@timurproko/a1 0.2.7-dev.1276 → 0.2.7-dev.1286

package/dist/integrations/pi/engine/adapter.js

@@ -19,7 +19,12 @@ import { EngineViewState, projectSessionView } from "./view-state.js";
 import { createEnginePorts } from "./ports.js";
 /** Explicit flush failure when required delivery was interrupted rather than completed. */
 export class EngineDeliveryError extends Error {
-    constructor() { super("Engine delivery did not complete"); this.name = "EngineDeliveryError"; }
+    deliveryFailure;
+    constructor(failure = null) {
+        super("Engine delivery did not complete");
+        this.name = "EngineDeliveryError";
+        this.deliveryFailure = failure;
+    }
 }
 /** Owns the pinned Pi session lifecycle and serves it to the owned shell as the neutral session backend. */
 export class PiEngineAdapter {
@@ -43,12 +48,22 @@ export class PiEngineAdapter {
     #delivery = new PiEventDelivery({
         sessionId: () => this.#sessionId,
         sessionGeneration: () => this.#engine.generation,
+        authoritativeTranscript: () => this.#projection.snapshot(),
+        retainedAssetBytes: excluding => this.#projection.assets.pendingBytesExcluding(excluding),
         transcriptBlock: id => this.#projection.block(id),
         retainEvent: event => this.#projection.assets.retainEvent(event),
         isPendingCommand: correlationId => this.#commands.isPending(correlationId),
         cancelForOverload: () => this.#cancelForOverload(),
         reconcileOverload: cancelled => this.#reconcileOverload(cancelled),
         listenerFailed: message => { this.#recordDiagnostic("warning", "event-listener", message, true); },
+        canResume: () => !this.#disposed && this.#runningCommands === 0,
+        resume: () => {
+            this.#admissionStopped = false;
+            this.#state.settleOverload(true, false);
+            this.#engine.resume();
+            this.#emitView();
+        },
+        incident: failure => { this.#engineHost.deliveryIncident?.(failure); },
     });
     #admissionStopped = false;
     #runningCommands = 0;
@@ -87,6 +102,7 @@ export class PiEngineAdapter {
     });
     #extensions = new PiExtensionUiBinding({
         session: () => this.#engine.session,
+        runtime: () => this.#engine.runtime,
         diagnostic: (severity, code, message, recoverable) => { this.#addDiagnostic(severity, code, message, recoverable); },
         emitView: () => { this.#emitView(); },
     });
@@ -113,6 +129,7 @@ export class PiEngineAdapter {
             signal: this.#engineHost.signal,
             markStartupPhase: phase => this.#engineHost.markStartupPhase(phase),
             ...(options.repositoryContextReader === undefined ? {} : { repositoryContextReader: options.repositoryContextReader }),
+            ...(options.worktreeCwdReader === undefined ? {} : { worktreeCwdReader: options.worktreeCwdReader }),
             host: this.#workflowHost,
         }, {
             disposed: () => this.#disposed,
@@ -148,7 +165,7 @@ export class PiEngineAdapter {
             admissionStopped: () => this.#delivery.overloaded || this.#admissionStopped || this.#disposed,
             pendingCommandCount: () => this.#commands.pendingCount,
             beginRunning: () => { this.#runningCommands++; },
-            endRunning: () => { this.#runningCommands--; },
+            endRunning: () => { this.#runningCommands--; this.#delivery.recovery.resume(); },
             activeModel: () => this.#state.activeModel,
             setActiveModel: model => { this.#state.activeModel = model; },
             thinkingLevel: () => this.#state.thinkingLevel,
@@ -167,7 +184,7 @@ export class PiEngineAdapter {
             pendingWorkflowCount: () => this.#workflows.pendingCount,
             sessionGeneration: () => this.#engine.generation,
             beginRunning: () => { this.#runningCommands++; },
-            endRunning: () => { this.#runningCommands--; },
+            endRunning: () => { this.#runningCommands--; this.#delivery.recovery.resume(); },
             perform: command => performEngineCommand(command, this.#commandContext()),
             emit: value => { this.#emitEvent(value); },
             emitView: () => { this.#emitView(); },
@@ -250,7 +267,7 @@ export class PiEngineAdapter {
         await this.#delivery.settle();
         if (failed || this.#delivery.failed || this.#disposed && this.#state.lifecycle !== "stopped") {
             this.#delivery.clearFailure();
-            throw new EngineDeliveryError();
+            throw new EngineDeliveryError(this.#delivery.failure);
         }
     }
     async executeWorkflow(request) {
@@ -438,8 +455,8 @@ export class PiEngineAdapter {
     }
     // Concurrency: cancellation runs synchronously so the overload reservation already guards reentrant outcomes.
     #cancelForOverload() {
-        this.#commands.cancelPending();
-        this.#workflows.cancelPending();
+        this.#commands.cancelPending(["set-model", "set-thinking-level", "resize-surface"]);
+        this.#workflows.cancelForDelivery();
         const session = this.#engine.session;
         return Promise.resolve().then(() => session?.abort()).then(() => undefined);
     }
@@ -447,6 +464,7 @@ export class PiEngineAdapter {
         const canResume = cancelled === true && this.#runningCommands === 0;
         this.#admissionStopped = !canResume;
         this.#engine.suspend();
+        this.#delivery.recovery.defer(canResume ? undefined : this.#engine.generation);
         this.#events.abandonRun();
         this.#state.settleOverload(canResume, this.#disposed);
         // Invariant: overload publishes one authoritative view; settle tool phases before finalizing other live blocks.

package/dist/integrations/pi/engine/changelog.js

@@ -20,14 +20,17 @@ export async function readPinnedCommandChangelog(sinceVersion, path = new URL(".
     }
 }
 function formatPinnedCommandChangelog(content, sinceVersion) {
-    // Provenance: behavior follows Pi 0.84.2 utils/changelog.ts at 914cf1472e715297caa30db4b9535d534a9eb718.
+    // Provenance: behavior follows pinned Pi's utils/changelog.ts, including leading-version comparison.
     // Runtime reads only the owned data resource; maintenance tooling verifies its pinned provenance.
     let releases = content.split(/(?=^## )/m).flatMap((section) => {
         const version = /^##\s+\[?(\d+)\.(\d+)\.(\d+)\]?/.exec(section);
         return version ? [{ version: version.slice(1).map(Number), markdown: section.trim() }] : [];
     });
     if (sinceVersion !== undefined) {
-        const previous = sinceVersion.split(".").map(value => Number(value) || 0);
+        const matched = sinceVersion.trim().match(/^v?(\d+)\.(\d+)\.(\d+)/);
+        if (matched === null)
+            return "";
+        const previous = matched.slice(1).map(Number);
         releases = releases.filter(release => {
             for (let index = 0; index < 3; index++) {
                 const difference = release.version[index] - (previous[index] ?? 0);

package/dist/integrations/pi/engine/delivery-retention.d.ts

@@ -0,0 +1,7 @@
+/** Accounts shared immutable graphs once; only delivery-exclusive storage consumes backlog capacity. */
+export declare class DeliveryRetention {
+    #private;
+    get bytes(): number;
+    baseline(value: unknown): void;
+    retain(value: unknown): () => void;
+}

package/dist/integrations/pi/engine/delivery-retention.js

@@ -0,0 +1,66 @@
+/** Accounts shared immutable graphs once; only delivery-exclusive storage consumes backlog capacity. */
+export class DeliveryRetention {
+    #objects = new WeakMap();
+    #current;
+    #baseline;
+    #bytes = 0;
+    get bytes() { return this.#bytes; }
+    baseline(value) {
+        if (value === this.#current)
+            return;
+        const next = this.#allocation(value);
+        // Invariant: retain first so common blocks never become transient backlog during a revision change.
+        this.#change(next, "authoritative", 1);
+        if (this.#baseline)
+            this.#change(this.#baseline, "authoritative", -1);
+        this.#current = value;
+        this.#baseline = next;
+    }
+    retain(value) {
+        const allocation = this.#allocation(value);
+        this.#change(allocation, "pending", 1);
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            this.#change(allocation, "pending", -1);
+        };
+    }
+    #allocation(value) {
+        if (value === null || typeof value !== "object") {
+            return { bytes: scalarBytes(value), children: [], pending: 0, authoritative: 0 };
+        }
+        const cached = this.#objects.get(value);
+        if (cached)
+            return cached;
+        let bytes = 32;
+        const children = [];
+        for (const [key, item] of Object.entries(value)) {
+            bytes += 16 + key.length * 2;
+            if (item !== null && typeof item === "object")
+                children.push(this.#allocation(item));
+            else
+                bytes += scalarBytes(item);
+        }
+        const result = { bytes, children, pending: 0, authoritative: 0 };
+        this.#objects.set(value, result);
+        return result;
+    }
+    #change(allocation, owner, delta) {
+        const before = allocation[owner];
+        const charged = allocation.pending > 0 && allocation.authoritative === 0;
+        allocation[owner] += delta;
+        const charge = allocation.pending > 0 && allocation.authoritative === 0;
+        if (charged !== charge)
+            this.#bytes += charge ? allocation.bytes : -allocation.bytes;
+        // Invariant: a shared parent's second owner does not retain every descendant again.
+        if (before === 0 || allocation[owner] === 0) {
+            for (const child of allocation.children)
+                this.#change(child, owner, delta);
+        }
+    }
+}
+function scalarBytes(value) {
+    return typeof value === "string" ? 16 + value.length * 2 : 8;
+}

package/dist/integrations/pi/engine/event-delivery.d.ts

@@ -1,4 +1,5 @@
 import type { OwnedUiEvent, OwnedUiTranscriptBlock } from "../../../contracts/owned-ui/index.js";
+import { OverloadRecovery } from "./view-state.js";
 /** An event the adapter emits before delivery stamps it with the session id and sequence. */
 export type PiEmittedEvent = Omit<Extract<OwnedUiEvent, {
     type: "session-lifecycle";
@@ -32,9 +33,19 @@ interface ReservedCommandOutcome {
         type: "command-outcome";
     }>["diagnostic"];
 }
+export interface DeliveryFailure {
+    readonly reason: "event-count" | "retained-bytes" | "listener";
+    readonly event: OwnedUiEvent["type"] | "snapshot";
+    readonly generation: number;
+    readonly pending: number;
+    readonly bytes: number;
+}
 export interface PiEventDeliveryPorts {
     sessionId(): string;
     sessionGeneration(): number;
+    /** Immutable history already owned by the engine, not additional pending payload. */
+    authoritativeTranscript?(): readonly OwnedUiTranscriptBlock[];
+    retainedAssetBytes?(excluding?: OwnedUiEvent): number;
     /** The current block for a lazily materialized transcript event. */
     transcriptBlock(id: string): OwnedUiTranscriptBlock | undefined;
     /** Retain the image assets an event references until the returned release runs. */
@@ -47,6 +58,9 @@ export interface PiEventDeliveryPorts {
     reconcileOverload(cancelled: boolean): Promise<void>;
     /** A listener threw; the adapter records the warning. */
     listenerFailed(message: string): void;
+    canResume?(): boolean;
+    resume?(): void;
+    incident?(failure: DeliveryFailure): void;
 }
 /**
  * Bounded delivery of owned UI events: stamps sequence numbers, keeps subscribers, queues events
@@ -56,6 +70,8 @@ export interface PiEventDeliveryPorts {
  */
 export declare class PiEventDelivery {
     #private;
+    readonly recovery: OverloadRecovery;
+    get failure(): DeliveryFailure | null;
     constructor(ports: PiEventDeliveryPorts);
     /** The sequence number of the most recently stamped event. */
     get sequence(): number;
@@ -90,7 +106,7 @@ export declare class PiEventDelivery {
     /** Drop queued events from earlier session generations. */
     discardObsolete(generation: number): void;
     /** Enter the bounded overload transition; a no-op while one is already in progress. */
-    beginOverload(): void;
+    beginOverload(event?: DeliveryFailure["event"]): void;
     /** Deliver out of band, bypassing the queue; used for reconciliation after an overload. */
     deliverNow(event: OwnedUiEvent): void;
     /** The command outcomes reserved during an overload, in arrival order; clears the reservation. */

package/dist/integrations/pi/engine/event-delivery.js

@@ -1,3 +1,4 @@
+import { OverloadRecovery } from "./view-state.js";
 import { PendingEngineDelivery } from "./pending-delivery.js";
 /**
  * Engine events delivered before the queue hands the event loop a turn. Small enough
@@ -26,9 +27,15 @@ export class PiEventDelivery {
     #overloads = 0;
     #deliveryFailed = false;
     #invalidatedEvents = 0;
+    #failure = null;
+    #reported = 0;
+    recovery;
+    get failure() { return this.#failure; }
     constructor(ports) {
         this.#ports = ports;
-        this.#queue = new PendingEngineDelivery(event => ports.retainEvent(event));
+        this.recovery = new OverloadRecovery({ generation: () => ports.sessionGeneration(), busy: () => this.overloaded,
+            canResume: () => ports.canResume?.() ?? false, resume: () => ports.resume?.() });
+        this.#queue = new PendingEngineDelivery(event => ports.retainEvent(event), ports.authoritativeTranscript, ports.retainedAssetBytes);
     }
     /** The sequence number of the most recently stamped event. */
     get sequence() {
@@ -77,7 +84,7 @@ export class PiEventDelivery {
         }
         if (!this.#queue.push(event, this.#ports.sessionGeneration(), event.type === "transcript-block"
             ? this.#blockReconciliation(event.block.id, event.sequence) : undefined)) {
-            this.beginOverload();
+            this.beginOverload(event.type);
             if (event.type === "command-outcome" && event.outcome !== "accepted" && this.#ports.isPendingCommand(event.correlationId)
                 && !this.#reservedOutcomes.has(event.correlationId)) {
                 this.#reservedOutcomes.set(event.correlationId, { outcome: event.outcome, diagnostic: event.diagnostic });
@@ -98,19 +105,22 @@ export class PiEventDelivery {
         this.#invalidatedEvents += this.#queue.discardObsolete(generation);
     }
     /** Enter the bounded overload transition; a no-op while one is already in progress. */
-    beginOverload() {
+    beginOverload(event = "snapshot") {
         if (this.#overload !== undefined)
             return;
+        this.#recordFailure(this.#queue.rejection ?? "retained-bytes", event);
         this.#overloads = Math.min(Number.MAX_SAFE_INTEGER, this.#overloads + 1);
         this.#deliveryFailed = true;
         // Concurrency: reserve before cancellation; outcomes produced reentrantly must not enter the saturated queue.
         this.#overload = Promise.resolve(false);
+        this.recovery.begin();
         const cancellation = this.#ports.cancelForOverload();
         this.#overload = new Promise(resolve => {
             const timer = setTimeout(() => resolve(false), OVERLOAD_CANCELLATION_TIMEOUT_MS);
             cancellation.then(() => {
                 clearTimeout(timer);
                 resolve(true);
+                this.recovery.settled();
             }, () => { clearTimeout(timer); resolve(false); });
         });
     }
@@ -124,10 +134,21 @@ export class PiEventDelivery {
             }
             catch (error) {
                 this.#deliveryFailed = true;
+                this.#recordFailure("listener", event.type);
                 this.#ports.listenerFailed(error instanceof Error ? error.message : String(error));
             }
         }
     }
+    #recordFailure(reason, event) {
+        const { pending, bytes } = this.#queue.diagnostics();
+        this.#failure = { reason, event, generation: this.#ports.sessionGeneration(), pending, bytes };
+        if (this.#reported++ < 10) {
+            try {
+                this.#ports.incident?.(this.#failure);
+            }
+            catch { /* Invariant: diagnostics never own recovery. */ }
+        }
+    }
     /** The command outcomes reserved during an overload, in arrival order; clears the reservation. */
     takeReservedOutcomes() {
         const reserved = [...this.#reservedOutcomes];
@@ -172,6 +193,7 @@ export class PiEventDelivery {
                 // Invariant: an outcome reserved while reconciliation replayed the earlier ones is dropped with the overload.
                 this.#reservedOutcomes.clear();
                 this.#overload = undefined;
+                this.recovery.resume();
             }
         }
         finally {

package/dist/integrations/pi/engine/extension-ui-binding.d.ts

@@ -1,8 +1,9 @@
-import type { AgentSession } from "../startup-public.js";
+import type { AgentSession, AgentSessionRuntime } from "../startup-public.js";
 import { type OwnedUiDiagnostics, type OwnedUiVisualExtensionSupport } from "../../../contracts/owned-ui/index.js";
 export type OwnedPiVisualExtensionSupport = OwnedUiVisualExtensionSupport;
 interface PiExtensionUiBindingPorts {
     session(): AgentSession | undefined;
+    runtime(): AgentSessionRuntime | undefined;
     diagnostic(severity: OwnedUiDiagnostics["severity"], code: string, message: string, recoverable: boolean): void;
     emitView(): void;
 }

package/dist/integrations/pi/engine/extension-ui-binding.js

@@ -1,5 +1,7 @@
 import { PRODUCT_IDENTITY } from "../../../product-identity.js";
 import { isRecord } from "./message-values.js";
+import { missingSessionCwdRecovery } from "./session-cwd-recovery.js";
+import { switchToRecoveredFork } from "./runtime-integration.js";
 import { OWNED_UI_EXTENSION_CONTRACT_VERSION, OWNED_UI_EXTENSION_RENDER_CALLBACKS, OWNED_UI_EXTENSION_UI_CALLBACKS, OWNED_UI_EXTENSION_UI_PROPERTIES, assertOwnedUiExtensionUiPort, } from "../../../contracts/owned-ui/index.js";
 /**
  * The owned extension UI bridge's attachment to pinned Pi sessions: the bridge the shell hands
@@ -54,8 +56,51 @@ export class PiExtensionUiBinding {
             return;
         }
         try {
+            const runtime = this.#ports.runtime();
             await session.bindExtensions({
                 uiContext: ui,
+                ...(runtime === undefined ? {} : {
+                    commandContextActions: {
+                        waitForIdle: () => session.waitForIdle(),
+                        newSession: options => runtime.newSession(options),
+                        fork: (entryId, options) => runtime.fork(entryId, options),
+                        navigateTree: async (targetId, options) => {
+                            const result = await session.navigateTree(targetId, options);
+                            return { cancelled: result.cancelled === true };
+                        },
+                        reload: async () => { await session.reload(); await this.rebind(); },
+                        switchSession: async (path, options) => {
+                            try {
+                                const result = await runtime.switchSession(path, options);
+                                if (!result.cancelled)
+                                    ui.notify("Resumed session", "info");
+                                return result;
+                            }
+                            catch (error) {
+                                const recovery = missingSessionCwdRecovery(error);
+                                if (recovery === undefined)
+                                    throw error;
+                                const selected = await ui.select(recovery.message, recovery.options.map(option => option.label));
+                                const choice = recovery.options.find(option => option.label === selected)?.id;
+                                const cwd = recovery.cwdRecovery.fallbackCwd;
+                                if (choice === "fork") {
+                                    const result = await switchToRecoveredFork(runtime, path, cwd, options);
+                                    if (!result.cancelled)
+                                        ui.notify(result.message, "info");
+                                    return { cancelled: result.cancelled };
+                                }
+                                if (choice === "continue") {
+                                    const result = await runtime.switchSession(path, { ...options, cwdOverride: cwd });
+                                    if (!result.cancelled)
+                                        ui.notify(`Resumed session in ${cwd}`, "info");
+                                    return result;
+                                }
+                                ui.notify("Resume cancelled", "info");
+                                return { cancelled: true };
+                            }
+                        },
+                    },
+                }),
                 mode: "tui",
                 shutdownHandler: () => this.#extensionShutdown?.(),
                 onError: error => {

package/dist/integrations/pi/engine/host-ports.d.ts

@@ -1,3 +1,4 @@
+import type { DeliveryFailure } from "./event-delivery.js";
 import { type StartupPhase } from "../../../foundation/startup/startup-runtime.js";
 /**
  * What one engine session may ask of the process-level host that created it. The host owns
@@ -6,6 +7,7 @@ import { type StartupPhase } from "../../../foundation/startup/startup-runtime.j
 export interface PiEngineHostSessionPorts {
     /** Aborted when the host is disposed; host-level timers and probes stop with it. */
     readonly signal: AbortSignal;
+    deliveryIncident?(failure: DeliveryFailure): void;
     /** Record a startup trace phase; the host records each phase once per process. */
     markStartupPhase(phase: StartupPhase): Promise<void>;
     /** A session's runtime loaded the profile's HTTP idle timeout; the host installs the dispatcher once. */

package/dist/integrations/pi/engine/host.d.ts

@@ -1,3 +1,4 @@
+import type { DeliveryFailure } from "./event-delivery.js";
 import { PiEngineAdapter } from "./adapter.js";
 import { type StartupPhase } from "../../../foundation/startup/startup-runtime.js";
 import type { PiEnginePackageUpdateProbe, PiEngineRuntimeFactory, PiRepositoryContextReader } from "./session-runtime.js";
@@ -21,6 +22,7 @@ export interface PiEngineHostTheme {
 }
 export interface PiEngineHostOptions {
     readonly productMode: "bare" | "comparison";
+    readonly deliveryIncident?: (failure: DeliveryFailure) => void;
     readonly theme: PiEngineHostTheme;
     /** Themes installed on this machine, listed by the component adapter that owns the theme unit. */
     readonly availableThemes?: () => readonly string[];
@@ -41,6 +43,7 @@ export interface PiEngineSessionRequest extends OwnedUiSessionRequest {
     readonly sessionSelection?: PiSessionSelection;
     readonly sessionForkPrompt?: PiSessionForkPrompt;
     readonly repositoryContextReader?: PiRepositoryContextReader;
+    readonly worktreeCwdReader?: import("./worktree-tools.js").PiWorktreeCwdReader;
 }
 /** The dispatcher policy in force for the process and the session that put it there. */
 export interface PiEngineHttpPolicy {

package/dist/integrations/pi/engine/host.js

@@ -26,6 +26,7 @@ class ProcessPiEngineHost {
         this.#markStartupPhase = options.markStartupPhase ?? (phase => markStartupPhase(process.env, phase));
         this.#sessionPorts = {
             signal: this.#abort.signal,
+            deliveryIncident: failure => options.deliveryIncident?.(failure),
             markStartupPhase: phase => this.#tracePhase(phase),
             httpPolicyLoaded: (timeoutMs, sessionId) => { this.#applyHttpPolicy(timeoutMs, sessionId, "startup"); },
             httpPolicyChanged: (timeoutMs, sessionId) => { this.#applyHttpPolicy(timeoutMs, sessionId, "setting"); },
@@ -68,6 +69,7 @@ class ProcessPiEngineHost {
             ...(request.sessionSelection === undefined ? {} : { sessionSelection: request.sessionSelection }),
             ...(request.sessionForkPrompt === undefined ? {} : { sessionForkPrompt: request.sessionForkPrompt }),
             ...(request.repositoryContextReader === undefined ? {} : { repositoryContextReader: request.repositoryContextReader }),
+            ...(request.worktreeCwdReader === undefined ? {} : { worktreeCwdReader: request.worktreeCwdReader }),
         });
         this.#sessions.set(sessionId, adapter);
         try {

package/dist/integrations/pi/engine/package-integration.js

@@ -17,6 +17,8 @@ export function createPiPackagesPort(input) {
     const { profileRoot, cwd } = input;
     // Compatibility: model-only refresh bypasses package settings and their diagnostics, as Pi does.
     let packageManager;
+    let updateChanges = [];
+    let updateWarningCount = 0;
     const manager = () => {
         if (packageManager)
             return packageManager;
@@ -29,9 +31,16 @@ export function createPiPackagesPort(input) {
         }
         packageManager = new DefaultPackageManager({ cwd, agentDir: profileRoot, settingsManager });
         packageManager.setProgressCallback(event => {
-            if (event.type !== "start")
-                return;
-            input.onProgress?.({ operation: operationFor(event.action), message: String(event.message) });
+            if (event.type === "result" && event.action === "update" && event.message) {
+                updateChanges.push(event.message);
+            }
+            else if (event.type === "start") {
+                input.onProgress?.({ operation: operationFor(event.action), message: String(event.message) });
+            }
+            else if (event.type === "progress" && event.message) {
+                updateWarningCount++;
+                input.onProgress?.({ operation: operationFor(event.action), message: event.message, severity: "warning" });
+            }
         });
         return packageManager;
     };
@@ -65,8 +74,14 @@ export function createPiPackagesPort(input) {
         async update(source) {
             return await attempt("update", source ?? null, async () => {
                 // Compatibility: Pi owns source identity and its contextual no-match suggestions.
+                updateChanges = [];
+                updateWarningCount = 0;
                 await manager().update(source);
-                return agentPackageOutcome("update", "completed", null, source ?? null, configured());
+                // Compatibility: Pi's offline predicate is not part of its package-root public API.
+                const offline = ["1", "true", "yes"].includes(process.env.PI_OFFLINE?.toLowerCase() ?? "");
+                return agentPackageOutcome("update", "completed", null, source ?? null, configured(), {
+                    offline, warningCount: updateWarningCount, changes: updateChanges,
+                });
             });
         },
         async refreshModels() {

package/dist/integrations/pi/engine/pending-delivery.d.ts

@@ -2,8 +2,11 @@ import type { OwnedUiEvent } from "../../../contracts/owned-ui/index.js";
 /** Intrusive FIFO + segment index: replacement unlinks in O(1), never changes source ordering. */
 export declare class PendingEngineDelivery {
     #private;
+    rejection: "event-count" | "retained-bytes" | null;
     private readonly retain;
-    constructor(retain?: (event: OwnedUiEvent) => () => void);
+    private readonly current;
+    private readonly externalBytes;
+    constructor(retain?: (event: OwnedUiEvent) => () => void, current?: () => unknown, externalBytes?: (excluding?: OwnedUiEvent) => number);
     get size(): number;
     diagnostics(): {
         pending: number;

package/dist/integrations/pi/engine/pending-delivery.js

@@ -1,3 +1,4 @@
+import { DeliveryRetention } from "./delivery-retention.js";
 const MAX_PENDING_EVENTS = 1024;
 const MAX_PENDING_EVENT_BYTES = 8 * 1024 * 1024;
 /** Actual shell semantics: only live complete block state has no independent side effect. */
@@ -29,21 +30,32 @@ export class PendingEngineDelivery {
     #head;
     #tail;
     #size = 0;
-    #bytes = 0;
+    #retention = new DeliveryRetention();
     #protected = 0;
     #generation = -1;
     #superseded = 0;
     #peakNodes = 0;
     #peakBytes = 0;
+    rejection = null;
     retain;
-    constructor(retain) { this.retain = retain; }
+    current;
+    externalBytes;
+    constructor(retain, current, externalBytes) {
+        this.retain = retain;
+        this.current = current;
+        this.externalBytes = externalBytes;
+    }
     get size() { return this.#size; }
+    get #bytes() { return this.#retention.bytes + this.#size * 128 + (this.externalBytes?.() ?? 0); }
     diagnostics() {
         return { pending: this.#size, bytes: this.#bytes, protected: this.#protected,
             superseded: this.#superseded, peakNodes: this.#peakNodes, peakBytes: this.#peakBytes };
     }
     /** False means not admitted. The caller must enter its reserved recovery protocol, never evict. */
     push(event, generation, reconcile) {
+        this.rejection = null;
+        if (this.current)
+            this.#retention.baseline(this.current());
         const key = replaceableEventKey(event);
         if (generation !== this.#generation || key === null) {
             if (!this.seal())
@@ -51,14 +63,23 @@ export class PendingEngineDelivery {
             this.#generation = generation;
         }
         const prior = key === null ? undefined : this.#replaceable.get(key);
-        let bytes = retainedEventBytes(event);
-        const marker = key !== null && bytes > 64 * 1024 && reconcile !== undefined;
-        if (marker)
-            bytes = 128;
+        // Compatibility: production owns exact immutable revisions through the ledger. Legacy standalone
+        // queues retain the compact-marker contract when no authoritative owner is supplied.
+        const marker = this.current === undefined && key !== null && retainedEventBytes(event) > 64 * 1024 && reconcile !== undefined;
+        const charge = marker ? undefined : this.#retention.retain(event);
+        const release = marker ? undefined : this.retain?.(event);
+        prior?.charge?.();
+        const bytes = this.#retention.bytes + this.#size * 128 + (this.externalBytes?.(prior?.event) ?? 0);
         if (this.#size - (prior === undefined ? 0 : 1) >= MAX_PENDING_EVENTS
-            || this.#bytes - (prior?.bytes ?? 0) + bytes > MAX_PENDING_EVENT_BYTES)
+            || bytes + (prior === undefined ? 128 : 0) > MAX_PENDING_EVENT_BYTES) {
+            this.rejection = this.#size - (prior === undefined ? 0 : 1) >= MAX_PENDING_EVENTS ? "event-count" : "retained-bytes";
+            charge?.();
+            release?.();
+            if (prior?.event)
+                prior.charge = this.#retention.retain(prior.event);
             return false;
-        const node = { key, generation, bytes, ...(marker ? { resolve: reconcile } : { event, release: this.retain?.(event) }) };
+        }
+        const node = { key, generation, charge, ...(marker ? { resolve: reconcile } : { event, release }) };
         if (prior !== undefined) {
             this.#unlink(prior);
             this.#superseded = Math.min(Number.MAX_SAFE_INTEGER, this.#superseded + 1);
@@ -70,7 +91,6 @@ export class PendingEngineDelivery {
             this.#head = node;
         this.#tail = node;
         this.#size++;
-        this.#bytes += bytes;
         if (key === null)
             this.#protected++;
         else
@@ -101,9 +121,17 @@ export class PendingEngineDelivery {
             return undefined;
         const event = node.event ?? node.resolve();
         const release = node.release ?? this.retain?.(event);
+        const charge = node.charge;
         this.#unlink(node, false);
-        // Invariant: a consumed snapshot retains its assets through synchronous listener delivery, including reentrant production.
-        return { event, generation: node.generation, ...(release === undefined ? {} : { release }) };
+        // Invariant: keep the exact revision and assets charged through reentrant listener production.
+        let released = false;
+        return { event, generation: node.generation, release: () => {
+                if (released)
+                    return;
+                released = true;
+                charge?.();
+                release?.();
+            } };
     }
     // Invariant: a barrier freezes lazy authoritative markers before a later segment can change them.
     seal() {
@@ -111,22 +139,28 @@ export class PendingEngineDelivery {
             if (node.resolve === undefined)
                 continue;
             const event = node.resolve();
-            const bytes = retainedEventBytes(event);
-            if (this.#bytes - node.bytes + bytes > MAX_PENDING_EVENT_BYTES)
+            const charge = this.#retention.retain(event);
+            const release = this.retain?.(event);
+            if (this.#bytes > MAX_PENDING_EVENT_BYTES) {
+                this.rejection = "retained-bytes";
+                charge();
+                release?.();
                 return false;
-            this.#bytes += bytes - node.bytes;
-            node.bytes = bytes;
+            }
+            node.charge = charge;
             node.event = event;
             node.resolve = undefined;
-            node.release = this.retain?.(event);
+            node.release = release;
             this.#peakBytes = Math.max(this.#peakBytes, this.#bytes);
         }
         this.#replaceable.clear();
         return true;
     }
     #unlink(node, release = true) {
-        if (release)
+        if (release) {
+            node.charge?.();
             node.release?.();
+        }
         if (node.previous !== undefined)
             node.previous.next = node.next;
         else
@@ -136,7 +170,6 @@ export class PendingEngineDelivery {
         else
             this.#tail = node.previous;
         this.#size--;
-        this.#bytes -= node.bytes;
         if (node.key === null)
             this.#protected--;
         else if (this.#replaceable.get(node.key) === node)