# Verification evidence

## Compact inspector interface

Only Environment resource presentation changes. The original monospace font, spacing, palette, header, primary navigation, footer, Context, Session, Cache, and Event details styles are preserved. `style.css`, `composition.css`, `session.css`, and `tool-inspector.css` are byte-identical to pre-PR commit `d977f562`; `app.tsx` differs only by the Environment stylesheet import. Every new selector is scoped to `.environment-surface`. Environment uses a bounded 1040px column, compact cards, complete wrapping descriptions, semantic status badges, and consistent Copy rows. Source and Schema remain collapsed by default.

- All 435 package tests pass across 21 files. The complete Chromium suite passes 134/134, including six new cases for 320/375/900/1672px layouts and light/dark portaled drawer focus.
- Browser assertions preserve the original monospace font and 64px/80px header and 34px footer heights. Environment coverage includes complete multiline descriptions, both navigation levels, hover/focus states, clipboard contents, normal-text contrast of at least 4.5:1, no document overflow, and scrolling the last Copy action and card bottom above the footer even when a card exceeds the viewport height. Existing tests retain lazy catalogs, disclosure/scroll state, live updates, session replacement, cancellation, and read-only behavior.
- Scope review confirms Environment inherits the original typography and palette instead of replacing shared theme tokens. Original global focus rules are unchanged; drawer Close and Copy keyboard focus remain tested in both themes.
- Earlier full-workspace test attempts did not pass: the first run exceeded the 300-second tool limit, and a single-worker retry was stopped after repeated failures in unchanged `pi-subagents`, `pi-starship`, `pi-fleet`, `pi-langfuse`, and `pi-worktree` tests. No timeout or unrelated source was changed. Logs: `/tmp/pi-inspect-interface-tests.log` and `/tmp/pi-inspect-interface-tests-serial.log`.
- After limiting the change to Environment, `npm run check`, all 134 Chromium tests, and the CI affected root gate pass. The root command was `PI_EXTENSIONS_BUILD_READY=1 PI_EXTENSIONS_TEST_BASE=origin/main VITEST_MAX_WORKERS=1 npm test`: 595 tests across 44 files, including all root tests and the Inspector workspace. An earlier subset run passed 594/595 with one dependency-installation timeout; the later pass does not establish a full-workspace pass or waive the broader failures above. Current logs: `/tmp/pi-inspect-environment-only-check.log`, `/tmp/pi-inspect-environment-only-root-tests.log`, and `/tmp/pi-inspect-environment-only-browser.log`.
- Final review against `AGENTS.md` and `docs/extension-conventions.md` confirms no changes to data collection, payloads, resource ownership, asynchronous work, settings, commands, model-visible prefixes, dependencies, metadata, or runtime loading. Pack and package-loader smokes are not required for these browser-only changes. The browser suite includes the existing real-Pi reload/shutdown smoke. A patch Changeset records the interface change; no publication is authorized.

Synthetic captures are ignored under `packages/pi-inspect/test-results/`: `environment-compact-resour-7177e-board-disclosures-at-1672px/resources-1672-light.png` and `environment-compact-resour-64909-yboard-disclosures-at-375px/resources-375-dark.png` show representative desktop/mobile layouts. Both were inspected, together with `composition-reference-comp-2b550-content-and-explicit-source/context-composition-reference.png` to confirm the original Context appearance. Regenerate all sizes and appearances with `npm --workspace @narumitw/pi-inspect run test:browser`; each run replaces generated output. Baseline captures are local under `/tmp/pi-inspect-interface-before/baseline/`; no images or session data are committed.

Maintainer handoff: after regenerating captures, review spacing and readability in the intended browser/font and on a physical touch device. Expected behavior is readable text, reachable controls, and unobscured content. Native browser/font rendering and physical touch behavior remain unverified by headless Chromium. The required affected CI gate passed; no full-workspace-suite pass is claimed. The completed interface plan was removed after its evidence and external handoff were retained here. Release still requires explicit approval.

## Cache trend chart

The Cache trend now uses fixed 0–100% vertical bars with Low/Moderate/High text labels, explicit empty and unknown states, current-window summaries, and known epoch separators. The 32-point and 200-row bounds, accounting formulas, branch-weighted totals, and read-only session behavior are unchanged. Epoch metadata is additive and optional; absent or invalid epochs do not create separators.

- Package build and typecheck pass; 435 package Vitest tests pass across 21 files.
- Focused cache browser tests pass 29/29; the complete Chromium suite passes 128/128. Coverage includes raw thresholds and midpoint rounding, unknown versus known-zero marks, sparse slots, auxiliary-only usage, displaced unknown-response actions, epoch boundaries, older snapshots, incomplete reports, native pointer/Enter/Space actions, branch replacement, and stale snapshot cancellation.
- All four band text colors meet 4.5:1 contrast in both themes. Initial light-theme amber/green contrast failures were corrected with stronger text tokens; distinct fills and visible focus remain tested.
- `npm run check` passes. The CI-equivalent root test gate passes 595 tests across 44 files with `PI_EXTENSIONS_BUILD_READY=1 PI_EXTENSIONS_TEST_BASE=origin/main VITEST_MAX_WORKERS=1 npm test`: all root tests plus the affected `pi-inspect` workspace. The build-ready flag reuses the successful root build; the 5,000 ms test budget is unchanged.
- Broad local `npm test` attempts did not complete successfully: the first hit the tool's 300-second limit; later attempts were stopped after timeouts in unchanged workspaces. The single-worker attempt still timed out in `pi-sync` convergence and Git-route tests. No timeout was increased or unrelated test changed; no full-workspace-suite pass is claimed. Local logs are `/tmp/pi-inspect-cache-trend-test.log`, `/tmp/pi-inspect-cache-trend-test-full.log`, and `/tmp/pi-inspect-cache-trend-test-serial.log`.
- `npm run package:pack -- inspect` passes. An actual 65-file tarball was also inspected: entrypoint, chart source, browser assets, documentation, and license are present; tests, scripts, and dependencies are excluded. The Pi smoke passes text/JSON opening rejection, explicit package loading, trusted discovery, RPC rejection, stop, reload, session replacement, and shutdown without a provider request.
- A fenced-code-aware audit passes required headings and order for 35 package READMEs; seven local documentation links resolve.
- Independent review and the final diff audit against `AGENTS.md`, `docs/extension-conventions.md`, and `docs/readme-conventions.md` cover correctness, security, lifecycle, compatibility, regressions, and scope. Midpoint formatting now uses one rounding result, and all-unknown samples retain Event details actions even after auxiliary rows displace their usage records.
- No dependency, settings, command, consent, authentication, model-visible prefix, resource ownership, package metadata, or runtime-loading path changed. The chart adds no new fetch path, timer, observer, storage, or animation loop. A patch Changeset records the behavior change; no publication or release dispatch is authorized.

Synthetic chart captures are ignored generated files under `packages/pi-inspect/test-results/`; no images or real session data are committed:

| Case | Artifact relative to `test-results/` |
| --- | --- |
| Empty, desktop light | `cache-trend-empty-and-auxi-9d1de--fabricated-axes-or-samples/empty-desktop-light.png` |
| One sample, desktop light | `cache-trend-1-sparse-sampl-52a45-es-and-fixed-capacity-slots/1-samples-desktop-light.png` |
| Two samples, narrow dark | `cache-trend-2-sparse-sampl-c0277-es-and-fixed-capacity-slots/2-samples-narrow-dark.png` |
| Three samples, desktop light | `cache-trend-3-sparse-sampl-0e8ba-es-and-fixed-capacity-slots/3-samples-desktop-light.png` |
| Mixed unknowns and epochs, narrow dark | `cache-trend-epoch-separato-1ffbe-luding-unknown-rate-samples/mixed-unknown-epochs-narrow-dark.png` |
| 32 samples, desktop light | `cache-trend-32-point-clipp-080e8-e-a-bounded-narrow-document/32-samples-desktop-light.png` |
| 32 samples, narrow dark | `cache-trend-32-point-clipp-080e8-e-a-bounded-narrow-document/32-samples-narrow-dark.png` |

The captures were inspected for readable labels, normal sparse bar widths, and bounded chart scrolling. Subjective acceptance remains with the user: after obtaining these captures, review spacing, band readability, and dense-chart legibility in the intended browser and font. Physical touch devices and the user's actual browser/font preferences remain unverified by headless Chromium. This visual review is not an agent-plan completion gate; publication still requires explicit approval. Reproduce the captures with the package's documented browser-test command; each full run replaces the previous generated test output.

## Package migration

The inspector now lives under `packages/pi-inspect/`, with a thin source entrypoint, prebuilt browser assets, package-owned development dependencies and root workspace registration. Current verification commands are in the [package README](../README.md#development-verification).

- Pinned-toolchain `npm install` and `npm run check` pass; no existing locked package version changed.
- All 306 deterministic Inspector tests and 56 Chromium tests pass, including nine restricted-storage cases. Two new root prepare tests verify production ordering and build-failure propagation.
- Pi smoke passes package-directory loading, trusted source discovery, text/JSON/RPC opening rejection, stop, reload, session replacement and shutdown without a provider request. The production Git-install smoke starts without assets, runs Pi's exact npm dependency-install flags, builds assets with dev dependencies omitted and verifies serving and Pi loading. See [current review ledger](./REVIEW.md#pr-1524-package-review) for all feedback outcomes.
- `npm run package:pack -- inspect` and actual tarball inspection pass; source, browser assets, docs and license are present, while tests, scripts and dependencies are excluded. The extracted package loads through Pi's CLI and rejects JSON-mode opening without corrupting protocol output.
- Pinned-toolchain root `npm run check` and `npm test` pass after removing workflow-YAML assertions at the user's request: 7,979 tests pass and two are skipped after adding root prepare regressions. Root scripts, installation-policy and release-helper behavior remain tested; no tests read or assert `.github/workflows/*`, and workflows are unchanged. The earlier run had one workflow-trigger assertion failure, now removed rather than repaired by changing release behavior.

Semantic review against `docs/extension-conventions.md` and `docs/readme-conventions.md` confirms preserved commands, consent, cancellation, lifecycle ownership, privacy and model-visible prefixes. No settings changes are required. The package review adds a minor Changeset because the overall PR introduces a new public package to main, not merely a path migration of an existing published package. No registry publication was performed. The earlier paid-provider, physical-terminal and OS-specific browser-opener limitations remain unverified.

## Historical project-local evidence

The following evidence and old `.pi/extensions/inspect/` paths describe the pre-package implementation, not current installation instructions.

Recorded on 2026-10-08 for the project-local Session Inspector. Commands run from the repository root; installed dependency versions come from the manifest and lockfile.

## Checks

| Gate | Evidence |
| --- | --- |
| Browser build | `node .pi/extensions/inspect/build.mjs` passes; bundled React/Radix JS/CSS load through authenticated loopback serving with no development server. |
| Local types | `npm exec tsc -- --project .pi/extensions/inspect/tsconfig.json` passes. |
| Local tests | `npm exec vitest -- run --config .pi/extensions/inspect/vitest.config.ts`: 16 files, 306 tests pass within the 5,000 ms test limit. |
| Browser tests | `npm exec playwright -- test --config .pi/extensions/inspect/playwright.config.ts`: 47 Chromium tests pass, including real Pi codemode, cancellation, reload and runtime shutdown. |
| Pi loading/modes | `node .pi/extensions/inspect/smoke.mjs` passes explicit loading, trusted auto-discovery, RPC rejection/stop, reload, replacement, orderly exit, and text/JSON rejection without protocol corruption. |
| Root gate | `npm run check` passes builds, Biome, boundaries and workspace typechecks. Existing unrelated `pi-sync` test lint warnings remain warnings. |
| Root tests | `npm test`: 555 files pass and one platform-only file is skipped; 7,676 tests pass and two platform-only/existing tests are skipped (pinned merged-base toolchain). |
| Dependency installation | Root `npm install` completed; comparison with the base lockfile found no changed version at any existing package path. New dependencies support local frontend building and browser verification only. |

The current 1,500-entry browser fixture verifies at most 50 trace rows and 100 navigator rows in the DOM, an actual hierarchy level beyond 1,500, and only one initial selected-entry detail request. A separate deterministic chain test covers 1,600 levels without recursive traversal or a UI depth cap. The older pre-redesign sample (182,216 snapshot characters in 2.2 ms) was observational evidence, not an SLA; it is not claimed as a benchmark of the current layout. The deterministic 10,000-entry inventory cap test remains.

## Review remediation

All nine original threads were evaluated independently in `REVIEW.md`: eight introduced/exposed defects are fixed in scope; the old endpoint-page issue is already covered by the current 1,500-level selected-leaf regression. New tests cover coalesced notifications and static-node identity during high-frequency partials, zero retained timers after abort, silent append/label/name/active/schema changes without projection polling, missing versus known-empty historical tool baselines, long OSC/CSI sanitation before visible budgets, repeated raw/nested IDs and per-assistant correlation, overlapping ambiguous IDs and occurrence eviction, independent repeated-ID selection, eviction fallback, navigator scrolling without live-update scroll resets, and selected-detail error/retry recovery. Final native pipeline tests continue to compare enabled/disabled model-visible prefixes.

The reconciliation path uses only public readonly APIs. No private extension implementation, model-prefix transition, new dependency or persistent setting is introduced. Static cache strips live-call references so it cannot retain evicted results. Existing budgets remain; sanitization scans complete strings before output truncation, using Node\'s control-sequence remover and bounded object traversal. Original payloads remain unchanged.

## Repeat-review remediation

Four additional comments at head `745969a2` were verified against current code and native Pi ancestry traversal. New regressions cover a visible roving trace target after paging, keyboard page crossing, collapse and filtering; 429/503 reconnect and terminal HTTP/generation refusal; self/disconnected parent cycles, missing parents, both selected/leaf ancestry and the explicit 10,000-entry inspection budget; and sanitized 512-character session-name publication/reconciliation with truncation metadata and unchanged raw source. Browser cycle selection retains raw evidence and remains responsive. All ancestry traversal call sites were audited; unsafe native `getBranch()` is no longer used by the inspector. Canonical Pi projections remain unchanged for valid bounded paths.

Both root gates, local build/types/Biome, 42 local tests, 21 browser tests and explicit/discovery Pi CLI smoke passed. Original model-prefix/native pipeline and prior UI regressions remain covered. No package promotion, private extension dependency, settings or model-visible prefix transition was introduced.

## Third-review remediation

Four new comments at `c63b99f7` were confirmed independently. Runtime identity tests cover missing/null/numeric/object/array/boolean/empty entry IDs; missing/non-string/empty parent IDs; ancestry rejection; malformed leaf publication; bounded diagnostic samples and unchanged source. A browser test serves a real synthetic malformed entry through the native fixture server and verifies healthy navigation plus raw evidence. Other browser regressions verify branch-error survival across live snapshot refresh and retry, independent retained JSON disclosure across A/B/A/B selections, and visible child counts with matching/hidden siblings. All Inspector historical structured-data scopes were audited alongside the core scope-key fix.

The full local suite now contains 56 tests and 25 Chromium tests. Identity validation uses public readonly fields only and does not repair sessions or invent IDs. Scoped branch requests preserve abort/stale-owner protection, and no model-visible prefix or settings transition is introduced.

## Fourth-review remediation

Five new comments at `a5b741aa` were independently confirmed: quiet snapshot failures need their own retry; semantic kind fields can be React-invalid; duplicate IDs have conflicting map/raw evidence; inline fan-out projects full off-branch history; and linked legal files are not served. Regressions cover transient snapshot recovery with unchanged SSE, terminal snapshot refusal, terminal SSE cancellation of pending snapshot retries, type/role equivalence classes, duplicate collisions inside/outside the navigation budget and duplicate ancestors, 50 inline details against 100,000 off-branch entries with zero full-history reads after one owned index build, structural invalidation/disposal, canonical projection equality at every valid fixture leaf, and actual inline license text in generated app.js.

Local validation now passes 67 tests across nine files and 29 Chromium tests. The structural index is owned by SessionFeed, invalidated on structural change and inaccessible after close. Native projection receives only validated ancestry; no provider/private extension behavior is recreated. Generated third-party legal notices remain inside the served JS rather than linking unserved assets.

## Compact fallback URL

Fallback URLs use a 43-character Base64url encoding of the original 32 random token bytes, retaining 256-bit entropy. The full URL is at most 68 characters and printed on its own notification line. Public generation metadata is encoded into the data-free HTML shell; all authenticated endpoints still enforce the generation and token. Tests verify URL bounds/entropy, absence of credentials in the shell, inert encoded generation text, standalone fallback notification, compact-link browser authentication/fragment removal/reload and legacy fragment compatibility. Lifecycle cleanup and model-visible prefix behavior remain unchanged; native terminal hyperlink detection is terminal-specific and not asserted by browser tests.

## Primary /inspect command

`/inspect` and `/inspect stop` are the primary routes and all usage/fallback prompts use them. `/session-inspector` retains the identical handler as a compatibility alias. Extension-conventions command MUST rules were audited for preserved established routes, argument completion/rejection, consent, non-TUI observability and shared lifecycle ownership; no settings or model-visible behavior changed. Local tests exercise primary mode guards and alias consent/start/stop reuse; the real Pi/browser lifecycle test and explicit/trusted-discovery/reload/replacement smoke now exercise `/inspect`. The other browser flows are unchanged and reuse the preceding full 30-test run.

## Sixth-review remediation

R36–R40 are confirmed in-scope fixes. Sanitized credential keys are classified across camelCase/acronym boundaries while tokenCount/apiKeyCount and prose labels remain visible. Snapshot eviction uses filter ownership at async admission and only represented anchors. Entry-summary timestamp/result IDs use 512-character rejection budgets with bounded raw diagnostics. Context edits validate target identity plus null/string/object-array replacements before native replay, preserving authenticated raw access for the edit and descendants. Optional missing/empty session_info names retain native title-clear semantics; other non-string values remain diagnostic.

Native comparison covers user, assistant, toolResult and custom edit targets, null omissions, strings (including empty), empty/object arrays, and loaded strings requiring native role normalization. Malformed replacement/target classes and exact/over-budget summary identities are table-tested. The delayed browser snapshot test changes filters after the server response is captured and verifies visible fallback in both views, unchanged filters and unchanged Pi leaf. Validation: local build/types/Biome, 162 local tests, 40 Chromium tests, explicit/trusted-discovery/reload/replacement Pi smoke and both root gates passed (7,461 root tests, one skip). Final native-equivalence test additions were locally revalidated; production source and root inputs are unchanged since those full gates.

Semantic audit against AGENTS.md and docs/extension-conventions.md covered every EntrySummary string, sanitation-before-classification, all native replacement branches, optional name semantics, async generation/filter ownership, immutable raw payloads, request-prefix stability and owned lifecycle cleanup. No new task/settings/dependency/package/protocol/prefix transition. CI1 remains deferred; paid-provider/final-transport/physical-desktop limitations are unchanged.

## Final-refresh system-envelope fix

R41 was found by the required final feedback refresh and independently confirmed in Pi AI contentText/getCurrentSystemMessage/getCurrentTools. Before replay, malformed system content, section values and tool-delta shapes are diagnosed; valid string/text arrays, future non-text object blocks, null section removals and absent/null optional metadata retain native behavior. Native prompt/tool equality and authenticated system/descendant raw-route regressions pass. Total local suite: 185 tests. Full browser suite (40), Pi smoke and root check rerun; unchanged root test inputs reuse the full passing gate above. No new prefix, mutation, ownership or compatibility deviation beyond explicit unsafe-envelope diagnostics.

## R57–R59 follow-up

Session IDs are display-only sanitized copies of accepted non-empty strings at most 512 characters; malformed/over-budget getter values publish explicit unavailable markers without echoing, hashing or changing manager identity. Snapshot/API/browser full-title fields now receive only that bounded value; quiet stamp never used session ID. Tables verify exact boundaries, control removal and original-value preservation. Persisted tool-call ID/name bounds from 6610f66c are reverified at exact/empty/over-limit boundaries (R58 already addressed).

Live selected reveal identity includes the bounded actual occurrence ancestor chain, not only its selected ID. Late parent adoption reopens the required ancestors once; manual collapse remains closed on passive snapshots. The visited-set guard avoids cyclic traversal. Late-parent/disclosure browser and all prior eviction/navigation tests pass.

Final local/build/types/Biome/browser/Pi smoke/root check were rerun. Root-test inputs remain unchanged since the passing 7,676-test full gate and that evidence is reused. Guides/audits: AGENTS.md / docs/extension-conventions.md, complete display-ID/classification and live ancestry ownership. Existing release integration/provider/desktop/transport limits remain unverified.

## Final-refresh R49–R56 fixes

Native ancestry always validates structural IDs/parents/roles/cycles/budgets, while selected context edits and native projected message envelopes are validated after compaction/edits. Only the newest checkpoint contributes messages; obsolete malformed checkpoints/content no longer suppress valid descendants. Previous malformed context is explicitly unavailable without disabling valid current context. Structural corruption remains fenced.

Same-ID/same-anchor occurrence multiplicity fences transcript association, including descendants; different completed anchors remain independent. Live hierarchy retains raw parent IDs after parent eviction, and still-captured calls with anchors omitted from the bounded node inventory retain captured details with an explicit unavailable navigator target. No fake fallback source or Pi leaf mutation is introduced.

Privacy tests cover exact AWS secret-access-key forms and preserve public accessKeyId/metric fields. Raw message/system/edit content arrays are bounded before scans. Skill evidence uses indexed paths, explicit recorded success, per-assistant unambiguous read IDs, at most 2,048 scanned evidence items/256 results and bounded user text. Incomplete traversal is flagged rather than claiming completeness; unknown outcomes are not successes.

Native compaction/edit/cycle/array boundaries, same/different-anchor/descendant correlation, credential/outcome tables and evidence caps pass; browser tests cover evicted raw parent display and >10,000-node anchor omission. Guides: AGENTS.md / docs/extension-conventions.md. Audit includes all semantic/structural selection branches, raw/preview separation, prefix stability, cache/scroll ownership and lifecycle cleanup. Existing release-gate integration/paid-provider/final-transport/desktop limitations remain unverified; no dispatch or new settings/packages.

## Concurrent push-trigger CI repair

User commit 4068d169 arrived during root validation, replacing the previously repaired trigger. The failed root policy assertion is independently reproduced. Its push trigger is preserved; the release job uses push/manual identities and checks out github.sha. Before dependency scripts/publication, a readonly GitHub API gate waits for the newest exact-SHA main push CI run to succeed; absence/pending waits, terminal failure/unknown response/HTTP error/timeout refuses publication. Polling and request/step deadlines are bounded; tokens are never logged. Manual dispatch remains the explicit bypass, as before. Deterministic gate-state tests and workflow-order code audit cover the classes without dispatching/publishing. User commit 40bf25d3 committed/pushed the fixes and removed the obsolete separation test; publication is reused, and that test is not recreated. Live main-push gate integration remains unverified because PR CI does not invoke publication.

## Ninth-review historical tool and live identity budgets

R47 adds a 2,048 cumulative addition/removal budget across each current/previous projection, with per-array size rejection before shape scanning. Added name/description/parameter metadata and removed names share the 1 MiB input-character budget; declaration traversal stops at 16,384 nodes/depth 32, without serialization or terminal sanitation of oversized inputs. Ordinary/checkpoint, repeated/removed names, cumulative/previous-only, metadata/array bounds and accepted native ordering are tested; mocked native helpers must remain untouched on failure. Bounded Raw diagnostics remain available.

R48 validates all start/update/end admissions before lookups or argument/result capture. Invalid own IDs or tool names are rejected, never truncated/replaced, and an additive invalidCallEvents count publishes unavailable correlation in the live drawer. Invalid parent IDs are omitted and fenced against later adoption, including active records and throttled updates; invalid anchors become null with unavailable correlation. Only finite non-negative native durations are published. Exact 512-character boundaries, malformed classes, immutable inputs, all snapshot/feed cache paths and browser/HTTP rejection summaries are tested. Prefix, async session ownership and lifecycle cleanup are unchanged.

Applicable guides: AGENTS.md and docs/extension-conventions.md; audit covers every native tool replay call, current/previous/compaction projections, all published live string/numeric fields, cache/SSE notification and parent correlation fences. No settings/dependencies/package/release changes; existing paid-provider/desktop/final-transport limits remain. Final command totals above apply.

## Eighth-review merged-base CI and replay/reveal budgets

Integrated accepted main a5f24bd6 without changing its package implementations. Preserved .node-version, npm ci and installation-policy checks; restored publish's workflow_run trigger to align with its success/push condition, exact-tested-revision checkout and existing policy test. No release dispatch/publication. Use the pinned Node toolchain and bundled npm via fnm exec; preflight/install and Kit resolution verified without bypassing policy. Merged-base root gates, including release/install policy tests, are required rather than relying on the prior old-base local pass.

R45 reveal identity includes selected ID, serial and reveal ownership. A >300-row browser fixture excludes the late call's anchor, evicts the call, re-pages the same anchor into view under retained filters, and preserves manual pagination on a passive snapshot. Trace already keys explicit selection by serial; Live drawer has no reveal-ownership override or pagination, so unchanged ID-only expansion does not share this failure.

R46 preflights current and previous native projected messages before every inspector system-message/prompt join. Ordinary and checkpoint system content, text-block counts/fragments, section names/values and overwritten/deleted input contribute to the cumulative 1,048,576-character input budget; no source is truncated or changed. Over-budget previews report unavailable; authenticated branch diagnostics/detail Raw remain bounded. Tests assert no native concatenating helper is invoked on budget failure, exact boundaries, valid preview truncation, previous-only overflow and discarded-history/native equality. All other-role content is excluded from system replay budgeting. Raw preview capture remains separately bounded.

AGENTS.md and unchanged docs/extension-conventions.md audits cover complete native system replay sources, current/previous ownership, original-prefix equality, asynchronous lifecycle/cancellation and standalone Jiti loading. Existing paid-provider/final-transport/physical-desktop limits remain; no extension settings/package promotion. Commands/totals above apply to final merged-base validation.

## Seventh-review checkpoint and selection fixes

R42/R43 and native-audit finding R44 are recorded in REVIEW.md. Every stored system-message source was enumerated from sessionEntryToContextMessages: ordinary message entries normalize legacy missing/null content; compaction-owned checkpoints inject their message directly; custom/branch/compaction summaries contribute distinct non-system roles. Shared system-message.ts guards checkpoint content/sections/tool deltas without altering raw data, while ordinary system/user/assistant/toolResult missing/null normalization remains native-owned. Tests cover malformed and absent/falsy checkpoints, valid native prompt/tool equality, newest-checkpoint-only retention, all four legacy message roles and authenticated checkpoint/descendant raw routes.

Snapshot selection is reconciled against represented IDs at async admission. Omitted entries fall back to a represented leaf/node with the current filter epoch; empty inventories clear selection/details; represented historical previews remain selected even when Pi moves its leaf. Browser fixtures exceed 10,000 entries and verify filtered fallback visibility in navigator/trace, retained search, represented preview stability and no inspector-driven leaf mutation. Validation commands and final totals above apply; the unchanged R1–R41/native-prefix/lifecycle suites are retained. Guides: AGENTS.md and docs/extension-conventions.md; audit covers projection sources/normalization, bounded membership, original payload preservation, async ownership and standalone Jiti imports. CI1 and pre-existing paid-provider/desktop limitations remain deferred/unverified; no package/settings/release or model-prefix transition.

## Local directory rename

The project-local directory is now `.pi/extensions/inspect/`; no package promotion, command or runtime behavior changes. All 63 tracked files moved: 59 implementation/test/config files are byte-identical, with only README/verification paths, Vitest discovery and the smoke auto-discovery directory updated. Root generated-path ignores and retained-plan links follow the new path; `/session-inspector` remains a compatibility alias.

Against AGENTS.md and docs/extension-conventions.md, the final audit confirms local boundaries, relative imports, preserved default entrypoint/command ownership, no stale old-directory references and ignored generated outputs. New-path build/types/Biome, all 108 local tests, 39 Chromium tests, explicit/trusted-discovery/reload/replacement Pi smoke and both root gates passed (7,461 root tests, one existing skip). No new unverified runtime path or policy deviation is introduced; existing paid-provider/physical-desktop limitations remain unchanged.

## Fifth-review remediation

R23–R35 are independently confirmed in-scope defects, with evidence and dispositions in REVIEW.md. New local tests cover overlapping parent identities, retained descendants after eviction, malformed labels/session names/content/tool arguments/nested metadata, oversized IDs, late active-leaf reservation, prefixed credential redaction, bounded sanitized searches, zero idle getEntries calls on SDK managers with readonly-adapter fallback, and independent payload observations without false cache-warming turn attribution. Browser tests cover widened pane toggles, distant and case-only search/category resets plus preserved subsequent scroll, bounded paste ingestion, a leaf beyond 10,000 entries and independently labeled replay payloads. Existing native normalized-prefix, lifecycle/cancellation and R1–R22 regressions pass unchanged.

Local build/types/Biome, 108 tests, 39 Chromium tests, explicit/discovery/reload/replacement Pi smoke and both root gates pass (7,461 root tests, one existing skip). The final virtual-reset-only adjustment is excluded from unchanged root test discovery; local/browser/Pi and root check are rerun. Semantic audit against AGENTS.md and docs/extension-conventions.md covers every touched source/identity/search/parent traversal, public SDK count method fallback, immutable bounded raw evidence, pane/scroll/focus ownership and independent observation disposal. No settings, dependency, package or release changes.

GitHub run 37786510345 failed the unrelated release-workflow assertion: main commit 02f99c9a changes publish.yml to push while test/check-test-separation.test.ts still requires workflow_run. Neither file is changed by this PR. CI1 is deferred with a recommendation for a separate workflow/test alignment PR; no incident or scope-expansion justification exists. Paid-provider/physical desktop/OS paths remain unverified as before.

## Context Composition revision

The reference at https://sharex.narumi.dev/2026/10/08/rbVPWFceZphkJIJo.png defines the new primary off-white single-column composition. Screenshot evidence: `test-results/composition-reference-comp-2b550-content-and-explicit-source/context-composition-reference.png` and the adjacent mobile-dark screenshot, both ignored generated artifacts. The reference and rendered desktop/mobile images were inspected: role-colored rows, inline two-column metadata/content, collapsed advanced disclosures, muted fonts/surfaces and a narrow colored minimap replace persistent dashboard panes.

Public Pi runtime inspection verifies context_with_system runs after context handlers and Pi state restoration but before possible later handlers/provider conversion. Consent-gated handlers only copy bounded data and return undefined; real Pi normalized enabled/disabled request prefixes still match. The fallback is native active-leaf projection, explicitly session-derived. Assistant thinking/text/toolCall blocks stay in source order, repeated contents have independent stable identities, signatures/secrets are sanitized before summaries, and no usage count is relabeled as segment tokens. Lifecycle tests verify pre-consent silence, immutable copies, replacement disposal and raw provider-payload redaction.

Browser regressions verify secondary legacy functionality, source labels, independent disclosure/filter/navigation, nested JSON, dark/mobile overflow, minimap navigation, keyboard traversal across virtual windows, 2,000-message variable-height rendering with fewer than 50 mounted rows, and an older scroll anchor surviving tail append. Every ResizeObserver is disposed and cached measurements are pruned when source IDs disappear. Final local build/types/Biome, 76 local tests, all 35 Chromium tests, explicit/trusted-discovery/reload/replacement Pi smoke and both root gates passed before signed implementation `20446e07` was pushed to PR #1510. Root tests passed 7,461 cases in 542 files with one existing skip; existing unrelated Biome warnings remained non-failing. Semantic audit covered public capture-stage equivalence, normalized prefixes, privacy/truncation, immutable read-only data, source identity/order, virtual-scroll/focus ownership and observer disposal against root AGENTS.md and docs/extension-conventions.md. Settings, package promotion, new dependencies and publication remain out of scope. No paid-provider smoke was run; later hook stages/final transport payload, uncaptured content and segment token sizes remain unavailable rather than guessed.

## Progressive Explorer revision

The latest authorized redesign makes the center the primary developer surface: compact horizontal actual-parent rows, independent selection/disclosure, retained descendants, inline Overview/Content/Raw/Metadata, recursive object/array disclosure, and a collapsed live drawer. The metrics panel is now a small toolbar; heavy per-section blue framing and repetitive recorded-status badges were removed. Desktop sides resize/collapse, while constrained viewports use accessible Radix Dialog drawers.

Current generated Chromium artifacts (ignored) are `test-results/browser-compact-desktop-la-5d1fe-ew-JSON-copy-and-screenshot/session-explorer-desktop.png` and `test-results/browser-medium-narrow-and--04553-wers-without-page-scrolling/session-explorer-narrow.png`. Both were inspected after disabling screenshot-time animations. The 1115×627 layout is an effective 150% CSS-viewport surrogate for 1672×941, not a claim that native desktop Chrome zoom controls were automated.

Acceptance coverage includes three-plus actual nesting levels, sibling/orphan/cycle preservation, collapsed-parent descendant restoration, independently controlled selection, synchronized related navigation even outside filters, ArrowUp/Down/Left/Right/Enter/Space, retained JSON expansion, non-wrapping labels/tabs, pointer/keyboard resize and Escape cancellation, drawer focus trapping/restoration, scrolling only the owned panel, four-request concurrency and cancellation, 64-entry detail caching, compact empty live state and no auto-opening on updates. Existing public native codemode/post-transform/cancellation/reload/shutdown and redaction/CSP coverage remain.

Public execution events expose monotonic `durationMs` but no start/end timestamp. The collector therefore records explicitly named callback-observation wall-clock times, only for events actually seen. List remains default; log entries are points and live observed intervals use a shared axis. Tests verify start/end provenance, end/update-only records, running calls, reversed clocks, equal-time points and unchanged native durations. No inferred model/provider span is introduced. Source UI/async audit covers API queue abort listeners, immutable own-node projection cache keys, clipboard feedback guards, resize listener disposal, media listener cleanup, Radix focus ownership, and additive non-model metadata.

## Earlier screenshot-form revision (superseded interaction model)

The earlier UI was changed to the supplied screenshot\'s structure rather than merely recolored: top session bar, left tree/filter cards, wide center overview and expandable trace table, right event inspector with Formatted/JSON, and bottom connection bar. A rendered 1672×941 Chromium screenshot was inspected against the reference; the generated artifact is `test-results/browser-screenshot-form-la-98bd7-ON-filters-and-bounded-copy/session-inspector-desktop.png` under the local extension (ignored).

New browser coverage verifies column proportions, overview/trace/inspector regions, Expand all/Collapse all, Timeline/List, Formatted/JSON, copy success/denial, category/error/slow filters and the 1,000-line preview cap. Existing coverage still verifies search/keyboard, light/narrow layouts, malicious payloads, real native codemode/cancellation/reload/shutdown and lazy details. New deterministic metadata coverage verifies recorded usage, absent legacy usage/model fields, tool-result provenance and raw-history preservation.

Metrics intentionally differ from the mockup where data is unavailable: recorded timestamp span is not execution time; assistant-message count is not provider request count; tokens include only persisted assistant usage; errors count the bounded live collector; unavailable model durations/latency remain `—`. File-parent branch order and live execution-parent relationships are not merged into a fictitious execution graph. Clipboard output is a bounded redacted display copy, and feedback is guarded after component disposal. No new Pi hooks, settings, dependencies or model-visible prefix transitions were introduced.

## Semantic audit

Applicable guides: root `AGENTS.md`, `docs/extension-conventions.md`, and `docs/extension-settings.md` (persistent settings are not implemented).

- **Boundary:** All implementation, browser source, build helper, tests, configs and documentation are local to `.pi/extensions/inspect/`. Root changes are limited to frontend/test development dependencies, their lockfile, and generated-path ignores. No workspace, package manifest, Changeset, shared TypeScript configuration, root test support, root script or root extension registration was added.
- **Read-only contract:** Actual model-visible inputs are identical in enabled and disabled inspector sessions after excluding non-model metadata. Consecutive requests preserve the earlier normalized prefix. Activation does not alter prompt, messages or ordered active tools. Browser previews leave the Pi leaf unchanged.
- **Data provenance:** Pi AI replay and Pi projection helpers own prompt/tool/context reconstruction. Direct, parallel nested, permission-blocked, schema-invalid, unknown-tool and cancelled calls are represented without inventing child transcript entries. Live results are observed after result transformation; historical nested metadata is not mistaken for saved results. Unknown/legacy data and missing system checkpoints remain explicit.
- **Lifecycle:** Consent receives an owned abort signal. Startup reads/listening and the opener task are cancellable. Ownership is revalidated after awaits, including overlapping lifecycle boundaries. Resources are keyed by session manager rather than UI. Stop/reload/replacement/shutdown revoke serving resources, while browser effects cancel stale fetches/readers/timers. Tests cover partial startup, failed startup/retry, cancelled consent, stale launch, repeated activation, two managers sharing a UI, native SSE socket closure, real reload token rotation, and real runtime disposal.
- **Security:** Authentication includes constant-time equal-byte-length token comparison and generation checks. Host/Origin/method validation, malformed URLs, path traversal, client/socket limits and SSE backpressure have tests. Display traversal is bounded and does not evaluate object accessors; source entries/events are unchanged. Raster formats are allowlisted; SVG and oversized payloads are omitted, Markdown/HTML is literal, CSP and browser tests prove no remote requests or script execution.
- **Compatibility:** Entrypoint loading and public APIs are exercised through the manifest-selected Pi runtime and CLI resource loader. No implementation imports another extension or its private structures. Discovery/model-helper results and transport bytes are not claimed to be observable.
- **Recovery:** No settings or trace files are created. Failed activation can be retried; reconnect fetches a fresh snapshot. No session-file rewrites, migrations, uploads or release operations occur.

## Scope decisions and unverified paths

The default command is intentionally a frequent single action, with `stop` for deterministic cleanup rather than a manager menu. The Navigator remains a compact collapsible navigation list, while the Trace Explorer exposes actual levels, selected/expanded states and tree keyboard semantics. Existing capture/index bounds remain; hierarchy depth is not capped by the UI. Markdown/code are rendered as literal text rather than enabling rich HTML. These choices are documented in the README.

Headless Chromium and actual Pi SDK/RPC runtimes were exercised. A physical interactive terminal and the user's default desktop browser opener were not launched by automation; OS-specific macOS/Windows opener behavior remains unverified. The public dialog/notification contract and cancellation/fallback paths are covered by deterministic tests. No live paid provider or real external MCP server was used: native codemode and namespaced tool fixtures cover their public tool pipeline without external side effects.

`npm install` reports five existing dependency advisories (three high, two critical) in the Pi/concurrently dependency trees. No existing package version changed, and no force audit fix was applied; unrelated dependency maintenance is outside this change. Package packing, publication and release smokes are not applicable to a project-local extension.

The saved implementation plan remains until user acceptance of the first-version behavior and documented limitations; automated verification is not a substitute for that acceptance.