@zq-silk/yui 2.18.0 → 2.20.0

package/docs/release-workflow.md

@@ -51,6 +51,55 @@ merely to avoid a version decision. Package versions remain distinct from protoc
 and persistent-storage contracts: their compatibility checks and required migrations
 are unchanged, and the storage rules below do not authorize a package release.
 
+### 2.20.0 compatibility and migration notes
+
+This minor adds independent optional Role instance codes (`--instance-code` /
+`--clear-instance-code`) and a `Draft` marker for Leader Sessions with planning
+authority. Operator-only configuration does not propagate to Leader or other
+Roles. Task Role template copies remain independent; codes are presentation,
+not identity, authorization or launch-configuration drift. Full lowercase Task
+IDs remain unchanged. See [Role configuration](roles-and-configuration.md).
+
+New Sessions use the configured code. Normal Codex Host launches/resumes can refresh
+confirmed Yui-owned titles without forcing a stop/replacement. Historical untagged
+titles and recorded custom names are preserved. Codex resume naming requires
+the native name to match the previous generated title; missing metadata and
+user renames are left untouched. Title provenance advances only after a successful
+native naming receipt, not pre-start registration or live Host reuse. Other
+Providers receive generated names only on creation, never on resume. Provider
+naming remains best effort.
+
+Storage advances **1.24 → 1.25** through an additive, no-rewrite transition for
+optional Role code and Session title provenance. Older supported Homes follow
+the centralized contiguous chain; do not open an upgraded Home with older
+software. Controller/Host protocols remain v1. Publication does not authorize
+installing the release, migrating a production Home, restarting shared services,
+replacing Sessions or choosing codes for existing Roles.
+
+Release gates require exact-merge Core CI and the same runtime tarball's
+fresh-install matrix before npm `latest` publication. These deterministic
+checks do not establish real-model behavior.
+
+### 2.19.0 compatibility and migration notes
+
+This minor adds message backlog and blocked-delivery monitoring with Operator
+alerts (PR #492). Observations distinguish live work, paused execution and bounded
+retry from stalled delivery, retain original evidence, and deduplicate alerts
+across Controller restarts. Alerts include evidence-matched management guidance:
+inspect the exact input and execution first, distinguish rejected retry from
+unknown-result resolution, and require scoped stop proof or explicit replacement
+authority where applicable. Monitoring never retries, stops or replaces execution
+automatically; an alert is not recovery authority or proof of a unique root cause.
+
+Storage remains **1.24**, and Controller/Host protocols remain v1. Existing
+messages and events are preserved; this release adds no storage migration.
+Older supported Homes still use the centralized contiguous migration chain.
+With separate update authority, the Operator verifies the published artifact
+then runs `yui update --version 2.19.0`. Compatible live Sessions are retained;
+publishing alone does not update the installed program or recover other Tasks.
+Exact-merge Core CI and the same tarball's fresh-install platform/Node matrix
+remain release gates. These checks do not establish real-model behavior.
+
 ### 2.18.0 compatibility and migration notes
 
 This minor includes the already-merged independent Jobs workspace and global

package/docs/release-workflow.zh-CN.md

@@ -36,6 +36,43 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 不能将不兼容冒称为兼容，也不为回避版本选择新增历史兼容机制。包版本与协议、
 持久存储契约仍然独立：兼容性检查和必要迁移要求不变，下文存储规则不授予发版权限。
 
+### 2.20.0 兼容性及迁移说明
+
+本 minor 增加按 Role 独立可选的实例码（`--instance-code` /
+`--clear-instance-code`），以及持有 planning 权限的 Leader Session 的 `Draft`
+标识。仅设置 Operator 不会传播到 Leader 或其他 Role；Task Role 模板副本保持
+独立。实例码仅供展示，不改变身份、权限、启动配置版本或完整小写 Task ID。
+详见 [Role 配置](roles-and-configuration.zh-CN.md)。
+
+新会话采用配置，正常 Codex Host 启动/恢复可刷新确认由 Yui 管理的标题，不强停或替换会话。
+旧的无来源标记标题和已记录的用户标题保留。Codex 恢复时仅在原生名字仍匹配上次
+生成标题时改名；原生信息缺失或用户已改名则跳过。标题来源仅在原生命名成功回执后
+推进，不因预启动登记或存活 Host 复用而变化。其他 Provider 仅在新建时传入生成名，
+恢复时不传入。Provider 命名仍为尽力能力。
+
+存储通过中央连续迁移从 **1.24 → 1.25**，只增加可选实例码和标题来源，
+不改写历史记录。较早的受支持 Home 沿既有迁移链升级，不可用旧程序打开升级后的
+Home。Controller/Host 协议仍为 v1。发布不授权安装升级、迁移生产 Home、
+重启共享服务、替换会话或为现有 Role 选择实例码。
+
+发布门禁要求准确合入 commit 的 Core CI 和同一 runtime tarball 的全平台
+fresh-install 矩阵通过后才向 npm `latest` 发布；这些确定性验证不证明真实模型行为。
+
+### 2.19.0 兼容性及迁移说明
+
+本 minor 新增消息积压、投递阻塞监测及 Operator 告警（PR #492）。观测区分正常执行、
+暂停、有界重试与投递停滞，保留原始证据，并跨 Controller 重启去重告警。
+告警包含按证据匹配的管理恢复引导：先检查精确输入和执行状态，区分明确拒绝后的
+retry 与未知结果的 resolve，并在需要时要求精确停止证明或显式替换授权。
+监测不会自动重试、停止或替换执行；告警本身不是恢复授权，也不证明唯一根因。
+
+存储仍为 **1.24**，Controller/Host 协议仍为 v1。已有消息与事件保留，本版本
+不新增存储迁移；较早受支持 Home 仍通过集中式连续迁移链升级。
+另行获得更新授权后，由 Operator 核验实际发布包，再执行
+`yui update --version 2.19.0`。兼容的存活 Session 保留；发布本身不更新运行安装，
+也不恢复其他 Task。精确 merge commit 的 Core CI 与同一 tarball 的全新安装
+平台／Node 矩阵仍为发布门禁，这些验证不代表真实模型行为验证。
+
 ### 2.18.0 兼容性及迁移说明
 
 本 minor 包含已合入的独立 Jobs 工作区和全局 Shell 脚本 Job（PR #490），以及

package/docs/roles-and-configuration.md

@@ -18,6 +18,55 @@ requiring a same-named global Role. A global Role is a creation template only
 when the requested Task Role does not exist. Availability, producer separation
 and the frozen review candidate still apply.
 
+## Optional instance codes and Session titles
+
+Each Role can independently set a display-only instance code. For example,
+configure only Operator, leaving Leader and all other Roles unset:
+
+```sh
+yui config role update operator --instance-code dev-bj
+yui config role show operator
+yui config role update operator --clear-instance-code
+yui task role update task-159 leader --instance-code dev-sg
+```
+
+`add` also accepts `--instance-code`. Codes accept 1–24 UTF-16 units of Unicode
+letters, numbers, combining marks, hyphen and underscore; omit `@`. Whitespace,
+controls, escapes and punctuation are rejected, not silently normalized.
+There is no Home-wide fallback. A Global Role's code is copied when that template
+creates a Task Role; later template changes do not rewrite the copy. Agent
+Profiles do not supply display codes. Use Task Role update/clear for an existing
+copy. Codes do not alter launch revisions, permissions, IDs or message routing.
+Choose recognizable values; codes are not globally unique identities. Use
+Session inspection and the actual Home/native identity when resolving ambiguity.
+
+Generated Task titles use `Yui Leader task-159 Draft @dev-sg · Task name`.
+`Draft` means the Leader Session has planning authority, including a retained
+planning Session after activation; delivery Sessions omit it. Other Role names
+and the full lowercase Task ID remain intact. Operator uses
+`Yui Operator @dev-bj · MMDD`; without a code its existing
+`Yui · Operator · MMDD` format remains. The date derives from Session creation
+and the configured timezone. Other Global Roles get a generated title when a
+code is configured. Descriptions are truncated first without splitting surrogate
+pairs; if the identity itself cannot fit the 80-unit title limit, launch fails
+with a bounded diagnostic instead of truncating the identity.
+
+Configuration does not rename, stop or recreate a live Session. New Sessions
+use it; a subsequent normal Host launch/resume can refresh confirmed Yui-owned titles,
+not historical records. Existing untagged titles and recorded user names stay
+untouched. Codex applies a resume rename only when its returned native name still
+matches the previous generated title; absent metadata or a user rename prevents
+the rename. Codex records only successfully applied names; live Host reuse,
+skipped naming and naming failures do not advance title provenance. Naming is
+best effort; unsupported Providers or failures do not invalidate the Session.
+Other Providers receive generated names only on creation, never on resume,
+to protect native user renames. No restart is performed to force a naming change.
+On the safe Codex resume path, clearing a custom Global Role's code restores
+`Yui role`; clearing Operator's code restores its unconfigured format.
+
+Storage 1.24 → 1.25 adds optional code/title provenance without rewriting
+historical payloads or inferring who named an old Session.
+
 ## Enable and disable
 
 Availability is configuration, separate from active Agent selection, Session

package/docs/roles-and-configuration.zh-CN.md

@@ -15,6 +15,44 @@ Task Role 是 Task 局部的；global Role 提供已配置的默认值和全局
 的 global Role。只有当请求的 Task Role 不存在时，global Role 才作为创建模板。
 可用性、producer 分离和冻结的审查候选仍然适用。
 
+## 可选实例码与会话标题
+
+每个 Role 独立配置仅用于展示的实例码。例如只设置 Operator，其他角色留空：
+
+```sh
+yui config role update operator --instance-code dev-bj
+yui config role show operator
+yui config role update operator --clear-instance-code
+yui task role update task-159 leader --instance-code dev-sg
+```
+
+`add` 也接受 `--instance-code`。允许 1–24 个 UTF-16 单位的 Unicode 字母、
+数字、组合标记、短横线和下划线，不输入 `@`。空白、控制字符、转义和其他标点
+直接拒绝，不静默清洗。没有 Home 级默认值；Global Role 作为模板创建 Task Role
+时复制其值，之后模板变化不回写。Agent Profile 不携带实例码；既有 Task Role
+通过自己的 update/clear 修改。实例码不改变启动版本、权限、内部 ID 或消息寻址，
+也不保证全局唯一；遇到歧义应查看实际 Home、Session 和原生身份。
+
+生成的 Task 标题为 `Yui Leader task-159 Draft @dev-sg · 任务名`。
+`Draft` 根据 Leader Session 的 planning 权限显示；Task 激活后保留的 planning
+会话仍显示 Draft，delivery 会话不显示。保留完整小写 Task ID。
+Operator 为 `Yui Operator @dev-bj · MMDD`；未配置保持
+`Yui · Operator · MMDD`，日期使用会话创建时间和配置时区。
+其他 Global Role 配置实例码后生成标题。80 单位总长度内优先截断任务名，
+不拆开代理对；身份部分无法容纳则明确报错，不静默截断。
+
+配置修改不会立即重命名、停止或重建活动会话。新会话采用新配置，后续正常
+Host 启动/恢复可刷新确认由 Yui 管理的标题，不改写历史记录。
+缺少来源标记的旧标题及已记录的用户标题保留。Codex 恢复时只有原生返回的
+名字仍等于上次生成标题才改名；原生信息缺失或用户已改名则跳过。
+Codex 只记录已成功应用的名称；复用存活 Host、命名失败或跳过不推进标题来源。
+Provider 命名为尽力能力；失败或不支持不会使会话失效。其他 Provider 仅在新建时
+传入生成名，恢复时不重新传入名称，以保护原生用户改名；不为改名主动重启。
+在可安全改名的 Codex 恢复路径，清除自定义 Global Role 实例码后恢复
+`Yui role`；Operator 恢复未配置格式。
+
+存储 1.24 → 1.25 增加可选实例码和生成标题来源，不回填历史记录或猜测标题所有权。
+
 ## 启用与停用
 
 启停是配置状态，与 Active Agent、Session 是否运行和 Task executionGate 分开：

package/docs/storage-baseline.md

@@ -2,7 +2,10 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.24. The 1.23 → 1.24 transition adds transaction-maintained
+Current storage is 1.25. The 1.24 → 1.25 transition admits optional Role
+`instanceCode` and Session `generatedTitle` presentation fields without rewriting
+existing records. Untagged historical titles remain user-owned; no code or
+title provenance is inferred. The 1.23 → 1.24 transition adds transaction-maintained
 Task read-cache revisions for the scheduler's nine source tables. Inserts,
 updates and deletions invalidate only the affected Task; rollback also rolls
 back the token. These tokens are derived cache identities, never Task authority

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,7 @@
 
 # 存储基线 1.0
 
-当前存储为 1.24。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
+当前存储为 1.25。1.24 → 1.25 增加可选 Role `instanceCode` 和 Session `generatedTitle` 展示字段，不回填历史标题来源或实例码，不改写既有记录。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
 同时增加两个局部索引，支持按精确运行观测身份查找，不再扫描或反序列化历史观测集合。
 
 1.22 → 1.23 新增全局 Shell Job、版本化脚本文件及每次运行的配置快照，不改写已有 Job、计划和历史记录。

package/docs/testing/verification-levels.md

@@ -53,12 +53,12 @@ is required.
 Both include `test/core` and `test/platform`. For an already built checkout,
 `npm run test:business` runs only `test/core` and `npm run test:platform` runs
 only `test/platform`; neither rebuilds. CI owns one explicit build per job.
-The stable suite owns current storage 1.24 and its declared 1.0 through 1.23 minor
+The stable suite owns current storage 1.25 and its declared 1.0 through 1.24 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.24, exact schema/record validation, no initialization over
+1. Fresh storage 1.25, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and

package/docs/testing/verification-levels.zh-CN.md

@@ -39,7 +39,7 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 两者均包含 `test/core` 和 `test/platform`。已构建的 checkout 可分别运行
 `npm run test:business` 与 `npm run test:platform`，它们不会再次构建。
 CI 每个作业只显式构建一次。
-稳定套件维护当前存储 1.24 和明确声明的 1.0 至 1.23 连续小版本迁移，
+稳定套件维护当前存储 1.25 和明确声明的 1.0 至 1.24 连续小版本迁移，
 不包含未声明的历史格式兼容路径。
 
 当前覆盖包括：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "2.18.0",
+  "version": "2.20.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,