@zq-silk/yui 2.15.0 → 2.17.0

package/dist/web/assets/styles/views/terminal.js

@@ -1,7 +1,7 @@
 import { DEFAULT_DARK_THEME } from "../../shared/themes.js";
 const SESSION_TONES = DEFAULT_DARK_THEME.tokens;
 /*
- * TERMINAL VIEW — the Live session pane. It renders a native terminal, so it
+ * TERMINAL VIEW — the session page's terminal mode. It renders a native terminal, so it
  * stays dark in every theme: its chrome uses a scoped palette (white alphas
  * and the default dark theme's status colours) instead of theme tokens.
  */
@@ -9,16 +9,18 @@ export const TERMINAL_STYLES = `
 .dock-session{background:var(--term-bg);color:#e6e6e8;--chrome-line:rgba(255,255,255,.07);--chrome-ok:${SESSION_TONES.ok};--chrome-info:${SESSION_TONES.info};--chrome-bad:${SESSION_TONES.bad}}
 .dock-session .faint{color:rgba(255,255,255,.4)}
 
-/* Target bar: one chip per attachable Role, then the connection state */
+/* Header row: the selected Session, the connection state, the mode switch */
 .session-bar{flex:none;display:flex;align-items:center;gap:8px;min-height:44px;padding:6px 10px;border-bottom:1px solid var(--chrome-line)}
-.session-targets{display:flex;gap:4px;flex:1;min-width:0;overflow-x:auto;scrollbar-width:none}
-.target-chip{display:inline-flex;align-items:center;gap:6px;flex:none;height:26px;padding:0 10px;border:1px solid rgba(255,255,255,.12);border-radius:var(--r-pill);background:transparent;color:rgba(255,255,255,.72);font-size:var(--fs-xs);font-weight:500}
-.target-chip:hover{color:#fff;border-color:rgba(255,255,255,.3)}
-.target-chip[aria-pressed="true"]{background:rgba(255,255,255,.12);border-color:rgba(255,255,255,.3);color:#fff}
-.target-chip .dot{width:7px;height:7px;box-shadow:none}
+.session-bar .spacer{flex:1 1 0;min-width:0}
+.sp-term-icon{width:14px;height:14px;flex:none;color:rgba(255,255,255,.45)}
+.sp-term-name{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:#fff;font-size:var(--fs-sm);font-weight:600}
+.dock-session .sp-modes{background:rgba(255,255,255,.06);border-color:rgba(255,255,255,.1)}
+.dock-session .sp-modes .seg-btn{color:rgba(255,255,255,.62)}
+.dock-session .sp-modes .seg-btn:hover{color:#fff}
+.dock-session .sp-modes .seg-btn[aria-checked="true"]{background:rgba(255,255,255,.14);color:#fff;box-shadow:none}
 .conn{display:inline-flex;align-items:center;gap:6px;flex:none;color:rgba(255,255,255,.6);font-size:var(--fs-xs);font-weight:500}
 .conn i{width:7px;height:7px;border-radius:50%;background:rgba(255,255,255,.3)}
-.conn[data-state="connecting"] i{background:var(--warn);animation:blink 1s infinite}
+.conn[data-state="connecting"] i{background:var(--warn);animation:m-blink 1s infinite}
 .conn[data-state="writable"] i{background:var(--chrome-ok);box-shadow:0 0 0 3px rgba(79,209,139,.2)}
 .conn[data-state="readonly"] i{background:var(--chrome-info)}
 .conn[data-state="error"] i{background:var(--chrome-bad)}
@@ -33,6 +35,8 @@ export const TERMINAL_STYLES = `
 .terminal-empty .icon{color:rgba(255,255,255,.35)}
 .terminal-empty-title{color:#fff;font-weight:600}
 .terminal-empty-text{max-width:300px;font-size:var(--fs-xs);line-height:1.5}
+.terminal-empty[hidden]{display:none}
+.terminal-empty .btn{margin-top:4px}
 .session-foot{flex:none;display:flex;align-items:center;gap:8px;padding:8px 12px;border-top:1px solid var(--chrome-line);color:rgba(255,255,255,.45);font-size:var(--fs-2xs)}
-.session-foot code{color:rgba(255,255,255,.8);user-select:all}
+.session-foot code{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:rgba(255,255,255,.8);user-select:all}
 `;

package/dist/web/webConversation.js

@@ -91,6 +91,7 @@ export function conversationSessions(set) {
         endReason: session.endReason, createdAt: session.createdAt,
         executionAuthority: session.effective.executionAuthority,
         launchModel: session.effective.model ?? null,
+        launchEffort: session.effective.effort ?? null,
         current: set.sessions[set.activeAgentId] === session,
         conversationEpoch: set.providerBinding?.conversations.find(c => c.conversationId === session.nativeSessionId)?.epoch ?? null }));
 }

package/dist/web/webSettings.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { isEnabled } from "../role/availability.js";
 import { CONFIG_DOMAINS, configDefinitionsForDomain } from "../config/configCatalog.js";
 import { effectiveConfigData, runConfigCommand } from "../commands/configCommands.js";
 import { runAgentCommand } from "../commands/agentCommands.js";
@@ -9,8 +10,8 @@ import { staticAgentConfigurationFields } from "../executor/agentConfigurationFi
 import { validateAgentLaunchConfiguration } from "../executor/agentConfigurationCatalog.js";
 import { resolveAgentProfileView } from "../profile/agentProfileRuntime.js";
 import { webLocalMutation, WebRequestRejected } from "./webMutation.js";
-const ROLE_NOTICE = "Saved desired configuration applies to a subsequent Role launch, not the current Session. Existing Task bindings are unchanged. No Session is restarted here.";
-const PROFILE_NOTICE = "Profile behavior is copied into newly created Task Roles. Inherited runtime resolves from the global Worker when applied. Existing Task Roles are not rebound.";
+const ROLE_NOTICE = "Disabling blocks new execution and template selection, without stopping running Sessions or discarding input. Enable allows normal scheduling, not an immediate Session start. Existing Task bindings are unchanged. Launch settings apply to a subsequent launch; no Session is restarted here.";
+const PROFILE_NOTICE = "Disabling prevents new Profile application. A Profile is a template, not a process. Existing Task Roles are not rebound or stopped. Inherited runtime requires an enabled global Worker when applied. Reset preserves enabled state.";
 const AGENT_NOTICE = "Command, arguments and environment references apply to subsequent Host processes. Authentication remains with the native Agent. Only reference names and presence in the Controller environment are shown; no environment values are returned.";
 /** A view adapter over existing commands, not another writable configuration store. */
 export function createWebSettings(store, options) {
@@ -84,6 +85,7 @@ export function createWebSettings(store, options) {
             notice = ROLE_NOTICE;
             const specs = roleOptionSpecs({ update: true, includeWorkspace: true });
             fields = [
+                { ...field("enabled", isEnabled(role), "boolean"), summary: ROLE_NOTICE },
                 { ...field("activeAgentId", role.activeAgentId), choices: store.listConfiguredAgents().map(a => a.id),
                     summary: "Explicit global Role Agent selection. Save this field alone, then edit the selected Agent's settings. Existing live-session and lifecycle guards apply; no Task is rebound." },
                 field("workspace", role.workspace),
@@ -109,6 +111,7 @@ export function createWebSettings(store, options) {
             notice = PROFILE_NOTICE;
             agentId = view.runtime.status === "resolved" ? view.runtime.binding.agentId : undefined;
             fields = [
+                { ...field("enabled", isEnabled(profile), "boolean"), summary: PROFILE_NOTICE },
                 { ...field("access", profile.defaultAccess), choices: ["read", "write"] },
                 { ...field("description", profile.description ?? "", "multiline"), reset: true },
                 { ...field("instructions", profile.instructions ?? "", "multiline"), reset: true },
@@ -287,6 +290,11 @@ function objectArguments(id, changes) {
     if (CONFIG_DOMAINS.includes(id))
         return [];
     return changes.flatMap(c => {
+        if ((id.startsWith("role/") || id.startsWith("profile/")) && c.key === "enabled") {
+            if (typeof c.value !== "boolean")
+                throw new WebRequestRejected("Enabled must be a boolean.");
+            return ["--enabled", String(c.value)];
+        }
         if (id.startsWith("role/") && c.key === "activeAgentId")
             return [];
         if (id.startsWith("agent/")) {

package/docs/managed-turn-and-session-runtime.md

@@ -526,6 +526,16 @@ conversation unrecoverable. The request is legal while an AgentRun is active,
 the Session is ended, or previous cleanup is pending. A Leader may also request
 its own replacement and end its current turn.
 
+For a Draft Leader whose planning Run has already ended, the replacement
+initialization notification admits the selected fresh Session after confirmed
+cleanup. It does not create another business Run, activate the Task, or adopt a
+delivery workspace: the successor retains planning-only authority and reads
+current Task context and retained inbox originals before handling them. Ordinary
+Draft notifications and unscoped native hooks cannot use this admission.
+A rejected startup retains the notification for explicit `task wake retry`
+after correction, or another legal Session replacement; unknown input acceptance
+never becomes permission to replay.
+
 `task role session stop` can also stop a running Role without first changing
 its Run status. It retains the native conversation for possible reuse. Pending
 Messages remain intent and may start a continuation after the stop; use Task

package/docs/managed-turn-and-session-runtime.zh-CN.md

@@ -400,6 +400,12 @@ Run 的普通 Leader 通知。未知的原生状态阻塞清理；仅停止一
 一种偏好，而不是要求证明旧对话不可恢复。该请求在 AgentRun 活动、Session 已结束或
 上一次清理待处理时都是合法的。Leader 也可以请求替换自己并结束当前轮次。
 
+对于 planning Run 已结束的 Draft Leader，替换初始化通知在确认清理后允许所选的新
+Session 登记。它不会新增业务 Run、激活 Task 或接纳 delivery 工作区；后继仍只有
+planning 权限，先读取当前 Task 上下文和保留的信箱原文，再处理输入。普通 Draft 通知
+和无启动范围的原生 hook 不能借用此准入。启动被拒绝时保留通知，修正原因后可显式
+`task wake retry`，或再次合法替换 Session；接受状态未知的输入始终不能据此重放。
+
 `task role session stop` 也可以在不先更改 Run 状态的情况下停止一个运行中的 Role。它
 保留原生对话以备复用。待处理的 Message 仍是意图，可以在停止后启动一次 continuation；
 当整个 Task 都必须保持暂停时，使用 Task execution stop。对于自我替换，使用异步的

package/docs/release-workflow.md

@@ -51,6 +51,52 @@ merely to avoid a version decision. Package versions remain distinct from protoc
 and persistent-storage contracts: their compatibility checks and required migrations
 are unchanged, and the storage rules below do not authorize a package release.
 
+### 2.17.0 compatibility and migration notes
+
+This minor adds persistent Role/Profile enable and disable controls in CLI and
+Web settings. Use `yui config role enable|disable`, `yui config profile
+enable|disable`, and `yui task role enable|disable` with the relevant identity.
+Disabled templates cannot be selected for new bindings; existing Task Role
+copies remain independent. Disabling a Role prevents new execution and pauses
+eligible pending work; it does not kill a running Turn, discard pending input,
+block exact terminal recording or erase inspection/claim/acknowledgement access.
+Re-enabling resumes eligible work under its existing authority and retry budgets,
+without replaying accepted or unknown input.
+
+Storage advances from **1.21 to 1.22** through the centralized additive migration
+for optional `enabled` fields. Existing records without the field remain enabled;
+their historical payloads are preserved. With separate upgrade authorization,
+use `yui update --version 2.17.0`; the updater owns preflight, backup, migration
+and Controller handover. Do not open the upgraded Home with an older binary.
+
+The release also includes the merged Draft planning Session replacement repair
+and stronger behavioral-constraint/real-path review handoffs. Validation uses
+deterministic tests and the exact-tarball fresh-install matrix, not real-model
+behavior. Publishing does not update the global CLI, migrate a production Home,
+restart its Controller or deploy a production Web listener.
+
+### 2.16.0 compatibility and migration notes
+
+This minor refreshes the Web workbench (PR #484). One global navigation rail
+(Workbench / Models / Settings) is shared by the workbench and management pages,
+and the task sidebar can be collapsed. Dialogs, menus, presses and column layout
+changes use one motion source; reduced-motion preferences, narrow layouts and
+hidden documents get instant updates. The 「結」 brand glyph is replaced by a
+vector capital-Y mark drawn from the active theme's tokens, and each theme has a
+matching SVG favicon that follows theme switches.
+
+These are presentation changes only. Web APIs, sign-in sessions, `--auth-file`,
+CLI commands and Controller/Host protocols are unchanged. Scripts or browser
+automation that matched the old brand glyph or previous navigation markup must
+use the current page structure. Storage remains **1.21**; there is no migration.
+
+With separate upgrade authorization, use `yui update --version 2.16.0`; the
+updater owns preflight, backup and Controller handover. A running Web listener
+serves the new assets after it is restarted. Release gates reuse exact-commit
+Core CI and the existing fresh-install matrix (Linux x64, macOS x64/arm64,
+Node 20/22/24/26). Publishing does not update the global CLI, migrate a
+production Home, restart its Controller or deploy a production Web listener.
+
 ### 2.15.0 compatibility and migration notes
 
 This minor replaces the browser's HTTP Basic prompt with a standalone English/

package/docs/release-workflow.zh-CN.md

@@ -36,6 +36,40 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 不能将不兼容冒称为兼容，也不为回避版本选择新增历史兼容机制。包版本与协议、
 持久存储契约仍然独立：兼容性检查和必要迁移要求不变，下文存储规则不授予发版权限。
 
+### 2.17.0 兼容性及迁移说明
+
+本 minor 在 CLI 和 Web 设置中新增持久化的 Role/Profile 启用、停用控制。
+可使用 `yui config role enable|disable`、`yui config profile enable|disable`
+及 `yui task role enable|disable`，并指定对应身份。停用的模板不可用于新绑定；
+已复制到 Task 的 Role 保持独立。停用 Role 会阻止新的执行并暂停符合条件的待执行工作，
+但不杀死正在运行的 Turn、不丢弃待处理输入、不阻止精确终态补录，也不移除查看、
+claim 和 ACK 权限。重新启用后，符合条件的工作按原有权限和重试预算继续，
+不会重放已接受或结果未知的输入。
+
+存储通过集中式增量迁移从 **1.21 升至 1.22**，加入可选的 `enabled` 字段。
+没有该字段的已有记录仍视为启用，历史载荷保持不变。另行获得升级授权后，可使用
+`yui update --version 2.17.0`；updater 负责预检、备份、迁移与 Controller 交接。
+不得使用旧二进制打开升级后的 Home。
+
+本次发布还包含已合入的 Draft 规划 Session 替换修复，以及强化行为约束和真实调用路径的
+审查交接说明。验证依据为确定性测试与精确 tarball 的全新安装矩阵，不代表真实模型行为验证。
+发布本身不会更新全局 CLI、迁移生产 Home、重启其 Controller 或部署生产 Web listener。
+
+### 2.16.0 兼容性及迁移说明
+
+本 minor 更新 Web 工作台（PR #484）：工作台与管理页共用一条全局导航栏
+（工作台 / 模型 / 设置），任务侧栏可折叠。弹窗、菜单、按压与分栏布局变化使用统一动效来源；
+开启减少动态效果、窄屏布局或页面不可见时直接更新。品牌标志由「結」改为矢量大写 Y，
+颜色取自当前主题令牌；每个主题配有对应的 SVG favicon，随主题切换。
+
+以上仅为界面变化。Web API、登录会话、`--auth-file`、CLI 命令以及 Controller/Host 协议均不变。
+依赖旧品牌字形或旧导航结构的脚本、浏览器自动化需改用当前页面结构。存储仍为 **1.21**，无迁移。
+
+另行获得升级授权后，使用 `yui update --version 2.16.0`；更新器负责预检、备份与 Controller 交接。
+正在运行的 Web 监听器需重启后才会提供新资源。发布门禁复用同一提交的 Core CI 与既有全新安装矩阵
+（Linux x64、macOS x64/arm64，Node 20/22/24/26）。发布不会更新全局 CLI、迁移生产 Home、
+重启其 Controller 或部署生产 Web 监听器。
+
 ### 2.15.0 兼容性及迁移说明
 
 本 minor 以独立中英文登录页替代浏览器 HTTP Basic 弹窗，支持页内错误提示及安全回跳。

package/docs/roles-and-configuration.md

@@ -18,7 +18,51 @@ requiring a same-named global Role. A global Role is a creation template only
 when the requested Task Role does not exist. Availability, producer separation
 and the frozen review candidate still apply.
 
-## Profiles
+## Enable and disable
+
+Availability is configuration, separate from active Agent selection, Session
+activity and the Task execution gate:
+
+```sh
+yui config role disable worker
+yui config role enable worker
+yui config profile disable implementer
+yui config profile enable implementer
+yui task role disable task-1 reviewer
+yui task role enable task-1 reviewer
+```
+
+`update --enabled true|false` uses the same rules. Repeating an enable/disable
+is a no-op. Settings → Role/Profile exposes the same boolean with its scope.
+List/show keeps disabled entries visible; application selectors exclude them.
+
+A disabled Global Role cannot start/resume execution, receive a new automatic
+Turn, or create a new Task binding from that template. This includes Operator,
+Leader, Worker and Job-owned Roles. An existing Task Role instead uses its own
+flag, even when its original template is disabled. A disabled Profile cannot be
+applied; inherited runtime also requires an enabled Global Worker. Explicit
+Agent Profiles also require an enabled Worker when copying a matching Worker
+binding's options; an explicit Agent without such a binding uses its own defaults.
+No fallback Agent, account or reviewer is chosen.
+
+Disabling never kills a Session, cancels a Run, settles a claim, acknowledges
+input or discards unknown delivery evidence. Current execution can finish and
+report. New delivery and automatic recovery wait; retry budgets are not reset
+or extended. Use the existing stop/interrupt operations when stopping is intended.
+Enabling does not start an empty Session, activate a Draft, reopen a completed
+Task, override a Task stop, or replay accepted/unknown effects. Normal scheduling
+continues only where existing lifecycle, authority and exact-input fences allow.
+
+All settings remain editable while disabled. Profile reset restores builtin
+content but preserves enabled state; initialization and upgrades do not revive
+disabled entries. Deletion retains its existing reference checks. Missing
+`enabled` in older records means enabled; storage 1.21 → 1.22 adds this optional
+field without rewriting old records or frozen Session/context evidence.
+If Operator or a Task Leader is disabled, use the authorized local CLI/Web
+configuration entry to re-enable it; a disabled critical responsibility is not
+silently replaced or considered completed.
+
+## Profile behavior
 
 An Agent Profile combines portable behavior—instructions, Skills and access
 intent—with runtime intent. Runtime either follows the current Global Worker

package/docs/roles-and-configuration.zh-CN.md

@@ -15,6 +15,41 @@ Task Role 是 Task 局部的；global Role 提供已配置的默认值和全局
 的 global Role。只有当请求的 Task Role 不存在时，global Role 才作为创建模板。
 可用性、producer 分离和冻结的审查候选仍然适用。
 
+## 启用与停用
+
+启停是配置状态，与 Active Agent、Session 是否运行和 Task executionGate 分开：
+
+```sh
+yui config role disable worker
+yui config role enable worker
+yui config profile disable implementer
+yui config profile enable implementer
+yui task role disable task-1 reviewer
+yui task role enable task-1 reviewer
+```
+
+`update --enabled true|false` 使用相同规则；重复启停不产生变化。
+Web 设置页的 Role/Profile 提供同一开关和作用域提示。
+list/show 保留停用项供查看和恢复，应用选择器不提供不可用项。
+
+Global Role 停用阻止它自身的新启动、恢复、自动 Turn，以及从该模板新建 Task
+绑定；Operator、Leader、Worker 和 Job-owned Role 同样适用。已复制的 Task Role
+以自身开关为准，不随模板停用。Profile 停用后不能新应用；动态继承还要求 Global
+Worker 可用。显式 Agent Profile 若复制匹配 Worker 绑定的配置选项，也要求
+Worker 启用；没有匹配绑定的显式 Agent 使用其默认配置。不偷偷切换 Agent、账号或审查角色。
+
+停用不强停 Session、不取消 Run、不消费 claim/ACK，也不丢弃未知投递证据。
+运行中的执行可以正常收尾和报告；新投递及自动恢复等待，原重试预算不重置或延长。
+需要停止时使用既有 stop/interrupt。启用不是立即启动空 Session，不激活 Draft、
+重开已完成 Task、解除 Task 停止或重放已接受/未知效果；仅允许原调度在原生命周期、
+权限及准确输入约束内继续。
+
+停用期间仍可编辑配置。Profile reset 恢复内置内容但保留启停状态；初始化、升级
+不会复活停用项。删除沿用已有引用检查。旧记录缺少 `enabled` 默认启用，
+存储 1.21 → 1.22 只声明新增可选字段，不改写历史记录、冻结 Session 或上下文。
+若 Operator/Task Leader 被停用，可由有权限的本地 CLI/Web 配置入口恢复；
+系统不会跳过关键职责、换人或假定完成。
+
 ## Profile
 
 Agent Profile 把可移植行为（指令、Skill 和访问意图）与运行时意图组合在一起。

package/docs/storage-baseline.md

@@ -2,7 +2,12 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.21. The 1.20 → 1.21 transition converts provably unedited
+Current storage is 1.22. The 1.21 → 1.22 transition admits an optional boolean
+`enabled` on Roles and Profiles. Absence means enabled. SQL layout, historical
+payloads, existing Task bindings, Session snapshots and input receipts are
+unchanged; upgrade does not launch or stop execution.
+
+The 1.20 → 1.21 transition converts provably unedited
 built-in Project sync defaults to timezone-explicit clock schedules, archiving
 their original bytes under migration 21. Ambiguous higher revisions and custom
 plans remain unchanged; no Git work or reauthorization occurs. See

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,11 @@
 
 # 存储基线 1.0
 
-当前存储为 1.21。1.20 → 1.21 将可证明未经修改的旧内置 Project 同步默认计划
+当前存储为 1.22。1.21 → 1.22 为 Role/Profile 声明可选布尔字段 `enabled`，
+缺省表示启用。SQL 布局、历史 payload、已有 Task 绑定、Session 快照和输入回执
+保持不变；升级不启动或停止执行。
+
+1.20 → 1.21 将可证明未经修改的旧内置 Project 同步默认计划
 转换为显式时区的整点计划，在 migration 21 下归档原始字节。更高 revision 的
 来源不明确计划及自定义计划保留，不执行 Git 或重新授权。保守转换边界见
 [Project 同步](project-sync.zh-CN.md)。

package/docs/testing/review-evaluation.md

@@ -14,7 +14,9 @@ may benefit from a short Task artifact index:
 
 - Goal/non-goals and effective decision references.
 - Observable scenarios, expected behavior and independent contract sources.
-- Contract entry points, callers and key risks.
+- For cross-layer/async risks, a short actual path: entry, consumers, relevant
+  waits/atomic commits, result and failure/recovery consequences, linked to
+  candidate code or existing documentation.
 - Candidate identity and actual check results (commit, environment, command,
   result), distinguishing unexecuted scenarios and uncovered boundaries.
 - For full re-review: repair delta, previous findings' dispositions and still
@@ -29,6 +31,38 @@ Later Brief/decision edits do not change an existing Review snapshot. This is
 not a document-completeness gate, prose parser or Skill-version freeze.
 Ordinary full review and the existing equivalence Delta Recheck remain distinct.
 
+### Keep the material small and actionable
+
+These are examples, not mandatory sections or a scenario quota. A simple E01
+handoff can cite its half-open interval contract and `main.mjs/select` directly:
+the caller supplies bounds and receives rows; timezone conversion is a non-goal.
+No separate path document is needed.
+
+For E03, the contract requires unchanged opaque cursors and ordered items.
+The actual path is caller -> `main.mjs/collect` -> await
+`page.mjs/fetchPage(cursor)` -> consume items/cursor -> next request or return.
+There is no persistent commit. Check the cursor at the downstream consumer,
+not merely the first successful page; a rejected request rejects collection,
+so accumulated rows are not returned as success. Retry/concurrent mutation is
+outside this example's contract. The index is a navigation hint, not a finding
+or a claim that all paths were inspected.
+
+Keep evidence roles separate: that contract is the expectation;
+`scripts/review-eval/verify.mjs`'s E03 probes are executable references;
+only an actual `node scripts/review-eval/evaluate.mjs verify` invocation plus its
+candidate commit, environment and output establishes a result. The probes use
+the two supplied modules for the counterexample, a one-page normal control,
+and a controlled wait followed by rejection to check pending/failure behavior.
+They do not exercise a live server, crash recovery or Reviewer behavior.
+
+In a pause/resume task, constraints might instead distinguish unsubmitted
+intent, registered/unknown effects, terminal settlement and legal resumption.
+Those are domain-specific examples, not universal state-machine requirements.
+Use the task's own contract and reachable paths. After a shared-root finding,
+check the other affected consumers in the same scope and refresh the small
+index and repair evidence; do not append the entire review history. Reviewer
+inspection still covers the complete frozen candidate, not just these hints.
+
 ## Small development corpus
 
 `scripts/review-eval/` is an offline file tool, not a scheduler, model adapter or

package/docs/testing/review-evaluation.zh-CN.md

@@ -12,7 +12,8 @@
 
 - 目标/非目标及有效决定入口。
 - 可观察场景、预期行为和独立契约依据。
-- 契约入口、调用方及关键风险。
+- 对跨层/异步风险，提供简短实际链路：入口、消费者、关键等待/原子提交边界、
+  结果及失败/恢复后果，并指向候选代码或已有文档。
 - 候选身份和实际检查结果（提交、环境、命令、结果），区分未执行场景与未覆盖边界。
 - 完整复审追加修复 delta、历史 Findings 处置及仍适用证据；当前完整冻结候选仍在范围内。
 
@@ -23,6 +24,29 @@
 后续 Brief/决定修改不改变既有 Review Snapshot。这不是文档齐全门禁、
 自然语言解析器或 Skill 版本冻结机制。普通完整复审与已有等价性 Delta Recheck 保持不同语义。
 
+### 保持材料简短且可用
+
+以下是示例，不是必填章节或场景配额。简单的 E01 交接可直接引用半开区间契约和
+`main.mjs/select`：调用方提供边界并接收行，时区转换是非目标，无须另写链路文档。
+
+E03 的契约要求原样传递不透明游标并按顺序返回条目。实际链路是：
+调用方 -> `main.mjs/collect` -> 等待 `page.mjs/fetchPage(cursor)` ->
+消费条目/游标 -> 下一次请求或返回。这里没有持久化提交。
+应检查下游消费者收到的游标，而不只是首个成功页面；请求拒绝时收集操作拒绝，
+已累计条目不会作为成功结果返回。重试/并发修改不属于此例契约。
+索引只是定位提示，不是缺陷结论，也不声称已检查所有路径。
+
+分清证据身份：上述契约是预期；`scripts/review-eval/verify.mjs` 的 E03
+探针是可执行引用；只有实际运行 `node scripts/review-eval/evaluate.mjs verify`
+并保留候选提交、环境和输出才构成结果。探针用给定的两个模块验证反例，
+提供单页正常对照，以及可控等待后拒绝的未完成/失败行为检查；
+不覆盖真实服务、崩溃恢复或 Reviewer 行为。
+
+暂停/恢复类任务的约束可能分别要求：未提交意图保留、已登记/未知效果不重放、
+已有执行允许终态收尾、恢复后沿合法意图继续。这些是领域示例，不是通用状态机要求。
+应以本任务契约和可达路径为依据。同根因发现后检查同范围内其他受影响消费者，
+刷新简短索引与修复证据，不追加整轮历史；Reviewer 仍检查完整冻结候选，不局限于这些提示。
+
 ## 小型开发集
 
 `scripts/review-eval/` 是离线文件工具，不是调度器、模型适配器或新增 Core 存储。

package/docs/testing/verification-levels.md

@@ -53,12 +53,12 @@ is required.
 Both include `test/core` and `test/platform`. For an already built checkout,
 `npm run test:business` runs only `test/core` and `npm run test:platform` runs
 only `test/platform`; neither rebuilds. CI owns one explicit build per job.
-The stable suite owns current storage 1.21 and its declared 1.0 through 1.20 minor
+The stable suite owns current storage 1.22 and its declared 1.0 through 1.21 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.21, exact schema/record validation, no initialization over
+1. Fresh storage 1.22, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and

package/docs/testing/verification-levels.zh-CN.md

@@ -39,12 +39,12 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 两者均包含 `test/core` 和 `test/platform`。已构建的 checkout 可分别运行
 `npm run test:business` 与 `npm run test:platform`，它们不会再次构建。
 CI 每个作业只显式构建一次。
-稳定套件维护当前存储 1.21 和明确声明的 1.0 至 1.20 连续小版本迁移，
+稳定套件维护当前存储 1.22 和明确声明的 1.0 至 1.21 连续小版本迁移，
 不包含未声明的历史格式兼容路径。
 
 当前覆盖包括：
 
-1. 新建存储 1.21、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
+1. 新建存储 1.22、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
 2. 精确版本暂存、目标不匹配拒绝、同主版本连续小版本预检、交接锁显式所有者，
    以及恢复时核对捕获的协议和存储身份，不接受缺失字段。
 3. 持久 Task／Message／Decision 上下文、Draft 激活权威、mailbox 认领、

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "2.15.0",
+  "version": "2.17.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/VERSION

@@ -1 +1 @@
-6
+7

package/skills/yui-leader/references/execution.md

@@ -303,12 +303,20 @@ authority. Never invent authorization, impersonate Operator, or modify the core
 
 ## Validate and make the review judgment
 
-Prepare useful evidence, not a documentation gate. Supply or reference the
-effective goals/non-goals and decisions, independently grounded expected
-behavior, key user paths/constraints, contract entry points and relevant callers.
-Keep three things distinct: a behavioral scenario and its expectation, an
-executable test reference, and an actual result with candidate/environment/
-command. Disclose real gaps rather than deriving acceptance from current code.
+Prepare useful evidence, not a documentation gate. From effective requirements,
+non-goals and decisions, distill the few observable behavioral constraints that
+matter to this change, with independently grounded expectations. Do not infer
+correctness from the candidate or its mocks.
+
+For material cross-layer or asynchronous risks, trace a short real path in the
+exact candidate: entry -> actual consumers -> relevant waits/atomic commit
+boundaries -> observable result and failure/recovery consequences. Point to
+candidate code or existing documents, not just module names or a coverage claim.
+Use it to expose where the same constraint must hold across boundaries; do not
+enumerate every entry or generate a combination matrix. Keep three things
+distinct: constraints/scenarios and expectations, executable test references,
+and actual results with candidate/environment/command. Name material unverified
+boundaries; a test reference alone is not a passing result.
 
 Small tasks can reference existing materials directly. For complex tasks, put a
 short review index in Task artifacts and its commit-pinned reference in Brief.
@@ -380,8 +388,11 @@ main synthesis through its exact AgentRun, preserving its selected source snapsh
 A Worker or Reviewer AgentRun result is evidence, not acceptance. Inspect the
 result, diff, checks, and current Candidate before deciding.
 
-Group confirmed findings by root cause and repair other reachable instances
-within scope together. For ordinary full re-review, preserve the current complete
+Group confirmed findings by root cause. Use the traced paths to check other
+reachable consumers/boundaries within scope and repair affected instances
+together, not just the reported checkpoint. Refresh the short material index
+and repair evidence where they changed, without accumulating round-by-round
+history. For ordinary full re-review, preserve the current complete
 candidate and requirements; add repair delta, prior finding dispositions and
 still-valid evidence. Delta is an attention aid, not the full-review boundary.
 Do not conflate this with an explicitly authorized equivalence Delta Recheck.

package/skills/yui-reviewer/SKILL.md

@@ -111,9 +111,20 @@ contracts, state/data invariants, failure and partial recovery, authorization,
 and whether verification tests the actual contract. Multiple perspectives do
 not require multiple Agents or every perspective on every task.
 
+Use the Leader's real-path material as navigation and risk hints, not a scope
+ceiling or proof of completeness. Check its links against the frozen candidate
+and independently derive scenarios. For relevant cross-layer/asynchronous paths,
+follow actual consumers and compare the same constraint before/after key waits
+and atomic commits, through downstream error classification and recovery.
+Inspect other reachable consumers when a shared assumption may fail elsewhere;
+neither a module list nor a passing mock establishes end-to-end behavior.
+
 Turn applicable perspectives into concrete scenarios, expected behavior and
-evidence. Challenge important assumptions with the smallest reachable
-counterexample; check normal controls and non-goals too. A shared assumption
+evidence. Distinguish independently grounded expectations, executable test
+references, and actual results for the stated candidate/environment; retain
+material unverified boundaries as gaps. Challenge important assumptions with
+the smallest reachable counterexample; check normal controls and non-goals too.
+A shared assumption
 between a mock and implementation is not independent confirmation. Reuse valid
 checks; do not run external-resource validation without its exact authorization.
 Stop neither at the changed lines nor after finding a few defects.

package/skills/yui-reviewer/VERSION

@@ -1 +1 @@
-4
+5