@zq-silk/yui 2.22.0 → 2.23.0

package/dist/runtime/structuredProviderHost.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import { createNativeTitleSync } from "./nativeTitleSync.js";
 import { Duplex } from "node:stream";
 import { nativeExecutable } from "./nativeExecutable.js";
 import { startMissingCodexSharedDaemon } from "./codexSharedDaemon.js";
@@ -15,6 +16,7 @@ import { JsonLineChannel, PROVIDER_MESSAGE_MAX_BYTES, terminateProcessGroup } fr
 import { PROVIDER_ACCEPT_TIMEOUT_MS } from "./runtimeDeadlines.js";
 import { foldPublicReply } from "./publicReply.js";
 import { createCodexNativeAccess } from "./codexNativeAccess.js";
+import { isNativeContextRecovery } from "./contextRecovery.js";
 const CODEX_PROXY_HANDSHAKE_TIMEOUT_MS = 10_000;
 /**
  * These Session implementations do not expose run-configuration observations.
@@ -396,7 +398,22 @@ class CodexStructuredProviderSession {
     onActivity;
     mirror;
     nativeAccountHome;
+    contextEpoch = 0;
+    async checkQuiescent() {
+        const snapshot = await this.runtime.readConversation(this.conversationId, { includeTurns: false });
+        if (snapshot.threadId !== this.conversationId || snapshot.status !== "idle"
+            || snapshot.activeTurnId !== undefined)
+            return false;
+        const backgrounds = await this.nativeAccess.read("thread/backgroundTerminals/list", {
+            threadId: this.conversationId, limit: 1
+        });
+        if (!Array.isArray(backgrounds.data) || !("nextCursor" in backgrounds)) {
+            throw new Error("Native background execution response is invalid.");
+        }
+        return backgrounds.data.length === 0 && backgrounds.nextCursor === null;
+    }
     appliedGeneratedTitle;
+    #titleSync;
     nativeAccess;
     #turnAttempts = new Map();
     adapterId = "codex";
@@ -456,16 +473,6 @@ class CodexStructuredProviderSession {
                 throw error;
             }
         }
-        if (control.sessionTitle !== undefined) {
-            // The native title mutation can persist without replying and stall later
-            // Goal/Turn requests, even through a separate metadata connection. Keep
-            // Yui's launch title, but do not put that optional mutation on a managed
-            // Session's execution path. Reconnect must not replay it either.
-            // This is an intentional omission, not a failed delivery or unavailable
-            // observer. Keep it in the Host log without waking an Agent to recover
-            // an operation that was never attempted.
-            mirror("stderr", "Native title synchronization was not submitted; Yui retains its Session title without blocking native Goal/Turn control.\n");
-        }
         const ownedTurn = control.kind === "restore" ? control.ownedTurn : undefined;
         // Keep notifications buffered during paginated recovery. Otherwise a live
         // terminal can be emitted before open returns and then returned again as a
@@ -521,6 +528,15 @@ class CodexStructuredProviderSession {
             }
         }
         const goal = await runtime.readGoal(conversationId);
+        session.#titleSync = createNativeTitleSync(payload, conversationId, session.nativeAccountHome, result => {
+            if (result.status === "confirmed")
+                session.appliedGeneratedTitle = result.title;
+            mirror("stderr", `Native title: ${JSON.stringify(result)}\n`);
+        });
+        void exit.then(() => session.#titleSync?.close());
+        // Fresh Threads may not be persisted until their first accepted input.
+        if (control.mode === "resume")
+            session.#titleSync.notify();
         return Object.freeze({
             session,
             ...(recoveredTerminal === undefined ? {} : { recoveredTerminal }),
@@ -530,6 +546,8 @@ class CodexStructuredProviderSession {
     #observeMessage(message, emit) {
         const method = typeof message.method === "string" ? message.method : "";
         const params = object(message.params) ?? {};
+        if (isNativeContextRecovery("codex", this.conversationId, message))
+            this.contextEpoch += 1;
         const threadId = optionalId(params.threadId);
         if (emit)
             this.publicReply = foldPublicReply(this.publicReply, this.conversationId, method, params);
@@ -539,6 +557,13 @@ class CodexStructuredProviderSession {
             }
             return undefined;
         }
+        if (method === "thread/name/updated") {
+            this.#titleSync?.close();
+            if (params.threadName !== this.appliedGeneratedTitle)
+                this.appliedGeneratedTitle = undefined;
+        }
+        if (method === "turn/started")
+            this.#titleSync?.notify();
         let goal;
         try {
             goal = codexGoalNotification({ method, params });
@@ -663,6 +688,7 @@ class CodexStructuredProviderSession {
                 conversationId: this.conversationId,
                 attemptId: turn.attemptId,
                 text: turn.boundedText,
+                ...(turn.additionalContext === undefined ? {} : { additionalContext: turn.additionalContext }),
                 expectedNoActiveTurn: true,
                 ...(turn.requireQuiescent ? { requireQuiescent: true } : {}),
                 ...(turn.expectedFailedNativeTurnId === undefined ? {} : {
@@ -682,6 +708,7 @@ class CodexStructuredProviderSession {
             this.#clientOwnedTurnId = acceptance.turnId;
             this.#clientOwnedAttemptId = turn.attemptId;
             this.#turnAttempts.set(acceptance.turnId, turn.attemptId);
+            this.#titleSync?.notify();
             return Object.freeze({
                 attemptId: turn.attemptId,
                 conversationId: this.conversationId,
@@ -712,6 +739,7 @@ class CodexStructuredProviderSession {
             conversationId: this.conversationId,
             expectedTurnId: nativeTurnId,
             text: turn.boundedText,
+            ...(turn.additionalContext === undefined ? {} : { additionalContext: turn.additionalContext }),
             clientUserMessageId: turn.attemptId
         });
         if (acceptance.status === "unknown") {
@@ -776,6 +804,7 @@ class CodexStructuredProviderSession {
         return result === "interrupted" ? "requested" : result;
     }
     terminate(signal) {
+        this.#titleSync?.close();
         terminateProcessGroup(this.child, signal);
     }
 }
@@ -787,6 +816,7 @@ class ClaudeStructuredProviderSession {
     channel;
     onGoal;
     mirror;
+    contextEpoch = 0;
     adapterId = "claude";
     get ownedProcessId() { return this.child.pid; }
     #activeAttemptId;
@@ -903,6 +933,8 @@ class ClaudeStructuredProviderSession {
         terminateProcessGroup(this.child, signal);
     }
     #receive(message, onTerminal, onAccepted, onActivity) {
+        if (isNativeContextRecovery("claude", this.conversationId, message))
+            this.contextEpoch += 1;
         const goal = claudeActiveGoal(message, this.conversationId);
         if (goal !== undefined) {
             const key = JSON.stringify(goal === null ? null : {

package/dist/storage/sqliteSchema.js

@@ -295,6 +295,26 @@ const MINOR_UPGRADES = Object.freeze([{
         targetChecksum: CURRENT_SCHEMA_CHECKSUM,
         // Optional workspace-write permission fields; preserve all existing payloads.
         sql: ""
+    }, {
+        fromVersion: "1.26",
+        toVersion: "1.27",
+        name: "host-upgrade-lifecycle-signals",
+        introducedIn: "next",
+        sourceChecksum: CURRENT_SCHEMA_CHECKSUM,
+        targetChecksum: CURRENT_SCHEMA_CHECKSUM,
+        // New versioned signal sources in the existing role-runtime mailbox. No
+        // historical requests are inferred and existing records remain unchanged.
+        sql: ""
+    }, {
+        fromVersion: "1.27",
+        toVersion: "1.28",
+        name: "native-title-effect-receipts",
+        introducedIn: "next",
+        sourceChecksum: CURRENT_SCHEMA_CHECKSUM,
+        targetChecksum: CURRENT_SCHEMA_CHECKSUM,
+        // Additive exact-identity intent/confirmation files under runtime/native-titles.
+        // Never invent native ownership or replay history during migration.
+        sql: ""
     }]);
 export function storageMinorUpgradePlan(from) {
     if (from === CURRENT_STORAGE_VERSION)

package/dist/storage/storageVersions.js

@@ -1,4 +1,4 @@
-export const CURRENT_STORAGE_VERSION = "1.26";
+export const CURRENT_STORAGE_VERSION = "1.28";
 export const MIN_SUPPORTED_STORAGE_VERSION = "1.0";
 export const STORAGE_FORMAT = "yui-home";
 export function isStorageVersion(value) {

package/docs/managed-turn-and-session-runtime.md

@@ -2,6 +2,99 @@
 
 # Session, AgentRun and notifications
 
+## Two lifecycle layers and nonblocking checks
+
+Controller custody of a Host and the Host's native Session lifecycle have
+separate event/guard/transition tables. Neither is an upgrade workflow.
+
+| Layer | Events and transitions | Authority and correlation |
+| --- | --- | --- |
+| Controller → Host | Fresh physical observations recover `unavailable`/`stopped`/`starting`/`running`. Authorized launch enters `starting`; matching launch handshake enters `running`. Stop or graceful-exit request enters `stopping`; sending exit does not prove `stopped`. Physical absence confirms `stopped`; unknown effects enter `unavailable`. | Owner, local operation/revision, returned binding and native Session ID. Durable Role/Task intent, launch reservations and exact process custody remain authoritative. |
+| Host → native Session | Launch, attachment, input acceptance, native activity, terminal, persistence, disconnect and exit drive the native states described below. | Native Session, proxy process, attempt and Turn identity; existing writer/resource fences still authorize effects. |
+
+The Controller wraps the shared Host port for launch/restore, observation and
+stop, including graceful-upgrade exit. A competing physical operation is
+rejected before its side effect, not queued or replayed by this FSM. Late
+reads and old bindings cannot overwrite newer custody; identical observations
+produce no hook feedback loop. A Controller restart reconstructs by observation,
+never by replaying the process-local state. Native completion/attachment exit
+does not prove Host process exit. Legal same-conversation resume correlates the
+layers without sharing their state enums or inventing another durable authority.
+
+Host-side native Session lifecycle state is owned by an explicit transition table, not
+by version detection. Launch/submit enters `starting`; attachment facts select
+`idle`, `busy`, `ready` (owned input), or `delivery-unknown`; acceptance enters
+`ready`; native execution enters `busy`; terminal handling enters `settling`;
+persisted settlement returns to observed `idle`/`busy`. Disconnect enters
+`starting`, classified failures retain their failure outcome, and exit enters
+`exited`. Only an explicit launch can leave `exited`. Native-TUI attachment
+readiness has its own event: `ready` there is not proof of native quiescence.
+Illegal edges do not mutate state; stale process, attempt and terminal-Turn
+facts are ignored. Exact writer/resource guards remain at command admission.
+This process-local reducer reconstructs from existing launch and native facts;
+it adds no persisted Session authority or upgrade workflow state machine.
+
+Optional before/after observations are immutable, deferred and independently
+coalesced (at most one running and one latest pending observation per check).
+“Before” describes the transition's source, not an awaited precondition.
+A slow or failing check cannot veto a transition or hold event folding/input
+delivery; checks must yield for I/O and honour cancellation before effects.
+They may recommend work to the separate fenced upgrade coordinator.
+Controller Host-state hooks suggest version reconciliation. Host Session-state
+hooks asynchronously observe current Skill metadata on attachment/settlement,
+without reading Skill bodies, committing a notice or assuming model memory.
+The exact per-input integrity check remains an ingress safeguard: invalid
+Skills can reject that input, but an optional check cannot stall lifecycle.
+Only accepted input advances the existing notice baseline; unchanged input
+is passed through without any extra content.
+
+Controller startup, Host connection/exit observations, Host state-change
+signals and event persistence trigger version checks without an explicit
+`update` request. Existing periodic reconciliation covers missed hints,
+including providers without reliable background-execution-end events and
+graceful exits that cannot emit a post-exit hint. Checks
+compare actual loaded Host/Endpoint implementations with this Controller's
+loaded target, never npm `latest`. Incomplete readiness on matching versions
+is not an upgrade reason. Checks stop on shutdown; already-admitted work
+retains the existing durable mailbox. A request pinned to a different target
+stays waiting for explicit recovery, not silent retargeting. An explicitly
+stopped Session is never restarted by a check.
+
+## Host upgrade and context checks
+
+`update` reports package installation, verified Controller startup and each
+Host separately. `update --hosts-status` reads current per-Host evidence without
+installing, starting or advancing a switch. Supported controlled Codex Hosts fence new input immediately,
+wait for the current native Turn and event persistence, inspect native background
+execution, and release their owned Endpoint before exiting gracefully. The
+existing role-runtime mailbox retains the exact generation, native Session,
+configuration digest and drain receipt across Controller restarts. A successor
+uses the recorded effective configuration and resumes that same conversation;
+only its loaded Host/Endpoint and control/event handshake confirm success.
+Queued Messages remain original and accepted/unknown inputs are never replayed.
+
+Paused Roles stay paused. Older Hosts, native-TUI-only attachments and Endpoints
+without a quiescence capability are retained with an unsupported diagnosis; no
+unsupported drain command is sent. A busy/unknown native execution has no
+bounded upgrade-completion promise. An uncertain launch is not automatically
+repeated; a later exact successful handshake can settle the retained request.
+This fence covers Host-controlled ingress, not arbitrary external native clients;
+it never terminates a shared daemon or native conversation.
+
+Host Skill checks still run before every input. Unchanged inputs are passed
+through exactly, with no notice, marker, separator or extra native input part.
+The attachment's loading guidance explains this managed-input contract; no
+notice is not a reason to repeat the check. Unmediated clients or uncertain
+current input routing retain the explicit Manifest check fallback; reusing a
+conversation alone does not establish Host mediation. Cold attachment,
+affected Skill changes and observed native compaction supply loading guidance;
+compaction invalidates the next input's metadata baseline. Without a reliable
+native event, the Agent must still recover any missing instructions using the
+Manifest. Neither a version nor an accepted notice proves model memory.
+Routine checks and empty inboxes are not user-facing progress.
+
+## Session stop and runtime observations
+
 Global Session stop/replacement uses the same exact native-execution quiescence
 boundary as Task Sessions. A departed Host or archived Session alone is not
 proof that an accepted input ended: its retained Provider binding is inspected
@@ -31,7 +124,9 @@ Samples use a process-monotonic clock and hashed target/request labels, with
 at most 16 recent and 16 active samples plus the slowest completed sample.
 In-flight request count is not queue depth; total client-to-route wait is not
 measured by the server alone. These observations neither identify an old incident
-retroactively nor establish quiescence; restarting a Controller does not refresh live Hosts.
+retroactively nor establish quiescence. A Controller restart does not itself
+prove Host replacement; asynchronous lifecycle checks still require a safe
+drain and the successor's actual handshake.
 
 `observations.commands.routes.transport` correlates socket accept-to-route,
 complete-frame receive-to-route and route-to-local-flush stages by the same

package/docs/managed-turn-and-session-runtime.zh-CN.md

@@ -2,6 +2,74 @@
 
 # Session、AgentRun 与通知
 
+## 两层生命周期与非阻塞检查
+
+Controller 对 Host 的管理状态、Host 对原生 Session 的生命周期分别拥有自己的
+事件、guard 和转换表，都不是升级流程状态机。
+
+| 层级 | 事件与转换 | 权限及关联 |
+| --- | --- | --- |
+| Controller → Host | 新鲜物理观测恢复 `unavailable`／`stopped`／`starting`／`running`；合法 launch 进入 `starting`，匹配启动握手进入 `running`。停止或优雅退出请求进入 `stopping`，发送退出不证明 `stopped`；物理不存在才确认 `stopped`，未知效果进入 `unavailable`。 | owner、本地操作／观测 revision、返回 binding 和原生 Session ID；持久 Role／Task 意图、启动 reservation 和精确进程权属仍是权威。 |
+| Host → 原生 Session | launch、附件、输入接受、原生活动、终态、持久化、断连和退出驱动下述原生状态。 | 原生 Session、proxy 进程、attempt 和 Turn 身份；原有 writer／资源栅栏继续授权副作用。 |
+
+Controller 在共享 Host port 处统一管理启动／恢复、观测与停止（含安全升级的优雅退出）。
+冲突物理操作在副作用前拒绝，不由状态机另建队列或重放。迟到读取和旧 binding 不能覆盖
+新管理状态；相同观测不重复触发检查反馈循环。Controller 重启后从观测重建，
+不重放进程内状态。原生轮次完成或附件退出不能证明 Host 进程已退出；
+合法恢复通过同一原生对话关联两层，不共用状态枚举或新增持久权威。
+
+Host 内的原生 Session 生命周期由明确的转换表管理，不由版本检查管理。
+launch／submit 进入 `starting`；附件事实选择 `idle`、`busy`、
+`ready`（持有输入）或 `delivery-unknown`；接受输入进入 `ready`；
+原生执行进入 `busy`；终态处理进入 `settling`；持久化结清后回到观测到的
+`idle`／`busy`。断连进入 `starting`，分类失败保留对应失败状态，退出进入
+`exited`，只有显式 launch 可离开它。原生 TUI 附件就绪有独立事件，
+其 `ready` 不证明原生执行静止。非法边不改变状态；过期的进程、attempt、
+终态 Turn 事实被忽略。精确 writer／资源 guard 仍在命令准入处执行。
+状态机仅在进程内从现有 launch 和原生事实恢复，不新增持久 Session 权威或升级流程状态机。
+
+可组合的前／后检查接收不可变观测，各自异步执行并合并重复提示
+（每项最多一个执行中和一个最新待处理观测）。“前”表示转换来源，不是等待完成的前置条件。
+慢检查或失败不能否决转换、阻塞事件折叠或输入投递；检查回调必须异步等待 I/O，
+并在请求副作用前响应取消。它们只能向独立的、受精确栅栏保护的升级协调器提出请求。
+Controller 的 Host 状态 hook 提议版本对账；Host 的 Session 状态 hook 在附件和结清时
+异步观测当前 Skill 元数据，不读正文、不提交通知基线、不假定模型记忆。
+逐输入完整性核验仍是投递安全门：无效 Skill 可以拒绝该次输入，但可选检查不能卡住生命周期。
+仍只有被接受的输入推进通知基线，未变化输入原样通过，不额外注入内容。
+
+Controller 启动、Host 连接／退出观测、Host 状态变化 signal 和事件持久化均可触发版本检查，
+不依赖显式 `update`。现有周期对账覆盖丢失提示、无法可靠提供后台执行结束事件的提供方，
+以及无法在退出后发出提示的优雅退出。
+比较对象是实际加载的 Host／Endpoint 实现与当前 Controller 已加载的目标，不查询 npm `latest`。
+版本匹配但就绪证据未齐不是升级理由。关闭时停止检查，已准入工作仍保留现有持久 mailbox；
+请求固定的目标与当前 Controller 不同时保持等待，交由显式恢复，不静默改目标。
+检查不会复活明确停止的 Session。
+
+## Host 升级与上下文检查
+
+`update` 分别报告程序安装、Controller 启动核验及逐 Host 的状态。
+`update --hosts-status` 只读查询逐 Host 证据，不安装、启动或推进切换。支持此能力的
+受控 Codex Host 先关闭新输入准入，等待当前原生轮次和事件持久化、核验后台执行，
+释放自己持有的 Endpoint 后优雅退出。现有 role-runtime mailbox 保存精确实现代际、
+native Session、配置摘要和排空回执，Controller 重启后仍可继续。
+后继使用原 effective 配置接回同一对话；实际加载的 Host/Endpoint、控制与事件能力
+握手通过后才确认成功。队列中的 Message 原文不变，不重放 accepted 或 unknown 输入。
+
+暂停角色保持暂停。旧 Host、仅有原生 TUI 的附件及不能证明静止的 Endpoint
+保留并报告不支持，不反复发送不支持的排空命令。忙碌或未知执行不承诺限时升级。
+启动结果未知不自动重放；后续精确成功握手可结清原请求。
+准入栅栏覆盖 Host 控制的入口，不控制任意外部原生客户端，也不会终止共享 daemon 或原生对话。
+
+Host 仍逐输入机械检查 Skills。未变化时原文原样通过，不添加检查通知、隐藏标记、
+分隔换行或原生输入片段。附件加载指引说明这一托管输入约定，不因没有通知而重复检查。
+绕过 Host 的客户端或当前输入路由不明时仍通过 Manifest 显式检查；复用同一对话
+本身不证明当前输入受 Host 托管。首次附件、局部 Skill 变化、已观测到的原生压缩
+提供相应加载指引；压缩使下一次输入的元数据基线失效。
+提供方无法可靠暴露事件时，Agent 仍须通过 Manifest 恢复缺失指令。
+版本和已接受的通知都不能证明模型记忆；例行检查、角色版本和空 inbox 不作为用户进度播报。
+
+## 会话停止与运行时观测
+
 局部停止等待自身的持久清理义务完成，不等待整个 Home 的 `scheduler.scan`
 循环排空。signal 只请求调度；完成仍以现有物理停止证明及清理事务为准。
 超时保留义务并阻止替换；选择失败和新会话启动未确认分别报告，不允许重放未知效果。
@@ -16,7 +84,8 @@ interrupt-owned 输入仍保留原处理路径。
 目标／请求标签仅保存哈希；每组最多保留 16 个近期样本、16 个活动样本及最慢完成样本。
 in-flight 请求数不是排队数，服务端不能独自测量客户端到路由的完整等待。
 观测不能反推旧事故的唯一根因，
-也不构成静止证明；重启 Controller 不会刷新存活 Host。
+也不构成静止证明；Controller 重启本身不证明 Host 已替换，
+异步生命周期检查仍须经过安全排空和后继实际握手。
 
 `observations.commands.routes.transport` 使用与 route service time 相同的请求哈希，
 分别关联 socket accept→route、完整帧 receive→route、route→本地 flush。

package/docs/release-workflow.md

@@ -51,6 +51,34 @@ merely to avoid a version decision. Package versions remain distinct from protoc
 and persistent-storage contracts: their compatibility checks and required migrations
 are unchanged, and the storage rules below do not authorize a package release.
 
+### 2.23.0 compatibility and migration notes
+
+Host upgrades use explicit lifecycle signals and safe drain/reattachment
+boundaries without replaying business input or replacing native identity.
+Routine Skill checks remain inside the Host; unchanged Turns carry no Skill
+notice. Cold attachment, explicit context loss/compaction and changed Skills
+provide only the current loading pointers.
+
+Codex keeps original user input separate from application context on start and
+steer. Failed-Turn recovery does not duplicate the original input or imply lost
+Skill context. This requires the native `additionalContext` contract verified
+against Codex CLI 0.159.2; older native implementations are not covered and there
+is no fallback that reinserts metadata into user input.
+
+Native titles reuse the Role/Task/Draft/instance format through an independent,
+bounded metadata process, never blocking Startup, Goal or Turn. Exact identity,
+persisted intent and native readback distinguish confirmed naming from unknown
+effects. Observed manual names are preserved; unknown writes are not replayed.
+Historical polluted names without ownership evidence are diagnosed, not renamed.
+The native naming API has no compare-and-swap, so a final concurrent external
+rename cannot be protected atomically.
+
+Storage advances to **1.28**, preserving **1.26 → 1.27** Host-upgrade signals and
+adding **1.27 → 1.28** native-title receipts without rewriting history. Back up
+the Home and use the normal upgrade/migration path; do not open a migrated Home
+with an older binary. Controller/Host protocols remain v1. Publishing does not
+update the global CLI, migrate production data or restart shared services.
+
 ### 2.22.0 compatibility and migration notes
 
 Context reads now support bounded discovery, precise batched original retrieval,

package/docs/release-workflow.zh-CN.md

@@ -36,6 +36,26 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 不能将不兼容冒称为兼容，也不为回避版本选择新增历史兼容机制。包版本与协议、
 持久存储契约仍然独立：兼容性检查和必要迁移要求不变，下文存储规则不授予发版权限。
 
+### 2.23.0 兼容性及迁移说明
+
+Host 升级使用明确的生命周期信号及安全排空／重新挂接边界，不重放业务输入、
+不替换原生会话身份。常规 Skill 检查保留在 Host 内，未变化的 Turn 不携带
+Skill 提示；仅首次挂接、明确上下文丢失／压缩及 Skill 变化提供当前加载指针。
+
+Codex 的 start／steer 将用户原文与应用上下文分离。失败 Turn 恢复不复制原文，
+也不视为 Skill 上下文丢失。此路径要求原生 `additionalContext` 契约，已核对
+Codex CLI 0.159.2；旧原生实现不在验证范围内，不提供把元信息塞回用户输入的回退。
+
+原生标题复用 Role／Task／Draft／实例格式，通过独立、有界的元数据进程同步，
+不阻塞 Startup、Goal 或 Turn。精确身份、持久化意图和原生读回区分成功与未知效果。
+保留已观测到的手动命名，未知写入不重放；缺乏归属证据的历史污染标题只诊断、不改名。
+原生命名 API 没有 compare-and-swap，无法原子保护最后读写窗口内的外部并发改名。
+
+存储升级至 **1.28**：保留 **1.26 → 1.27** Host 升级信号迁移，追加
+**1.27 → 1.28** 原生标题回执，不改写历史。升级前备份 Home，使用正常升级／迁移
+路径，不要用旧二进制打开已迁移的 Home。Controller/Host 协议仍为 v1。
+发布本身不更新全局 CLI、不迁移生产数据，也不重启共享服务。
+
 ### 2.22.0 兼容性及迁移说明
 
 上下文读取增加有界发现、精确批量原文读取、正文传输回执及聚焦通知。

package/docs/storage-baseline.md

@@ -2,7 +2,16 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.26. The 1.25 → 1.26 transition admits optional Codex
+Current storage is 1.28. The 1.27 → 1.28 transition admits exact-identity native
+title effect receipts under `runtime/native-titles`. It does not infer historical
+title ownership, rename conversations, or change existing database payloads.
+Unconfirmed naming intents remain non-replayable across Host replacement.
+
+The 1.26 → 1.27 transition admits versioned Host-upgrade
+signals in the existing role-runtime mailbox. It adds no table, infers no past
+upgrade request, and preserves existing payloads. Drain receipts precede Host
+exit; a Controller restart resumes the exact request, not business input.
+The 1.25 → 1.26 transition admits optional Codex
 workspace-write temporary-directory exclusions without changing historical
 permission payloads. The published 1.24 → 1.25 transition remains unchanged
 and admits optional Role

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,11 @@
 
 # 存储基线 1.0
 
-当前存储为 1.26。1.25 → 1.26 增加 Codex workspace-write 可选临时目录排除字段，不改写历史权限 payload。已发布的 1.24 → 1.25 定义保持不变：增加可选 Role `instanceCode` 和 Session `generatedTitle` 展示字段，不回填历史标题来源或实例码，不改写既有记录。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
+当前存储为 1.28。1.27 → 1.28 声明 `runtime/native-titles` 下绑定精确会话身份的原生标题意图与回执；迁移不认领历史标题、不改名、不改写既有数据库 payload。未确认改名意图在 Host 替换后也不得重放。
+
+1.26 → 1.27 允许现有 role-runtime mailbox 保存版本化 Host 升级信号，不新增表、不推断历史升级请求、不改写既有 payload。排空回执先于 Host 退出持久化；Controller 重启继续精确升级请求，不重放业务输入。
+
+1.25 → 1.26 增加 Codex workspace-write 可选临时目录排除字段，不改写历史权限 payload。已发布的 1.24 → 1.25 定义保持不变：增加可选 Role `instanceCode` 和 Session `generatedTitle` 展示字段，不回填历史标题来源或实例码，不改写既有记录。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
 同时增加两个局部索引，支持按精确运行观测身份查找，不再扫描或反序列化历史观测集合。
 
 1.22 → 1.23 新增全局 Shell Job、版本化脚本文件及每次运行的配置快照，不改写已有 Job、计划和历史记录。

package/docs/testing/verification-levels.md

@@ -53,12 +53,12 @@ is required.
 Both include `test/core` and `test/platform`. For an already built checkout,
 `npm run test:business` runs only `test/core` and `npm run test:platform` runs
 only `test/platform`; neither rebuilds. CI owns one explicit build per job.
-The stable suite owns current storage 1.26 and its declared 1.0 through 1.25 minor
+The stable suite owns current storage 1.28 and its declared 1.0 through 1.27 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.26, exact schema/record validation, no initialization over
+1. Fresh storage 1.28, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and

package/docs/testing/verification-levels.zh-CN.md

@@ -39,12 +39,12 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 两者均包含 `test/core` 和 `test/platform`。已构建的 checkout 可分别运行
 `npm run test:business` 与 `npm run test:platform`，它们不会再次构建。
 CI 每个作业只显式构建一次。
-稳定套件维护当前存储 1.26 和明确声明的 1.0 至 1.25 连续小版本迁移，
+稳定套件维护当前存储 1.28 和明确声明的 1.0 至 1.27 连续小版本迁移，
 不包含未声明的历史格式兼容路径。
 
 当前覆盖包括：
 
-1. 新建存储 1.26、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
+1. 新建存储 1.28、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
 2. 精确版本暂存、目标不匹配拒绝、同主版本连续小版本预检、交接锁显式所有者，
    以及恢复时核对捕获的协议和存储身份，不接受缺失字段。
 3. 持久 Task／Message／Decision 上下文、Draft 激活权威、mailbox 认领、

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "2.22.0",
+  "version": "2.23.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-runtime/SKILL.md

@@ -13,9 +13,14 @@ Resolve links relative to their containing file.
 ## Keep the current working set
 
 The managed Host mechanically checks current Skill VERSION/readability for each
-input. Use its short check result/current pointers; do not duplicate that check.
-Without a Host check, run the Manifest's `contextProtocol.skillCheckCommand`
+input. It injects guidance only when loading is needed; unchanged inputs carry
+no notice or marker. Do not duplicate the Host's check merely because no notice
+appears. For unmediated clients or uncertain current input routing, run the
+Manifest's `contextProtocol.skillCheckCommand`
 (older Manifests: `yui session skills --json`) through the intended CLI/Home.
+Conversation reuse alone does not establish Host mediation. Keep routine
+role/Skill checks and empty-inbox observations internal; only report business
+progress or actionable failures.
 Global `loadCommand` includes the check. Recheck after repair/relevant change.
 
 A check is metadata, not bodies, remembered instructions, a loading receipt or

package/skills/yui-runtime/VERSION

@@ -1 +1 @@
-44
+46