[johnnyhuy]

Session history now groups fork archives beneath their source and provides a navigable entry tree and branch-tip selector. Selected entry and archive tip are distinct; preview follows only the selected parent chain. Resume and Fork from here carry that exact selection through IPC, and the main process checks Pi's loaded leaf before sending a prompt. The main process refreshes archive ownership and validates/reuses a single live runtime; repeated current-tip resume preserves its tab, and a running, mismatched, or unresponsive owner cannot silently become a competing writer. A reused runtime that switched archives refreshes its identity and transcript from verified state. Invalid/missing lineage, empty archives, stale selection, malformed records, and unavailable sources have explicit handling. Large entry lists and existing transcripts remain virtualized.

Pi 1.5.0 RPC exposes tree reads, fork, and clone, but no arbitrary-entry navigation command. Current-tip resume continues the original archive. Pi can append thinking/model metadata while opening an archive, so every fork is extracted before Pi starts; source bytes stay unchanged even during runtime startup. Historical continuation is labeled Resume in new fork. Forking writes a separate native v3 archive containing the selected chain, then opens it through supported --session. The runtime guard accepts only a verified linear chain of startup model/thinking entries after the selection and rejects unrelated movement. It preserves the original file and both source branches. ADR 0013 records the inspected runtime semantics and trade-offs.

Validation actually run (final head 3bce2eab0a0c738e589254fdc336e8679c11bacf; all GitHub checks pass and AO internal review is approved; this is not GitHub approval or merge authorization):

• mise run build: lint, all typechecks, 57 unit tests, 26 component tests, production bundle passed with pinned Node 22.23.0/Bun 1.3.14.
• bun run test:e2e under mise: all 26 deterministic Electron tests passed, including branch/ancestor selection, exact fork contents and prompt target, unchanged source bytes, current-tip resume, empty/stale selection, repeated resume with identical subprocess/tab count, active-owner rejection, failed owner-refresh refusal with unchanged bytes/PID, archive-switch identity/history replacement, normal archive-tree clicks at 1100×700, existing workbench behavior, streaming, and 4,500-entry transcript regressions. An earlier long-streaming timing timeout passed unchanged in isolation and on full reruns. The initial CI archive-list collapse is fixed with a reserved scrollable list; no forced clicks are used.
• Installed Pi 1.5.0 smoke: opened the actual forkArchive output and checked startup setup lineage through the implemented guard plus history through get_messages; only the selected branch appeared and source bytes were unchanged. No model prompt or tools executed.
• Screenshot/video proof: the branch tests capture selected-branch.png, selected-entry-fork.png, and session-tree-navigation.webm; CI uploads these in the pidex-e2e artifact under branch-proof/. Download uploaded screenshot/video proof. Local proof is also attached to AO session pidex-2. The recording includes a deliberate owner-refresh failure and its expected refusal to start another writer.
• AO Browser panel preview opened with deterministic temporary archives and the production renderer/parser. Interactive verification is pending panel visibility: AO reports BROWSER_PANEL_HIDDEN for human pointer input and ordinary input has not navigated the preview.

Known limits: continuation requires intact v3 archives within the existing 16 MiB browsing bound; older archives must be migrated in Pi. Archive extraction does not invoke extension fork hooks and previews show stored parent-chain history while Pi constructs its compacted runtime context. This adds no in-place historical navigation RPC. No live-provider inference was tested.

Refs #3 — first slice only. Last meaningful action / next-step recovery summaries and stale/blocked/done signals remain deferred, as do #4 cross-folder migration and #5 multi-root workflows. This PR intentionally does not close #3. No merge requested.

[johnnyhuy]

Changes requested: one required lifecycle fix is posted inline.

Standards

No required standards or convention findings.

Spec

Repeated current-tip resume can create concurrent writers for the same archive. Preserve one live owner while validating the requested selection.

Static review covered the base-to-head diff, tests, and installed Pi 1.5.0 archive/RPC implementation. Tests and project programs were not run, as required by the reviewer role.

Findings: Standards 0; Spec 1 (P1: concurrent archive writers).

[johnnyhuy]

Changes requested. The earlier P1 repeated-resume finding is fixed for successful RPC calls, with regression coverage for runtime/tab reuse and streaming rejection. Two P2 issues remain and are posted inline.

Standards

No required standards or convention findings.

Spec

1. A failed owner state refresh can permit a second writer for the same archive.
2. Reusing a runtime after it switches archives retains the previous archive's identity and transcript.

Reviewed the full diff against main at a7e9f44 and the revision since 4ae2149, including tests and installed Pi RPC semantics. Tests and project programs were not run, as required by the reviewer role.

Findings: Standards 0; Spec 2 (both P2).

[johnnyhuy]

Approved / ready. The prior P1 and both P2 findings are addressed: repeated resume reuses the archive owner, uncertain ownership fails closed, and switched-archive reuse refreshes tab identity and history. Regression coverage exercises these paths.

Standards

No required findings.

Spec

No required findings within the documented session-tree first slice.

Reviewed the full diff against main at a7e9f44 and the latest revision. Verified successful CI and Electron e2e runs for head 3bce2ea. Tests and project programs were not run locally, as required by the reviewer role.

Findings: Standards 0; Spec 0.