@timurproko/a1 0.2.7-dev.788 → 0.2.7-dev.794

package/dist/native/win32-x64/manifest.json

@@ -1,20 +1,23 @@
 {
-  "schema": "a1-process-guardian-artifact-v1",
-  "protocolVersion": 1,
+  "schema": "a1-process-guardian-artifact-v2",
+  "kind": "node-addon",
+  "nodeApi": 9,
+  "protocolVersion": 2,
   "crateVersion": "0.1.0-dev",
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-16T17:09:00.247Z",
+  "builtAt": "2026-10-18T08:41:31.607Z",
   "artifact": {
-    "filename": "process-guardian.exe",
-    "sha256": "22cad9088f307ea7c98eb992e56f0a9bda111ea14d42d478f1a6ec0216da75d4",
-    "size": 288256
+    "filename": "process-guardian.node",
+    "sha256": "6299956800f1ab62f2e5bb4a1e4d61dbd45ce70a7711cbb9aca8f23033bdbbaf",
+    "size": 402432
   },
   "provenance": {
     "language": "Rust",
     "cargoLock": "native/process-guardian/Cargo.lock",
     "sourceRoot": "native/process-guardian",
-    "signatureStatus": "ci-attestation-required"
+    "signatureStatus": "ci-attestation-required",
+    "identityCheck": "executed"
   }
 }

package/dist/native/win32-x64/terminal-host-THIRD-PARTY-NOTICES.txt

@@ -1,6 +1,6 @@
 Third-party notices for the A1 terminal host
 
-The terminal-host executable and its session-writer lock include the following components.
+The terminal-host Node-API addon includes the following components.
 
 ==============================================================================
 anyhow 1.0.104

package/dist/native/win32-x64/terminal-host.manifest.json

@@ -1,5 +1,7 @@
 {
-  "schema": "a1-terminal-host-artifact-v1",
+  "schema": "a1-terminal-host-artifact-v2",
+  "kind": "node-addon",
+  "nodeApi": 9,
   "protocolVersion": 1,
   "generation": 1,
   "crateVersion": "0.1.0-dev",
@@ -7,21 +9,21 @@
   "architecture": "x64",
   "target": "x86_64-pc-windows-msvc",
   "capability": "supported",
-  "builtAt": "2026-10-16T17:13:44.310Z",
+  "builtAt": "2026-10-18T08:44:54.428Z",
   "artifact": {
-    "filename": "terminal-host.exe",
-    "sha256": "8a75c5c5d1ca1b7e5d1e42eef4342f76037fc6d2962c2ca6f00c78abb6a7693e",
-    "size": 5219840
+    "filename": "terminal-host.node",
+    "sha256": "de82227898a90a6ec6bda0c8b503148388d3769ef4ab7f1176e56c8472b76232",
+    "size": 5617664
   },
-  "sessionLock": {
-    "filename": "a1_session_lock.node",
-    "sha256": "41e23a5a2d65943bfc82fca6f9f3eb0b3169dcbe7181dbc848de015675639790",
-    "size": 1996288
+  "entry": {
+    "filename": "dist/foundation/resident-tabs/host-entry.js",
+    "sha256": "4b1f702cc9980ffa531cf3e9963b884eaa35120d04d5c195ea3308f501d8d557",
+    "size": 1315
   },
   "notices": {
     "filename": "terminal-host-THIRD-PARTY-NOTICES.txt",
-    "sha256": "9e80136b62106ac672162dacbd0d6eb2a94b3318e597e40dfcf70c4920c34b00",
-    "size": 555140
+    "sha256": "127b8634dc7f47d9b8c250ff281e028daeac7729290da4f41cf1a1eeafdb76ca",
+    "size": 555117
   },
   "provenance": {
     "language": "Rust",
@@ -34,11 +36,11 @@
     "zigVersion": "0.15.2",
     "rustVersion": "rustc 1.99.1 (58cf8f9c3 2026-10-13)",
     "features": {
-      "executable": [],
-      "sessionLock": [
+      "addon": [
         "node-addon"
       ]
     },
-    "signatureStatus": "ci-attestation-required"
+    "signatureStatus": "ci-attestation-required",
+    "identityCheck": "executed"
   }
 }

package/dist/product-identity.d.ts

@@ -5,7 +5,7 @@ declare const ENDPOINT_KEYS: readonly ["windowsPipeStem", "unixSocketFilename",
 declare const MANIFEST_KEYS: readonly ["releaseFilename", "packageFilename"];
 declare const PROTOCOL_KEYS: readonly ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "promptHistorySchema", "releaseCohortSchema", "updateJournalSchema"];
 declare const EVIDENCE_KEYS: readonly ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema", "startupTraceSchema", "dependencyLayerSchema", "dependencyLayerCertificationSchema", "runtimePayloadSchema"];
-declare const ARTIFACT_KEYS: readonly ["cliEntry", "supervisorEntry", "guardianEntry", "uiEntry", "nativeExecutable", "nativeCrate", "processGuardianExecutable", "releaseTarballStem", "diagnosticStem"];
+declare const ARTIFACT_KEYS: readonly ["cliEntry", "supervisorEntry", "guardianEntry", "uiEntry", "terminalHostAddon", "terminalHostEntry", "nativeCrate", "processGuardianAddon", "releaseTarballStem", "diagnosticStem"];
 type StringRecord<Keys extends readonly string[]> = {
     readonly [Key in Keys[number]]: string;
 };

package/dist/product-identity.js

@@ -9,7 +9,7 @@ const ENDPOINT_KEYS = ["windowsPipeStem", "unixSocketFilename", "metadataFilenam
 const MANIFEST_KEYS = ["releaseFilename", "packageFilename"];
 const PROTOCOL_KEYS = ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "promptHistorySchema", "releaseCohortSchema", "updateJournalSchema"];
 const EVIDENCE_KEYS = ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema", "startupTraceSchema", "dependencyLayerSchema", "dependencyLayerCertificationSchema", "runtimePayloadSchema"];
-const ARTIFACT_KEYS = ["cliEntry", "supervisorEntry", "guardianEntry", "uiEntry", "nativeExecutable", "nativeCrate", "processGuardianExecutable", "releaseTarballStem", "diagnosticStem"];
+const ARTIFACT_KEYS = ["cliEntry", "supervisorEntry", "guardianEntry", "uiEntry", "terminalHostAddon", "terminalHostEntry", "nativeCrate", "processGuardianAddon", "releaseTarballStem", "diagnosticStem"];
 const ROOT_KEYS = ["schema", "displayName", "commandName", "packageName", "filesystem", "environment", "state", "endpoint", "manifest", "protocol", "evidence", "artifacts"];
 export function validateProductIdentity(value) {
     const root = exactObject(value, ROOT_KEYS, "product identity");

package/dist/product-identity.json

@@ -87,9 +87,10 @@
         "supervisorEntry": "bin/supervisor.js",
         "guardianEntry": "bin/guardian.js",
         "uiEntry": "bin/ui.js",
-        "nativeExecutable": "terminal-host",
+        "terminalHostAddon": "terminal-host",
+        "terminalHostEntry": "host-entry",
         "nativeCrate": "terminal-host",
-        "processGuardianExecutable": "process-guardian",
+        "processGuardianAddon": "process-guardian",
         "releaseTarballStem": "timurproko-a1",
         "diagnosticStem": "a1"
     }

package/dist/runtime-payload-inventory.json

@@ -8,6 +8,7 @@
     "bin/ui.js",
     "bin/update-recovery.js",
     "bin/warmup.js",
+    "dist/foundation/launch-guardian/exit-watcher.js",
     "dist/foundation/startup/startup-descriptor.js",
     "dist/integrations/pi/startup-public.js"
   ],

package/dist/ui/components/index.d.ts

@@ -32,8 +32,8 @@ export { readVisibleHyperlinks } from "./visible-hyperlinks.js";
 export type { VisibleHyperlinkRange, VisibleHyperlinkRow } from "./visible-hyperlinks.js";
 export { renderStatusLine, statusText } from "./status-line.js";
 export type { StatusLineInput } from "./status-line.js";
-export { SUBMITTED_PROMPT_PREFIX_WIDTH, composeSubmittedPromptRows, formatSubmittedPromptTime, submittedPromptLayout } from "./submitted-prompt.js";
-export type { SubmittedPromptLayout, SubmittedPromptStyle } from "./submitted-prompt.js";
+export { SUBMITTED_PROMPT_PREFIX_WIDTH, composeSubmittedPromptRows, formatLocalTime, formatSubmittedPromptTime, submittedPromptLayout } from "./submitted-prompt.js";
+export type { SubmittedPromptLayout, SubmittedPromptStyle, UiTimeFormat } from "./submitted-prompt.js";
 export { numericValues, steppedValue, stepperEnds } from "./stepper.js";
 export type { NumericRange } from "./stepper.js";
 export { TranscriptViewport, assertTranscriptViewportFrameDescriptor } from "./transcript-viewport.js";

package/dist/ui/components/index.js

@@ -16,7 +16,7 @@ export { GLOBAL_SCOPE, ShortcutRegistry, assembleShortcuts, assertNoShortcutConf
 export { backgroundSgrSpan, heldNativeHyperlinkStyle, hyperlinkSgrSpan, hyperlinkTargetAtColumn, nativeHyperlinkStyle, overlaySpan } from "./spans.js";
 export { readVisibleHyperlinks } from "./visible-hyperlinks.js";
 export { renderStatusLine, statusText } from "./status-line.js";
-export { SUBMITTED_PROMPT_PREFIX_WIDTH, composeSubmittedPromptRows, formatSubmittedPromptTime, submittedPromptLayout } from "./submitted-prompt.js";
+export { SUBMITTED_PROMPT_PREFIX_WIDTH, composeSubmittedPromptRows, formatLocalTime, formatSubmittedPromptTime, submittedPromptLayout } from "./submitted-prompt.js";
 export { numericValues, steppedValue, stepperEnds } from "./stepper.js";
 export { TranscriptViewport, assertTranscriptViewportFrameDescriptor } from "./transcript-viewport.js";
 export { RAIL_COLUMNS, renderEmptyState, withScrollbarRail } from "./surface.js";

package/dist/ui/components/selection-copy.d.ts

@@ -20,5 +20,7 @@ export interface SelectionCopySnapshot {
 }
 /** Shares the viewport's semantic chrome exclusions with isolated copy preparation. */
 export declare function selectionCopyLineContent(text: string, prompt: SelectionCopyPrompt): TextSelectionLineContent;
+/** Builds an immutable exact-text snapshot without changing editor-owned selection state. */
+export declare function literalSelectionCopySnapshot(text: string, revision?: number): SelectionCopySnapshot | null;
 /** Extracts one snapshot row with the existing grapheme/newline policy; run expensive rows off-thread. */
 export declare function selectionCopyRowText(snapshot: Pick<SelectionCopySnapshot, "selection" | "literal">, row: SelectionCopyRow, index: number): string;

package/dist/ui/components/selection-copy.js

@@ -19,6 +19,19 @@ export function selectionCopyLineContent(text, prompt) {
         return { from, to: from + 1 };
     return usefulTextLineContent(plain, from);
 }
+/** Builds an immutable exact-text snapshot without changing editor-owned selection state. */
+export function literalSelectionCopySnapshot(text, revision = 0) {
+    if (text.trim().length === 0)
+        return null;
+    const selection = {
+        start: { line: 0, column: 0 },
+        end: { line: 0, column: Number.MAX_SAFE_INTEGER },
+    };
+    if (text.length > MAX_COPY_SOURCE_UNITS) {
+        return { literal: true, selection, revision, rows: [], sourceUnits: 0, rejected: "size" };
+    }
+    return { literal: true, selection, revision, rows: [{ text }], sourceUnits: text.length };
+}
 /** Extracts one snapshot row with the existing grapheme/newline policy; run expensive rows off-thread. */
 export function selectionCopyRowText(snapshot, row, index) {
     if (snapshot.literal)

package/dist/ui/components/submitted-prompt.d.ts

@@ -1,3 +1,6 @@
+export type UiTimeFormat = "20:00" | "8:00 PM";
+/** Deterministic local hour/minute presentation shared by A1-owned time labels. */
+export declare function formatLocalTime(source: Date | number, format?: UiTimeFormat): string | null;
 /** Visible width of the submitted-prompt prefix (`❯ `). */
 export declare const SUBMITTED_PROMPT_PREFIX_WIDTH = 2;
 export interface SubmittedPromptStyle {
@@ -8,16 +11,16 @@ export interface SubmittedPromptLayout {
     readonly contentWidth: number;
     readonly timestamp: string | null;
 }
-/** Formats transcript metadata, never render time, as local 24-hour HH:mm. */
-export declare function formatSubmittedPromptTime(source: Date | number): string | null;
+/** Formats transcript metadata, never render time, in the active A1 time format. */
+export declare function formatSubmittedPromptTime(source: Date | number, format?: UiTimeFormat): string | null;
 /**
  * Computes the width at which the prompt's Markdown body must be rendered.
  * The timestamp is omitted rather than allowing it to crowd useful content.
  */
-export declare function submittedPromptLayout(width: number, source?: Date | number | null): SubmittedPromptLayout;
+export declare function submittedPromptLayout(width: number, source?: Date | number | null, format?: UiTimeFormat): SubmittedPromptLayout;
 /**
  * Composes already-rendered prompt content into the compact submitted bar.
  * Continuations align below the content, not below the prefix, and no row can
  * exceed the supplied terminal width even when the content renderer misbehaves.
  */
-export declare function composeSubmittedPromptRows(contentRows: readonly string[], width: number, source?: Date | number | null, style?: SubmittedPromptStyle): readonly string[];
+export declare function composeSubmittedPromptRows(contentRows: readonly string[], width: number, source?: Date | number | null, style?: SubmittedPromptStyle, format?: UiTimeFormat): readonly string[];

package/dist/ui/components/submitted-prompt.js

@@ -1,22 +1,30 @@
 import { displayWidth, truncateToWidth } from "./text.js";
+/** Deterministic local hour/minute presentation shared by A1-owned time labels. */
+export function formatLocalTime(source, format = "8:00 PM") {
+    const date = source instanceof Date ? source : new Date(source);
+    if (!Number.isFinite(date.getTime()))
+        return null;
+    const hour = date.getHours();
+    const minute = String(date.getMinutes()).padStart(2, "0");
+    if (format === "20:00")
+        return `${String(hour).padStart(2, "0")}:${minute}`;
+    return `${hour % 12 || 12}:${minute} ${hour < 12 ? "AM" : "PM"}`;
+}
 /** Visible width of the submitted-prompt prefix (`❯ `). */
 export const SUBMITTED_PROMPT_PREFIX_WIDTH = 2;
 const TIMESTAMP_MARGIN = 3;
 const MIN_USEFUL_CONTENT_WIDTH = 8;
-/** Formats transcript metadata, never render time, as local 24-hour HH:mm. */
-export function formatSubmittedPromptTime(source) {
-    const date = source instanceof Date ? source : new Date(source);
-    if (!Number.isFinite(date.getTime()))
-        return null;
-    return `${String(date.getHours()).padStart(2, "0")}:${String(date.getMinutes()).padStart(2, "0")}`;
+/** Formats transcript metadata, never render time, in the active A1 time format. */
+export function formatSubmittedPromptTime(source, format = "8:00 PM") {
+    return formatLocalTime(source, format);
 }
 /**
  * Computes the width at which the prompt's Markdown body must be rendered.
  * The timestamp is omitted rather than allowing it to crowd useful content.
  */
-export function submittedPromptLayout(width, source) {
+export function submittedPromptLayout(width, source, format = "8:00 PM") {
     const boundedWidth = Math.max(1, width);
-    const timestamp = source === undefined || source === null ? null : formatSubmittedPromptTime(source);
+    const timestamp = source === undefined || source === null ? null : formatSubmittedPromptTime(source, format);
     const timestampReserve = timestamp === null ? 0 : displayWidth(timestamp) + TIMESTAMP_MARGIN;
     const canShowTimestamp = timestamp !== null
         && boundedWidth - SUBMITTED_PROMPT_PREFIX_WIDTH - timestampReserve >= MIN_USEFUL_CONTENT_WIDTH;
@@ -30,10 +38,10 @@ export function submittedPromptLayout(width, source) {
  * Continuations align below the content, not below the prefix, and no row can
  * exceed the supplied terminal width even when the content renderer misbehaves.
  */
-export function composeSubmittedPromptRows(contentRows, width, source, style = {}) {
+export function composeSubmittedPromptRows(contentRows, width, source, style = {}, format = "8:00 PM") {
     if (width <= 0)
         return [];
-    const layout = submittedPromptLayout(width, source);
+    const layout = submittedPromptLayout(width, source, format);
     const prefix = (style.prefix ?? identity)("❯ ");
     const rows = (contentRows.length === 0 ? [""] : contentRows).map((row, index) => {
         const content = truncateToWidth(row, layout.contentWidth);

package/dist/ui/components/transcript-viewport.d.ts

@@ -6,6 +6,8 @@ export interface TranscriptPromptAnchor {
     readonly lastRow: number;
     /** The source first row, including its submitted-prompt styling and timestamp. */
     readonly sourceRow: string;
+    /** Right-edge metadata cells omitted from semantic prompt copies. */
+    readonly copySuffixWidth?: number;
     /** Optional source-styled row used only while prominent and not hovered. */
     readonly prominentSourceRow?: string;
 }
@@ -36,7 +38,11 @@ export interface TranscriptViewportFrameInput {
     /** Final transient rows to bottom-align with unused viewport space while content fits. */
     readonly bottomAlignedTailRowCount?: number;
     readonly dockRows: readonly string[];
-    readonly explicitCopyDockRows?: number;
+    /** Zero-based dock rows admitted to frame copying, classified before dock composition. */
+    readonly copyableDockRows?: readonly {
+        readonly row: number;
+        readonly prompt?: "first" | "continuation";
+    }[];
     readonly promptAnchors: readonly TranscriptPromptAnchor[];
     readonly width: number;
     readonly height: number;
@@ -142,7 +148,6 @@ export interface TranscriptViewportFrame {
         readonly cacheEntries: number;
     };
 }
-type SelectionCopyIntent = "automatic" | "explicit";
 /**
  * A1-owned viewport state. It knows only rows and semantic prompt anchors; Pi
  * components and transcript payloads remain outside this neutral boundary.
@@ -172,9 +177,9 @@ export declare class TranscriptViewport {
     extendSelection(column: number, frameRow: number, now?: number, autoScroll?: boolean): boolean;
     releaseSelection(): boolean;
     clearSelection(): boolean;
-    selectedText(intent?: SelectionCopyIntent): string | null;
+    selectedText(): string | null;
     /** Captures visible selected text, not off-screen history. */
-    captureSelectedText(intent?: SelectionCopyIntent): SelectionCopySnapshot | null;
+    captureSelectedText(): SelectionCopySnapshot | null;
     scrollBy(lines: number, now?: number): boolean;
     scrollTo(position: number, now?: number): boolean;
     scrollToEnd(now?: number): boolean;
@@ -186,7 +191,6 @@ export declare class TranscriptViewport {
     clearTransient(): void;
     compose(input: TranscriptViewportFrameInput): TranscriptViewportFrame;
     /** Reuses an established transcript frame when only same-height dock rows changed. */
-    composeDockOnly(dockRows: readonly string[], width: number, height: number, explicitCopyDockRows?: number): TranscriptViewportFrame | null;
+    composeDockOnly(dockRows: readonly string[], width: number, height: number, copyableDockRows?: TranscriptViewportFrameInput["copyableDockRows"]): TranscriptViewportFrame | null;
 }
 export declare function assertTranscriptViewportFrameDescriptor(descriptor: TranscriptViewportFrameDescriptor): void;
-export {};

package/dist/ui/components/transcript-viewport.js

@@ -63,7 +63,7 @@ export class TranscriptViewport {
     #contentWidth = 0;
     #selectionWidth = 0;
     #viewportHeight = 0;
-    #explicitCopyDockRows = 0;
+    #copyableDockRows = new Map();
     #firstSelectableRow = 0;
     #selectionRowAnchors = [];
     #frameId = 0;
@@ -179,14 +179,14 @@ export class TranscriptViewport {
         this.#selectionRevision += 1;
         return true;
     }
-    selectedText(intent = "automatic") {
+    selectedText() {
         const selection = this.#visibleSelection();
         if (selection === undefined)
             return null;
         const copiedLines = Array.from({ length: Math.max(0, selection.end.line - selection.start.line + 1) }, (_value, index) => selection.start.line + index).filter(line => {
             const anchor = this.#selectionRowAnchors[line];
             return anchor?.kind === "document" && anchor.row < this.#selectableDocumentRowCount
-                || intent === "explicit" && anchor?.kind === "dock" && anchor.fromBottom < this.#explicitCopyDockRows;
+                || anchor?.kind === "dock" && this.#copyableDockRows.has(anchor.fromBottom);
         });
         if (copiedLines.length === 0)
             return null;
@@ -199,18 +199,24 @@ export class TranscriptViewport {
         const text = textSelectionText(selection, this.#selectionRows, line => {
             const row = this.#selectionRows[line] ?? "";
             const anchor = this.#selectionRowAnchors[line];
-            return prompt !== undefined && anchor?.kind === "document"
-                ? selectionCopyLineContent(row, anchor.row === prompt.firstRow ? "first" : "continuation")
-                : usefulTextLineContent(row);
+            const dock = anchor?.kind === "dock" ? this.#copyableDockRows.get(anchor.fromBottom) : undefined;
+            if (prompt !== undefined && anchor?.kind === "document") {
+                const first = anchor.row === prompt.firstRow;
+                const copyRow = first && (prompt.copySuffixWidth ?? 0) > 0
+                    ? truncateToWidth(row, Math.max(0, displayWidth(row) - (prompt.copySuffixWidth ?? 0)))
+                    : row;
+                return selectionCopyLineContent(copyRow, first ? "first" : "continuation");
+            }
+            return dock?.prompt !== undefined ? selectionCopyLineContent(row, dock.prompt) : usefulTextLineContent(row);
         }, line => included.has(line));
         return text.length === 0 ? null : text;
     }
     /** Captures visible selected text, not off-screen history. */
-    captureSelectedText(intent = "automatic") {
-        if (intent === "automatic" && !this.#copyableSelection)
+    captureSelectedText() {
+        if (!this.#copyableSelection)
             return null;
         const started = performance.now();
-        let text = this.selectedText(intent);
+        let text = this.selectedText();
         if (text === null)
             return null;
         text = text.trim();
@@ -313,7 +319,7 @@ export class TranscriptViewport {
         this.#contentWidth = 0;
         this.#selectionWidth = 0;
         this.#viewportHeight = 0;
-        this.#explicitCopyDockRows = 0;
+        this.#copyableDockRows.clear();
         this.clearTransient();
         this.#frame = null;
     }
@@ -329,7 +335,7 @@ export class TranscriptViewport {
         const theme = input.theme ?? PLAIN_THEME;
         const previousDescriptor = this.#frame?.descriptor ?? null;
         const dock = input.dockRows.length > height ? input.dockRows.slice(-height) : [...input.dockRows];
-        this.#explicitCopyDockRows = clamp(input.explicitCopyDockRows ?? 0, 0, dock.length);
+        this.#copyableDockRows = copyableDockRowsBySuffix(input.dockRows, input.copyableDockRows);
         const viewportHeight = Math.max(0, height - dock.length);
         const bottomAlignedTailRowCount = clamp(input.bottomAlignedTailRowCount ?? 0, 0, input.documentRows.length);
         const transientAlignmentGapRows = bottomAlignedTailRowCount > 0
@@ -606,7 +612,7 @@ export class TranscriptViewport {
         return frame;
     }
     /** Reuses an established transcript frame when only same-height dock rows changed. */
-    composeDockOnly(dockRows, width, height, explicitCopyDockRows = 0) {
+    composeDockOnly(dockRows, width, height, copyableDockRows = []) {
         const previous = this.#frame;
         const boundedWidth = Math.max(1, width);
         const boundedHeight = Math.max(0, height);
@@ -642,7 +648,7 @@ export class TranscriptViewport {
         };
         assertTranscriptViewportFrameDescriptor(descriptor);
         this.#selectionRows = [...this.#selectionRows.slice(0, viewportHeight), ...dock].slice(0, boundedHeight);
-        this.#explicitCopyDockRows = clamp(explicitCopyDockRows, 0, dock.length);
+        this.#copyableDockRows = copyableDockRowsBySuffix(dockRows, copyableDockRows);
         const frame = {
             rows: [...previous.rows.slice(0, viewportHeight), ...dock].slice(0, boundedHeight),
             contentWidth: previous.contentWidth,
@@ -961,6 +967,15 @@ function assertDocumentRange(range, label) {
 function sameRectangle(left, right) {
     return left === null ? right === null : right !== null && left.rowStart === right.rowStart && left.rowEnd === right.rowEnd;
 }
+function copyableDockRowsBySuffix(dockRows, declarations) {
+    const result = new Map();
+    for (const declaration of declarations ?? []) {
+        if (!Number.isSafeInteger(declaration.row) || declaration.row < 0 || declaration.row >= dockRows.length)
+            continue;
+        result.set(dockRows.length - declaration.row - 1, declaration.prompt === undefined ? {} : { prompt: declaration.prompt });
+    }
+    return result;
+}
 function clamp(value, minimum, maximum) {
     return Math.min(Math.max(value, minimum), maximum);
 }

package/dist/ui/settings/declarations.d.ts

@@ -1,4 +1,4 @@
-export declare const OWNED_UI_SETTINGS_VERSION = 16;
+export declare const OWNED_UI_SETTINGS_VERSION = 17;
 export type OwnedUiSettingValue = string | number | boolean;
 export type OwnedUiSettingApplication = "live" | "restart";
 export interface OwnedUiSettingDeclaration {
@@ -32,6 +32,18 @@ export declare const OWNED_SETTING_DECLARATIONS: Readonly<{
         defaultValue: true;
         allowedValues: readonly [true, false];
     }>;
+    readonly timeFormat: Readonly<{
+        id: "timeFormat";
+        label: "Time format";
+        section: Readonly<{
+            id: "generic";
+            title: "Generic";
+        }>;
+        description: "Format used by submitted-prompt timestamps and the resident tab clock.";
+        application: "live";
+        defaultValue: "8:00 PM";
+        allowedValues: readonly ["20:00", "8:00 PM"];
+    }>;
     readonly accentColor: Readonly<{
         id: "accentColor";
         label: "Accent color";
@@ -164,18 +176,6 @@ export declare const OWNED_SETTING_DECLARATIONS: Readonly<{
         defaultValue: 8;
         allowedValues: readonly [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16];
     }>;
-    readonly tabsMax: Readonly<{
-        id: "tabsMax";
-        label: "Maximum tabs";
-        section: Readonly<{
-            id: "tabs";
-            title: "Tabs";
-        }>;
-        description: "Maximum resident A1 tabs kept in the shared strip.";
-        application: "live";
-        defaultValue: 10;
-        allowedValues: readonly number[];
-    }>;
     readonly tabsAutoName: Readonly<{
         id: "tabsAutoName";
         label: "Auto name";

package/dist/ui/settings/declarations.js

@@ -1,4 +1,4 @@
-export const OWNED_UI_SETTINGS_VERSION = 16;
+export const OWNED_UI_SETTINGS_VERSION = 17;
 const UI_ACCENT_COLOR_CHOICES = Object.freeze([
     "purple", "blue", "cyan", "green", "orange", "pink",
 ]);
@@ -10,7 +10,6 @@ const APPEARANCE_SECTION = Object.freeze({ id: "appearance", title: "Appearance"
 const SCROLL_SECTION = Object.freeze({ id: "scroll", title: "Scroll" });
 const AGENT_SECTION = Object.freeze({ id: "agent", title: "Agent" });
 const TABS_SECTION = Object.freeze({ id: "tabs", title: "Tabs" });
-const TABS_MAX_CHOICES = Object.freeze(Array.from({ length: 50 }, (_, index) => index + 1));
 /**
  * Every A1 setting, keyed by its id. The table is the one declaration: ids, defaults, and allowed
  * values are read from it, and `OwnedSettingValueOf` derives each getter's type from it.
@@ -25,6 +24,17 @@ export const OWNED_SETTING_DECLARATIONS = Object.freeze({
         defaultValue: true,
         allowedValues: Object.freeze([true, false]),
     }),
+    timeFormat: Object.freeze({
+        id: "timeFormat",
+        label: "Time format",
+        section: GENERIC_SECTION,
+        description: "Format used by submitted-prompt timestamps and the resident tab clock.",
+        application: "live",
+        defaultValue: "8:00 PM",
+        allowedValues: Object.freeze([
+            "20:00", "8:00 PM",
+        ]),
+    }),
     accentColor: Object.freeze({
         id: "accentColor",
         label: "Accent color",
@@ -126,15 +136,6 @@ export const OWNED_SETTING_DECLARATIONS = Object.freeze({
         defaultValue: 8,
         allowedValues: Object.freeze([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]),
     }),
-    tabsMax: Object.freeze({
-        id: "tabsMax",
-        label: "Maximum tabs",
-        section: TABS_SECTION,
-        description: "Maximum resident A1 tabs kept in the shared strip.",
-        application: "live",
-        defaultValue: 10,
-        allowedValues: TABS_MAX_CHOICES,
-    }),
     tabsAutoName: Object.freeze({
         id: "tabsAutoName",
         label: "Auto name",

package/dist/ui/settings/migrations.js

@@ -130,6 +130,13 @@ export const OWNED_UI_SETTINGS_MIGRATIONS = Object.freeze([
             return migrated;
         },
     }),
+    Object.freeze({
+        to: 17,
+        description: "Introduce the shared twelve-hour time format default.",
+        migrate(values) {
+            return { ...values };
+        },
+    }),
 ]);
 /** Shape-selected compatibility for the metadata-free product object. */
 export function normalizeOwnedUiSettingsValues(source) {

package/docs/architecture/boundaries.md

@@ -7,23 +7,24 @@ Every interactive command uses this profile-neutral lifecycle path:
 ```text
 mutable a1 entry
   -> verified immutable release
-  -> Node launch guardian and authenticated launch-instance registration
-  -> native process guardian and per-instance containment
-  -> profile-aware owned-UI runtime selection
+  -> Node launch guardian loading the verified process-guardian addon
+  -> addon-held per-instance containment and profile-aware runtime selection
   -> owned Pi-backed composition, with A1 surfaces enabled only for bare a1
 ```
 
 Launch-instance ownership is plural. The supervisor tracks any number of independently authenticated `a1` and `a1 pi` instances and never uses one product-wide foreground mutex. Closing one instance closes only its verified process tree. Persisted rows alone do not prove liveness, and uncertainty never authorizes terminating an unrelated process.
 
-Neither guardian reads ordinary terminal input, parses or relays runtime output, renders cells, infers frames, synthesizes terminal responses, or emits display control. Both profiles use the same owned rendering and input pipeline. Bare `a1` exposes A1-owned surfaces; `a1 pi` withholds those surfaces and uses Pi's ordinary profile root. The private guardian boundary carries only bounded identity, readiness, stop, and outcome data.
+The launch guardian and process-guardian addon do not read ordinary terminal input, parse or relay runtime output, render cells, infer frames, or synthesize terminal responses. Their only terminal output is the bounded reset and sanitized armed exit notice after runtime failure. Both profiles use the same owned rendering and input pipeline. Bare `a1` exposes A1-owned surfaces; `a1 pi` withholds those surfaces and uses Pi's ordinary profile root. The containment boundary carries only bounded identity, readiness, stop, and outcome data.
+
+A detached Node exit watcher sits outside the launch guardian's containment. It waits for the guardian, performs bounded Unix process-group cleanup, and may deliver the same claimed exit notice. A kill aimed at every Node runtime also kills this watcher; the accepted loss of the notice and Unix fallback cleanup in that case is documented in [`process-guardian-provenance.md`](process-guardian-provenance.md), and A1 starts no native executable to close that gap.
 
 The owned Pi-backed surface is not an arbitrary-CLI terminal multiplexer. A feature that requires resident arbitrary CLI sessions, internal tabs, terminal-state reconnection, or A1-authoritative scrollback must introduce and certify the separate composed-terminal authority rather than reactivating the retired transparent attachment path.
 
 ## Current module responsibilities
 
 - `lifecycle`: dependency-free launch-instance, process identity, state transition, outcome, and control-command contracts.
-- `process-containment`: artifact verification, OS-verifiable process inspection, containment adapters, and bounded graceful/forced cleanup; it owns no terminal content.
-- `launch-guardian`: one profile-neutral instance coordinator above runtime selection.
+- `process-containment`: process-guardian addon loading and artifact verification, OS-verifiable process inspection, in-process containment adapters, and bounded graceful/forced cleanup; it owns no terminal content.
+- `launch-guardian`: one profile-neutral Node instance coordinator above runtime selection, plus the fixed Node exit-watcher entry used only for owner-death cleanup and the armed notice.
 - `protocol`: additive control handshake, bounded line framing, authenticated launch-instance commands, typed stop intent, snapshots, and command results.
 - `launch`: resolves the effective profile home and the history-specific data root. Composition uses its public path resolver to select `~/.a1/data` for history unless `A1_DATA_DIR` is explicit; global control/release/runtime/cache paths stay unchanged.
 - `prompt-history`: narrowly typed user-input retention in separate profile-owned databases under `~/.a1/data/history` (or `<A1_DATA_DIR>/history`), with bounded worker queues and no supervisor/control-store payloads. It receives a resolved root rather than importing launch-feature internals; it never probes, imports, or deletes the former platform-default history. The editor's owned history state machine remains inside the Pi component boundary; the session UI only coordinates snapshots and classified submissions.
@@ -32,14 +33,14 @@ The owned Pi-backed surface is not an arbitrary-CLI terminal multiplexer. A feat
 - `supervisor`: endpoint identity, plural cohort ownership, per-instance reconciliation, and aggregate release shutdown coordination. It owns no terminal surface.
 - `pi-engine-adapter`, `pi-component-adapter`, and `pi-tui-runtime-adapter`: isolate pinned Pi engine and presentation knowledge behind neutral contracts; product features do not import them directly. Inside the engine adapter, one process-level engine host owns what is process-wide (the HTTP dispatcher, the theme singletons, the one-time changelog and package-update announcements, the startup trace) and is the only place sessions are created, so every session id is unique per process.
 - `session-shell` (`src/app/session-shell`): the application layer that composes the feature owners, the UI foundations, and the three Pi adapters into the interactive session; only composition imports it. Its render root assembles semantic document and dock rows, while its focused viewport controller owns follow state, pointer routing, selection, and interaction timers. Owned-app route lifecycle belongs to the neutral `ui-apps` owner and is only hosted by the session shell.
-- release/update/bootstrap: package-derived immutable release identity, process-guardian integrity, cohort selection, durable update transactions, rollback, and dependency-light command entry. After an unsuccessful bare-A1 child exit, the bootstrap restores owned terminal modes; neither guardian emits terminal controls.
+- release/update/bootstrap: package-derived immutable release identity, native-addon integrity, cohort selection, durable update transactions, rollback, and dependency-light command entry. Before certified fast-path reuse it checks every recorded product file is present; a missing or altered file is replaced only from the matching installed package when its size and digest reproduce the approved release, followed by full verification. Dependency layers keep their separate verification and repair policy. After an unsuccessful bare-A1 child exit, the launch owner or its Node watcher restores owned terminal modes and emits only the armed bounded notice.
 - `terminal-cleanup`: bounded, idempotent emergency restoration and fatal-exit diagnostics for an explicitly owned terminal. It does not inspect commands, relay terminal input/output, or emulate terminal state. The owned UI installs its fatal boundary before terminal activation; packaged bootstrap and checkout launch provide the surviving-owner fallback. Fatal records retain at most ten 16 KiB records with trusted classifications and code locations, never prompts, attachments, raw input, credentials, or arbitrary exception messages.
 
 ## Dependency direction
 
 Terminal boundaries are application-agnostic. They may not select behavior from executable names, arguments, CLI-specific environment variables, or visible text. Production code may not import private Pi distribution APIs or use a Pi-specific terminal workaround.
 
-The JavaScript product path has no PTY or terminal-emulator dependency. Reintroducing `node-pty`, xterm state, custom input encoders, mode/query trackers, cadence-derived frame inference, or renderer/projection code requires an approved capability change and cannot become a second terminal authority. The Rust process guardian is a lifecycle-only native boundary and is independent from the held composed terminal host.
+The JavaScript product path has no PTY or terminal-emulator dependency. Reintroducing `node-pty`, xterm state, custom input encoders, mode/query trackers, cadence-derived frame inference, or renderer/projection code requires an approved capability change and cannot become a second terminal authority. The Rust process guardian is a lifecycle-only Node-API addon loaded by the launch guardian and is independent from the terminal-host Node-API addon. No A1-built executable is part of the production process surface.
 
 `scripts/governance/check-architecture.mjs` enforces the structural parts of these boundaries. Cross-cutting rationale belongs here; implementation history belongs in Git and archived OpenSpec changes.
 
@@ -61,7 +62,7 @@ Default future agents and composed hosts are children of the originating bare-`a
 
 The structured-agent runtime uses a versioned adapter hello and feature negotiation before readiness. Runtime state must use typed events, commands, snapshots, cancellation, and recovery evidence. It must not infer structured semantics from terminal text, terminal timing, or visual content and must not own pseudoterminals or renderer state.
 
-The terminal-host protocol boundary may carry only bounded typed control and semantic lifecycle messages. Pseudoterminal bytes, per-event child input, rendered cells, cell grids, framebuffers, and screen buffers are forbidden across it. Console host executables and packaging live outside the current JavaScript production owners and remain unavailable until the isolated in-terminal proof passes; replacing them with a lightweight custom parser/renderer is forbidden. A desktop-native window and GPU application shell are postponed and are not required for the terminal-hosted product.
+The JavaScript-to-native terminal-host boundary carries only the fixed role arguments, host command, return code, session-lock calls, and typed semantic bridge data. `host-entry.js` does not touch Node's stdin/stdout streams; pseudoterminal bytes, per-event child input, rendered cells, cell grids, framebuffers, and screen buffers remain inside the addon's native roles and their bounded native IPC. The verified addon and fixed entry are the packaged production host; no console host executable exists. Replacing libghostty-vt with a lightweight custom parser/renderer is forbidden. A desktop-native window and GPU application shell are postponed and are not required for the terminal-hosted product.
 
 Resource queues, retained state, evidence, logs, and diagnostics follow `docs/architecture/resource-and-data-policy.md`. Terminal content and authentication material are never control-store records. Unknown data is potentially sensitive by default and must be rejected or redacted before persistence.