@zq-silk/yui 2.7.1 → 2.8.1

package/dist/web/assets/styles/views/models.js

@@ -0,0 +1,129 @@
+import { BREAKPOINTS } from "../../shared/geometry.js";
+/*
+ * MODELS VIEW — the content of the /models sections. The rail, reading column
+ * and section headings come from views/manage; cards, badges, chips,
+ * segmented controls and fields from the shared ui stylesheets. These rules
+ * add the provider table, the catalog list and the quota meters. On phones
+ * the provider table becomes stacked rows.
+ */
+export const MODELS_STYLES = `
+/* Heading first, as on every management page: the page scope and the shared
+   connection status sit under the current section's heading. The wrappers
+   flatten into one column so only order changes, never the DOM. */
+.models-body .manage-main{display:flex;flex-direction:column;gap:14px}
+.models-body .models-root,.models-body .models-section:not([hidden]){display:contents}
+.models-body .manage-main>*,.models-root>*,.models-section>*{width:100%;max-width:1120px;margin-left:auto;margin-right:auto}
+.models-section>.manage-head{order:-1}
+.models-body .manage-scope{margin-bottom:0}
+.models-root .seg-btn[aria-pressed="true"]{background:var(--surface-2);color:var(--ink);box-shadow:var(--shadow-1),0 0 0 1px var(--line-2)}
+.models-root{display:grid;gap:16px;min-width:0}
+.models-section p:not(.kicker){color:var(--ink-2);font-size:var(--fs-sm);line-height:1.55;overflow-wrap:anywhere}
+.models-section .manage-heading p:not(.kicker){color:var(--ink-3)}
+.models-card{overflow:hidden}
+.models-card>.card-body{gap:12px}
+.models-status{display:grid;gap:8px;min-width:0}
+.models-status:empty{display:none}
+.models-facts{display:flex;flex-wrap:wrap;gap:6px 8px;align-items:center;min-width:0}
+.models-facts small{overflow-wrap:anywhere}
+.models-facts .badge[hidden]{display:none}
+.models-notice{flex:1 1 280px;min-width:0}
+.models-alert{display:flex;flex-wrap:wrap;align-items:center;gap:8px 12px;padding:10px 14px;border:1px solid var(--bad-soft);border-radius:var(--r-md);background:var(--bad-soft)}
+.models-alert>.icon{width:16px;height:16px;color:var(--bad);flex:none}
+.models-alert p{flex:1 1 240px;min-width:0}
+.models-note{display:flex;flex-wrap:wrap;align-items:center;gap:6px;padding:9px 12px;border:1px solid var(--line);border-radius:var(--r-md);background:var(--surface-2)}
+.models-note>.icon{width:15px;height:15px;color:var(--info);flex:none}
+.models-empty{color:var(--ink-3)!important;font-size:var(--fs-sm)}
+.models-count{color:var(--ink-4);font-size:var(--fs-xs)!important;font-variant-numeric:tabular-nums}
+.models-receipt{white-space:pre-wrap;overflow-wrap:anywhere}
+.models-receipt-group .settings-actions{margin-top:8px}
+
+/* Toolbars: search plus segmented filters */
+.models-toolbar{display:flex;flex-wrap:wrap;align-items:center;gap:8px 10px;padding:12px 16px;border-bottom:1px solid var(--line);min-width:0}
+.models-toolbar-flat{padding:0;border:0}
+.models-toolbar .seg{flex-wrap:wrap}
+.models-search{position:relative;display:flex;align-items:center;flex:1 1 240px;min-width:0;max-width:420px}
+.models-search>.icon{position:absolute;left:10px;width:15px;height:15px;color:var(--ink-4);pointer-events:none}
+.models-search input{width:100%;height:32px;padding:0 10px 0 32px;border-radius:var(--r-md);background:var(--surface-2)}
+.models-results{display:grid;gap:0;min-width:0}
+.models-results>.models-count{padding:8px 16px 0}
+.models-results>.models-empty{padding:12px 16px 16px}
+.models-catalog-results>.models-count{padding:0 0 8px}
+.models-catalog-results>.models-empty{padding:0}
+
+/* Provider table */
+.models-table-wrap{min-width:0;overflow-x:auto}
+.models-table{width:100%;border-collapse:collapse;font-size:var(--fs-sm)}
+.models-table th{padding:10px 12px;color:var(--ink-4);font-size:var(--fs-2xs);font-weight:600;letter-spacing:.04em;text-align:left;text-transform:uppercase;border-bottom:1px solid var(--line);white-space:nowrap}
+.models-table td{padding:11px 12px;border-bottom:1px solid var(--line);vertical-align:top;min-width:0}
+.models-table tr:last-child td{border-bottom:0}
+.models-table th:first-child,.models-table td:first-child{padding-left:16px}
+.models-table th:last-child,.models-table td:last-child{padding-right:16px}
+.models-table tbody tr:hover{background:var(--surface-2)}
+.models-table tbody tr[aria-current="true"]{background:var(--accent-soft);box-shadow:inset 3px 0 0 var(--accent)}
+.models-cell-main{display:grid;gap:3px;justify-items:start;min-width:0}
+.models-cell-main strong{font-weight:600;color:var(--ink);overflow-wrap:anywhere}
+.models-cell-main code{white-space:normal;overflow-wrap:anywhere}
+.models-url{display:block;max-width:280px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--ink-2)}
+.models-row-actions{display:flex;flex-wrap:wrap;align-items:center;justify-content:flex-end;gap:6px;min-width:0}
+.models-row-actions .btn{height:28px;padding:0 10px;font-size:var(--fs-xs)}
+.models-reason{flex-basis:100%;max-width:260px;text-align:right;line-height:1.4;overflow-wrap:anywhere}
+.models-danger{color:var(--bad)}
+.models-danger:hover:not(:disabled){color:var(--bad);background:var(--bad-soft)}
+
+/* Provider editor */
+.models-editor{border-color:var(--accent-line)}
+.models-form-head{display:flex;flex-wrap:wrap;align-items:center;gap:8px 10px;min-width:0}
+.models-form-head h2{font-size:var(--fs-md);font-weight:600;overflow-wrap:anywhere;min-width:0}
+.models-provider-form .settings-grid{gap:14px 20px;align-items:start}
+.models-provider-form input:not([type=checkbox]),.models-provider-form select,.models-connection-form input{width:100%;min-width:0}
+.models-provider-form .settings-actions{margin-top:4px}
+
+/* Connection settings */
+.models-connection-form{display:grid;gap:16px;min-width:0}
+.models-connection-form{grid-template-columns:repeat(2,minmax(0,1fr))}
+.models-connection-form>.settings-actions,.models-connection-form>.receipt,.models-connection-form>.models-receipt-group{grid-column:1/-1;margin-top:0}
+.models-fieldset{display:grid;align-content:start;gap:14px;min-width:0;margin:0;padding:0;border:0}
+.models-fieldset legend{margin-bottom:12px;padding:0;color:var(--ink);font-size:var(--fs-sm);font-weight:600}
+.models-explain h2{font-size:var(--fs-sm);font-weight:600}
+
+/* Catalog */
+.models-catalog{list-style:none;margin:0;padding:0;display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:0 20px;min-width:0}
+.models-catalog-item{display:flex;align-items:center;justify-content:space-between;gap:10px;min-width:0;padding:7px 2px;border-bottom:1px solid var(--line)}
+.models-catalog-item code{font-family:var(--font-mono);font-size:var(--fs-xs);color:var(--ink);overflow-wrap:anywhere;min-width:0}
+
+/* Quota accounts, groups and meters */
+.models-accounts{list-style:none;margin:0 auto;padding:0;display:grid;gap:14px;min-width:0}
+.models-account .card-title>span:first-child{font-family:var(--font-mono);font-size:var(--fs-sm)}
+.models-groups{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:18px 28px;min-width:0}
+.models-group{display:grid;align-content:start;gap:10px;min-width:0}
+.models-group h3{font-size:var(--fs-sm);font-weight:600;color:var(--ink)}
+.models-windows{list-style:none;margin:0;padding:0;display:grid;gap:12px;min-width:0}
+.models-window{display:grid;gap:5px;min-width:0}
+.models-window-line{display:flex;justify-content:space-between;gap:12px;font-size:var(--fs-sm);min-width:0}
+.models-window-name{color:var(--ink-2);overflow-wrap:anywhere;min-width:0}
+.models-window-value{color:var(--ink);font-weight:500;font-variant-numeric:tabular-nums;white-space:nowrap}
+.models-meter{position:relative;height:6px;border-radius:var(--r-pill);background:var(--surface-3);overflow:hidden}
+.models-meter>span{position:absolute;inset:0 auto 0 0;border-radius:inherit;background:var(--tone)}
+.models-meter.is-unknown{background:repeating-linear-gradient(90deg,var(--surface-3) 0 6px,transparent 6px 10px)}
+.models-window small{font-size:var(--fs-xs);overflow-wrap:anywhere}
+.models-balances{display:flex;flex-wrap:wrap;gap:8px 28px;margin:0;padding-top:12px;border-top:1px solid var(--line);font-size:var(--fs-sm)}
+.models-balances div{display:grid;gap:2px;min-width:0}
+.models-balances dt{color:var(--ink-3);font-size:var(--fs-xs)}
+.models-balances dd{margin:0;color:var(--ink);font-weight:500;font-variant-numeric:tabular-nums}
+
+@media(max-width:${BREAKPOINTS.small}px){
+  .models-connection-form{grid-template-columns:minmax(0,1fr)}
+  .models-provider-form .settings-grid{grid-template-columns:minmax(0,1fr)}
+  .models-search{max-width:none;flex-basis:100%}
+  .models-table thead{position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0)}
+  .models-table,.models-table tbody,.models-table tr,.models-table td{display:block;width:100%}
+  .models-table tr{padding:10px 14px;border-bottom:1px solid var(--line)}
+  .models-table tr:last-child{border-bottom:0}
+  .models-table td{display:grid;grid-template-columns:84px minmax(0,1fr);gap:8px;align-items:start;padding:4px 0!important;border:0}
+  .models-table td::before{content:attr(data-label);color:var(--ink-4);font-size:var(--fs-2xs);font-weight:600;letter-spacing:.04em;text-transform:uppercase;padding-top:3px}
+  .models-url{max-width:none;white-space:normal;overflow-wrap:anywhere}
+  .models-row-actions{justify-content:flex-start}
+  .models-reason{text-align:left;max-width:none}
+  .models-catalog{grid-template-columns:minmax(0,1fr)}
+}
+`;

package/dist/web/assets/styles/views/settings.js

@@ -1,26 +1,40 @@
+import { BREAKPOINTS } from "../../shared/geometry.js";
+/*
+ * SETTINGS VIEW — the content of the /settings sections (preferences, Skills,
+ * Agents & server). The rail, reading column and section headings come from
+ * views/manage. Settings panels share the card surface of the model pages:
+ * the same border, radius, padding and title scale; nested panels (a Skill in
+ * the catalog) sit one surface step lower instead of nesting full cards.
+ */
 export const SETTINGS_STYLES = `
-.settings-body{display:block;overflow:auto;height:auto;min-height:100dvh}
-.settings-page{max-width:1040px;margin:auto;padding:32px 24px 80px;display:grid;gap:22px}
-.settings-page p{color:var(--ink-2);font-size:var(--fs-sm);line-height:1.6;overflow-wrap:anywhere}
-.settings-header{display:flex;gap:20px;align-items:center}
-.settings-card{padding:22px;border:1px solid var(--line-2);border-radius:var(--r-lg);background:var(--surface);min-width:0}
-.settings-card>summary{font-size:var(--fs-md);font-weight:600;cursor:pointer}
-.settings-card h2{font-size:var(--fs-md);margin-bottom:16px}
-.settings-card[open]>summary{margin-bottom:16px}
+.settings-card{display:block;padding:16px;border:1px solid var(--line);border-radius:var(--r-lg);background:var(--surface);min-width:0}
+.settings-card .settings-card{padding:14px;background:var(--surface-2)}
+.settings-card>summary{display:flex;align-items:center;gap:8px;min-height:24px;font-size:var(--fs-md);font-weight:600;color:var(--ink);cursor:pointer;overflow-wrap:anywhere}
+.settings-card h2{font-size:var(--fs-md);font-weight:600;color:var(--ink);margin-bottom:14px}
+.settings-card h3{font-size:var(--fs-sm);font-weight:600;color:var(--ink);overflow-wrap:anywhere}
+.settings-card[open]>summary{margin-bottom:14px;padding-bottom:12px;border-bottom:1px solid var(--line)}
+.manage-section[data-section] .settings-card p,.settings-stack>p{color:var(--ink-2);font-size:var(--fs-sm);line-height:1.6;overflow-wrap:anywhere}
 .settings-stack{display:grid;gap:16px;min-width:0}
-.settings-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:24px}
+.settings-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:20px 24px;min-width:0}
 .settings-field{padding:14px 0;border-bottom:1px solid var(--line);display:grid;gap:8px;min-width:0}
 .settings-field small{color:var(--ink-3);overflow-wrap:anywhere}
 .settings-field small:empty,.settings-field .settings-actions:empty{display:none}
 .settings-field textarea{width:100%;min-height:88px;resize:vertical}
 .settings-field input,.settings-field select{width:100%;min-width:0}
 .settings-field .settings-reset{display:flex;gap:8px;align-items:center;font-size:var(--fs-xs)}
-.settings-reset input{width:auto}
-.settings-actions{display:flex;gap:10px;flex-wrap:wrap;margin-top:16px;align-items:center}
+.settings-reset{display:flex;gap:8px;align-items:center;font-size:var(--fs-sm);color:var(--ink-2)}
+.settings-reset input{width:auto;flex:none}
+.settings-actions{display:flex;gap:10px;flex-wrap:wrap;margin-top:16px;align-items:center;min-width:0}
+.settings-actions code{overflow-wrap:anywhere;min-width:0}
 .settings-receipt{white-space:pre-wrap;overflow-wrap:anywhere}
 .settings-error{color:var(--bad)!important}
 .settings-observation{max-height:260px;overflow:auto;white-space:pre-wrap;overflow-wrap:anywhere;font-size:var(--fs-xs)}
-.settings-search{position:sticky;top:0;background:var(--canvas);padding:12px 0;z-index:1}
-.settings-page input[type=checkbox]{width:16px;height:16px;padding:0;accent-color:var(--accent)}
-@media(max-width:640px){.settings-page{padding:18px 12px 48px}.settings-grid{grid-template-columns:1fr}.settings-card{padding:16px}}
+.settings-search{position:sticky;top:0;z-index:1;padding:10px 0;background:var(--canvas)}
+.settings-search input{width:100%;max-width:520px}
+#settings-status:empty,#browser-receipt:empty{display:none}
+.mono-line{overflow-wrap:anywhere}
+@media(max-width:${BREAKPOINTS.small}px){
+  .settings-grid{grid-template-columns:minmax(0,1fr)}
+  .settings-card{padding:14px}
+}
 `;

package/dist/web/assets/styles/views/sidebar.js

@@ -71,4 +71,5 @@ export const SIDEBAR_STYLES = `
 .foot-btn[aria-pressed="true"]{color:var(--accent);border-color:var(--accent-line);background:var(--accent-soft)}
 .foot-btn kbd{margin-left:2px}
 .side-foot .icon-btn{margin-left:auto}
+.side-foot .icon-btn+.icon-btn{margin-left:0}
 `;

package/dist/web/webServer.js

@@ -7,9 +7,9 @@ import { parseTaskSearchOptions, searchTaskBodies } from "../context/taskSearch.
 import { readTaskUsage } from "../runtime/taskUsageQuery.js";
 import { readWebTaskActivity } from "./webTaskActivity.js";
 import { WebRequestRejected } from "./webMutation.js";
-import { SETTINGS_HTML } from "./assets/shell/settings.js";
+import { MODELS_HTML } from "./assets/shell/models.js";
 import { TASK_SUBMISSION_INTENTS } from "../message/message.js";
-import { DASHBOARD_HTML, findWebAsset } from "./assets/assetManifest.js";
+import { DASHBOARD_HTML, findWebAsset, prepareWebDocument, WEB_ASSET_VERSION } from "./assets/assetManifest.js";
 import { buildWebTaskCatalog, buildWebPageSessions, buildWebTaskDetail } from "./webSnapshot.js";
 const MAX_JSON_BODY_BYTES = 16 * 1024;
 const MAX_TERMINAL_MESSAGE_BYTES = 64 * 1024;
@@ -204,6 +204,54 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         }
         return;
     }
+    if (pathname === "/api/models" || pathname.startsWith("/api/models/")) {
+        try {
+            const service = dependencies.models;
+            if (!service)
+                throw new WebRequestRejected("Model management unavailable.");
+            const query = new URL(request.url, "http://localhost").searchParams;
+            if ([...query.keys()].some(k => !["cursor", "source"].includes(k) || query.getAll(k).length !== 1)) {
+                throw new WebRequestRejected("Unknown Model query.");
+            }
+            let value;
+            if (method === "GET" && pathname === "/api/models")
+                value = service.read();
+            else if (method === "GET" && pathname === "/api/models/catalog")
+                value = service.readCatalog(query.get("cursor") ?? "0");
+            else if (method === "GET" && pathname === "/api/models/quota")
+                value = service.readQuota(query.get("source") ?? "factory");
+            else if (method === "POST") {
+                // Credential-bearing forms require an exact same-origin browser request.
+                if (headerValue(request, "origin") !== `http://${headerValue(request, "host")}`) {
+                    throw new WebRequestRejected("Model changes require a same-origin request.");
+                }
+                if (headerValue(request, "content-type")?.split(";")[0]?.trim() !== "application/json") {
+                    throw new WebRequestRejected("Model changes require JSON.");
+                }
+                const body = await readMutationBody(request);
+                if (pathname === "/api/models/connection")
+                    value = service.saveConnection(body);
+                else if (pathname === "/api/models/provider")
+                    value = service.saveProvider(body);
+                else if (pathname === "/api/models/refresh")
+                    value = await service.refresh(body);
+                else
+                    throw new WebRequestRejected("Unknown Model operation.");
+            }
+            else {
+                sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, false);
+                return;
+            }
+            sendJson(response, 200, value, false);
+        }
+        catch (error) {
+            sendJson(response, 409, {
+                error: error instanceof WebRequestRejected ? error.message : "Model operation failed. Inspect the current state before retrying.",
+                disposition: method === "GET" || error instanceof WebRequestRejected ? "not-submitted" : "unknown"
+            }, false);
+        }
+        return;
+    }
     if (pathname === "/api/settings" || pathname === "/api/settings/group" || pathname === "/api/settings/capabilities") {
         try {
             if (!dependencies.settings)
@@ -529,12 +577,14 @@ async function handleHttpRequest(request, response, store, dependencies, token,
     }
     if (method === "GET" || method === "HEAD") {
         try {
-            const asset = findWebAsset(pathname);
-            if (pathname === "/" || pathname === "/index.html" || pathname === "/settings") {
-                sendText(response, 200, "text/html; charset=utf-8", pathname === "/settings" ? SETTINGS_HTML.replace("__YUI_WEB_TOKEN__", token) : dashboardHtml(token), method === "HEAD");
+            const assetVersion = new URL(request.url, "http://localhost").searchParams.get("v");
+            const asset = findWebAsset(pathname, assetVersion);
+            const managementPage = /^\/(?:models(?:\/(?:providers|catalog|quota))?|settings(?:\/(?:preferences|skills|server|connection))?)\/?$/.test(pathname);
+            if (pathname === "/" || pathname === "/index.html" || managementPage) {
+                sendText(response, 200, "text/html; charset=utf-8", prepareWebDocument(managementPage ? MODELS_HTML.replace("__YUI_WEB_TOKEN__", token) : dashboardHtml(token), managementPage ? "/assets/js/app/manage.js" : "/assets/app.js"), method === "HEAD");
             }
             else if (asset !== null) {
-                sendAsset(response, asset, method === "HEAD");
+                sendAsset(response, asset, method === "HEAD", assetVersion === WEB_ASSET_VERSION);
             }
             else if (pathname === "/api/search") {
                 const query = new URL(request.url, "http://localhost").searchParams;
@@ -960,12 +1010,12 @@ function sendText(response, status, contentType, body, head) {
     response.setHeader("content-length", Buffer.byteLength(body));
     response.end(head ? undefined : body);
 }
-function sendAsset(response, asset, head) {
+function sendAsset(response, asset, head, versioned = false) {
     const payload = asset.encoding === "base64"
         ? Buffer.from(asset.body, "base64")
         : Buffer.from(asset.body, "utf-8");
-    if (asset.contentType.startsWith("font/") || asset.contentType.startsWith("image/")) {
-        response.setHeader("cache-control", "public, max-age=31536000, immutable");
+    if (versioned) {
+        response.setHeader("cache-control", "private, max-age=31536000, immutable");
     }
     response.statusCode = 200;
     response.setHeader("content-type", asset.contentType);

package/docs/cli-information-contract.md

@@ -14,14 +14,15 @@ schema migration or new snapshot/cache store is introduced.
 | Question | Entry | Default information / further reading |
 | --- | --- | --- |
 | Which Task? | `task list` | Existing bounded catalog, filters, attention and cursor |
-| What is current? | `task context <task>` | Current Task/Brief/Role/Project/workspace facts, active work and Runs, open inputs, active decisions, unresolved jobs, recent Message references; no event or terminal-Run dump |
+| What is current? | `task context <task>` | Current facts, active work, open inputs, active decisions, unresolved jobs and unacknowledged Message references; no event or terminal-Run dump |
 | What records exist? | `task context list <task> --store <family>` | One authorized family, summaries and exact digest-bearing references |
 | What does it actually say? | `task context inspect <task> --store <family> --ref <id> --digest <digest>` | Exact current record, including original result expansion; long documents are paged |
 | What changed? | `task context delta <task> --after <cursor>` | Immutable events with a fixed upper bound, not a snapshot of current mutable state |
-| Which Global input? | `session context <role>` | Identity, profile, authority, current native Turn/retry and separate bounded pending/recent Message pages |
+| Which Global input? | `session context <role>` | Identity, Profile read pointer, authority, current native Turn/retry facts and a bounded pending Message page; history is opt-in |
 | Read Global input | `role message list <role> [--pending]`, `role message show <role> <id>` | Scoped discovery, then exact original; queue acceptance never erases history |
 | What arrived in this wake? | `task wake show <task> <wake>` | Fixed-window inputs/results, attributed optional summaries and exact original reads; `--history` expands diagnostics |
-| What was assigned? | `task run context <task>/<run>` | Frozen authority and a single `pointers` inventory with summaries; changed identities in `deltaRefs`; current observations remain separate |
+| What was assigned? | `task run context <task>/<run>` | Frozen authority, up to 16 `pointers`, sampled changed identities and live observations with totals; `--view refs` pages references, `--view full` reads the full pack |
+| Which repeated failure? | `role message list <role> --diagnostics` | Derived classified groups with count, first/latest and recovery evidence; `--diagnostic <key>` pages original occurrences |
 | Which configuration is real? | `task role session inspect <task> <role>` | Task/Role identity, desired binding, frozen Session, current Provider binding, retry and explicit Host observation; no full Task/Role copies or Provider conversation history |
 
 Domain lists for Task Messages, events, WorkItems, Runs, decisions, milestones,
@@ -35,23 +36,35 @@ workspaces and other authorized record families. `--status`, `--after` and
 `--work-item` narrow Context discovery; every continuation must retain filters.
 Run listing accepts a Task or `task/work` target.
 
-Current Context's `attention.messages` counts all authorized Messages, not only
-undelivered input. `collections` counts and `omitted` explicitly describe
-incomplete discovery. Recent samples are not proof that no older pending or
+Current Context's `attention.messages` excludes explicit acknowledgements and
+retirements; delivery alone is not handling. The exact wake receipt and latest
+Message revision determine coverage. `--view current` continues that view;
+the default family list still includes history. `collections` counts and `omitted`
+explicitly describe incomplete discovery. Samples are not proof that no older pending or
 relevant input exists. Read the relevant fixed wake and original Messages;
 use family discovery when a broader requirement/history audit is needed.
 
 ## Budgets and continuations
 
-- Discovery pages default to 20 items, accept 1–100, and reserve a 32 KiB
-  compact-JSON budget. Items contain summaries, never full Message/report bodies.
+- Discovery pages default to 20 items, accept 1–100, and enforce a 32 KiB
+  compact-JSON budget including the success envelope, escaped identities,
+  continuation and nested structure. Summaries are at most 512 UTF-8 bytes.
 - Current Task Context has at most 64 records, with a 24 KiB record/attention
   budget inside a 32 KiB response budget. Single inline values are at most
   2 KiB; large values and Message/Run/WorkItem/Knowledge bodies use references.
   Each collection contributes at most eight sampled records at entry.
-- Global entry samples up to eight pending and eight recent Messages separately.
-  They have independent continuations, so a long historical list cannot crowd
-  pending input out of the entry view.
+- Global entry samples up to eight unacknowledged inputs, including claimed or
+  uncertain ones. It does not repeat recent history, Profile bodies, frozen Skill
+  packages or accumulated retry details. The Manifest is the Profile pointer;
+  explicit Message and Session retry reads retain history and original evidence.
+- Run entry samples up to eight records per live category and 16 frozen refs.
+  Pointer continuation uses `--view refs` and `pointerPage.nextCursor`; full pack
+  document continuation uses `--view full`. Neither changes the frozen authority.
+  Read `--view input` before acting when `input.directiveOmitted` is true: the
+  entry's bounded directive summary is not the assigned instruction body.
+- `session skills [--cursor ...]` checks only current metadata/readability. It
+  does not read Skill bodies or historical packages, and uses document pagination
+  only when the configured metadata exceeds the inline budget.
 - Detail documents up to 16 KiB remain ordinary JSON. Larger documents return
   `contentPage`: exact source, SHA-256 digest, JSON-character offset, total bytes
   and characters, text, completeness and a next cursor. Chunks contain at most
@@ -78,6 +91,24 @@ concurrent writes. For append-only event traversal use fixed-bound Context delta
 Discovery currently scans the selected authorized family to fingerprint it;
 its output, not total storage-reading cost, is bounded.
 
+## Runtime diagnostics
+
+Global failure evidence remains ordinary record-only Messages; no aggregate
+table, Message envelope change, memory store or recovery state machine is added.
+Grouping is a derived view of new evidence documents. Older documents remain
+readable in ordinary history, not heuristically reclassified. Classified source,
+Host/Session, error category/code and explicit effect distinctions determine
+equivalence; unclassified faults are not merged. Original affected IDs and raw
+evidence remain in exact documents, never a growing array in one notification.
+Counts represent distinct observations, not repeat polls of the same identity.
+
+One queued notice represents an unchanged failure episode. Only a new group,
+changed impact or exact successful recovery observation produces a new notice.
+Recovery ends the corresponding episode without acknowledging inputs or proving
+absence of previous effects. Recurrence after recovery gets a new episode.
+Operator's own failures/recovery notices are retained without self-delivery.
+Discovery and every evidence page retain the existing Role read boundary.
+
 ## Effects and exceptions
 
 Message send/queue/steer receipts preserve identity, digest, body byte count and

package/docs/cli-information-contract.zh-CN.md

@@ -12,14 +12,14 @@ CLI 调用成功，不代表 Task、原生 Turn 或远端投递完成。
 | 问题 | 入口 | 默认信息与下一步 |
 | --- | --- | --- |
 | 找哪个 Task？ | `task list` | 既有有界目录、过滤器、attention 与游标 |
-| 当前有什么？ | `task context <task>` | 当前 Task/Brief/Role/Project/工作区事实、活跃工作与 Run、开放输入、有效决策、未解决 Job、近期 Message 引用；不倾倒事件或终态 Run |
+| 当前有什么？ | `task context <task>` | 当前事实、活跃工作、开放输入、有效决策、未解决 Job、未确认处理的 Message 引用；不倾倒事件或终态 Run |
 | 有哪些记录？ | `task context list <task> --store <family>` | 一种获授权的记录、摘要与带 digest 的确切引用 |
 | 原文是什么？ | `task context inspect <task> --store <family> --ref <id> --digest <digest>` | 确切当前记录，含原始结果展开；长文档分页 |
 | 发生了什么变化？ | `task context delta <task> --after <cursor>` | 固定上界内的不可变事件，不是可变当前状态的快照 |
-| Global 收到了什么？ | `session context <role>` | 身份、Profile、权限、当前原生 Turn/retry，以及分别有界的 pending/recent Message 页 |
+| Global 收到了什么？ | `session context <role>` | 身份、Profile 读取指针、权限、当前 Turn/retry 事实与小窗口 pending 页；历史按需读取 |
 | 读取 Global 输入 | `role message list <role> [--pending]`、`role message show <role> <id>` | 在自身范围内发现，再读完整原文；队列接受不删除历史 |
 | 本次唤醒带来什么？ | `task wake show <task> <wake>` | 固定窗口的输入/结果、标明来源的可选摘要和确切原文入口；`--history` 展开诊断历史 |
-| 分配了什么？ | `task run context <task>/<run>` | 冻结授权与一份带摘要的 `pointers` 目录；`deltaRefs` 表示变化身份；当前观察独立 |
+| 分配了什么？ | `task run context <task>/<run>` | 冻结授权与有限 `pointers` 窗口，变化身份和活跃观察附总数；`--view refs/full` 按需扩展 |
 | 实际配置是什么？ | `task role session inspect <task> <role>` | Task/Role 身份、期望绑定、冻结 Session、当前 Provider 绑定、retry 与显式 Host 观察；不复制整个 Task/Role 或 Provider 会话历史 |
 
 Task Message、事件、WorkItem、Run、决策、里程碑、publication 和 InputRequest 列表
@@ -31,17 +31,26 @@ Context 列表还暴露候选、Review、Job、Project Knowledge、工作区等
 `--status`、`--after`、`--work-item` 缩小发现范围；续读必须保留过滤条件。
 Run 列表接受 Task 或 `task/work` 目标。
 
-当前 Context 的 `attention.messages` 统计全部获授权 Message，不仅是未投递输入。
-`collections` 计数与 `omitted` 明确表达发现不完整。近期抽样不能证明没有更早的待处理
+当前 Context 的 `attention.messages` 排除明确 ack 或退役的 Message；投递成功不代表
+处理完成。精确 wake 回执必须覆盖最新原文版本。用 `--view current` 续读当前视图，
+默认分类列表仍保留完整历史。`collections` 计数与 `omitted` 明确表达发现不完整。抽样不能证明没有更早的待处理
 或相关输入。读取相关固定 wake 与原始 Message；更广的需求/历史审计使用分类发现。
 
 ## 预算与续读
 
-- 发现页默认 20 条，可选 1–100，紧凑 JSON 预算 32 KiB。条目包含摘要，不含完整报告正文。
+- 发现页默认 20 条，可选 1–100，紧凑 JSON 预算 32 KiB，计入成功 envelope、
+  转义身份、游标和嵌套结构。摘要至多 512 UTF-8 字节，不含完整报告正文。
 - 当前 Task Context 至多 64 条，记录与 attention 共 24 KiB，响应预算 32 KiB。
   单个内联值至多 2 KiB；大值及 Message/Run/WorkItem/Knowledge 正文用引用。
   入口每个集合最多抽样八条。
-- Global 入口分别抽样八条 pending 与八条 recent；独立续读，历史不能挤掉待处理输入。
+- Global 入口最多八条未确认处理的输入，保留已领取或效果未知项；不重复 recent、
+  Profile 正文、历史 Skill 包和累计 retry 详情。Profile 由 Manifest 精确指向。
+- Run 入口最多 16 个冻结引用和每类八条活跃观察，附总数。`--view refs` 配合
+  `pointerPage.nextCursor` 发现更多引用；`--view full` 显式读取完整冻结包。
+  若 `input.directiveOmitted` 为 true，行动前用 `--view input` 全文读取分配指令；
+  默认入口的指令摘要不是指令正文。
+- `session skills [--cursor ...]` 只检查当前元信息和可读性，不读技能正文；
+  配置元信息过大时使用相同文档分页。
 - 不超过 16 KiB 的详情保持普通 JSON。更大详情返回 `contentPage`：确切来源、
   SHA-256 digest、JSON 字符偏移、总字节数/字符数、文本、完整性与下一游标。
   每块最多 4096 个 UTF-16 单元，不拆代理对，转义后的输出低于 32 KiB。
@@ -61,6 +70,18 @@ Run 列表接受 Task 或 `task/work` 目标。
 追加事件遍历使用固定上界 Context delta。目前分类发现扫描选定的授权集合来计算指纹；
 有界的是输出，不是总存储读取成本。
 
+## 重复运行时诊断
+
+`role message list <role> --diagnostics` 从原始 record-only Message 派生故障组，
+给出首次/最近时间、不同观察的数量及恢复证据；`--diagnostic <key>` 分页发现原文。
+按明确的 Host/Session、来源、故障类别/代码及效果边界区分；未分类错误不猜测合并。
+同一观察重复轮询不新增记录或计数，同组跨 Turn 不重复唤醒。新故障、影响变化、
+精确成功恢复或恢复后再发生可产生通知。Operator 自身诊断保留但不自动唤醒自身。
+恢复不等于消息 ack、Task 完成或撤销旧副作用。
+
+聚合不持久化，也不累计受影响 ID 数组；不增加表、消息 envelope 字段或第二状态机。
+旧证据仍由普通历史读取，不启发式重新分类。每页沿用现有 Role 权限边界。
+
 ## 效果与例外
 
 Message send/queue/steer 回执保留身份、digest、正文字节数及原有提交/投递/control

package/docs/managed-turn-and-session-runtime.md

@@ -39,6 +39,40 @@ automatically create Runs. Explicit dispatch loads one exact Run Context Pack.
 
 ## Context
 
+### Current caller and durable handling
+
+Desktop and TUI use the same current-Session authority. A Desktop command carrying
+only `CODEX_THREAD_ID` resolves its owner from the selected Home's existing active
+Session inventory, then verifies the current Role/Agent binding, revocation and
+captured workspace. Codex's native ID takes precedence over an inherited transport
+ID, so a native child cannot borrow its parent's identity. Unknown native IDs,
+wrong Homes and conflicting hints fail closed; only a terminal with no managed or
+native identity is a plain user. Environment variables and a Manifest locate
+context, not continuing authority. A replaced Session retains only its bounded
+self-diagnostic reads, not inbox or mutation permission.
+
+`yui inbox list` exposes the current identity, delivery evidence, handling state
+and blockers separately. Reads never consume input. Automatically accepted
+Global messages, delivered Leader windows and the current Assignment's
+continuation messages still need `claim` and explicit `ack --reason` after their
+originals and effects have been handled. Claiming delivered input does not resend
+it. Pending/unknown acceptance cannot be taken over; an accepted Global input or
+Leader window can be explicitly settled by its rightful successor without
+changing its original delivery target. Include useful result/effect receipt
+references in the reason. Task completion still requires handling user inputs,
+not merely a native terminal.
+
+Receipts remain on the existing Message/TaskWake records. Both notification
+paths pin mutable Draft revisions by existing `message.updated` event IDs,
+not timestamps; a later revision cannot inherit an old acknowledgement.
+Claimed Message content and fixed window references cannot be silently replaced.
+Duplicate accepted notifications do not re-submit that revision. If a handler
+crashes or ack fails after an external effect, inspect the original claim and
+effect receipt, finish only unfinished work, and retry the same acknowledgement.
+No lease expires and no installation upgrade or context compaction resets
+handling. This reuses storage 1.7 payloads without adding a message system,
+schema transition or an arbitrary external exactly-once guarantee.
+
 ```sh
 yui task context <task> --json
 yui task context list <task> --store <store> [--cursor <cursor>]
@@ -181,12 +215,17 @@ terminal for the exact Session, authority, attempt and native Turn. For a Deskto
 direct Turn, that Host must have retained both the exact start and terminal under
 the unchanged writer fence; `direct:<nativeTurnId>` and the native Turn are both
 required. This bounded latest observation does not make the input client-owned.
+During an Inbox persistence failure, the Host additionally retains every
+unpersisted original fact, including starts and full terminals, until the
+existing Inbox accepts it. Later direct turns must not overwrite those bytes.
 This uses the existing Inbox and canonical observer, including the original result.
 It does not submit input, query another native client, restart a Host, or infer
 quiescence from elapsed time/idle state. Normal terminal processing signals again
 after releasing Host occupancy. Unknown acceptance remains isolated unless exact
 evidence settles that input. Explicit stop/replacement and external writers remain
-hard boundaries.
+hard boundaries. Full Task and Global reconciliation also covers an unsettled
+final input with no queued successor. A filesystem repair retries observations,
+not native execution; process loss before persistence remains a disclosed gap.
 
 `yui session context <role> --json` includes bounded `backlog` diagnostics: pending
 count, oldest timestamp, target and attempt identities, blocking reason and
@@ -211,6 +250,13 @@ that CLI. An Endpoint checkout generation is not a complete Host build identity.
 The runtime-attention evidence distinguishes an unavailable control channel,
 rejected control (including implementations without reconciliation), and a missing
 exact retained terminal, with reported Endpoint/event-delivery observations.
+The status `controlCapabilities` advertisement gates additive v1 commands.
+Missing `reconcile-turn` support yields `unsupported` without sending the
+invalid request. The original Inbox remains usable; no alternative native
+input or guessed terminal is generated. `hostImplementation` identifies code
+captured when the Host loaded, not the current install or Endpoint generation.
+Compatible build changes do not block exact native Session resume after an
+authorized safe release. They never change the user's launch configuration.
 Missing delivery diagnostics mean unreported, not healthy. Unsupported live code
 cannot be repaired by another Controller restart or guessed adoption; inspect the
 original evidence and explicitly authorize any necessary lifecycle recovery.

package/docs/managed-turn-and-session-runtime.zh-CN.md

@@ -2,6 +2,30 @@
 
 # Session、AgentRun 与通知
 
+## 当前身份与持久处理回执
+
+桌面与 TUI 使用相同的当前 Session 授权。只有 `CODEX_THREAD_ID` 的桌面命令
+先在所选 Home 的现有活动 Session 索引中定位角色，再校验当前绑定、撤销状态、
+工作域和 Assignment。Codex 原生线程 ID 优先于继承的 transport ID，原生子
+Agent 不能借用父身份。错误 Home、未知线程和冲突提示会明确拒绝，不降为公共
+用户；只有不带受管或原生身份的终端才是普通用户。环境变量和 Manifest 是
+定位提示，不是持续授权。旧 Session 仅保留限定的自身诊断读取。
+
+`yui inbox list` 分别返回当前身份、投递事实、处理状态和阻断原因。自动接受的
+Global 消息、已投递的 Leader 窗口及当前 Assignment 续接消息仍须显式 claim，
+核对原文和既有副作用，完成处理后再 `ack --reason`。这不会重新投递输入；
+pending/unknown 不能借 claim 接管。合法继任者可以核对并结清已接受的 Global
+输入或 Leader 窗口，保留原投递目标。说明中可引用结果和外部操作回执。
+native terminal 不能替代用户输入处理，也不能单独满足 Task 完成条件。
+
+回执继续保存在现有 Message/TaskWake 中。自动通知和主动领取都以既有
+`message.updated` 事件 ID 绑定可变 Draft 修订，同时间戳的修改也不会沿用旧
+ack。已领取消息的原文和固定窗口引用不能被悄悄替换，重复通知不会重新提交
+已投递修订。处理崩溃或副作用完成后 ack 失败时，先读回 claim 和外部回执，
+只完成未完成工作，再重试相同确认。上下文压缩、Session 续接和升级不清空回执。
+实现复用 storage 1.7 的现有字段，不新增消息系统或 schema 迁移，也不承诺
+任意外部系统的天然 exactly-once。
+
 Global Session 停止／替换与 Task Session 共用精确的原生执行静止确认边界。
 Host 消失或 Session 已入历史不代表已接受输入结束：须先检查并停止保留的
 Provider binding，再结算执行占用。Global 停止证据保存为仅记录的 system Message，
@@ -151,10 +175,18 @@ runtime-attention Message，可通过既有 message list/show 查看，不自动
 
 Controller 重启保留存活 Host，不替换它们已加载的代码。支持当前协议的原 Host 在 Controller
 停机期间仍把原始观察写入不可变 Inbox，重启后由 Controller 按当前 Session 围栏应用。
+Inbox 写入故障时，Host 保留尚未持久化的原始 start 与完整终态，不能被后续直接 Turn
+覆盖；修复后按原始观察顺序补收。Task 与 Global 完整协调也覆盖没有后续输入的最后
+一个未结算 Turn。补收不重执行；落盘前进程丢失仍是明确的恢复缺口。
 冻结 Manifest 的旧 CLI/storage 不匹配是 Context 读取失败，不足以证明 Host 发布失败：
 发布器使用 Inbox/RPC，不执行该 CLI。Endpoint 的 checkout generation 也不是完整 Host
 构建身份。runtime-attention 区分控制通道不可达、控制被拒绝（包括实现不支持协调）和
 精确终态未保留，并附已报告的 Endpoint/eventDelivery 观察；缺少诊断表示未报告，而非健康。
+status 的 `controlCapabilities` 决定可用的 v1 增量命令，未声明 `reconcile-turn` 时
+直接返回 unsupported，不发送已知无效请求，仍可消费原始 Inbox。
+`hostImplementation` 在 Host 加载时捕获，不借磁盘当前安装或 Endpoint generation
+冒充运行代码。兼容构建差异不阻止安全释放后的同一原生 Session 恢复，
+不改变模型、账号、原生权限或工作域。
 再次重启 Controller 或猜测 adoption 不能修复不支持的存活代码；须检查原证据，并为必要的
 生命周期恢复另行取得明确授权。