@zq-silk/yui 0.8.6 → 0.8.7

package/dist/review/taskFinalReviewContractRebind.js

@@ -23,6 +23,13 @@ export function resolveRecordedTaskFinalReviewContract(taskId, workItems, review
                     source: `Candidate ${item.id}/${candidate.id}`
                 }];
     });
+    const historicalCandidateObservations = workItems.flatMap((item) => (item.candidates
+        .filter((candidate) => candidate.taskFinalReviewContract !== undefined)
+        .map((candidate) => ({
+        contract: candidate.taskFinalReviewContract,
+        createdAt: candidate.createdAt,
+        source: `Historical Candidate ${item.id}/${candidate.id}`
+    }))));
     const reviewObservations = reviewRounds.flatMap((round) => ((round.scope ?? "work-item") !== "task"
         || round.taskFinalReviewContract === undefined
         ? []
@@ -31,7 +38,7 @@ export function resolveRecordedTaskFinalReviewContract(taskId, workItems, review
                 createdAt: round.createdAt,
                 source: `ReviewRound ${round.id}`
             }]));
-    return resolveTaskFinalReviewContract(taskId, [...candidateObservations, ...reviewObservations], events);
+    return resolveTaskFinalReviewContract(taskId, [...candidateObservations, ...reviewObservations], events, historicalCandidateObservations);
 }
 export function createTaskFinalReviewContractRebind(input) {
     const taskId = requireIdentity(input.taskId, "Task final-review rebind Task id");
@@ -140,7 +147,7 @@ export function taskFinalReviewContractRebindFromEvent(event) {
  * as a forward-only sequence, then require one strict append-only rebind chain.
  * Any Reviewer change, reversion, fork, or post-rebind drift fails closed.
  */
-export function resolveTaskFinalReviewContract(taskId, observations, events) {
+export function resolveTaskFinalReviewContract(taskId, observations, events, historicalObservations = []) {
     const normalizedTaskId = requireIdentity(taskId, "Task final-review contract Task id");
     const orderedObservations = [...observations]
         .map((observation) => ({
@@ -149,6 +156,13 @@ export function resolveTaskFinalReviewContract(taskId, observations, events) {
         source: requireText(observation.source, "Task final-review observation source")
     }))
         .sort(compareCreatedAt);
+    const orderedHistoricalObservations = [...historicalObservations]
+        .map((observation) => ({
+        contract: validateTaskFinalReviewContract(observation.contract),
+        createdAt: requireTimestamp(observation.createdAt, "Task final-review historical observation createdAt"),
+        source: requireText(observation.source, "Task final-review historical observation source")
+    }))
+        .sort(compareCreatedAt);
     const orderedEvents = events
         .filter(({ type }) => type === TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT)
         .map((event) => ({
@@ -158,26 +172,29 @@ export function resolveTaskFinalReviewContract(taskId, observations, events) {
     }))
         .sort((left, right) => compareCreatedAt(left, right)
         || left.event.id.localeCompare(right.event.id, undefined, { numeric: true }));
-    if (orderedObservations.length === 0) {
-        if (orderedEvents.length > 0) {
-            throw new Error(`Task ${normalizedTaskId} has a final-review rebind without a stored contract.`);
-        }
+    if (orderedObservations.length === 0 && orderedEvents.length === 0)
         return undefined;
-    }
-    for (const observation of orderedObservations) {
+    for (const observation of [...orderedObservations, ...orderedHistoricalObservations]) {
         if (observation.contract.taskId !== normalizedTaskId) {
             throw new Error(`${observation.source} carries a final-review contract for another Task.`);
         }
     }
-    const initial = orderedObservations[0].contract;
-    const reviewerRoleName = initial.reviewerRoleName;
     const firstRebindAt = orderedEvents[0]?.createdAt;
-    const legacyObservations = firstRebindAt === undefined
+    const primaryLegacyObservations = firstRebindAt === undefined
         ? orderedObservations
         : orderedObservations.filter(({ createdAt }) => createdAt < firstRebindAt);
+    const historicalRebindSource = orderedEvents[0] === undefined
+        ? undefined
+        : orderedHistoricalObservations.find((observation) => (observation.createdAt < orderedEvents[0].createdAt
+            && sameTaskFinalReviewContract(observation.contract, orderedEvents[0].rebind.fromContract)));
+    const legacyObservations = primaryLegacyObservations.length > 0
+        ? primaryLegacyObservations
+        : historicalRebindSource === undefined ? [] : [historicalRebindSource];
     if (legacyObservations.length === 0) {
         throw new Error(`Task ${normalizedTaskId} has a final-review rebind without an established source contract.`);
     }
+    const initial = legacyObservations[0].contract;
+    const reviewerRoleName = initial.reviewerRoleName;
     let effective = initial;
     const legacyContractDigests = new Set([initial.digest]);
     for (const observation of legacyObservations) {

package/dist/runtime/exactControlPlane.js

@@ -9,7 +9,6 @@ import { hasRuntimeCleanupObligation, isRuntimeLaunchReservation, runtimeLifecyc
 import { nativeSessionIdForLaunch } from "./preallocatedNativeSession.js";
 import { agentRunDeliveryReceiptId } from "../run/agentRun.js";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
-import { readActiveReleasePointer } from "../release/runtimeRelease.js";
 export const EXACT_CONTROL_ARGUMENT = "--yui-control";
 export const YUI_CONTROL_PLANE_DESCRIPTOR = "YUI_CONTROL_PLANE_DESCRIPTOR";
 export const YUI_TASK_RUNTIME_DESCRIPTOR = "YUI_TASK_RUNTIME_DESCRIPTOR";
@@ -174,43 +173,67 @@ export async function assertExactControlPlanePreflight(input, options = {}) {
             + `(expected ${descriptor.identity.aggregateSchemaVersion}, found `
             + `${storage.currentAggregateSchemaVersion ?? "unknown"}).`);
     }
-    // Issue 02: bind the descriptor to the active release. A descriptor that
-    // carries a build ID must match the Home's active release pointer; a
-    // descriptor without a build ID is rejected once a Home has an active
-    // release (old Sessions cannot mutate a released control plane). Homes
-    // without an active release pointer keep the legacy continuity contract.
-    const readActiveRelease = options.readActiveRelease ?? defaultReadActiveRelease;
-    const activeRelease = readActiveRelease(descriptor.yuiHome);
-    if (descriptor.buildId !== undefined) {
-        if (activeRelease === null) {
-            throw new Error("Exact control-plane descriptor names a release build but the Home has "
-                + "no active release pointer.");
+    // A frozen descriptor authenticates the command that created it; it no
+    // longer pins the Home's deployment pointer for the lifetime of a Session.
+    // Continuity is the protocol/storage contract checked above and the durable
+    // Task/Role/Run identity checked below. This lets a compatible Controller or
+    // active release advance without invalidating a still-current Session.
+    if (options.checkController !== false) {
+        const call = options.callController ?? defaultCallController;
+        try {
+            const status = await call(descriptor.yuiHome, "controller.status", {});
+            assertControllerContinuityIdentity(status, descriptor.identity);
         }
-        if (activeRelease.buildId !== descriptor.buildId) {
-            throw new Error("Exact control-plane release changed since the descriptor was frozen "
-                + `(expected ${descriptor.buildId}, active ${activeRelease.buildId}).`);
+        catch (error) {
+            if (!isDefinitelyNotRunning(error))
+                throw error;
         }
-        if (descriptor.activeReleaseDigest !== undefined
-            && activeRelease.packageDigest !== descriptor.activeReleaseDigest) {
-            throw new Error("Exact control-plane release digest does not match the active release pointer.");
+    }
+    return descriptor;
+}
+/**
+ * Compatibility gate for an ordinary `yui` invocation inside a managed
+ * Session. The Session Manifest and durable runtime state authenticate the
+ * actor separately; this gate proves that the current CLI can safely share the
+ * Home with its storage and Controller without pinning package/build identity.
+ */
+export async function assertCompatibleControlPlanePreflight(input, options = {}) {
+    const home = canonicalPath(input.actualHome);
+    const identity = validateVersionIdentity(options.identity ?? yuiVersionIdentity());
+    const storage = (options.inspectStorage ?? inspectStorageSchema)(home);
+    if (storage.status !== "current") {
+        const compatibleRecordOnlyOlder = storage.status === "unsupported"
+            && storage.incompatibleComponent === "record"
+            && storage.direction === "older"
+            && storage.currentLayoutVersion === identity.storageLayoutVersion
+            && storage.currentAggregateSchemaVersion === identity.aggregateSchemaVersion;
+        if (!compatibleRecordOnlyOlder) {
+            throw new Error(`Managed control-plane storage is not current: ${storage.status}.`);
         }
+        (options.openCompatibleStore ?? openCompatibleFileTaskStore)(home).getConfig();
     }
-    else if (activeRelease !== null) {
-        throw new Error("Exact control-plane descriptor predates the active release; old Sessions "
-            + "cannot mutate a released control plane. Re-launch through the current release.");
+    if (storage.currentLayoutVersion !== identity.storageLayoutVersion) {
+        throw new Error("Managed control-plane storage layout is incompatible "
+            + `(expected ${identity.storageLayoutVersion}, found `
+            + `${storage.currentLayoutVersion ?? "unknown"}).`);
+    }
+    if (storage.currentAggregateSchemaVersion !== identity.aggregateSchemaVersion) {
+        throw new Error("Managed control-plane aggregate schema is incompatible "
+            + `(expected ${identity.aggregateSchemaVersion}, found `
+            + `${storage.currentAggregateSchemaVersion ?? "unknown"}).`);
     }
     if (options.checkController !== false) {
         const call = options.callController ?? defaultCallController;
         try {
-            const status = await call(descriptor.yuiHome, "controller.status", {});
-            assertControllerContinuityIdentity(status, descriptor.identity);
+            const status = await call(home, "controller.status", {});
+            assertControllerContinuityIdentity(status, identity);
         }
         catch (error) {
             if (!isDefinitelyNotRunning(error))
                 throw error;
         }
     }
-    return descriptor;
+    return identity;
 }
 export function assertControllerStatusIdentity(status, expected = yuiVersionIdentity()) {
     if (!isRecord(status) || status.running !== true) {
@@ -539,16 +562,3 @@ function isRecord(value) {
 function isDefinitelyNotRunning(error) {
     return isRecord(error) && error.code === "CONTROLLER_NOT_RUNNING";
 }
-function defaultReadActiveRelease(home) {
-    try {
-        const pointer = readActiveReleasePointer(home);
-        return pointer === null
-            ? null
-            : { buildId: pointer.buildId, packageDigest: pointer.packageDigest };
-    }
-    catch {
-        // A damaged pointer fails closed: treat it as an active release the
-        // descriptor cannot match, rather than silently skipping the gate.
-        return { buildId: "unknown", packageDigest: "unknown" };
-    }
-}

package/dist/runtime/firstProgressStopLoss.js

@@ -21,7 +21,9 @@ export function projectFirstProgressStopLoss(input) {
             ...input.events
                 .filter((event) => typeof event.payload.leaderRunId === "string")
                 .map((event) => ({ at: event.createdAt, ref: `event:${event.id}` })),
-            ...input.workItems.map((item) => ({ at: item.createdAt, ref: `work-item:${item.id}` })),
+            ...input.workItems
+                .filter((item) => item.status !== "retired")
+                .map((item) => ({ at: item.createdAt, ref: `work-item:${item.id}` })),
             ...input.reviewRounds.map((round) => ({ at: round.createdAt, ref: `review-round:${round.id}` })),
             ...input.integrations.map((attempt) => ({ at: attempt.createdAt, ref: `integration-attempt:${attempt.id}` }))
         ]

package/dist/scheduler/actionability.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { isDurableJobTerminal } from "../job/durableJob.js";
+import { operationalTaskRecords } from "../task/taskRecordRetirement.js";
 /**
  * Canonical SHA-256 digest over the normalized actionable facts. Pure and
  * deterministic: the same facts always produce the same digest regardless of
@@ -46,7 +47,8 @@ export function collectTaskActionability(store, taskId) {
         throw new Error(`Task not found for actionability projection: ${taskId}.`);
     }
     const facts = [];
-    for (const run of store.listAgentRuns(taskId).filter((candidate) => candidate.status === "active")) {
+    const events = store.listEvents?.(taskId) ?? [];
+    for (const run of operationalTaskRecords(store.listAgentRuns(taskId), events, "agent-run").filter((candidate) => candidate.status === "active")) {
         facts.push({
             key: `active-run:${run.id}`,
             value: [
@@ -95,7 +97,7 @@ export function collectTaskActionability(store, taskId) {
             value: `${request.status}|${request.updatedAt}`
         });
     }
-    for (const message of store.listMessages?.(taskId) ?? []) {
+    for (const message of operationalTaskRecords(store.listMessages?.(taskId) ?? [], events, "message")) {
         if (message.wakePolicy !== "leader")
             continue;
         facts.push({

package/dist/scheduler/activeTaskProgress.js

@@ -3,6 +3,7 @@ import { queueLeaderWakeup } from "./wakeupQueue.js";
 import { wakeReason } from "./wakeReason.js";
 import { projectTaskExecution } from "./taskExecutionProjection.js";
 import { collectTaskActionability, computeActionabilityDigest, decideOrphanWake } from "./actionability.js";
+import { operationalTaskRecords } from "../task/taskRecordRetirement.js";
 /**
  * Repairs an active Task that has no durable owner capable of advancing it.
  * This is a low-frequency safety net; normal transitions enqueue their own
@@ -96,7 +97,7 @@ function admitOrphanWake(store, taskId) {
  * so the admission check never suppresses while a Leader is still running.
  */
 function findLastLeaderRun(store, taskId) {
-    const runs = store.listAgentRuns?.(taskId) ?? [];
+    const runs = operationalTaskRecords(store.listAgentRuns?.(taskId) ?? [], store.listEvents?.(taskId) ?? [], "agent-run");
     let latest = null;
     for (const run of runs) {
         if (run.roleName !== "leader")

package/dist/scheduler/taskExecutionProjection.js

@@ -1,3 +1,4 @@
+import { operationalTaskRecords } from "../task/taskRecordRetirement.js";
 import { currentWorkItemExecutionGroup } from "../workItem/workItem.js";
 import { mailboxBatches } from "../coordination/workMailbox.js";
 import { summarizeExecutionGroup } from "../execution/executionGroup.js";
@@ -12,7 +13,8 @@ export function buildTaskExecutionProjection(store, taskId, taskOverride) {
     if (task === null)
         return null;
     const roles = store.listRoles?.(taskId) ?? [];
-    const runs = store.listAgentRuns?.(taskId) ?? [];
+    const events = store.listEvents?.(taskId) ?? [];
+    const runs = operationalTaskRecords(store.listAgentRuns?.(taskId) ?? [], events, "agent-run");
     const leaderMailbox = store.getWorkMailbox?.({
         kind: "role",
         taskId,
@@ -42,7 +44,7 @@ export function buildTaskExecutionProjection(store, taskId, taskOverride) {
         ...(store.listIntegrationAttempts === undefined
             ? {}
             : { integrations: store.listIntegrationAttempts(taskId) }),
-        ...(store.listEvents === undefined ? {} : { events: store.listEvents(taskId) }),
+        ...(store.listEvents === undefined ? {} : { events }),
         ...(store.getTaskBrief === undefined ? {} : { brief: store.getTaskBrief(taskId) }),
         pendingWakeup: store.getPendingWakeup?.(taskId) ?? null,
         leaderMailbox,
@@ -60,7 +62,11 @@ export function buildTaskExecutionProjection(store, taskId, taskOverride) {
 export function projectTaskExecutionFromFacts(facts) {
     const executionGroups = facts.executionGroups
         ?? collectExecutionGroups(facts.workItems ?? [], facts.reviewRounds ?? []);
-    return projectTaskExecution({ ...facts, executionGroups });
+    return projectTaskExecution({
+        ...facts,
+        runs: operationalTaskRecords(facts.runs, facts.events ?? [], "agent-run"),
+        executionGroups
+    });
 }
 /** Alias kept intentionally small for scheduler callers and external read models. */
 export const deriveTaskExecutionProjection = projectTaskExecution;
@@ -471,7 +477,10 @@ function collectBlockers(workItems, reviewRounds, integrations, openInputs, task
                 summary: item.outcome ?? `WorkItem ${item.id} is ${item.status}.`
             });
         }
-        if (item.status === "pending" && (item.dependsOn ?? []).some((id) => byId.get(id)?.status !== "completed")) {
+        if (item.status === "pending" && (item.dependsOn ?? []).some((id) => {
+            const status = byId.get(id)?.status;
+            return status !== "completed" && status !== "retired";
+        })) {
             blockers.push({
                 kind: "work",
                 id: item.id,

package/dist/storage/sqliteStore.js

@@ -48,6 +48,7 @@ import { generateHomeIdentity, validateHomeIdentity } from "../repository/homeId
 import { validateIntegrationQueueEntry } from "../integration/integrationQueueEntry.js";
 import { validDurableJobTransition, validateDurableJob } from "../job/durableJob.js";
 import { validateTaskWake } from "../scheduler/taskWake.js";
+import { operationalTaskRecords, TASK_RECORD_RETIRED_EVENT } from "../task/taskRecordRetirement.js";
 import { TASK_RECORD_ID_PREFIXES } from "../task/taskRecordReference.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { assertHomeWritable } from "./upgradeFence.js";
@@ -709,7 +710,13 @@ export class SqliteTaskStore {
             return null;
         // One indexed query (idx_agent_runs_role_status) covers both the active
         // Runs the projection waits on and the Leader Runs the budget consumes.
-        const runs = this.#sortById(this.#listPayload("agent_runs", "task_id = ? AND (status = 'active' OR role_name = 'leader')", [taskId]), (run) => run.id);
+        const events = this.#sortById(this.#listPayload("events", "task_id = ? AND type IN (?, ?, ?)", [
+            taskId,
+            TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT,
+            TASK_RECORD_RETIRED_EVENT,
+            "review.completed"
+        ]), (event) => event.id);
+        const runs = operationalTaskRecords(this.#sortById(this.#listPayload("agent_runs", "task_id = ? AND (status = 'active' OR role_name = 'leader')", [taskId]), (run) => run.id), events, "agent-run");
         return {
             task: {
                 id: task.id,
@@ -721,7 +728,8 @@ export class SqliteTaskStore {
             changeSets: this.#sortById(this.#listPayload("change_sets", "task_id = ?", [taskId]), (changeSet) => changeSet.id),
             integrations: this.#sortById(this.#listPayload("integration_attempts", "task_id = ?", [taskId]), (attempt) => attempt.id),
             reviewRounds: this.#sortById(this.#listPayload("review_rounds", "task_id = ?", [taskId]), (round) => round.id),
-            taskFinalReviewContractEvents: this.#sortById(this.#listPayload("events", "task_id = ? AND type = ?", [taskId, TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT]), (event) => event.id),
+            taskFinalReviewContractEvents: events
+                .filter((event) => event.type === TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT),
             reviewConfig: this.getReviewConfig(),
             openInputRequests: this.#sortById(this.#listPayload("input_requests", "task_id = ? AND status = 'open'", [taskId]), (request) => request.id),
             activeRuns: runs.filter((run) => run.status === "active"),
@@ -729,7 +737,7 @@ export class SqliteTaskStore {
             reviewOutcomeEvidence: {
                 agentRuns: this.#sortById(this.#listPayload("agent_runs", "task_id = ?", [taskId]).filter((run) => run.purpose === "review"), (run) => run.id),
                 reviewFindings: this.listReviewFindings(taskId),
-                events: this.listEvents(taskId).filter((event) => event.type === "review.completed")
+                events: events.filter((event) => event.type === "review.completed")
             }
         };
     }
@@ -739,7 +747,7 @@ export class SqliteTaskStore {
             return null;
         return {
             ...base,
-            agentRuns: this.listAgentRuns(taskId),
+            agentRuns: operationalTaskRecords(this.listAgentRuns(taskId), this.listEvents(taskId), "agent-run"),
             roleSessionSets: this.listRoleSessionSets(taskId),
             managedWorkspaces: this.#sortById(this.#listPayload("managed_workspaces", "task_id = ?", [taskId]), (workspace) => managedWorkspaceKey(workspace.owner)),
             durableJobs: this.#sortById(this.#listPayload("durable_jobs", "task_id = ?", [taskId]), (job) => job.id),

package/dist/storage/taskStore.js

@@ -34,6 +34,7 @@ import { CURRENT_LEADER_FAILURE_SCHEMA_VERSION } from "../scheduler/leaderFailur
 import { CURRENT_OPERATOR_NOTIFICATION_SCHEMA_VERSION } from "../scheduler/operatorNotification.js";
 import { CURRENT_TASK_WAKE_SCHEMA_VERSION, validateTaskWake } from "../scheduler/taskWake.js";
 import { validateTask } from "../task/task.js";
+import { operationalTaskRecords } from "../task/taskRecordRetirement.js";
 import { TASK_RECORD_ID_PREFIXES, validateTaskRecordReference } from "../task/taskRecordReference.js";
 import { workItemExecutionGroupById, validateWorkItem } from "../workItem/workItem.js";
 import { isExecutionGroupTransition, validateExecutionGroup } from "../execution/executionGroup.js";
@@ -409,7 +410,8 @@ export class FileTaskStore {
         const aggregate = this.#state().tasks[taskId];
         if (aggregate === undefined)
             return null;
-        const agentRuns = values(aggregate.agentRuns, "id");
+        const events = values(aggregate.events, "id");
+        const agentRuns = operationalTaskRecords(values(aggregate.agentRuns, "id"), events, "agent-run");
         return {
             task: {
                 id: aggregate.task.id,
@@ -421,7 +423,7 @@ export class FileTaskStore {
             changeSets: values(aggregate.changeSets, "id"),
             integrations: values(aggregate.integrationAttempts, "id"),
             reviewRounds: values(aggregate.reviewRounds, "id"),
-            taskFinalReviewContractEvents: values(aggregate.events, "id")
+            taskFinalReviewContractEvents: events
                 .filter((event) => event.type === TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT),
             reviewConfig: this.getReviewConfig(),
             openInputRequests: values(aggregate.inputRequests, "id")
@@ -432,7 +434,7 @@ export class FileTaskStore {
                 agentRuns: agentRuns.filter((run) => run.purpose === "review"),
                 // The rollback file backend has no finding-ledger records.
                 reviewFindings: [],
-                events: values(aggregate.events, "id").filter((event) => (event.type === "review.completed"))
+                events: events.filter((event) => (event.type === "review.completed"))
             }
         };
     }
@@ -451,7 +453,7 @@ export class FileTaskStore {
         }
         return {
             ...base,
-            agentRuns: this.listAgentRuns(taskId),
+            agentRuns: operationalTaskRecords(this.listAgentRuns(taskId), values(aggregate.events, "id"), "agent-run"),
             roleSessionSets: this.listRoleSessionSets(taskId),
             managedWorkspaces: values(aggregate.managedWorkspaces, (workspace) => managedWorkspaceKey(workspace.owner)),
             durableJobs: values(aggregate.durableJobs, "id"),

package/dist/task/nextAction.js

@@ -650,7 +650,10 @@ function selectOpenWorkItem(workItems) {
     const openItems = workItems.filter((item) => OPEN_WORK_ITEM_STATUSES.has(item.status));
     if (openItems.length === 0)
         return { kind: "none" };
-    const eligible = openItems.find((item) => (item.dependsOn.every((dependencyId) => byId.get(dependencyId)?.status === "completed")));
+    const eligible = openItems.find((item) => (item.dependsOn.every((dependencyId) => {
+        const status = byId.get(dependencyId)?.status;
+        return status === "completed" || status === "retired";
+    })));
     if (eligible !== undefined)
         return { kind: "ready", item: eligible };
     let current = openItems[0];
@@ -660,8 +663,10 @@ function selectOpenWorkItem(workItems) {
             return { kind: "blocked", itemId: current.id, blockedBy: current.id };
         }
         visited.add(current.id);
-        const blockedBy = current.dependsOn
-            .find((dependencyId) => byId.get(dependencyId)?.status !== "completed");
+        const blockedBy = current.dependsOn.find((dependencyId) => {
+            const status = byId.get(dependencyId)?.status;
+            return status !== "completed" && status !== "retired";
+        });
         if (blockedBy === undefined)
             return { kind: "ready", item: current };
         const dependency = byId.get(blockedBy);

package/dist/task/taskRecordRetirement.js

@@ -0,0 +1,72 @@
+import { createTaskEvent } from "../event/taskEvent.js";
+export const TASK_RECORD_RETIRED_EVENT = "task.record-retired";
+export const RETIRABLE_TASK_RECORD_KINDS = [
+    "work-item",
+    "message",
+    "agent-run"
+];
+/**
+ * Appends a tombstone fact without rewriting the original record. Operational
+ * projections ignore the retired identity; audit and list surfaces can still
+ * render both the original bytes and this reasoned retirement event.
+ */
+export function createTaskRecordRetirement(input, now) {
+    return createTaskEvent(input.eventId, input.taskId, TASK_RECORD_RETIRED_EVENT, {
+        recordKind: requireRecordKind(input.recordKind),
+        recordId: requireText(input.recordId, "Task record id"),
+        reason: requireText(input.reason, "Task record retirement reason"),
+        retiredBy: requireRetiredBy(input.retiredBy)
+    }, now);
+}
+export function taskRecordRetirement(event) {
+    if (event.type !== TASK_RECORD_RETIRED_EVENT)
+        return null;
+    const recordKind = event.payload.recordKind;
+    const retiredBy = event.payload.retiredBy;
+    if (!RETIRABLE_TASK_RECORD_KINDS.includes(recordKind)
+        || (retiredBy !== "user" && retiredBy !== "operator" && retiredBy !== "leader")
+        || event.payload.recordId?.trim().length === 0
+        || event.payload.reason?.trim().length === 0) {
+        return null;
+    }
+    return Object.freeze({
+        recordKind: recordKind,
+        recordId: event.payload.recordId,
+        reason: event.payload.reason,
+        retiredBy
+    });
+}
+export function retiredTaskRecordIds(events, recordKind) {
+    const ids = new Set();
+    for (const event of events) {
+        const retirement = taskRecordRetirement(event);
+        if (retirement?.recordKind === recordKind)
+            ids.add(retirement.recordId);
+    }
+    return ids;
+}
+export function isTaskRecordRetired(events, recordKind, recordId) {
+    return retiredTaskRecordIds(events, recordKind).has(recordId);
+}
+export function operationalTaskRecords(records, events, recordKind) {
+    const retired = retiredTaskRecordIds(events, recordKind);
+    return retired.size === 0 ? [...records] : records.filter(({ id }) => !retired.has(id));
+}
+function requireRecordKind(value) {
+    if (!RETIRABLE_TASK_RECORD_KINDS.includes(value)) {
+        throw new Error(`Task record retirement kind is invalid: ${String(value)}.`);
+    }
+    return value;
+}
+function requireRetiredBy(value) {
+    if (value !== "user" && value !== "operator" && value !== "leader") {
+        throw new Error(`Task record retirement actor is invalid: ${String(value)}.`);
+    }
+    return value;
+}
+function requireText(value, label) {
+    if (typeof value !== "string" || value.includes("\0") || value.trim().length === 0) {
+        throw new Error(`${label} is required.`);
+    }
+    return value.trim();
+}

package/dist/workItem/workItem.js

@@ -638,8 +638,8 @@ function normalizeProjectBaseRefs(baseRefs) {
     });
 }
 function normalizeDisposition(input, now) {
-    if (input.by !== "leader") {
-        throw new Error("Only the Task Leader may retire a Work Item.");
+    if (input.by !== "leader" && input.by !== "operator" && input.by !== "user") {
+        throw new Error("Work Item retirement actor is invalid.");
     }
     const summary = requireText(input.summary, "Work item disposition summary");
     const replacementWorkItemId = input.replacementWorkItemId;
@@ -648,7 +648,7 @@ function normalizeDisposition(input, now) {
     }
     const result = {
         schemaVersion: 1,
-        by: "leader",
+        by: input.by,
         summary,
         retiredAt: now.toISOString(),
         ...(replacementWorkItemId === undefined ? {} : { replacementWorkItemId })
@@ -659,7 +659,9 @@ function validateDisposition(disposition) {
     if (disposition.schemaVersion !== 1) {
         throw new Error("Work Item disposition must use schemaVersion 1.");
     }
-    if (disposition.by !== "leader") {
+    if (disposition.by !== "leader"
+        && disposition.by !== "operator"
+        && disposition.by !== "user") {
         throw new Error("Work Item disposition actor is invalid.");
     }
     requireText(disposition.summary, "Work item disposition summary");

package/i18n/README.zh-CN.md

@@ -404,6 +404,19 @@ yui task work accept <task-id>/<work-item-id> --summary "验收标准满足。"
 replacement。WorkItem、Integration
 worktree 与检查日志会作为证据保留，直到显式清理。
 
+错误的历史指令或执行记录可以从运行投影中废弃，而不删除审计证据：
+
+```sh
+yui task message retire <task>/<message> --reason "已被新指令替代"
+yui task run retire <task>/<agent-run> --reason "无效的启动记录"
+```
+
+这些命令追加 retirement 事实；列表和审计仍保留并标记原 Message、
+WorkItem 或 AgentRun，而受管 Run 上下文、actionability、恢复、Review 证据和调度会忽略
+它。活动 AgentRun 会先按精确身份终态化；重复废弃是幂等操作。Message 与
+AgentRun 只能由用户或全局 Operator 废弃，WorkItem 也可由所属 Task Leader
+废弃。
+
 长期 Task 不依赖 native transcript 恢复。Leader 每次 yield 前更新 Brief
 的 focus 和 leader summary；材料性技术选择写入 Decision；可独立汇报的
 阶段成果写入 Milestone；只有跨 Task 稳定有效的信息才进入 Project
@@ -481,6 +494,12 @@ binding 是预先保存、可随时切换的配置，而不是并行身份。Ope
 并切换。跨 Agent 切换默认复用已保存的 model/effort，只有用户明确选择
 更新时才进入现有配置选择流程。
 
+受管理 Session 的普通工作流命令统一调用 PATH 中的 `yui`。Session Manifest
+与持久 Role/Run fence 负责身份认证，CLI 和 Controller 只需满足协议与存储兼容，
+不会因包版本升级而使现有 Session 失效；Provider 回调等内部路径仍保留精确围栏。
+`update` 会幂等刷新旧版本生成的精确 CLI wrapper，使历史 Session 也转为这一
+兼容入口。
+
 使用 `yui config role unbind <global-role> <agent-id>` 或 `yui task role unbind <task-id> <role> <agent-id>` 可移除休眠 binding。active binding 或任何未 stopped 的 native session 都会被拒绝；stopped session 记录会和 binding 在同一事务中删除。
 
 Claude 的 session ID 在启动前分配，并由持久 stream-json Provider 进程承载多个 Turn；Codex 使用持久 App Server thread。两者都复用同一套 Conversation、Activation、Turn 与 authority fence，不再向模型对话注入 session-bind prompt。
@@ -502,7 +521,7 @@ yui controller stop
 yui controller restart
 ```
 
-`controller restart` 会用当前安装的 Yui 版本替换 Controller 进程及其调度循环、socket 服务，不会停止或重启已受管的 tmux/Agent 会话。
+`controller restart` 会用当前安装的 Yui 版本替换 Controller 进程及其调度循环、socket 服务，不会停止或重启已受管的 tmux/Agent 会话；普通 Session 命令按协议与存储身份兼容，不要求 Controller 与 CLI 包版本完全相同。
 
 成功的 `setup`、`upgrade` 和 `update` 都会确保当前 Home 有一个运行中的
 Controller；如果之前没有运行，会在完成后启动。只读命令和

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-operator/SKILL.md

@@ -319,6 +319,13 @@ ChangeSet is integrated.
   Role with `yui task enter <task-id> <role>`.
 - Relay explicit Task information with
   `yui task message send <task-id> "<body>"`.
+- When a proven incorrect historical record is affecting current projections,
+  preserve it as audit evidence and append a reasoned retirement with
+  `yui task message retire <task>/<message> --reason "..."`,
+  `yui task run retire <task>/<run> --reason "..."`, or
+  `yui task work retire <task>/<work> --summary "..."`. Inspect the exact
+  record first; retirement is not a substitute for normal failure recovery or
+  for resolving a still-valid result.
 - Inspect each InputRequest before presenting it. Present questions, choices,
   recommendations, and deadlines exactly only when the request is a user-owned
   boundary (a real choice, authorization, credential, unavailable external

package/skills/yui-runtime/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yui-runtime
-description: Load and use the exact authorized context for every Yui-managed Leader, Worker, Reviewer, Operator, or custom Role Run, and complete that Run through its bounded control-plane protocol.
+description: Load and use the authorized context for every Yui-managed Leader, Worker, Reviewer, Operator, or custom Role Run, and complete that Run through its bounded control-plane protocol.
 ---
 
 # Yui Runtime
@@ -12,10 +12,10 @@ workspace layout, native transcript, or an earlier Run.
 For every managed Task Run:
 
 1. Read the exact Run identity from the newest Bootstrap Envelope.
-2. Before acting, load its authorized pack with the exact Session CLI:
+2. Before acting, load its authorized pack with the ordinary Yui CLI command:
 
    ```sh
-   "$YUI_SESSION_CLI" task run context "$YUI_TASK_ID/<run-id>" --json
+   yui task run context "$YUI_TASK_ID/<run-id>" --json
    ```
 
 3. Verify that the returned Task, Run, Role, purpose, Snapshot digest, workspace,
@@ -27,7 +27,7 @@ For every managed Task Run:
    `refId`:
 
    ```sh
-   "$YUI_SESSION_CLI" task run context expand "$YUI_TASK_ID/<run-id>" <ref-id> --store <store> --mode full --json
+   yui task run context expand "$YUI_TASK_ID/<run-id>" <ref-id> --store <store> --mode full --json
    ```
 
    A bare `<ref-id>` remains supported only when it identifies exactly one
@@ -42,11 +42,11 @@ The pack's authority view and writable Project IDs are hard boundaries. A
 native subagent inherits the parent Run's refs and authority; it does not gain a
 new Yui actor, Run, Session, or cross-Task read permission.
 
-For a global Operator or custom GlobalRole Session, load the stable exact view
+For a global Operator or custom GlobalRole Session, load the stable authorized view
 before routing or acting:
 
 ```sh
-"$YUI_SESSION_CLI" session context "$YUI_ROLE" --json
+yui session context "$YUI_ROLE" --json
 ```
 
 Global context grants no Task implementation workspace. Read a Task only after