@zq-silk/yui 2.20.0 → 2.22.0

package/docs/managed-turn-and-session-runtime.md

@@ -29,9 +29,21 @@ submitting, unknown and interrupt-owned input still retain their handling path.
 scopes, phase/read costs and sampled event-loop lag are separate facts.
 Samples use a process-monotonic clock and hashed target/request labels, with
 at most 16 recent and 16 active samples plus the slowest completed sample.
-In-flight request count is not queue depth, and pre-routing wait is not
-measured. These observations neither identify an old incident retroactively
-nor establish quiescence; restarting a Controller does not refresh live Hosts.
+In-flight request count is not queue depth; total client-to-route wait is not
+measured by the server alone. These observations neither identify an old incident
+retroactively nor establish quiescence; restarting a Controller does not refresh live Hosts.
+
+`observations.commands.routes.transport` correlates socket accept-to-route,
+complete-frame receive-to-route and route-to-local-flush stages by the same
+request hash as route service time. A close before the response finishes is a
+failed transport observation, even if the business handler later succeeds.
+Client socket failures retain local monotonic connect/write/first-response/end
+timestamps in `details.diagnostic.controller.timing`; null means not observed.
+Match the request ID's SHA-256 prefix before comparing these with server stages.
+These are local events, not peer acknowledgement or pure kernel queue time.
+The interval before the server's accept callback includes unobserved socket and
+event-loop delay; sampled lag alone cannot attribute it to a scheduler phase.
+No timeout, coherence check, receipt, retry or stop/start policy is changed.
 
 `observations.persistence` separates main-thread database lock/body/commit
 costs from persistence-worker round trips, worker execution and worker reads.
@@ -54,6 +66,24 @@ admission and other lifecycle writes still require their own boundary analysis.
 Status responsiveness during these maintenance operations is not proof that
 every possible Controller stall has been eliminated.
 
+The worker-backed runtime drain reads its immutable inbox files asynchronously,
+as does native-Session discovery during launch. The 64-event fold limit is not
+a limit on the initial directory scan: a large retained backlog must not be
+read synchronously on the socket thread before that limit takes effect.
+Sorting, per-file validation, event identities, fold order and commit-before-ACK
+remain unchanged. This trades some backlog throughput for control responsiveness;
+it is not a bound on total backlog memory or every CPU operation. Synchronous
+producer deduplication and explicit worker-off drains still need separate
+boundary analysis.
+
+Controller stop retains the captured PID/start-generation fence through both
+graceful drain and physical recovery. If the ownership inventory is unreadable,
+a protected Home-validated discovery can retain that fence, but cannot authorize
+a signal. No physical match is not proof of exit: before allowing successor
+startup, the captured generation must be provably gone. A still-live generation
+times out; unavailable generation evidence refuses recovery. Explicit physical
+stop still revalidates UID, entrypoint, Home, PID and start identity before signalling.
+
 Idle Global inbox recovery and already-settled retry checks use read-only
 snapshots, without reserving SQLite's writer. Creating a recovery notice or
 settling an outstanding retry still rechecks the current Session/claim/input
@@ -85,12 +115,17 @@ pin a read snapshot, uncommitted writes cannot publish a reusable cache token,
 and only 16 recent Task projections are retained. Cache entries never authorize
 dispatch or replace exact mutation-time checks.
 
-A newly created global Operator conversation requests the native title
-`Yui · Operator · MMdd`, using Yui's configured time zone. The request is made
-only after the provider returns the exact new conversation identity; restore
-and reconnect paths never replay it. Providers without a post-create rename
-capability keep the usable Session and expose a diagnostic instead of treating
-metadata failure as Session-creation failure.
+Role instance codes and generated Session/planning titles are Yui presentation
+metadata, using Yui's configured time zone where a date is included.
+Managed Codex retains this launch title but does not submit native title
+synchronization, including on restore and reconnect. This intentional omission
+is logged locally, not emitted as a failed operation or recovery notification.
+An unsubmitted name is never persisted as an applied native title; the native
+conversation and business execution remain usable.
+The native title mutation has been observed to persist without replying and
+block later Goal/Turn requests, even with a separate metadata client. Automatic
+synchronization must not be restored merely by increasing a timeout or retrying
+an unknown write; it requires a verified nonblocking native path.
 
 ## Authority
 
@@ -177,14 +212,27 @@ continuations and the complete-original reading protocol.
 Run Context freezes Assignment, source references, effective configuration and
 workspace boundaries. A Role edit does not rewrite an existing Assignment.
 Reading either Context does not acknowledge input or create execution authority.
-Every managed input points to the exact Session Manifest and CLI entry. The
+Initial or changed managed input points to the exact Session Manifest and CLI entry. The
 Run Pack is a reference directory: read the relevant requirement and message
 bodies before acting, rather than treating a successful load as the deliverable.
 Planning Packs expose no Project write scope or Task-completion permission.
 
-The Manifest pointer is a recovery locator, not a read receipt. At the start of
-every turn run `yui session skills --json` through the Session's CLI/Home. It
-checks current paths, internal `VERSION` files and readability, without reading
+The Manifest pointer is a recovery locator, not a read receipt. The managed Host
+checks current paths, internal `VERSION` files and readability before submit/steer,
+including the native Operator TUI relay. Unchanged inputs carry a short check
+notice, not repeated Skill lists or a request for another Agent tool call.
+The ordinary notice is only a check result: it does not repeat compaction or
+loading procedures. Those belong to the launch contract and event-specific
+entry guidance. After lost context, reconstruct the current working set from
+the Runtime/Role entry points and references applicable to the next action;
+do not restore the union of every procedure used earlier in the conversation.
+This is instruction routing, not a claim that the Host detects compaction,
+can evict old text, or knows what the model remembers.
+First input, changed metadata and Host reattachment/recovery supply current pointers.
+Only confirmed Provider acceptance advances the Host-local notice state; failures
+and unknown submissions do not. This state is ephemeral, not a loading receipt.
+Unmediated clients retain `yui session skills --json` through their Session CLI/Home.
+The check operates without reading
 Skill bodies or walking/snapshotting resources. Builtins use the running
 installation's `skills/<id>` entry; configured Skills use `YUI_HOME/skills/<id>`.
 These paths do not contain a Session/content digest. After changing installation
@@ -200,6 +248,8 @@ compacted/uncertain context. Reuse only when versions are unchanged and the full
 instructions remain available now. Yui stores no "already read" state and does
 not claim to inspect the model's context. Historical packages remain audit only;
 missing/corrupt snapshots do not prevent valid Session resume or input delivery.
+Provider compaction is not reliably observable here: missing instructions still
+require Agent-directed reload even when engineering reports unchanged versions.
 Missing current files report their exact path and recovery action. Session
 identity, scope, writer fences and real CLI/Home incompatibility still reject.
 Always refresh dynamic facts. Leader notifications use
@@ -411,7 +461,7 @@ The three failure ingresses retain their native fencing/classification, while
 record creation and deduplication share one writer and supervisor notices use
 the existing event-routing boundary.
 
-Unknown Leader notifications preserve their wake and input window:
+Unknown or rejected Leader notifications preserve their wake and input window:
 
 ```sh
 yui task wake show <task> <wake>
@@ -419,14 +469,20 @@ yui task wake resolve <task> <wake> --reason <quiescence-evidence>
 ```
 
 Resolve releases the claim after native-effect fences are clear. It neither
-replays the notification nor invents acceptance or completion. Independent
+replays the notification nor invents acceptance or completion. A rejection,
+including one recorded after an unknown outcome, is not quiescence evidence.
+If an execution stop removed the operational mailbox, the exact durable
+notification attempt can still be explicitly released for inbox inspection
+and handling; a different current batch is never released. Missing delivery
+evidence is refused, not guessed. Original delivery events and handling claims
+remain unchanged; a repeated resolve adds no second disposition. Independent
 Role work and legal local facts are not a Task-wide recovery lock.
 
 Wake status records notification delivery, not Message implementation. For
 ordinary Leader notifications, `consumed` means native acceptance. Native Turn
 completion and Task delivery need their own runtime evidence and durable results.
-A rejected wake stays `dispatched` with its claim until explicit retry or Session
-replacement; an explicitly released historical wake can remain `dispatched`
+A rejected wake stays `dispatched` with its claim until explicit retry, no-replay
+resolve or Session replacement; an explicitly released historical wake can remain `dispatched`
 without a claim. Unknown acceptance cannot use `wake retry`.
 Session replacement preserves queued input for a new wake and current Context;
 it does not retroactively mark an old wake accepted. Late receipts cannot settle
@@ -725,10 +781,15 @@ Goal `stalled` alone neither establishes the cause nor warrants clearing Goal.
 
 In this candidate, `task wake retry` requires a proven-rejected, unconsumed
 exact claim, a corrected cause and no accepted/uncertain native execution.
-`task wake resolve` supports an unknown exact claim after shared-native
-quiescence; it releases scheduling without replay or semantic acknowledgement.
-Deferred delivery meets neither precondition. Do not assume another recovery
-package's extended behavior is installed. For Global Roles, this candidate
+As an alternative, not a sequence, `task wake resolve` supports an unknown or
+rejected exact notification attempt after shared-native/background/writer
+quiescence and persisted evidence; rejection (including after unknown) is not
+quiescence. It releases scheduling without replay or semantic acknowledgement.
+If the operational mailbox is absent, exact durable wake/attempt evidence is
+still required; another current batch is never released. Original claims,
+delivery events and saved alerts remain unchanged. Deferred delivery meets
+neither precondition. Refresh current installed capabilities before acting.
+For Global Roles, this candidate
 does not establish a dedicated targeted Host-stop command: inspect original
 input/control and `session retry <role> show`, then discover current authorized
 capabilities. There is no guessed Task equivalent or stop-all fallback.

package/docs/managed-turn-and-session-runtime.zh-CN.md

@@ -14,9 +14,20 @@ interrupt-owned 输入仍保留原处理路径。
 `controller status --json` 的 `identity.runtime.observations` 分别呈现已认证请求、
 调度待处理范围、阶段／读取成本及采样的事件循环延迟。样本使用进程单调时钟，
 目标／请求标签仅保存哈希；每组最多保留 16 个近期样本、16 个活动样本及最慢完成样本。
-in-flight 请求数不是排队数，路由前等待尚未测量。观测不能反推旧事故的唯一根因，
+in-flight 请求数不是排队数，服务端不能独自测量客户端到路由的完整等待。
+观测不能反推旧事故的唯一根因，
 也不构成静止证明；重启 Controller 不会刷新存活 Host。
 
+`observations.commands.routes.transport` 使用与 route service time 相同的请求哈希，
+分别关联 socket accept→route、完整帧 receive→route、route→本地 flush。
+响应完成前连接关闭会记录 transport 失败，即使业务 handler 随后成功。
+客户端 socket 失败在 `details.diagnostic.controller.timing` 保留单调时钟的
+connect／write／首个 response／end 时间戳；null 表示未观测到。
+比较服务端阶段前须匹配 request ID 的 SHA-256 前缀。这些是本地事件，
+不是对端确认或纯内核排队时间。服务端 accept callback 之前仍有未观测到的
+socket／事件循环延迟，不能仅凭采样 lag 归因到某个调度阶段。
+timeout、coherence、receipt、重试及 stop/start 策略均未改变。
+
 `observations.persistence` 将主线程数据库锁等待／事务体／提交成本，与持久化
 worker 的往返耗时、执行和读取成本分开。worker 摘要搭载既有响应，保留 worker
 实例标识；status 只读缓存观测，不另发诊断 RPC。比较往返和执行时间时须匹配
@@ -31,6 +42,18 @@ worker 的往返耗时、执行和读取成本分开。worker 摘要搭载既有
 隔离：启动准入、邮箱领取、到期 Job 准入及其他生命周期写入仍需分别分析边界。
 这些维护操作期间状态请求可响应，不代表 Controller 的所有长停顿都已消除。
 
+worker 模式的 runtime drain 改用异步读取不可变 inbox 文件，启动时的原生 Session
+发现也使用同一路径。64 条折叠上限不限制前置目录扫描，不能在该上限生效前，
+先在 socket 主线程同步读取整个积压。排序、逐文件校验、事件身份、折叠顺序及
+先提交后 ACK 保持不变。这以部分积压吞吐换取控制面响应，不构成总积压内存或
+全部 CPU 操作的上限；同步生产者去重及显式关闭 worker 的 drain 仍需分别分析。
+
+Controller stop 在优雅停止和物理恢复两条分支都保留所捕获的 PID／启动代次。
+所有权扫描不可读时，经权限及 Home 校验的 discovery 可以保留该代次约束，但
+不能据此发信号。未找到物理匹配不等于已退出：允许启动后继前，必须证明原代次
+已消失；仍活着则超时，代次证据不可读则拒绝恢复。显式物理停止在发信号前，
+仍复核 UID、入口、Home、PID 及启动代次。
+
 空闲 Global 收件箱恢复检查、已处分的重试检查使用只读快照，不申请 SQLite
 写锁。真正创建恢复通知或处分未完成重试时，仍在原写事务内复核当前
 Session／claim／输入。这消除的是空操作等锁，不是所有实际写入的竞争。
@@ -90,10 +113,13 @@ Provider binding，再结算执行占用。Global 停止证据保存为仅记录
 不触发新的原生输入。待投递通知不能重启已明确停止的 Session；普通 Host 脱离仍
 保留 active Session，可正常重连。部分切换失败后，仍须先结算旧输入再选择新会话。
 
-新建 global Operator 对话会按 Yui 当前配置时区请求原生标题
-`Yui · Operator · MMdd`。只有 Provider 返回新对话的确切身份后才执行该请求；
-恢复与重连路径不会重放。若 Provider 不支持创建后改名，已创建的 Session 仍保持
-可用，并留下诊断，而不会把元数据失败冒充为 Session 创建失败。
+Role 实例码及生成的 Session／规划标题属于 Yui 展示元数据；包含日期时采用当前
+配置时区。托管 Codex 保留 launch 标题，但不提交原生标题同步，恢复与重连也不提交。
+这一有意省略只写本地日志，不作为失败操作或恢复通知；未提交的标题不能记作已应用的
+原生标题，原生对话与业务执行保持可用。
+原生命名曾出现写入已生效却无回执、随后 Goal/Turn 请求阻塞的情况，独立元数据
+连接也未解决。恢复自动同步需要验证不会阻塞执行的原生路径，不能仅增加超时或重试
+结果未知的写入。
 
 ## 权威
 
@@ -137,8 +163,16 @@ Run Context 冻结 Assignment、来源引用、生效配置和工作区边界。
 和消息正文，而不是把加载成功当成交付物。规划 Pack 不暴露 Project 写范围或 Task 完成
 权限。
 
-Manifest 指针是恢复定位入口，不是已读凭据。每轮开始通过本 Session 的 CLI/Home 执行
-`yui session skills --json`，轻量检查当前路径、内部 `VERSION` 和文件可读性，不读取
+Manifest 指针是恢复定位入口，不是已读凭据。managed Host 在 submit/steer 前检查，
+原生 Operator TUI 代理也使用同一逻辑。普通未变化输入仅附短检查提示，不重复清单、
+不要求 Agent 再发工具调用；首次、元数据变化和 Host 重连／恢复才给当前入口。
+普通提示仅是工程检查结果，不逐轮重发压缩或加载操作说明；这些说明属于启动契约和
+事件触发的入口引导。丢失上下文后，从 Runtime／Role 入口和当前动作适用引用重建工作集，
+不恢复历史上用过的全部流程。这是指令路由，不声称 Host 能识别所有压缩、移除历史文本
+或判断模型记忆。任务原文和必要新鲜状态仍按业务需要读取。
+只有 Provider 明确接受才推进 Host 进程内的通知状态，失败与未知提交不推进；
+它不是持久化加载收据。不经过该 Host 的客户端仍通过本 Session CLI/Home 执行
+`yui session skills --json`。检查当前路径、内部 `VERSION` 和文件可读性，不读取
 正文或遍历/冻结资源。内置入口是当前安装目录的 `skills/<id>`，自定义入口是
 `YUI_HOME/skills/<id>`，不包含 Session/内容摘要；安装位置变化后由检查重新解析当前入口。
 Global Manifest 的 `skillCheckCommand` 使用自包含的 `session context <role>`，
@@ -147,6 +181,8 @@ Global Manifest 的 `skillCheckCommand` 使用自包含的 `session context <rol
 首次进入、版本变化、恢复，以及压缩后全文缺失或可用性不确定时，读取当前 Runtime、
 Role/custom Skills 全文及必要引用、Manifest 的 profile。只有版本未变且全文仍在当前
 上下文时才复用。系统不保存“已经读过”状态，也不声称检查了模型上下文。
+当前接口不能可靠观察 Provider 压缩；即使工程报告版本未变，Agent 发现指令缺失时
+仍须补读，不能将未发变化提示当作全文仍在的证明。
 历史冻结包仅作审计：缺失或损坏不阻止合法 Session 恢复与消息投递；当前文件缺失则
 报告具体路径和修复动作。身份、作用域、writer fence 与实际 CLI/Home 不兼容仍会拒绝。
 动态事实仍须刷新：
@@ -302,19 +338,23 @@ retry 把被拒绝批次及后续排队输入交回现有 mailbox，不把旧 wa
 工作区条目或当前 Session 引导协议。三类错误入口保留各自的原生身份检查与分类，
 错误创建、去重统一一个写入入口，上级通知统一使用事件路由边界。
 
-未知的 Leader 通知保留其唤醒和输入窗口：
+未知或被拒绝的 Leader 通知保留其唤醒和输入窗口：
 
 ```sh
 yui task wake show <task> <wake>
 yui task wake resolve <task> <wake> --reason <quiescence-evidence>
 ```
 
-resolve 在原生效果围栏清除后释放该认领。它既不重放通知，也不编造接受或完成。独立的
+resolve 在原生效果围栏清除后释放该认领。它既不重放通知，也不编造接受或完成。
+被拒绝（包括先 unknown 后 rejected）不等于已经静止。执行停止移除临时 mailbox 后，
+仍可依据该 wake 的精确持久投递 attempt 显式释放，以便在 inbox 检查和结清；
+不得释放另一当前批次。缺失投递证据时拒绝猜测。原始投递事件与处理认领保持不变，
+重复 resolve 不增加第二次处分。独立的
 Role 工作和合法的本地事实不是一把 Task 范围的恢复锁。
 
 wake 状态记录通知投递，不记录 Message 的实施结果。普通 Leader 通知的 `consumed`
 表示原生接受；原生 Turn 完成与 Task 交付应分别依据运行证据和持久结果判断。
-被拒绝的 wake 保持 `dispatched` 并保留 claim，直到显式重试或 Session 替换；
+被拒绝的 wake 保持 `dispatched` 并保留 claim，直到显式重试、无重放 resolve 或 Session 替换；
 已显式释放的历史 wake 可以保持 `dispatched` 而不占用 claim。
 接受状态未知的通知不能用 `wake retry` 重放。Session 替换把待投递输入
 保留给新 wake 与当前 Context，不会追溯把旧 wake 标成已接受；旧回执也不能结算
@@ -536,9 +576,12 @@ Host 中尚未持久化的事实。stop 请求保存不等于物理清理成功
 仅显示 Goal stalled 不能确定根因，也不能据此要求清 Goal。
 
 本候选的 `task wake retry` 仅适用已纠正原因、原准确 claim 仍未消费的明确 rejected，
-且不能存在已接受或不确定原生执行；`task wake resolve` 仅支持准确 unknown claim
-在共享原生静止证明后释放调度，不重放、不 ACK。deferred 不满足二者前提，不能假定
-其他恢复包的扩展行为已经安装。GlobalRole 未确认有专用准确 Host-stop 命令时，读取
+且不能存在已接受或不确定原生执行。另一可选动作是 `task wake resolve`：准确 unknown
+或 rejected 通知 attempt 在共享原生／后台／writer 静止及持久证据确认后释放调度，
+不重放、不 ACK。两者不是自动依次执行的步骤；rejected（包括 unknown 后的拒绝）
+不等于静止。operational mailbox 缺失时仍须精确持久 wake/attempt 证据，不能释放
+另一当前批次。原始处理认领、投递事件与已保存告警不改写。deferred 不满足二者前提，
+执行前刷新实际安装能力。GlobalRole 未确认有专用准确 Host-stop 命令时，读取
 原输入/control 和 `session retry <role> show`，再发现当前权限下的能力；不臆造
 Task 等价命令，也不退化为 stop-all。
 

package/docs/provider-retry.md

@@ -25,6 +25,17 @@ next input. Agents still own semantic recovery and acceptance.
   accepted failed Turn and original input. The error need not have qualified
   for automation; manual intent does not waive Session, authority, latest-Turn
   or background-quiescence checks.
+- A current-owner manual execution retry can recover that same failed Turn
+  across a message continuation and subsequent retries only when the durable
+  chain proves every intervening attempt was rejected before a Provider write.
+  Session, authority, Assignment, launch configuration and workspace must match.
+  It carries the current continuation input, not the earlier business directive,
+  and preserves the original automatic budget. Missing proof or any intervening
+  accepted/unknown input leaves ordinary admission fenced.
+- Once that exact recovery is accepted, its Agent can claim and acknowledge
+  the original continuation Message through the same verified lineage. This
+  is handling authority, not another delivery: recipient, continuation target,
+  prior claims and failure records stay unchanged; no Message is requeued.
 
 The records live on the existing Provider binding, with indexed pending-record
 reads and the existing Controller deadline timer. There is no retry Task status,

package/docs/release-workflow.md

@@ -51,6 +51,62 @@ merely to avoid a version decision. Package versions remain distinct from protoc
 and persistent-storage contracts: their compatibility checks and required migrations
 are unchanged, and the storage rules below do not authorize a package release.
 
+### 2.22.0 compatibility and migration notes
+
+Context reads now support bounded discovery, precise batched original retrieval,
+body transport receipts and focused notifications. Runtime/Role Skills organize
+required material around actions and recovery after compaction; pointers and
+transport receipts never prove semantic reading or acknowledge an input.
+Full originals remain available. Automated consumers must follow explicit
+pagination and retrieval references rather than assuming every default response
+contains every body. Help is focused by default; consumers needing the complete
+recursive command tree must explicitly request recursive help, including JSON
+consumers affected by the changed child projection.
+
+Host restoration and Controller scheduling/SQLite transaction boundaries are
+bounded without replaying unknown effects. Codex Host native title mutation is
+omitted where it could stall execution; Yui presentation retains Role instance
+codes and planning markers, but an unapplied native title is not recorded as
+success. Codex temporary-directory exclusion options are preserved end to end.
+
+Storage advances to **1.26** through the centralized **1.25 → 1.26** migration;
+the already-published 1.24 → 1.25 migration is unchanged. Back up the Home and
+use the normal upgrade/migration path; do not open a migrated Home with an older
+binary. Controller/Host protocols remain v1. Publishing this version does not
+update the global CLI, migrate a production Home or restart its services.
+
+The maintained evaluation entry is `scripts/eval/`, with shared infrastructure
+separate from context-specific logic. Context guidance and historical analyses
+live under `docs/evaluations/context/`; the old `scripts/collaboration-eval/`
+entry is retired. Engineering gathers measurements; Agents interpret actual
+experimental and production traces, including compaction boundaries and missing
+evidence. Local output reductions are not a claim of universal token savings.
+
+### 2.21.0 compatibility and migration notes
+
+Ordinary Task, Assignment and frozen-context evidence reads now use the local
+resource boundary rather than Task ownership as a confidentiality boundary.
+Catalog/search and relevant records are readable without borrowing the target
+Task's identity or execution authority. Cross-Task context explicitly reports
+`reference-only`. Consumers must not treat readable records, returned instructions,
+or a frozen pack as permission to write, claim input, dispatch, or control work.
+Real user/tenant, filesystem, authenticated transport and explicit read limits
+remain. Native conversation reads use existing legal native tools, not a new gateway.
+
+Leader follow-up guidance permits the existing reopen operation for same-result
+tracked diagnosis, evidence handoff, necessary coordination or delivery authorized
+by the user's request or an explicit unfinished commitment. Simple questions stay
+completed, diagnosis stays read-only, and reopen does not lift stop, archive,
+cancelled-intent, Session, workspace or external-effect restrictions. Existing
+reopen and InputRequest operations remain separate; no completed-state write
+exception or automatic replay is introduced.
+
+Storage remains **1.25** and Controller/Host protocols remain v1; no migration is
+added. Runtime and Role Skill versions advance independently of the package.
+Exact-merge Core CI and the same runtime archive's fresh-install matrix gate npm
+publication. These deterministic checks do not establish model semantic behavior.
+Publishing does not authorize a global installation update or production restart.
+
 ### 2.20.0 compatibility and migration notes
 
 This minor adds independent optional Role instance codes (`--instance-code` /
@@ -845,6 +901,12 @@ and timeout hierarchy. A no-target activation, help, `--json`, and every other
 command remain on the global CLI. Activation does not add another ordinary CLI
 routing path.
 
+Activation's two storage preflights use the verified target's existing read-only
+upgrade primitive in an isolated process, not its ordinary inactive CLI entry.
+The target must be installed in this Home with matching integrity and smoke
+evidence before each preflight. This neither migrates storage nor permits an
+inactive release or checkout CLI to read/write the Home through ordinary commands.
+
 ## Step catalog
 
 The plan is a fixed, predeclared subset of operations. Each plan entry has an

package/docs/release-workflow.zh-CN.md

@@ -36,6 +36,48 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 不能将不兼容冒称为兼容，也不为回避版本选择新增历史兼容机制。包版本与协议、
 持久存储契约仍然独立：兼容性检查和必要迁移要求不变，下文存储规则不授予发版权限。
 
+### 2.22.0 兼容性及迁移说明
+
+上下文读取增加有界发现、精确批量原文读取、正文传输回执及聚焦通知。
+Runtime／Role Skill 按动作组织必需材料，并明确上下文压缩后的恢复路径；
+指针和传输回执不证明语义阅读，也不自动 ACK。完整原文仍可获取。
+自动化调用方应遵循明确的分页和原文入口，不再假定默认返回包含全部正文。
+help 默认聚焦当前命令；需要完整递归命令树时须明确请求递归 help，
+使用 JSON 的调用方也应适配子命令投影变化。
+
+Host 恢复、Controller 调度及 SQLite 事务边界改为有界处理，不重放未知效果。
+Codex Host 在可能阻塞执行的路径省略原生标题变更；Yui 展示保留 Role 实例码及
+planning 标记，但不会将未应用的原生标题记为成功。Codex 临时目录排除选项
+贯穿配置及启动链路保留。
+
+存储通过集中式 **1.25 → 1.26** 迁移升级至 **1.26**；已发布的 1.24 → 1.25
+迁移不变。升级前备份 Home，并使用正常升级／迁移路径；不要用旧二进制打开
+已迁移的 Home。Controller/Host 协议仍为 v1。发布本版本本身不更新全局 CLI、
+不迁移生产 Home，也不重启服务。
+
+受维护的评测入口为 `scripts/eval/`，公共基础设施与上下文专属逻辑分离；
+上下文指导及历史分析位于 `docs/evaluations/context/`，旧
+`scripts/collaboration-eval/` 入口退役。工程负责数据统计，Agent 根据实验和
+线上实际轨迹分析，包括压缩边界及证据缺失；局部输出减量不代表普遍 token 收益。
+
+### 2.21.0 兼容性及迁移说明
+
+普通 Task、Assignment 和冻结上下文证据读取改按本地资源边界处理，不再将 Task
+归属本身作为保密边界。目录、搜索及相关记录可读，但不借用目标 Task 身份或执行权；
+跨 Task Context 明确标记 `reference-only`。调用方不得将可读记录、返回的指令或
+冻结包当作写入、领取输入、派发或控制执行的授权。真实用户／租户、文件系统、
+认证传输及明确阅读限制仍保留；原生会话读取复用合法原生工具，不增加专用网关。
+
+Leader 可依据同结果用户请求或明确未履行承诺，为需要跟踪的诊断、证据交接、
+必要协调或交付使用既有 reopen。简单问答保持 completed，诊断保持只读；重开
+不解除停止、归档、撤销意图、Session、工作区或外部效果限制。reopen 与 InputRequest
+仍是独立操作，不新增 completed 写入例外或自动重放。
+
+存储仍为 **1.25**，Controller/Host 协议仍为 v1，不新增迁移。Runtime 与 Role Skill
+版本独立递增。npm 发布仍要求准确合入 commit 的 Core CI，以及同一 runtime archive
+的全新安装矩阵通过；这些确定性检查不证明模型语义行为。发布不授权全局安装更新
+或生产重启。
+
 ### 2.20.0 兼容性及迁移说明
 
 本 minor 增加按 Role 独立可选的实例码（`--instance-code` /
@@ -629,6 +671,10 @@ CLI、Operator Session 和 Controller 替换保持兼容，而不必把每个命
 `dist/cli.js`。因此目标发布拥有完整的交接协议和超时层级。一次无目标的激活、help、
 `--json` 以及其他每个命令都留在全局 CLI 上。激活不新增另一条普通 CLI 路由路径。
 
+激活的两次存储预检在隔离子进程中调用已验证目标包现有的只读升级原语，不经过目标包
+尚未激活的普通 CLI 入口。每次预检前都要求目标已安装于此 Home，且完整性及冒烟回执
+匹配。这既不迁移存储，也不允许 inactive release 或源码 checkout 的普通命令读写 Home。
+
 ## 步骤目录
 
 计划是一个固定、预先声明的操作子集。每个计划条目有一个 id（工作流内唯一）、一个

package/docs/roles-and-configuration.md

@@ -155,6 +155,23 @@ different contracts. Provider bypass does not grant writes to another Project.
 Managed workspace owner, exact Assignment and resource grants enforce Yui
 operations; broad native permissions are not an OS sandbox.
 
+Codex configured permissions can explicitly exclude automatic writable temp roots:
+`--sandbox workspace-write --exclude-tmpdir-env-var true --exclude-slash-tmp true`.
+Each exclusion accepts `true` or `false`; `--clear-exclude-tmpdir-env-var` and
+`--clear-exclude-slash-tmp` remove the respective override. Omission preserves
+native defaults, not an implicit exclusion. Both fields require an explicit
+`workspace-write` sandbox and reject other adapters or conflicting strategies.
+Managed launches compile them into per-thread `sandbox_workspace_write`
+configuration on start/resume, never shared-daemon defaults or account files.
+Ordinary interactive launches use equivalent invocation-local structured options.
+The mapping follows the native
+[configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference).
+These exclude automatic `$TMPDIR` and `/tmp` grants, not explicitly authorized
+writable roots within those paths. They do not establish read isolation or
+prevent effects through an authorized Controller RPC. Inspect the actual native
+receipt and validate enforcement in a separately authorized disposable fixture;
+accepting the configuration does not prove OS sandbox enforcement.
+
 A write-intent delivery Leader launched in its own Task-owned main workspace
 captures that workspace's bound writable Projects without needing an open
 WorkItem. Accepted results do not remove this direct-delivery scope. An explicit
@@ -236,12 +253,23 @@ yui config role show <global-role>
 yui config profile show <profile>
 yui task role add <task> <role> --profile <profile>
 yui task role show <task> <role>
+yui task role show <task> <role> --view full
 yui task role update <task> <role> --environment <preparation-id>
 yui task role update <task> <role> --managed-environment
 yui task role session inspect <task> <role>
 yui task role session new <task> <role> --reason "<why a fresh Session is useful>"
 ```
 
+`task role show` defaults to the complete desired Role configuration and its
+current recorded Session configuration, not historical Run snapshots. Recorded
+configuration and a retained control target are not live-state or stop evidence;
+use the returned status/session inspection commands for those questions.
+`--view full` retains the previous complete `role`, `sessions`, and `runs`
+document with bounded pagination. JSON consumers needing those historical
+fields must now request that view and retain it on cursor continuations.
+This changes the CLI default JSON view, not storage or the `task.role.show`
+configuration RPC used by the interactive wizard.
+
 The global query uses the calling process's default native context. Task-scoped
 queries use the Controller's native account environment and the selected Role
 configuration; they never forward the caller's credentials to another Provider.

package/docs/roles-and-configuration.zh-CN.md

@@ -125,6 +125,18 @@ Provider 权限策略、Profile 访问意图和 Project 写范围是不同的合
 不授予对另一个 Project 的写入。受管工作区 owner、精确 Assignment 和资源 grant
 落实 Yui 操作；宽泛的原生权限不是 OS 沙箱。
 
+Codex configured 权限可显式排除自动加入的可写临时目录：
+`--sandbox workspace-write --exclude-tmpdir-env-var true --exclude-slash-tmp true`。
+两项均接受 `true`/`false`；`--clear-exclude-tmpdir-env-var` 和
+`--clear-exclude-slash-tmp` 分别清除覆盖。省略时保留原生默认语义，不默认排除。
+两项都要求显式 `workspace-write`，其他 adapter 或冲突策略会被拒绝。
+受管 start/resume 编译到该 Thread 的 `sandbox_workspace_write`，不修改共享 daemon
+默认值或账户文件；普通交互启动使用等价的单次调用结构化选项。
+映射依据[原生配置参考](https://learn.chatgpt.com/docs/config-file/config-reference)。
+这只排除自动 `$TMPDIR`、`/tmp` 写授权，不排除位于其中且被显式授权的 writable root；
+也不证明读隔离或阻止合法 Controller RPC 的副作用。配置被接受不是 OS 沙箱生效证明；
+应检查原生回执，并在另行授权的可丢弃 fixture 内验证实际执行边界。
+
 以 write 意图在自己 Task-owned main 工作区启动的 delivery Leader，从该工作区
 捕获已绑定 Project 的写域，不要求存在 open WorkItem；已接受结果也不会移除这个
 直接交付写域。显式 Assignment（包括空写域）仍决定受派发执行的范围。
@@ -189,12 +201,21 @@ yui config role show <global-role>
 yui config profile show <profile>
 yui task role add <task> <role> --profile <profile>
 yui task role show <task> <role>
+yui task role show <task> <role> --view full
 yui task role update <task> <role> --environment <preparation-id>
 yui task role update <task> <role> --managed-environment
 yui task role session inspect <task> <role>
 yui task role session new <task> <role> --reason "<why a fresh Session is useful>"
 ```
 
+`task role show` 默认返回完整的期望 Role 配置及当前记录的 Session 配置，
+不再附带历史 Run 配置副本。记录配置和保留的控制目标不等于实时状态或停止
+证明；需要这些事实时使用返回的 status/session 检查入口。`--view full`
+保留原来的完整 `role`、`sessions`、`runs` 文档及有界分页。依赖这些历史
+字段的 JSON 消费者须显式选择 full，并在后续游标读取中保持同一视图。
+这是 CLI 默认 JSON 视图变更，不改变存储，也不改变交互配置向导使用的
+`task.role.show` 配置 RPC。
+
 全局查询使用调用进程的默认原生环境；Task 查询使用 Controller 的原生账户环境及
 所选 Role 配置，不把调用方的凭据转交给其他 Provider。省略 `--error` 查看当前期望
 配置；指定错误记录时，使用失败时保存的模型、工作区、profile/settings 选项，不受

package/docs/storage-baseline.md

@@ -2,7 +2,10 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.25. The 1.24 → 1.25 transition admits optional Role
+Current storage is 1.26. The 1.25 → 1.26 transition admits optional Codex
+workspace-write temporary-directory exclusions without changing historical
+permission payloads. The published 1.24 → 1.25 transition remains unchanged
+and admits optional Role
 `instanceCode` and Session `generatedTitle` presentation fields without rewriting
 existing records. Untagged historical titles remain user-owned; no code or
 title provenance is inferred. The 1.23 → 1.24 transition adds transaction-maintained

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,7 @@
 
 # 存储基线 1.0
 
-当前存储为 1.25。1.24 → 1.25 增加可选 Role `instanceCode` 和 Session `generatedTitle` 展示字段，不回填历史标题来源或实例码，不改写既有记录。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
+当前存储为 1.26。1.25 → 1.26 增加 Codex workspace-write 可选临时目录排除字段，不改写历史权限 payload。已发布的 1.24 → 1.25 定义保持不变：增加可选 Role `instanceCode` 和 Session `generatedTitle` 展示字段，不回填历史标题来源或实例码，不改写既有记录。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
 同时增加两个局部索引，支持按精确运行观测身份查找，不再扫描或反序列化历史观测集合。
 
 1.22 → 1.23 新增全局 Shell Job、版本化脚本文件及每次运行的配置快照，不改写已有 Job、计划和历史记录。

package/docs/task-delivery.md

@@ -73,6 +73,13 @@ An existing merge/rebase/cherry-pick without the attempt's own progress receipt
 is not adopted from Git markers. Preserve the scene and choose explicit recovery;
 normal continuation uses the original receipt and never replays a completed step.
 
+If Git stopped but persisting the conflict failed, explicit `task integration
+continue` can resume that same operation when the original progress receipt,
+workspace, branch, source and Git metadata all match. This recovery requires a
+nonempty staged resolution with no unresolved, unstaged or untracked files.
+Ordinary re-entry does not authorize it; missing evidence still refuses recovery.
+It does not invent a conflict record, restart the source command or bypass checks.
+
 When checks are a DurableJob, the Integration retains that exact jobId while
 running. Once the Job settles, `task integration continue <task>/<integration>`
 consumes its result and performs the guarded finalization. Existing unsettled

package/docs/task-delivery.zh-CN.md

@@ -58,6 +58,11 @@ Integration 在候选 worktree 中套用固定来源提交，运行已配置的
 已有 merge/rebase/cherry-pick 若缺少原尝试的进度回执，不根据 Git 标记接管。
 保留现场并选择显式恢复；正常续作使用原回执，不重放已完成步骤。
 
+若 Git 已停止而保存冲突的事务失败，显式 `task integration continue` 可以继续
+同一次操作，但原进度回执、工作区、分支、来源和 Git 元数据必须全部匹配。
+此恢复要求非空且全部暂存的解决结果，无未解决、未暂存或未跟踪文件。
+普通重入不授权恢复；缺少证据仍拒绝。不伪造冲突记录、不重新发起来源命令，也不跳过检查。
+
 当检查是一个 DurableJob 时，Integration 在运行期间保留那个确切的 jobId。Job 结算
 后，`task integration continue <task>/<integration>` 消费其结果并执行带守卫的收尾。
 未结算的 Integration（包括冲突）仍阻止完成，不依赖 Agent 采用了什么执行顺序。

package/docs/task-discovery.md

@@ -116,11 +116,11 @@ source records; no report text is parsed into status. Web explicitly labels
 these facts and offers category navigation. Selected detail survives paging,
 filtering and refresh; only the detail read can establish absence.
 
-Task Leader Sessions see only their own Task. Assignment-scoped Workers and
-Reviewers use existing authorized Run Context instead of whole-Task discovery;
-the catalog rejects their request before counting. Global non-Operator and
-incomplete managed identities are rejected. Historical Leader diagnostic reads
-retain their original Task scope. A cursor is scope/filter-bound continuation,
+Task Leaders, Workers and Reviewers may discover relevant ordinary records
+under the local resource's access rules; Task/Assignment ownership does not
+filter the catalog. Global non-Operator and incomplete or unknown managed
+identities remain rejected. Historical readers retain read-only identity,
+never another Task's execution authority. A cursor is scope/filter-bound continuation,
 not a credential. Read operations do not consume messages, acknowledge jobs,
 wake Roles or query providers.