@llblab/pi-kit 0.25.0 → 0.27.0

package/node_modules/@llblab/pi-state-flow/lib/git.ts

@@ -206,14 +206,15 @@ export function backupCurrentStateFlowFiles(repositoryRoot: string, signal?: Abo
 }
 
 /** Skip overlapping pushes; the next accepted turn can push the latest HEAD. */
-export function startStateFlowBackupPush(repositoryRoot: string, onFailure: (error: unknown) => void, onSuccess?: () => void): boolean {
+export function startStateFlowBackupPush(repositoryRoot: string, onFailure: (error: unknown) => void, onSuccess?: () => void, signal?: AbortSignal): boolean {
 	const root = resolve(repositoryRoot);
-	if (activePushes.has(root)) return false;
-	const push = pushCurrentStateFlowBackup(root).then(
+	if (signal?.aborted || activePushes.has(root)) return false;
+	const push = pushCurrentStateFlowBackup(root, signal).then(
 		(result) => {
-			if (result) { try { onSuccess?.(); } catch { /* Reporting cannot change push acceptance. */ } }
+			if (result && !signal?.aborted) { try { onSuccess?.(); } catch { /* Reporting cannot change push acceptance. */ } }
 		},
 		(error) => {
+			if (signal?.aborted) return;
 			try { onFailure(error); } catch { /* Reporting cannot revive a failed push. */ }
 		},
 	).finally(() => { activePushes.delete(root); });
@@ -228,15 +229,17 @@ export async function awaitInFlightBackupPushes(repositoryRoot: string): Promise
 }
 
 /** Push the current backup commit to its explicitly configured branch remote without blocking settlement. */
-export function pushCurrentStateFlowBackup(repositoryRoot: string): Promise<{ commit: string; remote: string; ref: string } | undefined> {
+export function pushCurrentStateFlowBackup(repositoryRoot: string, signal?: AbortSignal): Promise<{ commit: string; remote: string; ref: string } | undefined> {
 	return new Promise((resolvePush, rejectPush) => {
 		let root: string;
 		let commit: string | undefined;
 		let destination: { remote: string; ref: string } | undefined;
 		try {
+			signal?.throwIfAborted();
 			root = assertRepositoryRoot(repositoryRoot);
 			commit = currentHead(root);
 			destination = configuredPushDestination(root);
+			signal?.throwIfAborted();
 		} catch (error) {
 			rejectPush(new Error(redactGitDiagnostic(error instanceof Error ? error.message : String(error))));
 			return;
@@ -273,6 +276,7 @@ export function pushCurrentStateFlowBackup(repositoryRoot: string): Promise<{ co
 			if (settled) return;
 			settled = true;
 			clearTimeout(timeout);
+			signal?.removeEventListener("abort", cancelled);
 			if (error) rejectPush(error);
 			else resolvePush({ commit: commit!, ...destination! });
 		}
@@ -284,5 +288,73 @@ export function pushCurrentStateFlowBackup(repositoryRoot: string): Promise<{ co
 		child.once("exit", () => { if (failure) child.stderr?.destroy(); });
 		child.once("close", (code, endedBy) => finish(failure ?? (code === 0 ? undefined
 			: new Error(`Git backup push failed (${endedBy ?? code}): ${redactGitDiagnostic(stderr.trim()) || "no diagnostic output"}`))));
+		function cancelled(): void {
+			terminate(signal?.reason instanceof Error ? signal.reason : new Error("Git backup push cancelled"));
+		}
+		signal?.addEventListener("abort", cancelled, { once: true });
+		if (signal?.aborted) cancelled();
 	});
 }
+
+/**
+ * Settled-turn backup obligation owned by one extension instance: an accepted
+ * publication makes a backup due, an accepted turn permits it at settlement,
+ * and one lifetime cancels owned captures/pushes without touching accepted state.
+ */
+export class SettledTurnBackup {
+	#turnAccepted = false;
+	#pending = false;
+	#lifetime = new AbortController();
+	#pushFailureNotified = false;
+	readonly #operations = new Set<Promise<unknown>>();
+
+	/** An accepted canonical publication makes the next settled-turn backup due. */
+	markPublished(): void { this.#pending = true; }
+
+	/** An accepted turn permits the due backup at its settlement. */
+	markTurnAccepted(): void { this.#turnAccepted = true; }
+
+	/** Forget the current turn's permission without dropping a due backup. */
+	clearTurn(): void { this.#turnAccepted = false; }
+
+	/** Consume the accepted-turn permission; true only when a backup is also due. */
+	takeSettledTurn(): boolean {
+		if (!this.#turnAccepted) return false;
+		this.#turnAccepted = false;
+		if (!this.#pending) return false;
+		this.#pending = false;
+		return true;
+	}
+
+	/** Lifetime signal for owned captures and pushes. */
+	get lifetime(): AbortSignal { return this.#lifetime.signal; }
+
+	/** Cancel owned work and the due backup, then open a fresh lifetime. */
+	cancel(): void {
+		this.#lifetime.abort();
+		this.#lifetime = new AbortController();
+		this.#pending = false;
+	}
+
+	/** Cancel owned work for shutdown without opening a new lifetime. */
+	abort(): void { this.#lifetime.abort(); }
+
+	/** Track one owned capture until it settles. */
+	async track<T>(operation: Promise<T>): Promise<T> {
+		this.#operations.add(operation);
+		try { return await operation; }
+		finally { this.#operations.delete(operation); }
+	}
+
+	/** Owned captures still in flight. */
+	get operations(): Promise<unknown>[] { return [...this.#operations]; }
+
+	/** True once per failure streak; a successful push resets it. */
+	claimPushFailureNotice(): boolean {
+		if (this.#pushFailureNotified) return false;
+		this.#pushFailureNotified = true;
+		return true;
+	}
+
+	resetPushFailureNotice(): void { this.#pushFailureNotified = false; }
+}

package/node_modules/@llblab/pi-state-flow/lib/operation.ts

@@ -0,0 +1,75 @@
+// Domain: one cancellable lifecycle owner slot shared by Start, inactive-mode persistence,
+// branch restoration, inference preparation and response reconciliation.
+
+/** Minimal shape of a cancellable owned lifecycle operation. */
+export interface OwnedOperation {
+	readonly controller: AbortController;
+	operation?: Promise<unknown>;
+}
+
+/**
+ * At most one current owner per lifecycle concern. A newer claim supersedes by
+ * explicit cancellation, and identity-guarded release prevents a late
+ * completion from clearing newer work.
+ */
+export class OwnedOperationSlot<E extends OwnedOperation> {
+	#current: E | undefined;
+	readonly #inflight = new Set<Promise<unknown>>();
+
+	/** The current owner, if any. */
+	get current(): E | undefined { return this.#current; }
+
+	/** True while `entry` still owns the slot. */
+	owns(entry: E): boolean { return this.#current === entry; }
+
+	/** Install a new owner; callers cancel a previous owner explicitly when supersession requires it. */
+	claim(entry: E): E {
+		this.#current = entry;
+		return entry;
+	}
+
+	/** Abort and forget the current owner; returns its operation for optional awaiting. */
+	cancel(): E["operation"] | undefined {
+		const entry = this.#current;
+		entry?.controller.abort();
+		this.#current = undefined;
+		return entry?.operation;
+	}
+
+	/** Forget `entry` only if it still owns the slot. */
+	release(entry: E): void {
+		if (this.#current === entry) this.#current = undefined;
+	}
+
+	/** Attach `operation` to `entry` and remember it until it settles, optionally releasing ownership then. */
+	track<P extends NonNullable<E["operation"]>>(entry: E, operation: P, releaseOnSettle = true): P {
+		entry.operation = operation;
+		this.#inflight.add(operation);
+		const settle = () => {
+			this.#inflight.delete(operation);
+			if (releaseOnSettle) this.release(entry);
+		};
+		void operation.then(settle, settle);
+		return operation;
+	}
+
+	/** Tracked operations not yet settled, including superseded ones. */
+	get inflight(): Promise<unknown>[] { return [...this.#inflight]; }
+}
+
+/** A renewable cancellation lifetime: ending it aborts every holder of the current signal. */
+export class RenewableLifetime {
+	#controller = new AbortController();
+
+	/** Signal of the current lifetime. */
+	get signal(): AbortSignal { return this.#controller.signal; }
+
+	/** Abort current holders and open a fresh lifetime. */
+	renew(reason?: unknown): void {
+		this.#controller.abort(reason);
+		this.#controller = new AbortController();
+	}
+
+	/** Abort current holders without opening a new lifetime (shutdown). */
+	end(reason?: unknown): void { this.#controller.abort(reason); }
+}

package/node_modules/@llblab/pi-state-flow/lib/ownership.ts

@@ -0,0 +1,120 @@
+import { isObject, type JsonObject, type JsonValue } from "./json.ts";
+import type { SemanticState, StateScope } from "./state.ts";
+
+/** Planes whose object keys an intent may own by structured reference. */
+export type OwnedPlane = "working" | "lazy";
+
+/** One same-scope object-key target of an intent ownership reference. */
+export interface OwnedPath {
+	plane: OwnedPlane;
+	keys: string[];
+}
+
+const OWNED_PLANES = new Set<string>(["working", "lazy"]);
+// Same key grammar as read_state value paths; array selectors never parse.
+const OBJECT_KEY = /^[A-Za-z_$][A-Za-z0-9_$-]*$/;
+
+/**
+ * Parse one structured `$ref` target as an ownership path of `scope`.
+ * Cross-scope, unscoped, `effective`, historical, plane-root, array-element
+ * and non-`working`/`lazy` targets are not ownership targets.
+ */
+export function parseOwnedPath(scope: StateScope, ref: string): OwnedPath | undefined {
+	const parts = ref.split(".");
+	if (parts.length < 3 || parts[0] !== scope || !OWNED_PLANES.has(parts[1]!)) return undefined;
+	const keys = parts.slice(2);
+	if (!keys.every((key) => OBJECT_KEY.test(key))) return undefined;
+	return { plane: parts[1] as OwnedPlane, keys };
+}
+
+function pathId(path: OwnedPath): string {
+	return JSON.stringify([path.plane, ...path.keys]);
+}
+
+/** Extract unique ownership targets from structured references anywhere inside one intent value. */
+export function extractOwnedPaths(scope: StateScope, value: JsonValue): OwnedPath[] {
+	const found = new Map<string, OwnedPath>();
+	const visit = (node: JsonValue): void => {
+		if (Array.isArray(node)) {
+			for (const item of node) visit(item);
+			return;
+		}
+		if (!isObject(node)) return;
+		if (typeof node.$ref === "string") {
+			const path = parseOwnedPath(scope, node.$ref);
+			if (path) found.set(pathId(path), path);
+		}
+		for (const key of Object.keys(node)) if (key !== "$ref" || typeof node[key] !== "string") visit(node[key]!);
+	};
+	visit(value);
+	return [...found.values()];
+}
+
+function related(left: OwnedPath, right: OwnedPath): boolean {
+	if (left.plane !== right.plane) return false;
+	const length = Math.min(left.keys.length, right.keys.length);
+	for (let index = 0; index < length; index++) if (left.keys[index] !== right.keys[index]) return false;
+	return true;
+}
+
+function exists(state: SemanticState, path: OwnedPath): boolean {
+	let node: JsonValue | undefined = state[path.plane];
+	for (const key of path.keys) {
+		if (!isObject(node) || !Object.hasOwn(node, key)) return false;
+		node = node[key];
+	}
+	return true;
+}
+
+/**
+ * Compute the same-scope ownership cascade for intent keys removed between
+ * `before` and `after` (the state after authored operations). A target is
+ * kept while any remaining intent references it, an ancestor or a descendant;
+ * missing targets are skipped. The result is minimal (no target below
+ * another) and deterministically ordered.
+ */
+export function computeIntentCascade(scope: StateScope, before: SemanticState, after: SemanticState): OwnedPath[] {
+	const previous = isObject(before.intents) ? before.intents : {};
+	const remaining = isObject(after.intents) ? after.intents : {};
+	const deleted = Object.keys(previous).filter((key) => !Object.hasOwn(remaining, key));
+	if (deleted.length === 0) return [];
+	const candidates = new Map<string, OwnedPath>();
+	for (const key of deleted) for (const path of extractOwnedPaths(scope, previous[key]!)) candidates.set(pathId(path), path);
+	if (candidates.size === 0) return [];
+	const retained = Object.values(remaining).flatMap((value) => extractOwnedPaths(scope, value));
+	const owned = [...candidates.values()].filter((path) =>
+		!retained.some((other) => related(path, other)) && exists(after, path));
+	return owned
+		.filter((path) => !owned.some((other) => other.keys.length < path.keys.length && related(path, other)))
+		.sort((left, right) => pathId(left).localeCompare(pathId(right)));
+}
+
+/** Express cascade targets as explicit nested object-key deletions. */
+export function cascadeDeletionPatch(paths: readonly OwnedPath[]): JsonObject {
+	const patch: JsonObject = {};
+	const define = (target: JsonObject, key: string, value: JsonValue) =>
+		Object.defineProperty(target, key, { value, enumerable: true, configurable: true, writable: true });
+	for (const path of paths) {
+		if (!Object.hasOwn(patch, path.plane)) define(patch, path.plane, {});
+		let node = patch[path.plane] as JsonObject;
+		for (const key of path.keys.slice(0, -1)) {
+			if (!Object.hasOwn(node, key)) define(node, key, {});
+			node = node[key] as JsonObject;
+		}
+		define(node, path.keys.at(-1)!, null);
+	}
+	return patch;
+}
+
+/** Render an ownership target as its scoped `read_state` path. */
+export function formatOwnedPath(scope: StateScope, path: OwnedPath): string {
+	return [scope, path.plane, ...path.keys].join(".");
+}
+
+/** Top-level `working`/`lazy` keys that at least one current intent of `scope` owns. */
+export function ownedTopLevelKeys(scope: StateScope, state: SemanticState): Record<OwnedPlane, Set<string>> {
+	const owned: Record<OwnedPlane, Set<string>> = { working: new Set(), lazy: new Set() };
+	const intents = isObject(state.intents) ? state.intents : {};
+	for (const value of Object.values(intents)) for (const path of extractOwnedPaths(scope, value)) owned[path.plane].add(path.keys[0]!);
+	return owned;
+}

package/node_modules/@llblab/pi-state-flow/lib/protocol.ts

@@ -1,5 +1,4 @@
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
-import { isObject } from "./json.ts";
 
 export type { StateDocument } from "./state.ts";
 
@@ -89,24 +88,24 @@ export function stateFlowProtocol(bootstrap: boolean): string {
 	return `State Flow is enabled. It owns durable memory.
 
 ${bootstrapProtocol}STATE:
-- intents: chosen active commitments; detail may stay lazy; remove when fulfilled, abandoned, superseded, or impossible.
-- contract: durable requirements, decisions, rejections, interfaces, compiled knowledge.
-- working: facts, validation, failures, domain state, unresolved work, continuation.
+- intents: queue of chosen actions; work from them; remove when fulfilled, abandoned, superseded, or impossible.
+- contract: durable requirements, decisions, rejections, interfaces.
+- working: temporary context of intents: facts, validation, failures, domain state.
 - artifacts: source-path routing metadata; descriptions do not imply body acquisition.
-- response: previous answer; runtime stores the exact accepted answer at turn_end (empty=""). Ordinary assistant completion needs no finalization patch.
+- response: previous answer; runtime stores the exact accepted answer at turn_end (empty="").
 - lazy: retrieve explicitly.
 
 SCOPES: Use the narrowest scope: session=branch/run continuation by default; cwd=reusable project truth; global=established cross-project/user/environment knowledge.
 
-READ: Use read_state for concrete scope/retained-history gaps. lazy_navigation lists bounded effective lazy keys, not bodies. Unscoped=effective; effective/global/cwd/session select overlay or owner. Arrays use indices or [start..end]; keys gives structure, patch the intersected change. ${TASK_DRIVEN_HISTORY}
+READ: Use read_state for concrete scope/retained-history gaps. lazy_navigation lists bounded effective lazy keys, not bodies. ${TASK_DRIVEN_HISTORY}
 
-WRITE: patch_state is the sole model-authored semantic mutation mechanism; all supplied scopes are validated and durably accepted as one atomic transition. Call alone in an assistant response; await acceptance. Global/CWD use current canonical values after cancelable lock waiting. Correct repeats succeed without new revisions. ${PATCH_RESULT_PROTOCOL}
+WRITE: patch_state is the sole model-authored semantic mutation mechanism; all supplied scopes are validated and durably accepted as one atomic transition. Global/CWD use current canonical values after cancelable lock waiting. Correct repeats succeed without new revisions. ${PATCH_RESULT_PROTOCOL}
 
 PATCH: Use global/cwd/session object patches for material updates, not acknowledgments. Omit empty scopes. artifacts/contract/working/intents are objects; lazy is ordinary JSON. Omitted fields persist. Never patch runtime config/meta/response. Objects merge recursively; arrays/primitives replace. An object containing only canonical "[N]" keys recursively patches array elements. Indexed deletion is forbidden; nested object null deletes; materialized null is forbidden.
 
 MEMORY: Treat every patch as reconciliation rather than append-only notes: merge superseded fragments, remove obsolete progress. Preserve commitments, open questions, consequential results and exact continuation; distinguish requirements, decisions, observations, conclusions and hypotheses. Exclude secrets, raw history, transient progress, speculation and unsupported claims; retain decision-relevant uncertainty. Curate touched state; cleanup and scope reviews require an explicit user request. Proven moves use targeted read_state and one atomic multi-scope patch, then verify both owners. External transfers need verified acceptance before deletion. Never invent memory changes.
 
-REFS: State refs use {"$ref":"cwd.lazy.plan"} or \`$cwd.lazy.plan\` in text. Resolve only when needed; infer no authority, hydration, execution, or completion. Hint paths are current reference owners, not relocated targets or proof of staleness. Fix proven stale refs only as needed; never scan refs or history offsets.
+REFS: State refs use {"$ref":"cwd.lazy.plan"} or \`$cwd.lazy.plan\` in text. In an intent, $ref owns a same-scope working/lazy key; deleting the intent deletes keys no other intent refs (supersede in one patch). Text refs only use. Before deleting, save survivors unowned: results to working/contract/broader scope, abandonment reasons to contract. Unowned entries are fine. Resolve only when needed; infer no authority, hydration, execution, or completion. Hint paths are current reference owners, not relocated targets or proof of staleness. Fix proven stale refs only as needed; never scan refs or history offsets.
 
 ACQUISITION: Read only for a concrete gap, exact source/edit, invalidation, contradiction/failure, or explicit request; changed source fingerprints require rereading.
 ARTIFACTS: Compile acquired invalidated artifacts at artifacts[exact path] in the reported scope (global/cwd/session), with a description; never relocate or invent global copies. Runtime owns all artifact/Skill provenance.

package/node_modules/@llblab/pi-state-flow/lib/query.ts

@@ -96,7 +96,7 @@ function parseValuePath(path: string): { root: string; selectors: ValueSelector[
 			rest = rest.slice(index[0].length);
 			continue;
 		}
-		throw new Error("Invalid State Flow read path selector");
+		throw new Error("Invalid State Flow read path selector; object keys must match [A-Za-z_$][A-Za-z0-9_$-]* (ASCII), array selectors use [N] or [start..end]");
 	}
 	return { root, selectors };
 }

package/node_modules/@llblab/pi-state-flow/lib/runtime.ts

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { lstatSync } from "node:fs";
 import { join } from "node:path";
 import { classifyScopeStream, hasCwdMaterialization, parseScopeProvenance, parseScopeStream, sessionRuntimePaths, temporalScopePaths, type SessionAddress } from "./durable.ts";
-import { parseArtifactProvenanceRegistry, pruneArtifactProvenance, type ArtifactProvenance, type ArtifactProvenanceRegistry } from "./artifact.ts";
+import { pruneArtifactProvenance, type ArtifactProvenance, type ArtifactProvenanceRegistry } from "./artifact.ts";
 import { assertTemporalFileBase, captureTemporalFileBase, initializeFileStore, publishTemporalStateToFiles, withStorageTransaction, type StorageTransaction, type TemporalFileBase } from "./storage.ts";
 import { DEFAULT_HISTORY_LIMIT, MAX_HISTORY_LIMIT, type AcceptedTransition, type RecentTransitionWindow } from "./history.ts";
 import { hashJson, sameJson } from "./json.ts";

package/node_modules/@llblab/pi-state-flow/lib/session.ts

@@ -1,4 +1,4 @@
-import { parseRetainedPiCheckpoint, type InactiveMode } from "./snapshot.ts";
+import { parseRetainedPiCheckpoint, readCheckpointMode, type InactiveMode, type StateFlowMode } from "./snapshot.ts";
 
 export const SNAPSHOT_ENTRY_TYPE = "state-flow-snapshot";
 
@@ -22,6 +22,8 @@ export interface PassiveStopBoundary {
 	persistenceError?: string;
 	/** The inactive mode selected by that failed change; legacy markers omit it. */
 	mode?: InactiveMode;
+	/** Native-only Off choice; canonical runtime mode is deliberately not updated. */
+	memoryDeferred?: true;
 }
 
 export interface SnapshotDiscovery {
@@ -44,6 +46,55 @@ export function discoverSnapshotData(branch: readonly BranchEntry[]): SnapshotDi
 	return { candidates, errors };
 }
 
+/** Read native mode policy only; semantic checkpoint validity remains the recovery owner's concern. */
+export function findBranchPolicy(
+	branch: readonly BranchEntry[], sessionId: string | undefined, stopEntryType: string | undefined, inactiveMode: InactiveMode,
+): { mode: StateFlowMode; persistenceError?: string } | undefined {
+	let stopReset = false;
+	for (let index = branch.length - 1; index >= 0; index--) {
+		try {
+			const entry = branch[index];
+			if (entry?.type !== "custom") continue;
+			if (entry.customType === SNAPSHOT_ENTRY_TYPE) {
+				const mode = readCheckpointMode(entry.data, inactiveMode);
+				if (mode !== undefined) return { mode };
+				const data = entry.data as { disabled?: unknown; mode?: unknown; enabled?: unknown } | undefined;
+				if (data?.disabled === true && !Object.hasOwn(data, "mode") && !Object.hasOwn(data, "enabled")) return { mode: inactiveMode };
+			} else if (stopEntryType !== undefined && entry.customType === stopEntryType) {
+				const data = entry.data as PassiveStopBoundary & { owner?: unknown; reset?: unknown } | undefined;
+				if (!data || stopReset || (sessionId === undefined ? typeof data.owner !== "string" || !data.owner.trim() : data.owner !== sessionId)) continue;
+				if (data.reset === true) { stopReset = true; continue; }
+				if (Number.isSafeInteger(data.at) && data.at >= 0 && data.memoryDeferred === true && data.mode === "off") {
+					return { mode: "off", ...(typeof data.persistenceError === "string" && data.persistenceError.trim() ? { persistenceError: data.persistenceError } : {}) };
+				}
+				if (Number.isSafeInteger(data.at) && data.at >= 0 && typeof data.persistenceError === "string" && data.persistenceError.trim()) {
+					return { mode: data.mode === "off" || data.mode === "passive" ? data.mode : inactiveMode, persistenceError: data.persistenceError };
+				}
+			}
+		} catch {
+			// Malformed native policy cannot prevent another explicit retained choice from being read.
+		}
+	}
+	return undefined;
+}
+
+/** Native policy bookkeeping retains an unacquired fork across extension reloads. */
+export function hasPendingFork(branch: readonly BranchEntry[], sessionId: string, entryType: string): boolean {
+	for (let index = branch.length - 1; index >= 0; index--) {
+		try {
+			const entry = branch[index];
+			if (entry?.type !== "custom" || entry.customType !== entryType) continue;
+			const data = entry.data as { owner?: unknown; reset?: unknown; forkPending?: unknown } | undefined;
+			if (data?.owner !== sessionId) continue;
+			if (data.reset === true) return false;
+			if (data.forkPending === true) return true;
+		} catch {
+			// Unrelated native entries grant no fork authority.
+		}
+	}
+	return false;
+}
+
 export function snapshotDataNewestFirst(branch: readonly BranchEntry[]): unknown[] {
 	return discoverSnapshotData(branch).candidates;
 }

package/node_modules/@llblab/pi-state-flow/lib/snapshot.ts

@@ -1,9 +1,8 @@
 import { resolve } from "node:path";
 import { parseArtifactProvenanceRegistry, type ArtifactProvenanceRegistry } from "./artifact.ts";
 import { MAX_HISTORY_LIMIT } from "./history.ts";
-import { applyPatch, canonicalJson, containsNull, isJsonValue, isObject, type JsonObject } from "./json.ts";
+import { canonicalJson, isJsonValue, isObject, type JsonObject } from "./json.ts";
 import { validateTemporalLineage, type TransitionBoundary } from "./temporal.ts";
-import { isMaterializedState, type MaterializedState } from "./state.ts";
 const MAX_RESTORED_STEP = Number.MAX_SAFE_INTEGER - 1;
 const MAX_LEGACY_VALIDATION_ATTEMPT = 7;
 
@@ -26,10 +25,12 @@ export interface SnapshotConfig {
 }
 
 /**
- * Read-only compatibility for session config and native checkpoints written before `mode`:
- * `enabled:true` stays active; `enabled:false` stays the caller's inactive policy.
+ * Read only mode policy, without validating or accessing semantic checkpoint metadata.
+ * Missing/invalid policy stays undecided; callers must not treat this as restoration proof.
+ * Legacy `enabled:false` follows the caller's inactive policy.
  */
-function decodeLegacyMode(value: JsonObject, inactiveMode: InactiveMode): StateFlowMode | undefined {
+export function readCheckpointMode(value: unknown, inactiveMode: InactiveMode = "passive"): StateFlowMode | undefined {
+	if (!isObject(value)) return undefined;
 	if (Object.hasOwn(value, "mode")) return Object.hasOwn(value, "enabled") || !isStateFlowMode(value.mode) ? undefined : value.mode;
 	return typeof value.enabled === "boolean" ? value.enabled ? "active" : inactiveMode : undefined;
 }
@@ -134,7 +135,7 @@ export function parseSessionRuntime(
 	let runtime: unknown;
 	try {
 		const settings: unknown = JSON.parse(config);
-		const mode = isObject(settings) && Object.keys(settings).length === 1 ? decodeLegacyMode(settings, "passive") : undefined;
+		const mode = isObject(settings) && Object.keys(settings).length === 1 ? readCheckpointMode(settings, "passive") : undefined;
 		if (mode === undefined) throw new Error("Invalid State Flow runtime configuration or counters");
 		runtime = { config: { mode }, meta: JSON.parse(runtimeSource) };
 	} catch (error) {
@@ -230,7 +231,7 @@ export function parseRetainedPiCheckpoint(value: unknown, inactiveMode: Inactive
 	if (keys.length === 1 && value.disabled === true) return { mode: inactiveMode };
 	if (keys.length === 1 && (value.mode === "passive" || value.mode === "off")) return { mode: value.mode };
 	const allowed = new Set(["boundary", "mode", "enabled", "step", "bootstrap", "specification"]);
-	const mode = decodeLegacyMode(value, inactiveMode);
+	const mode = readCheckpointMode(value, inactiveMode);
 	if (keys.some((key) => !allowed.has(key))
 		|| typeof value.boundary !== "string" || value.boundary.trim().length === 0
 		|| mode === undefined

package/node_modules/@llblab/pi-state-flow/lib/status.ts

@@ -1,5 +1,6 @@
 import type { ArtifactInvalidationReason } from "./artifact.ts";
 import type { RecentTransitionWindow } from "./history.ts";
+import { ownedTopLevelKeys } from "./ownership.ts";
 import { conciseDiagnostic } from "./protocol.ts";
 import type { Snapshot } from "./snapshot.ts";
 import { overlayStates, projectSemanticState, type SemanticState, type ScopedStates, type StateScope } from "./state.ts";
@@ -46,6 +47,33 @@ function countArtifacts(states: ScopedStates, scope: StateScope): number {
 	return Object.keys(states[scope].artifacts).length;
 }
 
+const STATUS_PLANES = ["intents", "contract", "working", "artifacts", "response", "lazy"] as const;
+const encoder = new TextEncoder();
+
+function isPresentPlane(value: unknown): boolean {
+	if (value === undefined || value === "") return false;
+	return typeof value !== "object" || value === null || Object.keys(value).length > 0;
+}
+
+/** Operator-only footprint: serialized plane sizes and intent-owned share of top-level working/lazy entries. */
+export function scopeMemoryLines(states: ScopedStates): string[] {
+	const lines: string[] = [];
+	for (const scope of ["global", "cwd", "session"] as const) {
+		const state = states[scope] as SemanticState;
+		const sizes = STATUS_PLANES.filter((plane) => isPresentPlane(state[plane]))
+			.map((plane) => `${plane} ${encoder.encode(JSON.stringify(state[plane])).length} B`);
+		if (sizes.length === 0) continue;
+		const owned = ownedTopLevelKeys(scope, state);
+		const shares = (["working", "lazy"] as const).flatMap((plane) => {
+			const value = state[plane];
+			const keys = value !== null && typeof value === "object" && !Array.isArray(value) ? Object.keys(value) : [];
+			return keys.length === 0 ? [] : [`${plane} ${keys.filter((key) => owned[plane].has(key)).length}/${keys.length}`];
+		});
+		lines.push(`- ${scope}: ${sizes.join(", ")}${shares.length ? `; intent-owned ${shares.join(", ")}` : ""}`);
+	}
+	return lines.length ? ["Scope memory:", ...lines] : [];
+}
+
 export function detailedStatus(snapshot: Snapshot, diagnostics: StatusDiagnostics): string {
 	const available = diagnostics.temporal !== undefined && diagnostics.durableStateError === undefined;
 	const materialized = !available ? undefined : diagnostics.effectiveState ?? projectSemanticState(overlayStates(
@@ -79,6 +107,7 @@ export function detailedStatus(snapshot: Snapshot, diagnostics: StatusDiagnostic
 		...(diagnostics.publicationError === undefined ? [] : [`Memory writes paused after mode change: ${conciseDiagnostic(diagnostics.publicationError)}`]),
 		...(hasArtifacts ? [`Artifacts: global ${artifacts("global")}; CWD ${artifacts("cwd")}; session ${artifacts("session")}; pending invalidations ${invalidated}`] : []),
 		...invalidationLines,
+		...(available ? scopeMemoryLines(diagnostics.scopeStates) : []),
 		...(stateJson === undefined
 			? ["Effective memory: unavailable"]
 			: ["Effective memory:", "", stateJson]),

package/node_modules/@llblab/pi-state-flow/lib/transition.ts

@@ -10,6 +10,7 @@ import {
 import type { SuccessfulArtifactRead } from "./acquisition.ts";
 import { createAcceptedTransition, type AcceptedTransition } from "./history.ts";
 import { applyPatch, containsNull, hashJson, isObject, validatePatch, type JsonObject } from "./json.ts";
+import { cascadeDeletionPatch, computeIntentCascade } from "./ownership.ts";
 import { hasCompiledSkillArtifact, SKILL_ARTIFACT_COMPILER, type SuccessfulSkillRead } from "./skills.ts";
 import type { Snapshot } from "./snapshot.ts";
 import { emptyState } from "./state.ts";
@@ -188,7 +189,10 @@ function stageScopedSemanticTransition(
 	for (const scope of SCOPES) {
 		const authored = patches.get(scope) ?? {};
 		const patch = { ...authored, ...(scope === "session" && acceptedResponse !== undefined ? { response: acceptedResponse } : {}) };
-		const materialized = applyPatch({ ...emptyState(), ...currentStates[scope] }, patch) as StateDocument;
+		let materialized = applyPatch({ ...emptyState(), ...currentStates[scope] }, patch) as StateDocument;
+		// Authored operations first, then the same-scope intent ownership cascade.
+		const cascade = computeIntentCascade(scope, currentStates[scope], materialized);
+		if (cascade.length > 0) materialized = applyPatch(materialized, cascadeDeletionPatch(cascade)) as StateDocument;
 		compileReadArtifacts(
 			materialized,
 			{ artifacts: authored.artifacts ?? {} },

package/node_modules/@llblab/pi-state-flow/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@llblab/pi-state-flow",
-  "version": "0.23.0",
+  "version": "0.25.0",
+  "license": "MIT",
   "private": false,
   "description": "Incremental scoped state/context/memory compiler for Pi, inspired by SKILL.state",
   "keywords": [
@@ -66,16 +67,16 @@
     "node": ">=22.19.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-agent-core": ">=0.87.0",
-    "@earendil-works/pi-ai": ">=0.87.0",
-    "@earendil-works/pi-coding-agent": ">=0.87.0",
-    "@earendil-works/pi-tui": ">=0.87.0"
+    "@earendil-works/pi-agent-core": ">=1.0.0",
+    "@earendil-works/pi-ai": ">=1.0.0",
+    "@earendil-works/pi-coding-agent": ">=1.0.0",
+    "@earendil-works/pi-tui": ">=1.0.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-agent-core": "0.87.0",
-    "@earendil-works/pi-ai": "0.87.0",
-    "@earendil-works/pi-coding-agent": "0.87.0",
-    "@earendil-works/pi-tui": "0.87.0",
+    "@earendil-works/pi-agent-core": "1.0.0",
+    "@earendil-works/pi-ai": "1.0.0",
+    "@earendil-works/pi-coding-agent": "1.0.0",
+    "@earendil-works/pi-tui": "1.0.0",
     "@types/node": "^26.4.0",
     "typescript": "^7.0.2"
   }