@zq-silk/yui 1.0.0-alpha.1 → 1.0.1

package/README.md

@@ -34,9 +34,9 @@ not from terminal windows you juggle or details you have to remember.
 - **Isolated by default** — repository work happens in managed Git worktrees;
   the stable checkout stays read-only.
 
-> **Status:** 1.0.0-alpha.1, with a clean storage 1.0 baseline. Default updates
-> support only declared minor upgrades within one storage major. Existing v37
-> Homes require the separate [one-time conversion](docs/storage-baseline.md).
+> **Status:** 1.0.0, with a clean storage 1.0 baseline. Default updates
+> support only declared minor upgrades within one storage major. Homes with
+> any other storage identity are rejected without mutation.
 
 [Quick start](#quick-start) · [Working through conversation](#working-through-conversation) · [Architecture](#architecture) · [Design principles](#design-principles)
 

package/dist/commands/taskCommands.js

@@ -827,9 +827,8 @@ function createTaskCommand(args, store, options) {
     return output(`Created Draft task ${created.task.id}: ${created.task.title}\n`
         + `Assigned role: ${created.leader.name}\n`
         + `Type: ${created.task.type ?? "unspecified"}\n`
-        + (created.task.projectBindings.length > 0
-            ? "Execution: Leader decides whether independent WorkItems are warranted\n"
-            : "Execution: no Project delivery evidence required\n"), {
+        + "Status: Draft; discussion and development have not started\n"
+        + "Next: explicitly submit with intent discuss or develop when the Task should start\n", {
         task: created.task,
         leader: created.leader
     });

package/dist/executor/fileRoleLaunchPlanner.js

@@ -17,7 +17,7 @@ import { managedRuntimeAdmission } from "../runtime/agentDriver.js";
 import { builtinAgentEndpointImplementation, validateAgentEndpointImplementation } from "../runtime/agentEndpointIdentity.js";
 import { builtinAgentDriverRegistry, builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 import { assertProviderConversationReplaceable } from "../runtime/providerRuntimeIdentity.js";
-import { resolveTaskRoleSessionTitle } from "../runtime/sessionTitle.js";
+import { operatorSessionTitle, resolveTaskRoleSessionTitle } from "../runtime/sessionTitle.js";
 import { parseTaskRuntimeIsolationDescriptor, taskRuntimeIsolationEnvironment } from "../runtime/taskRuntimeIsolation.js";
 import { planningRuntimeCwd } from "../storage/homeLayout.js";
 import { resolveAgentAdapter } from "./agentAdapter.js";
@@ -33,6 +33,7 @@ export class FileRoleLaunchPlanner {
     #agentEnvironment;
     #nativeAgentEnvironment;
     #createNativeSessionId;
+    #now;
     #cliPath;
     #inspectWorkspacePhysicalState;
     #entryPoint;
@@ -51,6 +52,7 @@ export class FileRoleLaunchPlanner {
         this.#agentEnvironment = this.#selectConfiguredAgentEnvironment(sourceEnvironment);
         this.#nativeAgentEnvironment = this.#selectConfiguredNativeEnvironment(sourceEnvironment);
         this.#createNativeSessionId = options.createNativeSessionId ?? randomUUID;
+        this.#now = options.now ?? (() => new Date());
         this.#inspectWorkspacePhysicalState = options.inspectWorkspacePhysicalState
             ?? inspectWorkspacePhysicalState;
         this.#cliPath = canonicalPath(options.cliPath
@@ -259,7 +261,9 @@ export class FileRoleLaunchPlanner {
         if (input.mode === "new" && sessionSet?.providerBinding != null) {
             assertProviderConversationReplaceable(sessionSet.providerBinding);
         }
-        return this.#compile(role, input, { scope: "global" }, undefined, input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, undefined, effective, { purpose: "execution" });
+        return this.#compile(role, input, { scope: "global" }, input.mode === "new" && role.name === "operator"
+            ? operatorSessionTitle(this.#now(), this.store.getConfig().timeZone)
+            : undefined, input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, undefined, effective, { purpose: "execution" });
     }
     #compile(role, input, owner, sessionTitle, knownNativeSessionId, workspaceOverride, effective, sessionPolicy) {
         const launchRole = effectiveRoleForLaunch(role, effective);
@@ -389,11 +393,16 @@ export class FileRoleLaunchPlanner {
         const effectiveConfig = withNativeProjectDirectories(roleConfig, effective.executionEnvironment === undefined
             ? nativeAdditionalDirectories(effective.workspace, agentWorkspace)
             : []);
+        const postCreateOperatorTitle = owner.scope === "global"
+            && role.name === "operator"
+            && sessionTitle !== undefined;
         const compileInput = {
             agent,
             config: effectiveConfig,
             workspace: agentWorkspace,
-            ...(sessionTitle === undefined ? {} : { sessionTitle }),
+            ...(sessionTitle === undefined || postCreateOperatorTitle
+                ? {}
+                : { sessionTitle }),
             ...sessionContext
         };
         if (input.mode === "resume"

package/dist/runtime/agentHost.js

@@ -328,7 +328,12 @@ export async function runAgentHost(input) {
                 kind: "restore",
                 mode: "resume",
                 nativeSessionId: disconnectedSession.nativeSessionId,
+                // The dated Operator title is a one-shot effect of creating the
+                // Conversation. Reattaching this client must not replay metadata whose
+                // earlier outcome may be unknown.
                 ...(previousControl.sessionTitle === undefined
+                    || (currentPayload.environment.YUI_SESSION_SCOPE === "global"
+                        && currentPayload.environment.YUI_ROLE === "operator")
                     ? {}
                     : { sessionTitle: previousControl.sessionTitle }),
                 codexThread: disconnectedSession.configuration.threadOptions,

package/dist/runtime/sessionTitle.js

@@ -1,3 +1,4 @@
+import { resolveTimeZone } from "../config/timeZone.js";
 const TITLE_SEPARATOR = " · ";
 export const MAX_SESSION_TITLE_LENGTH = 80;
 const TASK_TITLE_MAX_LENGTH = 20;
@@ -22,6 +23,20 @@ export function resolveTaskRoleSessionTitle(existingTitle, task, roleName) {
     }
     return taskRoleSessionTitle(task, roleName);
 }
+export function operatorSessionTitle(now, configuredTimeZone) {
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime())) {
+        throw new TypeError("Operator session title date is invalid.");
+    }
+    const parts = Object.fromEntries(new Intl.DateTimeFormat("en-CA", {
+        timeZone: resolveTimeZone(configuredTimeZone),
+        month: "2-digit",
+        day: "2-digit"
+    }).formatToParts(now).map(({ type, value }) => [type, value]));
+    if (parts.month === undefined || parts.day === undefined) {
+        throw new TypeError("Operator session title date is unavailable.");
+    }
+    return `Yui${TITLE_SEPARATOR}Operator${TITLE_SEPARATOR}${parts.month}${parts.day}`;
+}
 function displayTitle(value, maxLength) {
     if (value.length <= maxLength)
         return value;

package/dist/runtime/structuredProviderHost.js

@@ -68,10 +68,21 @@ export async function startStructuredProviderSession(payload, input = {}) {
                 ...(input.onDiagnostic === undefined ? {} : { onDiagnostic: input.onDiagnostic }),
                 mirror
             });
+            if (isPostCreateOperatorTitle(payload)) {
+                input.onDiagnostic?.({
+                    nativeSessionId: session.nativeSessionId,
+                    failure: {
+                        detail: "This Agent protocol does not support setting a native Session title.",
+                        phase: "session-start",
+                        inputDisposition: "not-accepted",
+                        sessionDisposition: "recoverable"
+                    }
+                });
+            }
             return Object.freeze({ session });
         }
         if (control.adapterId === "codex") {
-            const opened = await CodexStructuredProviderSession.open(child, exit, processInstanceId, payload, control, input.onStarted, input.onTerminal, input.onGoal, input.onInput, input.onActivity, mirror);
+            const opened = await CodexStructuredProviderSession.open(child, exit, processInstanceId, payload, control, input.onStarted, input.onTerminal, input.onGoal, input.onInput, input.onActivity, input.onDiagnostic, mirror);
             return Object.freeze({
                 session: opened.session,
                 ...(opened.recoveredTerminal === undefined
@@ -81,6 +92,17 @@ export async function startStructuredProviderSession(payload, input = {}) {
             });
         }
         const session = await ClaudeStructuredProviderSession.open(child, exit, processInstanceId, control, input.onAccepted, input.onTerminal, input.onGoal, input.onActivity, input.onDiagnostic, mirror);
+        if (isPostCreateOperatorTitle(payload)) {
+            input.onDiagnostic?.({
+                nativeSessionId: session.nativeSessionId,
+                failure: {
+                    detail: "This Agent provider does not support renaming a Session after creation.",
+                    phase: "session-start",
+                    inputDisposition: "not-accepted",
+                    sessionDisposition: "recoverable"
+                }
+            });
+        }
         return Object.freeze({ session });
     }
     catch (error) {
@@ -88,6 +110,12 @@ export async function startStructuredProviderSession(payload, input = {}) {
         throw error;
     }
 }
+function isPostCreateOperatorTitle(payload) {
+    return payload.providerControl?.sessionTitle !== undefined
+        && payload.providerControl.mode === "new"
+        && payload.environment.YUI_SESSION_SCOPE === "global"
+        && payload.environment.YUI_ROLE === "operator";
+}
 /**
  * Open an uninitialized, transparent connection for a native TUI. The TUI
  * owns its requests; Yui observes only its exact startup response.
@@ -351,7 +379,7 @@ class CodexStructuredProviderSession {
         this.mirror = mirror;
         this.nativeAccountHome = nativeAccountHome;
     }
-    static async open(child, exit, processInstanceId, payload, control, onStarted, onTerminal, onGoal, onInput, onActivity, mirror) {
+    static async open(child, exit, processInstanceId, payload, control, onStarted, onTerminal, onGoal, onInput, onActivity, onDiagnostic, mirror) {
         const channel = await CodexProxyWebSocketChannel.connect(child, mirror);
         const openingMessages = [];
         const stopOpeningBuffer = channel.onMessage((message) => openingMessages.push(message));
@@ -385,10 +413,22 @@ class CodexStructuredProviderSession {
             }
         }
         if (control.sessionTitle !== undefined) {
-            await runtime.setConversationName({
-                conversationId,
-                name: control.sessionTitle
-            });
+            try {
+                await runtime.setConversationName({
+                    conversationId,
+                    name: control.sessionTitle
+                });
+            }
+            catch (error) {
+                onDiagnostic?.({
+                    nativeSessionId: conversationId,
+                    failure: providerDeliveryFailureFrom(error, {
+                        phase: "session-start",
+                        inputDisposition: "not-accepted",
+                        sessionDisposition: "recoverable"
+                    })
+                });
+            }
         }
         const session = new CodexStructuredProviderSession(child, exit, processInstanceId, conversationId, runtime, onStarted, onTerminal, onGoal, onInput, onActivity, mirror, optionalId(initialized.codexHome));
         session.#activeTurnId = resumedActiveTurnId;

package/dist/storage/baselineSchema.js

@@ -1,4 +1,4 @@
-/** Current Home schema. Fresh initialization executes this once; no historical DDL is replayed. */
+/** Current Home schema. Fresh initialization executes this once. */
 export const BASELINE_SCHEMA_SQL = String.raw `CREATE TABLE storage_schema (
   id INTEGER PRIMARY KEY CHECK (id = 1),
   format TEXT NOT NULL,

package/dist/storage/currentTaskStore.js

@@ -11,7 +11,7 @@ export function initializeCurrentTaskStore(home) {
     }
     return openCurrentTaskStore(home);
 }
-/** Open only the current SQLite contract. Historical Homes are never normalized. */
+/** Open only the current SQLite contract. Unsupported Homes are never normalized. */
 export function openCurrentTaskStore(home) {
     const schema = inspectStorageSchema(home);
     if (schema.status !== "current") {

package/dist/storage/recordValidation.js

@@ -28,7 +28,7 @@ import { requireKnownFields } from "../domain/validation.js";
 const check = (validate) => record => { validate(record); };
 /** One current domain contract for saves, reads and explicit Home diagnostics.
  * Protocol-specific metadata/outbox/telemetry have their own readers. This is
- * validation only: other storage formats require an independent converter. */
+ * validation only: unsupported storage formats are rejected without mutation. */
 const validators = {
     task_records: check(validateTask),
     work_items: check(validateWorkItem),

package/dist/storage/sqliteSchema.js

@@ -114,7 +114,7 @@ export function applySqliteMinorUpgrades(db) {
         const before = inspectSqliteSchema(db);
         const plan = storageMinorUpgradePlan(before.currentVersion);
         if (plan === null)
-            throw new SqliteSchemaError("cross-major or unknown upgrades require an independent explicit converter.");
+            throw new SqliteSchemaError("cross-major or unknown storage upgrades are unsupported.");
         for (const step of plan) {
             const state = inspectSqliteSchema(db);
             if (state.currentVersion !== step.fromVersion || state.currentChecksum !== step.sourceChecksum) {

package/dist/storage/storageSchema.js

@@ -87,7 +87,7 @@ export function inspectStorageSchema(rootDir) {
         database.close();
     }
 }
-/** Require the current storage contract without normalizing historical data. */
+/** Require the current storage contract without normalizing unsupported data. */
 export function requireCurrentStorageSchema(rootDir) {
     const state = inspectStorageSchema(rootDir);
     switch (state.status) {

package/dist/storage/upgrade/upgradeOrchestrator.js

@@ -11,9 +11,9 @@ import { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION } from "../stora
 /**
  * Upgrade only recognized minor versions within the current Home major.
  *
- * Supported earlier versions are readable only here. Ordinary stores still
- * admit exactly {@link CURRENT_STORAGE_VERSION}; no old-shape normalizer or
- * dual read path enters runtime code. Execute mode is an offline primitive:
+ * Declared source versions are readable only here. Ordinary stores still
+ * admit exactly {@link CURRENT_STORAGE_VERSION}; no alternate-shape normalizer
+ * or dual read path enters runtime code. Execute mode is an offline primitive:
  * its caller must own the maintenance fence and keep the Controller quiesced
  * for the whole backup, migration, and validation interval.
  */
@@ -259,8 +259,7 @@ function unsupportedClassification(state) {
             + `migration version ${MIN_SUPPORTED_STORAGE_VERSION}.`;
     const action = future
         ? "Use a newer Yui release."
-        : "Preserve this Home for use with its matching historical Yui release, "
-            + "or use the independent explicit converter for a different storage major.";
+        : "Preserve this Home unchanged and let an Agent or Operator decide its disposition.";
     return {
         classification: {
             verdict: "NEEDS_NEW_VERSION",

package/docs/managed-turn-and-session-runtime.md

@@ -11,6 +11,13 @@ notifications cannot restart an explicitly stopped Session; normal Host detach
 preserves an active Session and remains reconnectable. A switch after a partial
 failure still settles the retained input before selecting a new conversation.
 
+A newly created global Operator conversation requests the native title
+`Yui · Operator · MMdd`, using Yui's configured time zone. The request is made
+only after the provider returns the exact new conversation identity; restore
+and reconnect paths never replay it. Providers without a post-create rename
+capability keep the usable Session and expose a diagnostic instead of treating
+metadata failure as Session-creation failure.
+
 ## Authority
 
 Task, WorkItem, Message, Decision, Artifact and Project Knowledge preserve
@@ -69,8 +76,8 @@ drifted. An explicit ordinary retry creates a new Run and Snapshot from current
 authorized facts, without reconstructing the old snapshot; Review and synthesis
 reuse still require exact frozen evidence. Subsequent observed/steered input may
 omit its own Snapshot because it does not establish a new Assignment.
-Storage uses the 1.0 baseline; the independent converter preserves these records
-without making missing optional execution evidence a Home-wide blocker.
+Storage uses the 1.0 baseline. Missing optional execution evidence remains a
+run-scoped condition and does not become a Home-wide blocker.
 
 Operational failures are scoped to their owner, not treated as proof that the
 whole Controller must stop. Optional resource reaping and continuation metadata

package/docs/managed-turn-and-session-runtime.zh-CN.md

@@ -8,6 +8,11 @@ Provider binding，再结算执行占用。Global 停止证据保存为仅记录
 不触发新的原生输入。待投递通知不能重启已明确停止的 Session；普通 Host 脱离仍
 保留 active Session，可正常重连。部分切换失败后，仍须先结算旧输入再选择新会话。
 
+新建 global Operator 对话会按 Yui 当前配置时区请求原生标题
+`Yui · Operator · MMdd`。只有 Provider 返回新对话的确切身份后才执行该请求；
+恢复与重连路径不会重放。若 Provider 不支持创建后改名，已创建的 Session 仍保持
+可用，并留下诊断，而不会把元数据失败冒充为 Session 创建失败。
+
 ## 权威
 
 Task、WorkItem、Message、Decision、Artifact 和 Project Knowledge 保存持久工作。
@@ -55,8 +60,8 @@ Leader／Operator 查看、结算失败或显式废弃，无关工作继续推
 确切冻结上下文在证据缺失、漂移时局部失败。显式普通重试根据当前授权事实创建
 新的 Run 和 Snapshot，不补造旧快照；Review／结果汇总的确切复用仍需冻结证据。
 后续原生输入或 steer 可以没有独立 Snapshot，因为它们不建立新的 Assignment。
-存储采用 1.0 基线；独立转换器保留这些记录，不把可选执行证据缺失扩大为
-整个 Home 的转换阻塞。
+存储采用 1.0 基线；可选执行证据缺失保持为 Run 局部状态，不扩大为
+整个 Home 的阻塞。
 
 运行异常按所属对象限制影响，不等同于整个 Controller 必须停摆。可选的资源回收
 和 continuation 元数据检查失败会报告诊断，不阻断正常调度；Provider 重试准入

package/docs/release-workflow.md

@@ -27,63 +27,45 @@ system sits behind `ReleaseWorkflowPorts`
 external ports exercise recovery without real GitHub, npm, git, Controller,
 or model effects.
 
-## Clean baseline prereleases: 1.0.0-alpha series
+## Stable 1.0 baseline and release evidence
 
-`1.0.0-alpha.1` fixes the independent converter's rejection of equivalent
-`home_meta` indentation. It archives the original DDL and recreates the exact
-target table while preserving every row. The runtime storage 1.0 definition
-and checksum are unchanged; already-converted Homes need no new conversion.
-Each alpha version has a new immutable package/tag and its own verified
-converter attachments. Continue using npm `next`; never replace an existing tag
-or overwrite a previously published package or attachment.
-
-0.16.2 remains the frozen historical bridge. The 1.0.0-alpha runtime starts the
-distinct storage **1.0** baseline and carries no old migration chain or
-conversion tool. Package 1.0.0 will reuse the final verified prerelease storage
-contract without another reset.
+Package 1.0.0 defines the storage **1.0** contract directly. The runtime and
+current source carry no historical migration chain, old-format reader,
+conversion tool, fixture or compatibility test. A fresh Home initializes the
+current schema; any unsupported storage identity is rejected without mutation.
 
 Storage versions have two levels. Default updates may advance only contiguous
 minor versions within the same major; pinning a package does not authorize a
 cross-major conversion. Current Yui-owned envelopes and protocols start at 1,
 without resetting business revisions, epochs or audit evidence.
-Any persistent change after an alpha is published requires an explicit new
-minor transition; published schema definitions must not be silently replaced.
+Any future persistent change requires an explicit new minor transition;
+published schema definitions must not be silently replaced.
 Current bounded automatic recovery, lock waiting, transactions, replay
 protection and valid exact-identity caches remain normal runtime behavior.
 
-Use the exact package version `1.0.0-alpha.1` to opt into this baseline. Stable
-releases use npm `latest`; prereleases use `next`, never the stable default.
-
-The old-v37 converter is a separate archive. Its source/target verification,
-offline boundary, full backup, original-payload audit, cold startup and rollback
-are specified in [Storage baseline 1.0](./storage-baseline.md).
-Publish its archive and checksum as durable attachments to each alpha release alongside
-the exact tested runtime package. Expiring CI artifacts alone are insufficient.
-The alpha-only `baseline-release` job runs after npm publication, uploads missing
-attachments to a draft without overwriting existing files, downloads and compares
-every attachment against the tested artifact, then publishes the prerelease.
-A retry verifies matching existing attachments; a different byte or an incomplete
-already-published Release is an error, not permission to replace release evidence.
-If this job fails after npm publication, resume only this job with the same
-retained artifacts rather than republishing or rebuilding the package.
-The runtime tarball must contain neither tools/ nor dist/storage/migrations/.
+Stable releases use npm `latest`; prereleases use `next`, never the stable
+default. The release workflow builds one runtime archive, verifies it across
+supported Node versions, publishes that exact archive to npm, then creates the
+matching GitHub Release. Every release carries the runtime archive, checksum and
+provenance. A stable tag becomes GitHub latest; a prerelease does not.
+
+The GitHub Release job uploads only missing assets to a draft, downloads and
+compares every asset against the tested artifact, and never overwrites a
+published asset. A retry accepts only byte-identical existing evidence. If npm
+has already published and the Release job fails, rerun that failed job with the
+retained artifact rather than rebuilding or republishing the package. The
+runtime tarball must contain neither tools/ nor historical storage migrations.
 
 Use `yui update --version <exact-version>` for an exact published package.
 Staged metadata must match the requested version, and target-owned storage
 preflight runs before activation and again under the maintenance fence.
-An unsupported Home remains unchanged; use the independent converter rather
-than replacing the global CLI first. Current update/activation children must
+An unsupported Home remains unchanged. Current update/activation children must
 explicitly identify their handover-lock owner.
 
 Restoration checks the captured executable/argv, package version, Controller
 protocol and both storage-version bounds against status and live identity.
 Missing contract fields are errors, not an older-Controller exception.
 
-The converter source, frozen endpoint fixture and converter-specific tests are
-release-only deliverables for the alpha series. Remove them from the 1.0.0 development line
-only after the final corrected alpha release attachments and checksums are durably available
-and verified. Do not delete the only conversion path before publication.
-
 ## Authorization model
 
 Every (re)submission of a step passes `checkGrant(grant, request, now)`

package/docs/release-workflow.zh-CN.md

@@ -20,48 +20,36 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 （`src/release/releaseWorkflowPorts.ts`）之后。可用临时 SQLite 和确定性的外部端口测试
 恢复逻辑，无需真实 GitHub、npm、git、Controller 或模型效果。
 
-## 纯净基线版本：1.0.0-alpha
+## 稳定的 1.0 基线与发布证据
 
-`1.0.0-alpha.1` 修复独立转换器对 `home_meta` 等价缩进的误判，保留原 DDL，
-按目标定义重建该表并验证所有行不变。运行时存储 1.0 定义及校验和不变，
-已转换的 Home 无需再次转换。alpha 系列每次使用新的不可变版本／标签和
-独立转换器附件，继续发布到 npm `next`，不覆盖已发布版本、标签或附件。
-
-0.16.2 保留为冻结历史桥接版。1.0.0-alpha 运行包启用独立的存储 **1.0**，
-不携带旧迁移链或一次性转换工具；之后的 1.0.0 复用最终已验证的预发布存储契约，
-不再重置。
+1.0.0 软件包直接定义存储 **1.0** 契约。运行包和当前源码不携带任何历史
+迁移链、旧格式读取器、转换工具、样本或兼容测试。新 Home 直接初始化当前
+结构；任何不受支持的存储身份都会在不修改 Home 的前提下被拒绝。
 
 存储采用主版本、小版本两级编号，默认更新只允许同主版本内连续的小版本升级。
 指定软件版本不代表授权跨存储主版本。当前 Yui 自有格式和协议从 1 开始，
 但不重置业务 revision、epoch 或审计证据。
-alpha 发布后如需改变持久化契约，必须声明新的小版本迁移，不能静默改写
-已发布基线。有界自动恢复、锁等待、事务、重放保护和精确身份匹配的有效缓存
+后续如需改变持久化契约，必须声明新的小版本迁移，不能静默改写已发布基线。
+有界自动恢复、锁等待、事务、重放保护和精确身份匹配的有效缓存
 都是当前运行能力，不作为历史兼容删除。
 
-使用精确软件版本 `1.0.0-alpha.1` 主动选择新基线。正式版使用 npm `latest`，
-预发布版使用 `next`，不能覆盖默认稳定版本。
+正式版使用 npm `latest`，预发布版使用 `next`，不能覆盖默认稳定版本。
+发布流水线只构建一个运行包，在受支持 Node 版本上验证后，将同一产物发布到
+npm，并创建对应 GitHub Release。每个 Release 都包含运行包、校验和与来源记录；
+正式 tag 成为 GitHub latest，预发布 tag 不会。
 
 恢复 Controller 时，status 和 live identity 都必须匹配此前捕获的执行文件、
 参数、软件版本、Controller 协议和存储版本上下界。缺少字段直接报错，
 不再为较早的 Controller 放宽校验。
 
-旧 v37 转换器独立分发；来源与目标校验、离线边界、完整备份、原始负载审计、
-冷启动和回滚见[存储基线 1.0](./storage-baseline.zh-CN.md)。
-发布时将转换包及校验和作为每个 alpha 版本的长期附件，与确切测试过的运行包一同保留；
-不能只依赖会过期的 CI artifact。运行 tarball 不得包含 tools/ 或旧迁移目录。
-alpha 专用 `baseline-release` 在 npm 发布成功后向草稿上传缺少的附件，不覆盖
-已有文件；逐个下载并与经过测试的产物比较后，才公开预发布 Release。
-重试只接受字节一致的已有附件；字节不同或已公开 Release 缺少附件都明确失败，
-不自动覆盖发布证据。若 npm 已发布而此步骤失败，只用同一批保留产物重跑该
-job，不重新构建或再次发布 npm 包。
-
-转换器源码、冻结终点样本及专用测试只服务于 alpha 系列的独立交付。
-必须先确认最终修正版 alpha 的长期发布附件和校验和可取得且验证通过，才能在 1.0.0
-开发线上移除它们；不能在发布前删掉唯一转换入口。
+GitHub Release job 只向草稿上传缺少的附件，逐个下载并与测试产物比较，
+不覆盖已经公开的资产。重试只接受字节一致的已有证据。若 npm 已发布而
+Release job 失败，只用保留的同一产物重跑失败 job，不重新构建或再次发布。
+运行 tarball 不得包含 tools/ 或历史存储迁移。
 
 `yui update --version <exact-version>` 选择精确发布包，实际暂存版本必须匹配。
-激活前及维护锁内分别执行目标包的存储预检。不支持的 Home 保持不变，应使用
-独立转换工具，不能先覆盖全局 CLI。当前交接子进程必须显式提供锁持有者身份。
+激活前及维护锁内分别执行目标包的存储预检。不支持的 Home 保持不变。
+当前交接子进程必须显式提供锁持有者身份。
 
 ## 授权模型
 

package/docs/sqlite-control-plane-design.md

@@ -4,7 +4,8 @@
 
 Yui has one authoritative product Store: `YUI_HOME/yui.db`, in WAL mode.
 `storage_schema` contains its single **major.minor** version and schema
-checksum. The clean baseline is **1.0**, introduced by package 1.0.0-alpha.
+checksum. Package 1.0.0 uses the clean storage **1.0** baseline established and
+verified by its prereleases.
 
 ## Authority
 
@@ -55,12 +56,12 @@ native evidence settles one. WorkItem and Task acceptance remain Agent-owned.
 Version APIs expose `"1.0"` strings, not floats. Default `upgrade` / `update`
 supports only a known contiguous minor path within the same storage major.
 The initial baseline has no such steps. Cross-major and old integer formats
-require an independent explicit converter; they never enter a runtime fallback.
+are unsupported; they never enter a runtime fallback or heuristic repair path.
 The updater preflights the exact staged package before activation, then rechecks
 under its maintenance fence. Unknown ownership remains a blocker.
 
-See [Storage baseline 1.0](./storage-baseline.md) for the independent old-v37
-conversion, backup/rollback, artifact boundaries and cold startup procedure.
+See [Storage baseline 1.0](./storage-baseline.md) for current admission,
+backup/rollback, artifact boundaries and cold startup procedure.
 
 ## Unified Home layout
 
@@ -69,4 +70,3 @@ Self-managed data stays under one canonical Home: Task worktrees under
 `workspaces/global`, runtime data under `runtime`, and backups under `backups`.
 Explicit external Project inputs keep their external-resource semantics.
 Only deliberately short IPC socket paths may live outside Home.
-The converter does not relocate workspaces or rewrite their Git identities.

package/docs/sqlite-control-plane-design.zh-CN.md

@@ -3,8 +3,8 @@
 # SQLite 控制面存储
 
 Yui 唯一的权威产品 Store 是 WAL 模式的 `YUI_HOME/yui.db`。
-`storage_schema` 单行记录唯一的**主版本.小版本**与 Schema 摘要；
-1.0.0-alpha 软件包引入的纯净基线为 **1.0**。
+`storage_schema` 单行记录唯一的**主版本.小版本**与 Schema 摘要。
+1.0.0 使用已经过预发布验证的纯净存储基线 **1.0**。
 
 ## 权威
 
@@ -42,10 +42,10 @@ AgentRun 记录显式执行请求、可见输入和原始结果，不记录隐
 
 版本 API 返回 `"1.0"` 字符串，不用浮点数。默认 `upgrade/update`
 只接受同一存储主版本内完整且连续的小版本路径；初始基线尚无升级步骤。
-跨主版本和旧整数格式只由独立显式转换器处理，运行包没有回退。
+跨主版本和旧整数格式不受支持，运行包没有回退或启发式修复路径。
 updater 先检查精确暂存包，再在维护锁内重查；未知所有权始终阻塞。
 
-独立旧 v37 转换、备份恢复、产物边界和冷启动流程见
+当前格式准入、备份恢复、产物边界和冷启动流程见
 [存储基线 1.0](./storage-baseline.zh-CN.md)。
 
 ## Home 布局
@@ -54,4 +54,3 @@ updater 先检查精确暂存包，再在维护锁内重查；未知所有权始
 `workspaces/tasks/<task>/<owner>/<project>`，Global scratch 在
 `workspaces/global`，运行数据在 `runtime`，备份在 `backups`。
 显式外部 Project 保留外部资源语义；只有受限长度的 IPC socket 可位于 Home 外。
-一次性转换不搬迁工作区，也不改写 Git 身份。

package/docs/storage-baseline.md

@@ -1,139 +1,56 @@
-# Storage baseline 1.0
-
-Yui 1.0.0-alpha is the clean runtime baseline. Package version `1.0.0-alpha`, Home
-storage version `1.0`, record envelope version `1`, and Controller protocol `1`
-have different responsibilities. The later 1.0.0 package reuses the final
-verified prerelease storage contract; it must not reset it again. Persistent
-changes after the first alpha publication require explicit minor transitions.
-
-## Current runtime
-
-- `storage_schema` contains one authoritative identity: format, major, minor,
-  schema checksum and creation time. JSON APIs expose storage versions as
-  canonical strings such as `"1.0"`, not floating-point numbers.
-- New Homes execute the complete current DDL once. They do not replay the old
-  v1..v37 ledger. Ordinary reads validate the current identity, physical schema
-  and typed records; they never normalize data.
-- Explicit `upgrade` / `update` can apply only a complete, contiguous **minor**
-  path within one major. The initial 1.0 baseline has no minor steps.
-  Cross-major, downgrade, unknown and old integer formats fail before activation.
-  An exact package selector is not permission to cross a storage major.
-- Yui-owned record envelopes start at 1. Host control uses the distinct
-  `yui-agent-host-control/v1` identity, so it cannot accidentally adopt an old
-  `yui-agent-host/v1` producer. Context/Run/Host-event/Driver contracts already at
-  v1 remain there. External Provider protocols and package versions are unchanged.
-- Business revisions, authority epochs, IDs, event sequences, native data and
-  immutable Context resources are not schema versions. Never reset them.
-- `storage_migration_archive` is opaque audit evidence, not an executable
-  compatibility reader. Old numbers and original bytes in audit remain intact.
-- Candidates have one current authority: the owning WorkItem's candidate array.
-  The baseline does not create the unused `work_item_candidates` or
-  `coordination_locks` tables, or the obsolete `idx_input_open` index.
-
-The runtime tarball contains neither historical migration modules nor the
-standalone converter. Source-level history and previous published packages
-remain available for explicit diagnosis, not automatic runtime fallback.
-
-## One-time conversion from 0.16.2
-
-The independent `yui-baseline-cutover` archive accepts only the exact frozen
-0.16.2 schema and its complete v37 ledger. Older Homes must first use 0.16.2.
-Admission is based on this exact storage contract, not an installed package
-version: an already-valid v37 Home does not need a cosmetic rewrite.
-It never runs the old migration chain itself.
-
-Use the corrected converter attached to `1.0.0-alpha.1`. The initial alpha
-converter rejected equivalent indentation in `home_meta`. The corrected tool
-allows only that table's per-line indentation differences, archives the old
-DDL and recreates the canonical target table without changing its rows.
-Columns, constraints, all other objects and all ledger entries still match
-exactly. The published runtime storage 1.0 definition is unchanged.
-
-The v37 → 1.0 transition preserves Runs with missing optional Snapshot
-references, including their original references and results. A retained record
-need not be ready to execute: missing evidence must not block Home conversion.
-The Leader/Operator can inspect and retire the affected Run; an explicit ordinary
-retry creates a new Run and Snapshot from current authorized facts without
-rewriting the old evidence. Exact Review/synthesis reuse still requires its
-frozen evidence. Unknown formats, structural corruption and unsettled external
-effects remain separate conversion blockers.
-
-1. Using 0.16.2, settle active Runs, Jobs, claimed notifications, in-flight
-   retries and unconfirmed effects. Preserve queued intent rather than marking
-   it completed. Stop managed Sessions and the Controller. `session stop --all`
-   refuses busy Sessions; it is not authority to force-stop or discard work.
-2. Stage the published 1.0.0-alpha.1 package in a separate installation prefix, with
-   its native dependencies installed. Do not overwrite the global CLI or try to
-   run the new Controller against the old Home.
-3. Verify the converter archive checksum, unpack it, then use its entrypoint.
-   The examples below use **placeholders**, not a production Home:
+<p align="right"><strong>English</strong> | <a href="./storage-baseline.zh-CN.md">简体中文</a></p>
 
-```sh
-node /absolute/converter/cli.mjs \
-  --home /absolute/home --runtime /absolute/staged/package
-
-node /absolute/converter/cli.mjs \
-  --home /absolute/home --runtime /absolute/staged/package \
-  --apply --backup-dir /absolute/new-backup-directory
-```
-
-`--runtime` names the package directory containing `package.json`, `dist/` and
-available dependencies, not its `bin/yui` entrypoint. The default invocation is
-read-only. `--apply` requires a new backup directory outside Home, under an
-existing canonical parent. Run from an external Operator shell, not a managed
-Task or a Session that is itself being converted.
-
-The tool refuses active durable execution, pending outbox operations, active
-Session bindings, recorded live processes, observable processes referencing
-this Home/database, pending native Inbox files and unfinished Controller
-handover/discovery. Unknown identity for a recorded owner remains a blocker;
-unrelated user processes are not adopted or terminated. Stop unmanaged writers
-and external workspace editors too; a file copy is not a filesystem snapshot.
-The maintenance fence and SQL write transaction protect the conversion.
-
-Before mutation, the tool copies Home and creates a self-contained SQLite
-backup with checksum. It converts only named Yui envelopes and active typed
-verification plans, preserving each changed payload and the original ledger in
-audit. User text, native payloads, frozen Context bytes, Git data, dirty files,
-IDs, counters and Task outcomes are preserved.
-Before dropping the two unused source tables, every original row is retained
-under `baseline-v37/retired-table/<table>` in the audit archive. Their payloads
-are opaque evidence, not active records to normalize. The receipt reports
-`retiredRows` separately from changed current records.
-
-Old `active-release.json` and `runtime-identity.json` are archived in
-`retired-runtime/`, not relabelled as observations of the new runtime. The tool
-also verifies and converts the typed isolation owner markers at the declared
-runtime inventory paths, retaining their originals and recomputing only the
-format-dependent fingerprint. Resource paths, namespace and port allocations
-do not change. Unknown markers or links remain blockers. The tool
-does not resume old Hosts, update the global installation, start a Controller,
-or submit model input. After a successful conversion, use the staged 1.0.0-alpha.1 CLI
-to install the exact package and start only the new runtime. Start new managed
-Sessions through the ordinary explicit lifecycle; history is not live authority.
-
-## Evidence and recovery
-
-Success is `outcome: converted`, target `1.0`, with the exact backup path.
-Repeating against a valid current Home returns `already-current` without
-creating another backup or rewriting records.
-
-- `backup/home/` preserves the Home tree; `backup/yui.db` is the consistent
-  standalone database snapshot; `receipt.json` identifies source, target,
-  checksum and completed conversion. `retired-runtime/` preserves old bindings.
-- A validation failure rolls back the SQL transaction and restores runtime
-  bindings moved by that attempt. If restoration cannot be proven, the error
-  names the retained files; keep Home stopped.
-- A crash or receipt-write failure is not proof that storage stayed old.
-  Inspect the actual format and backup before choosing recovery. There is no
-  automatic repair worker or speculative replay.
-- To roll back, stop all new writers, preserve the failed/new Home separately,
-  and restore the old Home tree plus the standalone `yui.db` at the **same**
-  original Home path, without mixing in newer WAL/SHM files. Use only 0.16.2.
-  Review the converter-owned lock in the snapshot by exact process identity.
-- After new business writes, restoring the old backup loses those writes.
-  Recovery then needs an explicit disposition; never restore automatically.
+# Storage baseline 1.0
 
-Real Home conversion and publication require separate user authorization.
-Isolated fixture evidence does not claim that a particular production Home is
-ready to convert.
+Yui 1.0.0 starts from one clean persistent contract. The package version,
+storage schema, record envelopes and Controller protocol are separate
+identities; none is inferred from another.
+
+## Current contract
+
+- `storage_schema` identifies the authoritative storage **major.minor** and the
+  exact physical-schema checksum.
+- A fresh Home creates the complete current DDL directly. Ordinary reads accept
+  only the current identity and never normalize records.
+- Default `upgrade` and `update` may follow only a complete, declared,
+  same-major minor path. The initial 1.0 baseline has no migration steps.
+- Cross-major, downgrade, unknown and undeclared identities are rejected before
+  activation and leave the Home unchanged.
+- Current Yui-owned envelopes and protocols begin at their own version 1.
+  Business IDs, revisions, epochs, event counters, Context digests and external
+  provider protocols are independent and are never reset by storage numbering.
+- `storage_migration_archive` is opaque audit evidence for declared current
+  transitions. It is not a reader, scheduler or repair mechanism.
+- The runtime package and current source contain only the current contract and
+  its declared same-major minor transition mechanism.
+
+Future persistent changes must add an explicit storage minor version, source
+and target checksums, a deterministic transactional transform and focused
+regression evidence. A published baseline is immutable.
+
+## Failure and recovery
+
+Update preflight validates the staged package and target Home before activation,
+then repeats the check under the maintenance fence. A migration failure rolls
+back its transaction and does not advance the storage identity.
+
+Invalid, malformed or unsupported state is preserved and diagnosed. Yui does
+not guess repairs, discard evidence or silently initialize over it. The Agent,
+Leader or Operator can inspect the exact failure and choose a bounded action
+such as retrying, abandoning an affected execution, restoring a verified
+backup, or initializing a separate fresh Home.
+
+Before an authorized persistent update, make a restorable backup of the Home
+while the Controller is stopped or held by the maintenance fence. Restore the
+database and its matching WAL/SHM set as one unit. Do not combine files from
+different observations.
+
+Real Home operations, publication and shared-infrastructure validation require
+explicit user authority. Development and CI use isolated disposable fixtures.
+
+## Release artifact boundary
+
+The published runtime tarball is the only executable release artifact. It must
+exclude repository tests, development tools and non-current storage material.
+Every GitHub Release carries the exact tested runtime archive, checksum and
+provenance used for npm publication.

package/docs/storage-baseline.zh-CN.md

@@ -1,111 +1,44 @@
-# 存储基线 1.0
-
-Yui 1.0.0-alpha 是纯净运行基线。软件版本 `1.0.0-alpha`、Home 存储版本 `1.0`、
-记录格式版本 `1`、Controller 协议版本 `1` 各有职责。后续 `1.0.0` 软件包
-复用最终已验证的预发布存储契约，不再重置。首个 alpha 发布后如需修改
-持久化契约，必须声明显式的小版本迁移。
-
-## 当前运行包
-
-- `storage_schema` 的单行记录是唯一存储版本权威，包含格式、主版本、小版本、
-  Schema 摘要与创建时间。JSON 中版本采用 `"1.0"` 字符串，不用浮点数。
-- 新 Home 一次创建最终 DDL，不执行旧 v1→v37 链。普通读取只校验当前身份、
-  物理结构和类型化记录，不转换数据。
-- 显式 `upgrade/update` 默认也只允许同主版本内连续的小版本升级。
-  首个 `1.0` 尚无小版本升级步骤。跨主版本、降级、未知格式、旧整数版本
-  都会在激活前拒绝；指定软件版本不等于授权跨存储主版本。
-- Yui 自有记录格式从 1 开始。Host 控制采用独立的
-  `yui-agent-host-control/v1`，不会误认历史 `yui-agent-host/v1`。
-  原本为 v1 的 Context、Run、Host 事件和 Driver 协议保持 v1。
-  外部 Provider 协议和依赖版本不重置。
-- 业务 revision、授权 epoch、ID、事件序号、原生数据和冻结 Context
-  不是 Schema 版本，不能重置。
-- `storage_migration_archive` 只保留不透明审计证据，不解释旧格式来执行工作。
-  其中的旧版本数字与原始字节保持不变。
-- Candidate 的当前权威只有所属 WorkItem 的候选数组。基线不再创建无用的
-  `work_item_candidates`、`coordination_locks` 表或废弃的 `idx_input_open` 索引。
-
-运行 tarball 不包含历史迁移模块，也不包含独立转换器。旧 tag 和发布包用于
-显式诊断，不构成运行时回退。
+<p align="right"><a href="./storage-baseline.md">English</a> | <strong>简体中文</strong></p>
 
-## 从 0.16.2 一次性转换
-
-独立 `yui-baseline-cutover` 压缩包只接受精确的 0.16.2 结构和完整 v37 账本。
-更旧 Home 必须先通过 0.16.2 升级；转换器本身不执行整条旧迁移链。
-准入依据是精确的存储结构与账本，不是当前安装的软件版本号；
-已经满足该 v37 契约的 Home 不需要为了改软件编号而重写数据。
-
-使用 `1.0.0-alpha.1` 附带的修正版转换器。初始 alpha 转换器会把 `home_meta`
-的等价缩进误判为不支持；修正版仅允许该表逐行缩进不同，保留原 DDL 并按目标定义
-重建该表，验证所有行不变。字段、约束、其他结构对象和完整账本仍严格匹配。
-已发布的运行时存储 1.0 定义没有改变。
-
-v37 → 1.0 转换保留缺少可选 Snapshot 引用的 Run、原始引用和结果。
-记录可以读取不代表它必须能执行：证据缺失不应阻断整个 Home 转换。
-Leader／Operator 可以查看、废弃异常 Run；显式普通重试根据当前授权事实创建
-新的 Run 和 Snapshot，不改写旧证据。Review／结果汇总若要复用确切冻结证据，
-仍需满足该操作的前提。未知格式、结构损坏和未结算外部效果仍是独立的转换阻塞条件。
-
-1. 使用 0.16.2 结算活动 Run、Job、已认领通知、在途重试和未知外部效果。
-   保留排队意图，不伪造完成。停止受管 Session 和 Controller。
-   `session stop --all` 会拒绝忙碌 Session，不是强停或丢弃工作的授权。
-2. 将已发布的 1.0.0-alpha.1 暂存在独立安装前缀中，安装所需原生依赖。
-   不先覆盖全局 CLI，不让新 Controller 打开旧 Home。
-3. 核验转换包校验和并解压，调用入口。以下路径均为**占位示例**：
+# 存储基线 1.0
 
-```sh
-node /absolute/converter/cli.mjs \
-  --home /absolute/home --runtime /absolute/staged/package
+Yui 1.0.0 从唯一、纯净的持久化契约开始。软件包版本、存储结构、记录封装和
+Controller 协议是相互独立的身份，不能从其中一个推断另一个。
 
-node /absolute/converter/cli.mjs \
-  --home /absolute/home --runtime /absolute/staged/package \
-  --apply --backup-dir /absolute/new-backup-directory
-```
+## 当前契约
 
-`--runtime` 指包含 `package.json`、`dist/` 和可用依赖的软件包目录，
-不是 `bin/yui`。默认仅检查。`--apply` 要求 Home 外一个不存在的新备份目录，
-其父目录必须存在且为规范物理路径。从外部 Operator shell 执行，不在受管
-Task 或正在转换的 Session 内执行。
+- `storage_schema` 记录权威的存储**主版本.小版本**和精确物理结构校验和。
+- 新 Home 直接创建完整的当前 DDL。普通读取只接受当前身份，不规范化记录。
+- 默认 `upgrade` 和 `update` 只能沿同一主版本内完整、已声明的小版本路径执行；
+  初始 1.0 基线没有迁移步骤。
+- 跨主版本、降级、未知或未声明的身份会在激活前被拒绝，并保持 Home 不变。
+- 当前 Yui 自有封装和协议分别从版本 1 开始。业务 ID、revision、epoch、事件计数、
+  Context 摘要和外部 Provider 协议相互独立，不随存储编号重置。
+- `storage_migration_archive` 只保存当前已声明迁移的不透明审计证据，不是读取器、
+  调度器或修复机制。
+- 运行包和当前源码只包含当前契约及同主版本内已声明的小版本迁移机制。
 
-工具拒绝活动持久执行、待应用 outbox、活动 Session、仍存活的登记进程、
-可观测到引用此 Home/数据库的进程、待消费的原生 Inbox 文件，以及未完成的
-Controller 交接或发现记录。登记所有者身份不可验证时仍阻塞；不会接管或
-终止无关用户进程。也应停止非受管写入者及外部工作区编辑器：普通文件复制
-不是文件系统快照。维护锁和 SQL 写事务保护实际转换。
+未来持久化变更必须增加明确的存储小版本、源和目标校验和、确定性的事务转换，
+并提供聚焦的回归证据。已经发布的基线不可改写。
 
-变更前复制整个 Home，并生成带校验和的独立 SQLite 备份。转换只处理明确的
-Yui 记录封装及活动类型化验证计划，将每个改写前的原始负载和旧账本保存在审计中。
-用户文本、原生负载、冻结 Context、Git 数据、未提交文件、ID、计数和 Task
-结果保持原样。
-删除两张旧表之前，每一行原始内容都写入审计的
-`baseline-v37/retired-table/<table>` 分类，不把其中的负载当作活动记录规范化。
-回执以 `retiredRows` 单独报告归档行数。
+## 失败与恢复
 
-旧 `active-release.json` 和 `runtime-identity.json` 归档到
-`retired-runtime/`，不改写成新运行事实。工具不恢复旧 Host、不改全局安装、
-不启动 Controller、不提交模型输入。转换成功后，再由暂存的 1.0.0-alpha.1 CLI
-安装精确版本并启动新运行环境；通过正常显式生命周期创建新 Session，
-历史记录不代表活动授权。
+更新预检会在激活前校验暂存包和目标 Home，并在维护锁内再次检查。迁移失败会
+回滚事务，不推进存储身份。
 
-声明的运行资源目录中的隔离所有者标记也会先验证旧摘要，再转换格式并重算
-相应指纹，原文件保存在归档中。资源路径、namespace 和端口分配不变。
-未知标记或符号链接直接阻塞，不猜测接管。
+无效、损坏或不受支持的状态会被保留并给出诊断。Yui 不猜测修复、不丢弃证据，
+也不会在其上静默初始化。Agent、Leader 或 Operator 可以检查精确失败，并选择
+有界操作，例如重试、废弃受影响的执行、恢复已验证备份，或初始化独立的新 Home。
 
-## 证据与恢复
+执行已授权的持久化更新前，应在 Controller 停止或由维护锁隔离时制作可恢复的
+Home 备份。数据库及其匹配的 WAL/SHM 必须作为一个整体恢复，不能混用不同观察
+时刻的文件。
 
-成功结果为 `outcome: converted`、目标 `1.0` 及精确备份路径。
-对有效新 Home 重复运行返回 `already-current`，不再次备份或改写。
+真实 Home 操作、发布和共享基础设施验证需要用户明确授权；开发与 CI 使用隔离的
+一次性样本。
 
-- `backup/home/` 保留 Home 树；`backup/yui.db` 是一致的独立数据库快照；
-  `receipt.json` 记录来源、目标、摘要及转换结果；`retired-runtime/` 保存旧绑定。
-- 校验失败时回滚 SQL，并恢复本次移动的运行绑定。若恢复无法确认，错误会指出
-  保留文件；Home 应继续保持停止。
-- 崩溃或回执写入失败不证明数据库仍是旧版。先检查实际格式与备份，再选择恢复；
-  没有自动修复 worker 或猜测性重放。
-- 回滚前停止新写入者、另存失败或新 Home，再将旧 Home 树和独立 `yui.db`
-  恢复到**原来的同一路径**，不能混入新 WAL/SHM。只使用 0.16.2；
-  按精确进程身份检查快照中转换器自己的维护锁。
-- 一旦新版产生业务写入，恢复旧备份会丢失这些新写入，必须明确处理，不能自动恢复。
+## 发布产物边界
 
-真实 Home 转换和发布需要另外获得用户授权。隔离样本通过不等于生产 Home
-已经满足转换条件。
+发布的运行 tarball 是唯一可执行发布产物，必须排除仓库测试、开发工具和非当前
+存储材料。每个 GitHub Release 都携带 npm 发布所使用的同一份已测试运行包、
+校验和与来源记录。

package/docs/testing/verification-levels.md

@@ -50,43 +50,37 @@ is required.
 ## Permanent core smoke
 
 `npm test` and `npm run test:core` build the checkout and run the maintained suite.
-The baseline cutover retires tests owned solely by the removed v1..v37
-implementation. Their source/evidence remains in the frozen 0.16.2 release;
-mixed tests retain current behavior, such as Review scope and Integration
-completion boundaries.
+The stable suite owns only current storage 1.0 and future declared minor
+transitions. It contains no historical conversion implementation, fixture or
+compatibility test.
 
 Current coverage includes:
 
 1. Fresh storage 1.0, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
-2. Independent v37 conversion: original intent/audit/counters, nested Session
-   envelopes, opaque Context, rollback on invalid input, offline backup and
-   repeat-call idempotence. The CLI fixture uses a disposable Home; it never
-   converts a real account. The converter is not part of the runtime tarball.
-3. Exact-version staging, mismatched-target refusal, same-major contiguous
+2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and
    restoration against captured protocol/storage identity rather than omitted fields.
-4. Durable Task/Message/Decision context, draft activation authority, mailbox
+3. Durable Task/Message/Decision context, draft activation authority, mailbox
    claims, notification idempotence, Session replacement and exact late results.
-5. Integration/Job request identity, immutable candidate proofs, conflict
+4. Integration/Job request identity, immutable candidate proofs, conflict
    continuation, Review scope and final acceptance without fabricated delivery.
-6. Runtime/Host isolation, Provider protocol parsing and bounded retry using
+5. Runtime/Host isolation, Provider protocol parsing and bounded retry using
    fake producers, current configuration provenance and native-account boundaries.
-7. Workspace/GC authority, archive cleanup, resource CAS, telemetry, Web
+6. Workspace/GC authority, archive cleanup, resource CAS, telemetry, Web
    projections and authorized release recovery without real external effects.
-8. Idempotent per-checkout launcher installation, exact argument/Home forwarding,
+7. Idempotent per-checkout launcher installation, exact argument/Home forwarding,
    refusal to overwrite unrelated files, and rejection of removed global-link
    commands before side effects. Development Home reset retains its independent
    identity checks and backup behavior.
-9. Failure isolation for optional Controller maintenance, individual retry
+8. Failure isolation for optional Controller maintenance, individual retry
    Sessions and Task continuation observation, with scoped errors and no
    fabricated delivery, cancellation or quiescence.
 
 Keep the test phase seconds-scale and measure build separately. Use the
 existing assembled-package smoke for actual CLI/Controller/Host/tmux wiring,
-not a second daemon matrix. Converter schema fixtures preserve one frozen
-endpoint; do not reconstruct the entire historical chain in the new suite.
-Real-model or real-Home checks require explicit authorization.
+not a second daemon matrix. Do not reconstruct retired storage paths in the
+stable suite. Real-model or real-Home checks require explicit authorization.
 Current envelope checks reject arbitrary unknown fields, rather than maintaining
 a blacklist of retired field names.
 

package/docs/testing/verification-levels.zh-CN.md

@@ -36,31 +36,28 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 ## 永久 core smoke
 
 `npm test` 和 `npm run test:core` 构建当前 checkout 并运行维护中的套件。
-基线切换移除仅属于旧 v1→v37 实现的测试，源码和证据保留在冻结的 0.16.2。
-混合测试中的当前行为继续保留，例如 Review scope 和 Integration 完成边界。
+稳定套件只维护当前存储 1.0 和未来明确声明的小版本迁移，不包含任何历史
+转换实现、样本或兼容测试。
 
 当前覆盖包括：
 
 1. 新建存储 1.0、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
-2. 独立 v37 转换：原始意图、审计、计数器、嵌套 Session、不透明 Context、
-   无效输入回滚、离线备份及重复调用幂等。CLI 样本使用临时 Home，不转换真实账号；
-   转换器不进入运行 tarball。
-3. 精确版本暂存、目标不匹配拒绝、同主版本连续小版本预检、交接锁显式所有者，
+2. 精确版本暂存、目标不匹配拒绝、同主版本连续小版本预检、交接锁显式所有者，
    以及恢复时核对捕获的协议和存储身份，不接受缺失字段。
-4. 持久 Task／Message／Decision 上下文、Draft 激活权威、mailbox 认领、
+3. 持久 Task／Message／Decision 上下文、Draft 激活权威、mailbox 认领、
    通知幂等、Session 替换及精确晚到结果。
-5. Integration／Job 请求身份、冻结候选证据、冲突延续、Review scope 和最终验收。
-6. Runtime／Host 隔离、假生产者的 Provider 协议和有界重试、配置来源与账号边界。
-7. 工作区／GC 权威、归档清理、资源 CAS、telemetry、Web 投影与无真实外部效果的发布恢复。
-8. checkout 隔离启动器的幂等安装、参数与 Home 精确传递、禁止覆盖无关文件，
+4. Integration／Job 请求身份、冻结候选证据、冲突延续、Review scope 和最终验收。
+5. Runtime／Host 隔离、假生产者的 Provider 协议和有界重试、配置来源与账号边界。
+6. 工作区／GC 权威、归档清理、资源 CAS、telemetry、Web 投影与无真实外部效果的发布恢复。
+7. checkout 隔离启动器的幂等安装、参数与 Home 精确传递、禁止覆盖无关文件，
    以及已移除的全局链接命令在任何副作用前拒绝。开发 Home 重置保留独立的身份检查
    和备份行为。
-9. Controller 可选维护、各个重试 Session、Task continuation 观察的失败隔离，
+8. Controller 可选维护、各个重试 Session、Task continuation 观察的失败隔离，
    诊断包含所属对象，不伪造投递、取消或静默状态。
 
 测试阶段保持秒级，构建单独计时。真实 CLI／Controller／Host／tmux 接线复用现有
-组装包冒烟，不新增守护进程矩阵。转换样本只保留一个冻结终点，不在新套件里
-重新实现整条旧迁移链。真实模型或真实 Home 检查需要显式授权。
+组装包冒烟，不新增守护进程矩阵；稳定套件不重建任何已退役的存储路径。
+真实模型或真实 Home 检查需要显式授权。
 当前记录按声明的字段集合拒绝未知字段，不维护退役字段名称黑名单。
 
 ## Skill 与指令变更

package/i18n/README.zh-CN.md

@@ -30,9 +30,8 @@ Yui 是面向编程 Agent 的本地控制面。你只需用自然语言把目标
   Web 仅本地回环，包含只读视图和经认证的用户控制。
 - **默认隔离** —— 仓库改动发生在受管 Git worktree 中，稳定 checkout 保持只读。
 
-> **状态：** 1.0.0-alpha.1，采用纯净的存储 1.0 基线。默认更新只执行同一存储
-> 主版本内已声明的小版本升级。旧 v37 Home 需要独立的
-> [一次性转换](../docs/storage-baseline.zh-CN.md)。
+> **状态：** 1.0.0，采用纯净的存储 1.0 基线。默认更新只执行同一存储
+> 主版本内已声明的小版本升级；其他存储身份会在不修改 Home 的前提下被拒绝。
 
 [快速开始](#快速开始) · [通过对话管理工作](#通过对话管理工作) · [架构](#架构) · [设计原则](#设计原则)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "1.0.0-alpha.1",
+  "version": "1.0.1",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-operator/SKILL.md

@@ -74,13 +74,30 @@ determine Task identity. They also do not determine WorkItem count. Let
 isolated workspaces and Integration handle independent Git changes.
 
 Keep the Task title concise and put detailed intent, constraints, and evidence
-in its description or routed Message. The examples below are separate
-operations, not an automatic create/submit/activate sequence. For creation-only
-intent, save the Task without starting planning. Discussion does not authorize
-delivery; follow the Leader's [planning and activation boundary](../yui-leader/references/planning.md)
-before activation. Queries, record-only input and discussion do not authorize
-reopening. An explicit request to continue the same completed result can authorize
-the necessary reopening; follow the delivery guidance below.
+in its description or routed Message.
+
+Treat Task creation and Task submission as separate user-authorized actions.
+When the user asks only to add, create, register, or record a Task, create the
+Draft and write all known requirements into its metadata, then stop. Do not
+submit a `discuss` or `develop` Message, request activation, start a Leader
+Session, or create execution resources. A detailed or immediately actionable
+requirement, or the user's desire for its eventual completion, is not permission
+to start it. Report that the Task is a Draft and has not started, and explain
+that the user can explicitly ask to discuss/plan it or to develop/implement it.
+
+Start the corresponding route only when the user's current request contains
+that additional intent: discussion or planning authorizes `discuss`;
+development, implementation, fixing, continuing execution, or immediate
+progress authorizes `develop` or the applicable lifecycle continuation. Do not
+weaken explicit intent merely because the request also says “create a Task.”
+The examples below are separate operations, never an automatic
+create/submit/activate sequence.
+
+Discussion does not authorize delivery; follow the Leader's
+[planning and activation boundary](../yui-leader/references/planning.md) before
+activation. Queries, record-only input and discussion do not authorize
+reopening. An explicit request to continue the same completed result can
+authorize the necessary reopening; follow the delivery guidance below.
 
 ```sh
 yui operator submit "<related request and delta>" --task <task-id> --intent discuss
@@ -94,14 +111,17 @@ Inspect an existing request before creating another. `task activate <task-id>`
 can adopt an eligible request in the foreground; it never activates a Draft
 without a recorded request and environment plan.
 
-Choose the submission intent explicitly; it is never inferred from the message
-text. `discuss` (the default) routes the Draft to
-planning; `record` saves the message without waking the Leader; `develop` asks an
-unplanned Draft to activate now, and reports the exact next step when it cannot
-(already planned → request activation explicitly; execution stopped → start it first). Pass
-`--request-id <key>` to make a submission idempotent: retrying the same key
-returns the original message and routing instead of creating a duplicate, and the
-same key with different text is refused as a conflict.
+After the user has authorized a submission, choose its intent explicitly; it is
+never inferred by the CLI from the message text. `discuss` (the CLI default when
+`operator submit` is already being invoked) routes the Draft to planning;
+`record` saves the message without waking the Leader; `develop` asks an unplanned
+Draft to activate now, and reports the exact next step when it cannot (already
+planned → request activation explicitly; execution stopped → start it first).
+The CLI default is not permission for the Operator to invoke submission after a
+creation-only request. Pass `--request-id <key>` to make a submission idempotent:
+retrying the same key returns the original message and routing instead of
+creating a duplicate, and the same key with different text is refused as a
+conflict.
 
 Resolve all known Projects before repository-backed execution. A stable Project
 checkout is read-only reference state, not the Task base authority. Yui records