@zq-silk/yui 0.9.0 → 0.10.1

package/dist/runtime/tmuxAdapters.js

@@ -281,11 +281,14 @@ export class TmuxSessionHost {
             return binding;
         }
         const broker = launchBrokerForHome(yuiHome);
+        const sessionManifest = planned.launch.env.YUI_SESSION_MANIFEST;
         const frozenControlPlane = planned.launch.env[YUI_CONTROL_PLANE_DESCRIPTOR];
         const frozenTaskRuntime = planned.launch.env[YUI_TASK_RUNTIME_DESCRIPTOR];
         if (request.owner.scope === "task" && request.runId !== undefined
-            && (frozenControlPlane === undefined || frozenTaskRuntime === undefined)) {
-            throw new Error("Managed Task Agent Host launch is missing its frozen control descriptors.");
+            && (sessionManifest === undefined
+                || frozenControlPlane === undefined
+                || frozenTaskRuntime === undefined)) {
+            throw new Error("Managed Task Agent Host launch is missing its Session Manifest or frozen control descriptors.");
         }
         const reservation = broker.reserve(Object.freeze({
             schemaVersion: 1,
@@ -324,6 +327,9 @@ export class TmuxSessionHost {
                 ...(planned.launch.env.YUI_WORKSPACE === undefined
                     ? {}
                     : { YUI_WORKSPACE: planned.launch.env.YUI_WORKSPACE }),
+                ...(sessionManifest === undefined
+                    ? {}
+                    : { YUI_SESSION_MANIFEST: sessionManifest }),
                 ...(frozenControlPlane === undefined
                     ? {}
                     : { [YUI_CONTROL_PLANE_DESCRIPTOR]: frozenControlPlane }),

package/dist/scheduler/leaderWakeupProcessor.js

@@ -9,7 +9,6 @@ import { recordLeaderFailure } from "./leaderFailure.js";
 import { createLeaderRecoveryNotification } from "./operatorNotification.js";
 import { isSchedulerTaskWorkspaceReady } from "./ports.js";
 import { RuntimeLaunchError } from "../runtime/ports.js";
-import { projectFirstProgressStopLoss } from "../runtime/firstProgressStopLoss.js";
 export async function processLeaderWakeups(store, delivery, now, selection) {
     const results = [];
     const wakeups = selection === undefined || selection.full
@@ -128,30 +127,6 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
                 && existingSession.status !== "stopped"
                 && existingSession.status !== "broken";
             const mode = resumableSession && compatibleSession ? "resume" : "new";
-            if (mode === "new" && store.getTaskRoleSessionSet !== undefined) {
-                const stopLoss = projectFirstProgressStopLoss({
-                    sessions: store.getTaskRoleSessionSet(task.id, role.name),
-                    events: store.listEvents?.(task.id) ?? [],
-                    workItems: store.listWorkItems?.(task.id) ?? [],
-                    reviewRounds: store.listReviewRounds?.(task.id) ?? [],
-                    integrations: store.listIntegrationAttempts?.(task.id) ?? []
-                });
-                if (stopLoss.exhausted && store.saveLeaderFirstProgressStopLoss !== undefined) {
-                    const saved = store.saveLeaderFirstProgressStopLoss({
-                        taskId: task.id,
-                        roleName: role.name,
-                        expectedFingerprint: stopLoss.fingerprint,
-                        now
-                    });
-                    results.push({
-                        taskId: task.id,
-                        status: "skipped",
-                        reason: saved === "recorded" ? "recovery-blocked" : "state-changed",
-                        error: saved === "recorded" ? stopLoss.reason : undefined
-                    });
-                    continue;
-                }
-            }
             const runId = store.peekNextAgentRunId(task.id);
             const wakeEnvelope = resolveLeaderWakeEnvelope(store, task.id);
             const contextSnapshot = store.freezeLeaderContextSnapshot?.(task.id, role.name, now);

package/dist/setup/setupCommand.js

@@ -176,11 +176,6 @@ function saveMinimumConfiguration(store, agent, workspace, usableAgentIds) {
             scope: "global",
             roleName: SYSTEM_OPERATOR_ROLE
         }, "desired Agent binding update");
-        const duplicateAdapter = Object.values(operator.agentBindings).find((candidate) => candidate.adapterId === agent.adapterId && candidate.agentId !== agent.id);
-        if (duplicateAdapter !== undefined) {
-            throw usageError(`Operator already has a ${agent.adapterId} Agent: ${duplicateAdapter.agentId}. `
-                + "Use yui config agent update or yui config role bind to repair the Operator configuration.");
-        }
         tx.saveGlobalRole(updateGlobalRole(operator, {
             activeAgentId: agent.id,
             agentBindings: { ...operator.agentBindings, [agent.id]: binding }

package/dist/storage/sqliteStore.js

@@ -727,6 +727,7 @@ export class SqliteTaskStore {
             workItems: this.#sortById(this.#listPayload("work_items", "task_id = ?", [taskId]), (item) => item.id),
             changeSets: this.#sortById(this.#listPayload("change_sets", "task_id = ?", [taskId]), (changeSet) => changeSet.id),
             integrations: this.#sortById(this.#listPayload("integration_attempts", "task_id = ?", [taskId]), (attempt) => attempt.id),
+            integrationQueueEntries: this.#sortById(this.#listPayload("integration_queue", "task_id = ?", [taskId]), (entry) => entry.id),
             reviewRounds: this.#sortById(this.#listPayload("review_rounds", "task_id = ?", [taskId]), (round) => round.id),
             taskFinalReviewContractEvents: events
                 .filter((event) => event.type === TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT),

package/dist/storage/taskStore.js

@@ -422,6 +422,7 @@ export class FileTaskStore {
             workItems: values(aggregate.workItems, "id"),
             changeSets: values(aggregate.changeSets, "id"),
             integrations: values(aggregate.integrationAttempts, "id"),
+            integrationQueueEntries: values(aggregate.integrationQueue, "id"),
             reviewRounds: values(aggregate.reviewRounds, "id"),
             taskFinalReviewContractEvents: events
                 .filter((event) => event.type === TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT),

package/dist/storage/upgrade/upgradeOrchestrator.js

@@ -298,7 +298,7 @@ function describeOfflineBlockers(inventory) {
         return `${index + 1}. ${identity.length === 0 ? "identity=unknown" : identity} ` +
             `reason=${reason}`;
     });
-    return `Offline migration blocked by ${inventory.total} active runtime item(s). ` +
+    return `Offline Home migration cannot start while ${inventory.total} runtime obligation(s) remain. ` +
         lines.join("; ");
 }
 async function readOfflineInventory(options, home) {
@@ -315,15 +315,43 @@ async function readOfflineInventory(options, home) {
 }
 function offlineInventoryBlocker(inventory, sceneUnchanged) {
     const lifecycleOnly = inventory.blockers.every(({ reason }) => (reason === "pending-mailbox" || reason === "pending-inbox"));
+    const runtimeUnknown = inventory.blockers.some(({ reason }) => (reason === "native-session-unknown"));
+    const action = lifecycleOnly
+        ? (sceneUnchanged
+            ? "No binary, Controller, fence, or Home change was made. Wait for the listed lifecycle "
+                + "events to settle, then re-run `yui update`."
+            : "The Home was not switched. Wait for the listed lifecycle events to settle, then "
+                + "re-run `yui update`.")
+        : runtimeUnknown
+            ? (sceneUnchanged
+                ? "Offline Home migration could not confirm that every native Session is stopped. Run "
+                    + "`yui controller status --verbose` from a normal shell and inspect the reported "
+                    + "runtime ownership. Use `yui controller cleanup` only for resources it classifies "
+                    + "for cleanup, then re-run `yui update`; do not kill unknown processes blindly. No "
+                    + "binary, Controller, fence, or Home change was made."
+                : "The Home was not switched because native Session state could not be confirmed. Run "
+                    + "`yui controller status --verbose`, inspect the reported ownership, and use "
+                    + "`yui controller cleanup` only for resources it classifies for cleanup before "
+                    + "retrying; do not kill unknown processes blindly.")
+            : (sceneUnchanged
+                ? "This version requires an offline Home migration with every managed Agent Session "
+                    + "stopped. Let the listed Turns or Runs finish. If the installed `yui` supports "
+                    + "`session stop --all`, run `yui session stop --all` from a normal shell; otherwise "
+                    + "exit every listed managed Session manually. Then re-run `yui update`. No binary, "
+                    + "Controller, fence, or Home change was made."
+                : "The Home was not switched. Let the listed Turns or Runs finish. If the installed "
+                    + "`yui` supports `session stop --all`, run `yui session stop --all` from a normal "
+                    + "shell; otherwise exit every listed managed Session manually. Then re-run "
+                    + "`yui update`.");
     return {
         outcome: "blocked",
-        stage: lifecycleOnly ? "drain-incomplete" : "active-sessions",
+        stage: lifecycleOnly
+            ? "drain-incomplete"
+            : runtimeUnknown
+                ? "runtime-unknown"
+                : "active-sessions",
         message: describeOfflineBlockers(inventory),
-        action: sceneUnchanged
-            ? "No binary, Controller, fence, or Home change was made. Keep working; when every " +
-                "listed runtime obligation is clear, re-run `yui update` so preflight is repeated."
-            : "The Home was not switched. Let every listed runtime obligation settle, then re-run " +
-                "`yui update`; do not kill, reset, rebind, or retry the blocked runtime blindly.",
+        action,
         blockers: inventory.blockers,
         retryCommand: "yui update",
         ...(sceneUnchanged ? { sceneUnchanged: true } : {})

package/dist/task/completionReadiness.js

@@ -1,7 +1,9 @@
+import { changeSetDeliverySettled, governingChangeSets, integrationAttemptRequiresSettlement, latestGoverningQueueEntries } from "../integration/deliveryObligation.js";
 import { isReviewFindingBlocking } from "../review/reviewFinding.js";
 import { deltaRecheckBlocksAcceptance } from "../review/reviewRound.js";
 import { isSemanticReviewRound } from "../review/reviewOutcomeClassifier.js";
 import { reviewFindingLedgerWriteFailedFromEvents } from "../review/reviewFindingLedger.js";
+import { resolveRecordedTaskFinalReviewContract } from "../review/taskFinalReviewContractRebind.js";
 import { blockingProviderContinuations } from "../runtime/runtimeContinuationProjection.js";
 const ACTIVE_JOB_STATUSES = new Set([
     "queued",
@@ -20,6 +22,7 @@ export function projectCompletionReadiness(facts, options = {}) {
     const advisories = [];
     const { task } = facts;
     const findingsGate = options.findingsGate ?? true;
+    const taskFinalReviewRequired = resolveRecordedTaskFinalReviewContract(task.id, facts.workItems, facts.reviewRounds, facts.taskFinalReviewContractEvents) !== undefined;
     // A pending/running Task-final Review must be resumed or blocked first.
     for (const round of facts.reviewRounds) {
         if ((round.scope ?? "work-item") !== "task")
@@ -49,7 +52,8 @@ export function projectCompletionReadiness(facts, options = {}) {
         .sort((left, right) => (left.createdAt.localeCompare(right.createdAt)
         || left.id.localeCompare(right.id, undefined, { numeric: true })))
         .at(-1);
-    if (latestCompletedTaskReview !== undefined
+    if (taskFinalReviewRequired
+        && latestCompletedTaskReview !== undefined
         && deltaRecheckBlocksAcceptance(latestCompletedTaskReview)) {
         const round = latestCompletedTaskReview;
         const disposition = round.deltaRecheck.disposition;
@@ -97,9 +101,10 @@ export function projectCompletionReadiness(facts, options = {}) {
             fix: `wait for DurableJob ${job.id} to finish, or cancel it`
         });
     }
-    // Integration obligations are derived from real independent delivery units.
-    // A Leader-owned Task needs no synthetic WorkItem; once a WorkItem produces a
-    // Git Candidate, that exact unit must be captured and integrated.
+    // Integration obligations follow only the Candidate that currently governs
+    // each independent delivery unit. Superseded Candidate history remains
+    // visible without keeping the Task open forever.
+    const deliveryChangeSets = governingChangeSets(facts.workItems, facts.changeSets);
     for (const item of facts.workItems) {
         if (item.status !== "completed")
             continue;
@@ -107,7 +112,7 @@ export function projectCompletionReadiness(facts, options = {}) {
         const hasGitDelivery = candidate?.workspace !== undefined
             || candidate?.gitSnapshot !== undefined;
         if (hasGitDelivery
-            && !facts.changeSets.some((changeSet) => changeSet.workItemId === item.id)) {
+            && !deliveryChangeSets.some((changeSet) => changeSet.workItemId === item.id)) {
             blockers.push({
                 code: "integration-evidence-missing",
                 ref: ref("work-item", item.id),
@@ -116,8 +121,8 @@ export function projectCompletionReadiness(facts, options = {}) {
             });
         }
     }
-    for (const changeSet of facts.changeSets) {
-        if (facts.integrations.some((attempt) => (attempt.status === "committed" && attempt.changeSetIds.includes(changeSet.id))))
+    for (const changeSet of deliveryChangeSets) {
+        if (changeSetDeliverySettled(changeSet, facts.integrations, facts.integrationQueueEntries))
             continue;
         blockers.push({
             code: "integration-evidence-missing",
@@ -126,10 +131,13 @@ export function projectCompletionReadiness(facts, options = {}) {
             fix: `yui task integration start ${task.id} --project ${changeSet.projectId} --change-set ${changeSet.id}`
         });
     }
-    // Unresolved Integration Attempts must settle.
+    // Current delivery Attempts and any Attempt that may still be writing must
+    // settle. Historical blocked Attempts remain audit evidence only.
     for (const integration of facts.integrations) {
         if (!UNRESOLVED_INTEGRATION_STATUSES.has(integration.status))
             continue;
+        if (!integrationAttemptRequiresSettlement(integration, deliveryChangeSets))
+            continue;
         blockers.push({
             code: "unresolved-integration",
             ref: ref("integration-attempt", integration.id),
@@ -138,7 +146,7 @@ export function projectCompletionReadiness(facts, options = {}) {
         });
     }
     // Unsettled integration queue entries must commit or be superseded.
-    for (const entry of facts.integrationQueueEntries) {
+    for (const entry of latestGoverningQueueEntries(deliveryChangeSets, facts.integrationQueueEntries)) {
         if (entry.status === "committed" || entry.status === "superseded")
             continue;
         blockers.push({

package/dist/task/nextAction.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { changeSetDeliverySettled, governingChangeSets } from "../integration/deliveryObligation.js";
 import { deltaRecheckBlocksAcceptance } from "../review/reviewRound.js";
 import { classifyReviewRoundOutcome, isSemanticReviewRound } from "../review/reviewOutcomeClassifier.js";
 import { resolveRecordedTaskFinalReviewContract } from "../review/taskFinalReviewContractRebind.js";
@@ -253,7 +254,10 @@ export function projectNextAction(facts) {
             judgmentRequired: "Leader must choose the execution path: direct execution, a native subagent, or managed Task Role dispatch."
         });
     }
-    if (facts.workItems.length === 0 && !taskFinalReviewRequired(facts)) {
+    if (facts.workItems.length === 0
+        && !taskFinalReviewRequired(facts)
+        && !facts.reviewRounds.some((round) => ((round.scope ?? "work-item") === "task"
+            && (round.status === "pending" || round.status === "running")))) {
         const reviewAlternative = facts.reviewConfig === null
             ? []
             : [{
@@ -296,8 +300,8 @@ export function projectNextAction(facts) {
             recommendedCommand: `yui task work capture ${task.id}/${uncaptured.id}`
         });
     }
-    const unintegrated = facts.changeSets
-        .find((changeSet) => !hasCommittedIntegration(facts.integrations, changeSet.id));
+    const unintegrated = governingChangeSets(facts.workItems, facts.changeSets)
+        .find((changeSet) => !changeSetDeliverySettled(changeSet, facts.integrations, facts.integrationQueueEntries));
     if (unintegrated !== undefined) {
         return buildAction(facts, {
             kind: "integrate-change-set",
@@ -310,11 +314,13 @@ export function projectNextAction(facts) {
             recommendedCommand: `yui task integration start ${task.id} --project ${unintegrated.projectId} --change-set ${unintegrated.id}`
         });
     }
+    const finalReviewRequired = taskFinalReviewRequired(facts);
     const failedFinal = latestTaskFinalReview(facts.reviewRounds);
     const failedFinalOutcome = failedFinal === undefined
         ? null
         : classifyReviewRoundOutcome(failedFinal, nextActionReviewOutcomeEvidence(facts));
-    if (failedFinal !== undefined && failedFinalOutcome?.kind === "non-semantic") {
+    if (finalReviewRequired
+        && failedFinal !== undefined && failedFinalOutcome?.kind === "non-semantic") {
         return buildAction(facts, {
             kind: "resume-review",
             reason: `Task-final Review ${failedFinal.id} ended before a semantic review was proven.`,
@@ -325,7 +331,8 @@ export function projectNextAction(facts) {
             recommendedCommand: `yui task review force-fresh ${task.id}/${failedFinal.id}`
         });
     }
-    if (failedFinal !== undefined && failedFinalOutcome?.kind === "ambiguous") {
+    if (finalReviewRequired
+        && failedFinal !== undefined && failedFinalOutcome?.kind === "ambiguous") {
         return buildAction(facts, {
             kind: "repair-protocol-inconsistency",
             reason: `Task-final Review ${failedFinal.id} has ambiguous semantic and infrastructure evidence: ${failedFinalOutcome.reason}`,
@@ -336,7 +343,8 @@ export function projectNextAction(facts) {
             ]
         });
     }
-    if (failedFinal !== undefined
+    if (finalReviewRequired
+        && failedFinal !== undefined
         && failedFinalOutcome?.kind === "semantic"
         && ((failedFinal.checks ?? []).some(({ outcome }) => outcome === "failed")
             || deltaRecheckBlocksAcceptance(failedFinal))) {
@@ -415,7 +423,6 @@ export function projectNextAction(facts) {
             recommendedCommand: `yui task review retry ${task.id}/${activeFinal.id}`
         });
     }
-    const finalReviewRequired = taskFinalReviewRequired(facts);
     if (task.projectBindings.length > 0
         && finalReviewRequired
         && !hasValidFinalReview(facts)) {
@@ -430,7 +437,7 @@ export function projectNextAction(facts) {
                 ? [{ fact: "Valid established Task-final Review at the direct head", satisfied: false }]
                 : [
                     { fact: "All Work Items are terminal", satisfied: true },
-                    { fact: "Every ChangeSet is committed", satisfied: true },
+                    { fact: "Every governing ChangeSet is settled", satisfied: true },
                     { fact: "Valid Task-final Review at the integrated head", satisfied: false }
                 ],
             recommendedCommand: facts.workItems.length === 0
@@ -461,11 +468,13 @@ export function projectNextAction(facts) {
                 : facts.workItems.length === 0
                     ? [{ fact: "Task main is clean, committed, and verified", satisfied: false }]
                     : [
-                        { fact: "Every ChangeSet is committed", satisfied: true },
-                        {
-                            fact: "Valid Task-final Review at the integrated head",
-                            satisfied: hasValidFinalReview(facts)
-                        }
+                        { fact: "Every governing ChangeSet is settled", satisfied: true },
+                        ...(finalReviewRequired
+                            ? [{
+                                    fact: "Valid Task-final Review at the integrated head",
+                                    satisfied: hasValidFinalReview(facts)
+                                }]
+                            : [])
                     ])
         ],
         ...(finalReviewAlternative.length === 0 ? {} : { alternatives: finalReviewAlternative }),
@@ -488,6 +497,7 @@ export function durableStateFingerprint(facts) {
         ...facts.workItems.map((item) => `work:${item.id}:${item.status}:${item.revision}:${item.updatedAt}`),
         ...facts.changeSets.map((changeSet) => `change-set:${changeSet.id}:${changeSet.headCommit}`),
         ...facts.integrations.map((attempt) => `integration:${attempt.id}:${attempt.status}:${attempt.updatedAt}`),
+        ...facts.integrationQueueEntries.map((entry) => `integration-queue:${entry.id}:${entry.status}:${entry.updatedAt}`),
         ...facts.reviewRounds.map((round) => `review:${round.id}:${round.status}:${round.endedAt ?? ""}`),
         ...facts.taskFinalReviewContractEvents.map((event) => `task-final-review-event:${event.id}:${event.createdAt}`)
     ];
@@ -670,8 +680,7 @@ function taskFinalReviewContractResolution(facts) {
     return resolveRecordedTaskFinalReviewContract(facts.task.id, facts.workItems, facts.reviewRounds, facts.taskFinalReviewContractEvents);
 }
 function taskFinalReviewRequired(facts) {
-    return taskFinalReviewContract(facts) !== undefined
-        || latestTaskFinalReview(facts.reviewRounds) !== undefined;
+    return taskFinalReviewContract(facts) !== undefined;
 }
 function taskFinalReviewRole(facts) {
     return taskFinalReviewContract(facts)?.reviewerRoleName
@@ -697,13 +706,10 @@ function latestTaskFinalReview(rounds) {
         .reverse()
         .find((round) => (round.scope ?? "work-item") === "task");
 }
-function hasCommittedIntegration(integrations, changeSetId) {
-    return integrations.some((attempt) => attempt.status === "committed" && attempt.changeSetIds.includes(changeSetId));
-}
 function needsChangeSetCapture(facts, item) {
     if (item.status !== "completed")
         return false;
-    if (facts.changeSets.some((changeSet) => changeSet.workItemId === item.id))
+    if (governingChangeSets([item], facts.changeSets).length > 0)
         return false;
     const candidate = item.candidates.at(-1);
     if (candidate === undefined)

package/i18n/README.zh-CN.md

@@ -120,8 +120,9 @@ Task type 描述需求意图，不选择执行协议。软件 Project 通常使
 独立 owner，应先改为 feature 再创建 WorkItem。feature 由 Leader 判断是自己直接
 交付，还是拆成由不同 Worker 独立负责、可并行推进的较大
 WorkItem。实现步骤、测试、review finding 和局部修复都不是 WorkItem。只有当一项
-需求本身具有独立 owner 和可验收结果时才创建 WorkItem；一旦 WorkItem 产生 Git
-结果，就必须通过 ChangeSet 和 committed Integration 汇总回 Leader 的 Task main。
+需求本身具有独立 owner 和可验收结果时才创建 WorkItem。只有当前 governing
+Candidate 的 ChangeSet 是交付义务：它们必须通过 committed Integration 汇总回
+Task main，或由 Leader 在队列中显式 supersede；旧 Candidate 和 ChangeSet 只保留为审计证据。
 
 面向用户的时间默认按北京时间（`Asia/Shanghai`）显示；持久化记录和
 `--json` 数据仍使用 UTC/RFC 3339。可通过以下命令查看或修改 IANA 时区：
@@ -475,6 +476,7 @@ Task Role 使用以下显式入口：
 
 ```sh
 yui session enter <global-role>
+yui session stop --all
 yui task role view <task-id> <role>
 yui task role takeover <task-id> <role>
 yui task role release <task-id> <role>
@@ -482,12 +484,20 @@ yui task role release <task-id> <role>
 
 `view` 始终只读。`takeover` 要求存在 active managed Run 且没有未决 Turn；它先以持久 CAS 把唯一 writer authority 转给人工 holder，再把相同 epoch 同步给 Agent Host，最后开放 PTY 输入网关。人工输入仍由 Host 转换为结构化 Provider Turn，而不是直接注入 Provider 终端。detach 会自动归还 authority；`release` 即使没有 active Run 也可执行，用于幂等修复中断或未完全同步的接管。Global Operator 与 global Role 继续使用原生交互式 CLI，不属于受管理 Task Provider 协议。
 
+当新版本需要离线迁移 Home 时，应等待当前 Turn/Run 完成，然后从普通 shell
+执行 `yui session stop --all`，再重新执行 `yui update`。停止命令会先整体预检：
+只要仍有 Session 正在运行或存在未决生命周期工作，就不会开始停止；全部空闲
+时会先阻止新的 Leader 调度，停止并等待 Controller 完全退出，重新检查运行时
+事实后再停止 Task Role 和 global Role Session。成功后 Controller 保持停止，
+应紧接着执行 `yui update`。如果当前安装版本还没有这条命令，应手动退出提示中
+列出的全部 managed Session；新的 staged CLI 不能写入尚待迁移的旧 Home。
+
 tmux 会在 pane 创建时固定其历史容量。配置该限制之前创建的 Role 会保留原容量；Yui 会在 Terminal attach 和 Web 中提示用户退出并重新进入一次，从而创建具有 100,000 行历史的新 pane。
 
-每个 Role 可绑定多个 Agent，但任一时刻只有一个 active Agent，并为每个
-Agent binding 独立保存 native session。Operator 进一步限制为同一种
-adapter 最多绑定一个，例如可同时绑定一个 Codex 和一个 Claude；这些
-binding 是预先保存、可随时切换的配置，而不是并行身份。Operator 可为
+每个 Role（包括 Operator）可绑定多个 Agent，但任一时刻只有一个 active Agent，
+并为每个 Agent binding 独立保存 native session。同一种 adapter 可以有多个
+binding，用于不同账号、模型、profile 或环境来源；这些 binding 是预先保存、
+可随时切换的配置，而不是并行 writer。Operator 可为
 每个 binding 保留多条历史对话。`operator new` 与 `operator resume`
 复用唯一的 Operator tmux pane；存在运行中进程时，Yui 会先确认再停止
 并切换。跨 Agent 切换默认复用已保存的 model/effort，只有用户明确选择
@@ -508,7 +518,7 @@ state、receipt 与 pane fence。Yui 不会解析 prompt glyph、进度文本、
 或其他 Agent 终端输出来推断 ready 或 success。`captureRole()` 只用于显式的人类
 transcript 查看，不具备生命周期权威。
 
-稳定的 Role 上下文也属于启动元数据，而不是 bootstrap turn。Yui 通过 Agent 原生的 system/developer instruction 通道传入 Role 策略和 `systemPrompt`。Task execution Run 按角色接收通用 Leader 或 Worker Skill，review Run 则按持久 Run purpose 接收通用 Reviewer Skill；这些都只是 Yui 自己拥有的可移植编排规则。Project Skills 始终是 Project 中正常版本化的文件，由 Agent 通过自身项目机制发现、选择并按需加载；Yui 不扫描、不解析、不复制，也不注入 Project Skills。Codex developer instructions 只携带 Yui 自有 Role Skill 的精简绝对路径。由于 `developer_instructions` 是单一标量配置，Yui 会检查当前支持的全部 Linux Codex 配置层：`/etc/codex/config.toml`、用户配置、选中的 `$CODEX_HOME/<name>.config.toml`、项目配置以及 `/etc/codex/managed_config.toml`；任意一层已经设置该值时都会明确拒绝覆盖。受管理的 Codex 会话还必须独占用于记录原生 Turn 完成状态的结构化 `notify` 回调；任意受检配置层已经定义 `notify` 时，Yui 都会拒绝启动，避免两个回调互相静默覆盖。`skills.config` 只负责启停已发现 Skill，Yui 不会误用它。Claude 从 Yui 管理的私有 `0600` context 文件读取同一份 Yui Role Skill 内容，不再把大段或敏感文本放进 argv；重试和 resume 会复用按 purpose 区分的稳定路径。非 Operator 的 global Role 保持中性，不会注入 Task 编排 Skill。因此 Operator 会停在空白的原生 composer，用户输入仍是第一条 user message；Leader wake、Worker 和 Reviewer Run assignment 仍是邮箱投递的真实工作消息。不具备原生指令通道的 adapter 必须拒绝这类上下文，不能静默降级为首轮 user prompt。
+稳定的 Role 上下文也属于启动元数据，而不是 bootstrap turn。Yui 通过 Agent 原生的 system/developer instruction 通道传入 Role 策略和 `systemPrompt`。Task execution Run 按角色接收通用 Leader 或 Worker Skill，review Run 则按持久 Run purpose 接收通用 Reviewer Skill；这些都只是 Yui 自己拥有的可移植编排规则。Project Skills 始终是 Project 中正常版本化的文件，由 Agent 通过自身项目机制发现、选择并按需加载；Yui 不扫描、不解析、不复制，也不注入 Project Skills。Codex developer instructions 只携带 Yui 自有 Role Skill 的精简绝对路径，并作为本次 invocation 的覆盖值传入；已有的用户、profile、Project 和 system 配置不会使 Session 拒绝启动，Yui 也不会修改原配置文件。优先级高于 invocation 的 managed `developer_instructions` 仍会成为边界明确的启动阻塞，因为 Codex 不允许本次启动参数覆盖它。交互式 Codex Session 的结构化 `notify` 遵循同一规则：Doctor 会把普通覆盖来源作为上下文报告，并拒绝最终生效的 managed 冲突；Managed Run 不占用 `notify`，只使用 Agent Driver Hook。`skills.config` 只负责启停已发现 Skill，Yui 不会误用它。Claude 从 Yui 管理的私有 `0600` context 文件读取同一份 Yui Role Skill 内容，不再把大段或敏感文本放进 argv；重试和 resume 会复用按 purpose 区分的稳定路径。非 Operator 的 global Role 保持中性，不会注入 Task 编排 Skill。因此 Operator 会停在空白的原生 composer，用户输入仍是第一条 user message；Leader wake、Worker 和 Reviewer Run assignment 仍是邮箱投递的真实工作消息。不具备原生指令通道的 adapter 必须拒绝这类上下文，不能静默降级为首轮 user prompt。
 
 ## Controller 与失败处理
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -115,15 +115,14 @@ children through adapter metadata, and routes a later result reference through
 the durable inbox. Do not poll, send a waiting Message, rewrite a checkpoint,
 or yield merely to preserve that native wait.
 
-Before the first durable Leader action, Yui permits at most one automatic
-same-Session Provider continuation. If two fresh Leader generations still
-produce no WorkItem, Review, Integration, or Leader-attributed durable event,
-the Controller stops before a third generation, marks recovery failed, and
-hands the exact evidence to the unique global Operator. Do not bypass that
-stop-loss by manufacturing another Role, Run, Session, or Task. The Operator
-must inspect the failure and explicitly recover or change the configured
-Leader; after first durable progress, ordinary bounded Provider retry policy
-continues to apply.
+Before the first durable Leader action, Yui observes fresh native generations
+that produce no WorkItem, Review, Integration, or Leader-attributed durable
+event. Two such generations create a non-blocking orchestration advisory for
+Leader and Operator judgment; they do not fail the Role, reduce the configured
+Provider retry policy, or prevent another useful generation. Read the evidence
+before retrying, then choose whether to continue, change the configured Leader,
+or perform direct maintenance without manufacturing protocol records merely to
+silence the advisory.
 
 Native child results have an explicit durability boundary. A native subagent is
 best-effort by default: its result returns through the parent Conversation, and

package/skills/yui-operator/SKILL.md

@@ -293,8 +293,9 @@ terminal text. For progress, report:
 - current Brief focus, latest Milestone, blockers, and open InputRequests.
 
 Worker yield is not completion. Describe a result as awaiting Leader review
-until it is accepted; do not report isolated code as delivered before its latest
-ChangeSet is integrated.
+until it is accepted. Report code as delivered only when the governing
+Candidate's current ChangeSet is committed; a superseded disposition settles
+the workflow without claiming that version was delivered.
 
 ## Enter and administer
 
@@ -340,11 +341,10 @@ ChangeSet is integrated.
   Run, Agent, receipt, launch, and Session identities; never reconstruct them
   from terminal text or ask the user to paste them.
 - Retry only an explicitly failed recovery Job.
-- When a Leader first-progress stop-loss is reported, inspect its two exact
-  native generations and absence of durable progress. Do not request a third
-  automatic generation or create another Operator. Recover the existing Task
-  only after choosing an explicit valid Leader configuration or a direct
-  maintenance action.
+- When a Leader first-progress advisory is reported, inspect its native
+  generations and absence of durable progress. It is cost evidence rather than
+  a recovery gate: choose whether another generation, a different configured
+  Leader, or direct maintenance is the smallest useful next action.
 - Use `yui task next-action <task>` and `yui execution audit` orchestration
   advisories as read-only cost evidence. They may flag excess WorkItems,
   repeated Reviews/checks, pre-progress generations, or terminal workspaces;