@zq-silk/yui 0.8.9 → 0.10.0

package/dist/task/nextAction.js

@@ -1,8 +1,8 @@
 import { createHash } from "node:crypto";
+import { changeSetDeliverySettled, governingChangeSets } from "../integration/deliveryObligation.js";
 import { deltaRecheckBlocksAcceptance } from "../review/reviewRound.js";
 import { classifyReviewRoundOutcome, isSemanticReviewRound } from "../review/reviewOutcomeClassifier.js";
 import { resolveRecordedTaskFinalReviewContract } from "../review/taskFinalReviewContractRebind.js";
-import { taskDeliveryPath } from "./task.js";
 import { currentWorkItemCandidate, governingWorkItemCandidate } from "../workItem/workItem.js";
 const OPEN_WORK_ITEM_STATUSES = new Set(["pending", "running", "awaiting_acceptance"]);
 export function projectNextAction(facts) {
@@ -70,7 +70,7 @@ export function projectNextAction(facts) {
             const candidateRef = ref("candidate", `${candidateReady.id}/${candidate.id}`);
             return buildAction(facts, {
                 kind: "repair-protocol-inconsistency",
-                reason: `Candidate ${candidate.id} is a direct Task-main delivery with base==head (no commits); reject it and re-dispatch real work.`,
+                reason: `Candidate ${candidate.id} is a Task-main delivery with base==head (no commits); reject it and re-dispatch real work.`,
                 refs: [ref("work-item", candidateReady.id), candidateRef],
                 conflicts: [candidateRef],
                 preconditions: [
@@ -254,42 +254,38 @@ export function projectNextAction(facts) {
             judgmentRequired: "Leader must choose the execution path: direct execution, a native subagent, or managed Task Role dispatch."
         });
     }
-    if (facts.workItems.length === 0) {
-        if (taskDeliveryPath(task) === "direct" && !taskFinalReviewRequired(facts)) {
-            return buildAction(facts, {
-                kind: "complete-task",
-                reason: `Task ${task.id} uses direct delivery; implement and verify the managed Task main, then complete without creating a WorkItem.`,
-                refs: [ref("task", task.id)],
-                preconditions: [
-                    { fact: "Task is active", satisfied: task.status === "active", ref: ref("task", task.id) },
-                    { fact: "Task main is clean, committed, and verified", satisfied: false }
-                ],
-                recommendedCommand: `yui task complete ${task.id} --summary-file -`,
-                ...(facts.reviewConfig === null
-                    ? {}
-                    : {
-                        alternatives: [{
-                                kind: "promote-to-integrated-delivery",
-                                reason: "Before Task main advances, promote to integrated delivery when risk warrants an independently managed ReviewRound.",
-                                recommendedCommand: `yui task update ${task.id} --delivery integrated`,
-                                refs: [ref("task", task.id)]
-                            }],
-                        judgmentRequired: "Leader must decide whether the work still fits direct delivery or should be promoted before completing it."
-                    })
-            });
-        }
-        if (taskDeliveryPath(task) === "integrated") {
-            return buildAction(facts, {
-                kind: "implement-current-work-item",
-                reason: `Task ${task.id} has no Work Item; create the first unit of work.`,
-                refs: [],
-                preconditions: [
-                    { fact: "At least one Work Item exists", satisfied: false },
-                    { fact: "Task is active", satisfied: task.status === "active" }
-                ],
-                recommendedCommand: `yui task work create ${task.id} \"<objective>\"`
-            });
-        }
+    if (facts.workItems.length === 0
+        && !taskFinalReviewRequired(facts)
+        && !facts.reviewRounds.some((round) => ((round.scope ?? "work-item") === "task"
+            && (round.status === "pending" || round.status === "running")))) {
+        const reviewAlternative = facts.reviewConfig === null
+            ? []
+            : [{
+                    kind: "request-final-review",
+                    reason: "Request one independent Review of the frozen Task result when risk warrants it.",
+                    recommendedCommand: `yui task review request ${task.id} --role ${facts.reviewConfig.roleName}`,
+                    refs: [ref("task", task.id)]
+                }];
+        return buildAction(facts, {
+            kind: "complete-task",
+            reason: task.type === "bugfix"
+                ? `Task ${task.id} is a Leader-owned bugfix; implement and verify it on Task main without manufacturing a WorkItem.`
+                : task.type === "feature"
+                    ? `Feature ${task.id} has no independent delivery units; the Leader may implement it on Task main or create WorkItems only if separate ownership is genuinely useful.`
+                    : `Task ${task.id} has no independent delivery units; the Leader decides whether to own it on Task main or create WorkItems only if separate ownership is genuinely useful.`,
+            refs: [ref("task", task.id)],
+            preconditions: [
+                { fact: "Task is active", satisfied: task.status === "active", ref: ref("task", task.id) },
+                { fact: "Task main is clean, committed, and verified", satisfied: false }
+            ],
+            recommendedCommand: `yui task complete ${task.id} --summary-file -`,
+            ...(reviewAlternative.length === 0 ? {} : { alternatives: reviewAlternative }),
+            judgmentRequired: task.type === "bugfix"
+                ? "Leader must judge whether the bugfix risk warrants one optional final Review."
+                : task.type === "feature"
+                    ? "Leader must judge whether this feature is small enough to own directly or needs independently owned WorkItems, and whether the final result warrants Review."
+                    : "Leader must choose the smallest useful topology from the Project-defined Task intent, then decide whether the frozen result warrants Review."
+        });
     }
     const uncaptured = facts.workItems.find((item) => needsChangeSetCapture(facts, item));
     if (uncaptured !== undefined) {
@@ -304,8 +300,8 @@ export function projectNextAction(facts) {
             recommendedCommand: `yui task work capture ${task.id}/${uncaptured.id}`
         });
     }
-    const unintegrated = facts.changeSets
-        .find((changeSet) => !hasCommittedIntegration(facts.integrations, changeSet.id));
+    const unintegrated = governingChangeSets(facts.workItems, facts.changeSets)
+        .find((changeSet) => !changeSetDeliverySettled(changeSet, facts.integrations, facts.integrationQueueEntries));
     if (unintegrated !== undefined) {
         return buildAction(facts, {
             kind: "integrate-change-set",
@@ -318,11 +314,13 @@ export function projectNextAction(facts) {
             recommendedCommand: `yui task integration start ${task.id} --project ${unintegrated.projectId} --change-set ${unintegrated.id}`
         });
     }
+    const finalReviewRequired = taskFinalReviewRequired(facts);
     const failedFinal = latestTaskFinalReview(facts.reviewRounds);
     const failedFinalOutcome = failedFinal === undefined
         ? null
         : classifyReviewRoundOutcome(failedFinal, nextActionReviewOutcomeEvidence(facts));
-    if (failedFinal !== undefined && failedFinalOutcome?.kind === "non-semantic") {
+    if (finalReviewRequired
+        && failedFinal !== undefined && failedFinalOutcome?.kind === "non-semantic") {
         return buildAction(facts, {
             kind: "resume-review",
             reason: `Task-final Review ${failedFinal.id} ended before a semantic review was proven.`,
@@ -333,7 +331,8 @@ export function projectNextAction(facts) {
             recommendedCommand: `yui task review force-fresh ${task.id}/${failedFinal.id}`
         });
     }
-    if (failedFinal !== undefined && failedFinalOutcome?.kind === "ambiguous") {
+    if (finalReviewRequired
+        && failedFinal !== undefined && failedFinalOutcome?.kind === "ambiguous") {
         return buildAction(facts, {
             kind: "repair-protocol-inconsistency",
             reason: `Task-final Review ${failedFinal.id} has ambiguous semantic and infrastructure evidence: ${failedFinalOutcome.reason}`,
@@ -344,7 +343,8 @@ export function projectNextAction(facts) {
             ]
         });
     }
-    if (failedFinal !== undefined
+    if (finalReviewRequired
+        && failedFinal !== undefined
         && failedFinalOutcome?.kind === "semantic"
         && ((failedFinal.checks ?? []).some(({ outcome }) => outcome === "failed")
             || deltaRecheckBlocksAcceptance(failedFinal))) {
@@ -423,33 +423,29 @@ export function projectNextAction(facts) {
             recommendedCommand: `yui task review retry ${task.id}/${activeFinal.id}`
         });
     }
-    const finalReviewRequired = taskFinalReviewRequired(facts);
     if (task.projectBindings.length > 0
         && finalReviewRequired
         && !hasValidFinalReview(facts)) {
         const reviewerRole = taskFinalReviewRole(facts);
-        const directWithoutWorkItems = taskDeliveryPath(task) === "direct"
-            && facts.workItems.length === 0;
         return buildAction(facts, {
             kind: "request-final-review",
-            reason: directWithoutWorkItems
-                ? "This direct Task already owns a final-Review obligation; completion must prepare or resume a Review of its frozen Task head."
-                : "All Work Items are delivered but no valid Task-final Review attests the integrated head.",
+            reason: facts.workItems.length === 0
+                ? "This Task already owns a final-Review obligation; completion must prepare or resume a Review of its frozen Task head."
+                : "All WorkItems are integrated but no valid Task-final Review attests the frozen Task result.",
             refs: [ref("task", task.id)],
-            preconditions: directWithoutWorkItems
+            preconditions: facts.workItems.length === 0
                 ? [{ fact: "Valid established Task-final Review at the direct head", satisfied: false }]
                 : [
                     { fact: "All Work Items are terminal", satisfied: true },
-                    { fact: "Every ChangeSet is committed", satisfied: true },
+                    { fact: "Every governing ChangeSet is settled", satisfied: true },
                     { fact: "Valid Task-final Review at the integrated head", satisfied: false }
                 ],
-            recommendedCommand: directWithoutWorkItems
+            recommendedCommand: facts.workItems.length === 0
                 ? `yui task complete ${task.id} --summary-file -`
                 : `yui task review request ${task.id} --role ${reviewerRole ?? "<reviewer-role>"}`
         });
     }
-    const finalReviewOptional = taskDeliveryPath(task) === "integrated"
-        && !finalReviewRequired
+    const finalReviewOptional = !finalReviewRequired
         && !hasValidFinalReview(facts);
     const finalReviewAlternative = finalReviewOptional && facts.reviewConfig !== null
         ? [{
@@ -461,32 +457,31 @@ export function projectNextAction(facts) {
         : [];
     return buildAction(facts, {
         kind: "complete-task",
-        reason: taskDeliveryPath(task) === "direct"
-            ? "The direct Task head and its established obligations are ready; converge the Task without creating successor work."
-            : "The delivery chain is complete; converge the Task instead of creating successor work.",
+        reason: facts.workItems.length === 0
+            ? "The Leader-owned Task result and its established obligations are ready; complete it without creating successor work."
+            : "Every independent delivery unit is integrated; complete the Task instead of creating successor work.",
         refs: [ref("task", task.id)],
         preconditions: [
             { fact: "All Work Items are terminal", satisfied: true },
             ...(task.projectBindings.length === 0
                 ? []
-                : taskDeliveryPath(task) === "direct"
-                    ? [{
-                            fact: "Valid established Task-final Review at the direct head",
-                            satisfied: hasValidFinalReview(facts)
-                        }]
+                : facts.workItems.length === 0
+                    ? [{ fact: "Task main is clean, committed, and verified", satisfied: false }]
                     : [
-                        { fact: "Every ChangeSet is committed", satisfied: true },
-                        {
-                            fact: "Valid Task-final Review at the integrated head",
-                            satisfied: hasValidFinalReview(facts)
-                        }
+                        { fact: "Every governing ChangeSet is settled", satisfied: true },
+                        ...(finalReviewRequired
+                            ? [{
+                                    fact: "Valid Task-final Review at the integrated head",
+                                    satisfied: hasValidFinalReview(facts)
+                                }]
+                            : [])
                     ])
         ],
         ...(finalReviewAlternative.length === 0 ? {} : { alternatives: finalReviewAlternative }),
         ...(!finalReviewOptional
             ? {}
             : {
-                judgmentRequired: "Leader must decide whether the integrated delivery is safe to complete directly or needs an optional Task-final Review."
+                judgmentRequired: "Leader must decide whether the frozen Task result is safe to complete or needs one optional Task-final Review."
             }),
         recommendedCommand: `yui task complete ${task.id} --summary-file -`
     });
@@ -502,6 +497,7 @@ export function durableStateFingerprint(facts) {
         ...facts.workItems.map((item) => `work:${item.id}:${item.status}:${item.revision}:${item.updatedAt}`),
         ...facts.changeSets.map((changeSet) => `change-set:${changeSet.id}:${changeSet.headCommit}`),
         ...facts.integrations.map((attempt) => `integration:${attempt.id}:${attempt.status}:${attempt.updatedAt}`),
+        ...facts.integrationQueueEntries.map((entry) => `integration-queue:${entry.id}:${entry.status}:${entry.updatedAt}`),
         ...facts.reviewRounds.map((round) => `review:${round.id}:${round.status}:${round.endedAt ?? ""}`),
         ...facts.taskFinalReviewContractEvents.map((event) => `task-final-review-event:${event.id}:${event.createdAt}`)
     ];
@@ -684,10 +680,7 @@ function taskFinalReviewContractResolution(facts) {
     return resolveRecordedTaskFinalReviewContract(facts.task.id, facts.workItems, facts.reviewRounds, facts.taskFinalReviewContractEvents);
 }
 function taskFinalReviewRequired(facts) {
-    return taskFinalReviewContract(facts) !== undefined
-        || latestTaskFinalReview(facts.reviewRounds) !== undefined
-        || (taskDeliveryPath(facts.task) === "integrated"
-            && facts.reviewConfig?.trigger === "final");
+    return taskFinalReviewContract(facts) !== undefined;
 }
 function taskFinalReviewRole(facts) {
     return taskFinalReviewContract(facts)?.reviewerRoleName
@@ -713,18 +706,15 @@ function latestTaskFinalReview(rounds) {
         .reverse()
         .find((round) => (round.scope ?? "work-item") === "task");
 }
-function hasCommittedIntegration(integrations, changeSetId) {
-    return integrations.some((attempt) => attempt.status === "committed" && attempt.changeSetIds.includes(changeSetId));
-}
 function needsChangeSetCapture(facts, item) {
     if (item.status !== "completed")
         return false;
-    if (facts.changeSets.some((changeSet) => changeSet.workItemId === item.id))
+    if (governingChangeSets([item], facts.changeSets).length > 0)
         return false;
     const candidate = item.candidates.at(-1);
     if (candidate === undefined)
         return false;
-    // A metadata-only direct Task-main Candidate has no WorkItem Develop
+    // A metadata-only Task-main Candidate has no WorkItem Develop
     // workspace to capture; its boundary is the Task-main head itself.
     if (candidate.workspace === undefined
         && candidate.gitSnapshot === undefined
@@ -750,7 +740,7 @@ function hasValidFinalReview(facts) {
         .filter((changeSet) => attempt.changeSetIds.includes(changeSet.id))
         .map((changeSet) => changeSet.headCommit)));
     if (integratedHeads.size === 0)
-        return false;
+        return facts.workItems.length === 0;
     for (const head of integratedHeads) {
         if (!reviewedCommits.has(head))
             return false;
@@ -816,6 +806,8 @@ function detectProtocolInconsistency(facts) {
     for (const round of facts.reviewRounds) {
         if (round.status !== "pending" && round.status !== "running")
             continue;
+        if (round.workItemId === undefined)
+            continue;
         const item = workItemById.get(round.workItemId);
         if (item !== undefined && item.status === "retired") {
             return {

package/dist/task/task.js

@@ -2,7 +2,7 @@ import { validateTaskWorkspaceIdentity } from "../repository/taskWorkspaceIdenti
 export function createTask(id, title, now, metadata = {}) {
     const timestamp = now.toISOString();
     return {
-        schemaVersion: 4,
+        schemaVersion: 5,
         id: requireSafeIdentity(id, "Task id"),
         title: requireText(title, "Task title"),
         ...cloneMetadata(metadata),
@@ -141,6 +141,7 @@ export function updateTaskMetadata(task, metadata, now) {
     const updated = { ...task, updatedAt: now.toISOString() };
     if (metadata.title !== undefined)
         updated.title = requireText(metadata.title, "Task title");
+    applyOptional(updated, "type", metadata.type);
     applyOptional(updated, "description", metadata.description);
     applyOptional(updated, "priority", metadata.priority);
     applyOptional(updated, "tags", metadata.tags === undefined || metadata.tags === null
@@ -152,8 +153,6 @@ export function updateTaskMetadata(task, metadata, now) {
     }
     if (metadata.cwd !== undefined)
         updated.cwd = requireText(metadata.cwd, "Task workspace");
-    if (metadata.requireIntegration === true)
-        updated.requireIntegration = true;
     return updated;
 }
 function applyOptional(task, key, value) {
@@ -171,10 +170,12 @@ export function isTaskArchived(task) {
     return task.status === "archived";
 }
 export function validateTask(task) {
-    if (task.schemaVersion !== 4)
-        throw new Error("Task must use schemaVersion 4.");
+    if (task.schemaVersion !== 5)
+        throw new Error("Task must use schemaVersion 5.");
     requireSafeIdentity(task.id, "Task id");
     requireText(task.title, "Task title");
+    if (task.type !== undefined)
+        requireSafeIdentity(task.type, "Task type");
     if (!["draft", "active", "completed", "retired", "archived"].includes(task.status)) {
         throw new Error(`Task status is invalid: ${String(task.status)}.`);
     }
@@ -206,8 +207,10 @@ export function validateTask(task) {
     normalizeProjectBindings(task.projectBindings);
     if (task.cwd !== undefined)
         requireText(task.cwd, "Task workspace");
-    if (task.requireIntegration !== undefined && task.requireIntegration !== true) {
-        throw new Error("Task requireIntegration must be true when present.");
+    if (task.legacyDeliveryPath !== undefined
+        && task.legacyDeliveryPath !== "direct"
+        && task.legacyDeliveryPath !== "integrated") {
+        throw new Error("Task legacy delivery path is invalid.");
     }
     const completionFields = [task.completedAt, task.completedBy, task.completionSummary];
     const hasAnyCompletion = completionFields.some((value) => value !== undefined);
@@ -283,13 +286,13 @@ export function validateTask(task) {
 }
 function cloneMetadata(metadata) {
     const cloned = {
+        ...(metadata.type === undefined ? {} : { type: requireSafeIdentity(metadata.type, "Task type") }),
         ...(metadata.description === undefined ? {} : { description: metadata.description }),
         ...(metadata.priority === undefined ? {} : { priority: metadata.priority }),
         ...(metadata.tags === undefined ? {} : { tags: [...metadata.tags] }),
         ...(metadata.dueAt === undefined ? {} : { dueAt: metadata.dueAt }),
         projectBindings: normalizeProjectBindings(metadata.projectBindings ?? []),
-        ...(metadata.cwd === undefined ? {} : { cwd: requireText(metadata.cwd, "Task workspace") }),
-        ...(metadata.requireIntegration === true ? { requireIntegration: true } : {})
+        ...(metadata.cwd === undefined ? {} : { cwd: requireText(metadata.cwd, "Task workspace") })
     };
     return cloned;
 }
@@ -319,16 +322,6 @@ export function taskProjectBinding(task, projectId) {
 export function taskHasProjects(task) {
     return task.projectBindings.length > 0;
 }
-/**
- * Delivery is a projection of the existing Task contract, not a second source
- * of truth. Keeping it derived preserves every stored Task schema while giving
- * callers one product-level name for the three supported paths.
- */
-export function taskDeliveryPath(task) {
-    if (task.projectBindings.length === 0)
-        return "no-project";
-    return task.requireIntegration === true ? "integrated" : "direct";
-}
 export function taskProjectIds(task) {
     return task.projectBindings.map(({ projectId }) => projectId);
 }

package/dist/web/assets/client/components.js

@@ -577,7 +577,9 @@ export function reviewCard(round, t, locale) {
   card.append(head);
   const meta = node("div", "record-meta");
   meta.append(node("span", "meta-name", round.reviewerRoleName));
-  meta.append(node("span", "mono", round.workItemId + " · " + round.candidateId));
+  if (round.workItemId && round.candidateId) {
+    meta.append(node("span", "mono", round.workItemId + " · " + round.candidateId));
+  }
   if (round.createdAt) meta.append(node("time", "", formatDateTime(round.createdAt, locale)));
   meta.append(node("span", "", t("detail.reviewBase") + " · " + round.reviewBaseCommit));
   if (round.workspace && round.workspace.root) {

package/dist/web/assets/client/i18n.js

@@ -106,6 +106,9 @@ const messages = {
     "detail.writeProjects": "Writable Projects",
     "disposition.abandoned": "Abandoned",
     "disposition.integrated": "Integrated",
+    "disposition.preserved": "Preserved",
+    "disposition.reassigned": "Continued by a newer review",
+    "disposition.removed": "Removed",
     "empty.brief": "No task brief has been recorded.",
     "empty.none": "No items",
     "empty.runs": "No runs yet.",
@@ -406,6 +409,9 @@ const messages = {
     "detail.writeProjects": "可写项目",
     "disposition.abandoned": "已废弃",
     "disposition.integrated": "已集成",
+    "disposition.preserved": "已保留",
+    "disposition.reassigned": "已由后续评审继续使用",
+    "disposition.removed": "已移除",
     "empty.brief": "尚未记录任务简报。",
     "empty.none": "暂无条目",
     "empty.runs": "暂无运行记录。",

package/dist/web/webSnapshot.js

@@ -1,4 +1,3 @@
-import { taskDeliveryPath } from "../task/task.js";
 import { isRoleRunStalled, latestRunDurableProgressAt } from "../scheduler/roleRunStall.js";
 import { buildTaskExecutionProjection } from "../scheduler/taskExecutionProjection.js";
 import { summarizeExecutionGroup } from "../execution/executionGroup.js";
@@ -41,7 +40,6 @@ export function buildWebDashboardSnapshot(store, now = new Date()) {
             });
             return {
                 ...task,
-                deliveryPath: taskDeliveryPath(task),
                 ...(names.length === 0 ? {} : { projectNames: names }),
                 workItems: countWorkItems(reader.listWorkItems(task.id)),
                 roleCount: reader.listRoles(task.id).length,
@@ -110,7 +108,6 @@ export function buildWebTaskDetail(store, taskId, now = new Date()) {
         return {
             task: {
                 ...task,
-                deliveryPath: taskDeliveryPath(task),
                 ...(projectNames.length === 0 ? {} : { projectNames })
             },
             execution: buildTaskExecutionProjection(reader, taskId),

package/i18n/README.zh-CN.md

@@ -106,8 +106,8 @@ yui project add app /absolute/workspace/app \
 yui project update app --alias app-cli --development develop
 yui project list
 
-yui task create "修复 CSV 转义" --project app --delivery direct
-yui task create "交付 CSV 导出" --project app --delivery integrated
+yui task create "修复 CSV 转义" --project app --type bugfix
+yui task create "交付 CSV 导出" --project app --type feature
 yui task update <task-id> --priority high --tags release,csv --due-at 2026-08-01T00:00:00Z
 yui task update <task-id> --clear-priority --clear-tags --clear-due-at
 yui task show <task-id>
@@ -115,15 +115,14 @@ yui task context <task-id>
 yui task activate <task-id>
 ```
 
-Project 交付路径显式分为两类，但仍复用现有 Task schema。`direct` 用于
-Project Policy 允许的单一低风险修复：Leader 直接在干净且已提交的 Task main
-实现、验证并完成，不要求 WorkItem、IntegrationAttempt 或由全局策略自动创建的
-final ReviewRound。`integrated` 用于受保护、跨 Project、迁移、授权、并发/恢复、
-破坏性或发布改动，并要求 WorkItem、ChangeSet 与 committed Integration 证据。
-全局 final-review 策略只自动约束 integrated Task。direct Task 可使用有边界的原生
-review；若需要独立托管的 final Review，必须在 Task main 前进前提升为 integrated。
-一旦已有提交或交付证据，提升会 fail closed，避免早期修改失去 ChangeSet provenance。
-旧的 `--require-integration` 等价于 `--delivery integrated`，且 integrated 不可降级。
+Task type 描述需求意图，不选择执行协议。软件 Project 通常使用 `bugfix` 或
+`feature`：bugfix 由 Leader 在 Task main 独立、快速完成；如果范围扩大到需要
+独立 owner，应先改为 feature 再创建 WorkItem。feature 由 Leader 判断是自己直接
+交付，还是拆成由不同 Worker 独立负责、可并行推进的较大
+WorkItem。实现步骤、测试、review finding 和局部修复都不是 WorkItem。只有当一项
+需求本身具有独立 owner 和可验收结果时才创建 WorkItem。只有当前 governing
+Candidate 的 ChangeSet 是交付义务：它们必须通过 committed Integration 汇总回
+Task main，或由 Leader 在队列中显式 supersede；旧 Candidate 和 ChangeSet 只保留为审计证据。
 
 面向用户的时间默认按北京时间（`Asia/Shanghai`）显示；持久化记录和
 `--json` 数据仍使用 UTC/RFC 3339。可通过以下命令查看或修改 IANA 时区：
@@ -142,9 +141,8 @@ yui config show
 yui config workflow clear review
 ```
 
-对带 Project 的软件交付，可使用 `--trigger final`：WorkItem 验收与
-Integration 保持独立，在 Task 完成前只对所有已集成 Project 的冻结候选做
-一次 Task 级 ReviewRound：
+对带 Project 的软件交付，可使用 `--trigger final` 提供默认 Reviewer Role；
+是否需要独立的 Task-final Review 仍由 Leader 根据风险判断：
 
 ```sh
 yui config workflow set review --role reviewer --trigger final
@@ -161,11 +159,13 @@ AgentRun 不创建新 WorkItem，也不会递归触发审查。审查以自然
 唤醒 Leader；Leader 决定验收、reject 后在原 Role 与原 Session 中修复、
 再次审查，或通过 InputRequest 询问用户。审查失败会保留为可见证据并
 唤醒 Leader，但不会取代 Leader 的最终判断。
-`final` 不为每个 WorkItem 创建完整 ReviewRound；integrated Task 的
-`task complete` 会在每个绑定 Project 都有 committed Integration 后排队一次
-Task 级 Review。direct Task 不会因可变的全局 final 配置自动增加 Review。冻结的集成头
-发生变化时才会重新排队，旧报告仍保留为证据。Reviewer 按 Project Policy/Knowledge
-检查整个 Task，并只报告有直接证据的可达、重要、可行动问题或有限验证缺口。
+`final` 不为每个 WorkItem 创建完整 ReviewRound，也不决定 Task 拓扑。Leader
+显式请求 Task 级 Review；不可变 Task contract 也可以强制要求。Task-final Round
+直接冻结 Task main，不需要虚构 WorkItem/Candidate，因此没有 WorkItem 的小任务也能
+review。冻结头变化时创建新的语义 Round；同一 Reviewer 的兼容原生 Session 可以在
+稳定 workspace 中继续，而每个 Run 仍严格绑定自己的 Round 和冻结头。旧报告保留为
+证据。Reviewer 按 Project Policy/Knowledge 检查整个 Task，并只报告有直接证据的
+可达、重要、可行动问题或有限验证缺口。
 所有候选、ReviewRound 和 Leader 决策都集中在原 WorkItem 下；reject
 后的下一轮会复用原执行 Role、Session 与 workspace，并追加新候选。
 
@@ -476,6 +476,7 @@ Task Role 使用以下显式入口：
 
 ```sh
 yui session enter <global-role>
+yui session stop --all
 yui task role view <task-id> <role>
 yui task role takeover <task-id> <role>
 yui task role release <task-id> <role>
@@ -483,12 +484,20 @@ yui task role release <task-id> <role>
 
 `view` 始终只读。`takeover` 要求存在 active managed Run 且没有未决 Turn；它先以持久 CAS 把唯一 writer authority 转给人工 holder，再把相同 epoch 同步给 Agent Host，最后开放 PTY 输入网关。人工输入仍由 Host 转换为结构化 Provider Turn，而不是直接注入 Provider 终端。detach 会自动归还 authority；`release` 即使没有 active Run 也可执行，用于幂等修复中断或未完全同步的接管。Global Operator 与 global Role 继续使用原生交互式 CLI，不属于受管理 Task Provider 协议。
 
+当新版本需要离线迁移 Home 时，应等待当前 Turn/Run 完成，然后从普通 shell
+执行 `yui session stop --all`，再重新执行 `yui update`。停止命令会先整体预检：
+只要仍有 Session 正在运行或存在未决生命周期工作，就不会开始停止；全部空闲
+时会先阻止新的 Leader 调度，停止并等待 Controller 完全退出，重新检查运行时
+事实后再停止 Task Role 和 global Role Session。成功后 Controller 保持停止，
+应紧接着执行 `yui update`。如果当前安装版本还没有这条命令，应手动退出提示中
+列出的全部 managed Session；新的 staged CLI 不能写入尚待迁移的旧 Home。
+
 tmux 会在 pane 创建时固定其历史容量。配置该限制之前创建的 Role 会保留原容量；Yui 会在 Terminal attach 和 Web 中提示用户退出并重新进入一次，从而创建具有 100,000 行历史的新 pane。
 
-每个 Role 可绑定多个 Agent，但任一时刻只有一个 active Agent，并为每个
-Agent binding 独立保存 native session。Operator 进一步限制为同一种
-adapter 最多绑定一个，例如可同时绑定一个 Codex 和一个 Claude；这些
-binding 是预先保存、可随时切换的配置，而不是并行身份。Operator 可为
+每个 Role（包括 Operator）可绑定多个 Agent，但任一时刻只有一个 active Agent，
+并为每个 Agent binding 独立保存 native session。同一种 adapter 可以有多个
+binding，用于不同账号、模型、profile 或环境来源；这些 binding 是预先保存、
+可随时切换的配置，而不是并行 writer。Operator 可为
 每个 binding 保留多条历史对话。`operator new` 与 `operator resume`
 复用唯一的 Operator tmux pane；存在运行中进程时，Yui 会先确认再停止
 并切换。跨 Agent 切换默认复用已保存的 model/effort，只有用户明确选择
@@ -509,7 +518,7 @@ state、receipt 与 pane fence。Yui 不会解析 prompt glyph、进度文本、
 或其他 Agent 终端输出来推断 ready 或 success。`captureRole()` 只用于显式的人类
 transcript 查看，不具备生命周期权威。
 
-稳定的 Role 上下文也属于启动元数据，而不是 bootstrap turn。Yui 通过 Agent 原生的 system/developer instruction 通道传入 Role 策略和 `systemPrompt`。Task execution Run 按角色接收通用 Leader 或 Worker Skill，review Run 则按持久 Run purpose 接收通用 Reviewer Skill；这些都只是 Yui 自己拥有的可移植编排规则。Project Skills 始终是 Project 中正常版本化的文件，由 Agent 通过自身项目机制发现、选择并按需加载；Yui 不扫描、不解析、不复制，也不注入 Project Skills。Codex developer instructions 只携带 Yui 自有 Role Skill 的精简绝对路径。由于 `developer_instructions` 是单一标量配置，Yui 会检查当前支持的全部 Linux Codex 配置层：`/etc/codex/config.toml`、用户配置、选中的 `$CODEX_HOME/<name>.config.toml`、项目配置以及 `/etc/codex/managed_config.toml`；任意一层已经设置该值时都会明确拒绝覆盖。受管理的 Codex 会话还必须独占用于记录原生 Turn 完成状态的结构化 `notify` 回调；任意受检配置层已经定义 `notify` 时，Yui 都会拒绝启动，避免两个回调互相静默覆盖。`skills.config` 只负责启停已发现 Skill，Yui 不会误用它。Claude 从 Yui 管理的私有 `0600` context 文件读取同一份 Yui Role Skill 内容，不再把大段或敏感文本放进 argv；重试和 resume 会复用按 purpose 区分的稳定路径。非 Operator 的 global Role 保持中性，不会注入 Task 编排 Skill。因此 Operator 会停在空白的原生 composer，用户输入仍是第一条 user message；Leader wake、Worker 和 Reviewer Run assignment 仍是邮箱投递的真实工作消息。不具备原生指令通道的 adapter 必须拒绝这类上下文，不能静默降级为首轮 user prompt。
+稳定的 Role 上下文也属于启动元数据，而不是 bootstrap turn。Yui 通过 Agent 原生的 system/developer instruction 通道传入 Role 策略和 `systemPrompt`。Task execution Run 按角色接收通用 Leader 或 Worker Skill，review Run 则按持久 Run purpose 接收通用 Reviewer Skill；这些都只是 Yui 自己拥有的可移植编排规则。Project Skills 始终是 Project 中正常版本化的文件，由 Agent 通过自身项目机制发现、选择并按需加载；Yui 不扫描、不解析、不复制，也不注入 Project Skills。Codex developer instructions 只携带 Yui 自有 Role Skill 的精简绝对路径，并作为本次 invocation 的覆盖值传入；已有的用户、profile、Project 和 system 配置不会使 Session 拒绝启动，Yui 也不会修改原配置文件。优先级高于 invocation 的 managed `developer_instructions` 仍会成为边界明确的启动阻塞，因为 Codex 不允许本次启动参数覆盖它。交互式 Codex Session 的结构化 `notify` 遵循同一规则：Doctor 会把普通覆盖来源作为上下文报告，并拒绝最终生效的 managed 冲突；Managed Run 不占用 `notify`，只使用 Agent Driver Hook。`skills.config` 只负责启停已发现 Skill，Yui 不会误用它。Claude 从 Yui 管理的私有 `0600` context 文件读取同一份 Yui Role Skill 内容，不再把大段或敏感文本放进 argv；重试和 resume 会复用按 purpose 区分的稳定路径。非 Operator 的 global Role 保持中性，不会注入 Task 编排 Skill。因此 Operator 会停在空白的原生 composer，用户输入仍是第一条 user message；Leader wake、Worker 和 Reviewer Run assignment 仍是邮箱投递的真实工作消息。不具备原生指令通道的 adapter 必须拒绝这类上下文，不能静默降级为首轮 user prompt。
 
 ## Controller 与失败处理
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.8.9",
+  "version": "0.10.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,