@llblab/pi-kit 0.28.0 → 0.29.0

package/BACKLOG.md

@@ -1,9 +1,10 @@
 # Backlog
 
-The 0.28.0 composition advances Telegram to 0.52.0; package pins, resource order and bundled runtime ownership remain authoritative in `package.json`. Release outcomes belong in [CHANGELOG.md](./CHANGELOG.md).
+The 0.29.0 composition advances State Flow to 0.26.0; package pins, resource order and bundled runtime ownership remain authoritative in `package.json`. Release outcomes belong in [CHANGELOG.md](./CHANGELOG.md).
 
 ## Carried checks
 
+- **Installed 0.29.0 State Flow smoke (operator-owned):** After separately authorized installation/reload, use disposable storage to confirm `/tree` to an old step and reload keep current memory writable in Active and Passive, a fork copies the parent's current memory, and unreadable current files show `active (blocked)` with Passive retry and Off releasing inference only. Packed validation does not certify installed clients.
 - **Installed 0.28.0 Telegram smoke (operator-owned):** After separately authorized installation/reload and queue drain or accepted waiting-work loss, confirm Restore/routing controls and follower delivery with disposable runtime storage. Do not test damaged-state reset against live shared state. Windows Restore remains fail-closed without strict evidence; packed validation does not certify installed clients.
 - **Installed 0.27.6 restoration/compaction smoke (operator-owned):** After separately authorized installation/reload, use disposable storage to confirm failed Active restoration blocks provider inference across tree/reload, explicit mode recovery remains available, and native Codemode values/deletions survive completed-history compaction. Packed validation does not certify installed clients.
 - **Installed 0.27.5 cleanup smoke (operator-owned):** After separately authorized installation/reload, confirm State Flow missing-deletion hints, recursive empty-object cleanup, inherited fallback and preserved array slots in disposable storage. Packed validation does not certify installed clients.

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.29.0: State Flow Stable Modes
+
+- `Step-independent memory`: Advances the exact State Flow pin to `0.26.0`. Memory no longer depends on the Pi step: startup, reload, resume and `/tree` attach current same-session memory, old branch points never block or rewind it, and forks copy the parent's current memory. Passive stays writable across reload; unreadable memory under Active shows `active (blocked)`. Other pins, resources and load order are unchanged.
+
 ## 0.28.0: Telegram Workspace Restore and Runtime Resilience
 
 - `Workspace and Routing`: Advances Telegram to `0.52.0` with conservative Workspace Restore, shared Reroute/Restore/Cancel controls, temporary-Thread lifetimes and 60-minute prompt choice expiry. Strict journal proofs remain required; Windows Restore fails closed. Other pins, resource ownership and load order are unchanged.

package/README.md

@@ -17,7 +17,7 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | [`@llblab/pi-clean-room`](https://github.com/llblab/pi-clean-room) | `0.3.0` | Isolated nested Pi TUI with named npm extensions and compatible model selection |
 | [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.12.1` | Shared Codex quota/Business credit status and persistent priority Fast toggle, mirrored in Telegram |
 | [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.9.0` | Visible continuation scheduling and bounded worker Skills through compiled, manifest-owned resources |
-| [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.25.5` | Scoped context/memory compiler with intent-owned memory, failed Active restoration fencing and Codemode-safe compaction |
+| [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.26.0` | Scoped context/memory compiler with step-independent current memory, stable Passive/Active modes and visible blocked-state status |
 | [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.52.0` | Telegram companion with Workspace Restore, routing lifetime, resilient runtime storage, follower Threads, files, voice, and controls |
 | [`@llblab/skills`](https://github.com/llblab/skills) | `1.15.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 
@@ -25,7 +25,7 @@ Versions are exact by design. An upstream release does not change an installed k
 
 ## Install
 
-Requires **Pi 1.0.0+** and **Node.js 22.19.0+**. State Flow requires its canonical checkpoint/tail storage format and does not convert unsupported stores in place. Preserve existing stores and consult the [owning package's storage guidance](https://github.com/llblab/pi-state-flow/blob/v0.25.5/docs/usage.md#moving-a-store-and-supported-formats) before changing installations.
+Requires **Pi 1.0.0+** and **Node.js 22.19.0+**. State Flow requires its canonical checkpoint/tail storage format and does not convert unsupported stores in place. Preserve existing stores and consult the [owning package's storage guidance](https://github.com/llblab/pi-state-flow/blob/v0.26.0/docs/usage.md#moving-a-store-and-supported-formats) before changing installations.
 
 From npm:
 
@@ -45,7 +45,7 @@ Prefer the kit instead of separately loading the same packages. If you already u
 
 ## Development
 
-The `0.28.0` composition includes Telegram `0.52.0` with Workspace Restore, bounded delivery replay protection and damaged-state reset; all other pins, resources and load order remain unchanged. Telegram runtime storage now uses `tmp/pi-telegram` without migrating the old directory. Drain the prompt queue or accept losing waiting work before reload/restart; damaged-state reset discards all profiles' runtime continuity. Windows Restore remains fail-closed without strict journal evidence. `npm run validate` checks exact installed pins, declared resources, dependency audit and bundled inventory. It does not certify installed-client rendering; carried checks remain in [Backlog](./BACKLOG.md).
+The `0.29.0` composition includes State Flow `0.26.0` with step-independent current memory and stable modes; all other pins, resources and load order remain unchanged. Telegram runtime storage now uses `tmp/pi-telegram` without migrating the old directory. Drain the prompt queue or accept losing waiting work before reload/restart; damaged-state reset discards all profiles' runtime continuity. Windows Restore remains fail-closed without strict journal evidence. `npm run validate` checks exact installed pins, declared resources, dependency audit and bundled inventory. It does not certify installed-client rendering; carried checks remain in [Backlog](./BACKLOG.md).
 
 ```bash
 npm install

package/node_modules/@llblab/pi-state-flow/AGENTS.md

@@ -18,12 +18,12 @@ The [relocation ledger](docs/agent-contract-relocation.md) maps every pre-compac
 
 - Treat canonical scope files as semantic authority and Git only as optional backup. Classify complete, wholly absent, partial and malformed cohorts before recovery; absent shared pairs may initialize only under accepted authority, while incomplete/private evidence fails closed. Never repair through ad-hoc writes. See [storage recovery](docs/usage.md#storage-and-recovery) and [transaction rule](docs/filesystem-recovery.md#transaction-rule).
 - Keep exact regular-file, byte-CAS and lock-serialized publication with cancelable waits, single-use callback-scoped capabilities and guarded rollback. Never hold exclusion across inference, source acquisition or Git; do not steal interrupted locks, claim kernel-atomic multi-file publication or promise power-loss durability. See [asynchronous transaction](docs/architecture.md#asynchronous-storage-transaction) and [durability boundary](docs/filesystem-recovery.md#power-loss-durability).
-- Attach Off branches through native policy bookkeeping only, deferring memory acquisition and recovery diagnostics until explicit Passive/Active. Preserve pending Off forks across cold reload with child-owned native markers, without reading the parent header/store until acquisition. When memory is selected, restore private retained boundaries over live shared scopes and copy exact proven source-session history into a fresh fork owner; never substitute current, empty, Git or another branch on expiry/failure. Explicit Start instead validates current same-session authority. Only accepted candidates install cache, checkpoint and mode. Failed selected Active restoration fences live inference through public Abort until valid selection, accepted Start or explicit Passive/Off; never silently expose native history as the inactive fallback. See [Pi lifecycle](docs/architecture.md#pi-lifecycle) and [fork contract](docs/fork-contract.md).
+- Attach Off branches through native policy bookkeeping only, deferring memory acquisition and recovery diagnostics until explicit Passive/Active. Preserve pending Off forks across cold reload with child-owned native markers, without reading the parent header/store until acquisition. Memory never depends on the Pi step: it is the current same-session JSON state, advanced only by accepted `patch_state`/lifecycle publications. Startup, reload, resume and tree navigation validate and accept current same-session memory; native checkpoints supply only mode and run lifecycle, never a revision to rewind to. A fork copies its parent's current memory into a fresh child owner. Never substitute empty, Git, foreign or fabricated memory when current files are missing, corrupt or contradictory. Only accepted candidates install cache, checkpoint and mode. Unreadable current memory under Active retains Active policy, visibly reports `active (blocked)` and fences live inference through public Abort until accepted Active/Passive or explicit Off; never silently expose native history or an inactive indicator as fallback. See [Pi lifecycle](docs/architecture.md#pi-lifecycle) and [fork contract](docs/fork-contract.md).
 - Persist each material semantic change and its affected revisions exactly once, including accepted Session responses. Optional settled-turn Git backup may capture only already-accepted owned files, leave unrelated index/worktree data intact and push without force or semantic side effects. Defer busy backup when the host provides no settlement operation signal rather than blocking Abort; never move it to `turn_end` or add a durable push queue. Off cancels owned captures/pushes and suppresses late reporting; normal agent-operation completion must not cancel an independently admitted push, and foreign callers' pushes retain ownership. See [optional Git backup](docs/architecture.md#optional-git-backup).
 - Accept one atomic `patch_state` cohort across supplied scopes against current shared memory; reject empty scopes, unknown/retired grammar and model-authored `response`. Correct no-ops create no transition. Enforce the single-call inference barrier before sibling tools execute and retain conservative model-facing reconciliation when a result cannot be predicted. See [model tools](docs/architecture.md#model-tools) and [Pi lifecycle](docs/architecture.md#pi-lifecycle).
 - Reconcile the actual accepted ordinary answer at `turn_end` with response-owned cancellation and one accepted lifecycle publication; do not request private repair inference, ceremonial finalization patches or roll back accepted memory after cancellation. See [Pi lifecycle](docs/architecture.md#pi-lifecycle).
 - Capture specifications without writes at `before_agent_start`, then await one cancellable preparation acceptance before active inference; abort failed context preparation through Pi's public hook. Keep user text at user authority and state as fallible data. Preserve an existing conversation for exactly one bootstrap run, not forever. See [Pi lifecycle](docs/architecture.md#pi-lifecycle) and [pre-inference cancellation](docs/compatibility.md#pre-inference-cancellation).
-- Make Start await coherent current-head acceptance; unaccepted Off-to-Active retains deferred history and cannot confer current-memory authority on a superseding Passive choice. Passive selects local policy before asynchronous runtime-only persistence; preserve its independently owned fork/restoration work. Off instead cancels owned memory waits, clears semantic caches and records only native mode/continuation/fork bookkeeping without canonical I/O. Preserve already accepted publications and carried write fences; failed Passive persistence uses a native fence, never a substitute semantic checkpoint. Off exposes no frozen handoff. See [lifecycle planes](docs/architecture.md#lifecycle-planes) and [lifecycle operations](docs/usage.md#lifecycle-operations).
+- Make Start await coherent current-head acceptance; unaccepted Off-to-Active retains deferred history and cannot confer current-memory authority on a superseding Passive choice. Passive selects local policy before asynchronous runtime-only persistence; preserve its independently owned fork/restoration work. Off instead cancels owned memory waits, clears semantic caches and records only native mode/continuation/fork bookkeeping without canonical I/O. Preserve already accepted publications and carried write fences; failed Passive persistence uses a native fence, never a substitute semantic checkpoint; a later explicit Passive retries current-memory acceptance and clears the fence only after acceptance. Off exposes no frozen handoff. See [lifecycle planes](docs/architecture.md#lifecycle-planes) and [lifecycle operations](docs/usage.md#lifecycle-operations).
 - Request completed-history native compaction only after an accepted non-bootstrap settled run, public usage ≥24,000 tokens and a uniquely captured first-user anchor; retain the complete latest run and foreign context. Use per-request owned markers, cancel stale/inactive owned hooks without default summary fallback, and prevent old completion from clearing a new plan. Await its native callback before returning, and leave Pi manual/threshold compaction and append-only history alone. See [lifecycle planes](docs/architecture.md#lifecycle-planes).
 - Contribute only State Flow's compact normative system-prompt section through Pi's section membrane; refresh it with current mode without overwriting foreign sections, forced-prompt precedence or native message identities. Never invent a continuation scheduler. See [lifecycle planes](docs/architecture.md#lifecycle-planes) and [host context compatibility](docs/compatibility.md#context-tools-and-provider-input).
 

package/node_modules/@llblab/pi-state-flow/BACKLOG.md

@@ -1,6 +1,6 @@
 # Backlog
 
-The **0.25.5: Active Restoration Fence and Codemode Compaction** hotfix is prepared; outcomes belong in [CHANGELOG.md](CHANGELOG.md). This backlog retains publication, installed-client gates and deferred decisions.
+The **0.25.5: Active Restoration Fence and Codemode Compaction** hotfix is published (exact-tag workflow, GitHub Release and npm commit verified) and bundled in published Pi Kit 0.27.6. **0.26.0: Stable Modes** is prepared and validated locally but not committed, tagged or published; Pi Kit sync follows its release. Outcomes belong in [CHANGELOG.md](CHANGELOG.md). This backlog retains installed-client gates and deferred decisions.
 
 ## Out of scope
 
@@ -8,9 +8,12 @@ The **0.25.5: Active Restoration Fence and Codemode Compaction** hotfix is prepa
 - Nested `lazy_navigation` and intent-ownership warnings, validation or rejection. Authored missing-deletion hints do not change cascade behavior.
 - Any reduction of lifecycle state; the tagged-union question stays deferred.
 
+## 0.26.0 acceptance
+
+- **Installed stable-mode smoke (operator-owned).** After separately authorized reload, use disposable storage to confirm `/tree` to an old step and reload keep current memory writable in Active and Passive; a fork copies the parent's current memory; unreadable current files show `active (blocked)` in terminal/Telegram, Passive retries and Off releases inference only. Local/native validation does not certify the installed client.
+
 ## 0.25.5 acceptance
 
-- **Publication.** Run the exact-tag workflow and verify GitHub Release/npm identity, then synchronize and release Pi Kit 0.27.6.
 - **Installed restoration/compaction smoke (operator-owned).** After separately authorized reload, use disposable storage to confirm failed Active restoration blocks provider inference across tree/reload, explicit mode recovery remains available, and native Codemode values/deletions survive completed-history compaction. Local/native tests do not certify the installed client.
 
 ## Carried gates

package/node_modules/@llblab/pi-state-flow/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 > Each release keeps at most 8 outcome records of at most 512 characters.
 
+## 0.26.0: Stable Modes
+
+- `Step-independent memory`: Memory no longer depends on the Pi step. Startup, reload, resume and `/tree` attach the current same-session JSON state; native checkpoints supply only mode and run lifecycle. Old or expired branch points never block or rewind memory. Forks copy the parent's current memory. Past values remain readable through `read_state` offsets within retained history.
+- `Removed boundary restoration (library API)`: With nothing left to rewind, `withRestoreTransaction`, `prepareBoundaryRestore`, `restoreBoundary`, `acceptRestoredOrigin`, `prepareBoundaryFork`, `HistoryBoundaryExpiredError` and the temporal boundary selectors are removed. `withForkTransaction(source, lifecycle, …)` now copies the parent's current memory inside its transaction; `lifecycle` carries only mode/bootstrap. Library consumers attach current memory through `withStartTransaction`.
+- `Stable Passive`: Explicit Passive accepts validated current memory like Active and stays writable across reload, including after a failed mode write. Writes stay paused only while current memory is missing, corrupt, contradictory or unpublishable; failed retries add no duplicate fence.
+- `Truthful blocked status`: Unreadable current memory under Active retains Active policy and shows `active (blocked)` in terminal/Telegram, instead of a hidden fence behind an Off indicator. Active or Passive accepts repaired memory; Off releases inference only. Status explains the block and recovery.
+
 ## 0.25.5: Active Restoration Fence and Codemode Compaction
 
 - `Active restoration fence`: Failed retained Active restoration aborts live inference instead of silently exposing native history under an inactive fallback. Expired tree/reload and contradictory-lineage native tests prove zero provider calls and unchanged memory. Valid selection, accepted Start or explicit Passive/Off releases the fence; historical authority is never substituted.

package/node_modules/@llblab/pi-state-flow/README.md

@@ -201,16 +201,15 @@ The default store is `~/.pi/agent/state-flow/`, independent of registered source
 - Shutdown cancels owned pushes and waits for that repository's active push to close or time out.
 - Commit failures warn locally. Repeated push failures produce one concise warning until a push succeeds, with redacted Git detail kept in the local diagnostic log. Neither failure rejects or rolls back accepted memory.
 - Backup needs a Git commit identity; accepting and persisting state does not.
-- Git history can be inspected separately, but it is not the authority for `read_state` or for automatic restoration of expired semantic boundaries.
+- Git history can be inspected separately, but it is not the authority for `read_state` or for restoring memory.
 
 **Resume, tree navigation and forks:**
 
-- Memory-enabled resume and tree navigation restore the selected retained session boundary over the current shared global/CWD memory. Off defers this acquisition.
+- **State Flow does not depend on the Pi step.** Memory is the current JSON state of each scope and changes only through accepted `patch_state` calls and run lifecycle. Resume and tree navigation restore the branch's mode, never an older memory revision; Off defers acquisition. Past values stay readable through `read_state` offsets within retained history.
 - A new session gets its own session layer.
-- Supported native forks copy the selected session state into a new owner without changing the parent's private data.
-- Expired, incomplete or contradictory boundaries never silently substitute newer private state during restoration.
-- Explicit Start is a mode change, not historical restoration. It activates the validated **current** memory of that same session, including private state, even after expired active/passive, interrupted or pre-runtime selections. Available aligned history and revisions survive; unavailable history is not recreated.
-- Malformed storage, unsafe fork copying and concurrent writes remain fenced.
+- Supported native forks copy the parent's **current** session memory into a new owner without changing the parent's private data.
+- Explicit Active or Passive accepts the validated current memory of that same session; modes stay stable.
+- Missing, malformed or contradictory current files, unsafe fork copying and concurrent writes remain fenced and are never replaced by empty or foreign memory.
 
 See [fork support](docs/usage.md#fork-support-and-limits) and [storage recovery](docs/usage.md#storage-and-recovery).
 
@@ -221,9 +220,9 @@ See [fork support](docs/usage.md#fork-support-and-limits) and [storage recovery]
 
 How mode changes interact with storage:
 
-- Selecting Passive switches local policy/context immediately and awaits runtime-only persistence. Passive keeps independently owned restoration/fork work. If its persistence fails, local policy stays and publication is fenced until an accepted activation.
+- Selecting Passive switches local policy/context immediately and awaits runtime-only persistence. Passive keeps independently owned attachment/fork work. If its persistence fails, local policy stays and publication is fenced until a later accepted Active or Passive selection.
 - Off cancels owned memory waits and saves only native mode/continuation/fork bookkeeping, without validating or rewriting canonical storage. It also cancels restoration/fork work and defers later acquisition.
-- Explicit Off inspection may read current stored values through a disposable validated reader. It does not activate memory, install cache or change the selected historical/fork boundary. Missing private authority stays unavailable.
+- Explicit Off inspection may read current stored values through a disposable validated reader. It does not activate memory, install cache or change pending fork acquisition. Missing private authority stays unavailable.
 - Active waits for a coherent capture and acceptance; another mode or selection can withdraw its wait.
 
 State Flow accepts only the canonical store contract and provides no in-place format converter. Preserve existing data and check the [format boundary](docs/usage.md#moving-a-store-and-supported-formats) before changing versions or moving a store.

package/node_modules/@llblab/pi-state-flow/dist/lib/extension.js

@@ -22,7 +22,7 @@ import { selectedBoundaryFailure, selectRetainedCheckpoint, waitForRecovery } fr
 import { TemporalRuntime } from "./runtime.js";
 import { discoverSnapshotData, findAssistantToolBatch, findBranchPolicy, findPassiveStopBoundary, hasPendingFork, hasPriorConversation, hasUncheckpointedConversation, isNewSession, retainsPhysicalSessionProjection, SNAPSHOT_ENTRY_TYPE } from "./session.js";
 import { hasCompiledSkillArtifact, hashSkillSource, registeredSkillResolver, SkillReadTracker } from "./skills.js";
-import { HistoryBoundaryExpiredError, emptySnapshot, migrationFailure, preRuntimeCheckpoint } from "./snapshot.js";
+import { emptySnapshot, isActiveRestorationBlocked, migrationFailure, preRuntimeCheckpoint } from "./snapshot.js";
 import { emptyState, projectStateForModel } from "./state.js";
 import { compactStatus, detailedStatus, STATUS_KEY } from "./status.js";
 import { PublicationBusyError } from "./storage.js";
@@ -42,7 +42,6 @@ export default function stateFlowExtension(pi, options = {}) {
     let scopeStates = { global: emptyState(), cwd: emptyState(), session: emptyState() };
     let effectiveState = {};
     let branchStartsWithoutRuntime = false;
-    let selectedBoundaryError;
     let modePersistenceError;
     /** One pending inactive-mode persistence; later inactive choices coalesce until it publishes. */
     const inactivePersistence = new OwnedOperationSlot();
@@ -121,10 +120,11 @@ export default function stateFlowExtension(pi, options = {}) {
         if (modePersistenceError)
             throw new Error(`Memory writes paused after mode change: ${modePersistenceError}; use /state-flow-active`);
     }
+    /** Active lifecycle work requires validated memory, not merely a selected Active policy. */
     function isActive() {
-        return snapshot.config.mode === "active";
+        return snapshot.config.mode === "active" && !isActiveRestorationBlocked(snapshot);
     }
-    /** An unavailable or pending active selection keeps the configured inactive policy, never an invented one. */
+    /** Pending acquisition has no accepted Active memory yet. */
     function inactiveSelection(mode) {
         return mode === "active" ? config.inactiveMode : mode;
     }
@@ -390,7 +390,6 @@ export default function stateFlowExtension(pi, options = {}) {
                 runtime = undefined;
                 snapshot = emptySnapshot("off");
                 branchStartsWithoutRuntime = withoutRuntime;
-                selectedBoundaryError = undefined;
                 modePersistenceError = persistenceError;
                 forkInitialization = reason === "fork";
                 installScopeStates();
@@ -408,7 +407,6 @@ export default function stateFlowExtension(pi, options = {}) {
         runtime = createRuntime(ctx);
         installScopeStates();
         branchStartsWithoutRuntime = false;
-        selectedBoundaryError = undefined;
         forkInitialization = sessionStartReason === "fork";
         let selection = { kind: "settled" };
         let skipped = 0;
@@ -439,13 +437,11 @@ export default function stateFlowExtension(pi, options = {}) {
                                 ? { ...selected.checkpoint, mode: sourceFence.mode ?? config.inactiveMode } : selected.checkpoint };
                     }
                     catch (error) {
-                        selectedBoundaryError = { expired: error instanceof HistoryBoundaryExpiredError,
-                            blockInference: selected.checkpoint.mode === "active" && requestedMode === undefined };
-                        snapshot = selectedBoundaryFailure(diagnosticText(error), inactiveSelection(selected.checkpoint.mode));
+                        snapshot = selectedBoundaryFailure(diagnosticText(error), requestedMode ?? selected.checkpoint.mode);
                     }
                 }
                 else if (selected.kind === "boundary") {
-                    selection = { kind: "restore", checkpoint: selected.checkpoint };
+                    selection = { kind: "attach", checkpoint: selected.checkpoint };
                 }
                 else if (selected.kind === "pre-runtime") {
                     snapshot = emptySnapshot(selected.mode);
@@ -503,10 +499,9 @@ export default function stateFlowExtension(pi, options = {}) {
         };
         let accepted = false;
         const failSelection = (error) => {
-            selectedBoundaryError = { expired: error instanceof HistoryBoundaryExpiredError,
-                blockInference: pending.requestedMode === undefined && (selection.kind === "auto-start"
-                    || ((selection.kind === "restore" || selection.kind === "fork") && selection.checkpoint.mode === "active")) };
-            snapshot = selectedBoundaryFailure(diagnosticText(error), inactiveSelection(snapshot.config.mode));
+            const mode = pending.requestedMode ?? (selection.kind === "auto-start" ? "active"
+                : selection.kind === "attach" || selection.kind === "fork" ? selection.checkpoint.mode : snapshot.config.mode);
+            snapshot = selectedBoundaryFailure(diagnosticText(error), mode);
             installScopeStates();
         };
         // Install accepted memory before native writes; later ancillary failures cannot revert or replay it.
@@ -544,9 +539,18 @@ export default function stateFlowExtension(pi, options = {}) {
                             : migrationFailure({}, "Current State Flow session memory is unavailable", pending.requestedMode ?? selection.mode);
                         installScopeStates();
                     }
-                    else if (selection.kind === "restore") {
-                        await candidate.withRestoreTransaction(selection.checkpoint, (restored, publish) => {
+                    else if (selection.kind === "attach") {
+                        // Memory is the current same-session files; the Pi checkpoint supplies only mode and run lifecycle.
+                        await candidate.withStartTransaction((current, publish) => {
                             assertCurrent();
+                            if (!current)
+                                throw new Error("Current State Flow session memory is unavailable");
+                            const { checkpoint } = selection;
+                            const restored = { config: { mode: checkpoint.mode }, meta: {
+                                    step: current.meta.step,
+                                    ...(checkpoint.bootstrap ? { bootstrap: true } : {}),
+                                    ...(checkpoint.specification === undefined ? {} : { specification: checkpoint.specification }),
+                                } };
                             // Canceled preparation or boundary continuation may have no specification. Retain uncompiled native context.
                             if (restored.config.mode === "active" && restored.meta.specification === undefined
                                 && retainsPhysicalSessionProjection(reason) && hasUncheckpointedConversation(ctx.sessionManager.getBranch()))
@@ -557,6 +561,7 @@ export default function stateFlowExtension(pi, options = {}) {
                         }, signal);
                     }
                     else if (selection.kind === "fork") {
+                        // The runtime copies the parent's current memory; the checkpoint supplies only child mode/bootstrap.
                         await candidate.withForkTransaction(selection.source, selection.checkpoint, (child, publish) => {
                             assertCurrent();
                             // Mode is selected independently of creating the child's private memory.
@@ -601,8 +606,9 @@ export default function stateFlowExtension(pi, options = {}) {
                     return;
             }
             settleSelection(ctx, reason, notifyRecovery, skipped, selected !== placeholder);
-            if (snapshot.config.mode !== "passive" || runtime?.view)
+            if (snapshot.config.mode === "off" || isActive() || runtime?.view)
                 return;
+            // Unavailable Active memory may expose shared reads, never substitute private memory or model context.
             const passive = await loadPassiveView(ctx, signal, isCurrent, notifyRecovery);
             if (passive === undefined)
                 return;
@@ -647,10 +653,7 @@ export default function stateFlowExtension(pi, options = {}) {
     function settleSelection(ctx, reason, notifyRecovery, skipped, selectedMemory) {
         const failure = !isActive() && snapshot.meta.validation?.attempt === 0 ? snapshot.meta.validation.error : undefined;
         if (failure !== undefined && notifyRecovery && !modePersistenceError) {
-            if (selectedBoundaryError?.expired)
-                notifyProblem(ctx, "State Flow history is outside the retained temporal window; /state-flow-active can use current session memory.", "warning");
-            else
-                notifyProblem(ctx, `State Flow restore failed: ${failure}`, "error");
+            notifyProblem(ctx, `State Flow restore failed: ${failure}`, "error");
         }
         const continuation = selectedMemory ? selectedContinuation(ctx, reason) : undefined;
         if (continuation !== undefined) {
@@ -891,19 +894,23 @@ export default function stateFlowExtension(pi, options = {}) {
             return { ok: false, message, signal: AbortSignal.any([pending.signal, sharedInspectionLifetime.signal]) };
         }
     }
-    async function activateCurrentState(ctx, pending) {
+    /** Explicit Active or Passive accepts validated current same-session memory without claiming unavailable history. */
+    async function activateCurrentState(ctx, pending, mode = "active", owns = () => startActivation.current?.controller === pending) {
         let selected = runtime;
         const owner = ctx.sessionManager.getSessionId();
         const sameSession = sessionIdentity(ctx);
-        const initiallyActive = isActive();
+        const policy = () => `${snapshot.config.mode}:${isActive()}`;
+        const initialPolicy = policy();
+        const acceptedPolicy = `${mode}:${mode === "active"}`;
+        const active = mode === "active";
         let accepted = false;
         let receipt = AbortSignal.any([pending.signal, sharedInspectionLifetime.signal]);
         const signal = ctx.signal ? AbortSignal.any([pending.signal, ctx.signal]) : pending.signal;
-        const isCurrent = () => startActivation.current?.controller === pending && !signal.aborted && runtime === selected && !shuttingDown
-            && sameSession() && isActive() === (accepted || initiallyActive);
+        const isCurrent = () => owns() && !signal.aborted && runtime === selected && !shuttingDown
+            && sameSession() && policy() === (accepted ? acceptedPolicy : initialPolicy);
         const superseded = () => {
             pending.abort();
-            return { ok: false, message: "State Flow activation was superseded", signal: pending.signal };
+            return { ok: false, message: active ? "State Flow activation was superseded" : "State Flow mode change was superseded", signal: pending.signal };
         };
         try {
             const activation = createRuntime(ctx);
@@ -918,29 +925,32 @@ export default function stateFlowExtension(pi, options = {}) {
                 signal.throwIfAborted();
                 if (!isCurrent())
                     throw new Error("State Flow activation selection changed while awaiting publication");
-                if (!current && !branchStartsWithoutRuntime)
+                if (!current && (!active || !branchStartsWithoutRuntime))
                     throw new Error(snapshot.meta.validation?.error ?? "Current State Flow session memory is unavailable");
                 const boundary = deferred && retainsPhysicalSessionProjection(deferred.reason)
                     ? findPassiveStopBoundary(ctx.sessionManager.getBranch(), owner, PASSIVE_STOP_ENTRY_TYPE) : undefined;
                 const bootstrap = hasPriorConversation(ctx.sessionManager.getBranch()) || passiveContinuation !== undefined || boundary !== undefined;
-                const activated = current ? resumeEpisode(current, bootstrap) : startEpisode(bootstrap);
-                const recoveredCurrent = selectedBoundaryError?.expired;
+                const activated = !active ? deactivateEpisode(current, "passive")
+                    : current ? resumeEpisode(current, bootstrap) : startEpisode(bootstrap);
+                const resumedWrites = modePersistenceError !== undefined;
                 publish(activated);
                 accepted = true;
-                inactivePersistence.cancel();
+                // Passive acceptance runs inside its own inactive-persistence owner.
+                if (active)
+                    inactivePersistence.cancel();
                 runtime = selected = activation;
                 snapshot = activated;
                 activeContext = ctx;
-                selectedBoundaryError = undefined;
                 modePersistenceError = undefined;
                 installScopeStates();
                 const continuation = passiveContinuation ?? bootstrapContinuation ?? (deferred ? selectedContinuation(ctx, deferred.reason) : undefined);
                 deferredBranch = undefined;
                 clearRunTransient();
                 contextProjection.reset();
-                passiveContinuation = undefined;
-                bootstrapContinuation = snapshot.meta.bootstrap ? continuation : undefined;
-                deferInferencePreparation();
+                passiveContinuation = active ? undefined : continuation;
+                bootstrapContinuation = active && snapshot.meta.bootstrap ? continuation : undefined;
+                if (active)
+                    deferInferencePreparation();
                 receipt = AbortSignal.any([pending.signal, sharedInspectionLifetime.signal]);
                 recordPublication();
                 syncStateFlowTools();
@@ -950,20 +960,25 @@ export default function stateFlowExtension(pi, options = {}) {
                     pi.appendEntry(PASSIVE_STOP_ENTRY_TYPE, { reset: true, owner });
                 }
                 appendCheckpoint();
-                ctx.ui.notify(recoveredCurrent
-                    ? "State Flow active from current session memory; unavailable historical state was not restored."
-                    : snapshot.meta.bootstrap
-                        ? "State Flow active. The next complete agent run will migrate active context into state."
-                        : "State Flow active. The next prompt starts a stateful agent run.", "info");
+                if (!active) {
+                    if (resumedWrites)
+                        ctx.ui.notify("State Flow passive; memory writes resumed from current session memory.", "info");
+                    return { ok: true, message: "State Flow passive", signal: receipt };
+                }
+                ctx.ui.notify(snapshot.meta.bootstrap
+                    ? "State Flow active. The next complete agent run will migrate active context into state."
+                    : "State Flow active. The next prompt starts a stateful agent run.", "info");
                 return { ok: true, message: "State Flow active", signal: receipt };
-            }, signal, branchStartsWithoutRuntime);
+            }, signal, active && branchStartsWithoutRuntime);
             return isCurrent() ? result : superseded();
         }
         catch (error) {
             if (!isCurrent())
                 return superseded();
-            const message = conciseDiagnostic(`${accepted ? "State Flow active; lifecycle update failed" : "State Flow activation failed"}: ${diagnosticText(error)}`);
-            notifyProblem(ctx, message, accepted ? "warning" : "error");
+            const message = conciseDiagnostic(`${accepted ? `State Flow ${mode}; lifecycle update failed` : active ? "State Flow activation failed" : "State Flow passive acceptance failed"}: ${diagnosticText(error)}`);
+            // Failed Passive acceptance falls back to its caller's write-fence report.
+            if (active || accepted)
+                notifyProblem(ctx, message, accepted ? "warning" : "error");
             return { ok: accepted, message, signal: receipt };
         }
     }
@@ -990,11 +1005,13 @@ export default function stateFlowExtension(pi, options = {}) {
             ctx.ui.notify(detailedStatus(snapshot, statusDiagnostics(ctx)), "info");
         },
     });
+    /** Unavailable selection or failed persistence needs current-memory acceptance, not a sticky Passive write fence. */
+    function passiveRecoveryNeeded(mode) {
+        return mode === "passive" && (modePersistenceError !== undefined || snapshot.meta.validation?.attempt === 0);
+    }
     /** Local policy, tools and UI change before any canonical wait. */
     function applyInactiveMode(ctx, mode) {
         snapshot = deactivateEpisode(snapshot, mode);
-        if (selectedBoundaryError)
-            selectedBoundaryError.blockInference = false;
         clearRunTransient();
         syncStateFlowTools();
         updateUi(ctx);
@@ -1027,7 +1044,7 @@ export default function stateFlowExtension(pi, options = {}) {
         if (snapshot.config.mode === mode) {
             const retained = selectRetainedCheckpoint(discoverSnapshotData(ctx.sessionManager.getBranch()).candidates, config.inactiveMode);
             const recordedMode = retained.kind === "pre-runtime" ? retained.mode : retained.kind === "boundary" ? retained.checkpoint.mode : undefined;
-            if (modePersistenceError || recordedMode === mode)
+            if (!passiveRecoveryNeeded(mode) && (modePersistenceError || recordedMode === mode))
                 return Promise.resolve({ ok: true, message: `State Flow is already ${mode}` });
         }
         inactivePersistence.cancel();
@@ -1081,7 +1098,6 @@ export default function stateFlowExtension(pi, options = {}) {
         acquisition.reset();
         runtime = undefined;
         snapshot = emptySnapshot("off");
-        selectedBoundaryError = undefined;
         branchStartsWithoutRuntime = preRuntime;
         forkInitialization = pendingFork;
         deferredBranch = { owner: address.key, cwd: ctx.cwd, reason: pendingFork ? "fork" : undefined };
@@ -1124,8 +1140,38 @@ export default function stateFlowExtension(pi, options = {}) {
         const wasActive = current.config.mode === "active";
         let unfinished = current.meta.specification !== undefined
             || (inferencePreparation.current?.prompt !== undefined && !inferencePreparation.current.accepted);
+        const recoverPassive = passiveRecoveryNeeded(mode);
         applyInactiveMode(ctx, mode);
         const stoppedAt = Date.now();
+        if (recoverPassive) {
+            const superseded = () => ({ ok: false, message: "State Flow mode change was superseded" });
+            const owns = () => inactivePersistence.owns(pending) && !pending.controller.signal.aborted && !shuttingDown;
+            try {
+                // Join pending read-only recovery so its installation cannot supersede this acceptance.
+                const restoring = branchRestoration.current?.operation;
+                if (restoring)
+                    await waitForRecovery(restoring, pending.controller.signal);
+            }
+            catch {
+                return superseded();
+            }
+            if (!owns())
+                return superseded();
+            // Passive is a stable mode: explicit selection accepts validated current memory instead of keeping a write fence.
+            const recovered = await activateCurrentState(ctx, pending.controller, "passive", () => inactivePersistence.owns(pending));
+            if (recovered.ok)
+                pending.published = true;
+            if (recovered.ok || !owns())
+                return recovered;
+            if (current.config.mode === mode && modePersistenceError) {
+                // The existing native fence already records this policy; report why acceptance still failed.
+                pending.published = true;
+                const message = conciseDiagnostic(`State Flow passive; memory writes remain paused: ${recovered.message}`);
+                notifyProblem(ctx, message, "warning");
+                return { ok: true, message };
+            }
+            selected = runtime;
+        }
         if (modePersistenceError) {
             // Writes stay paused; the native marker records only the newly selected inactive policy.
             pending.published = true;
@@ -1227,6 +1273,7 @@ export default function stateFlowExtension(pi, options = {}) {
         port: {
             snapshot: () => ({
                 mode: snapshot.config.mode,
+                inferenceBlocked: isActiveRestorationBlocked(snapshot),
                 step: snapshot.meta.step,
                 revisions: scopeRevisions(),
                 bootstrap: snapshot.meta.bootstrap === true,
@@ -1315,7 +1362,7 @@ export default function stateFlowExtension(pi, options = {}) {
     }
     function prepareContext(messages, ctx) {
         // Pi continues after hook errors; public Abort fences inference instead of exposing the native history fallback.
-        if (selectedBoundaryError?.blockInference && ctx.signal && !shuttingDown) {
+        if (isActiveRestorationBlocked(snapshot) && ctx.signal && !shuttingDown) {
             ctx.abort();
             notifyProblem(ctx, "State Flow inference blocked: Active memory restoration failed. Select a valid branch or use /state-flow-active for current memory; /state-flow-passive or /state-flow-off explicitly permits native context.", "error");
             return;

package/node_modules/@llblab/pi-state-flow/dist/lib/recovery.d.ts

@@ -1,4 +1,4 @@
-import { type InactiveMode, type RetainedBoundaryCheckpoint, type Snapshot } from "./snapshot.ts";
+import { type InactiveMode, type RetainedBoundaryCheckpoint, type Snapshot, type StateFlowMode } from "./snapshot.ts";
 export type RetainedCheckpointSelection = {
     kind: "boundary";
     checkpoint: RetainedBoundaryCheckpoint;
@@ -17,4 +17,4 @@ export declare function selectRetainedCheckpoint(candidates: readonly unknown[],
 /** Withdraw a caller's join without cancelling independently owned recovery or mode persistence. */
 export declare function waitForRecovery<T>(operation: Promise<T>, signal: AbortSignal): Promise<T>;
 /** A selected boundary that cannot be resolved stays unavailable; callers never fall through to older evidence. */
-export declare function selectedBoundaryFailure(cause: string, mode?: InactiveMode): Snapshot;
+export declare function selectedBoundaryFailure(cause: string, mode?: StateFlowMode): Snapshot;

package/node_modules/@llblab/pi-state-flow/dist/lib/runtime.d.ts

@@ -2,7 +2,7 @@ import { type SessionAddress } from "./durable.ts";
 import { type ArtifactProvenance, type ArtifactProvenanceRegistry } from "./artifact.ts";
 import { publishTemporalStateToFiles } from "./storage.ts";
 import { type AcceptedTransition, type RecentTransitionWindow } from "./history.ts";
-import { type RetainedBoundaryCheckpoint, type RetainedPiCheckpoint, type Snapshot } from "./snapshot.ts";
+import { type RetainedPiCheckpoint, type Snapshot, type StateFlowMode } from "./snapshot.ts";
 import { type MaterializedState, type SemanticState, type ScopedSemanticStates, type ScopedStates, type StateScope } from "./state.ts";
 import { type TemporalState } from "./temporal.ts";
 export type RuntimePublication = ReturnType<typeof publishTemporalStateToFiles>;
@@ -12,6 +12,11 @@ export interface RuntimePatchTransaction {
     readonly provenance: Record<StateScope, ArtifactProvenanceRegistry>;
     publish(snapshot: Snapshot, accepted?: AcceptedTransition, provenance?: Partial<Record<StateScope, Record<string, ArtifactProvenance>>>): RuntimePublication;
 }
+/** Child policy recorded by the native fork; memory always comes from the parent's current files. */
+export interface ForkLifecycle {
+    mode: StateFlowMode;
+    bootstrap?: true;
+}
 /** A targeted removed scope was deliberately adopted as empty before refusing the stale semantic patch. */
 export declare class SharedScopeRemovalConflictError extends Error {
     readonly scopes: readonly StateScope[];
@@ -24,7 +29,6 @@ export declare class TemporalRuntime {
     private semanticRevision;
     private savedRuntime;
     private transaction;
-    private restoredOriginPending;
     private provenanceByScope;
     /** Shared scopes whose wholly absent live basis was accepted after one stale-target refusal. */
     private readonly absentSharedScopes;
@@ -52,28 +56,9 @@ export declare class TemporalRuntime {
     retainedCheckpoint(snapshot: Snapshot): RetainedPiCheckpoint;
     usesCanonicalFiles(): boolean;
     recent(): RecentTransitionWindow;
-    /** Prepare a retained session boundary from current canonical files; shared scopes remain live. */
-    prepareBoundaryRestore(checkpoint: RetainedBoundaryCheckpoint): {
-        snapshot: Snapshot;
-        restore: () => Snapshot;
-    };
-    private prepareBoundaryRestoreBase;
-    /** Restore and canonically accept one retained boundary as a single lifecycle operation. */
-    restoreBoundary(checkpoint: RetainedBoundaryCheckpoint): {
-        snapshot: Snapshot;
-        publication: RuntimePublication;
-    };
     /** Await a coherent read-only recovery view; this neither activates policy nor accepts publication authority. */
     refreshCurrentMemory(signal?: AbortSignal): Promise<Snapshot | undefined>;
     private loadCurrentMemoryBase;
-    /** Copy one retained source-session boundary over the child's current shared scopes. */
-    prepareBoundaryFork(source: SessionAddress, checkpoint: RetainedBoundaryCheckpoint): {
-        snapshot: Snapshot;
-        fork: () => {
-            snapshot: Snapshot;
-            publication: RuntimePublication;
-        };
-    };
     initialize(snapshot: Snapshot, allowCreateCwd: boolean, expectedShared?: Pick<ScopedStates, "global" | "cwd">, newSessionOrigin?: boolean): RuntimePublication | undefined;
     private initializeOrigin;
     /** Copy the private origin and apply configured retention folding, preserving live shared values/provenance. */
@@ -95,16 +80,12 @@ export declare class TemporalRuntime {
     withPatchTransaction<T>(action: (transaction: RuntimePatchTransaction) => T, signal?: AbortSignal): Promise<T>;
     /** Activate current owned memory; the caller must authorize a wholly absent private origin after waiting. */
     withStartTransaction<T>(action: (current: Snapshot | undefined, publish: (snapshot: Snapshot) => RuntimePublication) => T, signal?: AbortSignal, allowCreateOrigin?: boolean): Promise<T>;
-    /** Select one retained private boundary beside current shared streams, then accept only after caller policy is rechecked. */
-    withRestoreTransaction<T>(checkpoint: RetainedBoundaryCheckpoint, action: (selected: Snapshot, publish: (snapshot: Snapshot) => RuntimePublication) => T, signal?: AbortSignal): Promise<T>;
-    /** Copy exact retained parent authority into an unoccupied child; the caller rechecks native selection after waiting. */
-    withForkTransaction<T>(source: SessionAddress, checkpoint: RetainedBoundaryCheckpoint, action: (selected: Snapshot, publish: (snapshot: Snapshot) => RuntimePublication) => T, signal?: AbortSignal): Promise<T>;
+    /** Copy the parent's current session memory into an unoccupied child; the caller rechecks native selection after waiting. */
+    withForkTransaction<T>(source: SessionAddress, lifecycle: ForkLifecycle, action: (selected: Snapshot, publish: (snapshot: Snapshot) => RuntimePublication) => T, signal?: AbortSignal): Promise<T>;
     private prepareForkCandidate;
     /** Recheck caller policy after waiting, then accept only config/runtime over an already accepted private basis. */
     withLifecycleTransaction<T>(action: (publish: (snapshot: Snapshot) => RuntimePublication) => T, signal?: AbortSignal): Promise<T>;
     private withPublicationTransaction;
-    /** Canonically accept a prepared retained-boundary origin before lifecycle-only persistence. */
-    acceptRestoredOrigin(snapshot: Snapshot): RuntimePublication;
     publish(snapshot: Snapshot, semantic?: boolean, accepted?: AcceptedTransition, options?: {
         provenance?: Partial<Record<StateScope, Record<string, ArtifactProvenance>>>;
     }): RuntimePublication | undefined;