@zq-silk/yui 2.6.0 → 2.8.0

package/dist/web/assets/styles/views/models.js

@@ -0,0 +1,129 @@
+import { BREAKPOINTS } from "../../shared/geometry.js";
+/*
+ * MODELS VIEW — the content of the /models sections. The rail, reading column
+ * and section headings come from views/manage; cards, badges, chips,
+ * segmented controls and fields from the shared ui stylesheets. These rules
+ * add the provider table, the catalog list and the quota meters. On phones
+ * the provider table becomes stacked rows.
+ */
+export const MODELS_STYLES = `
+/* Heading first, as on every management page: the page scope and the shared
+   connection status sit under the current section's heading. The wrappers
+   flatten into one column so only order changes, never the DOM. */
+.models-body .manage-main{display:flex;flex-direction:column;gap:14px}
+.models-body .models-root,.models-body .models-section:not([hidden]){display:contents}
+.models-body .manage-main>*,.models-root>*,.models-section>*{width:100%;max-width:1120px;margin-left:auto;margin-right:auto}
+.models-section>.manage-head{order:-1}
+.models-body .manage-scope{margin-bottom:0}
+.models-root .seg-btn[aria-pressed="true"]{background:var(--surface-2);color:var(--ink);box-shadow:var(--shadow-1),0 0 0 1px var(--line-2)}
+.models-root{display:grid;gap:16px;min-width:0}
+.models-section p:not(.kicker){color:var(--ink-2);font-size:var(--fs-sm);line-height:1.55;overflow-wrap:anywhere}
+.models-section .manage-heading p:not(.kicker){color:var(--ink-3)}
+.models-card{overflow:hidden}
+.models-card>.card-body{gap:12px}
+.models-status{display:grid;gap:8px;min-width:0}
+.models-status:empty{display:none}
+.models-facts{display:flex;flex-wrap:wrap;gap:6px 8px;align-items:center;min-width:0}
+.models-facts small{overflow-wrap:anywhere}
+.models-facts .badge[hidden]{display:none}
+.models-notice{flex:1 1 280px;min-width:0}
+.models-alert{display:flex;flex-wrap:wrap;align-items:center;gap:8px 12px;padding:10px 14px;border:1px solid var(--bad-soft);border-radius:var(--r-md);background:var(--bad-soft)}
+.models-alert>.icon{width:16px;height:16px;color:var(--bad);flex:none}
+.models-alert p{flex:1 1 240px;min-width:0}
+.models-note{display:flex;flex-wrap:wrap;align-items:center;gap:6px;padding:9px 12px;border:1px solid var(--line);border-radius:var(--r-md);background:var(--surface-2)}
+.models-note>.icon{width:15px;height:15px;color:var(--info);flex:none}
+.models-empty{color:var(--ink-3)!important;font-size:var(--fs-sm)}
+.models-count{color:var(--ink-4);font-size:var(--fs-xs)!important;font-variant-numeric:tabular-nums}
+.models-receipt{white-space:pre-wrap;overflow-wrap:anywhere}
+.models-receipt-group .settings-actions{margin-top:8px}
+
+/* Toolbars: search plus segmented filters */
+.models-toolbar{display:flex;flex-wrap:wrap;align-items:center;gap:8px 10px;padding:12px 16px;border-bottom:1px solid var(--line);min-width:0}
+.models-toolbar-flat{padding:0;border:0}
+.models-toolbar .seg{flex-wrap:wrap}
+.models-search{position:relative;display:flex;align-items:center;flex:1 1 240px;min-width:0;max-width:420px}
+.models-search>.icon{position:absolute;left:10px;width:15px;height:15px;color:var(--ink-4);pointer-events:none}
+.models-search input{width:100%;height:32px;padding:0 10px 0 32px;border-radius:var(--r-md);background:var(--surface-2)}
+.models-results{display:grid;gap:0;min-width:0}
+.models-results>.models-count{padding:8px 16px 0}
+.models-results>.models-empty{padding:12px 16px 16px}
+.models-catalog-results>.models-count{padding:0 0 8px}
+.models-catalog-results>.models-empty{padding:0}
+
+/* Provider table */
+.models-table-wrap{min-width:0;overflow-x:auto}
+.models-table{width:100%;border-collapse:collapse;font-size:var(--fs-sm)}
+.models-table th{padding:10px 12px;color:var(--ink-4);font-size:var(--fs-2xs);font-weight:600;letter-spacing:.04em;text-align:left;text-transform:uppercase;border-bottom:1px solid var(--line);white-space:nowrap}
+.models-table td{padding:11px 12px;border-bottom:1px solid var(--line);vertical-align:top;min-width:0}
+.models-table tr:last-child td{border-bottom:0}
+.models-table th:first-child,.models-table td:first-child{padding-left:16px}
+.models-table th:last-child,.models-table td:last-child{padding-right:16px}
+.models-table tbody tr:hover{background:var(--surface-2)}
+.models-table tbody tr[aria-current="true"]{background:var(--accent-soft);box-shadow:inset 3px 0 0 var(--accent)}
+.models-cell-main{display:grid;gap:3px;justify-items:start;min-width:0}
+.models-cell-main strong{font-weight:600;color:var(--ink);overflow-wrap:anywhere}
+.models-cell-main code{white-space:normal;overflow-wrap:anywhere}
+.models-url{display:block;max-width:280px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--ink-2)}
+.models-row-actions{display:flex;flex-wrap:wrap;align-items:center;justify-content:flex-end;gap:6px;min-width:0}
+.models-row-actions .btn{height:28px;padding:0 10px;font-size:var(--fs-xs)}
+.models-reason{flex-basis:100%;max-width:260px;text-align:right;line-height:1.4;overflow-wrap:anywhere}
+.models-danger{color:var(--bad)}
+.models-danger:hover:not(:disabled){color:var(--bad);background:var(--bad-soft)}
+
+/* Provider editor */
+.models-editor{border-color:var(--accent-line)}
+.models-form-head{display:flex;flex-wrap:wrap;align-items:center;gap:8px 10px;min-width:0}
+.models-form-head h2{font-size:var(--fs-md);font-weight:600;overflow-wrap:anywhere;min-width:0}
+.models-provider-form .settings-grid{gap:14px 20px;align-items:start}
+.models-provider-form input:not([type=checkbox]),.models-provider-form select,.models-connection-form input{width:100%;min-width:0}
+.models-provider-form .settings-actions{margin-top:4px}
+
+/* Connection settings */
+.models-connection-form{display:grid;gap:16px;min-width:0}
+.models-connection-form{grid-template-columns:repeat(2,minmax(0,1fr))}
+.models-connection-form>.settings-actions,.models-connection-form>.receipt,.models-connection-form>.models-receipt-group{grid-column:1/-1;margin-top:0}
+.models-fieldset{display:grid;align-content:start;gap:14px;min-width:0;margin:0;padding:0;border:0}
+.models-fieldset legend{margin-bottom:12px;padding:0;color:var(--ink);font-size:var(--fs-sm);font-weight:600}
+.models-explain h2{font-size:var(--fs-sm);font-weight:600}
+
+/* Catalog */
+.models-catalog{list-style:none;margin:0;padding:0;display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:0 20px;min-width:0}
+.models-catalog-item{display:flex;align-items:center;justify-content:space-between;gap:10px;min-width:0;padding:7px 2px;border-bottom:1px solid var(--line)}
+.models-catalog-item code{font-family:var(--font-mono);font-size:var(--fs-xs);color:var(--ink);overflow-wrap:anywhere;min-width:0}
+
+/* Quota accounts, groups and meters */
+.models-accounts{list-style:none;margin:0 auto;padding:0;display:grid;gap:14px;min-width:0}
+.models-account .card-title>span:first-child{font-family:var(--font-mono);font-size:var(--fs-sm)}
+.models-groups{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:18px 28px;min-width:0}
+.models-group{display:grid;align-content:start;gap:10px;min-width:0}
+.models-group h3{font-size:var(--fs-sm);font-weight:600;color:var(--ink)}
+.models-windows{list-style:none;margin:0;padding:0;display:grid;gap:12px;min-width:0}
+.models-window{display:grid;gap:5px;min-width:0}
+.models-window-line{display:flex;justify-content:space-between;gap:12px;font-size:var(--fs-sm);min-width:0}
+.models-window-name{color:var(--ink-2);overflow-wrap:anywhere;min-width:0}
+.models-window-value{color:var(--ink);font-weight:500;font-variant-numeric:tabular-nums;white-space:nowrap}
+.models-meter{position:relative;height:6px;border-radius:var(--r-pill);background:var(--surface-3);overflow:hidden}
+.models-meter>span{position:absolute;inset:0 auto 0 0;border-radius:inherit;background:var(--tone)}
+.models-meter.is-unknown{background:repeating-linear-gradient(90deg,var(--surface-3) 0 6px,transparent 6px 10px)}
+.models-window small{font-size:var(--fs-xs);overflow-wrap:anywhere}
+.models-balances{display:flex;flex-wrap:wrap;gap:8px 28px;margin:0;padding-top:12px;border-top:1px solid var(--line);font-size:var(--fs-sm)}
+.models-balances div{display:grid;gap:2px;min-width:0}
+.models-balances dt{color:var(--ink-3);font-size:var(--fs-xs)}
+.models-balances dd{margin:0;color:var(--ink);font-weight:500;font-variant-numeric:tabular-nums}
+
+@media(max-width:${BREAKPOINTS.small}px){
+  .models-connection-form{grid-template-columns:minmax(0,1fr)}
+  .models-provider-form .settings-grid{grid-template-columns:minmax(0,1fr)}
+  .models-search{max-width:none;flex-basis:100%}
+  .models-table thead{position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0)}
+  .models-table,.models-table tbody,.models-table tr,.models-table td{display:block;width:100%}
+  .models-table tr{padding:10px 14px;border-bottom:1px solid var(--line)}
+  .models-table tr:last-child{border-bottom:0}
+  .models-table td{display:grid;grid-template-columns:84px minmax(0,1fr);gap:8px;align-items:start;padding:4px 0!important;border:0}
+  .models-table td::before{content:attr(data-label);color:var(--ink-4);font-size:var(--fs-2xs);font-weight:600;letter-spacing:.04em;text-transform:uppercase;padding-top:3px}
+  .models-url{max-width:none;white-space:normal;overflow-wrap:anywhere}
+  .models-row-actions{justify-content:flex-start}
+  .models-reason{text-align:left;max-width:none}
+  .models-catalog{grid-template-columns:minmax(0,1fr)}
+}
+`;

package/dist/web/assets/styles/views/settings.js

@@ -1,26 +1,40 @@
+import { BREAKPOINTS } from "../../shared/geometry.js";
+/*
+ * SETTINGS VIEW — the content of the /settings sections (preferences, Skills,
+ * Agents & server). The rail, reading column and section headings come from
+ * views/manage. Settings panels share the card surface of the model pages:
+ * the same border, radius, padding and title scale; nested panels (a Skill in
+ * the catalog) sit one surface step lower instead of nesting full cards.
+ */
 export const SETTINGS_STYLES = `
-.settings-body{display:block;overflow:auto;height:auto;min-height:100dvh}
-.settings-page{max-width:1040px;margin:auto;padding:32px 24px 80px;display:grid;gap:22px}
-.settings-page p{color:var(--ink-2);font-size:var(--fs-sm);line-height:1.6;overflow-wrap:anywhere}
-.settings-header{display:flex;gap:20px;align-items:center}
-.settings-card{padding:22px;border:1px solid var(--line-2);border-radius:var(--r-lg);background:var(--surface);min-width:0}
-.settings-card>summary{font-size:var(--fs-md);font-weight:600;cursor:pointer}
-.settings-card h2{font-size:var(--fs-md);margin-bottom:16px}
-.settings-card[open]>summary{margin-bottom:16px}
+.settings-card{display:block;padding:16px;border:1px solid var(--line);border-radius:var(--r-lg);background:var(--surface);min-width:0}
+.settings-card .settings-card{padding:14px;background:var(--surface-2)}
+.settings-card>summary{display:flex;align-items:center;gap:8px;min-height:24px;font-size:var(--fs-md);font-weight:600;color:var(--ink);cursor:pointer;overflow-wrap:anywhere}
+.settings-card h2{font-size:var(--fs-md);font-weight:600;color:var(--ink);margin-bottom:14px}
+.settings-card h3{font-size:var(--fs-sm);font-weight:600;color:var(--ink);overflow-wrap:anywhere}
+.settings-card[open]>summary{margin-bottom:14px;padding-bottom:12px;border-bottom:1px solid var(--line)}
+.manage-section[data-section] .settings-card p,.settings-stack>p{color:var(--ink-2);font-size:var(--fs-sm);line-height:1.6;overflow-wrap:anywhere}
 .settings-stack{display:grid;gap:16px;min-width:0}
-.settings-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:24px}
+.settings-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:20px 24px;min-width:0}
 .settings-field{padding:14px 0;border-bottom:1px solid var(--line);display:grid;gap:8px;min-width:0}
 .settings-field small{color:var(--ink-3);overflow-wrap:anywhere}
 .settings-field small:empty,.settings-field .settings-actions:empty{display:none}
 .settings-field textarea{width:100%;min-height:88px;resize:vertical}
 .settings-field input,.settings-field select{width:100%;min-width:0}
 .settings-field .settings-reset{display:flex;gap:8px;align-items:center;font-size:var(--fs-xs)}
-.settings-reset input{width:auto}
-.settings-actions{display:flex;gap:10px;flex-wrap:wrap;margin-top:16px;align-items:center}
+.settings-reset{display:flex;gap:8px;align-items:center;font-size:var(--fs-sm);color:var(--ink-2)}
+.settings-reset input{width:auto;flex:none}
+.settings-actions{display:flex;gap:10px;flex-wrap:wrap;margin-top:16px;align-items:center;min-width:0}
+.settings-actions code{overflow-wrap:anywhere;min-width:0}
 .settings-receipt{white-space:pre-wrap;overflow-wrap:anywhere}
 .settings-error{color:var(--bad)!important}
 .settings-observation{max-height:260px;overflow:auto;white-space:pre-wrap;overflow-wrap:anywhere;font-size:var(--fs-xs)}
-.settings-search{position:sticky;top:0;background:var(--canvas);padding:12px 0;z-index:1}
-.settings-page input[type=checkbox]{width:16px;height:16px;padding:0;accent-color:var(--accent)}
-@media(max-width:640px){.settings-page{padding:18px 12px 48px}.settings-grid{grid-template-columns:1fr}.settings-card{padding:16px}}
+.settings-search{position:sticky;top:0;z-index:1;padding:10px 0;background:var(--canvas)}
+.settings-search input{width:100%;max-width:520px}
+#settings-status:empty,#browser-receipt:empty{display:none}
+.mono-line{overflow-wrap:anywhere}
+@media(max-width:${BREAKPOINTS.small}px){
+  .settings-grid{grid-template-columns:minmax(0,1fr)}
+  .settings-card{padding:14px}
+}
 `;

package/dist/web/assets/styles/views/sidebar.js

@@ -71,4 +71,5 @@ export const SIDEBAR_STYLES = `
 .foot-btn[aria-pressed="true"]{color:var(--accent);border-color:var(--accent-line);background:var(--accent-soft)}
 .foot-btn kbd{margin-left:2px}
 .side-foot .icon-btn{margin-left:auto}
+.side-foot .icon-btn+.icon-btn{margin-left:0}
 `;

package/dist/web/webServer.js

@@ -7,9 +7,9 @@ import { parseTaskSearchOptions, searchTaskBodies } from "../context/taskSearch.
 import { readTaskUsage } from "../runtime/taskUsageQuery.js";
 import { readWebTaskActivity } from "./webTaskActivity.js";
 import { WebRequestRejected } from "./webMutation.js";
-import { SETTINGS_HTML } from "./assets/shell/settings.js";
+import { MODELS_HTML } from "./assets/shell/models.js";
 import { TASK_SUBMISSION_INTENTS } from "../message/message.js";
-import { DASHBOARD_HTML, findWebAsset } from "./assets/assetManifest.js";
+import { DASHBOARD_HTML, findWebAsset, prepareWebDocument, WEB_ASSET_VERSION } from "./assets/assetManifest.js";
 import { buildWebTaskCatalog, buildWebPageSessions, buildWebTaskDetail } from "./webSnapshot.js";
 const MAX_JSON_BODY_BYTES = 16 * 1024;
 const MAX_TERMINAL_MESSAGE_BYTES = 64 * 1024;
@@ -204,6 +204,54 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         }
         return;
     }
+    if (pathname === "/api/models" || pathname.startsWith("/api/models/")) {
+        try {
+            const service = dependencies.models;
+            if (!service)
+                throw new WebRequestRejected("Model management unavailable.");
+            const query = new URL(request.url, "http://localhost").searchParams;
+            if ([...query.keys()].some(k => !["cursor", "source"].includes(k) || query.getAll(k).length !== 1)) {
+                throw new WebRequestRejected("Unknown Model query.");
+            }
+            let value;
+            if (method === "GET" && pathname === "/api/models")
+                value = service.read();
+            else if (method === "GET" && pathname === "/api/models/catalog")
+                value = service.readCatalog(query.get("cursor") ?? "0");
+            else if (method === "GET" && pathname === "/api/models/quota")
+                value = service.readQuota(query.get("source") ?? "factory");
+            else if (method === "POST") {
+                // Credential-bearing forms require an exact same-origin browser request.
+                if (headerValue(request, "origin") !== `http://${headerValue(request, "host")}`) {
+                    throw new WebRequestRejected("Model changes require a same-origin request.");
+                }
+                if (headerValue(request, "content-type")?.split(";")[0]?.trim() !== "application/json") {
+                    throw new WebRequestRejected("Model changes require JSON.");
+                }
+                const body = await readMutationBody(request);
+                if (pathname === "/api/models/connection")
+                    value = service.saveConnection(body);
+                else if (pathname === "/api/models/provider")
+                    value = service.saveProvider(body);
+                else if (pathname === "/api/models/refresh")
+                    value = await service.refresh(body);
+                else
+                    throw new WebRequestRejected("Unknown Model operation.");
+            }
+            else {
+                sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, false);
+                return;
+            }
+            sendJson(response, 200, value, false);
+        }
+        catch (error) {
+            sendJson(response, 409, {
+                error: error instanceof WebRequestRejected ? error.message : "Model operation failed. Inspect the current state before retrying.",
+                disposition: method === "GET" || error instanceof WebRequestRejected ? "not-submitted" : "unknown"
+            }, false);
+        }
+        return;
+    }
     if (pathname === "/api/settings" || pathname === "/api/settings/group" || pathname === "/api/settings/capabilities") {
         try {
             if (!dependencies.settings)
@@ -529,12 +577,14 @@ async function handleHttpRequest(request, response, store, dependencies, token,
     }
     if (method === "GET" || method === "HEAD") {
         try {
-            const asset = findWebAsset(pathname);
-            if (pathname === "/" || pathname === "/index.html" || pathname === "/settings") {
-                sendText(response, 200, "text/html; charset=utf-8", pathname === "/settings" ? SETTINGS_HTML.replace("__YUI_WEB_TOKEN__", token) : dashboardHtml(token), method === "HEAD");
+            const assetVersion = new URL(request.url, "http://localhost").searchParams.get("v");
+            const asset = findWebAsset(pathname, assetVersion);
+            const managementPage = /^\/(?:models(?:\/(?:providers|catalog|quota))?|settings(?:\/(?:preferences|skills|server|connection))?)\/?$/.test(pathname);
+            if (pathname === "/" || pathname === "/index.html" || managementPage) {
+                sendText(response, 200, "text/html; charset=utf-8", prepareWebDocument(managementPage ? MODELS_HTML.replace("__YUI_WEB_TOKEN__", token) : dashboardHtml(token), managementPage ? "/assets/js/app/manage.js" : "/assets/app.js"), method === "HEAD");
             }
             else if (asset !== null) {
-                sendAsset(response, asset, method === "HEAD");
+                sendAsset(response, asset, method === "HEAD", assetVersion === WEB_ASSET_VERSION);
             }
             else if (pathname === "/api/search") {
                 const query = new URL(request.url, "http://localhost").searchParams;
@@ -960,12 +1010,12 @@ function sendText(response, status, contentType, body, head) {
     response.setHeader("content-length", Buffer.byteLength(body));
     response.end(head ? undefined : body);
 }
-function sendAsset(response, asset, head) {
+function sendAsset(response, asset, head, versioned = false) {
     const payload = asset.encoding === "base64"
         ? Buffer.from(asset.body, "base64")
         : Buffer.from(asset.body, "utf-8");
-    if (asset.contentType.startsWith("font/") || asset.contentType.startsWith("image/")) {
-        response.setHeader("cache-control", "public, max-age=31536000, immutable");
+    if (versioned) {
+        response.setHeader("cache-control", "private, max-age=31536000, immutable");
     }
     response.statusCode = 200;
     response.setHeader("content-type", asset.contentType);

package/docs/cli-information-contract.md

@@ -14,14 +14,15 @@ schema migration or new snapshot/cache store is introduced.
 | Question | Entry | Default information / further reading |
 | --- | --- | --- |
 | Which Task? | `task list` | Existing bounded catalog, filters, attention and cursor |
-| What is current? | `task context <task>` | Current Task/Brief/Role/Project/workspace facts, active work and Runs, open inputs, active decisions, unresolved jobs, recent Message references; no event or terminal-Run dump |
+| What is current? | `task context <task>` | Current facts, active work, open inputs, active decisions, unresolved jobs and unacknowledged Message references; no event or terminal-Run dump |
 | What records exist? | `task context list <task> --store <family>` | One authorized family, summaries and exact digest-bearing references |
 | What does it actually say? | `task context inspect <task> --store <family> --ref <id> --digest <digest>` | Exact current record, including original result expansion; long documents are paged |
 | What changed? | `task context delta <task> --after <cursor>` | Immutable events with a fixed upper bound, not a snapshot of current mutable state |
-| Which Global input? | `session context <role>` | Identity, profile, authority, current native Turn/retry and separate bounded pending/recent Message pages |
+| Which Global input? | `session context <role>` | Identity, Profile read pointer, authority, current native Turn/retry facts and a bounded pending Message page; history is opt-in |
 | Read Global input | `role message list <role> [--pending]`, `role message show <role> <id>` | Scoped discovery, then exact original; queue acceptance never erases history |
 | What arrived in this wake? | `task wake show <task> <wake>` | Fixed-window inputs/results, attributed optional summaries and exact original reads; `--history` expands diagnostics |
-| What was assigned? | `task run context <task>/<run>` | Frozen authority and a single `pointers` inventory with summaries; changed identities in `deltaRefs`; current observations remain separate |
+| What was assigned? | `task run context <task>/<run>` | Frozen authority, up to 16 `pointers`, sampled changed identities and live observations with totals; `--view refs` pages references, `--view full` reads the full pack |
+| Which repeated failure? | `role message list <role> --diagnostics` | Derived classified groups with count, first/latest and recovery evidence; `--diagnostic <key>` pages original occurrences |
 | Which configuration is real? | `task role session inspect <task> <role>` | Task/Role identity, desired binding, frozen Session, current Provider binding, retry and explicit Host observation; no full Task/Role copies or Provider conversation history |
 
 Domain lists for Task Messages, events, WorkItems, Runs, decisions, milestones,
@@ -35,23 +36,35 @@ workspaces and other authorized record families. `--status`, `--after` and
 `--work-item` narrow Context discovery; every continuation must retain filters.
 Run listing accepts a Task or `task/work` target.
 
-Current Context's `attention.messages` counts all authorized Messages, not only
-undelivered input. `collections` counts and `omitted` explicitly describe
-incomplete discovery. Recent samples are not proof that no older pending or
+Current Context's `attention.messages` excludes explicit acknowledgements and
+retirements; delivery alone is not handling. The exact wake receipt and latest
+Message revision determine coverage. `--view current` continues that view;
+the default family list still includes history. `collections` counts and `omitted`
+explicitly describe incomplete discovery. Samples are not proof that no older pending or
 relevant input exists. Read the relevant fixed wake and original Messages;
 use family discovery when a broader requirement/history audit is needed.
 
 ## Budgets and continuations
 
-- Discovery pages default to 20 items, accept 1–100, and reserve a 32 KiB
-  compact-JSON budget. Items contain summaries, never full Message/report bodies.
+- Discovery pages default to 20 items, accept 1–100, and enforce a 32 KiB
+  compact-JSON budget including the success envelope, escaped identities,
+  continuation and nested structure. Summaries are at most 512 UTF-8 bytes.
 - Current Task Context has at most 64 records, with a 24 KiB record/attention
   budget inside a 32 KiB response budget. Single inline values are at most
   2 KiB; large values and Message/Run/WorkItem/Knowledge bodies use references.
   Each collection contributes at most eight sampled records at entry.
-- Global entry samples up to eight pending and eight recent Messages separately.
-  They have independent continuations, so a long historical list cannot crowd
-  pending input out of the entry view.
+- Global entry samples up to eight unacknowledged inputs, including claimed or
+  uncertain ones. It does not repeat recent history, Profile bodies, frozen Skill
+  packages or accumulated retry details. The Manifest is the Profile pointer;
+  explicit Message and Session retry reads retain history and original evidence.
+- Run entry samples up to eight records per live category and 16 frozen refs.
+  Pointer continuation uses `--view refs` and `pointerPage.nextCursor`; full pack
+  document continuation uses `--view full`. Neither changes the frozen authority.
+  Read `--view input` before acting when `input.directiveOmitted` is true: the
+  entry's bounded directive summary is not the assigned instruction body.
+- `session skills [--cursor ...]` checks only current metadata/readability. It
+  does not read Skill bodies or historical packages, and uses document pagination
+  only when the configured metadata exceeds the inline budget.
 - Detail documents up to 16 KiB remain ordinary JSON. Larger documents return
   `contentPage`: exact source, SHA-256 digest, JSON-character offset, total bytes
   and characters, text, completeness and a next cursor. Chunks contain at most
@@ -78,6 +91,24 @@ concurrent writes. For append-only event traversal use fixed-bound Context delta
 Discovery currently scans the selected authorized family to fingerprint it;
 its output, not total storage-reading cost, is bounded.
 
+## Runtime diagnostics
+
+Global failure evidence remains ordinary record-only Messages; no aggregate
+table, Message envelope change, memory store or recovery state machine is added.
+Grouping is a derived view of new evidence documents. Older documents remain
+readable in ordinary history, not heuristically reclassified. Classified source,
+Host/Session, error category/code and explicit effect distinctions determine
+equivalence; unclassified faults are not merged. Original affected IDs and raw
+evidence remain in exact documents, never a growing array in one notification.
+Counts represent distinct observations, not repeat polls of the same identity.
+
+One queued notice represents an unchanged failure episode. Only a new group,
+changed impact or exact successful recovery observation produces a new notice.
+Recovery ends the corresponding episode without acknowledging inputs or proving
+absence of previous effects. Recurrence after recovery gets a new episode.
+Operator's own failures/recovery notices are retained without self-delivery.
+Discovery and every evidence page retain the existing Role read boundary.
+
 ## Effects and exceptions
 
 Message send/queue/steer receipts preserve identity, digest, body byte count and

package/docs/cli-information-contract.zh-CN.md

@@ -12,14 +12,14 @@ CLI 调用成功，不代表 Task、原生 Turn 或远端投递完成。
 | 问题 | 入口 | 默认信息与下一步 |
 | --- | --- | --- |
 | 找哪个 Task？ | `task list` | 既有有界目录、过滤器、attention 与游标 |
-| 当前有什么？ | `task context <task>` | 当前 Task/Brief/Role/Project/工作区事实、活跃工作与 Run、开放输入、有效决策、未解决 Job、近期 Message 引用；不倾倒事件或终态 Run |
+| 当前有什么？ | `task context <task>` | 当前事实、活跃工作、开放输入、有效决策、未解决 Job、未确认处理的 Message 引用；不倾倒事件或终态 Run |
 | 有哪些记录？ | `task context list <task> --store <family>` | 一种获授权的记录、摘要与带 digest 的确切引用 |
 | 原文是什么？ | `task context inspect <task> --store <family> --ref <id> --digest <digest>` | 确切当前记录，含原始结果展开；长文档分页 |
 | 发生了什么变化？ | `task context delta <task> --after <cursor>` | 固定上界内的不可变事件，不是可变当前状态的快照 |
-| Global 收到了什么？ | `session context <role>` | 身份、Profile、权限、当前原生 Turn/retry，以及分别有界的 pending/recent Message 页 |
+| Global 收到了什么？ | `session context <role>` | 身份、Profile 读取指针、权限、当前 Turn/retry 事实与小窗口 pending 页；历史按需读取 |
 | 读取 Global 输入 | `role message list <role> [--pending]`、`role message show <role> <id>` | 在自身范围内发现，再读完整原文；队列接受不删除历史 |
 | 本次唤醒带来什么？ | `task wake show <task> <wake>` | 固定窗口的输入/结果、标明来源的可选摘要和确切原文入口；`--history` 展开诊断历史 |
-| 分配了什么？ | `task run context <task>/<run>` | 冻结授权与一份带摘要的 `pointers` 目录；`deltaRefs` 表示变化身份；当前观察独立 |
+| 分配了什么？ | `task run context <task>/<run>` | 冻结授权与有限 `pointers` 窗口，变化身份和活跃观察附总数；`--view refs/full` 按需扩展 |
 | 实际配置是什么？ | `task role session inspect <task> <role>` | Task/Role 身份、期望绑定、冻结 Session、当前 Provider 绑定、retry 与显式 Host 观察；不复制整个 Task/Role 或 Provider 会话历史 |
 
 Task Message、事件、WorkItem、Run、决策、里程碑、publication 和 InputRequest 列表
@@ -31,17 +31,26 @@ Context 列表还暴露候选、Review、Job、Project Knowledge、工作区等
 `--status`、`--after`、`--work-item` 缩小发现范围；续读必须保留过滤条件。
 Run 列表接受 Task 或 `task/work` 目标。
 
-当前 Context 的 `attention.messages` 统计全部获授权 Message，不仅是未投递输入。
-`collections` 计数与 `omitted` 明确表达发现不完整。近期抽样不能证明没有更早的待处理
+当前 Context 的 `attention.messages` 排除明确 ack 或退役的 Message；投递成功不代表
+处理完成。精确 wake 回执必须覆盖最新原文版本。用 `--view current` 续读当前视图，
+默认分类列表仍保留完整历史。`collections` 计数与 `omitted` 明确表达发现不完整。抽样不能证明没有更早的待处理
 或相关输入。读取相关固定 wake 与原始 Message；更广的需求/历史审计使用分类发现。
 
 ## 预算与续读
 
-- 发现页默认 20 条，可选 1–100，紧凑 JSON 预算 32 KiB。条目包含摘要，不含完整报告正文。
+- 发现页默认 20 条，可选 1–100，紧凑 JSON 预算 32 KiB，计入成功 envelope、
+  转义身份、游标和嵌套结构。摘要至多 512 UTF-8 字节，不含完整报告正文。
 - 当前 Task Context 至多 64 条，记录与 attention 共 24 KiB，响应预算 32 KiB。
   单个内联值至多 2 KiB；大值及 Message/Run/WorkItem/Knowledge 正文用引用。
   入口每个集合最多抽样八条。
-- Global 入口分别抽样八条 pending 与八条 recent；独立续读，历史不能挤掉待处理输入。
+- Global 入口最多八条未确认处理的输入，保留已领取或效果未知项；不重复 recent、
+  Profile 正文、历史 Skill 包和累计 retry 详情。Profile 由 Manifest 精确指向。
+- Run 入口最多 16 个冻结引用和每类八条活跃观察，附总数。`--view refs` 配合
+  `pointerPage.nextCursor` 发现更多引用；`--view full` 显式读取完整冻结包。
+  若 `input.directiveOmitted` 为 true，行动前用 `--view input` 全文读取分配指令；
+  默认入口的指令摘要不是指令正文。
+- `session skills [--cursor ...]` 只检查当前元信息和可读性，不读技能正文；
+  配置元信息过大时使用相同文档分页。
 - 不超过 16 KiB 的详情保持普通 JSON。更大详情返回 `contentPage`：确切来源、
   SHA-256 digest、JSON 字符偏移、总字节数/字符数、文本、完整性与下一游标。
   每块最多 4096 个 UTF-16 单元，不拆代理对，转义后的输出低于 32 KiB。
@@ -61,6 +70,18 @@ Run 列表接受 Task 或 `task/work` 目标。
 追加事件遍历使用固定上界 Context delta。目前分类发现扫描选定的授权集合来计算指纹；
 有界的是输出，不是总存储读取成本。
 
+## 重复运行时诊断
+
+`role message list <role> --diagnostics` 从原始 record-only Message 派生故障组，
+给出首次/最近时间、不同观察的数量及恢复证据；`--diagnostic <key>` 分页发现原文。
+按明确的 Host/Session、来源、故障类别/代码及效果边界区分；未分类错误不猜测合并。
+同一观察重复轮询不新增记录或计数，同组跨 Turn 不重复唤醒。新故障、影响变化、
+精确成功恢复或恢复后再发生可产生通知。Operator 自身诊断保留但不自动唤醒自身。
+恢复不等于消息 ack、Task 完成或撤销旧副作用。
+
+聚合不持久化，也不累计受影响 ID 数组；不增加表、消息 envelope 字段或第二状态机。
+旧证据仍由普通历史读取，不启发式重新分类。每页沿用现有 Role 权限边界。
+
 ## 效果与例外
 
 Message send/queue/steer 回执保留身份、digest、正文字节数及原有提交/投递/control

package/docs/managed-turn-and-session-runtime.md

@@ -39,6 +39,40 @@ automatically create Runs. Explicit dispatch loads one exact Run Context Pack.
 
 ## Context
 
+### Current caller and durable handling
+
+Desktop and TUI use the same current-Session authority. A Desktop command carrying
+only `CODEX_THREAD_ID` resolves its owner from the selected Home's existing active
+Session inventory, then verifies the current Role/Agent binding, revocation and
+captured workspace. Codex's native ID takes precedence over an inherited transport
+ID, so a native child cannot borrow its parent's identity. Unknown native IDs,
+wrong Homes and conflicting hints fail closed; only a terminal with no managed or
+native identity is a plain user. Environment variables and a Manifest locate
+context, not continuing authority. A replaced Session retains only its bounded
+self-diagnostic reads, not inbox or mutation permission.
+
+`yui inbox list` exposes the current identity, delivery evidence, handling state
+and blockers separately. Reads never consume input. Automatically accepted
+Global messages, delivered Leader windows and the current Assignment's
+continuation messages still need `claim` and explicit `ack --reason` after their
+originals and effects have been handled. Claiming delivered input does not resend
+it. Pending/unknown acceptance cannot be taken over; an accepted Global input or
+Leader window can be explicitly settled by its rightful successor without
+changing its original delivery target. Include useful result/effect receipt
+references in the reason. Task completion still requires handling user inputs,
+not merely a native terminal.
+
+Receipts remain on the existing Message/TaskWake records. Both notification
+paths pin mutable Draft revisions by existing `message.updated` event IDs,
+not timestamps; a later revision cannot inherit an old acknowledgement.
+Claimed Message content and fixed window references cannot be silently replaced.
+Duplicate accepted notifications do not re-submit that revision. If a handler
+crashes or ack fails after an external effect, inspect the original claim and
+effect receipt, finish only unfinished work, and retry the same acknowledgement.
+No lease expires and no installation upgrade or context compaction resets
+handling. This reuses storage 1.7 payloads without adding a message system,
+schema transition or an arbitrary external exactly-once guarantee.
+
 ```sh
 yui task context <task> --json
 yui task context list <task> --store <store> [--cursor <cursor>]
@@ -69,11 +103,27 @@ Run Pack is a reference directory: read the relevant requirement and message
 bodies before acting, rather than treating a successful load as the deliverable.
 Planning Packs expose no Project write scope or Task-completion permission.
 
-The Manifest pointer is a recovery locator, not a read receipt. Load its exact
-`yui-runtime`, Role Skills and profile on first entry, a new/version-changed
-Session, or missing context after compaction/recovery. Reuse instructions only
-when the same-version full content is still available; Yui stores no "already
-read" state. Always refresh dynamic facts. Leader notifications use
+The Manifest pointer is a recovery locator, not a read receipt. At the start of
+every turn run `yui session skills --json` through the Session's CLI/Home. It
+checks current paths, internal `VERSION` files and readability, without reading
+Skill bodies or walking/snapshotting resources. Builtins use the running
+installation's `skills/<id>` entry; configured Skills use `YUI_HOME/skills/<id>`.
+These paths do not contain a Session/content digest. After changing installation
+locations the check resolves the current installation, not an old recorded path.
+For Global Sessions the Manifest's `skillCheckCommand` is its self-contained
+`session context <role>` read, which also returns current Skill metadata and works
+after moving to Desktop without the launch shell's environment. An older Global
+Manifest's existing `loadCommand` provides the same check.
+
+Load current `yui-runtime`, applicable Role/custom Skills and necessary references,
+plus the Manifest's profile, on first entry, a version change, recovery, or missing/
+compacted/uncertain context. Reuse only when versions are unchanged and the full
+instructions remain available now. Yui stores no "already read" state and does
+not claim to inspect the model's context. Historical packages remain audit only;
+missing/corrupt snapshots do not prevent valid Session resume or input delivery.
+Missing current files report their exact path and recovery action. Session
+identity, scope, writer fences and real CLI/Home incompatibility still reject.
+Always refresh dynamic facts. Leader notifications use
 `currentCommand`; dispatched AgentRuns use the actual Run ID with
 `loadCommand`/`expandCommand`, never their placeholder templates.
 
@@ -139,6 +189,78 @@ summary store, read-acknowledgement or extra model call is involved. Missing or
 oversized summaries fall back to facts without clipping qualifications.
 Summaries never grant authority, accept results or mark reviews approved.
 
+### Operator backlog and periodic recovery
+
+Task completion/cancellation/retirement, publication records/adoption and input
+requests enqueue Operator attention in the same transaction as their durable
+event. Existing Run failure routing keeps its retry and supervisor guards.
+The ready mailbox is the incremental recovery source: a lost scheduler signal
+or Controller restart does not require a Leader report or a scan of historical
+Tasks. The existing periodic pass retries outstanding mailbox work; an unchanged,
+settled mailbox creates neither a Message nor a model call.
+
+At most one unsent engineering notice is queued. Further facts coalesce in the
+mailbox until that notice is accepted or conclusively not delivered. Each handoff
+claims at most 64 source signals and reads exact records, retaining the unclaimed
+suffix. Global delivery reads at most 64 pending Messages per Role per pass;
+conclusively stale originals retain their nondelivery evidence, with later pages
+handled by subsequent passes. Reserved interrupt-then inputs remain discoverable
+beyond that ordinary page. FIFO user inputs and unknown-effect fences are not
+reordered to make notifications appear healthy. SQL aggregates still inspect
+matching stored rows; these bounds limit materialized records and per-pass
+delivery work, not the size of the persisted mailbox or database.
+
+A full reconciliation may ask the original Host to republish an already observed
+terminal for the exact Session, authority, attempt and native Turn. For a Desktop
+direct Turn, that Host must have retained both the exact start and terminal under
+the unchanged writer fence; `direct:<nativeTurnId>` and the native Turn are both
+required. This bounded latest observation does not make the input client-owned.
+During an Inbox persistence failure, the Host additionally retains every
+unpersisted original fact, including starts and full terminals, until the
+existing Inbox accepts it. Later direct turns must not overwrite those bytes.
+This uses the existing Inbox and canonical observer, including the original result.
+It does not submit input, query another native client, restart a Host, or infer
+quiescence from elapsed time/idle state. Normal terminal processing signals again
+after releasing Host occupancy. Unknown acceptance remains isolated unless exact
+evidence settles that input. Explicit stop/replacement and external writers remain
+hard boundaries. Full Task and Global reconciliation also covers an unsettled
+final input with no queued successor. A filesystem repair retries observations,
+not native execution; process loss before persistence remains a disclosed gap.
+
+`yui session context <role> --json` includes bounded `backlog` diagnostics: pending
+count, oldest timestamp, target and attempt identities, blocking reason and
+recovery guidance. Live age is in `backlogObservation`, outside the paged source
+digest. `in-flight-or-unobserved-terminal` deliberately does not label a
+long-running accepted Turn as stuck. An unavailable/older Host or missing retained
+terminal produces one record-only runtime-attention Message per exact attempt;
+inspect it through the existing message list/show commands. No recovery Agent,
+private timer, migration or new acknowledgement state is introduced. If the
+Provider itself never reported a terminal, or the original Host lost its evidence,
+automatic reconciliation cannot prove completion: restore the compatible observation
+path or explicitly stop/replace only with the required native quiescence evidence.
+This change does not backfill arbitrary pre-existing historical events, adopt old
+Hosts, or authorize production upgrades/restarts.
+
+Controller restart preserves live Hosts; it does not replace their loaded code.
+A supported surviving Host writes raw observations to the immutable Inbox even
+while the Controller is down; the restarted Controller applies them under current
+Session fences. A frozen Manifest's CLI/storage mismatch is a context-read failure,
+not proof that the Host publisher failed: this publisher uses the Inbox/RPC, not
+that CLI. An Endpoint checkout generation is not a complete Host build identity.
+The runtime-attention evidence distinguishes an unavailable control channel,
+rejected control (including implementations without reconciliation), and a missing
+exact retained terminal, with reported Endpoint/event-delivery observations.
+The status `controlCapabilities` advertisement gates additive v1 commands.
+Missing `reconcile-turn` support yields `unsupported` without sending the
+invalid request. The original Inbox remains usable; no alternative native
+input or guessed terminal is generated. `hostImplementation` identifies code
+captured when the Host loaded, not the current install or Endpoint generation.
+Compatible build changes do not block exact native Session resume after an
+authorized safe release. They never change the user's launch configuration.
+Missing delivery diagnostics mean unreported, not healthy. Unsupported live code
+cannot be repaired by another Controller restart or guessed adoption; inspect the
+original evidence and explicitly authorize any necessary lifecycle recovery.
+
 `task wake show <task> <wake>` now defaults to inputs/results and explicit
 references, including older referenced originals. It omits unrelated diagnostic
 events and merely started Runs; `--history` restores full fixed-window discovery.