@llblab/pi-kit 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.17.0 - 2026-09-18
+
+- `Proportional State Flow Guidance`: Advances the exact State Flow pin to `0.16.0`, adding the focused operational Skill, compacting memory curation guidance, and returning bounded reactive diagnostics for missing paths with durable references.
+- `Intentional Agency`: Includes State Flow 0.15.0 hot scoped intents for selected future commitments, explicit references to supporting Lazy memory, complete lifecycle and migration semantics, and read-only Telegram inspection without introducing scheduling or automatic execution.
+- `Package Cohort`: Keeps every other bundled package at its current exact version; the package set, resource inventory, and explicit load order remain unchanged.
+
 ## 0.16.0 - 2026-09-17
 
 - `Canonical Knowledge Memory`: Advances the exact State Flow pin to `0.14.0`, making Global Lazy the sole canonical Knowledge store and removing the former Markdown Knowledge layer while preserving scoped semantic compilation and recovery.

package/README.md

@@ -14,7 +14,7 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | [`@llblab/pi-clean-room`](https://github.com/llblab/pi-clean-room) | `0.1.1` | Isolated nested Pi TUI with explicitly selected extensions |
 | [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.10.0` | Compact Codex/Spark subscription-limit and Business credit-usage status |
 | [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.8.1` | Visible continuation scheduling and bounded worker Skills |
-| [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.14.0` | Incremental scoped state/context/memory compiler with Global Lazy as the canonical Knowledge store, compiled runtime delivery, safe compaction, and exact publication |
+| [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.16.0` | Incremental scoped state/context/memory compiler with proportional operational guidance, intentional agency, reactive dangling-reference diagnostics, compiled runtime delivery, safe compaction, and exact publication |
 | [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.49.0` | Telegram companion with native fresh-session replacement, adaptive Thread continuity, exact queues, files, voice, controls, and Generative Apps guidance |
 | [`@llblab/skills`](https://github.com/llblab/skills) | `1.15.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 

package/node_modules/@llblab/pi-state-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # Agent Instructions
 
-- Keep independent domain modules under `lib/`, mirror every domain with a same-named file under `tests/`, place cross-domain architecture checks in `tests/invariants.test.ts`, and keep `index.ts` as a minimal composition/public-export boundary.
+- Keep independent domain modules under `lib/`, mirror every domain with a same-named file under `tests/`, place cross-domain architecture checks in `tests/invariants.test.ts`, and keep `index.ts` as a minimal public-export boundary. Keep `lib/extension.ts` as the Pi lifecycle composition root: it may wire configuration, domain capabilities, handlers, and event subscriptions, but low-level parsing, traversal, formatting, persistence, queue/worker mechanics, and diagnostic I/O belong to their existing owning domains.
 - Keep the extension opt-in and preserve clear attribution to SKILL.state wherever the inherited explicit-state approach is described.
 - Preserve Pi's native tool loop and complete inspectable session trace; project completed-run history only at user-run boundaries. The runtime-context builder owns model projection of the raw scope overlay; callers must not pre-project it. Retain persistent and current-run context-bearing custom messages from other extensions, plus the complete current-run trajectory, except State Flow's own validation feedback when it is represented separately.
-- Expose one canonical materialized state shape across global, CWD, and session scopes with exactly `artifacts`, `contract`, `working`, and `response`; the first three are flexible semantic objects and the fourth is the latest complete user-facing answer string where applicable.
+- Expose one canonical materialized state shape across global, CWD, and session scopes with exactly `artifacts`, `contract`, `working`, `intents`, and `response`, plus optional `lazy`; the first four are flexible semantic objects and `response` is the latest complete user-facing answer string where applicable. `intents` contains only active commitments to future action, remains hot by default, and must not become a planner, scheduler, task manager, or execution loop.
 - Key artifacts directly by their source path. Model-visible artifact entries require only a non-empty `description` plus optional forward-compatible metadata; runtime-owned freshness evidence (`sourceHash`, `compilerRevision`, `compiledAt`) belongs in the scope `meta.json` provenance registry, never in projected semantic state. Retired embedded `hash`/`compiler`/`compiled_at` fields remain readable compatibility evidence and are stripped from model projection. Validate provenance restrictions on every authored artifact entry, not on retained legacy state: individual runtime/legacy provenance fields cannot be set or deleted by model patches in any scope.
 - After local activation and before the next enabled inference, discover regular lowercase `*.md` files recursively beneath the configured Knowledge repository root; use canonical absolute paths, hash opaque source bytes and retain their byte counts without decoding or retaining bodies, skip symlinks, and never traverse outside that canonical root. Treat the current candidate set plus explicit owner-confirmed removals as generic global artifact input without invoking Knowledge validators. Partial candidate sets, unavailable roots, and symlink/external/non-Markdown paths never authorize deletion. Re-derive removals from the retained global registry so status inspection and restart cannot consume uncommitted observations; unavailable roots mean unknown freshness. Materialize removals deterministically as runtime-owned global transitions without rereading missing bodies or requesting model compiler output. Never reserve Knowledge document names, provide built-in Knowledge templates, or implement `save_knowledge`.
 - Derive artifact freshness per available evidence: a new source always requires compilation, a matching `sourceHash` or `compilerRevision` detects its own change, malformed present evidence fails closed for the capability that depends on it, and missing evidence degrades to an unknown-but-usable artifact rather than corrupt state or a migration. Never treat `compiled_at` as a correctness signal. Plan acquisition from path/hash identity without source bodies, project stale global candidates as runtime-owned `artifact_invalidations` containing only `{path, reason}`, and publish accepted compilation semantics plus matching provenance in one durable cohort.
@@ -19,7 +19,7 @@
 - Keep historical reads lazy through the smallest runtime/model read interface. Normal inference gets only current effective state and useful bounded compact transition context, never eight full snapshots. `patch_state` is the sole semantic mutation tool. `read_state` treats unscoped semantic paths as current effective aliases, accepts explicit effective/scoped materializations and scope-local retained accepted patches, and rejects the retired top-level `state` segment; materialization indices share the composed causal lineage while `patches[n]` walks the selected scope's retained patch tail. The public reader accepts only `path` or `paths`; temporal offsets and scope selection are expressed in path syntax. Reads return the exact boundary and never publish, append a checkpoint, or advance history. Both tools follow branch enablement and host tool restrictions; the patch barrier blocks reader siblings too. Live/cached checkpoint plus tails own the hot path; use Git for branch restoration and explicit cold inspection, not to rebuild current state on every inference.
 - Store runtime state in its own directory with optional Git durability, defaulting to `state-flow/` beneath Pi's configured agent directory (`~/.pi/agent/state-flow/` normally), independently from the Knowledge Markdown source root. Use exactly these owned paths: `checkpoint.json`, `patches.jsonl`, and `meta.json` for global; `<cwd-key>/checkpoint.json`, `<cwd-key>/patches.jsonl`, and `<cwd-key>/meta.json` for CWD; `<cwd-key>/<session-key>/checkpoint.json`, `patches.jsonl`, `meta.json`, `config.json`, and `runtime.json` for session. Do not create `.state-flow`, `scopes`, or another storage/history namespace. Mirror Pi's native CWD session-directory encoding and JSONL-basename session key (deriving `<header timestamp>_<UUID>` for in-memory sessions), while retaining separately verifiable canonical identity provenance in owned state. Keep the UUID authoritative, reject unsafe segments and mismatches rather than selecting another scope, and use CWD `meta.json` ownership to fail closed on Pi-name collisions.
 - Classify every filesystem cohort before recovery: complete valid evidence is usable; total absence is recoverable only from an explicit semantic default or exact surviving authority; partial, malformed, contradictory, or authority-losing evidence fails closed at the smallest dependent capability. A wholly absent untouched global/CWD checkpoint-tail pair is current empty shared reality and must not resurrect selected cold values; a patch targeting that disappeared scope is stale and must fail for reinference. Missing provenance means unavailable freshness, not semantic corruption. Perform every repair through normal locked/CAS publication, never ad-hoc writes.
-- Support the release-owned storage migration chain through the migration domain: complete predecessor checkpoint/tail envelopes convert into semantic-only checkpoint/tail files plus temporal `meta.json`, and the 0.13 → 0.14 step splits every owner-proven session's combined `meta.json` into scope-only `meta.json` plus branch/run `runtime.json`. Execute the applicable steps through one normal locked/CAS publication. Replace a Git-backed semantic-envelope store's history with one new root commit for the complete migrated tree; apply the same cohort without Git in file-only mode. `state.json`, pre-0.4 hashed layouts, and semantic Pi checkpoint envelopes are unsupported and never become recovery authority. Exercise migrations in temporary repositories rather than modifying the user's active data during development.
+- Support the release-owned storage migration chain through the migration domain: complete predecessor checkpoint/tail envelopes convert into semantic-only checkpoint/tail files plus temporal `meta.json`, the 0.13 → 0.14 step splits every owner-proven session's combined `meta.json` into scope-only `meta.json` plus branch/run `runtime.json`; and the 0.14 → 0.15 step adds empty `intents` to retained semantic checkpoints without inferring commitments. Execute the applicable steps through one normal locked/CAS publication. Replace a Git-backed semantic-envelope store's history with one new root commit for the complete migrated tree; apply the same cohort without Git in file-only mode. `state.json`, pre-0.4 hashed layouts, and semantic Pi checkpoint envelopes are unsupported and never become recovery authority. Exercise migrations in temporary repositories rather than modifying the user's active data during development.
 - Read and write only regular non-symlink State Flow-owned files at those exact paths, publish each file by same-directory atomic rename, preserve arbitrary repository contents, and classify ownership exactly. Git acceptance follows the complete-delta isolated-index contract below. Retain opaque source bytes for file identity and rollback, not decoded-text reconstructions. Use validated structural JSON equality for in-process semantic comparisons; reserve cryptographic hashes for compact identities that cross inference, persistence, process, or source-freshness boundaries. Serialize cooperating Git publications through a common-Git-directory publication lock; low-level file helpers require caller exclusion. Recheck prepared bases before each replacement/deletion and restore only bytes still matching the publisher's own output. Preserve detected concurrent changes and report unresolved rollback conflicts; do not claim kernel-atomic multi-file CAS against nonparticipating writers. Markdown discovery uses its independently configured source root, defaulting to `knowledge/` beneath Pi's agent directory; a storage-root override must not redirect source discovery.
 - At instance initialization resolve the repository, CWD key, and session key; load each scope's anchored checkpoint and tail, materialize at the selected temporal boundary, then overlay `global → cwd → session`. Install cached view and publication basis atomically only after successful restoration/initialization; unavailable publication is an error, not a semantic no-op. Branch recovery may reuse one owner-bound, single-use inspection of the exact selected immutable Git revision, with a detached inspection snapshot and a freshly acquired live publication basis at installation. Revalidate mutable file cohorts, legacy snapshot fallbacks, and redirected runtime owners; never turn inspection into a long-lived revision or publication-basis cache. Preserve the selected revision across transient restore failure so an explicit start can retry it. A genuinely new session gets an empty session layer and inherits only global/CWD values; it must never reuse another same-CWD session layer. Explicit native fork adoption instead follows the [session-copy contract](docs/fork-contract.md): copy the proven source session checkpoint/tail and provenance into a distinct owner over current shared streams, without pruning shared provenance or modifying the parent. Use a fresh origin, preserve copied replay records, reject occupied live/HEAD targets, and publish/checkpoint the child only after CAS acceptance. Inherited parent pointers never authorize an empty reset; fence parent passive Stop projection across child reload.
 - Bind every loaded scope and active Pi branch/checkpoint to the corresponding State Flow Git revision. Resume and tree restoration must recover branch-correct runtime config and semantic layers from that revision without blindly importing Git `HEAD`; reading an older revision must use object-level Git reads and never reset or check out the shared repository worktree.
@@ -29,7 +29,7 @@
 - Treat every semantic `patch_state` as a strict inference barrier. Give it sequential execution mode; find the matching synchronized assistant through public parent traversal from the selected leaf without constructing a full branch during tool preflight; require exactly one `patch_state` call in that response and block every sibling tool call before execution. Every enabled iteration begins terminal-ineligible; only a successful call containing `final:true` latches eligibility for the next accepted `turn_end`, without stopping later reasoning, tools, or patches. If a terminal draft ends before eligibility, preserve it as the runtime-owned response at that `turn_end` and start at most two same-run fallback turns whose only purpose is the `final:true` patch; an eligible draft whose final validation fails after a later acquisition follows the same path. Fallback turns never enter `response`, and their only instruction is to apply `patch_state` with any durable changes and `final:true`, or `{final:true}` alone. A successful fallback closes resolution with the preserved answer intact; two failed fallbacks close the iteration with the preserved answer and current state plus one bounded warning and a finalization diagnostic. Failed patch calls do not consume fallback turns. A subsequent legal patch remains possible, and only an accepted ordinary answer is reconciled.
 - Reconcile `response` only from the actually accepted ordinary assistant answer at `turn_end`; it remains runtime-owned. State Flow has no terminal HTML-comment mutation protocol and does not parse generic service comments. The first terminal draft that cannot be reconciled is preserved as the iteration response rather than discarded; fallback turns during pending resolution never reach `response`. Other extensions retain ownership of their own comments and output handling.
 - Treat terminal state as a decision-relevant handoff, not narration: retain source-addressed reusable operational knowledge in `artifacts`; compile stable requirements, confirmed decisions, rejected approaches, and interface commitments into `contract`; retain observations, validation, failures, current domain state, unresolved work, interaction consequences, and exact continuation in `working`. Preserve relevant completed prerequisites and verified outcomes while removing obsolete progress narration; reconcile only information affected by the run and relevant existing commitments, not every scope or repository surface.
-- Preserve active constraints, unresolved questions, consequential negative results, and the next discriminating check before compression. Distinguish observations, user requirements, assistant decisions, and hypotheses; do not promote assistant conclusions to user requirements. Retain useful source locators and validity conditions for consequential facts without mandatory per-value metadata. Keep rejection reasons and reconsideration conditions. Reconcile contradictions through evidence or user clarification instead of silently overwriting established constraints or observations; retain unresolved conflicts and decision-relevant hypotheses as uncertain. These are protocol obligations, not deterministic semantic validation gates.
+- Preserve active constraints, unresolved questions, consequential negative results, and the next discriminating check before compression. Distinguish observations, user requirements, assistant decisions, and hypotheses; do not promote assistant conclusions to user requirements. Treat resource, document, memory, Skill, and agent locators as semantic references wherever context expresses them. Inside ordinary strings and prose, encode a semantic-state path as `$` immediately followed by one valid `read_state` path, for example `$effective.lazy.memory[7]`; the prefix distinguishes a reference from incidental path-like text and leaves room for future parsing. `{"$ref":"cwd.lazy.plan"}` remains the optional structured state-reference form; neither form is a runtime link type. External resource locators retain their native path, URI, Skill, or agent syntax. Resolve references explicitly through the appropriate read/tool when needed and infer no authority, existence, dependency, hydration, execution, or completion merely from their presence. Never scan, audit, or proactively resolve references merely to find broken ones. Only after one requested `read_state` value path is missing may the query domain perform one bounded reverse lookup over current model-patchable semantic planes for exact structured `$ref` and `$path` matches. When durable sources match, return a successful top-level `{value:null, hint:[...]}` diagnostic sentinel: every hint has `type:"dangling-reference"`, an action message, and at most three runtime-verified current owning paths. The null sentinel is never presented without `hint` for this case; keys, patch, and multi-path reads retain ordinary all-or-error semantics. Never scan runtime-owned `response`, and retain the ordinary missing-path error when no durable source matches. A match proves durable semantic provenance, not staleness; no match does not prove invention. The agent may then inspect ownership and patch a proven stale source while preserving surrounding meaning. Effective-state absence does not identify ownership, and unavailable history, inaccessible external resources, or transient read failure do not prove a dangling reference. Retain useful source locators and validity conditions for consequential facts without mandatory per-value metadata. Keep rejection reasons and reconsideration conditions. Reconcile contradictions through evidence or user clarification instead of silently overwriting established constraints or observations; retain unresolved conflicts and decision-relevant hypotheses as uncertain. These are protocol obligations, not deterministic semantic validation gates.
 - Treat `working` as last observations, not a live workspace. Revalidate volatile facts before consequential actions; after interruption or branch navigation inspect relevant external effects before repeating operations. Failed state commits and restored memory do not undo tool effects. Missing evidence proves neither success nor absence of effects: retain uncertainty and the next check. Keep revalidation targeted, without action ledgers or runtime freshness/rollback guarantees.
 - Treat each successful `SKILL.md` read as CWD artifact acquisition using the finalized tool-execution arguments after mutable interception: require a non-empty compiler output in the next `patch_state` call under `cwd.artifacts[exactReadPath]` with `description`, `kind: "skill"`, and a flexible non-empty `compilation` object; hash the executed source bytes and record runtime-owned `sourceHash` plus `skill-artifact-v1` `compilerRevision` in the CWD provenance registry; reject missing, unhashable, malformed, or forged freshness data; replace the complete prior Skill artifact and its provenance entry on refresh so obsolete evidence cannot survive. `contract.compiled_skills` is retired and rejected; migrate useful legacy entries into artifacts while preserving behavior and marking fallback hashes unverified when the source is unavailable.
 - Make state stewardship an ordinary model responsibility without a background loop or gratuitous full-state rewrite. Every handoff curates touched and obviously stale or mis-scoped visible branches: place new knowledge at the narrowest valid scope, merge fragmented facts, compress history into conclusions, and delete stale, completed, redundant, or low-value keys while preserving active commitments and evidence. At a completed feature/release/campaign, project switch, or active-version change, require one bounded scoped reconciliation before terminal completion; use targeted `read_state` when ownership is not visible, then write and verify the destination before deleting and verifying the source. Global is only established cross-project/user/environment knowledge, CWD is reusable project truth, and session is branch/run continuation.

package/node_modules/@llblab/pi-state-flow/BACKLOG.md

@@ -1,3 +1,5 @@
 # BACKLOG
 
-Completed release work belongs in [CHANGELOG.md](CHANGELOG.md).
+Completed implementation belongs in [CHANGELOG.md](CHANGELOG.md); durable semantic contracts belong in [AGENTS.md](AGENTS.md) and [docs/architecture.md](docs/architecture.md).
+
+No open work.

package/node_modules/@llblab/pi-state-flow/CHANGELOG.md

@@ -4,6 +4,22 @@
 
 ## Unreleased
 
+## 0.16.0: Proportional State Flow guidance
+
+- `Operational Skill`: Adds the packaged `state-flow-guide` as an on-demand reference for concrete read, patch, inheritance, acquisition, finalization, and recovery problems without triggering memory audits or unsolicited cleanup.
+- `Memory Skill`: Compresses `state-flow-memory` into one bounded curation procedure while preserving authority separation, intent cleanup, evidence boundaries, ownership checks, two-phase scope transfer, external acceptance verification, and active/passive finalization behavior.
+- `Contract alignment`: Updates executable Skill discovery and release-package inventory checks for both Skills, removes obsolete documentation for retired read syntax, and defines state references as structured `$ref` values or `$`-prefixed `read_state` paths in prose without proactive link scanning.
+- `Reference diagnostics`: When one requested value path is missing and exact durable sources exist, returns `{value:null, hint:[...]}` with a typed reconciliation message and at most three runtime-verified current owning paths. Keys, patch, batch, and unmatched reads remain all-or-error; no match never implies that the agent invented the path.
+- `Composition root`: Reduces `lib/extension.ts` to higher-level Pi lifecycle wiring by moving patch presentation into `protocol`, branch traversal into `session`, diagnostic persistence into `logging`, and durable queue/worker lifecycle into `publication`, without adding domains or changing public behavior.
+
+## 0.15.0: Intentional agency
+
+- `Intent semantic plane`: Adds hot, object-valued `intents` to global, CWD, session, and effective state. An intent is a selected commitment to future action, distinct from requirements in `contract`, observations or possibilities in `working`, and inactive supporting memory in `lazy`.
+- `Intent lifecycle`: Supports ordinary atomic creation, update, scope overlay, supersession, and removal. Active intents survive intermediate handoffs; fulfilled, abandoned, superseded, or impossible intents disappear while consequential results and referenced state remain independently retained.
+- `Explicit semantic references`: Intents may carry conventional `{"$ref":"cwd.lazy.plan"}` pointers. Reads return references exactly and follow their targets only through a separate explicit `read_state`; State Flow adds no dependency graph, automatic hydration, scheduling, execution, or completion behavior.
+- `Durability and migration`: Preserves intents across hot history, Git and file-only persistence, passive and active operation, forks, compaction, and CAS conflicts. The explicit 0.14 → 0.15 migration adds empty intents to retained scopes without inferring commitments from working state, plans, requirements, lazy memory, or response prose.
+- `Inspection and guidance`: Extends current, scoped, historical, key, patch, and batch reads; adds read-only Telegram intent inspection; and updates the model protocol and bundled memory Skill to reconcile active commitments without introducing a task manager or second agent loop.
+
 ## 0.14.0: Passive and progressive memory
 
 - `Default passive memory`: Repository-root configuration now adds independently configurable passive bootstrap and `read_state`/`patch_state` access, both enabled by default. Passive reads project durable memory without mutation; explicit patches may materialize storage while episode barriers, continuation, response reconciliation, and compaction remain inactive. Start promotes to active semantics and Stop returns to passive mode.

package/node_modules/@llblab/pi-state-flow/README.md

@@ -58,17 +58,20 @@ Active State Flow episodes remain **opt-in**, while passive durable memory boots
 The same semantic planes exist at every scope:
 
 - `contract`: Requirements, decisions, constraints, and interface commitments.
-- `working`: Observations, results, unresolved questions, and what to do next.
+- `working`: Observations, results, unresolved questions, and possible next steps.
+- `intents`: Courses of action the agent has actually committed to pursue.
 - `artifacts`: Source-addressed descriptions and reusable compiled knowledge.
 - `response`: The latest complete answer, captured by the runtime.
 - `lazy`: Durable, versioned memory omitted from ordinary context until explicitly read.
 
-Memory overlays **global → project CWD → session**. Put reusable cross-project knowledge in global, project knowledge in CWD, and private task continuation in session. Hot planes carry what must matter now; `lazy` retains what may matter later without hydrating its body into every prompt.
+Memory overlays **global → project CWD → session**. Put reusable cross-project knowledge in global, project knowledge in CWD, and private task continuation in session. Hot planes carry what must matter now; `lazy` retains what may matter later without hydrating its body into every prompt. An intent stays hot only while its course remains chosen and disappears when fulfilled, abandoned, superseded, or impossible. It may refer to supporting detail through a structured `{"$ref":"cwd.lazy.plan"}` value or a `$`-prefixed state path inside ordinary prose, such as `$effective.lazy.memory[7]`. Both remain semantic content interpreted by the agent: State Flow never parses, validates, hydrates, executes, or completes them automatically. The agent never scans references for breakage. Only when current work already follows one and a single value path is missing does State Flow perform a bounded exact reverse lookup. Matching durable sources produce a top-level `{value:null, hint:[...]}` sentinel whose typed hint names runtime-verified current owning paths and asks the agent to reconcile them. Keys, patch, batch, and unmatched reads retain ordinary all-or-error behavior; no match does not prove that the agent invented the path. The agent may then repair or remove a proven stale locator in its owning value.
 
 **Resuming an existing Pi session restores its selected State Flow state and enablement.** A genuinely new session starts with an empty session layer and inherits only shared global/CWD memory; it does not resume another session's private work. Tree navigation follows the selected branch, not whichever state happens to be at Git `HEAD`.
 
 The agent uses `read_state` for exact current or historical paths. Unscoped paths read the effective overlay; `global`, `cwd`, and `session` address ownership directly; `[n]` selects one of up to seven prior accepted transition boundaries. Bounded array ranges and `value`, `keys`, or `patch` projections support progressive reads without hydrating whole lazy collections. Git-backed stores retain older committed history separately.
 
+Two packaged Skills keep guidance proportional: `state-flow-guide` resolves concrete operational questions about reading, patching, inheritance, acquisition, finalization, and recovery; `state-flow-memory` performs one bounded explicit or phase-boundary curation. Neither runs background maintenance.
+
 ## Boundaries worth knowing
 
 - `Not a second agent loop`: State Flow adds memory to Pi; it does not run background reasoning or replace session controls.

package/node_modules/@llblab/pi-state-flow/dist/lib/durable.d.ts

@@ -1,6 +1,6 @@
 import { type ArtifactProvenanceRegistry } from "./artifact.ts";
 import { type ScopeStream, type TemporalState } from "./temporal.ts";
-import type { StateScope } from "./state.ts";
+import { type StateScope } from "./state.ts";
 /** Canonical semantic sources plus runtime-owned temporal metadata. */
 export interface ScopeStreamSources {
     checkpoint: string;

package/node_modules/@llblab/pi-state-flow/dist/lib/durable.js

@@ -5,6 +5,7 @@ import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { parseArtifactProvenanceRegistry, serializeArtifactProvenanceRegistry, } from "./artifact.js";
 import { canonicalJson, isJsonValue, isObject } from "./json.js";
 import { validateScopeStream, validateTemporalState } from "./temporal.js";
+import { migratePreIntentState } from "./state.js";
 const SESSION_KEY_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
 const STATE_FILE = "state.json";
 const CHECKPOINT_FILE = "checkpoint.json";
@@ -65,6 +66,7 @@ export function classifyScopeStream(checkpointSource, patchesSource, scope, expe
     }
     const temporal = meta?.temporal;
     if (isObject(temporal) && Object.hasOwn(temporal, "checkpoint") && Array.isArray(temporal.patches)) {
+        checkpoint = migratePreIntentState(checkpoint) ?? checkpoint;
         const owner = meta?.owner;
         if (scope === "cwd" && expectedCwd !== undefined
             && (!isObject(owner) || Object.keys(owner).join(",") !== "cwd" || owner.cwd !== resolve(expectedCwd))) {
@@ -94,6 +96,11 @@ export function classifyScopeStream(checkpointSource, patchesSource, scope, expe
     else if (scope === "cwd" && expectedCwd !== undefined) {
         throw new Error("State Flow CWD scope identity is missing");
     }
+    if (isObject(legacyCheckpoint) && isObject(legacyCheckpoint.state)) {
+        const migrated = migratePreIntentState(legacyCheckpoint.state);
+        if (migrated)
+            legacyCheckpoint = { ...legacyCheckpoint, state: migrated };
+    }
     const stream = { checkpoint: legacyCheckpoint, patches };
     validateScopeStream(stream, scope);
     return { kind: "present", stream };

package/node_modules/@llblab/pi-state-flow/dist/lib/extension.d.ts

@@ -1,4 +1,5 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { formatPatchStateArguments, normalizePatchStateArguments } from "./protocol.ts";
 import { type StateFlowTelegramLoader } from "./telegram.ts";
 import { type MaterializedState, type StateScope } from "./state.ts";
 export interface StateFlowExtensionOptions {
@@ -17,11 +18,8 @@ export interface StateFlowExtensionOptions {
         tools?: boolean;
     };
 }
+export { formatPatchStateArguments, normalizePatchStateArguments };
 export declare const PATCH_STATE_TOOL_NAME = "patch_state";
 export declare const READ_STATE_TOOL_NAME = "read_state";
 export declare const MAX_FALLBACK_ATTEMPTS: number;
-/** Keep successful patch JSON valid while separating adjacent scopes and memory sections visually. */
-export declare function formatPatchStateArguments(args: unknown): string;
-/** Normalize a bounded compatibility superset without advertising aliases in the model-facing contract. */
-export declare function normalizePatchStateArguments(args: unknown): any;
 export default function stateFlowExtension(pi: ExtensionAPI, options?: StateFlowExtensionOptions): void;

package/node_modules/@llblab/pi-state-flow/dist/lib/extension.js

@@ -2,97 +2,38 @@ import { randomUUID } from "node:crypto";
 import { StringEnum, Type } from "@earendil-works/pi-ai";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
-import { assistantToolCallCount, finalizedAssistantResponse, stateFlowProtocol } from "./protocol.js";
+import { assistantToolCallCount, finalizedAssistantResponse, formatPatchStateArguments, normalizePatchStateArguments, separatedFailure, separatedOutput, stateFlowProtocol } from "./protocol.js";
 import { createPassiveContinuation, currentRunTrajectory, lazyNavigationHint, passiveContinuationMessages, runtimeContextMessage, syntheticUser, VALIDATION_MESSAGE_TYPE, withoutPrivateValidation } from "./context.js";
 import { ArtifactReadTracker } from "./acquisition.js";
 import { loadStateFlowConfig } from "./config.js";
 import { createStateFlowTelegramAdapter } from "./telegram.js";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { isAbsolute, resolve } from "node:path";
 import { SkillReadTracker } from "./skills.js";
 import { emptySnapshot, migrationFailure, persistableSnapshot, RevisionUnavailableError } from "./snapshot.js";
 import { readNativeSessionHeader } from "./continuation.js";
 import { MissingSessionRuntimeError, SharedScopeRemovalConflictError, TemporalRuntime } from "./runtime.js";
 import { emptyState, overlayStates, projectStateForModel } from "./state.js";
 import { commitScopedTransition, stageAtomicScopePatches, stageScopedTransition, validateFinalEligibility } from "./transition.js";
-import { discoverSnapshotData, hasPriorConversation, isNewSession, SNAPSHOT_ENTRY_TYPE } from "./session.js";
+import { discoverSnapshotData, findAssistantToolBatch, findPassiveStopBoundary, hasPriorConversation, isNewSession, retainsPhysicalSessionProjection, SNAPSHOT_ENTRY_TYPE } from "./session.js";
 import { compactStatus, detailedStatus, STATUS_KEY } from "./status.js";
 import { completeRun, prepareRun, resumeEpisode, startEpisode, stopEpisode } from "./episode.js";
 import { recoverSnapshot } from "./recovery.js";
-import { resolveRemotePublicationPolicy, serializeRemotePublicationPolicyDocument } from "./publication.js";
-import { coalescePublicationTarget, createPublicationQueue } from "./publication.js";
-import { acquirePublicationWorkerLease, loadPublicationQueue, publicationQueuePath, removePublicationQueue, savePublicationQueue } from "./publication.js";
-import { runPublicationWorker } from "./publication.js";
+import { loadPublicationQueue, publicationQueuePath, PublicationWorkerController, resolveRemotePublicationPolicy, serializeRemotePublicationPolicyDocument } from "./publication.js";
 import { getKnowledgeRoot, GlobalMarkdownDiscovery } from "./discovery.js";
 import { canonicalJson, isObject, sameJson } from "./json.js";
 import { readProjectedState, readStatePath } from "./query.js";
 import { cwdScopeKey, resolveSessionAddress, sessionScopeKey, } from "./durable.js";
 import { projectRecentTransitionsWithLimit, RECENT_TRANSITION_LIMIT } from "./history.js";
-import { appendStateFlowDiagnostic, projectDiagnosticContent, stateFlowLogPath } from "./logging.js";
+import { StateFlowDiagnosticWriter, stateFlowLogPath } from "./logging.js";
 import { isGitCommitAncestor, pushGitCommit, pushGitTarget, resolveGitPushDestination } from "./git.js";
 import { ORDINARY_ARTIFACT_COMPILER, planArtifactInvalidation, } from "./artifact.js";
 import { hasCompactionSizedTranscript, planStateFlowCompaction, shouldRequestStateFlowCompaction, stateFlowCompactionResult } from "./compaction.js";
+export { formatPatchStateArguments, normalizePatchStateArguments };
 export const PATCH_STATE_TOOL_NAME = "patch_state";
 export const READ_STATE_TOOL_NAME = "read_state";
 export const MAX_FALLBACK_ATTEMPTS = 2;
 const PASSIVE_STOP_ENTRY_TYPE = "state-flow-passive-stop";
 const PUBLICATION_SHUTDOWN_WAIT_MS = 2_000;
-const PATCH_DISPLAY_SECTION_KEYS = new Set([
-    "global",
-    "cwd",
-    "session",
-    "artifacts",
-    "contract",
-    "working",
-    "response",
-    "final",
-]);
-/** Keep successful patch JSON valid while separating adjacent scopes and memory sections visually. */
-export function formatPatchStateArguments(args) {
-    const seenAtIndent = new Set();
-    return JSON.stringify(args, null, 2).split("\n").flatMap((line) => {
-        const indent = line.length - line.trimStart().length;
-        const match = /^(\s+)"([^"]+)":/.exec(line);
-        if (match === null || !PATCH_DISPLAY_SECTION_KEYS.has(match[2])) {
-            for (const seenIndent of seenAtIndent) {
-                if (seenIndent > indent)
-                    seenAtIndent.delete(seenIndent);
-            }
-            return [line];
-        }
-        const separator = seenAtIndent.has(indent) ? [""] : [];
-        seenAtIndent.add(indent);
-        return [...separator, line];
-    }).join("\n");
-}
-/** Normalize a bounded compatibility superset without advertising aliases in the model-facing contract. */
-export function normalizePatchStateArguments(args) {
-    if (!isObject(args) || !Object.hasOwn(args, "final"))
-        return args;
-    const value = args.final;
-    let final;
-    if (typeof value === "boolean")
-        final = value;
-    else if (value === 1)
-        final = true;
-    else if (value === 0)
-        final = false;
-    else if (typeof value === "string" && value.trim().toLowerCase() === "true")
-        final = true;
-    else if (typeof value === "string" && value.trim().toLowerCase() === "false")
-        final = false;
-    else
-        return args;
-    return { ...args, final };
-}
-/** Keep tool output visually separated from its heading with exactly one leading newline. */
-function separatedOutput(text) {
-    return `\n${text.replace(/^\n+/, "")}`;
-}
-/** Keep a failed tool invocation visually separated from its rendered error without changing error semantics. */
-function separatedFailure(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return new Error(separatedOutput(message), error instanceof Error ? { cause: error } : undefined);
-}
 export default function stateFlowExtension(pi, options = {}) {
     const agentDir = options.agentDir ?? getAgentDir();
     const loadedConfig = loadStateFlowConfig(agentDir, options.repositoryRoot);
@@ -125,15 +66,19 @@ export default function stateFlowExtension(pi, options = {}) {
     let pendingPublication;
     let rehydrationPhase;
     let turnPublicationTarget;
-    const activePublicationWorkers = new Map();
-    let publicationStopped = false;
     let publicationShutdown;
     const repositoryRoot = resolve(options.repositoryRoot ?? config.directory);
+    const diagnosticWriter = new StateFlowDiagnosticWriter(config.logging, stateFlowLogPath(agentDir), repositoryRoot, (message) => activeContext?.ui.notify(message, "warning"));
+    const publicationWorker = new PublicationWorkerController({
+        resolveDestination: () => resolveGitPushDestination(repositoryRoot),
+        isAncestor: (ancestor, descendant) => isGitCommitAncestor(repositoryRoot, ancestor, descendant),
+        push: (destination, target, signal) => pushGitTarget(repositoryRoot, destination, target, signal),
+        onDiverged: (dropped, target) => activeContext && recordDiagnostic(`Retired publication queue target ${dropped.target} after a journal lineage rewrite; retargeting to ${target}`, "publication-conflict", activeContext),
+    });
     const skillReads = new SkillReadTracker();
     const artifactReads = new ArtifactReadTracker();
     const globalMarkdown = new GlobalMarkdownDiscovery(options.knowledgeRoot ?? getKnowledgeRoot(agentDir));
     let artifactInvalidations = [];
-    let loggingWarningReported = false;
     let telegramStartPending = false;
     function sessionAddress(ctx) {
         return resolveSessionAddress(ctx.sessionManager.getSessionFile(), ctx.sessionManager.getSessionId(), ctx.sessionManager.getHeader()?.timestamp);
@@ -184,29 +129,6 @@ export default function stateFlowExtension(pi, options = {}) {
         skillReads.clear();
         artifactReads.clear();
     }
-    function passiveStopBoundary(ctx) {
-        for (const entry of [...ctx.sessionManager.getBranch()].reverse()) {
-            try {
-                if (entry?.type !== "custom" || entry.customType !== PASSIVE_STOP_ENTRY_TYPE)
-                    continue;
-                const { at, from, reset, owner } = entry.data ?? {};
-                if (reset === true && owner === ctx.sessionManager.getSessionId())
-                    return undefined;
-                if (typeof at === "number" && Number.isSafeInteger(at) && at >= 0)
-                    return {
-                        at,
-                        ...(typeof from === "number" && Number.isSafeInteger(from) && from >= 0 ? { from } : {}),
-                    };
-            }
-            catch {
-                // A hostile unrelated branch entry cannot manufacture or suppress a valid marker.
-            }
-        }
-        return undefined;
-    }
-    function retainsPhysicalSessionProjection(reason) {
-        return reason === undefined || reason === "startup" || reason === "reload" || reason === "resume";
-    }
     function deferArtifactRefresh() {
         artifactInvalidations = [];
         artifactReads.setCandidates([]);
@@ -252,22 +174,6 @@ export default function stateFlowExtension(pi, options = {}) {
             ? [...new Set([...active, ...owned])]
             : active.filter((name) => !owned.includes(name)));
     }
-    function assistantToolBatch(ctx, toolCallId) {
-        for (let cursor = ctx.sessionManager.getLeafEntry(); cursor; cursor = cursor.parentId ? ctx.sessionManager.getEntry(cursor.parentId) : undefined) {
-            const entry = cursor;
-            if (entry.type !== "message" || entry.message?.role !== "assistant" || !Array.isArray(entry.message.content))
-                continue;
-            const calls = entry.message.content.filter((block) => {
-                return typeof block === "object" && block !== null
-                    && block.type === "toolCall"
-                    && typeof block.id === "string"
-                    && typeof block.name === "string";
-            });
-            if (calls.some(({ id }) => id === toolCallId))
-                return calls.map(({ name }) => name);
-        }
-        return undefined;
-    }
     function recordPublication(publication, ctx) {
         const revision = publication.revision ?? publication.commit;
         if (revision !== undefined)
@@ -294,8 +200,8 @@ export default function stateFlowExtension(pi, options = {}) {
             return;
         turnPublicationTarget = target;
         try {
-            enqueueTurnPublication(ctx);
-            launchPublicationWorker();
+            enqueueTurnPublication();
+            publicationWorker.launch();
         }
         catch (error) {
             ctx.ui.notify(`State Flow accepted the local commit; remote publication is deferred: ${error instanceof Error ? error.message : String(error)}`, "warning");
@@ -338,104 +244,17 @@ export default function stateFlowExtension(pi, options = {}) {
         persist();
         return true;
     }
-    function enqueueTurnPublication(ctx) {
+    function enqueueTurnPublication() {
         const target = turnPublicationTarget;
         turnPublicationTarget = undefined;
-        if (!target)
-            return;
-        const destination = resolveGitPushDestination(repositoryRoot);
-        if (!destination)
-            return;
-        const path = publicationQueuePath(destination);
-        const previous = loadPublicationQueue(path);
-        const next = previous
-            ? coalescePublicationTarget(previous, destination, target, (ancestor, descendant) => isGitCommitAncestor(repositoryRoot, ancestor, descendant), {
-                onDivergedLineage: (dropped) => recordDiagnostic(`Retired publication queue target ${dropped.target} after a journal lineage rewrite; retargeting to ${target}`, "publication-conflict", ctx),
-            })
-            : createPublicationQueue(destination, target);
-        savePublicationQueue(path, next, previous);
-    }
-    function launchPublicationWorker() {
-        if (publicationStopped)
-            return;
-        let destination;
-        try {
-            destination = resolveGitPushDestination(repositoryRoot);
-        }
-        catch (error) {
-            if (error instanceof Error && /ENOENT/.test(error.message))
-                return;
-            throw error;
-        }
-        if (!destination)
-            return;
-        const path = publicationQueuePath(destination);
-        if (activePublicationWorkers.has(path))
-            return;
-        let queued;
-        let lease;
-        try {
-            queued = loadPublicationQueue(path);
-            if (!queued)
-                return;
-            lease = acquirePublicationWorkerLease(path);
-        }
-        catch {
-            return;
-        }
-        if (!lease)
-            return;
-        const controller = new AbortController();
-        const done = runPublicationWorker(queued, ({ target }) => pushGitTarget(repositoryRoot, destination, target, controller.signal), () => loadPublicationQueue(path) ?? queued, (ancestor, descendant) => isGitCommitAncestor(repositoryRoot, ancestor, descendant)).then((result) => {
-            if (publicationStopped)
-                return; // Late outcomes belong to an unconfirmed queue, not the replacement generation.
-            const current = loadPublicationQueue(path);
-            if (!current)
-                return;
-            if (result.next === undefined) {
-                if (current.target === result.attempted.target)
-                    removePublicationQueue(path, current);
-                return;
-            }
-            if (current.target === result.attempted.target || result.next.target === current.target) {
-                savePublicationQueue(path, result.next, current);
-            }
-        }).catch(() => {
-            // Queue/CAS truth remains durable; status and a later activation expose retry.
-        }).finally(() => {
-            activePublicationWorkers.delete(path);
-            try {
-                lease.release();
-                if (!publicationStopped && loadPublicationQueue(path)?.status === "pending")
-                    launchPublicationWorker();
-            }
-            catch {
-                // Failed lease cleanup or malformed persistence stays inert until retry or repair.
-            }
-        });
-        activePublicationWorkers.set(path, { controller, done });
+        if (target)
+            publicationWorker.enqueue(target);
     }
     function shutdownPublicationWorkers(ctx) {
-        publicationStopped = true;
-        return publicationShutdown ??= (async () => {
-            const workers = [...activePublicationWorkers.values()];
-            for (const { controller } of workers)
-                controller.abort();
-            if (workers.length === 0)
-                return;
-            let timeout;
-            try {
-                const completed = await Promise.race([
-                    Promise.all(workers.map(({ done }) => done)).then(() => true),
-                    new Promise((resolve) => { timeout = setTimeout(() => resolve(false), PUBLICATION_SHUTDOWN_WAIT_MS); }),
-                ]);
-                if (!completed)
-                    ctx.ui.notify(`State Flow push cleanup is unconfirmed after ${PUBLICATION_SHUTDOWN_WAIT_MS}ms; worker leases remain held until child exit.`, "warning");
-            }
-            finally {
-                clearTimeout(timeout);
-            }
-        })();
+        return publicationShutdown ??= publicationWorker.shutdown(PUBLICATION_SHUTDOWN_WAIT_MS).then((completed) => {
+            if (!completed)
+                ctx.ui.notify(`State Flow push cleanup is unconfirmed after ${PUBLICATION_SHUTDOWN_WAIT_MS}ms; worker leases remain held until child exit.`, "warning");
+        });
     }
     function retryPendingPush(ctx) {
         if (pendingPublication === undefined || !runtime?.view)
@@ -447,8 +266,8 @@ export default function stateFlowExtension(pi, options = {}) {
             if (mode === "turn-end") {
                 turnPublicationTarget = target;
                 try {
-                    enqueueTurnPublication(ctx);
-                    launchPublicationWorker();
+                    enqueueTurnPublication();
+                    publicationWorker.launch();
                 }
                 catch (error) {
                     ctx.ui.notify(`State Flow retained local state; asynchronous publication recovery is deferred: ${error instanceof Error ? error.message : String(error)}`, "warning");
@@ -655,7 +474,7 @@ export default function stateFlowExtension(pi, options = {}) {
             ctx.ui.notify(`State Flow restored disabled: ${snapshot.meta.validation.error}`, "error");
         }
         if (retainsPhysicalSessionProjection(sessionStartReason) && runtime?.view) {
-            const boundary = passiveStopBoundary(ctx);
+            const boundary = findPassiveStopBoundary(ctx.sessionManager.getBranch(), ctx.sessionManager.getSessionId(), PASSIVE_STOP_ENTRY_TYPE);
             if (boundary !== undefined) {
                 const continuation = createPassiveContinuation(projectStateForModel(overlayStates(scopeStates.global, scopeStates.cwd, scopeStates.session)), boundary.at, boundary.from);
                 if (!snapshot.config.enabled)
@@ -679,34 +498,7 @@ export default function stateFlowExtension(pi, options = {}) {
         updateUi(ctx);
     }
     function recordDiagnostic(error, category, ctx, extras = {}) {
-        if (!config.logging)
-            return;
-        try {
-            const path = stateFlowLogPath(agentDir);
-            const fromRepository = relative(repositoryRoot, path);
-            if (fromRepository === "" || (!isAbsolute(fromRepository) && fromRepository !== ".." && !fromRepository.startsWith(`..${sep}`))) {
-                throw new Error("diagnostic path overlaps the State Flow repository");
-            }
-            appendStateFlowDiagnostic(path, {
-                at: new Date().toISOString(),
-                sessionId: sessionAddress(ctx).id,
-                cwd: resolve(ctx.cwd),
-                category,
-                error,
-                ...(extras.content === undefined ? {} : { content: projectDiagnosticContent(extras.content) }),
-                ...(extras.input === undefined ? {} : { input: extras.input }),
-                ...(extras.tool === undefined ? {} : { tool: extras.tool }),
-                ...(extras.toolCallId === undefined ? {} : { toolCallId: extras.toolCallId }),
-                ...(extras.resolutionAttempt === undefined ? {} : { resolutionAttempt: extras.resolutionAttempt }),
-                ...(extras.terminalEligible === undefined ? {} : { terminalEligible: extras.terminalEligible }),
-            });
-        }
-        catch (failure) {
-            if (loggingWarningReported)
-                return;
-            loggingWarningReported = true;
-            ctx.ui.notify(`State Flow could not write diagnostics: ${failure instanceof Error ? failure.message : String(failure)}`, "warning");
-        }
+        diagnosticWriter.record(sessionAddress(ctx).id, ctx.cwd, error, category, extras);
     }
     function continueFallbackResolution(lastWarning) {
         resolutionPending = true;
@@ -1171,7 +963,7 @@ export default function stateFlowExtension(pi, options = {}) {
     pi.on("tool_call", (event, ctx) => {
         if (!snapshot.config.enabled)
             return;
-        const batch = assistantToolBatch(ctx, event.toolCallId);
+        const batch = findAssistantToolBatch(ctx.sessionManager, event.toolCallId);
         const patchCalls = batch?.filter((name) => name === PATCH_STATE_TOOL_NAME).length ?? 0;
         if (patchCalls > 0) {
             if (patchCalls !== 1) {
@@ -1245,9 +1037,9 @@ export default function stateFlowExtension(pi, options = {}) {
             responseCommitted = true;
             bootstrapContinuation = undefined;
             rehydrationPhase = "step";
-            enqueueTurnPublication(ctx);
+            enqueueTurnPublication();
             if (snapshot.meta.remotePublication?.mode === "turn-end")
-                launchPublicationWorker();
+                publicationWorker.launch();
             completedRunAccepted = !wasBootstrap;
         }
         catch (error) {
@@ -1279,7 +1071,7 @@ export default function stateFlowExtension(pi, options = {}) {
             startStateFlow(ctx);
         }
         if (snapshot.meta.remotePublication?.mode === "turn-end")
-            launchPublicationWorker();
+            publicationWorker.launch();
         if (!completedRunAccepted || compactionStopped || !snapshot.config.enabled || snapshot.meta.bootstrap || resolutionPending
             || compactionInFlight || !ctx.isIdle() || ctx.hasPendingMessages() || !snapshot.meta.durableBase
             || !shouldRequestStateFlowCompaction(ctx.getContextUsage()))
@@ -1304,7 +1096,7 @@ export default function stateFlowExtension(pi, options = {}) {
         restoreActiveBranch(ctx, event.reason);
         retryPendingPush(ctx);
         if (snapshot.meta.remotePublication?.mode === "turn-end")
-            launchPublicationWorker();
+            publicationWorker.launch();
         updateUi(ctx);
         void telegram.ensure();
     });

package/node_modules/@llblab/pi-state-flow/dist/lib/history.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { isJsonValue, isObject, sameJson, validatePatch } from "./json.js";
 export const RECENT_TRANSITION_LIMIT = 7;
 const SCOPES = new Set(["global", "cwd", "session"]);
-const PATCH_KEYS = new Set(["artifacts", "contract", "working", "response", "lazy"]);
+const PATCH_KEYS = new Set(["artifacts", "contract", "working", "intents", "response", "lazy"]);
 /** Normalize accepted replacements into recursive-merge replay, including removals. */
 function replayPatch(before, after) {
     const entries = [];