@zq-silk/yui 2.9.0 → 2.10.0

package/docs/release-workflow.md

@@ -51,6 +51,49 @@ merely to avoid a version decision. Package versions remain distinct from protoc
 and persistent-storage contracts: their compatibility checks and required migrations
 are unchanged, and the storage rules below do not authorize a package release.
 
+### 2.10.0 compatibility and migration notes
+
+This stable minor includes exact-turn inbox handling and successor recovery
+(Task131 / PR #463 and Task134 / PR #464), plus authenticated trusted-LAN Web
+access and current Operator lifecycle controls (Task135 / PR #465).
+It also includes explicit Task Project delivery scope and safe ordinary archive
+(PR #462), and deployment-specific GitLab publication URLs (PR #461).
+
+Web still defaults to loopback. Explicit private/wildcard binding requires
+`--auth-file <absolute-path>` with an owner-only password file; the browser
+username is `yui`. Authentication precedes workbench content, APIs and Terminal,
+while sandbox previews retain their narrower, listener-scoped read tickets.
+HTTP remains unencrypted: use a trusted network, not a public deployment.
+Current Operator starts, `--detach`, and `--json` return Controller-owned
+receipts; inspect with `yui web --status` and stop with `yui web --stop`.
+Credential rotation requires stop/start, and Controller recovery does not
+automatically reopen Web. See [controlled Web access](web-access.md).
+
+Inbox consumers should use the current/history views and exact returned
+identities. Missing acknowledgement is not proof that work was never executed.
+A successor inspects original input and prior effects before settling a retained
+claim; it does not replay the input or borrow another Session's authority.
+Exact terminal handling checks remain bounded. Project delivery exclusions
+require original scoped authorization and do not erase bindings or prove a merge.
+See [CLI information contracts](cli-information-contract.md) and
+[Project delivery scope](project-delivery-scope.md).
+
+Storage advances from **1.11 to 1.13** through the centralized transitions:
+**1.12** declares Project delivery decisions; **1.13** declares exact inbox
+attempt/target identities, Global input retirement and terminal handling checks.
+Historical messages, claims and acceptance evidence are preserved without
+inventing old Turn ownership or ACKs. Supported **1.0–1.12** Homes use the
+existing same-major update path. With separate update authorization, use
+`yui update --version 2.10.0`; the updater owns preflight, backup, migration and
+Controller handover. Do not open upgraded Homes with an older binary or edit
+storage manually. Package minor numbering is not a blanket compatibility promise.
+
+Release gates reuse exact-commit Core CI and test one runtime tarball on
+Linux x64 and macOS x64/arm64 with Node 20/22/24/26 before npm publication.
+These are deterministic and isolated runtime checks, not real-model validation.
+Publishing does not update any global CLI, migrate a production Home, replace
+an Agent Session or start a production Web listener.
+
 ### 2.9.0 compatibility and migration notes
 
 This stable minor includes scoped Job definitions and exact execution Runs,

package/docs/release-workflow.zh-CN.md

@@ -36,6 +36,41 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 不能将不兼容冒称为兼容，也不为回避版本选择新增历史兼容机制。包版本与协议、
 持久存储契约仍然独立：兼容性检查和必要迁移要求不变，下文存储规则不授予发版权限。
 
+### 2.10.0 兼容性及迁移说明
+
+本稳定 minor 包含精确 Turn 收件箱处理与继任恢复（Task131 / PR #463、
+Task134 / PR #464），以及受认证保护的可信内网 Web 和当前 Operator 生命周期
+控制（Task135 / PR #465）。同时纳入显式 Task Project 交付范围与安全普通归档
+（PR #462），以及部署特定 GitLab 发布 URL 支持（PR #461）。
+
+Web 默认仍为 loopback。显式私网／通配监听要求
+`--auth-file <absolute-path>` 指向仅本用户可访问的密码文件，浏览器用户名为 `yui`。
+工作台页面、API 和 Terminal 之前必须认证；沙箱预览保留仅授权当前监听内特定
+服务读取的窄票据。HTTP 仍不加密，只应在可信网络使用，不用于公网部署。
+当前 Operator、`--detach` 和 `--json` 启动返回 Controller 持有的回执；
+通过 `yui web --status` 查询、`yui web --stop` 停止。轮换密码需停止后重启，
+Controller 恢复不会自动重新开放 Web。详见[受控 Web 访问](web-access.md)。
+
+收件箱调用者应使用 current/history 视图及返回的精确身份；缺少 ACK 不代表
+工作未执行。继任 Session 先检查原始输入和既有效果，再处理保留的 claim，
+不重放输入，也不借用另一 Session 的权限。精确 terminal 的处理检查保持有界。
+Project 交付排除须有原始范围授权，不删除 binding，也不证明代码已合并。
+详见 [CLI 信息契约](cli-information-contract.zh-CN.md)和
+[Project 交付范围](project-delivery-scope.md)。
+
+存储经集中式连续迁移从 **1.11 升至 1.13**：**1.12** 声明 Project 交付决策；
+**1.13** 声明精确 inbox attempt/target 身份、Global 输入退役及 terminal 处理检查。
+历史消息、claim 和验收证据保留，不猜造旧 Turn 归属或 ACK。受支持的
+**1.0–1.12** Home 沿用同 major 更新路径。另获更新授权后使用
+`yui update --version 2.10.0`，由更新器负责预检、备份、迁移与 Controller 交接；
+不要用旧程序打开升级后的 Home，也不要手工编辑存储。包 minor 编号不代表
+对所有接口作向后兼容承诺。
+
+发布门禁复用精确提交的 Core CI，并在 npm 发布前对同一 runtime tarball 执行
+Linux x64、macOS x64/arm64 与 Node 20/22/24/26 的全新安装验证。
+这是确定性和隔离运行时证据，不是真实模型验证。发布不会更新全局 CLI、
+迁移生产 Home、替换 Agent Session 或启动生产 Web。
+
 ### 2.9.0 兼容性及迁移说明
 
 本稳定 minor 包含分作用域的 Job 定义与精确执行 Run、持久 Schedule、受控 Project

package/docs/storage-baseline.md

@@ -2,7 +2,20 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.11. The declared 1.10 → 1.11 transition adds source provenance
+Current storage is 1.13. The 1.12 → 1.13 transition permits exact native attempt
+identity on new inbox claims, exact target identity on new steer controls,
+explicit Global inbox retirement and terminal handling-check evidence.
+It does not rewrite historical messages, infer old turn ownership or synthesize
+ACKs. SQL layout is unchanged. Current inputs and historical missing handling
+evidence have separate bounded discovery views; neither is a second queue.
+
+The 1.11 → 1.12 transition admits append-only
+`task.project-delivery-decided` events with Project requirement, reason, actor,
+original Message/digest/quote and the previous decision ID. Existing records and
+SQL layout are unchanged. No historical exclusions are inferred; absent decisions
+retain the required-delivery default. See [Project delivery scope](project-delivery-scope.md).
+
+The declared 1.10 → 1.11 transition adds source provenance
 to new activation-request event payloads: an existing Message/body digest or
 exact caller-attributed native input, plus the recorded Message boundary.
 Historical events are preserved without guessed sources or replay. Missing

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,17 @@
 
 # 存储基线 1.0
 
-当前存储为 1.11。1.10 → 1.11 为新 activation-request 事件增加来源证据：
+当前存储为 1.13。1.12 → 1.13 允许新 inbox claim 记录精确 native attempt、
+新 steer control 记录精确目标，以及 Global 输入显式退役和终态缺回执检查证据。
+不改写历史消息、不推断旧轮次归属、不补造 ACK；SQL 布局不变。
+当前输入和历史处理缺证据通过有界视图分别发现，不新增第二队列。
+
+1.11 → 1.12 允许追加 `task.project-delivery-decided` 事件，
+记录 Project 交付要求、原因、actor、原始 Message/digest/引用及前一决定 ID。
+SQL 布局和历史记录不变，不自动推断历史排除；没有决定时仍按需交付处理。
+详见 [Project 交付范围](project-delivery-scope.md)。
+
+1.10 → 1.11 为新 activation-request 事件增加来源证据：
 已有 Message 及正文 digest，或带调用者归属的原生输入原文，以及当时的 Message 序号边界。
 历史事件保持原样，不推测缺失来源、不重放输入；缺失来源通过读取诊断明确展示。
 SQL 布局及冻结 digest 不变，集中迁移不改写历史正文。

package/docs/task-delivery.md

@@ -273,8 +273,14 @@ Once recorded, verification is a fixed observation, not live monitoring or a
 unknown results never assert a fresh success. URL/target/candidate changes reset
 verification, while title-only changes can retain it.
 GitHub repository URL comparison respects case-insensitive owner/name identity.
-GitLab relative deployment paths are allowed, but the complete registered
-service prefix must still match. Adapter observations retain the observed target
+GitLab browser routes are deployment-specific: standard `/-/merge_requests/`,
+legacy `/merge_requests/`, and custom service paths are allowed in both entry
+points. Identity comes from structured repository/MR evidence, not a URL path
+template. The complete registered URL must still match after URL parsing and
+removal of one trailing slash; HTTP(S) is required and credentials, query and
+fragment remain forbidden. The provider URL is retained, not rewritten to a
+guessed route. A successful HTTP response is not merge evidence.
+Adapter observations retain the observed target
 branch even when the earlier Publication did not specify one; missing targets
 cannot establish new verification.
 

package/docs/task-delivery.zh-CN.md

@@ -182,6 +182,12 @@ ISO 时间戳。`provider` 表示 GitHub/GitLab 服务，不表示工具品牌
 完整 JSON 最大 64 KiB。Yui 不执行 `command`，不解析任意自然语言来判定成功。
 Leader 负责实际检查和解释输出，Core 负责身份、服务 URL、目标、候选和时间绑定。
 
+GitLab 浏览路径由服务部署决定：两个验证入口均允许标准 `/-/merge_requests/`、
+legacy `/merge_requests/` 和自定义服务路径，不再用 URL 模板推断仓库/MR 身份。
+结构化身份仍须匹配；完整登记 URL 经 URL 解析及移除一个末尾斜杠后仍须一致。
+仅允许 HTTP(S)，禁止凭据、query 和 fragment；保留 provider 返回的 URL，
+不改写为猜测的路由。HTTP 访问成功不是合并证据。
+
 新证据必须引用当前不可变 Publication，距登记不超过 24 小时且不能在未来。
 观察可以早于首次登记或仅标题更新；只有不可变历史中的候选、对象、目标或远程事实
 发生实质变化，才构成观察时间下界。候选改变后又恢复，也不能复用变化前的证据。

package/docs/testing/verification-levels.md

@@ -50,12 +50,12 @@ is required.
 ## Permanent core smoke
 
 `npm test` and `npm run test:core` build the checkout and run the maintained suite.
-The stable suite owns current storage 1.11 and its declared 1.0 through 1.10 minor
+The stable suite owns current storage 1.13 and its declared 1.0 through 1.12 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.11, exact schema/record validation, no initialization over
+1. Fresh storage 1.13, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and

package/docs/testing/verification-levels.zh-CN.md

@@ -36,12 +36,12 @@ Yui 是一个单用户本地产品。永久验证保护关键的 happy path 和
 ## 永久 core smoke
 
 `npm test` 和 `npm run test:core` 构建当前 checkout 并运行维护中的套件。
-稳定套件维护当前存储 1.11 和明确声明的 1.0 至 1.10 连续小版本迁移，
+稳定套件维护当前存储 1.13 和明确声明的 1.0 至 1.12 连续小版本迁移，
 不包含未声明的历史格式兼容路径。
 
 当前覆盖包括：
 
-1. 新建存储 1.11、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
+1. 新建存储 1.13、精确结构与记录校验、禁止覆盖未知数据库、无修改拒绝旧整数格式。
 2. 精确版本暂存、目标不匹配拒绝、同主版本连续小版本预检、交接锁显式所有者，
    以及恢复时核对捕获的协议和存储身份，不接受缺失字段。
 3. 持久 Task／Message／Decision 上下文、Draft 激活权威、mailbox 认领、

package/i18n/README.zh-CN.md

@@ -27,7 +27,7 @@ Yui 是面向编程 Agent 的本地控制面。你只需用自然语言把目标
 - **自带 Agent** —— Codex CLI、Claude Code CLI 和 ACP 通过统一边界接入，
   可替换而不丢失 Task。
 - **本地优先、私有** —— 一切运行在你自己的机器上，面向单个受信任用户；
-  Web 仅本地回环，包含只读视图和经认证的用户控制。
+  Web 默认本地回环，可显式开启带认证的可信内网访问。
 - **默认隔离** —— 仓库改动发生在受管 Git worktree 中，稳定 checkout 保持只读。
 
 > **状态：** 1.1.0，当前存储版本为 1.1，已声明从 1.0 基线升级。默认更新只执行同一存储
@@ -156,6 +156,9 @@ Agent 可以重新读取任务上下文，继续兼容的 Session，或在必要
 想直观看进展，可以在另一个终端运行 `yui web`。本地 Web 展示同一份任务与
 待回答问题，也允许发送消息、回答问题，以及显式 queue、steer 或 interrupt Task 输入。
 这些经认证的 Task 控制复用 CLI 的相同操作，不是另一套需要同步的任务系统。
+内网监听要求权限受限的凭证文件；浏览器使用原生认证提示（用户名 `yui`）。
+当前 Operator 可按用户请求启动、查询和停止，不能冒充浏览器用户。HTTP 不加密。
+详见[受控 Web 访问](../docs/web-access.md)的命令、地址发现、凭证轮换及安全边界。
 详情分为四个页签：概览（用户待办、任务进展和关键决定）、交付（工作项、评审、
 集成与远程交付，按需读取）、运行（Role、原生会话活动、进行中的执行和用量）、
 记录（决定、里程碑、执行与问题的时间线）。详见[用户关注与进展](../docs/observability/README.zh-CN.md#web-用户关注与进展)。
@@ -263,7 +266,7 @@ Yui 为你组织的东西 —— 是持久对象，而不是进程：
      它负责搬运工作、记录事实——但从不判断回答好坏
 
   Agent 在 Project 中工作：只读 checkout + 隔离 worktree。
-  Web（yui web）：本地回环视图 + 经认证的用户控制。
+  Web（yui web）：默认本地回环 + 显式认证的内网访问。
 ```
 
 ### 分层设计
@@ -272,7 +275,7 @@ Yui 为你组织的东西 —— 是持久对象，而不是进程：
 
 ```text
   体验层 Experience   —  你如何交互
-    CLI（Operator）· Web（本地回环、经认证）· 原生 Agent 会话
+    CLI（Operator）· Web（本地 / 经认证内网）· 原生 Agent 会话
     采集输入 · 展示事实 · 确认操作 · 调用能力
         ▼
   决策层 Intelligence —  谁来决定

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "2.9.0",
+  "version": "2.10.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -142,6 +142,32 @@ heartbeat or unchanged wait. Ordinary fact edits need no self-wake.
 
 ## Close the current turn
 
+### Adjust Project delivery scope without erasing work
+
+When explicit user intent or an original delegation allows a Project to leave
+the final delivery, read that original Message and `task remote-delivery`.
+Record the bounded decision with
+`task project delivery <task> <project-id> --requirement excluded --reason <reason>
+--source-message <message-id> --purpose <verbatim-authorization>
+--if-current <scopeDecision.id|none>`.
+Interpret whether the original really authorizes this scope change; a matching
+quote alone is not semantic permission. Do not exclude a Project to conceal an
+unmet commitment. Ask only for a genuinely missing scope decision, not a second
+approval when existing user intent or delegated judgment already covers it.
+Use the same operation with `--requirement required` and the latest decision ID
+to restore normal checks. Reconcile a stale guard instead of overwriting newer
+intent. These append-only decisions also work on completed, unarchived Tasks
+without reopening, rewriting acceptance, or rerunning work.
+
+Unchanged Projects need no exclusion. Required changed/unknown Projects still
+need exact verified delivery. Excluded Projects retain their binding, code
+changes and Publication facts and are not counted as merged or verified merely
+because they are excluded. Scope is not execution, write, archive or deletion
+authority: open commitments and unknown execution still need settlement, and
+unique commits or dirty resources remain protected. With separate archive
+authorization, use ordinary archive/preflight and report retained resources;
+do not recommend force merely because an authorized Project is excluded.
+
 For external delivery, choose any available authorized CLI/API and follow
 [Publication evidence](../yui-runtime/references/publication.md). Record exact
 tool observations through `publication verify --observation`; gh/glab are optional

package/skills/yui-leader/VERSION

@@ -1 +1 @@
-5
+6

package/skills/yui-operator/SKILL.md

@@ -183,6 +183,23 @@ user-owned configuration and external-effect boundaries.
 Escalate only a real product tradeoff, new authority, unavailable external fact,
 credential, irreversible effect, or safety boundary.
 
+For user-requested Web lifecycle operations, use `yui web`, `yui web --status`
+and `yui web --stop` with the current Operator identity and intended Home.
+Operator starts return a Controller-owned receipt without holding this turn
+open. Non-loopback binding requires `--auth-file <absolute-path>` containing
+an owner-only (0600) regular file with a unique 32–128 character printable ASCII
+password; browser username is `yui`. There is no default password.
+Honor the user's exact network exposure and credential scope. Never clear
+managed identity, impersonate a browser user, launch a bypass server or restart
+the Controller merely to open Web. Report actual access URLs and failures,
+never a wildcard address or an old snapshot as a working link. Explain that
+HTTP is unencrypted, and keep credentials out of messages, logs and URLs.
+Lifecycle authority does not authenticate visitors. On unknown startup outcome,
+inspect status before retrying; a running listener is not proof of remote reachability.
+Stopping Web closes browser connections without stopping Agents. Password
+rotation requires explicit stop/start; changing the file alone does not revoke
+the running credential. Controller recovery does not automatically reopen Web.
+
 ## Configure Yui through confirmed conversation
 
 Read both effective configuration and the catalog before explaining or changing
@@ -237,6 +254,10 @@ Apply **yui-runtime**'s own-inbox flow at useful routing boundaries and before
 handoff. `yui inbox list/show/claim/ack` processes Operator input in this turn;
 do not wait for another wake or copy pending notices into new input. Read every
 relevant original and finish the authorized routing/disposition before ack.
+Routing to an owning Task, recording a necessary user question, or verifying
+that a later request superseded a notice may settle this input immediately;
+cite the durable reference and do not wait for the downstream Task to finish.
+Use the Runtime current/history split and never replay effects to repair ACK.
 
 Use JSON reads and their top-level `data` field.
 Use Global Context's bounded `pending` page to find Messages, then
@@ -287,6 +308,16 @@ Distinguish settled business and stopped execution from safely retained
 physical resources. Ordinary archive may retain the latter; follow the shared
 archive diagnostics and exact cleanup actions instead of requesting force
 merely for old terminal Integration worktrees or preserved diagnostics.
+When only some bound Projects remain in the final delivery, preserve the exact
+user scope decision or delegation in the owning Task and route it to its Leader.
+The Leader can record `task project delivery` with the original Message and
+latest scope-decision guard; this also works for completed, unarchived Tasks
+without reopening them. An unchanged Project already needs no delivery.
+An explicitly excluded Project is not a verified merge and its data is not
+disposable. Use the shared remote-delivery/preflight projection, settle open
+business and execution independently, and use ordinary authorized archive
+while reporting safely retained resources. Do not demand force, delete bindings,
+or solicit repeated Operator approval when the original scope authority suffices.
 When the user explicitly authorizes force archive for an eligible terminal
 Task, archive even if delivery proof or cleanup is incomplete. Report the
 warnings and retained resources without claiming merge verification or physical

package/skills/yui-operator/VERSION

@@ -1 +1 @@
-3
+6

package/skills/yui-runtime/SKILL.md

@@ -191,11 +191,13 @@ unmanaged Session is not silently replaced or adopted; use an explicit Session
 lifecycle action before enabling controlled delivery.
 
 Context reads never consume queue entries. Global Context returns a bounded
-`pending` discovery page, not Message bodies, Profile bodies, recent history or
-accumulated retry details. The Manifest retains the exact Role profile.
+`pending` discovery page of current-turn and available input, not Message bodies,
+Profile bodies, historical receipt debt or accumulated retry details. Its
+`historyCount` is a separate absence-of-handling-evidence count, not new work.
+The Manifest retains the exact Role profile.
 Read a referenced
 original with `role message show <role> <message-id> --json`. Follow a pending
-page's `nextCursor` using `role message list <role> --pending --cursor <cursor>`
+page's `nextCursor` using `role message list <role> --current --cursor <cursor>`
 when it is incomplete; accepted delivery does not erase the Message from the
 separate all-message list. Native/transport acceptance is not implementation, and
 `interrupt-requested` is not a stopped Turn or stopped background resources.
@@ -214,13 +216,24 @@ explicit new control attempt; uncertainty does not.
 
 ## Handle your own inbox in the current turn
 
+For an automatic delivery naming an exact Message or wake, use that entry
+directly: read its original, claim it, and record its semantic disposition
+before ending this turn. Do not first enumerate history to rediscover it.
 After loading authorized context, at useful work boundaries and before handing
-off, use `yui inbox list --json` to discover pending input addressed to your
-current managed identity. This applies to Operator, custom GlobalRole, Leader,
+off, use `yui inbox list --view current --json` to discover current-turn and
+available input addressed to your current managed identity. This applies to Operator, custom GlobalRole, Leader,
 Worker and Reviewer. Do not poll an empty inbox or create another model turn.
 No target Role, Task or native Session is supplied: Yui resolves your current
 identity. A native child gains no separate actor or inbox.
 
+`--view history` discovers old missing receipts explicitly; default `--view all`
+prioritizes current inputs and labels each entry's category. Never treat an
+absent historical ACK as proof that its work was not done. Read history when a
+specific reminder, recovery or user request calls for it, not every turn.
+Current correlation reuses exact delivery/continuation/control identities;
+active claims retain their observed native attempt when available. Missing
+historical correlation is not reconstructed from timestamps or final text.
+
 1. Read the selected `yui inbox show <entry> --json`. Reads never consume input.
    Follow `nextCursor` and all `contentPage` pages using the rules below.
 2. Before processing, reserve exact entries with
@@ -241,6 +254,33 @@ identity. A native child gains no separate actor or inbox.
    Record an obsolete notification as requiring no further action only after
    checking its originals and current facts, never based solely on age.
 
+An input can be settled as executed, legally routed/delegated, a necessary user
+question raised, or superseded/no action after inspecting authoritative
+originals. Put that concrete disposition and useful Task/InputRequest/result/
+Publication references in `--reason`. Routing may be complete while the Task
+is still running; do not hold the input until all downstream work finishes.
+For supersession, identify the later source, not merely its age.
+
+At an exact native terminal, engineering checks for unacknowledged inputs
+correlated to that turn and emits at most one existing notification. This is
+missing-evidence detection, never semantic ACK or proof of absent effects.
+Reminder-only turns do not generate another reminder. The retained originals
+remain inspectable if the bounded reminder is also missed; do not start a
+private polling/retry loop or copy the business input to obtain another turn.
+Task Assignment checks go to Leader for inspection and existing handoff or
+retirement, not automatic Worker/Reviewer replay. Exact terminal can end an
+active-consumption notification reservation without acknowledging its input;
+it does not infer or release an uncertain native writer.
+
+For obsolete Global input that was conclusively not submitted, use
+`yui inbox retire <entry> --request-id <stable-id> --reason "<disposition>"`
+after inspecting the original and current facts. Retirement preserves the
+original target, claim and explicit management evidence; it is not ACK.
+Accepted input uses normal claim/ack reconciliation. Unknown/pending control,
+transport acceptance and interrupt-then ownership cannot be retired through
+this operation. Task Messages retain the existing Leader `task message retire`
+and exact-Assignment handoff paths.
+
 Claiming prevents ordinary automatic delivery; it is not processing completion.
 Acknowledgement records Agent handling, not Host acceptance, result acceptance,
 Task completion, publication or archive. Never acknowledge merely to empty the
@@ -248,6 +288,13 @@ list. On failure or interruption, leave the claim unacknowledged; it remains
 discoverable and does not expire or replay automatically. A current rightful
 successor must inspect original input and prior effects before finishing and
 acknowledging a retained claim. Never replay uncertain external actions.
+After legal Session replacement, initialization can arrive before old handling
+is settled. This recovery notification is not the original business input or
+an acknowledgement. Read the current inbox and prior effects first. For
+`claimed-by-previous-session`, retain the original claim: do not claim again.
+Finish only the still-authorized handling and use a new stable ack request ID
+with a concrete disposition; the receipt retains both the old claimant and
+the current acknowledging actor. New queued input remains separate.
 For an exact-Session input already claimed by its selected Session, a rightful
 successor may explicitly settle that handling after inspecting the original
 and prior effects. This preserves the original target and claim; it grants no
@@ -277,6 +324,12 @@ This claim never sends the input again. A current rightful successor may settle
 an accepted Global input or Leader window while retaining the original delivery
 target; it must inspect prior effects first. Pending/unknown acceptance stays
 blocked and cannot use claim as a replay path.
+An explicitly released Leader notification (`notification.resolved` with
+`released-without-replay`) can be claimed for evidence inspection and settlement
+after verified native stop. Its original delivery status stays unknown or
+unaccepted; handling it cannot retarget Session-specific instructions or
+authorize re-executing unknown effects. If a required fact or user decision is
+unavailable, preserve the claim and report that exact boundary.
 
 An ack belongs to the exact original and revision: fixed windows pin
 `message.updated` event identities, including same-timestamp edits. A later

package/skills/yui-runtime/VERSION

@@ -1 +1 @@
-8
+10

package/skills/yui-runtime/references/recovery.md

@@ -122,6 +122,27 @@ context and fixed notification references, then chooses which still-valid
 assignment to continue. Released Leaders retain scoped diagnostic reads but
 cannot regain write authority.
 
+Leader initialization is delivered separately from old inbox handling and
+new queued business. A retained claim cannot block this lifecycle notification.
+The current Leader reads `yui inbox list --view history --json`, then the exact originals and
+prior effects. Claims survive unchanged; use `inbox ack` only after actual
+handling, with the successor's own disposition. Do not claim an already-claimed
+entry again. Repeated reconciliation or Controller restart does not settle
+anything or repeatedly wake an idle handler.
+
+A legally started GlobalRole successor with claims from a previous Session
+receives one Session-pinned recovery Message in its existing inbox. It requests
+the same inspection, not replay of those Messages. A stopped Global Session
+is not started by this notice. Worker/Reviewer Assignment changes still require
+the existing explicit handoff or retirement; no bulk transfer is implied.
+
+Replacement waits for exact native/resource stop and writer release. Missing
+proof requires repairing that observation or a genuinely missing user decision,
+not a timeout, another name, force-ACK or record deletion. Uncertain old
+notification submissions are released from scheduling without replay, retaining
+their fixed wakes and `notification.resolved` evidence. They become explicitly
+inspectable/settleable, not automatically accepted or resubmitted.
+
 ## Handle uncertainty and failed cleanup
 
 Never replay a notification whose acceptance is unknown. After evidence