# Scope selection and lifecycle contract

## Status and baseline

**All seven nonempty selections and public command/completion controls shipped in 0.27.0.** The [M2 functional boundary](#m2-functional-acceptance-boundary) records bounded deterministic acceptance, including captured policy, private acquisition, Session-excluded response suppression, deferred forks and mode-only Telegram controls. The [flat model interface](single-scope-interface-contract.md) also shipped in 0.27.0; it does not change these scope/private authorities. No settings chooser is required. [BACKLOG.md](../BACKLOG.md) owns outstanding work.

This document owns selected-scope policy and its authority boundaries; [usage](usage.md) owns operator syntax/configuration. The proposals, candidate gates and validation totals in implementation-checkpoint sections below are historical at their named M0/M2 source boundaries. Later retained integration superseded their all-three-only, pending-selector and deferred-copy implementation limits, not their preservation duties or original review verdicts. They are not current prerequisites.

Source baseline: package 0.26.5, commit `4494fee9da8258cdf5f02c42672a0eb9866a512a`, matching repository-local Pi SDK 1.0.0. At that baseline `SnapshotConfig` contained only mode, while Session config and retained-checkpoint codecs rejected the proposed scopes field. The legacy mode-only reader can extract a mode while ignoring such a field; selected policy admission cannot reuse it as full validation. Current internal v2 admission and the aggregate-validated default-all-three bridge are described below.

This contract complements the [semantic handoff contract](semantic-handoff-contract.md) and [compatibility decision brief](semantic-compatibility-decision.md). The [architecture](architecture.md), [usage](usage.md), and [fork contract](fork-contract.md) remain the current runtime references. Implementation checkpoint sections preserve their original bounded evidence and then-current gates; the [retained native-seven integration](#retained-native-seven-selection-integration) supersedes earlier all-three-only activation limits, not their storage/authority preservation duties.

## Agreed invariants

- Execution mode, scope participation, and semantic responsibility are independent dimensions. Do not add one mode per selection or assign a semantic plane permanently to a scope.
- Every nonempty selection is valid: `global`, `cwd`, `session`, `global cwd`, `global session`, `cwd session`, `global cwd session`. Compose the selected set in that relative order; input order does not change precedence.
- Scope equality means equal semantic capability, not identical sharing mechanics. Global/CWD remain shared; Session remains private. Precedence is not truth, authority, importance, or permission.
- Disabled owners contribute no ordinary model values, patches, implicit fallbacks, maintenance, or hidden response/provenance writes. Their canonical checkpoint/tail/metadata bytes are not normalized, folded, initialized, moved, or deleted by selection.
- Selection alone advances no semantic revision/step or transition identity and rewrites no history. Explicit acquisition can validate current data and establish authorized lifecycle state; it is not proof of a semantic change.
- Off exposes neither memory tools nor State Flow context. Its automatic lifecycle remains canonically memory-inert, even if selection must be remembered.
- Cancellation before acceptance installs no candidate. Cancellation after acceptance cannot undo accepted memory. Publication remains exact-cohort, lock/CAS guarded, and owned by the existing runtime/storage boundary.

## Current operator policy

### Parsing

Use the existing `registerCommand` argument string on Active, Passive and Off. Split whitespace-separated canonical tokens, reject duplicates/unknown spellings and mixed invented flag syntax before changing either mode or selection, and normalize order. Whitespace-only arguments mean no new explicit selection. This refines the initial argument-free-Off recommendation: explicit Off scopes are only native policy DATA, remain canonically I/O-inert and allow participation changes without entering an enabled mode. Mode-only Off still preserves selection; no new command, acquisition grant or global-default mutation is added.

Global configuration accepts a nonempty unique array under `scopes`; missing means all three. Invalid global JSON/keys/values still fail loading. Commands and Telegram do not edit global defaults. A mode-only Telegram action preserves the concrete current selection; a seven-combination chooser is not required.

**Installed boundary:** Global `scopes` supplies any nonempty selection for first native capture; enabled participation then uses the selected bridge and its independent origin/current/private/fork authorities. Capture is still only policy DATA. Missing scopes retains all three; mode-only controls preserve the captured choice. Optional scope tokens and SDK argument completion are now bound to the existing commands; see the current [public command boundary](#public-mode-command-scope-overrides). A settings chooser is not required.

### Default and branch precedence

**Implemented D3 policy:**

1. A command with valid explicit scopes proposes that concrete selection for the current session branch.
2. Without arguments, retain the already established branch/session selection, across mode changes and Off. A same-mode command with different scopes is not an “already active” no-op.
3. A genuinely new independent session samples the loaded global default and records that concrete policy in Pi. Later default edits affect later new sessions, not recorded sessions.
4. A legacy session without any scope evidence samples the currently loaded global default once at its first upgraded attachment. Record it as native policy without eagerly creating or converting semantic storage. Do not treat absence and a malformed explicit selection as equivalent.
5. Native branch policy chooses mode and selection; current canonical files choose memory. Tree navigation can select a branch's earlier policy but must not rewind its memory. Same-session reload/resume preserves that policy.
6. A fork inherits its source branch's concrete policy into a fresh child owner. It is not an independent `/new` default, and it cannot share a mutable selection object with its parent.
7. Canonical session config mirrors accepted lifecycle policy when memory-enabled acceptance is allowed. A newer owner-local native Off/deferred/failure marker overrides older canonical policy without becoming semantic authority.

The selected D3 direction is concrete capture at the first upgraded/new native attachment, after validating branch policy and before canonical acquisition. It is not a permanent coupling to live global defaults. Native persistence, precedence and malformed-policy fencing have their retained integration witnesses below; the internal value tests alone do not establish them.

## Internal value boundary and lifecycle encoding direction

`lib/selection.ts` now owns the immutable nonempty `ScopeSelection` value, its explicit array decoder and whitespace-token parser. It depends only on the existing scope identity type, not on mode, SDK, filesystem, temporal history or publication. It is not exported from the package root. Global configuration reuses this decoder for captured native choices; mode commands now bind this exact parser and pure unused-owner prefix completions. The retained native bridge admits all seven selections without making the decoder a publication or private-acquisition capability.

- `captureScopeSelection(value)` rejects missing, empty, duplicate, noncanonical, sparse or inherited-index input; it returns a detached frozen array ordered `global → cwd → session`. Every one of the seven nonempty sets has the same semantic eligibility.
- `parseScopeSelectionArguments(args)` returns no explicit selection for blank input, not all scopes. A mode-only caller must preserve its established choice. Invalid tokens throw before the caller may change policy.
- `DEFAULT_SCOPE_SELECTION` is the all-three fallback for an absent global setting only. An explicit `undefined`, `null` or `[]` is not absence. The config owner distinguishes a missing property from a malformed present property before calling the decoder.
- A legacy native session with no explicit selection evidence samples the loaded default once; that may be a subset. This differs from saying every legacy session must use all three. Captured values survive later default edits, and child values must detach from parent inputs.
- A scope value carries no mode, causal identity, acquisition proof or request epoch. Equal sets after changing away and back cannot revive an older operation; request/operation ownership remains a separate integration obligation.

**Historical M2.1b format checkpoint, subsequently integrated by the selected owners below:** Use selection-aware lifecycle format **2**, separate from semantic scope format **3**. Canonical config contains required `{mode, scopes}` and its paired runtime metadata declares version 2. Native policy checkpoints also declare version 2 and require a concrete scope set, including pre-runtime/Off forms; they carry policy/lifecycle only, never semantic data. Future versions and malformed explicit scope evidence must reject before mode-only fallback. Do not add an optional scopes field to legacy version-1 runtime evidence and then ignore it.

The lifecycle header needs an explicit `privateAcquisition` discriminator: `unacquired` for legitimate independent private origin not yet acquired, `deferred` for a child awaiting private fork copy, or `acquired`. A complete accepted legacy version-1 runtime retains its existing acquired-private contract; missing files cannot downgrade it to unacquired. Deferred copy must additionally require child-owned direct-parent evidence through the existing fork authority path; the discriminator alone cannot authorize a parent lookup/copy. Native markers never substitute for validated physical identity, lineage or exact source/target CAS. The detached preflight functions validate these closed shapes and preserve opaque runtime metadata without activating them in current readers. An acquisition discriminator is an asserted lifecycle fact, not proof that the required private files or fork source actually exist.

This chooses explicit epochs and acquisition provenance over optional-field inference, while reusing existing owners rather than adding a policy registry, second store or hidden Session stream. At that format-only checkpoint, selected-owner I/O, shared-only causal proofs, deferred-copy admission and malformed-policy recovery were not yet implemented; subsequent sections record their owner/native evidence. An owned v1→v2 lifecycle publication will need its own exact-source backup/CAS proof even when no semantic scope needs v3 conversion; the existing semantic-conversion detector alone is insufficient. No lifecycle file is rewritten by this preparation.

`tests/selection.test.ts` covers every subset/permutation, command syntax, frozen/detached values, malformed explicit input and value-only capture semantics. At M2.1a, configuration/snapshot tests still rejected unintegrated scopes fields; global data admission is now installed below. The architecture invariant includes selection in the SDK/lifecycle-independent core. These are preparation witnesses, not seven-selection native lifecycle acceptance. M2.1a validation passed 37 focused tests and the full `npm run validate` with **898 tests, 0 failures**, tracked build/import checks and a 125-file dry-run package inventory. The 33-file/145-edge source graph remains acyclic. No active store operation or live inference was required.

## Detached policy and lifecycle preflight

`lib/snapshot.ts::prepareSessionPolicyMigration` accepts a complete explicit config/runtime string pair, expected physical identity and a caller-supplied legacy selection. It admits only runtime versions 1/2 before interpreting owned fields, validates identity/lineage/counters/provenance framing and returns detached v2 data plus serialized target strings. Both absent sources return absence, never a fresh runtime; partial sources reject. Original strings remain available for inspection but are not file observations, byte receipts or CAS authority.

A legacy v1 source retains its acquired-private contract regardless of the new selection. Raw legacy `config.scopes` or `meta.privateAcquisition` collisions refuse before filtering; no field is silently overwritten. Existing opaque metadata, including retired temporal and artifact evidence, remains data rather than being normalized away. V2 requires explicit valid scopes and one of the three acquisition states. `requiresConversion` identifies an epoch change only; canonical target strings may normalize whitespace/key or scope ordering even for already-v2 input. Preparing those strings authorizes no write.

`prepareRetainedPolicyMigration` in the same domain validates unversioned legacy or explicit-v2 native checkpoint values, including pre-runtime inactive forms. V2 requires mode/scopes and refuses legacy `enabled`/`disabled` aliases; unversioned scopes and unknown explicit versions refuse. A prepared native v2 checkpoint preserves its concrete selection when decoded with later defaults. Its boundary token remains opaque lifecycle evidence, not a memory rewind or restoration capability.

`lib/session.ts::prepareBranchCheckpointPolicy` considers snapshot entries only. The latest recognized owned snapshot must validate; malformed/unreadable data cannot silently fall through to an older wider selection. Foreign/unclassifiable records grant no policy. This checkpoint-only helper remains separate from the complete resolver below and is not wired into existing attachment. Current `findBranchPolicy` and mode-only extraction remain legacy behavior until integration.

Runtime JSON errors expose fixed diagnostics without raw payload snippets or nested parser causes. Existing `parseSessionRuntime`, `serializeSessionRuntime` and `parseRetainedPiCheckpoint` continue to refuse prepared v2 data. Candidate preparation neither installs policy/cache nor reads parent/private memory, advances a revision, acquires a stream, backs up files or publishes. Those obligations remain with selected-owner runtime/storage and the owning native lifecycle operations.

**M2.1b validation:** 43 focused tests and the full `npm run validate` passed with **905 tests, 0 failures**, typecheck, tracked build, extension import and the 125-file dry-run package check. Compiled-module probes passed legacy→v2 preparation, target idempotence, current-reader refusal and latest-invalid-checkpoint fencing. The source graph remains acyclic at 33 files/147 edges. These prove codec/data boundaries, not selected-owner operation or real-model quality; no working store was converted.

## Complete native policy and marker admission

`session.ts::prepareSelectedBranchPolicy` now combines v2/legacy snapshots with native policy/Stop/fence/reset and child-owned pending-fork evidence. Its explicit context supplies the physical owner, the marker entry type, a caller-chosen new-session/inactive fallback mode and loaded scope default; the resolver never infers independent-session origin permission from absence. It returns detached concrete mode/scopes, pending-child status, the native continuation boundary, any physical-owner persistence fence and an optional-needed v2 **policy-only capture value**. It does not append entries, install native policy, inspect a parent header/store or confer semantic acquisition authority.

`captureSelectedNativeMarker` validates a closed version-2 marker with required `owner`, `mode` and canonical nonempty `scopes`. Policy-only and pending-fork forms may carry any mode without semantic fields. Stop forms carry safe nonnegative `at`/optional `from`, inactive mode and optional preserve-context/persistence-error fields; `memoryDeferred` requires Off. Reset is a distinct flag combination carrying explicit mode/scopes, with no Stop/pending payload. Unknown epochs, aliases/extra roots, malformed flags, incomplete policy and legacy raw `scopes` collisions reject. Actual unversioned legacy writer shapes remain readable; malformed fields that old permissive readers happened to ignore are not a supported way to invent a new selection. Checkpoint and marker epoch checks precede payload interpretation; unreadable native identity/version/data produces fixed diagnostics without payload-bearing causes.

Policy is folded in branch chronology. Legacy mode-only checkpoints/Stop choices retain an already captured concrete selection instead of resampling later loaded defaults. With no prior scope evidence, the supplied scope default is captured into the returned v2 native value; appending that value is the later adapter's obligation and makes subsequent default edits irrelevant. Explicit v2 policy replaces earlier valid scope choices. Latest malformed/unsupported owned policy never falls through to an older wider selection. A later **explicit valid v2 policy** can supersede known malformed policy; a later scope-less legacy choice cannot repair tainted selection evidence by sampling a default. Unknown pending-fork epochs require a later understood owned reset/pending disposition, not a policy-only scope choice.

Physical-owner write fences, continuation boundaries and fork bookkeeping remain distinct from requested mode/scopes. A later policy-only marker or pre-runtime policy-only checkpoint cannot certify canonical acceptance or clear an older write fence; a supported boundary-backed checkpoint or owned reset can. A newer Stop/Off choice without an error also does not erase an existing fence. Legacy reset cancels older Stop mode overrides using the last checkpoint/caller fallback mode while preserving captured scopes; new v2 reset carries its complete explicit resulting policy. This prevents a mode-only reset from widening memory participation. `capture` deliberately contains no reset/error/boundary claim, so freezing a selected policy cannot itself acknowledge canonical recovery.

Fresh native fork context or surviving child-owned pending evidence permits inheritance of source-branch mode/scopes **only before child-owned bookkeeping takes over**. Parent/foreign fences, continuation and resets never become the child's physical authority. A checkpoint alone cannot clear child pending-copy facts; only the child's understood reset does. Returned pending/capture values are bookkeeping, never proof of a direct parent, private target absence or permission to copy/acquire. The existing fork/storage acceptance must still independently revalidate those facts. Foreign-owner payloads are filtered before scope/error interpretation in ordinary same-session resolution, and Off/pending-fork admission performs no canonical or parent-file I/O.

`tests/session.test.ts` covers all seven selections × modes, closed marker combinations, frozen/detached capture, later defaults and legacy mode-only choices, reset scope preservation, sticky fences versus policy-only capture/checkpoints, accepted-boundary clearing, fresh/cold fork inheritance, foreign reset isolation, pending facts across checkpoints, invalid/unknown epochs and policy recovery, privacy-safe hostile data, and filesystem-forbidden Off/fork resolution. Existing mode-only native readers and callbacks remain unchanged; these are complete value-admission/precedence witnesses, not installed native selected behavior. M2.1c passed **119 focused owner checks** and full `npm run validate`: **1013 tests, 0 failures**, tracked build/import parity and a 125-file package inventory. A compiled probe confirmed captured defaults, physical fences, child pending/reset, legacy mode-only scope retention and zero canonical/parent I/O. Context validation remains at 0 errors / 22 existing warnings; the 33-file/155-edge graph is acyclic with 26 existing header warnings. No working store, credential operation or live model was involved.

## Selected policy-bound request lifetime

`session.ts::SelectedPolicyLifetime` binds one immutable requested `{cwd, owner, mode, scopes}` policy to the existing `operation.ts::RenewableLifetime`. CWD is an explicit absolute identity normalized lexically, with no realpath/store/header lookup; owner remains an opaque native session identity. Policy admission is closed and detached, rejects malformed/inherited/missing/extra fields without payload-bearing errors, and captures canonical nonempty scopes. This is requested policy, **not** accepted canonical memory, a native parent proof, new-origin permission or permission to publish under some other runtime/selection.

`select` changes owner/CWD/mode/scopes before synchronously aborting old requests. Same canonical policy, including reordered scopes or equivalent lexical CWD, retains its lifetime and independent concern owners. `capture` is available only for enabled policy and returns a frozen policy/signal/synchronous `revalidate` receipt. Capture it **before** source acquisition, inference or queueing. Pass its signal (combined with a concern's own controller) to selected runtime waits and its in-memory recheck to the runtime native-policy port; origin/copy operations still need their separate native authority and exact address/selection binding. A native adapter must also gate calls on accepted runtime/selection consistency; a current request alone cannot attach an old cache to a new policy.

A change-away-and-back cannot revive old signals/receipts. `invalidate` renews the lifetime even when policy values are unchanged, for same-policy branch movement/Abort or other independently owned native invalidation. `end` withdraws requests, drops the in-memory policy slot and is terminal: late selection/capture cannot reopen it. Selecting Off aborts old memory work and prevents new memory captures; the adapter still owns I/O-free semantic-cache clearing and native-only Off bookkeeping. The helper itself neither clears accepted cache nor updates native/canonical policy, waits for a lock, reads sources or registers another operation scheduler.

Concern-specific `OwnedOperationSlot`/controllers stay independent. Canceling/settling preparation or response work does not renew the policy lifetime or cancel another admitted concern. Abort dispatch is synchronous and may reenter: slot cancellation now forgets its old owner **before** dispatch, and lifetime renewal installs its new controller **before** aborting the old signal. An abort listener may claim newer work, make a newer policy choice, or end the new lifetime without being erased/reopened by the outer cancellation. Identity-guarded releases and drainable superseded promises remain unchanged.

`tests/session.test.ts` covers all seven subsets × modes, detached/frozen capture, equal-choice noninterference, malformed-policy preservation, physical identity/mode/scope changes, ABA/invalidation/shutdown and reentrant listeners. The genuinely composed policy/operation/runtime fixtures in `tests/integration.test.ts` queue patch/raw-replay/preparation/response/attachment/fork/mode port calls behind a still-held foreign lock and prove cancellation settles **before release**, with no stale callback, byte change or cache install; a fresh request then accepts. Separate fixtures preserve independent concern waits, refuse late asynchronous source/inference results, recheck immediately before publication, preserve already accepted semantics after a later Off choice, clear cache with file operations forbidden, and deny acquisition without independent permission. The ordinary-answer fixture is deterministic, not a live-provider or native-callback claim.

M2.4a passed **92 focused owner checks** and full `npm run validate`: **1023 tests, 0 failures**, tracked build/import parity and a 125-file package inventory. The compiled probe independently exercised held-lock ABA withdrawal, accepted-stage persistence after a later Off choice, I/O-free cache clear and reentrant slot/lifetime ownership. Context validation remains 0 errors / 22 existing warnings; the 33-file/156-edge graph is acyclic with 26 existing header warnings. All stores were isolated fixtures; no credential operation, live inference, working-store conversion or publication occurred.

These request bindings and runtime-port witnesses implement the lower contract. Default-all-three native tool/answer callbacks are now connected as described below; M2.4's actual selected lifecycle matrix remains open, as do coherent attachment, native selected observation/diagnostic delivery and public scopes activation.

## Native turn and tool-batch request correlation

`session.ts::NativeToolRequestCorrelation` owns **one** live native turn and its finalized assistant tool-ID/name map. `extension.ts` captures the physical owner/CWD, current mode and concrete default-all-three selection into `SelectedPolicyLifetime` at SDK `turn_start`, before context/provider work. A synchronous native-session identity closure accompanies the receipt. Mode choice, branch restoration, Off and shutdown revoke old receipts; same captured choices do not renew unrelated ownership. This does not install v2 native scopes/settings or replace the legacy native memory backend.

**Installed SDK evidence:** Pi 1.0.0 emits `turn_start` before request preparation/context, awaits assistant `message_end` before tool execution, then emits `tool_execution_start` → argument validation → `tool_call` → execute/result/end; `turn_end` follows completed tools. Agent-core clones partial `message_start` objects and may replace finalized messages, so object identity/timestamp is not used as an invented request ID. Provider HTTP hooks are transport-dependent, and `before_provider_request` supplies payload rather than a portable request/response correlation token. The owned turn plus the awaited finalized assistant IDs is the supported public evidence; payloads, headers, credentials and provider-specific responses are not inspected.

Unfinalized, unknown, mismatched, duplicate or already-consumed State Flow IDs refuse. Unexpected overlapping turns or repeated assistant finalization become unprovable until turn end instead of guessing the newest policy. Each tool execution consumes its matching admission once; its lease combines request, native-operation and turn cancellation and rechecks the same in-memory turn/identity/policy before publication. A policy change-away-and-back cannot rebind old arguments at `execute`, even when a later permission handler changed mode after our `tool_call` gate. Rejected stale admission does not clone/log its arguments or capture diagnostic state. Native turn end drains its volatile ID map; shutdown ends both turn and policy lifetimes. Raw non-model domain invocations without a native turn/operation retain existing compatibility, but every public SDK State Flow `tool_call` requires correlation: absence is not fresh native authority.

Only State Flow's read/mutation calls are gated. A stale State Flow patch cannot assert a current barrier over foreign siblings; unrelated native tools and trace stay Pi-owned. Existing valid Active barriers still enforce the sole-patch rule through the selected native suffix without scanning wider session history, and Passive retains its no-barrier behavior for **fresh** batches. Source-read start/call/result tracking also ignores revoked native batches so old reads cannot repopulate newer acquisition evidence.

Nested reads inherit only an explicit SDK `parentToolCallId` chain from an admitted batch, never an ID-prefix guess or branch-history search. Start/call notices for the same nested ID must agree on its parent/name. Active nested `patch_state` is rejected: an outer script may hide siblings, so it cannot prove the existing direct assistant barrier invariant. Fresh Passive nested patches retain normal atomic publication through explicit parent proof; Passive gains no new barrier. No foreign tool is blocked merely for lacking State Flow parent evidence. A finalized ordinary answer also needs its original native turn receipt before claiming response reconciliation; queued reconciliation carries the policy signal/recheck, while the actual post-handler answer still comes from `turn_end`. Already accepted canonical publications remain accepted after later cancellation.

`tests/session.test.ts` owns pure identity/phase/ID/single-use/explicit-parent/ABA/Abort/ambiguous-turn correlation admission. The corresponding `tests/extension.test.ts` group uses the real installed SDK with the credential-isolated faux provider. Native witnesses change Off→Active during an outstanding response, refuse both its stale patch and ordinary answer, allow a foreign read sibling, repeat the change **after** our preflight in a later permission handler with logging enabled, prove nested-read versus nested-mutation behavior, and observe an actual `openSync(lock, "wx")` patch wait cancel **before foreign lock release**, followed by a fresh accepted batch. Provider assertions are checked after native completion, not only inside scripts. Existing unit barrier witnesses now announce their simulated turn/finalized assistant rather than fabricating authority from branch presence alone.

M2.4b passed the **9 final focused request/native witnesses** and full `npm run validate`: **1042 tests, 0 failures**, tracked build/import parity and a 125-file package inventory. The wider owner check passed 154 tests before the final mode-specific nested witness; aggregate validation includes both Active refusal and Passive acceptance. A compiled-extension SDK/faux probe separately confirmed in-flight mode ABA, stale-patch refusal, foreign-tool independence and fresh answer acceptance. Context remains 0 errors / 22 existing warnings; the 33-file/160-edge graph is acyclic with 26 existing header warnings. All canonical stores/credentials were isolated fixtures; no live provider inference, working-store conversion, commit or release occurred.

**Remaining boundary:** These installed request/tool/answer guards use concrete all-three policy. The context/preparation boundary is now installed below; the default-all-three composition below is aggregate-validated, while the public seven-selection matrix remains uninstalled. Scripted SDK evidence is not live model-quality, credentials readiness or working-store rollout evidence.

## Native context and preparation request admission

`NativeToolRequestCorrelation.preparing()` supplies one stable phase-bound `NativeContextRequest` lease from turn start through provider preparation, before assistant finalization. It contains cancellation/revalidation only, **not** semantic acquisition or publication permission. `SelectedPolicyLifetime.signal` exposes cancellation even under Off; the existing memory `capture()` still refuses Off. Native turns bind that control signal independently from the actual model-operation signal, so an Off-origin turn cannot acquire a replacement Active request after a mode change, even if it returns to Off.

Live `context` captures its original lease before preparation, binds it into the existing preparation controller/store wait, checks it before maintenance/publication and rechecks after awaited acceptance. An old wait cannot join a newer request's pending operation. Already accepted preparation is not replayed merely because the next model turn has a fresh lease. Policy/identity/phase revocation or superseded Active preparation uses public `ctx.abort()`, rather than returning an undefined hook result that Pi could interpret as permission to send raw native history. Abort is guarded by the captured native operation identity: an obsolete callback cannot abort a newer ambient operation. Stale withdrawal remains diagnostic-inert; actual preparation failures retain the existing fixed diagnostics and accepted-after-publication behavior.

The owned `context_with_system` transcript membrane rechecks the lease after conversation-context handlers and before contributing the current normative section. An additional `before_provider_request` handler performs the same check on transports that expose it, without inspecting/returning a payload or touching headers/credentials. These are the SDK's available public pre-provider checkpoints, **not** a universal post-handler firewall against privileged extensions changing policy/payload after the last supported hook. The faux SDK witness covers a later conversation-context handler, caught at the full-transcript checkpoint; optional transport callback behavior is separately exercised without a payload read. No transport-independent HTTP hook or hidden provider wrapper is invented.

**Control ownership correction:** A native model request and explicit Start/Passive/branch-restoration work are distinct owners even when the SDK temporarily exposes the same ambient model `ctx.signal`. Correlation retains the last actual model-operation signal as an ownership fact. Mode/attachment work keeps its own controller and forwards standalone/user Abort, including a user Abort during an in-run Start. Only a model Abort explicitly issued by this stale-request guard is marked unrelated and not forwarded to newer control work. The native port retains that one guard-aborted operation identity; it does not reinterpret every model Abort as unrelated. This prevents the old guard Abort from canceling newer Passive persistence or Start acceptance without making a real user Abort wait for the canonical lock. Cancellation by explicit replacement selection, Off, native branch lifetime or shutdown remains owned by the existing slots/controllers; no new scheduler or durable operation registry is introduced.

Idle projections remain observational and outside live request leases. A genuinely new Off turn passes native context with no canonical/source reads or memory receipt; selecting Off during stale Active preparation instead withdraws that old turn, and the next genuine Off request is allowed. Accepted preparation/mode publications remain accepted after a later guard Abort; no old specification or semantic state is replayed or rolled back.

`tests/session.test.ts` covers stable phase leases and Off control ABA; the native-context group in `tests/extension.test.ts` covers payload non-observation/idle behavior, replacement-operation Abort protection, real SDK later-context mode ABA with zero faux-provider input, and actual held-preparation waits superseded by Off, Passive, restart and tree navigation. The Native SDK refuses tree navigation while streaming; that fixture first verifies the refusal, then uses public Abort before navigating while foreign exclusion is still held. Independent Passive/Start work settles after release, and only a fresh request reaches the provider. The Passive counterexample exposed and fixed a real ambient-signal coupling: canonical mode previously stayed Active because old-model Abort canceled the newer persistence. Existing raw-domain/standalone Abort witnesses remain compatible.

M2.4c passed **10 focused context witnesses**, the targeted existing real-SDK user-Abort/Start regression, and final `npm run validate`: **1052 tests, 0 failures, 0 cancellations**, tracked build/import parity and a 125-file package inventory. The broader owner cohort passed 161 checks. An initial aggregate caught an over-broad model-Abort exemption; the retained implementation exempts only guard-origin Abort and preserves real user Abort. A compiled SDK/faux probe separately confirmed zero stale provider input, withdrawal before lock release, independent Passive persistence and fresh acceptance. Context remains 0 errors / 22 existing warnings; the 33-file/160-edge graph is acyclic with 26 existing header warnings. All stores/model routes were isolated fixtures; no working-store conversion, credential operation, live inference or publication occurred.

Installed native guards still use concrete **all-three** policy. They do not activate v2 selected attachment, expose scopes settings, install a selected-native memory facade or certify the seven-selection lifecycle matrix.

## Selected observational diagnostics and projector admission

`status.ts::StatusDiagnostics` accepts an explicit `selection` plus exact sparse `scopeStates` and selected-only revision/tail-count records. Omitted selection retains **all-three** compatibility, never infers a subset from missing fields, and explicit null/malformed policy rejects. Available observations validate the selected own-key sets before values; revisions/counts must be nonnegative safe integers. Missing, extra or excluded owners are not rendered as empty states, false memory flags or zero revisions. An unavailable observation renders unavailable memory/history instead of manufacturing a head, empty JSON or offset zero.

Explicit selected status derives its effective overlay from those exact owners using the same sparse projection/merge semantics as accepted runtime reads. It deliberately does **not** consult an optional stale all-owner `effectiveState` override; legacy all-three callers retain that existing override and output. Revision vectors contain only canonical selected components (`c4`, `g7s4`), selected scope keys/artifact counts/footprints omit excluded owners, and a selected line identifies the admitted policy. Disabled stale-artifact notices are filtered by owner **before** path/reason fields; unavailable selected observations do not inspect notice/semantic/vector bodies at all. History depth comes from the actual selected causal window, not `recent().length`, since excluded-only witnesses may preserve boundaries without visible patches.

`scopeMemoryLines(states, selection)` and `memory.ts::retainedMemoryScopes(states, selection)` admit exact sparse selected values. The original no-selection memory-helper signature still returns all three flags for full materialized callers; explicit selected results contain no excluded keys. Footprints retain actual present plane sizes and same-owner intent-owned tactics/lazy shares; memory-bearing flags preserve their existing strategy/tactics meaning rather than treating registrations/answers as a new definition of memory. Observation neither deletes nor relocates any admitted legacy Global/CWD response value and does not infer new shared response authorship.

Compact terminal mode remains independent of semantic/revision inspection; Off returns before inspecting metadata, revisions, colors or source files. Detailed status is an **explicit operator observation** and may render supplied accepted values under Off; it does not itself load memory, attach cache or confer manual-inspection authority. The native adapter must still choose a disposable validated reader for explicit Off inspection and perform no automatic canonical/source I/O.

**Projector decision — no new selection API:** Existing `contextView`, `runtimeContextHead`, `ContextProjection` and passive-handoff helpers already consume one effective semantic projection plus admitted ancillary evidence. The accepted selected cache supplies exact `readView()`, selected-only `recent()` and stage-owned cascade paths; adding another selection/overlay engine inside context would duplicate ownership. Real selected fixtures prove current/recent context, lazy navigation, cascade receipts and model-projected Stop handoffs omit excluded values and lazy bodies without I/O. As in the existing native path, handoff input is first `projectStateForModel` data, not the raw lazy-bearing overlay. Selection movement must reset the owned projection and rebuild it from newly **accepted** selected values; these pure helpers alone cannot revoke a native request or filter an incorrectly supplied old full-owner overlay.

`tests/status.test.ts` covers seven subsets × modes, sparse empty/present observations, exact vector/key admission, malformed explicit selection, getter-blocked excluded state/counts/keys/notices, stale effective overrides, unavailable and compact Off fast paths, footprints and shared-response compatibility. `tests/status.test.ts` also covers actual excluded-witness history; `tests/context.test.ts` owns cascade receipts and projection reset after reduction. One genuinely composed accepted-cache-to-status-and-context/handoff witness remains in `tests/integration.test.ts`, covering both enabled modes, byte/cache immutability, source/provenance I/O prohibition and accepted response visibility. Shared `tests/observation-fixture.ts` contains setup/read helpers only, with no suite registration. These are deterministic format/cache-to-projector proofs, **not** installed native selected status, seven-selection Telegram controls, or live-provider observations; native composition/public scopes remain gated on the full lifecycle/request integration. M2.3b passed **139 focused owner checks** and full `npm run validate`: **1033 tests, 0 failures**, tracked build/import parity and a 125-file package inventory. A compiled seven-cache probe confirmed sparse status/flags, disabled getter isolation, existing context projection and I/O-free Off. Context remains 0 errors / 22 existing warnings; the 33-file/159-edge graph is acyclic with 26 existing header warnings. No working store, credential operation or live model was involved.

## Selected temporal value algebra

`lib/temporal.ts` now represents `SelectedTemporalState` with exactly its canonical `selection`, selected `scopes`, retained `lineage` and a metadata-only `causalBasis`. There is no excluded empty stream, fallback owner or fabricated zero revision. The selected revision vector and exact scope materializations contain only participating owners. A default-bearing effective materialization remains a compatibility result, not a stored owner.

`selectTemporalState` validates its source cohort, copies only selected streams and preserves every retained boundary and independent revision. It can restrict an already selected cohort, but cannot expand it by inventing an unacquired stream. Effective/current/historical reads overlay only selected owners; explicit excluded reads and any atomic patch containing an excluded owner reject, including otherwise harmless no-ops. Advancement/folding touch selected streams only. Existing all-three algebra callers retain their behavior; legacy `validateTemporalState` explicitly refuses the selected envelope, so existing durable publication cannot silently admit it.

For a retained step with no selected semantic patch, each causal-basis witness contains only the exact transition triple and a nonempty canonical set of excluded witness owners. It is derived from actual patch identities in the validated source cohort, or from that cohort's already validated excluded witnesses. This is sufficient witness ownership, not necessarily the complete original write set. No checkpoint value, patch body or private semantic stream survives exclusion. Invalid positions/parents, selected-owner claims, duplicate/redundant witnesses, missing evidence and projection-token substitutes reject. Folding trims witnesses outside the guaranteed hot window without changing revisions.

`createSelectedTemporalState` requires explicit values for exactly the selected owners at a new origin; it grants no file-initialization permission. `adoptSelectedTemporalStreams` requires explicit validated streams and preserves their current values/revisions at one fresh boundary, with no invented aligned past. Selection itself never performs that adoption or allocates a transition identity. Scope acquisition and whether a fresh-origin reconciliation is justified remain runtime responsibilities.

**Proof boundary:** Value validation establishes replay/causal consistency, not physical acceptance. Projection from an all-owner cohort still validates that source, so it does not prove independence from corruption in a required disabled source. Storage must bind any restored excluded-owner witnesses to admitted canonical owner metadata or reviewed accepted lifecycle evidence. The v2 candidate's bare contiguous lineage, a guessed owner label or a projection ID is not that proof. The read-only durable-admission boundary below now distinguishes exact byte dependencies from private/layout presence dependencies. It requires an explicit persisted owner-witness skeleton for excluded-only steps under lifecycle v2; legacy v1 still needs the complete semantic cohort. These helpers perform no I/O, policy installation, artifact maintenance or response capture.

`tests/temporal.test.ts` covers every subset and retention limits 0/1/7/100, exact overlays/history/revisions, excluded-only causal steps, corrupted witnesses, atomic disabled-owner rejection, no-op/overflow behavior, selected folding, explicit creation/adoption and legacy-admission refusal. This is an internal value-algebra checkpoint, not seven-selection native runtime support. M2.2a passed 76 focused owner checks and `npm run validate` with **910 tests, 0 failures**, tracked build/import and 125-file package checks. Compiled-module probes verified selected-only materialization, excluded-step history, selected advancement/folding and legacy-admission refusal. The source graph remains acyclic at 33 files/148 edges; no working store or live-model experiment was used.

## Read-only selected-cohort durable admission

`lib/storage.ts::loadSelectedFileCohort` awaits the existing cancelable store mutex and delegates to callback-scoped `StorageTransaction.prepareSelected`. It never initializes an absent store, installs runtime policy/cache, publishes, converts or creates backups. A returned absence means no surviving current-session lifecycle/private authority was found; it is not permission to initialize over an established owner. Partial lifecycle evidence and surviving orphan private semantics fail closed.

Lifecycle v1 has no accepted owner-witness skeleton. Admission therefore captures and validates all three semantic cohorts and their provenance before projecting the requested set. Those disabled byte dependencies are explicit and necessary; unrelated disabled-body corruption is not isolated on this path. Runtime/source identities, complete retained replay and the legacy acquired-private contract remain enforced.

Lifecycle v2 can carry `meta.causalWitnesses`: ordered `{transition, owners}` skeleton records generated by `temporalCausalWitnesses` from a validated cohort. The new `restoreSelectedTemporalState` checks exact lineage triples and canonical nonempty owner sets. Every claimed currently selected owner must have the actual patch; an excluded-only step must have an explicit witness. Bare contiguous lineage never supplies missing ownership. Existing selected patches can prove their own steps without a skeleton record, but malformed present witness metadata always refuses. Legacy v1 use of this newly owned root field is a raw collision, not an additive compatibility shortcut.

This is a cooperating-producer contract: the guarded selected publisher below persists skeletons derived from admitted semantic records/prior accepted witnesses. The reader validates their consistency under the correct physical lifecycle identity and exact captured header bytes; it does not cryptographically authenticate arbitrary manually edited metadata. Unknown/nonparticipating writers and power-loss durability are not newly supported. Current native v1 publication remains unchanged and cannot produce/accept these selected envelopes; the new internal selected publisher has no native runtime caller yet.

With that v2 evidence, admission opens only selected semantic checkpoint/tail/metadata files plus session config/runtime. It returns selected-only provenance. Disabled body/provenance files are not read or maintained; malformed unrelated bytes may remain untouched. Separately, `captureOwnedFilePresence` checks regular-file/directory chains without opening bodies: acquired Session requires all private semantic files, while `unacquired`/`deferred` requires their absence and cannot select Session before explicit acquisition. A deferred label alone never authorizes parent lookup/copy. Reserved `state.json` layouts are presence-only rejection probes, not newly writable owned paths.

`SelectedFileCohort.basis` contains exact byte/hash dependencies; `presence` contains distinct existence/type dependencies, not fictitious byte receipts. `assertSelectedFileCohortBasis` compares selection, required captured bytes and presence on recapture. It deliberately ignores unrelated excluded bytes and is not request-lifetime/publication authority. The selected publisher rechecks these dependencies under exclusion and preserves acquisition unchanged. New private/shared origins, deferred fork copy and native policy integration still need explicit owned authority.

The selected-cohort properties now consolidated in `tests/storage.test.ts` verify every subset using filesystem read spies, untouched canonical bytes, legitimate shared-only unacquired/deferred states, acquired-loss refusal, v2 corruption isolation, insufficient/contradictory witness rejection, strict legacy dependencies, identity/epoch refusal, source conflicts, orphan/symlink/partial evidence, callback/store lifetime and cancellation before acquisition. None of these tests operates on a working store. M2.2b passed 82 focused owner checks and the full `npm run validate` with **920 tests, 0 failures**, tracked build/import and a 125-file package check. Compiled probes confirmed witness-bound admission, excluded-body corruption isolation and exact dependency recapture. Context validation had no errors; the 33-file/149-edge import graph remains acyclic. Native selected runtime and new-origin/acquisition authority remain unimplemented; the following bounded publication cohort supplies the lifecycle-upgrade backup.

## Guarded selected-cohort publication

`StorageTransaction.publishSelected` is one single-use publication attempt per callback, including failed attempts; ended, canceled or different-store calls reject. The asynchronous `publishSelectedTemporalStateToFiles` wrapper obtains a fresh transaction. Neither interface initializes an absent owner nor acquires/copies private semantics. Native policy/settings/tools remain unchanged.

The publisher recaptures and validates the selected source under exclusion, compares both byte and presence dependencies, then derives the sole admissible successor with `constrainTemporalState` and optional exact `AcceptedTransition` replay. The caller's `view` must equal that derived result; changed checkpoint values, forged lineage/witnesses and excluded no-op patches refuse before backup/writes. Folding is limited to selected streams. Semantic no-ops and selection changes alone create no boundary or owner-revision increment. The existing replay grammar keeps new responses Session-owned; excluded Session cannot be supplied as a hidden response owner.

Optional `lifecycle` input contains only closed Snapshot run/mode fields (`config.mode`; `meta.step/specification/bootstrap/validation`). It cannot supply identity, scopes, lineage, acquisition or witness claims. The writer preserves opaque admitted lifecycle metadata and acquisition, captures the requested concrete selection, and derives lineage/witnesses from the replay result. Opaque scope metadata/provenance survives changed-stream encoding. This is owned semantic/selection acceptance, **not** the native runtime-only mode-persistence path; that existing path still does not migrate semantic scopes.

Selected legacy semantic owners convert to v3 only within this accepted publication; omitted owners remain byte-identical. A lifecycle-v1→v2 upgrade requires a verified exact-byte backup even when every semantic owner is already v3. The existing private content-addressed manifest keeps its semantic `targetVersion: 3` and adds `lifecycleConversion: {sourceVersion: 1, targetVersion: 2}` when applicable; `convertedScopes` may then be empty. It captures the complete required admitted source basis, not unrelated sessions. An existing lifecycle-v2 subset has only its selected/lifecycle byte dependencies. Backup failure prevents canonical writes; completed backups survive failed publication and exact retries reuse them.

Predicted file receipts are decoded and checked against the replay result **before** publication; output `cohort` contains the new v2 dependency set, not obsolete legacy all-owner dependencies. Existing exact-output verification and guarded rollback protect ordinary failure and intervening foreign bytes. These are cooperating-process guarantees, not kernel-atomic multi-file or power-loss durability. No failed attempt installs native cache/checkpoint policy.

`tests/storage.test.ts` covers every subset, exact receipt recapture, Session response ownership, lifecycle-only and combined semantic/lifecycle upgrades, sparse replay and folding at 0/1/7/100, unacquired/deferred shared-only updates, corruption/forgery refusal, stale-source/cancellation, backup privacy, injected failure/retry and concurrent-edit-preserving rollback. All files are isolated fixtures. M2.2c passed **98 focused owner checks** and full `npm run validate`: **931 tests, 0 failures**, tracked build/import parity and a 125-file package check. Compiled-module probes confirmed replay publication, lifecycle-only backup, zero-window receipts and stale-CAS refusal. Context validation passed with no errors; the 33-file/149-edge graph remains acyclic. Existing nonblocking context/style/header warnings remain. No working store, credential, live model, commit or release was involved.

## Selected semantic staging and commit

`lib/transition.ts` now stages full and selected values through the same `stageScopedSemanticTransition` engine. The selected entrypoints accept `SelectedSemanticBasis {selection, states}` with an exact nonempty acquired owner set. No fake empty owner is supplied to satisfy the legacy API. `ScopeStateValues` is only a partial value type; selected admission validates canonical selection, own-key presence, finite JSON and semantic shape before staging.

`stageSelectedScopePatches` rejects any excluded supplied owner, even a no-op, before reading its patch getter or consuming acquisition iterables. Its output contains only selected `nextStates`, hashes, cascades and provenance updates plus a detached frozen selection. Authored operations, scope-local normalization, intent-owned temporary-memory closure and compiler validation use the existing engine. Unsupplied selected owners are not normalized; disabled owner bodies are never visited. Cross-scope references do not authorize cascades into another owner.

`stageSelectedScopedTransition` captures the ordinary answer only if Session is selected. Otherwise it retains no answer string and can still stage other authored selected changes. A lifecycle-only completion publishes no semantic transition and does not increment semantic iteration; bootstrap/validation finalization remains possible. Model-authored `response` is still rejected, including in Session. Default-all-three native completion now uses these entrypoints; the enabled-subset response/whole native matrix remains gated. See [native response ownership](#native-response-callback-ownership).

`commitSelectedTransition` verifies the current selection, causal basis and selected state hashes, derives exact replay only from the final staged values, and installs in-memory values/lifecycle only after synchronous durable acceptance returns. Failed publication leaves snapshot/current values and the committed flag unchanged. Repeated successful commit does not republish. The legacy commit explicitly rejects a selected stage. `history.createAcceptedTransition` now derives canonical-order replay from matching nonempty present owner sets without inventing disabled state or requiring three placeholders.

Selected compiler staging does no source/filesystem acquisition. Metadata for a disabled-owner successful read creates no impossible compilation obligation and its hash/fingerprint is not inspected. A registered Skill's known source owner still prevents attempted relocation into a selected different owner. Selected-owner ordinary compilation produces selected-only provenance updates; carrying those updates through selected artifact maintenance/publication remains M2.3 work, not completed by this value boundary.

The selected staging properties now consolidated in `tests/transition.test.ts`, plus the stage→guarded-publisher round trip in `tests/integration.test.ts`, cover all subsets at 0/1/7/100 retention, exact sparse replay and cascades, getter/iterator non-observation on excluded admission, stale selection/value/basis refusal, failed-publication isolation, response suppression/finalization, compiler eligibility and a real isolated callback-owned stage→commit→selected-publisher round trip. These values and causal strings do not confer file, acquisition or request-lifetime authority; native change-away-and-back revocation remains an integration obligation. M2.2d passed **80 focused owner checks** and full `npm run validate`: **939 tests, 0 failures**, tracked build/import parity and a 125-file package check. Compiled probes confirmed selected cascade replay, response suppression and legacy commit refusal. Context validation passed with no errors; the 33-file/150-edge graph remains acyclic. Existing nonblocking warnings remain. Native scope activation remains unimplemented; explicit origin and first private acquisition support follows.

## Explicit new shared-only origins

`TemporalRuntime.withSelectedSharedOriginTransaction` now supports the three shared-only selections (`global`, `cwd`, `global+cwd`) across explicit Active/Passive origin acceptance. Like the existing start boundary, it defaults to **no origin permission**: the native caller must independently establish a genuinely new session and recheck that authority in the callback after the cancelable mutex wait. Scope/absence/prepared values do not provide this permission. Off, Session selection, malformed run fields and missing permission refuse before even creating an absent root.

The callback must make exactly one synchronous publication. Its guarded `StorageTransaction.initializeSelectedSharedOrigin` operation shares the single-use selected-publication capability and remains store/lifetime/cancellation-bound. It checks session config/runtime and private checkpoint/tail/metadata/retired-layout presence first. Any surviving private evidence or existing/partial lifecycle refuses new initialization; no private semantic body is opened for this check. The runtime retains a sticky origin fact and remembers previously observed private/lifecycle evidence, so disappearance after accepted/read current state cannot be reinterpreted as a fresh origin on that instance. A cold caller still needs native new-session authority; complete erased evidence cannot be reconstructed from absence.

Only selected shared file triples are read. A new scope requires **all three** checkpoint/tail/metadata files absent; partial pairs or orphan metadata refuse. Existing selected streams/provenance are validated before adoption. New empty selected owners start at revision zero; live shared values and revisions survive adoption at one fresh current origin, with no invented older aligned history. Selected retention folding is allowed by this owned start acceptance. Disabled shared bodies/layouts are not observed or rewritten, and Session semantic files are never created. Lifecycle v2 explicitly records `unacquired` and the concrete selection.

Target receipts are validated before canonical publication. Selected legacy semantic conversion requires the existing verified exact-byte backup, including absent lifecycle files and separate `presenceDependencies`; unsupported layouts are never converted implicitly. A fresh origin UUID does not affect exact-source backup reuse. Existing guarded publication rolls back interrupted writes and preserves completed backups for retries. Successful owned acceptance now installs the detached selected cache described below; failed attempts do not. Native scopes settings/attachments remain unchanged: this boundary returns a file receipt and retains only the sticky origin fact, **not** a partially working native selected semantic cache. Legacy full-runtime publication is fenced after this instance accepts a selected origin.

`captureLifecycleSnapshot` now owns closed run-field capture for both origin and selected publication. It detaches values and omits only undefined optional in-memory fields. This is necessary for actual completion snapshots, whose `validation: undefined` must not prevent publication; explicit malformed values, unknown authority fields, null mode/counters and scopes injected into config still reject. A stage→commit→publisher fixture now exercises default run finalization, not only the non-finalizing path.

`tests/runtime.test.ts` verifies all three shared selections × Active/Passive, zero private files, missing permission/Off/malformed rejection, current shared adoption and revision/history boundaries, disabled-corruption non-observation, partial/orphan/symlink refusal, exact legacy backup/rollback/retry, sticky lost-authority refusal, callback/single-use lifetime and cancellation behind a held foreign lock. The original mixed scenario's direct store-binding/expired-transaction checks have their own `tests/storage.test.ts` property; `tests/origin-fixture.ts` shares setup only without registering tests. All operations use isolated temporary fixtures. M2.2e passed **153 focused owner checks** and full `npm run validate`: **948 tests, 0 failures**, tracked build/import parity and a 125-file package check. Compiled probes confirmed explicit shared-only origin, absence of private semantics, exact receipt recapture and finalized lifecycle publication. Context validation passed with no errors; the 33-file/151-edge graph remains acyclic. Existing nonblocking context/header/style warnings remain. No working store, credential, live model, commit or release was involved.

First private acquisition, parent-current fork copy and existing-current selected acceptance extend these boundaries below. Native source-facility integration, attachment and request epochs remain unimplemented; selected facility admission is implemented below. None may infer permission from a new-origin helper or reset acquired state to unacquired.

## Selected first-authoring origin routing

`TemporalRuntime.withSelectedFirstPatchTransaction` captures a detached canonical selection before waiting and routes it through the existing origin-authoring engine: `shared-new` without Session, `new` with Session. The formerly unconditional private route rejected every shared-only first patch; a negative witness reproduced `Selected private acquisition requires Session` before this correction. No API, backend, capability or second publication engine was added.

The independent native origin grant and synchronous policy/memory checks remain mandatory. The author sees unpersisted candidate state, stages through the same selected compiler/ownership rules and commits origin, semantic replay and lifecycle in one publication; no empty persisted origin precedes validation. Rejected prepublication authoring installs no owner/cache; a later callback failure cannot undo an already accepted publication. A valid semantic no-op may accept the explicitly authorized origin/lifecycle, as on the prior Session route, but creates no semantic transition, step or revision. Shared-only acceptance remains unacquired with no Session semantic triple; known existing/private authority cannot be replaced by a new origin.

New properties cover every selection × Active/Passive × retention 0/1/7/100, exact one runtime publication, values/revisions/causal window and excluded-file absence; invalid/no-op first calls, competing source-byte edits, rollback/retry, selection mutation during a held wait, cancellation before lock release and explicit-origin/known-authority refusal. The runtime-transactions family passes 26 tests (15 new top-level properties); full `npm run validate` passes **1174/1174**, build/typecheck/import/package125. Five compiled cases pass; the fifth proves lower-runtime first shared authoring without an intermediate lifecycle or private stream. This is lower-owner completeness, not native seven-selection activation. Independent review supported dispatch/atomicity but reproduced an inherited unused-publisher lifetime escape: after authoring rejected for no synchronous publication, a retained transaction could write under a later foreign lock. A negative-first regression now covers all seven selections × normal/exceptional callback exit. The storage-owned inner publisher checks its callback lifetime before planning and is revoked in `finally`; late stage/commit cannot write files, install cache or mark a stage committed. The compiled probe also refuses escaped shared/private publishers under a held lock. This is callback-scoped capability enforcement, not another engine or asynchronous acceptance API. The narrow follow-up independently passed 123 related owner tests and all five compiled cases, plus six direct lifetime/finality checks. It approved HIGH-1 closure, including exact ended-before-consumed ordering, ignored async continuations receiving no renewed authority and accepted publication surviving a later callback throw. The slice is accepted within those boundaries, not as whole-M2 delivery. Remaining native/public integration lives only in [BACKLOG.md](../BACKLOG.md); counts overlap and are not summed.

## Explicit first Session acquisition

`TemporalRuntime.withSelectedSessionAcquisitionTransaction` owns two explicitly permitted attempts: `kind: "new"` for a genuinely new independent session, or `kind: "unacquired"` with an exact admitted selected source cohort. It defaults to no native acquisition permission. The caller must establish/recheck native policy after waiting; kind, selection, snapshot, history limit and source bytes are captured values, not capabilities. Only Session-containing selections and Active/Passive pass. Scope/mode/permission/format refusal occurs before creating an absent root; an existing unacquired source cannot initialize a missing store.

`StorageTransaction.acquireSelectedSession` shares the single-use store/callback publication guard and the existing selected-origin adoption/serialization/rollback engine. New sessions require lifecycle and private semantics wholly absent. An existing source must be **lifecycle v2 + unacquired**, match exact recaptured byte/presence dependencies, and preserve every supplied run field/counter. It may change mode, not silently reset step/specification/bootstrap/validation. Opaque lifecycle metadata and physical identity survive. `acquired` (even with all files lost), `deferred`, partial/orphan evidence, occupied or symbolic private targets and stale bases refuse. Runtime sticky private-observation facts survive passive inspection and prevent an observed acquired owner from being replaced by an empty source.

Only explicitly selected shared streams are initialized/adopted. The new Session stream is empty at revision zero; acquisition itself creates no semantic patch or revision increment. Existing selected live values/revisions survive a fresh current origin; earlier aligned history is unavailable rather than fabricated. Dropped owners stay byte-identical. Predicted receipts canonically order the new dependency set and switch private presence facts to present before acceptance. Ordinary selected publication cannot supply/change acquisition claims. Selected semantic format conversion still requires a verified exact-source backup; an unacquired→acquired flag transition within lifecycle v2 is initialization, not an epoch conversion. Lifecycle v1 is acquired already and is never reclassified.

The boundary returns accepted files and sticky authority facts; successful acceptance now installs the internal selected cache below, not native policy. Existing settings/commands/checkpoint attachment remain unchanged. Deferred source-parent validation/copy and source-backed artifact maintenance remain distinct later work; no parent lookup or copy occurs here.

`tests/runtime.test.ts` covers every Session-containing subset × Active/Passive; first acquisition after shared-only state, retained shared revisions and opaque run/identity preservation; exact receipt recapture; excluded-file stability; stale/reset/deferred/acquired/occupied/partial/identity refusals; failed creation rollback and retry; remembered private loss; callback/cancellation ownership; captured admission inputs across a held wait; and symbolic target refusal. The original mixed property's direct acquisition store-binding assertion now has its own `tests/storage.test.ts` property. Shared `tests/session-acquisition-fixture.ts` contains setup only, without suite registration. All files are isolated fixtures. M2.2f passed **162 focused owner checks** and full `npm run validate`: **957 tests, 0 failures**, tracked build/import parity and a 125-file package check. Compiled probes confirmed explicit unacquired→acquired acceptance, exact new byte/presence receipts, no implicit Global and sticky repeat refusal. Context validation passed with no errors; the 33-file/151-edge graph remains acyclic. Existing nonblocking context/header/style warnings remain. No working store, credential, live model, commit or release was involved.

## Child-owned selected fork deferral

`TemporalRuntime.withSelectedDeferredForkTransaction` accepts a genuinely fresh fork child's shared-only selection through explicit native fork permission, defaulting to refusal. Its closed `ForkLifecycle` supplies only mode/bootstrap; step starts at zero, with no inherited specification or validation diagnostic. Off or Session-containing selections refuse before an absent root is created. The caller still owns native fork identity/policy and must recheck it after waiting.

`StorageTransaction.deferSelectedFork` reuses the same selected-origin engine and single-use publication capability. It validates an unoccupied child and selected current shared sources, then writes lifecycle v2 with `privateAcquisition: "deferred"`. No Session semantic files are created. There is no parent locator parameter, parent-header read, parent-store lookup or recursive ancestry discovery on this path. Disabled source bytes remain inactive; existing shared-origin adoption, conversion backup, exact receipts and guarded rollback rules continue to apply.

The accepted child-owned discriminator survives cold selected loading; it is **not** direct-parent copy authority. Existing new/unacquired empty-initialization paths reject that child. Eventual Session acquisition must independently revalidate native direct-parent evidence and parent-current private semantics/provenance under exact source/target CAS. Until that path exists, a deferred child cannot expose Session. Its marker must survive native reload/Off handling until accepted private copy; those native integrations are not yet implemented.

`tests/runtime.test.ts` covers all three shared-only selections × Active/Passive, bootstrap/run reset, parent-read non-observation, absence of private files, cold deferred admission, empty-acquisition refusal, occupied-child refusal, failed-publication rollback/retry, explicit authority/Off/scope rejection, callback/single-use lifetime, sticky lost-child evidence and cancellation before a held foreign lock releases. The original mixed deferral property has independent direct store/lifetime/single-use checks in `tests/storage.test.ts`; checkpoint-to-native-policy pending preservation belongs to the composed `tests/integration.test.ts` witness. Their shared `tests/deferred-fork-fixture.ts` contains setup only and registers no suites. Tests operate only on temporary fixtures. M2.2g1 passed **168 focused owner checks** and full `npm run validate`: **963 tests, 0 failures**, tracked build/import parity and a 125-file package check. Compiled probes confirmed native-permitted deferral, cold child receipt, absence of private semantics and empty-acquisition refusal. Context validation passed with no errors; the 33-file/151-edge graph remains acyclic. Existing nonblocking context/header/style warnings remain. Native scope activation was outside this historical internal-port checkpoint; the following internal copy boundary extended its proof. No working store or live model was involved.

## Selected parent-current private copy

`TemporalRuntime.withSelectedForkCopyTransaction` now handles eager `fork-new` children and `fork-deferred` lifecycle-only children through the common selected-origin engine. The request must include Session and a distinct captured parent identity/key. The native adapter supplies an independent synchronous parent/policy check: **prepare** validates persisted direct-parent identity outside exclusion, while **recheck** only checks current in-memory native child/parent/policy ownership after waiting and immediately before publication. Recheck must not acquire external sources. A missing check, self identity/key, Off, changed native ownership or remembered acquired private state refuses. At that internal checkpoint this port was not yet wired into `extension.ts`; later retained native integration superseded that activation limit. A passed source value or deferred discriminator is still never native authority.

`StorageTransaction.copySelectedFork` binds parent-current canonical private authority under the same store mutex. It captures only the parent's config/runtime and Session checkpoint/tail/metadata plus regular-file presence. The parent must have acquired private memory under its physical CWD/session identity. Both supported legacy lifecycle v1 and explicit v2 work; missing/unacquired/deferred parent private state fails instead of supplying empty memory. Parent Session replay is checked against its own runtime lineage, independently of unrelated shared bodies. There is no ancestor recursion, directory discovery or older-boundary/Git lookup.

For a deferred child, the exact current child source must still be lifecycle-v2 deferred, match the admitted byte/presence basis and preserve run fields. Eager children require all child lifecycle/private files absent and a fresh step-zero fork lifecycle. Partial/occupied private targets reject. Acquired children cannot recopy, even if files later disappear. The fresh child receives the parent's then-current sparse private value, owner revision and matching validated provenance at one new current origin, while selected shared streams remain live/current. Earlier aligned history is unavailable; copy creates no semantic revision.

Predicted child receipts are validated before publication. Parent byte/presence dependencies are recaptured before backup and again immediately before publication; they are read-only inputs, never write targets. Existing child/shared CAS, selected conversion backups and guarded rollback apply. Parent canonical bytes are unchanged by successful copy, failed publication or retry. No partially working native selected cache is installed; source-backed artifact/Skill maintenance and native attachment/epoch integration remain later work.

`tests/runtime.test.ts` covers every Session-containing subset; cold deferred child copy of a newer parent head; current semantic/provenance/revision preservation; independent live shared streams beside a legacy parent; missing/unacquired/foreign/self parent and changed native proof; stale/occupied child; parent byte conflicts; disabled-corruption isolation; rollback/retry; cancellation and single-use acceptance. Native identity checks use isolated persisted-header fixtures and an in-memory recheck port, not a claim that native command wiring already exists. M2.2g2 passed **176 focused owner checks** and full `npm run validate`: **971 tests, 0 failures**, tracked build/import parity and a 125-file package check. Compiled probes confirmed deferred parent-current copy, phased native check port, exact child receipts and unchanged parent bytes. Context validation passed with no errors; the 33-file/151-edge graph remains acyclic. Existing nonblocking warnings remain. The following current-session acceptance boundary extended this historical internal-port checkpoint, which did not itself prove native scope activation. No working store or live model was involved.

## Selected current-session acceptance

`StorageTransaction.prepareSelectedCurrent` prepares a read-only Start/refresh candidate from current same-session lifecycle authority. `acceptSelectedCurrent` recaptures that authority under the callback-owned store mutex, checks the exact selection/byte/presence basis and derives the accepted output from current files, not from caller-modifiable candidate values or identity fields. No missing lifecycle can become a new session, and no parent lookup/copy occurs here. A candidate is neither a persisted receipt nor an acquisition capability.

When selected streams remain aligned with the owned runtime lineage, the operation retains the available history, folding only to the requested retention window. Independently validated selected live shared drift, or a wholly absent newly selected shared triple, instead establishes one current origin. Current sparse values, owner revisions and opaque provenance survive; earlier aligned history is explicitly unavailable. There is no semantic patch, revision increment or implicit Session acquisition. Partial shared triples, invalid semantic epochs/replay/provenance or malformed witness syntax reject instead of triggering adoption. `scopeLineageMatches` classifies alignment only after stream/lineage validators pass; `captureTemporalWitnesses` validates metadata syntax/ordering without asserting semantic replay or authority.

Selected acquired Session validates against its admitted active lifecycle or separately retained private causal basis, including its selected-owner witness claims. A retained basis cannot rescue contradictory private bytes while the source policy already selects Session, and a failed retained proof cannot fall back to another origin. It cannot be reset, recopied or substituted because a shared stream moved. For v2, excluded bodies remain unread and unchanged, while acquired-private existence remains required; intentionally unacquired/deferred states survive shared-only acceptance. The v1 path still requires every complete scope body/provenance dependency before projection; legacy shared drift may therefore cause a fresh selected origin even when that shared owner is excluded. This is an explicit compatibility dependency, not disabled-owner write permission. Bare old lineage or a discarded witness skeleton promises no earlier semantic history after current-origin adoption.

Replay publication and current-origin acceptance share one selected successor planner. It compares actual admitted stream bytes/values with the derived output, preserves opaque metadata and matching provenance, validates predicted receipts, checks byte/presence dependencies, and uses the existing guarded rollback. Lifecycle-v1 conversion still creates a verified exact-byte backup before publication, even when semantic scopes are already v3. Selected current output drops obsolete legacy all-owner byte dependencies. Repeated aligned acceptance is byte-idempotent.

`TemporalRuntime.withSelectedCurrentTransaction` requires a synchronous in-memory native policy check before waiting, after exclusion and immediately before acceptance. It captures the concrete selection and history policy before waiting, but reads the latest lifecycle under exclusion. The callback receives detached mode/run fields and must invoke its single-use publish capability synchronously. Off cannot accept semantic memory; explicit enabled acceptance may preserve/alter owned mode/run fields. Missing stores remain absent. Sticky acquired authority cannot be downgraded to unacquired, even after manual file deletion. After durable acceptance, a prior all-owner cache is retired rather than exposing stale/excluded values. The accepted selected cache below now replaces that legacy cache. Native source-maintenance/attachment and request epochs remain later work; selected semantic transactions and source-facility admission are implemented below.

`tests/runtime.test.ts` and the direct candidate/identity/presence-CAS cases in `tests/storage.test.ts` partition every selection and retention limits 0/1/7/100; aligned history and repeat idempotence; independent shared drift and current-origin boundaries; absent versus partial shared owners; excluded corruption; unacquired/deferred versus acquired private authority; invalid epochs/replay/witnesses and false selected-owner claims; forged candidates and exact CAS; legacy conversion/backup and prior-cache retirement; rollback/retry; Off/resume; capture across a held mutex; late presence conflicts; cancellation, lifetime/store guards and native policy revocation. All fixtures are isolated; shared `tests/current-fixture.ts` holds setup/read helpers only, with no suite registration. Native policy checks here are a required adapter port, not completed native command/epoch wiring. M2.2h passed **209 focused owner checks** and full `npm run validate`: **982 tests, 0 failures**, tracked build/import parity and a 125-file package check. A compiled probe confirmed shared-drift acceptance, preserved private/current owner revisions, excluded-byte isolation, exact receipts and repeat idempotence. Context validation has 0 errors / 22 existing warnings; the 33-file/151-edge graph remains acyclic with its 26 existing header warnings. No working store or live model was involved.

## Acquired-private reselection proof boundary

A strict witness exposed a gap beyond the original matrix: `Session → absent CWD current origin → Session` retained exact private bytes and acquired provenance but lost the private stream's runtime causal binding. The negative failed at `validateScopeLineage`; a second independently executable partition covers shared drift. Both now pass, including cold re-enable and another accepted private mutation/exclusion cycle. No validation or foreign-private fence is relaxed.

At that pre-release checkpoint, lifecycle v2 reserved optional `privateCausalBasis: {lineage, causalWitnesses}`. It carries only the last admitted private causal claims, never values, source locators, file hashes or acquisition permission. Snapshot owns closed syntax: every retained non-anchor step requires an actual witness skeleton; present malformed/extra-key/non-acquired claims reject, and any occurrence in v1 is a target-format collision. Absent is not empty/default proof. Unrelated opaque metadata remains preserved; legacy opaque `temporal` is never repurposed. An historical exact-shape JSON value cannot be distinguished from a cooperating declared field without an authenticated epoch; no writer-authentication claim is made. Reservation was justified by the then-unreleased v2 format, not a claim that arbitrary opaque collisions can be overwritten.

Before the first owned publication excludes acquired Session, the storage publisher retains the source lifecycle basis, not the requested view (which may already have a new shared-only origin). V2 needs its complete admitted witness skeleton; insufficient source evidence refuses before writes. An aligned legacy conversion may derive proof from its already-validated projection, but an unprovable legacy realignment refuses rather than inventing owners. Once Session is excluded, shared replay/folding/run acceptance carries the basis unchanged. Strictly mode-only Passive neither mints, repairs nor retires it. Excluding Session never opens or rewrites its bodies to construct proof; acquired presence remains mandatory.

When Session is re-enabled, actual private replay/witnesses must validate against its applicable retained basis before the existing selected current-origin planner can reconcile it with live shared streams. Active source policy still uses active lifecycle authority, never stale-proof fallback. Only successful Session acceptance retires the now-redundant basis after target receipts validate. Read-only observation can inspect proven current private values but cannot retire proof or confer publication authority. Parent-current copy uses the same admission and exact read-only parent CAS; the child receives values/raw artifact provenance, not the parent's proof as child identity. Unacquired/deferred origins retain their independent acquisition rules.

An older already-separated source without retained proof can re-enable only when its actual private stream still validates against current lineage. If that authority has already diverged, missing proof is not recoverable from presence, standalone parsing, Git or a native bookmark. This is conservative refusal, not universal repair. It creates no new API, private acquisition route, semantic format, history reconstruction or native subset activation.

The new owner cohort passes 76 tests, including seven-by-seven policy round trips at retention 0/1/7/100 through existing current/acquisition ports, complete-proof refusal, foreign/lost/corrupt private cases, no excluded body opens/writes, proof refresh after private mutation, shared folding, mode-only byte stability, observation and parent copy. Fresh full validation passes **1159/1159**, build/typecheck/import/package125; compiled probes pass four cases, of which the last is a lower-runtime cold private round trip, not native seven-selection delivery. Independent format review approved the leaf after 44 tests and 18 direct syntax/provenance probes. The authority review passed 75 owner and 36 adjacent checks but reproduced a current-witness admission bypass in parent copy. Its correction moves current witness syntax and every Session-owner claim into the shared private admission helper; current acceptance and eager/deferred parent copy now reject the same null/false-owner evidence under active or retained source policies. An eight-partition negative-first witness and the compiled lower probe preserve parent/child bytes and caches on refusal. The narrow follow-up independently passed 76 owner, 36 adjacent, four compiled and four missing/sparse-current-witness compatibility partitions and approved HIGH-1 closure. Complete detached proof is still required; sparse current evidence can remain valid when selected patches themselves prove steps. Original dissent is retained as evidence, not waived by green counts. Counts overlap and are not summed. The private-reselection slice is accepted within these boundaries; remaining native/public work lives only in [BACKLOG.md](../BACKLOG.md).

## Accepted selected runtime cache and reads

`TemporalRuntime` owns one discriminated semantic cache slot: legacy all-owner memory, an explicitly read-only selected observation, or an accepted selected file cohort, never simultaneous variants. The compatibility `view` property exposes only the legacy variant; a selected cache cannot masquerade as three owners. Successful shared/private origins, deferred forks, parent-current copy and current-session acceptance privately install a detached selected cohort **after** guarded durable publication. Neither returned receipt objects nor read-only current candidates install an **accepted** cache. Explicit read-only observation has its own variant and guards, described below. Canonical failure, canceled waits, policy refusal or an abandoned callback preserves the previous accepted cache. A caller error after publication cannot undo already accepted memory/cache.

`read` supplies defaulted effective/scoped materializations and `readView` supplies sparse effective/scoped projections through the existing temporal algebra. `selectedStates(offset?)` returns detached exact present-owner values and a frozen canonical selection for the existing selected staging engine; it never manufactures Global/CWD/Session placeholders. `selectedView()` returns a detached semantic value envelope, not byte receipts or publication authority. `causalBasis()` follows the readable cache lineage; an observation token is not a publication basis, and selected publication/run/checkpoint APIs require the accepted variant. Ordinary cached reads perform no filesystem I/O or source maintenance and do not silently observe later peer writes; owned current or semantic acceptance is needed to replace the cache.

Explicit excluded-owner reads/provenance queries reject. `artifactProvenance` returns detached matching selected-owner evidence only; legacy `states()` rejects rather than returning an all-owner structure. No new ordinary answer is captured or backfilled when Session is excluded; fixtures without legacy shared response data have no effective sparse response, and the defaulted materializer's empty string is not a hidden stored response. Any admitted legacy Global/CWD response remains ordinary selected compatibility data, not permission for new shared response authorship. Current/historical offsets retain the admitted causal window, including excluded-only witnesses. `recent()` returns only actual selected semantic patch records, never hidden patches or fabricated empty transitions: it is not a complete boundary-index table when excluded-only steps exist. Folding and fresh current-origin adoption keep their existing availability limits and owner revisions.

Legacy passive/current/shared acquisition, legacy native checkpoint production and legacy view replacement refuse selected authority before all-owner I/O. Setting compatibility `view = undefined` clears semantic cache without I/O but does not erase sticky session/private authority or reopen new-origin/all-owner fallback. A later explicit owned selected-current acceptance can reload it. This is an internal selected runtime/read boundary; public selected settings/commands remain uninstalled, and the default-all-three checkpoint/backend bridge is now aggregate-validated. Native request guards retain their separate acceptance evidence. Selected semantic transactions extend this boundary below.

`tests/runtime.test.ts` covers all seven selections × Active/Passive; effective/sparse/scoped reads and historical limits 0/1/7/100; excluded-only history and visible recent records; detached receipts/staging/projections/provenance; I/O-free reads and early legacy fences; shared drift followed by owned refresh; failure/cancellation versus post-publication error; new/unacquired/deferred private acquisition; parent-current copy; and cache clearing/reacceptance without authority reset. All source/store fixtures are isolated. M2.2i1 passed **195 focused owner checks** and full `npm run validate`: **990 tests, 0 failures**, tracked build/import parity and a 125-file package check. A compiled probe confirmed detached accepted cache, historical/effective reads, excluded-owner fences, response isolation and clear/reaccept behavior. Context validation remains at 0 errors / 22 existing warnings; the 33-file/151-edge graph is acyclic with 26 existing header warnings. The following M2.2i2 boundary implements semantic transactions separately from cache installation. No working store or live model was involved.

## Selected semantic transactions and provenance publication

`TemporalRuntime.withSelectedPatchTransaction` stages under canonical exclusion against independently validated **current selected values**. It exposes detached selected states, closed mode/run fields, current causal token and selected-only provenance plus one synchronous publish capability. The existing `stageSelectedScopePatches` / `stageSelectedScopedTransition` and `commitSelectedTransition` remain the sole staging/commit algorithm; no placeholder owner or second cascade/replay engine is introduced. Terminal answer capture remains Session-only, with shared-only lifecycle completion creating no semantic boundary/revision. True no-ops preserve step/history and unchanged canonical bytes.

`publishSelected` instead captures a precomputed replay, lifecycle snapshot and metadata deltas **before waiting**. It remains tied to its accepted cache. Changed targeted Global/CWD stream or provenance refuses with the existing selected-target conflict; a wholly removed target refuses with `SharedScopeRemovalConflictError`. Untargeted independently valid selected shared drift/removal can be adopted as current reality alongside the replay. Private and lifecycle bytes remain strict non-adoptable CAS dependencies. Fresh authoring under exclusion may target the live shared values it actually receives; an old raw replay is never silently restaged on them. Partial/malformed evidence still fails before authoring or publication.

A selected removed-target refusal deliberately **keeps the prior accepted cache and publishes nothing**. Unlike the legacy raw path's read-only absent-target adoption, it does not install an unaccepted current candidate. Explicit owned current acceptance can establish empty shared reality, after which a new authored patch may proceed. This preserves both the stale-target refusal and the selected durable-only installation rule; no lost private memory can take that route.

Both semantic routes bind the captured cache object before waiting, after exclusion and before publication, in addition to the required synchronous in-memory native policy check and AbortSignal. Clearing/reaccepting or changing away/back invalidates the prior operation even when selection/head strings later match. Failed publication leaves the stage uncommitted and the previous cache intact; successful durable publication installs a detached coherent selected cohort before yielding. Capabilities are callback/store/lifetime guarded and consumed on their first attempt. Actual native request/preparation/response/attach/fork epochs remain later integration work, not proof supplied by these internal cache guards.

`StorageTransaction.acceptSelectedCurrent` can now derive an optional replay successor from its freshly admitted basis. Ordinary selected publication and current-origin adoption share `selectedReplaySuccessor` and one byte planner. `SelectedProvenanceUpdates` admits only explicit selected owners, rejecting excluded keys before getters and rejecting nonfinite/uninterpretable deltas. Compiler evidence merges atomically with semantic/lifecycle output; metadata-only changes rewrite no checkpoint/tail and advance no owner revision or semantic step. Predicted receipts validate selected values **and** matching provenance before publication.

Explicit metadata deltas merge into the **raw admitted metadata registry** before owned serialization. Unrelated opaque/forward-compatible or malformed retained entries survive unchanged rather than being normalized away through a parsed registry. There is no incidental provenance pruning, including when semantic cards change. Source observation, registered-path/fingerprint/Skill ownership checks and any authorized source maintenance remain with their owning facilities; storage admission does not authenticate source freshness or read external sources under exclusion.

`tests/runtime.test.ts` covers every selection × retention limits 0/1/7/100 through the real runtime/staging/publisher path; sparse cascades, exact replay and no-op/response completion; fresh versus stale shared targets and provenance; removed target versus untargeted adoption; compiler metadata and opaque registry preservation; metadata-only byte/revision stability and compiler output into an admitted wholly absent shared owner; excluded getters and malformed deltas; private/lifecycle CAS; rollback/stage/cache refusal; callback lifetime/single use; cache change-away/back, cancellation, policy revocation and pre-wait input capture. Fixtures use isolated stores and synthetic completed-acquisition records, not live source/model-quality evidence. Native source-facility integration and public activation were outside this historical internal-port proof; the following facility-admission boundary extended that checkpoint. M2.2i2 passed **298 owner checks**, then a final **19 targeted checks** including the admitted-absent shared metadata counterexample/fix. Final `npm run validate` passed **998 tests, 0 failures**, tracked build/import parity and the 125-file package inventory. A compiled probe confirmed real selected stage/commit, atomic compiler provenance, stale-target refusal, live authoring, Session response and metadata-only byte stability. Context validation remains at 0 errors / 22 existing warnings; the 33-file/151-edge graph remains acyclic with 26 existing header warnings. No working store, credential operation or live model was involved.

## Accepted selected lifecycle ports

`TemporalRuntime.selectedSnapshot()` returns detached accepted run fields and the canonical cohort's mode, not a pending prompt or the current native policy. `retainedSelectedCheckpoint(mode?)` binds those same accepted run fields to the actual accepted head and scopes in a v2 native value. Its optional mode is bookkeeping only: it performs no I/O, changes no cache/store/policy and grants no acquisition, recovery or publication authority. Both refuse without an accepted selected cache; the existing retained-counter/field codec still applies. Native pre-runtime policy must use its separate marker contract, never a fabricated boundary.

`persistSelectedPassive(revalidateNativePolicy, signal?)` is a narrow mode-only port, not another semantic transaction. It captures accepted cache identity before waiting, requires an independent synchronous native policy check before/after exclusion, and recaptures exact lifecycle/selected-byte/presence dependencies. Lifecycle bytes are compared **before parsing** so a changed v1 source cannot widen this v2-only read. Matching legacy lifecycle candidates also refuse before semantic body acquisition. Disabled v2 bodies remain unread; acquired private presence remains mandatory.

Run fields derive from recaptured authority, never caller snapshots. The existing selected successor planner alone computes receipts and publication; a lifecycle-only path guard rejects any proposed semantic/provenance write before conversion backup or canonical writes. Passive cannot adopt shared drift, initialize absent owners, fold history, convert predecessors, reset a run or acquire private/parent memory. Stale or missing evidence refuses without replacing the prior cache. Owned current acceptance remains a separate operation. Only successful changed publication replaces cache; a same-policy no-op keeps cache identity so independently queued semantic work survives. Store/callback/single-use/cancellation and rollback rules remain unchanged. Off has no canonical persistence path here.

`tests/runtime.test.ts` witnesses every selection × retention 0/1/7/100, unchanged run/history/revisions/provenance and semantic bytes, detached I/O-free checkpoint capture, acquired/unacquired/deferred authority, excluded corrupt bodies, stale shared/private/lifecycle refusal, pre-parse epoch CAS, no predecessor conversion, source-derived output despite forged candidate payloads, capability lifetime/single use, policy ABA cancellation before lock release, cache ABA, no-op independent owners and failed-publication cache preservation. Direct Passive publication/capability and predecessor-conversion properties live in `tests/storage.test.ts`; the original mixed epoch test is partitioned into runtime early refusal and an independent storage legacy-candidate refusal. Actual policy-ABA-to-Passive-publication propagation lives in `tests/integration.test.ts`. Their shared `tests/lifecycle-fixture.ts` contains setup/inspection helpers only and registers no tests. These internal-port fixtures alone do **not prove native selected attachment**. Their historical port checkpoint preceded the selected native composition and public scope controls described below; it did not enable working-store conversion. Test-file consolidation does not upgrade their proof category.

## Selected read-only observation ports

There is one runtime slot, not an auxiliary store or second backend. Its `observed` variant is explicitly distinct from accepted selected authority. `observedSelectedView()` returns detached read-only values; `selectedView()`, `selectedSnapshot()`, retained selected checkpoint production, selected semantic publication and mode-only persistence do **not** accept this variant. Cached `read`, `readView`, `selectedStates`, `recent` and provenance lookup share the existing temporal readers. A returned token, source snapshot, successful observation or wholly absent store does not grant origin/private/fork/publication permission.

`refreshSelectedShared(selection, revalidateNativePolicy, signal?)` admits only a nonempty Global/CWD subset. The store observer reads only its exact canonical triples and retired-layout presence; it never observes Session/lifecycle files, disabled shared bodies or external artifact/Skill sources. Present triples validate independently, including supported predecessor translation and CWD identity; partial triples, metadata-only orphans, malformed/unsupported epochs, symbolic files and retired layouts refuse. Missing roots remain absent. Requested but physically absent owners stay absent, with no empty stream, revision, provenance key or fabricated Session. CWD-only needs no Global. This is not a fallback for failed required current/private proof: native attachment must independently authorize the new/shared observation path and retain known private failures as unavailable/fenced. Available owners compose at one volatile current-only origin retaining actual owner values/revisions; there is no invented aligned past or durable source maintenance.

`refreshSelectedCurrent(selection, revalidateNativePolicy, signal?)` instead reuses the existing selected current-cohort preflight for fenced inactive restoration or explicit disposable inspection. V1 still requires complete owner evidence before projection; v2 reads selected bodies plus lifecycle and requires acquired-private presence even when Session is excluded. Selected Session requires genuine acquired authority. Aligned proven history remains queryable; valid shared drift becomes current-only observation, **without** publishing that origin. Planned absent shared owners from the acceptance candidate are removed from the observational view using its exact file-presence evidence, not exposed as empty memory. The returned detached snapshot describes source run fields/canonical mode, not accepted memory or the native policy. Known acquired provenance remains sticky after clearing and cannot downgrade into a fresh private origin.

Both paths capture cache identity before waiting, synchronously recheck the independently owned native/inspection request before acquisition and installation, and withdraw on cancellation, ABA or supersession. Failure keeps prior data but does not authorize projecting it under a changed policy; the native adapter must withdraw old requests and reset/rebuild projection. Accepted selected or legacy private memory cannot be downgraded into observation. Clearing values retains the selected-backend fence against legacy all-owner fallback but observation alone does not set accepted-origin authority: a genuinely new owner still needs explicit later origin/acquisition permission, and existing authority still needs owned current acceptance. No observation writes canonical bytes, creates a migration backup, clears a native fence, installs policy or acquires private/parent memory. Automatic Off callbacks must never invoke these ports; explicitly requested Off inspection may use a disposable reader with its own inspection lifetime.

`tests/runtime.test.ts` covers shared requested/present subsets × retention 0/1/7/100 and all seven current selections × those windows; absent/partial/legacy/unsupported/identity/UTF-8/symbolic sources; disabled/lifecycle/private/source-body isolation and v1 full dependency proof; detached data and current-only versus retained history; unavailable-owner omission; explicit later acceptance/acquisition; capability and legacy fences; acquired-provenance downgrade; cancellation before foreign lock release, late acquisition and cache ABA. Negative probes demonstrate that exposing planned absent streams or dropping the sticky-acquisition check fails its focused property. The direct borrowed-observer/capability property belongs to `tests/storage.test.ts`; captured-policy ABA through actual observation belongs to `tests/integration.test.ts`. Their shared `tests/read-observation-fixture.ts` contains setup/inspection helpers only. These are internal read-only port fixtures, **not installed native selected delivery**; native composition and public controls were outside that historical port proof and have separate later witnesses. Test relocation does not upgrade its proof category.

## Selected semantic query admission

`query.ts` keeps one path/projection/reference engine for legacy and selected temporal values. Selected ownership is explicit; malformed-present or missing selection on a selected envelope cannot infer three owners from physical keys. `readStatePath`, `readProjectedState` and reactive `findStateReferenceSources` reject explicit disabled roots before accessing their streams. Disabled paths never become dangling-reference hints. Effective and historical queries use the selected temporal algebra; value/keys/lazy/array projections and canonical references keep their existing syntax and detached outputs.

Reactive reference lookup visits only current selected owners, preserving the existing bounded source/node budget and structured-before-text ordering. It does not inspect excluded state, external source bodies, parent sessions or other history. A batch remains all-or-error, not a partial successful projection. A stored cross-owner reference is still syntax and evidence, not permission to read a disabled owner.

Selected patch queries distinguish actual retained scope records, known no-op boundaries and unavailable deltas. A folded owner patch cannot become an invented `{}` result. Effective patch projection with no retained predecessor also refuses when a selected owner changed at that boundary; an excluded-only boundary remains a proven selected no-op when every selected stream proves no mutation there. A fresh current-only origin grants no earlier effective history and introduces no semantic patch. Legacy full-owner query grammar and retained-history behavior remain compatible. Shared effective-delta construction uses own-property-safe dictionaries so valid JSON keys such as `__proto__`, `constructor` and `prototype` survive creation, update and deletion rather than becoming fake no-op output; this exactness correction applies to legacy projections too.

The selected query properties now consolidated in `tests/query.test.ts` partition all seven selections × retention 0/1/7/100, value/keys/lazy/range/state/patch paths, explicit disabled getters, partial-batch refusal, selected-only hint sources, excluded-only causal boundaries, folded unavailable deltas, current-only origins, detached deletion patches, special-key effective/explicit patch equivalence and malformed envelope/selection refusal. An independent read-only review supplied the inherited special-key counterexample; the focused regression and correction preserve exact projection. This is query admission for the native composition cohort, not proof that the selected native backend or public scope controls are installed.

## Default-all-three native bridge

The native adapter now composes selected acquisition/current acceptance, staging/commit/publication, accepted lifecycle checkpoints and read-only observation through the existing runtime. Default-all-three N1c integration is now accepted on aggregate and bounded independent test-integrity evidence; **public seven-selection activation remains gated**. Enabled non-default selections reject rather than silently widen; native Off can retain a recognized gated selection without canonical memory access. The existing selected policy lifetime owns captured scopes, without another mutable policy holder.

Recognized Active admission failure remains Active-blocked: malformed understood checkpoints, gated subsets and failed required capture cannot silently become inactive/native-context inference. Failure-only inspection uses own data-property descriptors of understood native record epochs; it cannot admit policy, acquire memory or invoke record getters. The newest understood mode header controls denial: an older Active record cannot override a later Off header merely because that header's semantic bookmark is unusable. Explicit Off remains a memory-inert escape, not proof of canonical recovery or permission to widen a captured selection on later Start.

Pending child-copy authority is independent of a native semantic-boundary bookmark. A fresh child resolves/copies the direct parent's current private memory even when ancillary parent checkpoint appends failed. An already accepted child instead accepts its own current memory; pending native reset/checkpoint bookkeeping never grants recopy authority or requires a parent read. Parent bytes remain read-only dependencies. Explicit Start retains accepted semantic values/history/revisions but clears the prior run's prompt and repair validation; Passive mode-only persistence still preserves source-derived run fields.

Unaccepted explicit activation is a proposal, not installation authority over the retained lifecycle: its failure cannot replace that lifecycle or poison an independently waiting Stop. Existing attachment failure still owns required-proof unavailability. Pending auto-start binds a later independent Passive choice inside the existing origin/lifecycle authoring callback; its original Active grant owns acquisition, while Off cancels before publication. No second engine, publication API, dummy patch or revision is added.

While selected attachment is pending, local memory authoring rejects before storage changes. The lost-update witness therefore uses an independently admitted same-physical-session peer after the shared read: stale observation cannot change its accepted canonical bytes or fabricate private cache authority. A later explicit current acceptance reveals that retained private value. This is explicit serialization at the selected admission seam, not an assertion that a formerly permitted concurrent local call still succeeds.

Legacy Stop compatibility retains the prior reader's treatment of an invalid optional `from` anchor as absent while preserving a valid `at` cutoff. This narrow translation does not relax lifecycle-v2/native-v2 anchors, malformed selections or epoch admission. The pure policy family covers owned/unowned markers over all seven selections, alongside the native reload/cutoff witness.

The native-composition group in `tests/extension.test.ts` and the direct first-authoring contract in `tests/runtime.test.ts` cover atomic first authoring, exact CAS/rollback, unavailable-private refusal, current-memory attachment, policy/fork boundaries, explicit-Start run reset and a later Passive/Off origin-publication boundary. Negative witnesses reproduced the missing Active fence, empty boundary-less fork, stale prompt and legacy cutoff failure before correction. The original N1c composition family had 12 tests; the combined native/query/policy/fixture cohort passed 338/338, and the secondary five-file fixture family passed 72/72. The N1c full `npm run validate` passed build/typecheck, **1112/1112 tests with zero failures/cancellations**, compiled import and the 125-file dry-run package check. The SDK migration preserved response/private-proof assertions; the false bootstrap/compiled-history cases and known registration-removal SDK witnesses now pass. The earlier owner review approved its lifecycle slice after 93 checks. A later independent SDK/provenance review passed 122 checks but reproduced two raw-evidence losses. Their corrections, including an explicit-empty follow-up, are independently verified. The last ten aggregate failures were adjudicated without production changes: seven SDK cases asserted obsolete policy/checkpoint shapes, one SDK case incorrectly expected stale shared model-cache exposure through required-private failure, and two runtime cases used a pre-native reload API or obsolete Off marker. Exact owner-bound policy records remain distinct from accepted semantic boundaries; failed private proof blocks all model reads/provider fallback, refusal preserves bytes, and explicit repair changes only permitted bootstrap lifecycle. Sparse selected reload remains read-only, not accepted publication authority. Independent final review reran all eight SDK and two runtime cases and approved this bounded test-integrity closure. Counts overlap the aggregate and are not summed. Remaining work and ownership live only in [BACKLOG.md](../BACKLOG.md). The separately completed compiled SDK/faux probe installs only the compiled factory (the source factory is disabled), with isolated roots and explicit in-memory fake credentials/provider. It proves default-all-three Off inertness, Passive observation without acquisition, first authoring, accepted answers, bootstrap expiry/provider-history suppression, current-memory resume and stale owned-patch refusal after in-flight mode ABA. Both probe cases pass and were independently rerun; this is not public-subset or live-model evidence. No working-store rollout or live-model result follows from this bridge.

## Configured scope defaults and native capture

`config.ts::loadStateFlowConfig` now admits optional global `scopes` through the existing `captureScopeSelection`, returning frozen detached canonical values. All seven sets and their input permutations are valid policy data. A missing config/property uses all three; malformed-present values, unknown keys and other invalid settings still fail before extension registration. Scope errors expose a fixed path diagnostic, not the input payload. Legacy mode aliases, explicit mode precedence and read-only load-time settings remain unchanged. No file is rewritten and this value grants no memory participation.

The native resolver and policy-lifetime fallback now use these loaded scopes, not a hard-coded all-three value, only where the current owner/branch lacks captured policy. New and first-upgraded legacy attachment records concrete owner-bound v2 native policy before acquisition. A valid policy is captured even when the subsequent enabled-subset gate refuses it: failure must not leave a future reload free to resample a wider global default. Malformed/unknown policy still fails before any successful capture. Capture is policy-only, never an accepted semantic boundary, current cache, origin permission or acknowledgement of a persistence fence.

An existing registration retains its loaded defaults until reload. Recorded branches retain their scopes over reload/resume, later global edits and mode-only Off/Start; a fresh independent owner after reload samples the new default. Off forks inherit their source's concrete scopes into a detached child-owned pending record, not the child's later global default, and cold Off resume preserves that pending choice without parent-header reads. No native subset memory activation or public scope-selection controls are installed: the existing enabled non-default guard remains before canonical acceptance. Active denial stays inference-blocked; unavailable Passive does not acquire a memory view merely because its tools are declared.

During integration, after config data admission but before native binding, negative witnesses reproduced configured CWD being replaced with all three (including unintended all-three auto-start). Binding the loaded default and capturing before the separate activation guard closes that integration gap. Independent review approves this bounded DATA/capture slice and separately reran the 84 owner checks and all three compiled cases. The owner cohort passes 84 checks: config permutations/malformed fields, 33 new native policy-capture/legacy/gated/Off-fork witnesses, existing composition and selected-policy/Off families. Fresh full `npm run validate` passes **1148/1148**, build/typecheck/import and package125. The separate compiled SDK/faux probe passes three cases, including a persisted same-physical-owner Off policy/resume versus later all-three defaults and refusal of a widening mode-only Start. The probe persists an ordinary native answer before reopening Pi's lazily written session file; it does not fabricate a semantic boundary. These counts overlap and are not summed. This is data/capture preparation, not public seven-selection acceptance, live-model quality or working-store rollout. Remaining work and review ownership live only in [BACKLOG.md](../BACKLOG.md).

## Guarded nonfork native selection binding

The nonfork native adapter now captures the current concrete policy selection for current/fenced observation, accepted attachment, pre-runtime independent acceptance and explicit activation. That value replaces hard-coded all-three arguments to these selected runtime ports and is compared during asynchronous ownership checks. A later independent Passive mode choice remains allowed under its existing owner when the scopes are unchanged; this value comparison is not a new standalone scope-ABA receipt or public chooser lifetime.

Pre-runtime Passive and its read-only loader derive only the selected shared subset. If there are no selected shared owners, they do not widen to Global/CWD or invent an empty observed cohort. First patch forwarding also uses the captured native policy. Explicit new Active now uses the same atomic first-authoring port as automatic start, accepting origin/lifecycle at step/revision zero without a dummy semantic transition or separate private-init API. The existing store/callback lifetime and accepted-publication-finality rules remain.

**Preparation boundary:** The enabled non-default guard and scope-command refusal are unchanged. Fork attachment now has the separately reviewed canonical-deferred disposition below, but fresh shared-only native creation is prepared below but remains unexecuted behind the subset guard; selected facility/response/handoff completion and the whole native matrix remain required before enabling subsets. The Session-only Passive branch is prepared code behind that guard, not a claim of native Session-only execution. Explicit Off operator inspection remains a separately requested disposable reader, not model participation or origin authority.

A negative native test showed explicit Start previously skipped the common first-authoring port; it now observes exactly one call with captured scopes, no pre-existing lifecycle/cache, one genuine origin and one accepted native checkpoint. The old Telegram failure-injection target changed from private acquisition to this actual port; its same completed-failure/menu-revocation assertions still pass. Fresh full validation passes **1175/1175**, typecheck/build/import/package125; six compiled cases pass, including real SDK explicit Start through the compiled common port exactly once. The focused five-family owner run passes 112 tests. Counts overlap and are not summed; this does not expand the supported enabled selection beyond all three. Independent review reran 189 native/config/context/Telegram checks and all six compiled cases and approved this bounded preparation only. Scope A→B→A must invalidate owning restoration/activation/observation work before public selection is enabled; value equality is not that proof, and a full mode-bound receipt must not cancel the separately permitted latest Passive choice. Remaining work ownership lives only in [BACKLOG.md](../BACKLOG.md).

## Canonical fork disposition before native copy

The internal `TemporalRuntime.inspectSelectedLifecycle` port returns detached **header data**: stored canonical selection (or supplied captured defaults for legacy v1), private acquisition state, and the same filtered run-field projection used by accepted snapshot reads. Its storage owner admits lifecycle/config and required private **presence**, without opening any semantic checkpoint/patch/metadata body, selecting a semantic cache, migrating, publishing, creating a missing root, or granting private/fork authority. Missing lifecycle differs from malformed/partial/foreign/future lifecycle. Returned fields are not accepted checkpoints or copy capabilities; even a deferred record cannot authorize current Session reads. Existing boolean presence classification delegates to this port. Known lifecycle/acquired-private observations are denial-only sticky facts: a later loss or downgrade cannot become a fresh empty origin.

Native pending-fork attachment uses this disposition rather than treating every existing lifecycle as acquired child-current:

- An acquired child uses current acceptance and never reads or recopies the parent, including after native reset/checkpoint failure.
- A canonical deferred child whose captured policy includes Session uses the existing exact selected base and `fork-deferred` copy engine. Independently admitted native direct-parent identity is still required and checked outside/inside exclusion as before. Child step/specification/bootstrap remain source-derived, not reset to a fresh run or replaced by parent run metadata. Source-byte/private/causal proof requirements are unchanged.
- An independent `unacquired` lifecycle is not deferred-parent authority: a pending fork cannot promote it or silently acquire empty Session.
- The prepared Session-excluding **existing** child-current path retains the native pending-copy fact until genuine acquired private state is known. A **new** shared-only native fork now has the guarded mode-only deferral binding described below, but enabled non-default policy still refuses before memory acquisition; it is not temporarily widened to all three. Enabled nondefault policy remains gated before these native branches.

Copy publication uses the already existing single-use origin author callback to sample the latest independently requested Passive mode inside exclusion; it does not resample scopes or change metadata from a stale native bookmark. Accepted native state is projected from the actual published cohort. Off withdraws the original operation before publication; accepted memory remains final if ancillary native reset later fails. A later explicit Start independently clears an old specification/validation under its existing contract—this is separate from preserving run fields during copy.

The reproduced native all-three/canonical-deferred case previously failed with `Session requires explicit private acquisition` after boolean presence chose ordinary current acceptance. It now copies parent-current data while retaining child step 3/shared run fields. A counterfactual fixed-snapshot author failed newer-Passive retention (`active != passive`); sampling mode at the existing author boundary closes that race without a new engine/API. Added fixtures cover header-only 7×7 stored/requested selections, detachment/no cache/no migration, missing/deferred/malformed source, sticky private loss, cancelable/stale waits before header IO, native deferred acquisition/Passive/Off/reset failure/cold no-recopy, and unacquired refusal.

Fresh aggregate **1182/1182**, affected seven-family owner **121/121**, and compiled **7/7** pass; counts overlap. The compiled suite has five native SDK cases (one with an explicitly lower-runtime seeded canonical deferred child) and two lower-runtime cases. The seeded case observes preserved fields at genuine copy publication, then verifies intentional explicit-Start specification clearing. It does **not** demonstrate native Session-excluded fork creation or public seven-selection delivery. Independent review approved this bounded all-three/deferred closure after 164 affected checks and the same seven compiled cases; no source change was requested. Scope-ABA ownership, fresh shared-only deferral, automatic/first-mutation unacquired composition, facility/response composition and full native matrix remain gated work in [BACKLOG.md](../BACKLOG.md).

## Explicit native first-Session activation

An explicit Active Start may accept a valid lifecycle-v2 `unacquired` shared source under its already captured native all-three policy. **The live Start owner supplies the permission**; header inspection only selects the existing `unacquired` transaction and exact old selected base. Ordinary Active attachment/resume still fails closed when Session needs acquisition; Passive acceptance does not inherit the Start grant. This is not an implicit policy/default change or support for enabled non-default scopes.

The controller reuses `withSelectedSessionAcquisitionTransaction` plus its existing synchronous author callback. The acquisition request first preserves exact source run fields; the author invokes normal Start transformation against that admitted source snapshot. The source step remains unchanged, while old specification/validation are deliberately cleared by Start. First Session is a genuine empty origin with revision zero and no fake semantic patch; existing shared values/revisions are preserved. Native checkpoint/cache installation follows successful canonical publication only.

A same-owner accepted Session takes current acceptance directly, never fresh acquisition—even if a later header claims `unacquired`. This avoids redundant classification I/O for known current memory and preserves its existing ownership/Stop behavior. If an existing same-owner runtime has cleared/excluded its cache, its header inspection still applies denial-only remembered private knowledge before a fresh activation candidate can proceed. A new candidate cannot escape known acquired-private refusal. These are bounded in-process proof duties, not universal writer authentication across forged stores/restarts.

Deferred/fork-pending state is never independent empty-Session permission; canonical acquired state missing required private presence and malformed/future lifecycle refuse. Exact shared or run-field drift/header loss between inspection and acquisition fails CAS without overwriting a peer. Newer Passive or Off withdraws the unaccepted explicit Start; unlike independently owned restoration's latest-Passive handling, the obsolete Start does not install its result. After publication, native checkpoint failure cannot undo acquired memory, and later Start uses current rather than reacquiring.

New regressions cover three prior shared selections, policy/port identity and single genuine checkpoint, passive run-field reset versus preserved source step, no dummy private history, Active resume refusal followed by explicit acceptance, newer Passive/Off, shared/run/header-loss CAS, deferred/pending/acquired-loss/future refusal, accepted-publication finality and same-owner private denial with both present and cleared caches. The original Start/source regression failed because ordinary current acceptance left Session unacquired. A counterfactual initial new-route implementation without remembered-private guards incorrectly accepted a rewritten unacquired source after live private acceptance; the new denial witnesses close that regression. Existing held-Stop/failing-Start/coalesced-Start tests remain unchanged and pass.

Fresh full **1189/1189**, affected six-family **215/215**, and compiled **8/8** pass (overlapping counts). The compiled suite has six SDK cases, including two explicitly lower-seeded canonical fixtures, and two lower-runtime cases. The new actual SDK Start performs exactly one `unacquired` call, preserves source step 4, clears old run fields, creates Session at revision zero, and subsequently accepts a genuine original request/new answer without exposing the old repair/specification. Independent review approved this bounded slice after 103 source/lower cases, all 116 unchanged extension cases and the eight compiled cases, plus an uncounted cleared-cache/removed-header refusal challenge. No source change was requested. This does not establish native subset authoring/activation or fresh Session-excluded native fork creation. Automatic attachment permission, first-mutation/facility composition, scope-ABA and the coherent full matrix remain separately owned by [BACKLOG.md](../BACKLOG.md).

## Native first mutation over an unacquired source

With a live enabled all-three native participation/request receipt, first `patch_state` may acquire a truthful existing `unacquired` Session and apply the staged patch **in one publication**. This permission comes from the owned receipt/policy and current physical context—not model arguments, lifecycle inspection, absence, or generic new-session-origin permission. The common patch guard binds receipt owner/CWD and selected physical storage key to the actual context; a raw host call cannot borrow another native owner's receipt. Public SDK model calls still require their original tool receipt; the existing raw-domain allowance requires no active model request/operation signal.

Without accepted cache, header disposition supplies only the stored selection/run-field data. Exact-base `unacquired` acquisition and the existing synchronous author callback feed the same selected staging/commit engine as normal patches. Only selected owners are inspected for change; first-authoring metadata starts from the admitted author snapshot, not stale native lifecycle. A material patch advances source run step 4→5 while preserving Passive specification/validation/bootstrap. A valid semantic no-op may accept the explicitly authorized origin only: no counter increment, no fake private patch/revision, and repeated no-op writes nothing.

An accepted cache stays on the ordinary current-patch route. Deferred/pending forks do not become empty Session, and an acquired source without accepted cache is not reinterpreted as unacquired. Remembered private denial survives cache clearing. Malformed drafts publish no lifecycle/private state. Abort, Off and policy A→B→A withdraw the old first mutation; equal Passive policy preserves it. Source semantic/run/header-loss drift fails exact CAS without peer overwrite. Accepted memory remains final after native checkpoint failure; retry is a semantic no-op.

Regressions check an actual single private-metadata replacement (no empty intermediate publication), source run fields, three prior shared selections/no-ops, foreign physical context, malformed/deferred/pending denial, cancellation/equal-policy/ABA, semantic/run/header CAS, private knowledge with both accepted/cleared cache, and post-publication failure. The original `new` dispatch failed on existing lifecycle. A counterfactual stale native snapshot reset step to 1 instead of 5; a raw foreign context also originally borrowed policy until the physical-owner guard was added. Those guards are substantive source fixes, not fixture adjustments.

Fresh full **1197/1197**, focused owner **119/119**, compiled **10/10** pass (overlap, not summed). Eight SDK cases include four explicitly lower-seeded canonical fixtures; two cases are lower-runtime only. New SDK coverage admits a genuine original Passive first patch, preserves an equal-policy request, does not persist the Passive ordinary answer as Session response, and reports the old tool as an error after mode ABA while preserving canonical bytes. Existing provider-input assertions remain; the new first-mutation probe checks native user input/absence of old specification-repair and verifies retained shared data after publication. That sequence introduced a source after Passive observation; it does **not** establish per-turn external-source refresh. The separately validated [pre-runtime Passive input boundary](#native-pre-runtime-passive-input-observation) below proves source visibility at mode entry/reload before mutation; the enabled-subset facility/input matrix remains separate. Independent review approved this bounded mutation slice after 258 affected native/lower cases, 39 lifetime/facility cases and the ten compiled cases. It explicitly confirmed that the pre-mutation Passive input limit is not a fixture waiver or full facility acceptance. No source change was requested. No new runtime API/format/backend or partial-scope activation was added. Remaining work is owned only by [BACKLOG.md](../BACKLOG.md).

## Native pre-runtime Passive input observation

An admitted lifecycle's existence is not proof that its Session has been acquired. In the native pre-runtime/auto-start arm, a live Passive choice with Session participation and explicit `unacquired` header disposition selects the existing shared read-only observer, rather than required-private current acceptance. Header DATA chooses this route only; it supplies no private/fork grant, accepted cache, run-field adoption or publication basis. The native run snapshot remains empty Passive data; stored source step/specification/bootstrap/repair stay internal until a separately authorized semantic acceptance.

The distinction is made **before** current acceptance, never by catching a required-private failure and retrying shared memory. Acquired and deferred dispositions still require the original current/private proof. Attached semantic checkpoints, fenced current restoration and native forks retain their separate arms. Ordinary Active restoration cannot borrow this route or acquire an unacquired Session, and occupied/malformed/unknown lifecycle evidence cannot turn into an observation permission. Missing owners are omitted, not fabricated.

Header inspection is awaited under the existing owner/physical-session/scope/controller checks. A newer independently owned Passive choice during that wait must be sampled after the await, not defeated by the earlier Active value; Off withdraws the old owner. This mode sampling affects the admitted unacquired observation branch only. A wholly absent source keeps the existing atomic auto-start origin behavior, including a newer Passive mode. No extra policy holder, epoch, lease, API or backend is needed.

**Freshness boundary:** Shared state present at Passive entry or public reload reaches actual first provider input before a Session mutation, with canonical bytes/presence unchanged and private disposition still unacquired. A source introduced after an existing observation does not silently become current on each ordinary user turn; public reload establishes a fresh observation. This is not a blanket waiver of the earlier missing-input witness and not a new disk-polling promise. Accepted patch acknowledgement/tail visibility and frozen-head semantics remain distinct from initial input visibility. A predictable authored leaf may need no redundant `state_updates` receipt; the native call and successful matching acknowledgement remain visible.

The Passive-input group in `tests/extension.test.ts` has nine real-SDK cases: the three shared lower seed sets Global/CWD/both at mode entry and late-source reload, plus Active/deferred/required-private-corruption refusals. Actual detached provider inputs are parsed and asserted after prompt completion: one Passive head, source strategy/cards, owned system section, no source run instructions/lazy/external body, exact canonical proof at first invocation, then an original first patch preserving source run fields at step 4→5. Source body read/open attempts on exact registered paths are counted, thrown and asserted outside the handler/hasher; metadata stat is permitted, with no all-FS/async/alias-path claim. A tenth native-handler race property suspends admitted header inspection and proves newer Passive observation or Off withdrawal without canonical writes. It is not labeled SDK original-call-ID evidence.

Full validation passes **1221/1221**; compiled **17/17** comprises thirteen SDK cases (seven explicitly lower-seeded canonical fixtures), three lower-runtime cases and one native-bound lower adapter. Three new genuine compiled SDK cases prove CWD mode-entry input, Global+CWD late-source reload input and public newer-Passive control during header inspection. Counts overlap source validation. Lower seeding is not native subset-origin creation; native participation remains all-three throughout these cases. Independent authority/input reviews approved the base boundary. The coordinator subsequently reproduced the newer-Passive header-wait counterexample despite that bounded approval; its narrow follow-up independently passed 216 affected tests and all 17 compiled cases and verified the correction. Those overlapping cohorts are not summed, and approval is not exhaustive interleaving assurance.

**Remaining boundary:** Complete native ordinary-source/query/rehydration facilities, enabled-subset Skill/input/response/handoff behavior and the coherent native seven-selection matrix before public activation. No working-store conversion, credential/live-model evidence, release or wider private/fork recovery is earned here.

## Guarded fresh shared-only fork deferral

The native fresh-fork branch for a captured Session-excluding selection is now bound to the existing `withSelectedDeferredForkTransaction` engine. It admits selected shared owners plus a child-owned deferred-private lifecycle; it does not call `forkSource`, read the native parent header/session store, open excluded private bodies or create a dummy Session. Selected Global/CWD storage is still ordinary selected shared evidence, not parent-private acquisition.

The existing runtime port gained one narrow optional synchronous `modeAtPublication` sampler. This is **mode only**, not an arbitrary author/run-field callback: it is invoked once by the existing origin-author lifetime under exclusion, and may replace only mode while fresh child step 0/allowed captured bootstrap remain unchanged. Initial Off, absent independent fork permission or Session selection cannot be rescued by this hook. Mutating the original lifecycle during sampling cannot inject specification, validation, counters or changed bootstrap. Late Off, invalid return data or a thrown callback cannot publish. A post-sampler signal check handles reentrant revocation before the publisher is entered.

The native binding supplies the existing restoration-owner check and latest independently requested mode to that sampler, then accepts the actual published snapshot and appends an ordinary selected checkpoint **without acquired-private reset**. Child native pending-copy remains separate from canonical `privateAcquisition: deferred`; current acceptance, Off and cold reload do not turn it into acquired state. Existing acquired child-current still wins without recopy; later Session participation requires real direct-parent/private proof.

**Preparation limit:** The enabled-subset assertion and scope-command refusal are unchanged. The fresh shared native branch therefore remains unexecuted behind the guard; no native test-only bypass was added. This slice supplies executable lower-port proofs plus guarded source composition, not native seven-selection delivery, native scope-ABA proof, or a promise that all facility/provider inputs already honor subsets.

The original wrapper's pre-wait capture reproduced `active != passive` after a held lock. A new callback's reentrant Abort initially also escaped the publisher guard; the explicit post-sample signal check closes that reproduced edge. Tests cover all three shared selections × four windows × two modes, selected-only open paths, fresh lifecycle capture, initial/late refusal, canceled waits without sampling, single use/expired publishers and accepted-publication finality. A separately labeled DATA composition case uses an actual lower accepted checkpoint and child-owned native records to retain pending through current acceptance/Off/cold inspection; it is not native shared-subset execution.

Fresh full **1203/1203**, focused five-family **112/112**, compiled **11/11** pass (overlapping counts). Eight SDK cases (four lower-seeded canonical fixtures) retain prior all-three/request proofs; three cases are lower-runtime only, including the new late-mode deferral/reentrant-abort case. That lower probe imports the existing compiled internal storage module for its peer lock, not a new package-root export. Independent review approved this preparation only after 122 affected checks and all eleven compiled cases; no source correction was requested. It explicitly excludes execution of the guarded native shared branch and zero-filesystem-activity promises for late rejection. Remaining lifetime/facility/native matrix work and activation gate are owned only by [BACKLOG.md](../BACKLOG.md).

## Native scope-only lifetime evidence and future control duty

The existing native policy/branch entrypoint already supplies scope-only withdrawal: `restoreActiveBranch` invalidates request policy, renews memory-tool lifetime and cancels obsolete restoration/activation owners **before** admitting/capturing the next native scope data or reaching the enabled-selection guard. `SelectedPolicyLifetime` then captures canonical selection with its renewable request epoch; operation slots own their separate work. No new mutable holder, epoch, lease facade or backend is needed for this entrypoint. Scope-value equality alone is still not an ABA receipt.

Four new native callback properties hold actual exclusion while selecting same-mode scope A→B→A: a captured mutation receipt cannot publish or revive; pending Off→Active Start withdraws across all six proper Off scope subsets; obsolete current restoration cannot install cache/checkpoint; and old shared observation withdraws while a fresh A owner reads current peer bytes without publishing lifecycle/private state. Equal Passive policy keeps its existing observation alive. Existing newer-Passive automatic-origin/deferred-copy witnesses retain their independent ownership rules. Native branch selection itself is a superseding event even when values are equal; this differs from an equal-value mode/policy no-op.

Three properties hold a real suspended storage transaction; the observation property uses a synthetic live-PID publication lock and a fixture peer write to exercise the real wait path. Tests record and reject known canonical-file read/open/stat/existence attempts, then assert the recorded list outside native error handlers so a caught I/O assertion cannot masquerade as refusal. Old operations must settle while exclusion is still held, old signals/receipts remain dead after A returns, and stale accepted snapshots/checkpoints cannot appear. Fresh all-three acceptance after release is allowed. Unsupported B under enabled Active/Passive is valid captured **policy data**, rejected before memory work; Off B is fully memory-inert data selection. No test bypasses the subset assertion.

A new compiled **public SDK** case persists native physical identity, stages explicit Start under a held lock, appends owner-bound Off scope data and uses public `navigateTree` selection for A→B→A. Mode remains Off, the old controller withdraws before lock release, canonical-file I/O attempts and byte changes remain zero, and a fresh all-three Start succeeds afterward. This is genuine native Off policy/control evidence, not enabled subset memory execution. The mutation receipt case uses the actual callback's existing idle-host policy capture; original model-request scope ABA is composed with the separately tested request-correlation owner, not falsely presented as another SDK original-tool scope test.

Fresh full **1207/1207**, focused six-family **106/106**, and compiled **12/12** pass (overlapping counts). The compiled suite has nine SDK cases (four lower-seeded canonical fixtures) and three lower-runtime cases. This cohort changes tests/evidence only, no production source or publication format. Independent review approved the current-entrypoint/no-extra-primitive conclusion after 120 affected checks, all twelve compiled cases and typecheck, explicitly preserving the idle-host-versus-original-model and lock/known-file monitoring limits. No remediation was requested.

**Future selector contract:** Equal canonical choice must remain a no-op. A different concrete choice must use the same owned native reselection/cancellation path (or prove equivalent withdrawal), never merely mutate a scopes array or rely on equality becoming true again. Explicit choice/acquisition permissions remain distinct from inspection and ordinary attachment. Direct public chooser behavior, enabled native seven-selection lifecycle/facility/response/input acceptance and final scope-change matrix remain gated; these proofs do not waive them. Remaining work is owned only by [BACKLOG.md](../BACKLOG.md).

## Canonical continuation provenance inspection

The explicit known-header advisory inspector captures only config/runtime before interpreting policy, derives concrete stored scopes with `prepareSessionPolicyMigration`, and reuses read-only selected-current admission. Its optional expected-lifecycle byte guard on `prepareSelectedCurrent` compares the initial two-file basis before a changed epoch could widen interpretation. This byte guard supports legacy inspection; strictly mode-only Passive publication separately retains its v2-before-semantic-body requirement.

V1 requires the complete legacy cohort; v2 reads selected bodies and required private presence. The inspector does not read native transcript or disabled semantic bodies, initialize owners, accept a current origin, convert, install cache or publish. Acquired private presence remains mandatory even if its body is excluded. Malformed/orphaned/unknown lifecycle or semantic authority stays ineligible; cancellation never becomes a fallback recommendation. Canonical eligibility does not inspect native Off/Stop policy, activate unsupported subsets or open a session: the host still owns explicit startup intent and native branch admission.

`tests/continuation.test.ts` partitions all seven stored selections, enabled/inactive canonical modes, corrupt excluded shared bodies, acquired excluded private bodies versus missing presence, exact unchanged bytes, epoch replacement before widened reads, legacy drift, absence/orphans and canceled waits. Native compiled-conversation detection separately recognizes validated v2 boundary checkpoints through the selected codec. Policy-only v2 captures cannot certify compilation; legacy compatibility remains. This closes the false bootstrap that re-exposed already compiled conversation/source bodies in the real SDK/faux continuation witnesses.

The selected provenance cleanup candidate shares one raw-metadata merger across successor and first-origin authoring. Its boundary is only accepted deletion of a previously present registration with interpretable owned evidence, not broad cleanup of unbound or opaque records. After independently reproduced loss counterexamples, deletion eligibility now validates every present recognized field with the artifact owner's existing hash/fingerprint/compiler/string contracts; permissive retained parsing remains unchanged. Empty, unknown-shaped and invalid-known-value records stay raw. This is eligibility to revoke evidence, not stricter admission or a sanitizer.

Fork source capture now carries the exact admitted raw artifact-registry JSON payload separately from parsed evidence, under the same parent byte/presence CAS. The child inherits raw future/malformed records instead of lossy `malformed:true` replacements; no parent lifecycle/identity document is copied as child authority. Raw-only payload changes still conflict even when the parsed sentinel is unchanged, and rollback never writes the parent's foreign edit. The provenance parser/canonical serializer use own data properties for `__proto__`, `constructor` and `prototype`; neither raw inheritance nor valid recognized-key handling depends on inherited setters.

An explicit empty inherited registry remains distinct from an absent one. The merger checks raw member presence before strict finite-JSON equality; it authors inherited `{}` rather than dropping it or comparing undefined as JSON. Eager/deferred × absent/explicit-empty cases reproduce and guard that boundary without changing global equality.

The correction's final owner family passes 86 tests, including invalid recognized values over successor/first authoring, eager/deferred raw copy, subsequent child deletion, raw-only CAS, special keys, empty/absent presence, ordinary seven-selection × retention properties, no-op/Passive publication and rollback. The first correction review verified 89 cases and found the empty-registry boundary; the narrow follow-up independently passed 94 cases and approved its correction. Counts describe distinct, overlapping families and are not summed into an aggregate claim. Remaining review/integration work belongs only to [BACKLOG.md](../BACKLOG.md), not to a weakened preservation contract.

## Selected source-facility admission

`ArtifactAcquisitionState.refresh(states, provenance, selection)` and `missingArtifactRemovals(states, selection)` now accept exact selected sparse owners. Omitting selection remains the legacy all-three contract, **not** inference from missing fields. `state.ts::assertScopeStateValues` owns their shared finite semantic/value-key validation and the existing selected staging admission. Selection is captured/canonicalized first; extra, missing or inherited owner values fail before excluded body getters. No placeholder scope values are introduced.

Ordinary artifact planning overlays only selected registrations in canonical order before source observation. A narrower selected registration masks the broader path; effective Skill registrations trigger no automatic ordinary-source stat/hash/body read. Only effective selected ordinary paths and their matching selected provenance are considered for invalidations/hints. Missing-source maintenance observes exact selected registered paths, including each selected owner of a shared path. Only a positive missing observation emits same-owner deletion patches; unavailable/symlink/nonregular sources are not deletion evidence. Plans and patches are advisory value results, not permission to skip current registration/source checks or canonical CAS.

`ArtifactReadTracker.setCandidates(candidates, selection)` filters excluded owners before path/fingerprint/hash getters. Optional source identity fields may be absent; legacy candidates without scope keep their Global identity and are discarded when Global is excluded, never reassigned to an enabled owner. Selection changes, removed/replaced candidate identity and owner changes revoke correlated pending/successful evidence, so removing/re-adding a plan cannot revive an old read. A successful read must retain its actually captured path and stable before/after fingerprint; a later registered path or mutated executed path cannot borrow a prior fingerprint. `validateArtifactReadEvidence` performs exact selected-path metadata revalidation and rejects missing/unavailable/stale fingerprints. Source body acquisition remains outside canonical exclusion; exact-path metadata checks do not authenticate external future state or replace ownership/CAS.

`SkillReadTracker` captures a concrete selection in its constructor and `select`; selection changes clear pending/successful correlation. Registered ownership still derives from Pi command source provenance, never path shape. A successfully read excluded Skill records **only path/scope**: no hash attempt/error and no impossible compiler obligation. That volatile identity still prevents relocating its compilation into an enabled owner. Selected Skill reads retain the existing optional-compilation policy. `validateCompilations` revalidates current registered path/owner and rehashes **only attempted selected compiler outputs**; unrelated volatile reads are not forced into durable output. This source-body operation must run outside canonical exclusion. Missing/unavailable/changed selected identity fails an attempted compilation, not the ordinary read or another owner's data.

Default `hashSkillSource` now admits only regular non-symlink files. It checks the exact leaf before nonblocking/no-follow open, binds the descriptor identity, hashes the read bytes and verifies descriptor/path inode, size and nanosecond modification/change timestamps before returning. A symlink, special file, replacement or in-capture change refuses; this is a stable identity observation, not a guarantee about the source after observation or a retrospective proof of arbitrary provider-visible content.

`planKnowledgeRehydration` takes optional captured `selection` and discards excluded routes **before sorting or reading source/metadata/hash/provenance/budget fields**. Excluded paths produce no read, materialized hint or deferred entry and consume no budget. Selected route/source owner disagreement rejects; existing new-bootstrap Session deferral and read/byte limits remain. The planner remains pure: no reads, compilation, publication, acquisition authority or native policy installation.

`tests/acquisition.test.ts`, `tests/skills.test.ts` and `tests/rehydration.test.ts` own the selected source properties: every subset, exact-path stat/provenance spies, invalid/extra owner refusal, ordinary/Skill masking, selected missing versus unavailable sources, excluded candidate getters, pending-plan/selection change-away/back, actual path/owner/fingerprint correlation, volatile registered Skills and relocation refusal, source revalidation, stable/nonregular/changed Skill hashing and pre-sort rehydration isolation. Setup-only `tests/source-facility-fixture.ts` is shared without suite registration. The genuinely composed isolated real-file witness in `tests/integration.test.ts` acquires selected ordinary/Skill records outside exclusion, then compiles/removes only selected registrations through the existing staging/commit/publisher with external source-body opens forbidden under the mutex. Native callbacks/settings, selected diagnostics and request epochs are not wired by this helper boundary. M2.3a passed **60 focused owner checks** and full `npm run validate`: **1005 tests, 0 failures**, tracked build/import parity and a 125-file package inventory. A compiled real-file probe confirmed selected ordinary/Skill acquisition, stable hashes, disabled hash isolation, rehydration filtering and publication through the shared selected engine. Context validation remains at 0 errors / 22 existing warnings; the 33-file/154-edge local graph is acyclic with 26 existing header warnings. No working store, credential operation or live model was involved.

### Guarded native Skill selection binding

The native composition's `syncStateFlowTools` captures the matching current owner/CWD policy selection once and passes that same value to `requestPolicy.select` and the existing `SkillReadTracker.select`, before the tool-availability early return. Thus an already-Off/equal-tool-list path still binds captured scope DATA; native policy capture does not leave the tracker at its constructor's all-three default. No new scope holder, epoch, API, lower compiler or hash implementation is introduced.

A negative witness reproduced the missing binding on the actual extension-created tracker: after native Off/CWD capture, a **direct lower tracker invocation** for a registered Session Skill returned a body hash instead of ownership-only metadata. This was not Off native hooks hashing or an enabled-subset leak. The binding reuses the existing lower filter: disabled registered owners retain only path/scope, without source stat/open/hash/error or a durable compilation hint. This restricts State Flow attribution/compilation acquisition, not an independently requested native tool's ability to read a file. Existing Active/current-request hook fences, ownership checks and source hashing outside canonical exclusion remain unchanged.

The native-skill-selection group in `tests/extension.test.ts` exercises all seven **Off DATA captures with native-bound lower tracker invocation**, not enabled-subset hooks. Selected owners yield valid hashes, excluded owners yield exact ownership-only evidence; source stat/open attempts are recorded and asserted outside the hasher's catch, with canonical bytes unchanged. Actual native tree DATA CWD→Global→CWD clears old pending correlation without relocating ownership. Cold retained CWD versus later Global defaults uses a distinguishing Global Skill: retained CWD forbids its source hash, while a fresh branch under Global permits it. The all-three source handler test retains hash proof/hints through compilation and clears accepted acquisitions.

Full validation passes **1211/1211**. Compiled **14/14** comprises ten SDK cases (four explicitly lower-seeded fixtures), three lower-runtime cases and one native-bound lower Skill adapter case; counts overlap source validation. The new genuine SDK case reads Global/CWD/Session Skills, checks owner-specific hints, compiles runtime hash provenance and rereads a current Skill without an acquisition hint. The new Off/CWD adapter case directly invokes the compiled native-bound tracker and asserts no excluded source I/O. Neither supplies native enabled-seven coverage. Independent bounded review approved the binding; its cold-witness limitation was corrected with the distinguishing owner/control rather than waived.

**Remaining boundary:** Native ordinary-source/query/rehydration/provider inputs, complete Skill hook/facility behavior under enabled subsets, response/handoff and the coherent native seven-selection matrix remain gated under the canonical backlog. No pre-mutation Passive source/context freshness proof, public chooser, or permission to remove the subset guard is earned here.

### Native source callback and planning boundary

Native source callbacks first validate original ID/name/lifetime (or the existing no-signal/no-active-request raw eligibility), then bind current policy, cached runtime and actual callback context by native ID, CWD and storage key. Only an admitted callback can inspect source input or enter ordinary/Skill tracking, fingerprint/hash work, hints or State Flow barrier attribution. A foreign completion cannot consume a legitimate pending read; the rightful completion may still finish it. Source callbacks do not consume original IDs themselves, since start/call/end/result are phases of one execution. Attempted Skill compilation also invokes the existing caller/receipt check **before** source rehash; the body hash still runs outside canonical exclusion, and locked author/publication checks remain. An ultimately denied foreign compiler must not open an owned source first or consume the rightful read evidence.

Failure here **skips State Flow attribution**, not the ordinary native tool. A foreign ordinary read is not blocked by another owner's patch barrier; the rightful same-owner sibling still is. An unsupported Active subset may be captured as DATA and denied; returning to equal all-three values cannot revive old ordinary/Skill pending evidence. Existing policy withdrawal and tracker clearing suffice; no new epoch, holder or grant is introduced.

Ordinary planning already passes the validated available `view.selection` into `ArtifactAcquisitionState.refresh`; pre-inference missing-source maintenance passes the transaction's selected states/selection. Sparse Passive CWD observation therefore plans only CWD, even while native policy remains all-three; it neither fabricates absent Global/Session nor acquires them. The actual SDK sparse witness checks explicit selection/state/provenance owners, visible card data, no automatic external body read and unchanged canonical files. Five source-handler properties separately cover foreign/raw/original callbacks, rightful pending completion, scope DATA ABA, foreign barrier independence and caller admission before compiler rehash; host-declared callbacks are not mislabeled actual SDK body reads.

The native rehydration contribution is **phase metadata only**: `contextView` emits `knowledge_rehydration: { phase }` or null. `extension.ts` imports the phase type; it does not execute `planKnowledgeRehydration` routes. That existing pure helper filters selected routes before paths/sort/budgets and remains advisory. There is no missing automatic native route/body/budget executor to invent; actual source reads remain explicit native tool actions. This audit does not authorize removing the helper or deciding later public API work prematurely.

Full validation passes **1236/1236**. Compiled **24/24** comprises twenty SDK cases (seven lower-seeded canonical fixtures), three lower-runtime cases and one native-bound lower adapter. Two new cases deliberately inject foreign **callback** contexts for actual ordinary/Skill SDK reads: the native file tool still returns its body, but State Flow tracking/hints/stamps stay absent and an independent patch incurs no borrowed compiler obligation; CWD canonical bytes remain unchanged. A third added SDK case first acquires a rightful Skill, injects a foreign compiler execution context, observes owner refusal with zero rehash calls/source opens and unchanged CWD bytes, then compiles successfully under a fresh original owner ID. These are explicit adapter faults, not normal SDK foreign-context behavior or host authentication. Compiler-shaped semantic data is not itself a trusted runtime compilation; no new semantic-card rejection policy is earned or required here. Initial callback review approved the bounded binding/phase audit. A subsequent coordinator counterexample demonstrated source opens before an ultimately refused compiler; independent follow-up verified the reordered admission, rightful evidence retention and outside-exclusion hash after 97 affected tests, four scoped extension tests, seven source/rehydration SDK tests and all 24 compiled cases. These overlapping cohorts are not summed.

Enabled native subset source/Skill/query/facility acceptance, response/handoff and the coherent seven-selection matrix remain separate gates. Source-plan/default-all-three preparation and a real sparse observation are not native enabled-subset execution.

## Policy versus authority representation

The following are distinct, runtime-owned facts, not proposed semantic planes or user-patchable fields:

- **Requested policy:** The operator's selected mode and nonempty scope set.
- **Validated model view:** The values actually available under that selection, with a volatile projection identity.
- **Accepted lifecycle authority:** Proven physical session identity, lineage, and publication basis. Session config/runtime may exist even when Session semantic memory is excluded.
- **Owner acquisition evidence:** Whether private Session semantics have legitimately been acquired, remain intentionally unacquired, or await a specific fork copy.
- **Operation lifetime:** The immutable selection/request ownership captured before asynchronous work; changing away and back must still revoke older work.

**Recommended design for D4:** Represent nonparticipation explicitly rather than passing an invented empty `ScopeStream` into a fixed three-owner record. Keep selected semantic owners separate from excluded raw file/CAS evidence and the proven lifecycle/causal spine. This is a finite existing-owner distinction, not a generic scope-provider registry or a second store.

An intentionally unacquired Session stream must be distinguishable from loss/corruption of an already acquired private stream. A new shared-only session may have lifecycle authority without private semantic files. Once Session semantics have been acquired, their unexplained absence remains a fail-closed error; switching scopes does not reset acquisition provenance and grant empty initialization.

The minimum representation needs durable acquisition provenance under the current physical session identity. The exact field/envelope is open; do not infer “never acquired” solely from missing semantic files, current `scopes` excluding Session, a zero revision, or the absence of a patch in a sparse lineage. Legacy complete accepted runtime evidence implies acquired private memory under its existing contract.

### Verified affected seams

- `lib/runtime.ts::loadPassiveBase` currently requires Global when CWD exists and manufactures unused empty CWD/Session streams for its all-owner temporal view. CWD-only selection cannot reuse that prerequisite or mistake those compatibility views for real selected owners.
- `loadCurrentMemoryBase` currently requires a private Session stream, binds it to runtime lineage, and loads all scopes. The new shared-only authority cannot weaken private identity or use missing private files as an empty replacement.
- `publish` / fork-origin acceptance and `lib/storage.ts::decodeFileCohort` currently assume complete all-owner cohorts. Filtering context alone would still initialize/fold/serialize disabled owners or reject a legitimate selected-only cohort.
- `lib/temporal.ts` validates a complete three-owner record and requires semantic witnesses for lineage transitions. An offset whose only historical patch belongs to a now-disabled owner must remain a proven causal boundary without exposing its values; simply filtering patches before validation loses that witness.
- Session config parsing is strict and retained-checkpoint parsing has a closed key set. `findBranchPolicy` currently returns mode/fence, not a validated selection. Mode-only extraction is policy evidence only, never semantic or scope-validation authority.

### Disabled evidence and corruption

**Recommended design:** A selected owner must be independently validated for current memory, provenance, and every requested historical boundary. Lifecycle identity/causal authority must also remain proven. Internal capture/validation of disabled evidence is permissible only when needed for that proof or exact CAS; it contributes no values and authorizes no writes.

**Open D4 subdecision:** Whether unrelated disabled-stream corruption can be isolated from all selected-owner operations. Do not promise that result while current lineage proofs require the disabled stream. If a required dependency is invalid, identify that dependency and fail closed. Never decode it as empty or fabricate a history boundary to keep selection available. Any new metadata-only witness must derive from accepted authority, not from a projection ID or guessed native step.

## Selection-aware model access and history

**Recommended policy:** Disabled explicit owner paths are errors in both current and retained-history model reads, and disabled writes reject the whole atomic patch. Batch reads fail wholly. Unscoped/effective reads compose only selected owners; a disabled-owner read must not become a dangling-reference hint or implicit empty object.

Reverse lookup hints, recent transitions, lazy navigation, acquisition notices, cascade paths, and receipts must not reveal disabled-owner values or diagnostic reference owners. Stored references can still name an excluded owner as ordinary unresolved data; they do not authorize lookup, hydration, relocation, or a cross-owner cascade.

Historical effective reads use the currently selected set at the original proven boundary, not that boundary's former selection. Preserve causal identities/positions even when every patch at an offset is hidden from automatic context. A selected owner without materializable history makes the requested effective historical read unavailable; do not return a partially composed success or use a current value at an old boundary.

Re-enabling an owner acquires its current canonical values. Foreign shared drift may require the existing fresh proven-origin reconciliation; selection alone does not manufacture a transition or unnecessarily reset available history. Explain any resulting loss of aligned offsets rather than rebuilding discarded history.

Explicit Telegram inspection follows the captured participating owners: only their buttons/help are offered, and Effective exists only for2+ owners and composes only those available validated streams. A sole owner is already effective. Disposable inspection, including Off, must not install caches, maintain sources, publish, clear fences, or acquire an unaccepted fork parent. Stale excluded-owner/singleton-Effective callbacks reject before readers. Selection is not confidentiality or transcript erasure. Ordinary status must not invent zero revisions for excluded/unavailable owners.

Selection is not confidentiality: already retained native conversation/tool results can contain earlier information. Preserve Pi's trajectory and foreign context; do not pretend selection erases them.

### Native query caller and runtime binding

A finalized original tool ID proves request correlation, not that any supplied context or cached runtime belongs to that request. Before `read_state` accesses parameters or materializes a view, it revalidates the original receipt (or captures the existing raw-host policy), binds policy owner/CWD to the caller, and binds the selected runtime's native identity/CWD/storage key to that receipt and caller. Missing context is denied; it never defaults to the ambient active owner. The same runtime-native-identity check strengthens the existing `patch_state` check before semantic authoring, without moving query access behind publication permission.

A foreign native ID, CWD, or different storage-file key cannot borrow accepted or observed memory. File-backed identity follows the established `.jsonl` **basename stem**; only in-memory identity reconstructs that key from immutable header timestamp and native ID. A changed header timestamp beside the same actual file is not a new persisted storage identity, nor is another directory with the same stem. This is existing storage-address coherence, not host/filesystem authentication. A new policy owner matching its caller and storage key still cannot rebind a cached runtime with a different native ID.

Raw-domain invocation remains allowed only without a context operation signal and without an active native model request; it still needs the actual owned context. SDK calls retain finalized matching one-use IDs. A refused original ID stays consumed, while an independently valid sibling/fresh ID remains usable. Context object identity alone is not required: a cloned context with the same owner/CWD/address is valid. Read-only shared observation remains readable without inventing Session; a Passive write fence does not itself prohibit an already validated same-owner read. Queries acquire no publication/private authority, append no checkpoints and do not poll disk or clear write fences.

The query-owner group in `tests/extension.test.ts` supplies nine source-harness properties: foreign-context current/history/batch/keys/patch refusal before parameters/view calls, in-memory timestamp identity, legitimate cloned contexts, finalized-ID refusal/consumption, unacquired shared observation, cancellation/nonoriginal/missing-context refusal, fenced reads, and same-key policy/runtime owner mismatch in both reads and patches. Canonical bytes, native entries and accepted cache remain unchanged on rejection. After completion callbacks gained earlier physical-owner admission, the two same-key policy/runtime tests assert that foreign `message_end` cannot finalize, then explicitly finalize the real lower correlation object to keep the independent callee guard exercised with original B policy/receipt/ID; this is a named correlation-adapter fault, not normal SDK behavior or a subset bypass. Existing historical/query/reference/Git-no-publication assertions keep their actual SDK execute context; no ambient-default helper or weakened foreign fixture is introduced.

Fresh validation passes **1230/1230**. Compiled **21/21** comprises seventeen SDK cases (seven lower-seeded canonical fixtures), three lower-runtime cases and one native-bound lower adapter. Healthy current/history/batch reads use actual SDK IDs/signals; three additional query/patch cases deliberately inject inconsistent execution-file or native-event/execution-owner metadata and require tool denial plus unchanged canonical data. These are explicit adapter faults, not evidence that the SDK naturally supplies foreign contexts, a universal provider-context guarantee, or host authentication. The earlier foreign-context negative and later same-key/runtime-owner read/patch counterexamples are retained separately. Initial bounded review approved the caller binding; the coordinator then reproduced the runtime-owner mismatch in both tools. Independent follow-up verified both guards after 195 affected tests, 29 overlapping owner/current tests and all 21 compiled cases, without treating approval as an exhaustive ownership proof.

Native enabled-subset facility/query/provider acceptance and the coherent seven-selection matrix remain gated. Selection does not erase earlier native context, and these guards do not grant working-store conversion, release, credential or live-model authority.

### Native response callback ownership

An actual physical/native callback must belong to the current policy/runtime **before** assistant finalization, user-anchor observation, response cancel/claim, native-turn end or body/view access. The completion predicate admits native owner/CWD/storage-key coherence, the attached address, and an actual operation signal when present against the active original operation. It permits the established raw host path without inventing signal authentication or using message-object identity as a request ID. Passive/Off still track their rightful native loop but do not publish ordinary answers.

An ordinary Active completion captures the existing finalized policy receipt, or the existing raw-policy receipt for the no-model/no-operation region. Its response-owned slot retains the captured physical identity, native operation signal and a revalidation closure. A foreign `message_end` cannot cancel a rightful pending answer; a foreign `turn_end` cannot end the rightful request table, spend its pending completion or substitute body text. Only the actual `turn_end` value is reconciled, so post-handler edits/empty-string clearing remain authoritative rather than freezing the earlier `message_end` content.

The same policy/identity check remains before staging and at the existing selected live-current publication checks. Both the capture context and the actual end context revalidate **the once-captured operation signal identity as well as physical identity** over storage waits, even after native request-table end. Pi's context signal is a lazy getter; its earlier value cannot be inferred from the context object or the current ambient predicate after the table ends. Changing A→live B without aborting A denies publication. Failed ownership revalidation in the catch path also suppresses stale diagnostics/UI. The engine still owns Session-only response staging and one accepted completion; publication failure installs nothing and accepted publication is not undone by later cancellation/ancillary failure. No new runtime/Frame holder, epoch, serializer, response inference or relocation engine is added.

The response-owner group in `tests/extension.test.ts` has eight source-harness properties: foreign owner/CWD/file keys deny before message getters/views/bytes; pending response and finalized-answer preservation; original-batch finalize/end protection including wrong-operation signal; same-key new-policy/old-runtime refusal; foreign message while a real response waits for exclusion; actual end-context movement after the wait with no stale notices; independent capture/end lazy signal movement A→B while both remain live; and Passive/Off no answer publication. The initial negative actually persisted `FOREIGN_ANSWER_MUST_NOT_PERSIST` into the current Session, not merely a getter/count failure. These are raw/explicit adapter witnesses, not genuine SDK body/ID dispatch evidence by themselves.

Fresh full validation passes **1244/1244**, typecheck/build/import and package inventory 125. Compiled **28/28** contains twenty-four SDK cases (seven lower-seeded canonical fixtures), three lower-runtime cases and one native-bound lower adapter. New SDK callback-file faults prove native ordinary answer delivery without foreign semantic capture; one foreign end is interleaved before the rightful actual end, preserves exact bytes before the rightful call, touches no foreign message getter, and lets the rightful/fresh answer publish. They are explicit fault adapters, not claims that normal SDK emits foreign contexts or authenticates arbitrary host plugins. Two inherited query native-policy-rebind faults now deny at callback finalization/preflight before the callee; assertions inspect the actual blocked native trace if the next provider is aborted, require the exact batch denial and zero owned executes, and preserve the original no-private-payload/no-publication checks. Separate source correlation-adapter tests retain the callee identity proof.

Compiled reader wiring explicitly captures the compiled factory's existing `onRuntime` port: a source-fixture reader is absent when `stateFlow:false`. Correcting that test-only reader fixed the two initial new-probe TypeErrors; no production behavior or rejection policy was relaxed. Initial independent review requested changes despite green 1243/26: actual end-operation identity could move after admission and still publish. The retained eighth-property negative reproduces the review's R1. The local fix compares original signal identity in both closures, keeps the policy receipt alive across native end and suppresses unowned notices; two additional real SDK **explicit signal-getter fault** cases move end/capture signals during real exclusion with A still live, observe unchanged bytes/no notice and delivered text, then accept a fresh ordinary answer. Old built 26-case output fails those new probes before rebuild; the rebuilt candidate passes 28. Independent follow-up **VERIFIED / APPROVE** closes R1 for this default-all-three cohort after 253 affected tests, typecheck and all 28 exact compiled cases. Both capture/end movement are denied while raw compatibility, actual final answer, current/CAS checks and accepted-publication finality remain. This is not whole-M2 or enabled-subset approval. Counts overlap and are not summed. Native enabled-subset response/handoff, coherent seven-selection lifecycle/facility/input acceptance and actual guarded shared-only native fork creation remain open before public activation.

### Native input and frozen-handoff caller ownership

The existing private native-owner predicate is shared by completion and contribution hooks (now named `currentNativeContextOwner`; no new holder/API). `before_agent_start`, `context`, `context_with_system` and optional `before_provider_request` admit policy/runtime/caller native ID, CWD, storage key, attached address and original operation when present **before** input messages/prompt sections, cached view/source refresh or preparation. The installed SDK supplies a physical context even for the no-operation `before_agent_start` hook; it remains capture-only. Foreign calls return no State Flow contribution and do not rewrite native messages/foreign sections or borrow A's frozen Stop handoff.

Active preparation captures its actual context identity and original signal; the existing native request lease is not a substitute for this caller. Those checks run in the selected transaction and at current/publication revalidation over waits. A moved file/owner/signal cannot publish a stale specification or perform maintenance as the prior caller. Capture/slot/current/CAS and accepted-publication finality stay separate. The post-context system membrane and optional transport checkpoint also require accepted pending Active preparation for their **rightful current original request**, fencing through existing guarded public Abort rather than treating a skipped/failed callback as native-history inference fallback. They do not turn a foreign entry into a global abort or cancel newer control ownership.

The input-owner group in `tests/extension.test.ts` has seven source-harness properties: foreign Session projection denial before message/view/source-refresh access; frozen Stop handoff ownership and Off omission; foreign prompt cannot replace captured specification/sections; foreign system/transport hooks skip payloads/Abort while the original input remains usable; actual owner/operation movement during real exclusion rejects specification publication and the rightful post-context hook fences inference; same-key policy-B/runtime-A refusal; and legitimate cloned idle contexts preserve read-only input/native messages. Both operation signals in the movement property stay un-aborted. These are source adapter properties, not seven SDK dispatch cases.

The initial negative actually returned `OWNER_A_PRIVATE_INPUT` in an automatic Passive memory head to a foreign callback. Current full validation passes **1251/1251**, typecheck/build/import/package inventory 125. Compiled **32/32** contains twenty-eight SDK cases (seven lower-seeded canonical fixtures), three lower-runtime cases and one native-bound lower adapter. The prior 28-case probe is preserved unchanged; only four cases are appended in this cohort. They fail against the old built 48 candidate before rebuild and pass against current output.

Two new SDK **context-file fault adapters** omit the automatic current Passive head or frozen Stop head, deliver the actual native answer and accept a later rightful input without canonical changes. They deliberately preserve earlier native trace, including prior tool arguments containing A data: this is no automatic foreign projection, **not erasure/confidentiality of already retained native context**. Two further SDK file/signal-getter faults move the actual preparation context during real DIST exclusion; stale preparation leaves exact bytes unchanged, the rightful post-context membrane admits zero provider calls before preparation acceptance, then a fresh original operation succeeds. This is explicit adapter-fault/interleaving evidence, not ordinary SDK reachability or host authentication. No unsupported native subset is activated.

Frozen state still comes from the admitted available selected view; the seven-selection enabled-native handoff/input/facility/lifecycle matrix and guarded shared-only native fork execution remain separate gates. Idle/raw host compatibility, source-outside-exclusion, lazy-body omission and no per-turn disk-polling promise remain unchanged. Independent review **VERIFIED / APPROVE** confirms this bounded default-three input/handoff boundary after 281 affected tests, 76 projection/Passive/lifetime/operation tests, typecheck and all 32 exact compiled cases; overlapping counts are not summed. The reviewer inspected current source/DIST and the append-only probe diff. This does not approve the coherent enabled-seven native matrix or whole M2.

### Selected model protocol and grammar boundary

The remaining model-surface preparation gap was literal all-three guidance: the old Active renderer had no selection argument and a pure helper call with CWD DATA still returned Session-default/automatic-answer wording. The negative is **a requested helper-contract witness**, not an already enabled native subset failure: the native gate denied non-default participation throughout.

`stateFlowProtocol(bootstrap, selection)` now validates/canonicalizes a detached selection before rendering Active/bootstrap scope meanings, patch targets, exact-owner artifact targets and a participating reference example. Session-excluded output explicitly delivers new answers without storage/backfill/shared relocation, while selected legacy shared response remains read-only data. With Session selected, existing answer semantics remain. Scope meaning/provenance does not change: exclusion never licenses broadening or relocation, and source-owner mapping is not permission to acquire excluded memory.

`passiveMemoryProtocol(selection)` shares the conditional answer rule and selected guidance; the exported default Passive string remains a default value, not a second policy dialect. The general tool guideline qualifies Active auto-capture with Session participation. Both packaged Skills now restrict explicit/history reads, patches, curation and moves to participating owners, preserve owner meanings, and forbid excluded-response backfill. No Skill source hash/provenance is fabricated.

Native `before_agent_start` and `context_with_system` pass their **captured policy selection**, not merely the sparse available view or later global defaults, to the renderer after the established caller/lease guard. The all-three ordinary and bootstrap Active bodies remain exactly **4398 / 4499 UTF-8 bytes** (4392 / 4493 JavaScript code units), with SHA-256 `c61511a1d0a8d650034f735e1c83721dd04288be5424d2232aec6b0ddf9d26b0` and `6491e6abf18e8e8604b9aae824346b921b93dee4d0c30d5aeeec8e75e8f16cad`. This is byte equality of those raw bodies, not of the whole provider request: generic tool/Passive guidance intentionally becomes conditional, and the SDK still wraps the owned section normally.

**Grammar versus participation:** The existing read path grammar and patch schema name the possible owner vocabulary. The current protocol/view and runtime admission determine which owners participate; names/examples confer no authority. Both tools now say so explicitly. No evidence in this preparation slice earns dynamic tool re-registration, a registry/backend, schema getter or public scope controls. The coherent enabled-seven matrix must still prove disabled-path/all-or-error admission and every lifecycle/facility/response/handoff path; this is not a claim that static grammar alone proves that matrix or settles M3's flat-schema work.

The six retained selected-protocol properties are consolidated by owner in `tests/protocol.test.ts` (five renderer properties) and `tests/extension.test.ts` (native composition): seven selections × ordinary/bootstrap scope/response/target/reference truth; Passive and generic guidance; canonical permutations with caller immutability; malformed/sparse/inherited selection refusal; exact default-body SHA equivalence; and default native composition using captured policy with one existing grammar. Pure renderers grant no memory capability. Existing lower selected staging/query tests own runtime exclusion semantics; these new tests do not bypass the native subset gate.

Fresh full validation passes **1257/1257**, typecheck/build/import/package inventory 125. Compiled **34/34** contains twenty-nine SDK cases (seven lower-seeded canonical fixtures), four lower-runtime/helper cases and one native-bound lower adapter. The prior 32-case probe is unchanged; appended cases are one pure seven-selection DATA renderer matrix and one actual default-three SDK Active/Passive protocol/tool-guideline witness with exactly one registration per tool. The old built candidate fails the new lower DATA expectation before rebuild. The first new native probe incorrectly compared the SDK's XML-wrapped owned section to a raw body; its corrected exact wrapper+body comparison changes only the oracle, not production semantics. Independent review **VERIFIED / APPROVE** confirms this preparation after 279 affected tests, typecheck and all 34 exact compiled cases. It independently compared all 21 source/DIST renderings, both default-body hashes/lengths and complete packaged Skills. The prior 32 test bodies are inherited unchanged; their entire file through its last non-whitespace character is an exact prefix, but trailing blank lines differ before the appended cases—literal whole-file-prefix byte identity is not claimed. Enabled-seven native execution, settings/commands activation and whole M2 remain open; overlapping counts are not summed.

### Cold current semantic author and guarded shared-only first mutation

Pre-enablement inspection identified a concrete dependency: the native first-author branch for an existing lifecycle always required Session acquisition, even when the requested policy excludes Session. The storage current-accept request already supported transition/provenance; its runtime wrapper exposed only lifecycle publication. Extending that same port is needed before coherent native shared-only first-mutation acceptance. The negative demonstrates this **additive future callback contract** (missing third argument), not a defect in the old documented two-argument API or enabled native subsets.

`withSelectedCurrentTransaction` retains its existing lifecycle-only second publisher and adds a third, frozen `SelectedRuntimePatchTransaction` over the live selected current basis: detached states/snapshot/provenance, actual causal basis and the same single-use publisher forwarding replay/provenance into existing `acceptSelectedCurrent`. No intermediate empty acceptance/cache install is needed. Existing current policy/history/private-source/current-CAS checks remain, with no new method, root export, runtime/backend or acquisition grant. Both publishers expire when the author returns/throws, before late inputs can be interpreted; successful publication remains accepted even if later author/ancillary work fails.

The guarded native branch now routes an existing lifecycle with Session excluded into that current author rather than private acquisition/new origin. It keeps actual source run fields and samples the admitted receipt mode only; the existing author/stage/commit and original physical/request checks remain. This branch is **prepared but still unexecuted behind the non-default native guard**. Lower acquired/unacquired/deferred fixtures or code inspection do not establish native shared-only first mutation or native fork creation.

`tests/runtime.test.ts` owns five current-author properties; the composed captured-policy Abort/ABA property lives in `tests/integration.test.ts`, with setup-only `tests/current-author-fixture.ts` shared between them. The six preserved properties are: cold current semantic author across all seven selections and retention 0/1/7/100, preserving run fields with one patch; excluded acquired private bytes/body non-observation; refusal to acquire/repair private authority and preservation of deferred disposition; callback expiry/single-use/post-publication finality; trusted provenance forwarding/excluded getter refusal/foreign-byte CAS; and Abort/captured scope ABA withdrawal while exclusion remains held with fresh recovery. Added semantic authoring is over an independently admitted existing current cohort, never a candidate/reference as acquisition permission. Existing lifecycle-only callbacks remain compatible.

Fresh full validation passes **1263/1263**, typecheck/build/import/package inventory 125. Compiled **36/36** comprises twenty-nine SDK cases (seven lower-seeded canonical fixtures), six lower helper/runtime cases and one native-bound lower adapter. Two new cases are **LOWER**, not native subset execution: three shared-only current writers and callback expiry/legacy lifecycle compatibility. The old built candidate lacks the third argument; its negative is an API-preparation witness, and an escaped-function TypeError there is not proof that the old lifecycle publisher escaped. The prior 34 test bodies are unchanged apart from boundary trailing whitespace before appending. Independent review **VERIFIED / APPROVE** confirms this finite dependency and guarded preparation after 276 current/origin/publication/native tests, 28 source/storage/acquisition/migration tests, typecheck and all 36 exact compiled cases. It inspected source, built JS/declarations and the unchanged inherited test bodies after trailing-boundary whitespace normalization; it did not independently regenerate a byte-for-byte build. Counts overlap supplied full validation and are not summed. Native seven-selection and public activation remain gated.

## State-by-state lifecycle acceptance map

All rows describe recommended target behavior under the agreed preservation invariants. They are future acceptance oracles, not current test claims.

| State/event | Admission, publication, and failure contract | Focused future witness |
| --- | --- | --- |
| New independent Off | Capture concrete default in native policy only; create/read no canonical semantic owner or parent memory. | Default differs from another session; store busy/corrupt/absent; canonical byte/read spy unchanged. |
| New independent Passive | Declare both tools; project only a validated selected view. Read-only load does not initialize absent storage. First explicit patch can establish authorized selected owners/lifecycle without creating disabled owners. | Each subset, especially CWD-only without Global and shared-only without Session. |
| New independent Active | Accept current selected shared memory plus authorized new private semantics only if Session is selected. Create selected empty owners only under legitimate origin authority, with no invented semantic revision. | First provider follows one coherent acceptance; disabled file paths remain absent/unchanged. |
| Retained Off reload/tree | Read native mode/selection/fence/deferred-fork bookkeeping only; no semantic materialization or recovery scan. | Selection survives cold reload while canonical I/O is forbidden. |
| Retained Passive/Active reload/tree | Select branch policy; attach current same-session/selected-owner files, never an old Pi-step memory snapshot. Explicit acquisition provenance distinguishes legitimate unacquired state from corruption. | Old native step with newer current memory; malformed acquired private evidence never becomes empty. |
| Same-mode explicit new selection | Withdraw obsolete work; validate the requested selected view, refresh schema/protocol if applicable, and reset projection identity once. Do not swallow as a repeated mode command. | Active→Active and Passive→Passive across restrictions/expansions, including sole-owner changes. |
| Selection while already Active | Fence new provider requests until the requested selection is validated. A failure remains visibly Active-blocked rather than sending the old/wider memory. | Hold store, change selection, inject failure, assert no stale provider request or cache installation. |
| Off→Active acquisition | Preserve existing inactive policy until successful acceptance. Off/Passive/selection/shutdown can withdraw the pending activation; later diagnostics cannot roll back accepted state. | Withdrawal proved while exclusion remains held, then replacement accepts once. |
| Passive pending/failed selection | Apply exclusions immediately; withhold newly enabled unavailable memory. Native inference can continue, but affected memory tools stay unavailable/fenced. Record requested policy/failure without claiming semantic acceptance. | Failure never widens back to former scopes or clears a carried write fence. |
| Mode-only Active↔Passive | Preserve selection. Keep Passive immediate policy and independently owned attachment/fork behavior; persistent lifecycle work uses current accepted identity and ownership. | Repeated toggles/coalesced waits preserve the selection and no semantic revisions. |
| Any→Off | Cancel owned patch/preparation/response/acquisition/attach/fork/inspection/mode waits, clear semantic caches, and record native policy only. Already accepted bytes stay accepted. | No canonical I/O, late diagnostics, frozen handoff, or hidden tool exposure. |
| Re-enable acquired Session | Validate and use child/same-session current files, preserving private identity and provenance. Never recopy a fork parent or initialize over missing acquired files. | Parent changed after child acquisition; child's current values remain authoritative. |
| Shared-only accepted answer | Reconcile lifecycle without a hidden Session response write under the suppression recommendation below. | No semantic transition when only specification/bootstrap lifecycle changes; correct next native continuation. |

## Response without Session: recommended suppression

**Open D5; recommended design:** Keep response Session-owned, and capture only when Session participates. Lifecycle completion still removes the unfinished specification, finalizes bootstrap as appropriate, updates accepted completion/settlement bookkeeping, and installs one checkpoint after accepted publication. It needs no model finalization patch, new inference, relocated shared answer, or hidden private stream.

When no semantic value changes, completion is lifecycle-only acceptance. Its authority must work for an intentionally shared-only runtime, not demand an excluded Session checkpoint as a safety net. Cancellation before acceptance preserves the previous accepted lifecycle; after acceptance never undo it.

When Session is selected, preserve current exact post-handler answer and empty-string clearing behavior. When excluded, leave old Session response and its revision untouched; later selection reveals the last genuinely captured prior answer, not a backfill. Passive never captures a new answer and omits response from automatic context. Native answer text is not redacted.

Relocating response outside semantic scopes remains an alternative, not a settled decision. It needs new history, fork, read, projection, and migration contracts and risks hidden scope-independent semantic memory. Legacy Global/CWD response values need an explicit compatibility treatment; do not delete them or infer new shared response authorship.

## Artifact and Skill admission

**Recommended design:** Restrict exact-path observation, missing-source pruning, invalidations, rehydration, acquisition candidates, required ordinary compilation, and provenance pruning/publication to selected canonical owners. Disabled metadata is not maintained, even if a source is proven missing.

Skill provenance remains `user → global`, `project → cwd`, `temporary → session`. Reading a registered Skill whose owner is excluded remains volatile native tool context; do not request impossible durable output or relocate it. If another selected owner legitimately has an ordinary artifact at the same source path, evaluate that card's own evidence; it does not inherit a disabled Skill owner's provenance.

Selection change revokes stale acquisition evidence. Later re-selection reacquires/validates normally rather than executing a deferred compilation queue. Preserve stable pre/post-read and publication fingerprints, separate Skill hashing, exact owner/complete replacement, and atomic rejection of misowned attempted output.

## Fork policy and acquisition provenance

**Implemented D6 policy:** If Session is excluded at child attachment, create only child lifecycle policy/authority and selected shared access. Keep a child-owned deferred-private-copy marker; do not read/copy parent semantic memory merely to provide excluded state. Off also defers parent-header/store acquisition under its existing contract.

On the first explicit Session acquisition, validate the direct parent source and copy its then-current private stream/provenance once into the child's absent semantic target. An already legitimate child config/runtime is not proof that semantic copying already happened. Require child-owned pending-copy evidence and exact source/target CAS; refusal for malformed/missing parent or occupied private semantics never becomes empty child memory.

At the original D6 proposal, `prepareForkCandidate` refused any occupied checkpoint, tail, metadata, config, or runtime file. The subsequent selected acquisition path admits the proven lifecycle-only child without removing the general occupancy guard; simply dropping that guard remains unsafe. Bind the deferred source to native direct-parent evidence, validate physical identities at acquisition, and never guess another parent from a path shape. Retain the marker through reload until accepted copy; release/reset it only at the accepted child-owned boundary.

An acquired child always uses its own current private state afterward. New selection, tree navigation, or parent drift never triggers recopy. Do not infer unacquired status from temporary file disappearance. If the parent itself legitimately never acquired Session semantics, define the source failure explicitly rather than pretending the child inherited private memory.

Eager copying while Session is excluded is the competing option. It retains more of today's always-copy shape but violates the stronger disabled-owner inactivity direction and can require inaccessible parent evidence for shared-only work. Use the authorized deferred direction and bind its marker encoding to direct-parent evidence in owning acceptance tests. Preparation does not implement copying or create a new general approval gate.

## Selection/request cancellation authority

**Recommended design:** Bind every model-facing request and asynchronous operation to physical owner identity plus a fresh immutable selection lifetime. Compare identity, not just a set string: changing `session → cwd → session` must not revive the first request.

Admission checks occur before waiting, after lock acquisition, and immediately before synchronous publish/install. Accepted file publication remains single-use and callback-scoped. An old completion cannot clear a new operation slot, update UI/checkpoints, or emit a misleading successful receipt.

Tool arguments generated under an earlier request must not be rebound to a newly selected sole owner merely because execution begins after a selection change. In particular, capturing only the current selection inside `patch_state.execute` is insufficient. Correlate the actual native assistant/tool batch with the request's accepted policy through public host lifecycle evidence, or cancel/reject it conservatively when correlation is unavailable. The exact SDK correlation seam is an M2/M3 implementation proof, not permission to guess a request epoch from text or projection IDs.

Selection changes also revoke read/inspection presentation, clear source acquisition candidates, reset projection identity, and rebuild owned Stop/bootstrap handoffs without excluded semantic values. They do not rewrite native results or foreign context. Off continues to use native bookkeeping only, and failed selection cannot clear an existing publication fence.

## M2 functional acceptance boundary

The native seven-selection bridge, public scope controls and mode-only optional Telegram presentation complete the deterministic **M2 functional checkpoint**. Both actual terminal independent reviews are **VERIFIED / APPROVE** and were consumed before closure; M0.3's concrete selection/lifecycle decisions are integrated, not awaiting another general approval. This is the existing engine and mode/policy owners, not a second runtime or generic schema/selector framework. M3 flat/schema behavior is explicitly separate.

| Property | Retained owner and evidence | Boundary / dependency |
| --- | --- | --- |
| Concrete choice / mode independence | `selection` exact frozen values; native v2 capture/policy precedence; public seven-choice × mode SDK laws and prefix completion | Blank/equal choices preserve permitted work; malformed present values never widen; defaults are sampled once and commands do not edit them. |
| Current memory / selected history | Selected current/acquisition/query runtime plus native core/fork/peer laws | Pi trees choose policy, not semantic rewind. No fake absent owner/history/revision; folded deltas can be unavailable rather than empty. |
| Shared origins / private permission | Existing first/current/acquisition publishers, native original-ID first patch and explicit Start laws | Unacquired inspection/observation is not a grant; acquired loss, deferred parent permission, partial/orphan targets and write fences do not become independent origins. |
| Parent-current fork / private retention | Native fork matrix, lower exact source/target CAS and retained private causal-basis laws | Session exclusion defers copy without private/State Flow parent-header reads; re-enable needs one actual direct parent, never ancestry scans. Acquired child never recopies; known lost proof fails closed. |
| Disabled ordinary owners / sources | Selected stage/query/context/protocol/source/Skill laws and native facility matrix | No model values, response backfill, hidden private layer, excluded semantic normalization/folding/provenance or relocation; legal earlier native tool arguments remain. Source bodies/hash stay outside canonical exclusion. |
| Material changes / publication finality | Existing single staging/commit engine, callback-scoped single-use publisher, byte-CAS/rollback and native publication-wait laws | Selection/mode-only changes do not advance semantic identity/revisions. Responses are new semantic writes only in Active participating Session; accepted memory survives later cancellation/bookkeeping errors. |
| Physical and request lifetime | Native caller/CWD/key/original-ID/signal guards; source/response/context callbacks; public/Telegram waits and ABA laws | Equal values after a real change do not revive old receipts. Foreign callbacks skip attribution rather than globally banning native tools; no host-authentication claim. |
| Off / presentation | Public Off and optional Telegram callbacks over exact-path guarded waits; busy deferral and accepted-receipt stale-menu laws | Off memory callbacks are native-only; explicit inspection is distinct. Seven mode-only callbacks retain publicly captured choice, not a seven-way chooser. No real network/device rendering was used. |
| Requested versus available | Sparse observational status DTO and native late-Passive/control tests | Requested Session may remain unacquired while CWD is observed. No invented private state/zero vector; header classification and shared observation are separate transactions, not atomic publication proof. |

### Explicit proof dependencies and inspection exception

- **Lifecycle v1:** It has no accepted excluded-owner witness skeleton. Safe admission requires the complete three-owner semantic/provenance cohort plus config/runtime (the full 11-file proof) before projection. An excluded body's corruption can therefore reject v1 admission. Only owned acceptance with verified exact-byte backup can upgrade; excluded owners remain byte-identical. No selective parser pretends this legacy dependency disappeared.
- **Lifecycle v2:** Only selected semantic bodies/provenance plus config/runtime are opened for ordinary selected admission. Acquired excluded Session still requires regular-file/path-chain presence of its private triple, not body reads; unacquired/deferred targets require absence. Retained private causal proof stays lifecycle metadata and cannot be invented by mode changes, observation or missing files.
- **Explicit operator inspection:** Current Telegram buttons/help follow wanted participation, not sparse availability. Effective is offered only for2+ owners and reads only that selected overlay; selected shared-only inspection does not require excluded Session bodies. Session/current proof still fails closed, and lifecycle-v1 admission retains its complete-cohort dependency. Disposable Off reads publish/install nothing, clear no fence and grant no private acquisition. This is not automatic Off memory access or a confidentiality promise.
- **Unsupported/foreign evidence:** Unknown epochs, malformed identity/selection/causal proof, old low-level writers without the supported fence and working-store migration are not repaired by this checkpoint. The [settled support policy](semantic-compatibility-decision.md#implementation-direction-and-reserved-names) retains legacy conversion/root reservations throughout State Flow0.x and ends that temporary window beginning1.0.0, with unsupported-version refusal retained. Released 0.27.0/0.27.1 and this consolidation retain the converter and retired-root reservations; no transition plan, release or working-store operation is implied.

### Current scope-aware presentation

`StateFlowTelegramSnapshot.scopes` supplies captured wanted DATA to the existing optional section; absent legacy embedding fields retain all-three presentation, malformed explicit values reject. Owner buttons/descriptions are selected-only, Effective is absent for a singleton, and mode controls preserve selection without adding a chooser. The runtime reader composes only inspected participating owners, retaining existing shared/private proof and disposable Off semantics. Callback eligibility is checked before readers and after acknowledgement/observation; native inspection retains its physical/selection revocation checks. `tests/telegram.test.ts` covers seven-choice/mode rendering, legacy/malformed input, stale target rejection, async withdrawal and excluded revision getters. `tests/extension.test.ts` extends the seven SDK mode/control/reload cases with fresh configured-default menu assertions and adds a native seeded-all-owner observation matrix: selected-only values/vectors, rejected stale callbacks, exact excluded-body read guards, unchanged canonical files and no cache/provider installation. The scope-aware UI slice is independently APPROVED: actual source58 adapter/pure/raw-handler checks, eight actual SDK owner/default/reload/inspection cases, and eight complete import-only body-equivalent DIST/SDK cases pass; fresh full1627/1627 passes on Node22.19.0 and24.21.0 with build/typecheck/import/prepack. Independent review reran58 adapter checks on minimum Node, eight Source SDK and eight DIST SDK cases on Node24, sixteen inherited SDK lifetime cases and one minimum-Node legacy-full-proof witness, verified complete Source/DIST body parity and252/252 frozen inputs before/after, and requested no correction. Counts overlap and are not summed. The actual complete approval was consumed after ROOT terminal before context-only closure. Context0/19,DAG0/25 and diff checks pass. These are deterministic section/SDK fixtures, not actual Telegram device/network rendering or live reload. NATIVE-1/PUB-1 and MIRROR-1 remain separate release gates, not waived by this approval. Original checkpoint56 totals and old import-normalized mirrors below remain historical; their old all-button assertions are not silently reused as current UI equivalence.

### Historical mode-only presentation witnesses

The seven actual SDK/public-capture cases originally in `tests/native-telegram-selection.test.ts` are now consolidated and extended in `tests/extension.test.ts`, each exercising registered mode-only Passive/Off/Active controls before/after new defaults and reload, actual native original-ID writes/reads, selected responses, excluded bytes/private absence and explicit disposable inspection. The native-telegram-lifetime group in `tests/extension.test.ts` supplies sixteen SDK cases (seven held Start/Off, seven accepted-Passive receipt/public scope ABA, two busy deferral outcomes) with the original pure operator-copy/radio-layout property now owned by `tests/telegram.test.ts`. Only the existing optional presentation-loader seam is injected; native mode owners/storage are not replaced. Callback payloads never choose participation. Core provider assertions were moved outside faux callbacks before final validation so a swallowed provider exception cannot masquerade as tool/context proof.

The original checkpoint56's sole production change clarified the then-existing Effective inspection copy: operator stored-state view is not all-owner model participation. Existing fenced inspection documentation was reconciled to actual disposable current reads; an older source test now requires the peer's newly accepted field as well as earlier retained values, with unchanged canonical files. No new inspection permission is created.

Fresh full validation passes **1413/1413**, zero failed/cancelled/skipped, build/typecheck/import/package **125**. New complete import-normalized Source/DIST mirrors pass **24/24**: **23 actual SDK cases plus one pure presentation-copy property**, not 24 SDK scenarios. Earlier unchanged compiled **124/124** (66 native-seven, 17 prerequisite, 41 public-command SDK cases) and compatibility **36/36** remain green; all overlap the source aggregate and are not summed. The new compiled wrapper differs from the earlier immutable wrapper only by forwarding the existing optional presentation loader into the compiled factory; Source activation remains disabled. Independent integrity review passed source **76/76** (new24 +existing52), compiled **24/24**, targeted current-fence **1/1**, typecheck, complete normalized mirrors, exact one-line wrapper parity and frozen **26/26** entries before/after. Independent authority review passed source **119/119** (76 +adjacent public-control43), compiled **24/24**, typecheck and **7/7** targeted sticky-private/legacy/current/copy dependencies, plus the same parity/frozen26 evidence. Both explicitly approve the finite M2 functional/M0.3 integration boundary, request no remediation and do not claim independent full1413/rebuild/inherited124/36 execution. Counts overlap each other and the source aggregate; no summed uniqueness claim. Reports were read completely after terminal; source/tests/dist/wrappers remained frozen throughout and all owners returned before context-only reconciliation. Context/DAG/documentation and changelog limits pass; the one new wide map-table warning is informational, not a hidden gate or a zero-warning claim. The scripted SDK/fake-presentation boundary is not actual Telegram delivery, live-model cognition/cost/cache, universal filesystem nonaccess or exhaustive interleavings.

## Public mode-command scope overrides

The existing three mode commands now accept optional nonempty unique whitespace-separated owners. Canonical equality takes the unchanged mode-only path, preserving independent same-scope work. Unknown/duplicate/mixed syntax rejects before selection/mode side effects; completion replaces the entire argument prefix with a legal next unused owner. Inputs/controls never mutate the global default or model-patchable semantics. The implementation refines the original argument-free-Off recommendation because native-only selection can remain Off and I/O-inert; seven actual public Off-scope held-wait cases instrument exact canonical paths and verify withdrawal without acquisition. No fake Off staging is used for Active or Passive.

Different Active scopes record a validated owner-local native choice, revoke old-scope inactive persistence and use the **existing Start owner** through restoration and explicit activation; already-active/pending-Start shortcuts cannot swallow a real selection change. Same-scope failed Start still cannot poison independent Stop. Passive scopes record policy then use existing restoration/observation admission; unacquired observation is not a private grant, and acquired corruption/deferred parent permission/write fences remain strict. Changed Off scopes use the existing synchronous cancellation/native-only route but never append an old-selection cached checkpoint after the new choice; that old accepted bookmark stays history, not a counterfeit acceptance of the new scopes.

Public late Passive witnesses cover both an attached bookmark and a genuine earlier native tree point with no accepted bookmark, over real header waits. They exposed why policy persistence belongs in the **mode owner before awaiting observation**, not only the attachment observer added in checkpoint54: either observer may never publish a checkpoint. The pending Passive owner now records its newer native mode once, without reset/fence/private acceptance, and equal repeats add no duplicate policy record. Four earlier boundary/auto-start × restart fixtures now explicitly assert exactly that one normal v2 policy DATA entry and still forbid canonical writes, fences, resets and accepted checkpoints while waiting.

Status likewise distinguishes requested policy from available materialization. The new public late tests first found the old view-only label silently reporting just CWD when Session was requested but unacquired. An attempted label-only correction correctly hit strict exact-vector admission; the retained fix leaves `selection` as exact materialized owners and adds observational `requestedSelection`. Status prints wanted owners plus `Materialized scopes` when sparse, validates the subset relationship and never pads Session state/revision with zeros. The actual SDK tests assert reload, CWD values, unavailable private view and exact unchanged files.

The public-scope group in `tests/extension.test.ts` supplies 21 actual public seven-selection × mode cases plus three SDK malformed-input properties. All sources originate in public commands/native original-ID patches; no policy-DATA chooser supplies the new choice. The public-scope-lifetime group in `tests/extension.test.ts` supplies 17 native properties: seven Off canonical-path I/O/held-Start withdrawals, Active/Passive scope ABA, late mode-only Passive over both boundary kinds, equal canonical pending-patch preservation versus actual public scope-ABA withdrawal, different-scope inactive-persistence withdrawal, controlled real Passive-persistence fence, required acquired corruption and deferred-child parent-permission refusal. The two retained completion/registration properties now live in `tests/selection.test.ts` and `tests/extension.test.ts`, respectively; consolidation does not reissue the following historical validation as a fresh run. Fresh full validation passes **1389/1389**, zero failed/cancelled/skipped, build/typecheck/import/package **125**. The **41/41** compiled SDK mirrors have byte-equal complete bodies after only static import-specifier normalization; the two pure/registration cases remain source-only, with a separate compiled pure-completion DATA smoke. Earlier immutable compiled **83/83** (66 native-seven +17 prerequisite) and compatibility **36/36** remain green. Counts overlap full validation and each other and are not summed.

Both actual terminal reports were consumed: authority and integrity each **VERIFIED / APPROVE**, no substantive counterexample or waiver. Authority independently passed **94** affected/adjacent source, **26** core/completion, **7** Stop controls, typecheck and compiled **41**. Integrity independently passed source **43**, changed Stop **4**, typecheck, compiled **41** and complete normalized mirrors; it inspected the installed SDK/TUI full-prefix replacement seam, without claiming visual rendering. Both checked all **17** frozen entries before/after; neither independently reran full1389 or rebuilt all generated production bytes. Integrity's initial unsupported `--experimental-transform-types` flag exited before tests; the corrected invocation passed without file changes. The original full1385/4 Stop-oracle failures and sparse-status counterexamples remain as evidence, not erased successes. At the public-command checkpoint, mode-only Telegram/final reconciliation and whole M2 still remained open; the completed functional boundary is now recorded above.

## Passive Session expansion after an accepted shared bookmark

M2.1 command preparation exposed a finite native control prerequisite, not a missing new runtime: a real accepted shared-only bookmark followed by owned Passive policy DATA including Session was routed into current acceptance and refused before the first explicit Session patch could acquire its unacquired source. The native negative actually observed that error. At that prerequisite checkpoint the command scope interface was still uninstalled; the current public binding is described above.

Attachment now recognizes a **previously validated scoped shared-only bookmark**, captures header-only disposition under the same existing owner, and samples the latest requested mode after the wait. Only actual Passive plus explicit `unacquired` disposition can observe selected shared owners; absent shared sources are omitted and Session-only requests get no fabricated view. It publishes no lifecycle/config/checkpoint/private semantics and does not confer a private grant. The existing original-ID first-patch route independently acquires the exact source and preserves source run fields while advancing its material transition. Active, acquired, deferred and fenced paths retain their original strict admission.

Native SDK tests cover three prior shared choices × four Session-containing requested choices. Files/checkpoint counts remain unchanged through reload/ordinary Passive delivery, then actual first Session mutation succeeds through the existing acquisition port; now-excluded shared bytes survive. Three independent denial properties preserve acquired corruption, a deferred child's unavailable parent permission and an existing write fence, with original native results and exact bytes. No fake checkpoint or lower canonical seeding supplies them.

A separate header-wait counterexample showed newer Passive worked locally but reverted to the older Active request on the next reload, because read-only observation writes no accepted checkpoint. The attachment observer now records that newer independent Passive choice as **policy DATA only** after revalidation, without resetting fences or granting memory. Native late Passive/Off tests require canonical bytes and unacquired disposition unchanged, reload persistence, and Off withdrawal before exclusion release. Generic native history remains legal; tests forbid automatic contributions rather than demanding transcript erasure. Fresh full validation passes **1346/1346**, build/typecheck/import/package **125**. The same 17 new SDK cases pass **17/17** through the compiled-only factory wrapper, and the earlier compiled **66/66** plus compatibility **36/36** remain green. Static-import-normalized Source/DIST mirror bodies are identical. Counts overlap full validation and are not summed. Independent review **VERIFIED / APPROVE** inspected the decoder, attachment/header/observation and first-authoring closure, independently passed **31/31** affected/adjacent source cases, compiled **17/17**, strict typecheck and complete import-normalized parity, and verified all **6** frozen entries before/after execution. The actual report was consumed after terminal completion. Header inspection and shared observation are separate transactions, not an atomic snapshot or publication basis; first authoring independently recaptures exact current authority. This is accepted within that finite boundary, not public scope-command acceptance or whole M2.

## Retained native-seven-selection integration

Iteration53 integrates the independently reviewed SDK candidate into normal strict-TypeScript regression tests: `native-seven-core` (14), `native-seven-fork` (21) and `native-seven-facility` (7). The production native-scope assertion uses the existing canonical selection validator instead of an all-three-only refusal. All acquisition/current/fork/staging/response/caller ports remain the same; no feature switch, tool replacement, factory copy, lower fixture seeding or extra runtime is introduced. Fresh `npm run validate` passes **1329/1329**, build/typecheck/import and package **125**; independent authority and test-integrity reviews both return **VERIFIED / APPROVE** for this retained configured/captured integration, not whole M2 or public override controls. Compiled-factory mirrors of the same 66 typed SDK cases pass **66/66**; the inherited compiled probe passes **36/36** after retargeting only its former subset-gate case to require narrow native CWD acceptance. The other 35 bodies remain unchanged. These counts overlap the full suite and are not added.

`native-seven-cancellation` adds all seven selected Starts over held exclusion, native Off policy-DATA tree ABA, withdrawal before release, unchanged canonical bytes/no stale notices and fresh selected recovery. `native-seven-publication-cancellation` adds all seven × patch/ordinary-response publication waits: actual SDK events arm an independent fixture exclusion holder, public Off withdraws the owned operation, accepted preparation remains final, native answers remain delivered and fresh selected requests succeed. These do not claim that SDK tree navigation is legal during a streaming model operation; same-mode pending-restoration ABA is separately tested at the source callback seam. `native-seven-shared-peers` adds three actual shared-only native peer cases, live untargeted drift preservation and current read after reload, without private semantic files. In total these retain **66 SDK scenarios**, not a universal interleaving cross-product.

Fourteen prior gate-oriented expectations are retargeted, not waived: the compound required-private-loss test keeps its unchanged corrupt-private/no-fallback half and explicitly rejects excluded writes; twelve configured subset/mode cases now require accepted selected memory, atomic disabled-owner refusal, captured-default preservation and no excluded initialization; source acquisition ABA now traverses accepted intermediate CWD rather than an Active-blocked shortcut. Held-restoration fixtures start replacement work without awaiting its required exclusion, prove old and intermediate owners withdraw, then release the lock and await only the current owner. Pending local policy is Passive until accepted Active restoration; the native wanted-mode DATA remains Active.

A real native Passive/CWD status witness initially printed the all-owner fallback before a view existed. Status now uses captured native policy DATA when no view exists, still renders unavailable materialization and cannot acquire memory. The core matrix checks both unloaded and Off status, unchanged files and all seven captured choices. This is truthful operator metadata, not new semantic authority. Mode-only Telegram actions share the same lifecycle owners; no scope chooser is added.

The authority reviewer independently passed **102** native/current/fork/response checks, **59** adjacent admission/request checks, compiled **66** and the retargeted compatibility **36**. The integrity reviewer independently passed **141** native/fixture checks, strict typecheck, compiled **66** and compatibility **36**, verified all six import-only mirror equalities and the complete unchanged prefix/suffix around the retargeted compatibility case. Both verified all 18 manifest entries after execution. These sets overlap each other and the supplied full **1329**; they are not summed. Reviewer invocation mistakes (missing external-probe import-resolution flag, and one comparison's old/new title anchor) failed before semantic cases and were corrected without file edits. Both actual reports were consumed after terminal completion; no correctness or authority finding required production remediation.

The earlier candidate's exact-path/prototype/factory attribution limits still apply. Generic Skill maintenance does not content-hash; hashes remain explicit-read/compiler evidence. Selection is not trace erasure, body confidentiality, SDK host authentication, deployment readiness or live-model quality. The newer public command binding is described above; mode-only Telegram acceptance and the final M2 checkpoint stay owned only by BACKLOG.

## Native-seven SDK validation candidate

**Historical iteration52 preparation, superseded by the retained native integration above.** The following candidate status, promotion gates and results belong to that checkpoint, not current release prerequisites. Iteration52 exercised the existing selected bridge on an **unreleased validation candidate**, replacing only the all-three-only native assertion with existing `captureScopeSelection` validation. There is no test-only subset switch, copied factory, lower-seeded canonical memory or second engine. This is not yet retained activation: the accepted all-three guard is restored before the candidate checkpoint ends. Public scope arguments/settings remain disabled. The exact candidate and scripts are retained separately for promotion and regression integration.

Source and freshly built JS each pass **14 core**, **21 fork/private-copy** and **7 facility** actual-SDK scenarios (zero failure/cancellation/skip). Core covers all seven selections × Active/Passive, original-ID writes/queries/history/batch/keys/patches, rejection/no-op bytes, Session-only new responses, reload, scoped Stop/Passive heads, Off and captured-default/tree-current behavior. Fork covers all seven × Active/Passive plus six late Session-copy cases and one missing-parent-proof denial: shared-only children defer without State Flow parent-header/private-body reads, preserve pending facts through Off/reload, and later copy genuine parent-current private state; acquired child-current never recopies. Default-three header/private-read controls distinguish the zero-I/O cases. No recursive discovery or universal filesystem nonaccess claim follows.

Facility state/provenance is first authored by native all-three reads/compilation, then reselected using owned v2 native-policy DATA plus public Off/reload/Start, **not public scope controls**. Seven cases prove selected ordinary invalidations/removal, registered Skill ownership, explicit selected read-driven hashes/compilation, no excluded source I/O in automatic contribution or relocation, legal ordinary native excluded reads, and excluded acquired-owner canonical bytes preserved. Generic maintenance computes no content hash; the requested automatic changed-Skill hash oracle was rejected as contrary to that contract, not implemented. Successful native reading/compilation supplies the actual hash positive controls. Earlier provider JSON-block, singleton-batch and excluded-tree private-read expectations were corrected in the probes, not production authority.

Build/typecheck pass for the candidate, but a candidate-wide legacy suite attempt is **not green**: 13 obsolete all-three-gate expectations fail, and enabled replacement restoration now waits for a deliberately held exclusion where old lifetime fixtures awaited immediate gate denial. The command timed out at 200 seconds and left no test process running. Those fixture obligations and retained typed regressions, enabled-subset cancellation, fresh full validation and candidate review remain promotion prerequisites. Historical full **1263** and compiled **36** belong to the accepted guarded tree, not this scope-enabled candidate; counts are not added. Independent review **VERIFIED / APPROVE — candidate/preparation only** read every probe, compared Source/DIST variants and independently reran all six commands: Source and DIST each **14/21/7** passes, with candidate/script hashes unchanged before and after. No false-pass, copied factory, lower seeding or publication-grant bypass was found. The review explicitly does not approve retained activation. After reviewer completion, the coordinator restored the all-three assertion and rebuilt: fresh full **1263/1263**, build/typecheck/import/package **125**, and exact inherited compiled **36/36** pass, zero failure/cancellation/skip. The candidate run of that inherited probe was **35/36**, failing its obsolete subset-gate expectation; restoration returns that expectation to green. Candidate source/built hashes differ intentionally after restoration; the seven exact probe/fixture files remain hash-identical. Promotion still requires retained regressions and enabled-subset cancellation/ABA with fresh integrated validation.

## Evidence and review gates

**Historical M0.3 baseline evidence, not current codec behavior.** The later retained M2 integration and public command sections above discharge the implementation prerequisites recorded here. A synthetic in-memory baseline probe confirmed:

- Session config with a scopes field and pre-runtime/retained checkpoints with a scopes field are rejected by today's strict codecs.
- `readCheckpointMode({mode: "active", scopes: []})` nevertheless returns Active because it is mode-only extraction. A future complete policy reader must reject/quarantine malformed explicit selection instead of silently falling through to an all-scope default.

Focused current-source command:

```bash
node --experimental-strip-types --test tests/config.test.ts tests/session.test.ts tests/operation.test.ts tests/extension.test.ts tests/acquisition.test.ts tests/rehydration.test.ts
```

Result: **54 passed, 0 failed** on the baseline above. This includes native scripted response-isolation witnesses, current mode/default/branch policy, operation ownership, acquisition, and rehydration. It does not certify seven selections, shared-only authority, deferred private copying, flat tools, or selection-owned cancellation; those remain future implementation acceptance.

The original M0.3 handoff required exact metadata/host-admission and selected-owner proof, including D3 persistence and D4–D6 authority/response/fork witnesses. The later [M2 functional boundary](#m2-functional-acceptance-boundary) records their completion and explicit legacy dependencies. Neither this historical probe nor the internal selection parser alone certified installed behavior; deterministic SDK evidence still does not certify live-client compatibility. The canonical backlog owns remaining external validation, not completed M2 cohorts.