@timurproko/a1 0.1.8-dev.290 → 0.1.8-dev.322

package/dist/integrations/pi/tui-runtime/damage-aware-terminal.d.ts

@@ -12,6 +12,12 @@ export interface PiTuiDamageFrameDescriptor {
         readonly rowStart: number;
         readonly rowEnd: number;
     } | null;
+    /**
+     * Visible rows owned by the block that is currently streaming. A live block repaints
+     * every row it owns when it reflows, so the allowed damage follows the declared tail
+     * instead of assuming a one-row tail.
+     */
+    readonly liveTailRows?: number;
     readonly verticalShiftRows: number;
     readonly safeVerticalShift: boolean;
     readonly cause: string;
@@ -34,6 +40,7 @@ export interface DamageAwareTerminalOptions {
     /** The shell supplies visible-row analysis; the terminal layer owns no UI parser. */
     readonly inspectHyperlinks: (content: string) => {
         readonly ranges: readonly unknown[];
+        readonly hasExplicitLink: boolean;
         readonly signature: string;
         readonly replaySafe: boolean;
         readonly width: number;

package/dist/integrations/pi/tui-runtime/damage-aware-terminal.js

@@ -204,10 +204,11 @@ export class DamageAwareTerminalAdapter {
             if (descriptor.dock !== null && row.row >= descriptor.dock.rowStart && row.row <= descriptor.dock.rowEnd)
                 painted.add(row.row);
         }
-        // Rationale: ordinary followed prose may change one active tail source row, expose
-        // the shifted suffix, and restyle one sticky boundary row. Larger changes indicate
-        // Markdown/theme/overlay reflow and fail closed.
-        if (painted.size > descriptor.verticalShiftRows + 2 + countDockRows(parsed.rows, descriptor.dock)) {
+        // Rationale: a followed frame may repaint the live tail it declares, expose the shifted
+        // suffix, and restyle one sticky boundary row. A frame that declares no tail keeps the
+        // historical one-row allowance. Anything beyond that reaches settled rows and fails closed.
+        const liveTailRows = Math.max(1, descriptor.liveTailRows ?? 1);
+        if (painted.size > descriptor.verticalShiftRows + liveTailRows + 1 + countDockRows(parsed.rows, descriptor.dock)) {
             return { ...base, reason: "excessive-real-damage" };
         }
         return {
@@ -252,7 +253,7 @@ export class DamageAwareTerminalAdapter {
         for (const [row, state] of this.#links) {
             if (region !== undefined && (row < region.rowStart || row > region.rowEnd))
                 continue;
-            if (state.ranges.length > 0)
+            if (state.hasExplicitLink || state.ranges.length > 0)
                 return true;
         }
         return false;
@@ -345,7 +346,7 @@ function hasUnsafeTerminalContent(parsed, inspect, linkRegion) {
         if (linkRegion !== undefined && (row.row < linkRegion.rowStart || row.row > linkRegion.rowEnd))
             return false;
         const state = inspect(row.content);
-        return !state.replaySafe || state.ranges.length > 0;
+        return !state.replaySafe || state.hasExplicitLink || state.ranges.length > 0;
     });
 }
 function buildDamageWrite(parsed, descriptor, paintedRows, previousRows) {

package/dist/native/darwin-arm64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "supported",
-  "builtAt": "2026-09-11T07:23:35.242Z",
+  "builtAt": "2026-09-12T11:45:08.507Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "9db1726bbe3fc2e8292f2ead1e7e9d0fd4d7d0dc9217b372582bf354b0f565dc",

package/dist/native/linux-x64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-11T07:23:38.591Z",
+  "builtAt": "2026-09-12T11:45:14.951Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "d8cda6b0c7cb36c0cc41e90802aceebf6c02eaebbc08a83d7d963d2e918dbd7a",

package/dist/native/win32-x64/manifest.json

@@ -5,10 +5,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-11T07:23:55.165Z",
+  "builtAt": "2026-09-12T11:45:38.237Z",
   "artifact": {
     "filename": "process-guardian.exe",
-    "sha256": "57d07c4be5d43295bb5af2ddafc482f8f79b47c7245c953222690b2e91d302fc",
+    "sha256": "ae2bf5d92411273a936b89376077bc13db6f73d16707a2bace8a8f048523891e",
     "size": 177664
   },
   "provenance": {

package/dist/product-identity.d.ts

@@ -1,9 +1,9 @@
-declare const ENVIRONMENT_KEYS: readonly ["certificationTarball", "configDir", "dataDir", "databasePath", "developmentInstanceId", "developmentRoot", "endpoint", "fixture", "fixtureInput", "fixtureToken", "inputAcknowledgement", "immutableWarmup", "internalPackaging", "launchProfile", "nativePi", "paneId", "piParityIntentionalMutation", "piPortRoot", "piSourceLedgerPath", "piSourceScanRoot", "probeTrace", "processGuardianPath", "profileHome", "protocolVersion", "releaseDigest", "releaseId", "releaseLayers", "releaseRoot", "releaseRunnerLabel", "runtimeDir", "structuredFlowLimits", "startupTrace", "terminalArgumentsJson", "terminalExecutable", "terminalSessionId"];
+declare const ENVIRONMENT_KEYS: readonly ["configDir", "dataDir", "databasePath", "developmentInstanceId", "developmentRoot", "endpoint", "paneId", "probeTrace", "processGuardianPath", "profileHome", "runtimeDir", "startupTrace", "terminalSessionId"];
 declare const FILESYSTEM_KEYS: readonly ["slug", "windowsDirectory", "unixDirectory", "temporaryPrefix"];
 declare const STATE_KEYS: readonly ["windowsControlDirectory", "unixControlDirectory", "developmentDirectory", "piAgentProfile", "piVanillaProfile"];
 declare const ENDPOINT_KEYS: readonly ["windowsPipeStem", "unixSocketFilename", "metadataFilename", "supervisorLogFilename", "databaseFilename"];
 declare const MANIFEST_KEYS: readonly ["releaseFilename", "packageFilename"];
-declare const PROTOCOL_KEYS: readonly ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "releaseCohortSchema", "updateJournalSchema"];
+declare const PROTOCOL_KEYS: readonly ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "promptHistorySchema", "releaseCohortSchema", "updateJournalSchema"];
 declare const EVIDENCE_KEYS: readonly ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema", "startupTraceSchema", "dependencyLayerSchema", "dependencyLayerCertificationSchema", "runtimePayloadSchema"];
 declare const ARTIFACT_KEYS: readonly ["cliEntry", "supervisorEntry", "guardianEntry", "uiEntry", "nativeExecutable", "nativeCrate", "processGuardianExecutable", "releaseTarballStem", "diagnosticStem"];
 type StringRecord<Keys extends readonly string[]> = {

package/dist/product-identity.js

@@ -1,46 +1,13 @@
 import rawIdentity from "./product-identity.json" with { type: "json" };
 const ENVIRONMENT_KEYS = [
-    "certificationTarball",
-    "configDir",
-    "dataDir",
-    "databasePath",
-    "developmentInstanceId",
-    "developmentRoot",
-    "endpoint",
-    "fixture",
-    "fixtureInput",
-    "fixtureToken",
-    "inputAcknowledgement",
-    "immutableWarmup",
-    "internalPackaging",
-    "launchProfile",
-    "nativePi",
-    "paneId",
-    "piParityIntentionalMutation",
-    "piPortRoot",
-    "piSourceLedgerPath",
-    "piSourceScanRoot",
-    "probeTrace",
-    "processGuardianPath",
-    "profileHome",
-    "protocolVersion",
-    "releaseDigest",
-    "releaseId",
-    "releaseLayers",
-    "releaseRoot",
-    "releaseRunnerLabel",
-    "runtimeDir",
-    "structuredFlowLimits",
-    "startupTrace",
-    "terminalArgumentsJson",
-    "terminalExecutable",
-    "terminalSessionId",
+    "configDir", "dataDir", "databasePath", "developmentInstanceId", "developmentRoot", "endpoint",
+    "paneId", "probeTrace", "processGuardianPath", "profileHome", "runtimeDir", "startupTrace", "terminalSessionId",
 ];
 const FILESYSTEM_KEYS = ["slug", "windowsDirectory", "unixDirectory", "temporaryPrefix"];
 const STATE_KEYS = ["windowsControlDirectory", "unixControlDirectory", "developmentDirectory", "piAgentProfile", "piVanillaProfile"];
 const ENDPOINT_KEYS = ["windowsPipeStem", "unixSocketFilename", "metadataFilename", "supervisorLogFilename", "databaseFilename"];
 const MANIFEST_KEYS = ["releaseFilename", "packageFilename"];
-const PROTOCOL_KEYS = ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "releaseCohortSchema", "updateJournalSchema"];
+const PROTOCOL_KEYS = ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "promptHistorySchema", "releaseCohortSchema", "updateJournalSchema"];
 const EVIDENCE_KEYS = ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema", "startupTraceSchema", "dependencyLayerSchema", "dependencyLayerCertificationSchema", "runtimePayloadSchema"];
 const ARTIFACT_KEYS = ["cliEntry", "supervisorEntry", "guardianEntry", "uiEntry", "nativeExecutable", "nativeCrate", "processGuardianExecutable", "releaseTarballStem", "diagnosticStem"];
 const ROOT_KEYS = ["schema", "displayName", "commandName", "packageName", "filesystem", "environment", "state", "endpoint", "manifest", "protocol", "evidence", "artifacts"];

package/dist/product-identity.json

@@ -10,40 +10,18 @@
         "temporaryPrefix": "a1-"
     },
     "environment": {
-        "certificationTarball": "A1_CERTIFICATION_TARBALL",
         "configDir": "A1_CONFIG_DIR",
         "dataDir": "A1_DATA_DIR",
         "databasePath": "A1_DATABASE_PATH",
         "developmentInstanceId": "A1_DEV_INSTANCE_ID",
         "developmentRoot": "A1_DEV_ROOT",
         "endpoint": "A1_ENDPOINT",
-        "fixture": "A1_FIXTURE",
-        "fixtureInput": "A1_FIXTURE_INPUT",
-        "fixtureToken": "A1_FIXTURE_TOKEN",
-        "inputAcknowledgement": "A1_INPUT_ACK",
-        "immutableWarmup": "A1_IMMUTABLE_WARMUP",
-        "internalPackaging": "A1_INTERNAL_PACKAGING",
-        "launchProfile": "A1_LAUNCH_PROFILE",
-        "nativePi": "A1_NATIVE_PI",
         "paneId": "A1_PANE_ID",
-        "piParityIntentionalMutation": "A1_PI_PARITY_INTENTIONAL_MUTATION",
-        "piPortRoot": "A1_PI_PORT_ROOT",
-        "piSourceLedgerPath": "A1_PI_SOURCE_LEDGER_PATH",
-        "piSourceScanRoot": "A1_PI_SOURCE_SCAN_ROOT",
         "probeTrace": "A1_PROBE_TRACE",
         "processGuardianPath": "A1_PROCESS_GUARDIAN_PATH",
         "profileHome": "A1_PROFILE_HOME",
-        "protocolVersion": "A1_PROTOCOL_VERSION",
-        "releaseDigest": "A1_RELEASE_DIGEST",
-        "releaseId": "A1_RELEASE_ID",
-        "releaseLayers": "A1_RELEASE_LAYERS",
-        "releaseRoot": "A1_RELEASE_ROOT",
-        "releaseRunnerLabel": "A1_RELEASE_RUNNER_LABEL",
         "runtimeDir": "A1_RUNTIME_DIR",
-        "structuredFlowLimits": "A1_STRUCTURED_FLOW_LIMITS",
         "startupTrace": "A1_STARTUP_TRACE",
-        "terminalArgumentsJson": "A1_TERMINAL_ARGUMENTS_JSON",
-        "terminalExecutable": "A1_TERMINAL_EXECUTABLE",
         "terminalSessionId": "A1_TERMINAL_SESSION_ID"
     },
     "state": {
@@ -71,6 +49,7 @@
         "nativeHostSchema": "a1-native-host-v1",
         "structuredAgentSchema": "a1-structured-agent-v1",
         "controlStoreSchema": "a1-control-store-v1",
+        "promptHistorySchema": "a1-prompt-history-v1",
         "releaseCohortSchema": "a1-release-cohort-v1",
         "updateJournalSchema": "a1-update-journal-v1"
     },

package/dist/ui/components/transcript-viewport.d.ts

@@ -24,6 +24,12 @@ export interface TranscriptViewportFrameInput {
     readonly paintDocumentRow?: (row: string) => string;
     /** Leading document rows that participate in pointer selection and copying. */
     readonly selectableDocumentRowCount?: number;
+    /**
+     * First document row owned by the block that is currently streaming, if any. Rows from
+     * here to the end of the selectable document reflow together whenever that block
+     * re-renders, so the frame can declare how much damage is legitimately its own.
+     */
+    readonly liveTailStartRow?: number;
     /** Final transient rows to bottom-align with unused viewport space while content fits. */
     readonly bottomAlignedTailRowCount?: number;
     readonly dockRows: readonly string[];
@@ -94,6 +100,8 @@ export interface TranscriptViewportFrameDescriptor {
     readonly transientAlignmentGapRows: number;
     /** Live status rows at the end of the transient suffix. */
     readonly bottomAlignedTailRowCount: number;
+    /** Visible rows owned by the currently streaming transcript block. */
+    readonly liveTailRows: number;
     readonly verticalShiftRows: number;
     readonly safeVerticalShift: boolean;
     /** Monotonic interaction revision used to reject stale selection evidence. */

package/dist/ui/components/transcript-viewport.js

@@ -358,9 +358,9 @@ export class TranscriptViewport {
         const frameRows = [...visible, ...dock].slice(0, height);
         let bottomHit = null;
         if (this.#maxScroll > 0 && !this.#followingEnd && frameRows.length > 0) {
-            const genericLabel = " Jump to bottom (End) ";
+            const genericLabel = " Jump to bottom (Ctrl+End) ↓ ";
             const countedLabel = this.#newMessages > 0
-                ? ` ${this.#newMessages} new message${this.#newMessages === 1 ? "" : "s"} (End) `
+                ? ` ${this.#newMessages} new message${this.#newMessages === 1 ? "" : "s"} (Ctrl+End) ↓ `
                 : genericLabel;
             const label = displayWidth(countedLabel) <= contentWidth ? countedLabel : genericLabel;
             const labelWidth = displayWidth(label);
@@ -406,6 +406,7 @@ export class TranscriptViewport {
             transientRowCount: Math.max(0, documentRows.length - this.#selectableDocumentRowCount),
             transientAlignmentGapRows,
             bottomAlignedTailRowCount,
+            liveTailRows: visibleLiveTailRows(input.liveTailStartRow, this.#selectableDocumentRowCount, this.#scrollTop, viewportHeight),
             verticalShiftRows,
             safeVerticalShift,
             selectionRevision: composingSelectionRevision,
@@ -480,6 +481,7 @@ export class TranscriptViewport {
             transientRowCount: previous.descriptor.transientRowCount,
             transientAlignmentGapRows: previous.descriptor.transientAlignmentGapRows,
             bottomAlignedTailRowCount: previous.descriptor.bottomAlignedTailRowCount,
+            liveTailRows: previous.descriptor.liveTailRows,
             verticalShiftRows: 0,
             safeVerticalShift: false,
             selectionRevision: this.#selectionRevision,
@@ -568,6 +570,18 @@ function trimCache(cache, limit) {
     while (cache.size > limit)
         cache.delete(cache.keys().next().value);
 }
+/**
+ * Rows of the streaming block that the visible window actually shows. Gap insertion happens
+ * after the selectable document, so live-block indices need no adjustment here.
+ */
+function visibleLiveTailRows(liveTailStartRow, selectableDocumentRowCount, scrollTop, viewportHeight) {
+    if (liveTailStartRow === undefined || !Number.isSafeInteger(liveTailStartRow))
+        return 0;
+    const start = clamp(liveTailStartRow, 0, selectableDocumentRowCount);
+    const visibleStart = Math.max(start, scrollTop);
+    const visibleEnd = Math.min(selectableDocumentRowCount, scrollTop + viewportHeight);
+    return Math.max(0, visibleEnd - visibleStart);
+}
 function governingPrompt(anchors, scrollTop) {
     let result = null;
     for (const anchor of anchors) {
@@ -611,6 +625,13 @@ export function assertTranscriptViewportFrameDescriptor(descriptor) {
         || descriptor.transientAlignmentGapRows + descriptor.bottomAlignedTailRowCount > descriptor.transientRowCount) {
         throw new TypeError("viewport frame descriptor transient geometry is invalid");
     }
+    const transcriptHeight = descriptor.transcript === null
+        ? 0
+        : descriptor.transcript.rowEnd - descriptor.transcript.rowStart + 1;
+    if (!Number.isSafeInteger(descriptor.liveTailRows) || descriptor.liveTailRows < 0
+        || descriptor.liveTailRows > transcriptHeight) {
+        throw new TypeError("viewport frame descriptor live tail is invalid");
+    }
     if (!Number.isSafeInteger(descriptor.verticalShiftRows))
         throw new TypeError("viewport frame descriptor shift is invalid");
     if (descriptor.previousDocumentRange === null && descriptor.verticalShiftRows !== 0) {

package/dist/ui/components/visible-hyperlinks.d.ts

@@ -6,6 +6,13 @@ export interface VisibleHyperlinkRange {
 }
 export interface VisibleHyperlinkRow {
     readonly ranges: readonly VisibleHyperlinkRange[];
+    /**
+     * Whether the row declares a terminal hyperlink of its own. Only a declared link gives the
+     * terminal per-cell link identity that moving the row can misattribute, so movement safety
+     * asks this rather than counting ranges: a candidate range is host-hover text such as
+     * `obj.method` or `./src/index.ts`, which ordinary code produces on nearly every row.
+     */
+    readonly hasExplicitLink: boolean;
     /** False for unclosed links, malformed escapes, images, or row-moving controls. */
     readonly replaySafe: boolean;
     readonly width: number;

package/dist/ui/components/visible-hyperlinks.js

@@ -55,6 +55,7 @@ export function readVisibleHyperlinks(line, widthOf = displayWidth) {
     ranges.sort((left, right) => left.from - right.from);
     return {
         ranges,
+        hasExplicitLink: ranges.some(range => range.kind === "explicit"),
         replaySafe,
         width: column,
         // Rationale: a path with spaces or a wrapped host match may extend beyond

package/dist/ui/settings/declarations.js

@@ -30,9 +30,28 @@ export const OWNED_UI_SETTING_DECLARATIONS = Object.freeze([
         defaultValue: "normal",
         allowedValues: Object.freeze(["normal", "fast", "high"]),
     }),
+    Object.freeze({
+        id: "promptHistoryEnabled",
+        label: "Persistent history",
+        section: Object.freeze({ id: "history", title: "History" }),
+        description: "Retain reusable prompts across sessions. Applies on next start; disabling does not erase saved history or stop existing instances.",
+        application: "restart",
+        defaultValue: true,
+        allowedValues: Object.freeze([true, false]),
+    }),
+    Object.freeze({
+        id: "promptHistoryMaxItems",
+        label: "History limit",
+        section: Object.freeze({ id: "history", title: "History" }),
+        description: "Maximum recent unique prompts after next start. Byte limits also apply; increasing the limit cannot restore pruned entries.",
+        application: "restart",
+        defaultValue: 100,
+        allowedValues: Object.freeze([10, 20, 30, 40, 50, 60, 70, 80, 90, 100]),
+    }),
     Object.freeze({
         id: "promptSuggestions",
         label: "Prompt suggestions",
+        section: Object.freeze({ id: "agent", title: "Agent" }),
         description: "Predict likely next prompts with one additional background request using the selected model.",
         application: "live",
         defaultValue: true,

package/dist/ui/settings/sections.js

@@ -25,6 +25,8 @@ export function buildOwnedUiSettingsSections(input) {
         });
         grouped.set(section.id, group);
     }
+    const ownedAgentEntries = grouped.get(AGENT_SECTION_ID)?.entries ?? [];
+    grouped.delete(AGENT_SECTION_ID);
     const ownedSections = [...grouped].map(([id, group]) => ({
         id,
         title: group.title,
@@ -32,7 +34,15 @@ export function buildOwnedUiSettingsSections(input) {
         unavailableReason: null,
         readOnlyReason: null,
     }));
-    return Object.freeze([...ownedSections, agentSection(input.agent)]);
+    const agent = agentSection(input.agent);
+    // Invariant: presentation grouping does not transfer ownership or engine availability to owned entries.
+    const combinedAgent = ownedAgentEntries.length === 0 ? agent : {
+        ...agent,
+        entries: Object.freeze([...agent.entries, ...ownedAgentEntries]),
+        unavailableReason: null,
+        readOnlyReason: null,
+    };
+    return Object.freeze([...ownedSections, combinedAgent]);
 }
 export function findOwnedUiSettingsEntry(sections, id, backend) {
     for (const section of sections) {

package/dist/ui/settings/session.js

@@ -10,12 +10,17 @@ export class OwnedUiSettingsSession {
     #resolution;
     #agentSnapshot = null;
     #pending = new Map();
+    #restartEffective = new Map();
     constructor(options) {
         this.#store = options.store;
         this.#agent = options.agent ?? null;
         this.#agentProvider = options.agentProvider ?? null;
         this.#hiddenAgentSettingIds = new Set(options.hiddenAgentSettingIds ?? []);
         this.#resolution = options.store.read();
+        for (const setting of this.#resolution.settings) {
+            if (setting.declaration.application === "restart")
+                this.#restartEffective.set(setting.declaration.id, setting.value);
+        }
     }
     get resolution() {
         return this.#resolution;
@@ -27,10 +32,15 @@ export class OwnedUiSettingsSession {
         this.#notify();
     }
     sections() {
-        return buildOwnedUiSettingsSections({ resolution: this.#resolution, agent: this.#agentSnapshot });
+        return buildOwnedUiSettingsSections({ resolution: this.#resolution, agent: this.#agentSnapshot }).map(section => ({
+            ...section,
+            entries: section.entries.map(entry => entry.backend === "a1" && this.#restartEffective.has(entry.id)
+                ? { ...entry, effectiveValue: this.#restartEffective.get(entry.id) }
+                : entry),
+        }));
     }
     value(id) {
-        return this.#resolution.settings.find(setting => setting.declaration.id === id)?.value ?? null;
+        return this.#restartEffective.get(id) ?? this.#resolution.settings.find(setting => setting.declaration.id === id)?.value ?? null;
     }
     pendingValue(id) {
         return this.#pending.get(id) ?? null;
@@ -61,9 +71,8 @@ export class OwnedUiSettingsSession {
         const previousSetting = previous.settings.find(setting => setting.declaration.id === id);
         if (previousSetting?.declaration.application === "restart") {
             this.#pending.set(id, value);
-            this.#resolution = previous;
             this.#notify();
-            return changed("deferred", "next-start", value, previousSetting.value);
+            return changed("deferred", "next-start", value, this.#restartEffective.get(id));
         }
         this.#pending.delete(id);
         this.#notify();

package/docs/architecture/boundaries.md

@@ -28,6 +28,8 @@ The owned Pi-backed surface is not an arbitrary-CLI terminal multiplexer. A feat
 - `structured-agent-runtime`: planned typed event/command/snapshot runtime. It must not infer semantics from terminal text, own pseudoterminals, or reconstruct screens.
 - `native-host-protocol`: bounded typed local boundary for terminal-host identity, topology revisions, lifecycle, and recovery. Terminal bytes, per-event child input, and rendered cells are forbidden across it.
 - `protocol`: additive control handshake, bounded line framing, authenticated launch-instance commands, typed stop intent, snapshots, and command results.
+- `launch`: resolves the effective profile home and the history-specific data root. Composition uses its public path resolver to select `~/.a1/data` for history unless `A1_DATA_DIR` is explicit; global control/release/runtime/cache paths stay unchanged.
+- `prompt-history`: narrowly typed user-input retention in separate profile-owned databases under `~/.a1/data/history` (or `<A1_DATA_DIR>/history`), with bounded worker queues and no supervisor/control-store payloads. It receives a resolved root rather than importing launch-feature internals; it never probes, imports, or deletes the former platform-default history. The editor's owned history state machine remains inside the Pi component boundary; the session UI only coordinates snapshots and classified submissions.
 - `storage`: SQLite migrations, prior-boot reconciliation, and plural launch-instance persistence. Legacy foreground rows are historical migration input and never authorize current ownership.
 - `supervisor`: endpoint identity, plural cohort ownership, per-instance reconciliation, and aggregate release shutdown coordination. It owns no terminal surface.
 - `pi-engine-adapter`, `pi-component-adapter`, `pi-tui-runtime-adapter`, and `pi-session-ui-integration`: isolate pinned Pi engine and presentation knowledge behind neutral contracts; product features do not import them directly. The session UI render root assembles semantic document and dock rows, while its focused viewport controller owns follow state, pointer routing, selection, and interaction timers. Owned-app route lifecycle belongs to the neutral `ui-apps` owner and is only hosted by the Pi session UI.

package/docs/architecture/history-editor-provenance.md

@@ -0,0 +1,96 @@
+# History editor source boundary
+
+The history-enabled default editor is derived from Pi 0.84.2 at commit
+`914cf1472e715297caa30db4b9535d534a9eb718`, repository
+<https://github.com/earendil-works/pi>. The approved scope is
+`openspec/changes/add-persistent-prompt-history/design.md`, decision 2a.
+
+## Source and import inventory
+
+The owning directory is `src/integrations/pi/components/upstream/history/`.
+
+| Owned unit | Upstream source under `packages/tui/src/` | Retained behavior |
+|---|---|---|
+| `editor-core.ts` | `components/editor.ts` | Editor state machine, layout, history boundaries, paste backing, autocomplete, undo integration |
+| `kill-ring.ts` | `kill-ring.ts` | Kill/yank accumulation and rotation |
+| `undo-stack.ts` | `undo-stack.ts` | Clone-on-push undo storage |
+| `word-navigation.ts` | `word-navigation.ts` | Word/atomic-segment navigation |
+| `text-helpers.ts` | selected declarations in `utils.ts` | Shared local segmenters, CJK break classification, punctuation/whitespace predicates only |
+| `printable-key.ts` | selected declarations in `keys.ts` | Pure modifyOtherKeys printable helper and modifier constants; delegates Kitty decoding to the public export |
+
+All reusable terminal APIs come from `#pi-tui`: keybinding state, `matchesKey`,
+`decodeKittyPrintable`, `CURSOR_MARKER`, width/slicing, `SelectList`, and public
+component/autocomplete types. No terminal runtime, parser stack, terminal
+renderer, package loader, or dependency copy is introduced. The terminal-package
+alias and exported constructors remain unchanged.
+
+`node scripts/pi/extract-history-editor-source.mjs` resolves the terminal package
+from pinned Pi's entry and extracts references and hashes into the ignored
+`.artifacts/history-editor-upstream/` directory. It never overwrites owned code.
+The source ledger records upstream and owned destination hashes. Source maps are
+used only by provenance tooling, not by the shipped runtime. Changed source must
+be explicitly reconciled, not automatically adopted in an engine upgrade.
+
+## Owned changes and collaborator boundaries
+
+The core uses public imports, a distinct `HistoryEditorCore` class, and strict
+TypeScript declaration adjustments. Persistent history is opt-in: its typed
+snapshot installation and observation methods preserve input and undo state,
+freeze an active browse cycle, and change caret placement only in that mode.
+The editor renders position/overflow in its existing border. The position label
+uses an injected neutral status-text style (`dim`), while the surrounding rules
+retain the active input-border color, as clarified during manual review. Recall temporarily
+separates the draft's live paste backing from recalled literal text, restoring it
+on return; ordinary pinned mode remains source-equivalent.
+
+The integration inventory is:
+
+- `shell-editor-autocomplete.ts`: choose the default editor through a typed
+  component interface, never cast the owned core to the concrete Pi editor.
+- `upstream/components/owned-editor.ts`: retain its pinned-based comparison and
+  disabled-history route; share app actions and owned prefix/suggestion behavior
+  through typed composition for the history-enabled route.
+- `owned-editor-ux.ts`: selection, atomic segmentation, visual-line geometry,
+  provisional paste completion, and undo repair need a typed owned collaborator
+  boundary. Existing compatibility access on the pinned route is not permission
+  for new private access on the owned core.
+- `shell-extension-ui.ts`: public text, shortcut, autocomplete, and factory
+  behavior remain extension-owned. A custom editor is not patched for recall.
+- `session-shell-root.ts` and `session-shell.ts`: deliver semantic snapshot and
+  submission events; they must not own a second history index, mutable draft,
+  undo stack, or rendered-border parser.
+
+`test/integrations/pi/components/history-editor-core.test.ts` independently runs
+real pinned and owned editors against the same input tapes, comparing rows,
+text/expanded text, cursor, autocomplete, and submissions. Separate fixtures
+cover v2 directional placement and numbering, deferred snapshots, draft/undo
+restoration, and literal paste-marker collisions. This is editor-core evidence,
+not acceptance of the complete persistent-history feature.
+
+## License
+
+Upstream license at the recorded commit:
+
+```text
+MIT License
+
+Copyright (c) 2025 Mario Zechner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/docs/architecture/internal-naming.md

@@ -0,0 +1,89 @@
+# Internal naming and private launch context
+
+Internal code names contain no case-insensitive `a1` substring. This includes constants, variables, parameters, functions, methods, classes, types, private fields, aliases, and quoted/constant-computed member names. Branding remains at supported external boundaries: the `a1` command, public package identity, user-visible text, user directories, public settings, and declared serialized fields.
+
+## Required PR validation
+
+The required **Internal naming validation** job scans complete added, modified, copied, and renamed-to files at the exact PR head against the complete merge-base diff. It does not inspect only changed lines. Policy, exception, ownership, parser-dependency, and selection changes require a full audit and inspector regression tests. A stale, missing, failed, or unexpectedly skipped required result blocks the aggregate development check.
+
+The nightly release workflow runs `full-release`, including `naming-full`, against the entire tracked codebase at its selected source commit. It does not use PR changed-file selection, including when it verifies an already-published immutable package. Naming failure fails platform validation and blocks publication. `naming-selection.test.ts` locks down this nightly wiring and checks that unchanged source is audited.
+
+- Full local audit: `npm run check:names` (tracked files, including staged new files).
+- Exact selected PR audit: `npm run check:names:changed` after producing `.artifacts/validation/impact.json`.
+- Evidence: `.artifacts/validation/naming.json`, uploaded as `development-naming-validation`.
+- Parser fixtures: `test/repository-governance/naming-inspection.test.ts`.
+- Git selection fixtures: `test/repository-governance/naming-selection.test.ts`.
+
+TypeScript/JavaScript and Python use syntax trees. Rust uses a token-aware scanner. Workflow environment maps, embedded Node scripts, JSON environment definitions, and supported shell assignments are inspected. Dependencies, immutable vendor files, generated output, and other worktrees are excluded; owned test helpers and locally adapted source ports are not. Unsupported owned inputs fail explicitly. Python inspection uses a bundled development-only grammar, not an installed Python interpreter.
+
+The exact externally branded key/member authority is `config/internal-naming-policy.json`. It records each setting's owner, evidence, exposure, and value semantics. Arbitrary uppercase properties are not public environment settings. No compatibility-alias exposure category is allowed. Test snippets and negative-test input data are not declarations or supported aliases.
+
+## Environment ownership inventory
+
+### Supported branded external settings
+
+| Keys | Producer / consumer and exposure |
+| --- | --- |
+| `A1_CONFIG_DIR`, `A1_DATA_DIR`, `A1_RUNTIME_DIR`, `A1_DATABASE_PATH`, `A1_ENDPOINT` | User/shell configuration consumed by `src/foundation/lifecycle/paths.ts`; documented public overrides, unchanged. |
+| `A1_PROFILE_HOME` | Caller-supplied profile-home override consumed by `src/features/launch/profile-paths.ts`; exact existing exposure-review entry. |
+| `A1_STARTUP_TRACE` | Caller-supplied diagnostic path and trace context in `src/foundation/startup/startup-runtime.ts`; exact existing exposure-review entry. |
+| `A1_DEV_INSTANCE_ID`, `A1_DEV_ROOT` | Caller-supplied development overrides consumed by `src/features/launch/development-launch.ts`; exact existing exposure-review entries. |
+| `A1_PROCESS_GUARDIAN_PATH` | Explicit executable override in `src/foundation/process-containment/native-guardian-containment.ts`, also configured by CI; exact existing exposure-review entry. |
+| `A1_PROBE_TRACE` | Opt-in diagnostics read by native terminal-host code; exact existing exposure-review entry. |
+| `A1_BUILD_VERBOSE`, `A1_DEV_SHELL` | Developer invocation controls in the build helper and development launcher; exact existing exposure-review entries. |
+| `A1_PANE_ID`, `A1_TERMINAL_SESSION_ID` | Produced by `native/terminal-host/src/workspace.rs` and exported to launched programs; external integration names, unchanged. |
+
+Pending review preserves a possible external interface, not an obsolete private alias. Once a setting is established as private, it cannot keep its branded spelling through that category.
+
+### Current private settings
+
+| Keys | Producer / consumer and value semantics |
+| --- | --- |
+| `LAUNCH_CONTEXT_RELEASE_ROOT`, `LAUNCH_CONTEXT_RELEASE_ID`, `LAUNCH_CONTEXT_RELEASE_DIGEST`, `LAUNCH_CONTEXT_RELEASE_LAYERS` | Release bootstrap writes the selected verified immutable identity; supervision, guardian, and startup/cache readers consume it. Layers are comma-separated and can be empty. |
+| `LAUNCH_CONTEXT_PROFILE` | Bootstrap or the development launcher writes the selected `a1`/`pi` profile; guardian and UI entries consume it. |
+| `LAUNCH_CONTEXT_WARMUP` | Release warmup writes exactly `1`; the private warmup entry requires it together with release context. |
+| `RELEASE_CLEANUP_HOLDS`, `RELEASE_CLEANUP_RUN_ID` | Cleanup scheduler/worker handoff in `src/foundation/release/release-gc.ts`; serialized holds and a worker run identity. |
+| `SOURCE_LEDGER_PATH`, `SOURCE_LEDGER_SCAN_ROOT`, `SOURCE_LEDGER_PORT_ROOT` | Source-ledger governance fixture overrides; produced by its tests and consumed by `check-pinned-pi-source-ledger.mjs`. |
+| `RELEASE_RUNNER_LABEL` | Release/full-regression workflows supply certification-runner provenance to `run-release-gates.mjs`. |
+| `TERMINAL_FIXTURE_INPUT`, `TERMINAL_FIXTURE_TOKEN` | Native terminal probe producer/consumer in `native/terminal-host/src/main.rs`; expected input and fixture token. |
+| `DOCS_AUTO_MERGE_POLL_ATTEMPTS`, `DOCS_AUTO_MERGE_POLL_MS` | Documentation automation polling controls, produced by governance tests and consumed by `manage-documentation-auto-merge.mjs`. |
+| `VALIDATION_JOB_STARTED_MS`, `RENDERING_JOB_STARTED_MS` | CI timing handoffs within `.github/workflows/ci.yml`; epoch milliseconds. |
+| `RUN_PROCESS_CONTAINMENT_INTEGRATION` | CI enables the real containment fixture with exactly `1`; platform containment tests consume it. |
+| `PACKAGE_MESSAGE_SCENARIO` | Package-message worker parent/child JSON scenario handoff. |
+| `RECOVERY_TEST_CANCEL_AFTER`, `RECOVERY_TEST_REMOVAL_MARKER` | Recovery test parent/fake-npm handoff; mutation index and disposable sentinel path. |
+
+The private launch contract is `neutral-launch-v1`, declared by the package's `privateLaunchContract` metadata and bound into immutable release identity. It is validated before activation or execution. There is one reader/writer and no mapping from obsolete private names.
+
+### Existing neutral automation and third-party boundaries
+
+These names are already neutral; their definitions and consumers remain the authority for their existing behavior:
+
+- Development aggregate: `CHANGES_RESULT`, `DOCS_RESULT`, `DOCUMENTATION_RESULT`, `DOCUMENTATION_REQUIRED`, `VALIDATE_RESULT`, `CONTAINMENT_RESULT`, `STARTUP_RESULT`, `RENDERING_RESULT`, `RENDERING_TIER`, `DOCS_ONLY`, `VERSION_ONLY`, `OPENSPEC_TOUCHED`, `SELECTED_HEAD`, `EXPECTED_HEAD`, `EVENT_BASE_SHA`, `EVENT_HEAD_SHA`. The workflow produces these and `require-development-validation.mjs` or the selector consumes them.
+- Naming aggregate: `NAMING_RESULT`, `NAMING_REQUIRED`, `NAMING_HEAD`, produced by CI and consumed by the same required aggregate.
+- Validation: `VALIDATION_BUILD_READY`, `VALIDATION_CANDIDATE_TARBALL`, `VALIDATION_DOCUMENTATION_FULL_READY`, `VALIDATION_SELECTION_JSON`, `STARTUP_PERFORMANCE_RESULT`, owned by validation orchestration and exact-package fixtures.
+- Publication workflow-local handoffs: `BUILD`, `EVENT_NAME`, `EXISTS`, `EXPECTED_INTEGRITY`, `EXPECTED_REGISTRY_INTEGRITY`, `EXPECTED_REGISTRY_SHASUM`, `EXPECTED_SHASUM`, `MODE`, `PACKAGE`, `PLAN`, `PUBLISH`, `PULLS_PATH`, `PULL_REQUEST`, `REGISTRY_TARBALL`, `RELEASE_CHANNEL`, `RELEASE_VERSION`, `REQUESTED_CHANNEL`, `REQUESTED_SHA`, `SOURCE_SHA`, `VALIDATE`, `VERSION`, `WORK`, defined and consumed in `.github/workflows/release.yml`.
+- Isolated fixture controls: `PROMPT_SUGGESTION_AGENT_DIR`, `RUN_PROMPT_SUGGESTION_PROVIDER_TEST`, `TEST_SUPERVISOR_SECRET`, owned by their specific provider/supervisor tests.
+- Host/tool integration: `CARGO`, `ZIG`, `PATH`, `HOME`, `USERPROFILE`, `APPDATA`, `LOCALAPPDATA`, XDG directory variables, `TERM`, `COLORTERM`, `TERM_PROGRAM`, `WT_SESSION`, `EXEPATH`, `MINGW_PREFIX`, `MSYSTEM`, and third-party `PI_*`, `GITHUB_*`, `GH_TOKEN`, and npm variables. Their external spellings and caller values are not private product naming targets. The forwarding of an arbitrary user's environment is distinct from defining an owned setting.
+
+### Removed or reclassified registry entries
+
+The old environment registry included `fixture` and `inputAcknowledgement`, but their values describe native probe stdout markers, not environment settings. Their existing external wire spellings stay in that protocol, not in the public environment registry.
+
+`certificationTarball`, `internalPackaging`, `nativePi`, `piParityIntentionalMutation`, `protocolVersion`, `structuredFlowLimits`, `terminalArgumentsJson`, and `terminalExecutable` had no active runtime consumer in the reviewed tree. They are removed from the current environment authority, not renamed into new settings. Rejection patterns and immutable historical evidence remain factual.
+
+## Clean cutover and protected state
+
+The first new-contract installation is intentionally not an old-to-new `a1 update` path. Stop existing A1 sessions, supervisors, and workers first. Install the **accepted published version** explicitly with `npm install --global @timurproko/a1@<accepted-version>`; the implementation/release handoff must replace the placeholder with the actual accepted version. Do not execute an old recovery launcher to bridge the cutover.
+
+Old-contract targets are rejected with a cutover diagnostic. No reset or migration runs automatically. If disposable state blocks installation, inspect its resolved paths and obtain separate approval before removal. A supported rollback must also use `neutral-launch-v1`; no eligible target means an explicit unavailable rollback, not a fallback to older code.
+
+| State | Treatment |
+| --- | --- |
+| `<configDir>` and its settings | Preserve. |
+| `~/.a1/agent`, credentials, extensions, and session files | Preserve. |
+| Prompt-history databases under the selected data/history owner | Preserve; this change does not relocate history. |
+| `<dataDir>/releases`, release references/certification records, `<dataDir>/update-recovery`, update journal | Disposable runtime/release candidates only; inspect exact paths and live ownership before any separately approved manual reset. |
+| `<runtimeDir>` endpoints, locks, and worker records | Reset candidates only after all affected processes stop and their precise scope is confirmed. |
+| The whole `<dataDir>` or `<configDir>` | Never delete as a shortcut: disposable and user data can share these roots. |
+
+`test/foundation/launch-context/cutover.test.ts` places protected settings/session/history sentinels next to incompatible runtime fixtures and verifies failed admission does not change them. No test or implementation command uses actual user data as its cleanup fixture.