@timurproko/a1 0.1.8-dev.299 → 0.1.8-dev.332

package/dist/product-identity.js

@@ -1,40 +1,7 @@
 import rawIdentity from "./product-identity.json" with { type: "json" };
 const ENVIRONMENT_KEYS = [
-    "certificationTarball",
-    "configDir",
-    "dataDir",
-    "databasePath",
-    "developmentInstanceId",
-    "developmentRoot",
-    "endpoint",
-    "fixture",
-    "fixtureInput",
-    "fixtureToken",
-    "inputAcknowledgement",
-    "immutableWarmup",
-    "internalPackaging",
-    "launchProfile",
-    "nativePi",
-    "paneId",
-    "piParityIntentionalMutation",
-    "piPortRoot",
-    "piSourceLedgerPath",
-    "piSourceScanRoot",
-    "probeTrace",
-    "processGuardianPath",
-    "profileHome",
-    "protocolVersion",
-    "releaseDigest",
-    "releaseId",
-    "releaseLayers",
-    "releaseRoot",
-    "releaseRunnerLabel",
-    "runtimeDir",
-    "structuredFlowLimits",
-    "startupTrace",
-    "terminalArgumentsJson",
-    "terminalExecutable",
-    "terminalSessionId",
+    "configDir", "dataDir", "databasePath", "developmentInstanceId", "developmentRoot", "endpoint",
+    "paneId", "probeTrace", "processGuardianPath", "profileHome", "runtimeDir", "startupTrace", "terminalSessionId",
 ];
 const FILESYSTEM_KEYS = ["slug", "windowsDirectory", "unixDirectory", "temporaryPrefix"];
 const STATE_KEYS = ["windowsControlDirectory", "unixControlDirectory", "developmentDirectory", "piAgentProfile", "piVanillaProfile"];

package/dist/product-identity.json

@@ -1,6 +1,6 @@
 {
     "schema": "a1-product-identity-v1",
-    "displayName": "A1",
+    "displayName": "a1",
     "commandName": "a1",
     "packageName": "@timurproko/a1",
     "filesystem": {
@@ -10,40 +10,18 @@
         "temporaryPrefix": "a1-"
     },
     "environment": {
-        "certificationTarball": "A1_CERTIFICATION_TARBALL",
         "configDir": "A1_CONFIG_DIR",
         "dataDir": "A1_DATA_DIR",
         "databasePath": "A1_DATABASE_PATH",
         "developmentInstanceId": "A1_DEV_INSTANCE_ID",
         "developmentRoot": "A1_DEV_ROOT",
         "endpoint": "A1_ENDPOINT",
-        "fixture": "A1_FIXTURE",
-        "fixtureInput": "A1_FIXTURE_INPUT",
-        "fixtureToken": "A1_FIXTURE_TOKEN",
-        "inputAcknowledgement": "A1_INPUT_ACK",
-        "immutableWarmup": "A1_IMMUTABLE_WARMUP",
-        "internalPackaging": "A1_INTERNAL_PACKAGING",
-        "launchProfile": "A1_LAUNCH_PROFILE",
-        "nativePi": "A1_NATIVE_PI",
         "paneId": "A1_PANE_ID",
-        "piParityIntentionalMutation": "A1_PI_PARITY_INTENTIONAL_MUTATION",
-        "piPortRoot": "A1_PI_PORT_ROOT",
-        "piSourceLedgerPath": "A1_PI_SOURCE_LEDGER_PATH",
-        "piSourceScanRoot": "A1_PI_SOURCE_SCAN_ROOT",
         "probeTrace": "A1_PROBE_TRACE",
         "processGuardianPath": "A1_PROCESS_GUARDIAN_PATH",
         "profileHome": "A1_PROFILE_HOME",
-        "protocolVersion": "A1_PROTOCOL_VERSION",
-        "releaseDigest": "A1_RELEASE_DIGEST",
-        "releaseId": "A1_RELEASE_ID",
-        "releaseLayers": "A1_RELEASE_LAYERS",
-        "releaseRoot": "A1_RELEASE_ROOT",
-        "releaseRunnerLabel": "A1_RELEASE_RUNNER_LABEL",
         "runtimeDir": "A1_RUNTIME_DIR",
-        "structuredFlowLimits": "A1_STRUCTURED_FLOW_LIMITS",
         "startupTrace": "A1_STARTUP_TRACE",
-        "terminalArgumentsJson": "A1_TERMINAL_ARGUMENTS_JSON",
-        "terminalExecutable": "A1_TERMINAL_EXECUTABLE",
         "terminalSessionId": "A1_TERMINAL_SESSION_ID"
     },
     "state": {

package/dist/ui/components/transcript-viewport.d.ts

@@ -24,6 +24,12 @@ export interface TranscriptViewportFrameInput {
     readonly paintDocumentRow?: (row: string) => string;
     /** Leading document rows that participate in pointer selection and copying. */
     readonly selectableDocumentRowCount?: number;
+    /**
+     * First document row owned by the block that is currently streaming, if any. Rows from
+     * here to the end of the selectable document reflow together whenever that block
+     * re-renders, so the frame can declare how much damage is legitimately its own.
+     */
+    readonly liveTailStartRow?: number;
     /** Final transient rows to bottom-align with unused viewport space while content fits. */
     readonly bottomAlignedTailRowCount?: number;
     readonly dockRows: readonly string[];
@@ -94,6 +100,8 @@ export interface TranscriptViewportFrameDescriptor {
     readonly transientAlignmentGapRows: number;
     /** Live status rows at the end of the transient suffix. */
     readonly bottomAlignedTailRowCount: number;
+    /** Visible rows owned by the currently streaming transcript block. */
+    readonly liveTailRows: number;
     readonly verticalShiftRows: number;
     readonly safeVerticalShift: boolean;
     /** Monotonic interaction revision used to reject stale selection evidence. */

package/dist/ui/components/transcript-viewport.js

@@ -358,9 +358,9 @@ export class TranscriptViewport {
         const frameRows = [...visible, ...dock].slice(0, height);
         let bottomHit = null;
         if (this.#maxScroll > 0 && !this.#followingEnd && frameRows.length > 0) {
-            const genericLabel = " Jump to bottom (End) ";
+            const genericLabel = " Jump to bottom (Ctrl+End) ↓ ";
             const countedLabel = this.#newMessages > 0
-                ? ` ${this.#newMessages} new message${this.#newMessages === 1 ? "" : "s"} (End) `
+                ? ` ${this.#newMessages} new message${this.#newMessages === 1 ? "" : "s"} (Ctrl+End) ↓ `
                 : genericLabel;
             const label = displayWidth(countedLabel) <= contentWidth ? countedLabel : genericLabel;
             const labelWidth = displayWidth(label);
@@ -406,6 +406,7 @@ export class TranscriptViewport {
             transientRowCount: Math.max(0, documentRows.length - this.#selectableDocumentRowCount),
             transientAlignmentGapRows,
             bottomAlignedTailRowCount,
+            liveTailRows: visibleLiveTailRows(input.liveTailStartRow, this.#selectableDocumentRowCount, this.#scrollTop, viewportHeight),
             verticalShiftRows,
             safeVerticalShift,
             selectionRevision: composingSelectionRevision,
@@ -480,6 +481,7 @@ export class TranscriptViewport {
             transientRowCount: previous.descriptor.transientRowCount,
             transientAlignmentGapRows: previous.descriptor.transientAlignmentGapRows,
             bottomAlignedTailRowCount: previous.descriptor.bottomAlignedTailRowCount,
+            liveTailRows: previous.descriptor.liveTailRows,
             verticalShiftRows: 0,
             safeVerticalShift: false,
             selectionRevision: this.#selectionRevision,
@@ -568,6 +570,18 @@ function trimCache(cache, limit) {
     while (cache.size > limit)
         cache.delete(cache.keys().next().value);
 }
+/**
+ * Rows of the streaming block that the visible window actually shows. Gap insertion happens
+ * after the selectable document, so live-block indices need no adjustment here.
+ */
+function visibleLiveTailRows(liveTailStartRow, selectableDocumentRowCount, scrollTop, viewportHeight) {
+    if (liveTailStartRow === undefined || !Number.isSafeInteger(liveTailStartRow))
+        return 0;
+    const start = clamp(liveTailStartRow, 0, selectableDocumentRowCount);
+    const visibleStart = Math.max(start, scrollTop);
+    const visibleEnd = Math.min(selectableDocumentRowCount, scrollTop + viewportHeight);
+    return Math.max(0, visibleEnd - visibleStart);
+}
 function governingPrompt(anchors, scrollTop) {
     let result = null;
     for (const anchor of anchors) {
@@ -611,6 +625,13 @@ export function assertTranscriptViewportFrameDescriptor(descriptor) {
         || descriptor.transientAlignmentGapRows + descriptor.bottomAlignedTailRowCount > descriptor.transientRowCount) {
         throw new TypeError("viewport frame descriptor transient geometry is invalid");
     }
+    const transcriptHeight = descriptor.transcript === null
+        ? 0
+        : descriptor.transcript.rowEnd - descriptor.transcript.rowStart + 1;
+    if (!Number.isSafeInteger(descriptor.liveTailRows) || descriptor.liveTailRows < 0
+        || descriptor.liveTailRows > transcriptHeight) {
+        throw new TypeError("viewport frame descriptor live tail is invalid");
+    }
     if (!Number.isSafeInteger(descriptor.verticalShiftRows))
         throw new TypeError("viewport frame descriptor shift is invalid");
     if (descriptor.previousDocumentRange === null && descriptor.verticalShiftRows !== 0) {

package/dist/ui/components/visible-hyperlinks.d.ts

@@ -6,6 +6,13 @@ export interface VisibleHyperlinkRange {
 }
 export interface VisibleHyperlinkRow {
     readonly ranges: readonly VisibleHyperlinkRange[];
+    /**
+     * Whether the row declares a terminal hyperlink of its own. Only a declared link gives the
+     * terminal per-cell link identity that moving the row can misattribute, so movement safety
+     * asks this rather than counting ranges: a candidate range is host-hover text such as
+     * `obj.method` or `./src/index.ts`, which ordinary code produces on nearly every row.
+     */
+    readonly hasExplicitLink: boolean;
     /** False for unclosed links, malformed escapes, images, or row-moving controls. */
     readonly replaySafe: boolean;
     readonly width: number;

package/dist/ui/components/visible-hyperlinks.js

@@ -55,6 +55,7 @@ export function readVisibleHyperlinks(line, widthOf = displayWidth) {
     ranges.sort((left, right) => left.from - right.from);
     return {
         ranges,
+        hasExplicitLink: ranges.some(range => range.kind === "explicit"),
         replaySafe,
         width: column,
         // Rationale: a path with spaces or a wrapped host match may extend beyond

package/dist/ui/settings/declarations.js

@@ -51,6 +51,7 @@ export const OWNED_UI_SETTING_DECLARATIONS = Object.freeze([
     Object.freeze({
         id: "promptSuggestions",
         label: "Prompt suggestions",
+        section: Object.freeze({ id: "agent", title: "Agent" }),
         description: "Predict likely next prompts with one additional background request using the selected model.",
         application: "live",
         defaultValue: true,

package/dist/ui/settings/sections.js

@@ -25,6 +25,8 @@ export function buildOwnedUiSettingsSections(input) {
         });
         grouped.set(section.id, group);
     }
+    const ownedAgentEntries = grouped.get(AGENT_SECTION_ID)?.entries ?? [];
+    grouped.delete(AGENT_SECTION_ID);
     const ownedSections = [...grouped].map(([id, group]) => ({
         id,
         title: group.title,
@@ -32,7 +34,15 @@ export function buildOwnedUiSettingsSections(input) {
         unavailableReason: null,
         readOnlyReason: null,
     }));
-    return Object.freeze([...ownedSections, agentSection(input.agent)]);
+    const agent = agentSection(input.agent);
+    // Invariant: presentation grouping does not transfer ownership or engine availability to owned entries.
+    const combinedAgent = ownedAgentEntries.length === 0 ? agent : {
+        ...agent,
+        entries: Object.freeze([...agent.entries, ...ownedAgentEntries]),
+        unavailableReason: null,
+        readOnlyReason: null,
+    };
+    return Object.freeze([...ownedSections, combinedAgent]);
 }
 export function findOwnedUiSettingsEntry(sections, id, backend) {
     for (const section of sections) {

package/docs/architecture/boundaries.md

@@ -28,7 +28,8 @@ The owned Pi-backed surface is not an arbitrary-CLI terminal multiplexer. A feat
 - `structured-agent-runtime`: planned typed event/command/snapshot runtime. It must not infer semantics from terminal text, own pseudoterminals, or reconstruct screens.
 - `native-host-protocol`: bounded typed local boundary for terminal-host identity, topology revisions, lifecycle, and recovery. Terminal bytes, per-event child input, and rendered cells are forbidden across it.
 - `protocol`: additive control handshake, bounded line framing, authenticated launch-instance commands, typed stop intent, snapshots, and command results.
-- `prompt-history`: narrowly typed user-input retention in separate profile-owned application-data databases, with bounded worker queues and no supervisor/control-store payloads. The editor's owned history state machine remains inside the Pi component boundary; the session UI only coordinates snapshots and classified submissions.
+- `launch`: resolves the effective profile home and the history-specific data root. Composition uses its public path resolver to select `~/.a1/data` for history unless `A1_DATA_DIR` is explicit; global control/release/runtime/cache paths stay unchanged.
+- `prompt-history`: narrowly typed user-input retention in separate profile-owned databases under `~/.a1/data/history` (or `<A1_DATA_DIR>/history`), with bounded worker queues and no supervisor/control-store payloads. It receives a resolved root rather than importing launch-feature internals; it never probes, imports, or deletes the former platform-default history. The editor's owned history state machine remains inside the Pi component boundary; the session UI only coordinates snapshots and classified submissions.
 - `storage`: SQLite migrations, prior-boot reconciliation, and plural launch-instance persistence. Legacy foreground rows are historical migration input and never authorize current ownership.
 - `supervisor`: endpoint identity, plural cohort ownership, per-instance reconciliation, and aggregate release shutdown coordination. It owns no terminal surface.
 - `pi-engine-adapter`, `pi-component-adapter`, `pi-tui-runtime-adapter`, and `pi-session-ui-integration`: isolate pinned Pi engine and presentation knowledge behind neutral contracts; product features do not import them directly. The session UI render root assembles semantic document and dock rows, while its focused viewport controller owns follow state, pointer routing, selection, and interaction timers. Owned-app route lifecycle belongs to the neutral `ui-apps` owner and is only hosted by the Pi session UI.

package/docs/architecture/internal-naming.md

@@ -0,0 +1,91 @@
+# Internal naming and private launch context
+
+Internal code names contain no case-insensitive `a1` substring. This includes constants, variables, parameters, functions, methods, classes, types, private fields, aliases, and quoted/constant-computed member names. Branding remains at supported external boundaries: the `a1` command, public package identity, user-visible text, user directories, public settings, and declared serialized fields.
+
+## Required PR validation
+
+The required **Internal naming validation** job scans complete added, modified, copied, and renamed-to files at the exact PR head against the complete merge-base diff. It does not inspect only changed lines. Policy, exception, ownership, parser-dependency, and selection changes require a full audit and inspector regression tests. A stale, missing, failed, or unexpectedly skipped required result blocks the aggregate development check.
+
+The nightly release workflow runs `full-release`, including `naming-full`, against the entire tracked codebase at its selected source commit. It does not use PR changed-file selection, including when it verifies an already-published immutable package. Naming failure fails platform validation and blocks publication. `naming-selection.test.ts` locks down this nightly wiring and checks that unchanged source is audited.
+
+- Full local audit: `npm run check:names` (tracked files, including staged new files).
+- Exact selected PR audit: `npm run check:names:changed` after producing `.artifacts/validation/impact.json`.
+- Evidence: `.artifacts/validation/naming.json`, uploaded as `development-naming-validation`.
+- Parser fixtures: `test/repository-governance/naming-inspection.test.ts`.
+- Git selection fixtures: `test/repository-governance/naming-selection.test.ts`.
+
+TypeScript/JavaScript and Python use syntax trees. Rust uses a token-aware scanner. Workflow environment maps, embedded Node scripts, JSON environment definitions, and supported shell assignments are inspected. Dependencies, immutable vendor files, generated output, and other worktrees are excluded; owned test helpers and locally adapted source ports are not. Unsupported owned inputs fail explicitly. Python inspection uses a bundled development-only grammar, not an installed Python interpreter.
+
+The exact externally branded key/member authority is `config/internal-naming-policy.json`. It records each setting's owner, evidence, exposure, and value semantics. Arbitrary uppercase properties are not public environment settings. No compatibility-alias exposure category is allowed. Test snippets and negative-test input data are not declarations or supported aliases.
+
+## Environment ownership inventory
+
+### Supported branded external settings
+
+| Keys | Producer / consumer and exposure |
+| --- | --- |
+| `A1_CONFIG_DIR`, `A1_DATA_DIR`, `A1_RUNTIME_DIR`, `A1_DATABASE_PATH`, `A1_ENDPOINT` | User/shell configuration consumed by `src/foundation/lifecycle/paths.ts`; documented public overrides, unchanged. |
+| `A1_PROFILE_HOME` | Caller-supplied profile-home override consumed by `src/features/launch/profile-paths.ts`; exact existing exposure-review entry. |
+| `A1_STARTUP_TRACE` | Caller-supplied diagnostic path and trace context in `src/foundation/startup/startup-runtime.ts`; exact existing exposure-review entry. |
+| `A1_DEV_INSTANCE_ID`, `A1_DEV_ROOT` | Caller-supplied development overrides consumed by `src/features/launch/development-launch.ts`; exact existing exposure-review entries. |
+| `A1_PROCESS_GUARDIAN_PATH` | Explicit executable override in `src/foundation/process-containment/native-guardian-containment.ts`, also configured by CI; exact existing exposure-review entry. |
+| `A1_PROBE_TRACE` | Opt-in diagnostics read by native terminal-host code; exact existing exposure-review entry. |
+| `A1_BUILD_VERBOSE`, `A1_DEV_SHELL` | Developer invocation controls in the build helper and development launcher; exact existing exposure-review entries. |
+| `A1_PANE_ID`, `A1_TERMINAL_SESSION_ID` | Produced by `native/terminal-host/src/workspace.rs` and exported to launched programs; external integration names, unchanged. |
+
+Pending review preserves a possible external interface, not an obsolete private alias. Once a setting is established as private, it cannot keep its branded spelling through that category.
+
+### Current private settings
+
+| Keys | Producer / consumer and value semantics |
+| --- | --- |
+| `LAUNCH_CONTEXT_RELEASE_ROOT`, `LAUNCH_CONTEXT_RELEASE_ID`, `LAUNCH_CONTEXT_RELEASE_DIGEST`, `LAUNCH_CONTEXT_RELEASE_LAYERS` | Release bootstrap writes the selected verified immutable identity; supervision, guardian, and startup/cache readers consume it. Layers are comma-separated and can be empty. |
+| `LAUNCH_CONTEXT_PROFILE` | Bootstrap or the development launcher writes the selected `a1`/`pi` profile; guardian and UI entries consume it. |
+| `LAUNCH_CONTEXT_WARMUP` | Release warmup writes exactly `1`; the private warmup entry requires it together with release context. |
+| `RELEASE_CLEANUP_HOLDS`, `RELEASE_CLEANUP_RUN_ID` | Cleanup scheduler/worker handoff in `src/foundation/release/release-gc.ts`; serialized holds and a worker run identity. |
+| `SOURCE_LEDGER_PATH`, `SOURCE_LEDGER_SCAN_ROOT`, `SOURCE_LEDGER_PORT_ROOT` | Source-ledger governance fixture overrides; produced by its tests and consumed by `check-pinned-pi-source-ledger.mjs`. |
+| `RELEASE_RUNNER_LABEL` | Release/full-regression workflows supply certification-runner provenance to `run-release-gates.mjs`. |
+| `TERMINAL_FIXTURE_INPUT`, `TERMINAL_FIXTURE_TOKEN` | Native terminal probe producer/consumer in `native/terminal-host/src/main.rs`; expected input and fixture token. |
+| `DOCS_AUTO_MERGE_POLL_ATTEMPTS`, `DOCS_AUTO_MERGE_POLL_MS` | Documentation automation polling controls, produced by governance tests and consumed by `manage-documentation-auto-merge.mjs`. |
+| `VALIDATION_JOB_STARTED_MS`, `RENDERING_JOB_STARTED_MS` | CI timing handoffs within `.github/workflows/ci.yml`; epoch milliseconds. |
+| `RUN_PROCESS_CONTAINMENT_INTEGRATION` | CI enables the real containment fixture with exactly `1`; platform containment tests consume it. |
+| `PACKAGE_MESSAGE_SCENARIO` | Package-message worker parent/child JSON scenario handoff. |
+| `RECOVERY_TEST_CANCEL_AFTER`, `RECOVERY_TEST_REMOVAL_MARKER` | Recovery test parent/fake-npm handoff; mutation index and disposable sentinel path. |
+
+The private launch contract is `neutral-launch-v1`, declared by the package's `privateLaunchContract` metadata and bound into immutable release identity. It is validated before activation or execution. There is one reader/writer and no mapping from obsolete private names.
+
+### Existing neutral automation and third-party boundaries
+
+These names are already neutral; their definitions and consumers remain the authority for their existing behavior:
+
+- Development aggregate: `CHANGES_RESULT`, `DOCS_RESULT`, `DOCUMENTATION_RESULT`, `DOCUMENTATION_REQUIRED`, `VALIDATE_RESULT`, `CONTAINMENT_RESULT`, `STARTUP_RESULT`, `RENDERING_RESULT`, `RENDERING_TIER`, `DOCS_ONLY`, `VERSION_ONLY`, `OPENSPEC_TOUCHED`, `SELECTED_HEAD`, `EXPECTED_HEAD`, `EVENT_BASE_SHA`, `EVENT_HEAD_SHA`. The workflow produces these and `require-development-validation.mjs` or the selector consumes them.
+- Naming aggregate: `NAMING_RESULT`, `NAMING_REQUIRED`, `NAMING_HEAD`, produced by CI and consumed by the same required aggregate.
+- Validation: `VALIDATION_BUILD_READY`, `VALIDATION_CANDIDATE_TARBALL`, `VALIDATION_DOCUMENTATION_FULL_READY`, `VALIDATION_SELECTION_JSON`, `STARTUP_PERFORMANCE_RESULT`, owned by validation orchestration and exact-package fixtures.
+- Publication workflow-local handoffs: `BUILD`, `EVENT_NAME`, `EXISTS`, `EXPECTED_INTEGRITY`, `EXPECTED_REGISTRY_INTEGRITY`, `EXPECTED_REGISTRY_SHASUM`, `EXPECTED_SHASUM`, `MODE`, `PACKAGE`, `PLAN`, `PUBLISH`, `PULLS_PATH`, `PULL_REQUEST`, `REGISTRY_TARBALL`, `RELEASE_CHANNEL`, `RELEASE_VERSION`, `REQUESTED_CHANNEL`, `REQUESTED_SHA`, `SOURCE_SHA`, `VALIDATE`, `VERSION`, `WORK`, defined and consumed in `.github/workflows/release.yml`.
+- Isolated fixture controls: `PROMPT_SUGGESTION_AGENT_DIR`, `RUN_PROMPT_SUGGESTION_PROVIDER_TEST`, `TEST_SUPERVISOR_SECRET`, owned by their specific provider/supervisor tests.
+- Host/tool integration: `CARGO`, `ZIG`, `PATH`, `HOME`, `USERPROFILE`, `APPDATA`, `LOCALAPPDATA`, XDG directory variables, `TERM`, `COLORTERM`, `TERM_PROGRAM`, `WT_SESSION`, `EXEPATH`, `MINGW_PREFIX`, `MSYSTEM`, and third-party `PI_*`, `GITHUB_*`, `GH_TOKEN`, and npm variables. Their external spellings and caller values are not private product naming targets. The forwarding of an arbitrary user's environment is distinct from defining an owned setting.
+
+### Removed or reclassified registry entries
+
+The old environment registry included `fixture` and `inputAcknowledgement`, but their values describe native probe stdout markers, not environment settings. Their existing external wire spellings stay in that protocol, not in the public environment registry.
+
+`certificationTarball`, `internalPackaging`, `nativePi`, `piParityIntentionalMutation`, `protocolVersion`, `structuredFlowLimits`, `terminalArgumentsJson`, and `terminalExecutable` had no active runtime consumer in the reviewed tree. They are removed from the current environment authority, not renamed into new settings. Rejection patterns and immutable historical evidence remain factual.
+
+## Negotiated handoff and protected state
+
+An update is performed by the release that is already installed, so the contract is negotiated rather than cut over. `neutral-launch-v1` is the only contract this build **writes** for its own releases, and the superseded `A1_RELEASE_*`/`A1_IMMUTABLE_WARMUP` keys are still **read** when an older launcher starts this build, and still **written** when this build starts a retained release that declares no contract. An installation therefore stays launchable across the cutover in both directions, and no user is asked to stop processes and reinstall by hand.
+
+Metadata that predates contract declaration is stale, never fatal. A pre-cutover active record does not stop a launch: it is ignored, the installed payload is materialized, and ordinary cohort selection activates it. A launch that cannot take the installed payload at all — an installation being replaced right now — starts the retained active release instead of failing, and leaves activation to the next launch. What still requires `neutral-launch-v1` outright is narrow and never blocks a launch: the installed package's own manifest must declare it, and an update recovery capsule is never translated.
+
+`test/foundation/release/update-predecessor.integration.test.ts` is the gate for this. It installs each of the most recent published releases and drives the candidate through **that release's own** materialization and warmup, because a fixture built from the candidate would only prove the candidate agrees with itself. No reset or migration runs automatically. If disposable state blocks installation, inspect its resolved paths and obtain separate approval before removal.
+
+| State | Treatment |
+| --- | --- |
+| `<configDir>` and its settings | Preserve. |
+| `~/.a1/agent`, credentials, extensions, and session files | Preserve. |
+| Prompt-history databases under the selected data/history owner | Preserve; this change does not relocate history. |
+| `<dataDir>/releases`, release references/certification records, `<dataDir>/update-recovery`, update journal | Disposable runtime/release candidates only; inspect exact paths and live ownership before any separately approved manual reset. |
+| `<runtimeDir>` endpoints, locks, and worker records | Reset candidates only after all affected processes stop and their precise scope is confirmed. |
+| The whole `<dataDir>` or `<configDir>` | Never delete as a shortcut: disposable and user data can share these roots. |
+
+`test/foundation/launch-context/cutover.test.ts` places protected settings/session/history sentinels next to incompatible runtime fixtures and verifies failed admission does not change them. No test or implementation command uses actual user data as its cleanup fixture.

package/docs/architecture/resource-and-data-policy.md

@@ -47,8 +47,10 @@ Sanitization must classify before logging or storing. Unknown or untyped values
 
 The `prompt-history` feature owns only reusable interactive user input, not
 structured-message archives. It stores one independent profile database under
-`<dataDir>/history`, never agent resources or cache/release directories. Text is
-unencrypted and potentially sensitive. Retain up to 100 unique entries (configured
+`<effective-home>/.a1/data/history`, or `<A1_DATA_DIR>/history` when explicitly
+overridden, never agent resources or cache/release directories. The default home
+follows launch-profile resolution, including `A1_PROFILE_HOME`; other product
+data paths are unchanged. Text is unencrypted and potentially sensitive. Retain up to 100 unique entries (configured
 10-100), at most 1 MiB per entry and 8 MiB total canonical text. Background queues
 are limited to 32 writes/8 MiB per instance; reads are coalesced, lock retries are
 bounded to one second off-thread, and graceful shutdown drains for at most two
@@ -59,8 +61,11 @@ Only typed canonical text, submission identity, recency/timestamp, input kind,
 and bounded cwd/session provenance are allowed. No image bytes, transformed
 agent prompts, environment/credential copies, tool results, terminal streams, or
 private input in diagnostics are permitted. Disabling persistence is next-start
-and does not erase data or stop other live instances. Cache and release cleanup
-must not touch history. See [prompt history](../features/prompt-history.md) for
+and does not erase data or stop other live instances. Upgrades, ordinary npm
+uninstall/reinstall, and cache/release cleanup must not touch history. The new
+default starts fresh without probing, importing, or deleting the old platform
+store. Any old-store removal is a separate manual operation after its users have
+stopped, not startup or cleanup behavior. See [prompt history](../features/prompt-history.md) for
 retention, failure semantics, profile identity, and stopped-instance removal.
 
 ## Required architectural outcomes

package/docs/architecture/toolchain.md

@@ -82,7 +82,7 @@ These paths are A1 control and release state, not Pi profile roots. All are over
 | Purpose | Override | Windows default | Unix default |
 |---|---|---|---|
 | Config | `A1_CONFIG_DIR` | `%APPDATA%\\a1` | `$XDG_CONFIG_HOME/a1` or `~/.config/a1` |
-| Durable data | `A1_DATA_DIR` | `%LOCALAPPDATA%\\a1` | `$XDG_DATA_HOME/a1` or `~/.local/share/a1` |
+| Control/release data | `A1_DATA_DIR` | `%LOCALAPPDATA%\\a1` | `$XDG_DATA_HOME/a1` or `~/.local/share/a1` |
 | Runtime | `A1_RUNTIME_DIR` | `%LOCALAPPDATA%\\a1\\runtime` | `$XDG_RUNTIME_DIR/a1` or `<data>/runtime` |
 | Database | `A1_DATABASE_PATH` | `<data>/control.sqlite3` | `<data>/control.sqlite3` |
 | Endpoint | `A1_ENDPOINT` | runtime-scoped `a1-*` named pipe | `<runtime>/supervisor.sock` |
@@ -96,3 +96,17 @@ Do **not** remove `~/.a1/agent`; it is A1's current Pi profile root. `~/.pi/agen
 The obsolete npm package `@timurproko/addone` is deprecated with the registry message `This package is obsolete. Use @timurproko/a1 instead.` It is not a current identity, compatibility channel, or rollback source. Whole-package unpublication was rejected by npm policy; any later removal is owner-controlled registry administration and does not change the A1 runtime contract.
 
 The launch-profile feature separately owns A1's `~/.a1/agent` root and preserves ordinary Pi resolution through `~/.pi/agent`.
+
+## Internal naming validation
+
+The required PR naming job inspects complete new and changed source files. `npm run check:names` performs the full tracked audit, also required by nightly full-release validation. See [internal naming and clean cutover](internal-naming.md) for public/private environment ownership, required checks, and protected user data.
+
+### Prompt history
+
+Prompt history has a separate default: `<effective-home>/.a1/data/history/<profile-id>.sqlite3`
+on Windows, Linux, and macOS. The effective home follows launch-profile resolution
+(`A1_PROFILE_HOME` or the OS home), not `XDG_DATA_HOME`. An explicit `A1_DATA_DIR`
+continues to select `<A1_DATA_DIR>/history` as well as the control/release data root.
+The home-based history default does not relocate the paths above or the compile
+cache at `<data>/cache/compile`. See [prompt history](../features/prompt-history.md)
+for the deliberate fresh start without migration, privacy, and manual removal.

package/docs/features/prompt-history.md

@@ -36,10 +36,23 @@ imported automatically.
 
 | Platform | Default durable location |
 |---|---|
-| Windows | `%LOCALAPPDATA%/a1/history/<profile-id>.sqlite3` |
-| Current Unix policy (including macOS) | `$XDG_DATA_HOME/a1/history/<profile-id>.sqlite3`, or `~/.local/share/a1/history/<profile-id>.sqlite3` |
+| Windows | `%USERPROFILE%/.a1/data/history/<profile-id>.sqlite3` |
+| Linux and macOS | `~/.a1/data/history/<profile-id>.sqlite3` |
 | Explicit override | `<A1_DATA_DIR>/history/<profile-id>.sqlite3` |
 
+The default uses A1's effective profile home: `A1_PROFILE_HOME` when set, otherwise
+the operating-system home. A custom agent-profile directory changes the history
+identity, not this default root. `A1_DATA_DIR` takes precedence for storage;
+`XDG_DATA_HOME` does not redirect default history. Control metadata, settings,
+agent resources, releases, logs, runtime files, and caches keep their existing
+locations.
+
+**The home-based default starts fresh.** Previous versions used
+`%LOCALAPPDATA%/a1/history` on Windows, or `$XDG_DATA_HOME/a1/history` /
+`~/.local/share/a1/history` on Unix. A1 does not probe, import, merge, delete, or
+fall back to those stores. Explicit `A1_DATA_DIR` selections still work normally.
+Old and new releases using different roots do not synchronize history.
+
 The profile filename is `a1-` followed by a SHA-256 digest of a versioned tuple
 containing the launch kind and normalized effective agent-profile path. It is
 independent of project, session, checkout, and release. Windows ordinary case and
@@ -48,13 +61,16 @@ files. Moving a profile, unresolved symlink aliases, or selecting a different
 data root can select a different history; A1 never silently merges or imports it.
 
 The database is separate from `control.sqlite3`, agent resources, and disposable
-caches. Upgrades, release rollback, cache cleanup, and conversation deletion do
-not clear it. SQLite may keep `-wal` and `-shm` sidecars beside the database.
+caches. Upgrades, ordinary npm uninstall/reinstall, release rollback, cache cleanup,
+and conversation deletion do not clear it. Reusing saved history requires the
+same profile and history root; explicitly deleting user data still removes it.
+SQLite may keep `-wal` and `-shm` sidecars beside the database.
 
 **History is unencrypted potentially sensitive user text.** Owner permissions
-are restricted where supported; Windows uses the account's application-data
-ACLs. These protections do not make it safe to submit secrets. Credential files,
-image data, arbitrary environment values, assistant/tool output, and terminal
+are restricted where supported; Windows uses inherited ACLs at the selected
+history directory. Review parent-directory permissions if you customize your home
+or override root. These protections do not make it safe to submit secrets.
+Credential files, image data, arbitrary environment values, assistant/tool output, and terminal
 streams are not copied into this store. Prompt content and private provenance
 must not appear in history diagnostics or test evidence.
 
@@ -96,15 +112,27 @@ two seconds and reports an incomplete flush without preventing exit.
 
 First close **every instance using the selected profile**. Then remove only that
 profile's `.sqlite3` file and its matching `-wal` and `-shm` sidecars, if present.
-Do not delete an open database or the whole application-data root. Disabling the
-setting alone is not an erase operation. There is no interactive clear/export
-command in this release.
+Do not delete an open database, the whole `.a1` directory, or the whole
+application-data root. Disabling the setting alone is not an erase operation.
+There is no interactive clear/export command in this release.
+
+Removing a former default store is likewise a one-time manual cleanup, not an
+application feature. Wait until you have switched to the new version and closed
+all instances using the old store; an older running version can otherwise keep
+using or recreate it. Remove only the identified old profile database and matching
+sidecars, not other profiles or either application's caches.
 
 ## Manual acceptance
 
 Build the checkout, then launch it through `./scripts/dev`. Use an isolated
 `A1_DATA_DIR` for disposable history checks; keep that same directory on each
-restart and in both concurrent terminals. Test:
+restart and in both concurrent terminals. The development launcher always sets
+an isolated `A1_DATA_DIR`; to try the home-based location in that launcher,
+explicitly select `A1_DATA_DIR=<effective-home>/.a1/data` and keep
+`A1_DATABASE_PATH` in a separate disposable directory so control metadata is not
+placed beside history. For a history-only review, `NODE_DISABLE_COMPILE_CACHE=1`
+also avoids creating compile-cache files under that explicitly overridden root.
+The focused path/composition tests cover normal no-override selection. Test:
 
 1. Submit two text prompts and one repeated prompt; start `/new`, then restart.
    The latest unique prompts remain recallable.

package/docs/manual-code-streaming-cleanup.md

@@ -0,0 +1,88 @@
+# Bounded code-streaming and hyperlink cleanup review
+
+This candidate finishes the hyperlink portion of `eliminate-code-block-streaming-flicker`
+(specification PR #318), following the partial implementation in #321. It is a prerequisite
+for `keep-streaming-ui-responsive-during-selection` (#325), not that larger change's completed
+selection/wheel performance fix.
+
+## What changed
+
+- Candidate-looking text (paths, dotted identifiers) no longer vetoes a proven followed shift.
+  Real OSC 8 links, unsafe escapes, images, overlays, and selections retain their conservative
+  movement rules.
+- Ordinary streamed text changes no longer request hyperlink cleanup.
+- Pointer transitions identify the former hovered row. Editor link deletion and discarded
+  presentation state retain explicit cleanup requests, including when replacement content
+  has no links. Unscoped cleanup considers every previously linked row; a missing pointer
+  report is not treated as proof that no host decoration exists.
+- Cleanup paints affected and changed rows without manufacturing an erase-display. After
+  unknown paint or lost geometry, it waits for a complete safe frame instead of guessing.
+- Same-geometry forced frames preserve current cells without repainting unchanged rows.
+  Structural entry, resize, and unsafe-protocol fallbacks are still conservative.
+
+## Automated evidence
+
+`test/fixtures/rendering/baseline-code-streaming.json` is the pre-production-change capture
+from `6c5af810`, repeated twice with no production diff. Its synthetic content and cell hashes
+contain no private session input. The fixture predates the added dual-synchronization summary
+field; it remains a historical baseline rather than a regenerated candidate result.
+
+| Bare-A1 fullscreen workload | Baseline post-startup clears | Candidate post-startup clears |
+| --- | ---: | ---: |
+| Streamed fenced code | 3 | 0 |
+| Path-bearing prose | 3 | 0 |
+| Tall live tail | 0 | 0 |
+
+The deterministic producers use a shared scripted clock so cold imports do not advance spinner
+or presentation timers unpredictably. Independent comparison processes remain outside the owned
+damage adapter. Current budgets also fail candidate-only fallback, repaint of settled rows,
+stale final content, or divergent final cells with synchronization honored versus ignored.
+The dual-model replay reuses producer bytes rather than launching duplicate producers.
+
+Generate current evidence (non-interactive; writes only the named report):
+
+```sh
+cd D:/Git/a1/.worktrees/finish-bounded-link-cleanup && node --import tsx scripts/pi/report-code-streaming.ts --phase current --repeat 2 --output .artifacts/rendering/code-streaming-current.json
+```
+
+The baseline mode rejects dirty production sources. Do not replace the committed baseline with
+post-fix results. Repeated reports compare cells, row damage, decisions, and budgets, not elapsed
+machine timings. This is a paint regression check, not a CPU or input-latency benchmark.
+
+## Physical Windows Terminal review
+
+Use the candidate branch `fix/bounded-hyperlink-cleanup` and record its exact `git rev-parse HEAD`.
+Build and start the owned UI through the color-preserving shell entry:
+
+```sh
+cd D:/Git/a1/.worktrees/finish-bounded-link-cleanup && npm run build && ./scripts/dev
+```
+
+1. Ask the agent, without writing files, to produce a long fenced TypeScript example containing
+   `obj.method`, `package.json`, and `./src/index.ts`, followed by a short explanation and a real
+   Markdown hyperlink. Check that ordinary code/path streaming no longer blanks the screen.
+2. Hover a real hyperlink, then scroll it away without moving the pointer. Repeat with a
+   terminal-detected URL and file-like text inside code. Try both short and wrapped links,
+   duplicate targets, blank rows replacing links, and a smaller terminal.
+3. Move off a hovered link, select linked text, wheel/auto-scroll during selection, release,
+   and copy. Check exact copied text, normal link colors/activation, and no leftover solid
+   underlines on unrelated text, padding, or controls.
+4. Paste a URL chip into the editor and delete it. Open and close a covering overlay, and resize
+   while a link is visible. Check that obsolete targets/underlines are removed and restored
+   links have their correct targets.
+5. Verify that the dock stays intact and terminal mouse/cursor behavior is restored on exit.
+
+Use the same geometry for the independent comparison profile:
+
+```sh
+cd D:/Git/a1/.worktrees/finish-bounded-link-cleanup && npm run build && ./scripts/dev pi
+```
+
+Record terminal/version, geometry, synchronized-update support, explicit versus auto-detected
+link case, commit, and pass/fail. Test both before and after any pointer report: lack of a report
+must not be interpreted as evidence of an absent pointer.
+
+**Known gaps:** native Windows Terminal hover rasterization cannot be certified by headless cell
+replay. Visual acceptance and merge authorization are pending. The broader selection/wheel
+scheduling and collapsed-tool preparation optimizations have not been implemented in this PR.
+Do not merge on automated results alone; a ghost-underline or flicker regression blocks acceptance.

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.1.8-dev.299",
+  "version": "0.1.8-dev.332",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
+  "privateLaunchContract": "neutral-launch-v1",
   "packageManager": "npm@11.13.0",
   "bin": {
     "a1": "bin/cli.js"
@@ -26,7 +27,9 @@
     "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/development/build-process-guardian.mjs && node scripts/release/generate-runtime-payload-inventory.mjs",
     "build:process-guardian": "node scripts/development/build-process-guardian.mjs",
     "typecheck": "tsgo -p tsconfig.json --noEmit",
-    "check:architecture": "node scripts/governance/check-architecture.mjs && node scripts/governance/product-identifier-policy.mjs --check && node scripts/governance/check-product-identity-boundaries.mjs && node scripts/governance/check-package-identity.mjs && node scripts/governance/check-pinned-pi-source-ledger.mjs && node scripts/governance/check-terminal-host-provenance.mjs",
+    "check:architecture": "node scripts/governance/check-architecture.mjs && node scripts/governance/check-product-identity-boundaries.mjs && node scripts/governance/check-package-identity.mjs && node scripts/governance/check-pinned-pi-source-ledger.mjs && node scripts/governance/check-terminal-host-provenance.mjs",
+    "check:names": "node scripts/governance/product-identifier-policy.mjs --check",
+    "check:names:changed": "node scripts/governance/product-identifier-policy.mjs --check --selection .artifacts/validation/impact.json",
     "check:code-documentation": "node scripts/governance/check-code-documentation.mjs --mode full",
     "check:code-documentation:changed": "node scripts/release/run-changed-documentation.mjs",
     "select:validation-impact": "node scripts/release/select-validation-impact.mjs",
@@ -70,6 +73,7 @@
     "undici": "8.9.0"
   },
   "devDependencies": {
+    "@lezer/python": "1.1.19",
     "@types/cross-spawn": "6.0.6",
     "@types/node": "24.2.1",
     "@types/semver": "7.8.0",
@@ -78,7 +82,8 @@
     "node-pty": "1.1.0",
     "tsx": "4.20.3",
     "typescript": "5.9.2",
-    "vitest": "3.2.7"
+    "vitest": "3.2.7",
+    "yaml": "2.9.1"
   },
   "keywords": [
     "cli",