@timurproko/a1 0.2.5-dev.704 → 0.2.6-dev.717

package/dist/app/session-shell/session-shell-root.d.ts

@@ -5,6 +5,7 @@ import type { UiRouteHost, UiRouteInput } from "../../ui/apps/contracts.js";
 import type { TranscriptViewportFrame, TranscriptViewportFrameDescriptor } from "../../ui/components/transcript-viewport.js";
 import type { PiEngineAdapter } from "../../integrations/pi/engine/adapter.js";
 import type { PiWorkflowMessage, PiWorkflowResult } from "../../integrations/pi/engine/workflows.js";
+import type { PiShellLazySelectorLoader } from "../../integrations/pi/components/lazy-selectors.js";
 import { type PiShellHotkeysPresentation } from "../../integrations/pi/components/shell-presenters-info.js";
 import { type PiShellClipboardContent, type PiShellComponentPort, type PiShellEditorPort, type PiShellExtensionRendererResolver, type PiShellHeaderOptions, type PiShellHeaderPort, type PiShellImageAssetResolver, type PiShellLoadedResourcesPort, type PiShellResourceEntry, type PiShellTranscriptComponentPort } from "../../integrations/pi/components/shell-shared-facade.js";
 import { type PiTuiInputCoordinationScheduler, type PiTuiInputSurfaceKind } from "../../integrations/pi/tui-runtime/input-presentation-coordinator.js";
@@ -116,6 +117,8 @@ export interface OwnedUiShellDiagnosticOptions {
     readonly paste?: (event: PasteEvent) => void;
     /** Test seams for isolated paste preparation: an in-process starter, or the forked helper's entry. */
     readonly pastePreparation?: Omit<PastePreparationClientOptions, "onEvent" | "spareIdleMs">;
+    /** Test seam for pending and failed optional selector-module preparation. */
+    readonly lazySelectors?: PiShellLazySelectorLoader;
 }
 /** Live prompt-image admission policy supplied only by the bare-A1 profile. */
 export interface OwnedUiShellPromptImagesOptions {

package/dist/app/session-shell/session-shell.js

@@ -14,7 +14,7 @@ import { createPiExtensionUiBridge } from "../../integrations/pi/components/shel
 import { createPiShellEditor } from "../../integrations/pi/components/shell-editor-autocomplete.js";
 import { SKILLS_COMMAND_NAME, findSkillByArgument, rewriteSkillsTunnelSubmission, skillPrompt, skillsFromCommands, } from "../../integrations/pi/components/skills-command.js";
 import { createPiQueuedInputStatus, createPiShellFooter, createPiShellHeader, createPiShellLoadedResources, createPiShellStatus, } from "../../integrations/pi/components/shell-footer-status.js";
-import { createPiShellArmin, createPiShellAuthProviderSelector, createPiShellDialog, createPiShellEarendilAnnouncement, createPiShellExtensionSelector, createPiShellLoginDialog, createPiShellModelSelector, createPiShellModelsDialog, createPiShellReloadBox, createPiShellScopedModelsSelector, createPiShellSelector, createPiShellSessionSelector, createPiShellSettingsSelector, createPiShellSkillsSelector, createPiShellTreeSelector, createPiShellTrustSelector, createPiShellUserMessageSelector, } from "../../integrations/pi/components/shell-selectors-dialogs.js";
+import { createPiShellArmin, createPiShellAuthProviderSelector, createPiShellDialog, createPiShellEarendilAnnouncement, createPiShellExtensionSelector, createPiShellLoginDialog, createPiShellModelSelector, createPiShellModelsDialog, createPiShellReloadBox, createPiShellScopedModelsSelector, createPiShellSelector, createPiShellSessionSelector, createPiShellSettingsSelector, createPiShellSkillsSelector, createPiShellTrustSelector, createPiShellUserMessageSelector, } from "../../integrations/pi/components/shell-selectors-dialogs.js";
 import { createPiShellChangelog, createPiShellHotkeys, createPiShellSessionInfo, renderPiShellPackageUpdateNotice, renderPiShellStatusText, } from "../../integrations/pi/components/shell-presenters-info.js";
 import { createPiShellTranscriptComponent, renderPiShellStartupDiagnostic, renderPiShellTranscriptBlock, } from "../../integrations/pi/components/shell-presenters-transcript.js";
 import { onPiThemeChange, piTheme } from "../../integrations/pi/components/upstream/theme/theme.js";
@@ -62,6 +62,8 @@ export class OwnedUiSessionShell {
     // Invariant: translated startup diagnostics create at most one dock notice per kind per shell.
     #startupTrustHandled = false;
     #customViewport;
+    #lazySelectors;
+    #lazySelectorsPromise;
     #responseCopy;
     // Rationale: only an executor this shell created owns a spare copy helper worth warming and disposing.
     #copyExecutor;
@@ -100,6 +102,7 @@ export class OwnedUiSessionShell {
         this.#routeHost = routeHost ?? null;
         this.#startupRoute = options.engine.startupRoute;
         this.#customViewport = sessionLayout === "custom-viewport";
+        this.#lazySelectors = options.diagnostics?.lazySelectors;
         this.#stopped = new Promise(resolve => {
             this.#resolveStopped = resolve;
         });
@@ -622,6 +625,7 @@ export class OwnedUiSessionShell {
             if (this.#disposed || !this.#customViewport)
                 return;
             this.#presentStartupRoute();
+            void this.#loadLazySelectors().then(selectors => selectors.prepare()).catch(() => { });
             this.root.warmPastePreparation();
             this.#copyExecutor?.warm();
         });
@@ -900,6 +904,14 @@ export class OwnedUiSessionShell {
         this.#dialogHandle = handle;
         return handle;
     }
+    #loadLazySelectors() {
+        if (this.#lazySelectors !== undefined)
+            return Promise.resolve(this.#lazySelectors);
+        return this.#lazySelectorsPromise ??= import("../../integrations/pi/components/lazy-selectors.js").then(module => {
+            this.#lazySelectors = module.piShellLazySelectors;
+            return module.piShellLazySelectors;
+        });
+    }
     async showThinkingSelector() {
         const snapshot = this.backend.pinnedSettingsSnapshot();
         const close = () => {
@@ -911,14 +923,32 @@ export class OwnedUiSessionShell {
             close();
             void this.runWorkflow({ command: "thinking", argument: "", selection: level });
         };
-        const { createPiShellThinkingSelector } = await import("../../integrations/pi/components/thinking-selector-dialog.js");
-        const component = createPiShellThinkingSelector(snapshot.thinkingLevel, snapshot.availableThinkingLevels, select, close, level => this.backend.setDefaultThinkingLevel(level), snapshot.defaultThinkingLevel, this.#customViewport ? {
-            profile: "bare",
-            cycleBinding: this.root.editor.keybindingConfig()["app.thinking.cycle"] ?? [],
-        } : undefined);
-        this.root.setFooterLevel(false);
-        this.root.setInputSurface(component);
-        this.runtime.requestRender();
+        const releasePresentation = this.#customViewport ? this.runtime.beginPresentationHold() : undefined;
+        try {
+            const selectors = await this.#loadLazySelectors();
+            const component = await selectors.createThinking({
+                currentLevel: snapshot.thinkingLevel,
+                availableLevels: snapshot.availableThinkingLevels,
+                onSelect: select,
+                onCancel: close,
+                onSelectAsDefault: level => this.backend.setDefaultThinkingLevel(level),
+                defaultLevel: snapshot.defaultThinkingLevel,
+                ...(this.#customViewport ? {
+                    presentation: {
+                        profile: "bare",
+                        cycleBinding: this.root.editor.keybindingConfig()["app.thinking.cycle"] ?? [],
+                    },
+                } : {}),
+            });
+            if (this.#disposed)
+                return;
+            this.root.setFooterLevel(false);
+            this.root.setInputSurface(component);
+            this.runtime.requestRender();
+        }
+        finally {
+            releasePresentation?.();
+        }
     }
     /** The Skills dialog: a replacement input like the model selector, applying the chosen skill through the prompt path. */
     showSkillsSelector(skills = this.#skillSummaries()) {
@@ -1050,47 +1080,56 @@ export class OwnedUiSessionShell {
             this.root.setInputSurface(null);
             this.runtime.requestRender();
         };
-        const component = await createPiShellTreeSelector({
-            tree: context.tree,
-            currentLeafId: context.currentLeafId,
-            terminalHeight: this.runtime.viewport().rows,
-            initialFilterMode: context.filterMode,
-            ...(initialSelectedId === undefined ? {} : { initialSelectedId }),
-            onLabelChange: context.appendLabelChange,
-            onCopy: text => {
-                if (!text) {
-                    this.root.appendWorkflowResult({ command: "tree", outcome: "failed", message: "Selected entry has no text to copy" });
-                    this.runtime.requestRender();
-                    return;
-                }
-                const generation = this.backend.sessionBindingGeneration;
-                void this.backend.copyWorkflowText(text).then(acknowledged => {
-                    if (this.#disposed || generation !== this.backend.sessionBindingGeneration)
+        const releasePresentation = this.#customViewport ? this.runtime.beginPresentationHold() : undefined;
+        try {
+            const selectors = await this.#loadLazySelectors();
+            const component = await selectors.createTree({
+                tree: context.tree,
+                currentLeafId: context.currentLeafId,
+                terminalHeight: this.runtime.viewport().rows,
+                initialFilterMode: context.filterMode,
+                ...(initialSelectedId === undefined ? {} : { initialSelectedId }),
+                onLabelChange: context.appendLabelChange,
+                onCopy: text => {
+                    if (!text) {
+                        this.root.appendWorkflowResult({ command: "tree", outcome: "failed", message: "Selected entry has no text to copy" });
+                        this.runtime.requestRender();
                         return;
-                    this.root.appendWorkflowStatus(acknowledged ? "Copied selected message to clipboard" : "Submitted selected message to clipboard");
-                    this.runtime.requestRender();
-                }).catch(error => {
-                    if (this.#disposed || generation !== this.backend.sessionBindingGeneration)
+                    }
+                    const generation = this.backend.sessionBindingGeneration;
+                    void this.backend.copyWorkflowText(text).then(acknowledged => {
+                        if (this.#disposed || generation !== this.backend.sessionBindingGeneration)
+                            return;
+                        this.root.appendWorkflowStatus(acknowledged ? "Copied selected message to clipboard" : "Submitted selected message to clipboard");
+                        this.runtime.requestRender();
+                    }).catch(error => {
+                        if (this.#disposed || generation !== this.backend.sessionBindingGeneration)
+                            return;
+                        this.root.appendWorkflowResult({ command: "tree", outcome: "failed", message: error instanceof Error ? error.message : String(error) });
+                        this.runtime.requestRender();
+                    });
+                },
+                onCancel: close,
+                onSelect: entryId => {
+                    if (entryId === context.currentLeafId) {
+                        close();
+                        this.root.appendWorkflowStatus("Already at this point");
+                        this.runtime.requestRender();
                         return;
-                    this.root.appendWorkflowResult({ command: "tree", outcome: "failed", message: error instanceof Error ? error.message : String(error) });
-                    this.runtime.requestRender();
-                });
-            },
-            onCancel: close,
-            onSelect: entryId => {
-                if (entryId === context.currentLeafId) {
-                    close();
-                    this.root.appendWorkflowStatus("Already at this point");
-                    this.runtime.requestRender();
-                    return;
-                }
-                if (context.skipSummaryPrompt)
-                    close();
-                void this.#completeTreeSelection(entryId, context.skipSummaryPrompt);
-            },
-        });
-        this.root.setInputSurface(component);
-        this.runtime.requestRender();
+                    }
+                    if (context.skipSummaryPrompt)
+                        close();
+                    void this.#completeTreeSelection(entryId, context.skipSummaryPrompt);
+                },
+            });
+            if (this.#disposed)
+                return;
+            this.root.setInputSurface(component);
+            this.runtime.requestRender();
+        }
+        finally {
+            releasePresentation?.();
+        }
     }
     showLoginAuthTypeSelector() {
         const close = () => {

package/dist/composition/settings-route-host.js

@@ -1,4 +1,4 @@
-import { CHANGELOG_ROUTE, CHANGELOG_TITLE, HOTKEYS_ROUTE, HOTKEYS_TITLE, } from "../features/owned-ui/reference-routes.js";
+import { CHANGELOG_ROUTE, HOTKEYS_ROUTE, HOTKEYS_TITLE } from "../features/owned-ui/reference-routes.js";
 import { SETTINGS_APP_ID, SETTINGS_ROUTE } from "../features/owned-ui/settings-route.js";
 import { piTheme } from "../integrations/pi/components/upstream/theme/theme.js";
 import { faint } from "../ui/components/text.js";
@@ -15,7 +15,7 @@ export function createOwnedRouteHost(settings, references) {
             }
             const changelog = route === CHANGELOG_ROUTE;
             const session = route === "session";
-            const title = session ? "Session Info" : changelog ? CHANGELOG_TITLE : HOTKEYS_TITLE;
+            const title = session ? "Session Info" : changelog ? input ? "What's New" : "Changelog" : HOTKEYS_TITLE;
             const document = session ? references.session() : changelog ? references.changelog(input) : references.hotkeys();
             return deferredSurface(route, title, () => loadReferenceSurface(settings, route, route, title, document));
         },

package/dist/features/owned-ui/reference-routes.d.ts

@@ -1,6 +1,6 @@
 export declare const CHANGELOG_APP_ID = "changelog";
 export declare const CHANGELOG_ROUTE = "changelog";
-export declare const CHANGELOG_TITLE = "What's New";
+export declare const CHANGELOG_TITLE = "Changelog";
 export declare const HOTKEYS_APP_ID = "hotkeys";
 export declare const HOTKEYS_ROUTE = "hotkeys";
 export declare const HOTKEYS_TITLE = "Keyboard Shortcuts";

package/dist/features/owned-ui/reference-routes.js

@@ -1,6 +1,6 @@
 export const CHANGELOG_APP_ID = "changelog";
 export const CHANGELOG_ROUTE = "changelog";
-export const CHANGELOG_TITLE = "What's New";
+export const CHANGELOG_TITLE = "Changelog";
 export const HOTKEYS_APP_ID = "hotkeys";
 export const HOTKEYS_ROUTE = "hotkeys";
 export const HOTKEYS_TITLE = "Keyboard Shortcuts";

package/dist/features/owned-ui/resources/release-notes.json

@@ -1,6 +1,10 @@
 {
   "schema": "a1-release-notes-v1",
   "releases": [
+    {
+      "version": "0.2.5",
+      "markdown": "## [0.2.5] - 2026-10-07\n\n### New Features\n\n- show session info full screen ([#680](https://github.com/timurproko/a1/pull/680))\n- redesign session tree dialog ([#682](https://github.com/timurproko/a1/pull/682))\n- add name command input dialog ([#694](https://github.com/timurproko/a1/pull/694))\n\n### Changed\n\n- refine animated separator ([#681](https://github.com/timurproko/a1/pull/681))\n- upgrade pinned Pi to 1.0.4 ([#683](https://github.com/timurproko/a1/pull/683))\n- unify selection treatment ([#686](https://github.com/timurproko/a1/pull/686))\n- align project trust dialogs ([#687](https://github.com/timurproko/a1/pull/687))\n- standardize share dialog ([#689](https://github.com/timurproko/a1/pull/689))\n- align Resume Session dialog ([#693](https://github.com/timurproko/a1/pull/693))\n- unify dialog close hints ([#695](https://github.com/timurproko/a1/pull/695))\n- accent model scope markers ([#696](https://github.com/timurproko/a1/pull/696))\n\n### Fixed\n\n- wrap session file after label ([#684](https://github.com/timurproko/a1/pull/684))\n- align thinking markers with models ([#685](https://github.com/timurproko/a1/pull/685))\n- place new-session notice above prompt ([#688](https://github.com/timurproko/a1/pull/688))\n- close dialogs with Ctrl+C ([#690](https://github.com/timurproko/a1/pull/690))\n- restore suggestion after Backspace ([#691](https://github.com/timurproko/a1/pull/691))\n- cycle dialog filters backward ([#692](https://github.com/timurproko/a1/pull/692))\n- avoid initial value-menu highlight ([#697](https://github.com/timurproko/a1/pull/697))\n- keep session root expanded ([#698](https://github.com/timurproko/a1/pull/698))\n- hide skill prefixes in collapsed menu ([#699](https://github.com/timurproko/a1/pull/699))\n- omit space after command completion ([#700](https://github.com/timurproko/a1/pull/700))\n- stabilize values and add undo ([#701](https://github.com/timurproko/a1/pull/701))\n- standardize typing search hints ([#702](https://github.com/timurproko/a1/pull/702))\n- show tree time toggle state ([#703](https://github.com/timurproko/a1/pull/703))\n- refine resume search hints ([#704](https://github.com/timurproko/a1/pull/704))\n"
+    },
     {
       "version": "0.2.4",
       "markdown": "## [0.2.4] - 2026-10-05\n\n### Changed\n\n- upgrade pinned Pi to 1.0.0 ([#658](https://github.com/timurproko/a1/pull/658))\n- upgrade pinned Pi to 1.0.2 ([#669](https://github.com/timurproko/a1/pull/669))\n- add animated mark, section art, and browser preview ([#665](https://github.com/timurproko/a1/pull/665))\n- keep the hero mark still and link only it to the site ([#666](https://github.com/timurproko/a1/pull/666))\n- pick dark-mode art via picture sources ([#668](https://github.com/timurproko/a1/pull/668))\n\n### Fixed\n\n- make self-update upgrades reliable ([#664](https://github.com/timurproko/a1/pull/664))\n- restore the terminal and print a resume hint when a1 is killed ([#667](https://github.com/timurproko/a1/pull/667))\n- align progress with Pi accent ([#671](https://github.com/timurproko/a1/pull/671))\n- support Git URL rewrites ([#673](https://github.com/timurproko/a1/pull/673))\n- support repository relocation ([#675](https://github.com/timurproko/a1/pull/675))\n- prevent bottom control gutter bleed ([#677](https://github.com/timurproko/a1/pull/677))\n"

package/dist/integrations/pi/components/lazy-selectors.d.ts

@@ -0,0 +1,42 @@
+import type { PiShellComponentPort } from "./shell-shared-facade.js";
+import type { ThinkingSelectorLevel } from "./upstream/components/thinking-selector.js";
+import type { FilterMode } from "./upstream/components/tree-selector.js";
+type ThinkingSelectorModule = typeof import("./thinking-selector-dialog.js");
+type TreeSelectorModule = typeof import("./upstream/components/tree-selector.js");
+export interface PiShellLazyThinkingSelectorOptions {
+    readonly currentLevel: ThinkingSelectorLevel;
+    readonly availableLevels: readonly ThinkingSelectorLevel[];
+    readonly onSelect: (level: ThinkingSelectorLevel) => void;
+    readonly onCancel: () => void;
+    readonly onSelectAsDefault?: (level: ThinkingSelectorLevel) => void;
+    readonly defaultLevel?: ThinkingSelectorLevel;
+    readonly presentation?: {
+        readonly profile: "bare";
+        readonly cycleBinding: string | readonly string[];
+    };
+}
+export interface PiShellLazyTreeSelectorOptions {
+    readonly tree: readonly unknown[];
+    readonly currentLeafId: string | null;
+    readonly terminalHeight: number;
+    readonly onSelect: (id: string) => void;
+    readonly onCancel: () => void;
+    readonly onLabelChange: (entryId: string, label: string | undefined) => void;
+    readonly onCopy?: (text: string | undefined) => void;
+    readonly initialSelectedId?: string;
+    readonly initialFilterMode?: FilterMode;
+}
+export interface PiShellLazySelectorLoader {
+    prepare(): Promise<void>;
+    createThinking(options: PiShellLazyThinkingSelectorOptions): Promise<PiShellComponentPort>;
+    createTree(options: PiShellLazyTreeSelectorOptions): Promise<PiShellComponentPort>;
+}
+export interface PiShellLazySelectorImports {
+    readonly thinking: () => Promise<ThinkingSelectorModule>;
+    readonly tree: () => Promise<TreeSelectorModule>;
+}
+/** Builds one idempotent selector loader; fulfilled, in-flight, and rejected imports remain shared. */
+export declare function createPiShellLazySelectorLoader(imports?: PiShellLazySelectorImports): PiShellLazySelectorLoader;
+/** Production selector loader, dynamically reached only after the first input-ready frame. */
+export declare const piShellLazySelectors: PiShellLazySelectorLoader;
+export {};

package/dist/integrations/pi/components/lazy-selectors.js

@@ -0,0 +1,32 @@
+import { componentPort, ensureTheme } from "./shell-shared-facade.js";
+const DEFAULT_IMPORTS = {
+    thinking: () => import("./thinking-selector-dialog.js"),
+    tree: () => import("./upstream/components/tree-selector.js"),
+};
+/** Builds one idempotent selector loader; fulfilled, in-flight, and rejected imports remain shared. */
+export function createPiShellLazySelectorLoader(imports = DEFAULT_IMPORTS) {
+    let thinkingSelectorModule;
+    let treeSelectorModule;
+    const loadThinkingSelector = () => thinkingSelectorModule ??= imports.thinking();
+    const loadTreeSelector = () => treeSelectorModule ??= imports.tree();
+    return {
+        async prepare() {
+            // Performance: allSettled observes background failures while retaining each rejected module for explicit route recovery.
+            await Promise.allSettled([loadThinkingSelector(), loadTreeSelector()]);
+        },
+        async createThinking(options) {
+            const { createPiShellThinkingSelector } = await loadThinkingSelector();
+            return createPiShellThinkingSelector(options.currentLevel, options.availableLevels, options.onSelect, options.onCancel, options.onSelectAsDefault, options.defaultLevel, options.presentation);
+        },
+        async createTree(options) {
+            ensureTheme();
+            const { TreeSelectorComponent } = await loadTreeSelector();
+            const selector = new TreeSelectorComponent([...options.tree], options.currentLeafId, options.terminalHeight, options.onSelect, options.onCancel, options.onLabelChange, options.initialSelectedId, options.initialFilterMode);
+            if (options.onCopy)
+                selector.onCopy = options.onCopy;
+            return componentPort(selector);
+        },
+    };
+}
+/** Production selector loader, dynamically reached only after the first input-ready frame. */
+export const piShellLazySelectors = createPiShellLazySelectorLoader();

package/dist/integrations/pi/components/upstream/components/session-selector.js

@@ -8,8 +8,8 @@
  * frame with standalone title, standard outer rules, stable filter/status row, progressive result
  * paging, aligned result columns, Session Tree selection roles, quiet in-field query syntax guidance,
  * and one-line bottom dynamic feedback and searchable-dialog shortcut footer. Selected session rows
- * use the blue selection surface, success-green primary title, muted metadata, and ordinary text
- * weight.
+ * use the blue selection surface while preserving title and metadata foregrounds; the active session
+ * title uses success green independently of keyboard selection, with ordinary text weight.
  * Deviations: owned-modal-shortcut-hints, owned-resume-session-dialog,
  * owned-standard-dialog-selection.
  */
@@ -473,19 +473,13 @@ class SessionList {
                 messageColor = "error";
             }
             else if (isCurrent) {
-                messageColor = "accent";
+                messageColor = "success";
             }
             else if (hasName) {
                 messageColor = "warning";
             }
-            const styledMsg = isConfirmingDelete
-                ? theme.fg("error", truncatedMsg)
-                : isSelected
-                    ? theme.fg("success", truncatedMsg)
-                    : messageColor
-                        ? theme.fg(messageColor, truncatedMsg)
-                        : truncatedMsg;
-            const metadataColor = isConfirmingDelete ? "error" : isSelected ? "muted" : "dim";
+            const styledMsg = messageColor ? theme.fg(messageColor, truncatedMsg) : truncatedMsg;
+            const metadataColor = isConfirmingDelete ? "error" : "dim";
             const titleColumn = fitToWidth(cursor + theme.fg("dim", prefix) + styledMsg, titleColumnWidth, "…");
             const pathColumn = pathColumnWidth > 0
                 ? `${theme.fg(metadataColor, fitPathToWidth(pathText, pathColumnWidth, this.showPath))}${" ".repeat(columnGapWidth)}`

package/dist/integrations/pi/tui-runtime/adapter.d.ts

@@ -39,6 +39,12 @@ export declare class PiTuiRuntimeAdapter {
      */
     freezePresentation(): void;
     get presentationFrozen(): boolean;
+    /**
+     * Keeps asynchronous replacement-surface construction atomic at the terminal. Renderers may
+     * compose while held, but their writes are dropped until the final forced repaint on release.
+     */
+    beginPresentationHold(): () => void;
+    get presentationHeld(): boolean;
     addPreInputListener(listener: PiTuiPreInputListener): () => void;
     addInputListener(listener: PiTuiInputListener): () => void;
     switchMode(mode: "regular" | "fullscreen"): boolean;

package/dist/integrations/pi/tui-runtime/adapter.js

@@ -118,6 +118,7 @@ export class PiTuiRuntimeAdapter {
     #rootDisposed = false;
     #terminalProgress = false;
     #presentationFrozen = false;
+    #presentationHolds = new Set();
     constructor(options) {
         this.#root = options.root;
         this.#overlayGeometry = options.onOverlayGeometry === undefined ? undefined : new OverlayGeometryTracker(options.onOverlayGeometry);
@@ -128,7 +129,7 @@ export class PiTuiRuntimeAdapter {
         // Invariant: the pinned renderer's frames pass through this gate, while writeControl and
         // the stop sequence reach the terminal directly. Freezing drops frames without touching
         // the renderer, so a scheduled repaint cannot land on top of the quit outro.
-        const gatedTerminal = frozenGateTerminal(this.#terminal, () => this.#presentationFrozen);
+        const gatedTerminal = frozenGateTerminal(this.#terminal, () => this.#presentationFrozen || this.#presentationHolds.size > 0);
         const tracedTerminal = options.inputDiagnostics === undefined
             ? gatedTerminal
             : diagnosticTerminal(gatedTerminal, phase => this.#traceRuntimePhase(phase));
@@ -320,6 +321,24 @@ export class PiTuiRuntimeAdapter {
     get presentationFrozen() {
         return this.#presentationFrozen;
     }
+    /**
+     * Keeps asynchronous replacement-surface construction atomic at the terminal. Renderers may
+     * compose while held, but their writes are dropped until the final forced repaint on release.
+     */
+    beginPresentationHold() {
+        this.#assertRunning("presentation hold");
+        const token = Symbol("presentation-hold");
+        this.#presentationHolds.add(token);
+        return () => {
+            if (!this.#presentationHolds.delete(token) || this.#presentationHolds.size > 0)
+                return;
+            if (this.active && !this.#presentationFrozen)
+                this.#tui.requestRender(true);
+        };
+    }
+    get presentationHeld() {
+        return this.#presentationHolds.size > 0;
+    }
     addPreInputListener(listener) {
         if (this.#preInputListeners.has(listener))
             throw new TypeError("Pi TUI pre-input listener is already registered");
@@ -427,6 +446,7 @@ export class PiTuiRuntimeAdapter {
             return this.#stopPromise;
         if (this.#state === "idle") {
             this.#state = "stopped";
+            this.#presentationHolds.clear();
             this.#clearTerminalProgress();
             this.#preInputListeners.clear();
             this.#disposeRoot();
@@ -462,6 +482,7 @@ export class PiTuiRuntimeAdapter {
             // Invariant: the gate opens only for the synchronous stop sequence, so no render
             // scheduled during the outro can slip in before the alternate screen is left.
             this.#presentationFrozen = false;
+            this.#presentationHolds.clear();
             this.#tui.stop(stopOptions);
         }
         catch (error) {
@@ -599,6 +620,7 @@ export class PiTuiRuntimeAdapter {
     }
     #restoreAfterFailedStart() {
         this.#presentationFrozen = false;
+        this.#presentationHolds.clear();
         try {
             this.#tui.stop();
         }
@@ -615,6 +637,7 @@ export class PiTuiRuntimeAdapter {
     }
     #bestEffortTerminalRestore() {
         this.#presentationFrozen = false;
+        this.#presentationHolds.clear();
         this.#clearTerminalProgress();
         try {
             if (this.mode === "fullscreen")

package/dist/native/darwin-arm64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "supported",
-  "builtAt": "2026-10-07T15:28:34.230Z",
+  "builtAt": "2026-10-08T10:43:26.855Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "51b0b2dc1c9ae577f2586c4217066929278726c2c15308d9144eb6f538e118ff",

package/dist/native/linux-x64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-07T15:28:19.388Z",
+  "builtAt": "2026-10-08T10:43:15.921Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "ef62679e83bc1fad3d38f9f21675d9256f08d20e67fd4791571032115ca1b0e9",

package/dist/native/win32-x64/manifest.json

@@ -5,10 +5,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-07T15:29:15.953Z",
+  "builtAt": "2026-10-08T10:43:54.524Z",
   "artifact": {
     "filename": "process-guardian.exe",
-    "sha256": "a8e1e48b23cfa2a33b4821ccf799bf703b984ac5453c08926f8b5928801c07bb",
+    "sha256": "4c84729bd86ecee969b71895ccf86021af1f4b4e86e0906ff9ef78dbad03e6d7",
     "size": 288256
   },
   "provenance": {

package/docs/local-worktree-cleanup.md

@@ -24,9 +24,17 @@ node scripts/governance/local-worktree-cleanup.mjs sweep --repo D:/Git/a1
 
 `sweep` evaluates every released registration in one pass under the queue limits (100 registrations, 500 remote requests, a durable round-robin cursor) with a 180-second elapsed budget, since each merged candidate costs three evidence loads, and completes each candidate whose PR is verified merged using exactly the `complete` safeguards. It needs no `enable` and starts no process: its authority is each candidate's release. A candidate whose PR is open, draft, or not yet finalized reports `pending`; a candidate whose PR closed without merge reports `awaiting-discard` and is never touched; blockers report their exact reason. An old stop sentinel does not prevent a sweep, but `disable` run while a sweep is executing stops it before its next destructive step. If another session holds the mutation lock the sweep reports `mutation-busy` and the agent relays it as deferred rather than waiting. The JSON report carries a `lines` array with one relayable line per candidate and pruned branch, for example `#458 close-absent-and-skewed-cleanup: removed [worktree-removed, local-ref-removed]`. Pending or blocked results never delay the new delivery.
 
+### Standalone documentation evidence
+
+A PR without an `openspec-implementation` fence does not require corrective implementation association when its complete changed-file list is standalone documentation under the repository's existing documentation lifecycle policy. This includes ordinary documentation, the root `README.md`, canonical specification revisions, and revisions to existing active-change or archived-change documentation. Cleanup reuses the same path allowlist and immutable lifecycle checks as documentation auto-merge rather than maintaining a broader cleanup-only definition.
+
+The PR must be non-draft, same-repository, merged into `develop`, and bound to the registered PR, head, and branch. Cleanup additionally requires successful required CI for that exact head, the merge commit to remain an ancestor of current `develop`, and the remote topic ref to be absent. Introduced active changes, implementation/code or mixed paths, release notes, acceptance records, malformed lifecycle metadata, incomplete changed-file evidence, and invalid rename shapes do not qualify. Those cases remain on their existing implementation-association or fail-closed paths.
+
+Qualifying documentation uses the ordinary cleanup path without weakening it: exact worktree and local-ref identity, ownership, clean content, generated-content inspection, journaling, non-force Git removal, residue handling, and compare-and-delete local-ref behavior remain required. A blocker at any gate retains the worktree; agents never substitute manual deletion.
+
 ### Nothing left to remove
 
-A released entry whose evidence can never verify (for example `delivery-content-drift` after a stale-base merge, or `source-association` for a PR without an `openspec-implementation` fence) would otherwise be re-verified and reported `blocked` on every sweep. One narrow exception repairs an integrated unassociated delivery without rewriting its merged body: current `develop` must contain exactly one archived `association-repair.json` for the registered change, naming the exact original PR/head/merge and successful validation run, and its named corrective version-3 PR must itself have authorized manual merge, current exact-head CI, synchronized specs, a valid archive, and absent original/corrective remote refs. Only then does cleanup continue through all ordinary worktree identity, ownership, cleanliness, disposable-content, non-force removal, journaling, and local-ref safeguards. A mismatch remains blocked and generic merge/archive evidence never substitutes.
+A released entry whose evidence can never verify (for example `delivery-content-drift` after a stale-base merge, or `source-association` for an unassociated implementation PR) would otherwise be re-verified and reported `blocked` on every sweep. One narrow exception repairs an integrated unassociated delivery without rewriting its merged body: current `develop` must contain exactly one archived `association-repair.json` for the registered change, naming the exact original PR/head/merge and successful validation run, and its named corrective version-3 PR must itself have authorized manual merge, current exact-head CI, synchronized specs, a valid archive, and absent original/corrective remote refs. Only then does cleanup continue through all ordinary worktree identity, ownership, cleanliness, disposable-content, non-force removal, journaling, and local-ref safeguards. A mismatch remains blocked and generic merge/archive evidence never substitutes.
 
 When no valid corrective association exists and such an entry's worktree path is gone, Git holds no live row for it (its own dangling row is retired), and its local topic ref is absent, the sweep and `complete` ask GitHub only whether the pull request merged into `develop` in this repository and then mark the journal `done` with `retired-nothing-left` and the original evidence reason. Nothing is deleted; a present path, row, or ref keeps the entry blocked, an unmerged PR keeps it `pending` or `awaiting-discard`, a deferred failure such as `remote-budget` is never treated as unverifiable, and preview retires nothing. For an all-absent entry whose PR is not merged, the maintainer runs the explicit form, which reads nothing from GitHub and deletes nothing:
 
@@ -64,7 +72,7 @@ node scripts/governance/local-worktree-cleanup.mjs complete \
 
 The central disposable policy is `node_modules`, `dist`, `.builds`, `.artifacts`, `native/process-guardian/target`, `native/terminal-host/target`, and the exact generated file `src/integrations/pi/engine/pi-settings-metadata.json`. The `.artifacts` root is the repository's ignored generated-artifact root (finalization and validation reports, packed candidates, agent-written logs and diffs); the two native roots contain repository-generated Cargo output; Vitest writes the metadata file for source-side settings tests and leaves it shared for overlapping test processes until worktree cleanup. Agents select the owning worktree's `.artifacts/` root for their own transient delivery files rather than OS temp or another checkout, but its disposable status never makes scratch authoritative or permits secrets to be stored there. Registrations that still name `.artifacts/openspec-archive` or `.artifacts/validation` stay valid and are widened to the current policy on the next `complete`.
 
-Each root itself must be an ignored non-link regular file or directory inside the exact worktree. A descendant symbolic link or Windows junction is accepted only when its canonical target stays inside that same exact disposable root. Inspection records the link's path, filesystem identity, and target; purge revalidates them and removes the link entry without traversing it before removing the root. Root-level links, escapes, drift, unresolved/cyclic targets, special files, and nested repository boundaries remain blocking. Authority is component-exact: near matches such as `.artifacts-user`, `artifacts`, or `pi-settings-metadata-user.json`, arbitrary `target` directories, and sibling native projects remain blocking. Tracked/staged/unstaged/untracked content and every unknown ignored path still block. A tracked regular `.gitmodules` file alone is ordinary content; actual nested `.git` metadata, gitlinks, configured submodules, and submodule changes block. Ordinary content and these approved generated paths are traversed under separate finite entry allowances, so a normal dependency installation does not consume the ordinary source-tree allowance; both allowances retain the same deadline and content-boundary checks. Once those checks pass, cleanup deletes the declared disposable roots or files itself with a bounded retry for transient Windows sharing violations before handing the worktree to Git, so non-force Git removal only has to delete tracked content. A disposable path that stays locked after the retry budget reports `blocked` with `disposable-path-locked` and the path; the worktree, its `.git` pointer, and its journal are untouched, so stop the process holding the handle and rerun the same command.
+Each approved root must be an ignored regular file, directory, symbolic link, or Windows junction at that exact path inside the exact worktree. An exact-root link may target an external generated-content directory; cleanup records its link classification, filesystem identity, and canonical target, revalidates all three immediately before deletion, and removes only the link entry through a non-recursive primitive. It never traverses, removes, or mutates the external target. A descendant link remains stricter: its canonical target must stay inside that same exact disposable root. Escapes by descendant links, drift, replacements, unresolved/cyclic targets, special files, and nested repository boundaries remain blocking. Authority is component-exact: near matches such as `.artifacts-user`, `artifacts`, or `pi-settings-metadata-user.json`, arbitrary `target` directories, and sibling native projects remain blocking. Tracked/staged/unstaged/untracked content and every unknown ignored path still block. A tracked regular `.gitmodules` file alone is ordinary content; actual nested `.git` metadata, gitlinks, configured submodules, and submodule changes block. Ordinary content and these approved generated paths are traversed under separate finite entry allowances, so a normal dependency installation does not consume the ordinary source-tree allowance; both allowances retain the same deadline and content-boundary checks. Once those checks pass, cleanup deletes the declared disposable roots or files itself with a bounded retry for transient Windows sharing violations before handing the worktree to Git, so non-force Git removal only has to delete tracked content. A disposable path that stays locked after the retry budget reports `blocked` with `disposable-path-locked` (or `disposable-link-locked` for a link entry) and the path; the worktree, its `.git` pointer, and its journal are untouched, so stop the process holding the handle and rerun the same command.
 
 Agents do not manually remove generated content, call `git worktree remove`, or delete the local branch after delivery. The JSON result is authoritative: report success only for `removed` or verified `already-absent`; otherwise retain the worktree and report the exact blocker. A handed-off entry whose worktree was deleted by hand completes through its journal, and its branch is deleted under the accepted-ancestry rule. Legacy roles can supply separate `--source-pr`, `--candidate-pr`, and `--role` values.
 
@@ -150,13 +158,13 @@ node scripts/governance/local-worktree-cleanup.mjs register --repo D:/Git/a1 --p
 
 Registration binds the repository, exact directory/filesystem identity, candidate PR, HEAD/ref, role, and generation. It returns an ID and generation, not the owner token. The worktree stays `owned`: registration alone never authorizes removal. Supported roles:
 
-- `implementation`: exact merged implementation PR head; candidate PR equals source PR. This is the only version-3 role because the same PR contains implementation, acceptance manifest, synchronized specs, and archive.
+- `implementation`: exact merged implementation PR head, or exact merged standalone-documentation PR head under the policy above; candidate PR equals source PR. This is the only version-3 role because the same PR contains implementation, acceptance manifest, synchronized specs, and archive.
 - `acceptance`: legacy exact verified implementation merge commit; candidate PR equals source PR.
 - `archive`: legacy exact merged generated archive PR head; candidate PR is the archive PR and source PR is the implementation PR.
 
 A CI/base/older-ancestor checkout does not qualify automatically. Version 3 has no local acceptance/archive checkout to register. No local archive checkout is required when a legacy archive was generated entirely on GitHub. Legacy version-1/version-2 linkage remains supported, but individually reviewing and registering a legacy checkout is explicit adoption, not a bulk sweep.
 
-Low-level `register` keeps an explicit disposable allowlist for legacy and diagnostic use. The standard `complete` command supplies the central repository policy automatically; agents do not choose flags for normal completed-delivery cleanup. Neither route permits discarding tracked, staged, unstaged, untracked, unknown ignored, linked, special, or actual nested repository/submodule content. Declaring or centrally recognizing a generated directory does not bypass ignored-path, identity, type, or traversal checks.
+Low-level `register` keeps an explicit disposable allowlist for legacy and diagnostic use. The standard `complete` command supplies the central repository policy automatically; agents do not choose flags for normal completed-delivery cleanup. Neither route permits discarding tracked, staged, unstaged, untracked, unknown ignored, unapproved linked, special, or actual nested repository/submodule content. The sole link exception is the guarded exact-root or contained descendant behavior above. Declaring or centrally recognizing a generated directory does not bypass ignored-path, identity, type, or traversal checks.
 
 Before handing a completed checkout to cleanup, stop its development processes, leave its directory, and release it using the returned ID and current generation:
 

package/docs/manual-owned-ui-checkpoint.md

@@ -55,7 +55,7 @@ Use equivalent values in bare A1 and the Pi comparison profile. Exercise both a
 - [ ] `/settings`: selected cursor, label and value accent; unselected values muted; descriptions and hints dim; search uses `> ` with inverse cursor; scalar menus, numeric controls, warning-parts dialog, deferred notice, failed write, section spacing, clipping, and hidden-entry absence match their pinned semantic roles.
 - [ ] Transcript: toggle images and image width, thinking level/visibility, Mermaid mode, output padding, cache notices, warnings, auto-compaction, queue modes, command autocomplete, provider timeout/retry/error, and changelog collapse. Existing and streaming blocks must re-render without focus, selection, scroll, or queued-work loss.
 - [ ] Trust startup: from an undecided project, compare selected Trust/Do not trust rows, arrow navigation, Enter, Escape/Ctrl+C, clearing, cursor state, and restoration. No project extension/theme/prompt/skill may run before selection, and a fail-closed diagnostic must appear once on the restored parent rather than above a blank fullscreen frame.
-- [ ] Stable release note: with a built matching stable fixture from an explicitly approved draft GitHub Release snapshot and a fresh A1 profile, verify that exact note opens once after trust/other startup modals, fills the existing `What's New` screen, renders the Pi-style `## [version] - YYYY-MM-DD` heading and categorized `###` sections, scrolls by keys/wheel/rail, resizes, and closes with Escape. Relaunch to verify it stays closed, then use `/changelog` to verify version-labeled packaged history puts the latest A1 release at the top and the oldest at the bottom. A preview fixture must not auto-open or write acknowledgement state; `a1 pi` must retain Pi's oldest-first in-feed changelog so its latest release remains nearest the bottom.
+- [ ] Stable release note: with a built matching stable fixture from an explicitly approved draft GitHub Release snapshot and a fresh A1 profile, verify that exact note opens once after trust/other startup modals, fills the existing `What's New` screen, renders the Pi-style `## [version] - YYYY-MM-DD` heading and categorized `###` sections, scrolls by keys/wheel/rail, resizes, and closes with Escape. Relaunch to verify it stays closed, then use `/changelog` to verify the distinct `Changelog` screen's version-labeled packaged history puts the latest A1 release at the top and the oldest at the bottom. A preview fixture must not auto-open or write acknowledgement state; `a1 pi` must retain Pi's oldest-first in-feed changelog so its latest release remains nearest the bottom.
 - [ ] Terminal lifecycle: toggle hardware cursor, clear-on-shrink, and terminal progress; resize smaller/larger; open/close selectors; select and copy transcript text; verify no duplicate rows, stale OSC progress, leaked mouse mode, misplaced cursor, or broken parent input.
 - [ ] Images: in Kitty or iTerm2 verify inline width and clipping; in Windows Terminal verify the textual fallback and absence of image protocol bytes without hiding `showImages`.
 - [ ] Bare A1 quit (`/quit` and the second `Ctrl+C`): the configured quit effect plays over the last frame on the alternate screen, the terminal is restored once, and the parent shows only its earlier scrollback plus the dim `To resume this session:` hint. No frame rows, transcript rows, editor box, or footer may remain. With `/settings` → Quit → Effect set to `off`, the leave is immediate and the parent output is identical.

package/docs/openspec-archive-automation.md

@@ -1,8 +1,8 @@
 # Atomic OpenSpec delivery and legacy archival
 
-New OpenSpec deliveries use one ordinary development pull request from draft planning through implementation, validation, acceptance, specification synchronization, and archival. The only integration action is an authorized maintainer's manual merge. Automation never auto-merges implementation-bound work and never creates a version-3 acceptance or archive follow-up PR.
+New OpenSpec deliveries use one ordinary development pull request from draft planning through implementation, validation, acceptance, specification synchronization, and archival. An authorized maintainer chooses integration by manually merging the exact validated head or personally enabling GitHub native auto-merge for that unchanged head. Agents, Apps, bots, merge queue, and repository automation never arm or invoke implementation integration and never create a version-3 acceptance or archive follow-up PR.
 
-Unrelated standalone documentation remains separate: a non-draft unassociated PR changing only `openspec/**`, `docs/**`, and/or root `README.md` retains the existing CI-gated automatic route. A new active change, implementation association, malformed lifecycle data, or mixed path keeps the manual hold.
+Unrelated standalone documentation remains separate: a non-draft unassociated PR changing only `openspec/**`, `docs/**`, and/or root `README.md` retains the existing CI-gated automatic route. A new active change, implementation association, malformed lifecycle data, or mixed path remains outside documentation-owned integration. Before finalization or without valid human provenance, any arm is disabled; a finalized version-3 human arm remains a separate maintainer-owned route.
 
 Version-1 and version-2 deliveries and their existing comments, acceptance PRs, archive PRs, receipts, retries, and bounded catch-up remain supported under [Legacy delivery](#legacy-delivery). Do not silently convert an in-flight legacy delivery.
 
@@ -14,7 +14,7 @@ Version-1 and version-2 deliveries and their existing comments, acceptance PRs,
 4. **Plain acceptance list:** keep the body phase-free and add final `## Acceptance` with one to ten concise implementation-specific behavior-and-result bullets. Do not use checkboxes, generic review/CI/approval/archive statements, URLs, mentions, or automated-test inventory.
 5. **Ready and automated finalization:** mark the PR ready. The trusted `OpenSpec finalization` workflow reconciles current `develop`, conservatively synchronizes all deltas, moves the active change into its dated archive, stages the conditional acceptance manifest, commits that to the same branch with the archive App identity, and writes the emitted paths into the body's implementation fence. Running the [finalization command](#finalization-command) locally first is optional and yields the same bytes.
 6. **Validate:** one normal exact-head workflow validates the finalized head: implementation, synchronized specs, archive, manifest, tasks/evidence, exact PR-body list, and every selected product/governance scope before emitting the stable protected aggregate. A new commit or acceptance-list change re-finalizes automatically when needed and requires full renewed validation; no lifecycle body edit or second workflow run is required.
-7. **Manual merge accepts:** after the stable protected aggregate succeeds, an authorized human reviews and manually merges the exact validated head. That single action means the listed scenarios are accepted and explicitly authorizes integration. Auto-merge, merge queue, Apps, bots, and documentation reconciliation are forbidden.
+7. **Maintainer integration accepts:** after reviewing the finalized candidate, an authorized human either manually merges the exact validated head after the stable protected aggregate succeeds or personally enables GitHub native auto-merge for that unchanged head so protected integration waits for the aggregate. That human action means the listed scenarios are accepted. Agents, Apps, bots, merge queue, automation-owned implementation arms, and documentation integration remain forbidden. A changed head, acceptance list, or finalization invalidates the earlier arm and requires the maintainer to choose again.
 8. **Verify and clean:** trusted post-merge policy derives `Archived` and reports `accepted-and-archived` from committed bytes and immutable GitHub provenance without editing the accepted PR body. It publishes no lifecycle branch or PR. Shared exact-head remote cleanup may delete the unchanged topic ref; local cleanup remains separately ownership-controlled: the agent parks the worktree with `handoff` at step 7, and the next session's `sweep` removes it once the merge, archive, and remote-ref evidence verify (see [local cleanup](local-worktree-cleanup.md)).
 
 ### Complete-regression evidence ordering
@@ -38,7 +38,7 @@ Replace the multi-PR OpenSpec handoff with one manually merged development PR wh
 
 - Keep planning and implementation in the same draft PR.
 - Integrate implementation, synchronized specs, acceptance, and archive atomically.
-- Preserve standalone documentation auto-merge while forbidding implementation auto-merge.
+- Preserve standalone documentation auto-merge while forbidding automation-owned implementation auto-merge.
 
 ## Automation
 
@@ -75,7 +75,7 @@ Do not add a quoted phase line or a routine `Validation` section listing command
 </details>
 ```
 
-Keep acceptance absent during proposal review so unfinished intent is not mistaken for final acceptance criteria. The finalization workflow rewrites only the implementation fence; keep the rest of the phase-free body unchanged through exact-head validation, maintainer review, and authorized manual merge. The same workflow run validates its finalized delivery record and applicable product/governance scopes before the stable protected aggregate succeeds. Do not add a lifecycle body edit or start a second validation run. After manual merge, trusted verification derives `Archived`; do not rewrite the accepted body.
+Keep acceptance absent during proposal review so unfinished intent is not mistaken for final acceptance criteria. The finalization workflow rewrites only the implementation fence; keep the rest of the phase-free body unchanged through exact-head validation, maintainer review, and authorized integration. The same workflow run validates its finalized delivery record and applicable product/governance scopes before the stable protected aggregate succeeds. Do not add a lifecycle body edit or start a second validation run. After integration, trusted verification derives `Archived`; do not rewrite the accepted body.
 
 ## Agent scratch files
 
@@ -139,7 +139,7 @@ Use plain bullets:
 - Finalized specs and archive match the implementation.
 ```
 
-The committed conditional manifest contains the same ordered text. Trusted policy validates membership but never checks or edits it and never claims that the scenarios passed. Manual merge is the acceptance decision; no acceptance comment, checkbox edit, review-approval requirement, JSON edit, acceptance PR, archive PR, or later command is needed.
+The committed conditional manifest contains the same ordered text. Trusted policy validates membership but never checks or edits it and never claims that the scenarios passed. The authorized maintainer's manual merge or personal native auto-merge arm for the unchanged exact head is the acceptance decision; no acceptance comment, checkbox edit, review-approval requirement, JSON edit, acceptance PR, archive PR, or later command is needed.
 
 If the body list changes, candidate validation reruns and compares it with the committed manifest. If the head changes, all prior exact-head CI is stale. If only the body changes to disagree with the manifest, integration remains blocked until the list and committed candidate agree again. No lifecycle body edit is needed after green CI.
 
@@ -158,7 +158,7 @@ Because the branch gains commits from the archive App, pull before pushing. A re
 
 A missing fence is not an ordinary ready PR when immutable base/head evidence shows that the candidate introduces or restores an active change, or mixes active-change edits with code or operational paths. Base-controlled readiness and finalization both fail with `missing-implementation-association`; deleting editable body metadata cannot bypass finalization. Existing active-change documentation-only revisions and ordinary code PRs without active delivery paths retain their established routes.
 
-If an unassociated implementation has already integrated, do not edit its merged body or publish an archive-only follow-up. A corrective implementation-bound PR for the same still-active change must add the prevention fix and an exact `association-repair.json` record naming the original PR/head/merge/validation and the corrective PR. Normal version-3 finalization then synchronizes and archives the change; the corrective PR's authorized manual merge accepts that repair without pretending the original PR was finalized retroactively.
+If an unassociated implementation has already integrated, do not edit its merged body or publish an archive-only follow-up. A corrective implementation-bound PR for the same still-active change must add the prevention fix and an exact `association-repair.json` record naming the original PR/head/merge/validation and the corrective PR. Normal version-3 finalization then synchronizes and archives the change; the corrective PR's authorized maintainer integration accepts that repair without pretending the original PR was finalized retroactively.
 
 ## Finalization command
 
@@ -200,7 +200,7 @@ Before a first finalization, canonical specs must still equal the selected targe
 
 ## Conditional acceptance and derived receipt
 
-`acceptance.md` truthfully says its verdict activates only when the containing exact head is manually merged by an authorized human after required current-head checks. Its `openspec-delivery` block records stable pre-merge facts:
+`acceptance.md` truthfully says its verdict activates only when an authorized human manually merges the containing exact head after required current-head checks or personally arms native auto-merge for that unchanged head and GitHub integrates it after those checks. Its `openspec-delivery` block records stable pre-merge facts:
 
 - schema version, repository, change, and source PR;
 - archive and manifest paths and finalization date;
@@ -209,7 +209,7 @@ Before a first finalization, canonical specs must still equal the selected targe
 - archive, canonical-spec, task, and evidence digests; and
 - explicit known-gap dispositions.
 
-It does not predict source head, merge commit, merger, or merge time. The PR head contains the manifest, so required CI binds those bytes without a recursive self-hash. After merge, the shared reader combines the manifest with immutable GitHub source head, successful required run, authorized human actor, absence of automatic/queue/App provenance, merge commit/time, and `develop` ancestry. That derived result is the durable version-3 receipt used by audit and cleanup.
+It does not predict source head, merge commit, merger, or merge time. The PR head contains the manifest, so required CI binds those bytes without a recursive self-hash. After merge, the shared reader combines the manifest with immutable GitHub source head, successful required run, authorized human actor and permission, integration route, merge commit/time, and `develop` ancestry. Direct manual integration requires no active automatic authority. Human-enabled native auto-merge additionally requires a matching final-head enable event and `auto_merge.enabled_by`, with no later candidate commit or disable event. Queue, App/Bot, automation-owned, stale, malformed, or differently authored authority remains invalid. A human enable followed by disable before a valid manual merge is an abandoned attempt, not contradictory provenance. That shared result is the durable version-3 receipt used by audit and cleanup.
 
 Unavailable, stale, automatic, unauthorized, conflicting, or contradictory provenance produces `invalid-provenance`/`blocked`, not acceptance. Post-merge code does not repair it by pushing `develop` or publishing another PR.
 
@@ -217,7 +217,7 @@ Unavailable, stale, automatic, unauthorized, conflicting, or contradictory prove
 
 Normal Development CI remains complete for the implementation once its reviewable candidate exists. An archive-shaped final diff does not select documentation-only validation because the authoritative version-3 association remains implementation-bound. Base-controlled readiness defers a ready head that still holds the active change without running test suites or emitting `Development validation required`. The finalization workflow pushes the finalized head and updates its implementation fence; that update starts one complete selected validation, while PR-level concurrency cancels any superseded eligible run.
 
-`pull_request` body edits rerun required CI. The ordinary finalized phase-free run exposes the stable protected aggregate directly; it does not wait for a lifecycle body edit. Documentation auto-merge's trusted owner also reevaluates lifecycle association and disables any armed merge. Every publication entry point explicitly refuses version 3.
+`pull_request` body edits rerun required CI. The ordinary finalized phase-free run exposes the stable protected aggregate directly; it does not wait for a lifecycle body edit. Documentation auto-merge's trusted owner also reevaluates lifecycle association. It preserves only an authorized human arm for the exact finalized version-3 head, never creates or exercises that arm, and disables stale, automated, malformed, draft, edited, or otherwise ineligible arms. Every publication entry point explicitly refuses version 3.
 
 The OpenSpec archive workflow remains default-branch trusted. For version 3 it uses read-only contents, PR, and Actions access to report the integrated result; App credentials are unnecessary and are not minted for post-merge verification. For legacy candidates it retains its existing scoped App publication behavior. The OpenSpec finalization workflow is the one version-3 user of the archive App: it mints a short-lived installation token with `contents: write` and `pull_requests: write`, pushes only to the candidate's own branch under a lease, edits only the body fence, and revokes the token when the run ends.
 
@@ -229,7 +229,7 @@ Read-only inspection remains:
 GH_TOKEN="$(gh auth token)" node scripts/governance/reconcile-openspec-archive.mjs --dry-run --pr <implementation-pr>
 ```
 
-For version 3, status distinguishes `needs-finalization`, `ready-for-manual-merge`, `accepted-and-archived`, `closed`, `blocked`, and `invalid-provenance`. A successful workflow invocation does not imply acceptance while the PR is open. Dry run never mutates refs, PRs, body text, tasks, evidence, specs, or acceptance.
+For version 3, status distinguishes `needs-finalization`, `ready-for-maintainer-integration`, `accepted-and-archived`, `closed`, `blocked`, and `invalid-provenance`. A successful workflow invocation does not imply acceptance while the PR is open. Dry run never mutates refs, PRs, body text, tasks, evidence, specs, or acceptance.
 
 Scheduled scans continue to serve legacy catch-up. Version-3 candidates are verification-only and do not consume publication slots or block the legacy queue.
 
@@ -237,7 +237,7 @@ Scheduled scans continue to serve legacy catch-up. Version-3 candidates are veri
 
 After version-3 merge, verify:
 
-- the source PR is merged with the exact reviewed head by an authorized human;
+- the source PR is merged with the exact reviewed head through a verified authorized-human integration route;
 - required exact-head CI succeeded;
 - current `develop` descends from the merge;
 - the active change is absent;
@@ -263,16 +263,16 @@ This bootstrap policy itself finishes under deployed version-2 authority. The fi
 - draft planning remaining unmerged;
 - explicit plan approval and same-PR implementation;
 - automated current-target finalization and exact-head CI;
-- authorized human manual merge with plain acceptance scenarios;
+- authorized human integration, including manual merge and personally enabled exact-head native auto-merge, with plain acceptance scenarios;
 - integrated canonical specs/archive and no generated acceptance/archive PR;
 - read-only `accepted-and-archived` verification and exact-head branch cleanup;
-- stale head/body/base, incomplete tasks/evidence, malformed manifest, and automatic-merge refusal fixtures; and
+- stale head/body/base/arm, incomplete tasks/evidence, malformed manifest, and automated or unauthorized auto-merge refusal fixtures; and
 - an unrelated standalone spec/docs PR retaining auto-merge.
 
 Unit tests or API success alone are not live acceptance. Until this evidence exists, version 3 is deployable but documented as awaiting its operational canary.
 
 ## Disable or roll back
 
-Before a version-3 merge, disable new version-3 authoring and continue using legacy version 2. After a version-3 merge, preserve its integrated archive and provenance and use an ordinary explicit corrective PR. Never direct-push a rewritten receipt, delete historical evidence, relax branch protection, or reinterpret an automatic merge as human acceptance.
+Before a version-3 merge, disable new version-3 authoring and continue using legacy version 2. After a version-3 merge, preserve its integrated archive and provenance and use an ordinary explicit corrective PR. Never direct-push a rewritten receipt, delete historical evidence, relax branch protection, or reinterpret automation-owned, stale, App/Bot, or queue-backed integration as human acceptance.
 
 Disabling the OpenSpec archive workflow stops legacy publication and version-3 post-merge reporting, but does not change existing acceptance records, documentation auto-merge, remote branch cleanup, or release authority.

package/docs/releases/0.2.5.md

@@ -0,0 +1,35 @@
+## [0.2.5] - 2026-10-07
+
+### New Features
+
+- show session info full screen ([#680](https://github.com/timurproko/a1/pull/680))
+- redesign session tree dialog ([#682](https://github.com/timurproko/a1/pull/682))
+- add name command input dialog ([#694](https://github.com/timurproko/a1/pull/694))
+
+### Changed
+
+- refine animated separator ([#681](https://github.com/timurproko/a1/pull/681))
+- upgrade pinned Pi to 1.0.4 ([#683](https://github.com/timurproko/a1/pull/683))
+- unify selection treatment ([#686](https://github.com/timurproko/a1/pull/686))
+- align project trust dialogs ([#687](https://github.com/timurproko/a1/pull/687))
+- standardize share dialog ([#689](https://github.com/timurproko/a1/pull/689))
+- align Resume Session dialog ([#693](https://github.com/timurproko/a1/pull/693))
+- unify dialog close hints ([#695](https://github.com/timurproko/a1/pull/695))
+- accent model scope markers ([#696](https://github.com/timurproko/a1/pull/696))
+
+### Fixed
+
+- wrap session file after label ([#684](https://github.com/timurproko/a1/pull/684))
+- align thinking markers with models ([#685](https://github.com/timurproko/a1/pull/685))
+- place new-session notice above prompt ([#688](https://github.com/timurproko/a1/pull/688))
+- close dialogs with Ctrl+C ([#690](https://github.com/timurproko/a1/pull/690))
+- restore suggestion after Backspace ([#691](https://github.com/timurproko/a1/pull/691))
+- cycle dialog filters backward ([#692](https://github.com/timurproko/a1/pull/692))
+- avoid initial value-menu highlight ([#697](https://github.com/timurproko/a1/pull/697))
+- keep session root expanded ([#698](https://github.com/timurproko/a1/pull/698))
+- hide skill prefixes in collapsed menu ([#699](https://github.com/timurproko/a1/pull/699))
+- omit space after command completion ([#700](https://github.com/timurproko/a1/pull/700))
+- stabilize values and add undo ([#701](https://github.com/timurproko/a1/pull/701))
+- standardize typing search hints ([#702](https://github.com/timurproko/a1/pull/702))
+- show tree time toggle state ([#703](https://github.com/timurproko/a1/pull/703))
+- refine resume search hints ([#704](https://github.com/timurproko/a1/pull/704))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.2.5-dev.704",
+  "version": "0.2.6-dev.717",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "privateLaunchContract": "neutral-launch-v1",