2026.10.03 - Phase 2: Pi DCP Correctness and Configuration Safety

[lanhhoang]

• Pi-native file paths are protected from pruning — read, write, and edit now read Pi's path field in addition to legacy filePath on every tool, normalize Windows separators, dedupe, and preserve order. Nested calls recorded on a tool result (e.g. from codemode) are inspected too, so a parent tool result is protected when any direct or nested file path matches protectedFilePatterns (src/strategies/protected-patterns.ts, src/state/tool-cache.ts, src/state/types.ts, src/strategies/runner.ts, tests/protected-patterns.test.ts, tests/tool-cache.test.ts, tests/strategy-runner.test.ts).
• Development dependencies align with Pi 1.0.1 — @earendil-works/pi-agent-core and @earendil-works/pi-coding-agent move from ^1.0.0 to ^1.0.1 in devDependencies so the checked-in AgentMessage types expose toolResult.nestedCalls; the exact * peer ranges are preserved and no runtime dependency was added (package.json, pnpm-lock.yaml, pnpm-workspace.yaml).
• Context limits are bounded and rejected when unsafe — maxContextLimit / minContextLimit and their per-model entries accept only a positive integer token count or a percentage string greater than 0 and at most 100. Anything else is dropped with a warning instead of aborting startup (src/config-schema.ts, src/config-validation.ts, src/utils/context-limits.ts, tests/config.test.ts, tests/context-limits.test.ts).
• Configuration layers fall back independently — sanitizeConfigLayer walks each layer once with a schema-guided recursion: declared objects retain supplied valid siblings, Type.Record values are validated independently, arrays/unions/scalars go through Value.Check with collapsed union errors, and unknown or invalid fields emit one warning per RFC 6901-escaped JSON pointer including the source file. In loadConfig, the sanitized value is deep-merged over the accumulated config, so an invalid global field keeps the built-in default and an invalid project field inherits the valid global value rather than resetting it. Legacy maxContextPercent / minContextPercent cross-checks are relabeled as merged-configuration diagnostics (src/config.ts, src/config-validation.ts, src/logger.ts).
• Configuration problems surface once per reload — reloadConfig writes each warning via logger.warn("config", ...) and, when ctx.hasUI is true, emits exactly one ui.notify(..., "warning") containing the problem count and the participating global/project config paths. Raw configuration values are never included in the UI summary. The initial module-level loadConfig call stays silent; session_start owns the visible reload (src/index.ts, tests/index.test.ts).
• Compression turn nudges honor nudgeForce — eligible user/assistant pairs are anchored atomically: the user message and the nearest earlier assistant are both added in one branch, and frequency is measured against existing user-role turn anchors only (the assistant half of a prior pair never suppresses a later pair). strong renders the nudge in the user role; soft renders it in the assistant role, including a synthetic text part inserted before the first tool call of a tool-only assistant message. Context-limit and iteration anchors are unchanged, and the version-1 snapshot shape is preserved (src/messages/inject.ts, tests/anchored-nudges.test.ts, tests/inject.test.ts, tests/pipeline.test.ts, tests/summary-buffer.test.ts).
• Version bump and docs refresh — version 0.6.1 → 0.7.0 (package.json); CHANGELOG.md adds a [0.7.0] - 2026-10-03 entry; README.md replaces the 0.6.1 block with a focused "What's new in 0.7.0" section covering Pi path protection, bounded context limits, layer fallback, one-summary-per-reload, and strong/soft turn nudges. dcp.schema.json is regenerated and now exposes integer with minimum: 1 and the ^\d+(?:\.\d+)?%$ percentage pattern for the global and per-model limit fields (package.json, CHANGELOG.md, README.md, dcp.schema.json).
• Plan and design review fixes — the Phase 2 plan and the improvement-roadmap design spec were tightened to match what shipped: the persistence row note about the snapshot shape, the Pi 1.0.1 dependency line, and the warning-lifecycle rule are now consistent across both documents (docs/superpowers/specs/2026-10-03-pi-dcp-improvement-roadmap-design.md, docs/superpowers/plans/2026-10-03-phase-02-pi-dcp-correctness-config-safety.md).

Automatic pruning timing, canonical IDs, compression behavior, and the version-1 persisted snapshot shape remain unchanged; no new runtime dependencies, no published Pi or OpenCode reference repositories, and no release workflow were touched. Verified end-to-end with pnpm check (format, warning-free lint, typecheck, 570/570 tests), pnpm run pack:dry-run (pi-vault-pi-dcp-0.7.0.tgz ships only the intended source/schema/docs), and pnpm benchmark (three workloads complete without correctness failures).