@llblab/pi-kit 0.25.0 → 0.27.0

package/node_modules/@llblab/pi-state-flow/dist/lib/status.js

@@ -1,3 +1,4 @@
+import { ownedTopLevelKeys } from "./ownership.js";
 import { conciseDiagnostic } from "./protocol.js";
 import { overlayStates, projectSemanticState } from "./state.js";
 export const STATUS_KEY = "state-flow";
@@ -13,6 +14,32 @@ export function compactStatus(snapshot, _revisions, colorize) {
 function countArtifacts(states, scope) {
     return Object.keys(states[scope].artifacts).length;
 }
+const STATUS_PLANES = ["intents", "contract", "working", "artifacts", "response", "lazy"];
+const encoder = new TextEncoder();
+function isPresentPlane(value) {
+    if (value === undefined || value === "")
+        return false;
+    return typeof value !== "object" || value === null || Object.keys(value).length > 0;
+}
+/** Operator-only footprint: serialized plane sizes and intent-owned share of top-level working/lazy entries. */
+export function scopeMemoryLines(states) {
+    const lines = [];
+    for (const scope of ["global", "cwd", "session"]) {
+        const state = states[scope];
+        const sizes = STATUS_PLANES.filter((plane) => isPresentPlane(state[plane]))
+            .map((plane) => `${plane} ${encoder.encode(JSON.stringify(state[plane])).length} B`);
+        if (sizes.length === 0)
+            continue;
+        const owned = ownedTopLevelKeys(scope, state);
+        const shares = ["working", "lazy"].flatMap((plane) => {
+            const value = state[plane];
+            const keys = value !== null && typeof value === "object" && !Array.isArray(value) ? Object.keys(value) : [];
+            return keys.length === 0 ? [] : [`${plane} ${keys.filter((key) => owned[plane].has(key)).length}/${keys.length}`];
+        });
+        lines.push(`- ${scope}: ${sizes.join(", ")}${shares.length ? `; intent-owned ${shares.join(", ")}` : ""}`);
+    }
+    return lines.length ? ["Scope memory:", ...lines] : [];
+}
 export function detailedStatus(snapshot, diagnostics) {
     const available = diagnostics.temporal !== undefined && diagnostics.durableStateError === undefined;
     const materialized = !available ? undefined : diagnostics.effectiveState ?? projectSemanticState(overlayStates(diagnostics.scopeStates.global, diagnostics.scopeStates.cwd, diagnostics.scopeStates.session));
@@ -41,6 +68,7 @@ export function detailedStatus(snapshot, diagnostics) {
         ...(diagnostics.publicationError === undefined ? [] : [`Memory writes paused after mode change: ${conciseDiagnostic(diagnostics.publicationError)}`]),
         ...(hasArtifacts ? [`Artifacts: global ${artifacts("global")}; CWD ${artifacts("cwd")}; session ${artifacts("session")}; pending invalidations ${invalidated}`] : []),
         ...invalidationLines,
+        ...(available ? scopeMemoryLines(diagnostics.scopeStates) : []),
         ...(stateJson === undefined
             ? ["Effective memory: unavailable"]
             : ["Effective memory:", "", stateJson]),

package/node_modules/@llblab/pi-state-flow/dist/lib/transition.js

@@ -1,6 +1,7 @@
 import { compileArtifact, ORDINARY_ARTIFACT_COMPILER, validateArtifactMetadata, validateArtifactRegistry, validateModelArtifactPatch, } from "./artifact.js";
 import { createAcceptedTransition } from "./history.js";
 import { applyPatch, containsNull, hashJson, isObject, validatePatch } from "./json.js";
+import { cascadeDeletionPatch, computeIntentCascade } from "./ownership.js";
 import { hasCompiledSkillArtifact, SKILL_ARTIFACT_COMPILER } from "./skills.js";
 import { emptyState } from "./state.js";
 const SCOPES = new Set(["global", "cwd", "session"]);
@@ -138,7 +139,11 @@ function stageScopedSemanticTransition(currentStates, transition, successfulSkil
     for (const scope of SCOPES) {
         const authored = patches.get(scope) ?? {};
         const patch = { ...authored, ...(scope === "session" && acceptedResponse !== undefined ? { response: acceptedResponse } : {}) };
-        const materialized = applyPatch({ ...emptyState(), ...currentStates[scope] }, patch);
+        let materialized = applyPatch({ ...emptyState(), ...currentStates[scope] }, patch);
+        // Authored operations first, then the same-scope intent ownership cascade.
+        const cascade = computeIntentCascade(scope, currentStates[scope], materialized);
+        if (cascade.length > 0)
+            materialized = applyPatch(materialized, cascadeDeletionPatch(cascade));
         compileReadArtifacts(materialized, { artifacts: authored.artifacts ?? {} }, artifactReads.filter((read) => (read.scope ?? "global") === scope), provenanceUpdates[scope]);
         compileReadSkills(scope, materialized, { artifacts: authored.artifacts ?? {} }, skillReads.filter((read) => read.scope === scope), provenanceUpdates[scope]);
         validateMaterializedTransition(materialized, scope);

package/node_modules/@llblab/pi-state-flow/dist/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@llblab/pi-state-flow",
-  "version": "0.23.0",
+  "version": "0.25.0",
+  "license": "MIT",
   "private": false,
   "description": "Incremental scoped state/context/memory compiler for Pi, inspired by SKILL.state",
   "keywords": [
@@ -66,16 +67,16 @@
     "node": ">=22.19.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-agent-core": ">=0.87.0",
-    "@earendil-works/pi-ai": ">=0.87.0",
-    "@earendil-works/pi-coding-agent": ">=0.87.0",
-    "@earendil-works/pi-tui": ">=0.87.0"
+    "@earendil-works/pi-agent-core": ">=1.0.0",
+    "@earendil-works/pi-ai": ">=1.0.0",
+    "@earendil-works/pi-coding-agent": ">=1.0.0",
+    "@earendil-works/pi-tui": ">=1.0.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-agent-core": "0.87.0",
-    "@earendil-works/pi-ai": "0.87.0",
-    "@earendil-works/pi-coding-agent": "0.87.0",
-    "@earendil-works/pi-tui": "0.87.0",
+    "@earendil-works/pi-agent-core": "1.0.0",
+    "@earendil-works/pi-ai": "1.0.0",
+    "@earendil-works/pi-coding-agent": "1.0.0",
+    "@earendil-works/pi-tui": "1.0.0",
     "@types/node": "^26.4.0",
     "typescript": "^7.0.2"
   }

package/node_modules/@llblab/pi-state-flow/dist/skills/state-flow-guide/SKILL.md

@@ -21,9 +21,9 @@ Operator commands: `/state-flow-status` inspects; `/state-flow-active` selects s
 
 | Field | Purpose |
 | --- | --- |
-| `intents` | Chosen future actions, not possibilities |
-| `contract` | Requirements, decisions, constraints, interfaces |
-| `working` | Observations, results, open questions, continuation |
+| `intents` | Queue of chosen actions, not possibilities; may own `working`/`lazy` keys |
+| `contract` | Requirements, decisions, rejections, constraints, interfaces |
+| `working` | Temporary context of intents: observations, results, open questions |
 | `artifacts` | Exact source paths, descriptions, compilations |
 | `response` | Previous completed answer; runtime-owned |
 | `lazy` | Durable detail omitted from ordinary context |
@@ -46,7 +46,7 @@ Example arguments:
 {"paths":["cwd.working","session.working"]}
 ```
 
-Unscoped paths use effective state. `cwd[1].working` reads the preceding causal boundary. Materialized-history and scope patch-history paths such as `cwd.patches[1]` share the configured `historyLimit` bound (default 7) and require actually retained history. Lowering the limit folds excess tails without erasing current state; increasing it does not reconstruct discarded history. Array ranges such as `cwd.lazy.checks[0..3]` exclude the endpoint and require existing elements. Missing paths are unavailable; inspect parent keys only when needed for the task. Missing history is not empty history. Read `lazy` explicitly. Treat structured `$ref` values and `$`-prefixed `read_state` paths inside ordinary strings, such as `$effective.lazy.memory[7]`, as semantic-state references. Other resources retain their native locators. Resolve any reference through the appropriate read/tool only when needed. Neither form proves authority or existence, hydrates, or executes anything. Never scan or resolve references merely to test them. A missing single value path with exact durable sources returns `{value:null, hint:[{type:"dangling-reference", message, paths}]}`. Treat `hint` as top-level diagnostic metadata, never as the requested state: its message is descriptive and conditional; its paths are runtime-verified current reference owners, not verified new locations of the target. The hint proves provenance rather than staleness and is absent when no current durable source matches; keys, patch, and batch reads keep all-or-error behavior. Only then inspect ownership as needed and patch a proven stale owning value while preserving its surrounding meaning. Effective absence, inaccessible external resources, and transient failures are not proof.
+Unscoped paths use effective state. `cwd[1].working` reads the preceding causal boundary. Materialized-history and scope patch-history paths such as `cwd.patches[1]` share the configured `historyLimit` bound (default 7) and require actually retained history. Lowering the limit folds excess tails without erasing current state; increasing it does not reconstruct discarded history. Array ranges such as `cwd.lazy.checks[0..3]` exclude the endpoint and require existing elements. Missing paths are unavailable; inspect parent keys only when needed for the task. Missing history is not empty history. Read `lazy` explicitly. Treat structured `$ref` values and `$`-prefixed `read_state` paths inside ordinary strings, such as `$effective.lazy.memory[7]`, as semantic-state references. Other resources retain their native locators. Resolve any reference through the appropriate read/tool only when needed. Neither form proves authority or existence, hydrates, or executes anything; only intent ownership (see Write) has a deletion consequence. Never scan or resolve references merely to test them. A missing single value path with exact durable sources returns `{value:null, hint:[{type:"dangling-reference", message, paths}]}`. Treat `hint` as top-level diagnostic metadata, never as the requested state: its message is descriptive and conditional; its paths are runtime-verified current reference owners, not verified new locations of the target. The hint proves provenance rather than staleness and is absent when no current durable source matches; keys, patch, and batch reads keep all-or-error behavior. Only then inspect ownership as needed and patch a proven stale owning value while preserving its surrounding meaning. Effective absence, inaccessible external resources, and transient failures are not proof.
 
 Missing paths or runtime hints alone do not require historical search. The agent may choose a targeted historical read when a previous value is useful to the current task, without separate user permission. Otherwise continue without searching. Use found values as historical evidence, not automatically as current state; never automatically restore deleted memory. Do not scan all offsets, hydrate automatically or request repair inference. A hint does not prove prior existence, retained history or relocation. A proven stale reference may be repaired within touched work without resurrecting its target. Automatic state and recent-transition projections omit lazy bodies; bounded `lazy_navigation` preserves structure, and explicit current/historical reads still return requested lazy values or patches.
 
@@ -58,12 +58,20 @@ The runtime waits cancelably for publication ownership, then applies authored Gl
 
 When present, semantic planes `intents`, `contract`, `working`, `artifacts`, and `lazy` are objects; nested lazy values may contain ordinary JSON without stored nulls. Stored checkpoints and patches may omit any documented plane. Current and historical views assemble only known fields present in the selected scopes. Absent fields and empty responses are omitted from views. Checkpoint/tail readers ignore unknown top-level fields, and writers emit only known fields. Nested data within known planes remains intact. Explicit value reads of an absent documented top-level field return `null`. Authored `patch_state` keeps its documented field grammar. Objects merge, arrays/scalars replace, omitted fields persist. Nested `null` removes an owned object key; inherited content may reappear. Canonical `"[N]"` keys patch array elements; indexed deletion is forbidden.
 
-Illustrative deletion, only for an actually completed intent and after satisfying pending acquisitions:
+Work from intents. A structured `{"$ref"}` anywhere inside an intent owns ("delete with me") an existing object key under `working` or `lazy` in the same scope; a textual `$path` mention only uses it. Opening a task:
 
 ```json
-{"session":{"intents":{"check_api":null}}}
+{"session":{"intents":{"check_api":{"action":"Verify the API","notes":{"$ref":"session.working.api"},"plan":{"$ref":"session.lazy.api_plan"}}},"working":{"api":"draft findings"},"lazy":{"api_plan":["probe","compare"]}}}
 ```
 
+Deleting the intent deletes the owned keys after the authored operations, in the same atomic patch, unless another remaining same-scope intent references the target, an ancestor or a descendant. Before closing, move what must survive to an unowned path: results to `working`, `contract` or a broader scope; reasons for abandoned work to `contract` as rejected approaches. Supersede in one patch by deleting the old intent and referencing the same targets from its replacement. Writing to an owned target in the same patch that deletes its intent does not save it: the write is deleted too. Only keys matching `[A-Za-z_$][A-Za-z0-9_$-]*` can be owned. Cross-scope, plane-root, array-element and non-`working`/`lazy` targets are never deleted, nothing is rejected or warned about, and unowned entries remain legal. Illustrative closing, only for an actually completed intent and after satisfying pending acquisitions:
+
+```json
+{"session":{"intents":{"check_api":null},"contract":{"api":"verified: v2 only"}}}
+```
+
+Name object keys in ASCII matching `[A-Za-z_$][A-Za-z0-9_$-]*` (for example `api_plan`, not a Cyrillic or spaced key): other keys cannot be addressed by `read_state` paths or `$` references, and cannot be owned by intents. Values may use any language.
+
 Never edit backing files, `response`, configuration, provenance, or runtime metadata. Verify changed owner paths when needed; check effective state after override deletion.
 
 ## Acquire and finish

package/node_modules/@llblab/pi-state-flow/dist/skills/state-flow-memory/SKILL.md

@@ -20,9 +20,9 @@ Follow the installed runtime contract. This registered Skill follows its Pi sour
 ## Reconcile one bounded set
 
 1. **Limit the review.** Address the requested scope. A completed phase may motivate recommending cleanup, not starting it without a request. For a whole-state cleanup, inspect global, CWD, and session ownership explicitly; for a narrower request, inspect only affected owners. Use targeted reads for gaps, contradictions, ownership, or verification; do not rerun the project.
-2. **Classify.** Put user requirements and binding confirmed decisions in `contract`, observations, assistant conclusions, and unresolved work in `working`, chosen actions in `intents`, and inactive reusable detail in `lazy`. Never give an assistant conclusion user authority. Remove fulfilled, abandoned, superseded, or impossible intents; retain consequential results. Possibilities are not commitments.
+2. **Classify.** Put user requirements and binding confirmed decisions in `contract`, the queue of chosen actions in `intents`, their temporary context (observations, assistant conclusions, results in progress) in `working`, and inactive reusable detail in `lazy`. Never give an assistant conclusion user authority. Possibilities are not commitments. Name keys in ASCII (`[A-Za-z_$][A-Za-z0-9_$-]*`) so paths, references and ownership resolve; values may use any language. Work from intents: a structured `{"$ref"}` inside an intent owns ("delete with me") a same-scope `working`/`lazy` key; a textual `$path` mention only uses it. Deleting a fulfilled, abandoned, superseded, or impossible intent deletes owned keys no remaining same-scope intent references, so first move what must survive to an unowned path (a write to an owned key in the deleting patch is deleted too): results to `working`, `contract`, or a broader scope; reasons for abandoned work to `contract` as rejected approaches. Supersede in one patch by referencing the same targets from the replacement. Unowned entries remain legal.
 3. **Keep evidence boundaries.** Preserve corrections, prerequisites, bounded negative results, and useful uncertainty. Separate requirements, decisions, observations, conclusions, and hypotheses. Silence is not acceptance; repetition is not verification. One implementation's failure does not reject an approach. Neither freeze provisional methods nor reopen confirmed decisions without grounds.
-4. **Compact for continuation.** Remove duplicates, obsolete progress, unsupported claims, and secrets. Keep sufficient results, real retrieval pointers, pending interaction, and known next checks. Observations are not live external facts. Keep `lazy` shallow and priority-ordered. Recognize optional structured `$ref` values and `$`-prefixed `read_state` paths inside ordinary strings as semantic-state references; other resources retain native locators. No reference form proves authority or existence, authorizes execution, or implies completion. Never scan or resolve references merely to find broken ones. When the bounded review independently needs a reference, a missing single value path with exact durable sources returns `{value:null, hint:[{type:"dangling-reference", message, paths}]}`. Treat the top-level hint as conditional navigation and provenance, never as requested state or proof of staleness; its paths are runtime-verified current reference owners, not verified new locations of the target, while no hint does not prove invention. Inspect ownership only as needed, then patch a proven stale owning value while preserving surrounding meaning. Effective absence or external inaccessibility is insufficient.
+4. **Compact for continuation.** Remove duplicates, obsolete progress, unsupported claims, and secrets. Keep sufficient results, real retrieval pointers, pending interaction, and known next checks. Observations are not live external facts. Keep `lazy` shallow and priority-ordered. Recognize optional structured `$ref` values and `$`-prefixed `read_state` paths inside ordinary strings as semantic-state references; other resources retain native locators. No reference form proves authority or existence, authorizes execution, or implies completion; only intent ownership has a deletion consequence. Never scan or resolve references merely to find broken ones. When the bounded review independently needs a reference, a missing single value path with exact durable sources returns `{value:null, hint:[{type:"dangling-reference", message, paths}]}`. Treat the top-level hint as conditional navigation and provenance, never as requested state or proof of staleness; its paths are runtime-verified current reference owners, not verified new locations of the target, while no hint does not prove invention. Inspect ownership only as needed, then patch a proven stale owning value while preserving surrounding meaning. Effective absence or external inaccessibility is insufficient.
 5. **Check ownership.** Prefer `session` for branch/run continuation, `cwd` for project knowledge, and `global` for established cross-project knowledge. Effective values do not prove ownership; inspect owners before moves. Broader applicability requires evidence.
 
 Missing paths or runtime hints alone do not require historical search. The agent may choose a targeted historical read when a previous value is useful to the current task, without separate user permission. Otherwise continue without searching. Use found values as historical evidence, not automatically as current state; never automatically restore deleted memory. Do not scan all offsets, hydrate automatically or request repair inference. A hint does not prove prior existence, retained history or relocation. A proven stale reference may be repaired within touched work without resurrecting its target. Lazy bodies require explicit reads; automatic state/history projections retain navigation without hydrating those bodies.

package/node_modules/@llblab/pi-state-flow/docs/README.md

@@ -1,11 +1,21 @@
 # State Flow documentation
 
-- [Usage and recovery](usage.md): Configuration, new/resumed sessions, Active/Passive/Off controls, diagnostics, privacy, and storage recovery.
-- [Architecture](architecture.md): Semantic state, temporal algebra, Pi lifecycle, storage, publication, artifacts, and embedding contracts.
-- [Lazy state](lazy-state.md): Implemented ordinary-JSON lazy planes, an effective-by-default `lazy` read path, pure state/patch snapshots, narrow structural `meta` + `keys`, and recursive indexed array patches.
-- [Filesystem recovery](filesystem-recovery.md): Cohort-wide absence, partial-presence, malformed-evidence, repair-authority, and transaction rules.
-- [Temporal acceptance](temporal-acceptance.md): Required temporal properties and their executable witnesses.
-- [SDK compatibility](compatibility.md): Tested dependency stacks, public lifecycle seams, isolated validation, and host limits.
-- [Physical fork contract](fork-contract.md): Session-stream copying, live shared memory, child ownership/origin, and tested support boundaries.
-- [Agent contract relocation ledger](agent-contract-relocation.md): Source-bound paragraph-to-owner parity map for the compact `AGENTS.md`, with transferred clauses and validation evidence.
-- [Session performance](performance.md): Reproducible native-Pi/stateful workloads, long-session resume measurements, two-process publication probes, and evidence limits.
+Start with the [project README](../README.md) for installation and the memory model.
+
+## Operating State Flow
+
+- [Usage and recovery](usage.md): Configure State Flow, choose Active/Passive/Off, inspect memory and recover from storage problems. Includes diagnostics and privacy rules.
+- [Lazy state](lazy-state.md): Store ordinary JSON in `lazy` outside baseline context, read it progressively with structural `meta` + `keys`, patch array indices and understand intent ownership.
+- [Filesystem recovery](filesystem-recovery.md): What to do when files are missing, incomplete or malformed; which evidence authorizes repair and what durability is promised.
+- [Physical fork contract](fork-contract.md): What a child session copies, what stays live, how cancellation works and which forks are supported.
+
+## Integration and verification
+
+- [Architecture](architecture.md): Semantic state, temporal history, Pi lifecycle, storage transactions, artifact acquisition and embedding APIs.
+- [SDK compatibility](compatibility.md): Required packages, verified environments, host lifecycle requirements and isolated validation procedures.
+- [Session performance](performance.md): Run synthetic benchmarks, interpret their metrics and understand the current cost model. No provider-cache or latency guarantees.
+- [Temporal acceptance](temporal-acceptance.md): Find the tests that witness each required property, including cancellation, ownership and replay.
+
+## Development policy
+
+- [Agent contract relocation ledger](agent-contract-relocation.md): Audit map from [AGENTS.md](../AGENTS.md) development instructions to their owning contracts and tests. It is provenance evidence, not a user guide or an open-work list.

package/node_modules/@llblab/pi-state-flow/docs/agent-contract-relocation.md

@@ -1,6 +1,6 @@
 # Agent contract relocation ledger
 
-This is the source-bound **paragraph-to-owner parity map** for the 8,141-word pre-compaction `AGENTS.md` (SHA-256 `0d328eacc96d6b67c5eb036a51adc27e1dcd24d20bb6695f2fff6d5a3c87737b`; source lines 3–58, based on commit `70baecde` plus the Passive-footprint and `barrier-block` edits). Each `L##` identifies exactly one original bullet/paragraph. Its destination is the current owner of that paragraph's reusable contract; where necessary, a compact root rule or executable witness is also named. The root remains approximately 1,300 words; its 0.23.0 default-mode rule supersedes the original Passive-default clause. This is a reviewed documentation trace, not a claim that prose links alone prove runtime correctness.
+This is the source-bound **paragraph-to-owner parity map** for the 8,141-word pre-compaction `AGENTS.md` (SHA-256 `0d328eacc96d6b67c5eb036a51adc27e1dcd24d20bb6695f2fff6d5a3c87737b`; source lines 3–58, based on commit `70baecde` plus the Passive-footprint and `barrier-block` edits). Each `L##` identifies exactly one original bullet/paragraph. Its destination is the current owner of that paragraph's reusable contract; where necessary, a compact root rule or executable witness is also named. The root remains approximately 1,300 words; its current default-mode rule (new sessions start Off) supersedes the source's Passive-default clause. This is a reviewed documentation trace, not a claim that prose links alone prove runtime correctness.
 
 ## Composition, semantics, and model access
 
@@ -35,7 +35,7 @@ This is the source-bound **paragraph-to-owner parity map** for the 8,141-word pr
 - L19 canonical layout and identity → [storage and identity](architecture.md#storage-and-identity).
 - L20 optimistic durability, optional backup and contention → [power-loss boundary](filesystem-recovery.md#power-loss-durability), [asynchronous transaction](architecture.md#asynchronous-storage-transaction), [optional Git backup](architecture.md#optional-git-backup).
 - L21 cohort classification and missing shared pairs → [recovery](usage.md#missing-partial-and-malformed-storage), [transaction rule](filesystem-recovery.md#transaction-rule).
-- L22 predecessor formats and no in-place migration → [format boundary](usage.md#moving-a-store-and-the-017-format-boundary), [optional Git backup](architecture.md#optional-git-backup).
+- L22 predecessor formats and no in-place migration → [format boundary](usage.md#moving-a-store-and-supported-formats), [optional Git backup](architecture.md#optional-git-backup).
 - L23 exact-file CAS, awaited transaction and rollback → [asynchronous transaction](architecture.md#asynchronous-storage-transaction), [storage and identity](architecture.md#storage-and-identity), [transaction rule](filesystem-recovery.md#transaction-rule).
 - L24 initialization and exact-source fork → [Pi lifecycle](architecture.md#pi-lifecycle), [fork contract](fork-contract.md).
 - L25 retained-boundary restore, failed-Stop read-only recovery and selection races → [Pi lifecycle](architecture.md#pi-lifecycle), [mode restoration](compatibility.md#mode-selection-and-memory-restoration).
@@ -51,7 +51,7 @@ This is the source-bound **paragraph-to-owner parity map** for the 8,141-word pr
 ## Operator, agent, and development policy
 
 - L30 terminal handoff plane routing → [operational guidance](architecture.md#operational-guidance-and-memory-curation), [semantic state](architecture.md#semantic-state).
-- L31 consequential evidence, semantic references and dangling hints → [model tools](architecture.md#model-tools), [lazy navigation](usage.md#lazy-navigation-and-historical-reading), [memory curation](architecture.md#operational-guidance-and-memory-curation).
+- L31 consequential evidence, semantic references and dangling hints → [model tools](architecture.md#model-tools), [lazy navigation](usage.md#lazy-navigation-and-historical-reading), [memory curation](architecture.md#operational-guidance-and-memory-curation). The root's intent-ownership exception to reference semantics is owned by [intent ownership](lazy-state.md#intent-ownership).
 - L32 volatile observation and external-effects revalidation → [operational boundaries](../README.md#operational-boundaries), [memory guidance](usage.md#memory-and-source-acquisition).
 - L33 registered Skill acquisition → [artifact routing](architecture.md#artifact-routing).
 - L34 bounded curation and verified transfers → [operational guidance](architecture.md#operational-guidance-and-memory-curation), [memory Skill](../skills/state-flow-memory/SKILL.md).
@@ -69,4 +69,4 @@ This is the source-bound **paragraph-to-owner parity map** for the 8,141-word pr
 
 ## Verification evidence
 
-The map names all 56 source paragraphs exactly once. Each was compared with its destinations; the highest-risk clause groups were checked explicitly: L06/L45 native run anchors and Stop context, L23–L26 CAS/backup/rollback, L28 receipt-elision bounds, L31 reference/epistemic limits, L36 diagnostic privacy, L47 native compaction and L50 callback revocation. An additional exact-code-token audit exposed otherwise easy-to-lose clauses: legacy `{disabled:true}`, in-memory header key derivation, materialization equality, `contract.compiled_skills` rejection, Skill compiler revision, runtime-origin null exception and normalized artifact replay. Those are now stated in architecture; terse `patches[n]` and `{value:null, hint:[...]}` from the source are represented there by the more precise scoped patch path and expanded dangling-reference sentinel. The remaining uniquely durable developer rules, including no live-store fixture edits, stay in the compact root. `tests/invariants.test.ts` is unchanged; native and domain-specific witnesses remain in their named test files. Package, context and domain-DAG validation establish the final checked boundary; they cannot substitute for semantic judgment about future models.
+The map names all 56 source paragraphs exactly once. Each was compared with its destinations; the highest-risk clause groups were checked explicitly: L06/L45 native run anchors and Stop context, L23–L26 CAS/backup/rollback, L28 receipt-elision bounds, L31 reference/epistemic limits, L36 diagnostic privacy, L47 native compaction and L50 callback revocation. An additional exact-code-token audit exposed otherwise easy-to-lose clauses: legacy `{disabled:true}`, in-memory header key derivation, materialization equality, `contract.compiled_skills` rejection, Skill compiler revision, runtime-origin null exception and normalized artifact replay. Those are now stated in architecture; terse `patches[n]` and `{value:null, hint:[...]}` from the source are represented there by the more precise scoped patch path and expanded dangling-reference sentinel. The remaining uniquely durable developer rules, including no live-store fixture edits, stay in the compact root. The relocation itself changed no tests; native and domain-specific witnesses remain in their named test files. Later structural guards in `tests/invariants.test.ts` enforce composition-root ownership and do not alter this mapping. Package, context and domain-DAG validation establish the final checked boundary; they cannot substitute for semantic judgment about future models.