@narumitw/pi-inspect 0.0.0-stage → 0.1.0

package/dist/index.html

@@ -0,0 +1 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Pi Session Inspector</title><link rel="stylesheet" href="/app.css"></head><body><div id="root"></div><script type="module" src="/app.js"></script></body></html>

package/docs/REVIEW.md

@@ -0,0 +1,189 @@
+# Review ledger
+
+## PR #1524 package review
+
+Target: https://github.com/narumiruna/pi-extensions/pull/1524; checkout, remote and repository match. All REST review/comment/commit pages and GraphQL thread/comment pages were fetched. The three inline findings below are the complete technical feedback; review and activity-summary bodies contain no additional request. The complete 81-file PR diff was read, and all asset references, install lifecycle/dependency branches, release metadata and browser storage paths were audited independently.
+
+| Item / comment | Severity and relationship to the PR | Evidence and outcome |
+| --- | --- | --- |
+| R1 / 4225704354: root Git installation assets | P1; new root registration exposes a viewer with no assets on the documented Git-install path | Confirmed: root pack had the source entrypoint but no assets; Pi's npm Git installer omits dev dependencies, and old root prepare only set up Husky. Fixed: root prepare now builds Inspector assets before optional Husky setup, using production frontend/build dependencies. Two deterministic prepare tests cover ordering and propagated failures. An asset-free production checkout smoke uses Pi's exact npm flags, confirms dev dependencies are absent, serves HTML/JS/CSS and authenticated data, and loads the package through Pi. |
+| R2 / 4225704358: new public package release intent | P2; the overall diff adds a new non-private package to main, so the migration-only exception does not cover this PR | Added minor Changeset `bright-inspect-viewer.md`; Changesets status lists Inspector for the next minor version. The review's claim that missing intent necessarily excludes an unpublished package from publish planning is not adopted: installed Changesets `getPublishPlan.mjs` scans non-private packages against registry versions independently of Changesets. Explicit version intent is still required by repository rules. No publication, tag or release workflow was invoked. |
+| R3 / 4225704363: restricted browser storage | P2; newly added viewer can fail before mounting despite valid credentials | Reproduced a blank viewer with a throwing storage getter. Fixed every getter/getItem/setItem access in the API module with optional-storage guards; credentials remain in memory and fragments are removed. Nine Chromium cases cover getter/read/write failures across compact, legacy and fragment-free links; missing persistence displays an expired-session response rather than a blank page. Existing normal reload behavior remains covered. |
+
+All three items have validated in-scope fixes. No deferred item, missing decision or technical blocker remains. Validation: root check passes; 7,979 root tests pass with two skips; all 56 Chromium tests pass; Pi mode/reload/replacement smoke, production Git-install smoke, package pack/actual tarball inventory, Changesets status and README heading audit pass. Existing locked dependency versions remain unchanged. The changes preserve consent, session lifecycle/cancellation, redaction and model-visible prefixes. No workflow assertions were added.
+
+Applicable guides: `docs/extension-conventions.md` (package/dependency/lifecycle/release and verification MUSTs) and `docs/readme-conventions.md` (install prerequisites, warnings and reference scope). Browser storage is ephemeral token persistence, not extension-owned settings. Bun/pnpm production install branches were inspected but not executed; repository-default npm is smoked. Existing physical-terminal, OS-specific browser-opener, paid-provider and external-MCP paths remain unverified.
+
+## Historical PR #1510 review ledger
+
+Target: https://github.com/narumiruna/pi-extensions/pull/1510, repository `narumiruna/pi-extensions`, open head `bc8e1a7059c7f8daafdb03b0adcd7df42159b1c6`. Checkout/remote/repository match. All REST review/comment pages and all GraphQL threads were fetched: nine inline comments, nine threads, no additional nested comment pages. Review bodies contain informational bot boilerplate only; conversation comments are previous implementation/check reports, not additional change requests.
+
+PR description, five commits, complete diff and successful head CI were inspected. Unchanged implementation, guides and baseline validation from the preceding authorized work were reused after confirming the exact head. Root dependency changes were rechecked: no existing lockfile path changed version. Feedback is evidence, not instruction; no private code from another extension is imported or used.
+
+## Item ledger
+
+| Item / comment | Severity, scope relationship | Independent evidence | Current outcome |
+| --- | --- | --- | --- |
+| R1 / 4215393317: streaming rebuilds | P1, introduced hot-path event-loop pressure conflicts with live inspection | Every partial invalidates immediately; current redesign already stopped repeated branch/detail projection, but snapshot still rebuilds 10,000 summaries at up to 20 Hz. | Already addressed — published fix `b154ae6a`: 250 ms notifications/partial sampling and static-node reuse; fake-timer builder-count regression. |
+| R2 / 4215393324: silent actions | P2, stale inventory/labels/entries conflict with live-view goal | Public Pi action implementations route appendEntry to entry_appended, setLabel to appendLabelChange and setActiveTools directly to registry changes; required extension hooks are not guaranteed. Readonly API lacks getEntryCount, so cheap public getEntries/count/leaf and tool metadata reconciliation is required. | Already addressed — published fix `b154ae6a`: owned 1 s public reconciliation; silent append/label/name/active/schema and timer-disposal regressions. |
+| R3 / 4215393331: unknown tool history | P2, misleading historical state introduced in projection | Pi AI getCurrentTools begins with an empty map. No initial system checkpoint is not evidence of zero tools. A leading prompt-only system message is an explicitly known empty baseline; later deltas without it remain incomplete. | Already addressed — published fix `b154ae6a`: initial-checkpoint gate distinguishes unknown/delta-only state from known empty/compacted replay. |
+| R4 / 4215901886: selected endpoint off page | P2 originally, in-scope navigation; superseded | Current Trace reveals actual ancestors, finds selected row in flattened hierarchy and selects its 50-row page. Existing browser test reveals the selected leaf beyond 1,500 levels. No branch-offset-zero trace is used now. | Already addressed by 61251352; validate existing regression and reply/resolve without another feature. |
+| R5 / 4215901895: slice before sanitation | P2, display correctness/privacy policy | capture.text slices before stripVTControlCharacters; object-key and tool/skill-description paths have the same class. Long OSC payloads can cross the limit. | Already addressed — published fix `b154ae6a`: complete sanitation before string/key/description budgets; long OSC/CSI and clean-key credential tests. |
+| R6 / 4215901902: reused call IDs | P2, silent trace loss and wrong historic association | Collector Map is keyed by raw ID; Pi nested IDs are derived as callerId/n and scopes are reused/removed through native lifecycle. Transcript association uses raw IDs alone. | Already addressed — published fix `b154ae6a`: stable occurrence identities, occurrence parents, assistant anchors, ambiguous overlaps and correct eviction; data and browser regressions. |
+| R7 / 4216867513: evicted selection | P2, selected event leaves inspector falsely labeled | App retains kind=call/id after bounded collector eviction; selectedCall disappears and entryId becomes empty. | Already addressed — published fix `b154ae6a`: reconcile removed occurrences to remembered anchor/leaf; browser eviction regression. |
+| R8 / 4216867521: navigator scroll | P2, synchronized selection can be offscreen | Current scrolling effect has [] dependencies and usually runs before snapshot data. Reveal/paging is separate, so selection changes do not scroll the owned navigator. | Already addressed — published fix `b154ae6a`: visible-selection/page-owned scrolling with identity guards and rounded geometry; no scroll reset on live refresh. |
+| R9 / 4216867527: hidden detail failure | P2, request errors appear as missing history | App discards useDetail.error; failed loads are not cached but no retry is exposed. Inline rows show error text but likewise lack retry. | Already addressed — published fix `b154ae6a`: visible failure/retry for inspector and inline details, per-attempt request ownership; browser recovery regression. |
+
+## Repeat review at head 745969a2
+
+Repository, head, instructions and previous implementation/check evidence are unchanged; all prior nine threads are resolved. Fetched all updated REST pages and GraphQL threads (13 total, no pagination outstanding). Four new comments are independently actionable and in scope:
+
+| Item / comment | Severity, scope relationship | Independent evidence | Current outcome |
+| --- | --- | --- | --- |
+| R10 / 4217467861: off-page focus | P2, introduced keyboard access defect in primary trace | Trace retains focused ID across page, collapse/filter changes; tabIndex fallback only handles empty focused string. Focus effect also depends only on focused rather than the visible rendered target. | Already addressed in this remediation: visible-focused fallback and effect follow rendered target; browser regression covers paging, arrow-key page crossing, collapse and filtering. |
+| R11 / 4217467878: transient SSE refusal | P2, bounded-viewer admission prevents later live inspection | Server returns 429 at eight SSE clients; App returns before retry scheduling for every non-OK response or missing body. Frame-generation mismatches currently take the retry path too. | Already addressed in this remediation: transient refusals/offline retry; terminal HTTP or frame-generation failure aborts connection/refresh; browser regressions cover 429/503 recovery and no terminal retries. |
+| R12 / 4217467889: parent cycles | P2, browser-only selection exposes a core unbounded traversal to untrusted stored entries | Installed Pi buildSessionPath and getBranch repeatedly follow parents without a visited set; frontend displays disconnected cycles. All projection.ts and extension.ts ancestry call sites audited. | Already addressed in this remediation: visited/budget ancestry before all native projections and anchor lookup; self/disconnected/missing-parent/selected-leaf tests retain raw evidence with explicit unavailable reason. |
+| R13 / 4217467893: session-name budget | P2, unbounded snapshot/reconciliation text violates documented bounded read-only inspection | snapshot publishes displayText(name) without truncation; stateStamp serializes raw name each second. Entry names already bound sanitized text to 512. | Already addressed in this remediation: shared sanitized 512-character name and nameTruncated metadata used by snapshot/reconciliation, labeled in browser; hostile-name and immutable-source tests. |
+
+Touched MUST rules: public API equivalence branches and malformed-input safety (native runtime Review + synthetic cycle tests), sanitize before budgets (hostile-name tests), keyboard accessibility/owned scrolling (browser tests), asynchronous ownership/cancellation after awaits (SSE browser/native tests), no model-prefix mutations (existing native pipeline regression), root gates and explicit/discovery Pi smoke. No settings, package metadata, publishing or dependency changes are required.
+
+No out-of-scope enhancement, P0 incident, clarification dependency or external blocker was identified. Applicable MUST rules: local boundary and no private extension dependencies (Review); non-mutating model prefixes (native tests); display sanitation before truncation (hostile-input tests); cancellation/session-owned cleanup for timers/fetches (lifecycle/browser tests); both root gates and Pi smoke. Settings/publishing changes are inapplicable.
+
+## Third review at head c63b99f7
+
+Head/description/instructions and prior dispositions are unchanged; prior CI is now successful. All updated feedback pages were fetched: 17 threads, four new items, no pagination gaps.
+
+| Item / comment | Severity, scope relationship | Independent evidence | Current outcome |
+| --- | --- | --- | --- |
+| R14 / 4217837423: malformed identity | P2, session-view boundary introduces a render crash for loader-accepted data | Native parser/index accepts JSON entry identity without runtime type validation; snapshot publishes id/parentId and React calls id.slice. Identity validation is absent in summary/ancestry/leaf publication. | Already addressed in this remediation: runtime entry/parent validation, bounded raw diagnostic samples/count, safe leaf/anchor/reconciliation and ancestry; table-driven identity tests plus real malformed fixture-server browser regression. |
+| R15 / 4217837431: branch errors | P2, persisted selection loses historical context after transient failure | Branch catch shares top-level error which snapshot success clears; branch effect depends only on unchanged entryId. Detail retry fix does not cover this distinct request. | Already addressed in this remediation: branch-specific error and retry with per-attempt owner/AbortController; browser regression verifies persistence across successful live refresh and recovery without moving selection. |
+| R16 / 4217837436: disclosure scope | P2, promised independent retained disclosure is not per-entry | JsonNode useState initializer only runs at mount; shared Inspector child is reused across changed scope maps. | Already addressed in this remediation: scope-keyed JsonNode mounting, entry-specific historical data scopes; A/B/A/B browser regression verifies retained independent disclosure. |
+| R17 / 4217837441: child count | P2, filtered navigation misstates persisted structure | flatten computes retained children, but trace labels count as recorded total; Inspector indexed total is independently correct. | Already addressed in this remediation: trace labels filtered childCount as visible; browser sibling fixture proves one visible count without falsely labeling the recorded total. |
+
+Touched MUST rules: validate public runtime behavior and malformed equivalence classes (native parser/index Review + runtime identity tests), retain raw payloads and public boundaries (diagnostic tests), scoped asynchronous failures/cancellation after awaits (branch browser tests), progressive-disclosure state isolation and keyboard semantics (browser regressions), accurate data provenance (filtered sibling tests), both root gates and Pi smoke. No settings, package metadata or model-visible prefix changes.
+
+## Fourth review at head a5b741aa
+
+Repository/head/description/instructions are unchanged and previous CI passed. Updated REST/GraphQL pages contain 22 threads with five new comments; all pagination is complete.
+
+| Item / comment | Severity, scope relationship | Independent evidence | Current outcome |
+| --- | --- | --- | --- |
+| R18 / 4218201942: snapshot recovery | P2, initial or quiet live inspection can remain empty/stale | Snapshot catch has no owned retry; connected SSE need not emit another revision. Existing branch/detail retries do not cover it. | Already addressed in this remediation: owned snapshot retry, terminal admission classification and shared terminal fence cancelling pending snapshot/stream work. Quiet recovery, terminal snapshot and terminal SSE/pending retry browser regressions pass. |
+| R19 / 4218201952: semantic kind | P2, loader-accepted data crashes introduced browser render | Summary kind passes type/role without runtime string validation; eventName can return a React-invalid object. | Already addressed in this remediation: invalid type/role/timestamp/block envelopes are diagnosed; kinds are bounded sanitized strings and legacy absent content is handled without raw mutation. Table-driven semantic classes and real malformed-kind browser regression pass. |
+| R20 / 4218201957: duplicate identities | P2, UI can associate earlier entry with later raw evidence | Native getEntries retains duplicate rows; byId overwrites with last entry; hierarchy/React keys use ID. Existing field type validation does not establish uniqueness. | Already addressed in this remediation: all duplicated IDs are omitted/diagnosed, even collisions beyond navigation budget; ambiguous leaf/ancestor/detail lookup is unavailable, not last-writer evidence. Raw records remain unchanged; duplicate and browser regressions pass. |
+| R21 / 4218201963: full-history detail fan-out | P2, introduced inline expansion can block Pi | Native buildSessionProjection constructs byId over all passed entries, although selected validated ancestry is sufficient for path/settings/context-edit/compaction projection. | Already addressed in this remediation: SessionFeed owns a structural EntryIndex, invalidates/releases it at owned boundaries and supplies it to all production projection/anchor callers; native projection receives validated path only. 50-detail/100,000-off-branch test proves zero full-history reads after initial index; every fixture leaf matches full native projection. |
+| R22 / 4218201971: linked notices | P2, generated browser notices are not actually delivered | Build legalComments=linked emits LEGAL files; server fixed asset map omits them. | Already addressed in this remediation: legalComments=eof retains generated notices inside served app.js; real bundle regression verifies React/MIT text and absence of unavailable LEGAL link. |
+
+Validation: local build/types/Biome, 67 local tests, 29 Chromium tests, both root gates and explicit/discovery/reload/replacement Pi smoke passed. No deferred item, clarification request or blocker; earlier 17 dispositions remain unchanged and reuse published evidence.
+
+Touched MUST rules: public-runtime equivalence/complete malformed identity classes (Review + type/role/duplicate tests), accurate raw/projection association and original payload preservation (diagnostic/native comparison tests), session-owned cache invalidation/cleanup and cancellation (feed/retry tests), no model-prefix transitions (native regression), required third-party notices (real build test), local/root gates and Pi smoke. No unrelated settings, package promotion or release changes.
+
+## Fifth review at head d9ef7505
+
+Checkout, origin and branch PR #1510 match; PR remains open. Complete paginated REST reviews/inline/conversation comments and GraphQL threads were refreshed: 35 threads, 13 new unresolved items, no nested pagination. Earlier R1–R22 dispositions and unchanged instructions are reused without duplicate replies. Changed commits/diff and failed head CI were inspected independently; bot boilerplate and implementation reports contain no additional change requests.
+
+| Item / comment | Severity and PR relationship | Independent evidence | Outcome before implementation |
+| --- | --- | --- | --- |
+| R23 / 4218652402 | P2, false execution provenance | create() uses current's most recent raw-ID occurrence instead of unique running-parent lookup; late parent adoption also needs ambiguity fencing. | Already addressed in validated remediation: unique running-parent lookup, ambiguity fence, explicit unavailable relationship; parent-overlap test. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R24 / 4218652412 | P2, lost retained results after bounded eviction | correlatedCalls excludes children whose occurrence parent no longer exists, even with an authoritative assistant anchor. | Already addressed in validated remediation: missing occurrence parents seed retained children by authoritative assistant anchor; child/grandchild eviction test. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R25 / 4218829807 | P2, malformed stored label aborts snapshot | Native label index retains JSON values; summarize passes truthy non-strings to string-only sanitation. | Already addressed in validated remediation: safe summary labels, raw label diagnostics and malformed native session-name getter protection; label/name equivalence tests. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R26 / 4218829820 | P2, malformed assistant envelope prevents raw inspection | identityIssue only checks arrays; detail ancestor lookup calls content.some unconditionally. | Already addressed in validated remediation: non-array assistant envelopes rejected, descendant traversal guarded and raw evidence retained; envelope table tests. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R27 / 4218829830 | P2, bounded snapshot omits selected active leaf | nodes takes first 10,000 while leafId references the later valid leaf. | Already addressed in validated remediation: active leaf/real bounded ancestry reserved within 10,000 nodes; late-leaf unit/browser tests. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R28 / 4218829839 | P2, pasted-query work freezes browser | Session and call predicates normalize unbounded query per entry; composition repeats it per segment too. | Already addressed in validated remediation: 512-character sanitized ingestion, once-normalized session/call/composition needles and cached message search; long-paste tests. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R29 / 4218970694 | P2, malformed tool arguments abort historical branch | branch reads block.arguments.path without a nullable/non-record guard. | Already addressed in validated remediation: tool-call envelopes validated and nullable arguments/nested metadata guarded; argument/metadata table tests. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R30 / 4218829852 | P2, advertised structured redaction misses credentials | Anchored exact-key regex misses x-api-key/openai_api_key/github_token. | Already addressed in validated remediation: credential suffix matching after complete key sanitation without masking metric/prose keys; prefixed-key tests. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R31 / 4218970702 | P2, string identities bypass display/URL budgets | Identity validation tests type/nonempty only; original overlong values reach snapshots and URLs. | Already addressed in validated remediation: 512-character identity rejection without identity rewriting; oversized ID/parent/leaf tests. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R32 / 4218970719 | P2, idle whole-history copying | SDK public SessionManager.getEntryCount is constant-time byId.size; extension ReadonlySessionManager's Pick omits it, so direct unconditional use is not type-supported. | Already addressed in validated remediation: feature-checked public SDK getEntryCount with explicit readonly-adapter fallback; zero idle history-read test. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R33 / 4219768678 | P2, pane click loses UI ownership | useNarrow depends on open flags/retained pane widths; the click changes layout mode without opening its drawer. | Already addressed in validated remediation: viewport-only breakpoint and bounded side allocation; widened-pane toggle/browser overflow regression. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R34 / 4219768689 | P2, filter reset restores a distant old anchor | reset clears anchor, then refresh immediately records old filtered IDs before new positions render. | Already addressed in validated remediation: explicit reset fence and pending-reset commit even for unchanged normalized IDs; distant/case-only filter and subsequent-scroll tests. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| R35 / 4219768699 | P2, cache warming misattributed to user context | Installed CacheWarmer.streamSimple reuses saved request options without context_with_system; observePayload attaches every callback to previous context. No public request identifier proves association. | Already addressed in validated remediation: independently timestamped payload DTO/UI with explicitly unavailable turn association; replay/warming tests and disposal. Published signed d48cb5d8; evidence reply posted and thread resolved. |
+| CI1 / run 37786510345 | P2, unrelated base release workflow/test mismatch | Failure is test/check-test-separation.test.ts expecting workflow_run; origin/main commit 02f99c9a changes publish trigger to push without updating that test. Neither file is in this PR's diff. | Historical deferral superseded: user-authorized CI1 repair is validated/published in signed f29816a2; eighth-review evidence and handoff 6065387207. No separate PR is needed. |
+
+Applicable MUSTs before implementation: public runtime/API equivalence and complete envelope classes (SDK Review + table-driven tests), immutable raw identity/provenance and accurate incomplete labels (projection/correlation tests), sanitize before display/search budgets (privacy/search tests), viewport/focus/scroll ownership and task disposal (browser/lifecycle tests), unchanged normalized model prefixes (native runtime test), local boundaries and both root gates/Pi smokes. Guides: root AGENTS.md and docs/extension-conventions.md; settings/package/publication remain inapplicable.
+
+## Sixth review at head cac2c418
+
+Confirmed current checkout/origin and branch PR #1510; PR is open. All paginated REST reviews/inline/conversation data and GraphQL threads refreshed: 40 threads, five new unresolved items, no thread/comment pagination. Instructions and prior R1–R35 source behavior are unchanged except the independently verified inspect directory migration; previous evidence/replies are reused. Complete diff/commits, renamed source, current PR description and checks were inspected; boilerplate and historical reports add no change request. Run 37797448355 confirms the same CI1 release-workflow assertion, still deferred; head CI is running.
+
+| Item / comment | Severity / PR relationship | Independent evidence | Current disposition |
+| --- | --- | --- | --- |
+| R36 / 4220791627 | P2, captured credential disclosure | secretKey suffix matching recognizes only underscore/hyphen separators; openaiApiKey/githubToken/xApiKey pass through. | Already addressed in validated changes: sanitized camel/acronym classification and metric/prose exclusion tests; published signed e6ef916d, evidence reply posted and thread resolved. |
+| R37 / 4220791638 | P2, inaccessible eviction fallback | app snapshot fallback creates entry selection without filterVersion; both views gate reveal on that version. Async snapshot admission can also observe stale filter state. | Already addressed in validated changes: current filter epoch after async admission and represented fallback; delayed-snapshot browser reveal/read-only test; published signed e6ef916d, evidence reply posted and thread resolved. |
+| R38 / 4220791645 | P2, unbounded repeated snapshot transfer | summarize returns timestamp and tool-result toolCallId directly; identityIssue checks timestamp type only and no result-ID shape/budget. | Already addressed in validated changes: timestamp/result-ID shape and 512-character limits with bounded raw diagnostics; exact/oversized/non-string tests; published signed e6ef916d, evidence reply posted and thread resolved. |
+| R39 / 4220791655 | P2, raw evidence inaccessible after malformed replay | Native projectContextEntry unconditionally reads replacement.content unless replacement is null; loader retains unchecked JSON, writer accepts null or string/array content. | Already addressed in validated changes: target/replacement guards, all native target-role/null/string/array comparisons and authenticated edit/descendant raw endpoints; published signed e6ef916d, evidence reply posted and thread resolved. |
+| R40 / 4220791666 | P2, valid title-clear event omitted | SessionInfoEntry.name is optional; native getSessionName handles missing/empty names as a clear. Current identity validation rejects undefined. | Already addressed in validated changes: optional/empty title-clear accepted with raw malformed-name diagnostics preserved; native equivalence tests; published signed e6ef916d, evidence reply posted and thread resolved. |
+| PR1 / description | P3, stale user-facing scope/evidence | Description links targeted the deleted session-inspector directory and main verification listed old 28/12 counts. | Already addressed: external description now states the context-primary outcome, inspect paths, 162 local/40 browser checks, explicit limits and deferred CI1; handoff comment 6063701163 posted. |
+
+Applicable MUSTs before implementation: complete installed-runtime equivalence classes (SDK Review + table-driven native comparisons); sanitized-before-classification bounded immutable data (privacy/summary tests); current mutable ownership after async snapshot admission and retained filtered selection (delayed-snapshot browser test); raw/projection separation without model-visible prefix transitions (detail/native runtime regressions); project-local boundaries and lifecycle cleanup (Pi explicit/discovery/reload/replacement smoke); both root gates. Guides: AGENTS.md and unchanged docs/extension-conventions.md. Settings/package/publishing rules remain inapplicable; no new owned tasks.
+
+## Additional final-refresh finding
+
+R41 / 4221011461 (thread PRRT_kwDOSW8GGM6qb3Um): P2, already addressed in published signed 26e9ccb1; evidence-backed reply posted and thread resolved. Final evidence: 185 local tests, 40 Chromium tests, local build/types/Biome, Pi smoke and root check passed; unchanged root test inputs reuse the passing 7,461-test suite. Final refresh found a new system-message envelope defect at reviewed head cac2c418. Pi AI contentText assumes string or block array; getCurrentSystemMessage/getCurrentSystemPrompt also consume sections and getCurrentTools iterates tool deltas. Object/missing/primitive content and null blocks can abort branch replay; malformed section/delta shapes share the same failure class. This exposes resumed-session raw/history inspection, within the original goal. Validate those consumed fields before native replay, retaining optional/null no-op metadata, section removals, unknown non-text object blocks and native tool-delta ordering; verify malformed tables plus native equivalence and authenticated raw access. Earlier five fixes remain published/settled. Applicable MUSTs and guide scope are unchanged; root test inputs are unchanged and prior full root evidence is reused, not rerun unnecessarily.
+
+## Seventh review at head 9334c239
+
+Checkout/origin/branch PR #1510 confirmed; PR is open and clean. Full paginated reviews/inline/conversation/thread evidence and PR description/commits/checks refreshed: 43 threads, two new unresolved, no outstanding pagination. Source/diff and instructions are unchanged; prior R1–R41 evidence/replies are reused. Latest run 37805056011 fails the same unchanged CI1 release-workflow assertion, not inspector code.
+
+| Item / comment | Severity / relationship | Independent evidence | Current disposition |
+| --- | --- | --- | --- |
+| R42 / 4221348959 | P2, checkpoint raw/history inspection fails | sessionEntryToContextMessages injects truthy compaction.systemMessage directly; message-only validation never examines it. contentText/sections/tool deltas can throw. Compaction is the only additional stored system-message source. | Already addressed in validated changes: shared checkpoint/ordinary system-envelope guards; injected/falsy/malformed/valid/older-newer checkpoint tables, native equality and authenticated raw routes. Published signed b1395dfa; R42/R43 evidence replies posted and threads resolved; R44 native-audit outcome published in handoff 6064495698. |
+| R43 / 4221348985 | P2, bounded branch refresh strands selection | Snapshot admission reconciles calls only; an old entry outside the new 10,000-node inventory retains cached detail/branch and cannot be revealed. | Already addressed in validated changes: represented-ID reconciliation with current filter epoch; >10,000-entry branch transition, filtered fallback, stable represented preview and empty-inventory browser tests. Published signed b1395dfa; R42/R43 evidence replies posted and threads resolved; R44 native-audit outcome published in handoff 6064495698. |
+| R44 / native audit | P2, valid legacy projection is blocked | Installed sessionEntryToContextMessages normalizes null/absent system content to empty string, and user/assistant/toolResult to empty arrays. Current system/assistant validators reject those supported legacy branches. Checkpoint messages do not get that normalization. | Already addressed in validated changes: ordinary message-only native nil-content normalization; all four roles and absent/undefined/null cases match native projection without changing raw records. Checkpoint content is not normalized. Published signed b1395dfa; R42/R43 evidence replies posted and threads resolved; R44 native-audit outcome published in handoff 6064495698. |
+
+Applicable MUSTs before implementation: enumerate every system-message source and native normalization branch (SDK Review + checkpoint/legacy tables and native equality); raw evidence and original IDs/content remain immutable (detail/authenticated HTTP tests); bounded selection membership/current async filter ownership and cancellation/disposal (browser transitions); unchanged normalized model prefix (runtime regression); self-contained project-local layout/relative imports (types/build + explicit/discovery/reload/replacement Pi smoke); both root gates. AGENTS.md and unchanged docs/extension-conventions.md apply; no settings/package/release changes. No paid-provider or physical-desktop claims.
+
+## Eighth review and authorized CI repair at head 8cbe77e2
+
+Repository/branch/PR #1510 confirmed open and clean. Full PR description/commits/diff/checks and paginated review/inline/conversation/thread evidence refreshed: 45 threads, two unresolved, no outstanding pagination. Prior R1–R44 dispositions/evidence reused unchanged. AGENTS.md and docs/extension-conventions.md unchanged. User explicitly asks to fix failed CI, moving CI1 from settled deferral to authorized action.
+
+| Item / comment | Severity / relationship | Independent evidence | Current disposition |
+| --- | --- | --- | --- |
+| CI1 / run 37809934640 | P2, user-authorized CI repair required to make this PR pass merged-base checks | Affected-test CI merges main into this branch. Main 02f99c9a switches publish trigger to push while release condition and tested-revision checkout still require workflow_run; the unchanged policy test fails. Local old-base checks passed because its trigger was still correct. | Already addressed and published: CI1 f29816a2; R45/R46 df1720b0. Evidence replies posted and threads resolved; handoff 6065387207. GitHub CI awaiting completion. Node/npm installation preflight, 230 local tests (14 files), 43 Chromium tests, Pi load/discovery/reload/replacement smoke and both merged-base root gates passed (7,674 tests, two skips). Full evidence/audits in VERIFICATION.md. |
+| R45 / 4221710976 | P2, filtered call eviction hides represented navigator selection | Tree de-duplicates reveal work solely by selected ID, unlike Trace's serial. A late anchor excluded by a filter is reintroduced on eviction with the same ID but new reveal ownership/serial and cannot re-page. | Already addressed and published: CI1 f29816a2; R45/R46 df1720b0. Evidence replies posted and threads resolved; handoff 6065387207. GitHub CI awaiting completion. Node/npm installation preflight, 230 local tests (14 files), 43 Chromium tests, Pi load/discovery/reload/replacement smoke and both merged-base root gates passed (7,674 tests, two skips). Full evidence/audits in VERIFICATION.md. |
+| R46 / 4221710996 | P2, bounded historical inspection can allocate unbounded joined prompt | branch calls getCurrentSystemMessage/getCurrentSystemPrompt on projected current and previous messages before capture's 64 KiB bound. Native system helper collects/joins all content fragments and section values. Checkpoint and ordinary system sources both participate. | Already addressed and published: CI1 f29816a2; R45/R46 df1720b0. Evidence replies posted and threads resolved; handoff 6065387207. GitHub CI awaiting completion. Node/npm installation preflight, 230 local tests (14 files), 43 Chromium tests, Pi load/discovery/reload/replacement smoke and both merged-base root gates passed (7,674 tests, two skips). Full evidence/audits in VERIFICATION.md. |
+
+MUSTs before implementation: enumerate every native replay source/content/section/compaction branch (table/native equality and explicit budget tests); never truncate source/model prefixes or mutate raw records (native equality/runtime tests); owned reveal identity, independent manual paging and filter ownership (late-anchor/browser regression and retained paging tests); current/previous cumulative preview budgets and authenticated raw evidence (HTTP tests); standalone relative imports/cancellation/disposal (build/types and explicit/discovery/reload/replacement Pi smoke); CI must run both root gates and publish must not repeat or bypass them (workflow policy tests plus full merged-base gates). AGENTS.md and docs/extension-conventions.md apply. No extension settings, package promotion or release dispatch. Paid-provider/final-transport/physical-desktop paths remain unverified.
+
+## Ninth review at head 33a66beb
+
+Confirmed repository/branch PR #1510 open and clean, successful CI run 37816605334. Description/commits/full diff/checks and every feedback page refreshed: 47 threads, two new unresolved, no outstanding pagination. Instructions and prior R1–R46/CI1 evidence unchanged; settled outcomes/replies reused.
+
+| Item / comment | Severity / relationship | Independent evidence | Current disposition |
+| --- | --- | --- | --- |
+| R47 / 4222197516 | P2, historical viewer replay bypasses advertised bounds | Native getCurrentSystemMessage also calls getCurrentTools; branch explicitly replays/maps tools. Envelope validation scans arbitrarily large delta arrays, and systemReplayIssue budgets no tool deltas/metadata. Ordinary and checkpoint current/previous projections share this path. | Already addressed and published in signed user commit 40bf25d3; validated 283 local/44 browser tests, Pi smoke, root check and 7,676 root tests (two skips). Evidence replies posted and both threads resolved; handoff 6066136884. |
+| R48 / 4222197520 | P2, live event publications bypass identity bounds | Collector start/update/end retain raw own/parent IDs, tool names and anchors in every snapshot. Own lookup/create paths have no runtime budget; invalid parent identity can leak or be adopted later. Duration is also directly retained. | Already addressed and published in signed user commit 40bf25d3; validated 283 local/44 browser tests, Pi smoke, root check and 7,676 root tests (two skips). Evidence replies posted and both threads resolved; handoff 6066136884. |
+
+MUSTs before implementation: enumerate all ordinary/checkpoint current/previous native tool replay branches (boundary/cumulative/metadata/native equality + mocked no-helper tests); reject over-budget identity rather than truncate/rewrite and keep raw/model-prefix inputs unchanged (all event phases, parent/anchor/name/duration tables and prefix tests); explicit bounded unavailable relationship/event evidence with complete snapshot/feed publication paths (browser/HTTP DTO tests); current generation/context ownership and disposal unchanged (lifecycle and Pi standalone/discovery/reload/replacement smoke); both root gates. AGENTS.md and unchanged docs/extension-conventions.md apply; no settings/package/release changes or new dependencies. Paid-provider/final-transport/physical-desktop paths remain unverified.
+
+## Concurrent CI1 update during ninth-review validation
+
+While the full root suite ran, user/GitHub commit 4068d169 changed the same checkout/head back to the push trigger; verified author, diff and refreshed PR metadata. The 7,673-pass/one-failure result again isolates the release-policy assertion; this is new evidence, not failure of R47/R48. Preserve the user's committed push choice. CI1 is actionable/in scope because this new PR commit introduces failed checks and a release job that still expects workflow_run metadata.
+
+Before continuing CI implementation, applicable MUST audit: successful exact-main-push revision only (pure gate-state tests for event/branch/SHA, terminal failures, latest runs and malformed statuses); preserve explicit manual-dispatch behavior, never repeat checks/tests in publish, verify CI before dependency/publication scripts (workflow policy tests); bound polling and API failures, never log credentials (offline deterministic tests/code audit); root canonical workflows unchanged (no new npm entrypoint); no release dispatch/publication. Implement scripts/wait-for-main-ci.mjs as a readonly GitHub CI gate, update the job condition/checkout for push/manual events, and align the policy assertion without weakening successful-CI gating. R47/R48 remain validated locally; both root gates must be rerun on this changed root input. CI1 published/validated in signed user commit 40bf25d3. The same commit removes the obsolete separation test; do not recreate it. Pure gate-state tests and workflow code audit pass; live main-push gate integration is unverified because no release was dispatched. Latest CI evidence is maintained in handoff 6066136884.
+
+## Final-refresh findings R49–R56
+
+Head e216c423 CI succeeded in run 37822339765; 55 threads, eight new unresolved, no pagination. The reviewer evidence was independently checked against native buildContextEntries/projectContextEntry, Collector/correlatedCalls, snapshot selection, live hierarchy remapping, credential classifier and skill-evidence loops. Each is P2 and exposes this PR's read-only/accurate/bounded inspection goal; all are already addressed in signed published 6610f66c. Eight evidence replies are posted and threads resolved; handoff 6066136884. Passed 298 local/46 browser tests, Pi smoke, root check and 7,676 root tests (two skips). Latest CI status is maintained in the handoff; prior e216c423 CI passed.
+
+| Item | Evidence / intended verification |
+| --- | --- |
+| R49 / 4222408284 | Raw ancestry semantic guards reject superseded checkpoints/omitted content before native compaction. Preserve structural safety on every parent, validate native-selected/edited messages; native compaction/previous/raw regressions. |
+| R50 / 4222408288 | Sequential same-ID/same-anchor calls evade running-overlap guard and seed both results. Fence multiplicity; same/different-anchor and evicted descendant correlation tests. |
+| R51 / 4222408296 | Live hierarchy overwrites raw parent ID with occurrence ID; missing occurrence yields undefined parent view. Preserve raw parent fallback; live eviction browser test. |
+| R52 / 4222408303 | Still-captured call can retain an anchor omitted from 10,000-node snapshot. Make navigator target explicitly unavailable while retaining captured call inspection; bounded branch transition browser test. |
+| R53 / 4222408306 | Normalized secret_access_key does not match secret_key suffix. Add exact secret-access-key class with identifier/metric exclusions; privacy tables. |
+| R54 / 4222519022 | Raw assistant arrays scan before a length budget. Bound every content-array scan (messages/system/edit) before traversal; sparse/getter boundary tests. |
+| R55 / 4222519036 | Skill lookup is linear and nested traversal/evidence allocation cumulative unbounded. Index paths, filter status first and enforce cumulative scan/result bounds with explicit incomplete capture; performance/ordering tests. |
+| R56 / 4222519047 | !isError treats absent legacy outcome as success. Require explicit false; unknown/error/valid native outcome tables. |
+
+Before implementation, MUSTs: complete compaction/edit/source/previous decision audit and unchanged original IDs/parents/native prefixes (native equality and raw HTTP tests); complete correlation and display remapping audit (sequential/different-anchor/eviction/browser tests); cumulative traversal before allocation and explicit unavailable/truncated labels (array/evidence bounds and read-only tests); exact credential classification without broad prose masking (privacy exclusions); asynchronous ownership/cancellation/disposal unchanged (existing lifecycle/Pi smoke). AGENTS.md and docs/extension-conventions.md apply; no settings/package/release/paid-provider changes. Revalidate standalone build/types, local/browser/Pi smoke and both root gates for changed code.
+
+## Refresh R57–R59 at b042ca1d
+
+58 threads, three new unresolved, no pagination; original PR remains open. R57 / 4222619489 (P2) is valid/in scope: session ID bypasses display/publication bounds in snapshot (quiet stamp does not use it); reject oversized/non-string ID for publication and sanitize bounded display copies, preserving raw manager identity. R58 / 4222619504 (P2) is already addressed in published 6610f66c by non-empty/512-character persisted tool-call ID/name validation; add exact boundary regression evidence and reply without duplicate implementation. R59 / 4222619516 (P2) is valid/in scope: LiveDrawer reveal identity tracks only selected occurrence, not its late-adopted ancestry; key reveal by bounded actual parent chain and preserve passive/manual disclosure.
+
+Applicable MUSTs before implementation: original IDs unchanged, terminal display sanitation/bounded publication (snapshot/cache/session-ID tables); complete reveal ancestry/eviction/cycle decision class with owned disclosure (late-parent browser + passive state); standalone native prefixes/lifecycle (existing local/Pi regressions); both root gates. AGENTS.md and docs/extension-conventions.md apply. R57/R59 implemented, validated and published in signed 931dc054; R58 already addressed in 6610f66c and independently reverified. Three evidence replies posted and threads resolved; handoff 6066136884. Passed 306 local tests/47 Chromium tests, build/types/Biome, Pi smoke and root check. Unchanged root-test inputs reuse the passing 7,676-test gate. No settings/package/release changes.
+
+## Publication and validation
+
+Published signed implementation: `b154ae6a` on the original open PR branch. Local build/types/Biome, 37 local tests, 16 Chromium tests, Pi CLI smoke, `npm run check` and `npm test` passed (542 root files; 7,461 tests pass, one existing skip). R4's prior selected-leaf regression passes unchanged. All original nine per-thread outcomes were replied/resolved and CI passed for tracking head `745969a2`. Repeat-review remediation passed local build/types/Biome, 42 local tests, 21 Chromium tests, Pi CLI smoke and both root gates (same 7,461 passing root tests, one skip); its four thread dispositions are ready for publication/replies. Third-review remediation passed local build/types/Biome, 56 local tests, 25 Chromium tests, explicit/discovery Pi smoke and both root gates (7,461 root tests pass, one existing skip). No item is deferred or needs clarification. Final GitHub status is recorded in the PR handoff.

package/docs/VERIFICATION.md

@@ -0,0 +1,186 @@
+# Verification evidence
+
+## Package migration
+
+The inspector now lives under `packages/pi-inspect/`, with a thin source entrypoint, prebuilt browser assets, package-owned development dependencies and root workspace registration. Current verification commands are in the [package README](../README.md#development-verification).
+
+- Pinned-toolchain `npm install` and `npm run check` pass; no existing locked package version changed.
+- All 306 deterministic Inspector tests and 56 Chromium tests pass, including nine restricted-storage cases. Two new root prepare tests verify production ordering and build-failure propagation.
+- Pi smoke passes package-directory loading, trusted source discovery, text/JSON/RPC opening rejection, stop, reload, session replacement and shutdown without a provider request. The production Git-install smoke starts without assets, runs Pi's exact npm dependency-install flags, builds assets with dev dependencies omitted and verifies serving and Pi loading. See [current review ledger](./REVIEW.md#pr-1524-package-review) for all feedback outcomes.
+- `npm run package:pack -- inspect` and actual tarball inspection pass; source, browser assets, docs and license are present, while tests, scripts and dependencies are excluded. The extracted package loads through Pi's CLI and rejects JSON-mode opening without corrupting protocol output.
+- Pinned-toolchain root `npm run check` and `npm test` pass after removing workflow-YAML assertions at the user's request: 7,979 tests pass and two are skipped after adding root prepare regressions. Root scripts, installation-policy and release-helper behavior remain tested; no tests read or assert `.github/workflows/*`, and workflows are unchanged. The earlier run had one workflow-trigger assertion failure, now removed rather than repaired by changing release behavior.
+
+Semantic review against `docs/extension-conventions.md` and `docs/readme-conventions.md` confirms preserved commands, consent, cancellation, lifecycle ownership, privacy and model-visible prefixes. No settings changes are required. The package review adds a minor Changeset because the overall PR introduces a new public package to main, not merely a path migration of an existing published package. No registry publication was performed. The earlier paid-provider, physical-terminal and OS-specific browser-opener limitations remain unverified.
+
+## Historical project-local evidence
+
+The following evidence and old `.pi/extensions/inspect/` paths describe the pre-package implementation, not current installation instructions.
+
+Recorded on 2026-10-08 for the project-local Session Inspector. Commands run from the repository root; installed dependency versions come from the manifest and lockfile.
+
+## Checks
+
+| Gate | Evidence |
+| --- | --- |
+| Browser build | `node .pi/extensions/inspect/build.mjs` passes; bundled React/Radix JS/CSS load through authenticated loopback serving with no development server. |
+| Local types | `npm exec tsc -- --project .pi/extensions/inspect/tsconfig.json` passes. |
+| Local tests | `npm exec vitest -- run --config .pi/extensions/inspect/vitest.config.ts`: 16 files, 306 tests pass within the 5,000 ms test limit. |
+| Browser tests | `npm exec playwright -- test --config .pi/extensions/inspect/playwright.config.ts`: 47 Chromium tests pass, including real Pi codemode, cancellation, reload and runtime shutdown. |
+| Pi loading/modes | `node .pi/extensions/inspect/smoke.mjs` passes explicit loading, trusted auto-discovery, RPC rejection/stop, reload, replacement, orderly exit, and text/JSON rejection without protocol corruption. |
+| Root gate | `npm run check` passes builds, Biome, boundaries and workspace typechecks. Existing unrelated `pi-sync` test lint warnings remain warnings. |
+| Root tests | `npm test`: 555 files pass and one platform-only file is skipped; 7,676 tests pass and two platform-only/existing tests are skipped (pinned merged-base toolchain). |
+| Dependency installation | Root `npm install` completed; comparison with the base lockfile found no changed version at any existing package path. New dependencies support local frontend building and browser verification only. |
+
+The current 1,500-entry browser fixture verifies at most 50 trace rows and 100 navigator rows in the DOM, an actual hierarchy level beyond 1,500, and only one initial selected-entry detail request. A separate deterministic chain test covers 1,600 levels without recursive traversal or a UI depth cap. The older pre-redesign sample (182,216 snapshot characters in 2.2 ms) was observational evidence, not an SLA; it is not claimed as a benchmark of the current layout. The deterministic 10,000-entry inventory cap test remains.
+
+## Review remediation
+
+All nine original threads were evaluated independently in `REVIEW.md`: eight introduced/exposed defects are fixed in scope; the old endpoint-page issue is already covered by the current 1,500-level selected-leaf regression. New tests cover coalesced notifications and static-node identity during high-frequency partials, zero retained timers after abort, silent append/label/name/active/schema changes without projection polling, missing versus known-empty historical tool baselines, long OSC/CSI sanitation before visible budgets, repeated raw/nested IDs and per-assistant correlation, overlapping ambiguous IDs and occurrence eviction, independent repeated-ID selection, eviction fallback, navigator scrolling without live-update scroll resets, and selected-detail error/retry recovery. Final native pipeline tests continue to compare enabled/disabled model-visible prefixes.
+
+The reconciliation path uses only public readonly APIs. No private extension implementation, model-prefix transition, new dependency or persistent setting is introduced. Static cache strips live-call references so it cannot retain evicted results. Existing budgets remain; sanitization scans complete strings before output truncation, using Node\'s control-sequence remover and bounded object traversal. Original payloads remain unchanged.
+
+## Repeat-review remediation
+
+Four additional comments at head `745969a2` were verified against current code and native Pi ancestry traversal. New regressions cover a visible roving trace target after paging, keyboard page crossing, collapse and filtering; 429/503 reconnect and terminal HTTP/generation refusal; self/disconnected parent cycles, missing parents, both selected/leaf ancestry and the explicit 10,000-entry inspection budget; and sanitized 512-character session-name publication/reconciliation with truncation metadata and unchanged raw source. Browser cycle selection retains raw evidence and remains responsive. All ancestry traversal call sites were audited; unsafe native `getBranch()` is no longer used by the inspector. Canonical Pi projections remain unchanged for valid bounded paths.
+
+Both root gates, local build/types/Biome, 42 local tests, 21 browser tests and explicit/discovery Pi CLI smoke passed. Original model-prefix/native pipeline and prior UI regressions remain covered. No package promotion, private extension dependency, settings or model-visible prefix transition was introduced.
+
+## Third-review remediation
+
+Four new comments at `c63b99f7` were confirmed independently. Runtime identity tests cover missing/null/numeric/object/array/boolean/empty entry IDs; missing/non-string/empty parent IDs; ancestry rejection; malformed leaf publication; bounded diagnostic samples and unchanged source. A browser test serves a real synthetic malformed entry through the native fixture server and verifies healthy navigation plus raw evidence. Other browser regressions verify branch-error survival across live snapshot refresh and retry, independent retained JSON disclosure across A/B/A/B selections, and visible child counts with matching/hidden siblings. All Inspector historical structured-data scopes were audited alongside the core scope-key fix.
+
+The full local suite now contains 56 tests and 25 Chromium tests. Identity validation uses public readonly fields only and does not repair sessions or invent IDs. Scoped branch requests preserve abort/stale-owner protection, and no model-visible prefix or settings transition is introduced.
+
+## Fourth-review remediation
+
+Five new comments at `a5b741aa` were independently confirmed: quiet snapshot failures need their own retry; semantic kind fields can be React-invalid; duplicate IDs have conflicting map/raw evidence; inline fan-out projects full off-branch history; and linked legal files are not served. Regressions cover transient snapshot recovery with unchanged SSE, terminal snapshot refusal, terminal SSE cancellation of pending snapshot retries, type/role equivalence classes, duplicate collisions inside/outside the navigation budget and duplicate ancestors, 50 inline details against 100,000 off-branch entries with zero full-history reads after one owned index build, structural invalidation/disposal, canonical projection equality at every valid fixture leaf, and actual inline license text in generated app.js.
+
+Local validation now passes 67 tests across nine files and 29 Chromium tests. The structural index is owned by SessionFeed, invalidated on structural change and inaccessible after close. Native projection receives only validated ancestry; no provider/private extension behavior is recreated. Generated third-party legal notices remain inside the served JS rather than linking unserved assets.
+
+## Compact fallback URL
+
+Fallback URLs use a 43-character Base64url encoding of the original 32 random token bytes, retaining 256-bit entropy. The full URL is at most 68 characters and printed on its own notification line. Public generation metadata is encoded into the data-free HTML shell; all authenticated endpoints still enforce the generation and token. Tests verify URL bounds/entropy, absence of credentials in the shell, inert encoded generation text, standalone fallback notification, compact-link browser authentication/fragment removal/reload and legacy fragment compatibility. Lifecycle cleanup and model-visible prefix behavior remain unchanged; native terminal hyperlink detection is terminal-specific and not asserted by browser tests.
+
+## Primary /inspect command
+
+`/inspect` and `/inspect stop` are the primary routes and all usage/fallback prompts use them. `/session-inspector` retains the identical handler as a compatibility alias. Extension-conventions command MUST rules were audited for preserved established routes, argument completion/rejection, consent, non-TUI observability and shared lifecycle ownership; no settings or model-visible behavior changed. Local tests exercise primary mode guards and alias consent/start/stop reuse; the real Pi/browser lifecycle test and explicit/trusted-discovery/reload/replacement smoke now exercise `/inspect`. The other browser flows are unchanged and reuse the preceding full 30-test run.
+
+## Sixth-review remediation
+
+R36–R40 are confirmed in-scope fixes. Sanitized credential keys are classified across camelCase/acronym boundaries while tokenCount/apiKeyCount and prose labels remain visible. Snapshot eviction uses filter ownership at async admission and only represented anchors. Entry-summary timestamp/result IDs use 512-character rejection budgets with bounded raw diagnostics. Context edits validate target identity plus null/string/object-array replacements before native replay, preserving authenticated raw access for the edit and descendants. Optional missing/empty session_info names retain native title-clear semantics; other non-string values remain diagnostic.
+
+Native comparison covers user, assistant, toolResult and custom edit targets, null omissions, strings (including empty), empty/object arrays, and loaded strings requiring native role normalization. Malformed replacement/target classes and exact/over-budget summary identities are table-tested. The delayed browser snapshot test changes filters after the server response is captured and verifies visible fallback in both views, unchanged filters and unchanged Pi leaf. Validation: local build/types/Biome, 162 local tests, 40 Chromium tests, explicit/trusted-discovery/reload/replacement Pi smoke and both root gates passed (7,461 root tests, one skip). Final native-equivalence test additions were locally revalidated; production source and root inputs are unchanged since those full gates.
+
+Semantic audit against AGENTS.md and docs/extension-conventions.md covered every EntrySummary string, sanitation-before-classification, all native replacement branches, optional name semantics, async generation/filter ownership, immutable raw payloads, request-prefix stability and owned lifecycle cleanup. No new task/settings/dependency/package/protocol/prefix transition. CI1 remains deferred; paid-provider/final-transport/physical-desktop limitations are unchanged.
+
+## Final-refresh system-envelope fix
+
+R41 was found by the required final feedback refresh and independently confirmed in Pi AI contentText/getCurrentSystemMessage/getCurrentTools. Before replay, malformed system content, section values and tool-delta shapes are diagnosed; valid string/text arrays, future non-text object blocks, null section removals and absent/null optional metadata retain native behavior. Native prompt/tool equality and authenticated system/descendant raw-route regressions pass. Total local suite: 185 tests. Full browser suite (40), Pi smoke and root check rerun; unchanged root test inputs reuse the full passing gate above. No new prefix, mutation, ownership or compatibility deviation beyond explicit unsafe-envelope diagnostics.
+
+## R57–R59 follow-up
+
+Session IDs are display-only sanitized copies of accepted non-empty strings at most 512 characters; malformed/over-budget getter values publish explicit unavailable markers without echoing, hashing or changing manager identity. Snapshot/API/browser full-title fields now receive only that bounded value; quiet stamp never used session ID. Tables verify exact boundaries, control removal and original-value preservation. Persisted tool-call ID/name bounds from 6610f66c are reverified at exact/empty/over-limit boundaries (R58 already addressed).
+
+Live selected reveal identity includes the bounded actual occurrence ancestor chain, not only its selected ID. Late parent adoption reopens the required ancestors once; manual collapse remains closed on passive snapshots. The visited-set guard avoids cyclic traversal. Late-parent/disclosure browser and all prior eviction/navigation tests pass.
+
+Final local/build/types/Biome/browser/Pi smoke/root check were rerun. Root-test inputs remain unchanged since the passing 7,676-test full gate and that evidence is reused. Guides/audits: AGENTS.md / docs/extension-conventions.md, complete display-ID/classification and live ancestry ownership. Existing release integration/provider/desktop/transport limits remain unverified.
+
+## Final-refresh R49–R56 fixes
+
+Native ancestry always validates structural IDs/parents/roles/cycles/budgets, while selected context edits and native projected message envelopes are validated after compaction/edits. Only the newest checkpoint contributes messages; obsolete malformed checkpoints/content no longer suppress valid descendants. Previous malformed context is explicitly unavailable without disabling valid current context. Structural corruption remains fenced.
+
+Same-ID/same-anchor occurrence multiplicity fences transcript association, including descendants; different completed anchors remain independent. Live hierarchy retains raw parent IDs after parent eviction, and still-captured calls with anchors omitted from the bounded node inventory retain captured details with an explicit unavailable navigator target. No fake fallback source or Pi leaf mutation is introduced.
+
+Privacy tests cover exact AWS secret-access-key forms and preserve public accessKeyId/metric fields. Raw message/system/edit content arrays are bounded before scans. Skill evidence uses indexed paths, explicit recorded success, per-assistant unambiguous read IDs, at most 2,048 scanned evidence items/256 results and bounded user text. Incomplete traversal is flagged rather than claiming completeness; unknown outcomes are not successes.
+
+Native compaction/edit/cycle/array boundaries, same/different-anchor/descendant correlation, credential/outcome tables and evidence caps pass; browser tests cover evicted raw parent display and >10,000-node anchor omission. Guides: AGENTS.md / docs/extension-conventions.md. Audit includes all semantic/structural selection branches, raw/preview separation, prefix stability, cache/scroll ownership and lifecycle cleanup. Existing release-gate integration/paid-provider/final-transport/desktop limitations remain unverified; no dispatch or new settings/packages.
+
+## Concurrent push-trigger CI repair
+
+User commit 4068d169 arrived during root validation, replacing the previously repaired trigger. The failed root policy assertion is independently reproduced. Its push trigger is preserved; the release job uses push/manual identities and checks out github.sha. Before dependency scripts/publication, a readonly GitHub API gate waits for the newest exact-SHA main push CI run to succeed; absence/pending waits, terminal failure/unknown response/HTTP error/timeout refuses publication. Polling and request/step deadlines are bounded; tokens are never logged. Manual dispatch remains the explicit bypass, as before. Deterministic gate-state tests and workflow-order code audit cover the classes without dispatching/publishing. User commit 40bf25d3 committed/pushed the fixes and removed the obsolete separation test; publication is reused, and that test is not recreated. Live main-push gate integration remains unverified because PR CI does not invoke publication.
+
+## Ninth-review historical tool and live identity budgets
+
+R47 adds a 2,048 cumulative addition/removal budget across each current/previous projection, with per-array size rejection before shape scanning. Added name/description/parameter metadata and removed names share the 1 MiB input-character budget; declaration traversal stops at 16,384 nodes/depth 32, without serialization or terminal sanitation of oversized inputs. Ordinary/checkpoint, repeated/removed names, cumulative/previous-only, metadata/array bounds and accepted native ordering are tested; mocked native helpers must remain untouched on failure. Bounded Raw diagnostics remain available.
+
+R48 validates all start/update/end admissions before lookups or argument/result capture. Invalid own IDs or tool names are rejected, never truncated/replaced, and an additive invalidCallEvents count publishes unavailable correlation in the live drawer. Invalid parent IDs are omitted and fenced against later adoption, including active records and throttled updates; invalid anchors become null with unavailable correlation. Only finite non-negative native durations are published. Exact 512-character boundaries, malformed classes, immutable inputs, all snapshot/feed cache paths and browser/HTTP rejection summaries are tested. Prefix, async session ownership and lifecycle cleanup are unchanged.
+
+Applicable guides: AGENTS.md and docs/extension-conventions.md; audit covers every native tool replay call, current/previous/compaction projections, all published live string/numeric fields, cache/SSE notification and parent correlation fences. No settings/dependencies/package/release changes; existing paid-provider/desktop/final-transport limits remain. Final command totals above apply.
+
+## Eighth-review merged-base CI and replay/reveal budgets
+
+Integrated accepted main a5f24bd6 without changing its package implementations. Preserved .node-version, npm ci and installation-policy checks; restored publish's workflow_run trigger to align with its success/push condition, exact-tested-revision checkout and existing policy test. No release dispatch/publication. Use the pinned Node toolchain and bundled npm via fnm exec; preflight/install and Kit resolution verified without bypassing policy. Merged-base root gates, including release/install policy tests, are required rather than relying on the prior old-base local pass.
+
+R45 reveal identity includes selected ID, serial and reveal ownership. A >300-row browser fixture excludes the late call's anchor, evicts the call, re-pages the same anchor into view under retained filters, and preserves manual pagination on a passive snapshot. Trace already keys explicit selection by serial; Live drawer has no reveal-ownership override or pagination, so unchanged ID-only expansion does not share this failure.
+
+R46 preflights current and previous native projected messages before every inspector system-message/prompt join. Ordinary and checkpoint system content, text-block counts/fragments, section names/values and overwritten/deleted input contribute to the cumulative 1,048,576-character input budget; no source is truncated or changed. Over-budget previews report unavailable; authenticated branch diagnostics/detail Raw remain bounded. Tests assert no native concatenating helper is invoked on budget failure, exact boundaries, valid preview truncation, previous-only overflow and discarded-history/native equality. All other-role content is excluded from system replay budgeting. Raw preview capture remains separately bounded.
+
+AGENTS.md and unchanged docs/extension-conventions.md audits cover complete native system replay sources, current/previous ownership, original-prefix equality, asynchronous lifecycle/cancellation and standalone Jiti loading. Existing paid-provider/final-transport/physical-desktop limits remain; no extension settings/package promotion. Commands/totals above apply to final merged-base validation.
+
+## Seventh-review checkpoint and selection fixes
+
+R42/R43 and native-audit finding R44 are recorded in REVIEW.md. Every stored system-message source was enumerated from sessionEntryToContextMessages: ordinary message entries normalize legacy missing/null content; compaction-owned checkpoints inject their message directly; custom/branch/compaction summaries contribute distinct non-system roles. Shared system-message.ts guards checkpoint content/sections/tool deltas without altering raw data, while ordinary system/user/assistant/toolResult missing/null normalization remains native-owned. Tests cover malformed and absent/falsy checkpoints, valid native prompt/tool equality, newest-checkpoint-only retention, all four legacy message roles and authenticated checkpoint/descendant raw routes.
+
+Snapshot selection is reconciled against represented IDs at async admission. Omitted entries fall back to a represented leaf/node with the current filter epoch; empty inventories clear selection/details; represented historical previews remain selected even when Pi moves its leaf. Browser fixtures exceed 10,000 entries and verify filtered fallback visibility in navigator/trace, retained search, represented preview stability and no inspector-driven leaf mutation. Validation commands and final totals above apply; the unchanged R1–R41/native-prefix/lifecycle suites are retained. Guides: AGENTS.md and docs/extension-conventions.md; audit covers projection sources/normalization, bounded membership, original payload preservation, async ownership and standalone Jiti imports. CI1 and pre-existing paid-provider/desktop limitations remain deferred/unverified; no package/settings/release or model-prefix transition.
+
+## Local directory rename
+
+The project-local directory is now `.pi/extensions/inspect/`; no package promotion, command or runtime behavior changes. All 63 tracked files moved: 59 implementation/test/config files are byte-identical, with only README/verification paths, Vitest discovery and the smoke auto-discovery directory updated. Root generated-path ignores and retained-plan links follow the new path; `/session-inspector` remains a compatibility alias.
+
+Against AGENTS.md and docs/extension-conventions.md, the final audit confirms local boundaries, relative imports, preserved default entrypoint/command ownership, no stale old-directory references and ignored generated outputs. New-path build/types/Biome, all 108 local tests, 39 Chromium tests, explicit/trusted-discovery/reload/replacement Pi smoke and both root gates passed (7,461 root tests, one existing skip). No new unverified runtime path or policy deviation is introduced; existing paid-provider/physical-desktop limitations remain unchanged.
+
+## Fifth-review remediation
+
+R23–R35 are independently confirmed in-scope defects, with evidence and dispositions in REVIEW.md. New local tests cover overlapping parent identities, retained descendants after eviction, malformed labels/session names/content/tool arguments/nested metadata, oversized IDs, late active-leaf reservation, prefixed credential redaction, bounded sanitized searches, zero idle getEntries calls on SDK managers with readonly-adapter fallback, and independent payload observations without false cache-warming turn attribution. Browser tests cover widened pane toggles, distant and case-only search/category resets plus preserved subsequent scroll, bounded paste ingestion, a leaf beyond 10,000 entries and independently labeled replay payloads. Existing native normalized-prefix, lifecycle/cancellation and R1–R22 regressions pass unchanged.
+
+Local build/types/Biome, 108 tests, 39 Chromium tests, explicit/discovery/reload/replacement Pi smoke and both root gates pass (7,461 root tests, one existing skip). The final virtual-reset-only adjustment is excluded from unchanged root test discovery; local/browser/Pi and root check are rerun. Semantic audit against AGENTS.md and docs/extension-conventions.md covers every touched source/identity/search/parent traversal, public SDK count method fallback, immutable bounded raw evidence, pane/scroll/focus ownership and independent observation disposal. No settings, dependency, package or release changes.
+
+GitHub run 37786510345 failed the unrelated release-workflow assertion: main commit 02f99c9a changes publish.yml to push while test/check-test-separation.test.ts still requires workflow_run. Neither file is changed by this PR. CI1 is deferred with a recommendation for a separate workflow/test alignment PR; no incident or scope-expansion justification exists. Paid-provider/physical desktop/OS paths remain unverified as before.
+
+## Context Composition revision
+
+The reference at https://sharex.narumi.dev/2026/10/08/rbVPWFceZphkJIJo.png defines the new primary off-white single-column composition. Screenshot evidence: `test-results/composition-reference-comp-2b550-content-and-explicit-source/context-composition-reference.png` and the adjacent mobile-dark screenshot, both ignored generated artifacts. The reference and rendered desktop/mobile images were inspected: role-colored rows, inline two-column metadata/content, collapsed advanced disclosures, muted fonts/surfaces and a narrow colored minimap replace persistent dashboard panes.
+
+Public Pi runtime inspection verifies context_with_system runs after context handlers and Pi state restoration but before possible later handlers/provider conversion. Consent-gated handlers only copy bounded data and return undefined; real Pi normalized enabled/disabled request prefixes still match. The fallback is native active-leaf projection, explicitly session-derived. Assistant thinking/text/toolCall blocks stay in source order, repeated contents have independent stable identities, signatures/secrets are sanitized before summaries, and no usage count is relabeled as segment tokens. Lifecycle tests verify pre-consent silence, immutable copies, replacement disposal and raw provider-payload redaction.
+
+Browser regressions verify secondary legacy functionality, source labels, independent disclosure/filter/navigation, nested JSON, dark/mobile overflow, minimap navigation, keyboard traversal across virtual windows, 2,000-message variable-height rendering with fewer than 50 mounted rows, and an older scroll anchor surviving tail append. Every ResizeObserver is disposed and cached measurements are pruned when source IDs disappear. Final local build/types/Biome, 76 local tests, all 35 Chromium tests, explicit/trusted-discovery/reload/replacement Pi smoke and both root gates passed before signed implementation `20446e07` was pushed to PR #1510. Root tests passed 7,461 cases in 542 files with one existing skip; existing unrelated Biome warnings remained non-failing. Semantic audit covered public capture-stage equivalence, normalized prefixes, privacy/truncation, immutable read-only data, source identity/order, virtual-scroll/focus ownership and observer disposal against root AGENTS.md and docs/extension-conventions.md. Settings, package promotion, new dependencies and publication remain out of scope. No paid-provider smoke was run; later hook stages/final transport payload, uncaptured content and segment token sizes remain unavailable rather than guessed.
+
+## Progressive Explorer revision
+
+The latest authorized redesign makes the center the primary developer surface: compact horizontal actual-parent rows, independent selection/disclosure, retained descendants, inline Overview/Content/Raw/Metadata, recursive object/array disclosure, and a collapsed live drawer. The metrics panel is now a small toolbar; heavy per-section blue framing and repetitive recorded-status badges were removed. Desktop sides resize/collapse, while constrained viewports use accessible Radix Dialog drawers.
+
+Current generated Chromium artifacts (ignored) are `test-results/browser-compact-desktop-la-5d1fe-ew-JSON-copy-and-screenshot/session-explorer-desktop.png` and `test-results/browser-medium-narrow-and--04553-wers-without-page-scrolling/session-explorer-narrow.png`. Both were inspected after disabling screenshot-time animations. The 1115×627 layout is an effective 150% CSS-viewport surrogate for 1672×941, not a claim that native desktop Chrome zoom controls were automated.
+
+Acceptance coverage includes three-plus actual nesting levels, sibling/orphan/cycle preservation, collapsed-parent descendant restoration, independently controlled selection, synchronized related navigation even outside filters, ArrowUp/Down/Left/Right/Enter/Space, retained JSON expansion, non-wrapping labels/tabs, pointer/keyboard resize and Escape cancellation, drawer focus trapping/restoration, scrolling only the owned panel, four-request concurrency and cancellation, 64-entry detail caching, compact empty live state and no auto-opening on updates. Existing public native codemode/post-transform/cancellation/reload/shutdown and redaction/CSP coverage remain.
+
+Public execution events expose monotonic `durationMs` but no start/end timestamp. The collector therefore records explicitly named callback-observation wall-clock times, only for events actually seen. List remains default; log entries are points and live observed intervals use a shared axis. Tests verify start/end provenance, end/update-only records, running calls, reversed clocks, equal-time points and unchanged native durations. No inferred model/provider span is introduced. Source UI/async audit covers API queue abort listeners, immutable own-node projection cache keys, clipboard feedback guards, resize listener disposal, media listener cleanup, Radix focus ownership, and additive non-model metadata.
+
+## Earlier screenshot-form revision (superseded interaction model)
+
+The earlier UI was changed to the supplied screenshot\'s structure rather than merely recolored: top session bar, left tree/filter cards, wide center overview and expandable trace table, right event inspector with Formatted/JSON, and bottom connection bar. A rendered 1672×941 Chromium screenshot was inspected against the reference; the generated artifact is `test-results/browser-screenshot-form-la-98bd7-ON-filters-and-bounded-copy/session-inspector-desktop.png` under the local extension (ignored).
+
+New browser coverage verifies column proportions, overview/trace/inspector regions, Expand all/Collapse all, Timeline/List, Formatted/JSON, copy success/denial, category/error/slow filters and the 1,000-line preview cap. Existing coverage still verifies search/keyboard, light/narrow layouts, malicious payloads, real native codemode/cancellation/reload/shutdown and lazy details. New deterministic metadata coverage verifies recorded usage, absent legacy usage/model fields, tool-result provenance and raw-history preservation.
+
+Metrics intentionally differ from the mockup where data is unavailable: recorded timestamp span is not execution time; assistant-message count is not provider request count; tokens include only persisted assistant usage; errors count the bounded live collector; unavailable model durations/latency remain `—`. File-parent branch order and live execution-parent relationships are not merged into a fictitious execution graph. Clipboard output is a bounded redacted display copy, and feedback is guarded after component disposal. No new Pi hooks, settings, dependencies or model-visible prefix transitions were introduced.
+
+## Semantic audit
+
+Applicable guides: root `AGENTS.md`, `docs/extension-conventions.md`, and `docs/extension-settings.md` (persistent settings are not implemented).
+
+- **Boundary:** All implementation, browser source, build helper, tests, configs and documentation are local to `.pi/extensions/inspect/`. Root changes are limited to frontend/test development dependencies, their lockfile, and generated-path ignores. No workspace, package manifest, Changeset, shared TypeScript configuration, root test support, root script or root extension registration was added.
+- **Read-only contract:** Actual model-visible inputs are identical in enabled and disabled inspector sessions after excluding non-model metadata. Consecutive requests preserve the earlier normalized prefix. Activation does not alter prompt, messages or ordered active tools. Browser previews leave the Pi leaf unchanged.
+- **Data provenance:** Pi AI replay and Pi projection helpers own prompt/tool/context reconstruction. Direct, parallel nested, permission-blocked, schema-invalid, unknown-tool and cancelled calls are represented without inventing child transcript entries. Live results are observed after result transformation; historical nested metadata is not mistaken for saved results. Unknown/legacy data and missing system checkpoints remain explicit.
+- **Lifecycle:** Consent receives an owned abort signal. Startup reads/listening and the opener task are cancellable. Ownership is revalidated after awaits, including overlapping lifecycle boundaries. Resources are keyed by session manager rather than UI. Stop/reload/replacement/shutdown revoke serving resources, while browser effects cancel stale fetches/readers/timers. Tests cover partial startup, failed startup/retry, cancelled consent, stale launch, repeated activation, two managers sharing a UI, native SSE socket closure, real reload token rotation, and real runtime disposal.
+- **Security:** Authentication includes constant-time equal-byte-length token comparison and generation checks. Host/Origin/method validation, malformed URLs, path traversal, client/socket limits and SSE backpressure have tests. Display traversal is bounded and does not evaluate object accessors; source entries/events are unchanged. Raster formats are allowlisted; SVG and oversized payloads are omitted, Markdown/HTML is literal, CSP and browser tests prove no remote requests or script execution.
+- **Compatibility:** Entrypoint loading and public APIs are exercised through the manifest-selected Pi runtime and CLI resource loader. No implementation imports another extension or its private structures. Discovery/model-helper results and transport bytes are not claimed to be observable.
+- **Recovery:** No settings or trace files are created. Failed activation can be retried; reconnect fetches a fresh snapshot. No session-file rewrites, migrations, uploads or release operations occur.
+
+## Scope decisions and unverified paths
+
+The default command is intentionally a frequent single action, with `stop` for deterministic cleanup rather than a manager menu. The Navigator remains a compact collapsible navigation list, while the Trace Explorer exposes actual levels, selected/expanded states and tree keyboard semantics. Existing capture/index bounds remain; hierarchy depth is not capped by the UI. Markdown/code are rendered as literal text rather than enabling rich HTML. These choices are documented in the README.
+
+Headless Chromium and actual Pi SDK/RPC runtimes were exercised. A physical interactive terminal and the user's default desktop browser opener were not launched by automation; OS-specific macOS/Windows opener behavior remains unverified. The public dialog/notification contract and cancellation/fallback paths are covered by deterministic tests. No live paid provider or real external MCP server was used: native codemode and namespaced tool fixtures cover their public tool pipeline without external side effects.
+
+`npm install` reports five existing dependency advisories (three high, two critical) in the Pi/concurrently dependency trees. No existing package version changed, and no force audit fix was applied; unrelated dependency maintenance is outside this change. Package packing, publication and release smokes are not applicable to a project-local extension.
+
+The saved implementation plan remains until user acceptance of the first-version behavior and documented limitations; automated verification is not a substitute for that acceptance.

package/docs/viewer.md

@@ -0,0 +1,63 @@
+# Viewer reference
+
+Detailed views, data provenance, bounds and security for `pi-inspect`.
+
+## Views and data provenance
+
+**Context composition is the primary view.** A warm off-white document layout uses muted, consistent system/developer, user, assistant, tool-call, tool-result and neutral colors. Each ordered message or supported content block is an expandable row; assistant thinking/text/tool calls remain distinct. Desktop details place source metadata beside content, with lightweight structured/metadata/raw accordions. Copy acts on captured display data; the raw message and original role remain available. Missing segment token sizes are explicitly unavailable: persisted assistant totalTokens is usage, not the size of an individual context block.
+
+A narrow right-hand minimap summarizes the same filtered segment sequence in up to 160 contiguous buckets, with category proportions and the actual viewport region. Clicking a bucket jumps/focuses its first segment. Variable-height virtualization renders the viewport plus five-row overscan on each side; measured heights and source-ID anchoring preserve older scroll while expanding or appending. Search covers available bounded captured message content, not uncaptured data. Category filters and source-mode navigation retain row expansion; keyboard ArrowUp/ArrowDown/Home/End navigate and Enter/Space or Left/Right control disclosure. Light is the default; dark and responsive inline details remain available.
+
+**Source distinction is explicit.** After consent, context_with_system observes Pi messages after conversation-only context handlers and prompt/tool restoration. It returns nothing and does not modify the event. The primary view labels this as the last observed Pi-stage context, including its leaf/time when available; later context_with_system hooks, provider conversion and payload hooks can still differ. The advanced provider-payload copy is an independently timestamped hook-stage observation, not a guaranteed final transport body. Public callbacks have no request identity proving turn ownership: cache-warming and retry bodies may appear, so they are never attributed to the context leaf or observation time. Until a request is observed, the native active-leaf projection is labeled session-derived, not exact model input. Compaction/context edits use native Pi semantics, not the full session log. Session events and execution events are never silently appended to context.
+
+**Session events** is a secondary source view retaining the existing actual-parent Trace Explorer and timeline. Navigator and Event Inspector are collapsed by default and open only on request; choosing a Navigator event switches to Session events without changing the Pi leaf; captured live calls remain in a compact closed drawer and its empty primary region is omitted. The Session Navigator handles search, filtering and concise hierarchy navigation; the Trace Explorer handles progressive inline log inspection; the Event Inspector shows complete bounded historical/debugging details. Desktop side panes are resizable with pointer dragging or focused-separator ArrowLeft/ArrowRight/Home/End, and can be collapsed. Pointer cancellation, Escape, blur and unmount release drag listeners. When the viewport or resized sides leave insufficient trace space, side panes become Radix Dialog drawers with focus trapping, Escape dismissal and focus restoration. Widths and view choices are ephemeral browser state, not saved settings.
+
+Log rows use actual `parentId` relationships; live execution rows use only `parentToolCallId`. They are never merged into a fictional execution graph. Filters retain actual ancestors, visibly marked as context; trace child counts are labeled visible counts, not persisted totals. Explicit related-entry navigation can reveal a selected entry outside the current filters without clearing them; changing filters ends that exception. Metadata-only navigation items do not print JSON snippets. Entry and session names are sanitized before the 512-character bound; truncation is labeled. Raw exposes the full bounded captured entry value without changing its source. Long labels remain one line with ellipsis and hover text.
+
+**List is the default Session events mode.** Clicking a trace row selects and toggles it; its chevron toggles without changing selection. Enter selects, Space toggles, ArrowUp/ArrowDown move focus, ArrowRight expands or enters a child, and ArrowLeft collapses or moves to the recorded parent. Multiple rows can be expanded. Collapsing a parent retains descendant expansion state. Selected, expanded and keyboard-focused states are distinct. Inline Overview/Content/Raw/Metadata panels lazily fetch full bounded entries, display recorded text/output and tool arguments, and expose collapsible JSON objects/arrays. Inspector and navigator selection stay synchronized without navigating Pi.
+
+Trace pages contain at most 50 visible rows; navigator pages contain at most 100. Paging, filtering and collapse retain one visible keyboard tab target; ArrowUp/ArrowDown can cross trace pages. Arbitrary hierarchy levels are supported with iterative traversal, not a depth cap. Long chains use page-local/scaled indentation while retaining absolute ARIA levels and original parent IDs. Initial selection reveals its ancestors without fetching every ancestor\'s details. Detail request failures are shown with an explicit retry for both the Inspector and inline sections; historical-branch request failures have a separate selected-branch alert/retry that survives live snapshot refreshes; unavailable historical data remains a separate display state. Inline loads use four concurrent requests and a 64-entry immutable historical-detail cache; collapsing/unmounting rows cancels their work. JSON object disclosure state is isolated by scope and retained within a bounded 128-scope cache; Inspector historical sections use entry-specific scopes. Existing ingestion depth/node/character bounds still apply; UI expansion cannot recover omitted data.
+
+Malformed entry/parent IDs, non-string type/role/timestamp fields and all duplicated entry identities are excluded from navigation without manufacturing replacement IDs. Duplicate ancestor/detail identities are explicitly unavailable rather than selecting the last indexed occurrence. The overview labels the count and exposes up to 20 indexed raw diagnostic samples, each bounded to 2 KiB-equivalent characters; source entries are unchanged. Invalid leaf identities cannot become a browser selection or captured transcript anchor.
+
+A session-owned structural index is rebuilt on structural changes and released on stop/replacement. Inline requests reuse it and project only their validated ancestor path, not every off-branch entry; valid context-edit/compaction replay remains the native Pi result.
+
+Before historical replay, ancestry is validated with a visited set and a 10,000-entry inspection budget. Recorded parent cycles, missing parents or a budget overflow keep the raw entry and original parent links visible but mark projection unavailable; the inspector never asks Pi to traverse those malformed paths or mutates the session to repair them.
+
+The compact overview distinguishes persisted entries, indexed assistant messages/tokens/log errors and captured calls. Recorded span is the indexed log timestamp range, not execution duration. Tokens are persisted assistant `totalTokens`, excluding compaction/auxiliary usage; inline input/output bars appear only when recorded usage supplies both values, with cache excluded explicitly. Missing metrics are omitted or neutral. No model durations, transport latency, p95 or request totals are invented.
+
+Each captured execution has a unique `occurrenceId`; `id` remains the provider/native raw tool-call ID. Repeated raw IDs retain separate history and occurrence-parent links. Transcript correlation requires the recorded owning-assistant anchor, not raw ID alone; overlapping invalid IDs are explicitly marked unavailable rather than assigning an ambiguous result. Evicting a selected occurrence returns selection to its remembered recorded anchor (or current leaf).
+
+Live calls occupy a collapsed bottom drawer, including when calls arrive. Opening it is explicit; its own scroll area shows parent-correlated records and allows selecting an execution in the Inspector. The navigation highlight then denotes that execution\'s recorded anchor entry, not a new transcript result.
+
+Timeline is an optional shared-axis view. Log timestamps are points, not duration spans. `observedStartedAt`/`observedEndedAt` are wall-clock samples taken on entry to this collector\'s actual start/end callbacks, after activation; their intervals are labeled observations, not provider transport timing. Public `durationMs` remains the separate monotonic time spent in `execute()`, absent if it did not run. Missing starts are never synthesized from durations; update/end-only, running or reversed-clock records do not become closed spans. Earlier callbacks or framework work can separate observation intervals from reported execution durations.
+
+The Inspector preserves Raw/Prompt/Tools/Context/Skills/Codemode, uses a non-wrapping horizontally scrollable tab strip, and disables inapplicable tabs consistently: Context is unavailable for non-transcript live events, Skills requires catalog/evidence, and Codemode requires recorded codemode source/output. It falls back to Raw if the selected tab becomes inapplicable. Structured metadata and object disclosure are the default; Raw JSON text is explicit. Data sections can be collapsed, and technical strings/JSON scroll horizontally rather than forcing page-wide overflow. The panel owns vertical scrolling, rather than stacking nested vertical code scrollers.
+
+| View | Available | Limitations |
+| --- | --- | --- |
+| Tree / transcript | Raw entries, roots, branches, labels, compaction, summaries, and unknown entry previews | Up to 10,000 nodes, reserving the active leaf and bounded real ancestry; 50 trace rows and 100 navigator rows per page |
+| Prompt | Historical replay through Pi AI helpers, sections, updates, previous-node diff; separate current runtime prompt | Older history may have no system checkpoint; current runtime changes may not have been sent yet |
+| Tools / MCP | Configured tool schemas, namespace, exposure, active/callable status; historical declared tools on selected branch | Active does not equal provider-visible; full MCP connection/auth/config state is unavailable |
+| Skills | Currently advertised catalog, explicit skill invocation, successful exact-path reads and persisted nested-read metadata | Relative/aliased reads may lack evidence; old catalogs and model compliance are unknown |
+| Context | Pi's compaction/context-edit projection and selected-entry contribution | Request-local hooks and provider adapters may transform it further; not a final HTTP request |
+| Codemode | Script source, final printed output, public persisted nestedCalls metadata, and live correlated child results | Historical child results are not saved by Pi; metadata can be incomplete |
+| Live calls | Parent IDs, bounded args/results, status, reported duration, observed callback timestamps, partial updates | Session-wide, not a selected-branch Promise dependency graph; running calls at settle become unfinished |
+
+Live results come from public `tool_execution_end` events, after the runtime's tool-result transformation pipeline (verified with a real nested call and a transforming hook). Partial updates are provisional. Unknown tools, schema failures, and permission blocks still have nested execution events. Direct transcript results remain authoritative persisted history. The inspector observes only: its context_with_system and before_provider_request handlers return nothing and never mutate messages or payloads; it registers no result-transforming handler.
+
+Codemode discovery helpers (`searchTools`, `describeTool`, `describeNamespace`, catalog helpers), sandbox local variables, and internal Promise scheduling are not normal child-tool events. `models.classify` and `models.generateImages` are also not normal nested tools: their complete input/output is unavailable unless printed. The generic Raw tab can show documented persisted metadata but the inspector never imports another extension or depends on private codemode implementation types.
+
+## Bounds and security
+
+- The server binds only `127.0.0.1` on a random port, checks Host and Origin, rejects cross-site requests and non-GET methods, and authenticates every data/SSE request with a random per-session token and generation.
+- The URL is at most 68 characters and printed on its own line for manual opening. Its fragment contains the full 256-bit token in Base64url, not a query or HTTP request; the data-free HTML supplies the public generation identifier. Legacy token/generation fragments remain supported. The browser keeps credentials in memory, attempts to save them in origin-scoped sessionStorage, and removes the fragment from history. Storage getter/read/write failures do not block a valid compact or legacy private URL; without saved credentials, fragment-free reloads require reopening from Pi. The launch notification necessarily contains the private credential URL for manual opening; it is not an API key. No request logs are written.
+- A data-free shell and bundled JS/CSS are publicly readable on that loopback port; session data requires authentication. There is no CORS grant, arbitrary file read, attachment path endpoint, or upstream credential/header/environment API.
+- Structured previews use native object/array disclosure. JSON text and plain content are literal with line numbers and bounded coloring (at most 1,000 lines and 512 colored tokens); long lines fall back to plain text. Copy acts only on the bounded redacted display value, including lines omitted by the local preview cap, and reports success or denial. Pending clipboard feedback is ignored after its owning component is disposed; the browser clipboard API itself cannot be aborted.
+- CSP blocks remote scripts, connections, frames, fonts, and images. Tool text and Markdown are shown literally, not as executable HTML. Only small validated PNG/JPEG/GIF/WebP base64 blocks can render as images; SVG, remote images, opaque signatures, and large image payloads are omitted. No filesystem attachment is opened automatically.
+- The collector keeps 128 records, at most 8 KiB-equivalent argument characters and 32 KiB-equivalent result characters per call, with depth/node limits. Tool schemas are bounded, inventory limits are 256 tools/skills, prompt/raw/projection fields are bounded to 64 KiB-equivalent characters, and evictions/truncation are visible. These are character/traversal budgets, not exact serialized-byte caps; JSON overhead adds size.
+- Context observation is consent-gated, in-memory and discarded on stop/replacement/reload/shutdown. It captures at most 4,000 segments, up to 8 KiB-equivalent characters per message and approximately 1 MiB-equivalent serialized message characters overall; provider-payload copies use 64 KiB-equivalent characters. Bounds, omitted content and source-stage limitations are labeled. Expanded Raw/Copy can reveal all captured text beyond local preview limits, but cannot recover content excluded by capture bounds.
+- SSE sends revision invalidations rather than result payloads. Notifications and intermediate partial copies are sampled/coalesced to at most one per 250 ms; final results are always captured. Live-only requests reuse the static snapshot rather than re-summarizing history. An owned 1-second reconciliation checks the public SDK entry count (when exposed), leaf/name and bounded public tool metadata for actions without extension change events, without rebuilding context projections or copying idle history on SDK managers. Readonly adapters lacking that public count method fall back to getEntries. At most eight stream clients and 32 sockets are accepted. A backpressured stream is closed, and reconnect triggers a fresh snapshot. Viewer-capacity responses (429), transient server failures and offline transport retry after one second. Snapshot request failures also retry with an owned one-second timer even when SSE is quiet; authentication/closed-session/generation responses do not retry. Authentication, closed-session, generation and protocol failures stop the connection and require reopening from Pi. Pending fetches, readers, reconnect timers, reconciliation/coalescing timers, browser-launch tasks, and session resources are cancelled on their owning boundary.
+- Tokens do not defend against a malicious process running as your local user. Redaction is not a secrecy guarantee. Do not expose the port remotely or assume this is a multi-user service.
+
+Entry IDs, parent IDs, timestamps and tool-result IDs over 512 characters are rejected, not truncated; malformed labels, session names, assistant/tool-call envelopes and context-edit replacements remain bounded raw diagnostics. Missing or empty session names preserve Pi’s title-clear semantics. Ordinary message entries retain Pi’s legacy missing/null-content normalization; checkpoint-owned system messages use strict replay validation. Historical current/previous system replay is preflighted against a cumulative 1 MiB input-character budget before native concatenation; over-budget previews are explicitly unavailable while bounded Raw evidence remains accessible. Tool replay also allows at most 2,048 cumulative additions/removals, with declaration traversal bounded to 16,384 nodes and depth 32 inside the shared character budget. Live own IDs and tool-name inputs must be non-empty strings of at most 512 characters; rejected events are counted as omitted with unavailable correlation, not rewritten. Invalid parent IDs and anchors are omitted with explicit unavailable relationships. When a bounded refresh omits a selected entry, the preview falls back to a represented entry without moving Pi’s leaf. Credential classification includes camelCase/acronym suffixes without masking metric keys. Search queries strip terminal controls before a 512-character bound and normalize once per filter update. Responsive mode depends only on viewport width, with side widths constrained to preserve the central workspace. Explicit filter resets start at the source top even when the matching IDs do not change.