@zq-silk/yui 1.1.2 → 2.0.0

package/docs/managed-turn-and-session-runtime.md

@@ -41,6 +41,7 @@ automatically create Runs. Explicit dispatch loads one exact Run Context Pack.
 
 ```sh
 yui task context <task> --json
+yui task context list <task> --store <store> [--cursor <cursor>]
 yui task context delta <task> --after <coreCursor>
 yui task context inspect <task> --store <store> --ref <id>
 yui task run context <task/run> --json
@@ -52,6 +53,14 @@ Delta pages immutable events through a fixed upper bound; inspect expands a
 current record and can require an exact digest. Runtime observations state their
 own coverage and do not become another durable snapshot.
 
+Entry Context samples current facts; it is not a complete historical inventory.
+List one authorized record family, then inspect the relevant originals. Large
+details use `contentPage` and `--cursor`; concatenate all exact text chunks before
+parsing. Global `session context` likewise separates bounded pending/recent
+discovery from `role message show`. See the
+[CLI information contract](cli-information-contract.md) for budgets, scope,
+continuations and the complete-original reading protocol.
+
 Run Context freezes Assignment, source references, effective configuration and
 workspace boundaries. A Role edit does not rewrite an existing Assignment.
 Reading either Context does not acknowledge input or create execution authority.

package/docs/managed-turn-and-session-runtime.zh-CN.md

@@ -33,6 +33,7 @@ Run Context Pack。
 
 ```sh
 yui task context <task> --json
+yui task context list <task> --store <store> [--cursor <cursor>]
 yui task context delta <task> --after <coreCursor>
 yui task context inspect <task> --store <store> --ref <id>
 yui task run context <task/run> --json
@@ -43,6 +44,11 @@ Task Context 是一个有界的、获授权的工作集，带有当前 core 游
 上界内分页不可变事件；inspect 展开一条当前记录，并可要求确切摘要。运行时观察声明
 自己的覆盖范围，不会成为另一份持久快照。
 
+入口 Context 抽样当前事实，不是完整历史目录。先列出一种获授权的记录，再展开相关原文。
+长详情使用 `contentPage` 与 `--cursor`；必须拼接全部确切文本分块后再解析 JSON。
+Global `session context` 同样把有界 pending/recent 发现与 `role message show` 原文分开。
+预算、范围、续读及完整原文协议见 [CLI 信息契约](cli-information-contract.zh-CN.md)。
+
 Run Context 冻结 Assignment、来源引用、生效配置和工作区边界。一次 Role 编辑不改写
 既有 Assignment。读取任一 Context 都不确认输入或创建执行权限。每一条受管输入都指向
 确切的 Session Manifest 和 CLI 入口。Run Pack 是一个参考目录：动手前先读相关的需求

package/docs/plugin-sdk.md

@@ -87,7 +87,9 @@ changed source does not inherit an old digest's authorization. The boundaries
 around resources, network, global configuration and the core namespace are
 unchanged; when existing authority is sufficient it is not re-approved, and when a
 new permission is missing the specific gap is reported rather than impersonating
-the Operator or self-issuing a grant.
+the Operator or inventing user authorization. An original user authorization
+can support a bounded [Leader grant](../skills/yui-leader/references/authorization.md)
+without another Operator signature.
 
 On validation failure the Agent preserves the original error and judges the fix;
 an unknown or partial effect must not be auto-rerun. After using a new capability
@@ -323,8 +325,10 @@ Because trusted-local does not bound direct host effects, this grant must allow
 statement that every call actually produces an irreversible effect. `none` or
 `reversible` must not be read as unlimited local execution authority.
 
-An Operator explicitly authorized by the user uses the original grant ingress,
-for example to allow a single validation:
+An Operator explicitly authorized by the user uses the original grant ingress.
+A current delivery Leader can use that same ingress with `--source-message`,
+a verbatim `--purpose`, stable `--request-id`, expiry and finite uses, limited
+to the user's actual authorization. For example, the Operator path for a single validation:
 
 ```text
 <checkout>/output/dev/bin/yui task grant issue T --action plugin.execute --param pluginId=demo --param digest=SOURCE_SHA256 --param environmentRef=T/P --param trust=trusted-local --param phase=validate --max-uses 1 --irreversibility-ceiling irreversible

package/docs/plugin-sdk.zh-CN.md

@@ -66,7 +66,8 @@ Leader 先通过稳定 `capability search/describe` 读取当前目录和契约
 Task-local 管理权限不等于执行信任：可执行包仍逐阶段核对下面定义的精确
 `plugin.execute` grant，源码改变后不会继承旧摘要授权。资源、网络、全局
 配置及核心 namespace 的边界不变；已有授权充分时不重复批准，缺少新权限则
-报告具体缺口，不冒充 Operator 或自己签发 grant。
+报告具体缺口，不冒充 Operator 或虚构授权。原始用户授权已覆盖时，可使用
+[有界 Leader Grant](../skills/yui-leader/references/authorization.md)，无需 Operator 再次签字。
 
 验证失败由 Agent 保存原错误并判断修复；不可把 unknown／部分效果自动重跑。
 使用新增能力取得实际业务结果后，通过 `artifact.save` 将独立内容保存为文件产物
@@ -245,7 +246,9 @@ package scope 替代资源授信。因 trusted-local 不约束直接宿主效果
 必须允许 `irreversibilityCeiling: irreversible`：这是能力上限，不表示每次调用
 实际产生不可逆效果。`none/reversible` 不得解释为无限本机执行权。
 
-由获用户明确授权的 Operator 使用原 grant 入口，例如只允许一次验证：
+获明确授权的 Operator 保留原 grant 入口；当前 delivery Leader 也可使用同一入口，
+附上 `--source-message`、逐字授权引文 `--purpose`、稳定 `--request-id`、有效期及有限次数，
+范围必须来自真实用户授权。以下是 Operator 只允许一次验证的示例：
 
 ```text
 <checkout>/output/dev/bin/yui task grant issue T --action plugin.execute --param pluginId=demo --param digest=SOURCE_SHA256 --param environmentRef=T/P --param trust=trusted-local --param phase=validate --max-uses 1 --irreversibility-ceiling irreversible

package/docs/release-workflow.md

@@ -149,9 +149,12 @@ protection remain enforced.
 
 Storage upgrades are limited to the current major's explicit minor steps.
 Cross-major conversion is independently authorized and is not a runtime fallback.
-Session CLI refresh only retargets the current two-argument quoted wrapper
-named by a valid Manifest. It does not convert retired wrapper forms. Runtime
-diagnostics do not interpret `schema.json`, `state.json`, or a whole-map release
+New Sessions use the ordinary `yui` entry from their launch environment; updates
+do not generate or retarget per-Session CLI scripts. Global Context commands
+remain self-contained for remote TUI/Desktop use. Correct PATH and Home selection
+are required: protocol/storage checks do not distinguish every same-contract
+installation. Development uses an explicit isolated checkout entry.
+Runtime diagnostics do not interpret `schema.json`, `state.json`, or a whole-map release
 idempotency file; current SQLite data and per-key release receipts remain the
 authorities, and unrelated files are left untouched.
 
@@ -275,18 +278,25 @@ grouped by Role/AgentRun, and process owners use PID/start identity. Storage
 changes follow the [single explicit upgrade boundary](sqlite-control-plane-design.md);
 ordinary commands never rewrite the Home schema.
 
-Grant issue and revoke are irreversible-authority operations. They require
+Operator grant issue and revoke retain their existing authority. They require
 the current registered global Operator conversation. Its native session ID
 must match the durable live session binding: Codex commands use `CODEX_THREAD_ID`
 when present, otherwise `YUI_NATIVE_SESSION_ID`; Claude uses `YUI_NATIVE_SESSION_ID`.
 Host generation and launch-time Agent labels are not caller identity. Resuming
 the same conversation through another entry point does not revoke its authority.
 An unregistered, replaced, or ended conversation has no such authority.
-A managed Task Agent cannot self-issue or
-self-revoke a grant, and clearing the child-process environment does not
-confer user authority. The recorded granter/revoker is bound to that
-Operator session (`operator:<agent-id>`); there is no `--granter`/`--by`
-label to spoof.
+A current delivery Leader can instead issue finite, expiring grants for its own
+Task from an original user/Operator Message, using `--source-message`,
+`--purpose` (a verbatim authorization quotation), and `--request-id`. It must
+choose only the actions actually authorized by that source. Source validation
+is not natural-language approval; development intent is not publication intent.
+Release scope requires Task Projects and their repositories; package/version
+effects also need explicit package/version bounds. Global update, Controller
+replacement and migration remain Operator-only. The Leader may revoke only
+Leader-issued grants in its Task. Empty environments, Worker/Reviewer or
+planning/replaced Sessions confer no such authority. Granter/revoker attribution
+comes from the current Session; there is no `--granter`/`--by` label to spoof.
+See the [complete source/ordinary archive contract](../skills/yui-leader/references/authorization.md).
 
 ```sh
 # 1. The Operator session issues the authority for the release chain.

package/docs/release-workflow.zh-CN.md

@@ -113,8 +113,10 @@ Controller RPC 版本 1。Host 不打开 Home 数据库，包括进程归属、
 
 存储升级仅包含同主版本内明确的小版本步骤。跨主版本转换独立授权，
 不构成运行时回退。
-Session CLI 刷新只重定位有效 Manifest 指向的当前双参数引号 wrapper，不转换
-退役形态。运行时诊断不解释 `schema.json`、`state.json` 或整表 release 幂等文件；
+新 Session 使用启动环境中的普通 `yui` 入口；升级不生成或重定向会话 CLI 脚本。
+Global Context 命令保持自足，供远端 TUI/Desktop 使用。必须正确选择 PATH 和 Home：
+协议及存储校验不能区分所有同合约安装；开发使用显式隔离的 checkout 入口。
+运行时诊断不解释 `schema.json`、`state.json` 或整表 release 幂等文件；
 当前 SQLite 与逐 key release 回执仍是权威，无关文件保持原样。
 
 `task role status`、`task role list` 和 `task role session inspect` 在持久 Run 状态旁
@@ -209,14 +211,19 @@ Session 权威依据当前持久绑定检查。Telemetry 按 Role/AgentRun 分
 PID/start 身份。存储变更遵循[唯一的显式升级边界](sqlite-control-plane-design.zh-CN.md);
 普通命令绝不改写 Home schema。
 
-grant 的签发与撤销是不可逆权威操作。它们需要当前已登记的全局 Operator 对话。它的
+Operator 的 grant 签发与撤销保留现有权威边界，需要当前已登记的全局 Operator 对话。它的
 原生 session ID 必须与持久的活动 session 绑定匹配：Codex 命令在存在时使用
 `CODEX_THREAD_ID`，否则使用 `YUI_NATIVE_SESSION_ID`;Claude 使用 `YUI_NATIVE_SESSION_ID`。
 Host generation 和启动时的 Agent 标签不是调用者身份。通过另一个入口恢复同一段对话
-不撤销其权威。一个未登记、被替换或已结束的对话没有这种权威。一个受管的 Task Agent
-不能自签发或自撤销 grant，清空子进程环境也不赋予用户权威。被记录的授权者/撤销者
-绑定到那个 Operator session（`operator:<agent-id>`）；不存在可伪造的 `--granter`/`--by`
-标签。
+不撤销其权威。未登记、被替换或已结束的对话没有这种权威。
+本 Task 当前 delivery Leader 也可引用真实用户/Operator 原消息，以
+`--source-message`、`--purpose`（逐字授权引文）、`--request-id` 签发有有效期及有限次数的
+有界 Grant，并撤销本 Task 的 Leader Grant。语义判断仍由 Agent 负责：引文匹配只是来源
+验证，开发指令不是发布许可。发布必须限定 Task Project/repository，包与版本操作另须明确
+package/version 边界；全局升级、共享 Controller 替换、迁移仍不开放。
+Worker/Reviewer、规划/失效 Session 和清空环境不获得授权；身份来自当前持久 Session，
+不存在可伪造的 `--granter`/`--by` 标签。参见
+[完整来源与普通归档契约](../skills/yui-leader/references/authorization.md)。
 
 ```sh
 # 1. Operator session 为发布链签发权威。

package/docs/storage-baseline.md

@@ -2,6 +2,11 @@
 
 # Storage baseline 1.0
 
+Current storage is 1.2. The declared 1.1 → 1.2 transition adds optional
+CapabilityGrant authorization-source evidence and native-human input/archive
+audit records. Existing valid Operator grants remain unchanged; migration does
+not infer or invent past user authority. The SQL layout is unchanged.
+
 Yui 1.0.0 starts from one clean persistent contract. The package version,
 storage schema, record envelopes and Controller protocol are separate
 identities; none is inferred from another.

package/docs/testing/verification-levels.md

@@ -50,12 +50,12 @@ is required.
 ## Permanent core smoke
 
 `npm test` and `npm run test:core` build the checkout and run the maintained suite.
-The stable suite owns current storage 1.1 and its declared 1.0 minor
+The stable suite owns current storage 1.2 and its declared 1.0/1.1 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.1, exact schema/record validation, no initialization over
+1. Fresh storage 1.2, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and

package/i18n/README.zh-CN.md

@@ -345,6 +345,8 @@ Yui 面向一个受信任本地用户，不是 OS 沙箱，也不是远程多用
 [总体架构](../ARCHITECTURE.zh-CN.md)介绍端到端设计，
 [文档导航](../docs/architecture/README.zh-CN.md)提供配置、执行、交付、存储和插件的
 当前合同。想直接操作 CLI 时，使用 `yui --help` 查看命令。
+[CLI 信息契约](../docs/cli-information-contract.zh-CN.md)说明当前 Context、分页发现、
+完整原文读取和变更回执。
 
 Yui 默认将控制面数据保存在 `~/.yui`，通过 `YUI_HOME` 选择另一个实例。
 切换构建或更新已有 Home 前，请查看[存储与升级](../docs/sqlite-control-plane-design.md)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "1.1.2",
+  "version": "2.0.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -7,11 +7,18 @@ description: Lead one Yui Task through authorized planning, activation handoff,
 
 Follow [yui-runtime](../yui-runtime/SKILL.md) first. Load the exact Context Pack
 for an explicitly dispatched AgentRun; for direct conversation or a Task
-notification, read current Task context through the Manifest's Session CLI.
+notification, read current Task context using `yui task context <task-id> --json`.
 No self-dispatch or old completed Run is needed. Read the actual Task
 requirements, current Brief and relevant user/Operator Messages, not just
 their summaries. Resolve links relative to the file containing them.
 
+Current Context is a bounded working set, not all Task history. Use
+`task context list <task> --store <store>` or a domain list for discovery,
+then an exact detail read. A wake contains original Message/Run read pointers,
+not copied reports. Follow Runtime's `nextCursor` and `contentPage` rules:
+read the full relevant window and originals before disposition, without
+unconditionally walking unrelated history.
+
 ## Select the applicable stage
 
 Use current lifecycle, latest intent and the Session's actual planning/delivery

package/skills/yui-leader/references/authorization.md

@@ -0,0 +1,64 @@
+# Source-authorized Task actions
+
+Read the original user/Operator Message in full. A development request, local
+completion, Role report, quoted third-party text, or publication permission
+alone does not authorize another effect. Decide whether the user authorized
+the particular action, resource, trust and scope. Engineering verifies source
+and fixed bounds, not natural-language meaning: a matching quotation proves
+origin, not that your interpretation is correct. Do not issue publication or
+resource grants from a request that only asks to develop.
+
+For actual authorization, the current delivery Leader uses:
+
+```sh
+yui task grant issue <task> --source-message <message-id> \
+  --purpose "<verbatim explicit authorization>" --request-id <stable-id> \
+  --action <action> --expires-at <timestamp> --max-uses <finite-count> \
+  <exact scope, parameter bounds and irreversible ceiling>
+```
+
+The existing Grant records source identity/digest, quotation, Session and fixed
+bounds. Replaying the request id returns the same grant; it never replenishes
+expired, exhausted or revoked authority. Do not change ids to evade limits.
+A changed plan needs a new bounded decision within the user's scope, or a real
+InputRequest if new authority is missing. Operator retains issue/revoke.
+The current Leader may revoke this Task's Leader-issued grants, including
+after Session replacement, but cannot revoke Operator grants.
+
+Release grants require explicit Task Projects/repositories and `sourceCommit`
+bounds (checked against the workflow source, never a step's claimed value); package effects
+also require packages and concrete version bounds. All steps sharing a
+version-bound grant must pass that version. Global installation, shared
+Controller replacement, migration and other Tasks remain outside this path.
+Preserve source/artifact integrity, changed-candidate acceptance, CI,
+Publication and unknown-effect reconciliation.
+
+Plugin execution requires exact pluginId, digest, environmentRef, trust and
+phase. Directory grants require the resourceId, canonical path and read/write
+action. An explicitly authorized unregistered directory can be registered with
+`resource.local.register` using `sourceMessage` and a verbatim `purpose`;
+registration grants no access or Project configuration authority. Then use the
+existing prepare/adopt/bind/release operations. A Home, stable Project or
+managed workspace cannot be registered through this Leader path.
+
+Human input through the Host's human-owned console is persisted before the
+Provider write. Read that original Message. Provider-visible userMessage items
+alone cannot prove human authorship: managed prompts use them too. Never
+transcribe unproven input into a Role report and call it user authority. Use
+the authenticated user input surface when transport provenance is unavailable.
+
+For an explicitly authorized ordinary archive, first save acceptance/delivery
+evidence and complete the Task:
+
+```sh
+yui task archive <task> --integrated --source-message <message-id> \
+  --purpose "<verbatim archive authorization>" --request-id <stable-id>
+```
+
+This single Controller operation checks settlement, delivery and clean
+workspaces, records the source, stops the requesting Leader and applies normal
+cleanup/archive checks. The conversation can end before the CLI response.
+Inspect `task.leader-archive-started`, `task.leader-archive-result`,
+`task.archived` and cleanup receipts. A started operation without a result is
+uncertain; inspect its effects before recovery, never replay with a new id.
+No automatic retry, force or abandonment authority is implied.

package/skills/yui-leader/references/execution.md

@@ -22,6 +22,17 @@ implementation patterns, scheduling options, review routing, or recoverable
 runtime actions. Create an InputRequest only for a real product choice, new
 authority, irreversible external effect, or unavailable external fact.
 
+Task Messages and the Brief are durable records, not delivery receipts to the
+Operator. For a genuinely missing user choice, resource, credential or scope,
+use `task input request`; the Controller notifies the Operator through the
+existing durable notification path with references to the original records.
+Completion and existing blocked-work notifications use that same path. Do not
+invent an InputRequest just to announce progress or ask again for authority
+already granted. A failed global input call does not mean Task notifications
+are broken: a Task Leader must not call global `role message queue`, `steer`
+or `role interrupt`, impersonate Operator, or clear identity environment
+variables to bypass that boundary.
+
 ## Separate the work unit, executor, and concurrency
 
 Honor the user's explicit choice of direct work or delegation. Otherwise make
@@ -286,8 +297,9 @@ Use `capability search`, `describe`, and `call` to inspect current tools.
 Prefer existing tools, composition or a one-off script when sufficient.
 For reusable Task-local capabilities, read [Task plugins](task-plugins.md)
 before creation, validation or activation. Plugin management permission does
-not grant code execution or broader external effects. Never issue your own
-grants, impersonate Operator, or modify the core installation to obtain a tool.
+not grant code execution or broader external effects. Use
+[source-authorized capabilities](authorization.md) for existing explicit user
+authority. Never invent authorization, impersonate Operator, or modify the core installation to obtain a tool.
 
 ## Validate and make the review judgment
 
@@ -369,7 +381,9 @@ after its final report. Cleanup can remain advisory at completion. Ordinary
 archive requires settled resources; explicitly authorized force archive preserves
 unresolved resources and diagnostics under the shared
 [archive contract](../../yui-runtime/references/publication.md). The Leader
-does not gain independent archive authorization.
+does not gain independent archive authorization. An original explicit user
+archive request can authorize the Controller-owned ordinary archive described
+in [source-authorized capabilities](authorization.md).
 
 Complete only when the Task outcome is satisfied, required checks and review
 contracts are settled, WorkItems are accepted or deliberately retired, latest
@@ -381,7 +395,7 @@ yui task complete <task-id> \
 ```
 
 Completion records the exact Project heads. Archive is a separate,
-user-authorized Operator action.
+user-authorized action, never an implication of completion or publication.
 
 Completion is offline by default. `--refresh-remote` only refreshes remote
 freshness observations; neither path rebases or starts Integration checks.

package/skills/yui-leader/references/task-plugins.md

@@ -1,7 +1,7 @@
 # Task-local capabilities
 
 Read this before creating, validating or activating a Task-local plugin.
-Use the stable Session CLI's capability directory and read the exact schema
+Use the `yui` CLI's capability directory and read the exact schema
 before each unfamiliar operation. Prefer an existing tool, composition or
 one-off script unless a reusable named capability is useful.
 
@@ -17,7 +17,9 @@ the exact plugin id, digest, environment, trust and phase, within its remaining
 uses and validity. A source change cannot inherit an old digest's grant.
 Trusted-local subprocesses are not an OS sandbox.
 
-Never issue your own grants, impersonate Operator, change global configuration,
+Use [source-authorized capabilities](authorization.md) when original user input
+already authorizes the exact Task plugin/resource. Never invent grants,
+impersonate Operator, change global configuration,
 or modify the core installation, namespace or carrying Endpoint to obtain a
 tool. Request only a genuinely missing resource or trust boundary, not authority
 already available. Plugin grants do not authorize unrelated external effects.

package/skills/yui-operator/SKILL.md

@@ -227,8 +227,15 @@ a dormant Role and verify the complete binding before the next launch.
 
 ## Present current progress
 
-Use JSON reads and their top-level `data` field. Report the facts needed to
-understand the outcome:
+Use JSON reads and their top-level `data` field.
+Use Global Context's `pending`/`recent` pages to find Messages, then
+`role message show operator <id>` for the original. A successful send receipt
+contains saved identity and delivery/control facts, not another copy of the
+submitted body. Follow Runtime's bounded-read contract for list continuations
+and long `contentPage` details; do not decode `output` as nested JSON or print
+an entire Context again merely to extract one already-returned reference.
+
+Report the facts needed to understand the outcome:
 
 - Task ID, Projects, recorded bases, and lifecycle;
 - current WorkItems, ownership, dependencies, and acceptance state;

package/skills/yui-runtime/SKILL.md

@@ -17,8 +17,8 @@ workspace layout, native transcript, or an earlier AgentRun.
 ## Enter through the current context
 
 There are two normal Task entry points. A user may continue directly with the
-current, unrevoked Leader Session: read current context using the Session CLI
-with `task context <task-id> --json`. Do not request a self-wake, reopen a Task,
+current, unrevoked Leader Session: read current context using
+`yui task context <task-id> --json`. Do not request a self-wake, reopen a Task,
 or reuse an old completed AgentRun snapshot merely to obtain authority. Pending
 delivery, unknown execution evidence and missing reports do not themselves
 revoke Session authority. Task lifecycle, scope, Assignment, workspace and
@@ -27,26 +27,35 @@ authority merely because the Task becomes active.
 Use the runtime-provided `TMPDIR` for temporary context or diagnostic files,
 not fixed shared `/tmp` names or the logical multi-Project workspace container.
 
+Ordinary commands use `yui` from the intended launch environment's PATH and
+`YUI_HOME`. Session/native identity, Task/Assignment/workspace authority and
+Controller protocol/storage checks still apply; they do not distinguish every
+installation with the same protocol and storage versions. If the entry or Home
+is wrong or unavailable, report that fact and use the explicitly authorized
+entry/environment; do not guess another installation or clear Session identity.
+
 For every explicitly dispatched managed Task AgentRun:
 
 1. Read the exact AgentRun identity from the newest Bootstrap Envelope.
-2. Before acting, load its authorized pack with the Session CLI named by the
-   current Session Manifest:
+2. Before acting, load its authorized pack using the current Session Manifest's
+   Context command and the exact Task/Run identity:
 
    ```sh
-   "$YUI_SESSION_CLI" task run context "$YUI_TASK_ID/<run-id>" --json
+   yui task run context "<task-id>/<run-id>" --json
    ```
 
 3. Verify that the returned Task, AgentRun, Role, purpose, Snapshot digest, workspace,
    and Adapter match the Envelope and Session Manifest. Stop and report a
    context-load failure if the pack is missing, stale, unauthorized, malformed,
    or mismatched. Never request an inline/full-prompt fallback.
-4. Use pack summaries and pointers first. Expand only an authorized ref when
+4. Use the pack's `pointers` (including each pointer's summary) first. They are
+   the single readable-ref inventory; `deltaRefs` contains only changed identities.
+   Expand only an authorized ref when
    its full value is needed, selecting it by the pointer's exact `store` and
    `refId`:
 
    ```sh
-   "$YUI_SESSION_CLI" task run context expand "$YUI_TASK_ID/<run-id>" <ref-id> --store <store> --mode full --json
+   yui task run context expand "<task-id>/<run-id>" <ref-id> --store <store> --mode full --json
    ```
 
    `--store` is required, even when the ref id is unique. Select both fields
@@ -119,14 +128,47 @@ TUI, with the configured Agent, permissions and workspace unchanged. A live
 unmanaged Session is not silently replaced or adopted; use an explicit Session
 lifecycle action before enabling controlled delivery.
 
-Context reads never consume queue entries. Read the referenced Message in full
-from Session Context. Native/transport acceptance is not implementation, and
+Context reads never consume queue entries. Global Context returns bounded
+`pending` and `recent` discovery pages, not Message bodies. Read a referenced
+original with `role message show <role> <message-id> --json`. Follow a pending
+page's `nextCursor` using `role message list <role> --pending --cursor <cursor>`
+when it is incomplete; accepted delivery does not erase the Message from the
+separate all-message list. Native/transport acceptance is not implementation, and
 `interrupt-requested` is not a stopped Turn or stopped background resources.
+Saving a Task Message or Brief is not notification delivery to Operator. A
+Task Role uses the existing Task InputRequest path for a genuinely missing
+user decision, not global Role input controls or fabricated progress questions.
 Only an exact terminal and the original Session/writer boundary can release a
 then handoff. An accepted or unconfirmed steer must not be submitted again by
 changing its request id or composing then. A conclusive rejection permits an
 explicit new control attempt; uncertainty does not.
 
+## Read bounded information completely when required
+
+Structured CLI results live in the top-level `data`, not a JSON-encoded
+`output` string. Task current Context includes bounded current facts and
+message references; it does not include event or terminal Run history.
+`collections` and `attention` identify incomplete discovery. Use
+`task context list <task> --store <store> [--cursor <cursor>]` to discover one
+family, then `task context inspect <task> --store <store> --ref <refId>
+--digest <digest>` to read its exact current value. Common Task lists use the
+same `items`, `total`, `complete`, and `nextCursor` contract. Do not treat the
+first page or a summary as complete requirements.
+
+Long detail reads return `contentPage` instead of the ordinary value (under
+`data.context` for Run context/expand, `data.contextDelta` for Run Context delta). Repeat the same read with
+`--cursor <contentPage.nextCursor>` until `complete: true`. Concatenate `text`
+in offset order and parse the combined JSON once, retaining the same source
+and digest. A source-change error requires a fresh read, not mixing old and
+new chunks. Never use a read cursor to repeat a mutation.
+
+Read all pages of a relevant original requirement, result, or authorization
+before acting on it. For a wake, read its complete fixed window and the
+referenced original Messages; the wake itself contains pointers, not reports.
+For unrelated discovery, stop once the necessary evidence is found. Task
+event deltas retain their fixed upper bound and are history, not replacement
+current state. No read acknowledges implementation or consumes a queue.
+
 ## Preserve intent and authority
 
 An analysis, diagnosis, or review request is read-only unless the user also

package/skills/yui-runtime/references/publication.md

@@ -87,7 +87,9 @@ is not Candidate acceptance, Review, Integration or Task completion.
 
 ## Archive separately
 
-Completion does not authorize archive. The Operator obtains authorization for
+Completion does not authorize archive. A delivery Leader with original user
+authorization may use [ordinary archive](../../yui-leader/references/authorization.md);
+this grants no force or abandonment authority. Otherwise the Operator obtains authorization for
 the exact Task, checks archive eligibility, then uses `--integrated` for verified
 merged delivery or `--abandon` for deliberate non-delivery. General archive
 approval never implies `--force` authority. Preserve the Task record.