@zq-silk/yui 2.16.0 → 2.18.0

package/docs/managed-turn-and-session-runtime.md

@@ -11,6 +11,80 @@ notifications cannot restart an explicitly stopped Session; normal Host detach
 preserves an active Session and remains reconnectable. A switch after a partial
 failure still settles the retained input before selecting a new conversation.
 
+Local stop waits for its durable cleanup obligation, not for the Home-wide
+`scheduler.scan` loop to empty. A signal only requests reconciliation; the
+existing physical-stop proof and cleanup transaction remain the completion
+boundary. A timeout retains the obligation and blocks replacement. Selection
+failure and unconfirmed startup are reported separately; neither permits
+replaying an uncertain native operation.
+
+`operator status` and Session context distinguish desired/effective launch
+revisions and selected-writer state from Host observation health. Old-conversation
+failures remain audit evidence, not the new Session's current failure.
+An exact rejected input can be explicitly retired when obsolete; accepted,
+submitting, unknown and interrupt-owned input still retain their handling path.
+
+`controller status --json` exposes bounded observations under
+`identity.runtime.observations`: authenticated requests, scheduler pending
+scopes, phase/read costs and sampled event-loop lag are separate facts.
+Samples use a process-monotonic clock and hashed target/request labels, with
+at most 16 recent and 16 active samples plus the slowest completed sample.
+In-flight request count is not queue depth, and pre-routing wait is not
+measured. These observations neither identify an old incident retroactively
+nor establish quiescence; restarting a Controller does not refresh live Hosts.
+
+`observations.persistence` separates main-thread database lock/body/commit
+costs from persistence-worker round trips, worker execution and worker reads.
+Worker summaries travel on existing replies and retain a worker-instance ID;
+status reads only cached facts, never performs a diagnostic worker RPC.
+Match hashed request targets when comparing round trip and execution. The
+difference includes startup, queueing, transport and main-loop delay, not a
+pure queue-time measurement. Nested database/read durations overlap worker
+execution and must not be added to it. Historical maxima may belong to other
+requests; the latest/slowest samples retain their own timestamps.
+
+With the default persistence worker, periodic Project-sync configuration checks,
+expired Input recommendations and run-progress/stall diagnostic transactions
+execute on that worker as complete read/check/write operations. Their callers
+await completion; lock waiting does not block the socket thread. Existing
+transaction fences and idempotent folds remain unchanged. Explicit worker-off
+mode and injected adapters retain synchronous behavior. This is not blanket
+isolation of all database writes: launch admission, mailbox claims, due Job
+admission and other lifecycle writes still require their own boundary analysis.
+Status responsiveness during these maintenance operations is not proof that
+every possible Controller stall has been eliminated.
+
+Idle Global inbox recovery and already-settled retry checks use read-only
+snapshots, without reserving SQLite's writer. Creating a recovery notice or
+settling an outstanding retry still rechecks the current Session/claim/input
+inside the original write transaction. This removes no-op lock waits, not
+contention from actual writes.
+
+Production Controller startup (including handover promotion) retains operational
+diagnostics in `runtime/controller-diagnostics.jsonl`, with two rotated files.
+Each file is bounded to 1 MiB and owner-readable/writable only. An asynchronous
+writer admits at most 32 queued records (16 KiB each); it never writes the
+business database. Scheduler/startup errors retain a classification, fingerprint
+and build-relative source frames, not raw messages, arguments or credentials.
+A 250 ms memory-only sampler records new failed/slow observations (at least
+1 second), active slow work or its own loop delay at most once per second.
+Records carry wall time, monotonic time, PID, process-instance ID and version;
+bounded phase snapshots retain hashed request/target identities. It is sampled
+evidence, not a trace of every request or the exact cause of pre-routing delay.
+`observations.diagnostics` reports written/dropped/pending records and write
+failures. No successful diagnostic write is assumed when storage fails.
+Rotation, queue overflow and abrupt termination can lose evidence; a blocked
+loop cannot emit a snapshot until it resumes. No automatic restart or operation
+replay is introduced. These disposable operational logs are not Task state,
+acceptance, a second recovery authority or a Home schema migration.
+
+Scheduler caches load families lazily and use transaction-maintained Task
+read revisions. Another Task or Global message does not invalidate an unchanged
+Task history; updates, deletions and external writers still do. Compound folds
+pin a read snapshot, uncommitted writes cannot publish a reusable cache token,
+and only 16 recent Task projections are retained. Cache entries never authorize
+dispatch or replace exact mutation-time checks.
+
 A newly created global Operator conversation requests the native title
 `Yui · Operator · MMdd`, using Yui's configured time zone. The request is made
 only after the provider returns the exact new conversation identity; restore
@@ -526,6 +600,16 @@ conversation unrecoverable. The request is legal while an AgentRun is active,
 the Session is ended, or previous cleanup is pending. A Leader may also request
 its own replacement and end its current turn.
 
+For a Draft Leader whose planning Run has already ended, the replacement
+initialization notification admits the selected fresh Session after confirmed
+cleanup. It does not create another business Run, activate the Task, or adopt a
+delivery workspace: the successor retains planning-only authority and reads
+current Task context and retained inbox originals before handling them. Ordinary
+Draft notifications and unscoped native hooks cannot use this admission.
+A rejected startup retains the notification for explicit `task wake retry`
+after correction, or another legal Session replacement; unknown input acceptance
+never becomes permission to replay.
+
 `task role session stop` can also stop a running Role without first changing
 its Run status. It retains the native conversation for possible reuse. Pending
 Messages remain intent and may start a continuation after the stop; use Task

package/docs/managed-turn-and-session-runtime.zh-CN.md

@@ -2,6 +2,57 @@
 
 # Session、AgentRun 与通知
 
+局部停止等待自身的持久清理义务完成，不等待整个 Home 的 `scheduler.scan`
+循环排空。signal 只请求调度；完成仍以现有物理停止证明及清理事务为准。
+超时保留义务并阻止替换；选择失败和新会话启动未确认分别报告，不允许重放未知效果。
+
+`operator status` 与 Session context 区分 desired/effective 配置版本、选定写入者
+状态和 Host 观测健康。旧会话失败保留为审计证据，不是新会话的当前失败。
+明确 rejected 的过时输入可以显式退役；accepted、submitting、unknown 和
+interrupt-owned 输入仍保留原处理路径。
+
+`controller status --json` 的 `identity.runtime.observations` 分别呈现已认证请求、
+调度待处理范围、阶段／读取成本及采样的事件循环延迟。样本使用进程单调时钟，
+目标／请求标签仅保存哈希；每组最多保留 16 个近期样本、16 个活动样本及最慢完成样本。
+in-flight 请求数不是排队数，路由前等待尚未测量。观测不能反推旧事故的唯一根因，
+也不构成静止证明；重启 Controller 不会刷新存活 Host。
+
+`observations.persistence` 将主线程数据库锁等待／事务体／提交成本，与持久化
+worker 的往返耗时、执行和读取成本分开。worker 摘要搭载既有响应，保留 worker
+实例标识；status 只读缓存观测，不另发诊断 RPC。比较往返和执行时间时须匹配
+同一个请求哈希，其差值还包括启动、排队、传输和主线程延迟，不是纯排队时长。
+嵌套的数据库／读取耗时已包含在 worker 执行中，不能重复相加；历史最大值可能
+来自其他请求，latest／slowest 样本保留各自时间戳。
+
+默认启用持久化 worker 时，周期性 Project-sync 配置检查、到期 Input 建议执行、
+运行进展及停滞诊断事务，作为完整的读／检查／写操作在 worker 内执行，调用方等待
+完成；等锁不再阻塞 socket 主线程。既有事务校验和幂等折叠保持不变。
+显式关闭 worker 或注入自定义 adapter 时仍沿用同步行为。这不是全部数据库写入的
+隔离：启动准入、邮箱领取、到期 Job 准入及其他生命周期写入仍需分别分析边界。
+这些维护操作期间状态请求可响应，不代表 Controller 的所有长停顿都已消除。
+
+空闲 Global 收件箱恢复检查、已处分的重试检查使用只读快照，不申请 SQLite
+写锁。真正创建恢复通知或处分未完成重试时，仍在原写事务内复核当前
+Session／claim／输入。这消除的是空操作等锁，不是所有实际写入的竞争。
+
+生产 Controller（含升级接管后的启动）将运行诊断保存至
+`runtime/controller-diagnostics.jsonl`，另保留两个轮转文件，每个最多 1 MiB，
+仅文件所有者可读写。异步写入器最多排队 32 条记录，每条最多 16 KiB，
+不写业务数据库。调度及启动错误只保留分类、指纹和构建内相对源码位置，
+不保留原始错误正文、参数或凭据。每 250 ms 仅检查内存指标；出现新的失败／
+至少 1 秒慢操作、仍在进行的慢操作或自身事件循环延迟时，每秒最多记录一次快照。
+记录包含墙钟、单调时间、PID、进程实例及版本，阶段摘要使用请求／目标哈希。
+这是采样证据，不是逐请求追踪，也不直接证明路由前阻塞原因。
+`observations.diagnostics` 显示写入、丢弃、待写数量和写入失败；磁盘故障不伪装为
+记录成功。轮转、队列溢出、突然终止均可能丢失证据，主线程恢复前也无法输出快照。
+不新增自动重启或操作重放。这些可丢弃运行日志不是 Task 状态、验收依据的替代物、
+第二套恢复权威或 Home 数据格式迁移。
+
+调度缓存按需加载记录族，并使用事务维护的 Task 读取修订号。其他 Task 或 Global
+消息不会使未变化的本 Task 历史失效；更新、删除、其他进程写入仍正确失效。
+组合折叠固定在一个读取快照，未提交写入不产生可复用缓存标识，最多保留最近
+16 个 Task 的投影。缓存不授权派发，也不替代变更时的精确身份检查。
+
 ## 当前身份与持久处理回执
 
 桌面与 TUI 使用相同的当前 Session 授权。只有 `CODEX_THREAD_ID` 的桌面命令
@@ -400,6 +451,12 @@ Run 的普通 Leader 通知。未知的原生状态阻塞清理；仅停止一
 一种偏好，而不是要求证明旧对话不可恢复。该请求在 AgentRun 活动、Session 已结束或
 上一次清理待处理时都是合法的。Leader 也可以请求替换自己并结束当前轮次。
 
+对于 planning Run 已结束的 Draft Leader，替换初始化通知在确认清理后允许所选的新
+Session 登记。它不会新增业务 Run、激活 Task 或接纳 delivery 工作区；后继仍只有
+planning 权限，先读取当前 Task 上下文和保留的信箱原文，再处理输入。普通 Draft 通知
+和无启动范围的原生 hook 不能借用此准入。启动被拒绝时保留通知，修正原因后可显式
+`task wake retry`，或再次合法替换 Session；接受状态未知的输入始终不能据此重放。
+
 `task role session stop` 也可以在不先更改 Run 状态的情况下停止一个运行中的 Role。它
 保留原生对话以备复用。待处理的 Message 仍是意图，可以在停止后启动一次 continuation；
 当整个 Task 都必须保持暂停时，使用 Task execution stop。对于自我替换，使用异步的

package/docs/release-workflow.md

@@ -51,6 +51,73 @@ merely to avoid a version decision. Package versions remain distinct from protoc
 and persistent-storage contracts: their compatibility checks and required migrations
 are unchanged, and the storage rules below do not authorize a package release.
 
+### 2.18.0 compatibility and migration notes
+
+This minor includes the already-merged independent Jobs workspace and global
+Shell script Jobs (PR #490), plus Controller reliability and diagnostics.
+Exact Session stop/replacement no longer waits for unrelated global scheduling
+to drain. Stop proof, single-writer ownership and unknown-input replay fences
+remain required. Session health distinguishes historical failures from the
+current authority; conclusively rejected obsolete inputs can be retired without
+erasing their original evidence.
+
+Task-scoped lazy read caches, indexed observation queries and persistence
+timings reduce projection work and separate request/worker/database costs.
+With the default persistence worker, periodic maintenance lock waits no longer
+block the socket thread; idle Global recovery and settled retry checks are
+read-only. Actual admission and other business writes may still contend.
+Bounded, redacted asynchronous diagnostics retain incident evidence in
+`runtime/controller-diagnostics.jsonl` and two rotated files. These changes
+address reproduced mechanisms, not a proven unique cause of every historical
+timeout. See [managed runtime](managed-turn-and-session-runtime.md).
+
+Storage advances from **1.22 through 1.23 to 1.24**: 1.23 declares revisioned
+global Shell script definitions and Run snapshots; 1.24 adds Task read-revision
+tokens and triggers without rewriting historical payloads. A production 1.21
+Home first applies the existing 1.22 Role/Profile availability transition.
+Use the centralized contiguous same-major migration, never manual schema edits.
+Controller RPC and Host control/event protocols remain v1. Compatible live
+Hosts/Sessions are retained, not hot-upgraded; unreported Host capabilities and
+unknown results remain explicit.
+
+With separate production authority, the Operator uses
+`yui update --version 2.18.0` after verifying the published artifact. Refresh a
+consistent maintenance backup and capture the current executable/Controller
+identity before migration. An earlier online DB snapshot alone is not a complete
+rollback point and cannot overwrite subsequently accepted input. Do not open a
+1.24 Home with an older binary; rollback requires the matching pre-upgrade
+program and consistent Home backup, with intervening effects reconciled.
+
+Release gates require exact-merge-commit Core CI and the same runtime archive's
+fresh-install platform/Node matrix before npm publication. Local deterministic
+tests and prior smoke evidence do not replace those gates or prove real-model
+behavior. Publication does not itself update a production Home or resolve
+another Task's execution.
+
+### 2.17.0 compatibility and migration notes
+
+This minor adds persistent Role/Profile enable and disable controls in CLI and
+Web settings. Use `yui config role enable|disable`, `yui config profile
+enable|disable`, and `yui task role enable|disable` with the relevant identity.
+Disabled templates cannot be selected for new bindings; existing Task Role
+copies remain independent. Disabling a Role prevents new execution and pauses
+eligible pending work; it does not kill a running Turn, discard pending input,
+block exact terminal recording or erase inspection/claim/acknowledgement access.
+Re-enabling resumes eligible work under its existing authority and retry budgets,
+without replaying accepted or unknown input.
+
+Storage advances from **1.21 to 1.22** through the centralized additive migration
+for optional `enabled` fields. Existing records without the field remain enabled;
+their historical payloads are preserved. With separate upgrade authorization,
+use `yui update --version 2.17.0`; the updater owns preflight, backup, migration
+and Controller handover. Do not open the upgraded Home with an older binary.
+
+The release also includes the merged Draft planning Session replacement repair
+and stronger behavioral-constraint/real-path review handoffs. Validation uses
+deterministic tests and the exact-tarball fresh-install matrix, not real-model
+behavior. Publishing does not update the global CLI, migrate a production Home,
+restart its Controller or deploy a production Web listener.
+
 ### 2.16.0 compatibility and migration notes
 
 This minor refreshes the Web workbench (PR #484). One global navigation rail

package/docs/release-workflow.zh-CN.md

@@ -36,6 +36,54 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 不能将不兼容冒称为兼容，也不为回避版本选择新增历史兼容机制。包版本与协议、
 持久存储契约仍然独立：兼容性检查和必要迁移要求不变，下文存储规则不授予发版权限。
 
+### 2.18.0 兼容性及迁移说明
+
+本 minor 包含已合入的独立 Jobs 工作区和全局 Shell 脚本 Job（PR #490），以及
+Controller 可靠性与诊断改进。精确 Session 停止／替换不再等待无关全局调度排空；
+停止证明、单写者和未知输入防重放仍受保护。Session 健康区分历史故障与当前权限，
+明确拒绝的过期输入可以合法退役，原始证据保留。
+
+Task 局部惰性缓存、索引查询和持久化耗时观测减少投影开销，并区分请求、worker
+和数据库成本。默认持久化 worker 承担周期维护事务的锁等待；空闲 Global 恢复和
+已处分重试检查只读。实际启动准入和其他业务写入仍可能竞争。异步脱敏诊断保存到
+`runtime/controller-diagnostics.jsonl` 及两个有界轮转文件。这些改进解决已复现机制，
+不代表已证明每次历史超时的唯一根因。参见[托管运行时](managed-turn-and-session-runtime.zh-CN.md)。
+
+存储从 **1.22 经 1.23 升至 1.24**：1.23 声明全局 Shell 脚本定义及精确 Run 快照；
+1.24 增加 Task 读取修订号与触发器，不改写历史载荷。生产 1.21 Home 会先执行已有的
+1.22 Role/Profile 启停字段迁移。必须使用集中式同 major 连续迁移，不手工修改数据库。
+Controller RPC、Host control/event 协议仍为 v1；兼容的存活 Host 和 Session 保留，
+而非热更新。Host 未报告能力及未知结果仍明确保留。
+
+另行获得生产授权后，由 Operator 核验实际发布包，再执行
+`yui update --version 2.18.0`。迁移前刷新一致的维护备份，记录当时程序与 Controller
+身份。较早的在线数据库快照不是完整回滚点，不可覆盖后续已接受输入。
+旧二进制不能打开 1.24 Home；回滚需要匹配的旧程序和升级前一致 Home 备份，
+并核对期间发生的效果。
+
+发布门禁要求精确 merge commit 的 Core CI，以及同一运行包的全新安装平台／Node
+矩阵通过后才能发布 npm。本地确定性测试与既有 smoke 不替代这些门禁，也不证明
+真实模型行为。发布本身不更新生产 Home，不代表其他 Task 执行问题已解决。
+
+### 2.17.0 兼容性及迁移说明
+
+本 minor 在 CLI 和 Web 设置中新增持久化的 Role/Profile 启用、停用控制。
+可使用 `yui config role enable|disable`、`yui config profile enable|disable`
+及 `yui task role enable|disable`，并指定对应身份。停用的模板不可用于新绑定；
+已复制到 Task 的 Role 保持独立。停用 Role 会阻止新的执行并暂停符合条件的待执行工作，
+但不杀死正在运行的 Turn、不丢弃待处理输入、不阻止精确终态补录，也不移除查看、
+claim 和 ACK 权限。重新启用后，符合条件的工作按原有权限和重试预算继续，
+不会重放已接受或结果未知的输入。
+
+存储通过集中式增量迁移从 **1.21 升至 1.22**，加入可选的 `enabled` 字段。
+没有该字段的已有记录仍视为启用，历史载荷保持不变。另行获得升级授权后，可使用
+`yui update --version 2.17.0`；updater 负责预检、备份、迁移与 Controller 交接。
+不得使用旧二进制打开升级后的 Home。
+
+本次发布还包含已合入的 Draft 规划 Session 替换修复，以及强化行为约束和真实调用路径的
+审查交接说明。验证依据为确定性测试与精确 tarball 的全新安装矩阵，不代表真实模型行为验证。
+发布本身不会更新全局 CLI、迁移生产 Home、重启其 Controller 或部署生产 Web listener。
+
 ### 2.16.0 兼容性及迁移说明
 
 本 minor 更新 Web 工作台（PR #484）：工作台与管理页共用一条全局导航栏

package/docs/roles-and-configuration.md

@@ -18,7 +18,51 @@ requiring a same-named global Role. A global Role is a creation template only
 when the requested Task Role does not exist. Availability, producer separation
 and the frozen review candidate still apply.
 
-## Profiles
+## Enable and disable
+
+Availability is configuration, separate from active Agent selection, Session
+activity and the Task execution gate:
+
+```sh
+yui config role disable worker
+yui config role enable worker
+yui config profile disable implementer
+yui config profile enable implementer
+yui task role disable task-1 reviewer
+yui task role enable task-1 reviewer
+```
+
+`update --enabled true|false` uses the same rules. Repeating an enable/disable
+is a no-op. Settings → Role/Profile exposes the same boolean with its scope.
+List/show keeps disabled entries visible; application selectors exclude them.
+
+A disabled Global Role cannot start/resume execution, receive a new automatic
+Turn, or create a new Task binding from that template. This includes Operator,
+Leader, Worker and Job-owned Roles. An existing Task Role instead uses its own
+flag, even when its original template is disabled. A disabled Profile cannot be
+applied; inherited runtime also requires an enabled Global Worker. Explicit
+Agent Profiles also require an enabled Worker when copying a matching Worker
+binding's options; an explicit Agent without such a binding uses its own defaults.
+No fallback Agent, account or reviewer is chosen.
+
+Disabling never kills a Session, cancels a Run, settles a claim, acknowledges
+input or discards unknown delivery evidence. Current execution can finish and
+report. New delivery and automatic recovery wait; retry budgets are not reset
+or extended. Use the existing stop/interrupt operations when stopping is intended.
+Enabling does not start an empty Session, activate a Draft, reopen a completed
+Task, override a Task stop, or replay accepted/unknown effects. Normal scheduling
+continues only where existing lifecycle, authority and exact-input fences allow.
+
+All settings remain editable while disabled. Profile reset restores builtin
+content but preserves enabled state; initialization and upgrades do not revive
+disabled entries. Deletion retains its existing reference checks. Missing
+`enabled` in older records means enabled; storage 1.21 → 1.22 adds this optional
+field without rewriting old records or frozen Session/context evidence.
+If Operator or a Task Leader is disabled, use the authorized local CLI/Web
+configuration entry to re-enable it; a disabled critical responsibility is not
+silently replaced or considered completed.
+
+## Profile behavior
 
 An Agent Profile combines portable behavior—instructions, Skills and access
 intent—with runtime intent. Runtime either follows the current Global Worker

package/docs/roles-and-configuration.zh-CN.md

@@ -15,6 +15,41 @@ Task Role 是 Task 局部的；global Role 提供已配置的默认值和全局
 的 global Role。只有当请求的 Task Role 不存在时，global Role 才作为创建模板。
 可用性、producer 分离和冻结的审查候选仍然适用。
 
+## 启用与停用
+
+启停是配置状态，与 Active Agent、Session 是否运行和 Task executionGate 分开：
+
+```sh
+yui config role disable worker
+yui config role enable worker
+yui config profile disable implementer
+yui config profile enable implementer
+yui task role disable task-1 reviewer
+yui task role enable task-1 reviewer
+```
+
+`update --enabled true|false` 使用相同规则；重复启停不产生变化。
+Web 设置页的 Role/Profile 提供同一开关和作用域提示。
+list/show 保留停用项供查看和恢复，应用选择器不提供不可用项。
+
+Global Role 停用阻止它自身的新启动、恢复、自动 Turn，以及从该模板新建 Task
+绑定；Operator、Leader、Worker 和 Job-owned Role 同样适用。已复制的 Task Role
+以自身开关为准，不随模板停用。Profile 停用后不能新应用；动态继承还要求 Global
+Worker 可用。显式 Agent Profile 若复制匹配 Worker 绑定的配置选项，也要求
+Worker 启用；没有匹配绑定的显式 Agent 使用其默认配置。不偷偷切换 Agent、账号或审查角色。
+
+停用不强停 Session、不取消 Run、不消费 claim/ACK，也不丢弃未知投递证据。
+运行中的执行可以正常收尾和报告；新投递及自动恢复等待，原重试预算不重置或延长。
+需要停止时使用既有 stop/interrupt。启用不是立即启动空 Session，不激活 Draft、
+重开已完成 Task、解除 Task 停止或重放已接受/未知效果；仅允许原调度在原生命周期、
+权限及准确输入约束内继续。
+
+停用期间仍可编辑配置。Profile reset 恢复内置内容但保留启停状态；初始化、升级
+不会复活停用项。删除沿用已有引用检查。旧记录缺少 `enabled` 默认启用，
+存储 1.21 → 1.22 只声明新增可选字段，不改写历史记录、冻结 Session 或上下文。
+若 Operator/Task Leader 被停用，可由有权限的本地 CLI/Web 配置入口恢复；
+系统不会跳过关键职责、换人或假定完成。
+
 ## Profile
 
 Agent Profile 把可移植行为（指令、Skill 和访问意图）与运行时意图组合在一起。

package/docs/storage-baseline.md

@@ -2,7 +2,25 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.21. The 1.20 → 1.21 transition converts provably unedited
+Current storage is 1.24. The 1.23 → 1.24 transition adds transaction-maintained
+Task read-cache revisions for the scheduler's nine source tables. Inserts,
+updates and deletions invalidate only the affected Task; rollback also rolls
+back the token. These tokens are derived cache identities, never Task authority
+or a replacement for the Home revision CAS. Historical payloads are unchanged,
+and existing Tasks start with an implicit zero token until their first mutation.
+Two partial indexes support exact runtime-observation identity lookup without
+scanning or deserializing the historical observation set.
+
+The 1.22 → 1.23 transition adds global Shell Job
+definitions with revisioned script files and per-Run executable snapshots.
+It preserves existing payloads without rewriting any Job, schedule or history.
+
+The 1.21 → 1.22 transition admits an optional boolean
+`enabled` on Roles and Profiles. Absence means enabled. SQL layout, historical
+payloads, existing Task bindings, Session snapshots and input receipts are
+unchanged; upgrade does not launch or stop execution.
+
+The 1.20 → 1.21 transition converts provably unedited
 built-in Project sync defaults to timezone-explicit clock schedules, archiving
 their original bytes under migration 21. Ambiguous higher revisions and custom
 plans remain unchanged; no Git work or reauthorization occurs. See

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,16 @@
 
 # 存储基线 1.0
 
-当前存储为 1.21。1.20 → 1.21 将可证明未经修改的旧内置 Project 同步默认计划
+当前存储为 1.24。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
+同时增加两个局部索引，支持按精确运行观测身份查找，不再扫描或反序列化历史观测集合。
+
+1.22 → 1.23 新增全局 Shell Job、版本化脚本文件及每次运行的配置快照，不改写已有 Job、计划和历史记录。
+
+1.21 → 1.22 为 Role/Profile 声明可选布尔字段 `enabled`，
+缺省表示启用。SQL 布局、历史 payload、已有 Task 绑定、Session 快照和输入回执
+保持不变；升级不启动或停止执行。
+
+1.20 → 1.21 将可证明未经修改的旧内置 Project 同步默认计划
 转换为显式时区的整点计划，在 migration 21 下归档原始字节。更高 revision 的
 来源不明确计划及自定义计划保留，不执行 Git 或重新授权。保守转换边界见
 [Project 同步](project-sync.zh-CN.md)。

package/docs/testing/review-evaluation.md

@@ -14,7 +14,9 @@ may benefit from a short Task artifact index:
 
 - Goal/non-goals and effective decision references.
 - Observable scenarios, expected behavior and independent contract sources.
-- Contract entry points, callers and key risks.
+- For cross-layer/async risks, a short actual path: entry, consumers, relevant
+  waits/atomic commits, result and failure/recovery consequences, linked to
+  candidate code or existing documentation.
 - Candidate identity and actual check results (commit, environment, command,
   result), distinguishing unexecuted scenarios and uncovered boundaries.
 - For full re-review: repair delta, previous findings' dispositions and still
@@ -29,6 +31,38 @@ Later Brief/decision edits do not change an existing Review snapshot. This is
 not a document-completeness gate, prose parser or Skill-version freeze.
 Ordinary full review and the existing equivalence Delta Recheck remain distinct.
 
+### Keep the material small and actionable
+
+These are examples, not mandatory sections or a scenario quota. A simple E01
+handoff can cite its half-open interval contract and `main.mjs/select` directly:
+the caller supplies bounds and receives rows; timezone conversion is a non-goal.
+No separate path document is needed.
+
+For E03, the contract requires unchanged opaque cursors and ordered items.
+The actual path is caller -> `main.mjs/collect` -> await
+`page.mjs/fetchPage(cursor)` -> consume items/cursor -> next request or return.
+There is no persistent commit. Check the cursor at the downstream consumer,
+not merely the first successful page; a rejected request rejects collection,
+so accumulated rows are not returned as success. Retry/concurrent mutation is
+outside this example's contract. The index is a navigation hint, not a finding
+or a claim that all paths were inspected.
+
+Keep evidence roles separate: that contract is the expectation;
+`scripts/review-eval/verify.mjs`'s E03 probes are executable references;
+only an actual `node scripts/review-eval/evaluate.mjs verify` invocation plus its
+candidate commit, environment and output establishes a result. The probes use
+the two supplied modules for the counterexample, a one-page normal control,
+and a controlled wait followed by rejection to check pending/failure behavior.
+They do not exercise a live server, crash recovery or Reviewer behavior.
+
+In a pause/resume task, constraints might instead distinguish unsubmitted
+intent, registered/unknown effects, terminal settlement and legal resumption.
+Those are domain-specific examples, not universal state-machine requirements.
+Use the task's own contract and reachable paths. After a shared-root finding,
+check the other affected consumers in the same scope and refresh the small
+index and repair evidence; do not append the entire review history. Reviewer
+inspection still covers the complete frozen candidate, not just these hints.
+
 ## Small development corpus
 
 `scripts/review-eval/` is an offline file tool, not a scheduler, model adapter or

package/docs/testing/review-evaluation.zh-CN.md

@@ -12,7 +12,8 @@
 
 - 目标/非目标及有效决定入口。
 - 可观察场景、预期行为和独立契约依据。
-- 契约入口、调用方及关键风险。
+- 对跨层/异步风险，提供简短实际链路：入口、消费者、关键等待/原子提交边界、
+  结果及失败/恢复后果，并指向候选代码或已有文档。
 - 候选身份和实际检查结果（提交、环境、命令、结果），区分未执行场景与未覆盖边界。
 - 完整复审追加修复 delta、历史 Findings 处置及仍适用证据；当前完整冻结候选仍在范围内。
 
@@ -23,6 +24,29 @@
 后续 Brief/决定修改不改变既有 Review Snapshot。这不是文档齐全门禁、
 自然语言解析器或 Skill 版本冻结机制。普通完整复审与已有等价性 Delta Recheck 保持不同语义。
 
+### 保持材料简短且可用
+
+以下是示例，不是必填章节或场景配额。简单的 E01 交接可直接引用半开区间契约和
+`main.mjs/select`：调用方提供边界并接收行，时区转换是非目标，无须另写链路文档。
+
+E03 的契约要求原样传递不透明游标并按顺序返回条目。实际链路是：
+调用方 -> `main.mjs/collect` -> 等待 `page.mjs/fetchPage(cursor)` ->
+消费条目/游标 -> 下一次请求或返回。这里没有持久化提交。
+应检查下游消费者收到的游标，而不只是首个成功页面；请求拒绝时收集操作拒绝，
+已累计条目不会作为成功结果返回。重试/并发修改不属于此例契约。
+索引只是定位提示，不是缺陷结论，也不声称已检查所有路径。
+
+分清证据身份：上述契约是预期；`scripts/review-eval/verify.mjs` 的 E03
+探针是可执行引用；只有实际运行 `node scripts/review-eval/evaluate.mjs verify`
+并保留候选提交、环境和输出才构成结果。探针用给定的两个模块验证反例，
+提供单页正常对照，以及可控等待后拒绝的未完成/失败行为检查；
+不覆盖真实服务、崩溃恢复或 Reviewer 行为。
+
+暂停/恢复类任务的约束可能分别要求：未提交意图保留、已登记/未知效果不重放、
+已有执行允许终态收尾、恢复后沿合法意图继续。这些是领域示例，不是通用状态机要求。
+应以本任务契约和可达路径为依据。同根因发现后检查同范围内其他受影响消费者，
+刷新简短索引与修复证据，不追加整轮历史；Reviewer 仍检查完整冻结候选，不局限于这些提示。
+
 ## 小型开发集
 
 `scripts/review-eval/` 是离线文件工具，不是调度器、模型适配器或新增 Core 存储。

package/docs/testing/verification-levels.md

@@ -53,12 +53,12 @@ is required.
 Both include `test/core` and `test/platform`. For an already built checkout,
 `npm run test:business` runs only `test/core` and `npm run test:platform` runs
 only `test/platform`; neither rebuilds. CI owns one explicit build per job.
-The stable suite owns current storage 1.21 and its declared 1.0 through 1.20 minor
+The stable suite owns current storage 1.24 and its declared 1.0 through 1.23 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.21, exact schema/record validation, no initialization over
+1. Fresh storage 1.24, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and

package/docs/testing/verification-levels.zh-CN.md

@@ -39,12 +39,12 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 两者均包含 `test/core` 和 `test/platform`。已构建的 checkout 可分别运行
 `npm run test:business` 与 `npm run test:platform`，它们不会再次构建。
 CI 每个作业只显式构建一次。
-稳定套件维护当前存储 1.21 和明确声明的 1.0 至 1.20 连续小版本迁移，
+稳定套件维护当前存储 1.24 和明确声明的 1.0 至 1.23 连续小版本迁移，
 不包含未声明的历史格式兼容路径。
 
 当前覆盖包括：
 
-1. 新建存储 1.21、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
+1. 新建存储 1.24、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
 2. 精确版本暂存、目标不匹配拒绝、同主版本连续小版本预检、交接锁显式所有者，
    以及恢复时核对捕获的协议和存储身份，不接受缺失字段。
 3. 持久 Task／Message／Decision 上下文、Draft 激活权威、mailbox 认领、

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "2.16.0",
+  "version": "2.18.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/VERSION

@@ -1 +1 @@
-6
+7

package/skills/yui-leader/references/execution.md

@@ -303,12 +303,20 @@ authority. Never invent authorization, impersonate Operator, or modify the core
 
 ## Validate and make the review judgment
 
-Prepare useful evidence, not a documentation gate. Supply or reference the
-effective goals/non-goals and decisions, independently grounded expected
-behavior, key user paths/constraints, contract entry points and relevant callers.
-Keep three things distinct: a behavioral scenario and its expectation, an
-executable test reference, and an actual result with candidate/environment/
-command. Disclose real gaps rather than deriving acceptance from current code.
+Prepare useful evidence, not a documentation gate. From effective requirements,
+non-goals and decisions, distill the few observable behavioral constraints that
+matter to this change, with independently grounded expectations. Do not infer
+correctness from the candidate or its mocks.
+
+For material cross-layer or asynchronous risks, trace a short real path in the
+exact candidate: entry -> actual consumers -> relevant waits/atomic commit
+boundaries -> observable result and failure/recovery consequences. Point to
+candidate code or existing documents, not just module names or a coverage claim.
+Use it to expose where the same constraint must hold across boundaries; do not
+enumerate every entry or generate a combination matrix. Keep three things
+distinct: constraints/scenarios and expectations, executable test references,
+and actual results with candidate/environment/command. Name material unverified
+boundaries; a test reference alone is not a passing result.
 
 Small tasks can reference existing materials directly. For complex tasks, put a
 short review index in Task artifacts and its commit-pinned reference in Brief.
@@ -380,8 +388,11 @@ main synthesis through its exact AgentRun, preserving its selected source snapsh
 A Worker or Reviewer AgentRun result is evidence, not acceptance. Inspect the
 result, diff, checks, and current Candidate before deciding.
 
-Group confirmed findings by root cause and repair other reachable instances
-within scope together. For ordinary full re-review, preserve the current complete
+Group confirmed findings by root cause. Use the traced paths to check other
+reachable consumers/boundaries within scope and repair affected instances
+together, not just the reported checkpoint. Refresh the short material index
+and repair evidence where they changed, without accumulating round-by-round
+history. For ordinary full re-review, preserve the current complete
 candidate and requirements; add repair delta, prior finding dispositions and
 still-valid evidence. Delta is an attention aid, not the full-review boundary.
 Do not conflate this with an explicitly authorized equivalence Delta Recheck.