@llblab/pi-kit 0.37.1 → 0.38.1

package/node_modules/@llblab/pi-state-flow/lib/extension.ts

@@ -1,7 +1,7 @@
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
 import { StringEnum, Type } from "@earendil-works/pi-ai";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import { defineTool, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
 import { existsSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
@@ -9,7 +9,7 @@ import { ArtifactAcquisitionState, missingArtifactRemovals } from "./acquisition
 import { inspectRegisteredArtifactPaths, sameArtifactSourceFingerprint } from "./artifact.ts";
 import { hasCompactionSizedTranscript, planStateFlowCompaction, shouldRequestStateFlowCompaction, StateFlowCompactionRequests } from "./compaction.ts";
 import { inactiveModeFor, loadStateFlowConfig } from "./config.ts";
-import { ContextProjection, contextView, createPassiveContinuation, currentRunTrajectory, passiveContinuationMessages, projectSystemProtocol, runtimeContextHead, syntheticUser, type PassiveContinuation } from "./context.ts";
+import { ContextProjection, contextView, createPassiveContinuation, currentRunTrajectory, passiveContinuationMessages, projectSystemProtocol, runtimeContextHead, passiveContextHead, moduleConversationSource, projectModuleContext, type ScopedModuleContext, type PassiveContinuation } from "./context.ts";
 import { readNativeSessionHeader } from "./continuation.ts";
 import {
   cwdScopeKey,
@@ -22,21 +22,26 @@ import { awaitInFlightBackupPushes, backupCurrentStateFlowFiles, SettledTurnBack
 import { projectRecentTransitionsWithLimit } from "./history.ts";
 import { isObject, presentationJson, sameJson } from "./json.ts";
 import { StateFlowDiagnosticWriter, stateFlowLogPath, type DiagnosticExtras, type StateFlowDiagnosticCategory } from "./logging.ts";
-import { assistantToolCallCount, conciseDiagnostic, diagnosticText, finalizedAssistantResponse, formatPatchStateArguments, PASSIVE_MEMORY_PROTOCOL, RESPONSE_PATCH_GUIDELINE, separatedFailure, separatedOutput, stateFlowProtocol } from "./protocol.ts";
+import { normalizeModelPatches, normalizeModelReadPath, projectModelReferences, projectModelArtifactTarget, projectModelMissingDeletion } from "./model-interface.ts";
+import { StateFlowModuleHost } from "./module-registry.ts";
+import { prepareModuleContext, type PreparedModuleContext, type StateFlowModule, type RetainedModuleDescriptor } from "./semantic-module.ts";
+import type { JsonObject } from "./json.ts";
+import { assistantToolCallCount, conciseDiagnostic, diagnosticText, finalizedAssistantResponse, formatPatchStateArguments, passiveMemoryProtocol, RESPONSE_PATCH_GUIDELINE, SCOPE_PARTICIPATION_GUIDELINE, separatedFailure, separatedOutput, stateFlowProtocol } from "./protocol.ts";
 import { OwnedOperationSlot, RenewableLifetime, type OwnedOperation } from "./operation.ts";
 import { readProjectedState, readStatePath } from "./query.ts";
 import { selectedBoundaryFailure, selectRetainedCheckpoint, waitForRecovery } from "./recovery.ts";
 import type { RehydrationPhase } from "./rehydration.ts";
-import { TemporalRuntime, type RuntimePublication } from "./runtime.ts";
-import { discoverSnapshotData, findAssistantToolBatch, findBranchPolicy, findPassiveStopBoundary, hasPendingFork, hasPriorConversation, hasUncheckpointedConversation, isNewSession, retainsPhysicalSessionProjection, SNAPSHOT_ENTRY_TYPE } from "./session.ts";
+import { TemporalRuntime, type SelectedRuntimePatchTransaction } from "./runtime.ts";
+import { prepareSelectedBranchPolicy, captureSelectedNativeMarker, NativeToolRequestCorrelation, SelectedPolicyLifetime, type SelectedPolicyRequest, type NativeContextRequest, discoverSnapshotData, findAssistantToolBatch, hasPriorConversation, hasUncheckpointedConversation, isNewSession, retainsPhysicalSessionProjection, SNAPSHOT_ENTRY_TYPE } from "./session.ts";
 import { hasCompiledSkillArtifact, hashSkillSource, registeredSkillResolver, SkillReadTracker, type SuccessfulSkillRead } from "./skills.ts";
-import { emptySnapshot, isActiveRestorationBlocked, migrationFailure, preRuntimeCheckpoint, type InactiveMode, type RetainedBoundaryCheckpoint, type RetainedPiCheckpoint, type Snapshot, type StateFlowMode } from "./snapshot.ts";
-import { emptyState, projectStateForModel, type AtomicScopePatches, type SemanticState, type ModelState, type ScopedStates, type StateScope } from "./state.ts";
+import { emptySnapshot, isActiveRestorationBlocked, migrationFailure, type InactiveMode, type RetainedBoundaryCheckpoint, type Snapshot, type StateFlowMode } from "./snapshot.ts";
+import { emptyState, projectStateForModel, type SemanticState, type ModelState, type ScopeStateValues, type StateScope } from "./state.ts";
 import { compactStatus, detailedStatus, STATUS_KEY, type StatusDiagnostics } from "./status.ts";
-import { PublicationBusyError } from "./storage.ts";
+import { PublicationBusyError, loadSelectedFileCohort, type SelectedFilePublication } from "./storage.ts";
+import { captureScopeSelection, DEFAULT_SCOPE_SELECTION, parseScopeSelectionArguments, scopeSelectionArgumentCompletions, type ScopeSelection } from "./selection.ts";
 import { createStateFlowTelegramAdapter, type StateFlowTelegramControlResult, type StateFlowTelegramInspection, type StateFlowTelegramLoader, type StateFlowTelegramScope } from "./telegram.ts";
-import { temporalScopeRevisions, type ScopeRevisions } from "./temporal.ts";
-import { commitScopedTransition, stageAtomicScopePatches, stageScopedTransition } from "./transition.ts";
+import { readTemporalScopes, temporalScopeRevisions, type ScopeRevisions } from "./temporal.ts";
+import { commitSelectedTransition, stageSelectedScopePatches, stageSelectedScopedTransition, type ModuleReplacement } from "./transition.ts";
 
 export interface StateFlowExtensionOptions {
 	agentDir?: string;
@@ -53,11 +58,36 @@ export const PATCH_STATE_TOOL_NAME = "patch_state";
 export const READ_STATE_TOOL_NAME = "read_state";
 const PASSIVE_STOP_ENTRY_TYPE = "state-flow-passive-stop";
 
+const flatPatchParameters = Type.Object({
+	intents: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
+	strategy: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
+	tactics: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
+	artifacts: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
+	lazy: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
+}, { additionalProperties: false, minProperties: 1 });
+const scopedPatchParameters = Type.Object({
+	global: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
+	cwd: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
+	session: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
+}, { additionalProperties: false, minProperties: 1 });
+
 interface InferencePreparation extends OwnedOperation {
 	readonly controller: AbortController;
 	readonly prompt?: string;
 	accepted?: boolean;
 	operation?: Promise<void>;
+	request?: NativeContextRequest;
+	modules?: PreparedPublicModules;
+	moduleAcceptance?: () => void;
+}
+
+interface PreparedPublicModules {
+	readonly definitions: readonly StateFlowModule[];
+	readonly conversation: readonly AgentMessage[];
+	readonly bindings: readonly { module: StateFlowModule; scope: StateScope; content: JsonObject | undefined; descriptor: RetainedModuleDescriptor | undefined; prepared: PreparedModuleContext }[];
+	assertCurrent(): void;
+	assertOriginal(): void;
+	cancel(): void;
 }
 
 interface BranchRestoration extends OwnedOperation {
@@ -81,8 +111,9 @@ type BranchSelection =
 	| { kind: "settled" }
 	| { kind: "current"; mode: InactiveMode }
 	| { kind: "attach"; checkpoint: RetainedBoundaryCheckpoint }
-	| { kind: "fork"; checkpoint: RetainedBoundaryCheckpoint; source: SessionAddress }
-	| { kind: "auto-start" };
+	| { kind: "fork"; checkpoint: Pick<RetainedBoundaryCheckpoint, "mode" | "bootstrap"> }
+	| { kind: "auto-start" }
+	| { kind: "pre-runtime"; mode: "active" | "passive" };
 
 export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowExtensionOptions = {}): void {
 	const agentDir = options.agentDir ?? getAgentDir();
@@ -90,7 +121,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	const config = options.mode === undefined ? loadedConfig
 		: { ...loadedConfig, mode: options.mode, inactiveMode: inactiveModeFor(options.mode) };
 	let snapshot: Snapshot = emptySnapshot(config.inactiveMode);
-	let scopeStates: ScopedStates = { global: emptyState(), cwd: emptyState(), session: emptyState() };
+	let scopeStates: ScopeStateValues = {};
 	let effectiveState: SemanticState = {};
 	let branchStartsWithoutRuntime = false;
 	let modePersistenceError: string | undefined;
@@ -100,9 +131,13 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	let forkInitialization = false;
 	const branchRestoration = new OwnedOperationSlot<BranchRestoration>();
 	let deferredBranch: { reason: unknown; owner: string; cwd: string } | undefined;
-	const responseReconciliation = new OwnedOperationSlot<OwnedOperation>();
+	const responseReconciliation = new OwnedOperationSlot<OwnedOperation & { request: SelectedPolicyRequest; operationSignal?: AbortSignal; revalidate: () => void }>();
 	const sharedInspectionLifetime = new RenewableLifetime();
 	const memoryToolLifetime = new RenewableLifetime();
+	const requestPolicy = new SelectedPolicyLifetime();
+	const nativeRequests = new NativeToolRequestCorrelation();
+	const moduleHost = new StateFlowModuleHost();
+	let guardAbortedOperation: AbortSignal | undefined;
 	let completedRunAccepted = false;
 	const compactionRequests = new StateFlowCompactionRequests();
 	let passiveContinuation: PassiveContinuation | undefined;
@@ -150,6 +185,18 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		}
 	}
 
+	function modeOperationSignal(ctx: ExtensionContext, owned: AbortSignal): AbortSignal {
+		const ambient = ctx.signal;
+		if (!ambient || guardAbortedOperation === ambient) return owned;
+		if (!nativeRequests.ownsOperation(ambient)) return AbortSignal.any([owned, ambient]);
+		// User Abort still cancels in-run commands; only this guard's obsolete-model Abort is unrelated.
+		const forwarded = new AbortController();
+		const abort = () => { if (guardAbortedOperation !== ambient) forwarded.abort(ambient.reason); };
+		if (ambient.aborted) abort();
+		else ambient.addEventListener("abort", abort, { once: true, signal: owned });
+		return AbortSignal.any([owned, forwarded.signal]);
+	}
+
 	function createRuntime(ctx: ExtensionContext): TemporalRuntime {
 		return new TemporalRuntime(ctx.cwd, sessionAddress(ctx), repositoryRoot, undefined, config.historyLimit);
 	}
@@ -165,7 +212,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	}
 
 	options.onRuntime?.({ read: (offset, scope) => {
-		if (scope === "session") assertSelectedBranchAvailable();
+		assertSelectedBranchAvailable();
 		if (!runtime) throw new Error("State Flow temporal runtime is unavailable");
 		const { lazy: _lazy, ...defaults } = emptyState();
 		return { ...defaults, ...projectModelState(runtime.readView(offset, scope)) };
@@ -181,23 +228,69 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		return snapshot.config.mode === "active" && !isActiveRestorationBlocked(snapshot);
 	}
 
-	/** Pending acquisition has no accepted Active memory yet. */
-	function inactiveSelection(mode: StateFlowMode): InactiveMode {
-		return mode === "active" ? config.inactiveMode : mode;
+	function readableView(selected = runtime) {
+		return selected?.selectedView() ?? selected?.observedSelectedView();
+	}
+
+	function nativeScopeSelection(ctx = activeContext) {
+		const policy = requestPolicy.policy;
+		return ctx && policy?.owner === ctx.sessionManager.getSessionId() && policy.cwd === resolve(ctx.cwd)
+			? policy.scopes : config.scopes;
+	}
+
+	function appendNativeMarker(value: Record<string, unknown>, ctx = activeContext!): void {
+		pi.appendEntry(PASSIVE_STOP_ENTRY_TYPE, captureSelectedNativeMarker({ version: 2,
+			owner: ctx.sessionManager.getSessionId(), mode: snapshot.config.mode, scopes: nativeScopeSelection(ctx), ...value }));
+	}
+
+	function assertNativeMemoryScopes(scopes: readonly StateScope[]): void {
+		captureScopeSelection(scopes);
+	}
+
+	function branchPolicy(ctx: ExtensionContext, reason?: unknown, memoryRequired = true) {
+		const branch = ctx.sessionManager.getBranch();
+		const policy = prepareSelectedBranchPolicy(branch, { owner: ctx.sessionManager.getSessionId(), markerEntryType: PASSIVE_STOP_ENTRY_TYPE,
+			defaults: { mode: isNewSession(reason, branch) ? config.mode : config.inactiveMode, scopes: config.scopes },
+			inactiveMode: config.inactiveMode, fork: reason === "fork" });
+		if (memoryRequired) assertNativeMemoryScopes(policy.scopes);
+		return policy;
+	}
+
+	/** Failure-only denial evidence, never policy admission: inspect own known-epoch headers without getters or memory I/O. */
+	function failedNativePolicyMode(ctx: ExtensionContext, reason?: unknown): StateFlowMode | undefined {
+		const own = (value: object, key: string) => Object.getOwnPropertyDescriptor(value, key)?.value;
+		try {
+			const inherited = reason === "fork" || typeof ctx.sessionManager.getHeader()?.parentSession === "string";
+			for (const entry of [...ctx.sessionManager.getBranch()].reverse()) {
+				try {
+					if (own(entry, "type") !== "custom") continue;
+					const type = own(entry, "customType"), data = own(entry, "data");
+					if ((type !== SNAPSHOT_ENTRY_TYPE && type !== PASSIVE_STOP_ENTRY_TYPE) || !isObject(data)) continue;
+					const epoch = Object.getOwnPropertyDescriptor(data, "version");
+					if (epoch && (!("value" in epoch) || epoch.value !== 2)) continue;
+					if (type === PASSIVE_STOP_ENTRY_TYPE && own(data, "owner") !== ctx.sessionManager.getSessionId() && !inherited) continue;
+					const mode = own(data, "mode");
+					if (mode === "active" || mode === "passive" || mode === "off") return mode;
+					if (!epoch && typeof own(data, "enabled") === "boolean") return own(data, "enabled") ? "active" : config.inactiveMode;
+				} catch { /* Unreadable headers grant no memory participation. */ }
+			}
+		} catch { /* No failure-only mode evidence. */ }
+		return undefined;
 	}
 
 	function appendCheckpoint(): void {
-		const checkpoint = branchStartsWithoutRuntime ? preRuntimeCheckpoint(snapshot.config.mode)
-			: runtime?.view ? runtime.retainedCheckpoint(snapshot) : undefined;
-		if (!checkpoint) throw new Error("State Flow cannot checkpoint an unproven branch; restore a valid checkpoint first");
-		pi.appendEntry(SNAPSHOT_ENTRY_TYPE, checkpoint);
-		if ("boundary" in checkpoint) branchStartsWithoutRuntime = false;
+		if (runtime?.selectedView()) {
+			pi.appendEntry(SNAPSHOT_ENTRY_TYPE, runtime.retainedSelectedCheckpoint(snapshot.config.mode));
+			branchStartsWithoutRuntime = false;
+		} else if (branchStartsWithoutRuntime) {
+			// A policy capture cannot turn read-only shared observation into accepted memory.
+			appendNativeMarker({});
+		} else throw new Error("State Flow cannot checkpoint an unproven branch; restore current memory first");
 	}
 
-	function scopeRevisions(): ScopeRevisions {
-		return runtime?.view
-			? temporalScopeRevisions(runtime.view)
-			: { global: 0, cwd: 0, session: 0 };
+	function scopeRevisions(): Partial<ScopeRevisions> {
+		const view = readableView();
+		return view ? temporalScopeRevisions(view) : {};
 	}
 
 	function updateUi(ctx: ExtensionContext): void {
@@ -226,13 +319,14 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	}
 
 	function refreshArtifactHints(): void {
-		if (runtime?.view) acquisition.refresh(scopeStates, (scope) => runtime!.artifactProvenance(scope));
+		const view = readableView();
+		if (view) acquisition.refresh(scopeStates, (scope) => runtime!.artifactProvenance(scope), view.selection);
 		else acquisition.reset();
 	}
 
 	function installScopeStates(): void {
-		scopeStates = runtime?.view ? runtime.states() : { global: emptyState(), cwd: emptyState(), session: emptyState() };
-		effectiveState = runtime?.view ? runtime.readView() : {};
+		scopeStates = readableView() ? runtime!.selectedStates().states : {};
+		effectiveState = readableView() ? runtime!.readView() : {};
 	}
 
 	/** Active and passive expose both memory tools; Off exposes neither. */
@@ -242,7 +336,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 
 	/** Passive memory context needs a loaded view; Off and Active never inject it. */
 	function passiveMemoryAvailable(): boolean {
-		return snapshot.config.mode === "passive" && runtime?.view !== undefined;
+		return snapshot.config.mode === "passive" && readableView() !== undefined && snapshot.meta.validation?.attempt !== 0;
 	}
 
 	async function inspectTelegramState(scope: StateFlowTelegramScope): Promise<StateFlowTelegramInspection> {
@@ -250,31 +344,54 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		const ctx = activeContext;
 		const owner = sessionAddress(ctx).key;
 		const cwd = ctx.cwd;
+		const wanted = captureScopeSelection(nativeScopeSelection(ctx));
+		if (scope === "effective" ? wanted.length < 2 : !wanted.includes(scope)) throw new Error("State Flow inspection scope is not available in this selection");
+		const inspected = captureScopeSelection(scope === "effective" ? wanted : [scope]);
 		const off = snapshot.config.mode === "off";
-		const privateScope = scope === "session" || scope === "effective";
+		const privateScope = inspected.includes("session");
 		if (!off && privateScope) assertSelectedBranchAvailable();
 		// Off operator reads are disposable: they confer no selected-branch/cache authority.
-		const selected = off ? createRuntime(ctx) : runtime ??= createRuntime(ctx);
+		const selected = createRuntime(ctx);
 		const signal = sharedInspectionLifetime.signal;
-		let privateAvailable = true;
-		if (off && privateScope) privateAvailable = await selected.refreshCurrentMemory(signal) !== undefined;
-		else if (!selected.view || (scope !== "session" && !modePersistenceError)) await selected.refreshShared(signal);
-		signal.throwIfAborted();
-		if (activeContext !== ctx || ctx.cwd !== cwd || sessionAddress(ctx).key !== owner || (!off && runtime !== selected)) {
-			throw new Error("State Flow inspection selection changed; select the scope again");
-		}
-		if (!privateAvailable) throw new Error("Current State Flow session memory is unavailable");
-		if (!off && privateScope) assertSelectedBranchAvailable();
-		if (!selected.view) throw new Error("State Flow temporal runtime is unavailable");
-		if (!off) installScopeStates();
+		const check = () => {
+			signal.throwIfAborted();
+			if (activeContext !== ctx || ctx.cwd !== cwd || sessionAddress(ctx).key !== owner || !sameJson(nativeScopeSelection(ctx), wanted)) throw new Error("State Flow inspection selection changed; select the scope again");
+		};
+		if (privateScope && (off || !branchStartsWithoutRuntime || scope === "session")) {
+			await selected.refreshSelectedCurrent(inspected, check, signal);
+		} else await selected.refreshSelectedShared(captureScopeSelection(inspected.filter(owner => owner !== "session")), check, signal);
+		check();
+		const view = selected.observedSelectedView();
+		if (!view) throw new Error("State Flow temporal runtime is unavailable");
 		const state = selected.readView(0, scope === "effective" ? undefined : scope);
-		return { state: { ...projectModelState(state), ...(state.lazy === undefined ? {} : { lazy: structuredClone(state.lazy) }) }, revisions: temporalScopeRevisions(selected.view), signal };
+		return { state: { ...projectModelState(state), ...(state.lazy === undefined ? {} : { lazy: structuredClone(state.lazy) }) }, revisions: temporalScopeRevisions(view), signal };
 	}
 
-	function syncStateFlowTools(): void {
+	function syncStateFlowTools(force = false): void {
+		if (activeContext && !shuttingDown) {
+			const scopes = nativeScopeSelection(activeContext);
+			requestPolicy.select({ cwd: activeContext.cwd, owner: activeContext.sessionManager.getSessionId(), mode: snapshot.config.mode, scopes });
+			skillReads.select(scopes);
+		}
+		const available = memoryToolsAvailable();
+		if (available && activeContext) {
+			const external = moduleHost.captureIfBound()?.modules.filter(module => !module.immutable).map(module => module.id) ?? [];
+			const flat = nativeScopeSelection(activeContext).length === 1;
+			const desired = [...Object.keys(flatPatchParameters.properties), ...external];
+			const sameFlatShape = flat && desired.join("|") === Object.keys(patchStateTool.parameters.properties).join("|");
+			const parameters = !flat ? scopedPatchParameters : !external.length ? flatPatchParameters : sameFlatShape ? patchStateTool.parameters
+				: Type.Object({ ...flatPatchParameters.properties, ...Object.fromEntries(external.map(id => [id, Type.Optional(Type.Record(Type.String(), Type.Unknown()))])) }, { additionalProperties: false, minProperties: 1 });
+			// Cache only the desired shape on our unregistered template: host filtering can hide ToolInfo.
+			// Every SDK registration is a fresh copy, preserving old response-wrapper declarations.
+			if (force || patchStateTool.parameters !== parameters) {
+				patchStateTool.parameters = parameters;
+				pi.registerTool({ ...patchStateTool, ...(external.length ? {
+					promptGuidelines: [...(patchStateTool.promptGuidelines ?? []), `Registered mutable object planes: ${external.join(", ")}. Availability and matching retained schema/policy are revalidated at acceptance.`],
+				} : {}) });
+			}
+		}
 		const active = pi.getActiveTools();
 		const owned = [PATCH_STATE_TOOL_NAME, READ_STATE_TOOL_NAME];
-		const available = memoryToolsAvailable();
 		if (owned.every((name) => active.includes(name) === available)) return;
 		pi.setActiveTools(available
 			? [...new Set([...active, ...owned])]
@@ -289,9 +406,9 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	}
 
 	function skillReadIsCurrent(read: SuccessfulSkillRead): boolean {
-		return read.hash !== undefined && runtime?.view !== undefined && hasCompiledSkillArtifact(
-			scopeStates[read.scope].artifacts,
-			runtime.artifactProvenance(read.scope)[read.path],
+		return read.hash !== undefined && readableView()?.selection.includes(read.scope) === true && hasCompiledSkillArtifact(
+			scopeStates[read.scope]!.artifacts ?? {},
+			runtime!.artifactProvenance(read.scope)[read.path],
 			read.path,
 			read.hash,
 		);
@@ -303,9 +420,9 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		}
 	}
 
-	function skillAcquisitionHint(read: SuccessfulSkillRead): string | undefined {
+	function skillAcquisitionHint(read: SuccessfulSkillRead, wanted: ScopeSelection): string | undefined {
 		if (read.hash === undefined || skillReadIsCurrent(read)) return undefined;
-		const target = `${read.scope}.artifacts[${JSON.stringify(read.path)}]`;
+		const target = projectModelArtifactTarget(read.scope, read.path, wanted);
 		return `State Flow acquisition: this registered Skill belongs at ${target}. If durable compiled guidance is useful, include a non-empty description, kind:"skill", and compilation object there. Unrelated semantic patches do not need to include it.`;
 	}
 
@@ -314,31 +431,58 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		dropCurrentSkillReads();
 	}
 
-	async function prepareInference(pending: InferencePreparation, selected: TemporalRuntime | undefined, ctx: ExtensionContext, operationSignal: AbortSignal): Promise<void> {
-		const signal = AbortSignal.any([pending.controller.signal, operationSignal]);
+	async function prepareInference(pending: InferencePreparation, selected: TemporalRuntime | undefined, ctx: ExtensionContext, operationSignal: AbortSignal, request?: NativeContextRequest, messages: AgentMessage[] = []): Promise<void> {
+		const signal = AbortSignal.any([pending.controller.signal, operationSignal, ...(request ? [request.signal] : [])]);
+		const sameSession = sessionIdentity(ctx);
+		const check = () => {
+			request?.revalidate();
+			if (ctx.signal !== operationSignal || !sameSession() || !currentNativeContextOwner(ctx)) throw new Error("State Flow preparation context owner changed");
+		};
 		try {
-			if (!selected?.view) throw new Error("Temporal State Flow runtime is unavailable; reload before publishing");
-			await selected.withPatchTransaction((transaction) => {
+			check();
+			if (!selected?.selectedView()) throw new Error("Temporal State Flow runtime is unavailable; reload before publishing");
+			pending.modules = await capturePublicModules(messages, ctx, signal);
+			pending.modules?.assertOriginal();
+			const replacements: ModuleReplacement[] = [];
+			try {
+				const proposals = await Promise.all((pending.modules?.bindings ?? []).filter(binding => binding.module.produce).map(async binding => {
+					const content = await binding.prepared.produce();
+					return content === undefined ? undefined : { scope: binding.scope, id: binding.module.id, content };
+				}));
+				replacements.push(...proposals.filter((item): item is ModuleReplacement => item !== undefined));
+			} catch { throw new Error("State Flow registered module production failed"); }
+			pending.modules?.assertOriginal();
+			await selected.withSelectedPatchTransaction((transaction) => {
 				signal.throwIfAborted();
+				check();
 				if (runtime !== selected || !inferencePreparation.owns(pending) || !isActive() || shuttingDown) {
 					throw new Error("State Flow inference selection changed while awaiting publication");
 				}
 				assertPublicationAvailable();
+				pending.modules?.assertOriginal();
+				for (const binding of pending.modules?.bindings ?? []) {
+					if (!sameJson(transaction.states[binding.scope]?.[binding.module.id] ?? null, binding.content ?? null)
+						|| !sameJson(transaction.modules?.[binding.scope]?.[binding.module.id] ?? null, binding.descriptor ?? null)) throw new Error("State Flow producer content or descriptor basis changed");
+				}
 				const nextSnapshot = structuredClone(snapshot);
 				const rotatesRun = pending.prompt !== undefined && nextSnapshot.meta.specification !== undefined;
 				if (pending.prompt !== undefined) prepareRun(nextSnapshot, pending.prompt);
 				// Exact-path metadata validation belongs to the locked current head, including newly adopted registrations.
-				const removals = missingArtifactRemovals(transaction.states);
-				let publication: RuntimePublication | undefined;
-				if (Object.keys(removals).length > 0) {
-					const stage = stageAtomicScopePatches(transaction.states, removals, [], transaction.causalBasis);
-					commitScopedTransition(nextSnapshot, transaction.states, stage, (transition, next) => {
-						publication = transaction.publish(next, transition);
+				const removals = missingArtifactRemovals(transaction.states, transaction.selection);
+				let publication: SelectedFilePublication | undefined;
+				if (Object.keys(removals).length > 0 || replacements.length > 0) {
+					const stage = stageSelectedScopePatches(transaction, removals, [], transaction.causalBasis, [], pending.modules?.definitions, replacements);
+					commitSelectedTransition(nextSnapshot, transaction, stage, (transition, next) => {
+						pending.modules?.assertCurrent();
+						publication = transaction.publish(next, transition, stage.provenanceUpdates, stage.moduleAdditions);
 						pending.accepted = true;
+						pending.moduleAcceptance = selected.captureSelectedReadBasis();
 					}, transaction.causalBasis, { finalizeRun: false });
 				} else {
+					pending.modules?.assertCurrent();
 					publication = transaction.publish(nextSnapshot);
 					pending.accepted = true;
+					pending.moduleAcceptance = selected.captureSelectedReadBasis();
 				}
 				snapshot = nextSnapshot;
 				installScopeStates();
@@ -347,11 +491,18 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 				if (pending.prompt !== undefined || publication?.changed) appendCheckpoint();
 				if (Object.keys(removals).length > 0) clearAcceptedAcquisitions();
 				updateUi(ctx);
-			}, signal);
+			}, () => {
+				check();
+				if (runtime !== selected || !inferencePreparation.owns(pending) || !isActive()) throw new Error("State Flow preparation superseded");
+				pending.modules?.assertCurrent();
+			}, signal, [...new Set(pending.modules?.bindings.map(binding => binding.scope) ?? [])]);
 		} catch (error) {
+			if (!pending.accepted) pending.modules?.cancel();
 			if (signal.aborted || runtime !== selected || !inferencePreparation.owns(pending) || shuttingDown) return;
+			try { check(); } catch { return; }
+			if (!contextRequestCurrent(request, ctx, operationSignal)) return;
 			// Pi reports context-hook exceptions and continues. Abort through its public port rather than infer from stale preparation.
-			ctx.abort();
+			abortContext(ctx, operationSignal);
 			const cause = diagnosticText(error);
 			recordDiagnostic(cause, "publication-conflict", ctx);
 			notifyProblem(ctx, pending.accepted
@@ -363,7 +514,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 
 	function statusDiagnostics(ctx: ExtensionContext): StatusDiagnostics {
 		const cwd = ctx.cwd;
-		const view = runtime?.view;
+		const view = readableView();
 		const diagnosticRecent = runtime?.recent() ?? [];
 		const durableStateError = snapshot.meta.validation?.attempt === 0 ? snapshot.meta.validation.error
 			: view ? undefined : "no temporal runtime is selected on this branch";
@@ -376,6 +527,8 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 			repositoryRoot,
 			cwdScopeKey: cwdScopeKey(cwd),
 			sessionScopeKey: sessionScopeKey(session.key),
+			selection: view?.selection ?? nativeScopeSelection(ctx),
+			requestedSelection: nativeScopeSelection(ctx),
 			scopeStates,
 			effectiveState,
 			recent: diagnosticRecent,
@@ -383,7 +536,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 			...(view === undefined ? {} : { temporal: {
 				head: structuredClone(view.lineage.at(-1)!),
 				historyDepth: view.lineage.length - 1,
-				tailCounts: { global: view.scopes.global.patches.length, cwd: view.scopes.cwd.patches.length, session: view.scopes.session.patches.length },
+				tailCounts: Object.fromEntries(view.selection.map(scope => [scope, view.scopes[scope]!.patches.length])),
 				revisions: temporalScopeRevisions(view),
 			} }),
 			staleArtifacts,
@@ -403,6 +556,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	/** Select the active native branch under one owned restoration lifetime; only current accepted work installs memory. */
 	function restoreActiveBranch(ctx: ExtensionContext, sessionStartReason?: unknown, notifyRecovery = true, startOwner?: AbortController, requestedMode?: InactiveMode): Promise<void> {
 		contextProjection.reset();
+		requestPolicy.invalidate();
 		memoryToolLifetime.renew();
 		branchRestoration.cancel();
 		// Start-owned attachment/fork recovery keeps its owner; only accepted Start cancels Stop.
@@ -416,9 +570,26 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		acquisition.clearInvalidations();
 		telegramStartPending = false;
 		activeContext = ctx;
+		let nativePolicy;
+		try {
+			nativePolicy = branchPolicy(ctx, sessionStartReason, false);
+			requestPolicy.select({ cwd: ctx.cwd, owner: ctx.sessionManager.getSessionId(), mode: snapshot.config.mode, scopes: nativePolicy.scopes });
+			// Freeze admitted policy before accepting any selected memory.
+			// Policy-only capture grants no acquisition or semantic-boundary authority.
+			if (nativePolicy.requiresCapture) pi.appendEntry(PASSIVE_STOP_ENTRY_TYPE, nativePolicy.capture);
+			if (nativePolicy.mode !== "off") assertNativeMemoryScopes(nativePolicy.scopes);
+		} catch (error) {
+			runtime = undefined;
+			branchStartsWithoutRuntime = false;
+			modePersistenceError = diagnosticText(error);
+			snapshot = selectedBoundaryFailure(modePersistenceError, nativePolicy?.mode ?? failedNativePolicyMode(ctx, sessionStartReason) ?? config.inactiveMode);
+			installScopeStates();
+			syncStateFlowTools();
+			updateUi(ctx);
+			return Promise.resolve();
+		}
 		if (!startOwner) {
 			let mode: StateFlowMode = config.inactiveMode;
-			let adoptDefault = false;
 			let withoutRuntime = false;
 			let persistenceError: string | undefined;
 			let pendingFork = false;
@@ -426,15 +597,9 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 				const branch = ctx.sessionManager.getBranch();
 				const discovery = discoverSnapshotData(branch);
 				withoutRuntime = discovery.candidates.length === 0 && discovery.errors.length === 0;
-				adoptDefault = withoutRuntime && isNewSession(sessionStartReason, branch);
-				pendingFork = hasPendingFork(branch, ctx.sessionManager.getSessionId(), PASSIVE_STOP_ENTRY_TYPE);
-				const inherited = sessionStartReason === "fork" || pendingFork;
-				const policy = findBranchPolicy(branch, inherited ? undefined : ctx.sessionManager.getSessionId(),
-					inherited || retainsPhysicalSessionProjection(sessionStartReason) ? PASSIVE_STOP_ENTRY_TYPE : undefined, config.inactiveMode);
-				mode = policy?.mode ?? (adoptDefault ? config.mode : config.inactiveMode);
-				persistenceError = inherited
-					? findBranchPolicy(branch, ctx.sessionManager.getSessionId(), PASSIVE_STOP_ENTRY_TYPE, config.inactiveMode)?.persistenceError
-					: policy?.persistenceError;
+				pendingFork = nativePolicy.forkPending;
+				mode = nativePolicy.mode;
+				persistenceError = nativePolicy.persistenceError;
 			} catch {
 				// Off needs only policy; unavailable native evidence grants no memory authority.
 			}
@@ -443,7 +608,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 				const owner = sessionAddress(ctx).key;
 				const reason = pendingFork || (deferredBranch?.owner === owner && deferredBranch.cwd === ctx.cwd && deferredBranch.reason === "fork"
 					&& retainsPhysicalSessionProjection(sessionStartReason)) ? "fork" : sessionStartReason;
-				if (reason === "fork" && !pendingFork) pi.appendEntry(PASSIVE_STOP_ENTRY_TYPE, { owner: ctx.sessionManager.getSessionId(), forkPending: true });
+				if (reason === "fork" && !pendingFork) appendNativeMarker({ mode: "off", forkPending: true });
 				deferredBranch = { reason, owner, cwd: ctx.cwd };
 				runtime = undefined;
 				snapshot = emptySnapshot("off");
@@ -452,7 +617,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 				forkInitialization = reason === "fork";
 				installScopeStates();
 				acquisition.reset();
-				if (adoptDefault) appendCheckpoint();
+
 				syncStateFlowTools();
 				updateUi(ctx);
 				return Promise.resolve();
@@ -463,16 +628,21 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		runtime = createRuntime(ctx);
 		installScopeStates();
 		branchStartsWithoutRuntime = false;
-		forkInitialization = sessionStartReason === "fork";
+		forkInitialization = sessionStartReason === "fork" || nativePolicy.forkPending;
 		let selection: BranchSelection = { kind: "settled" };
 		let skipped = 0;
 		try {
 			const branch = ctx.sessionManager.getBranch();
-			const fence = retainsPhysicalSessionProjection(sessionStartReason)
-				? findPassiveStopBoundary(branch, ctx.sessionManager.getSessionId(), PASSIVE_STOP_ENTRY_TYPE)
-				: undefined;
+			const fence = nativePolicy.stop;
 			modePersistenceError = fence?.persistenceError ?? (startOwner ? modePersistenceError : undefined);
-			if (fence?.persistenceError) {
+			if (forkInitialization) {
+				// Pending copy authority is independent of whether ancillary Pi checkpoint appends succeeded.
+				const selected = selectRetainedCheckpoint(discoverSnapshotData(branch).candidates, config.inactiveMode);
+				selection = { kind: "fork", checkpoint: {
+					mode: requestedMode ?? (nativePolicy.mode === "off" && startOwner ? "passive" : nativePolicy.mode),
+					...(selected.kind === "boundary" && selected.checkpoint.bootstrap ? { bootstrap: true } : {}),
+				} };
+			} else if (fence?.persistenceError) {
 				// The native marker owns policy only: read proven memory, never replay or publish a stale selection.
 				selection = { kind: "current", mode: fence.mode ?? config.inactiveMode };
 			} else {
@@ -482,20 +652,11 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 				branchStartsWithoutRuntime = selected.kind === "pre-runtime" || (discovery.candidates.length === 0 && discovery.errors.length === 0);
 				if (discovery.candidates.length === 0 && discovery.errors.length > 0) {
 					snapshot = migrationFailure({}, `Snapshot restoration failed: ${discovery.errors[0]}`, config.inactiveMode);
-				} else if (selected.kind === "boundary" && forkInitialization) {
-					try {
-						// Native parent acquisition stays outside canonical exclusion.
-						const source = forkSource(ctx);
-						const sourceFence = findPassiveStopBoundary(branch, source.id, PASSIVE_STOP_ENTRY_TYPE);
-						selection = { kind: "fork", source, checkpoint: sourceFence?.persistenceError !== undefined
-							? { ...selected.checkpoint, mode: sourceFence.mode ?? config.inactiveMode } : selected.checkpoint };
-					} catch (error) {
-						snapshot = selectedBoundaryFailure(diagnosticText(error), requestedMode ?? selected.checkpoint.mode);
-					}
 				} else if (selected.kind === "boundary") {
-					selection = { kind: "attach", checkpoint: selected.checkpoint };
+					selection = { kind: "attach", checkpoint: { ...selected.checkpoint, mode: nativePolicy.mode } };
 				} else if (selected.kind === "pre-runtime") {
-					snapshot = emptySnapshot(selected.mode);
+					snapshot = emptySnapshot(nativePolicy.mode);
+					if (nativePolicy.mode === "active") selection = { kind: "auto-start" };
 				} else if (discovery.candidates.length > 0) {
 					snapshot = selected.snapshot;
 				} else if (isNewSession(sessionStartReason, branch)) {
@@ -503,21 +664,25 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 					if (config.mode === "active") selection = { kind: "auto-start" };
 					else {
 						snapshot = emptySnapshot(config.mode);
-						// Adopt the default once without initializing semantic storage.
-						appendCheckpoint();
+						// The native policy was captured before memory acquisition.
 					}
 				} else {
-					snapshot = emptySnapshot(config.inactiveMode);
+					snapshot = emptySnapshot(nativePolicy.mode);
+					if (nativePolicy.mode === "active" && branchStartsWithoutRuntime) selection = { kind: "auto-start" };
 				}
 			}
 		} catch (error) {
 			selection = { kind: "settled" };
-			snapshot = selectedBoundaryFailure(diagnosticText(error), config.inactiveMode);
+			snapshot = selectedBoundaryFailure(diagnosticText(error), nativePolicy.mode);
+		}
+		const preRuntimeMode = requestedMode ?? snapshot.config.mode;
+		if (selection.kind === "settled" && branchStartsWithoutRuntime && snapshot.meta.validation?.attempt !== 0 && preRuntimeMode !== "off") {
+			selection = { kind: "pre-runtime", mode: preRuntimeMode };
 		}
-		// Pending selection grants neither private reads nor publication until its acceptance installs memory.
+		// Retain selected policy while validation blocks memory authority and Active inference until acceptance.
 		if (selection.kind !== "settled") {
 			snapshot = migrationFailure({}, "State Flow branch restoration is pending", selection.kind === "current" ? selection.mode
-				: selection.kind === "auto-start" ? config.inactiveMode : inactiveSelection(selection.checkpoint.mode));
+				: selection.kind === "auto-start" ? "active" : selection.kind === "pre-runtime" ? selection.mode : selection.checkpoint.mode);
 		}
 		if (requestedMode) snapshot = deactivateEpisode(snapshot, requestedMode);
 		const pending: BranchRestoration = {
@@ -536,11 +701,11 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	): Promise<void> {
 		const placeholder = runtime;
 		let selected = runtime;
-		const owner = ctx.sessionManager.getSessionId();
+		const wanted = nativeScopeSelection(ctx);
 		const sameSession = sessionIdentity(ctx);
-		const signal = AbortSignal.any([pending.controller.signal, ...(ctx.signal ? [ctx.signal] : [])]);
+		const signal = modeOperationSignal(ctx, pending.controller.signal);
 		const isCurrent = () => branchRestoration.owns(pending) && !pending.controller.signal.aborted && !shuttingDown && runtime === selected
-			&& sameSession();
+			&& sameSession() && sameJson(nativeScopeSelection(ctx), wanted);
 		const assertCurrent = () => {
 			signal.throwIfAborted();
 			if (!isCurrent()) throw new Error("State Flow branch selection changed while awaiting publication");
@@ -548,7 +713,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		let accepted = false;
 		const failSelection = (error: unknown): void => {
 			const mode = pending.requestedMode ?? (selection.kind === "auto-start" ? "active"
-				: selection.kind === "attach" || selection.kind === "fork" ? selection.checkpoint.mode : snapshot.config.mode);
+				: selection.kind === "pre-runtime" ? selection.mode : selection.kind === "attach" || selection.kind === "fork" ? selection.checkpoint.mode : snapshot.config.mode);
 			snapshot = selectedBoundaryFailure(diagnosticText(error), mode);
 			installScopeStates();
 		};
@@ -567,61 +732,124 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		};
 		try {
 			if (selection.kind !== "settled") {
-				// Local policy is already passive while the selection waits for exclusion.
+				// Selected policy is visible while memory remains unavailable during the exclusion wait.
 				syncStateFlowTools();
 				updateUi(ctx);
 				const candidate = createRuntime(ctx);
 				try {
 					if (selection.kind === "current") {
-						const current = await candidate.refreshCurrentMemory(signal);
+						const current = await candidate.refreshSelectedCurrent(wanted, assertCurrent, signal);
 						assertCurrent();
-						if (current) runtime = selected = candidate;
-						snapshot = current ? deactivateEpisode(current, pending.requestedMode ?? selection.mode)
-							: migrationFailure({}, "Current State Flow session memory is unavailable", pending.requestedMode ?? selection.mode);
+						runtime = selected = candidate;
+						snapshot = deactivateEpisode(current, pending.requestedMode ?? selection.mode);
 						installScopeStates();
 					} else if (selection.kind === "attach") {
-						// Memory is the current same-session files; the Pi checkpoint supplies only mode and run lifecycle.
-						await candidate.withStartTransaction((current, publish) => {
+						// A validated shared-only bookmark may precede a new requested Session selection.
+						const addsSession = wanted.includes("session") && "scopes" in selection.checkpoint
+							&& !captureScopeSelection(selection.checkpoint.scopes).includes("session");
+						const disposition = addsSession ? await candidate.inspectSelectedLifecycle(wanted, assertCurrent, signal) : undefined;
+						assertCurrent();
+						if ((pending.requestedMode ?? selection.checkpoint.mode) === "passive" && disposition?.privateAcquisition === "unacquired") {
+							// Observation cannot turn the new policy or old bookmark into private acquisition.
+							const shared = wanted.filter(scope => scope !== "session");
+							if (shared.length) await candidate.refreshSelectedShared(captureScopeSelection(shared), assertCurrent, signal);
 							assertCurrent();
-							if (!current) throw new Error("Current State Flow session memory is unavailable");
-							const { checkpoint } = selection;
-							const restored: Snapshot = { config: { mode: checkpoint.mode }, meta: {
-								step: current.meta.step,
-								...(checkpoint.bootstrap ? { bootstrap: true } : {}),
-								...(checkpoint.specification === undefined ? {} : { specification: checkpoint.specification }),
-							} };
-							// Canceled preparation or boundary continuation may have no specification. Retain uncompiled native context.
-							if (restored.config.mode === "active" && restored.meta.specification === undefined
-								&& retainsPhysicalSessionProjection(reason) && hasUncheckpointedConversation(ctx.sessionManager.getBranch())) restored.meta.bootstrap = true;
-							const next = pending.requestedMode ? deactivateEpisode(restored, pending.requestedMode) : restored;
-							publish(next);
-							accept(candidate, next, appendCheckpoint);
-						}, signal);
+							runtime = selected = candidate;
+							snapshot = emptySnapshot(pending.requestedMode ?? "passive");
+							installScopeStates();
+						} else {
+							// Memory is the current same-session files; the Pi checkpoint supplies only mode and run lifecycle.
+							await candidate.withSelectedCurrentTransaction(wanted, (current, publish) => {
+								assertCurrent();
+								if (!current) throw new Error("Current State Flow session memory is unavailable");
+								const { checkpoint } = selection;
+								const restored: Snapshot = { config: { mode: checkpoint.mode }, meta: {
+									step: current.meta.step,
+									...(checkpoint.bootstrap ? { bootstrap: true } : {}),
+									...(checkpoint.specification === undefined ? {} : { specification: checkpoint.specification }),
+								} };
+								// Canceled preparation or boundary continuation may have no specification. Retain uncompiled native context.
+								if (restored.config.mode === "active" && restored.meta.specification === undefined
+									&& retainsPhysicalSessionProjection(reason) && hasUncheckpointedConversation(ctx.sessionManager.getBranch())) restored.meta.bootstrap = true;
+								const next = pending.requestedMode ? deactivateEpisode(restored, pending.requestedMode) : restored;
+								publish(next);
+								accept(candidate, next, appendCheckpoint);
+							}, assertCurrent, signal);
+						}
 					} else if (selection.kind === "fork") {
-						// The runtime copies the parent's current memory; the checkpoint supplies only child mode/bootstrap.
-						await candidate.withForkTransaction(selection.source, selection.checkpoint, (child, publish) => {
+						const disposition = await candidate.inspectSelectedLifecycle(wanted, assertCurrent, signal);
+						if (disposition && (!wanted.includes("session") || disposition.privateAcquisition === "acquired")) {
+							// Acquired child-current wins; a still-deferred shared child keeps its native pending fact.
+							await candidate.withSelectedCurrentTransaction(wanted, (current, publish) => {
+								assertCurrent();
+								const next = { ...current, config: { mode: pending.requestedMode ?? selection.checkpoint.mode } };
+								publish(next);
+								forkInitialization = false; modePersistenceError = undefined;
+								accept(candidate, next, () => { if (disposition.privateAcquisition === "acquired") appendNativeMarker({ reset: true }); appendCheckpoint(); });
+							}, assertCurrent, signal);
+						} else if (!wanted.includes("session")) {
+							// Admit selected shared owners only; no parent header/session data or private acquisition.
+							await candidate.withSelectedDeferredForkTransaction(wanted, { mode: pending.requestedMode ?? selection.checkpoint.mode,
+								...(selection.checkpoint.bootstrap ? { bootstrap: true } : {}) }, publish => {
+								assertCurrent(); publish();
+								forkInitialization = false; modePersistenceError = undefined;
+								accept(candidate, candidate.selectedSnapshot(), appendCheckpoint);
+							}, signal, true, () => { assertCurrent(); return pending.requestedMode ?? selection.checkpoint.mode; });
+						} else {
+							if (disposition?.privateAcquisition === "unacquired") throw new Error("Fork child has no deferred private-copy authority");
+							const base = disposition ? await loadSelectedFileCohort(ctx.cwd, candidate.sessionId, disposition.selection, candidate.root, candidate.sessionKey, signal) : undefined;
 							assertCurrent();
-							// Mode is selected independently of creating the child's private memory.
-							const next = pending.requestedMode ? deactivateEpisode(child, pending.requestedMode) : child;
-							publish(next);
-							forkInitialization = false;
-							accept(candidate, next, () => {
-								pi.appendEntry(PASSIVE_STOP_ENTRY_TYPE, { reset: true, owner });
-								appendCheckpoint();
-							});
-						}, signal);
+							if (disposition && !base) throw new Error("Deferred fork child authority disappeared");
+							// Direct-parent acquisition follows child classification and remains outside exclusion.
+							const source = forkSource(ctx), parentFile = ctx.sessionManager.getHeader()?.parentSession;
+							const next: Snapshot = { config: { mode: pending.requestedMode ?? selection.checkpoint.mode }, meta: disposition ? disposition.snapshot.meta : {
+								step: 0, ...(selection.checkpoint.bootstrap ? { bootstrap: true } : {}) } };
+							await candidate.withSelectedForkCopyTransaction({ ...(base ? { kind: "fork-deferred" as const, base } : { kind: "fork-new" as const }), source,
+								selection: wanted, snapshot: next, historyLimit: config.historyLimit,
+								author: (_basis, publish) => {
+									assertCurrent();
+									publish({ ...next, config: { mode: pending.requestedMode ?? selection.checkpoint.mode } });
+								} }, publish => {
+								assertCurrent(); publish();
+								forkInitialization = false; modePersistenceError = undefined;
+								accept(candidate, candidate.selectedSnapshot(), () => { appendNativeMarker({ reset: true }); appendCheckpoint(); });
+							}, (selectedSource, phase) => {
+								assertCurrent();
+								if (ctx.sessionManager.getHeader()?.parentSession !== parentFile) throw new Error("Native fork parent changed");
+								if (phase === "prepare" && !sameJson(forkSource(ctx), selectedSource)) throw new Error("Native direct parent mismatch");
+							}, signal);
+						}
 					} else {
-						await candidate.withStartTransaction((current, publish) => {
+						const mode = pending.requestedMode ?? (selection.kind === "pre-runtime" ? selection.mode : "active");
+						const disposition = await candidate.inspectSelectedLifecycle(wanted, assertCurrent, signal);
+						assertCurrent();
+						// A pre-runtime Passive choice may observe shared owners, not acquire an explicitly unacquired Session.
+						const observesUnacquired = (pending.requestedMode ?? mode) === "passive" && wanted.includes("session") && disposition?.privateAcquisition === "unacquired";
+						if (disposition && !observesUnacquired) {
+							await candidate.withSelectedCurrentTransaction(wanted, (current, publish) => {
+								assertCurrent();
+								const next = { ...current, config: { mode: pending.requestedMode ?? mode } };
+								publish(next);
+								accept(candidate, next, appendCheckpoint);
+							}, assertCurrent, signal);
+						} else if (mode === "passive" || observesUnacquired) {
+							const shared = wanted.filter(scope => scope !== "session");
+							if (shared.length) await candidate.refreshSelectedShared(captureScopeSelection(shared), assertCurrent, signal);
 							assertCurrent();
-							// Truly new branch authority is rechecked after waiting; existing memory needs its own selection.
-							const branch = ctx.sessionManager.getBranch();
-							const discovery = discoverSnapshotData(branch);
-							if (current || discovery.candidates.length > 0 || discovery.errors.length > 0) throw new Error("Existing session runtime requires retained-boundary restoration");
-							const activated = startEpisode(hasPriorConversation(branch));
-							const next = pending.requestedMode ? deactivateEpisode(activated, pending.requestedMode) : activated;
-							publish(next);
-							accept(candidate, next, appendCheckpoint);
-						}, signal, true);
+							runtime = selected = candidate;
+							snapshot = emptySnapshot(pending.requestedMode ?? mode);
+							installScopeStates();
+						} else {
+							const initial = startEpisode(hasPriorConversation(ctx.sessionManager.getBranch()));
+							await candidate.withSelectedFirstPatchTransaction(wanted, initial, transaction => {
+								assertCurrent();
+								if (!branchStartsWithoutRuntime || forkInitialization) throw new Error("Existing session or pending fork requires current-memory acceptance");
+								// Bind the newest independent mode inside the existing atomic origin/lifecycle staging engine.
+								const next = pending.requestedMode ? deactivateEpisode(initial, pending.requestedMode) : initial;
+								transaction.publish(next);
+								accept(candidate, next, appendCheckpoint);
+							}, assertCurrent, signal, true);
+						}
 					}
 				} catch (error) {
 					if (accepted) {
@@ -636,13 +864,13 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 				if (accepted) return;
 			}
 			settleSelection(ctx, reason, notifyRecovery, skipped, selected !== placeholder);
-			if (snapshot.config.mode === "off" || isActive() || runtime?.view) return;
-			// Unavailable Active memory may expose shared reads, never substitute private memory or model context.
+			if (snapshot.config.mode === "off" || isActive() || readableView() || snapshot.meta.validation?.attempt === 0 || !branchStartsWithoutRuntime) return;
+			// Only a proven pre-runtime Passive branch may observe shared owners without private acquisition.
 			const passive = await loadPassiveView(ctx, signal, isCurrent, notifyRecovery);
 			if (passive === undefined) return;
 			assertCurrent();
 			// An intervening passive patch or inspection owns its newer cache, even on the same physical branch.
-			if (runtime?.view) return;
+			if (readableView()) return;
 			runtime = selected = passive;
 			installScopeStates();
 			updateUi(ctx);
@@ -658,9 +886,13 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 
 	/** Load current shared memory for passive projection without initializing or publishing it. */
 	async function loadPassiveView(ctx: ExtensionContext, signal: AbortSignal, isCurrent: () => boolean, notify: boolean): Promise<TemporalRuntime | undefined> {
+		const wanted = nativeScopeSelection(ctx), shared = wanted.filter(scope => scope !== "session");
+		if (!shared.length) return undefined;
 		const passive = createRuntime(ctx);
 		try {
-			await passive.refreshShared(signal);
+			await passive.refreshSelectedShared(captureScopeSelection(shared), () => {
+				if (!isCurrent() || !sameJson(nativeScopeSelection(ctx), wanted)) throw new Error("State Flow observation selection changed");
+			}, signal);
 		} catch (error) {
 			if (isCurrent() && !signal.aborted && notify && !modePersistenceError) notifyProblem(ctx, `State Flow passive memory is unavailable: ${diagnosticText(error)}`, "warning");
 			return undefined;
@@ -669,10 +901,10 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	}
 
 	function selectedContinuation(ctx: ExtensionContext, reason: unknown): PassiveContinuation | undefined {
-		if (!retainsPhysicalSessionProjection(reason) || !runtime?.view) return undefined;
-		const boundary = findPassiveStopBoundary(ctx.sessionManager.getBranch(), ctx.sessionManager.getSessionId(), PASSIVE_STOP_ENTRY_TYPE);
+		if (!retainsPhysicalSessionProjection(reason) || !readableView()) return undefined;
+		const boundary = branchPolicy(ctx).stop;
 		return boundary === undefined ? undefined : createPassiveContinuation(
-			projectModelState(effectiveState), boundary.at, boundary.from, boundary.preserveContext,
+			projectModelState(effectiveState), boundary.at, boundary.from, boundary.preserveContext, nativeScopeSelection(ctx),
 		);
 	}
 
@@ -698,40 +930,89 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		diagnosticWriter.record(sessionAddress(ctx).id, ctx.cwd, error, category, extras);
 	}
 
+	function nativeToolAdmission(id: string, name: string, ctx?: ExtensionContext): SelectedPolicyRequest | undefined {
+		if (nativeRequests.has(id)) return nativeRequests.take(id, name);
+		// Raw non-model domain invocations have no operation signal. Public SDK tool_call always gates.
+		if (ctx?.signal || nativeRequests.active) throw new Error("State Flow tool batch has no current native request");
+		return undefined;
+	}
+
+	function currentNativeTool(id: string, name: string, ctx: ExtensionContext): boolean {
+		try {
+			if (nativeRequests.has(id)) nativeRequests.check(id, name);
+			else if (nativeRequests.active || ctx.signal !== undefined) return false;
+			const policy = requestPolicy.policy, selected = runtime;
+			return policy !== undefined && selected !== undefined && selected.sessionId === policy.owner
+				&& policy.owner === ctx.sessionManager.getSessionId() && policy.cwd === ctx.cwd && selected.cwd === ctx.cwd
+				&& selected.sessionKey === sessionAddress(ctx).key;
+		} catch { return false; }
+	}
+
 	pi.registerTool({
 		name: READ_STATE_TOOL_NAME,
 		label: "Read State",
-		description: "Read exact State Flow values or historical semantic patches with one path or an ordered path list. Unscoped semantic paths read the effective overlay; effective makes that overlay explicit, while global, cwd, and session select ownership. Array selectors support zero-based indices and half-open [start..end] ranges. Projection value returns semantic data; keys returns minimal structure; patch intersects the selected path at its boundary. Path object keys must be ASCII identifiers ([A-Za-z_$][A-Za-z0-9_$-]*); non-ASCII keys cannot be addressed.",
+		description: "Read exact State Flow values or historical semantic patches with one path or an ordered path list. With one participating owner, semantic paths and structured references are scope-free, effective[N] selects that owner's historical boundary, and patches[N] selects its retained owner patch. With multiple owners, unscoped paths use the effective overlay and owner patch history requires an explicit owner. Optional global/cwd/session roots may address only participating available owners. Array selectors are zero-based indices or half-open [start..end] ranges, never temporal offsets inside a semantic value. Projection value returns data; keys returns minimal structure; patch intersects the selected path at its boundary. Path object keys must be ASCII identifiers ([A-Za-z_$][A-Za-z0-9_$-]*); non-ASCII keys cannot be addressed.",
 		promptSnippet: "Read exact state values, structures, or historical semantic patches",
+		promptGuidelines: [SCOPE_PARTICIPATION_GUIDELINE],
 		parameters: Type.Object({
-			path: Type.Optional(Type.String({ description: "One semantic path; unscoped paths use effective, explicit roots may use effective/global/cwd/session and historical [N], and arrays support half-open [start..end] ranges" })),
+			path: Type.Optional(Type.String({ description: "One semantic path. One owner: flat planes, effective[N] history or retained patches[N]. Multiple owners: effective overlay or explicit participating owner; patch history needs owner.patches[N]. Nested array selectors stay ordinary indices/ranges." })),
 			paths: Type.Optional(Type.Array(Type.String(), { minItems: 1, description: "Ordered query paths evaluated as one all-or-error read" })),
 			projection: Type.Optional(StringEnum(["value", "keys", "patch"] as const, { description: "Value snapshot by default, structural keys with minimal meta, or the selected historical semantic patch" })),
 		}, { additionalProperties: false }),
-		async execute(_toolCallId, params, signal) {
+		async execute(toolCallId, params, signal, _onUpdate, ctx) {
 			try {
+				const admission = nativeToolAdmission(toolCallId, READ_STATE_TOOL_NAME, ctx);
+				admission?.revalidate();
+				if (admission) signal = signal ? AbortSignal.any([signal, admission.signal]) : admission.signal;
 				type ReadDetails = { path?: string; paths?: string[]; projection?: string; transitionId?: string };
 				if (!memoryToolsAvailable()) throw new Error("State Flow tools are off for this session");
 				if (signal?.aborted) throw new Error("State Flow read was aborted");
-				if (!runtime?.view) throw new Error("State Flow temporal runtime is unavailable");
+				assertSelectedBranchAvailable();
+				const selected = runtime;
+				if (!selected) throw new Error("State Flow temporal runtime is unavailable");
+				const receipt = admission ?? requestPolicy.capture();
+				const check = () => {
+					receipt.revalidate();
+					signal?.throwIfAborted();
+					if (!ctx || runtime !== selected || selected.sessionId !== receipt.policy.owner || receipt.policy.owner !== ctx.sessionManager.getSessionId() || receipt.policy.cwd !== ctx.cwd
+						|| selected.cwd !== ctx.cwd || selected.sessionKey !== sessionAddress(ctx).key) throw new Error("State Flow read selection owner changed");
+				};
+				check();
+				const wanted = captureScopeSelection(receipt.policy.scopes);
+				params = structuredClone(params);
+				check();
 				if (params.path === undefined && params.paths === undefined) throw new Error("read_state requires path or paths");
 				if (params.path !== undefined && params.paths !== undefined) throw new Error("read_state accepts path or paths, not both");
 				{
-					const paths = params.paths ?? [params.path!];
+					const requestedPaths = [...(params.paths ?? [params.path!])];
+					const paths = requestedPaths.map(path => normalizeModelReadPath(path, wanted, config.historyLimit));
+					check();
+					const view = readableView(selected);
+					// Wanted policy was checked by normalization; an observational subset is not an exclusion.
+					for (const path of paths) {
+						const owner = /^(global|cwd|session)(?=\.|\[|$)/.exec(path)?.[1] as StateScope | undefined;
+						if (owner && !view?.selection.includes(owner)) throw new Error(`State Flow ${owner}: selected, unavailable`);
+					}
+					if (!view) throw new Error("State Flow temporal runtime is unavailable");
+					check();
 					if (paths.some((path) => /^session(?:\.|\[|$)/.test(path))) assertSelectedBranchAvailable();
 					if (paths.length === 1 && /^(?:global|cwd|session)\.patches(?:\[\d+\])?$/.test(paths[0]!)) {
 						if (params.projection !== undefined && params.projection !== "value") throw new Error("Scope patch paths support only the value projection");
-						const result = readStatePath(runtime.view, paths[0]!, config.historyLimit);
+						const result = readStatePath(view, paths[0]!, config.historyLimit);
 						if (!("patch" in result)) throw new Error("Expected a scope patch path");
+						const output = wanted.length === 1 ? projectModelReferences({ patch: result.patch }, wanted, wanted.flatMap(scope => Object.keys(view.scopes[scope]?.modules ?? {}))) : { patch: result.patch };
+						check();
 						return {
-							content: [{ type: "text", text: `\n${JSON.stringify({ patch: result.patch })}` }],
-							details: { path: paths[0], transitionId: result.boundary.id } as ReadDetails,
+							content: [{ type: "text", text: `\n${JSON.stringify(output)}` }],
+							details: { path: requestedPaths[0], transitionId: result.boundary.id } as ReadDetails,
 						};
 					}
-					const result = readProjectedState(runtime.view, paths, params.projection, config.historyLimit);
+					const result = readProjectedState(view, paths, params.projection, config.historyLimit);
+					const output = wanted.length === 1 ? projectModelReferences(result, wanted, wanted.flatMap(scope => Object.keys(view.scopes[scope]?.modules ?? {}))) : result;
+					check();
 					return {
-						content: [{ type: "text", text: `\n${JSON.stringify(result)}` }],
-						details: { ...(params.path === undefined ? { paths } : { path: params.path }), projection: params.projection ?? "value" } as ReadDetails,
+						content: [{ type: "text", text: `\n${JSON.stringify(output)}` }],
+						details: { ...(params.path === undefined ? { paths: requestedPaths } : { path: requestedPaths[0] }), projection: params.projection ?? "value" } as ReadDetails,
 					};
 				}
 			} catch (error) {
@@ -740,23 +1021,20 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		},
 	});
 
-	pi.registerTool({
+	const patchStateTool = defineTool({
 		name: PATCH_STATE_TOOL_NAME,
 		label: "Patch State",
-		description: "The sole State Flow semantic mutation protocol. Supply one or more global, cwd, or session patches; all supplied scopes commit atomically. This call must be the only State Flow barrier in its assistant response. Deleting an intent also deletes same-scope working/lazy keys its {\"$ref\"} values own unless another intent refs them. Name keys in ASCII ([A-Za-z_$][A-Za-z0-9_$-]*) so read paths and refs resolve; values may use any language.",
-		promptSnippet: "Atomically patch one or more global/cwd/session scopes",
+		description: "The sole State Flow semantic mutation protocol. With one participating owner, supply intents/strategy/tactics/artifacts/lazy planes directly, without an owner wrapper. With multiple owners, supply one or more global, cwd, or session patches for participating owners; all supplied owners commit atomically. This call must be the only State Flow barrier in its assistant response. Intent updates run first, then clear owned same-scope strategy/tactics/lazy keys unless a remaining or new intent refs them, then other fields apply. Later writes can recreate cleared paths without old fields. Name keys in ASCII ([A-Za-z_$][A-Za-z0-9_$-]*) so read paths and refs resolve; values may use any language.",
+		promptSnippet: "Atomically patch participating semantic memory in its declared flat or multi-owner form",
 		promptGuidelines: [
 			RESPONSE_PATCH_GUIDELINE,
+			SCOPE_PARTICIPATION_GUIDELINE,
 			"Use patch_state only for material durable semantic changes; ordinary answers need no finalization call.",
 			"Use patch_state as reconciliation, not append-only notes: place new knowledge at the narrowest valid scope and remove superseded or completed state from touched branches.",
 			"Call patch_state alone in an assistant response; after its acknowledgement, further reasoning, tools, and later patch_state calls remain allowed.",
 		],
 		executionMode: "sequential",
-		parameters: Type.Object({
-			global: Type.Optional(Type.Record(Type.String(), Type.Unknown(), { description: "Optional global semantic patch" })),
-			cwd: Type.Optional(Type.Record(Type.String(), Type.Unknown(), { description: "Optional project semantic patch" })),
-			session: Type.Optional(Type.Record(Type.String(), Type.Unknown(), { description: "Optional session semantic patch" })),
-		}, { additionalProperties: false }),
+		parameters: config.scopes.length === 1 ? flatPatchParameters : scopedPatchParameters,
 		renderCall(args, theme, context) {
 			const title = theme.fg("toolTitle", theme.bold(PATCH_STATE_TOOL_NAME));
 			if (!config.showSuccessfulPatches && !context.isError) return new Text(title, 0, 0);
@@ -768,31 +1046,48 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		},
 		async execute(toolCallId, params, signal, _onUpdate, ctx) {
 			signal = signal ? AbortSignal.any([signal, memoryToolLifetime.signal]) : memoryToolLifetime.signal;
+			let admitted = false;
 			try {
+				const admission = nativeToolAdmission(toolCallId, PATCH_STATE_TOOL_NAME, ctx);
+				admission?.revalidate();
+				if (admission) signal = AbortSignal.any([signal, admission.signal]);
 				if (!memoryToolsAvailable()) throw new Error("State Flow tools are off for this session");
 				assertPublicationAvailable();
 				if (signal?.aborted) throw new Error("State Flow patch was aborted before materialization");
-				if (!isObject(params)) throw new Error("patch_state requires an object");
+				if (!ctx) throw new Error("State Flow patch selection owner changed");
+				const selected = runtime ??= createRuntime(ctx);
+				const sameSession = sessionIdentity(ctx);
+				const receipt = admission ?? requestPolicy.capture();
+				const wanted = captureScopeSelection(receipt.policy.scopes);
+				const catalog = moduleHost.captureIfBound();
+				signal = AbortSignal.any([signal, receipt.signal, ...(catalog ? [catalog.signal] : [])]);
+				const check = () => {
+					receipt.revalidate();
+					if (runtime !== selected || !sameSession() || selected.sessionId !== receipt.policy.owner || receipt.policy.owner !== ctx.sessionManager.getSessionId()
+						|| receipt.policy.cwd !== ctx.cwd || selected.cwd !== ctx.cwd || selected.sessionKey !== sessionAddress(ctx).key) throw new Error("State Flow patch selection owner changed");
+					assertPublicationAvailable();
+					catalog?.assertCurrent();
+				};
+				// Rehash and normalize only after caller admission, still before canonical exclusion.
+				check();
+				const excluded = isObject(params) && Object.keys(params).find(key =>
+					(DEFAULT_SCOPE_SELECTION as readonly string[]).includes(key) && !wanted.includes(key as StateScope));
+				if (excluded) throw new Error(`State Flow ${excluded} patch scope is excluded`);
 				params = structuredClone(params);
-				const allowed = new Set(["global", "cwd", "session"]);
-				for (const key of Object.keys(params)) {
-					if (!allowed.has(key)) throw new Error(`patch_state does not accept field ${key}`);
-				}
-				const patches: AtomicScopePatches = {};
-				for (const scope of ["global", "cwd", "session"] as const) {
-					if (!Object.hasOwn(params, scope)) continue;
-					const patch = params[scope];
-					if (!isObject(patch)) throw new Error(`patch_state ${scope} must be a semantic patch object`);
-					if (Object.keys(patch).length === 0) throw new Error(`patch_state ${scope} cannot be empty; omit it when unchanged`);
-					patches[scope] = patch;
-				}
+				check();
+				admitted = true;
+				const knownModules = [...new Set([...(catalog?.modules.map(module => module.id) ?? []),
+					...wanted.flatMap(scope => Object.keys(readableView(selected)?.scopes[scope]?.modules ?? {}))])];
+				const patches = normalizeModelPatches(params, wanted, knownModules);
+				check();
 				const scopes = Object.keys(patches) as StateScope[];
-				if (scopes.length === 0) throw new Error("patch_state requires at least one scope patch");
-				const selected = runtime ??= createRuntime(ctx);
+				const firstAuthoring = selected.selectedView() === undefined;
 				const acquiredArtifacts = structuredClone([...artifactReads.successful.values()]);
 				const acquiredSkills = structuredClone([...skillReads.successful.values()]);
 				const previousEffective = effectiveState;
-				return await selected.withPatchTransaction((transaction) => {
+				skillReads.validateCompilations(patches);
+				const author = (transaction: SelectedRuntimePatchTransaction) => {
+					check();
 					if (runtime !== selected) throw new Error("State Flow session selection changed while awaiting publication");
 					if (!memoryToolsAvailable()) throw new Error("State Flow tools are off for this session");
 					assertPublicationAvailable();
@@ -803,15 +1098,16 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 							throw new Error(`Artifact source changed after acquisition: ${acquired.path}`);
 						}
 					}
-					const stage = stageAtomicScopePatches(transaction.states, patches, acquiredSkills, transaction.causalBasis, acquiredArtifacts);
-					const changed = (["global", "cwd", "session"] as const).some((scope) =>
+					const stage = stageSelectedScopePatches(transaction, patches, acquiredSkills, transaction.causalBasis, acquiredArtifacts, catalog?.modules);
+					const changed = transaction.selection.some((scope) =>
 						!sameJson(transaction.states[scope], stage.nextStates[scope])
-						|| Object.entries(stage.provenanceUpdates[scope]).some(([path, evidence]) =>
-							!Object.hasOwn(transaction.provenance[scope], path) || !sameJson(transaction.provenance[scope][path], evidence)));
-					const nextSnapshot = structuredClone(snapshot);
-					let publication: RuntimePublication | undefined;
-					commitScopedTransition(nextSnapshot, transaction.states, stage, (accepted, next) => {
-						publication = transaction.publish(next, accepted, stage.provenanceUpdates);
+						|| Object.entries(stage.provenanceUpdates[scope] ?? {}).some(([path, evidence]) =>
+							!Object.hasOwn(transaction.provenance[scope] ?? {}, path) || !sameJson(transaction.provenance[scope]?.[path], evidence)));
+					const nextSnapshot = structuredClone(firstAuthoring ? transaction.snapshot : snapshot);
+					let publication: SelectedFilePublication | undefined;
+					commitSelectedTransition(nextSnapshot, transaction, stage, (accepted, next) => {
+						catalog?.assertCurrent();
+						publication = transaction.publish(next, accepted, stage.provenanceUpdates, stage.moduleAdditions);
 					}, transaction.causalBasis, { finalizeRun: false });
 					snapshot = nextSnapshot;
 					installScopeStates();
@@ -821,56 +1117,94 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 					}
 					clearAcceptedAcquisitions(new Set(acquiredArtifacts.map(({ path }) => path)));
 					updateUi(ctx);
-					const updates = contextProjection.acceptPatch(previousEffective, effectiveState, patches, acquisition.hints, stage.cascades, isActive());
+					const updates = contextProjection.acceptPatch(previousEffective, effectiveState, patches, acquisition.hints, stage.cascades, isActive(), wanted);
 					const acknowledgement = changed
 						? `\nState materialized atomically at ${scopes.join("+")} scope${scopes.length === 1 ? "" : "s"}.`
 						: "\nState already current.";
 					return { content: [
-						{ type: "text" as const, text: acknowledgement + stage.missingDeletions.map(({ path, unavailablePath }) =>
+						{ type: "text" as const, text: acknowledgement + stage.missingDeletions.map(deletion => projectModelMissingDeletion(deletion, wanted)).map(({ path, unavailablePath }) =>
 							`\n\nHint: deletion skipped at ${path}; target absent. First unavailable component: ${unavailablePath}. Check the path if you expected an existing value.`).join("") },
 						...(updates ? [{ type: "text" as const, text: `\n${presentationJson({ state_updates: updates })}` }] : []),
 					], details: { scopes, step: snapshot.meta.step, changed, missingDeletions: stage.missingDeletions } };
-				}, signal);
+				};
+				if (!firstAuthoring) return await selected.withSelectedPatchTransaction(author, check, signal);
+				check();
+				const disposition = await selected.inspectSelectedLifecycle(wanted, check, signal);
+				if (disposition && !wanted.includes("session")) {
+					return await selected.withSelectedCurrentTransaction(wanted, (_current, _publish, transaction) => author(Object.freeze({
+						...transaction, snapshot: { ...transaction.snapshot, config: { mode: receipt.policy.mode } },
+					})), check, signal);
+				}
+				if (disposition) {
+					const acquire = () => {
+						check();
+						if (receipt.policy.mode === "off" || !wanted.includes("session") || disposition.privateAcquisition !== "unacquired"
+							|| forkInitialization || branchPolicy(ctx).forkPending) throw new Error("State Flow first mutation requires independent unacquired Session participation");
+					};
+					acquire();
+					const base = await loadSelectedFileCohort(ctx.cwd, selected.sessionId, disposition.selection, selected.root, selected.sessionKey, signal);
+					acquire();
+					if (!base) throw new Error("Unacquired State Flow first mutation source disappeared");
+					let result!: ReturnType<typeof author>;
+					return await selected.withSelectedSessionAcquisitionTransaction({ kind: "unacquired", base, selection: wanted,
+						snapshot: { ...disposition.snapshot, config: { mode: receipt.policy.mode } }, historyLimit: config.historyLimit,
+						author: (basis, publish) => {
+							acquire();
+							result = author(Object.freeze<SelectedRuntimePatchTransaction>({ selection: wanted,
+								states: readTemporalScopes(basis.view, 0, config.historyLimit), snapshot: basis.snapshot,
+								modules: Object.fromEntries(wanted.filter(scope => basis.view.scopes[scope]?.modules !== undefined).map(scope => [scope, structuredClone(basis.view.scopes[scope]!.modules!)])),
+								causalBasis: basis.view.lineage.at(-1)!.id, provenance: basis.provenance,
+								publish: (next, transition, provenance, additions) => { acquire(); return publish(next, transition, provenance, additions); } }));
+						} }, publish => { acquire(); publish(); return result; }, signal, true);
+				}
+				if (!branchStartsWithoutRuntime || forkInitialization || branchPolicy(ctx).forkPending) throw new Error("State Flow first authoring requires native independent origin authority");
+				return await selected.withSelectedFirstPatchTransaction(wanted, snapshot, author, () => {
+					check();
+					if (!branchStartsWithoutRuntime || forkInitialization || branchPolicy(ctx).forkPending) throw new Error("State Flow origin authority changed");
+				}, signal, true);
 			} catch (error) {
-				let attempted: unknown;
-				try { attempted = structuredClone(params); } catch { attempted = undefined; }
-				const cause = diagnosticText(error);
-				if (!signal.aborted && memoryToolsAvailable()) recordDiagnostic(cause, /concurrently|advanced/.test(cause) ? "publication-conflict" : "invalid-patch", ctx, {
-					input: attempted,
-					tool: PATCH_STATE_TOOL_NAME,
-					toolCallId,
-				});
+				if (admitted && !signal.aborted && memoryToolsAvailable()) {
+					let attempted: unknown;
+					try { attempted = structuredClone(params); } catch { attempted = undefined; }
+					const cause = diagnosticText(error);
+					recordDiagnostic(cause, /concurrently|advanced/.test(cause) ? "publication-conflict" : "invalid-patch", ctx, {
+						input: attempted, tool: PATCH_STATE_TOOL_NAME, toolCallId,
+					});
+				}
 				throw separatedFailure(error);
 			}
 		},
 	});
 
-	function startStateFlow(ctx: ExtensionContext): Promise<StateFlowTelegramControlResult> {
+	pi.registerTool({ ...patchStateTool });
+
+	function startStateFlow(ctx: ExtensionContext, reselect = false): Promise<StateFlowTelegramControlResult> {
 		if (shuttingDown) return Promise.resolve({ ok: false, message: "State Flow is shutting down" });
-		if (startActivation.current?.operation) return startActivation.current.operation;
+		if (!reselect && startActivation.current?.operation) return startActivation.current.operation;
 		telegramStartPending = false;
-		if (activeContext && !branchRestoration.current && isActive()) {
+		if (!reselect && activeContext && !branchRestoration.current && isActive()) {
 			return Promise.resolve({ ok: true, message: "State Flow is already active", signal: sharedInspectionLifetime.signal });
 		}
 		const pending = startActivation.claim({ controller: new AbortController() });
-		return startActivation.track(pending, runStart(ctx, pending.controller));
+		return startActivation.track(pending, runStart(ctx, pending.controller, reselect));
 	}
 
 	/** Await restoration-owned attachment and exact-source fork recovery before current-head activation. */
-	async function runStart(ctx: ExtensionContext, pending: AbortController): Promise<StateFlowTelegramControlResult> {
+	async function runStart(ctx: ExtensionContext, pending: AbortController, reselect: boolean): Promise<StateFlowTelegramControlResult> {
 		const sameSession = sessionIdentity(ctx);
-		const signal = ctx.signal ? AbortSignal.any([pending.signal, ctx.signal]) : pending.signal;
+		const signal = modeOperationSignal(ctx, pending.signal);
 		const isOwner = () => startActivation.current?.controller === pending && !signal.aborted && !shuttingDown && sameSession();
 		const superseded = (): StateFlowTelegramControlResult => {
 			pending.abort();
 			return { ok: false, message: "State Flow activation was superseded", signal: pending.signal };
 		};
 		try {
-			if (deferredBranch?.reason === "fork") await waitForRecovery(restoreActiveBranch(ctx, "fork", false, pending), signal);
+			if (reselect) await waitForRecovery(restoreActiveBranch(ctx, undefined, false, pending), signal);
+			else if (deferredBranch?.reason === "fork") await waitForRecovery(restoreActiveBranch(ctx, "fork", false, pending), signal);
 			else if (!activeContext) await waitForRecovery(restoreActiveBranch(ctx, undefined, false, pending), signal);
 			else if (branchRestoration.current?.operation) await waitForRecovery(branchRestoration.current.operation, signal);
 			if (!isOwner()) return superseded();
-			if (isActive()) return { ok: true, message: "State Flow is already active", signal: sharedInspectionLifetime.signal };
+			if (!reselect && isActive()) return { ok: true, message: "State Flow is already active", signal: sharedInspectionLifetime.signal };
 			if (forkInitialization) {
 				// Withdraw this join on cancellation without revoking the independently owned mode persistence.
 				const stopping = inactivePersistence.current?.operation;
@@ -895,7 +1229,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		owns = () => startActivation.current?.controller === pending,
 	): Promise<StateFlowTelegramControlResult> {
 		let selected = runtime;
-		const owner = ctx.sessionManager.getSessionId();
+		const wanted = nativeScopeSelection(ctx);
 		const sameSession = sessionIdentity(ctx);
 		const policy = () => `${snapshot.config.mode}:${isActive()}`;
 		const initialPolicy = policy();
@@ -903,14 +1237,15 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		const active = mode === "active";
 		let accepted = false;
 		let receipt = AbortSignal.any([pending.signal, sharedInspectionLifetime.signal]);
-		const signal = ctx.signal ? AbortSignal.any([pending.signal, ctx.signal]) : pending.signal;
+		const signal = modeOperationSignal(ctx, pending.signal);
 		const isCurrent = () => owns() && !signal.aborted && runtime === selected && !shuttingDown
-			&& sameSession() && policy() === (accepted ? acceptedPolicy : initialPolicy);
+			&& sameSession() && sameJson(nativeScopeSelection(ctx), wanted) && policy() === (accepted ? acceptedPolicy : initialPolicy);
 		const superseded = (): StateFlowTelegramControlResult => {
 			pending.abort();
 			return { ok: false, message: active ? "State Flow activation was superseded" : "State Flow mode change was superseded", signal: pending.signal };
 		};
 		try {
+			assertNativeMemoryScopes(wanted);
 			const activation = createRuntime(ctx);
 			const deferred = deferredBranch;
 			if (deferred) {
@@ -919,15 +1254,20 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 				branchStartsWithoutRuntime = retained.kind === "pre-runtime" || (discovery.candidates.length === 0 && discovery.errors.length === 0);
 			}
 			// Off activation owns one cancellable current-head publication, not an independent read-only restore.
-			const result = await activation.withStartTransaction((current, publish) => {
+			const acceptActivation = (current: Snapshot | undefined, publish: (next: Snapshot) => SelectedFilePublication) => {
 				signal.throwIfAborted();
 				if (!isCurrent()) throw new Error("State Flow activation selection changed while awaiting publication");
 				if (!current && (!active || !branchStartsWithoutRuntime)) throw new Error(snapshot.meta.validation?.error ?? "Current State Flow session memory is unavailable");
 				const boundary = deferred && retainsPhysicalSessionProjection(deferred.reason)
-					? findPassiveStopBoundary(ctx.sessionManager.getBranch(), owner, PASSIVE_STOP_ENTRY_TYPE) : undefined;
+					? branchPolicy(ctx).stop : undefined;
 				const bootstrap = hasPriorConversation(ctx.sessionManager.getBranch()) || passiveContinuation !== undefined || boundary !== undefined;
 				const activated = !active ? deactivateEpisode(current!, "passive")
 					: current ? resumeEpisode(current, bootstrap) : startEpisode(bootstrap);
+				if (active) {
+					// Explicit Start accepts current memory, not the prior run's prompt or repair attempt.
+					delete activated.meta.specification;
+					delete activated.meta.validation;
+				}
 				const resumedWrites = modePersistenceError !== undefined;
 				publish(activated);
 				accepted = true;
@@ -951,7 +1291,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 				updateUi(ctx);
 				if (forkInitialization) {
 					forkInitialization = false;
-					pi.appendEntry(PASSIVE_STOP_ENTRY_TYPE, { reset: true, owner });
+					appendNativeMarker({ reset: true });
 				}
 				appendCheckpoint();
 				if (!active) {
@@ -962,12 +1302,44 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 					? "State Flow active. The next complete agent run will migrate active context into state."
 					: "State Flow active. The next prompt starts a stateful agent run.", "info");
 				return { ok: true, message: "State Flow active", signal: receipt };
-			}, signal, active && branchStartsWithoutRuntime);
+			};
+			const check = () => { signal.throwIfAborted(); if (!isCurrent()) throw new Error("State Flow activation superseded"); };
+			let result: StateFlowTelegramControlResult;
+			const sameRuntimeOwner = selected?.cwd === ctx.cwd && selected.sessionKey === activation.sessionKey;
+			// Known accepted Session can only take current acceptance, even if its live header is later downgraded.
+			const acceptedSession = sameRuntimeOwner && selected?.selectedView()?.selection.includes("session");
+			const disposition = active && !acceptedSession ? await activation.inspectSelectedLifecycle(wanted, check, signal) : undefined;
+			// Explicit Start owns the grant; header data only selects the existing acquisition route.
+			if (active && wanted.includes("session") && disposition?.privateAcquisition === "unacquired") {
+				if (forkInitialization || branchPolicy(ctx).forkPending) throw new Error("Pending fork cannot use independent private acquisition");
+				// Retain denial-only acquisition knowledge when an existing owner has cleared or excluded its cache.
+				if (sameRuntimeOwner) await selected!.inspectSelectedLifecycle(wanted, check, signal);
+				const base = await loadSelectedFileCohort(ctx.cwd, activation.sessionId, disposition.selection, activation.root, activation.sessionKey, signal);
+				check();
+				if (!base) throw new Error("Unacquired State Flow source authority disappeared");
+				let acquiredResult!: StateFlowTelegramControlResult;
+				result = await activation.withSelectedSessionAcquisitionTransaction({ kind: "unacquired", base, selection: wanted,
+					snapshot: { ...disposition.snapshot, config: { mode: "active" } }, historyLimit: config.historyLimit,
+					author: (basis, publish) => {
+						check();
+						if (forkInitialization || branchPolicy(ctx).forkPending) throw new Error("Pending fork cannot use independent private acquisition");
+						acquiredResult = acceptActivation(basis.snapshot, activated => publish(activated));
+					} }, publish => { check(); publish(); return acquiredResult; }, signal, true);
+			} else if (active && branchStartsWithoutRuntime && !acceptedSession && !disposition) {
+				const next = startEpisode(hasPriorConversation(ctx.sessionManager.getBranch()) || passiveContinuation !== undefined);
+				result = await activation.withSelectedFirstPatchTransaction(wanted, next, transaction => {
+					check();
+					if (!branchStartsWithoutRuntime || forkInitialization) throw new Error("State Flow origin authority changed");
+					return acceptActivation(undefined, activated => transaction.publish(activated));
+				}, check, signal, true);
+			} else result = await activation.withSelectedCurrentTransaction(wanted,
+				(current, publish) => acceptActivation(current, publish), check, signal);
 			return isCurrent() ? result : superseded();
 		} catch (error) {
 			if (!isCurrent()) return superseded();
 			const message = conciseDiagnostic(`${accepted ? `State Flow ${mode}; lifecycle update failed` : active ? "State Flow activation failed" : "State Flow passive acceptance failed"}: ${diagnosticText(error)}`);
-			// Failed Passive acceptance falls back to its caller's write-fence report.
+			// An unaccepted activation cannot replace retained lifecycle or poison an independent Stop.
+			// Attachment owns required-proof unavailability; failed Passive acceptance reports through its caller's fence.
 			if (active || accepted) notifyProblem(ctx, message, accepted ? "warning" : "error");
 			return { ok: accepted, message, signal: receipt };
 		}
@@ -980,15 +1352,38 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	};
 
 	/** Terminal commands and Telegram controls share these lifecycle owners. */
-	function selectMode(ctx: ExtensionContext, mode: StateFlowMode): Promise<StateFlowTelegramControlResult> {
-		return mode === "active" ? startStateFlow(ctx) : deactivateStateFlow(ctx, mode);
+	function selectMode(ctx: ExtensionContext, mode: StateFlowMode, scopes?: ScopeSelection): Promise<StateFlowTelegramControlResult> {
+		if (!scopes || sameJson(scopes, nativeScopeSelection(ctx))) return mode === "active" ? startStateFlow(ctx) : deactivateStateFlow(ctx, mode);
+		if (shuttingDown) return Promise.resolve({ ok: false, message: "State Flow is shutting down" });
+		if (mode === "off") return selectOff(ctx, scopes);
+		// The native choice is DATA, never a private/fork acquisition or a fence reset.
+		appendNativeMarker({ mode, scopes }, ctx);
+		if (mode === "active") {
+			// A different selection revokes old-scope persistence, not an independent same-scope Stop.
+			inactivePersistence.cancel();
+			return startStateFlow(ctx, true);
+		}
+		const sameSession = sessionIdentity(ctx);
+		const restoring = restoreActiveBranch(ctx, undefined, true, undefined, "passive");
+		const signal = branchRestoration.current?.controller.signal;
+		return restoring.then(() => {
+			if (signal?.aborted || !sameSession() || !sameJson(scopes, nativeScopeSelection(ctx)) || snapshot.config.mode !== "passive") {
+				return { ok: false, message: "State Flow mode change was superseded" };
+			}
+			return { ok: snapshot.meta.validation?.attempt !== 0, message: snapshot.meta.validation?.error ?? "State Flow passive" };
+		});
 	}
 
 	for (const mode of ["active", "passive", "off"] as const) {
 		pi.registerCommand(`state-flow-${mode}`, {
-			description: MODE_COMMAND_DESCRIPTIONS[mode],
-			handler: async (_args, ctx) => {
-				await selectMode(ctx, mode);
+			description: `${MODE_COMMAND_DESCRIPTIONS[mode]} [global cwd session]`,
+			getArgumentCompletions: prefix => {
+				const values = scopeSelectionArgumentCompletions(prefix);
+				return values.length ? values.map(value => ({ value, label: value })) : null;
+			},
+			handler: async (args, ctx) => {
+				const scopes = parseScopeSelectionArguments(args);
+				await selectMode(ctx, mode, scopes);
 			},
 		});
 	}
@@ -1033,30 +1428,37 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		if (restoring?.awaitingAcceptance) {
 			// Passive keeps independently owned restoration; Off withdraws it through selectOff.
 			applyInactiveMode(ctx, mode);
+			// A read-only observer may never write a checkpoint; retain the newer choice now.
+			if (branchPolicy(ctx).mode !== mode) appendNativeMarker({ mode }, ctx);
 			return Promise.resolve({ ok: true, message: `State Flow ${mode}; memory restoration continues` });
 		}
 		if (snapshot.config.mode === mode) {
-			const retained = selectRetainedCheckpoint(discoverSnapshotData(ctx.sessionManager.getBranch()).candidates, config.inactiveMode);
-			const recordedMode = retained.kind === "pre-runtime" ? retained.mode : retained.kind === "boundary" ? retained.checkpoint.mode : undefined;
+			const recordedMode = branchPolicy(ctx).mode;
 			if (!passiveRecoveryNeeded(mode) && (modePersistenceError || recordedMode === mode)) return Promise.resolve({ ok: true, message: `State Flow is already ${mode}` });
 		}
 		inactivePersistence.cancel();
 		const pending = inactivePersistence.claim({ controller: new AbortController() });
-		return inactivePersistence.track(pending, deferredBranch && mode === "passive" && !branchStartsWithoutRuntime
+		return inactivePersistence.track(pending, deferredBranch && mode === "passive"
 			? acquirePassiveMode(ctx, pending, deferredBranch.reason)
 			: persistInactiveMode(ctx, pending, mode));
 	}
 
 	/** Off owns cancellation and native policy only; no canonical transaction or semantic handoff. */
-	function selectOff(ctx: ExtensionContext): Promise<StateFlowTelegramControlResult> {
+	function selectOff(ctx: ExtensionContext, scopes?: ScopeSelection): Promise<StateFlowTelegramControlResult> {
 		const address = sessionAddress(ctx);
 		const owner = ctx.sessionManager.getSessionId();
 		const branch = ctx.sessionManager.getBranch();
 		const selected = runtime;
 		const sameOwner = selected?.sessionKey === address.key && selected.cwd === ctx.cwd;
-		const forkRecorded = hasPendingFork(branch, owner, PASSIVE_STOP_ENTRY_TYPE);
-		const pendingFork = forkRecorded || (sameOwner && forkInitialization) || (deferredBranch?.owner === address.key && deferredBranch.cwd === ctx.cwd && deferredBranch.reason === "fork");
-		const policy = findBranchPolicy(branch, owner, PASSIVE_STOP_ENTRY_TYPE, config.inactiveMode);
+		let policy: ReturnType<typeof branchPolicy> | undefined;
+		try {
+			policy = branchPolicy(ctx, undefined, false);
+			requestPolicy.select({ cwd: ctx.cwd, owner, mode: snapshot.config.mode, scopes: scopes ?? policy.scopes });
+		}
+		catch { /* Explicit Off denies memory even when the prior policy cannot be admitted. */ }
+		const forkRecorded = policy?.forkPending ?? false;
+		const pendingFork = forkRecorded || (sameOwner && forkInitialization) || (deferredBranch?.owner === address.key && deferredBranch.cwd === ctx.cwd && deferredBranch.reason === "fork")
+			|| (!policy && typeof ctx.sessionManager.getHeader()?.parentSession === "string");
 		const sameDeferred = deferredBranch?.owner === address.key && deferredBranch.cwd === ctx.cwd;
 		const current = sameOwner || sameDeferred ? snapshot : emptySnapshot("off");
 		if (!sameOwner && !sameDeferred) modePersistenceError = policy?.persistenceError;
@@ -1069,10 +1471,10 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		const preserveContext = modePersistenceError !== undefined || (incoming ? incoming.preserveContext : current.meta.bootstrap === true || (unfinished && from === undefined));
 		const discovery = discoverSnapshotData(branch);
 		const preRuntime = (sameOwner && branchStartsWithoutRuntime) || (discovery.candidates.length === 0 && discovery.errors.length === 0);
-		let checkpoint: RetainedPiCheckpoint | undefined;
+		let checkpoint: ReturnType<TemporalRuntime["retainedSelectedCheckpoint"]> | undefined;
 		try {
-			checkpoint = !modePersistenceError && current.meta.validation?.attempt !== 0
-				? preRuntime ? preRuntimeCheckpoint("off") : sameOwner && selected?.view ? selected.retainedCheckpoint(deactivateEpisode(current, "off")) : undefined
+			checkpoint = !scopes && !modePersistenceError && current.meta.validation?.attempt !== 0
+				? sameOwner && selected?.selectedView() ? selected.retainedSelectedCheckpoint("off") : undefined
 				: undefined;
 		} catch {
 			// An unusable cached bookmark cannot prevent native Off policy or authorize replacement memory.
@@ -1081,6 +1483,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		branchRestoration.cancel();
 		inactivePersistence.cancel();
 		backup.cancel();
+		requestPolicy.invalidate();
 		memoryToolLifetime.renew();
 		clearRunTransient();
 		contextProjection.reset();
@@ -1094,13 +1497,15 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		forkInitialization = pendingFork;
 		deferredBranch = { owner: address.key, cwd: ctx.cwd, reason: pendingFork ? "fork" : undefined };
 		activeContext = ctx;
+		if (scopes) requestPolicy.select({ cwd: ctx.cwd, owner, mode: "off", scopes });
 		installScopeStates();
 		syncStateFlowTools();
 		updateUi(ctx);
 		try {
-			if (!alreadyOff || (pendingFork && !forkRecorded)) {
-				if (!checkpoint || !preRuntime || pendingFork || preserveContext || from !== undefined || modePersistenceError) pi.appendEntry(PASSIVE_STOP_ENTRY_TYPE, {
+			if (scopes || !alreadyOff || (pendingFork && !forkRecorded)) {
+				if (!checkpoint || !preRuntime || pendingFork || preserveContext || from !== undefined || modePersistenceError) appendNativeMarker({
 					owner, at, mode: "off", memoryDeferred: true,
+					...(scopes === undefined ? {} : { scopes }),
 					...(from === undefined ? {} : { from }),
 					...(preserveContext ? { preserveContext: true } : {}),
 					...(pendingFork ? { forkPending: true } : {}),
@@ -1128,6 +1533,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		let selected = runtime;
 		const owner = ctx.sessionManager.getSessionId();
 		const current = snapshot;
+		const wanted = captureScopeSelection(nativeScopeSelection(ctx));
 		const wasActive = current.config.mode === "active";
 		let unfinished = current.meta.specification !== undefined
 			|| (inferencePreparation.current?.prompt !== undefined && !inferencePreparation.current.accepted);
@@ -1161,7 +1567,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		if (modePersistenceError) {
 			// Writes stay paused; the native marker records only the newly selected inactive policy.
 			pending.published = true;
-			pi.appendEntry(PASSIVE_STOP_ENTRY_TYPE, {
+			appendNativeMarker({
 				at: passiveContinuation?.startedAt ?? stoppedAt,
 				...(passiveContinuation?.activeRunStartedAt === undefined ? {} : { from: passiveContinuation.activeRunStartedAt }),
 				preserveContext: true, owner, persistenceError: modePersistenceError, mode,
@@ -1176,12 +1582,13 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		const superseded = (): StateFlowTelegramControlResult => ({ ok: false, message: "State Flow mode change was superseded" });
 		const freezeHandoff = (): PassiveContinuation | undefined => {
 			contextProjection.reset();
-			const handoff = (wasActive || modePersistenceError) && selected?.view && current.meta.validation?.attempt !== 0
+			const handoff = (wasActive || modePersistenceError) && readableView(selected) && current.meta.validation?.attempt !== 0
 				? createPassiveContinuation(
 					projectModelState(effectiveState),
 					incomingBoundary?.startedAt ?? stoppedAt,
 					incomingBoundary ? incomingBoundary.activeRunStartedAt : !idle || unfinished ? anchor : undefined,
 					modePersistenceError !== undefined || (incomingBoundary ? incomingBoundary.preserveContext : current.meta.bootstrap === true || (unfinished && anchor === undefined)),
+					wanted,
 				)
 				: undefined;
 			// Repeated Passive choices keep the already selected continuation boundary.
@@ -1192,7 +1599,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 			pending.published = true;
 			const exitHandoff = freezeHandoff();
 			const selectedMode = snapshot.config.mode;
-			if (exitHandoff || modePersistenceError) pi.appendEntry(PASSIVE_STOP_ENTRY_TYPE, {
+			if (exitHandoff || modePersistenceError) appendNativeMarker({
 				at: exitHandoff?.startedAt ?? stoppedAt,
 				...(exitHandoff?.activeRunStartedAt === undefined ? {} : { from: exitHandoff.activeRunStartedAt }),
 				...(exitHandoff?.preserveContext || modePersistenceError ? { preserveContext: true } : {}),
@@ -1214,31 +1621,28 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 			bootstrapContinuation = undefined;
 			acquisition.clearInvalidations();
 			assertPublicationAvailable();
-			const signal = ctx.signal ? AbortSignal.any([pending.controller.signal, ctx.signal]) : pending.controller.signal;
-			if (branchStartsWithoutRuntime || !selected?.view) {
+			const signal = modeOperationSignal(ctx, pending.controller.signal);
+			if (branchStartsWithoutRuntime || !selected?.selectedView()) {
 				// A pre-runtime choice is native-only; Passive then loads shared memory without initializing storage.
 				const result = complete();
-				if (snapshot.config.mode !== "passive" || runtime?.view) return result;
+				if (snapshot.config.mode !== "passive" || readableView()) return result;
 				const passive = await loadPassiveView(ctx, signal, isCurrent, true);
-				if (passive && isCurrent() && !signal.aborted && !runtime?.view) {
+				if (passive && isCurrent() && !signal.aborted && !readableView()) {
 					runtime = selected = passive;
 					installScopeStates();
 					updateUi(ctx);
 				}
 				return isCurrent() ? result : superseded();
 			}
-			const result = await selected.withLifecycleTransaction((publish) => {
+			await selected.persistSelectedPassive(() => {
 				signal.throwIfAborted();
 				if (!isCurrent()) throw new Error("State Flow mode selection changed while awaiting publication");
 				assertPublicationAvailable();
-				const next = structuredClone(snapshot);
-				publish(next);
-				accepted = true;
-				snapshot = next;
-				installScopeStates();
-				recordPublication();
-				return complete();
 			}, signal);
+			accepted = true;
+			installScopeStates();
+			recordPublication();
+			const result = complete();
 			return isCurrent() ? result : superseded();
 		} catch (error) {
 			if (!isCurrent()) return superseded();
@@ -1260,6 +1664,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		port: {
 			snapshot: () => ({
 				mode: snapshot.config.mode,
+				scopes: captureScopeSelection(nativeScopeSelection()),
 				inferenceBlocked: isActiveRestorationBlocked(snapshot),
 				step: snapshot.meta.step,
 				revisions: scopeRevisions(),
@@ -1292,12 +1697,31 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	});
 	void telegram.ensure();
 
-	pi.on("before_agent_start", (event) => {
+	function invalidateModuleModelContext(ctx: ExtensionContext): void {
+		if (!shuttingDown && snapshot.config.mode !== "off" && currentNativeContextOwner(ctx) && moduleHost.captureIfBound()?.modules.length) requestPolicy.invalidate();
+	}
+
+	pi.on("model_select", (event, ctx) => { if (event.previousModel !== event.model) invalidateModuleModelContext(ctx); });
+	pi.on("thinking_level_select", (event, ctx) => { if (event.previousLevel !== event.level) invalidateModuleModelContext(ctx); });
+
+	// turn_start/context/message_end are transport-independent; provider HTTP hooks are optional.
+	pi.on("turn_start", (_event, ctx) => {
+		if (shuttingDown) return;
+		requestPolicy.select({ cwd: ctx.cwd, owner: ctx.sessionManager.getSessionId(), mode: snapshot.config.mode, scopes: nativeScopeSelection(ctx) });
+		const catalog = snapshot.config.mode === "off" ? undefined : moduleHost.captureIfBound();
+		const sameSession = sessionIdentity(ctx);
+		nativeRequests.begin(snapshot.config.mode === "off" ? undefined : requestPolicy.capture(), ctx.signal,
+			() => { catalog?.assertCurrent(); return sameSession(); },
+			catalog ? AbortSignal.any([requestPolicy.signal, catalog.signal]) : requestPolicy.signal);
+	});
+
+	pi.on("before_agent_start", (event, ctx) => {
+		if (shuttingDown || !currentNativeContextOwner(ctx)) return;
 		// Native run identity is independent of semantic enablement and survives mode toggles.
 		runAnchorTimestamp = undefined;
 		if (!isActive()) {
 			if (!passiveMemoryAvailable()) return;
-			(event.systemPromptOptions.sections ??= {}).state_flow = PASSIVE_MEMORY_PROTOCOL;
+			(event.systemPromptOptions.sections ??= {}).state_flow = passiveMemoryProtocol(nativeScopeSelection(ctx));
 			return;
 		}
 		contextProjection.reset();
@@ -1307,20 +1731,58 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		completedRunAccepted = false;
 		// This native hook has no operation signal. Capture only; the first active context owns acceptance.
 		deferInferencePreparation(event.prompt);
-		(event.systemPromptOptions.sections ??= {}).state_flow = stateFlowProtocol(snapshot.meta.bootstrap === true);
+		(event.systemPromptOptions.sections ??= {}).state_flow = stateFlowProtocol(snapshot.meta.bootstrap === true, nativeScopeSelection(ctx));
 	});
 
-	pi.on("context_with_system", (event) => {
+	/** Never abort a replacement native operation through an obsolete ambient context. */
+	function abortContext(ctx: ExtensionContext, operationSignal: AbortSignal | undefined): void {
+		if (operationSignal && ctx.signal === operationSignal && !operationSignal.aborted
+			&& (!nativeRequests.active || nativeRequests.ownsOperation(operationSignal))) {
+			if (nativeRequests.ownsOperation(operationSignal)) guardAbortedOperation = operationSignal;
+			ctx.abort();
+		}
+	}
+
+	function contextRequest(ctx: ExtensionContext): NativeContextRequest | undefined {
+		if (!ctx.signal || !nativeRequests.active) return undefined;
+		if (!nativeRequests.ownsOperation(ctx.signal)) throw new Error("State Flow context operation is no longer current");
+		return nativeRequests.preparing();
+	}
+
+	function contextRequestCurrent(request: NativeContextRequest | undefined, ctx: ExtensionContext, operationSignal: AbortSignal | undefined): boolean {
+		try { request?.revalidate(); return true; }
+		catch { abortContext(ctx, operationSignal); return false; }
+	}
+
+	/** The post-context membrane must not turn failed Active preparation into raw-history fallback. */
+	function providerContextCurrent(ctx: ExtensionContext): boolean {
+		const operationSignal = ctx.signal;
+		try {
+			const request = contextRequest(ctx);
+			request?.revalidate();
+			if (request && isActive() && inferencePreparation.current && !inferencePreparation.current.accepted) throw new Error("State Flow preparation was not accepted");
+			return true;
+		} catch { abortContext(ctx, operationSignal); return false; }
+	}
+
+	pi.on("context_with_system", (event, ctx) => {
+		if (shuttingDown || !currentNativeContextOwner(ctx) || !providerContextCurrent(ctx)) return;
 		// Off removes the owned section, including one contributed before an in-flight mode change.
-		const protocol = isActive() ? stateFlowProtocol(snapshot.meta.bootstrap === true)
-			: passiveMemoryAvailable() ? PASSIVE_MEMORY_PROTOCOL : undefined;
+		const protocol = isActive() ? stateFlowProtocol(snapshot.meta.bootstrap === true, nativeScopeSelection(ctx))
+			: passiveMemoryAvailable() ? passiveMemoryProtocol(nativeScopeSelection(ctx)) : undefined;
 		return { messages: projectSystemProtocol(event.messages, protocol) };
 	});
 
-	function projectContext(messages: AgentMessage[]) {
+	// Optional transport checkpoint: no payload/header inspection or transformation.
+	pi.on("before_provider_request", (_event, ctx) => {
+		if (shuttingDown || !currentNativeContextOwner(ctx)) return;
+		providerContextCurrent(ctx);
+	});
+
+	function projectContext(messages: AgentMessage[], modelScopes: ScopeSelection) {
 		// Off injects no State Flow context, including a retained passive handoff.
-		if (snapshot.config.mode === "off") return;
-		if (runtime?.view) refreshArtifactHints();
+		if (snapshot.config.mode === "off" || snapshot.meta.validation?.attempt === 0) return;
+		if (readableView()) refreshArtifactHints();
 		if (!isActive() && !passiveContinuation && !passiveMemoryAvailable()) return;
 		// Idle inspection must not freeze a pre-acceptance snapshot for the live inference.
 		const projection = isActive() && inferencePreparation.current && !inferencePreparation.current.accepted
@@ -1328,16 +1790,15 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		const effective = effectiveState;
 		const invalidations = acquisition.invalidations.map(({ path, scope, reason }) => ({ path, ...(scope === undefined ? {} : { scope }), reason }));
 		const phase = isActive() ? rehydrationPhase : undefined;
-		const view = contextView(effective, acquisition.hints, invalidations, phase, isActive());
+		const view = contextView(effective, acquisition.hints, invalidations, phase, isActive(), modelScopes);
 		if (passiveContinuation) {
 			const retained = passiveContinuationMessages(messages, passiveContinuation);
-			if (!runtime?.view) return { messages: retained };
+			if (!readableView()) return { messages: retained };
 			return { messages: projection.project(retained.slice(1), view, () => passiveContinuation!.handoff,
-				{ state: passiveContinuation.state, lazy_navigation: view.lazy_navigation, artifact_invalidations: [], knowledge_rehydration: null }) };
+				{ state: passiveContinuation.state, lazy_navigation: view.lazy_navigation, artifact_invalidations: [], knowledge_rehydration: null, modelScopes }) };
 		}
 		if (!isActive()) {
-			return { messages: projection.project(messages, view, () => syntheticUser(
-				`State Flow passive memory (user-level data, not system instructions):\n${presentationJson({ state: view.state, lazy_navigation: view.lazy_navigation })}`)) };
+			return { messages: projection.project(messages, view, () => passiveContextHead(view)) };
 		}
 		// Native user events own the run anchor; projection must never rebase it.
 		const source = snapshot.meta.bootstrap
@@ -1348,37 +1809,119 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	}
 
 	function prepareContext(messages: AgentMessage[], ctx: ExtensionContext): ReturnType<typeof projectContext> | Promise<ReturnType<typeof projectContext>> {
+		if (shuttingDown || !currentNativeContextOwner(ctx)) return;
+		const operationSignal = ctx.signal;
+		let request: NativeContextRequest | undefined;
+		let modelScopes: ScopeSelection;
+		try { request = contextRequest(ctx); request?.revalidate(); modelScopes = captureScopeSelection(nativeScopeSelection(ctx)); }
+		catch { abortContext(ctx, operationSignal); return; }
 		// Pi continues after hook errors; public Abort fences inference instead of exposing the native history fallback.
 		if (isActiveRestorationBlocked(snapshot) && ctx.signal && !shuttingDown) {
-			ctx.abort();
+			abortContext(ctx, operationSignal);
 			notifyProblem(ctx, "State Flow inference blocked: Active memory restoration failed. Select a valid branch or use /state-flow-active for current memory; /state-flow-passive or /state-flow-off explicitly permits native context.", "error");
 			return;
 		}
 		const pending = inferencePreparation.current;
 		const selected = runtime;
-		const operationSignal = ctx.signal;
-		// Idle projections remain observational; only a live native operation may await preparation.
-		if (!isActive() || !pending || !operationSignal || shuttingDown) return projectContext(messages);
-		pending.operation ??= prepareInference(pending, selected, ctx, operationSignal).finally(() => {
+		// Idle projections remain observational; accepted preparation is not replayed for another model turn.
+		if (!isActive() || !pending || pending.accepted || !operationSignal || shuttingDown) return projectContext(messages, modelScopes);
+		if (pending.operation && pending.request !== request) { abortContext(ctx, operationSignal); return; }
+		pending.request = request;
+		pending.operation ??= prepareInference(pending, selected, ctx, operationSignal, request, messages).finally(() => {
 			// A late withdrawal must not clear newer work; accepted lifecycle is never replayed after an error.
 			if (!pending.accepted && inferencePreparation.owns(pending)) pending.operation = undefined;
 		});
 		return pending.operation.then(() => {
-			if (shuttingDown || operationSignal.aborted || runtime !== selected || ctx.signal !== operationSignal) return;
+			if (!currentNativeContextOwner(ctx)) return;
+			if (!contextRequestCurrent(request, ctx, operationSignal)) return;
+			if (shuttingDown || operationSignal.aborted || runtime !== selected || ctx.signal !== operationSignal) {
+				if (request) abortContext(ctx, operationSignal);
+				return;
+			}
 			if (isActive() && !inferencePreparation.owns(pending)) {
 				// Start may require same-run maintenance. A new captured user prompt instead owns a different context request.
 				if (inferencePreparation.current?.prompt === undefined) return prepareContext(messages, ctx);
+				if (request) abortContext(ctx, operationSignal);
 				return;
 			}
-			if (isActive() && !pending.accepted) return;
-			return projectContext(messages);
+			if (isActive() && !pending.accepted) { if (request) abortContext(ctx, operationSignal); return; }
+			return projectContext(messages, modelScopes);
 		});
 	}
 
-	pi.on("context", (event, ctx) => prepareContext(event.messages as AgentMessage[], ctx));
+	async function capturePublicModules(messages: AgentMessage[], ctx: ExtensionContext, ownedSignal?: AbortSignal): Promise<PreparedPublicModules | undefined> {
+		if (snapshot.config.mode === "off" || !ctx.signal || !nativeRequests.active) return;
+		const selected = runtime, view = readableView(selected), catalog = moduleHost.captureIfBound();
+		if (!selected || !view || !catalog?.modules.length) return;
+		const receipt = requestPolicy.capture(), sameSession = sessionIdentity(ctx), model = ctx.model, request = contextRequest(ctx);
+		const operationSignal = ctx.signal, controller = new AbortController();
+		const signal = AbortSignal.any([operationSignal, receipt.signal, catalog.signal, controller.signal, ...(ownedSignal ? [ownedSignal] : []), ...(request ? [request.signal] : [])]);
+		const basis = selected.captureSelectedReadBasis();
+		const check = () => {
+			signal.throwIfAborted(); receipt.revalidate(); catalog.assertCurrent();
+			if (shuttingDown || runtime !== selected || ctx.signal !== operationSignal || ctx.model !== model || !sameSession() || !currentNativeContextOwner(ctx)) throw new Error("State Flow module context owner changed");
+		};
+		try {
+			check(); basis();
+			const wanted = captureScopeSelection(receipt.policy.scopes);
+			const source = wanted.includes("session") && view.selection.includes("session") ? moduleConversationSource(messages, runAnchorTimestamp) : { conversation: [] };
+			const jobs = wanted.flatMap(scope => {
+				if (!view.selection.includes(scope)) return [];
+				const state = selected.readView(0, scope);
+				return catalog.modules.flatMap(module => {
+					const descriptor = view.scopes[scope]?.modules?.[module.id];
+					if (descriptor && (descriptor.schemaVersion !== module.schemaVersion || descriptor.immutable !== module.immutable)) return [];
+					const content = state[module.id] as JsonObject | undefined;
+					const frame = { mode: receipt.policy.mode as "active" | "passive", scope, ...(scope === "session" ? source : { conversation: [] }) };
+					return [prepareModuleContext(module, content, frame, signal, check).then(prepared => ({ module, scope, content, descriptor, prepared }))];
+				});
+			});
+			const bindings = await Promise.all(jobs);
+			const assertCurrent = () => { check(); for (const item of bindings) item.prepared.assertCurrent(); };
+			const assertOriginal = () => { assertCurrent(); basis(); };
+			assertOriginal();
+			return { bindings, definitions: catalog.modules, conversation: source.conversation, assertCurrent, assertOriginal, cancel: () => controller.abort() };
+		} catch { controller.abort(); throw new Error("State Flow registered module input preparation failed"); }
+	}
+
+	async function preparePublicContext(messages: AgentMessage[], projected: ReturnType<typeof projectContext>, ctx: ExtensionContext) {
+		if (!projected || snapshot.config.mode === "off" || !ctx.signal || !nativeRequests.active) return projected;
+		const operationSignal = ctx.signal, sameSession = sessionIdentity(ctx), selected = runtime;
+		let batch: PreparedPublicModules | undefined;
+		try {
+			const pending = inferencePreparation.current, request = contextRequest(ctx);
+			const accepted = pending?.accepted && pending.request === request ? pending.modules : undefined;
+			batch = accepted ?? await capturePublicModules(messages, ctx);
+			if (!batch || !selected) return projected;
+			if (!accepted) batch.assertOriginal();
+			const current = batch, basis = accepted ? pending!.moduleAcceptance! : selected.captureSelectedReadBasis();
+			const assertCurrent = () => { current.assertCurrent(); basis(); };
+			assertCurrent();
+			const contributions: ScopedModuleContext[] = current.bindings.map(({ module, scope, prepared }) => ({ id: module.id, scope,
+				contributions: prepared.evaluate({ content: selected.readView(0, scope)[module.id] }) }));
+			const result = projectModuleContext(projected.messages, messages, current.conversation, contributions);
+			assertCurrent(); nativeRequests.bindPreparedContext(assertCurrent);
+			return { messages: result };
+		} catch {
+			batch?.cancel(); abortContext(ctx, operationSignal);
+			if (!shuttingDown && sameSession()) notifyProblem(ctx, "State Flow registered module context is unavailable; the current inference was aborted without changing module memory", "error");
+			return undefined;
+		}
+	}
+
+	pi.on("context", (event, ctx) => {
+		if (shuttingDown || !currentNativeContextOwner(ctx)) return;
+		const messages = event.messages as AgentMessage[];
+		const projected = prepareContext(messages, ctx);
+		if (snapshot.config.mode === "off" || !ctx.signal || !nativeRequests.active || !moduleHost.captureIfBound()?.modules.length) return projected;
+		return Promise.resolve(projected).then(result => preparePublicContext(messages, result, ctx));
+	});
 
-	pi.on("tool_execution_start", (event) => {
-		if (!isActive()) return;
+	pi.on("tool_execution_start", (event, ctx) => {
+		if (event.parentToolCallId) {
+			try { nativeRequests.nested(event.toolCallId, event.toolName, event.parentToolCallId); } catch { return; }
+		}
+		if (!isActive() || !currentNativeTool(event.toolCallId, event.toolName, ctx)) return;
 		// Pi emits this before tool_call. Keep the argument object as a fallback;
 		// tool_call replaces it with the mutable, post-preflight input reference.
 		skillReads.recordStart(event.toolCallId, event.toolName, event.args);
@@ -1386,7 +1929,17 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	});
 
 	pi.on("tool_call", (event, ctx) => {
-		if (!isActive()) return;
+		const owned = event.toolName === PATCH_STATE_TOOL_NAME || event.toolName === READ_STATE_TOOL_NAME;
+		if (event.parentToolCallId) {
+			if (event.toolName === PATCH_STATE_TOOL_NAME && isActive()) return { block: true, reason: "patch_state requires a direct native assistant barrier, not a nested call" };
+			try { nativeRequests.nested(event.toolCallId, event.toolName, event.parentToolCallId); }
+			catch { if (owned) return { block: true, reason: "State Flow tool batch has no current native request" }; }
+		}
+		if (owned) {
+			try { nativeRequests.check(event.toolCallId, event.toolName); }
+			catch { return { block: true, reason: "State Flow tool batch has no current native request" }; }
+		}
+		if (!isActive() || !currentNativeTool(event.toolCallId, event.toolName, ctx)) return;
 		const batch = findAssistantToolBatch(ctx.sessionManager, event.toolCallId);
 		const patchCalls = batch?.filter((name) => name === PATCH_STATE_TOOL_NAME).length ?? 0;
 		if (patchCalls > 0) {
@@ -1405,28 +1958,50 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 		artifactReads.recordCall(event.toolCallId, event.toolName, event.input);
 	});
 
-	pi.on("tool_execution_end", (event) => {
-		if (!isActive()) return;
+	pi.on("tool_execution_end", (event, ctx) => {
+		if (!isActive() || !currentNativeTool(event.toolCallId, event.toolName, ctx)) return;
 		skillReads.recordEnd(event.toolCallId, event.toolName, event.isError);
 		dropCurrentSkillReads();
 		artifactReads.recordEnd(event.toolCallId, event.toolName, event.isError);
 	});
 
-	pi.on("tool_result", (event) => {
-		if (!isActive()) return;
+	pi.on("tool_result", (event, ctx) => {
+		if (!isActive() || !currentNativeTool(event.toolCallId, event.toolName, ctx)) return;
 		const read = skillReads.recordResult(event.toolName, event.input, event.isError);
 		if (!read) return;
 		dropCurrentSkillReads();
-		const hint = skillAcquisitionHint(read);
+		const hint = skillAcquisitionHint(read, nativeScopeSelection(ctx));
 		if (!hint) return;
 		return { content: [...event.content, { type: "text", text: `\n${hint}` }] };
 	});
 
+	/** Native contributions and completions may not borrow another physical/native owner. */
+	function currentNativeContextOwner(ctx: ExtensionContext): boolean {
+		try {
+			const policy = requestPolicy.policy, selected = runtime;
+			return policy !== undefined && activeContext !== undefined && policy.owner === ctx.sessionManager.getSessionId()
+				&& policy.cwd === ctx.cwd && sessionAddress(activeContext).key === sessionAddress(ctx).key
+				&& (selected === undefined || selected.sessionId === policy.owner && selected.cwd === ctx.cwd && selected.sessionKey === sessionAddress(ctx).key)
+				&& (!ctx.signal || !nativeRequests.active || nativeRequests.ownsOperation(ctx.signal));
+		} catch { return false; }
+	}
+
 	pi.on("message_end", (event, ctx): any => {
+		if (shuttingDown || !currentNativeContextOwner(ctx)) return;
+		if (event.message.role === "assistant") nativeRequests.finalize((Array.isArray(event.message.content) ? event.message.content : [])
+			.filter(block => block.type === "toolCall").map(block => ({ id: block.id, name: block.name })));
 		// Observe actual user events even while disabled; Start/Stop cannot invent or erase them.
 		if (event.message.role === "user" && runAnchorTimestamp === undefined) runAnchorTimestamp = event.message.timestamp;
 		if (shuttingDown || !isActive()) return;
 		if (event.message.role !== "assistant") return;
+		let request: SelectedPolicyRequest;
+		try { request = ctx.signal || nativeRequests.active ? nativeRequests.current() : requestPolicy.capture(); } catch { return; }
+		const selected = runtime, sameSession = sessionIdentity(ctx), operationSignal = ctx.signal;
+		const revalidate = () => {
+			request.revalidate();
+			if (runtime !== selected || ctx.signal !== operationSignal || !sameSession() || !currentNativeContextOwner(ctx)) throw new Error("State Flow response selection owner changed");
+		};
+		try { revalidate(); } catch { return; }
 		responseReconciliation.cancel();
 		const message = event.message as unknown as { role: "assistant"; stopReason?: string; content?: unknown };
 		if (message.stopReason === "aborted" || assistantToolCallCount(message.content) > 0 || message.stopReason === "toolUse") return;
@@ -1434,34 +2009,42 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 			recordDiagnostic(`Assistant response ended with ${message.stopReason}`, "finalization", ctx, { content: message.content });
 			return;
 		}
-		responseReconciliation.claim({ controller: new AbortController() });
+		responseReconciliation.claim({ controller: new AbortController(), request, operationSignal, revalidate });
 	});
 
 	pi.on("turn_end", async (event, ctx) => {
-		if (shuttingDown) return;
+		if (shuttingDown || !currentNativeContextOwner(ctx)) return;
 		const pending = responseReconciliation.current;
+		if (pending && pending.operationSignal !== ctx.signal) return;
+		nativeRequests.end();
 		if (!isActive() || !pending) {
 			updateUi(ctx);
 			return;
 		}
-		const selected = runtime;
-		const signal = ctx.signal ? AbortSignal.any([pending.controller.signal, ctx.signal]) : pending.controller.signal;
+		const selected = runtime, sameSession = sessionIdentity(ctx);
+		const check = () => {
+			pending.revalidate();
+			if (ctx.signal !== pending.operationSignal || !sameSession() || !currentNativeContextOwner(ctx)) throw new Error("State Flow response completion owner changed");
+		};
+		const signal = AbortSignal.any([pending.controller.signal, ...(ctx.signal ? [ctx.signal] : []), pending.request.signal]);
 		let responseCommitted = false;
 		try {
+			check();
 			const response = finalizedAssistantResponse(event.message);
-			if (!selected?.view) throw new Error("Temporal State Flow runtime is unavailable; reload before publishing");
-			await selected.withPatchTransaction((transaction) => {
+			if (!selected?.selectedView()) throw new Error("Temporal StateFlow runtime is unavailable; reload before publishing");
+			await selected.withSelectedPatchTransaction((transaction) => {
 				signal.throwIfAborted();
+				check();
 				if (runtime !== selected || !responseReconciliation.owns(pending) || !isActive()) {
 					throw new Error("State Flow response selection changed while awaiting publication");
 				}
 				assertPublicationAvailable();
 				const wasBootstrap = snapshot.meta.bootstrap === true;
 				const nextSnapshot = structuredClone(snapshot);
-				const stage = stageScopedTransition(transaction.states, { transitions: [], response }, [], transaction.causalBasis);
+				const stage = stageSelectedScopedTransition(transaction, { transitions: [], response }, [], transaction.causalBasis);
 				completeRun(nextSnapshot);
-				let publication: RuntimePublication | undefined;
-				commitScopedTransition(nextSnapshot, transaction.states, stage, (accepted, next) => {
+				let publication: SelectedFilePublication | undefined;
+				commitSelectedTransition(nextSnapshot, transaction, stage, (accepted, next) => {
 					publication = transaction.publish(next, accepted);
 				}, transaction.causalBasis, { finalizeRun: true });
 				snapshot = nextSnapshot;
@@ -1476,10 +2059,14 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 				completedRunAccepted = !wasBootstrap;
 				backup.markTurnAccepted();
 				updateUi(ctx);
+			}, () => {
+				check();
+				if (runtime !== selected || !responseReconciliation.owns(pending) || !isActive()) throw new Error("State Flow response superseded");
 			}, signal);
 		} catch (error) {
 			// Superseded completion owns neither the new lifecycle nor its diagnostics/UI.
 			if (signal.aborted || runtime !== selected || !responseReconciliation.owns(pending)) return;
+			try { check(); } catch { return; }
 			const cause = diagnosticText(error);
 			recordDiagnostic(cause, "finalization", ctx);
 			notifyProblem(ctx, responseCommitted
@@ -1536,7 +2123,7 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 			return;
 		}
 		if (!completedRunAccepted || compactionRequests.stopped || !isActive() || snapshot.meta.bootstrap
-			|| compactionRequests.inFlight || !ctx.isIdle() || ctx.hasPendingMessages() || !runtime?.view
+			|| compactionRequests.inFlight || !ctx.isIdle() || ctx.hasPendingMessages() || !runtime?.selectedView()
 			|| !shouldRequestStateFlowCompaction(ctx.getContextUsage())) return;
 		completedRunAccepted = false;
 		const entries = ctx.sessionManager.buildContextEntries();
@@ -1557,6 +2144,16 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	pi.on("session_compact", () => { contextProjection.reset(); });
 
 	pi.on("session_start", async (event, ctx) => {
+		const sameSession = sessionIdentity(ctx);
+		moduleHost.bind(ctx.sessionManager, () => { if (!sameSession()) throw new Error("State Flow module host native owner changed"); });
+		const refreshModules = (force = false) => {
+			if (shuttingDown) return;
+			const catalog = moduleHost.captureIfBound();
+			if (!catalog || !sameSession()) return;
+			syncStateFlowTools(force || catalog.modules.length > 0);
+			catalog.signal.addEventListener("abort", () => refreshModules(true), { once: true });
+		};
+		refreshModules();
 		runAnchorTimestamp = undefined;
 		rehydrationPhase = event.reason === "resume" ? "resume-bootstrap" : "new-bootstrap";
 		await restoreActiveBranch(ctx, event.reason);
@@ -1568,6 +2165,9 @@ export default function stateFlowExtension(pi: ExtensionAPI, options: StateFlowE
 	});
 	pi.on("session_shutdown", async (_event, _ctx) => {
 		shuttingDown = true;
+		moduleHost.dispose();
+		requestPolicy.end();
+		nativeRequests.end();
 		memoryToolLifetime.end();
 		contextProjection.reset();
 		const restoring = branchRestoration.cancel();