@llblab/pi-kit 0.28.0 → 0.29.0

package/node_modules/@llblab/pi-state-flow/dist/lib/runtime.js

@@ -6,8 +6,8 @@ import { pruneArtifactProvenance } from "./artifact.js";
 import { assertTemporalFileBase, captureTemporalFileBase, initializeFileStore, publishTemporalStateToFiles, withStorageTransaction } from "./storage.js";
 import { DEFAULT_HISTORY_LIMIT, MAX_HISTORY_LIMIT } from "./history.js";
 import { hashJson, sameJson } from "./json.js";
-import { HistoryBoundaryExpiredError, RevisionUnavailableError, createSessionRuntime, parseSessionRuntime, preRuntimeCheckpoint, retainedBoundaryCheckpoint } from "./snapshot.js";
-import { adoptTemporalStreams, advanceTemporalState, constrainTemporalState, createTemporalState, readTemporalScopes, readTemporalState, readTemporalView, selectScopeStreamAtBoundary, validateScopeLineage } from "./temporal.js";
+import { RevisionUnavailableError, createSessionRuntime, parseSessionRuntime, preRuntimeCheckpoint, retainedBoundaryCheckpoint } from "./snapshot.js";
+import { adoptTemporalStreams, advanceTemporalState, constrainTemporalState, createTemporalState, readTemporalScopes, readTemporalState, readTemporalView, validateScopeLineage } from "./temporal.js";
 const SCOPES = ["global", "cwd", "session"];
 const SHARED_SCOPES = ["global", "cwd"];
 function emptyProvenance() {
@@ -50,7 +50,6 @@ export class TemporalRuntime {
     semanticRevision;
     savedRuntime;
     transaction;
-    restoredOriginPending = false;
     provenanceByScope = emptyProvenance();
     /** Shared scopes whose wholly absent live basis was accepted after one stale-target refusal. */
     absentSharedScopes = new Set();
@@ -101,7 +100,6 @@ export class TemporalRuntime {
         this.provenanceByScope = provenance;
         this.semanticRevision = undefined;
         this.savedRuntime = undefined;
-        this.restoredOriginPending = false;
         this.absentSharedScopes.clear();
         return true;
     }
@@ -152,83 +150,6 @@ export class TemporalRuntime {
         }
         return result;
     }
-    /** Prepare a retained session boundary from current canonical files; shared scopes remain live. */
-    prepareBoundaryRestore(checkpoint) {
-        if (!lstatSync(this.root, { throwIfNoEntry: false }))
-            throw new RevisionUnavailableError("Selected State Flow boundary storage is unavailable");
-        return this.prepareBoundaryRestoreBase(checkpoint, captureTemporalFileBase(this.cwd, this.sessionId, this.root, this.sessionKey));
-    }
-    prepareBoundaryRestoreBase(checkpoint, base) {
-        const files = new Map(base.files.map((file) => [file.path, file.content]));
-        const scopes = Object.fromEntries(SCOPES.map((scope) => {
-            const paths = temporalScopePaths(this.cwd, this.sessionId, scope, this.root, this.sessionKey);
-            const stream = parseScopeStream(files.get(paths.checkpoint), files.get(paths.patches), scope, scope === "cwd" ? this.cwd : undefined, files.get(paths.meta));
-            if (!stream)
-                throw new RevisionUnavailableError(`State Flow ${scopeLabel(scope)} scope is unavailable for retained-boundary restoration`);
-            return [scope, stream];
-        }));
-        const runtimePaths = sessionRuntimePaths(this.cwd, this.sessionId, this.root, this.sessionKey);
-        const document = parseSessionRuntime(files.get(runtimePaths.config), files.get(runtimePaths.runtime), this.cwd, this.sessionId);
-        if (!document)
-            throw new RevisionUnavailableError("State Flow session runtime is unavailable for retained-boundary restoration");
-        // The codecs validate persisted retention against the format maximum, not the new operator limit.
-        validateScopeLineage(scopes.session, "session", document.meta.lineage, MAX_HISTORY_LIMIT);
-        const boundary = document.meta.lineage.slice(-(this.historyLimit + 1)).find(({ id }) => id === checkpoint.boundary);
-        if (!boundary)
-            throw new HistoryBoundaryExpiredError("Selected State Flow history boundary is outside the retained temporal window");
-        const selectedSession = selectScopeStreamAtBoundary(scopes.session, "session", boundary, MAX_HISTORY_LIMIT);
-        const view = adoptTemporalStreams({
-            global: scopes.global,
-            cwd: scopes.cwd,
-            session: selectedSession,
-        }, `restore:${checkpoint.boundary}:${randomUUID()}`, this.historyLimit);
-        const snapshot = {
-            config: { mode: checkpoint.mode },
-            meta: {
-                step: checkpoint.step,
-                ...(checkpoint.bootstrap === true ? { bootstrap: true } : {}),
-                ...(checkpoint.specification === undefined ? {} : { specification: checkpoint.specification }),
-            },
-        };
-        const provenance = Object.fromEntries(SCOPES.map((scope) => {
-            const paths = temporalScopePaths(this.cwd, this.sessionId, scope, this.root, this.sessionKey);
-            const parsed = parseScopeProvenance(files.get(paths.meta), paths.meta);
-            const retained = pruneArtifactProvenance(parsed, readTemporalState(view, 0, scope, this.historyLimit).artifacts);
-            if (scope === "session") {
-                // Live evidence cannot prove an earlier artifact version, even after a change-away-and-back.
-                for (const record of scopes.session.patches) {
-                    if (record.transition.position <= boundary.position)
-                        continue;
-                    for (const path of Object.keys(record.patch.artifacts === null ? retained : record.patch.artifacts ?? {}))
-                        delete retained[path];
-                }
-            }
-            return [scope, retained];
-        }));
-        let consumed = false;
-        return {
-            snapshot: structuredClone(snapshot),
-            restore: () => {
-                if (consumed)
-                    throw new Error("Prepared State Flow restore was already consumed");
-                consumed = true;
-                this.view = view;
-                this.base = base;
-                this.provenanceByScope = provenance;
-                this.semanticRevision = undefined;
-                this.savedRuntime = hashJson(createSessionRuntime(snapshot, this.cwd, this.sessionId, view.lineage, provenance.session));
-                this.restoredOriginPending = true;
-                this.absentSharedScopes.clear();
-                return structuredClone(snapshot);
-            },
-        };
-    }
-    /** Restore and canonically accept one retained boundary as a single lifecycle operation. */
-    restoreBoundary(checkpoint) {
-        const prepared = this.prepareBoundaryRestore(checkpoint);
-        const snapshot = prepared.restore();
-        return { snapshot, publication: this.acceptRestoredOrigin(snapshot) };
-    }
     /** Await a coherent read-only recovery view; this neither activates policy nor accepts publication authority. */
     async refreshCurrentMemory(signal) {
         signal?.throwIfAborted();
@@ -280,44 +201,9 @@ export class TemporalRuntime {
         this.provenanceByScope = provenance;
         this.semanticRevision = undefined;
         this.savedRuntime = undefined;
-        this.restoredOriginPending = false;
         this.absentSharedScopes.clear();
         return snapshot;
     }
-    /** Copy one retained source-session boundary over the child's current shared scopes. */
-    prepareBoundaryFork(source, checkpoint) {
-        const parent = Object.freeze({ ...source });
-        if (parent.id === this.sessionId || parent.key === this.sessionKey)
-            throw new Error("State Flow fork requires a distinct session identity and key");
-        const sourceRuntime = new TemporalRuntime(this.cwd, parent, this.root, undefined, this.historyLimit);
-        const prepared = sourceRuntime.prepareBoundaryRestore(checkpoint);
-        prepared.restore();
-        const snapshot = {
-            config: structuredClone(prepared.snapshot.config),
-            meta: {
-                step: 0,
-                ...(prepared.snapshot.meta.bootstrap === undefined ? {} : { bootstrap: prepared.snapshot.meta.bootstrap }),
-            },
-        };
-        let consumed = false;
-        return {
-            snapshot: structuredClone(snapshot),
-            fork: () => {
-                if (consumed)
-                    throw new Error("Prepared State Flow fork was already consumed");
-                consumed = true;
-                if (this.view)
-                    throw new Error("State Flow fork target already has session storage");
-                const publication = this.initializeOrigin(snapshot, { allowCreateCwd: false, copy: {
-                        stream: sourceRuntime.view.scopes.session,
-                        provenance: sourceRuntime.artifactProvenance("session"),
-                    } });
-                if (!publication?.revision)
-                    throw new Error("State Flow fork requires existing shared scope storage");
-                return { snapshot: structuredClone(snapshot), publication };
-            },
-        };
-    }
     initialize(snapshot, allowCreateCwd, expectedShared, newSessionOrigin = false) {
         return this.initializeOrigin(snapshot, { allowCreateCwd, expectedShared, newSessionOrigin });
     }
@@ -493,8 +379,6 @@ export class TemporalRuntime {
     }
     /** Prepare current shared state while retaining the exact accepted private publication basis. */
     publicationCandidate(storage, current) {
-        if (this.restoredOriginPending)
-            throw new RevisionUnavailableError("State Flow restored origin must be accepted before patching memory");
         current ??= storage.capture(this.cwd, this.sessionId, this.root, this.sessionKey);
         const candidate = new TemporalRuntime(this.cwd, this.session, this.root, undefined, this.historyLimit);
         candidate.transaction = storage;
@@ -546,20 +430,16 @@ export class TemporalRuntime {
     async withStartTransaction(action, signal, allowCreateOrigin = false) {
         return this.withPublicationTransaction((_candidate, publish, current) => action(current, (snapshot) => publish(snapshot)), { kind: "start", allowCreateOrigin }, signal);
     }
-    /** Select one retained private boundary beside current shared streams, then accept only after caller policy is rechecked. */
-    async withRestoreTransaction(checkpoint, action, signal) {
+    /** Copy the parent's current session memory into an unoccupied child; the caller rechecks native selection after waiting. */
+    async withForkTransaction(source, lifecycle, action, signal) {
         signal?.throwIfAborted();
-        return this.withPublicationTransaction((_candidate, publish, selected) => action(selected, (snapshot) => publish(snapshot)), { kind: "restore", checkpoint: structuredClone(checkpoint) }, signal);
+        return this.withPublicationTransaction((_candidate, publish, selected) => action(selected, (snapshot) => publish(snapshot)), { kind: "fork", source: { ...source }, lifecycle: { mode: lifecycle.mode, ...(lifecycle.bootstrap ? { bootstrap: true } : {}) } }, signal);
     }
-    /** Copy exact retained parent authority into an unoccupied child; the caller rechecks native selection after waiting. */
-    async withForkTransaction(source, checkpoint, action, signal) {
-        signal?.throwIfAborted();
-        return this.withPublicationTransaction((_candidate, publish, selected) => action(selected, (snapshot) => publish(snapshot)), { kind: "fork", source: { ...source }, checkpoint: structuredClone(checkpoint) }, signal);
-    }
-    prepareForkCandidate(storage, source, checkpoint) {
+    prepareForkCandidate(storage, source, lifecycle) {
         const sourceBase = storage.capture(this.cwd, source.id, this.root, source.key);
         const parent = new TemporalRuntime(this.cwd, source, this.root, undefined, this.historyLimit);
-        const selected = parent.prepareBoundaryRestoreBase(checkpoint, sourceBase).restore();
+        if (!parent.loadCurrentMemoryBase(sourceBase))
+            throw new RevisionUnavailableError("State Flow fork parent memory is unavailable");
         const base = storage.capture(this.cwd, this.sessionId, this.root, this.sessionKey);
         const files = new Map(base.files.map((file) => [file.path, file.content]));
         const paths = temporalScopePaths(this.cwd, this.sessionId, "session", this.root, this.sessionKey);
@@ -580,7 +460,7 @@ export class TemporalRuntime {
         }
         return {
             candidate,
-            current: { config: selected.config, meta: { step: 0, ...(selected.meta.bootstrap === undefined ? {} : { bootstrap: selected.meta.bootstrap }) } },
+            current: { config: { mode: lifecycle.mode }, meta: { step: 0, ...(lifecycle.bootstrap ? { bootstrap: true } : {}) } },
             assertSource: () => assertTemporalFileBase(sourceBase, storage.capture(this.cwd, source.id, this.root, source.key)),
         };
     }
@@ -599,7 +479,7 @@ export class TemporalRuntime {
                 if (this.view)
                     throw new Error("State Flow fork target already has session storage");
             }
-            if (!semantic && (!this.semanticRevision || !this.view || !this.base || this.restoredOriginPending)) {
+            if (!semantic && (!this.semanticRevision || !this.view || !this.base)) {
                 throw new Error("State Flow lifecycle transaction requires an accepted runtime");
             }
         };
@@ -607,8 +487,8 @@ export class TemporalRuntime {
         assertAuthority();
         if (kind === "patch" || allowCreateOrigin)
             initializeFileStore(this.root);
-        if ((kind === "start" || kind === "restore" || kind === "fork") && !lstatSync(this.root, { throwIfNoEntry: false })) {
-            throw new RevisionUnavailableError(kind !== "start" ? "Selected State Flow boundary storage is unavailable" : "Current State Flow session storage is unavailable");
+        if ((kind === "start" || kind === "fork") && !lstatSync(this.root, { throwIfNoEntry: false })) {
+            throw new RevisionUnavailableError(kind === "fork" ? "State Flow fork parent storage is unavailable" : "Current State Flow session storage is unavailable");
         }
         return withStorageTransaction(this.root, (storage) => {
             assertAuthority();
@@ -616,15 +496,13 @@ export class TemporalRuntime {
             let candidate;
             let assertSource;
             if (selection.kind === "fork") {
-                ({ candidate, current, assertSource } = this.prepareForkCandidate(storage, selection.source, selection.checkpoint));
+                ({ candidate, current, assertSource } = this.prepareForkCandidate(storage, selection.source, selection.lifecycle));
             }
-            else if (selection.kind === "restore" || selection.kind === "start") {
+            else if (selection.kind === "start") {
                 candidate = new TemporalRuntime(this.cwd, this.session, this.root, undefined, this.historyLimit);
                 candidate.transaction = storage;
                 const base = storage.capture(this.cwd, this.sessionId, this.root, this.sessionKey);
-                current = selection.kind === "restore"
-                    ? candidate.prepareBoundaryRestoreBase(selection.checkpoint, base).restore()
-                    : candidate.loadCurrentMemoryBase(base);
+                current = candidate.loadCurrentMemoryBase(base);
                 if (!current) {
                     if (!allowCreateOrigin)
                         throw new RevisionUnavailableError("Current State Flow session memory is unavailable");
@@ -646,7 +524,7 @@ export class TemporalRuntime {
                 assertSource?.();
                 // Patch preparation without semantic work preserves complete accepted cohorts; selection accepts origins with configured folding.
                 // New authority or wholly absent shared pairs still need normal atomic initialization; partial evidence already failed.
-                const writeSemantic = semantic && (kind === "start" || kind === "restore" || kind === "fork" || accepted !== undefined || !this.semanticRevision
+                const writeSemantic = semantic && (kind === "start" || kind === "fork" || accepted !== undefined || !this.semanticRevision
                     || SCOPES.some((scope) => Object.keys(provenance?.[scope] ?? {}).length > 0)
                     || candidate.base.files.some((file) => file.content === undefined));
                 // Every capability acceptance validates its captured cohort, including semantic no-ops.
@@ -658,7 +536,6 @@ export class TemporalRuntime {
                 this.provenanceByScope = candidate.provenanceByScope;
                 this.semanticRevision = candidate.semanticRevision;
                 this.savedRuntime = candidate.savedRuntime;
-                this.restoredOriginPending = false;
                 this.absentSharedScopes.clear();
                 published = true;
                 return publication;
@@ -668,21 +545,9 @@ export class TemporalRuntime {
             return result;
         }, signal);
     }
-    /** Canonically accept a prepared retained-boundary origin before lifecycle-only persistence. */
-    acceptRestoredOrigin(snapshot) {
-        if (!this.restoredOriginPending)
-            throw new Error("State Flow has no prepared restored origin to accept");
-        const publication = this.publish(snapshot, true);
-        if (!publication)
-            throw new Error("State Flow restored origin produced no canonical publication");
-        this.restoredOriginPending = false;
-        return publication;
-    }
     publish(snapshot, semantic = false, accepted, options = {}) {
         if (!this.view || !this.base)
             throw new Error("State Flow temporal publication is unavailable; restore or initialize before accepting a transition");
-        if (this.restoredOriginPending && !semantic)
-            throw new Error("State Flow restored origin must be accepted before runtime-only persistence");
         // Explicit evidence updates still own a scope CAS, even if they equal the stale cache.
         const provenanceScopes = SCOPES.filter((scope) => Object.keys(options.provenance?.[scope] ?? {}).length > 0);
         const runtimeOnly = !semantic && accepted === undefined && provenanceScopes.length === 0;

package/node_modules/@llblab/pi-state-flow/dist/lib/snapshot.d.ts

@@ -4,9 +4,6 @@ import { type TransitionBoundary } from "./temporal.ts";
 /** Missing operational capability is not evidence that a checkpoint target is invalid. */
 export declare class RevisionUnavailableError extends Error {
 }
-/** Expired history cannot be restored, but explicit activation may use validated current memory. */
-export declare class HistoryBoundaryExpiredError extends RevisionUnavailableError {
-}
 export type StateFlowMode = "active" | "passive" | "off";
 export type InactiveMode = Exclude<StateFlowMode, "active">;
 export declare function isStateFlowMode(value: unknown): value is StateFlowMode;
@@ -38,6 +35,8 @@ export interface StateFlowSnapshot {
     meta: SnapshotMeta;
 }
 export type Snapshot = StateFlowSnapshot;
+/** Failed Active selection retains its policy and fences inference until explicit recovery or an inactive choice. */
+export declare function isActiveRestorationBlocked(snapshot: Snapshot): boolean;
 export interface SessionRuntime {
     config: SnapshotConfig;
     meta: SnapshotMeta & {
@@ -85,5 +84,5 @@ export declare function retainedBoundaryCheckpoint(snapshot: Snapshot, boundary:
 export declare function preRuntimeCheckpoint(mode: StateFlowMode): PreRuntimeCheckpoint;
 /** Decode the retained-window checkpoint contract; legacy `enabled`/`{disabled:true}` markers map through `inactiveMode`. */
 export declare function parseRetainedPiCheckpoint(value: unknown, inactiveMode?: InactiveMode): RetainedPiCheckpoint;
-export declare function migrationFailure(data: JsonObject, error: string, mode?: InactiveMode): Snapshot;
+export declare function migrationFailure(data: JsonObject, error: string, mode?: StateFlowMode): Snapshot;
 export {};

package/node_modules/@llblab/pi-state-flow/dist/lib/snapshot.js

@@ -8,9 +8,6 @@ const MAX_LEGACY_VALIDATION_ATTEMPT = 7;
 /** Missing operational capability is not evidence that a checkpoint target is invalid. */
 export class RevisionUnavailableError extends Error {
 }
-/** Expired history cannot be restored, but explicit activation may use validated current memory. */
-export class HistoryBoundaryExpiredError extends RevisionUnavailableError {
-}
 export function isStateFlowMode(value) {
     return value === "active" || value === "passive" || value === "off";
 }
@@ -26,6 +23,10 @@ export function readCheckpointMode(value, inactiveMode = "passive") {
         return Object.hasOwn(value, "enabled") || !isStateFlowMode(value.mode) ? undefined : value.mode;
     return typeof value.enabled === "boolean" ? value.enabled ? "active" : inactiveMode : undefined;
 }
+/** Failed Active selection retains its policy and fences inference until explicit recovery or an inactive choice. */
+export function isActiveRestorationBlocked(snapshot) {
+    return snapshot.config.mode === "active" && snapshot.meta.validation?.attempt === 0;
+}
 export function validateSessionRuntime(value, cwd, sessionId) {
     if (!isJsonValue(value) || !isObject(value) || Object.keys(value).sort().join(",") !== "config,meta"
         || !isObject(value.config) || !isObject(value.meta))

package/node_modules/@llblab/pi-state-flow/dist/lib/status.d.ts

@@ -1,6 +1,6 @@
 import type { ArtifactInvalidationReason } from "./artifact.ts";
 import type { RecentTransitionWindow } from "./history.ts";
-import type { Snapshot } from "./snapshot.ts";
+import { type Snapshot } from "./snapshot.ts";
 import { type SemanticState, type ScopedStates, type StateScope } from "./state.ts";
 import type { ScopeRevisions, TransitionBoundary } from "./temporal.ts";
 export declare const STATUS_KEY = "state-flow";

package/node_modules/@llblab/pi-state-flow/dist/lib/status.js

@@ -1,5 +1,6 @@
 import { ownedTopLevelKeys } from "./ownership.js";
 import { conciseDiagnostic } from "./protocol.js";
+import { isActiveRestorationBlocked } from "./snapshot.js";
 import { overlayStates, projectSemanticState } from "./state.js";
 export const STATUS_KEY = "state-flow";
 export function formatScopeRevisionVector(revisions) {
@@ -9,7 +10,7 @@ export function compactStatus(snapshot, _revisions, colorize) {
     const { mode } = snapshot.config;
     if (mode === "off")
         return undefined;
-    return `${colorize("accent", "state-flow")} ${colorize("dim", mode)}`;
+    return `${colorize("accent", "state-flow")} ${colorize("dim", isActiveRestorationBlocked(snapshot) ? "active (blocked)" : mode)}`;
 }
 function countArtifacts(states, scope) {
     return Object.keys(states[scope].artifacts).length;
@@ -62,6 +63,8 @@ export function detailedStatus(snapshot, diagnostics) {
     const artifacts = (scope) => countArtifacts(diagnostics.scopeStates, scope);
     const hasArtifacts = available && ["global", "cwd", "session"].some((scope) => artifacts(scope) > 0);
     return [
+        `Mode: ${snapshot.config.mode}`,
+        ...(isActiveRestorationBlocked(snapshot) ? ["Inference blocked: Active memory restoration failed. Use /state-flow-active for current memory or select Passive/Off for native context."] : []),
         `Repository: ${diagnostics.repositoryRoot}`,
         `Scope keys: CWD ${diagnostics.cwdScopeKey}; session ${diagnostics.sessionScopeKey}`,
         ...temporalLines,

package/node_modules/@llblab/pi-state-flow/dist/lib/telegram.d.ts

@@ -6,6 +6,8 @@ export declare function stateFlowTelegramSectionSpecifiers(moduleUrl?: string):
 export interface StateFlowTelegramSnapshot {
     /** The current session's selected mode. */
     mode: StateFlowMode;
+    /** Failed Active restoration fences inference without silently selecting an inactive mode. */
+    inferenceBlocked?: boolean;
     /** Legacy branch step retained for existing adapter ports; current runtime ports also supply owner revisions. */
     step: number;
     revisions?: ScopeRevisions;

package/node_modules/@llblab/pi-state-flow/dist/lib/telegram.js

@@ -22,7 +22,7 @@ export function stateFlowTelegramSectionSpecifiers(moduleUrl = import.meta.url)
 }
 /** Main-menu section label shows only the current session mode. */
 export function formatStateFlowSectionLabel(snapshot) {
-    return `🌀 State Flow: ${snapshot.mode}`;
+    return `🌀 State Flow: ${snapshot.mode}${snapshot.mode === "active" && snapshot.inferenceBlocked ? " (blocked)" : ""}`;
 }
 export const STATE_FLOW_MODES = ["off", "passive", "active"];
 const STATE_FLOW_MODE_LABELS = { off: "Off", passive: "Passive", active: "Active" };
@@ -44,6 +44,10 @@ export function buildStateFlowSectionView(snapshot, callbackData) {
     return {
         text: [
             `<b>🌀 State Flow:</b> <code>${snapshot.mode}</code>`,
+            ...(snapshot.mode === "active" && snapshot.inferenceBlocked ? [
+                "",
+                "<b>Inference blocked:</b> Active memory restoration failed. Select Active to accept current session memory, or Passive/Off to permit native context.",
+            ] : []),
             "",
             "<b>Mode</b> — choose a workflow (switching modes never erases stored memory):",
             "",

package/node_modules/@llblab/pi-state-flow/dist/lib/temporal.d.ts

@@ -40,10 +40,6 @@ export declare function adoptTemporalStreams(scopes: Record<StateScope, ScopeStr
 export declare function createTemporalState(states: ScopedSemanticStates, id: string, historyLimit?: number): TemporalState;
 /** Fold retained tails to a lower configured limit without inventing history. */
 export declare function constrainTemporalState(view: TemporalState, historyLimit: number): TemporalState;
-/** Select one scope at a proven retained boundary from its owning runtime lineage. */
-export declare function selectScopeStreamAtBoundary(stream: ScopeStream, scope: StateScope, boundary: TransitionBoundary, historyLimit?: number): ScopeStream;
-/** Select one still-retained causal boundary without consulting an external history store. */
-export declare function selectTemporalStateBoundary(view: TemporalState, boundaryId: string, historyLimit?: number): TemporalState;
 /** Current independent scope revisions; Effective uses this vector rather than inventing a scalar owner. */
 export declare function temporalScopeRevisions(view: TemporalState): ScopeRevisions;
 /** Exact scope semantics for authored staging; defaults must never become implicit writes. */

package/node_modules/@llblab/pi-state-flow/dist/lib/temporal.js

@@ -200,42 +200,6 @@ export function constrainTemporalState(view, historyLimit) {
     validateTemporalState(next, historyLimit);
     return next;
 }
-/** Select one scope at a proven retained boundary from its owning runtime lineage. */
-export function selectScopeStreamAtBoundary(stream, scope, boundary, historyLimit = DEFAULT_HISTORY_LIMIT) {
-    validateHistoryLimit(historyLimit);
-    validateBoundary(boundary);
-    validateScopeStream(stream, scope, historyLimit);
-    if (boundary.position < stream.checkpoint.through.position) {
-        throw new Error("Selected State Flow history boundary predates the retained scope checkpoint");
-    }
-    const selected = structuredClone(stream);
-    const retained = selected.patches.filter(({ transition }) => transition.position <= boundary.position);
-    selected.revision -= selected.patches.length - retained.length;
-    selected.patches = retained;
-    validateScopeStream(selected, scope, historyLimit);
-    return selected;
-}
-/** Select one still-retained causal boundary without consulting an external history store. */
-export function selectTemporalStateBoundary(view, boundaryId, historyLimit = DEFAULT_HISTORY_LIMIT) {
-    validateHistoryLimit(historyLimit);
-    validateTemporalState(view, historyLimit);
-    if (typeof boundaryId !== "string" || boundaryId.trim().length === 0)
-        throw new Error("State Flow temporal boundary identity must be non-empty");
-    const index = view.lineage.findIndex(({ id }) => id === boundaryId);
-    if (index < 0)
-        throw new Error("Selected State Flow history boundary is outside the retained temporal window");
-    const target = view.lineage[index];
-    const selected = structuredClone(view);
-    selected.lineage = selected.lineage.slice(0, index + 1);
-    for (const scope of SCOPES) {
-        const stream = selected.scopes[scope];
-        const retained = stream.patches.filter(({ transition }) => transition.position <= target.position);
-        stream.revision -= stream.patches.length - retained.length;
-        stream.patches = retained;
-    }
-    validateTemporalState(selected, historyLimit);
-    return selected;
-}
 /** Current independent scope revisions; Effective uses this vector rather than inventing a scalar owner. */
 export function temporalScopeRevisions(view) {
     const revisions = {

package/node_modules/@llblab/pi-state-flow/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-state-flow",
-  "version": "0.25.5",
+  "version": "0.26.0",
   "license": "MIT",
   "private": false,
   "description": "Incremental scoped state/context/memory compiler for Pi, inspired by SKILL.state",

package/node_modules/@llblab/pi-state-flow/docs/architecture.md

@@ -236,7 +236,7 @@ Explicit Start independently prepares the validated current same-session canonic
 
 - Incompatible but independently valid live shared streams require a fresh origin, not invented cross-writer history.
 - An empty session origin is allowed only with wholly absent private authority and initialization-safe branch provenance; incomplete or contradictory evidence stays closed.
-- Initial physical fork copying still requires its exact-source contract; an already accepted child can activate its own current memory without recopying its parent.
+- Initial physical fork copying copies the parent's current memory; an already accepted child activates its own current memory without recopying its parent.
 - Repeated Start while already active changes neither the current run nor pending response reconciliation.
 
 ### Passive persistence
@@ -259,7 +259,7 @@ Off, session/tree selection, shutdown or an accepted Start revoke obsolete Passi
 
 **If persistence fails.** Accepted cached memory and all available native context are kept. The existing native passive-stop marker records `owner`, the selected inactive `mode`, `persistenceError` and `preserveContext: true`.
 
-- This is a same-session policy override and write fence, not semantic authority or a substitute checkpoint. No canonical failure is repaired by resetting memory.
+- This is a same-session policy override and write fence, not semantic authority or a substitute checkpoint. No canonical failure is repaired by resetting memory. A later explicit Passive joins pending read-only recovery, then retries the shared current-memory acceptance used by Start; only accepted publication and its newer checkpoint clear the fence.
 - Memory-enabled tree/reload/resume with that pending marker use `TemporalRuntime.refreshCurrentMemory()` to validate and read current memory, without historical restoration or publication; unavailable evidence stays unavailable.
 - A later accepted checkpoint supersedes the fence while keeping the context boundary for bootstrap.
 - Repeating the same degraded choice is inert; another inactive choice updates only native policy and keeps the fence.
@@ -433,22 +433,16 @@ meta.json
 - Start uses ordinary origin acceptance, including configured retention folding, not lifecycle-only semantic-byte preservation.
 - The synchronous prepared Start API keeps its selected-cohort CAS contract but has no production caller.
 
-**`TemporalRuntime.withRestoreTransaction(checkpoint, action, signal?)`** detaches the retained pointer before waiting, then captures and validates its exact private boundary beside current shared streams under one exclusion.
+Native startup, reload, resume and tree attachment use `withStartTransaction` over current same-session memory, applying the branch checkpoint's mode and run lifecycle. There is no API that rewinds memory to an older boundary.
 
-- `action(selectedSnapshot, publish)` rechecks caller selection/policy after waiting and accepts synchronously, once.
-- The candidate stays detached until publication. Expiry, incomplete evidence, cancellation and CAS failure never substitute current-head or empty memory.
-- Origin acceptance applies configured retention and causal provenance pruning, as the synchronous restore does.
-- Accepted memory is installed before control returns to caller checkpointing; a later failure cannot roll it back.
-- Native startup/tree restoration uses it through the extension's owned restoration lifetime.
+**`TemporalRuntime.withForkTransaction(source, lifecycle, action, signal?)`** pins the parent identity before waiting; `lifecycle` supplies only the child's mode and bootstrap.
 
-**`TemporalRuntime.withForkTransaction(source, checkpoint, action, signal?)`** pins the parent identity and boundary before waiting.
-
-- Under one exclusion it selects exact retained parent authority and captures an unoccupied child target.
+- Under one exclusion it loads the parent's current memory and captures an unoccupied child target, so the copy never depends on the native fork step.
 - The callback receives the child lifecycle (step zero, selected mode/bootstrap, no unfinished specification), rechecks native selection/policy, then publishes synchronously once.
 - Parent evidence is revalidated immediately before child publication, and the child's exact file cohort is CAS-protected. Only acceptance installs child memory.
 - Parent-private files stay untouched, shared provenance stays live, and configured folding still applies.
-- Expired, malformed or occupied selections never become an empty or newer-parent copy.
-- Native fork adoption and Start's exact-source retry use it.
+- Missing, malformed or occupied evidence never becomes an empty or foreign copy.
+- Native fork adoption and Start's fork retry use it.
 
 ### Run preparation and answer reconciliation
 
@@ -499,18 +493,17 @@ Without removals on a complete accepted cohort, publication preserves semantic/p
 
 - Off attaches without constructing a temporal runtime, resolving semantic boundaries, reading memory or emitting recovery warnings; native mode/write-fence bookkeeping stays available.
 - Deferred fork ownership is recorded in a child-owned `forkPending` native marker that survives extension recreation; accepted child initialization resets it.
-- Explicit Passive restores the deferred selected boundary (or fenced read-only current authority), while explicit Active keeps the documented current-memory activation after attachment.
-- Policy decoding is never proof that a historical boundary is valid.
+- Explicit Passive or Active accepts validated current same-session memory (a pending fork copies the parent's current memory first); a write fence clears only after that acceptance.
 - Automatic callbacks stay memory-inert in Off; installed-client acceptance gates are tracked separately in [BACKLOG](../BACKLOG.md).
 
 **Memory-enabled restoration.** Memory-enabled native `session_start` and `session_tree`, and explicit acquisition after an Off attachment, await one extension-owned branch restoration.
 
-1. **Synchronous prelude.** It revokes older selection work and pins the session id, file, header timestamp and CWD. It selects active-branch evidence through the recovery domain's pure `selectRetainedCheckpoint`: newer malformed envelopes are skipped, while revision pointers and every failure resolving the selected boundary fail closed.
+1. **Synchronous prelude.** It revokes older selection work and pins the session id, file, header timestamp and CWD. It reads the branch's newest supported checkpoint through the recovery domain's pure `selectRetainedCheckpoint` only for mode and run lifecycle (unfinished specification, bootstrap); its boundary is never a memory revision to rewind to. Revision pointers and unsupported envelopes fail closed.
 2. **While waiting,** the mode is the selected inactive policy, and private reads/publication report the pending selection.
-3. **Acceptance.** The selected boundary, the exact-source fork, a truly new auto-start origin (`withStartTransaction` with creation authority, rechecking branch evidence after waiting) or failed-Stop read-only recovery then use the awaited runtime API. Bootstrap and policy are derived after waiting and published in that single acceptance.
+3. **Acceptance.** Same-session attachment accepts current memory through `withStartTransaction` under the checkpoint's mode; a fork copies the parent's current memory; a truly new auto-start origin uses `withStartTransaction` with creation authority (rechecking branch evidence after waiting); failed-Stop reload uses read-only recovery. Bootstrap and policy are derived after waiting and published in that single acceptance.
 4. **Installation.** Only the current lifetime installs memory, checkpoint, continuation, tools and UI before yielding; a later native-write failure only warns.
 
-**Failed Active selection.** An unaccepted Active restoration/fork or automatic Start failure carries an inference fence independently of the inactive fallback mode. The live `context` hook calls public `ctx.abort()` before returning; merely throwing would let Pi continue with native history. Re-selecting/reloading the failed Active boundary reconstructs the fence. Accepted Start or a valid branch releases it; explicit Passive/Off permits native context but grants no missing historical/publication authority. Signal-less inspection does not cancel or clear the fence.
+**Failed Active selection.** Unreadable current memory (missing, corrupt, partial or contradictory files), a failed fork copy or automatic Start failure retains the selected Active mode with unavailable-memory validation. The inference fence is derived from that mode and validation, not an independent flag under an inactive fallback. No Active lifecycle work or fabricated projection runs before validated acceptance; shared reads may remain available. Terminal and Telegram show `active (blocked)` with explicit recovery guidance. The live `context` hook calls public `ctx.abort()` before returning; merely throwing would let Pi continue with native history. Reloading while current memory stays unreadable reconstructs the fence. Accepted Start or accepted explicit Passive releases it; explicit Off permits native context but grants no memory authority. Signal-less inspection does not cancel or clear the fence.
 
 **Interaction with mode choices:**
 
@@ -518,25 +511,21 @@ Without removals on a complete accepted cohort, publication preserves semantic/p
 - Passive keeps independently owned restoration, new-session initialization and fork copying, including attachment requested by a now-cancelled Active waiter. Off cancels those owned waits and keeps only native policy/source bookkeeping for later explicit acquisition.
 - The pending publisher applies the latest inactive policy inside its single acceptance. Passive can then patch memory without an artificial error fence, while Off exposes no model access. Repeated selections are inert with respect to that acceptance.
 - Start joins retained Passive acquisition. After Off, non-fork Active goes directly through one cancellable current-head Start transaction, keeping the deferred native selection and local Off policy until publication.
-- A superseding Passive cancels that activation and acquires its original retained private boundary, not the current-memory candidate. Native Abort silently withdraws Active, without inventing a write fence or losing later acquisition choices.
-- Accepted activation reconstructs any native continuation from its proven current memory. Exact-source fork acquisition keeps its independent restoration owner.
+- A superseding Passive cancels that activation and acquires current memory itself. Native Abort silently withdraws Active, without inventing a write fence or losing later acquisition choices.
+- Accepted activation reconstructs any native continuation from its proven current memory. Fork acquisition keeps its independent restoration owner.
 - Selection changes, shutdown and native operation cancellation still revoke obsolete work. Real validation/publication failures stay unavailable rather than becoming empty memory.
 - Start joins pending restoration, owns initial attachment and fork retry without cancelling itself, and is inert when the result is already active. A cancelled Start withdraws its join without cancelling independently owned restoration or Stop persistence.
 - Read-only recovery uses detached candidates and rechecks cancellation and physical identity before host installation. Passive attachment cannot overwrite a newer cache established by an intervening patch or inspection.
 
-Six synchronous runtime methods remain supported for library consumers and local tests/benchmarks; production lifecycle wiring uses the awaited APIs. Their contracts and cancellation boundaries are documented in [library API compatibility](compatibility.md#state-flow-library-api-compatibility).
+Two synchronous runtime methods (`loadPassive`, `initialize`) remain supported for library consumers and local tests/benchmarks; production lifecycle wiring uses the awaited APIs. Their contracts and cancellation boundaries are documented in [library API compatibility](compatibility.md#state-flow-library-api-compatibility).
 
 **What stays outside critical sections.** The advisory [continuation-candidate reader](#session-continuation) also awaits coherent capture, and current-head activation on an attached branch uses the awaited Start transaction. Raw precomputed replay keeps its selected-target guard, unlike current-head authored patch staging. Model inference, source acquisition and Git commands do not belong inside a canonical critical section; artifact freshness validation stays part of publication validation.
 
 ## Optional Git backup
 
-Canonical files always own semantic persistence, current materialization and retained hot history. Installing Git beside the store does not change authority or enable cold semantic restoration. Retained-boundary restoration selects private session history from the current canonical lineage while global/CWD scopes stay live; expired boundaries fail closed.
-
-**Artifact provenance across restore/fork.** Scope artifact provenance records only current evidence.
+Canonical files always own semantic persistence, current materialization and retained hot history. Installing Git beside the store does not change authority or enable cold semantic restoration. Branch navigation attaches current memory, so artifacts keep their current semantics and current evidence together.
 
-- Restore/fork drops session provenance for paths touched by any retained session patch after the selected boundary, including a change-away-and-back or a whole-artifacts-plane deletion. Path existence or equal final values cannot substitute for that causal check.
-- Selected artifact semantics stay intact with unavailable evidence until a stable explicit read and compilation.
-- Untouched paths, provenance-only refreshes of unchanged semantics, and live shared provenance stay usable.
+**Artifact provenance across attachment and fork.** Scope artifact provenance records only current evidence. Attachment keeps current semantics with their current evidence, and a fork copies the parent's current session provenance, so no historical pruning is needed.
 
 ### Local backup commit
 
@@ -812,9 +801,9 @@ See the [fork contract](fork-contract.md) and [operating limits](usage.md#fork-s
 
 Status is a projection of the selected runtime and semantic view, not a second store.
 
-- Compact terminal status uses accent `state-flow` with dim `active` or `passive`, and is hidden in Off.
-- Telegram main-menu status uses `State Flow: active`, `State Flow: passive` or `State Flow: off`.
-- `/state-flow-status` keeps the `g#c#s#` vector beside concise diagnostics and blank-line-separated top-level semantic JSON.
+- Compact terminal status uses accent `state-flow` with dim `active` or `passive`, and is hidden in Off. Failed Active restoration stays visible as `active (blocked)`.
+- Telegram main-menu status uses `State Flow: active`, `State Flow: passive` or `State Flow: off`, with the same blocked qualifier for failed Active restoration and an actionable submenu notice.
+- `/state-flow-status` reports selected mode and any inference fence explicitly, then keeps the `g#c#s#` vector beside concise diagnostics and blank-line-separated top-level semantic JSON.
 - Mode is read directly from the session's selected enum, never derived from a pending patch or separate passive flags.
 - Requested Global, CWD and Session Rich snapshots show their independent `#revision`, while Effective shows the vector. Global/CWD Rich views omit the empty structural response placeholder; Session and Effective expose the Session-owned response.
 - Missing evidence stays unavailable instead of appearing empty.
@@ -832,7 +821,7 @@ Status is a projection of the selected runtime and semantic view, not a second s
 - Memory-enabled inspection keeps its accepted-private/shared-refresh and failed-Passive cache rules.
 - Off inspection uses a fresh disposable `TemporalRuntime`. Global/CWD use coherent shared reads; Session/Effective use `refreshCurrentMemory` and reject absent, incomplete or malformed same-session private evidence, rather than manufacturing an empty layer/revision or borrowing foreign private data.
 - No reader installs the extension runtime/cache, changes native policy or canonical bytes, clears a carried write fence, acquires an unaccepted fork parent or replaces the selected historical target.
-- Expired selected history may coexist with inspectable current stored memory. A later Passive still restores the selected past fail-closed, while Active validates current memory.
+- Branch steps never select a past memory revision; inspection and acquisition always use current stored memory.
 - The awaited `StateFlowTelegramInspectionPort` returns a `StateFlowTelegramInspection` containing state and matching revisions, plus an optional revocation signal. A result checks its revocation lifetime and physical owner immediately before presentation.
 - Stop, selection changes and shutdown cancel obsolete reads without altering newer memory or clearing write fences.