强度。随后 setup 会确认位于 Yui home 外部的 Project workspace，
-并询问 shell completion。选择器同时提供原生 CLI 默认值和自定义值入口。
-再次运行不会删除已有 Task/Role，也不会改变当前安装的 Project workspace，
-可用于安全地调整配置。setup 成功返回前会确保当前 Home 的后台 Controller
-已经启动。
-
-模型与思考强度属于 Agent binding 设置，因此 Operator、Leader 和全局
-Worker 即使使用同一个 Agent CLI，也可以采用不同配置。Profile 中的
-model/effort 只是 native child 的可移植 hint。
-
-Setup 会为每个受管 Agent binding 显式设置 `bypass` permission strategy。
-后续 Role 更新可选择 `default`、`bypass` 或 `configured`；`configured` 会
-保留对应 adapter 的原生权限枚举与工具规则。
-
-运行时能力目录会在每次命令中刷新，并缓存在 Yui home。实时探测超时或失败时，Yui 会展示同一 Agent 启动上下文最近一次成功的缓存并明确提示数据可能过期；没有匹配缓存时，则提供 CLI 默认值和自定义入口。`yui agent capabilities <id>` 可一次性读取同一份目录，包括模型、逐模型思考强度，以及权限、搜索可用性、profile、settings source、service tier 等其他运行时选项。
+`setup` 被刻意缩减为最小流程：检查 tmux，复用或创建一个可用 Agent，在
+Yui home 外创建默认 workspace，并配置 Operator 与 Leader，使用户可以启动
+Yui 并执行 Task。它不会创建 Worker、Reviewer、Profile 或 review policy，
+也不会询问 model/effort、permission 或 shell completion。Operator 与 Leader
+的必需 binding 使用 Yui 的 adapter 默认 permission strategy（`bypass`）；
+后续调整统一通过 `config role` 完成。再次运行会原样保留已经可用的 Operator
+和 Leader；setup 成功返回前会启动当前 Home 的后台 Controller。
+
+所有持久配置都位于 `yui config` 下。`config show` 展示完整有效状态，
+`config --help` 介绍各配置域并给出示例。Operator 可通过结构化的
+`config describe` 读取配置目录，向用户说明当前值、具体影响、可选值和生效
+方式，并只执行用户确认的修改。
+
+持久设置按职责分组：`config system` 管理 Home 默认值和展示方式，
+`config runtime` 管理 Controller 健康阈值、并发、启动、投递和 Provider
+重试，`config workflow` 管理 Leader、context 与 review policy，
+`config resources` 管理隔离区和 GC，`config tools` 管理 tmux 与诊断
+telemetry。Agent、全局 Role、Profile 和 shell completion 则继续位于同级的
+`config agent|role|profile|completion` 域。每个持久设置域统一使用
+`show`、`set`、`clear`。
+
+运行时能力目录会在每次命令中刷新，并缓存在 Yui home。实时探测超时或失败时，Yui 会展示同一 Agent 启动上下文最近一次成功的缓存并明确提示数据可能过期；没有匹配缓存时，则提供 CLI 默认值和自定义入口。`yui config agent capabilities <id>` 可一次性读取同一份目录，包括模型、逐模型思考强度，以及权限、搜索可用性、profile、settings source、service tier 等其他运行时选项。
 
 `completion` 无论是否指定 shell，都会进入确认流程：
 
 ```sh
-yui completion
-yui completion zsh
+yui config completion
+yui config completion zsh
 ```
 
 流程会确认生成脚本、安装路径和 shell 启动文件修改。补全脚本直接由命令目录生成，支持二级及更深层子命令。
@@ -116,16 +119,16 @@ yui task activate <task-id>
 
 ```sh
 yui config show
-yui config set time-zone Europe/London
+yui config system set time-zone Europe/London
 ```
 
 WorkItem 审查只有一条可选的全局规则，并直接复用已有 Global Role 的
 Agent、model、权限、prompt 和 Skills：
 
 ```sh
-yui config set review --role reviewer --trigger always
+yui config workflow set review --role reviewer --trigger always
 yui config show
-yui config clear review
+yui config workflow clear review
 ```
 
 对带 Project 的软件交付，可使用 `--trigger final`：WorkItem 验收与
@@ -133,7 +136,7 @@ Integration 保持独立，在 Task 完成前只对所有已集成 Project 的
 一次 Task 级 ReviewRound：
 
 ```sh
-yui config set review --role reviewer --trigger final
+yui config workflow set review --role reviewer --trigger final
 ```
 
 每个进入 Leader 验收阶段的结果，都会成为原 WorkItem 上一个明确的候选。
@@ -261,7 +264,7 @@ Task/WorkItem 模型，不增加额外任务类型。
 从已配置的全局 Worker 创建 Task Role，应用 Profile 并派发 WorkItem：
 
 ```sh
-yui role show worker
+yui config role show worker
 yui task role add <task-id> implementer --profile implementer
 yui task role show <task-id> implementer
 
@@ -327,7 +330,7 @@ yui task work create <task-id> "审查实现" \
   --objective "返回有源码依据的问题" \
   --accept "每个问题都标明受影响路径"
 yui task work update <task-id>/<work-item-id> running
-yui profile show reviewer
+yui config profile show reviewer
 ```
 
 subagent 的创建与结果返回完全由 Leader 当前 Agent 的 native child 能力
@@ -432,20 +435,23 @@ Task 生命周期的交互选择只展示有效来源状态：activate 只展示
 
 ## Session 与 tmux
 
-tmux 负责 Agent 进程生命周期及其可观察输出。Global Operator 与 global Role 仍使用原生交互式 CLI；受管理的 Task Claude Run 则为每个 Run 启动一个有限生命周期进程，使用 `--print`、stream-json 输入和 stream-json 输出。Yui 通过 stdin 写入一条以换行结尾的精确 Run JSON user frame，并发排空 stdout/stderr，并通过 Claude session ID 保持原生上下文连续性。因此启动和投递不再依赖 TUI composer、ready 字符、粘贴延迟或模拟 Enter 键；Codex 保留其 adapter 原生的启动 prompt 与结构化 callback 路径。
+受管理的 Task Agent 统一使用混合 Provider Runtime：Controller 与 Agent Host 通过 Provider 原生结构化协议提交和确认输入；tmux/PTY 只负责保持 Host 存活、展示输出，以及在显式人工接管后提供输入网关。受管理输入绝不会作为终端按键、粘贴文本或启动 argv 发送。Codex 使用持久 App Server JSON-RPC 进程；Claude 使用持久 stream-json 进程，并以精确回放的 user message 作为接收确认。
 
-`task enter` 与 `task role enter` 只是附着到已存在的 Task Role pane：不会启动 Controller、准备 workspace、创建或恢复 Agent、唤醒 Role，也不会投递输入。Task attach 默认为 `--read-only`；只有显式指定 `--read-write` 才可交互，并且 Role 存在 active managed Run、受管理的 Claude 进程仍在退出，或同一 pane 已有 writer 时会被拒绝。读写 attach 会先发布 Role 级 tmux writer lease，再复核持久化 Run 状态，从而闭合与 Controller 启动之间的竞态。lease 存续期间只暂停该 Role 的受管理投递且不消耗有界投递重试；detach 会释放 lease，并且只通知已经存在的持久化 Role 工作重新评估，同一 Task 的其他 Role 不受影响。attach 前，Yui 会关闭 readline、退出 raw mode、暂停自身 stdin，再同步把终端交给 tmux。attach 会继承外层终端的真实能力并进入干净的 alternate screen；鼠标滚动只查看 Agent pane 的 100,000 行 tmux 历史，不再混入此前的 shell 或 IDE Terminal 历史。读写 attach 可以使用现有 pane 本身支持的原生交互，但它不参与受管理会话的启动或投递。
+Run、Conversation、Activation 与 Turn 是四个独立身份。Conversation 可以跨多个 Run 和进程；Activation 只代表一次 Provider 进程存活期；Turn 在写入前先持久化。写入超时或结果不明确会进入 `delivery-unknown`，不会自动重发。Provider 进程退出后结束当前 Activation；恢复同一 Conversation 会创建新 Activation 并推进 authority epoch。
 
-tmux 会在 pane 创建时固定其历史容量。配置该限制之前创建的 Role 会保留原容量；Yui 会在 Terminal attach 和 Web 中提示用户退出并重新进入一次，从而在保留 Agent 原生对话的同时创建具有 100,000 行历史的新 pane。
-
-Global 交互入口在不存在 writer 时保持可写；已有 writer 时自动降级为只读。global Web 对每个 tmux session 只允许一个 writer；Task Web 始终只读。Task CLI 入口除非显式请求 `--read-write`，否则始终只读，避免观察动作改变 Agent 执行。
+Task Role 使用以下显式入口：
 
 ```sh
-yui role enter <global-role>
-yui task enter <task-id> [role] [--read-only | --read-write]
-yui task role enter <task-id> <role> [--read-only | --read-write]
+yui session enter <global-role>
+yui task role view <task-id> <role>
+yui task role takeover <task-id> <role>
+yui task role release <task-id> <role>
 ```
 
+`view` 始终只读。`takeover` 要求存在 active managed Run 且没有未决 Turn；它先以持久 CAS 把唯一 writer authority 转给人工 holder，再把相同 epoch 同步给 Agent Host，最后开放 PTY 输入网关。人工输入仍由 Host 转换为结构化 Provider Turn，而不是直接注入 Provider 终端。detach 会自动归还 authority；`release` 即使没有 active Run 也可执行，用于幂等修复中断或未完全同步的接管。Global Operator 与 global Role 继续使用原生交互式 CLI，不属于受管理 Task Provider 协议。
+
+tmux 会在 pane 创建时固定其历史容量。配置该限制之前创建的 Role 会保留原容量；Yui 会在 Terminal attach 和 Web 中提示用户退出并重新进入一次，从而创建具有 100,000 行历史的新 pane。
+
 每个 Role 可绑定多个 Agent，但任一时刻只有一个 active Agent，并为每个
 Agent binding 独立保存 native session。Operator 进一步限制为同一种
 adapter 最多绑定一个，例如可同时绑定一个 Codex 和一个 Claude；这些
@@ -455,9 +461,9 @@ binding 是预先保存、可随时切换的配置，而不是并行身份。Ope
 并切换。跨 Agent 切换默认复用已保存的 model/effort，只有用户明确选择
 更新时才进入现有配置选择流程。
 
-使用 `yui role unbind <global-role> <agent-id>` 或 `yui task role unbind <task-id> <role> <agent-id>` 可移除休眠 binding。active binding 或任何未 stopped 的 native session 都会被拒绝；stopped session 记录会和 binding 在同一事务中删除。
+使用 `yui config role unbind <global-role> <agent-id>` 或 `yui task role unbind <task-id> <role> <agent-id>` 可移除休眠 binding。active binding 或任何未 stopped 的 native session 都会被拒绝；stopped session 记录会和 binding 在同一事务中删除。
 
-Claude 的 session ID 在启动前分配。每个受管理的 Task Claude Run 都使用新的有限生命周期进程；resume 会针对固定 native session 启动新进程，而不是复用交互式 pane。受管理的 Codex 启动使用 Codex 结构化 `notify` 回调，在 turn 完成后记录 thread ID，不再向模型对话注入 session-bind prompt。
+Claude 的 session ID 在启动前分配，并由持久 stream-json Provider 进程承载多个 Turn；Codex 使用持久 App Server thread。两者都复用同一套 Conversation、Activation、Turn 与 authority fence，不再向模型对话注入 session-bind prompt。
 
 自动生命周期与投递判断只使用结构化 Hook payload、持久身份、tmux process
 state、receipt 与 pane fence。Yui 不会解析 prompt glyph、进度文本、trust dialog
@@ -527,9 +533,11 @@ Web 端可以通过与 Terminal 相同的持久化 CLI 路径回答 open InputRe
 
 ```sh
 yui update
-yui agent add|list|show|capabilities|update|remove
-yui role add|list|show|update|remove|bind|enter
-yui role session record|replace
+yui config agent add|list|show|capabilities|update|remove
+yui config role add|list|show|update|remove|bind|unbind
+yui config profile add|list|show|update|remove|reset
+yui config completion [bash|zsh|fish]
+yui session enter|record|replace|reconcile
 yui project add|clone|update|discover|list|show|knowledge
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.7.1",
+  "version": "0.8.2",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,