sessionFlow v1.1.0

sessionFlow v1.1.0

The continuation bundle no longer lets a clock decide what the work was.

v1.1.0 is a correctness release. It has no new commands and no new providers.
What it changes is what the product says — about which session a piece of work
stopped in, which WorkThread a repository's work belongs to, and what a provider
can actually do. Several of those statements were wrong before this release, and
two of them were wrong in a way that would have made an agent act on the wrong
history.

Nothing is uploaded anywhere; all indexing, searching and context restoration
happens locally.

---

Highlights

• One canonical session order. The handoff order, the most recent activity
  and the goal-conditioned conclusion are now three separate things, and only
  the handoff order decides what the bundle leads with. A session that was merely
  re-scanned can no longer take the headline from the session the work was handed
  to, and when the clock and the handoff order disagree the bundle says so.
• Ambiguity is reported, not resolved. A repository with more than one active
  WorkThread no longer gets one picked for it. Every surface returns the
  candidates; the commands that act refuse and tell you how to choose.
• A capability matrix that matches the adapters. voyager verify --matrix
  previously reported ZCode as supporting native resume while the adapter set
  can_resume = False.
• A corrupt or locked ZCode database is no longer a deleted one. Unreadable
  is not absent: history is retained, and the reason is reported.
• The bundle prefers evidence to assertion. Under budget pressure it used to
  keep an assistant's self-report and drop the repository snapshot.

---

Continuity correctness

Three concepts, kept apart (D20, #15)

Two compilation paths used to disagree about a WorkThread's sessions — one
ordered them by updated_at, the other by thread_sessions.ord — and both chose
the "latest" session by timestamp. The result: a session whose provider file was
re-scanned could take the headline away from the session the work had actually
been handed to, and the two formats could tell different stories about the same
data.

concept	source	role
thread order	thread_sessions.ord	the one session order; the persisted handoff sequence
latest activity	updated_at	reported as provenance, never used to select
relevant conclusion	goal + evidence	its own mechanism, unchanged

canonical_session_order() is now the single source of the order, shared by both
renderers, the handoff engine, the launcher and the bridge. The headline is the
last row in that order — the end of the handoff chain — and the bundle names the
rule that chose it. Where the clock and the handoff order disagree, the bundle
states the disagreement rather than silently picking one.

A session's earlier work survives (#14)

The bundle used to keep only each session's last assistant message, so a
session whose final turn was a progress note lost the proposals, constraints and
open items it had raised earlier. Selection now keeps several per session, labels
them ([proposal], [open]) and never presents them as verified fact.

A conclusion is not verified state

The section titled "Current verified state" held the newest session's last
assistant message. It is now "Latest assistant conclusion", read as what was
said rather than as what is true, and the older-session section no longer marks
anything "superseded" — a newer session is not automatically more correct.

---

Multi-WorkThread ambiguity safety (#17)

A repository can carry several active WorkThreads at once. The core was already
of two minds about this: the session-start hook and the MCP surface refused to
choose, while current_work, continue_context, voyager continue and
voyager switch all quietly took the newest. voyager thread reopen had even
been printing "automatic continuation will now report AMBIGUOUS and refuse to
choose" — the CLI contradicted its own warning.

auto.resolve_work_thread() is now the single resolver behind all of them.
Recency may suggest a default; it never establishes intent.

situation	behaviour
more than one active thread	thread_ambiguous: true, every candidate listed (id, title, updated_at, goal), newest first; the returned one is labelled a default
exactly one / none	unchanged, nothing added
explicit thread_id	honoured, including one from another repo (thread_out_of_scope)
thread_id that does not exist	thread_not_found, and no fallback to another thread
voyager continue / voyager switch	exit 2, print every candidate and --thread

Additive only: bridge schema stays v1.

---

Provider data reliability

• Unreadable is not absent. A ZCode database that is corrupt, locked or
  permission-denied used to be dropped by discovery, which made the scan conclude
  that every one of that provider's sources had vanished and mark all its
  sessions SOURCE_MISSING. Sources are now classified as absent / readable /
  unreadable / not-a-ZCode-database; "present but unusable" keeps the sessions
  live and the reason is reported. When the database becomes readable again, the
  next scan re-indexes normally.
• The Codex SessionStart relay hardcoded C:\Python314\python.exe and passed
  its payload through the console code page. On any other machine the hook
  produced empty output, and a non-ASCII repository path was mangled. The
  interpreter is resolved at run time and the payload is forwarded as bytes.
• Signal-word matching no longer confuses optional with option or
  have nothing with have not, without breaking CJK text adjacent to a
  keyword.

---

Capability reporting

voyager verify --matrix declared ZCode's native_resume as SUPPORTED while
zcode.py sets can_resume = False, so the matrix advertised a resume path that
could not be built. The adapter is now the authority for that dimension, and
voyager doctor explains every dimension from the same resolver the matrix
reads — so the two cannot drift apart again.

The README's platform table now says explicitly that its Resume column names
the command Voyager will run, not a verified outcome.

---

Context budget and provenance

• Budget packing kept a section's priority and its render order as one thing, so
  trimming a bundle also reordered it. They are separate now: priority decides
  what survives, the compiler decides where it appears.
• The keep-order put an assistant's self-report above the repository snapshot,
  files, commands and errors. Evidence now outranks assertion.
• _priority_of matched by prefix, so ## Goal captured
  ## Goal-ranked evidence and gave the evidence section the goal's priority.
• When a tight budget drops a conflicting proposal, the drop is reported rather
  than leaving a silently single-sided summary.

---

Verification status

Kept apart on purpose — nothing below is promoted.

what	level	evidence
Core suite	PASS	1072 passed, 20 skipped, 1092 collected; CI 10/10 on Ubuntu and Windows, Python 3.10–3.13
Continuation ordering, ambiguity, budget, capability truth	UNIT + INTEGRATION VERIFIED	the suites named in CHANGELOG.md
Cross-agent continuation through DSH	LIVE VERIFIED (synthetic index)	six real DSH turns, real model, real core — dsh-sessionflow/docs/p8-live-verification.md
Continuation from real provider session files	LIVE VERIFIED (real files, fixture scenario)	3 real Codex rollouts + 3 real Claude Code sessions copied into an isolated HOME and parsed by the real adapters, then continued by a real agent — dsh-sessionflow/docs/p9-live-verification.md
Hook firing (Claude / Grok / Codex)	ZERO_TOUCH_LIVE_VERIFIED	see the verification table in README.md
Native resume	NOT VERIFIED	no resume has been exercised end to end on any provider. The commands exist and are wired up; that is not the same thing

---

Compatibility and upgrade notes

• No breaking changes. Bridge schema_version stays 1; the six DSH tool
  contracts are unchanged; no CLI command was removed or renamed.
• Every new field is additive. A client that ignores unknown keys needs no
  change.
• voyager continue and voyager switch now exit non-zero when a repository has
  more than one active WorkThread and no --thread was given. Scripts that
  relied on the newest thread being chosen should pass --thread explicitly.
• The bundle's section headings changed (## Latest assistant conclusion,
  ## Other sessions' conclusions). Anything matching the old strings — a
  parser, a saved prompt, a test — needs updating.
• The index is not migrated destructively; the schema change is additive.

---

Known limitations

• Native resume is not verified. codex, claude, dsh and grok declare
  a resume path and the adapter builds the command; none has been observed
  resuming a session end to end. zcode, cursor, kiro and antigravity
  report no resume path at all, and the matrix now says so.
• Provider capability variance is unchanged from v1.0.0: agents expose
  different levels of persistence detail, and file-edit tracking is stronger on
  some than others.
• The live verification used synthetic and real-format fixtures, not a real
  project of yours. What that proves is the pipeline; it does not claim anything
  about your specific session files.
• Distribution is still GitHub source install. PyPI and npm publication remain
  deferred: the voyager name on PyPI belongs to an unrelated library, so
  pip install voyager installs the wrong project.

---

Changelog: CHANGELOG.md.
Decisions: docs/DECISIONS.md — D20 covers the ordering rule.
Plugin: dsh-sessionflow — see its v1.1.0 notes for the DSH side.