@llblab/pi-kit 0.27.0 → 0.27.2

package/BACKLOG.md

@@ -1,7 +1,11 @@
 # Backlog
 
-The 0.27.0 composition is recorded in [CHANGELOG.md](./CHANGELOG.md). Package pins, resource order and bundled runtime ownership remain authoritative in `package.json`.
+The 0.27.2 composition is recorded in [CHANGELOG.md](./CHANGELOG.md). Package pins, resource order and bundled runtime ownership remain authoritative in `package.json`.
 
 ## Carried checks
 
+- **Installed 0.27.2 cascade receipt smoke (operator-owned):** After separately authorized installation/reload, close an intent owning a nested lazy key in disposable State Flow storage and confirm the receipt lists its owner path under `cascaded`, without the body. Packed validation does not certify installed clients.
+
+- **Installed 0.27.1 Fast status smoke (operator-owned):** After separately authorized installation/reload, check Telegram menu Fast on/off and model switching for Codex and Claude Opus; unsupported Claude families must not show Fast. Use disposable settings and mocked quota where possible; do not mutate live stores or reconnect Telegram without separate authorization.
+
 - **Installed 0.27.0 smoke (operator-owned):** After separately authorized installation/reload, check the exact released kit's terminal controls and optional Telegram rendering with disposable State Flow storage. Packed SDK validation does not certify the operator's running clients. Do not reconnect Telegram, change Pi settings or use live memory/usage/Recipe stores as fixtures without separate authorization.

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.27.2: State Flow Cascade Receipts
+
+- `Cascade Receipts`: Advances the exact State Flow pin to published `0.25.1`. Accepted receipts now list every intent-cascaded owner path, including nested lazy keys, without exposing bodies or eliding the list as predictable. The lifecycle-state ceiling also counts const-bound operation slots and lifetimes. Other pins, resources, load order and storage semantics are unchanged.
+
+## 0.27.1: Telegram Fast Status
+
+- `Telegram Fast Status`: Advances Codex Usage to `0.12.1` and Claude Usage to `0.2.1`. Their Telegram rows now show the active model's Fast preference alongside quota, or alone when quota is unavailable, and reread it at menu render time. Claude retains Opus-only eligibility. Other pins, resource order and quota coordination are unchanged.
+
 ## 0.27.0: Intent-Owned State Flow Memory
 
 - `Intent-Owned Memory`: Advances the exact State Flow pin to published `0.25.0`. Deleting an intent removes the same-scope `working`/`lazy` keys it owns through structured `$ref`, so agents that work from intents keep memory self-cleaning. `/state-flow-status` shows per-scope plane sizes and intent-owned shares; lifecycle internals were consolidated without behaviour changes.

package/README.md

@@ -13,11 +13,11 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | Package | Version | Purpose |
 | --- | ---: | --- |
 | [`@llblab/pi-actors`](https://github.com/llblab/pi-actors) | `0.54.0` | Inspectable local Runs, reusable Recipes, persistent tools, and delegation Skills |
-| [`@llblab/pi-claude-usage`](https://github.com/llblab/pi-claude-usage) | `0.2.0` | Claude subscription quota status and shared per-model Fast toggle for Opus |
+| [`@llblab/pi-claude-usage`](https://github.com/llblab/pi-claude-usage) | `0.2.1` | Claude subscription quota status and shared per-model Fast toggle for Opus, mirrored in Telegram |
 | [`@llblab/pi-clean-room`](https://github.com/llblab/pi-clean-room) | `0.3.0` | Isolated nested Pi TUI with named npm extensions and compatible model selection |
-| [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.12.0` | Shared Codex quota/Business credit status and persistent priority Fast toggle |
+| [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.12.1` | Shared Codex quota/Business credit status and persistent priority Fast toggle, mirrored in Telegram |
 | [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.9.0` | Visible continuation scheduling and bounded worker Skills through compiled, manifest-owned resources |
-| [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.25.0` | Scoped context/memory compiler with intent-owned self-cleaning memory, memory-inert Off and ownership status |
+| [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.25.1` | Scoped context/memory compiler with intent-owned self-cleaning memory, memory-inert Off and ownership status |
 | [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.51.6` | Telegram companion with connection resume, Workspace slot recovery, follower Threads, filterable Skills, files, voice, and controls |
 | [`@llblab/skills`](https://github.com/llblab/skills) | `1.15.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 
@@ -25,7 +25,7 @@ Versions are exact by design. An upstream release does not change an installed k
 
 ## Install
 
-Requires **Pi 1.0.0+** and **Node.js 22.19.0+**. State Flow requires its canonical checkpoint/tail storage format and does not convert unsupported stores in place. Preserve existing stores and consult the [owning package's storage guidance](https://github.com/llblab/pi-state-flow/blob/v0.25.0/docs/usage.md#moving-a-store-and-supported-formats) before changing installations.
+Requires **Pi 1.0.0+** and **Node.js 22.19.0+**. State Flow requires its canonical checkpoint/tail storage format and does not convert unsupported stores in place. Preserve existing stores and consult the [owning package's storage guidance](https://github.com/llblab/pi-state-flow/blob/v0.25.1/docs/usage.md#moving-a-store-and-supported-formats) before changing installations.
 
 From npm:
 
@@ -45,7 +45,7 @@ Prefer the kit instead of separately loading the same packages. If you already u
 
 ## Development
 
-The `0.27.0` composition includes published State Flow `0.25.0` and Telegram `0.51.6` alongside the Pi 1.0 Actors, usage, Clean Room and Grow Loop cohort. The packed bundle loads all seven extensions on Pi 1.0.0 with no credentials or external requests. This does not certify installed-client rendering; carried checks remain in [Backlog](./BACKLOG.md).
+The `0.27.2` composition includes published State Flow `0.25.1` with complete cascade receipts, Codex Usage `0.12.1` and Claude Usage `0.2.1` with Telegram Fast status, alongside Telegram `0.51.6` and the Pi 1.0 cohort. The packed bundle loads all seven extensions on Pi 1.0.0 with no credentials or external requests. This does not certify installed-client rendering; carried checks remain in [Backlog](./BACKLOG.md).
 
 ```bash
 npm install

package/node_modules/@llblab/pi-claude-usage/AGENTS.md

@@ -4,7 +4,7 @@
 - `Pi baseline`: Every declared `@earendil-works/*` peer requires ≥1.0.0. Keep Pi peer lock identities aligned and validate against that host generation.
 - `Statusline-first scope`: Own usage state + usage mode; keep quota reporting zero-configuration and optional Fast on the existing terminal status.
   - Trigger: Considering commands, menus, persisted settings, or notification output.
-  - Action: Prefer deleting the surface unless it is required for the optimistic TUI status widget, optional `pi-telegram` `/start` status-line mirror, or the argument-free shared `/fast`. Register only the `anthropic` provider handler through `@llblab/pi-command-fast` on session_start; release on session_shutdown. Never register the command directly or gate it on quota auth. Claude Fast eligibility is consumer-owned: permit the `claude-opus-` family without a version allowlist; warn `Fast mode is supported only for Opus` for other families without writes. Family eligibility is not proof of backend support; preserve server capability/billing errors. For rejected models, ignore stale unsupported overrides in status/request adaptation, and leave Codex eligibility unchanged. The library owns session WeakMap/reload arbitration and generic JSONC; `lib/fast.ts` owns Claude semantics; require Pi ≥1.0.0 for its assembled-beta payload contract, rather than copying upstream beta defaults. ON is `speed: "fast"` in the current model override; OFF deletes the property. Preserve existing request speed/betas, append the required Fast beta to the native assembled list rather than replacing a header, and keep Fast out of quota state/Telegram. Toggle redraws through the final terminal boundary without a quota request or success notification; unreadable config fails closed for Fast only.
+  - Action: Prefer deleting the surface unless it is required for the optimistic TUI status widget, optional `pi-telegram` `/start` status-line mirror, or the argument-free shared `/fast`. Register only the `anthropic` provider handler through `@llblab/pi-command-fast` on session_start; release on session_shutdown. Never register the command directly or gate it on quota auth. Claude Fast eligibility is consumer-owned: permit the `claude-opus-` family without a version allowlist; warn `Fast mode is supported only for Opus` for other families without writes. Family eligibility is not proof of backend support; preserve server capability/billing errors. For rejected models, ignore stale unsupported overrides in status/request adaptation, and leave Codex eligibility unchanged. The library owns session WeakMap/reload arbitration and generic JSONC; `lib/fast.ts` owns Claude semantics; require Pi ≥1.0.0 for its assembled-beta payload contract, rather than copying upstream beta defaults. ON is `speed: "fast"` in the current model override; OFF deletes the property. Preserve existing request speed/betas, append the required Fast beta to the native assembled list rather than replacing a header, and keep Fast out of quota state. The optional Telegram row reads the active model's eligible Fast preference at render time and appends plain-text ` fast` (or shows `fast` alone without quota). Toggle redraws through the final terminal boundary without a quota request or success notification; unreadable config fails closed for Fast only.
 - `Domain boundaries`: `index.ts` is export-only; `lib/extension.ts` composes lifecycle/Fast registration and request hooks. `lib/status.ts` owns refresh orchestration and terminal timers; `usage-store.ts` owns claims/fencing/mutex, `query.ts` owns OAuth/HTTP, `usage.ts` owns quota normalization, `status-format.ts` owns presentation, and `telegram.ts` owns optional registration. Preserve mature quota/auth/leadership behavior, keep imports acyclic with no domain importing the entrypoint, and keep domain-focused tests in `tests/`. Do not merge usage extensions or redesign polling to add Fast.
 - `Optimistic refresh`: Preserve the last good statusline bar during refresh and transient failures.
   - Trigger: Updating quota polling or error handling.

package/node_modules/@llblab/pi-claude-usage/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.1: Telegram Fast Status
+
+- The optional Telegram status row now appends lowercase ` fast` for the active eligible Opus model, or shows `fast` alone when quota is unavailable. It rereads the per-model preference at menu render time, so toggles and model changes do not wait for quota refresh. Unsupported Claude families ignore stale Fast overrides. Quota polling, auth, request adaptation and terminal behavior are unchanged; isolated tests cover eligibility, model/provider changes and unreadable configuration.
+
 ## 0.2.0: Shared Fast Mode and Pi 1.0 Baseline
 
 - Split the monolithic extension into cohesive `lib/` domains matching Codex Usage: composition, status lifecycle, shared state, OAuth query, quota normalization, formatting, Telegram and Fast. `index.ts` now only re-exports the unchanged public API; tests follow domain owners. Quota/auth/leadership, mutex/fencing/backoff, status redraw and Fast behavior are preserved.

package/node_modules/@llblab/pi-claude-usage/README.md

@@ -78,7 +78,7 @@ When Claude Usage and Codex Usage are loaded together, their shared library regi
 claude ██████▀▀▀▀ 6d fast
 ```
 
-Exactly lowercase ` fast` uses the existing dim/countdown role at the final terminal presentation boundary, including loading, single-window percentages, `n/a` and errors. Telegram, quota OAuth, polling, mutex, fencing and backoff are unchanged.
+Exactly lowercase ` fast` uses the existing dim/countdown role at the final terminal presentation boundary, including loading, single-window percentages, `n/a` and errors. Telegram also appends plain-text ` fast` for the active eligible model; quota OAuth, polling, mutex, fencing and backoff are unchanged.
 
 Native request adaptation adds `speed: "fast"` without overwriting an explicit speed. It adds `fast-mode-2026-02-01` to Pi's already-assembled request `betas`, preserving automatic OAuth/thinking/streaming and configured betas; the Anthropic SDK converts that list to the final `anthropic-beta` HTTP header. Setting a replacement header earlier would suppress Pi's automatic betas, so no header replacement or custom provider/transport is used. See [Anthropic Fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode).
 
@@ -144,6 +144,8 @@ If `@llblab/pi-telegram` is loaded with the public status-line provider API, thi
 claude: ██████▀▀▀▀ 6d
 ```
 
+When Fast is enabled for the active Opus model, the row appends plain-text ` fast`; without a usable quota report it shows `claude: fast`. The preference is reread when the menu is rendered, so toggles and model changes do not depend on a quota refresh. Unsupported Claude families never show Fast, even with stale overrides.
+
 If `pi-telegram` is absent or older, or the active model is not Anthropic, no Telegram row is added.
 
 ## Auth

package/node_modules/@llblab/pi-claude-usage/lib/status.ts

@@ -4,9 +4,9 @@ import { type ExtensionAPI, type ExtensionContext, getAgentDir } from "@earendil
 import { isFastEnabled } from "./fast.ts";
 import { claimRefresh, isRefreshDue, nextRefreshAt, ownsRefreshClaim, publishRefresh, readState, MIN_ATTEMPT_GAP_MS, type SharedState } from "./usage-store.ts";
 import { isAnthropicModel, type ClaudeUsageModel, type ClaudeUsageReport } from "./usage.ts";
-import { DUAL_BAR_WIDTH, STATUS_LABEL_TEXT, formatClaudeUsageBar, formatClaudeUsageStatusValue, formatClaudeUsageStatusline, formatStatuslineLoading, formatStatuslineProblem, nextResetCountdownDelayMs } from "./status-format.ts";
+import { DUAL_BAR_WIDTH, formatClaudeUsageBar, formatClaudeUsageStatusline, formatStatuslineLoading, formatStatuslineProblem, nextResetCountdownDelayMs } from "./status-format.ts";
 import { queryUsage } from "./query.ts";
-import { registerClaudeUsageTelegramStatusLine } from "./telegram.ts";
+import { claudeUsageTelegramStatusLine, registerClaudeUsageTelegramStatusLine } from "./telegram.ts";
 
 const DEFAULT_TIMEOUT_MS = 15_000;
 const SECOND_MS = 1000;
@@ -57,12 +57,7 @@ export function createClaudeUsageStatus(pi: ExtensionAPI) {
   const ensureTelegramStatusLineRegistered = () => {
     if (unregisterTelegramStatusLine || telegramStatusLineRegistration) return;
     telegramStatusLineRegistration = registerClaudeUsageTelegramStatusLine(
-      ({ activeModel }) => {
-        if (!isAnthropicModel(activeModel)) return undefined;
-        if (!shown.report) return undefined;
-        const value = formatClaudeUsageStatusValue(shown.report);
-        return value ? { label: STATUS_LABEL_TEXT, value } : undefined;
-      },
+      ({ activeModel }) => claudeUsageTelegramStatusLine(shown.report, activeModel),
     )
       .then((unregister) => {
         unregisterTelegramStatusLine = unregister;

package/node_modules/@llblab/pi-claude-usage/lib/telegram.ts

@@ -1,5 +1,7 @@
 /** Domain: Telegram status. Owns: optional status-provider discovery and registration. Excludes: quota state and terminal decoration. */
-import type { ClaudeUsageModel } from "./usage.ts";
+import { isFastEnabled } from "./fast.ts";
+import { isAnthropicModel, type ClaudeUsageModel, type ClaudeUsageReport } from "./usage.ts";
+import { formatClaudeUsageStatusValue, STATUS_LABEL_TEXT } from "./status-format.ts";
 const CLAUDE_USAGE_EXTENSION_ID = "@llblab/pi-claude-usage";
 const TELEGRAM_STATUS_IMPORT_SPECIFIERS = [
   "@llblab/pi-telegram/status",
@@ -18,6 +20,18 @@ type TelegramStatusLineModule = {
   ) => () => void;
 };
 
+/** Read the selected model's preference at menu render time, not from the terminal cache. */
+export function claudeUsageTelegramStatusLine(
+  report: ClaudeUsageReport | undefined,
+  activeModel: ClaudeUsageModel | undefined,
+): TelegramStatusLineProviderResult {
+  if (!activeModel || !isAnthropicModel(activeModel)) return undefined;
+  const value = report ? formatClaudeUsageStatusValue(report) : undefined;
+  const fast = isFastEnabled(activeModel.id);
+  if (!value && !fast) return undefined;
+  return { label: STATUS_LABEL_TEXT, value: value ? `${value}${fast ? " fast" : ""}` : "fast" };
+}
+
 async function importTelegramStatusLineModule(): Promise<
   TelegramStatusLineModule | undefined
 > {

package/node_modules/@llblab/pi-claude-usage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-claude-usage",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": false,
   "description": "Minimal Pi extension that shows Anthropic Claude subscription usage limits using Pi OAuth auth",
   "keywords": [

package/node_modules/@llblab/pi-codex-usage/AGENTS.md

@@ -5,7 +5,7 @@
 - `Domain DAG`: `index.ts` only re-exports the extension and public contracts; `lib/extension.ts` composes the Pi extension. `lib/usage-store.ts` owns persistence/leadership, `lib/query.ts` owns quota I/O, `lib/usage.ts` owns normalized reports, `lib/status.ts` and `lib/status-format.ts` own local UI orchestration and formatting, `lib/telegram.ts` owns optional registration, and `lib/fast.ts` owns Codex Fast semantics/request adaptation. `@llblab/pi-command-fast` owns command arbitration and generic JSONC override editing. Keep dependency direction acyclic; do not import `index.ts` from `lib/` or mix Fast persistence into quota coordination. Place domain tests in `tests/<domain>.test.ts` (or a domain-prefixed focused integration test); use independent names such as `invariants.test.ts` only for cross-domain invariants.
 - `Statusline-first scope`: Own usage state + usage mode: keep quota reporting zero-configuration and the optional Fast toggle focused on the existing terminal status.
   - Trigger: Considering new commands, menus, persisted settings, or notification output.
-  - Action: Prefer deleting the surface unless it is required for the optimistic TUI status widget, the optional `pi-telegram` `/start` status-line mirror, or the existing argument-free `/fast` command. Register the `openai-codex` provider handler through `registerFastProvider` on session_start and release on session_shutdown; never register `/fast` directly or filter Fast by model ID/auth. Fast persists solely as `serviceTier: "priority"` in the current model override; OFF deletes only that property. Preserve JSONC/unrelated settings, existing wire tiers, and usage refresh/Telegram. Apply lowercase ` fast` through the final terminal boundary; toggle redraws without quota fetch or success notification. The library owns session WeakMap/reload arbitration, not Fast state. A Fast config read failure must not block usage status.
+  - Action: Prefer deleting the surface unless it is required for the optimistic TUI status widget, the optional `pi-telegram` `/start` status-line mirror, or the existing argument-free `/fast` command. Register the `openai-codex` provider handler through `registerFastProvider` on session_start and release on session_shutdown; never register `/fast` directly or filter Fast by model ID/auth. Fast persists solely as `serviceTier: "priority"` in the current model override; OFF deletes only that property. Preserve JSONC/unrelated settings, existing wire tiers, and usage refresh/Telegram. Apply lowercase ` fast` through the final terminal boundary; the optional Telegram row reads the active model's Fast preference at render time and appends plain-text ` fast` (or shows `fast` alone without quota). Toggle redraws without quota fetch or success notification. The library owns session WeakMap/reload arbitration, not Fast state. A Fast config read failure must not block usage status.
 - `Optimistic refresh`: Preserve the last good statusline bar during refresh and transient failures.
   - Trigger: Updating quota polling or error handling.
   - Action: Do not collapse the bar while a request is in flight; only show `n/a` or `error` after repeated failures or no usable quota.

package/node_modules/@llblab/pi-codex-usage/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.12.1: Telegram Fast Status
+
+- The optional Telegram status row now appends lowercase ` fast` for the active Codex model, or shows `fast` alone when quota is unavailable. It rereads the per-model preference at menu render time, so toggles, model changes and manual edits do not wait for quota refresh. Quota polling, auth, request adaptation and terminal behavior are unchanged; isolated tests cover enabled/disabled state, model/provider changes and unreadable configuration.
+
 ## 0.12.0: Shared Fast Mode and Pi 1.0 Baseline
 
 - Requires Pi ≥1.0.0 across the coding-agent, AI and agent-core peers; previous hosts are outside this release's compatibility contract.

package/node_modules/@llblab/pi-codex-usage/README.md

@@ -83,7 +83,7 @@ Enabled native requests receive `service_tier: "priority"` only when the payload
 codex ██████▀▀▀▀ 6d fast
 ```
 
-The lowercase ` fast` suffix uses the existing dim/countdown theme role and is applied at the final terminal boundary, including loading, percentages/credits, `n/a`, and errors. Telegram values and quota polling/auth/leadership are unchanged.
+The lowercase ` fast` suffix uses the existing dim/countdown theme role and is applied at the final terminal boundary, including loading, percentages/credits, `n/a`, and errors. Telegram also appends plain-text ` fast` for the active model; quota polling/auth/leadership are unchanged.
 
 Pi 1.0.0 accepts the extra override but does not propagate it to native request options, so a small `before_provider_request` adapter remains necessary; no replacement provider or transport is registered. Its public command API cannot hide/unregister commands by current model, so `/fast` stays listed and checks the provider at invocation. Backend capability and actual priority service are not guaranteed by a stored preference or suffix: an earlier authorized sample sent `priority` but received `default`. Priority service may have different provider pricing.
 
@@ -161,7 +161,7 @@ If `@llblab/pi-telegram` is loaded with the public status-line provider API, thi
 codex: ██████▀▀▀▀ 6d
 ```
 
-The value is the same compact quota bar plus weekly reset countdown used by the terminal statusline, always with the `codex` label. If `pi-telegram` is absent, older, or the active model is not a Codex subscription model, no Telegram row is added.
+The value is the same compact quota bar plus weekly reset countdown used by the terminal statusline, always with the `codex` label. When Fast is enabled for the active model, it appends plain-text ` fast`; without a usable quota report it shows `codex: fast`. The preference is reread when the menu is rendered, so toggles and model changes do not depend on a quota refresh. If `pi-telegram` is absent, older, or the active model is not a Codex subscription model, no Telegram row is added.
 
 ## Auth
 

package/node_modules/@llblab/pi-codex-usage/lib/status.ts

@@ -4,11 +4,10 @@ import { type ExtensionAPI, type ExtensionContext, getAgentDir } from "@earendil
 import { isFastEnabled, isFastEligibleModel } from "./fast.ts";
 import { claimRefresh, isRefreshDue, nextRefreshAt, ownsRefreshClaim, publishRefresh, readState, type SharedState, MIN_ATTEMPT_GAP_MS } from "./usage-store.ts";
 import { canReuseCachedReport, isFullyAvailableReport, isOpenAICodexModel, isUsageUnavailable, type CodexUsageModel, type CodexUsageReport } from "./usage.ts";
-import { appendFastStatus, formatReportBar, formatStatuslineLoading, formatStatuslineProblem, formatCodexUsageStatusValue, formatCodexUsageStatusline, nextResetCountdownDelayMs } from "./status-format.ts";
+import { appendFastStatus, formatReportBar, formatStatuslineLoading, formatStatuslineProblem, formatCodexUsageStatusline, nextResetCountdownDelayMs } from "./status-format.ts";
 import { queryUsage, type QueryUsageResult } from "./query.ts";
-import { registerCodexUsageTelegramStatusLine } from "./telegram.ts";
+import { codexUsageTelegramStatusLine, registerCodexUsageTelegramStatusLine } from "./telegram.ts";
 
-const DEFAULT_STATUS_LABEL_TEXT = "codex";
 const DEFAULT_TIMEOUT_MS = 15_000;
 const SECOND_MS = 1000;
 const MINUTE_MS = 60 * SECOND_MS;
@@ -64,14 +63,7 @@ export function createCodexUsageStatus(pi: ExtensionAPI) {
   const ensureTelegramStatusLineRegistered = () => {
     if (unregisterTelegramStatusLine || telegramStatusLineRegistration) return;
     telegramStatusLineRegistration = registerCodexUsageTelegramStatusLine(
-      ({ activeModel }) => {
-        if (!isOpenAICodexModel(activeModel)) return undefined;
-        if (!shown.report) return undefined;
-        const value = formatCodexUsageStatusValue(shown.report, activeModel);
-        return value
-          ? { label: DEFAULT_STATUS_LABEL_TEXT, value }
-          : undefined;
-      },
+      ({ activeModel }) => codexUsageTelegramStatusLine(shown.report, activeModel),
     )
       .then((unregister) => {
         unregisterTelegramStatusLine = unregister;

package/node_modules/@llblab/pi-codex-usage/lib/telegram.ts

@@ -1,5 +1,8 @@
 /** Domain: Telegram adapter. Owns: optional provider registration. Excludes: quota state and terminal formatting. */
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { isFastEnabled } from "./fast.ts";
+import { isOpenAICodexModel, type CodexUsageReport } from "./usage.ts";
+import { formatCodexUsageStatusValue } from "./status-format.ts";
 const CODEX_USAGE_EXTENSION_ID = "@llblab/pi-codex-usage";
 const TELEGRAM_STATUS_IMPORT_SPECIFIERS = [
   "@llblab/pi-telegram/status",
@@ -19,6 +22,18 @@ type TelegramStatusLineModule = {
   ) => () => void;
 };
 
+/** Read the selected model's preference at menu render time, not from the terminal cache. */
+export function codexUsageTelegramStatusLine(
+  report: CodexUsageReport | undefined,
+  activeModel: CodexUsageTelegramStatusModel | undefined,
+): TelegramStatusLineProviderResult {
+  if (!activeModel || !isOpenAICodexModel(activeModel)) return undefined;
+  const value = report ? formatCodexUsageStatusValue(report, activeModel) : undefined;
+  const fast = isFastEnabled(activeModel.id);
+  if (!value && !fast) return undefined;
+  return { label: "codex", value: value ? `${value}${fast ? " fast" : ""}` : "fast" };
+}
+
 async function importTelegramStatusLineModule(): Promise<
   TelegramStatusLineModule | undefined
 > {

package/node_modules/@llblab/pi-codex-usage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-codex-usage",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "private": false,
   "description": "Pi extension for Codex subscription usage and an optional Fast toggle",
   "keywords": [

package/node_modules/@llblab/pi-state-flow/BACKLOG.md

@@ -1,28 +1,24 @@
 # Backlog
 
-The **0.25.0: Intent-Owned Memory** scope is implemented and locally validated; outcomes are recorded in [CHANGELOG.md](CHANGELOG.md), with package, lockfile and changelog aligned at 0.25.0. This backlog keeps publication, installed-client evidence and later decisions open. Current contracts live in [architecture](docs/architecture.md), [usage](docs/usage.md) and [intent ownership](docs/lazy-state.md#intent-ownership).
+The **0.25.1: Cascade Receipts** scope is implemented; outcomes belong in [CHANGELOG.md](CHANGELOG.md). This backlog retains release and installed-client gates and deferred decisions. Cascade semantics, canonical storage, stored patch records and lifecycle behaviour remain unchanged.
+
+## Out of scope
+
+- Changing what a cascade deletes, including writes into an owned target made by the closing patch. That stays deleted by design and already appears in the receipt.
+- Nested `lazy_navigation`, warnings, validation or rejection of any kind.
+- Any reduction of lifecycle state; the tagged-union question stays deferred.
 
 ## Carried gates
 
-- **0.25.0 publication (approval-gated):** Commit the prepared tree and push the exact `v0.25.0` tag; then verify the tag's successful release workflow, published GitHub Release and matching npm package before reporting release completion.
-- **Installed 0.25.0 smoke (operator-owned):** After separately authorized installation/reload, use a disposable store. In `session` and in `cwd`: open an intent with owned `working` and `lazy` entries plus one textual mention, close it, and confirm the owned entries are gone, the mentioned one remains, the receipt lists the deletions and `/state-flow-status` shares update. Then supersede an intent in one patch and confirm its targets survive.
-- **Installed 0.22.0 smoke (operator-owned):** Perform the carried check if it is not yet recorded, only against the exact released 0.22.0 installation; a reload of a later candidate cannot certify the old release. After an operator-authorized reload, confirm:
-  - terminal autocomplete exposes Active/Passive/Off and status;
-  - Telegram shows the single `off | passive | active` row plus the four inspection buttons;
-  - current-session mode agrees across tools, context and status, and survives reload.
-  Do not edit real global defaults or unrelated sessions.
-- **Installed 0.23.0 smoke (operator-owned):** After separately authorized installation/reload, confirm an unconfigured *new* session is Off without semantic writes, retained choices and explicit global modes survive, and Telegram shows one `Off | Passive | Active` radio row with the selected 🟡/🟣/🟢 marker and ⚫️ inactive markers, followed by four direct scope inspections. Isolate test storage; do not use the live store as a fixture. SDK tests alone do not certify installed-client rendering.
-- **Installed 0.24.0 smoke (approval/operator-owned):** Local lifecycle, cancellation, background-work and callback/inspection acceptance is complete; real-client behavior remains separate evidence. After separately authorized installation/reload of the exact 0.24.0 release, use a disposable store to check Off attachment and pending-work cancellation, no late memory warnings, current read-only inspections without private placeholders, preserved deferred Passive/Active/fork acquisition, and unchanged terminal/Telegram mode controls. Do not use the live store, treat its reload as evidence for older published releases, or change unrelated operator sessions.
-
-## Deferred beyond 0.25.0 (decision inputs, not commitments)
-
-- **Convention uptake:** After some real use, read the `/state-flow-status` ownership shares; if most `working`/`lazy` entries stay unowned, revisit the protocol wording, not the mechanism.
-- **Behavioural evaluation:** Live-model comparison of Active against native compaction on one long cyclic task. Needs a policy decision first; current benchmarks are synthetic and make no model calls.
-- **Lifecycle real-use measurement (gated):** The operator install runs with `logging: true` and has no recorded `publication-conflict`, `finalization` or `barrier-block` entries; cooperating-writer waits, Stop fences and fork/restore contention are not instrumented. Removing any awaited layer for rarity first needs a decision to add opt-in counters.
-- **Lifecycle state as one tagged union:** The 0.25.0 lifecycle review left 17 closure bindings in `lib/extension.ts`, each a justified selection, run or host fact. Remaining candidates: the seven branch-selection facts (`snapshot`, `runtime`, `branchStartsWithoutRuntime`, `selectedHistoryExpired`, `modePersistenceError`, `forkInitialization`, `deferredBranch`) as one Off-deferred/attached union, and `passiveContinuation`/`bootstrapContinuation` as one continuation slot once their exclusivity is proven. Decide only with a behavioural reason; no further mechanical moves are pending.
-- **Skill compilation fidelity:** Hashes detect source change, not a lossy first compilation. Measure before adding anything.
-- **Compaction threshold:** `STATE_FLOW_COMPACTION_MIN_CONTEXT_TOKENS = 24_000` is documented as a margin above Pi's default 20,000-token retained suffix. Make it configurable only if a real workload or non-default Pi retention settings demonstrate a mismatch.
+- **Installed 0.25.1 smoke (operator-owned).** Disposable store: close an intent that owns a nested lazy key and confirm the receipt lists it under `cascaded`. May be combined with the open 0.25.0 smoke.
+- **Installed 0.22.0, 0.23.0, 0.24.0 and 0.25.0 smokes** remain open as recorded.
+
+## Deferred (decision inputs, not commitments)
+
+- **Closing-patch losses.** In real sessions, look for closing patches that write into a target the same patch cascades. If frequent, revisit the closing sentence in the protocol, not the mechanism.
+- Convention uptake, behavioural evaluation, lifecycle real-use measurement, lifecycle tagged union, Skill compilation fidelity and compaction threshold carry over unchanged from the 0.25.0 backlog.
 
 ## Release boundary
 
-Release publication is owned by `.github/workflows/release.yml`. Align package, lockfile, tag and changelog at the release version, rebuild `dist/` from final sources, run `npm run validate` and the context validator after context edits, and verify the exact tag's successful workflow, published GitHub Release and matching npm package before reporting release completion. Installed-instance reload remains a separate operator action.
+- **Publication (approval-gated).** After explicit authorization, commit the prepared 0.25.1 package, lockfile, changelog and rebuilt `dist/`, tag the exact commit `v0.25.1`, and push. Verify the exact-tag release workflow, non-draft GitHub Release and matching npm version/commit before closing this gate. Local readiness requires `npm run validate` and the context validator; it does not certify installed clients.
+- **Installation/reload (operator-owned).** Requires separate authorization and disposable storage. Grow Loop preparation does not cross publication or live-client gates.

package/node_modules/@llblab/pi-state-flow/CHANGELOG.md

@@ -2,9 +2,14 @@
 
 > Each release keeps at most 8 outcome records of at most 512 characters.
 
+## 0.25.1: Cascade Receipts
+
+- `Composition ceiling`: One invariant now counts mutable closure bindings plus `OwnedOperationSlot` and `RenewableLifetime` instances in `lib/extension.ts`, including const-bound holders, against the current total of 24 (17 + 5 + 2). Existing named owner assertions remain. Mutation checks reject an added binding, operation slot or lifetime; lifecycle source and behavior are unchanged.
+- `Cascade receipts`: `state_updates.cascaded` lists every owner-scoped target removed by intent deletion, including nested lazy keys invisible to effective updates and top-level navigation. Paths only, never bodies; deterministic across scopes and never elided as predictable. Staging passes its existing cascade to the context projection without recomputing ownership or changing stored records. Native Active/Passive tests verify each scope, and the always-injected protocol did not grow.
+
 ## 0.25.0: Intent-Owned Memory
 
-- `Intent-owned memory`: Deleting an intent key now deletes the same-scope `working`/`lazy` object keys its structured `{"$ref"}` values own, after authored operations in the same atomic cohort and revision, unless a remaining intent of that scope references the target, an ancestor or a descendant. Other targets and textual `$path` mentions are skipped silently; nothing is rejected, warned about or archived. Records store the cascade as explicit deletions and receipts report it.
+- `Intent-owned memory`: Deleting an intent deletes same-scope `working`/`lazy` keys its structured `{"$ref"}` values own, after authored operations in one atomic cohort/revision, unless a surviving intent references the target, an ancestor or descendant. Other targets and textual `$path` mentions are skipped silently; no rejection, warning or archive. Records store explicit deletions; receipts report effective changes and top-level lazy navigation, but omit nested lazy targets (fixed in 0.25.1).
 - `Work from intents`: Protocol, `patch_state` description, both Skills, README and docs present `intents` as the queue of chosen actions and `working` as their temporary context. Structured refs inside intents own; textual `$path` mentions only use. Before closing an intent, save survivors to unowned paths, with abandonment reasons in `contract`. Unowned entries stay legal. The always-injected protocol did not grow; duplicated read-path and barrier wording now lives only in the tool definitions.
 - `Ownership status`: `/state-flow-status` adds a per-scope `Scope memory:` block with UTF-8 sizes of present planes and the share of top-level `working`/`lazy` entries owned by an open intent. Operator-only; no notices, thresholds or model-facing effects.
 - `Composition root step one`: Completed-history compaction request state moves into `StateFlowCompactionRequests` and settled-turn backup/push state into `SettledTurnBackup`, cutting `lib/extension.ts` mutable closure bindings from 34 to 26 and adding an invariant ceiling. No behaviour change.

package/node_modules/@llblab/pi-state-flow/dist/lib/context.d.ts

@@ -3,8 +3,9 @@ import { type ArtifactInvalidationNotice, type ArtifactModelHints } from "./arti
 import type { RecentTransitionWindow } from "./history.ts";
 import { type JsonValue } from "./json.ts";
 import type { Snapshot } from "./snapshot.ts";
+import { type OwnedPath } from "./ownership.ts";
 import type { RehydrationPhase } from "./rehydration.ts";
-import { type AtomicScopePatches, type SemanticState } from "./state.ts";
+import { type AtomicScopePatches, type SemanticState, type StateScope } from "./state.ts";
 /** Refresh only our section; Pi owns system frames, tools and forced-prompt precedence. */
 export declare function projectSystemProtocol(messages: AgentMessage[], protocol: string | undefined): AgentMessage[];
 type LazyValueKind = "array" | "boolean" | "null" | "number" | "object" | "string";
@@ -48,7 +49,7 @@ export declare class ContextProjection {
     private notices;
     reset(): void;
     /** Called only after successful publication and ancillary acceptance, immediately before returning the native result. */
-    acceptPatch(before: SemanticState, after: SemanticState, patches: AtomicScopePatches, hints: ArtifactModelHints): {
+    acceptPatch(before: SemanticState, after: SemanticState, patches: AtomicScopePatches, hints: ArtifactModelHints, cascades?: Partial<Record<StateScope, readonly OwnedPath[]>>): {
         effective: ModelStateUpdate[];
         lazy_navigation?: {
             available: boolean;
@@ -56,6 +57,7 @@ export declare class ContextProjection {
             keys?: Record<string, LazyValueKind>;
         } | undefined;
         projection: `${string}-${string}-${string}-${string}-${string}`;
+        cascaded?: string[] | undefined;
     } | undefined;
     project(messages: AgentMessage[], current: ContextView, makeHead: () => AgentMessage, initial?: ContextView): AgentMessage[];
 }

package/node_modules/@llblab/pi-state-flow/dist/lib/context.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { projectArtifactForModel } from "./artifact.js";
 import { applyPatch, isObject, presentationJson, sameJson } from "./json.js";
+import { formatOwnedPath } from "./ownership.js";
 import { projectSemanticPatch, projectStateForModel } from "./state.js";
 /** Refresh only our section; Pi owns system frames, tools and forced-prompt precedence. */
 export function projectSystemProtocol(messages, protocol) {
@@ -144,7 +145,7 @@ export class ContextProjection {
         this.notices = [];
     }
     /** Called only after successful publication and ancillary acceptance, immediately before returning the native result. */
-    acceptPatch(before, after, patches, hints) {
+    acceptPatch(before, after, patches, hints, cascades = {}) {
         const state = projectStateForModel(after, hints);
         const navigation = lazyNavigationHint(after);
         const beforeNavigation = this.view?.lazy_navigation ?? lazyNavigationHint(before);
@@ -252,7 +253,11 @@ export class ContextProjection {
         }
         if (this.view)
             this.view = { ...this.view, state, lazy_navigation: navigation };
-        return updates.effective.length || updates.lazy_navigation ? { projection: this.identity, ...updates } : undefined;
+        // Owner paths remain informative even when effective state/navigation is masked
+        // or the model could predict every direct write. Never expose target values.
+        const cascaded = ["global", "cwd", "session"].flatMap((scope) => (cascades[scope] ?? []).map((path) => formatOwnedPath(scope, path)));
+        return updates.effective.length || updates.lazy_navigation || cascaded.length
+            ? { projection: this.identity, ...updates, ...(cascaded.length ? { cascaded } : {}) } : undefined;
     }
     project(messages, current, makeHead, initial) {
         const identities = messages.map((message) => JSON.stringify([message.role, message.timestamp,

package/node_modules/@llblab/pi-state-flow/dist/lib/extension.js

@@ -801,7 +801,7 @@ export default function stateFlowExtension(pi, options = {}) {
                     }
                     clearAcceptedAcquisitions(new Set(acquiredArtifacts.map(({ path }) => path)));
                     updateUi(ctx);
-                    const updates = contextProjection.acceptPatch(previousEffective, effectiveState, patches, acquisition.hints);
+                    const updates = contextProjection.acceptPatch(previousEffective, effectiveState, patches, acquisition.hints, stage.cascades);
                     const acknowledgement = changed
                         ? `\nState materialized atomically at ${scopes.join("+")} scope${scopes.length === 1 ? "" : "s"}.`
                         : "\nState already current.";

package/node_modules/@llblab/pi-state-flow/dist/lib/protocol.d.ts

@@ -1,6 +1,6 @@
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
 export type { StateDocument } from "./state.ts";
-export declare const PASSIVE_MEMORY_PROTOCOL = "State Flow passive memory is available. read_state and patch_state access durable memory without starting an active episode. Passive turns never trigger State Flow continuation or compaction. Missing paths/hints do not require history search. Choose targeted historical reads when useful to the task; no separate user permission is needed. Past values are evidence, not current state; never automatically restore deleted memory. Head state/recent transitions are frozen at projection start. Only state_updates matching the head's State Flow projection ID apply; older IDs are history. When present, patch_state results/context-update notices carry state_updates: effective entries replace values at key/index-segment path arrays (deleted:true means absent); direct writes need no echo; shared drift remains visible. Latest entries win over earlier state at those paths; lazy bodies remain omitted. Notices replace invalidations/rehydration, including []/null.";
+export declare const PASSIVE_MEMORY_PROTOCOL = "State Flow passive memory is available. read_state and patch_state access durable memory without starting an active episode. Passive turns never trigger State Flow continuation or compaction. Missing paths/hints do not require history search. Choose targeted historical reads when useful to the task; no separate user permission is needed. Past values are evidence, not current state; never automatically restore deleted memory. Head state/recent transitions are frozen at projection start. Only state_updates matching the head's State Flow projection ID apply; other IDs are history. Results/context notices carry state_updates: effective entries replace values at key/index-segment path arrays (deleted:true means absent); cascaded lists owner paths an intent deletion removed. Direct writes may elide; shared drift stays visible. Latest entries win over earlier state; lazy bodies stay omitted. Notices replace invalidations/rehydration, including []/null.";
 /** Keep successful patch JSON valid while separating adjacent scopes and memory sections visually. */
 export declare function formatPatchStateArguments(args: unknown): string;
 /** Flatten causes before transport; native tool results need not retain Error.cause or AggregateError.errors. */

package/node_modules/@llblab/pi-state-flow/dist/lib/protocol.js

@@ -1,5 +1,5 @@
 const TASK_DRIVEN_HISTORY = "Missing paths/hints do not require history search. Choose targeted historical reads when useful to the task; no separate user permission is needed. Past values are evidence, not current state; never automatically restore deleted memory.";
-const PATCH_RESULT_PROTOCOL = "Head state/recent transitions are frozen at projection start. Only state_updates matching the head's State Flow projection ID apply; older IDs are history. When present, patch_state results/context-update notices carry state_updates: effective entries replace values at key/index-segment path arrays (deleted:true means absent); direct writes need no echo; shared drift remains visible. Latest entries win over earlier state at those paths; lazy bodies remain omitted. Notices replace invalidations/rehydration, including []/null.";
+const PATCH_RESULT_PROTOCOL = "Head state/recent transitions are frozen at projection start. Only state_updates matching the head's State Flow projection ID apply; other IDs are history. Results/context notices carry state_updates: effective entries replace values at key/index-segment path arrays (deleted:true means absent); cascaded lists owner paths an intent deletion removed. Direct writes may elide; shared drift stays visible. Latest entries win over earlier state; lazy bodies stay omitted. Notices replace invalidations/rehydration, including []/null.";
 export const PASSIVE_MEMORY_PROTOCOL = `State Flow passive memory is available. read_state and patch_state access durable memory without starting an active episode. Passive turns never trigger State Flow continuation or compaction. ${TASK_DRIVEN_HISTORY} ${PATCH_RESULT_PROTOCOL}`;
 const PATCH_DISPLAY_SECTION_KEYS = new Set(["global", "cwd", "session", "intents", "contract", "working", "artifacts", "response", "lazy"]);
 /** Keep successful patch JSON valid while separating adjacent scopes and memory sections visually. */

package/node_modules/@llblab/pi-state-flow/dist/lib/transition.d.ts

@@ -1,11 +1,14 @@
 import { type ArtifactProvenance } from "./artifact.ts";
 import type { SuccessfulArtifactRead } from "./acquisition.ts";
 import { type AcceptedTransition } from "./history.ts";
+import { type OwnedPath } from "./ownership.ts";
 import { type SuccessfulSkillRead } from "./skills.ts";
 import type { Snapshot } from "./snapshot.ts";
 import type { AtomicScopePatches, ScopedSemanticStates, StateScope, TerminalTransition } from "./state.ts";
 export interface StagedScopedTransition {
     nextStates: ScopedSemanticStates;
+    /** Scope-local targets removed by the staged intent cascade, not replay input. */
+    cascades: Record<StateScope, OwnedPath[]>;
     stateHashes: Record<StateScope, string>;
     /** Fresh runtime-owned provenance for artifacts compiled in this transition. */
     provenanceUpdates: Record<StateScope, Record<string, ArtifactProvenance>>;

package/node_modules/@llblab/pi-state-flow/dist/lib/transition.js

@@ -136,12 +136,13 @@ function stageScopedSemanticTransition(currentStates, transition, successfulSkil
     validateSkillCompilerTargets(patches, skillReads);
     const nextStates = { ...currentStates };
     const provenanceUpdates = { global: {}, cwd: {}, session: {} };
+    const cascades = { global: [], cwd: [], session: [] };
     for (const scope of SCOPES) {
         const authored = patches.get(scope) ?? {};
         const patch = { ...authored, ...(scope === "session" && acceptedResponse !== undefined ? { response: acceptedResponse } : {}) };
         let materialized = applyPatch({ ...emptyState(), ...currentStates[scope] }, patch);
         // Authored operations first, then the same-scope intent ownership cascade.
-        const cascade = computeIntentCascade(scope, currentStates[scope], materialized);
+        const cascade = cascades[scope] = computeIntentCascade(scope, currentStates[scope], materialized);
         if (cascade.length > 0)
             materialized = applyPatch(materialized, cascadeDeletionPatch(cascade));
         compileReadArtifacts(materialized, { artifacts: authored.artifacts ?? {} }, artifactReads.filter((read) => (read.scope ?? "global") === scope), provenanceUpdates[scope]);
@@ -157,6 +158,7 @@ function stageScopedSemanticTransition(currentStates, transition, successfulSkil
     }
     return {
         nextStates,
+        cascades,
         provenanceUpdates,
         stateHashes: {
             global: hashJson(currentStates.global),

package/node_modules/@llblab/pi-state-flow/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-state-flow",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "license": "MIT",
   "private": false,
   "description": "Incremental scoped state/context/memory compiler for Pi, inspired by SKILL.state",

package/node_modules/@llblab/pi-state-flow/dist/skills/state-flow-guide/SKILL.md

@@ -32,7 +32,7 @@ Scopes overlay `global → cwd → session`: cross-project, project, branch/run.
 
 ## Read
 
-Reuse sufficient visible state. The memory head and its recent transitions are frozen at projection start. Apply later `state_updates` only when their `projection` matches the head's `State Flow projection:` ID; older native results remain historical. Effective update paths are key/index arrays whose values replace that path, while `deleted: true` means absence. Current notices can replace invalidation lists or rehydration phase, including clearing them with `[]` or `null`; lazy bodies still require explicit reads.
+Reuse sufficient visible state. The memory head and its recent transitions are frozen at projection start. Apply later `state_updates` only when their `projection` matches the head's `State Flow projection:` ID; older native results remain historical. Effective update paths are key/index arrays whose values replace that path, while `deleted: true` means absence. The optional `cascaded` array lists owner-scoped paths removed by intent deletion, including nested lazy keys; it contains no values, is never elided, and does not mean the effective path is absent if a broader-scope value remains. Current notices can replace invalidation lists or rehydration phase, including clearing them with `[]` or `null`; lazy bodies still require explicit reads.
 
 `read_state` accepts `path` or `paths`, never both. Multi-path reads succeed or fail together. Projections: `value` (default), `keys` (structure), `patch` (intersecting change at the selected boundary).
 

package/node_modules/@llblab/pi-state-flow/docs/architecture.md

@@ -122,7 +122,7 @@ checkpoint.json + patches.jsonl
 
 ### `state_updates` receipts
 
-A successful native tool result includes a `state_updates` block, separate from the compact acknowledgement used by interactive rendering. The context domain owns this projection, not storage or the lifecycle composition root.
+A successful native tool result may include a `state_updates` block, separate from the compact acknowledgement used by interactive rendering. The context domain owns this projection, not storage or the lifecycle composition root.
 
 **Shape.** `effective` entries contain a `path` array of exact object keys/array indices, plus either a replacing `value` or `deleted: true`.
 
@@ -131,9 +131,10 @@ A successful native tool result includes a `state_updates` block, separate from
 - Indexed-array patch selectors become numeric update paths only against a communicated in-bounds array basis. Object keys with the same spelling are literal.
 - Artifact cards use the normal metadata filter, and touched cards replace their whole projected entry.
 - Lazy bodies never enter this block; a changed bounded `lazy_navigation` may accompany it.
-- Unrelated unchanged branches are omitted. A result with nothing left to reconcile has only the acknowledgement.
+- An optional `cascaded` array lists owner-scoped paths removed by intent deletion, including nested lazy targets that do not change the top-level navigation. It contains paths only, never values, and is absent when no target cascaded.
+- Unrelated unchanged branches are omitted. A result with nothing left to reconcile and no cascade has only the acknowledgement.
 
-**What is always included.** Entries conservatively cover changed scope fallbacks, masked or overlapping multi-scope touches, and projected changes since the last communicated view, including shared refreshes before or during the transaction.
+**What is always included.** Entries conservatively cover changed scope fallbacks, masked or overlapping multi-scope touches, and projected changes since the last communicated view, including shared refreshes before or during the transaction. `cascaded` lists every target computed during accepted staging, in deterministic per-scope order across Global, CWD and Session. It is never elided as predictable: a receipt with only `cascaded` and an empty `effective` array still reaches the model. The owner path does not imply effective absence; `effective` entries still describe any revealed fallback.
 
 **What may be omitted as predictable:**
 

package/node_modules/@llblab/pi-state-flow/docs/lazy-state.md

@@ -134,9 +134,11 @@ Intents can own the memory they create:
 - missing targets;
 - keys outside the `read_state` key grammar `[A-Za-z_$][A-Za-z0-9_$-]*`, for example keys with spaces, dots or non-Latin letters.
 
+**Receipt.** `state_updates.cascaded` lists all owner-scoped targets removed by intent deletion, for example `["session.lazy.plans.x", "session.working.draft"]`. Paths only, never lazy bodies or deleted values. The list is deterministic (Global, CWD, Session, then each scope's cascade order), absent when no target cascaded, and never omitted as a predictable write. Nested lazy deletions are reported even when the top-level `lazy_navigation` catalog is unchanged.
+
 **Edge cases:**
 
-- Deletion is scope-local, so an effective read may afterwards show a same-path value inherited from a broader scope. The receipt then reports that value rather than `deleted: true`.
+- Deletion is scope-local, so an effective read may afterwards show a same-path value inherited from a broader scope. The receipt's `effective` entry then reports that value rather than `deleted: true`; `cascaded` still identifies the deleted owner path.
 - Concurrent shared writers keep last-accepted-wins behaviour: a later write into an intent another session already deleted simply recreates a partial intent.
 
 **History and limits.** The accepted patch record stores cascaded keys as explicit deletions, so replay never re-derives them, and nothing is archived beyond ordinary retained history. Ownership adds no validation, unresolved-reference warning, cross-scope cascade, age-based cleanup, size budget, growth notice, archive of deleted entries or automatic hydration.

package/node_modules/@llblab/pi-state-flow/lib/context.ts

@@ -4,6 +4,7 @@ import { projectArtifactForModel, type ArtifactInvalidationNotice, type Artifact
 import type { RecentTransitionWindow } from "./history.ts";
 import { applyPatch, isObject, presentationJson, sameJson, type JsonObject, type JsonValue } from "./json.ts";
 import type { Snapshot } from "./snapshot.ts";
+import { formatOwnedPath, type OwnedPath } from "./ownership.ts";
 import type { RehydrationPhase } from "./rehydration.ts";
 import { projectSemanticPatch, projectStateForModel, type AtomicScopePatches, type SemanticState, type StateScope } from "./state.ts";
 
@@ -138,7 +139,8 @@ export class ContextProjection {
 	}
 
 	/** Called only after successful publication and ancillary acceptance, immediately before returning the native result. */
-	acceptPatch(before: SemanticState, after: SemanticState, patches: AtomicScopePatches, hints: ArtifactModelHints) {
+	acceptPatch(before: SemanticState, after: SemanticState, patches: AtomicScopePatches, hints: ArtifactModelHints,
+		cascades: Partial<Record<StateScope, readonly OwnedPath[]>> = {}) {
 		const state = projectStateForModel(after, hints);
 		const navigation = lazyNavigationHint(after);
 		const beforeNavigation = this.view?.lazy_navigation ?? lazyNavigationHint(before);
@@ -228,7 +230,12 @@ export class ContextProjection {
 			if (predictable && seen.size > 0 && sameJson(Object.fromEntries(expected), navigation.keys)) delete updates.lazy_navigation;
 		}
 		if (this.view) this.view = { ...this.view, state, lazy_navigation: navigation };
-		return updates.effective.length || updates.lazy_navigation ? { projection: this.identity, ...updates } : undefined;
+		// Owner paths remain informative even when effective state/navigation is masked
+		// or the model could predict every direct write. Never expose target values.
+		const cascaded = (["global", "cwd", "session"] as const).flatMap((scope) =>
+			(cascades[scope] ?? []).map((path) => formatOwnedPath(scope, path)));
+		return updates.effective.length || updates.lazy_navigation || cascaded.length
+			? { projection: this.identity, ...updates, ...(cascaded.length ? { cascaded } : {}) } : undefined;
 	}
 
 	project(messages: AgentMessage[], current: ContextView, makeHead: () => AgentMessage, initial?: ContextView): AgentMessage[] {

package/node_modules/@llblab/pi-state-flow/lib/extension.ts

@@ -807,7 +807,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 					}
 					clearAcceptedAcquisitions(new Set(acquiredArtifacts.map(({ path }) => path)));
 					updateUi(ctx);
-					const updates = contextProjection.acceptPatch(previousEffective, effectiveState, patches, acquisition.hints);
+					const updates = contextProjection.acceptPatch(previousEffective, effectiveState, patches, acquisition.hints, stage.cascades);
 					const acknowledgement = changed
 						? `\nState materialized atomically at ${scopes.join("+")} scope${scopes.length === 1 ? "" : "s"}.`
 						: "\nState already current.";

package/node_modules/@llblab/pi-state-flow/lib/protocol.ts

@@ -4,7 +4,7 @@ export type { StateDocument } from "./state.ts";
 
 const TASK_DRIVEN_HISTORY = "Missing paths/hints do not require history search. Choose targeted historical reads when useful to the task; no separate user permission is needed. Past values are evidence, not current state; never automatically restore deleted memory.";
 
-const PATCH_RESULT_PROTOCOL = "Head state/recent transitions are frozen at projection start. Only state_updates matching the head's State Flow projection ID apply; older IDs are history. When present, patch_state results/context-update notices carry state_updates: effective entries replace values at key/index-segment path arrays (deleted:true means absent); direct writes need no echo; shared drift remains visible. Latest entries win over earlier state at those paths; lazy bodies remain omitted. Notices replace invalidations/rehydration, including []/null.";
+const PATCH_RESULT_PROTOCOL = "Head state/recent transitions are frozen at projection start. Only state_updates matching the head's State Flow projection ID apply; other IDs are history. Results/context notices carry state_updates: effective entries replace values at key/index-segment path arrays (deleted:true means absent); cascaded lists owner paths an intent deletion removed. Direct writes may elide; shared drift stays visible. Latest entries win over earlier state; lazy bodies stay omitted. Notices replace invalidations/rehydration, including []/null.";
 
 export const PASSIVE_MEMORY_PROTOCOL = `State Flow passive memory is available. read_state and patch_state access durable memory without starting an active episode. Passive turns never trigger State Flow continuation or compaction. ${TASK_DRIVEN_HISTORY} ${PATCH_RESULT_PROTOCOL}`;
 

package/node_modules/@llblab/pi-state-flow/lib/transition.ts

@@ -10,7 +10,7 @@ import {
 import type { SuccessfulArtifactRead } from "./acquisition.ts";
 import { createAcceptedTransition, type AcceptedTransition } from "./history.ts";
 import { applyPatch, containsNull, hashJson, isObject, validatePatch, type JsonObject } from "./json.ts";
-import { cascadeDeletionPatch, computeIntentCascade } from "./ownership.ts";
+import { cascadeDeletionPatch, computeIntentCascade, type OwnedPath } from "./ownership.ts";
 import { hasCompiledSkillArtifact, SKILL_ARTIFACT_COMPILER, type SuccessfulSkillRead } from "./skills.ts";
 import type { Snapshot } from "./snapshot.ts";
 import { emptyState } from "./state.ts";
@@ -29,6 +29,8 @@ import type {
 
 export interface StagedScopedTransition {
 	nextStates: ScopedSemanticStates;
+	/** Scope-local targets removed by the staged intent cascade, not replay input. */
+	cascades: Record<StateScope, OwnedPath[]>;
 	stateHashes: Record<StateScope, string>;
 	/** Fresh runtime-owned provenance for artifacts compiled in this transition. */
 	provenanceUpdates: Record<StateScope, Record<string, ArtifactProvenance>>;
@@ -186,12 +188,13 @@ function stageScopedSemanticTransition(
 	validateSkillCompilerTargets(patches, skillReads);
 	const nextStates = { ...currentStates };
 	const provenanceUpdates: Record<StateScope, Record<string, ArtifactProvenance>> = { global: {}, cwd: {}, session: {} };
+	const cascades: Record<StateScope, OwnedPath[]> = { global: [], cwd: [], session: [] };
 	for (const scope of SCOPES) {
 		const authored = patches.get(scope) ?? {};
 		const patch = { ...authored, ...(scope === "session" && acceptedResponse !== undefined ? { response: acceptedResponse } : {}) };
 		let materialized = applyPatch({ ...emptyState(), ...currentStates[scope] }, patch) as StateDocument;
 		// Authored operations first, then the same-scope intent ownership cascade.
-		const cascade = computeIntentCascade(scope, currentStates[scope], materialized);
+		const cascade = cascades[scope] = computeIntentCascade(scope, currentStates[scope], materialized);
 		if (cascade.length > 0) materialized = applyPatch(materialized, cascadeDeletionPatch(cascade)) as StateDocument;
 		compileReadArtifacts(
 			materialized,
@@ -210,6 +213,7 @@ function stageScopedSemanticTransition(
 	}
 	return {
 		nextStates,
+		cascades,
 		provenanceUpdates,
 		stateHashes: {
 			global: hashJson(currentStates.global),

package/node_modules/@llblab/pi-state-flow/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-state-flow",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "license": "MIT",
   "private": false,
   "description": "Incremental scoped state/context/memory compiler for Pi, inspired by SKILL.state",

package/node_modules/@llblab/pi-state-flow/skills/state-flow-guide/SKILL.md

@@ -32,7 +32,7 @@ Scopes overlay `global → cwd → session`: cross-project, project, branch/run.
 
 ## Read
 
-Reuse sufficient visible state. The memory head and its recent transitions are frozen at projection start. Apply later `state_updates` only when their `projection` matches the head's `State Flow projection:` ID; older native results remain historical. Effective update paths are key/index arrays whose values replace that path, while `deleted: true` means absence. Current notices can replace invalidation lists or rehydration phase, including clearing them with `[]` or `null`; lazy bodies still require explicit reads.
+Reuse sufficient visible state. The memory head and its recent transitions are frozen at projection start. Apply later `state_updates` only when their `projection` matches the head's `State Flow projection:` ID; older native results remain historical. Effective update paths are key/index arrays whose values replace that path, while `deleted: true` means absence. The optional `cascaded` array lists owner-scoped paths removed by intent deletion, including nested lazy keys; it contains no values, is never elided, and does not mean the effective path is absent if a broader-scope value remains. Current notices can replace invalidation lists or rehydration phase, including clearing them with `[]` or `null`; lazy bodies still require explicit reads.
 
 `read_state` accepts `path` or `paths`, never both. Multi-path reads succeed or fail together. Projections: `value` (default), `keys` (structure), `patch` (intersecting change at the selected boundary).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-kit",
-  "version": "0.27.0",
+  "version": "0.27.2",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -42,11 +42,11 @@
   ],
   "dependencies": {
     "@llblab/pi-actors": "0.54.0",
-    "@llblab/pi-claude-usage": "0.2.0",
+    "@llblab/pi-claude-usage": "0.2.1",
     "@llblab/pi-clean-room": "0.3.0",
-    "@llblab/pi-codex-usage": "0.12.0",
+    "@llblab/pi-codex-usage": "0.12.1",
     "@llblab/pi-grow-loop": "0.9.0",
-    "@llblab/pi-state-flow": "0.25.0",
+    "@llblab/pi-state-flow": "0.25.1",
     "@llblab/pi-telegram": "0.51.6",
     "@llblab/skills": "1.15.0"
   },