@timurproko/a1 0.2.7-dev.806 → 0.2.7-dev.808

package/dist/app/session-shell/session-shell.js

@@ -1762,7 +1762,18 @@ export class OwnedUiSessionPresenter {
         this.#dialogId = dialog.id;
     }
     openOwnedRoute(route) {
-        this.#openOwnedRoute(route);
+        if (this.#disposed)
+            return;
+        // Invariant: a route requested before the runtime runs (the resident Settings bridge route arrives
+        // before start()) is retained, latest wins, and presented through the startup-route path once started.
+        if (!this.#terminal.running) {
+            this.#startupRoute = { route };
+            return;
+        }
+        const result = this.#openOwnedRoute(route);
+        if (result.outcome !== "completed" && result.diagnostic !== null) {
+            this.root.appendWorkflowMessage({ kind: "warning", message: result.diagnostic });
+        }
     }
     hotkeysPresentation() {
         const presentation = this.root.hotkeysPresentation();

package/dist/app/session-shell/shell-host.js

@@ -1,8 +1,10 @@
 import { MOUSE_TRACKING_OFF, MOUSE_TRACKING_ON, parseMouseInput } from "../../ui/components/mouse.js";
 import { readVisibleHyperlinks } from "../../ui/components/visible-hyperlinks.js";
 import { piCanvasBackgroundAnsi } from "../../integrations/pi/components/theme.js";
+import { residentFixtureControl } from "../../foundation/resident-tabs/fixture-control.js";
+import { residentProgressObserver } from "../../foundation/resident-tabs/progress-observation.js";
 import { DamageAwareTerminalAdapter, } from "../../integrations/pi/tui-runtime/damage-aware-terminal.js";
-import { PiTuiRuntimeAdapter } from "../../integrations/pi/tui-runtime/adapter.js";
+import { PiTuiRuntimeAdapter, legacyKeyInput } from "../../integrations/pi/tui-runtime/adapter.js";
 import { classifyPiTuiInput } from "../../integrations/pi/tui-runtime/input-presentation-coordinator.js";
 import { pinnedLayoutRoot, } from "./session-shell-root.js";
 /** The terminal a session's shell options call for: its layout, TUI mode, cursor, and presentation seams. */
@@ -47,6 +49,8 @@ export class OwnedUiTerminalHost {
         this.#customViewport = options.layout === "custom-viewport";
         this.#quitOutro = options.quitOutro;
         const input = options.input;
+        const fixtureControl = residentFixtureControl();
+        const progressObserver = residentProgressObserver();
         let damageTerminal;
         const surface = {
             render: width => this.#active?.render(width) ?? [],
@@ -72,6 +76,13 @@ export class OwnedUiTerminalHost {
                         inspectHyperlinks: readVisibleHyperlinks,
                         onResize: () => this.#active?.noteImmediatePresentation(),
                         onHyperlinkCleanupRequired: () => this.runtime?.requestRender(true),
+                        ...(fixtureControl === null ? {} : {
+                            allowWrite: () => !fixtureControl.stopped("child-render-write"),
+                            writeChunks: data => fixtureControl.fragmentChildWrite(data),
+                        }),
+                        ...(progressObserver === null ? {} : {
+                            onWrite: ({ bytes, fragments, transaction, frameId, cause }) => progressObserver.childRenderWrite(bytes, fragments, transaction, frameId, cause),
+                        }),
                     });
                     return damageTerminal;
                 },
@@ -337,7 +348,8 @@ export class OwnedUiTerminalHost {
                 callbacks.closed(rendered);
         };
         removeInterruptWatch = runtime.addInputListener(data => {
-            if (!attached() || !data.includes(INTERRUPT))
+            // Compatibility: a kitty-keyboard child reports Ctrl+C as a CSI-u sequence rather than the byte.
+            if (!attached() || !data.includes(INTERRUPT) && legacyKeyInput(data) !== INTERRUPT)
                 return undefined;
             // Protocol: route hosts decide whether one interrupt closes their app. Raw-input forwarding
             // is required because Pi handles Ctrl+C before the fullscreen overlay receives normal input.
@@ -395,8 +407,10 @@ export class OwnedUiTerminalHost {
                 const { events, rest } = parseMouseInput(data);
                 for (const event of events)
                     surface.handleMouse(event);
-                if (rest.length > 0)
-                    surface.handleInput(rest);
+                // Invariant: owned screens see legacy key bytes whether the terminal reports legacy or kitty keys.
+                const key = rest.length > 0 ? legacyKeyInput(rest) : "";
+                if (key.length > 0)
+                    surface.handleInput(key);
                 if (surface.isClosed()) {
                     closeSurface(true);
                     return;

package/dist/composition/owned-ui.d.ts

@@ -90,3 +90,5 @@ export declare function bindResidentTabBridge(tabBridge: TabBridgeClient, backen
     readonly openRoute?: (route: "settings") => void;
 }): Promise<() => void>;
 export declare function correlateResidentTabSubmission(recovery: Pick<ResidentTabRecovery, "correlated" | "settled">, backend: Pick<ComposedSessionBackend, "identity" | "session">, submissionId: string, entryId: string): Promise<void>;
+/** Rereads the shared settings document whenever its stat changes; returns the stop. */
+export declare function watchSharedSettings(settings: Pick<OwnedSettingsManager, "file" | "refresh">): () => void;

package/dist/composition/owned-ui.js

@@ -1,3 +1,4 @@
+import { unwatchFile, watchFile } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { SuggestionDiagnosticCapture } from "../features/prompt-suggestions/diagnostics.js";
 import { PRODUCT_IDENTITY } from "../product-identity.js";
@@ -188,13 +189,19 @@ export async function composeOwnedUi(options = {}) {
         : await import("../features/owned-ui/release-note-state.js").then(module => module.claimReleaseNote({
             configDir: productPaths.configDir, profileId: options.profileId, version: currentReleaseNote.version,
         }));
-    const unsubscribeAccent = settings === null || !ownedSurfaces
+    const unsubscribeAccentChange = settings === null || !ownedSurfaces
         ? () => { }
         : settings.onChange(current => {
             const accent = current.value("accentColor");
             host.setAccentColor(accent);
             tabBridge?.accent(accent);
         });
+    // Rationale: every resident tab is its own process over one shared settings document, so a
+    // change saved in any tab reaches the others only by rereading that document.
+    const unwatchSharedSettings = settings === null || !ownedSurfaces || tabBridge === null
+        ? () => { }
+        : watchSharedSettings(settings);
+    const unsubscribeAccent = () => { unwatchSharedSettings(); unsubscribeAccentChange(); };
     // Rationale: Routes open only after shell construction.
     const references = {
         changelog: async (input) => {
@@ -210,7 +217,9 @@ export async function composeOwnedUi(options = {}) {
         },
         session: () => import("./session-info-reference.js").then(m => m.loadSessionInfoReference(backend)),
     };
-    const routeHost = settings === null || !ownedSurfaces ? null : createOwnedRouteHost(settings, references);
+    const routeHost = settings === null || !ownedSurfaces ? null : createOwnedRouteHost(settings, references, {
+        settingsPinned: tabBridge?.tabId.startsWith("settings-") === true,
+    });
     const viewportSettings = settings === null || !ownedSurfaces ? null : {
         snapshot: () => viewportSettingsSnapshot(settings),
         onChange: listener => settings.onChange(() => listener(viewportSettingsSnapshot(settings))),
@@ -436,15 +445,27 @@ export async function bindResidentTabBridge(tabBridge, backend, recovery = null,
     tabBridge.status("starting");
     const currentSessionFile = () => currentBackendSessionFile(backend);
     let pendingAutoName = null;
+    // Invariant: while a generated name is being applied, the session name it produces is automatic
+    // even if the session normalizes it; reporting it as `user` would block the strip's title
+    // animation and every later automatic rename.
+    let applyingAutoName = false;
     const isDefaultName = (name) => name == null || /^agent(?: \d+)?$/i.test(name);
     const currentSessionName = () => backend.session.view().status.footer?.sessionName ?? null;
     const announceSession = () => {
         const name = currentSessionName();
-        const nameSource = name === pendingAutoName ? "auto" : isDefaultName(name) ? "default" : "user";
+        // Invariant: the session may announce the applied name after the workflow resolves; the
+        // first non-default name announced for a pending auto-name is that automatic name.
+        if (applyingAutoName && !isDefaultName(name)) {
+            pendingAutoName = name;
+            applyingAutoName = false;
+        }
+        const automatic = name === pendingAutoName;
+        const nameSource = automatic ? "auto" : isDefaultName(name) ? "default" : "user";
         tabBridge.session(currentSessionFile(), name, nameSource);
     };
     let working = false;
-    let lastTurnFailed = false;
+    // Invariant: the last turn's settlement stays reported until the next turn starts.
+    let lastTurn;
     let autoNameAttempted = false;
     let autoNameArmed = false;
     // Invariant: naming launches once per tab during an agent run, as soon as its prompt is projected,
@@ -461,12 +482,26 @@ export async function bindResidentTabBridge(tabBridge, backend, recovery = null,
             if (!isDefaultName(currentSessionName()))
                 return;
             pendingAutoName = name;
+            applyingAutoName = true;
             const result = await backend.workflows.executeWorkflow({ command: "name", argument: name });
-            if (result.outcome === "completed")
+            if (result.outcome !== "completed") {
+                applyingAutoName = false;
+                if (pendingAutoName === name)
+                    pendingAutoName = null;
+                return;
+            }
+            const current = currentSessionName();
+            if (current !== null && !isDefaultName(current)) {
+                // Invariant: The session already holds the applied name; report it as automatic now.
+                pendingAutoName = current;
+                applyingAutoName = false;
+                tabBridge.session(currentSessionFile(), current, "auto");
+            }
+            else {
+                // Invariant: The session announces later; show the generated name meanwhile, still automatic.
                 tabBridge.session(currentSessionFile(), name, "auto");
-            else if (pendingAutoName === name)
-                pendingAutoName = null;
-        }).catch(() => { pendingAutoName = null; });
+            }
+        }).catch(() => { pendingAutoName = null; applyingAutoName = false; });
     };
     const reportStatus = (lifecycle) => {
         const view = backend.session.view();
@@ -476,7 +511,7 @@ export async function bindResidentTabBridge(tabBridge, backend, recovery = null,
             lifecycle: lifecycle ?? view.lifecycle,
             pendingRequests,
             queuedInput,
-            ...(lastTurnFailed ? { stopReason: "error" } : {}),
+            ...(lastTurn === undefined ? {} : { lastTurn }),
         }), false, pendingRequests, queuedInput);
     };
     announceSession();
@@ -501,7 +536,7 @@ export async function bindResidentTabBridge(tabBridge, backend, recovery = null,
             const wasWorking = working;
             working = event.lifecycle === "busy";
             if (working)
-                lastTurnFailed = false;
+                lastTurn = undefined;
             reportStatus(event.lifecycle);
             if (wasWorking && !working && recovery !== null) {
                 void recovery.settled(currentSessionFile()).catch(() => tabBridge.degraded(true));
@@ -517,7 +552,7 @@ export async function bindResidentTabBridge(tabBridge, backend, recovery = null,
         if (event.type === "agent-run-settled") {
             launchAutoName();
             autoNameArmed = false;
-            lastTurnFailed = !event.successful && !event.aborted;
+            lastTurn = event.aborted ? "aborted" : event.successful ? "done" : "error";
             tabBridge.prompt(event.aborted);
             reportStatus();
         }
@@ -546,6 +581,21 @@ function currentBackendSessionFile(backend) {
     const resume = backend.identity.currentSessionResumeMetadata();
     return resume === null ? null : `${resume.sessionDir}/${resume.sessionId}`;
 }
+const SHARED_SETTINGS_POLL_MS = 250;
+/** Rereads the shared settings document whenever its stat changes; returns the stop. */
+export function watchSharedSettings(settings) {
+    const file = settings.file;
+    const listener = () => {
+        try {
+            settings.refresh();
+        }
+        catch {
+            // Compatibility: an unreadable peer write resolves on the next stat change.
+        }
+    };
+    watchFile(file, { interval: SHARED_SETTINGS_POLL_MS, persistent: false }, listener);
+    return () => unwatchFile(file, listener);
+}
 async function readPackageVersion() {
     const manifest = JSON.parse(await readFile(new URL("../../package.json", import.meta.url), "utf8"));
     const version = manifest?.version;

package/dist/composition/settings-route-host.d.ts

@@ -9,5 +9,10 @@ export interface OwnedReferenceProviders {
     hotkeys(): Promise<ReferenceDocumentProvider>;
     session(): Promise<ReferenceDocumentProvider>;
 }
+/** How the settings route is presented. */
+export interface OwnedRouteHostOptions {
+    /** The resident Settings tab: the screen is the tab, so it offers no screen-level close. */
+    readonly settingsPinned?: boolean;
+}
 /** Declares settings and lazy document routes. */
-export declare function createOwnedRouteHost(settings: OwnedSettingsManager, references?: OwnedReferenceProviders): UiRouteHost;
+export declare function createOwnedRouteHost(settings: OwnedSettingsManager, references?: OwnedReferenceProviders, options?: OwnedRouteHostOptions): UiRouteHost;

package/dist/composition/settings-route-host.js

@@ -3,7 +3,7 @@ import { SETTINGS_APP_ID, SETTINGS_ROUTE } from "../features/owned-ui/settings-r
 import { piTheme, renderPiAccentPreview } from "../integrations/pi/components/upstream/theme/theme.js";
 import { faint } from "../ui/components/text.js";
 /** Declares settings and lazy document routes. */
-export function createOwnedRouteHost(settings, references) {
+export function createOwnedRouteHost(settings, references, options = {}) {
     const routes = new Set([SETTINGS_ROUTE, ...(references === undefined ? [] : [CHANGELOG_ROUTE, HOTKEYS_ROUTE, "session"])]);
     return {
         claims: route => routes.has(route),
@@ -11,7 +11,7 @@ export function createOwnedRouteHost(settings, references) {
             if (!routes.has(route))
                 return null;
             if (route === SETTINGS_ROUTE) {
-                return deferredSurface(SETTINGS_APP_ID, "settings", () => loadSettingsSurface(settings));
+                return deferredSurface(SETTINGS_APP_ID, "settings", () => loadSettingsSurface(settings, options.settingsPinned === true));
             }
             const changelog = route === CHANGELOG_ROUTE;
             const session = route === "session";
@@ -61,9 +61,10 @@ function deferredSurface(id, label, load) {
         onExitRequested: listener => { onExit = listener; },
     };
 }
-async function loadSettingsSurface(settings) {
+async function loadSettingsSurface(settings, pinned) {
     const { SettingsApp } = await import("../features/owned-ui/settings-app.js");
-    return hostApp(SETTINGS_APP_ID, SETTINGS_ROUTE, () => new SettingsApp(settings));
+    // Invariant: a pinned Settings tab closes as a tab; neither Esc nor one Ctrl+C dismisses its screen.
+    return hostApp(SETTINGS_APP_ID, SETTINGS_ROUTE, () => new SettingsApp(settings, { pinned }), !pinned);
 }
 async function loadReferenceSurface(settings, id, route, title, document) {
     // Rationale: the app module and the document load together, so a document that fails
@@ -80,7 +81,7 @@ async function loadReferenceSurface(settings, id, route, title, document) {
         }),
     }));
 }
-async function hostApp(id, route, create) {
+async function hostApp(id, route, create, closeOnInterrupt = true) {
     const [{ UiAppHost }, { UiAppRegistry }] = await Promise.all([
         import("../ui/apps/host.js"),
         import("../ui/apps/registry.js"),
@@ -94,7 +95,7 @@ async function hostApp(id, route, create) {
     let onExit = () => undefined;
     const host = new UiAppHost({
         registry,
-        closeOnInterrupt: true,
+        closeOnInterrupt,
         theme: pinnedTheme(),
         surface: {
             size: () => size,

package/dist/features/owned-ui/settings-app.d.ts

@@ -12,7 +12,10 @@ export declare const SETTINGS_SHORTCUTS: ShortcutRegistry<Action>;
 export declare class SettingsApp implements UiApp {
     #private;
     readonly id = "settings";
-    constructor(session: OwnedSettingsManager);
+    /** `pinned` presents the screen as a resident Settings tab, which offers no screen-level close. */
+    constructor(session: OwnedSettingsManager, options?: {
+        readonly pinned?: boolean;
+    });
     onActivate(host: AppHostServices): void;
     onClose(_host: AppHostServices): void;
     render(rect: PaneRect, host: AppHostServices): readonly string[];

package/dist/features/owned-ui/settings-app.js

@@ -120,8 +120,11 @@ export class SettingsApp {
     #activeUntil = 0;
     #activityTimer;
     #renderedScroll;
-    constructor(session) {
+    #pinned;
+    /** `pinned` presents the screen as a resident Settings tab, which offers no screen-level close. */
+    constructor(session, options = {}) {
         this.#session = session;
+        this.#pinned = options.pinned === true;
     }
     onActivate(host) {
         this.#closed = false;
@@ -251,7 +254,8 @@ export class SettingsApp {
         const selected = indexOfKey(rows, this.#selectedKey);
         switch (action) {
             case "close":
-                host.close();
+                if (!this.#pinned)
+                    host.close();
                 return { consumed: true };
             case "open-filter":
                 this.#scrollBeforeFilter = this.#scroll;
@@ -1016,7 +1020,9 @@ export class SettingsApp {
             return this.#dialogLines(open, width, theme);
         // Rationale: standing guidance is more useful than transient feedback; failures still
         // roll back without displacing the Settings interaction contract.
-        const status = renderShortcutHintsWithClose(SETTINGS_SHORTCUTS.hintEntries(SCOPE), theme, width, width > 0 ? 1 : 0);
+        const entries = SETTINGS_SHORTCUTS.hintEntries(SCOPE).filter(entry => !this.#pinned
+            || entry.key !== DIALOG_CLOSE_SHORTCUT_HINT.key || entry.action !== DIALOG_CLOSE_SHORTCUT_HINT.action);
+        const status = renderShortcutHintsWithClose(entries, theme, width, width > 0 ? 1 : 0);
         const input = this.#filter;
         if (input === null)
             return [status];

package/dist/features/resident-tab/shortcut-declarations.js

@@ -13,7 +13,7 @@ export const RESIDENT_TAB_SHORTCUTS = Object.freeze([
     { id: "tabs.new", defaultKey: "alt+a", scope: "global", description: "New A1 tab" },
     { id: "tabs.close", defaultKey: "alt+w", scope: "global", description: "Close A1 tab" },
     { id: "tabs.rename", defaultKey: "f2", scope: "global", description: "Rename A1 tab" },
-    { id: "tabs.settings", defaultKey: "alt+.", scope: "global", description: "Open Settings tab" },
+    { id: "tabs.settings", defaultKey: "alt+,", scope: "global", description: "Open Settings tab" },
     ...jumps,
     { id: "tabs.next", defaultKey: null, scope: "global", description: "View next A1 tab" },
     { id: "tabs.previous", defaultKey: null, scope: "global", description: "View previous A1 tab" },

package/dist/features/resident-tab/status-deriver.d.ts

@@ -1,9 +1,10 @@
-export type ResidentTabDerivedStatus = "starting" | "working" | "needs-input" | "done-unseen" | "idle" | "failed";
+/** How the tab's last agent turn settled; it persists until the next turn starts. */
+export type ResidentTabTurnSettlement = "done" | "aborted" | "error";
+export type ResidentTabDerivedStatus = "starting" | "working" | "needs-input" | "idle" | "failed" | ResidentTabTurnSettlement;
 export interface ResidentTabFacts {
     readonly lifecycle: string;
     readonly pendingRequests: number;
     readonly queuedInput: number;
-    readonly stopReason?: string;
-    readonly settledUnseen?: boolean;
+    readonly lastTurn?: ResidentTabTurnSettlement;
 }
 export declare function deriveResidentTabStatus(facts: ResidentTabFacts): ResidentTabDerivedStatus;

package/dist/features/resident-tab/status-deriver.js

@@ -1,3 +1,4 @@
+// Invariant: `failed` is reserved for a failed tab lifecycle; a turn that errored reports `error`.
 export function deriveResidentTabStatus(facts) {
     if (facts.lifecycle === "failed")
         return "failed";
@@ -7,9 +8,5 @@ export function deriveResidentTabStatus(facts) {
         return "working";
     if (facts.lifecycle === "starting")
         return "starting";
-    if (facts.stopReason === "error")
-        return "failed";
-    if (facts.settledUnseen === true)
-        return "done-unseen";
-    return "idle";
+    return facts.lastTurn ?? "idle";
 }

package/dist/foundation/release/bootstrap.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { CLEAR_EXIT_INTERVAL_MS, restoreAfterOwnedExit } from "../terminal-cleanup/index.js";
+import { RESIDENT_DETACH_INTERVAL_MS, restoreAfterOwnedExit } from "../terminal-cleanup/index.js";
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { connect } from "node:net";
 import { resolve } from "node:path";
@@ -64,7 +64,7 @@ async function runBootstrapAttempt(options, retriesRemaining) {
                 residentRootExecutable: resident.executable.executable,
                 residentRootArguments: JSON.stringify([
                     resident.executable.entry,
-                    "attach", "--endpoint", resident.endpoint, "--cwd", process.cwd(), "--clear-exit-ms", String(CLEAR_EXIT_INTERVAL_MS),
+                    "attach", "--endpoint", resident.endpoint, "--cwd", process.cwd(), "--clear-exit-ms", String(RESIDENT_DETACH_INTERVAL_MS),
                     "--profile", environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir,
                     "--settings-file", resolve(agentProfileDir, "settings.json"),
                     "--data-dir", paths.dataDir, "--runtime-dir", paths.runtimeDir,

package/dist/foundation/resident-tabs/bridge-client.d.ts

@@ -1,4 +1,4 @@
-export type ResidentTabStatus = "starting" | "working" | "needs-input" | "done-unseen" | "idle" | "unresponsive" | "stalled" | "crashed" | "restarting" | "failed";
+export type ResidentTabStatus = "starting" | "working" | "needs-input" | "done-unseen" | "done" | "aborted" | "error" | "idle" | "unresponsive" | "stalled" | "crashed" | "restarting" | "failed";
 export interface TabBridgeCredentials {
     readonly tabId: string;
     readonly token: string;

package/dist/foundation/resident-tabs/bridge-client.js

@@ -137,7 +137,8 @@ export class TabBridgeClient {
             if (start === -1) {
                 let retained = 0;
                 const maximum = Math.min(prefix.length - 1, pending.length);
-                for (let length = maximum; length > 0; length--) {
+                // Invariant: a lone trailing Esc is a user key and passes at once; only `\x1bP` or more is withheld.
+                for (let length = maximum; length > 1; length--) {
                     if (pending.endsWith(prefix.slice(0, length))) {
                         retained = length;
                         break;

package/dist/foundation/resident-tabs/fixture-control.d.ts

@@ -0,0 +1,7 @@
+export type ResidentFixtureStoppedStage = "child-render-write";
+export interface ResidentFixtureControlPort {
+    stopped(stage: ResidentFixtureStoppedStage): boolean;
+    fragmentChildWrite(data: string): readonly string[];
+}
+/** Returns the exact-artifact fixture control, or null for every ordinary resident child. */
+export declare function residentFixtureControl(environment?: NodeJS.ProcessEnv): ResidentFixtureControlPort | null;

package/dist/foundation/resident-tabs/fixture-control.js

@@ -0,0 +1,35 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { PRODUCT_IDENTITY } from "../../product-identity.js";
+import { residentProgressObserver } from "./progress-observation.js";
+/** Returns the exact-artifact fixture control, or null for every ordinary resident child. */
+export function residentFixtureControl(environment = process.env) {
+    const directory = environment[PRODUCT_IDENTITY.environment.residentFixtureControlDir];
+    if (environment === process.env)
+        delete process.env[PRODUCT_IDENTITY.environment.residentFixtureControlDir];
+    // Invariant: launch erases the bridge tab identity; the observer retains the observed one.
+    const tabId = residentProgressObserver(environment)?.tabId;
+    if (!directory || !tabId || !/^[a-z0-9-]{1,128}$/iu.test(tabId))
+        return null;
+    return {
+        stopped: stage => existsSync(join(directory, `${tabId}.${stage}.stop`)),
+        fragmentChildWrite: data => existsSync(join(directory, `${tabId}.child-render-fragments.enable`))
+            ? boundedFragments(data)
+            : [data],
+    };
+}
+function boundedFragments(data) {
+    const points = [...data];
+    if (points.length <= 1)
+        return [data];
+    if (points.length <= 16)
+        return points;
+    const fragments = points.slice(0, 8);
+    const middle = points.slice(8, -8);
+    const chunkSize = Math.max(1, Math.ceil(middle.length / 48));
+    for (let index = 0; index < middle.length; index += chunkSize) {
+        fragments.push(middle.slice(index, index + chunkSize).join(""));
+    }
+    fragments.push(...points.slice(-8));
+    return fragments;
+}

package/dist/foundation/resident-tabs/progress-observation.d.ts

@@ -0,0 +1,7 @@
+export interface ResidentProgressObserverPort {
+    readonly tabId: string;
+    engineDelivery(event: unknown): void;
+    childRenderWrite(bytes: number, fragments: number, transaction: "synchronized-output" | "ordinary", frameId?: number, renderCause?: string): void;
+}
+/** Returns the opt-in payload-free observer for a resident child, or null on ordinary launches. */
+export declare function residentProgressObserver(environment?: NodeJS.ProcessEnv): ResidentProgressObserverPort | null;

package/dist/foundation/resident-tabs/progress-observation.js

@@ -0,0 +1,119 @@
+import { randomUUID } from "node:crypto";
+import { appendFile, mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { performance } from "node:perf_hooks";
+import { PRODUCT_IDENTITY } from "../../product-identity.js";
+const OBSERVATION_DIRECTORY_ENV = PRODUCT_IDENTITY.environment.residentProgressObservationDir;
+const OBSERVATION_RUN_ENV = PRODUCT_IDENTITY.environment.residentProgressRunId;
+const MAX_PENDING_BYTES = 256 * 1024;
+class ResidentProgressObserver {
+    #directory;
+    #runId;
+    #tabId;
+    #incarnation;
+    #processInstance;
+    #path;
+    #sequence = 0;
+    #engineSequence = 0;
+    #pendingBytes = 0;
+    #lost = 0;
+    #writing = Promise.resolve();
+    #failed = false;
+    get tabId() { return this.#tabId; }
+    constructor(directory, runId, tabId, incarnation) {
+        this.#directory = directory;
+        this.#runId = runId;
+        this.#tabId = tabId;
+        this.#incarnation = incarnation;
+        this.#processInstance = `${process.pid}-${randomUUID()}`;
+        this.#path = join(directory, `child-${this.#processInstance}.jsonl`);
+    }
+    engineDelivery(event) {
+        this.#engineSequence += 1;
+        this.#observe("engine-delivery", {
+            eventSequence: this.#engineSequence,
+            eventKind: eventKind(event),
+            count: 1,
+        });
+    }
+    childRenderWrite(bytes, fragments, transaction, frameId, renderCause) {
+        this.#observe("child-render-write", {
+            eventSequence: this.#engineSequence,
+            bytes,
+            count: 1,
+            fragmentCount: fragments,
+            transactionKind: transaction,
+            ...(frameId === undefined ? {} : { frameId }),
+            ...(renderCause === undefined ? {} : { renderCause }),
+        });
+    }
+    #observe(stage, fields) {
+        if (this.#failed)
+            return;
+        const lostBefore = this.#lost;
+        const record = {
+            schema: "a1-resident-progress-observation-v1",
+            runId: this.#runId,
+            role: "child",
+            stage,
+            pid: process.pid,
+            processInstance: this.#processInstance,
+            timestampUnixUs: Math.round((performance.timeOrigin + performance.now()) * 1_000),
+            // Rationale: timeOrigin is calibrated to the Unix epoch; retain a conservative cross-process error.
+            clockErrorUs: 1_000,
+            sequence: ++this.#sequence,
+            tabId: this.#tabId,
+            incarnation: this.#incarnation,
+            lostBefore,
+            ...fields,
+        };
+        const line = `${JSON.stringify(record)}\n`;
+        const length = Buffer.byteLength(line);
+        if (this.#pendingBytes + length > MAX_PENDING_BYTES) {
+            this.#lost = lostBefore + 1;
+            return;
+        }
+        this.#lost = 0;
+        this.#pendingBytes += length;
+        this.#writing = this.#writing.then(async () => {
+            await mkdir(this.#directory, { recursive: true });
+            await appendFile(this.#path, line, "utf8");
+        }).catch(() => {
+            this.#failed = true;
+        }).finally(() => {
+            this.#pendingBytes -= length;
+        });
+    }
+}
+let observer;
+/** Returns the opt-in payload-free observer for a resident child, or null on ordinary launches. */
+export function residentProgressObserver(environment = process.env) {
+    if (environment === process.env && observer !== undefined)
+        return observer;
+    const directory = environment[OBSERVATION_DIRECTORY_ENV];
+    const runId = environment[OBSERVATION_RUN_ENV];
+    const tabId = environment[PRODUCT_IDENTITY.environment.residentProgressTabId];
+    const incarnation = Number(environment[PRODUCT_IDENTITY.environment.residentProgressTabIncarnation]);
+    const value = directory && runId && runId.length <= 128 && tabId && Number.isSafeInteger(incarnation) && incarnation >= 0
+        ? new ResidentProgressObserver(directory, runId, tabId, incarnation)
+        : null;
+    if (environment === process.env) {
+        observer = value;
+        // Security: test evidence paths and tab identity are not child/tool configuration. Retain them only in
+        // this observer instance so extensions and spawned tools cannot append to the fixture trace.
+        for (const name of [
+            OBSERVATION_DIRECTORY_ENV,
+            OBSERVATION_RUN_ENV,
+            PRODUCT_IDENTITY.environment.residentProgressTabId,
+            PRODUCT_IDENTITY.environment.residentProgressTabIncarnation,
+        ])
+            delete process.env[name];
+    }
+    return value;
+}
+function eventKind(event) {
+    if (typeof event !== "object" || event === null)
+        return "unknown";
+    const value = event.type;
+    return typeof value === "string" && /^[a-z][a-z0-9_-]{0,63}$/iu.test(value) ? value : "unknown";
+}

package/dist/foundation/terminal-cleanup/index.d.ts

@@ -1,3 +1,3 @@
-export { CLEAR_EXIT_INTERVAL_MS, EMERGENCY_TERMINAL_RESET, boundedCleanup, restoreAfterOwnedExit, restoreProcessTerminal } from "./terminal-reset.js";
+export { CLEAR_EXIT_INTERVAL_MS, EMERGENCY_TERMINAL_RESET, RESIDENT_DETACH_INTERVAL_MS, boundedCleanup, restoreAfterOwnedExit, restoreProcessTerminal } from "./terminal-reset.js";
 export { installFatalExit, writeFatalDiagnostic } from "./fatal-exit.js";
 export type { FatalExitOptions } from "./fatal-exit.js";

package/dist/foundation/terminal-cleanup/index.js

@@ -1,2 +1,2 @@
-export { CLEAR_EXIT_INTERVAL_MS, EMERGENCY_TERMINAL_RESET, boundedCleanup, restoreAfterOwnedExit, restoreProcessTerminal } from "./terminal-reset.js";
+export { CLEAR_EXIT_INTERVAL_MS, EMERGENCY_TERMINAL_RESET, RESIDENT_DETACH_INTERVAL_MS, boundedCleanup, restoreAfterOwnedExit, restoreProcessTerminal } from "./terminal-reset.js";
 export { installFatalExit, writeFatalDiagnostic } from "./fatal-exit.js";

package/dist/foundation/terminal-cleanup/terminal-reset.d.ts

@@ -1,4 +1,9 @@
 export declare const CLEAR_EXIT_INTERVAL_MS = 500;
+/**
+ * How long a first `Ctrl+C` keeps the resident attach client's detach chord armed. It matches the
+ * owned dialogs' interrupt chord so an unhurried double press leaves resident tabs from any tab.
+ */
+export declare const RESIDENT_DETACH_INTERVAL_MS = 1500;
 export declare const EMERGENCY_TERMINAL_RESET: string;
 export declare function restoreProcessTerminal(): void;
 export declare function restoreAfterOwnedExit(ownsTerminal: boolean, code: number | null, signal: string | null, restore?: () => void): number;

package/dist/foundation/terminal-cleanup/terminal-reset.js

@@ -1,5 +1,10 @@
 import { writeSync } from "node:fs";
 export const CLEAR_EXIT_INTERVAL_MS = 500;
+/**
+ * How long a first `Ctrl+C` keeps the resident attach client's detach chord armed. It matches the
+ * owned dialogs' interrupt chord so an unhurried double press leaves resident tabs from any tab.
+ */
+export const RESIDENT_DETACH_INTERVAL_MS = 1_500;
 // Protocol: reset modes on both screens; setting keyboard flags to zero is idempotent,
 // unlike repeatedly popping a keyboard-protocol stack owned by a parent application.
 // Resetting parent-screen margins homes the cursor, so preserve its restored position.

package/dist/integrations/pi/engine/session-runtime.js

@@ -2,6 +2,7 @@ import { execFile } from "node:child_process";
 import { existsSync } from "node:fs";
 import { promisify } from "node:util";
 import { PRODUCT_IDENTITY } from "../../../product-identity.js";
+import { residentProgressObserver } from "../../../foundation/resident-tabs/progress-observation.js";
 import { observeCompactionProgress } from "./compaction-progress.js";
 import { createPiRuntimeIntegration } from "./runtime-integration.js";
 import { PiSessionCommandIntegration } from "./session-integration.js";
@@ -369,8 +370,10 @@ export class PiEngineRuntime {
             return;
         const generation = this.#sessionGeneration;
         this.#unsubscribe = session.subscribe(event => {
-            if (generation === this.#sessionGeneration && !this.#ports.disposed())
-                this.#ports.event(event);
+            if (generation !== this.#sessionGeneration || this.#ports.disposed())
+                return;
+            residentProgressObserver()?.engineDelivery(event);
+            this.#ports.event(event);
         });
     }
     /**

package/dist/integrations/pi/tui-runtime/adapter.d.ts

@@ -1,5 +1,11 @@
 import { type ProgramStatus, type WheelScrollLines } from "@earendil-works/pi-tui";
 import type { PiTuiComponentPort, PiTuiInputListener, PiTuiOverlayHandle, PiTuiOverlayOptions, PiTuiPreInputListener, PiTuiRuntimeAdapterOptions, PiTuiRuntimeState, PiTuiScrollState, PiTuiStopOptions, PiTuiViewport } from "./contracts.js";
+/**
+ * Re-encodes one key report decoded by pi-tui in the legacy form, so a kitty-keyboard child
+ * (resident tabs) and a legacy terminal produce the same owned-screen action. Releases decode
+ * to nothing; mouse reports, paste, and unknown sequences pass through unchanged.
+ */
+export declare function legacyKeyInput(data: string): string;
 export type PiTuiRuntimeErrorStage = "construction" | "start" | "input-drain" | "restoration";
 /** Identifies the Pi TUI lifecycle stage that failed while preserving the original cause. */
 export declare class PiTuiRuntimeError extends Error {

package/dist/integrations/pi/tui-runtime/adapter.js

@@ -1,8 +1,35 @@
-import { HStack, ProcessTerminal, ScrollView, TuiAltScreen, TuiMainScreen, VStack, visibleWidth, } from "@earendil-works/pi-tui";
+import { HStack, ProcessTerminal, ScrollView, TuiAltScreen, TuiMainScreen, VStack, decodeKittyPrintable, isKeyRelease, parseKey, visibleWidth, } from "@earendil-works/pi-tui";
 import { MouseReportInput, stripSgrMouseReports } from "./mouse-report-input.js";
 import { GeometryObservedAltScreen, OverlayGeometryTracker } from "./overlay-geometry.js";
 import { boundedCleanup, EMERGENCY_TERMINAL_RESET } from "../../../foundation/terminal-cleanup/terminal-reset.js";
 import { InputPresentationCoordinator, } from "./input-presentation-coordinator.js";
+// Protocol: the legacy bytes owned screens and their key tables compare against.
+const LEGACY_KEY_BYTES = {
+    escape: "\u001b", up: "\u001b[A", down: "\u001b[B", right: "\u001b[C", left: "\u001b[D",
+    "shift+up": "\u001b[1;2A", "shift+down": "\u001b[1;2B", pageUp: "\u001b[5~", pageDown: "\u001b[6~",
+    home: "\u001b[H", end: "\u001b[F", "ctrl+home": "\u001b[1;5H", "ctrl+end": "\u001b[1;5F",
+    enter: "\r", tab: "\t", "shift+tab": "\u001b[Z", backspace: "\u007f", delete: "\u001b[3~",
+    space: " ", "ctrl+c": "\u0003", "ctrl+z": "\u001a",
+};
+/**
+ * Re-encodes one key report decoded by pi-tui in the legacy form, so a kitty-keyboard child
+ * (resident tabs) and a legacy terminal produce the same owned-screen action. Releases decode
+ * to nothing; mouse reports, paste, and unknown sequences pass through unchanged.
+ */
+export function legacyKeyInput(data) {
+    if (data.length <= 1 || !data.startsWith("\u001b"))
+        return data;
+    const key = parseKey(data);
+    if (key === undefined)
+        return data;
+    if (isKeyRelease(data))
+        return "";
+    const legacy = LEGACY_KEY_BYTES[key];
+    if (legacy !== undefined)
+        return legacy;
+    const printable = decodeKittyPrintable(data);
+    return printable !== undefined && printable >= " " && printable !== "\u007f" ? printable : data;
+}
 /** Identifies the Pi TUI lifecycle stage that failed while preserving the original cause. */
 export class PiTuiRuntimeError extends Error {
     stage;

package/dist/integrations/pi/tui-runtime/damage-aware-terminal.d.ts

@@ -52,6 +52,17 @@ export interface DamageAwareTerminalOptions {
     };
     readonly onResize?: () => void;
     readonly onHyperlinkCleanupRequired?: () => void;
+    /** Exact-artifact fault controls evaluated before physical writes; absent in ordinary sessions. */
+    readonly allowWrite?: () => boolean;
+    readonly writeChunks?: (data: string) => readonly string[];
+    /** Optional payload-free observation after a terminal write returns. */
+    readonly onWrite?: (metadata: {
+        readonly bytes: number;
+        readonly fragments: number;
+        readonly transaction: "synchronized-output" | "ordinary";
+        readonly frameId?: number;
+        readonly cause?: string;
+    }) => void;
 }
 /**
  * A fail-closed adapter for one pinned Pi fullscreen write grammar. Semantic

package/dist/integrations/pi/tui-runtime/damage-aware-terminal.js

@@ -166,7 +166,36 @@ export class DamageAwareTerminalAdapter {
         const forwarded = this.#canvasBackgroundAnsi === null
             ? output
             : paintTerminalCanvasFrame(output, this.#canvasBackgroundAnsi);
-        this.inner.write(forwarded);
+        let writeAllowed = true;
+        try {
+            writeAllowed = this.options.allowWrite?.() ?? true;
+        }
+        catch { /* Invariant: fixture controls fail open. */ }
+        if (!writeAllowed)
+            return;
+        let chunks = [forwarded];
+        try {
+            const controlled = this.options.writeChunks?.(forwarded);
+            if (controlled !== undefined && controlled.length > 0 && controlled.length <= 4_096
+                && controlled.join("") === forwarded)
+                chunks = controlled;
+        }
+        catch { /* Invariant: fixture controls fail open without corrupting the renderer write. */ }
+        for (const chunk of chunks)
+            this.inner.write(chunk);
+        try {
+            this.options.onWrite?.({
+                bytes: Buffer.byteLength(forwarded),
+                fragments: chunks.length,
+                transaction: forwarded.startsWith(BEGIN_SYNCHRONIZED_OUTPUT) && forwarded.endsWith(END_SYNCHRONIZED_OUTPUT)
+                    ? "synchronized-output" : "ordinary",
+                ...(armed === undefined ? {} : {
+                    frameId: armed.descriptor.frameId,
+                    cause: armed.descriptor.cause,
+                }),
+            });
+        }
+        catch { /* Invariant: observation never changes rendering or write completion. */ }
         if (epoch !== this.#epoch
             || (armed !== undefined && this.#lastConsumedFrameId !== armed.descriptor.frameId))
             return;

package/dist/native/darwin-arm64/manifest.json

@@ -7,7 +7,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "supported",
-  "builtAt": "2026-10-19T04:50:42.711Z",
+  "builtAt": "2026-10-19T14:46:40.019Z",
   "artifact": {
     "filename": "process-guardian.node",
     "sha256": "a87eaaffcd986b624c8b044b756446cc1bdaf4334a1775b97820542fe34f9fb7",

package/dist/native/darwin-arm64/terminal-host.manifest.json

@@ -9,11 +9,11 @@
   "architecture": "arm64",
   "target": "aarch64-apple-darwin",
   "capability": "supported",
-  "builtAt": "2026-10-19T04:52:31.538Z",
+  "builtAt": "2026-10-19T14:50:21.966Z",
   "artifact": {
     "filename": "terminal-host.node",
-    "sha256": "af7b9fee2efa8478c728465031e73fb316b6b7012d11de0364130b0acd1b6e62",
-    "size": 5173904
+    "sha256": "12b73c5b9c2023badcdcbea9f2c3cca018cbb1704c0cb452303f59a551b0c407",
+    "size": 5813520
   },
   "entry": {
     "filename": "dist/foundation/resident-tabs/host-entry.js",

package/dist/native/darwin-x64/manifest.json

@@ -7,7 +7,7 @@
   "platform": "darwin",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-19T04:50:48.870Z",
+  "builtAt": "2026-10-19T14:46:46.372Z",
   "artifact": {
     "filename": "process-guardian.node",
     "sha256": "783a65f0de287a1c02cd5429dbe97bc8633f4cc8a7b92e3e961180b9bdcff814",

package/dist/native/darwin-x64/terminal-host.manifest.json

@@ -9,11 +9,11 @@
   "architecture": "x64",
   "target": "x86_64-apple-darwin",
   "capability": "supported",
-  "builtAt": "2026-10-19T04:54:11.822Z",
+  "builtAt": "2026-10-19T14:53:04.323Z",
   "artifact": {
     "filename": "terminal-host.node",
-    "sha256": "1a5465ea12ecfe76d5f0c8fd5c11dee99597b4206a7e9ece01b37fc5c477c211",
-    "size": 5656912
+    "sha256": "aea613cb66de9d7f87018ee32aba7d30d695a86752301e1dde771bdeb7dad724",
+    "size": 6349264
   },
   "entry": {
     "filename": "dist/foundation/resident-tabs/host-entry.js",

package/dist/native/linux-x64/manifest.json

@@ -7,7 +7,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-19T04:50:20.956Z",
+  "builtAt": "2026-10-19T14:46:32.168Z",
   "artifact": {
     "filename": "process-guardian.node",
     "sha256": "118e5954e3864672bd8482ab7edf419cb27dcdf2533720316979b7f5cc5a53a5",

package/dist/native/linux-x64/terminal-host.manifest.json

@@ -9,11 +9,11 @@
   "architecture": "x64",
   "target": "x86_64-unknown-linux-gnu",
   "capability": "supported",
-  "builtAt": "2026-10-19T04:53:24.471Z",
+  "builtAt": "2026-10-19T14:49:27.044Z",
   "artifact": {
     "filename": "terminal-host.node",
-    "sha256": "843b10ab29eddf859a74a97875ba646a90917d9ec78445474895bb64f6e0772a",
-    "size": 6353496
+    "sha256": "890d87b2fccecb4956243c40da97c461e180a40ace6b340d5c9f808ab9f4b586",
+    "size": 7099552
   },
   "entry": {
     "filename": "dist/foundation/resident-tabs/host-entry.js",

package/dist/native/win32-x64/manifest.json

@@ -7,10 +7,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-19T04:51:53.049Z",
+  "builtAt": "2026-10-19T14:46:55.773Z",
   "artifact": {
     "filename": "process-guardian.node",
-    "sha256": "19eb07160f90033855f43c38008aaf90665e40bc68a87fac0c44585b362977cd",
+    "sha256": "e8b39eb8c589c028024164c021a08183021574d06b48fbefc34fb3fb55636c62",
     "size": 402432
   },
   "provenance": {

package/dist/native/win32-x64/terminal-host.manifest.json

@@ -9,11 +9,11 @@
   "architecture": "x64",
   "target": "x86_64-pc-windows-msvc",
   "capability": "supported",
-  "builtAt": "2026-10-19T04:54:01.087Z",
+  "builtAt": "2026-10-19T14:49:14.794Z",
   "artifact": {
     "filename": "terminal-host.node",
-    "sha256": "2e11d6f772aac6780a0d4d55a6a79169483b14b2b1e055f0f694702d38cab825",
-    "size": 5617152
+    "sha256": "7661bc29672ef40853a94bcfe367fd6ed5c03b9e6e3e3ac4ac4bbea4c2aad891",
+    "size": 6323712
   },
   "entry": {
     "filename": "dist/foundation/resident-tabs/host-entry.js",

package/dist/product-identity.d.ts

@@ -1,10 +1,10 @@
-declare const ENVIRONMENT_KEYS: readonly ["clipboardDiagnostics", "configDir", "dataDir", "databasePath", "developmentInstanceId", "developmentRoot", "endpoint", "exitNoticePath", "paneId", "probeTrace", "processGuardianPath", "prFooterPreview", "profileHome", "runtimeDir", "sessionRuntimeId", "skipVersionCheck", "startupTrace", "suggestionDiagnostics", "tabEndpoint", "tabId", "tabToken", "tabsEndpoint", "terminalHostPath", "terminalSessionId"];
+declare const ENVIRONMENT_KEYS: readonly ["clipboardDiagnostics", "configDir", "dataDir", "databasePath", "developmentInstanceId", "developmentRoot", "endpoint", "exitNoticePath", "paneId", "probeTrace", "processGuardianPath", "prFooterPreview", "profileHome", "residentFixtureControlDir", "residentProgressObservationDir", "residentProgressRunId", "residentProgressTabId", "residentProgressTabIncarnation", "runtimeDir", "sessionRuntimeId", "skipVersionCheck", "startupTrace", "suggestionDiagnostics", "tabEndpoint", "tabId", "tabToken", "tabsEndpoint", "terminalHostPath", "terminalSessionId"];
 declare const FILESYSTEM_KEYS: readonly ["slug", "windowsDirectory", "unixDirectory", "temporaryPrefix"];
 declare const STATE_KEYS: readonly ["windowsControlDirectory", "unixControlDirectory", "developmentDirectory", "piAgentProfile", "piVanillaProfile", "sessionRepositoryDirectory", "sessionWorktreeClaimDirectory"];
 declare const ENDPOINT_KEYS: readonly ["windowsPipeStem", "unixSocketFilename", "metadataFilename", "supervisorLogFilename", "databaseFilename"];
 declare const MANIFEST_KEYS: readonly ["releaseFilename", "packageFilename"];
 declare const PROTOCOL_KEYS: readonly ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "promptHistorySchema", "releaseCohortSchema", "updateJournalSchema"];
-declare const EVIDENCE_KEYS: readonly ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema", "startupTraceSchema", "dependencyLayerSchema", "dependencyLayerCertificationSchema", "runtimePayloadSchema"];
+declare const EVIDENCE_KEYS: readonly ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "terminalTemporalSnapshotSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema", "startupTraceSchema", "dependencyLayerSchema", "dependencyLayerCertificationSchema", "runtimePayloadSchema"];
 declare const ARTIFACT_KEYS: readonly ["cliEntry", "supervisorEntry", "guardianEntry", "uiEntry", "terminalHostAddon", "terminalHostEntry", "nativeCrate", "processGuardianAddon", "releaseTarballStem", "diagnosticStem"];
 type StringRecord<Keys extends readonly string[]> = {
     readonly [Key in Keys[number]]: string;

package/dist/product-identity.js

@@ -1,14 +1,14 @@
 import rawIdentity from "./product-identity.json" with { type: "json" };
 const ENVIRONMENT_KEYS = [
     "clipboardDiagnostics", "configDir", "dataDir", "databasePath", "developmentInstanceId", "developmentRoot", "endpoint", "exitNoticePath",
-    "paneId", "probeTrace", "processGuardianPath", "prFooterPreview", "profileHome", "runtimeDir", "sessionRuntimeId", "skipVersionCheck", "startupTrace", "suggestionDiagnostics", "tabEndpoint", "tabId", "tabToken", "tabsEndpoint", "terminalHostPath", "terminalSessionId",
+    "paneId", "probeTrace", "processGuardianPath", "prFooterPreview", "profileHome", "residentFixtureControlDir", "residentProgressObservationDir", "residentProgressRunId", "residentProgressTabId", "residentProgressTabIncarnation", "runtimeDir", "sessionRuntimeId", "skipVersionCheck", "startupTrace", "suggestionDiagnostics", "tabEndpoint", "tabId", "tabToken", "tabsEndpoint", "terminalHostPath", "terminalSessionId",
 ];
 const FILESYSTEM_KEYS = ["slug", "windowsDirectory", "unixDirectory", "temporaryPrefix"];
 const STATE_KEYS = ["windowsControlDirectory", "unixControlDirectory", "developmentDirectory", "piAgentProfile", "piVanillaProfile", "sessionRepositoryDirectory", "sessionWorktreeClaimDirectory"];
 const ENDPOINT_KEYS = ["windowsPipeStem", "unixSocketFilename", "metadataFilename", "supervisorLogFilename", "databaseFilename"];
 const MANIFEST_KEYS = ["releaseFilename", "packageFilename"];
 const PROTOCOL_KEYS = ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "promptHistorySchema", "releaseCohortSchema", "updateJournalSchema"];
-const EVIDENCE_KEYS = ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema", "startupTraceSchema", "dependencyLayerSchema", "dependencyLayerCertificationSchema", "runtimePayloadSchema"];
+const EVIDENCE_KEYS = ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "terminalTemporalSnapshotSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema", "startupTraceSchema", "dependencyLayerSchema", "dependencyLayerCertificationSchema", "runtimePayloadSchema"];
 const ARTIFACT_KEYS = ["cliEntry", "supervisorEntry", "guardianEntry", "uiEntry", "terminalHostAddon", "terminalHostEntry", "nativeCrate", "processGuardianAddon", "releaseTarballStem", "diagnosticStem"];
 const ROOT_KEYS = ["schema", "displayName", "commandName", "packageName", "filesystem", "environment", "state", "endpoint", "manifest", "protocol", "evidence", "artifacts"];
 export function validateProductIdentity(value) {

package/dist/product-identity.json

@@ -23,6 +23,11 @@
         "processGuardianPath": "A1_PROCESS_GUARDIAN_PATH",
         "prFooterPreview": "A1_PR_FOOTER_PREVIEW",
         "profileHome": "A1_PROFILE_HOME",
+        "residentFixtureControlDir": "A1_RESIDENT_FIXTURE_CONTROL_DIR",
+        "residentProgressObservationDir": "A1_RESIDENT_PROGRESS_OBSERVATION_DIR",
+        "residentProgressRunId": "A1_RESIDENT_PROGRESS_RUN_ID",
+        "residentProgressTabId": "A1_RESIDENT_PROGRESS_TAB_ID",
+        "residentProgressTabIncarnation": "A1_RESIDENT_PROGRESS_TAB_INCARNATION",
         "runtimeDir": "A1_RUNTIME_DIR",
         "sessionRuntimeId": "A1_SESSION_RUNTIME_ID",
         "skipVersionCheck": "A1_SKIP_VERSION_CHECK",
@@ -70,6 +75,7 @@
         "nativeSpikeSchema": "a1-native-host-spike-evidence-v1",
         "terminalProvenanceSchema": "a1-terminal-host-provenance-v1",
         "terminalProofSchema": "a1-terminal-host-proof-v1",
+        "terminalTemporalSnapshotSchema": "a1-terminal-temporal-snapshot-v1",
         "stableReleaseSchema": "a1-stable-release-v1",
         "previewReleaseSchema": "a1-preview-release-v1",
         "releaseCertificationSchema": "a1-release-certification-v1",

package/dist/ui/settings/manager.d.ts

@@ -47,6 +47,12 @@ export declare class OwnedSettingsManager {
     /** Reads and resolves the product namespace. Never throws: every failure becomes a notice. */
     read(): OwnedUiSettingsResolution;
     load(): Promise<void>;
+    /**
+     * Adopts values another process stored in the shared document. Notifies only when a
+     * resolved value differs, so a peer's own write echo stays silent. Restart-bound values
+     * keep their session-start effect and surface as pending instead.
+     */
+    refresh(): boolean;
     sections(): readonly OwnedUiSettingsSection[];
     /**
      * The value in effect for a declared setting, typed by its declaration. A restart-bound

package/dist/ui/settings/manager.js

@@ -129,6 +129,28 @@ export class OwnedSettingsManager {
         this.#agentSnapshot = agent === null ? null : await snapshotOf(agent, this.#hiddenAgentSettingIds);
         this.#notify();
     }
+    /**
+     * Adopts values another process stored in the shared document. Notifies only when a
+     * resolved value differs, so a peer's own write echo stays silent. Restart-bound values
+     * keep their session-start effect and surface as pending instead.
+     */
+    refresh() {
+        const next = this.read();
+        if (resolvedValuesKey(next) === resolvedValuesKey(this.#resolution))
+            return false;
+        this.#resolution = next;
+        for (const setting of next.settings) {
+            const id = setting.declaration.id;
+            if (!this.#restartEffective.has(id))
+                continue;
+            if (setting.value === this.#restartEffective.get(id))
+                this.#pending.delete(id);
+            else
+                this.#pending.set(id, setting.value);
+        }
+        this.#notify();
+        return true;
+    }
     sections() {
         const resolution = this.#hiddenOwnedSettingIds.size === 0
             ? this.#resolution
@@ -270,6 +292,9 @@ async function snapshotOf(agent, hidden) {
         return { descriptors: [], writeAdvertised: false, failure: describe(error) };
     }
 }
+function resolvedValuesKey(resolution) {
+    return JSON.stringify(resolution.settings.map(setting => [setting.declaration.id, setting.value]));
+}
 function failed(failure) {
     return {
         status: "failed",

package/docs/architecture/resident-tabs.md

@@ -223,13 +223,13 @@ The channels carry bounded generation-1 frames: a u32 little-endian length follo
   - The server sends `bridge.visibility{visible}`, so a hidden A1 throttles animation, and `bridge.rename`, so a strip rename sets the Pi session name.
   - The bridge is advisory. A missing or broken bridge degrades that tab to process-level status and never breaks the tab.
 - **Backpressure:**
-  - Each client connection has a reliable, bounded control lane and a **single-slot render lane**. A newer full current surface replaces an unsent one, so a client that drains never depends on a dropped intermediate revision.
-  - The server never blocks a holder, another client, or registry writes on a slow client.
+  - Each client connection has a reliable, bounded control lane and a **single-slot render lane**. A newer full current surface replaces an unsent one, so a client that drains never depends on a dropped intermediate revision. Structured surfaces are immutable `Arc` values while routed; encoding happens outside the routing mutex, decoded structured state is capped at 8 MiB, and a superseded holder socket cannot publish into a newer incarnation.
+  - The server never blocks a holder, another client, or registry writes on a slow client. Attach and holder hot loops yield after bounded frame, byte, and two-millisecond work quanta; completed outer writes, rather than offers, advance the presentation baseline.
   - Holders parse their PTY continuously, whether or not the tab is viewed, so a PTY is never throttled and a child never blocks on output.
 
 ### 6. Rendering, input, and outer-terminal fidelity
 
-- **Composition.** The attach client composes row 0 (the strip) and rows `1..N` (the viewed tab's surface). The tab PTY is sized `cols × (rows − 1)`. Composition reuses the proof's damage-aware composer and synchronized-output support, and falls back to a full repaint only when the layout changes.
+- **Composition.** The attach client composes row 0 (the strip) and rows `1..N` (the viewed tab's surface). The tab PTY is sized `cols × (rows − 1)`. Ghostty remains the sole child-terminal parser. Its stream parser reports synchronized-output begin/end/reset boundaries to the holder, which keeps mutable parser state separate from an immutable committed surface and never publishes an open transaction. A non-renewable 250 ms deadline publishes one typed recovery commit for a malformed transaction. The outer composer owns the only synchronized envelope and falls back to a full repaint only when identity, geometry generation, dimensions, or the structured base changes.
 - **Outer modes.** The client negotiates the outer terminal's modes: raw mode, alternate screen, bracketed paste, focus events, SGR mouse, kitty keyboard protocol where available, and synchronized output.
   - Child-requested modes are tracked in the holder's model. Input is re-encoded per child mode by libghostty-vt, which the proof already does.
   - Mouse rows are offset by the strip. Row 0 belongs to the client.
@@ -249,8 +249,8 @@ Direct `a1 solo` is the behavioural oracle for every viewed resident child. Only
 - **Typed effects.** The holder registers libghostty's clipboard-write callback, which normalizes OSC 52 and OSC 1337. A write from the viewed tab crosses as one bounded `terminal.effect`; attach writes one OSC 52 for it. A hidden tab's write is dropped, never replayed into a later view. Payloads are never logged.
 - **Modes and cursor.** Each surface carries the child's cursor cell and modes. Attach mirrors a cursor shape the child chose and resets it on detach or failure; a default block cursor is left to the outer terminal, as direct A1 leaves it.
 - **Shortcut projection.** The owned child projects the effective A1 keybindings plus `keybindings.json` into one assignment per tab action: a key an A1 action holds never becomes a tab shortcut, and the earlier declaration keeps a duplicated key. It publishes the projection as `bridge.shortcuts`; the server relays it as `tabs.shortcuts`, and attach dispatches and labels exactly that projection. `/hotkeys` renders the same projection. A shared case file is replayed by both resolvers.
-- **Committed presentation.** A requested view commits only with a topology that lists it and a complete target surface. Surfaces of the committed view apply in revision order, and revisions rise across holder incarnations. A retained re-offer is marked stale and parks for at most 120 ms while the fresh frame arrives. One compositor writes strip, body, overlay, and final cursor inside a single synchronized update, and refuses clear-only, blank, and cursor-less strip-only frames. Clock, hover, and title-animation damage repaints only the strip and restores the child's cursor.
-- **Evidence.** One interaction matrix drives three layers: an owned-shell oracle that records content-free observations, role fixtures that drive real server, holder, and attach processes with a certified parity child, and an exact-artifact harness, `verify-interaction-parity.mjs`, that compares the bytes the same child observes directly and through the built host on each platform. Observations carry digests and lengths, never content. Each platform's verdict stands alone.
+- **Committed presentation.** A requested view commits only with a topology that lists it and a complete target surface. Retained rows, palette/default colors, modes, and cursor are captured atomically; equal captures do not invent a revision. Surfaces of the committed view apply in revision order, and revisions rise across holder incarnations. A retained re-offer is marked stale from the request start and parks for at most 120 ms while the fresh frame arrives. One compositor writes strip, body, overlay, modes, and the viewport-clipped final cursor inside a single synchronized update. It erases suffix cells when a complete replacement row becomes shorter and restores the newest underlying surface when an overlay leaves. Clock, hover, and title-animation damage repaints only the strip and restores the child's cursor.
+- **Evidence.** One interaction matrix drives three layers: an owned-shell oracle that records content-free observations, role fixtures that drive real server, holder, and attach processes with a certified parity child, and exact-artifact harnesses. `verify-interaction-parity.mjs` compares the bytes the same child observes directly and through the built host. `verify-resident-parallel-progress.mjs` configures the real engine against a bounded loopback streaming provider and crosses all six first-response orders with all three initial views while every turn remains unfinished behind a completion barrier. At matching 100×29 child geometry, the same real-A1 prompt also runs through isolated direct-solo and resident profiles; the native Ghostty oracle compares a content-free digest of the intermediate fixture cells and their resolved styles together with normalized cursor and mode state. It advances only at parser-reported synchronized-output boundaries, rejects unbalanced transactions or disappearing intermediate cells, and excludes only the resident strip row rather than normalizing terminal semantics. Opt-in per-process JSONL observations identify engine delivery, completed child writes, PTY ingestion, distinct holder commits, attach receipt, and completed outer paint by run/tab/incarnation/process-instance/sequence without recording terminal or conversation content; queue loss, clock faults, duplicates, stale order, and missing stages fail the report. Named pressure variants keep all turns unfinished while exercising hidden progress, repeated switching, navigation input, rename overlays, tab-local resize, a bounded 35 ms attach-receipt delay, and a 900 ms paused outer sink; every tab must retain partial animation/progress before settlement and then present its final output. A detached/reconnect variant releases all three unfinished turns after terminating the authenticated attach and exact self-reported server identity; child writes, PTY ingestion, and holder commits must continue before a replacement server and attach present every retained final output. Separate isolated exact-artifact control markers stop one target tab at engine delivery, physical child rendering, holder commit, or outer paint; each control requires its upstream stages and the other tabs to advance, then removes the stop and requires final output from all three tabs. A fifth control fragments a real owned-shell synchronized write into at most 64 physical writes without changing its bytes, records the DEC private mode 2026 transaction classification, and requires ordinary complete holder commits without deadline recovery before final output. This characterizes the built PTY/ConPTY coherence path; a passing fragmented run does not by itself assign the historical stall to that path without a failing live reproduction. The marker path is absent in ordinary sessions and is scrubbed before extensions or tools inherit the child environment, while observation callbacks remain passive and cannot select a control. CI runs the vendored Ghostty VT tests and both exact-artifact harnesses on Windows x64, Linux x64, and macOS arm64. Each platform's verdict stands alone.
 
 ### 7. Status and attention come from the tab bridge
 
@@ -262,11 +262,12 @@ Tab status is an A1-owned state machine fed by `bridge.status`:
 | `idle` | settled idle | none |
 | `working` | agent or turn start, tool execution, compaction | shared progress frames |
 | `needs-input` | an extension UI, trust, or permission request is pending | yellow `?` (warning) |
-| `done-unseen` | the turn settled while no client viewed the tab | `✓` success |
-| `error` | the last turn's `stopReason` was error | `✗` error |
-| `crashed` / `restarting` / `failed` | holder or child exit | `✗` error plus a banner |
+| `done` | the last turn finished successfully | green `✓` success |
+| `aborted` | the last turn was aborted | red `✗` error |
+| `error` | the last turn ended with an error | red `✗` error |
+| `crashed` / `restarting` / `failed` | holder or child exit, or a failed tab lifecycle (never a failed turn) | `✗` error plus a banner |
 
-- `seen` is tracked server-side, so viewing a tab in any client clears `✓` everywhere.
+- A `done`, `aborted`, or `error` marker stays on the chip, including after any client views the tab, until that tab's next turn starts.
 - A tab with a broken bridge shows only process-level states.
 - Future CLI tabs will derive status from process state, and may use BEL or OSC 9/777 from the program as an attention input.
 - The glyph set is the same in every client. A working spinner uses the resolved A1 accent reported by that specific tab.
@@ -335,7 +336,7 @@ Tab status is an A1-owned state machine fed by `bridge.status`:
   | `Alt+A` | new tab |
   | `Alt+W` | close |
   | `F2` | rename |
-  | `Alt+.` | create or activate the global Settings tab |
+  | `Alt+,` | open the global Settings tab, or close it while it is viewed |
   | `Alt+1`…`Alt+9`, `Alt+0` | jump to a tab |
   | unbound (`tabs.next` / `tabs.previous`) | next / previous, wrapping |
   | unbound (`tabs.moveRight` / `tabs.moveLeft`) | move the tab right / left |
@@ -349,7 +350,7 @@ Tab status is an A1-owned state machine fed by `bridge.status`:
   - right-click opens `Rename`/`Close` (`Close` only for Settings);
   - dragging reorders, with a `│` drop marker, after 250 ms or once the pointer moves;
   - `+` opens a persistent dark v2 menu with `+ Agent`, a separator, and `Settings`; hover and click remain active through the opening release.
-- **Settings.** The strip owns one profile-global `Settings` tab. The grouped launcher and `Alt+.` create or activate it; closing the screen or tab removes it. Resident Agent autocomplete omits `/settings`, and manually entering it does not open a per-Agent screen. `a1 solo` and `a1 pi` retain their existing Settings routes.
+- **Settings.** The strip owns one profile-global `Settings` tab. The grouped launcher creates or activates it; `Alt+,` does the same from another tab and closes it while it is viewed. Esc does not close the Settings tab; closing the tab removes it. Resident Agent autocomplete omits `/settings`, and manually entering it does not open a per-Agent screen. `a1 solo` and `a1 pi` retain their existing Settings routes.
 - **Commands inside A1 tabs:** existing `/name <name>` also renames the tab. Milestone 5 adds no tab-management slash commands: `/new-tab`, `/close`, `/tabs`, `/quit-all`, and `/restart-tab` are not exposed.
 - **Naming:**
   - Default names are `agent` or `agent N`.
@@ -391,7 +392,9 @@ Every queue, buffer, file, and collection the resident roles keep has a declared
 | Bound | Cap | Enforced in | Test |
 |---|---|---|---|
 | Protocol frame | 2 MiB, nesting 64, 65,536 collection items | `native/terminal-host/src/protocol.rs`, `src/foundation/resident-tabs/protocol.ts` | `refuses_oversized_header_before_payload`; `refuses a frame header past 2 MiB before buffering its payload`, `refuses nesting past 64 levels`, `refuses a collection past 65,536 items` |
+| Structured complete surface | 512 × 256 geometry, 65,536 cells, 4,096 styles, 4,096 links, and 8 MiB decoded state | `protocol.rs` `StructuredSurface::validate` | `structured_surfaces_fail_closed_on_dimensions_indexes_and_control_injection` |
 | Input per message and holder input queue | 1 MiB | `protocol.rs`, `core/holder.rs`, `roles/holder.rs` | `over_capacity_paste_delivers_no_prefix` |
+| Holder PTY ingress and work round | 64 × 16 KiB lossless chunks; at most 256 KiB or 2 ms before yielding | `roles/holder.rs` | `verify-resident-parallel-progress.mjs` concurrent and stopped-stage cases |
 | Per-client control lane | 1,024 frames and 4 MiB | `roles/server.rs` | `control_lane_is_bounded_by_frames_and_bytes` |
 | Per-client render slot | one pending full surface; a newer one replaces it | `roles/server.rs` `Peer::offer_surface` | `stalled_client_gets_one_full_current_surface` |
 | Concurrent endpoint connections | 128 | `roles/server.rs` `admit_connection` | `connections_beyond_the_cap_are_refused_and_released_slots_are_reused` |
@@ -407,7 +410,9 @@ Every queue, buffer, file, and collection the resident roles keep has a declared
 | Session reconciliation read | 64 MiB | `src/foundation/resident-tabs/recovery.ts` | `refuses to scan a session past the 64 MiB reconciliation cap` |
 | Release-hold report | 32 uncertainty reasons; 1 MiB read | `roles/release_holds.rs`, `release-holds.ts`, `bounded-host-command.ts` | `uncertainty_reasons_stay_within_their_cap`; `fails a release-hold report that pushes past its byte cap without returning a prefix` |
 | Maintenance exchange | 5 s reads, 60 s stops, 4 MiB report | `roles/maintain.rs`, `maintenance.ts`, `bounded-host-command.ts` | `fails a maintenance report that pushes past its byte cap without returning a prefix`, `kills and rejects a command that outlives its deadline` |
-| Attach client | no outbound queue: input is written synchronously in chunks of at most 1 MiB; inbound frames at most 2 MiB; one coalesced wake | `roles/attach.rs` | `refuses_oversized_header_before_payload`, `over_capacity_paste_delivers_no_prefix` |
+| Attach server ingress | reader queue 64 frames/4 MiB; execution queue 8 frames/4 MiB; at most 64 KiB or 2 ms before yielding | `roles/attach.rs` | `verify-resident-parallel-progress.mjs` slow-receipt and switching cases |
+| Attach input | 1,024 parsed events; semantic input is emitted in at most 1 MiB chunks and target-bound while a view/create is pending | `roles/attach.rs` | `deferred_input_is_atomic_bounded_and_bound_to_the_requested_tab` |
+| Outer presentation writer | one replaceable complete desired state, 8 control/effect frames, and 4 MiB effect bytes | `roles/attach.rs` `OuterWriter` | `presentation_is_one_ordered_synchronized_write`; `verify-resident-parallel-progress.mjs` paused-sink case |
 | Doctor bundle | 25 MiB, oldest log generations dropped first | `src/foundation/resident-tabs/doctor.ts` | `drops the oldest log generations first to stay within its cap` |
 
 ### 13. Packaging and certification

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.2.7-dev.806",
+  "version": "0.2.7-dev.808",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "privateLaunchContract": "neutral-launch-v1",
@@ -53,6 +53,7 @@
     "test:full": "node scripts/release/run-validation-tier.mjs full-release",
     "test:release": "node scripts/release/run-release-gates.mjs",
     "test:terminal-host": "node scripts/development/run-terminal-host-probe.mjs",
+    "test:resident-parallel-progress": "node scripts/development/verify-resident-parallel-progress.mjs",
     "test:resident-chaos": "node scripts/development/run-resident-chaos.mjs --build",
     "test:pi-engine-conformance": "vitest run test/integrations/pi/engine/conformance.test.ts test/integrations/pi/engine/runtime-integration.test.ts test/integrations/pi/engine/session-integration.test.ts",
     "report:pi-engine-conformance": "npm run build --silent && node scripts/pi/run-pi-engine-conformance.mjs",