@zq-silk/yui 2.6.0 → 2.8.0

package/docs/testing/review-evaluation.md

@@ -0,0 +1,148 @@
+<p align="right"><strong>English</strong> | <a href="./review-evaluation.zh-CN.md">简体中文</a></p>
+
+# First-round review: materials and offline evaluation
+
+The default is one Reviewer using risk-appropriate perspectives, not a fixed
+number of Agents or findings. Leader judgment still owns acceptance. Generic
+methods live in `skills/yui-reviewer` and `skills/yui-leader`; project commands
+and architecture rules remain in Project Skills/Policy.
+
+## Material handoff
+
+Use existing requirements, decisions and verification results. A complex change
+may benefit from a short Task artifact index:
+
+- Goal/non-goals and effective decision references.
+- Observable scenarios, expected behavior and independent contract sources.
+- Contract entry points, callers and key risks.
+- Candidate identity and actual check results (commit, environment, command,
+  result), distinguishing unexecuted scenarios and uncovered boundaries.
+- For full re-review: repair delta, previous findings' dispositions and still
+  applicable evidence. The complete current frozen candidate remains in scope.
+
+Save the index with `task artifact save`, then place its returned
+`git:<commit>:<relativePath>` in Brief. New Review snapshots include the Brief
+and active decisions. Read relevant bodies using the exact `store/refId` from
+the Context inventory, following content pagination. A same-Task artifact is
+read at its pinned commit with `task artifact read <task> <path> <commit>`.
+Later Brief/decision edits do not change an existing Review snapshot. This is
+not a document-completeness gate, prose parser or Skill-version freeze.
+Ordinary full review and the existing equivalence Delta Recheck remain distinct.
+
+## Small development corpus
+
+`scripts/review-eval/` is an offline file tool, not a scheduler, model adapter or
+new Core store. It never calls a provider. No historical Task cases or results
+are inputs. All eight examples are newly constructed from explicit contracts.
+
+| Cases | Capability | Shape |
+| --- | --- | --- |
+| E01 | Half-open interval behavior | Introductory single root |
+| E02 | Persistence failure and repeat identity | Two independent roots in one complete candidate |
+| E03 | Producer/consumer opaque-cursor contract | Two modules |
+| E04–E06 | Lifecycle, partial-result correspondence, authorization effects | Intermediate state/contract cases |
+| E07–E08 | Distinguishing permitted behavior from defects | LRU and progressive-display controls |
+
+Every package supplies a complete candidate, not a historical patch; there is no
+required repository baseline. Requirements define inputs, non-goals and effects.
+The scorer catalogue holds root/trigger/violation/impact and repair controls.
+`verify.mjs` probes observable behavior against independent literal expectations,
+checks seven target roots, passing repairs and normal controls. It does not
+prove exhaustive correctness, independent authorship verification or Agent
+effectiveness. Additional valid findings require adjudication.
+
+```sh
+node scripts/review-eval/evaluate.mjs verify
+node scripts/review-eval/evaluate.mjs export E03 basic /absolute/new-participant-directory
+```
+
+Export uses an explicit projection of candidate source and requirements; indexed
+materials add only a navigation index. Both have identical necessary contracts
+and source. Exports contain no gold, repair, scorer code, family labels or Git
+history. Existing destinations are refused. A failed export may leave a partial
+directory: inspect it, do not use it as a complete participant package.
+
+Export is NOT a filesystem sandbox. A participant with access to this repository,
+the scorer directory, prior sessions or the network can obtain answers.
+Only claim blind evaluation after a separately provisioned isolated environment
+denies those paths/tools, with access probes and exact evidence. Never use a
+“do not read answers” instruction as isolation.
+
+These are public development cases. Unknown holdouts must be separately authored
+after the method/protocol is fixed, with independent contract checking and a
+family-level overlap audit. Renamed, repaired or near-variant development cases
+cannot become holdouts. Keep holdout source, labels and adjudication outside
+participant access and method-tuning conversations. This tool deliberately
+does not fabricate a holdout or claim one has been evaluated.
+
+## Freeze a comparison before running it
+
+```sh
+node scripts/review-eval/evaluate.mjs plan protocol.json
+node scripts/review-eval/evaluate.mjs score plan.json records.json
+```
+
+Capture stdout as separate files using your normal artifact workflow. The
+protocol is a JSON object with nonempty `model`, `effort`, `tools`, `environment`,
+`budget`, `seed`; positive `repeats`; and `baseline`/`improved` maps of relative
+Skill paths to exact UTF-8 contents, including their VERSION and required
+references. Load these only in isolated evaluation configuration, not global
+installation. This file is scorer-side; it contains both methods.
+
+The plan assigns A=baseline/basic, B=improved/basic, C=baseline/indexed,
+D=improved/indexed. It fixes corpus/config/source/material/Skill digests and run
+IDs, seed-orders case/repeat blocks and balances group position by Latin rotation.
+Three repeats over eight development cases means 96 runs, not an authorization
+or statistical-power claim. Do not change models, budgets or tools between groups.
+An extra independent-Reviewer comparison is a separate experiment with all
+producer and synthesis costs, optionally with matched total budgets.
+
+There is no live execution or automatic retry command. Actual runs require
+explicit resource/effect authorization, fresh participant sessions and verified
+isolation. Preserve exact inputs, actually loaded Skills/configuration, raw
+outputs and execution/tool evidence. Do not infer a successful run from dispatch.
+Predeclare any retry protocol separately, retain original failures and every
+attempt's costs; do not replace a failed planned record with a successful retry
+in the primary analysis. This minimal tool reports one attempt per planned run.
+
+## Adjudicate before aggregation
+
+`records.json` is an array. Each supplied record contains its planned `id`,
+`planDigest`, observed `candidateDigest`, `materialDigest`, `skillDigest`, `configDigest`, and
+`status` (`completed`, `timeout`, `infra-failed`, `not-run`). Executed records
+also contain `evidenceRef` and `rawOutput`; incomplete records require `reason`.
+Identity digests are evidence supplied by the execution recorder, not attestation
+by this offline tool. Preserve the actual model/tool/environment configuration
+in that evidence and exclude protocol deviations rather than relabeling them.
+`configDigest` hashes the JSON object containing `model`, `effort`, `tools`,
+`environment`, `budget` in that order. Other digests use the exported `digest`
+helper (SHA-256 of `JSON.stringify(value)`). Reports bind the complete supplied
+record array with `recordsDigest`; retain that file alongside the plan/report.
+
+Completed records require `findings` (empty is valid). Each finding contains
+`id`, original `claim`, and `verdict`: `valid`, `invalid`, `pending`, `gap` or
+`suggestion`. Valid/invalid adjudications also require `root`, `reason` and
+`evidence`. Match meaning, triggers, violated constraints and impact, not wording
+or line numbers. Use the catalogue root ID only after checking evidence.
+Unlisted valid roots use `novel:<stable-key>` after separate verification;
+never automatically label them false positives. Keep disputes pending.
+Use a scorer who does not see group labels when practical; disclose if author,
+checker and scorer are the same person/Agent.
+
+Optional `coverage` entries contain `perspective`, `scenario`, `expected` and
+`evidence`, using the case's applicable perspectives. These remain claims to
+inspect, not automatic proof. Optional `metrics` contains nonnegative `wallMs`,
+`agentCalls`, `toolCalls`, `inputTokens`, `outputTokens`, `contextBytes`, `cost`
+(one predeclared currency). Missing values remain missing, never estimated.
+
+The report includes per-case repeated recalls, macro/micro known-root recall,
+adjudicated unique-root precision, false positives and control false-positive
+rate, duplicate/novel/pending counts, planned completion and discovery yield,
+cost availability and Skill/material/interaction contrasts. Zero denominators
+are null. Partial outputs are retained in originals but excluded from completed
+first-round metrics. Missing planned runs remain `not-run`; they are not clean
+reviews. Failed-run costs still count. Completed-only contrasts can be biased:
+inspect failures, denominators and per-case variation before interpretation.
+If gold changes, preserve the old plan and rescore every group under the same
+new adjudication version, reporting both results. No automatic acceptance
+threshold or generalization claim follows from this small synthetic corpus.

package/docs/testing/review-evaluation.zh-CN.md

@@ -0,0 +1,117 @@
+<p align="right"><a href="./review-evaluation.md">English</a> | <strong>简体中文</strong></p>
+
+# 首轮审查：材料与离线评测
+
+默认单 Reviewer 按风险使用互补视角，不固定 Agent 或 Findings 数量。
+验收仍由 Leader 判断。通用方法位于 `skills/yui-reviewer` 和
+`skills/yui-leader`；项目命令与架构规则保留在 Project Skill/Policy。
+
+## 材料交接
+
+复用有效要求、决定和验证结果。复杂变更可以保存简短的 Task 工件索引：
+
+- 目标/非目标及有效决定入口。
+- 可观察场景、预期行为和独立契约依据。
+- 契约入口、调用方及关键风险。
+- 候选身份和实际检查结果（提交、环境、命令、结果），区分未执行场景与未覆盖边界。
+- 完整复审追加修复 delta、历史 Findings 处置及仍适用证据；当前完整冻结候选仍在范围内。
+
+通过 `task artifact save` 保存索引，将返回的
+`git:<commit>:<relativePath>` 放入 Brief。新的 Review Snapshot 包含 Brief
+及 active 决定。按 Context inventory 的精确 `store/refId` 读取相关正文并跟完内容分页。
+同 Task 工件通过 `task artifact read <task> <path> <commit>` 读取固定提交。
+后续 Brief/决定修改不改变既有 Review Snapshot。这不是文档齐全门禁、
+自然语言解析器或 Skill 版本冻结机制。普通完整复审与已有等价性 Delta Recheck 保持不同语义。
+
+## 小型开发集
+
+`scripts/review-eval/` 是离线文件工具，不是调度器、模型适配器或新增 Core 存储。
+它不调用 Provider，不以任何历史 Task 案例或结果为输入。八个题目均由明确契约新构造。
+
+| 案例 | 能力 | 形态 |
+| --- | --- | --- |
+| E01 | 半开区间行为 | 入门单根因 |
+| E02 | 持久化失败与重试身份 | 一个完整候选内的两个独立根因 |
+| E03 | 生产者/消费者不透明游标契约 | 两个模块 |
+| E04–E06 | 生命周期、部分结果对应、授权副作用 | 中等状态/契约题 |
+| E07–E08 | 区分合法行为与缺陷 | LRU 与渐进展示正确对照 |
+
+每包提供完整候选，不是历史补丁，也不要求仓库基线。要求明确输入、非目标和副作用。
+评分侧目录保存根因、触发、违反约束、影响及修复对照。
+`verify.mjs` 用独立的字面预期检查可观察行为，验证七个目标根因、通过的修复及正常对照。
+这不证明穷尽正确性、独立出题核实或 Agent 效果。额外有效发现需要裁定。
+
+```sh
+node scripts/review-eval/evaluate.mjs verify
+node scripts/review-eval/evaluate.mjs export E03 basic /absolute/new-participant-directory
+```
+
+导出仅投影候选源码与要求；indexed 材料只增加导航索引。两组的必要契约与源码完全相同。
+导出不含 gold、修复、评分器、家族标签或 Git 历史，拒绝已有目标目录。
+导出失败可能留下部分目录，应检查并避免当作完整受测包使用。
+
+导出不是文件系统沙箱。若受测者能读本仓库、评分目录、先前会话或网络，仍可能获得答案。
+只有另行配置的隔离环境确实拒绝这些路径/工具访问，并留存探针证据，才能声称盲测。
+“禁止看答案”的提示词不能代替隔离。
+
+这些是公开开发题。未知保留题必须在方法与协议确定后单独编写，独立核实契约并做家族重叠审计。
+开发题的改名、修复和近似变体不能变成保留题。保留源码、标签和裁定材料不得进入受测权限或
+方法调优会话。本工具明确不伪造保留集，也不声称已评测保留集。
+
+## 运行前固定比较协议
+
+```sh
+node scripts/review-eval/evaluate.mjs plan protocol.json
+node scripts/review-eval/evaluate.mjs score plan.json records.json
+```
+
+按正常工件流程将 stdout 保存为单独文件。协议 JSON 包括非空
+`model`、`effort`、`tools`、`environment`、`budget`、`seed`，正整数 `repeats`，
+以及 `baseline`/`improved` 两个“Skill 相对路径 → 精确 UTF-8 内容”映射，
+包含 VERSION 和必要引用。只在隔离评测配置加载，不修改全局安装。
+协议文件属于评分侧，含两种方法，不能整体交给受测者。
+
+计划固定 A=baseline/basic、B=improved/basic、C=baseline/indexed、
+D=improved/indexed，记录题库、配置、源码、材料、Skill 摘要与 run ID。
+按 seed 排列案例/重复块，并以拉丁轮换平衡组别位置。八题各重复三次是 96 次运行，
+不是资源授权或统计效力承诺。各组不得更换模型、预算或工具。
+额外独立 Reviewer 属于另一项试验，计入全部生产者与汇总成本，可补同总预算比较。
+
+没有真实执行或自动重试命令。实际运行需要明确资源/副作用授权、全新受测会话和已验证隔离。
+保留精确输入、实际加载的 Skill/配置、原始输出与执行/工具证据，不能把投递当成功执行。
+重试规则须另行预先规定，保留原失败及全部尝试成本；主分析不得以成功重试覆盖失败的计划记录。
+此最小工具每个计划 run 只统计一次尝试。
+
+## 先裁定，再汇总
+
+`records.json` 是数组。每条记录包含计划 `id`、`planDigest`、
+实际观察到的 `candidateDigest`、`materialDigest`、`skillDigest`、`configDigest` 及 `status`
+（`completed`、`timeout`、`infra-failed`、`not-run`）。
+已执行记录还包含 `evidenceRef`、`rawOutput`；未完成记录需要 `reason`。
+身份摘要来自执行记录者，本离线工具不为其真实性背书。
+实际模型/工具/环境配置保留在证据中；协议偏离应单列排除，不能重标为合规运行。
+`configDigest` 对依次包含 `model`、`effort`、`tools`、`environment`、`budget`
+的 JSON 对象取摘要。其他摘要使用导出的 `digest` helper
+（`JSON.stringify(value)` 的 SHA-256）。报告通过 `recordsDigest` 绑定完整输入记录数组；
+该文件应与计划、报告一同保留。
+
+完成记录必须有 `findings`（允许空数组）。每条含 `id`、原始 `claim` 和
+`verdict`：`valid`、`invalid`、`pending`、`gap` 或 `suggestion`。
+valid/invalid 还必须有 `root`、`reason`、`evidence`。
+按语义、触发、违反约束及影响匹配，不按标题或行号匹配；核实证据后才使用题库根因 ID。
+gold 外有效根因经单独核实后用 `novel:<stable-key>`，不自动判误报；争议保留 pending。
+可行时让评分者不见组别；编题、核实和评分由同一人/Agent 完成时必须披露独立性限制。
+
+可选 `coverage` 条目含 `perspective`、`scenario`、`expected`、`evidence`，
+使用案例适用视角。它仍是待检查的覆盖声明，不是自动证明。
+可选 `metrics` 包含非负 `wallMs`、`agentCalls`、`toolCalls`、`inputTokens`、
+`outputTokens`、`contextBytes`、`cost`（预先约定同一币种）。
+缺失值保持缺失，不估造。
+
+报告包含逐题重复召回、已知根因宏/微召回、已裁定去重有效比例、误报及正确对照误报率、
+重复/新增/待裁定数、计划完成率与发现产出、成本可得性、Skill/材料/交互差异。
+零分母为 null；部分输出保留在原记录，但不混入完整首轮指标。
+缺失计划 run 保持 not-run，不算“审查无问题”；失败运行成本仍计入。
+完成子集的比较可能有选择偏差，须结合失败、分母及逐题波动解释。
+gold 修改后保留旧计划，在统一新裁定版本下重算所有组并同时报告新旧结果。
+此小型构造集不产生自动验收阈值或真实项目泛化结论。

package/docs/testing/verification-levels.md

@@ -50,12 +50,12 @@ is required.
 ## Permanent core smoke
 
 `npm test` and `npm run test:core` build the checkout and run the maintained suite.
-The stable suite owns current storage 1.6 and its declared 1.0/1.1/1.2/1.3/1.4/1.5 minor
+The stable suite owns current storage 1.8 and its declared 1.0/1.1/1.2/1.3/1.4/1.5/1.6/1.7 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.6, exact schema/record validation, no initialization over
+1. Fresh storage 1.8, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and
@@ -86,6 +86,12 @@ a blacklist of retired field names.
 ## Skill and instruction changes
 
 Review the shared Runtime contract and affected Role/Project Skills together.
+Managed Skills ship a separate integer `VERSION`; bump the owning version for
+substantive body or required-reference changes. The per-turn read reports current
+stable paths/versions, not remembered model state or a historical load receipt.
+Regressions cover pre-1.5 Session records upgraded from an isolated 1.4 Home,
+current Skill loading on resume, preserved original queued input and newly
+arriving suffixes, plus missing current files versus missing audit packages.
 Check instruction boundaries with a few relevant scenarios: analysis remains
 read-only, existing mechanisms are reused, Session loss preserves Task intent,
 and execution failure does not prevent authorized supervision. This is a
@@ -96,6 +102,10 @@ including cross-Role links. Entry points and their referenced Markdown must
 ship together. File/format checks establish availability, not Agent behavior;
 do not add prose-matching tests or claim model validation from static checks.
 
+For review-material handoff and the small original development corpus, see
+[review evaluation](review-evaluation.md). Its offline contract probes and
+adjudication aggregation are deterministic; they do not run or measure a model.
+
 ## CI and release
 
 `ci.yml` runs core plus one assembled-package normal-path smoke per supported
@@ -120,6 +130,13 @@ freshly installed package through
 artifact and provenance boundaries. This validates runtime integration, not
 real-model behavior. Pure contract and safety tests remain in `test/core`;
 production wiring is exercised here rather than only through mocked ports.
+The same release matrix runs `test/core/sqlite-driver.test.js` against the
+installed consumer: native selection boundaries plus real SQL, transactions,
+JSON/RETURNING, WAL and backup for each usable optional SQLite candidate.
+An unavailable optional candidate is explicitly skipped, not reported as
+compatible; the normal selected-driver path must still pass. Doctor smoke
+reports the selected driver, engine and fallback reason. This matrix does not
+prove old-glibc compatibility.
 The native dependency check launches a fixed local program through PTY and
 requires its output and normal exit. Installed-package smoke explicitly checks
 default Doctor's PTY results using dependencies resolved from the consumer.
@@ -132,8 +149,13 @@ The package smoke also checks unconditional status identity and update-owned
 resource/identity capture through the assembled package. Real lifecycle children
 stop the exact Controller and restore its captured launch identity while their
 parent holds the handover lock. Unrelated callers remain fenced, the lock stays
-owned by the parent, and durable input survives. These checks have no installation
-or publication effect.
+owned by the parent, and durable input survives. A live Operator Host also spans
+that replacement: a Desktop-direct terminal is persisted during Controller
+downtime, then the successor drains the queued user input and engineering notice
+without changing their original identities or replacing the Host. This is a
+current-contract process-handover regression, not proof of compatibility with
+every historical Host build. These checks have no installation or publication
+effect.
 
 Configured Agents acting as developers or reviewers are ordinary execution
 resources. Using a live provider or model as the subject of validation is

package/docs/testing/verification-levels.zh-CN.md

@@ -70,6 +70,9 @@ package-start 检查跟随已安装树中的本地 Skill 引用，包括跨 Role
 的 Markdown 必须一起发布。文件/格式检查确立可用性，而不是 Agent 行为；不要添加基于
 散文匹配的测试，也不要从静态检查中宣称模型验证。
 
+审查材料交接与小型原创开发集见[审查评测](review-evaluation.zh-CN.md)。
+其中离线契约探针和裁定汇总属于确定性检查，不运行或测量模型。
+
 ## CI 与发布
 
 `ci.yml` 在每个 PR 上构建一次，运行 core 及一个组装包正常链路检查，不重复 lint，
@@ -87,6 +90,10 @@ setup、输入跨重启持久化及幂等、scratch 激活、原生结果入库
 npm bin、依赖、受支持 Node 版本、产物和 provenance 边界。这证明运行时集成，不证明
 真实模型行为。纯契约与安全检查保留在 `test/core`，生产组件组装在这里验证，
 不只依赖模拟端口。
+同一发布矩阵还针对消费者安装包运行 `test/core/sqlite-driver.test.js`，验证原生
+选择边界，并对每个可用的可选 SQLite 候选执行真实 SQL、事务、JSON/RETURNING、
+WAL 和备份检查。不可用候选会明确标记跳过，不视为兼容；正常选择路径仍必须通过。
+Doctor 冒烟报告选中的驱动、引擎和回退原因。该矩阵不能证明旧 glibc 环境兼容。
 原生依赖检查必须通过 PTY 启动固定本地程序，确认输出和正常退出。安装包 smoke
 明确断言默认 Doctor 的 PTY 检查成功，并从消费者安装目录解析依赖。macOS 还会
 在可丢弃的依赖副本中移除 spawn-helper 执行权限，验证 Doctor 报出实际 helper
@@ -95,7 +102,10 @@ npm bin、依赖、受支持 Node 版本、产物和 provenance 边界。这证
 这不是整个 Doctor 一秒内返回的保证。
 组装包检查还验证固定身份输出，以及升级侧通过组装包采集资源和精确 Controller 身份，
 并在父进程持有交接锁时，通过真实生命周期子进程停止精确 Controller、恢复其已捕获的
-启动身份。无关调用仍被锁阻止，锁保持由父进程持有，持久输入不变；
+启动身份。无关调用仍被锁阻止，锁保持由父进程持有，持久输入不变。
+同一个存活 Operator Host 跨越交接：在 Controller 停机期间持久保存 Desktop
+直接回合的终态，随后由新 Controller 推进排队的用户输入和工程通知，保留原始输入身份，
+不替换 Host。这是当前契约下的进程交接回归，不证明所有历史 Host 实现都兼容；
 这些检查不执行安装或发布效果。
 
 作为开发者或审查者的已配置 Agent 是普通执行资源。把一个真实 provider 或模型作为验证

package/i18n/README.zh-CN.md

@@ -56,6 +56,25 @@ Claude 自身的 key 确认、目录信任等交互仍可能需要你完成。
 npm install -g @zq-silk/yui
 ```
 
+打开真实 Home 前，Yui 会惰性选择 SQLite：先用 `sqlite-modern`
+（`better-sqlite3@13.0.3`，N-API）建立可丢弃的内存连接，仅在明确的原生绑定缺失、
+Node ABI 或系统动态库不兼容时尝试 `sqlite-compat`（`better-sqlite3@10.1.0`）。
+每个进程固定首次成功的选择；Home 权限、损坏、锁定、SQL 与迁移错误都不会
+触发驱动切换。`yui doctor` 单独报告驱动版本、实际 SQLite 引擎和回退原因，
+与 Home 健康检查区分。
+
+N-API 驱动避开了旧驱动在 Node 24.19/24.20 上的原生 `ObjectWrap` 垃圾回收崩溃。
+它要求 Node-API 10；旧 API 的运行时（包括 Node 20 与 Node 22.9）会在加载
+原生模块前跳过它，使用兼容候选。此依赖修正不要求更换
+全局 Node 或迁移 Home。
+
+npm 安装时会**分别尝试两个**固定 optional alias，并非新版失败后才安装旧版，
+因此下载体积、安装和编译时间可能增加。可选依赖安装失败不一定使 npm 失败，
+但两个候选都不可用时 Yui 仍无法运行；不要使用 `--omit=optional`。
+兼容驱动使用旧 SQLite（3.46.0），不包含后续修复，也不保证兼容任意旧 glibc、
+编译器或较新的 Node ABI。上述 Node 支持范围不变；仍可能需要升级系统或工具链。
+驱动选择不会降级或迁移 Home 数据。
+
 ### 2. 自己初始化，或交给 Agent
 
 在终端中运行交互式初始化：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "2.6.0",
+  "version": "2.8.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,
@@ -48,9 +48,12 @@
   "dependencies": {
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
-    "better-sqlite3": "^12.11.1",
     "node-pty": "1.2.0-beta.15",
     "smol-toml": "1.8.0",
     "ws": "^8.21.1"
+  },
+  "optionalDependencies": {
+    "sqlite-modern": "npm:better-sqlite3@13.0.3",
+    "sqlite-compat": "npm:better-sqlite3@10.1.0"
   }
 }

package/skills/yui-leader/SKILL.md

@@ -1,11 +1,13 @@
 ---
 name: yui-leader
-description: Lead one Yui Task through authorized planning, activation handoff, execution and acceptance, choosing responsibilities and a useful stopping point from its current stage and user intent.
+description: Lead one Yui Task through authorized planning, activation handoff, execution, acceptance and same-result follow-up, including reopening its completed, unarchived result for an explicit implementation or delivery request.
 ---
 
 # Yui Leader
 
-Follow [yui-runtime](../yui-runtime/SKILL.md) first. Load the exact Context Pack
+Follow [yui-runtime](../yui-runtime/SKILL.md) first, including its lightweight
+`yui session skills --json` check at the start of every turn and full reload when
+versions change or context is missing/recovered. Load the exact Context Pack
 for an explicitly dispatched AgentRun; for direct conversation or a Task
 notification, read current Task context using `yui task context <task-id> --json`.
 No self-dispatch or old completed Run is needed. Read the actual Task
@@ -54,15 +56,22 @@ or planning work; the routes below do not override those restrictions.
   even on an active Task. Do not turn it into edits or dispatch. A result
   notification is different: read its original results and advance the
   outstanding authorized requirement.
-- **Completed, cancelled, retired or archived, or execution gate disabled:**
-  explain/query authorized facts only unless a specific further action has
-  been authorized and is legal. A conversation does not reopen, reactivate or
-  resume execution. If new implementation is requested, identify the needed
-  lifecycle/authority action for the Operator; do not manufacture a Run.
-  An explicit same-result follow-up on a completed, unarchived Task can authorize
-  the Operator's necessary reopen and submission without a second mechanical
-  confirmation. Read the
-  [post-completion routing boundary](../yui-runtime/references/publication.md#post-completion-routing-boundary).
+- **Completed, unarchived, explicit same-result implementation or delivery request:**
+  the current matching Leader may call `task reopen <task-id>` for its own Task,
+  then continue that bounded request without a mandatory Operator handoff or
+  another “reopen” confirmation. Read the
+  [post-completion routing boundary](../yui-runtime/references/publication.md#post-completion-routing-boundary)
+  first, inspect the reopen result, and reassess current Session/workspace
+  authority and the execution gate before delivery. Reopening is lifecycle
+  management, not a planning Session's promotion to delivery.
+- **Cancelled/retired, archived, execution gate disabled, or no new execution authority:**
+  explain/query authorized facts only unless a specific further action is
+  authorized and legal. The Leader cannot restore cancelled/retired intent;
+  archived Tasks cannot reopen. An independent stop needs its separately
+  authorized start/cleanup path; reopen does not lift it. Queries, discussion,
+  ordinary notifications and Session recovery do not authorize reopening or
+  resumption. Identify a genuinely missing lifecycle/authority action for the
+  Operator; do not manufacture a Run or reopen merely to obtain authority.
   Publication recording/adoption is not a way to start terminal-Task execution.
 
 These are instruction routes, not new lifecycle states or a scheduling
@@ -82,6 +91,14 @@ the failed target need not be running for you to act.
 
 ## Maintain useful durable context
 
+Apply **yui-runtime**'s own-inbox flow before acceptance or completion and at
+useful work boundaries. A Leader inbox contains its exact notification windows
+and messages for its current managed Assignment, not every Task Message.
+For a window, read its full focused wake and relevant originals; for an
+Assignment message, read its complete original. Dispose of results explicitly,
+then ack the exact entry. Inbox acknowledgement
+never accepts a Candidate or completes the Task.
+
 The DB Brief is the current summary, not a full plan or a history of messages.
 After meaningful progress, use `task brief update` with only intended fields;
 read `task event list` before deliberately restoring an older value. Keep

package/skills/yui-leader/VERSION

@@ -0,0 +1 @@
+3

package/skills/yui-leader/references/execution.md

@@ -303,6 +303,24 @@ authority. Never invent authorization, impersonate Operator, or modify the core
 
 ## Validate and make the review judgment
 
+Prepare useful evidence, not a documentation gate. Supply or reference the
+effective goals/non-goals and decisions, independently grounded expected
+behavior, key user paths/constraints, contract entry points and relevant callers.
+Keep three things distinct: a behavioral scenario and its expectation, an
+executable test reference, and an actual result with candidate/environment/
+command. Disclose real gaps rather than deriving acceptance from current code.
+
+Small tasks can reference existing materials directly. For complex tasks, put a
+short review index in Task artifacts and its commit-pinned reference in Brief.
+Keep Brief an up-to-date summary, not a copy of documents or accumulated history.
+Review Context carries the frozen Brief and active decisions; inspect the
+actual pointer inventory when a material's delivery is uncertain. Read referenced
+same-Task artifacts at their fixed commits, not HEAD. Do not assume a path in
+`--input`, a WorkItem-only `--context-ref` option, or a summary grants Review
+access. Recover a missing authorized reference through existing mechanisms;
+do not ask the Reviewer to bypass scope. Materials guide independent inspection,
+not its upper bound.
+
 Use the smallest evidence that establishes the accepted behavior and material
 boundaries. Do not repeat a successful unchanged check. Run the Project's
 complete local delivery validation once on the final candidate when its Policy
@@ -328,6 +346,10 @@ Use one direct main Reviewer by default. If independent replicas materially
 improve evidence, read [replicated execution](replicated-execution.md)
 before dispatch or synthesis. Honor required review contracts even when a
 cheaper execution path is otherwise available.
+One Reviewer should use the applicable complementary perspectives in one round.
+Consider independent replication for genuinely complementary cross-system risks,
+not a fixed headcount or file/frontend/backend partition. Keep the same candidate
+and common requirements; risk emphasis must not hide cross-layer contracts.
 
 When several WorkItems contribute to one outcome, prefer one independent
 Task-final Review after their accepted results are integrated over repeating a
@@ -358,6 +380,13 @@ main synthesis through its exact AgentRun, preserving its selected source snapsh
 A Worker or Reviewer AgentRun result is evidence, not acceptance. Inspect the
 result, diff, checks, and current Candidate before deciding.
 
+Group confirmed findings by root cause and repair other reachable instances
+within scope together. For ordinary full re-review, preserve the current complete
+candidate and requirements; add repair delta, prior finding dispositions and
+still-valid evidence. Delta is an attention aid, not the full-review boundary.
+Do not conflate this with an explicitly authorized equivalence Delta Recheck.
+Neither finding counts, fixed round counts nor a majority vote decides acceptance.
+
 If a result is insufficient, reject it with bounded feedback and redispatch
 the same WorkItem and Role while scope remains valid. Before accepting isolated
 Git changes, read [Integration](integration.md) to capture and

package/skills/yui-leader/references/replicated-execution.md

@@ -31,6 +31,9 @@ Retry main synthesis through its exact AgentRun, preserving the source snapshot.
 
 A Producer independently inspects or implements its exact frozen Assignment
 in the supplied Lane workspace and returns one complete original result.
+For Review, give Producers common requirements/contracts and the same candidate.
+Different risk emphases are not file ownership or permission to omit cross-layer
+interactions. Form independent initial results before reading sibling conclusions.
 Its evidence does not authorize a Candidate, ChangeSet, Integration or
 acceptance decision outside the assigned protocol.
 
@@ -40,3 +43,7 @@ judgment, and returns one authoritative report. Do not mutate source results,
 omit selected evidence, rerun Producers, or substitute a winning Lane for
 synthesis. A Review report remains evidence for Task acceptance, not acceptance
 itself.
+Deduplicate by root cause while retaining distinct triggers, coverage and
+unexamined risks. Explain disagreements and unresolved evidence; do not discard
+a valid minority finding or substitute voting for checking its contract and
+reachability.

package/skills/yui-operator/SKILL.md

@@ -5,7 +5,8 @@ description: Route requests and follow-up delivery through the owning Task Leade
 
 # Yui Operator
 
-Follow [yui-runtime](../yui-runtime/SKILL.md) for the Session's authorized entry. A global Operator reads
+Follow [yui-runtime](../yui-runtime/SKILL.md) for the Session's authorized entry,
+per-turn version/availability check and conditional full reload. A global Operator reads
 its Global Context without inventing a Task AgentRun. For explicit Task dispatch,
 load the exact Run Context Pack and preserve its scope and permission boundaries.
 
@@ -160,7 +161,9 @@ does not establish remote merge.
 For an explicitly requested continuation of a completed, unarchived result,
 use the existing `task reopen` then durable submission path. The user's request
 authorizes the necessary reopening within that scope; do not demand that they
-also say “reopen.” Ordinary messages do not auto-reopen a Task. Keep cancelled,
+also say “reopen.” A current matching Leader may also reopen its own Task and
+continue an already-received authorized request; Operator routing is not a
+mandatory handoff. Ordinary messages do not auto-reopen a Task. Keep cancelled,
 archived and independently stopped execution boundaries separate, and do not
 use Session recovery to bypass them.
 
@@ -230,13 +233,22 @@ a dormant Role and verify the complete binding before the next launch.
 
 ## Present current progress
 
+Apply **yui-runtime**'s own-inbox flow at useful routing boundaries and before
+handoff. `yui inbox list/show/claim/ack` processes Operator input in this turn;
+do not wait for another wake or copy pending notices into new input. Read every
+relevant original and finish the authorized routing/disposition before ack.
+
 Use JSON reads and their top-level `data` field.
-Use Global Context's `pending`/`recent` pages to find Messages, then
+Use Global Context's bounded `pending` page to find Messages, then
 `role message show operator <id>` for the original. A successful send receipt
 contains saved identity and delivery/control facts, not another copy of the
 submitted body. Follow Runtime's bounded-read contract for list continuations
 and long `contentPage` details; do not decode `output` as nested JSON or print
 an entire Context again merely to extract one already-returned reference.
+History and diagnostic aggregates are explicit `role message list` reads.
+Use `--diagnostics` for classified occurrence counts and `--diagnostic <key>`
+for evidence discovery within the caller's authorized Role scope. Do not
+automatically traverse all history or ask a failing Operator to wake itself.
 
 Report the facts needed to understand the outcome:
 

package/skills/yui-operator/VERSION

@@ -0,0 +1 @@
+3

package/skills/yui-operator/references/task-delivery.md

@@ -39,6 +39,8 @@ Separate lifecycle, execution gate and Session authority:
   necessary `task reopen` before submitting that bounded request. Follow the
   [authorized two-step path](../../yui-runtime/references/publication.md#post-completion-routing-boundary);
   do not require a second mechanical “reopen” confirmation.
+  The current matching Leader may perform that reopen itself and continue
+  an already-received request; it need not send the work back to Operator.
 - Cancelled/retired intent is not active work. An archived Task cannot be reopened;
   retained workspaces and historical Sessions do not authorize execution.
 - Session loss or replacement is not a new result or an automatic lifecycle