@zq-silk/yui 2.22.0 → 2.25.0

package/docs/release-workflow.md

@@ -51,6 +51,90 @@ merely to avoid a version decision. Package versions remain distinct from protoc
 and persistent-storage contracts: their compatibility checks and required migrations
 are unchanged, and the storage rules below do not authorize a package release.
 
+### 2.25.0 compatibility and migration notes
+
+This minor release removes macOS Intel support. Supported runtimes are now
+Linux x64 (glibc) and macOS Apple Silicon with native arm64 Node.js. macOS x64,
+including x64 Node.js under Rosetta on Apple Silicon, is rejected before either
+CLI product is loaded or the Home is opened. Intel Macs must remain on 2.23.0;
+Apple Silicon users must switch to native arm64 Node.js before upgrading.
+The combined npm manifest cannot express OS/CPU pairs, so npm installation can
+still succeed on an unsupported combination. Runtime startup fails explicitly;
+no install scripts, fallback helpers or first-use downloads are added.
+The existing updater's staged-target preflight also rejects that runtime before
+Controller shutdown, global binary activation or storage migration.
+
+Native builds, package contents, Core CI and release smoke now cover only those
+two platforms. Every supported Node 20/22/24/26 install remains gated (8 rows),
+with process lifecycle coverage on Node 24 for each platform. The `v2.24.0`
+tag is retained as unpublished evidence: required Intel smoke jobs did not
+acquire hosted runners, and neither npm nor GitHub Release was published.
+2.25.0 includes its complete configurable Git budget/error-handling changes
+described below.
+
+Storage remains **1.29**; the platform removal adds no migration. Updating from
+2.23.0 still applies the declared **1.28 → 1.29** Git configuration migration.
+Back up the Home and use the normal upgrade/migration path; do not open a
+migrated Home with an older binary. Controller/Host protocols remain v1.
+Publication does not update the global CLI, migrate production data or restart
+shared services. Deterministic package/OS checks do not establish real-model
+or real remote-server behavior.
+
+### 2.24.0 unpublished tag: Git budgets and migration
+
+Git workspace and artifact operations now use a configurable local total
+budget, independent of clone, remote fetch and network `ls-remote`. Configure
+`git-local-timeout-seconds` (default 30),
+`git-remote-inactivity-timeout-seconds` (default 120), and
+`git-remote-timeout-seconds` (default 1800) under `yui config tools` or Web
+settings. Each accepts integer seconds from 1 to 86400. Changes apply to the
+next command, including Controller-owned commands; in-flight budgets do not
+change. See [Git operation budgets](roles-and-configuration.md#git-operation-budgets).
+
+Clone/fetch request progress without a terminal. Output resets only the
+inactivity clock, never the total deadline; activity is not semantic progress
+proof. Remote stderr keeps a bounded tail. Timeout errors retain their kind
+and budget, elapsed time, exit code, signal and stderr instead of reporting
+only the last progress line. Deadline termination includes the invocation's
+owned transport helpers; no automatic Git retry or rollback is introduced.
+
+Storage advances **1.28 → 1.29** through the centralized additive migration
+for the three optional settings. Existing config bytes remain unchanged and
+missing values use runtime defaults. Back up the Home and use the normal
+upgrade/migration path; do not open a migrated Home with an older binary.
+Controller/Host protocols remain v1. Exact-merge Core CI and the same runtime
+archive's fresh-install matrix gate publication. These deterministic checks
+do not establish real remote-server or real-model behavior. Publication does
+not update the global CLI, migrate production data or restart shared services.
+
+### 2.23.0 compatibility and migration notes
+
+Host upgrades use explicit lifecycle signals and safe drain/reattachment
+boundaries without replaying business input or replacing native identity.
+Routine Skill checks remain inside the Host; unchanged Turns carry no Skill
+notice. Cold attachment, explicit context loss/compaction and changed Skills
+provide only the current loading pointers.
+
+Codex keeps original user input separate from application context on start and
+steer. Failed-Turn recovery does not duplicate the original input or imply lost
+Skill context. This requires the native `additionalContext` contract verified
+against Codex CLI 0.159.2; older native implementations are not covered and there
+is no fallback that reinserts metadata into user input.
+
+Native titles reuse the Role/Task/Draft/instance format through an independent,
+bounded metadata process, never blocking Startup, Goal or Turn. Exact identity,
+persisted intent and native readback distinguish confirmed naming from unknown
+effects. Observed manual names are preserved; unknown writes are not replayed.
+Historical polluted names without ownership evidence are diagnosed, not renamed.
+The native naming API has no compare-and-swap, so a final concurrent external
+rename cannot be protected atomically.
+
+Storage advances to **1.28**, preserving **1.26 → 1.27** Host-upgrade signals and
+adding **1.27 → 1.28** native-title receipts without rewriting history. Back up
+the Home and use the normal upgrade/migration path; do not open a migrated Home
+with an older binary. Controller/Host protocols remain v1. Publishing does not
+update the global CLI, migrate production data or restart shared services.
+
 ### 2.22.0 compatibility and migration notes
 
 Context reads now support bounded discovery, precise batched original retrieval,
@@ -738,7 +822,7 @@ protection and valid exact-identity caches remain normal runtime behavior.
 
 Stable releases use npm `latest`; prereleases use `next`, never the stable
 default. The release workflow builds one runtime archive, verifies it across
-supported Node versions on Linux x64, macOS x64 and macOS arm64, publishes that exact archive to npm, then creates the
+supported Node versions on Linux x64 and macOS arm64, publishes that exact archive to npm, then creates the
 matching GitHub Release. Every release carries the runtime archive, checksum and
 provenance. A stable tag becomes GitHub latest; a prerelease does not.
 
@@ -1063,7 +1147,7 @@ It reuses the exact commit that passed core CI and adds only artifact assembly,
 fresh installation, and provenance checks required to publish.
 
 Business contracts and full Jobs/Schedules wiring run once in Core CI on Linux
-Node 24. Release still installs the same checksummed archive on all three
+Node 24. Release still installs the same checksummed archive on both supported
 platforms × Node 20/22/24/26: every install checks CLI/setup/native helpers,
 Doctor/PTY and real SQLite SQL/GC. Node 24 additionally checks real process
 lifecycle on each platform. See the [coverage table](testing/verification-levels.md#ci-and-release).

package/docs/release-workflow.zh-CN.md

@@ -36,6 +36,70 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 不能将不兼容冒称为兼容，也不为回避版本选择新增历史兼容机制。包版本与协议、
 持久存储契约仍然独立：兼容性检查和必要迁移要求不变，下文存储规则不授予发版权限。
 
+### 2.25.0 兼容性及迁移说明
+
+本次 minor 版本移除 macOS Intel 支持。仅支持 Linux x64（glibc）和使用原生
+arm64 Node.js 的 macOS Apple Silicon。macOS x64（包括 Apple Silicon 上通过
+Rosetta 运行的 x64 Node.js）会在加载任一 CLI 产品或打开 Home 前明确拒绝。
+Intel Mac 用户须停留在 2.23.0；Apple Silicon 用户须先切换到原生 arm64 Node.js。
+合并 npm 包的 OS/CPU 字段不能表达平台配对，因此不支持的组合仍可能安装成功，
+但启动时会明确失败；不新增安装脚本、备用 helper 或首次使用下载。
+既有 updater 的目标包预检也会在停止 Controller、替换全局二进制或迁移存储前拒绝。
+
+原生构建、包内容、Core CI 和发布冒烟同步收敛到上述两个平台。
+保留全部受支持 Node 20/22/24/26 的全新安装门禁（8 组），各平台 Node 24
+仍验证真实进程生命周期。保留 `v2.24.0` tag 作为未发布证据：
+必需的 Intel 冒烟作业未能获得 hosted runner，npm 和 GitHub Release 均未发布。
+2.25.0 包含下文完整的 Git 预算配置及错误保真变更。
+
+存储仍为 **1.29**，移除平台本身不新增迁移；从 2.23.0 升级仍执行已声明的
+Git 配置 **1.28 → 1.29** 迁移。升级前备份 Home，使用正常升级／迁移路径，
+不要用旧二进制打开已迁移的 Home。Controller/Host 协议仍为 v1。
+发布本身不更新全局 CLI、不迁移生产数据，也不重启共享服务。
+确定性安装包及 OS 检查不证明真实模型或真实远端服务器行为。
+
+### 2.24.0 未发布 tag：Git 预算及迁移
+
+Git 工作区和产物操作使用可配置的本地总耗时预算，与 clone、远程 fetch 和需要连接
+远端的 `ls-remote` 分离。在 `yui config tools` 或 Web 设置中配置
+`git-local-timeout-seconds`（默认 30）、
+`git-remote-inactivity-timeout-seconds`（默认 120）及
+`git-remote-timeout-seconds`（默认 1800）；三项均接受 1–86400 的整数秒。
+保存后下一条命令生效，包含 Controller 发起的命令，已启动命令保持原预算。
+参见 [Git 操作预算](roles-and-configuration.zh-CN.md#git-操作预算)。
+
+clone/fetch 无终端时也请求进度。输出只重置无进展计时，不延长总耗时上限；
+有输出不等于传输实际推进。远程 stderr 保留有界尾部。错误保留超时类型和预算、
+实际耗时、退出码、信号及 stderr，不再只显示最后一行进度。预算耗尽时终止本次调用
+自己的传输 helper；不引入自动 Git 重试或回滚。
+
+存储通过集中式增量迁移从 **1.28 → 1.29**，声明三项可选配置。
+既有配置逐字节保留，缺失字段采用运行时默认值。升级前备份 Home，使用正常升级／迁移
+路径，不要用旧二进制打开已迁移的 Home。Controller/Host 协议仍为 v1。
+发布前要求确切合并提交的 Core CI 及同一 runtime 包的全新安装矩阵通过；
+确定性检查不证明真实远端服务器或真实模型行为。发布本身不更新全局 CLI、
+不迁移生产数据，也不重启共享服务。
+
+### 2.23.0 兼容性及迁移说明
+
+Host 升级使用明确的生命周期信号及安全排空／重新挂接边界，不重放业务输入、
+不替换原生会话身份。常规 Skill 检查保留在 Host 内，未变化的 Turn 不携带
+Skill 提示；仅首次挂接、明确上下文丢失／压缩及 Skill 变化提供当前加载指针。
+
+Codex 的 start／steer 将用户原文与应用上下文分离。失败 Turn 恢复不复制原文，
+也不视为 Skill 上下文丢失。此路径要求原生 `additionalContext` 契约，已核对
+Codex CLI 0.159.2；旧原生实现不在验证范围内，不提供把元信息塞回用户输入的回退。
+
+原生标题复用 Role／Task／Draft／实例格式，通过独立、有界的元数据进程同步，
+不阻塞 Startup、Goal 或 Turn。精确身份、持久化意图和原生读回区分成功与未知效果。
+保留已观测到的手动命名，未知写入不重放；缺乏归属证据的历史污染标题只诊断、不改名。
+原生命名 API 没有 compare-and-swap，无法原子保护最后读写窗口内的外部并发改名。
+
+存储升级至 **1.28**：保留 **1.26 → 1.27** Host 升级信号迁移，追加
+**1.27 → 1.28** 原生标题回执，不改写历史。升级前备份 Home，使用正常升级／迁移
+路径，不要用旧二进制打开已迁移的 Home。Controller/Host 协议仍为 v1。
+发布本身不更新全局 CLI、不迁移生产数据，也不重启共享服务。
+
 ### 2.22.0 兼容性及迁移说明
 
 上下文读取增加有界发现、精确批量原文读取、正文传输回执及聚焦通知。
@@ -801,7 +865,7 @@ yui task grant revoke task-15 capability-grant-1
 确切 commit，只增加发布所需的产物装配、全新安装和 provenance 检查。
 
 业务契约与完整 Jobs/Schedules 链路仅在 Core CI 的 Linux Node 24 执行一次。
-发布仍在三平台 × Node 20/22/24/26 全部安装同一个已校验 tarball：每组都验证
+发布仍在两个受支持平台 × Node 20/22/24/26 全部安装同一个已校验 tarball：每组都验证
 CLI/setup/原生 helper、Doctor/PTY 和真实 SQLite SQL/GC；各平台 Node 24 额外验证
 真实进程生命周期。参见[分层覆盖表](testing/verification-levels.zh-CN.md#ci-与发布)。
 依赖安装不再隐含构建，每个源码作业只构建一次，再验证原生依赖；smoke 输出分段耗时。

package/docs/roles-and-configuration.md

@@ -18,6 +18,40 @@ requiring a same-named global Role. A global Role is a creation template only
 when the requested Task Role does not exist. Availability, producer separation
 and the frozen review candidate still apply.
 
+## Git operation budgets
+
+All three Git timeout budgets have durable settings. Local commands (including
+local ref copies and artifact repositories) have a total limit; clone, remote
+fetch and network `ls-remote` have independent inactivity and total limits:
+
+```sh
+yui config tools show
+yui config tools set git-local-timeout-seconds 30
+yui config tools set git-remote-inactivity-timeout-seconds 120
+yui config tools set git-remote-timeout-seconds 1800
+yui config tools clear git-local-timeout-seconds
+yui config tools clear git-remote-inactivity-timeout-seconds
+yui config tools clear git-remote-timeout-seconds
+```
+
+All three accept integer seconds from 1 to 86400. Defaults are 30 seconds total
+per local command, 120 seconds without stdout/stderr output and 1800 seconds
+total per remote command.
+They apply to the next command, including Controller-owned Project refresh
+and Task preparation, without a restart; an in-flight command keeps its budgets.
+Clone/fetch explicitly request progress even without a terminal. Each output
+chunk resets only the silence timer, not the total deadline. Output is evidence
+of activity, not proof that a transfer is advancing; the total limit still wins.
+Remote stderr retains its last 64 KiB so progress cannot exhaust the output
+buffer; stdout and local command output retain their existing buffer limits.
+
+At either hard deadline Yui kills that invocation's process group, including
+transport helpers, and waits for process/pipe closure. Errors preserve the
+timeout kind/budget, elapsed time, exit code, signal and stderr where available.
+No Git operation is automatically retried, and a failure is not rollback proof.
+Storage 1.28 → 1.29 admits these optional configuration fields without
+rewriting historical configuration or persisting default values.
+
 ## Optional instance codes and Session titles
 
 Each Role can independently set a display-only instance code. For example,

package/docs/roles-and-configuration.zh-CN.md

@@ -15,6 +15,33 @@ Task Role 是 Task 局部的；global Role 提供已配置的默认值和全局
 的 global Role。只有当请求的 Task Role 不存在时，global Role 才作为创建模板。
 可用性、producer 分离和冻结的审查候选仍然适用。
 
+## Git 操作预算
+
+三项 Git 超时均有正式配置。本地命令（包括本地 ref 复制和产物仓库）使用总耗时上限；
+clone、远程 fetch 和需要连接远端的 `ls-remote` 使用独立的无进展超时与总耗时上限：
+
+```sh
+yui config tools show
+yui config tools set git-local-timeout-seconds 30
+yui config tools set git-remote-inactivity-timeout-seconds 120
+yui config tools set git-remote-timeout-seconds 1800
+yui config tools clear git-local-timeout-seconds
+yui config tools clear git-remote-inactivity-timeout-seconds
+yui config tools clear git-remote-timeout-seconds
+```
+
+三项都接受 1–86400 的整数秒，默认分别为单条本地命令总耗时 30 秒、
+无 stdout/stderr 输出 120 秒、单条远程命令总耗时 1800 秒。
+保存后下一条命令生效，包括 Controller 的 Project refresh 和 Task
+准备；无需重启，已启动命令保持原预算。clone/fetch 即使没有终端也显式请求进度输出。
+每次输出只重置静默计时，不延长总上限；输出仅证明活动，不证明传输在推进。
+远程 stderr 只保留末尾 64 KiB，避免长时间进度输出耗尽缓冲；stdout 和本地命令输出
+保留原缓冲上限。
+
+任一预算耗尽时终止该次调用自己的进程组（含传输 helper），等待进程与管道关闭。
+错误保留超时类型和预算、实际耗时、可用的退出码、信号及 stderr；不会自动重试，
+失败也不等于已回滚。存储 1.28 → 1.29 声明三项可选配置，不重写旧配置或持久化默认值。
+
 ## 可选实例码与会话标题
 
 每个 Role 独立配置仅用于展示的实例码。例如只设置 Operator，其他角色留空：

package/docs/storage-baseline.md

@@ -2,7 +2,20 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.26. The 1.25 → 1.26 transition admits optional Codex
+Current storage is 1.29. The 1.28 → 1.29 transition admits optional local Git
+total and remote Git inactivity/total timeout settings. Existing configuration payloads remain
+byte-for-byte unchanged; absent fields use runtime defaults.
+
+The 1.27 → 1.28 transition admits exact-identity native
+title effect receipts under `runtime/native-titles`. It does not infer historical
+title ownership, rename conversations, or change existing database payloads.
+Unconfirmed naming intents remain non-replayable across Host replacement.
+
+The 1.26 → 1.27 transition admits versioned Host-upgrade
+signals in the existing role-runtime mailbox. It adds no table, infers no past
+upgrade request, and preserves existing payloads. Drain receipts precede Host
+exit; a Controller restart resumes the exact request, not business input.
+The 1.25 → 1.26 transition admits optional Codex
 workspace-write temporary-directory exclusions without changing historical
 permission payloads. The published 1.24 → 1.25 transition remains unchanged
 and admits optional Role

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,13 @@
 
 # 存储基线 1.0
 
-当前存储为 1.26。1.25 → 1.26 增加 Codex workspace-write 可选临时目录排除字段，不改写历史权限 payload。已发布的 1.24 → 1.25 定义保持不变：增加可选 Role `instanceCode` 和 Session `generatedTitle` 展示字段，不回填历史标题来源或实例码，不改写既有记录。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
+当前存储为 1.29。1.28 → 1.29 声明本地 Git 总耗时、远程 Git 无进展超时和总耗时上限三项可选配置；既有配置 payload 逐字节保留，缺失字段使用运行时默认值。
+
+1.27 → 1.28 声明 `runtime/native-titles` 下绑定精确会话身份的原生标题意图与回执；迁移不认领历史标题、不改名、不改写既有数据库 payload。未确认改名意图在 Host 替换后也不得重放。
+
+1.26 → 1.27 允许现有 role-runtime mailbox 保存版本化 Host 升级信号，不新增表、不推断历史升级请求、不改写既有 payload。排空回执先于 Host 退出持久化；Controller 重启继续精确升级请求，不重放业务输入。
+
+1.25 → 1.26 增加 Codex workspace-write 可选临时目录排除字段，不改写历史权限 payload。已发布的 1.24 → 1.25 定义保持不变：增加可选 Role `instanceCode` 和 Session `generatedTitle` 展示字段，不回填历史标题来源或实例码，不改写既有记录。1.23 → 1.24 为调度器的九类来源表增加事务维护的 Task 读取缓存修订号。插入、更新和删除只使对应 Task 的缓存失效，回滚同时回滚修订号。该值仅是派生缓存标识，不是 Task 权限或 Home revision CAS 的替代。历史 payload 不变，旧 Task 在首次修改前使用隐含的零修订号。
 同时增加两个局部索引，支持按精确运行观测身份查找，不再扫描或反序列化历史观测集合。
 
 1.22 → 1.23 新增全局 Shell Job、版本化脚本文件及每次运行的配置快照，不改写已有 Job、计划和历史记录。

package/docs/testing/verification-levels.md

@@ -53,12 +53,12 @@ is required.
 Both include `test/core` and `test/platform`. For an already built checkout,
 `npm run test:business` runs only `test/core` and `npm run test:platform` runs
 only `test/platform`; neither rebuilds. CI owns one explicit build per job.
-The stable suite owns current storage 1.26 and its declared 1.0 through 1.25 minor
+The stable suite owns current storage 1.29 and its declared 1.0 through 1.28 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.26, exact schema/record validation, no initialization over
+1. Fresh storage 1.29, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and
@@ -160,17 +160,17 @@ adjudication aggregation are deterministic; they do not run or measure a model.
 
 `ci.yml` runs on PRs and master. Business contracts and full package business
 wiring run once on Linux x64/Node 24. Platform tests run on Linux Node 24/26
-and Mac Intel/Apple Silicon Node 24. Every job builds exactly once, without
+and macOS Apple Silicon Node 24. Every job builds exactly once, without
 another lint or implicit pretest build. Keep the existing job names for branch
 checks; the complete workflow must pass for the exact master commit.
 
 | Evidence | PR/master | Exact release tarball |
 | --- | --- | --- |
 | Business/state/authority contracts (`test/core`) | Linux 24 once | Reuse exact-SHA successful Core CI |
-| OS/helper/PTY/Git/SQLite boundaries (`test/platform`) | Linux 24/26, both Macs 24 | Real SQLite SQL/GC on all 12 installs; other installed boundaries below |
+| OS/helper/PTY/Git/SQLite boundaries (`test/platform`) | Linux 24/26, Apple Silicon Mac 24 | Real SQLite SQL/GC on all 8 installs; other installed boundaries below |
 | `full` smoke: business Jobs/Schedules + lifecycle + compatibility | Linux 24 once | Reuse exact-SHA business evidence |
-| `lifecycle` smoke: restart, Session/Host handoff, archive + compatibility | Both Macs 24 (Linux included in full) | Node 24 on each of the 3 platforms |
-| `compatibility` smoke: setup, CLI/bin, helpers, Doctor/PTY/SQLite | Linux 26 (included in other profiles) | All 3 platforms × Node 20/22/24/26 (included in lifecycle on 24) |
+| `lifecycle` smoke: restart, Session/Host handoff, archive + compatibility | Apple Silicon Mac 24 (Linux included in full) | Node 24 on each of the 2 platforms |
+| `compatibility` smoke: setup, CLI/bin, helpers, Doctor/PTY/SQLite | Linux 26 (included in other profiles) | Both platforms × Node 20/22/24/26 (included in lifecycle on 24) |
 
 `node scripts/smoke-runtime-package.mjs --assembled .release-stage` exercises
 the actual CLI/Controller/Host/SQLite and isolated tmux, replacing only the
@@ -224,7 +224,7 @@ It starts empty on each smoke invocation and is removed with the fixture.
 No cache is restored across jobs, packages or Node versions, and no production
 default changes. Keep it out of V8 coverage runs, where it can reduce precision.
 
-`publish.yml` builds one archive containing all three native targets and runs
+`publish.yml` builds one archive containing both supported native targets and runs
 the profiles above against that exact freshly installed package through
 `YUI_INSTALLED_ROOT`, adding actual npm-bin, dependency, supported Node version,
 artifact and provenance boundaries. This validates runtime integration, not

package/docs/testing/verification-levels.zh-CN.md

@@ -39,12 +39,12 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 两者均包含 `test/core` 和 `test/platform`。已构建的 checkout 可分别运行
 `npm run test:business` 与 `npm run test:platform`，它们不会再次构建。
 CI 每个作业只显式构建一次。
-稳定套件维护当前存储 1.26 和明确声明的 1.0 至 1.25 连续小版本迁移，
+稳定套件维护当前存储 1.29 和明确声明的 1.0 至 1.28 连续小版本迁移，
 不包含未声明的历史格式兼容路径。
 
 当前覆盖包括：
 
-1. 新建存储 1.26、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
+1. 新建存储 1.29、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
 2. 精确版本暂存、目标不匹配拒绝、同主版本连续小版本预检、交接锁显式所有者，
    以及恢复时核对捕获的协议和存储身份，不接受缺失字段。
 3. 持久 Task／Message／Decision 上下文、Draft 激活权威、mailbox 认领、
@@ -101,17 +101,17 @@ package-start 检查跟随已安装树中的本地 Skill 引用，包括跨 Role
 ## CI 与发布
 
 `ci.yml` 在 PR 和 master 上执行。业务契约与完整业务链路仅在 Linux x64/Node 24
-运行一次；平台测试在 Linux Node 24/26、Intel/Apple Silicon Mac Node 24 上运行。
+运行一次；平台测试在 Linux Node 24/26、Apple Silicon Mac Node 24 上运行。
 每个作业只构建一次，不重复 lint 或隐含 pretest 构建。保留现有作业名称；发布仍要求
 精确 master SHA 的整个 Core CI 成功，不复用另一源码的结果。
 
 | 证据 | PR/master | 精确发布 tarball |
 | --- | --- | --- |
 | 业务、状态、授权契约（`test/core`） | Linux 24 一次 | 复用精确 SHA 的成功 Core CI |
-| OS/helper/PTY/Git/SQLite（`test/platform`） | Linux 24/26、双 Mac 24 | 12 组真实 SQL/GC；其余安装边界见下 |
+| OS/helper/PTY/Git/SQLite（`test/platform`） | Linux 24/26、Apple Silicon Mac 24 | 8 组真实 SQL/GC；其余安装边界见下 |
 | `full`：Jobs/Schedules 业务链路 + lifecycle + compatibility | Linux 24 一次 | 复用精确 SHA 业务证据 |
-| `lifecycle`：重启、Session/Host 交接、归档 + compatibility | 双 Mac 24，Linux 已在 full 内 | 三平台 Node 24 |
-| `compatibility`：setup、CLI/bin、helper、Doctor/PTY/SQLite | Linux 26，其余已包含 | 三平台 × Node 20/22/24/26，24 已包含在 lifecycle 内 |
+| `lifecycle`：重启、Session/Host 交接、归档 + compatibility | Apple Silicon Mac 24，Linux 已在 full 内 | 两平台 Node 24 |
+| `compatibility`：setup、CLI/bin、helper、Doctor/PTY/SQLite | Linux 26，其余已包含 | 两平台 × Node 20/22/24/26，24 已包含在 lifecycle 内 |
 
 `node scripts/smoke-runtime-package.mjs --assembled .release-stage` 经过真实
 CLI/Controller/Host/SQLite 与隔离 tmux，仅用确定性夹具替换外部 Provider。它验证

package/i18n/README.zh-CN.md

@@ -5,7 +5,7 @@
 [![Core CI](https://github.com/zhangqian-silk/yui/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/zhangqian-silk/yui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](../LICENSE)
 ![Node](https://img.shields.io/badge/node-20%20%7C%2022%20%7C%2024-brightgreen.svg)
-![Platform](https://img.shields.io/badge/platform-Linux%20x64%20%28glibc%29%20%7C%20macOS%20x64%2Farm64-blue.svg)
+![Platform](https://img.shields.io/badge/platform-Linux%20x64%20%28glibc%29%20%7C%20macOS%20arm64-blue.svg)
 [![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](#参与开发)
 
 让 Agent 持续推进你的任务，而不只是回答一轮对话。
@@ -37,10 +37,14 @@ Yui 是面向编程 Agent 的本地控制面。你只需用自然语言把目标
 
 ## 快速开始
 
-npm 包包含 Linux x64、Mac Intel 和 Apple Silicon 的 Yui 预编译程序。
-同一份包在三个平台验证后发布，运行时只选择对应平台的程序。
+npm 包包含 Linux x64 和 macOS Apple Silicon 的 Yui 预编译程序。
+同一份包在两个平台验证后发布，运行时只选择对应平台的程序。
+从 2.25.0 开始不再支持 macOS Intel，也不支持通过 Rosetta 运行的 x64 Node.js。
+Intel Mac 用户须停留在 2.23.0；Apple Silicon 用户须使用原生 arm64 Node.js。
+npm 的 OS/CPU 字段不能表达这种平台配对，因此不支持的组合仍可能安装成功，
+但 Yui 会在加载任一 CLI 产品或打开 Home 前明确拒绝，不新增安装脚本。
 
-需要 Linux x64 / glibc 或 macOS（x64 或 Apple Silicon）、Git 2.29.0 或更新版本、tmux，以及
+需要 Linux x64 / glibc 或 macOS Apple Silicon（使用原生 arm64 Node.js）、Git 2.29.0 或更新版本、tmux，以及
 Node.js `^20.17.0`、`^22.9.0`、`^24.0.0` 或 `^26.0.0`。macOS 上可用
 `brew install tmux` 安装 tmux。最简单的方式是先安装 Codex CLI 或 Claude
 Code CLI，并确保它已经可以使用你自己的账号正常工作。Yui 负责协调 Agent，

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "2.22.0",
+  "version": "2.25.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-runtime/SKILL.md

@@ -13,9 +13,14 @@ Resolve links relative to their containing file.
 ## Keep the current working set
 
 The managed Host mechanically checks current Skill VERSION/readability for each
-input. Use its short check result/current pointers; do not duplicate that check.
-Without a Host check, run the Manifest's `contextProtocol.skillCheckCommand`
+input. It injects guidance only when loading is needed; unchanged inputs carry
+no notice or marker. Do not duplicate the Host's check merely because no notice
+appears. For unmediated clients or uncertain current input routing, run the
+Manifest's `contextProtocol.skillCheckCommand`
 (older Manifests: `yui session skills --json`) through the intended CLI/Home.
+Conversation reuse alone does not establish Host mediation. Keep routine
+role/Skill checks and empty-inbox observations internal; only report business
+progress or actionable failures.
 Global `loadCommand` includes the check. Recheck after repair/relevant change.
 
 A check is metadata, not bodies, remembered instructions, a loading receipt or

package/skills/yui-runtime/VERSION

@@ -1 +1 @@
-44
+46