@llblab/pi-kit 0.38.1 → 0.38.3

package/node_modules/@llblab/pi-state-flow/docs/scope-selection-contract.md

@@ -2,7 +2,9 @@
 
 ## Status and baseline
 
-**Native seven-selection integration is implemented through the existing selected runtime, with retained typed SDK regressions and held-exclusion cancellation/ABA witnesses; fresh integrated validation and independent authority/test-integrity reviews approve this bounded configured/captured integration. [Public mode-command scope overrides](#public-mode-command-scope-overrides) now compose the same owners and are accepted on fresh integrated validation plus independent authority/test-integrity review. The [M2 functional boundary](#m2-functional-acceptance-boundary) is now complete on deterministic SDK/control and legacy-proof evidence; M3 flat/schema and the remaining roadmap stay separate. No settings chooser is required.** On 2026-10-24 the owner lifted the M0-only restriction and requested roadmap implementation before live-model comparison. Use the recommended concrete-selection, private-acquisition, response-suppression and deferred-fork policies below as the starting design; settle exact representations in code and acceptance tests. Earlier review-gate language identifies proof obligations, not a blanket approval-only stop. Record evidence-based departures instead of silently weakening invariants. [BACKLOG.md](../BACKLOG.md#6-configurable-scope-selection) alone owns remaining work.
+**All seven nonempty selections and public command/completion controls shipped in 0.27.0.** The [M2 functional boundary](#m2-functional-acceptance-boundary) records bounded deterministic acceptance, including captured policy, private acquisition, Session-excluded response suppression, deferred forks and mode-only Telegram controls. The [flat model interface](single-scope-interface-contract.md) also shipped in 0.27.0; it does not change these scope/private authorities. No settings chooser is required. [BACKLOG.md](../BACKLOG.md) owns outstanding work.
+
+This document owns selected-scope policy and its authority boundaries; [usage](usage.md) owns operator syntax/configuration. The proposals, candidate gates and validation totals in implementation-checkpoint sections below are historical at their named M0/M2 source boundaries. Later retained integration superseded their all-three-only, pending-selector and deferred-copy implementation limits, not their preservation duties or original review verdicts. They are not current prerequisites.
 
 Source baseline: package 0.26.5, commit `4494fee9da8258cdf5f02c42672a0eb9866a512a`, matching repository-local Pi SDK 1.0.0. At that baseline `SnapshotConfig` contained only mode, while Session config and retained-checkpoint codecs rejected the proposed scopes field. The legacy mode-only reader can extract a mode while ignoring such a field; selected policy admission cannot reuse it as full validation. Current internal v2 admission and the aggregate-validated default-all-three bridge are described below.
 
@@ -18,7 +20,7 @@ This contract complements the [semantic handoff contract](semantic-handoff-contr
 - Off exposes neither memory tools nor State Flow context. Its automatic lifecycle remains canonically memory-inert, even if selection must be remembered.
 - Cancellation before acceptance installs no candidate. Cancellation after acceptance cannot undo accepted memory. Publication remains exact-cohort, lock/CAS guarded, and owned by the existing runtime/storage boundary.
 
-## Recommended operator policy
+## Current operator policy
 
 ### Parsing
 
@@ -30,7 +32,7 @@ Global configuration accepts a nonempty unique array under `scopes`; missing mea
 
 ### Default and branch precedence
 
-**Recommended design for D3:**
+**Implemented D3 policy:**
 
 1. A command with valid explicit scopes proposes that concrete selection for the current session branch.
 2. Without arguments, retain the already established branch/session selection, across mode changes and Off. A same-mode command with different scopes is not an “already active” no-op.
@@ -40,7 +42,7 @@ Global configuration accepts a nonempty unique array under `scopes`; missing mea
 6. A fork inherits its source branch's concrete policy into a fresh child owner. It is not an independent `/new` default, and it cannot share a mutable selection object with its parent.
 7. Canonical session config mirrors accepted lifecycle policy when memory-enabled acceptance is allowed. A newer owner-local native Off/deferred/failure marker overrides older canonical policy without becoming semantic authority.
 
-The selected D3 direction is concrete capture at the first upgraded/new native attachment, after validating branch policy and before canonical acquisition. It is not a permanent coupling to live global defaults. Native persistence, precedence and malformed-policy fencing still need their owning integration witnesses; the internal value tests below do not establish them.
+The selected D3 direction is concrete capture at the first upgraded/new native attachment, after validating branch policy and before canonical acquisition. It is not a permanent coupling to live global defaults. Native persistence, precedence and malformed-policy fencing have their retained integration witnesses below; the internal value tests alone do not establish them.
 
 ## Internal value boundary and lifecycle encoding direction
 
@@ -234,7 +236,7 @@ First private acquisition, parent-current fork copy and existing-current selecte
 
 The independent native origin grant and synchronous policy/memory checks remain mandatory. The author sees unpersisted candidate state, stages through the same selected compiler/ownership rules and commits origin, semantic replay and lifecycle in one publication; no empty persisted origin precedes validation. Rejected prepublication authoring installs no owner/cache; a later callback failure cannot undo an already accepted publication. A valid semantic no-op may accept the explicitly authorized origin/lifecycle, as on the prior Session route, but creates no semantic transition, step or revision. Shared-only acceptance remains unacquired with no Session semantic triple; known existing/private authority cannot be replaced by a new origin.
 
-New properties cover every selection × Active/Passive × retention 0/1/7/100, exact one runtime publication, values/revisions/causal window and excluded-file absence; invalid/no-op first calls, competing source-byte edits, rollback/retry, selection mutation during a held wait, cancellation before lock release and explicit-origin/known-authority refusal. The runtime-transactions family passes 26 tests (15 new top-level properties); full `npm run validate` passes **1174/1174**, build/typecheck/import/package125. Five compiled cases pass; the fifth proves lower-runtime first shared authoring without an intermediate lifecycle or private stream. This is lower-owner completeness, not native seven-selection activation. Independent review supported dispatch/atomicity but reproduced an inherited unused-publisher lifetime escape: after authoring rejected for no synchronous publication, a retained transaction could write under a later foreign lock. A negative-first regression now covers all seven selections × normal/exceptional callback exit. The storage-owned inner publisher checks its callback lifetime before planning and is revoked in `finally`; late stage/commit cannot write files, install cache or mark a stage committed. The compiled probe also refuses escaped shared/private publishers under a held lock. This is callback-scoped capability enforcement, not another engine or asynchronous acceptance API. The narrow follow-up independently passed 123 related owner tests and all five compiled cases, plus six direct lifetime/finality checks. It approved HIGH-1 closure, including exact ended-before-consumed ordering, ignored async continuations receiving no renewed authority and accepted publication surviving a later callback throw. The slice is accepted within those boundaries, not as whole-M2 delivery. Remaining native/public integration lives only in [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog); counts overlap and are not summed.
+New properties cover every selection × Active/Passive × retention 0/1/7/100, exact one runtime publication, values/revisions/causal window and excluded-file absence; invalid/no-op first calls, competing source-byte edits, rollback/retry, selection mutation during a held wait, cancellation before lock release and explicit-origin/known-authority refusal. The runtime-transactions family passes 26 tests (15 new top-level properties); full `npm run validate` passes **1174/1174**, build/typecheck/import/package125. Five compiled cases pass; the fifth proves lower-runtime first shared authoring without an intermediate lifecycle or private stream. This is lower-owner completeness, not native seven-selection activation. Independent review supported dispatch/atomicity but reproduced an inherited unused-publisher lifetime escape: after authoring rejected for no synchronous publication, a retained transaction could write under a later foreign lock. A negative-first regression now covers all seven selections × normal/exceptional callback exit. The storage-owned inner publisher checks its callback lifetime before planning and is revoked in `finally`; late stage/commit cannot write files, install cache or mark a stage committed. The compiled probe also refuses escaped shared/private publishers under a held lock. This is callback-scoped capability enforcement, not another engine or asynchronous acceptance API. The narrow follow-up independently passed 123 related owner tests and all five compiled cases, plus six direct lifetime/finality checks. It approved HIGH-1 closure, including exact ended-before-consumed ordering, ignored async continuations receiving no renewed authority and accepted publication surviving a later callback throw. The slice is accepted within those boundaries, not as whole-M2 delivery. Remaining native/public integration lives only in [BACKLOG.md](../BACKLOG.md); counts overlap and are not summed.
 
 ## Explicit first Session acquisition
 
@@ -260,7 +262,7 @@ The accepted child-owned discriminator survives cold selected loading; it is **n
 
 ## Selected parent-current private copy
 
-`TemporalRuntime.withSelectedForkCopyTransaction` now handles eager `fork-new` children and `fork-deferred` lifecycle-only children through the common selected-origin engine. The request must include Session and a distinct captured parent identity/key. The native adapter supplies an independent synchronous parent/policy check: **prepare** validates persisted direct-parent identity outside exclusion, while **recheck** only checks current in-memory native child/parent/policy ownership after waiting and immediately before publication. Recheck must not acquire external sources. A missing check, self identity/key, Off, changed native ownership or remembered acquired private state refuses. This port is not yet wired into `extension.ts`; a passed source value or a deferred discriminator is never itself native authority.
+`TemporalRuntime.withSelectedForkCopyTransaction` now handles eager `fork-new` children and `fork-deferred` lifecycle-only children through the common selected-origin engine. The request must include Session and a distinct captured parent identity/key. The native adapter supplies an independent synchronous parent/policy check: **prepare** validates persisted direct-parent identity outside exclusion, while **recheck** only checks current in-memory native child/parent/policy ownership after waiting and immediately before publication. Recheck must not acquire external sources. A missing check, self identity/key, Off, changed native ownership or remembered acquired private state refuses. At that internal checkpoint this port was not yet wired into `extension.ts`; later retained native integration superseded that activation limit. A passed source value or deferred discriminator is still never native authority.
 
 `StorageTransaction.copySelectedFork` binds parent-current canonical private authority under the same store mutex. It captures only the parent's config/runtime and Session checkpoint/tail/metadata plus regular-file presence. The parent must have acquired private memory under its physical CWD/session identity. Both supported legacy lifecycle v1 and explicit v2 work; missing/unacquired/deferred parent private state fails instead of supplying empty memory. Parent Session replay is checked against its own runtime lineage, independently of unrelated shared bodies. There is no ancestor recursion, directory discovery or older-boundary/Git lookup.
 
@@ -288,7 +290,7 @@ Replay publication and current-origin acceptance share one selected successor pl
 
 A strict witness exposed a gap beyond the original matrix: `Session → absent CWD current origin → Session` retained exact private bytes and acquired provenance but lost the private stream's runtime causal binding. The negative failed at `validateScopeLineage`; a second independently executable partition covers shared drift. Both now pass, including cold re-enable and another accepted private mutation/exclusion cycle. No validation or foreign-private fence is relaxed.
 
-The unreleased lifecycle-v2 runtime reserves optional `privateCausalBasis: {lineage, causalWitnesses}`. It carries only the last admitted private causal claims, never values, source locators, file hashes or acquisition permission. Snapshot owns closed syntax: every retained non-anchor step requires an actual witness skeleton; present malformed/extra-key/non-acquired claims reject, and any occurrence in v1 is a target-format collision. Absent is not empty/default proof. Unrelated opaque metadata remains preserved; legacy opaque `temporal` is never repurposed. An historical exact-shape JSON value cannot be distinguished from a cooperating declared field without an authenticated epoch; no writer-authentication claim is made. Reservation is justified by the still-unreleased v2 format, not a claim that arbitrary opaque collisions can be overwritten.
+At that pre-release checkpoint, lifecycle v2 reserved optional `privateCausalBasis: {lineage, causalWitnesses}`. It carries only the last admitted private causal claims, never values, source locators, file hashes or acquisition permission. Snapshot owns closed syntax: every retained non-anchor step requires an actual witness skeleton; present malformed/extra-key/non-acquired claims reject, and any occurrence in v1 is a target-format collision. Absent is not empty/default proof. Unrelated opaque metadata remains preserved; legacy opaque `temporal` is never repurposed. An historical exact-shape JSON value cannot be distinguished from a cooperating declared field without an authenticated epoch; no writer-authentication claim is made. Reservation was justified by the then-unreleased v2 format, not a claim that arbitrary opaque collisions can be overwritten.
 
 Before the first owned publication excludes acquired Session, the storage publisher retains the source lifecycle basis, not the requested view (which may already have a new shared-only origin). V2 needs its complete admitted witness skeleton; insufficient source evidence refuses before writes. An aligned legacy conversion may derive proof from its already-validated projection, but an unprovable legacy realignment refuses rather than inventing owners. Once Session is excluded, shared replay/folding/run acceptance carries the basis unchanged. Strictly mode-only Passive neither mints, repairs nor retires it. Excluding Session never opens or rewrites its bodies to construct proof; acquired presence remains mandatory.
 
@@ -296,7 +298,7 @@ When Session is re-enabled, actual private replay/witnesses must validate agains
 
 An older already-separated source without retained proof can re-enable only when its actual private stream still validates against current lineage. If that authority has already diverged, missing proof is not recoverable from presence, standalone parsing, Git or a native bookmark. This is conservative refusal, not universal repair. It creates no new API, private acquisition route, semantic format, history reconstruction or native subset activation.
 
-The new owner cohort passes 76 tests, including seven-by-seven policy round trips at retention 0/1/7/100 through existing current/acquisition ports, complete-proof refusal, foreign/lost/corrupt private cases, no excluded body opens/writes, proof refresh after private mutation, shared folding, mode-only byte stability, observation and parent copy. Fresh full validation passes **1159/1159**, build/typecheck/import/package125; compiled probes pass four cases, of which the last is a lower-runtime cold private round trip, not native seven-selection delivery. Independent format review approved the leaf after 44 tests and 18 direct syntax/provenance probes. The authority review passed 75 owner and 36 adjacent checks but reproduced a current-witness admission bypass in parent copy. Its correction moves current witness syntax and every Session-owner claim into the shared private admission helper; current acceptance and eager/deferred parent copy now reject the same null/false-owner evidence under active or retained source policies. An eight-partition negative-first witness and the compiled lower probe preserve parent/child bytes and caches on refusal. The narrow follow-up independently passed 76 owner, 36 adjacent, four compiled and four missing/sparse-current-witness compatibility partitions and approved HIGH-1 closure. Complete detached proof is still required; sparse current evidence can remain valid when selected patches themselves prove steps. Original dissent is retained as evidence, not waived by green counts. Counts overlap and are not summed. The private-reselection slice is accepted within these boundaries; remaining native/public work lives only in [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog).
+The new owner cohort passes 76 tests, including seven-by-seven policy round trips at retention 0/1/7/100 through existing current/acquisition ports, complete-proof refusal, foreign/lost/corrupt private cases, no excluded body opens/writes, proof refresh after private mutation, shared folding, mode-only byte stability, observation and parent copy. Fresh full validation passes **1159/1159**, build/typecheck/import/package125; compiled probes pass four cases, of which the last is a lower-runtime cold private round trip, not native seven-selection delivery. Independent format review approved the leaf after 44 tests and 18 direct syntax/provenance probes. The authority review passed 75 owner and 36 adjacent checks but reproduced a current-witness admission bypass in parent copy. Its correction moves current witness syntax and every Session-owner claim into the shared private admission helper; current acceptance and eager/deferred parent copy now reject the same null/false-owner evidence under active or retained source policies. An eight-partition negative-first witness and the compiled lower probe preserve parent/child bytes and caches on refusal. The narrow follow-up independently passed 76 owner, 36 adjacent, four compiled and four missing/sparse-current-witness compatibility partitions and approved HIGH-1 closure. Complete detached proof is still required; sparse current evidence can remain valid when selected patches themselves prove steps. Original dissent is retained as evidence, not waived by green counts. Counts overlap and are not summed. The private-reselection slice is accepted within these boundaries; remaining native/public work lives only in [BACKLOG.md](../BACKLOG.md).
 
 ## Accepted selected runtime cache and reads
 
@@ -372,7 +374,7 @@ While selected attachment is pending, local memory authoring rejects before stor
 
 Legacy Stop compatibility retains the prior reader's treatment of an invalid optional `from` anchor as absent while preserving a valid `at` cutoff. This narrow translation does not relax lifecycle-v2/native-v2 anchors, malformed selections or epoch admission. The pure policy family covers owned/unowned markers over all seven selections, alongside the native reload/cutoff witness.
 
-The native-composition group in `tests/extension.test.ts` and the direct first-authoring contract in `tests/runtime.test.ts` cover atomic first authoring, exact CAS/rollback, unavailable-private refusal, current-memory attachment, policy/fork boundaries, explicit-Start run reset and a later Passive/Off origin-publication boundary. Negative witnesses reproduced the missing Active fence, empty boundary-less fork, stale prompt and legacy cutoff failure before correction. The original N1c composition family had 12 tests; the combined native/query/policy/fixture cohort passed 338/338, and the secondary five-file fixture family passed 72/72. The N1c full `npm run validate` passed build/typecheck, **1112/1112 tests with zero failures/cancellations**, compiled import and the 125-file dry-run package check. The SDK migration preserved response/private-proof assertions; the false bootstrap/compiled-history cases and known registration-removal SDK witnesses now pass. The earlier owner review approved its lifecycle slice after 93 checks. A later independent SDK/provenance review passed 122 checks but reproduced two raw-evidence losses. Their corrections, including an explicit-empty follow-up, are independently verified. The last ten aggregate failures were adjudicated without production changes: seven SDK cases asserted obsolete policy/checkpoint shapes, one SDK case incorrectly expected stale shared model-cache exposure through required-private failure, and two runtime cases used a pre-native reload API or obsolete Off marker. Exact owner-bound policy records remain distinct from accepted semantic boundaries; failed private proof blocks all model reads/provider fallback, refusal preserves bytes, and explicit repair changes only permitted bootstrap lifecycle. Sparse selected reload remains read-only, not accepted publication authority. Independent final review reran all eight SDK and two runtime cases and approved this bounded test-integrity closure. Counts overlap the aggregate and are not summed. Remaining work and ownership live only in [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog). The separately completed compiled SDK/faux probe installs only the compiled factory (the source factory is disabled), with isolated roots and explicit in-memory fake credentials/provider. It proves default-all-three Off inertness, Passive observation without acquisition, first authoring, accepted answers, bootstrap expiry/provider-history suppression, current-memory resume and stale owned-patch refusal after in-flight mode ABA. Both probe cases pass and were independently rerun; this is not public-subset or live-model evidence. No working-store rollout or live-model result follows from this bridge.
+The native-composition group in `tests/extension.test.ts` and the direct first-authoring contract in `tests/runtime.test.ts` cover atomic first authoring, exact CAS/rollback, unavailable-private refusal, current-memory attachment, policy/fork boundaries, explicit-Start run reset and a later Passive/Off origin-publication boundary. Negative witnesses reproduced the missing Active fence, empty boundary-less fork, stale prompt and legacy cutoff failure before correction. The original N1c composition family had 12 tests; the combined native/query/policy/fixture cohort passed 338/338, and the secondary five-file fixture family passed 72/72. The N1c full `npm run validate` passed build/typecheck, **1112/1112 tests with zero failures/cancellations**, compiled import and the 125-file dry-run package check. The SDK migration preserved response/private-proof assertions; the false bootstrap/compiled-history cases and known registration-removal SDK witnesses now pass. The earlier owner review approved its lifecycle slice after 93 checks. A later independent SDK/provenance review passed 122 checks but reproduced two raw-evidence losses. Their corrections, including an explicit-empty follow-up, are independently verified. The last ten aggregate failures were adjudicated without production changes: seven SDK cases asserted obsolete policy/checkpoint shapes, one SDK case incorrectly expected stale shared model-cache exposure through required-private failure, and two runtime cases used a pre-native reload API or obsolete Off marker. Exact owner-bound policy records remain distinct from accepted semantic boundaries; failed private proof blocks all model reads/provider fallback, refusal preserves bytes, and explicit repair changes only permitted bootstrap lifecycle. Sparse selected reload remains read-only, not accepted publication authority. Independent final review reran all eight SDK and two runtime cases and approved this bounded test-integrity closure. Counts overlap the aggregate and are not summed. Remaining work and ownership live only in [BACKLOG.md](../BACKLOG.md). The separately completed compiled SDK/faux probe installs only the compiled factory (the source factory is disabled), with isolated roots and explicit in-memory fake credentials/provider. It proves default-all-three Off inertness, Passive observation without acquisition, first authoring, accepted answers, bootstrap expiry/provider-history suppression, current-memory resume and stale owned-patch refusal after in-flight mode ABA. Both probe cases pass and were independently rerun; this is not public-subset or live-model evidence. No working-store rollout or live-model result follows from this bridge.
 
 ## Configured scope defaults and native capture
 
@@ -382,7 +384,7 @@ The native resolver and policy-lifetime fallback now use these loaded scopes, no
 
 An existing registration retains its loaded defaults until reload. Recorded branches retain their scopes over reload/resume, later global edits and mode-only Off/Start; a fresh independent owner after reload samples the new default. Off forks inherit their source's concrete scopes into a detached child-owned pending record, not the child's later global default, and cold Off resume preserves that pending choice without parent-header reads. No native subset memory activation or public scope-selection controls are installed: the existing enabled non-default guard remains before canonical acceptance. Active denial stays inference-blocked; unavailable Passive does not acquire a memory view merely because its tools are declared.
 
-During integration, after config data admission but before native binding, negative witnesses reproduced configured CWD being replaced with all three (including unintended all-three auto-start). Binding the loaded default and capturing before the separate activation guard closes that integration gap. Independent review approves this bounded DATA/capture slice and separately reran the 84 owner checks and all three compiled cases. The owner cohort passes 84 checks: config permutations/malformed fields, 33 new native policy-capture/legacy/gated/Off-fork witnesses, existing composition and selected-policy/Off families. Fresh full `npm run validate` passes **1148/1148**, build/typecheck/import and package125. The separate compiled SDK/faux probe passes three cases, including a persisted same-physical-owner Off policy/resume versus later all-three defaults and refusal of a widening mode-only Start. The probe persists an ordinary native answer before reopening Pi's lazily written session file; it does not fabricate a semantic boundary. These counts overlap and are not summed. This is data/capture preparation, not public seven-selection acceptance, live-model quality or working-store rollout. Remaining work and review ownership live only in [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog).
+During integration, after config data admission but before native binding, negative witnesses reproduced configured CWD being replaced with all three (including unintended all-three auto-start). Binding the loaded default and capturing before the separate activation guard closes that integration gap. Independent review approves this bounded DATA/capture slice and separately reran the 84 owner checks and all three compiled cases. The owner cohort passes 84 checks: config permutations/malformed fields, 33 new native policy-capture/legacy/gated/Off-fork witnesses, existing composition and selected-policy/Off families. Fresh full `npm run validate` passes **1148/1148**, build/typecheck/import and package125. The separate compiled SDK/faux probe passes three cases, including a persisted same-physical-owner Off policy/resume versus later all-three defaults and refusal of a widening mode-only Start. The probe persists an ordinary native answer before reopening Pi's lazily written session file; it does not fabricate a semantic boundary. These counts overlap and are not summed. This is data/capture preparation, not public seven-selection acceptance, live-model quality or working-store rollout. Remaining work and review ownership live only in [BACKLOG.md](../BACKLOG.md).
 
 ## Guarded nonfork native selection binding
 
@@ -392,7 +394,7 @@ Pre-runtime Passive and its read-only loader derive only the selected shared sub
 
 **Preparation boundary:** The enabled non-default guard and scope-command refusal are unchanged. Fork attachment now has the separately reviewed canonical-deferred disposition below, but fresh shared-only native creation is prepared below but remains unexecuted behind the subset guard; selected facility/response/handoff completion and the whole native matrix remain required before enabling subsets. The Session-only Passive branch is prepared code behind that guard, not a claim of native Session-only execution. Explicit Off operator inspection remains a separately requested disposable reader, not model participation or origin authority.
 
-A negative native test showed explicit Start previously skipped the common first-authoring port; it now observes exactly one call with captured scopes, no pre-existing lifecycle/cache, one genuine origin and one accepted native checkpoint. The old Telegram failure-injection target changed from private acquisition to this actual port; its same completed-failure/menu-revocation assertions still pass. Fresh full validation passes **1175/1175**, typecheck/build/import/package125; six compiled cases pass, including real SDK explicit Start through the compiled common port exactly once. The focused five-family owner run passes 112 tests. Counts overlap and are not summed; this does not expand the supported enabled selection beyond all three. Independent review reran 189 native/config/context/Telegram checks and all six compiled cases and approved this bounded preparation only. Scope A→B→A must invalidate owning restoration/activation/observation work before public selection is enabled; value equality is not that proof, and a full mode-bound receipt must not cancel the separately permitted latest Passive choice. Remaining work ownership lives only in [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog).
+A negative native test showed explicit Start previously skipped the common first-authoring port; it now observes exactly one call with captured scopes, no pre-existing lifecycle/cache, one genuine origin and one accepted native checkpoint. The old Telegram failure-injection target changed from private acquisition to this actual port; its same completed-failure/menu-revocation assertions still pass. Fresh full validation passes **1175/1175**, typecheck/build/import/package125; six compiled cases pass, including real SDK explicit Start through the compiled common port exactly once. The focused five-family owner run passes 112 tests. Counts overlap and are not summed; this does not expand the supported enabled selection beyond all three. Independent review reran 189 native/config/context/Telegram checks and all six compiled cases and approved this bounded preparation only. Scope A→B→A must invalidate owning restoration/activation/observation work before public selection is enabled; value equality is not that proof, and a full mode-bound receipt must not cancel the separately permitted latest Passive choice. Remaining work ownership lives only in [BACKLOG.md](../BACKLOG.md).
 
 ## Canonical fork disposition before native copy
 
@@ -409,7 +411,7 @@ Copy publication uses the already existing single-use origin author callback to
 
 The reproduced native all-three/canonical-deferred case previously failed with `Session requires explicit private acquisition` after boolean presence chose ordinary current acceptance. It now copies parent-current data while retaining child step 3/shared run fields. A counterfactual fixed-snapshot author failed newer-Passive retention (`active != passive`); sampling mode at the existing author boundary closes that race without a new engine/API. Added fixtures cover header-only 7×7 stored/requested selections, detachment/no cache/no migration, missing/deferred/malformed source, sticky private loss, cancelable/stale waits before header IO, native deferred acquisition/Passive/Off/reset failure/cold no-recopy, and unacquired refusal.
 
-Fresh aggregate **1182/1182**, affected seven-family owner **121/121**, and compiled **7/7** pass; counts overlap. The compiled suite has five native SDK cases (one with an explicitly lower-runtime seeded canonical deferred child) and two lower-runtime cases. The seeded case observes preserved fields at genuine copy publication, then verifies intentional explicit-Start specification clearing. It does **not** demonstrate native Session-excluded fork creation or public seven-selection delivery. Independent review approved this bounded all-three/deferred closure after 164 affected checks and the same seven compiled cases; no source change was requested. Scope-ABA ownership, fresh shared-only deferral, automatic/first-mutation unacquired composition, facility/response composition and full native matrix remain gated work in [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog).
+Fresh aggregate **1182/1182**, affected seven-family owner **121/121**, and compiled **7/7** pass; counts overlap. The compiled suite has five native SDK cases (one with an explicitly lower-runtime seeded canonical deferred child) and two lower-runtime cases. The seeded case observes preserved fields at genuine copy publication, then verifies intentional explicit-Start specification clearing. It does **not** demonstrate native Session-excluded fork creation or public seven-selection delivery. Independent review approved this bounded all-three/deferred closure after 164 affected checks and the same seven compiled cases; no source change was requested. Scope-ABA ownership, fresh shared-only deferral, automatic/first-mutation unacquired composition, facility/response composition and full native matrix remain gated work in [BACKLOG.md](../BACKLOG.md).
 
 ## Explicit native first-Session activation
 
@@ -423,7 +425,7 @@ Deferred/fork-pending state is never independent empty-Session permission; canon
 
 New regressions cover three prior shared selections, policy/port identity and single genuine checkpoint, passive run-field reset versus preserved source step, no dummy private history, Active resume refusal followed by explicit acceptance, newer Passive/Off, shared/run/header-loss CAS, deferred/pending/acquired-loss/future refusal, accepted-publication finality and same-owner private denial with both present and cleared caches. The original Start/source regression failed because ordinary current acceptance left Session unacquired. A counterfactual initial new-route implementation without remembered-private guards incorrectly accepted a rewritten unacquired source after live private acceptance; the new denial witnesses close that regression. Existing held-Stop/failing-Start/coalesced-Start tests remain unchanged and pass.
 
-Fresh full **1189/1189**, affected six-family **215/215**, and compiled **8/8** pass (overlapping counts). The compiled suite has six SDK cases, including two explicitly lower-seeded canonical fixtures, and two lower-runtime cases. The new actual SDK Start performs exactly one `unacquired` call, preserves source step 4, clears old run fields, creates Session at revision zero, and subsequently accepts a genuine original request/new answer without exposing the old repair/specification. Independent review approved this bounded slice after 103 source/lower cases, all 116 unchanged extension cases and the eight compiled cases, plus an uncounted cleared-cache/removed-header refusal challenge. No source change was requested. This does not establish native subset authoring/activation or fresh Session-excluded native fork creation. Automatic attachment permission, first-mutation/facility composition, scope-ABA and the coherent full matrix remain separately owned by [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog).
+Fresh full **1189/1189**, affected six-family **215/215**, and compiled **8/8** pass (overlapping counts). The compiled suite has six SDK cases, including two explicitly lower-seeded canonical fixtures, and two lower-runtime cases. The new actual SDK Start performs exactly one `unacquired` call, preserves source step 4, clears old run fields, creates Session at revision zero, and subsequently accepts a genuine original request/new answer without exposing the old repair/specification. Independent review approved this bounded slice after 103 source/lower cases, all 116 unchanged extension cases and the eight compiled cases, plus an uncounted cleared-cache/removed-header refusal challenge. No source change was requested. This does not establish native subset authoring/activation or fresh Session-excluded native fork creation. Automatic attachment permission, first-mutation/facility composition, scope-ABA and the coherent full matrix remain separately owned by [BACKLOG.md](../BACKLOG.md).
 
 ## Native first mutation over an unacquired source
 
@@ -435,7 +437,7 @@ An accepted cache stays on the ordinary current-patch route. Deferred/pending fo
 
 Regressions check an actual single private-metadata replacement (no empty intermediate publication), source run fields, three prior shared selections/no-ops, foreign physical context, malformed/deferred/pending denial, cancellation/equal-policy/ABA, semantic/run/header CAS, private knowledge with both accepted/cleared cache, and post-publication failure. The original `new` dispatch failed on existing lifecycle. A counterfactual stale native snapshot reset step to 1 instead of 5; a raw foreign context also originally borrowed policy until the physical-owner guard was added. Those guards are substantive source fixes, not fixture adjustments.
 
-Fresh full **1197/1197**, focused owner **119/119**, compiled **10/10** pass (overlap, not summed). Eight SDK cases include four explicitly lower-seeded canonical fixtures; two cases are lower-runtime only. New SDK coverage admits a genuine original Passive first patch, preserves an equal-policy request, does not persist the Passive ordinary answer as Session response, and reports the old tool as an error after mode ABA while preserving canonical bytes. Existing provider-input assertions remain; the new first-mutation probe checks native user input/absence of old specification-repair and verifies retained shared data after publication. That sequence introduced a source after Passive observation; it does **not** establish per-turn external-source refresh. The separately validated [pre-runtime Passive input boundary](#native-pre-runtime-passive-input-observation) below proves source visibility at mode entry/reload before mutation; the enabled-subset facility/input matrix remains separate. Independent review approved this bounded mutation slice after 258 affected native/lower cases, 39 lifetime/facility cases and the ten compiled cases. It explicitly confirmed that the pre-mutation Passive input limit is not a fixture waiver or full facility acceptance. No source change was requested. No new runtime API/format/backend or partial-scope activation was added. Remaining work is owned only by [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog).
+Fresh full **1197/1197**, focused owner **119/119**, compiled **10/10** pass (overlap, not summed). Eight SDK cases include four explicitly lower-seeded canonical fixtures; two cases are lower-runtime only. New SDK coverage admits a genuine original Passive first patch, preserves an equal-policy request, does not persist the Passive ordinary answer as Session response, and reports the old tool as an error after mode ABA while preserving canonical bytes. Existing provider-input assertions remain; the new first-mutation probe checks native user input/absence of old specification-repair and verifies retained shared data after publication. That sequence introduced a source after Passive observation; it does **not** establish per-turn external-source refresh. The separately validated [pre-runtime Passive input boundary](#native-pre-runtime-passive-input-observation) below proves source visibility at mode entry/reload before mutation; the enabled-subset facility/input matrix remains separate. Independent review approved this bounded mutation slice after 258 affected native/lower cases, 39 lifetime/facility cases and the ten compiled cases. It explicitly confirmed that the pre-mutation Passive input limit is not a fixture waiver or full facility acceptance. No source change was requested. No new runtime API/format/backend or partial-scope activation was added. Remaining work is owned only by [BACKLOG.md](../BACKLOG.md).
 
 ## Native pre-runtime Passive input observation
 
@@ -465,7 +467,7 @@ The native binding supplies the existing restoration-owner check and latest inde
 
 The original wrapper's pre-wait capture reproduced `active != passive` after a held lock. A new callback's reentrant Abort initially also escaped the publisher guard; the explicit post-sample signal check closes that reproduced edge. Tests cover all three shared selections × four windows × two modes, selected-only open paths, fresh lifecycle capture, initial/late refusal, canceled waits without sampling, single use/expired publishers and accepted-publication finality. A separately labeled DATA composition case uses an actual lower accepted checkpoint and child-owned native records to retain pending through current acceptance/Off/cold inspection; it is not native shared-subset execution.
 
-Fresh full **1203/1203**, focused five-family **112/112**, compiled **11/11** pass (overlapping counts). Eight SDK cases (four lower-seeded canonical fixtures) retain prior all-three/request proofs; three cases are lower-runtime only, including the new late-mode deferral/reentrant-abort case. That lower probe imports the existing compiled internal storage module for its peer lock, not a new package-root export. Independent review approved this preparation only after 122 affected checks and all eleven compiled cases; no source correction was requested. It explicitly excludes execution of the guarded native shared branch and zero-filesystem-activity promises for late rejection. Remaining lifetime/facility/native matrix work and activation gate are owned only by [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog).
+Fresh full **1203/1203**, focused five-family **112/112**, compiled **11/11** pass (overlapping counts). Eight SDK cases (four lower-seeded canonical fixtures) retain prior all-three/request proofs; three cases are lower-runtime only, including the new late-mode deferral/reentrant-abort case. That lower probe imports the existing compiled internal storage module for its peer lock, not a new package-root export. Independent review approved this preparation only after 122 affected checks and all eleven compiled cases; no source correction was requested. It explicitly excludes execution of the guarded native shared branch and zero-filesystem-activity promises for late rejection. Remaining lifetime/facility/native matrix work and activation gate are owned only by [BACKLOG.md](../BACKLOG.md).
 
 ## Native scope-only lifetime evidence and future control duty
 
@@ -479,7 +481,7 @@ A new compiled **public SDK** case persists native physical identity, stages exp
 
 Fresh full **1207/1207**, focused six-family **106/106**, and compiled **12/12** pass (overlapping counts). The compiled suite has nine SDK cases (four lower-seeded canonical fixtures) and three lower-runtime cases. This cohort changes tests/evidence only, no production source or publication format. Independent review approved the current-entrypoint/no-extra-primitive conclusion after 120 affected checks, all twelve compiled cases and typecheck, explicitly preserving the idle-host-versus-original-model and lock/known-file monitoring limits. No remediation was requested.
 
-**Future selector contract:** Equal canonical choice must remain a no-op. A different concrete choice must use the same owned native reselection/cancellation path (or prove equivalent withdrawal), never merely mutate a scopes array or rely on equality becoming true again. Explicit choice/acquisition permissions remain distinct from inspection and ordinary attachment. Direct public chooser behavior, enabled native seven-selection lifecycle/facility/response/input acceptance and final scope-change matrix remain gated; these proofs do not waive them. Remaining work is owned only by [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog).
+**Future selector contract:** Equal canonical choice must remain a no-op. A different concrete choice must use the same owned native reselection/cancellation path (or prove equivalent withdrawal), never merely mutate a scopes array or rely on equality becoming true again. Explicit choice/acquisition permissions remain distinct from inspection and ordinary attachment. Direct public chooser behavior, enabled native seven-selection lifecycle/facility/response/input acceptance and final scope-change matrix remain gated; these proofs do not waive them. Remaining work is owned only by [BACKLOG.md](../BACKLOG.md).
 
 ## Canonical continuation provenance inspection
 
@@ -495,7 +497,7 @@ Fork source capture now carries the exact admitted raw artifact-registry JSON pa
 
 An explicit empty inherited registry remains distinct from an absent one. The merger checks raw member presence before strict finite-JSON equality; it authors inherited `{}` rather than dropping it or comparing undefined as JSON. Eager/deferred × absent/explicit-empty cases reproduce and guard that boundary without changing global equality.
 
-The correction's final owner family passes 86 tests, including invalid recognized values over successor/first authoring, eager/deferred raw copy, subsequent child deletion, raw-only CAS, special keys, empty/absent presence, ordinary seven-selection × retention properties, no-op/Passive publication and rollback. The first correction review verified 89 cases and found the empty-registry boundary; the narrow follow-up independently passed 94 cases and approved its correction. Counts describe distinct, overlapping families and are not summed into an aggregate claim. Remaining review/integration work belongs only to [BACKLOG.md](../BACKLOG.md#12-ordered-implementation-backlog), not to a weakened preservation contract.
+The correction's final owner family passes 86 tests, including invalid recognized values over successor/first authoring, eager/deferred raw copy, subsequent child deletion, raw-only CAS, special keys, empty/absent presence, ordinary seven-selection × retention properties, no-op/Passive publication and rollback. The first correction review verified 89 cases and found the empty-registry boundary; the narrow follow-up independently passed 94 cases and approved its correction. Counts describe distinct, overlapping families and are not summed into an aggregate claim. Remaining review/integration work belongs only to [BACKLOG.md](../BACKLOG.md), not to a weakened preservation contract.
 
 ## Selected source-facility admission
 
@@ -693,11 +695,11 @@ Selection change revokes stale acquisition evidence. Later re-selection reacquir
 
 ## Fork policy and acquisition provenance
 
-**Open D6; recommended deferred policy:** If Session is excluded at child attachment, create only child lifecycle policy/authority and selected shared access. Keep a child-owned deferred-private-copy marker; do not read/copy parent semantic memory merely to provide excluded state. Off also defers parent-header/store acquisition under its existing contract.
+**Implemented D6 policy:** If Session is excluded at child attachment, create only child lifecycle policy/authority and selected shared access. Keep a child-owned deferred-private-copy marker; do not read/copy parent semantic memory merely to provide excluded state. Off also defers parent-header/store acquisition under its existing contract.
 
 On the first explicit Session acquisition, validate the direct parent source and copy its then-current private stream/provenance once into the child's absent semantic target. An already legitimate child config/runtime is not proof that semantic copying already happened. Require child-owned pending-copy evidence and exact source/target CAS; refusal for malformed/missing parent or occupied private semantics never becomes empty child memory.
 
-Current `prepareForkCandidate` refuses any occupied checkpoint, tail, metadata, config, or runtime file. Supporting an existing lifecycle-only child therefore requires a reviewed narrow admission path; simply removing that occupancy guard is unsafe. Bind the deferred source to native direct-parent evidence, validate physical identities at acquisition, and never guess another parent from a path shape. Retain the marker through reload until accepted copy; release/reset it only at the accepted child-owned boundary.
+At the original D6 proposal, `prepareForkCandidate` refused any occupied checkpoint, tail, metadata, config, or runtime file. The subsequent selected acquisition path admits the proven lifecycle-only child without removing the general occupancy guard; simply dropping that guard remains unsafe. Bind the deferred source to native direct-parent evidence, validate physical identities at acquisition, and never guess another parent from a path shape. Retain the marker through reload until accepted copy; release/reset it only at the accepted child-owned boundary.
 
 An acquired child always uses its own current private state afterward. New selection, tree navigation, or parent drift never triggers recopy. Do not infer unacquired status from temporary file disappearance. If the parent itself legitimately never acquired Session semantics, define the source failure explicitly rather than pretending the child inherited private memory.
 
@@ -734,7 +736,7 @@ The native seven-selection bridge, public scope controls and mode-only optional
 - **Lifecycle v1:** It has no accepted excluded-owner witness skeleton. Safe admission requires the complete three-owner semantic/provenance cohort plus config/runtime (the full 11-file proof) before projection. An excluded body's corruption can therefore reject v1 admission. Only owned acceptance with verified exact-byte backup can upgrade; excluded owners remain byte-identical. No selective parser pretends this legacy dependency disappeared.
 - **Lifecycle v2:** Only selected semantic bodies/provenance plus config/runtime are opened for ordinary selected admission. Acquired excluded Session still requires regular-file/path-chain presence of its private triple, not body reads; unacquired/deferred targets require absence. Retained private causal proof stays lifecycle metadata and cannot be invented by mode changes, observation or missing files.
 - **Explicit operator inspection:** Current Telegram buttons/help follow wanted participation, not sparse availability. Effective is offered only for2+ owners and reads only that selected overlay; selected shared-only inspection does not require excluded Session bodies. Session/current proof still fails closed, and lifecycle-v1 admission retains its complete-cohort dependency. Disposable Off reads publish/install nothing, clear no fence and grant no private acquisition. This is not automatic Off memory access or a confidentiality promise.
-- **Unsupported/foreign evidence:** Unknown epochs, malformed identity/selection/causal proof, old low-level writers without the supported fence and working-store migration are not repaired by this checkpoint. The [settled support policy](semantic-compatibility-decision.md#implementation-direction-and-reserved-names) retains legacy conversion/root reservations throughout State Flow0.x and ends that temporary window beginning1.0.0, with unsupported-version refusal retained. The prepared0.27.0 candidate removes/reuses no reserved root or converter; no transition plan, release or working-store operation is implied.
+- **Unsupported/foreign evidence:** Unknown epochs, malformed identity/selection/causal proof, old low-level writers without the supported fence and working-store migration are not repaired by this checkpoint. The [settled support policy](semantic-compatibility-decision.md#implementation-direction-and-reserved-names) retains legacy conversion/root reservations throughout State Flow0.x and ends that temporary window beginning1.0.0, with unsupported-version refusal retained. Released 0.27.0/0.27.1 and this consolidation retain the converter and retired-root reservations; no transition plan, release or working-store operation is implied.
 
 ### Current scope-aware presentation
 
@@ -788,7 +790,7 @@ The earlier candidate's exact-path/prototype/factory attribution limits still ap
 
 ## Native-seven SDK validation candidate
 
-Iteration52 exercises the coherent existing selected bridge on an **unreleased validation candidate**, replacing only the all-three-only native assertion with existing `captureScopeSelection` validation. There is no test-only subset switch, copied factory, lower-seeded canonical memory or second engine. This is not yet retained activation: the accepted all-three guard is restored before the candidate checkpoint ends. Public scope arguments/settings remain disabled. The exact candidate and scripts are retained separately for promotion and regression integration.
+**Historical iteration52 preparation, superseded by the retained native integration above.** The following candidate status, promotion gates and results belong to that checkpoint, not current release prerequisites. Iteration52 exercised the existing selected bridge on an **unreleased validation candidate**, replacing only the all-three-only native assertion with existing `captureScopeSelection` validation. There is no test-only subset switch, copied factory, lower-seeded canonical memory or second engine. This is not yet retained activation: the accepted all-three guard is restored before the candidate checkpoint ends. Public scope arguments/settings remain disabled. The exact candidate and scripts are retained separately for promotion and regression integration.
 
 Source and freshly built JS each pass **14 core**, **21 fork/private-copy** and **7 facility** actual-SDK scenarios (zero failure/cancellation/skip). Core covers all seven selections × Active/Passive, original-ID writes/queries/history/batch/keys/patches, rejection/no-op bytes, Session-only new responses, reload, scoped Stop/Passive heads, Off and captured-default/tree-current behavior. Fork covers all seven × Active/Passive plus six late Session-copy cases and one missing-parent-proof denial: shared-only children defer without State Flow parent-header/private-body reads, preserve pending facts through Off/reload, and later copy genuine parent-current private state; acquired child-current never recopies. Default-three header/private-read controls distinguish the zero-I/O cases. No recursive discovery or universal filesystem nonaccess claim follows.
 
@@ -798,7 +800,7 @@ Build/typecheck pass for the candidate, but a candidate-wide legacy suite attemp
 
 ## Evidence and review gates
 
-A synthetic in-memory baseline probe confirmed:
+**Historical M0.3 baseline evidence, not current codec behavior.** The later retained M2 integration and public command sections above discharge the implementation prerequisites recorded here. A synthetic in-memory baseline probe confirmed:
 
 - Session config with a scopes field and pre-runtime/retained checkpoints with a scopes field are rejected by today's strict codecs.
 - `readCheckpointMode({mode: "active", scopes: []})` nevertheless returns Active because it is mode-only extraction. A future complete policy reader must reject/quarantine malformed explicit selection instead of silently falling through to an all-scope default.
@@ -811,4 +813,4 @@ node --experimental-strip-types --test tests/config.test.ts tests/session.test.t
 
 Result: **54 passed, 0 failed** on the baseline above. This includes native scripted response-isolation witnesses, current mode/default/branch policy, operation ownership, acquisition, and rehydration. It does not certify seven selections, shared-only authority, deferred private copying, flat tools, or selection-owned cancellation; those remain future implementation acceptance.
 
-The remaining M0.3 work is the exact metadata/host-admission and selected-owner proof, not another general approval gate. D3's value/capture direction is selected, while wire-codec and native persistence proof remains open. D4–D6 require the named authority/response/fork witnesses; neither these recommendations nor the internal selection parser certify installed behavior. The canonical backlog alone owns those remaining cohorts.
+The original M0.3 handoff required exact metadata/host-admission and selected-owner proof, including D3 persistence and D4–D6 authority/response/fork witnesses. The later [M2 functional boundary](#m2-functional-acceptance-boundary) records their completion and explicit legacy dependencies. Neither this historical probe nor the internal selection parser alone certified installed behavior; deterministic SDK evidence still does not certify live-client compatibility. The canonical backlog owns remaining external validation, not completed M2 cohorts.

package/node_modules/@llblab/pi-state-flow/docs/semantic-compatibility-decision.md

@@ -2,7 +2,9 @@
 
 ## Status and scope
 
-**M1 target dialect and guarded migration locally implemented; not released or exercised on active stores.** On 2026-10-24 the owner requested the complete roadmap implementation and proposed a one-shot migration with temporary retired-name reservations. This supersedes the earlier approval-only stop, not the data-preservation proofs. [BACKLOG.md](../BACKLOG.md#11-compatibility-and-migration) owns remaining work. The [current compatibility guide](compatibility.md) describes retained runtime behavior; the [semantic handoff contract](semantic-handoff-contract.md) defines target meanings. No active store conversion is authorized by this document.
+**The Strategy/Tactics dialect and guarded migration shipped in 0.27.0 and remain supported in 0.27.1.** On 2026-10-24 the owner requested roadmap implementation and one-shot migration with temporary retired-name reservations, superseding the earlier approval-only stop, not preservation duties. This document owns semantic translation and support policy; [compatibility](compatibility.md) summarizes current admission and verified environments, and the [handoff contract](semantic-handoff-contract.md) owns semantic meaning. [BACKLOG.md](../BACKLOG.md) owns outstanding work. No active-store conversion is authorized here.
+
+Core-only streams use metadata v3; metadata v4 additionally retains external-module descriptors and opaque object roots under the [public module contract](public-module-contract.md). Both use the same Strategy/Tactics dialect. Historical M0/M1 evidence and recommendations below retain their original source boundary; later metadata v4 support does not rewrite their counts or retroactively enlarge their approvals.
 
 Evidence baseline: package 0.26.5, commit `4494fee9da8258cdf5f02c42672a0eb9866a512a`, matching repository-local Pi SDK 1.0.0. Only repository code and synthetic in-memory values were inspected. No active store, external consumer, or production session was inventoried or converted.
 
@@ -14,12 +16,12 @@ Evidence baseline: package 0.26.5, commit `4494fee9da8258cdf5f02c42672a0eb9866a5
 - **One-time and recoverable:** Produce a detached, collision-checked conversion candidate, translate recognized semantic references, validate all retained replay boundaries, and publish checkpoint/tail/metadata together using existing exclusion/CAS/rollback. The accepted target version makes repeat acquisition idempotent. Ordinary inspection and history reads do not become migration writes; source discovery alone grants no publication authority.
 - **Fail closed:** Reject coexisting old/new root names for explicit reconciliation, unsupported versions, malformed replay, partial evidence and occupied/conflicting destinations. Do not silently merge or destroy evidence. Already-recorded ownership cascades do not run a second time.
 - **Retirement insight:** Removing the temporary converter does not remove version admission. An unsupported old store must fail explicitly after retirement, not be reinterpreted as newly available user-defined planes.
-- **Settled support timing:** These are State Flow package versions. Throughout **0.x**, retain legacy `contract`/`working` conversion and reserve those retired owner-root names. Beginning **1.0.0**, that temporary legacy support and reservation window ends; explicit unsupported-version refusal remains. There is no separate **1.1** deadline. The prepared **0.27.0** candidate keeps its converter and reservations unchanged. This policy does not authorize immediate code removal, release, working-store conversion or automatic registration of new planes. Package release numbers are not persisted schema identifiers.
+- **Settled support timing:** These are State Flow package versions. Throughout **0.x**, retain legacy `contract`/`working` conversion and reserve those retired owner-root names. Beginning **1.0.0**, that temporary legacy support and reservation window ends; explicit unsupported-version refusal remains. There is no separate **1.1** deadline. Released **0.27.0/0.27.1** retain the converter and reservations; 0.27.2 consolidation preserves that policy. This policy does not authorize immediate code removal, release, working-store conversion or automatic registration of new planes. Package release numbers are not persisted schema identifiers.
 - **Operational boundary:** Version checks in this checkout cannot retrofit already-deployed old low-level callers. Upgrade/quiesce unsupported writers before converting shared cohorts; development only exercises temporary stores. No implicit active-store conversion, downgrade or release publication.
 
 ## Pure conversion boundary
 
-`lib/migration.ts` owns the temporary, side-effect-free conversion candidate. `prepareSemanticMigration` requires an explicit source metadata version: 1/2 translate to candidate version **3**, while an already-target v3 candidate is validated/detached without another conversion. V3 is the current canonical scope identifier, independent of State Flow package SemVer and Pi SDK versions; native readers normalize supported legacy input into this one target dialect. This module is not exported from the package root and grants no file/publication authority.
+`lib/migration.ts` owns the temporary, side-effect-free conversion candidate. `prepareSemanticMigration` requires an explicit supported source metadata version. Versions 1/2 translate to target **3**; already-target v3/v4 candidates are validated and detached without another semantic rename. Admitted retained-module descriptors select target **4**, including the guarded first external-root admission; v4 descriptors cannot be dropped or silently changed. These are scope-format identifiers, independent of package SemVer and Pi SDK versions; native readers expose one Strategy/Tactics dialect. This module is not exported from the package root and grants no file/publication authority.
 
 - Root `contract`/`working` become `strategy`/`tactics`; sparse absence, empty legacy branches, patch deletion markers, arrays, ordinary nested keys and opaque unknown root data remain intact. Any target root name in declared legacy data rejects, even without an old sibling. Target candidates reject retired roots in checkpoints and patches, including deletion attempts.
 - Recognized exact structured `$ref` locators and deliberate textual `$path` tokens translate only the plane position. Scope, historical selectors, array/range spelling and ownership classification remain unchanged. The query domain supplies shared selector syntax validation without target lookup. Unsupported/unparseable locators, unmarked prose and resource paths stay unchanged; no reference is hydrated or granted authority.
@@ -34,14 +36,14 @@ Evidence baseline: package 0.26.5, commit `4494fee9da8258cdf5f02c42672a0eb9866a5
 `prepareSerializedScopeMigration` takes captured byte arrays for **all three** checkpoint/tail/metadata files, the owner scope and, for CWD, its expected canonical identity. It decodes the declared version before semantic interpretation, preserves raw roots until collision checks, validates local replay, and returns target strings plus detached `basis` byte receipts with SHA-256 identities compatible with the existing CAS convention. Empty tail bytes are present evidence; a missing file or wholly absent cohort is not migration authority and rejects instead of fabricating a new store.
 
 - Source bytes are copied before interpretation. Strict UTF-8 decoding rejects invalid bytes rather than replacing them with the Unicode replacement character; JSON documents are not silently BOM-stripped. Tail blank-line handling remains compatible with the existing JSONL decoder. These receipts describe the caller-supplied bytes, not independently observed files or a publication capability.
-- Supported legacy versions 1/2 produce canonical target v3 strings. If legacy revision metadata is absent, credit only the retained tail count, matching existing legacy decoding; discarded revisions/history are not reconstructed. Target v3 requires an explicit revision.
-- An already-target v3 cohort validates and returns **byte-identical** target contents, including noncanonical whitespace and JSONL blank lines, rather than rewriting on every open. Native v3 readers admit this target directly; legacy reads return translated semantics without publishing.
+- Supported legacy versions 1/2 produce canonical target v3 strings unless the same authorized acceptance admits retained-module descriptors for v4. If legacy revision metadata is absent, credit only the retained tail count, matching existing legacy decoding; discarded revisions/history are not reconstructed. Target v3/v4 requires an explicit revision.
+- An already-target v3/v4 cohort without a requested descriptor update validates and returns **byte-identical** target contents, including noncanonical whitespace and JSONL blank lines, rather than rewriting on every open. Native readers admit both directly; legacy reads return translated semantics without publishing.
 - Metadata values change only at the declared format version and, when absent in legacy input, the inferred revision; legacy whitespace/property order may canonicalize. Preserve temporal boundaries, unknown siblings, extra temporal data, CWD owner, opaque identity/lineage/lifecycle values and original provenance registry data. Do not run the normal metadata serializer, which can remove legacy Session authority fields or normalize provenance. Uninterpretable provenance entries remain uninterpretable; preserving them is not new source-hash or compilation evidence.
 - CWD requires an explicit expected identity and an exact canonical owner match; non-CWD calls cannot borrow a CWD identity. Provenance registry framing is validated using its owning parser without substituting that parser's normalized output for raw evidence. Partial/malformed cohorts, unsupported versions, mismatched record counts, invalid replay and raw old/target collisions fail closed.
 
 The serialized tests require both preflight and the integrated native decoder to reject target-name collisions in declared legacy bytes; the baseline filtering defect is no longer accepted behavior. They also cover all incomplete-file subsets, exact-byte hashes/detachment, metadata/provenance preservation, legacy revision fallback, empty tails, byte-idempotent v3, UTF-8/BOM/finite-JSON boundaries and CWD identity admission.
 
-**Remaining integration boundary:** This function performs no I/O, backup, lock acquisition, CAS, rollback or cache installation. Local stream validation does not prove Session ownership or composed lineage: native header/config/runtime authority and regular-file/path evidence remain the existing lifecycle/storage owners' responsibility. Bind receipts to the exact owned paths, preserve complete backups of the converted owner cohorts and required owned lifecycle/config/runtime authority outside canonical authority, revalidate under exclusion and prove conflict/interruption refusal before publication. This does not authorize discovering unrelated projects/sessions or scanning the entire store. The integrated M1 runtime uses only `strategy`/`tactics` across types, ownership, tools, query, Skills and callbacks. A returned preflight candidate alone still grants no publication authority.
+**Publication responsibility, not unfinished conversion work:** This function performs no I/O, backup, lock acquisition, CAS, rollback or cache installation. Local stream validation does not prove Session ownership or composed lineage: native header/config/runtime authority and regular-file/path evidence remain the existing lifecycle/storage owners' responsibility. Bind receipts to the exact owned paths, preserve complete backups of the converted owner cohorts and required owned lifecycle/config/runtime authority outside canonical authority, revalidate under exclusion and prove conflict/interruption refusal before publication. This does not authorize discovering unrelated projects/sessions or scanning the entire store. The integrated M1 runtime uses only `strategy`/`tactics` across types, ownership, tools, query, Skills and callbacks. A returned preflight candidate alone still grants no publication authority.
 
 ## Guarded publication and support boundary
 
@@ -51,7 +53,7 @@ Before publishing a legacy-to-v3 update, storage creates and verifies `<parent>/
 
 The legacy-publication groups in `tests/runtime.test.ts` and `tests/storage.test.ts` prove observational legacy reads, converted history/revision equality, exact complete backup contents, opaque metadata preservation, one-time backup creation, backup failure, injected publication failure/retry, stale CAS refusal, cancellation while a foreign lock is still held, and private-identity/partial-cohort refusal. Semantic consumers require valid UTF-8, but opaque capture/rollback deliberately retains arbitrary original bytes. Direct string codecs reject lone UTF-16 surrogates before lossy UTF-8 encoding; escaped JSON values (including surrogate values) and valid Unicode pairs retain their exact meaning. A raw backup is evidence, not a fallback store or permission to overwrite later data.
 
-**Public API change:** Existing exported type/function names remain where applicable, but semantic fields, schemas, callbacks and read paths use only `strategy`/`tactics`. Old model/SDK root writes reject; no permanent aliases or old-field type views are added. Historical reads expose translated semantics, not original names. Scope versions 1/2 are migration inputs, version 3 is the target, and unknown versions fail closed. This is an unreleased breaking semantic API/storage change: upgrade/quiesce cooperating consumers before deploying it. Already-deployed unsafe low-level callers remain unsupported concurrent writers; no universal retrofit fence is claimed.
+**Public API change:** Existing exported type/function names remain where applicable, but semantic fields, schemas, callbacks and read paths use only `strategy`/`tactics`. Old model/SDK root writes reject; no permanent aliases or old-field type views are added. Historical reads expose translated semantics, not original names. Scope versions 1/2 are legacy migration inputs, v3 is the core-only target and v4 retains external descriptors under the same dialect. Unknown versions fail closed. This breaking semantic API/storage change shipped in 0.27.0: upgrade/quiesce cooperating consumers before deploying it. Already-deployed unsafe low-level callers remain unsupported concurrent writers; no universal retrofit fence is claimed.
 
 ### Source-bound M1 validation
 
@@ -71,7 +73,7 @@ The updated isolated SDK calibration completed **41 faux calls** (Native 11, Pas
 
 An index is still a causal offset, not a schema version or scope revision. Declaring translated history “exact” must never imply original field names remain readable, discarded history has returned, or the old JSON bytes are unchanged.
 
-**D1 implementation choice:** Ordinary target-dialect historical tools will promise translated representation. Original bytes remain recoverable from a separate complete backup, not a permanent original-name model API. This is a declared contract change, not a claim that renamed JSON is literally unchanged. Its replay/ref/collision proof remains required in M1.
+**D1 implementation choice:** Ordinary target-dialect historical tools will promise translated representation. Original bytes remain recoverable from a separate complete backup, not a permanent original-name model API. This is a declared contract change, not a claim that renamed JSON is literally unchanged. Its replay/ref/collision proof was subsequently supplied at the M1 checkpoint above; these preservation duties remain binding.
 
 ## Compared designs
 
@@ -145,7 +147,7 @@ These observations are not evidence that the installed extension emits or accept
 
 ### Current admission hardening
 
-Native `classifyScopeStream` (and therefore `parseScopeStream`/`loadScopeStream`) admits declared v1/v2/v3 before interpreting semantic fields. Legacy input translates before target validation; v3 retired roots reject. `serializeScopeMetadata` refuses unsupported/missing versions on nonempty input, emits v3 and preserves opaque temporal siblings. The provenance reader shares the same supported-version predicate. A semantic stream requires complete temporal evidence; empty metadata is not permission to synthesize history.
+Native `classifyScopeStream` (and therefore `parseScopeStream`/`loadScopeStream`) admits declared v1/v2/v3/v4 before interpreting semantic fields. Legacy input translates before target validation; target-format retired roots reject. `serializeScopeMetadata` refuses unsupported/missing versions on nonempty input, emits v3 without retained-module metadata or v4 with it, and preserves opaque temporal siblings and retained descriptors. The provenance reader shares the same supported-version predicate. A semantic stream requires complete temporal evidence; empty metadata is not permission to synthesize history.
 
 `tests/durable.test.ts` covers all three owners, supported versions, metadata siblings, invalid/future/missing versions, direct codec paths, serializer refusal and unchanged fixture bytes. An isolated baseline-source probe at `4494fee9da8258cdf5f02c42672a0eb9866a512a` additionally exercised real target v3 bytes on matching SDK 1.0.0: missing/empty provenance, unknown metadata siblings and sparse checkpoint state. The old low-level decoder admitted and filtered target fields, and its serializer would downgrade to v2. The complete old `refreshCurrentMemory`, `loadPassive` and `withStartTransaction` compositions all refused through provenance-version admission, before cache installation or publisher callback; canonical byte revisions remained unchanged. This proves those compositions, not every historical consumer. No live data or inference was used.
 
@@ -158,11 +160,11 @@ Native `classifyScopeStream` (and therefore `parseScopeStream`/`loadScopeStream`
 - Do not insert invalid old-plane sentinel values, materialized nulls, duplicated semantic aliases, or new hidden memory just to trip an older validator.
 - An owner-format fence must survive unknown metadata siblings, sparse state, absent provenance registries, and the first target write. Off, inspection and runtime-only mode persistence cannot convert. An accepted owned Start transaction can; a UI receipt or pure policy choice alone grants no publication authority.
 
-**Supported boundary:** Upgrade/quiesce all cooperating writers; unsafe low-level mixed-version clients are not supported. If a deployment requires coexistence with one, do not convert that store without a separately reviewed bridge/representation. Broad implementation authorization does not authorize exact-store rollout. Legacy conversion and retired-root reservations remain supported throughout State Flow 0.x; their temporary support window ends at State Flow 1.0.0, while explicit unsupported-version refusal remains. The prepared0.27.0 candidate keeps its converter/reservations unchanged; no immediate removal, release or working-store conversion is authorized.
+**Supported boundary:** Upgrade/quiesce all cooperating writers; unsafe low-level mixed-version clients are not supported. If a deployment requires coexistence with one, do not convert that store without a separately reviewed bridge/representation. Broad implementation authorization does not authorize exact-store rollout. Legacy conversion and retired-root reservations remain supported throughout State Flow 0.x; their temporary support window ends at State Flow 1.0.0, while explicit unsupported-version refusal remains. Released 0.27.0/0.27.1 retain their converter/reservations; no removal or working-store conversion is authorized by this consolidation.
 
 ## Public API impact inventory
 
-This is the local exported surface, not an inventory of external users. Absence of in-repository callers does not prove a public export has no consumers.
+This is the historical M0/M1 semantic-rename impact inventory, not a complete current export listing or an inventory of external users. The later published `./modules` entry is specified in the [public module contract](public-module-contract.md). Absence of in-repository callers does not prove a public export has no consumers.
 
 | Export group | Verified surface and impact |
 | --- | --- |
@@ -209,4 +211,4 @@ node --experimental-strip-types --test tests/durable.test.ts tests/snapshot.test
 
 Result on the source identity above: **34 passed, 0 failed**. Together with the synthetic admission probe, this supports the current evidence map. It does not prove target-version admission, migration, crash consistency, safe coexistence with arbitrary older clients, or a new public API.
 
-**Current status, superseding the original M0.2 gate:** M1's translated-history, supported-writer, target API and guarded publication decisions are implemented with the proof boundaries recorded above; the34-test paragraph is historical M0 baseline evidence, not their sole current validation. The owner settled temporary legacy conversion/reservations through State Flow0.x with a cutoff beginning1.0.0 and explicit unsupported-version refusal retained. The prepared0.27.0 candidate keeps its converter/reservations unchanged. No retirement-policy approval, transition plan or compatibility-removal task remains for this release; real-model evaluation is separately M0.4b in [BACKLOG](../BACKLOG.md#12-ordered-implementation-backlog). Writer quiescence, exact-cohort backup/private authority and separate authorization for release or working-store conversion remain mandatory.
+**Current status, superseding the original M0.2 gate:** M1's translated-history, supported-writer, target API and guarded publication decisions are implemented with the proof boundaries recorded above; the34-test paragraph is historical M0 baseline evidence, not their sole current validation. The owner settled temporary legacy conversion/reservations through State Flow0.x with a cutoff beginning1.0.0 and explicit unsupported-version refusal retained. Released 0.27.0/0.27.1 keep their converter/reservations; 0.27.2 preserves them. No retirement-policy approval, transition plan or compatibility-removal task remains for this release. Real-model evaluation remains separately gated in [BACKLOG](../BACKLOG.md#external-validation-and-evaluation). Writer quiescence, exact-cohort backup/private authority and separate authorization for release or working-store conversion remain mandatory.

package/node_modules/@llblab/pi-state-flow/docs/semantic-extensibility-decision.md

@@ -2,9 +2,9 @@
 
 ## Scope and accepted disposition
 
-The later explicit module request supplied additional manual, read-only, exact-window and asynchronous-producer requirements. The [internal semantic-module contract](semantic-module-contract.md) implements their bounded internal seam. The no-new-API decision below records the earlier M5 checkpoint, not a current prohibition; public loading, new stored planes, production archive/scheduler and sandbox/quality claims remain deferred.
+The later explicit module request supplied additional manual, read-only, exact-window and asynchronous-producer requirements. The [internal semantic-module contract](semantic-module-contract.md) implements their bounded internal seam. Further explicitly authorized work delivered the [public registration contract](public-module-contract.md), external roots and metadata v4 retention in 0.27.0. The no-new-API decision below records the earlier M5 checkpoint, not a current prohibition or a claim that the published API is absent. Dynamic loading, production archives/scheduling and sandbox/quality claims remain deferred. All M5 disposition and validation statements below retain their historical scope; the original review verdict is not approval of the later implementation.
 
-**M5 accepted decision: no NEW semantic-module API at that checkpoint; explicitly defer declarative manifests, module loading and executable invariant registration.** Retain existing internal functions and reviewed private protocol snippets. This is a demand/alternatives decision, not implementation of a module framework, a ban on future helpers, or a claim that there are no existing public APIs. Actual independent integrated review is **APPROVE — bounded no-new-semantic-module-API / explicit expansion-deferral decision**; its complete report was consumed after ROOT terminal before acceptance. [BACKLOG](../BACKLOG.md#12-ordered-implementation-backlog) alone owns remaining work.
+**M5 accepted decision: no NEW semantic-module API at that checkpoint; explicitly defer declarative manifests, module loading and executable invariant registration.** Retain existing internal functions and reviewed private protocol snippets. This is a demand/alternatives decision, not implementation of a module framework, a ban on future helpers, or a claim that there are no existing public APIs. Actual independent integrated review is **APPROVE — bounded no-new-semantic-module-API / explicit expansion-deferral decision**; its complete report was consumed after ROOT terminal before acceptance. [BACKLOG](../BACKLOG.md) alone owns remaining work.
 
 The accepted [M4 retain/defer decision](protocol-composition-decision.md) found no earned descriptor layer. M5 asks whether an actual caller or invariant needs a new contract despite that result. The bounded repository/design/task evidence below establishes useful existing functions but no currently unmet semantic-module requirement. It cannot establish that no external user anywhere wants modules. No external discovery, live user/model experiment or production-store inspection was performed.