@timurproko/a1 0.1.8-dev.447 → 0.1.8-dev.457

package/dist/integrations/pi/session-ui/session-shell-root.d.ts

@@ -1,4 +1,4 @@
-import type { OwnedUiPromptSuggestionGeneratorPort, OwnedUiSessionViewModel, OwnedUiViewportSettings, OwnedUiViewportSettingsPort, SuggestionDecision, SuggestionDiagnosticObserver } from "../../../contracts/owned-ui/index.js";
+import type { OwnedUiPromptSuggestionGeneratorPort, OwnedUiSessionViewModel, OwnedUiViewportSettings, OwnedUiViewportSettingsPort, OwnedUiQuitOutroSettingsPort, SuggestionDecision, SuggestionDiagnosticObserver } from "../../../contracts/owned-ui/index.js";
 import type { PiTuiPointerSurface } from "../tui-runtime/contracts.js";
 import type { UiRouteHost } from "../../../ui/apps/contracts.js";
 import type { TranscriptViewportFrame, TranscriptViewportFrameDescriptor } from "../../../ui/components/transcript-viewport.js";
@@ -47,6 +47,17 @@ export interface OwnedUiSessionShellOptions {
     readonly sessionLayout?: "pinned" | "custom-viewport";
     /** Live profile-local settings, supplied only to the bare-A1 composition. */
     readonly viewportSettings?: OwnedUiViewportSettingsPort;
+    /**
+     * Quit outro settings and seams, supplied only to the bare-A1 composition.
+     * `interactive` states whether the terminal can show the animation; production
+     * passes stdout's TTY state, tests opt in explicitly.
+     */
+    readonly quitOutro?: OwnedUiQuitOutroSettingsPort & {
+        readonly interactive: boolean;
+        readonly now?: () => number;
+        readonly sleep?: (ms: number) => Promise<void>;
+        readonly seed?: number;
+    };
     /** Optional platform seam; production uses A1's system clipboard adapter. */
     readonly clipboard?: OwnedUiClipboardPort;
     /** Owned response-copy transport and payload-free diagnostic seams. Comparison profiles ignore them. */

package/dist/integrations/pi/session-ui/session-shell.js

@@ -55,6 +55,7 @@ export class OwnedUiSessionShell {
     #responseCopy;
     #unbindClipboardWriter;
     #damageTerminal;
+    #quitOutro;
     #streamPresentation;
     #removeViewportPreInput;
     #unsubscribeSettings;
@@ -250,6 +251,7 @@ export class OwnedUiSessionShell {
         runtime = new PiTuiRuntimeAdapter(runtimeOptions);
         this.runtime = runtime;
         this.#damageTerminal = damageTerminal ?? null;
+        this.#quitOutro = options.quitOutro;
         const presentationInterval = options.streamPresentation?.intervalMs ?? STREAM_PRESENTATION_INTERVAL_MS;
         streamPresentation = options.streamPresentation?.scheduler === undefined
             ? new StreamPresentationCoalescer(() => this.runtime.requestRender(), presentationInterval)
@@ -282,7 +284,9 @@ export class OwnedUiSessionShell {
         this.runtime.setClearOnShrink(initialPiSettings.clearOnShrink);
         this.#terminalProgressEnabled = initialPiSettings.showTerminalProgress;
         this.#fullscreenExitOutput = initialPiSettings.fullscreenExitOutput;
-        this.#unbindShutdownSettings = this.backend.bindSettingsOwner("shutdown", {
+        // Invariant: bare A1 prints only the resume hint at exit, so the pinned exit-output
+        // choice is hidden there and cannot be bound; the comparison profile binds and honors it.
+        this.#unbindShutdownSettings = this.backend.settingsProductMode === "bare" ? () => { } : this.backend.bindSettingsOwner("shutdown", {
             fullscreenExitOutput: { apply() { } },
         });
         this.#unbindTerminalSettings = this.backend.bindSettingsOwner("terminal", {
@@ -1350,6 +1354,8 @@ export class OwnedUiSessionShell {
     }
     async #dispose() {
         this.#disposed = true;
+        // Invariant: the outro frame is what the terminal shows now, before any cleanup writes.
+        const outroFrame = this.#captureQuitOutroFrame();
         this.#responseCopy?.dispose();
         this.#cancelWaitingImages();
         const failures = [];
@@ -1373,11 +1379,13 @@ export class OwnedUiSessionShell {
         let fullscreenExitText = "";
         attempt(() => {
             const exitMode = this.backend.disposed ? this.#fullscreenExitOutput : this.backend.pinnedSettingsSnapshot().fullscreenExitOutput;
-            const exitTranscript = this.root.exitTranscript(this.runtime.viewport().columns);
             const resume = this.backend.currentSessionResumeMetadata();
             const resumeHint = resume === null ? "" : `${dim("To resume this session:")} ${formatSessionResumeCommand(resume)}`;
+            // Invariant: bare A1 leaves only the hint behind; the pinned comparison profile still
+            // honors fullscreenExitOutput, including the styled transcript.
             fullscreenExitText = this.runtime.mode !== "fullscreen" ? ""
-                : exitMode === "resume-hint" ? resumeHint : [exitTranscript, resumeHint].filter(Boolean).join("\n\n");
+                : this.#customViewport || exitMode === "resume-hint" ? resumeHint
+                    : [this.root.exitTranscript(this.runtime.viewport().columns), resumeHint].filter(Boolean).join("\n\n");
         });
         attempt(() => this.#unbindClipboardWriter());
         attempt(() => this.#unbindPiSettings());
@@ -1386,8 +1394,11 @@ export class OwnedUiSessionShell {
         attempt(() => this.#unsubscribe());
         attempt(() => this.#dialogHandle?.hide());
         attempt(() => this.#extensionBridge.dispose());
-        // Invariant: terminal restoration precedes any potentially stalled backend teardown.
-        await this.runtime.dispose().catch(error => failures.push(error));
+        await this.#playQuitOutro(outroFrame);
+        // Invariant: terminal restoration precedes any potentially stalled backend teardown. The
+        // fullscreen leave preserves the screen: the pinned runtime never dumps its final document
+        // into the parent terminal, so only the configured exit text follows the leave.
+        await this.runtime.dispose({ preserveScreen: this.runtime.mode === "fullscreen" }).catch(error => failures.push(error));
         await historyCleanup.catch(() => false); // Security: background durability outcomes never enter terminal output.
         await boundedCleanup(() => pasteCleanup).catch(error => failures.push(error));
         await boundedCleanup(() => this.backend.unbindExtensionUi()).catch(error => failures.push(error));
@@ -1396,6 +1407,47 @@ export class OwnedUiSessionShell {
         if (fullscreenExitText.length > 0)
             this.runtime.writeAfterStop(`${fullscreenExitText}\n`);
     }
+    // Invariant: the snapshot is synchronous; the outro module itself loads only at quit.
+    #captureQuitOutroFrame() {
+        const outro = this.#quitOutro;
+        if (outro === undefined || !outro.interactive || !this.#customViewport || this.#damageTerminal === null)
+            return null;
+        if (!this.runtime.active || this.runtime.mode !== "fullscreen")
+            return null;
+        try {
+            const { effect, durationMs } = outro.snapshot();
+            if (effect === "off")
+                return null;
+            const viewport = this.runtime.viewport();
+            return { rows: this.#damageTerminal.presentedRows(), columns: viewport.columns, height: viewport.rows, settings: { effect, durationMs } };
+        }
+        catch {
+            return null;
+        }
+    }
+    // Rationale: any failure here only skips the effect; restoration always follows.
+    async #playQuitOutro(capture) {
+        const outro = this.#quitOutro;
+        if (capture === null || outro === undefined || !this.runtime.active)
+            return;
+        try {
+            // Rationale: the effects stay off the startup graph; quit is the only time they load.
+            const { captureQuitOutroFrame, playQuitOutro } = await import("./quit-outro.js");
+            const frame = captureQuitOutroFrame(capture.rows, capture.columns, capture.height);
+            if (frame === null || !this.runtime.active)
+                return;
+            this.runtime.freezePresentation();
+            await playQuitOutro(frame, capture.settings.effect, capture.settings.durationMs, {
+                write: data => this.runtime.writeControl(data),
+                ...(outro.now === undefined ? {} : { now: outro.now }),
+                ...(outro.sleep === undefined ? {} : { sleep: outro.sleep }),
+                ...(outro.seed === undefined ? {} : { seed: outro.seed }),
+            });
+        }
+        catch {
+            // Rationale: a failed or interrupted effect must never hold the terminal; restoration follows.
+        }
+    }
     #settleStoppedLifecycle() {
         void this.dispose().then(() => this.#resolveStoppedLifecycle(), () => this.#resolveStoppedLifecycle());
     }

package/dist/integrations/pi/tui-runtime/adapter.d.ts

@@ -26,10 +26,18 @@ export declare class PiTuiRuntimeAdapter {
     hasFocusedOverlay(): boolean;
     /**
      * Writes a terminal control sequence. Used to enable and disable mouse
-     * reporting while an A1-owned application is presented, and for nothing else:
-     * the transparent and pinned paths never call it.
+     * reporting while an A1-owned application is presented and to paint the quit
+     * outro while presentation is frozen, and for nothing else: the transparent
+     * and pinned paths never call it.
      */
     writeControl(data: string): void;
+    /**
+     * Drops every pinned frame write until the runtime stops. The quit outro owns
+     * the alternate screen between the last presented frame and the leave; the
+     * renderer keeps scheduling but nothing it paints reaches the terminal.
+     */
+    freezePresentation(): void;
+    get presentationFrozen(): boolean;
     addPreInputListener(listener: PiTuiPreInputListener): () => void;
     addInputListener(listener: PiTuiInputListener): () => void;
     switchMode(mode: "regular" | "fullscreen"): boolean;

package/dist/integrations/pi/tui-runtime/adapter.js

@@ -120,15 +120,20 @@ export class PiTuiRuntimeAdapter {
     #stopPromise;
     #rootDisposed = false;
     #terminalProgress = false;
+    #presentationFrozen = false;
     constructor(options) {
         this.#root = options.root;
         this.#overlayGeometry = options.onOverlayGeometry === undefined ? undefined : new OverlayGeometryTracker(options.onOverlayGeometry);
         this.#terminal = options.terminal ?? new ProcessTerminal();
         this.#inputDiagnostics = options.inputDiagnostics;
         this.#diagnosticNow = options.inputDiagnostics?.now ?? (() => performance.now());
+        // Invariant: the pinned renderer's frames pass through this gate, while writeControl and
+        // the stop sequence reach the terminal directly. Freezing drops frames without touching
+        // the renderer, so a scheduled repaint cannot land on top of the quit outro.
+        const gatedTerminal = frozenGateTerminal(this.#terminal, () => this.#presentationFrozen);
         const tracedTerminal = options.inputDiagnostics === undefined
-            ? this.#terminal
-            : diagnosticTerminal(this.#terminal, phase => this.#traceRuntimePhase(phase));
+            ? gatedTerminal
+            : diagnosticTerminal(gatedTerminal, phase => this.#traceRuntimePhase(phase));
         const decoratedTerminal = options.decorateTerminal?.(tracedTerminal) ?? tracedTerminal;
         const coordination = options.inputCoordination ?? (options.inputDiagnostics === undefined
             ? undefined
@@ -297,13 +302,26 @@ export class PiTuiRuntimeAdapter {
     }
     /**
      * Writes a terminal control sequence. Used to enable and disable mouse
-     * reporting while an A1-owned application is presented, and for nothing else:
-     * the transparent and pinned paths never call it.
+     * reporting while an A1-owned application is presented and to paint the quit
+     * outro while presentation is frozen, and for nothing else: the transparent
+     * and pinned paths never call it.
      */
     writeControl(data) {
         this.#assertRunning("control sequence");
         this.#terminal.write(data);
     }
+    /**
+     * Drops every pinned frame write until the runtime stops. The quit outro owns
+     * the alternate screen between the last presented frame and the leave; the
+     * renderer keeps scheduling but nothing it paints reaches the terminal.
+     */
+    freezePresentation() {
+        this.#assertRunning("presentation freeze");
+        this.#presentationFrozen = true;
+    }
+    get presentationFrozen() {
+        return this.#presentationFrozen;
+    }
     addPreInputListener(listener) {
         if (this.#preInputListeners.has(listener))
             throw new TypeError("Pi TUI pre-input listener is already registered");
@@ -433,6 +451,9 @@ export class PiTuiRuntimeAdapter {
         }
         try {
             const stopOptions = options.preserveScreen === undefined ? undefined : { preserveScreen: options.preserveScreen };
+            // Invariant: the gate opens only for the synchronous stop sequence, so no render
+            // scheduled during the outro can slip in before the alternate screen is left.
+            this.#presentationFrozen = false;
             this.#tui.stop(stopOptions);
         }
         catch (error) {
@@ -566,6 +587,7 @@ export class PiTuiRuntimeAdapter {
             throw new Error(`Pi TUI ${operation} requires a running runtime`);
     }
     #restoreAfterFailedStart() {
+        this.#presentationFrozen = false;
         try {
             this.#tui.stop();
         }
@@ -581,6 +603,7 @@ export class PiTuiRuntimeAdapter {
         this.#terminalProgress = false;
     }
     #bestEffortTerminalRestore() {
+        this.#presentationFrozen = false;
         this.#clearTerminalProgress();
         try {
             if (this.mode === "fullscreen")
@@ -676,6 +699,32 @@ function diagnosticTerminal(terminal, trace) {
         setProgress: active => terminal.setProgress(active),
     };
 }
+function frozenGateTerminal(terminal, frozen) {
+    return {
+        get columns() { return terminal.columns; },
+        get rows() { return terminal.rows; },
+        get kittyProtocolActive() { return terminal.kittyProtocolActive; },
+        start: (onInput, onResize) => terminal.start(onInput, onResize),
+        stop: () => terminal.stop(),
+        drainInput: (maxMs, idleMs) => terminal.drainInput(maxMs, idleMs),
+        write: data => { if (!frozen())
+            terminal.write(data); },
+        moveBy: lines => { if (!frozen())
+            terminal.moveBy(lines); },
+        hideCursor: () => { if (!frozen())
+            terminal.hideCursor(); },
+        showCursor: () => { if (!frozen())
+            terminal.showCursor(); },
+        clearLine: () => { if (!frozen())
+            terminal.clearLine(); },
+        clearFromCursor: () => { if (!frozen())
+            terminal.clearFromCursor(); },
+        clearScreen: () => { if (!frozen())
+            terminal.clearScreen(); },
+        setTitle: title => terminal.setTitle(title),
+        setProgress: active => terminal.setProgress(active),
+    };
+}
 function preInputTerminal(terminal, route, frameMouse) {
     let mouse;
     return {

package/dist/integrations/pi/tui-runtime/damage-aware-terminal.d.ts

@@ -63,6 +63,13 @@ export declare class DamageAwareTerminalAdapter implements PiTuiTerminalPort {
     get kittyProtocolActive(): boolean;
     get lastDecision(): PiTuiDamageDecision;
     get hyperlinkCleanupPending(): boolean;
+    /**
+     * The rows as last forwarded to the terminal, top to bottom, with styling
+     * intact. A row the adapter has not seen since its last invalidation is empty.
+     * The quit outro animates over this snapshot because it is what the terminal
+     * shows, not what a fresh render would produce.
+     */
+    presentedRows(): readonly string[];
     /** Latches the former link rows, including rows whose replacement contains no link. */
     requestHyperlinkCleanup(rows?: readonly number[]): void;
     arm(descriptor: PiTuiDamageFrameDescriptor, safety: PiTuiDamageFrameSafety): void;

package/dist/integrations/pi/tui-runtime/damage-aware-terminal.js

@@ -40,6 +40,18 @@ export class DamageAwareTerminalAdapter {
     get kittyProtocolActive() { return this.inner.kittyProtocolActive; }
     get lastDecision() { return this.#decision; }
     get hyperlinkCleanupPending() { return this.#cleanupRevision > this.#cleanedRevision; }
+    /**
+     * The rows as last forwarded to the terminal, top to bottom, with styling
+     * intact. A row the adapter has not seen since its last invalidation is empty.
+     * The quit outro animates over this snapshot because it is what the terminal
+     * shows, not what a fresh render would produce.
+     */
+    presentedRows() {
+        const presented = [];
+        for (let row = 1; row <= this.rows; row += 1)
+            presented.push(this.#rows.get(row) ?? "");
+        return presented;
+    }
     /** Latches the former link rows, including rows whose replacement contains no link. */
     requestHyperlinkCleanup(rows) {
         this.#cleanupRevision += 1;

package/dist/native/darwin-arm64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "supported",
-  "builtAt": "2026-09-17T07:00:33.413Z",
+  "builtAt": "2026-09-17T10:19:32.993Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "9db1726bbe3fc2e8292f2ead1e7e9d0fd4d7d0dc9217b372582bf354b0f565dc",

package/dist/native/linux-x64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-17T07:00:55.073Z",
+  "builtAt": "2026-09-17T10:19:33.794Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "d8cda6b0c7cb36c0cc41e90802aceebf6c02eaebbc08a83d7d963d2e918dbd7a",

package/dist/native/win32-x64/manifest.json

@@ -5,10 +5,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-17T07:01:11.858Z",
+  "builtAt": "2026-09-17T10:20:20.745Z",
   "artifact": {
     "filename": "process-guardian.exe",
-    "sha256": "41a34706be8b325fe7bc342a0e8d62e55962addf7cd22c2a6b37553a9b8c579c",
+    "sha256": "049f0659bfe5d506a900d07e219c6a96480e8495dede8375c7ea5f9e5dc1990d",
     "size": 177664
   },
   "provenance": {

package/dist/ui/settings/declarations.d.ts

@@ -1,4 +1,4 @@
-export declare const OWNED_UI_SETTINGS_VERSION = 4;
+export declare const OWNED_UI_SETTINGS_VERSION = 5;
 export type OwnedUiSettingValue = string | number | boolean;
 export type OwnedUiSettingApplication = "live" | "restart";
 export interface OwnedUiSettingDeclaration {
@@ -15,6 +15,8 @@ export interface OwnedUiSettingDeclaration {
     readonly defaultValue: OwnedUiSettingValue;
     readonly allowedValues: readonly OwnedUiSettingValue[];
 }
+/** Playback lengths the quit outro offers, in milliseconds. */
+export declare const QUIT_EFFECT_DURATIONS_MS: readonly number[];
 export declare const OWNED_UI_SETTING_DECLARATIONS: readonly OwnedUiSettingDeclaration[];
 export declare function assertOwnedUiSettingDeclarations(declarations: readonly OwnedUiSettingDeclaration[]): void;
 export declare function findOwnedUiSettingDeclaration(declarations: readonly OwnedUiSettingDeclaration[], id: string): OwnedUiSettingDeclaration | null;

package/dist/ui/settings/declarations.js

@@ -1,7 +1,10 @@
-export const OWNED_UI_SETTINGS_VERSION = 4;
+export const OWNED_UI_SETTINGS_VERSION = 5;
 const MAX_ID_LENGTH = 64;
 const ID_PATTERN = /^[a-z][a-z0-9]*(?:[A-Z][a-z0-9]*)*$/;
 const SCROLL_SECTION = Object.freeze({ id: "scroll", title: "Scroll" });
+const QUIT_SECTION = Object.freeze({ id: "quit", title: "Quit" });
+/** Playback lengths the quit outro offers, in milliseconds. */
+export const QUIT_EFFECT_DURATIONS_MS = Object.freeze(Array.from({ length: 18 }, (_, index) => 300 + index * 100));
 export const OWNED_UI_SETTING_DECLARATIONS = Object.freeze([
     Object.freeze({
         id: "scrollbarAppearance",
@@ -48,6 +51,24 @@ export const OWNED_UI_SETTING_DECLARATIONS = Object.freeze([
         defaultValue: 100,
         allowedValues: Object.freeze([10, 20, 30, 40, 50, 60, 70, 80, 90, 100]),
     }),
+    Object.freeze({
+        id: "quitEffect",
+        label: "Effect",
+        section: QUIT_SECTION,
+        description: "Animation played over the last screen when the session quits.",
+        application: "live",
+        defaultValue: "fall",
+        allowedValues: Object.freeze(["fall", "dissolve", "starburst", "waves", "off"]),
+    }),
+    Object.freeze({
+        id: "quitEffectDurationMs",
+        label: "Duration",
+        section: QUIT_SECTION,
+        description: "Milliseconds the quit animation plays before the terminal is restored.",
+        application: "live",
+        defaultValue: 800,
+        allowedValues: QUIT_EFFECT_DURATIONS_MS,
+    }),
     Object.freeze({
         id: "promptSuggestions",
         label: "Prompt suggestions",

package/dist/ui/settings/migrations.js

@@ -29,6 +29,13 @@ export const OWNED_UI_SETTINGS_MIGRATIONS = Object.freeze([
             return { ...values };
         },
     }),
+    Object.freeze({
+        to: 5,
+        description: "Introduce the quit outro effect and duration with prototype defaults.",
+        migrate(values) {
+            return { ...values };
+        },
+    }),
 ]);
 export function assertOwnedUiSettingsMigrations(migrations, currentVersion = OWNED_UI_SETTINGS_VERSION) {
     const firstProduced = currentVersion - migrations.length + 1;

package/docs/ci-release-runbook.md

@@ -58,9 +58,9 @@ effect of stable publication, not a trigger.
 
 Ordinary type, architecture, unit/contract, and dist checks always run for code changes. Changed-file documentation and rendering run as independent parallel jobs. Rendered shell/component changes select `smoke`; viewport, scheduler, terminal adapter, evidence harness, package identity, and selector changes select `full`; unrelated changes select `none`. The aggregate accepts a skipped modular job only when the current selector requested the skip.
 
-Integration owners declare one cadence in `config/integration-owners.json`. Impact mode selects affected `pull-request` owners; an invalidator, unknown operational path, or manual Development dispatch selects every `pull-request` owner. `exhaustive` owners are never silently skipped or reported as passed: impact and aggregate evidence list them as cadence-deferred, and malformed cadence blocks selection. Full regression and nightly/stable release still execute both cadence classes.
+Integration owners declare one cadence in `config/integration-owners.json`. Impact mode selects affected `pull-request` owners: a changed production path selects its coarse owner, a changed test selects its owner, and a changed file under `test/support/` or `test/fixtures/` selects the owners of the retained tests that import it directly or through other support files (the selection lists those tests as its `shared-support` reason). A support file that no retained test imports, or a test tree the scanner cannot read, falls back to every owner the shared rule declares and records `shared-support-declared`; an invalidator, unknown operational path, or manual Development dispatch selects every `pull-request` owner. An implementation-bound PR body does not force conservative selection; it only removes the documentation-only and version-only shortcuts. The modular matrix itself is derived from the selection by `scripts/release/validation-matrix.mjs`, so inactive jobs are not scheduled at all rather than checking out and exiting early. `exhaustive` owners are never silently skipped or reported as passed: impact and aggregate evidence list them as cadence-deferred, and malformed cadence blocks selection. Full regression and nightly/stable release still execute both cadence classes.
 
-The real three-release `update-predecessor` scenario is exhaustive because four fresh npm installations dominated recent PR critical paths. PR validation retains deterministic predecessor command, lifecycle, fault, fixture, materialization, warmup, package, and update contracts. This permits a real published-history incompatibility to reach `develop` before nightly detects it; nightly failure still blocks publication. For a high-risk release/update change, explicitly dispatch `.github/workflows/full-regression.yml` before merge instead of adding the exhaustive owner back to ordinary Development.
+The real three-release `update-predecessor` scenario is exhaustive because four fresh npm installations dominated recent PR critical paths, and `update-performance` is exhaustive because its assertion is wall-clock timing on a shared runner; the update path's deterministic contracts stay on pull requests through `pi-release-resume` and `package-contracts`. PR validation retains deterministic predecessor command, lifecycle, fault, fixture, materialization, warmup, package, and update contracts. This permits a real published-history incompatibility or update slowdown to reach `develop` before the next exhaustive run detects it. `.github/workflows/full-regression.yml` runs every night at `02:47 UTC` against the `develop` tip with every owner and enforced budgets, independent of publication, so such a regression shows as a failed Full regression run the next morning; nightly publication's own complete validation still blocks publication. For a high-risk release/update change, dispatch Full regression before merge instead of adding an exhaustive owner back to ordinary Development.
 
 Development outcomes report each owner/scope invocation separately while sharing authenticated build/package preparation. The aggregate reports setup, scope, job, aggregate-processing, total runner, and runner-critical-path durations. The acceptance targets are at most eight minutes of runner critical path and five minutes for one PR-required scope; an over-target result remains unmet without retries, timeout increases, workload reduction, or mutable installation caches. Hosted queue time is reported separately when available and is not counted as test execution.
 
@@ -86,9 +86,9 @@ Rendering evidence captures each selected producer/mode/workload matrix once and
 
 ## Resource-sensitive fast validation
 
-The authoritative fast-tier declaration identifies tests that repeatedly create temporary repositories, launch child processes, mutate storage, or coordinate release cohorts. The planner removes those files from the parallel remainder and runs each exactly once in its own `vitest-fast-resource-sensitive-*` process with file parallelism disabled. Per-file process isolation prevents one resource-heavy file from consuming another file's unchanged five-second test budget; no timeout override or retry is added. Pull-request, development-package, and complete release plans use the same partition on every platform.
+The authoritative fast-tier declaration identifies tests that repeatedly create temporary repositories, launch child processes, mutate storage, or coordinate release cohorts. The planner removes those files from the parallel remainder and runs them exactly once in one serial `vitest-fast-resource-sensitive` process with file parallelism disabled, on an isolated runner that no other partition shares. One process instead of one per file removes about twenty cold starts from the partition; each file still gets a fresh module context. Pull-request, development-package, and complete release plans use the same partition on every platform.
 
-The partition retains Vitest's five-second default test timeout. It does not add a test, suite, platform, or workflow timeout, and a failure is not retried or converted to success. If a serialized test still approaches five seconds, use `scripts/release/report-resource-sensitive-validation.mjs` to record repeated per-file and test-body timing, then optimize repository setup, subprocess count, storage operations, or release fixtures. Do not increase a timeout to create margin.
+The partition runs under an explicit `--testTimeout=30000`, the same hang bound the other explicit fast-tier invocations use. That bound is a hang detector, not a performance gate: shared Windows runners vary by a factor of two or more for identical work, and a fixed five-second wall-clock limit failed passing suites on runner noise. Per-test durations remain in the reporter evidence; `scripts/release/report-resource-sensitive-validation.mjs` records repeated executions and lists every test body above five seconds under `slowTests` so a real slowdown is visible without failing the pull request. A failure is still not retried or converted to success, and the bound is not raised to create margin.
 
 Inspect the partition without running tests:
 
@@ -147,7 +147,7 @@ validation; malformed, mixed, renamed, stale, or unavailable inputs fail closed.
 A legitimate generated baseline update remains outside the allowlist and follows the
 manually accepted mixed/code path.
 
-A new implementation-bound specification starts as OpenSpec-only artifacts in one normally named draft PR. Explicit approval to implement continues in that same worktree, branch, history, and PR; the plan does not merge first. Approved refinements reconcile planning before code. After implementation, the same branch conservatively synchronizes deltas and stages the dated archive plus conditional acceptance manifest. Add one to three plain implementation-specific bullets under `## Acceptance`, mark the finalized PR ready, and require exact-head CI. Auto-merge remains disabled: an authorized maintainer's manual merge accepts the listed scenarios and atomically integrates implementation, specs, and archive. No acceptance or archive follow-up PR is created. Closing an unmerged draft integrates nothing; cleanup still needs separate approval. See [delivery and archive handoff](openspec-archive-automation.md) for commands and legacy compatibility.
+A new implementation-bound specification starts as OpenSpec-only artifacts in one normally named draft PR. Explicit approval to implement continues in that same worktree, branch, history, and PR; the plan does not merge first. Approved refinements reconcile planning before code. After implementation, add one to three plain implementation-specific bullets under `## Acceptance` and mark the PR ready; the trusted `OpenSpec finalization` workflow conservatively synchronizes deltas, stages the dated archive plus conditional acceptance manifest, and commits them to the same branch, and exact-head CI validates that head. Auto-merge remains disabled: an authorized maintainer's manual merge accepts the listed scenarios and atomically integrates implementation, specs, and archive. No acceptance or archive follow-up PR is created. Closing an unmerged draft integrates nothing; cleanup still needs separate approval. See [delivery and archive handoff](openspec-archive-automation.md) for commands and legacy compatibility.
 
 ## Numbered development previews
 

package/docs/local-worktree-cleanup.md

@@ -18,7 +18,7 @@ node scripts/governance/local-worktree-cleanup.mjs complete \
 
 `complete` is explicit cleanup authorization for that exact candidate. It creates and releases an exact registration when needed, applies the repository-owned generated-path policy, verifies live merge/archive/CI/ref evidence, evaluates only that candidate, uses journaled non-force Git removal, deletes only the unchanged local topic ref, and leaves persistent watcher authority unchanged. Repeating it reports the completed candidate as already absent. Existing conflicting ownership, identity drift, unavailable evidence, or unknown content remains blocking.
 
-The central disposable policy is `node_modules`, `dist`, `.builds`, `.artifacts/openspec-archive`, `.artifacts/validation`, `native/process-guardian/target`, and `native/terminal-host/target`. The artifact roots contain repository-generated finalization and validation reports; the two native roots contain repository-generated Cargo output. Each encountered path must be ignored and stay inside the exact worktree with no link, special file, or nested repository boundary. Authority is component-exact: `.artifacts`, sibling directories such as `.artifacts/other`, near matches such as `.artifacts/validation-user`, arbitrary `target` directories, and sibling native projects remain blocking. Tracked/staged/unstaged/untracked content and every unknown ignored path still block. A tracked regular `.gitmodules` file alone is ordinary content; actual nested `.git` metadata, gitlinks, configured submodules, and submodule changes block. Ordinary content and these approved generated roots are traversed under separate finite entry allowances, so a normal dependency installation does not consume the ordinary source-tree allowance; both allowances retain the same deadline and content-boundary checks.
+The central disposable policy is `node_modules`, `dist`, `.builds`, `.artifacts`, `native/process-guardian/target`, and `native/terminal-host/target`. The `.artifacts` root is the repository's ignored generated-artifact root (finalization and validation reports, packed candidates, agent-written logs and diffs); the two native roots contain repository-generated Cargo output. Registrations that still name `.artifacts/openspec-archive` or `.artifacts/validation` stay valid and are widened to the root on the next `complete`. Each encountered path must be ignored and stay inside the exact worktree with no link, special file, or nested repository boundary. Authority is component-exact: near matches such as `.artifacts-user` or `artifacts`, arbitrary `target` directories, and sibling native projects remain blocking. Tracked/staged/unstaged/untracked content and every unknown ignored path still block. A tracked regular `.gitmodules` file alone is ordinary content; actual nested `.git` metadata, gitlinks, configured submodules, and submodule changes block. Ordinary content and these approved generated roots are traversed under separate finite entry allowances, so a normal dependency installation does not consume the ordinary source-tree allowance; both allowances retain the same deadline and content-boundary checks. Once those checks pass, cleanup deletes the declared disposable roots itself with a bounded retry for transient Windows sharing violations before handing the worktree to Git, so non-force Git removal only has to delete tracked content. A root that stays locked after the retry budget reports `blocked` with `disposable-path-locked` and the root's path; the worktree, its `.git` pointer, and its journal are untouched, so stop the process holding the handle and rerun the same command.
 
 Agents do not manually remove generated content, call `git worktree remove`, or delete the local branch after delivery. The JSON result is authoritative: report success only for `removed` or verified `already-absent`; otherwise retain the worktree and report the exact blocker. Legacy roles can supply separate `--source-pr`, `--candidate-pr`, and `--role` values.
 
@@ -135,12 +135,16 @@ State, journals, stop controls, and execution reports live in `<git-common-dir>/
 - `unmanaged`: no local registration; no automatic adoption.
 - `removed`: worktree and eligible local-ref operations were verified.
 - `already-absent`: a completed journal's path/ref are still absent.
-- `partial`: a destructive step began but all cleanup could not be verified.
+- `partial`: a destructive step began but all cleanup could not be verified; the same command resumes it.
 - `deferred`: a bounded pass or concurrent mutation owner prevented evaluation.
 
-Non-force Git removal is the only worktree deletion operation. Local topic-ref deletion then compares the exact old SHA and refuses refs checked out elsewhere. `develop`, primary/current directories, changed heads, and active sessions are protected. Normal removal retires its own Git worktree registration; unrelated stale/missing registrations are never globally pruned.
+Non-force Git removal is the only operation that deletes tracked content from an intact worktree. Local topic-ref deletion then compares the exact old SHA and refuses refs checked out elsewhere. `develop`, primary/current directories, changed heads, and active sessions are protected. Normal removal retires its own Git worktree registration; unrelated stale/missing registrations are never globally pruned.
 
-Windows file locks can leave a directory after Git removes part of a worktree. `partial` retains that residue and its journal; there is no `rm -rf`, force discard, or automatic directory-repair fallback. Stop the locking process and review the exact residual data before separately authorized manual repair. A recreated path is not the old checkout. If a prior run fully removed the worktree and only ref cleanup remains, a subsequent enabled pass rechecks evidence and safely resumes the branch-only step.
+A released worktree whose directory was deleted by hand before cleanup ran is finished through its journal rather than failing on the missing directory: the same merge/archive evidence is verified, Git may hold no registration for the path or only this candidate's own dangling one, that registration is retired, the step is recorded as `worktree-already-absent`, and the unchanged local topic ref is deleted under the usual compare-and-delete rule. A `complete` invocation for an absent path that was never registered blocks with `worktree-absent-unregistered`, because there is no journaled head to compare the ref against.
+
+Post-merge provenance accepts a `merged` timeline event whose time is within five seconds of the pull request's `merged_at`; GitHub stamps the two from different services and has reported them one second apart. The single-event, human-actor, no-App, and same-commit checks are unchanged.
+
+Windows file locks can interrupt Git after it has already unlinked the `.git` pointer and part of the tree. That pass reports `partial` with `git-operation-failed` and keeps the journal at `remove-intent`; rerunning the same command resumes it. If the exact registered worktree is still intact, the retry re-inspects it and repeats non-force Git removal. Otherwise the retry verifies the residue: Git must no longer list the path as a valid worktree, the residue may contain no `.git` entry, link, special file, or nested repository, and every remaining regular file must either sit below a declared disposable root or match the exact tracked path and blob hash of the journaled head (`git hash-object` with the repository's filters). Only residue verified that way is removed, with the same bounded retry, after which this candidate's own dangling Git registration is retired and ref cleanup continues. A residue with any unknown, changed, or boundary-violating path reports `residual-content` and lists the offending paths for manual review; a residue that is still locked reports `residual-locked` and is retried on a later pass. `git worktree prune` is never run. A recreated or foreign worktree at the path reports `residual-or-reused-path` and needs a new registration. If a prior run fully removed the worktree and only ref cleanup remains, a subsequent pass rechecks evidence and safely resumes the branch-only step.
 
 Ownership is cooperative: managed sessions must claim before use. It cannot police arbitrary external editors. Remote ref checks and local deletion also are not one distributed transaction; refs are read immediately before destructive steps, and uncertain identities always block.
 

package/docs/manual-owned-ui-checkpoint.md

@@ -57,8 +57,9 @@ Use equivalent values in bare A1 and the Pi comparison profile. Exercise both a
 - [ ] Trust startup: from an undecided project, compare selected Trust/Do not trust rows, arrow navigation, Enter, Escape/Ctrl+C, clearing, cursor state, and restoration. No project extension/theme/prompt/skill may run before selection, and a fail-closed diagnostic must appear once on the restored parent rather than above a blank fullscreen frame.
 - [ ] Terminal lifecycle: toggle hardware cursor, clear-on-shrink, and terminal progress; resize smaller/larger; open/close selectors; select and copy transcript text; verify no duplicate rows, stale OSC progress, leaked mouse mode, misplaced cursor, or broken parent input.
 - [ ] Images: in Kitty or iTerm2 verify inline width and clipping; in Windows Terminal verify the textual fallback and absence of image protocol bytes without hiding `showImages`.
-- [ ] Fullscreen exit `transcript`: verify the parent is restored before styled user, assistant Markdown, thinking, tool, notice, warning, error, and spacing rows are printed. No overlay, draft, animation, scrollbar, or inline-image payload may appear.
-- [ ] Fullscreen exit `resume-hint`: verify only dim `To resume this session:` plus `a1 --session <compact-id>` is printed for the default directory. A custom directory must place quoted `--session-dir <dir>` before `--session`; the raw default `.jsonl` path must never print.
+- [ ] Bare A1 quit (`/quit` and the second `Ctrl+C`): the configured quit effect plays over the last frame on the alternate screen, the terminal is restored once, and the parent shows only its earlier scrollback plus the dim `To resume this session:` hint. No frame rows, transcript rows, editor box, or footer may remain. With `/settings` → Quit → Effect set to `off`, the leave is immediate and the parent output is identical.
+- [ ] Fullscreen exit `transcript` (`a1 pi` only): verify the parent is restored before styled user, assistant Markdown, thinking, tool, notice, warning, error, and spacing rows are printed. No overlay, draft, animation, scrollbar, or inline-image payload may appear.
+- [ ] Fullscreen exit `resume-hint` (`a1 pi`) and bare A1: verify only dim `To resume this session:` plus `a1 --session <compact-id>` is printed for the default directory. A custom directory must place quoted `--session-dir <dir>` before `--session`; the raw default `.jsonl` path must never print.
 
 Record acceptance with:
 

package/docs/openspec-archive-automation.md

@@ -12,8 +12,8 @@ Version-1 and version-2 deliveries and their existing comments, acceptance PRs,
 2. **Same-PR implementation:** continue after explicit approval in the same worktree, branch, history, draft PR, and phase-free body. Reconcile approved refinements in proposal, design, deltas, and tasks before corresponding code edits.
 3. **Complete evidence:** finish implementation, required tests/evidence, substantive tasks, and explicit known-gap disposition. CI success is objective evidence, not acceptance.
 4. **Plain acceptance list:** keep the body phase-free and add final `## Acceptance` with one to three concise implementation-specific behavior-and-result bullets. Do not use checkboxes, generic review/CI/approval/archive statements, URLs, mentions, or automated-test inventory.
-5. **In-branch finalization:** reconcile current `origin/develop`, conservatively synchronize all deltas, move the active change into its dated archive, and stage the conditional acceptance manifest in the same branch.
-6. **Ready and validate:** mark the finalized PR ready without changing its body lifecycle marker because none exists. One normal exact-head workflow validates the implementation, synchronized specs, archive, manifest, tasks/evidence, exact PR-body list, and every selected product/governance scope before emitting the stable protected aggregate. A new commit, acceptance-list change, or advanced target requires full renewed validation; no lifecycle body edit or second workflow run is required.
+5. **Ready and automated finalization:** mark the PR ready. The trusted `OpenSpec finalization` workflow reconciles current `develop`, conservatively synchronizes all deltas, moves the active change into its dated archive, stages the conditional acceptance manifest, commits that to the same branch with the archive App identity, and writes the emitted paths into the body's implementation fence. Running the [finalization command](#finalization-command) locally first is optional and yields the same bytes.
+6. **Validate:** one normal exact-head workflow validates the finalized head: implementation, synchronized specs, archive, manifest, tasks/evidence, exact PR-body list, and every selected product/governance scope before emitting the stable protected aggregate. A new commit or acceptance-list change re-finalizes automatically when needed and requires full renewed validation; no lifecycle body edit or second workflow run is required.
 7. **Manual merge accepts:** after the stable protected aggregate succeeds, an authorized human reviews and manually merges the exact validated head. That single action means the listed scenarios are accepted and explicitly authorizes integration. Auto-merge, merge queue, Apps, bots, and documentation reconciliation are forbidden.
 8. **Verify and clean:** trusted post-merge policy derives `Archived` and reports `accepted-and-archived` from committed bytes and immutable GitHub provenance without editing the accepted PR body. It publishes no lifecycle branch or PR. Shared exact-head remote cleanup may delete the unchanged topic ref; local cleanup remains separately ownership-controlled.
 
@@ -69,7 +69,7 @@ Do not add a quoted phase line or a routine `Validation` section listing command
 </details>
 ```
 
-Keep acceptance absent during proposal review so unfinished intent is not mistaken for final acceptance criteria. Keep the finalized phase-free body unchanged through exact-head validation, maintainer review, and authorized manual merge. The same workflow run validates its finalized delivery record and applicable product/governance scopes before the stable protected aggregate succeeds. Do not add a lifecycle body edit or start a second validation run. After manual merge, trusted verification derives `Archived`; do not rewrite the accepted body.
+Keep acceptance absent during proposal review so unfinished intent is not mistaken for final acceptance criteria. The finalization workflow rewrites only the implementation fence; keep the rest of the phase-free body unchanged through exact-head validation, maintainer review, and authorized manual merge. The same workflow run validates its finalized delivery record and applicable product/governance scopes before the stable protected aggregate succeeds. Do not add a lifecycle body edit or start a second validation run. After manual merge, trusted verification derives `Archived`; do not rewrite the accepted body.
 
 ## Version-3 implementation metadata
 
@@ -129,9 +129,22 @@ The committed conditional manifest contains the same ordered text. Trusted polic
 
 If the body list changes, candidate validation reruns and compares it with the committed manifest. If the head changes, all prior exact-head CI is stale. If only the body changes to disagree with the manifest, integration remains blocked until the list and committed candidate agree again. No lifecycle body edit is needed after green CI.
 
+## Automated finalization
+
+The `OpenSpec finalization` workflow (`.github/workflows/openspec-finalization.yml`) runs on `pull_request_target` for `synchronize`, `ready_for_review`, `reopened`, and `edited` events of every non-draft PR targeting `develop`, one event at a time per PR. It checks out default-branch policy, installs the pinned tooling without hooks, and runs `scripts/governance/publish-openspec-finalization.mjs --pr <n>`; the PR head enters that process only as the `openspec/` tree the pinned OpenSpec engine reads. Drafts, closed, legacy, and unassociated PRs are skipped. For a version-3 candidate it reconciles the head to its finalized form:
+
+- **Active and current:** ordinary finalization with today's UTC date; one `docs(openspec): finalize <change>` commit.
+- **Finalized, valid, and current:** nothing is pushed; the run reports `already-finalized`.
+- **Finalized but drifted:** a later commit edited the archived tasks, evidence, design, or deltas, or the acceptance list changed. Finalization reruns from the archived form under the same archive date; one `docs(openspec): refinalize <change>` commit replaces the manifest and resynchronized specs.
+- **Behind `develop`:** a restore commit returns the archive to its active form with the merge-base's spec bytes, a merge of `develop` follows, and finalization runs against the new tip. A merge conflict outside `openspec/` stops the run with `finalization-merge-conflict`; rebase or merge `develop` yourself and push.
+
+The commit is pushed with a lease on the head the run read, so a developer push in between makes the run report `retry` and the next event finishes the work. Only after the push does the workflow `PATCH` the body fence, and only when the body is unchanged since it was read. The workflow's own push and body edit trigger further runs that report `already-finalized`. Every pushed commit is either a merge of the exact `develop` tip or confined to the change's active path, its archive path, and its declared canonical specs.
+
+Because the branch gains commits from the archive App, pull before pushing. A rebase that drops them is harmless: the next push is reconciled from whatever the head contains. Do not revert a finalization commit to make a fix; push the fix and let the workflow re-finalize. When the workflow fails, its summary names the finalization code (`tasks-incomplete`, `acceptance-*`, `delivery-known-gaps`, `openspec-operation`, `finalization-merge-conflict`, ...), nothing is pushed, and `Finalized delivery validation` on the unfinalized head reports that automated finalization is pending.
+
 ## Finalization command
 
-Finalization has inspection mode by default and an explicit `--write` mode. It never commits, pushes, edits GitHub, marks a PR ready, or merges. Use a temporary body file so the operation can update exact version-3 paths without mutating remote PR state:
+The local command remains available for inspection or when a developer prefers to finalize before marking the PR ready; the workflow then verifies the head and pushes nothing. It has inspection mode by default and an explicit `--write` mode. It never commits, pushes, edits GitHub, marks a PR ready, or merges. Use a temporary body file so the operation can update exact version-3 paths without mutating remote PR state:
 
 ```bash
 git fetch origin develop
@@ -164,7 +177,7 @@ Use repeated `--known-gap "exact disposition"` only for an actually reviewed exp
 
 The operation validates the active change strictly, requires complete substantive tasks, runs the pinned OpenSpec archive/synchronization engine in isolation, verifies the resulting canonical specs, retains every archive artifact, computes deterministic content digests, writes `acceptance.md`, and applies only the allowed OpenSpec diff. Repeating it against identical finalized inputs is verification-only and byte-stable.
 
-Before finalization, canonical specs must still equal the selected target. If `develop` advances, rebase/reconcile and regenerate. To refine a finalized but unmerged change, restore the active artifacts with ordinary branch history, update plan/code coherently, and rerun finalization; never hand-edit only the synchronized spec or archive copy.
+Before a first finalization, canonical specs must still equal the selected target. On an already finalized head the command re-finalizes from the archived form: it resets the synchronized specs to the target's bytes, reapplies the deltas, and rewrites the manifest under the same archive path, reporting `refinalized` (or `would-refinalize` without `--write`). If `develop` advances, merge or rebase onto it and rerun; the archive engine, not a hand edit, must produce the synchronized spec and archive copy.
 
 ## Conditional acceptance and derived receipt
 
@@ -183,11 +196,11 @@ Unavailable, stale, automatic, unauthorized, conflicting, or contradictory prove
 
 ## CI and automation ownership
 
-Normal Development CI remains complete for the implementation. An archive-shaped final diff does not select documentation-only validation because the authoritative version-3 association remains implementation-bound. The trusted acceptance-policy job validates finalization from base-controlled policy while ordinary impact selection retains all applicable product and governance owners.
+Normal Development CI remains complete for the implementation. An archive-shaped final diff does not select documentation-only validation because the authoritative version-3 association remains implementation-bound. The trusted acceptance-policy job validates finalization from base-controlled policy while ordinary impact selection retains all applicable product and governance owners. A ready head that still holds the active change fails that job with an `Awaiting automated finalization` notice pointing at the finalization workflow; the head the workflow pushes receives its own complete validation, and `Development validation` cancels the superseded run.
 
 `pull_request` body edits rerun required CI. The ordinary finalized phase-free run exposes the stable protected aggregate directly; it does not wait for a lifecycle body edit. Documentation auto-merge's trusted owner also reevaluates lifecycle association and disables any armed merge. Every publication entry point explicitly refuses version 3.
 
-The OpenSpec archive workflow remains default-branch trusted. For version 3 it uses read-only contents, PR, and Actions access to report the integrated result; App credentials are unnecessary and are not minted. For legacy candidates it retains its existing scoped App publication behavior.
+The OpenSpec archive workflow remains default-branch trusted. For version 3 it uses read-only contents, PR, and Actions access to report the integrated result; App credentials are unnecessary and are not minted for post-merge verification. For legacy candidates it retains its existing scoped App publication behavior. The OpenSpec finalization workflow is the one version-3 user of the archive App: it mints a short-lived installation token with `contents: write` and `pull_requests: write`, pushes only to the candidate's own branch under a lease, edits only the body fence, and revokes the token when the run ends.
 
 ## Status and audit
 
@@ -230,7 +243,7 @@ This bootstrap policy itself finishes under deployed version-2 authority. The fi
 
 - draft planning remaining unmerged;
 - explicit plan approval and same-PR implementation;
-- current-target finalization and exact-head CI;
+- automated current-target finalization and exact-head CI;
 - authorized human manual merge with plain acceptance scenarios;
 - integrated canonical specs/archive and no generated acceptance/archive PR;
 - read-only `accepted-and-archived` verification and exact-head branch cleanup;