@llblab/pi-kit 0.25.0 → 0.27.0

package/node_modules/@llblab/pi-command-fast/dist/models-json.js

@@ -0,0 +1,81 @@
+/** Domain: model overrides. Owns: targeted JSONC reads/toggles and atomic replacement. Excludes: provider semantics and locking. */
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import { applyEdits, modify, parse } from "jsonc-parser";
+export function modelsJsonPath() {
+    return join(getAgentDir(), "models.json");
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readConfig(path, target) {
+    let text;
+    let mode = 0o600;
+    try {
+        text = readFileSync(path, "utf8");
+        mode = statSync(path).mode & 0o777;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        text = "{}\n";
+    }
+    const errors = [];
+    const source = text.replace(/^\uFEFF/, "");
+    const config = parse(source, errors, { allowTrailingComma: true });
+    if (errors.length || !isRecord(config))
+        throw new Error("Invalid models.json");
+    // Missing containers are valid edit targets; existing non-object containers are not.
+    let current = config;
+    for (const key of ["providers", target.provider, "modelOverrides", target.id]) {
+        if (!isRecord(current))
+            throw new Error("Invalid model override structure in models.json");
+        current = Object.hasOwn(current, key) ? current[key] : undefined;
+        if (current === undefined)
+            return { text, source, mode, value: undefined };
+    }
+    if (!isRecord(current))
+        throw new Error("Invalid model override structure in models.json");
+    return { text, source, mode, value: Object.hasOwn(current, target.property) ? current[target.property] : undefined };
+}
+export function isModelOverrideValue(target, path = modelsJsonPath()) {
+    try {
+        return readConfig(path, target).value === target.enabledValue;
+    }
+    catch {
+        return false; // Failure is local to Fast; usage polling must continue.
+    }
+}
+/** Re-read at every toggle; OFF is property absence, never a sentinel value. */
+export function toggleModelOverrideValue(target, path = modelsJsonPath()) {
+    let temporary;
+    try {
+        const { text, source, mode, value } = readConfig(path, target);
+        const enabled = value === target.enabledValue;
+        const edits = modify(source, ["providers", target.provider, "modelOverrides", target.id, target.property], enabled ? undefined : target.enabledValue, { formattingOptions: { insertSpaces: true, tabSize: 2, eol: source.includes("\r\n") ? "\r\n" : "\n" } });
+        const next = applyEdits(source, edits);
+        const errors = [];
+        parse(next, errors, { allowTrailingComma: true });
+        if (errors.length)
+            throw new Error("Could not safely edit JSONC");
+        mkdirSync(dirname(path), { recursive: true });
+        temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+        writeFileSync(temporary, (text.startsWith("\uFEFF") ? "\uFEFF" : "") + next, { flag: "wx", mode });
+        renameSync(temporary, path);
+        temporary = undefined;
+        return !enabled;
+    }
+    catch (error) {
+        throw new Error(`Could not update models.json: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        if (temporary) {
+            try {
+                unlinkSync(temporary);
+            }
+            catch { /* Preserve the original write failure. */ }
+        }
+    }
+}

package/node_modules/@llblab/pi-command-fast/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@llblab/pi-command-fast",
+  "version": "0.1.0",
+  "description": "Shared Fast command arbitration and per-model JSONC overrides for Pi consumers",
+  "private": false,
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/llblab/pi-command-fast.git"
+  },
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist/",
+    "README.md",
+    "AGENTS.md",
+    "BACKLOG.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "npm run build && node --test tests/*.test.mjs",
+    "test:pi": "node scripts/test-packed-pi.mjs",
+    "check": "node -e \"import('./dist/index.js').then(() => console.log('pi-command-fast: library import ok'))\"",
+    "pack:dry": "npm pack --dry-run",
+    "validate": "npm run test && npm run check && npm audit --omit=peer && npm run pack:dry",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "jsonc-parser": "^3.3.1"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": ">=1.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.9.0"
+  }
+}

package/node_modules/@llblab/pi-grow-loop/AGENTS.md

@@ -2,6 +2,7 @@
 
 ## Meta-Protocol Principles
 
+- `Pi Baseline`: Require Pi ≥1.0.0 in peer metadata, dependency locks and source/packaged compatibility tests; preserve settled-event scheduling and operator interruption semantics.
 - `Constraint-Driven Evolution`: Add loop complexity only after real runs expose durable constraints.
 - `Single Source of Truth`: Keep durable rules in `AGENTS.md`, open work in `BACKLOG.md`, completed delivery in `CHANGELOG.md`, and operator-facing usage in `README.md`.
 - `Clean Backlog`: `BACKLOG.md` must contain only unresolved open work. When a task is completed, move the outcome into `CHANGELOG.md` and remove the completed item from `BACKLOG.md` instead of leaving checked-off history there.

package/node_modules/@llblab/pi-grow-loop/CHANGELOG.md

@@ -1,6 +1,9 @@
 # Changelog
 
-## Unreleased
+## 0.9.0: Pi 1.0 Baseline and Package Licensing
+
+- `Licensing`: Includes the MIT LICENSE in source checkouts and npm packages, preserving existing author attribution.
+- `Pi Baseline`: Requires Pi 1.0.0 or newer, with aligned peer metadata, dependency locks and package tests. Settled-event scheduling, interruption, continuation status and optional Telegram mirroring are unchanged.
 
 ## 0.8.2: Filterable Skills and drift-safe Git installs
 

package/node_modules/@llblab/pi-grow-loop/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 llblab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@llblab/pi-grow-loop/README.md

@@ -8,7 +8,7 @@ The agent owns scope, evidence, priority, safety, and the decision to continue o
 
 ## Quick Start
 
-Requires Pi `0.80.4` or newer for the settled-agent lifecycle event.
+Requires Pi `1.0.0` or newer; the settled-agent lifecycle event remains the continuation boundary.
 
 Install from npm:
 

package/node_modules/@llblab/pi-grow-loop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-grow-loop",
-  "version": "0.8.2",
+  "version": "0.9.0",
   "private": false,
   "description": "Semantic loop-engineering for agent-owned, visible, interruptible continuation in Pi",
   "keywords": [
@@ -37,6 +37,7 @@
     "prepack": "npm run build"
   },
   "files": [
+    "LICENSE",
     "banner.jpg",
     "index.ts",
     "dist",
@@ -56,7 +57,7 @@
     "image": "https://raw.githubusercontent.com/llblab/pi-grow-loop/main/banner.jpg"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": ">=0.80.4",
+    "@earendil-works/pi-coding-agent": ">=1.0.0",
     "typebox": "*"
   },
   "devDependencies": {

package/node_modules/@llblab/pi-state-flow/AGENTS.md

@@ -4,6 +4,7 @@ The [relocation ledger](docs/agent-contract-relocation.md) maps every pre-compac
 
 ## Ownership and semantics
 
+- Require matching Pi coding-agent, agent-core, AI and TUI packages at ≥1.0.0; pin the local verification stack to 1.0.0 and preserve the documented limits of fixture evidence.
 - Keep `index.ts` minimal, independent domains in `lib/` with same-named tests, architecture checks in `tests/invariants.test.ts`, and Pi lifecycle composition in `lib/extension.ts`; delegate low-level mechanics to their owners. See [composition](docs/architecture.md#composition).
 - Keep Off the genuinely new-session default, with Passive and Active opt-in; Off removes State Flow model tools/context without deleting memory. Modes belong to the current session; global mode is only a new-session default. Passive declares both tools even without memory, but contributes protocol/projected state only with a validated view. See [mode behavior](docs/usage.md#active-passive-and-configured-off) and [configuration](docs/usage.md#configuration).
 - Preserve Pi's native tool loop, trace and foreign context; the context domain alone projects the raw scope overlay. Freeze/rebase the head only at specified boundaries, retain current-run trajectory and stable-position tail notices, and never give projection IDs or guessed user anchors publication/compaction authority. See [Pi lifecycle](docs/architecture.md#pi-lifecycle) and [projection evidence](docs/performance.md#context-projection-and-trajectory-selection).
@@ -17,25 +18,25 @@ The [relocation ledger](docs/agent-contract-relocation.md) maps every pre-compac
 
 - Treat canonical scope files as semantic authority and Git only as optional backup. Classify complete, wholly absent, partial and malformed cohorts before recovery; absent shared pairs may initialize only under accepted authority, while incomplete/private evidence fails closed. Never repair through ad-hoc writes. See [storage recovery](docs/usage.md#storage-and-recovery) and [transaction rule](docs/filesystem-recovery.md#transaction-rule).
 - Keep exact regular-file, byte-CAS and lock-serialized publication with cancelable waits, single-use callback-scoped capabilities and guarded rollback. Never hold exclusion across inference, source acquisition or Git; do not steal interrupted locks, claim kernel-atomic multi-file publication or promise power-loss durability. See [asynchronous transaction](docs/architecture.md#asynchronous-storage-transaction) and [durability boundary](docs/filesystem-recovery.md#power-loss-durability).
-- Restore selected private retained boundaries over live shared scopes and copy exact proven source-session history into a fresh fork owner; never substitute current, empty, Git or another branch on expiry/failure. Explicit Start instead validates current same-session authority. Only accepted candidates install cache, checkpoint and mode. See [Pi lifecycle](docs/architecture.md#pi-lifecycle) and [fork contract](docs/fork-contract.md).
-- Persist each material semantic change and its affected revisions exactly once, including accepted Session responses. Optional settled-turn Git backup may capture only already-accepted owned files, leave unrelated index/worktree data intact and push without force or semantic side effects. Defer busy backup on Pi 0.87 rather than blocking Abort; never move it to `turn_end` or add a durable push queue. See [optional Git backup](docs/architecture.md#optional-git-backup).
+- Attach Off branches through native policy bookkeeping only, deferring memory acquisition and recovery diagnostics until explicit Passive/Active. Preserve pending Off forks across cold reload with child-owned native markers, without reading the parent header/store until acquisition. When memory is selected, restore private retained boundaries over live shared scopes and copy exact proven source-session history into a fresh fork owner; never substitute current, empty, Git or another branch on expiry/failure. Explicit Start instead validates current same-session authority. Only accepted candidates install cache, checkpoint and mode. See [Pi lifecycle](docs/architecture.md#pi-lifecycle) and [fork contract](docs/fork-contract.md).
+- Persist each material semantic change and its affected revisions exactly once, including accepted Session responses. Optional settled-turn Git backup may capture only already-accepted owned files, leave unrelated index/worktree data intact and push without force or semantic side effects. Defer busy backup when the host provides no settlement operation signal rather than blocking Abort; never move it to `turn_end` or add a durable push queue. Off cancels owned captures/pushes and suppresses late reporting; normal agent-operation completion must not cancel an independently admitted push, and foreign callers' pushes retain ownership. See [optional Git backup](docs/architecture.md#optional-git-backup).
 - Accept one atomic `patch_state` cohort across supplied scopes against current shared memory; reject empty scopes, unknown/retired grammar and model-authored `response`. Correct no-ops create no transition. Enforce the single-call inference barrier before sibling tools execute and retain conservative model-facing reconciliation when a result cannot be predicted. See [model tools](docs/architecture.md#model-tools) and [Pi lifecycle](docs/architecture.md#pi-lifecycle).
 - Reconcile the actual accepted ordinary answer at `turn_end` with response-owned cancellation and one accepted lifecycle publication; do not request private repair inference, ceremonial finalization patches or roll back accepted memory after cancellation. See [Pi lifecycle](docs/architecture.md#pi-lifecycle).
 - Capture specifications without writes at `before_agent_start`, then await one cancellable preparation acceptance before active inference; abort failed context preparation through Pi's public hook. Keep user text at user authority and state as fallible data. Preserve an existing conversation for exactly one bootstrap run, not forever. See [Pi lifecycle](docs/architecture.md#pi-lifecycle) and [pre-inference cancellation](docs/compatibility.md#pre-inference-cancellation).
-- Make Start await coherent current-head acceptance, and let Passive/Off select local policy before asynchronous runtime-only persistence. Preserve independently owned fork/restoration work and latest inactive choices; a failed Stop fences writes with a native marker, never a substitute semantic checkpoint. Off exposes no frozen handoff. See [lifecycle planes](docs/architecture.md#lifecycle-planes) and [lifecycle operations](docs/usage.md#lifecycle-operations).
-- Request completed-history native compaction only after an accepted non-bootstrap settled run, public usage ≥24,000 tokens and a uniquely captured first-user anchor; retain the complete latest run and foreign context. Await its native callback before returning, and leave Pi manual/threshold compaction and append-only history alone. See [lifecycle planes](docs/architecture.md#lifecycle-planes).
+- Make Start await coherent current-head acceptance; unaccepted Off-to-Active retains deferred history and cannot confer current-memory authority on a superseding Passive choice. Passive selects local policy before asynchronous runtime-only persistence; preserve its independently owned fork/restoration work. Off instead cancels owned memory waits, clears semantic caches and records only native mode/continuation/fork bookkeeping without canonical I/O. Preserve already accepted publications and carried write fences; failed Passive persistence uses a native fence, never a substitute semantic checkpoint. Off exposes no frozen handoff. See [lifecycle planes](docs/architecture.md#lifecycle-planes) and [lifecycle operations](docs/usage.md#lifecycle-operations).
+- Request completed-history native compaction only after an accepted non-bootstrap settled run, public usage ≥24,000 tokens and a uniquely captured first-user anchor; retain the complete latest run and foreign context. Use per-request owned markers, cancel stale/inactive owned hooks without default summary fallback, and prevent old completion from clearing a new plan. Await its native callback before returning, and leave Pi manual/threshold compaction and append-only history alone. See [lifecycle planes](docs/architecture.md#lifecycle-planes).
 - Contribute only State Flow's compact normative system-prompt section through Pi's section membrane; refresh it with current mode without overwriting foreign sections, forced-prompt precedence or native message identities. Never invent a continuation scheduler. See [lifecycle planes](docs/architecture.md#lifecycle-planes) and [host context compatibility](docs/compatibility.md#context-tools-and-provider-input).
 
 ## Model and operator boundaries
 
 - Treat state as a decision-relevant handoff, not a transcript: distinguish user requirements, confirmed decisions, observations, hypotheses, chosen intents and remaining checks. Revalidate volatile external effects before repeating actions; memory is neither an action ledger nor proof of current reality. See [operational guidance](docs/architecture.md#operational-guidance-and-memory-curation) and the [memory Skill](skills/state-flow-memory/SKILL.md).
-- Resolve semantic `$` paths and structured references only when needed; never confer authority or existence by reference alone, scan to find broken references, automatically search all history or restore deleted values from hints. See [model tools](docs/architecture.md#model-tools) and [lazy navigation](docs/usage.md#lazy-navigation-and-historical-reading).
+- Resolve semantic `$` paths and structured references only when needed; never confer authority or existence by reference alone, scan to find broken references, automatically search all history or restore deleted values from hints. Sole exception: a structured `{"$ref"}` inside an `intents` entry owns its same-scope `working`/`lazy` object-key target, so deleting that intent key deletes the target after authored operations in the same atomic cohort unless a remaining same-scope intent references it, an ancestor or a descendant. That bounded read of one scope's `intents` plane never validates, rejects, warns, archives or crosses scopes; textual `$path` mentions and structured references outside `intents` stay non-owning. See [model tools](docs/architecture.md#model-tools), [intent ownership](docs/lazy-state.md#intent-ownership) and [lazy navigation](docs/usage.md#lazy-navigation-and-historical-reading).
 - Keep Skill acquisition optional and exact-path/provenance-derived; successful reads alone are volatile, and attempted durable compilations require scoped validated output plus runtime-owned hash evidence. See [artifact routing](docs/architecture.md#artifact-routing).
 - Reconcile touched state without automatic whole-store audits. Dedicated curation needs a user request; intra-store moves use one verified multi-scope patch, and external transfers need verified destination acceptance before source deletion. See [operational guidance](docs/architecture.md#operational-guidance-and-memory-curation) and the [memory Skill](skills/state-flow-memory/SKILL.md).
 - Keep opt-in diagnostic categories, failure elision/privacy and barrier-only names-only records outside canonical state; logging failures cannot change accepted state. Preserve a blank line between every tool name and its output. See [diagnostic privacy](docs/usage.md#diagnostic-logging-and-privacy) and [barrier diagnostics](docs/architecture.md#pi-lifecycle).
 - Keep public patch outputs and staged drafts detached from caller/accepted values; private path-copying must not leak mutable objects or weaken CAS. Reject stored null in documented semantic planes while preserving valid nested object-key deletions. See [storage and identity](docs/architecture.md#storage-and-identity) and [model tools](docs/architecture.md#model-tools).
 - Do not add project schemas, state/patch byte caps, dynamic growth pressure, action authorization, automatic reference hydration or strict boundedness claims for state, the turn specification, the current-run trajectory or Pi's external trace. See [model tools](docs/architecture.md#model-tools) and [operational boundaries](README.md#operational-boundaries).
-- Keep terminal status observational and mode-derived; no source maintenance or invented empty view on inspection. Optional Git, Telegram and diagnostics degrade without fabricated success or weakened memory ownership. The optional `lib/telegram.ts` presentation leaf alone may consume pi-telegram's public membranes; core semantics/storage/inference remain transport-agnostic. See [status and controls](docs/usage.md#status-and-controls) and [observability](docs/architecture.md#observability).
+- Keep terminal status observational and mode-derived; no source maintenance or invented empty view on inspection. Explicit Off inspection uses disposable current-store readers, validates private/Effective authority, and must not install cache or alter deferred branch/fork policy; automatic callbacks and rejected queued tools remain memory-inert even with logging enabled. Optional Git, Telegram and diagnostics degrade without fabricated success or weakened memory ownership. The optional `lib/telegram.ts` presentation leaf alone may consume pi-telegram's public membranes; core semantics/storage/inference remain transport-agnostic. See [status and controls](docs/usage.md#status-and-controls) and [observability](docs/architecture.md#observability).
 
 ## Delivery discipline
 

package/node_modules/@llblab/pi-state-flow/BACKLOG.md

@@ -1,20 +1,28 @@
 # Backlog
 
-The **0.23.0** release scope is recorded in [CHANGELOG.md](CHANGELOG.md); this backlog keeps installed-client evidence and later decisions open. Canonical storage, CAS, `historyLimit`, temporal semantics, projection and the model-facing protocol remain unchanged; already retained session modes and explicit global/legacy policies stay authoritative. Current contracts live in [architecture](docs/architecture.md) and [usage](docs/usage.md).
+The **0.25.0: Intent-Owned Memory** scope is implemented and locally validated; outcomes are recorded in [CHANGELOG.md](CHANGELOG.md), with package, lockfile and changelog aligned at 0.25.0. This backlog keeps publication, installed-client evidence and later decisions open. Current contracts live in [architecture](docs/architecture.md), [usage](docs/usage.md) and [intent ownership](docs/lazy-state.md#intent-ownership).
 
 ## Carried gates
 
-- **Installed 0.22.0 smoke (operator-owned):** Perform the carried check if it is not yet recorded, only against the exact released 0.22.0 installation; a reload of the modified 0.23.0 candidate cannot certify the old release. After an operator-authorized reload, confirm:
+- **0.25.0 publication (approval-gated):** Commit the prepared tree and push the exact `v0.25.0` tag; then verify the tag's successful release workflow, published GitHub Release and matching npm package before reporting release completion.
+- **Installed 0.25.0 smoke (operator-owned):** After separately authorized installation/reload, use a disposable store. In `session` and in `cwd`: open an intent with owned `working` and `lazy` entries plus one textual mention, close it, and confirm the owned entries are gone, the mentioned one remains, the receipt lists the deletions and `/state-flow-status` shares update. Then supersede an intent in one patch and confirm its targets survive.
+- **Installed 0.22.0 smoke (operator-owned):** Perform the carried check if it is not yet recorded, only against the exact released 0.22.0 installation; a reload of a later candidate cannot certify the old release. After an operator-authorized reload, confirm:
   - terminal autocomplete exposes Active/Passive/Off and status;
   - Telegram shows the single `off | passive | active` row plus the four inspection buttons;
   - current-session mode agrees across tools, context and status, and survives reload.
   Do not edit real global defaults or unrelated sessions.
 - **Installed 0.23.0 smoke (operator-owned):** After separately authorized installation/reload, confirm an unconfigured *new* session is Off without semantic writes, retained choices and explicit global modes survive, and Telegram shows one `Off | Passive | Active` radio row with the selected 🟡/🟣/🟢 marker and ⚫️ inactive markers, followed by four direct scope inspections. Isolate test storage; do not use the live store as a fixture. SDK tests alone do not certify installed-client rendering.
+- **Installed 0.24.0 smoke (approval/operator-owned):** Local lifecycle, cancellation, background-work and callback/inspection acceptance is complete; real-client behavior remains separate evidence. After separately authorized installation/reload of the exact 0.24.0 release, use a disposable store to check Off attachment and pending-work cancellation, no late memory warnings, current read-only inspections without private placeholders, preserved deferred Passive/Active/fork acquisition, and unchanged terminal/Telegram mode controls. Do not use the live store, treat its reload as evidence for older published releases, or change unrelated operator sessions.
 
-## Deferred beyond 0.23.0 (decision inputs, not commitments)
+## Deferred beyond 0.25.0 (decision inputs, not commitments)
+
+- **Convention uptake:** After some real use, read the `/state-flow-status` ownership shares; if most `working`/`lazy` entries stay unowned, revisit the protocol wording, not the mechanism.
+- **Behavioural evaluation:** Live-model comparison of Active against native compaction on one long cyclic task. Needs a policy decision first; current benchmarks are synthetic and make no model calls.
+- **Lifecycle real-use measurement (gated):** The operator install runs with `logging: true` and has no recorded `publication-conflict`, `finalization` or `barrier-block` entries; cooperating-writer waits, Stop fences and fork/restore contention are not instrumented. Removing any awaited layer for rarity first needs a decision to add opt-in counters.
+- **Lifecycle state as one tagged union:** The 0.25.0 lifecycle review left 17 closure bindings in `lib/extension.ts`, each a justified selection, run or host fact. Remaining candidates: the seven branch-selection facts (`snapshot`, `runtime`, `branchStartsWithoutRuntime`, `selectedHistoryExpired`, `modePersistenceError`, `forkInitialization`, `deferredBranch`) as one Off-deferred/attached union, and `passiveContinuation`/`bootstrapContinuation` as one continuation slot once their exclusivity is proven. Decide only with a behavioural reason; no further mechanical moves are pending.
+- **Skill compilation fidelity:** Hashes detect source change, not a lossy first compilation. Measure before adding anything.
 - **Compaction threshold:** `STATE_FLOW_COMPACTION_MIN_CONTEXT_TOKENS = 24_000` is documented as a margin above Pi's default 20,000-token retained suffix. Make it configurable only if a real workload or non-default Pi retention settings demonstrate a mismatch.
-- **Lifecycle complexity review:** Measure how often cooperating-writer waits, Stop fences and fork/restore contention occur in real use before adding further awaited lifecycle layers. Use the result to decide whether any existing layer can be simplified.
 
 ## Release boundary
 
-Release publication is owned by `.github/workflows/release.yml`. Align package, lockfile, tag and changelog at the release version, rebuild `dist/` from final sources, and verify the exact tag's successful workflow, published GitHub Release and matching npm package before reporting release completion. Installed-instance reload remains a separate operator action.
+Release publication is owned by `.github/workflows/release.yml`. Align package, lockfile, tag and changelog at the release version, rebuild `dist/` from final sources, run `npm run validate` and the context validator after context edits, and verify the exact tag's successful workflow, published GitHub Release and matching npm package before reporting release completion. Installed-instance reload remains a separate operator action.

package/node_modules/@llblab/pi-state-flow/CHANGELOG.md

@@ -2,7 +2,22 @@
 
 > Each release keeps at most 8 outcome records of at most 512 characters.
 
-## Unreleased
+## 0.25.0: Intent-Owned Memory
+
+- `Intent-owned memory`: Deleting an intent key now deletes the same-scope `working`/`lazy` object keys its structured `{"$ref"}` values own, after authored operations in the same atomic cohort and revision, unless a remaining intent of that scope references the target, an ancestor or a descendant. Other targets and textual `$path` mentions are skipped silently; nothing is rejected, warned about or archived. Records store the cascade as explicit deletions and receipts report it.
+- `Work from intents`: Protocol, `patch_state` description, both Skills, README and docs present `intents` as the queue of chosen actions and `working` as their temporary context. Structured refs inside intents own; textual `$path` mentions only use. Before closing an intent, save survivors to unowned paths, with abandonment reasons in `contract`. Unowned entries stay legal. The always-injected protocol did not grow; duplicated read-path and barrier wording now lives only in the tool definitions.
+- `Ownership status`: `/state-flow-status` adds a per-scope `Scope memory:` block with UTF-8 sizes of present planes and the share of top-level `working`/`lazy` entries owned by an open intent. Operator-only; no notices, thresholds or model-facing effects.
+- `Composition root step one`: Completed-history compaction request state moves into `StateFlowCompactionRequests` and settled-turn backup/push state into `SettledTurnBackup`, cutting `lib/extension.ts` mutable closure bindings from 34 to 26 and adding an invariant ceiling. No behaviour change.
+- `Lifecycle review`: `lib/extension.ts` mutable closure bindings drop from 26 to 17 under the invariant ceiling. Artifact invalidations/hints move into `ArtifactAcquisitionState`, five lifecycle operations share one `OwnedOperationSlot`, renewable lifetimes and the session-identity guard have one owner each, and `noUnusedLocals`/`noUnusedParameters` guard dead code. No behaviour change.
+- `Readable documentation`: Human-facing guides use short sections, explicit operation steps and resource-specific recovery rules. They describe current behavior rather than release chronology; performance documentation retains reproducible workloads and metric limits, not obsolete measurements. The acceptance map includes intent ownership and lifecycle owners, and a test checks relative documentation links and anchors.
+
+## 0.24.0: Memory-Inert Off and Pi 1.0
+
+- `Memory-inert Off`: Off startup, resume, reload, tree navigation and automatic callbacks perform no semantic-store I/O or recovery reporting, even with logging enabled. Switching to Off cancels owned memory waits and clears model tools/context without altering accepted memory; native mode, continuation, write-fence and pending-fork policy survive.
+- `Safe reacquisition`: Passive restores the selected retained private boundary over live shared memory; Active validates current same-session memory. Pending Active can be cancelled or superseded by Passive without losing deferred history or inventing a write fence. Cold pending forks still require their exact proven source; expired history fails closed and bootstrap handoffs remain intact.
+- `Read-only inspection`: Explicit Off inspections use disposable current-store readers, never install model cache or mutate stored bytes, mode, fences or deferred selection. Session/Effective require validated same-session authority rather than fabricated empty or foreign private state; revisions describe the inspected view.
+- `Owned background work`: Off/shutdown cancel only owned backup captures and Git pushes, drain resources without late warnings and preserve accepted commits. Completed agent operations do not cancel admitted background pushes. Stale State Flow compaction requests cancel without model-summary fallback; old completion cannot clear a newer plan, and native operator/threshold compaction remains unchanged.
+- `Pi 1.0 and packaging`: Requires matching Pi packages at 1.0.0 or newer and pins local verification to 1.0.0. Token estimation uses coding-agent's public export, fixing the removed agent-core API; the transitive brace-expansion patch is locked to 5.0.12. The npm package declares MIT licensing and includes LICENSE. Canonical storage formats and scope ownership remain unchanged.
 
 ## 0.23.0: Off by Default and Mode Controls
 

package/node_modules/@llblab/pi-state-flow/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 llblab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.