Module continuity 

The continuity module: what this checkout’s lifecycle is holding right now — the open episode, the record the next worker would resume from, the newest progress note, what is blocking acceptance, and whether the provider’s events actually reach the tool.

Everything else in this executable reads the shared half of the layer: objects that are tracked, identical in every clone, and safe to project onto a public site. This module reads the other half, .ai/local/state/, and the difference decides the whole design.

It is read, never written. The lifecycle is the shell tool’s; this process is one of its readers. A second writer for the same records would be a second account of events the ledger already holds, which is the thing that design refuses.

It is served, never published. These records name this machine — a worktree path, the checkpoint that happened to be newest on this disk — and a fact about a disk is not a fact about the repository (ADR 0014). So the exposure is the loopback server and MCP, both of which serve the worker sitting in front of this checkout, and there is no projection into docs/generated/ or site/. The static site documents the mechanism and carries none of its content. A generator that published a session’s briefing would publish the one thing in the layer that no other clone can reproduce.

Absence is an answer. Every field here can be legitimately empty: a fresh clone has no ledger, a worker outside a task has no task, and a branch with no prior episode has no handover. Each of those is reported as itself rather than as a failure, and the resolver below never widens its search to make one go away — a record from another worktree silently becoming your context is worse than having none, because you cannot tell it is wrong until you have acted on it.

Structs

ActiveTask

The active task of this checkout, when there is one.

Continuity

What the lifecycle of this checkout is holding.

OpenSession

The open episode this checkout points at, when there is one.

Record

One durable record of the local half, as much of it as a reader needs to decide whether to open the file.

Thresholds

The thresholds a record is judged against, read from session.freshness: of the policy and never defaulted here.

Enums

Divergence

How far a record’s recorded commit is from the commit this checkout is on.

Freshness

How old a record is, judged against session.freshness in the policy.

Match

Which tier of the resolution rule matched. There is no third tier on purpose: a record from an unrelated worktree or branch is never offered.

Constants

CONTINUITY_URI

The URI under which continuity.state is read as an MCP resource.

Functions

epoch_seconds

Seconds since the Unix epoch for an RFC 3339 instant in UTC (2026-09-05T12:34:56Z), or None when the string is not one. The inverse of crate::peers::rfc3339, and written beside it for the same reason: no date crate, and the layer’s timestamps are one shape.

module

The module.

span

Whole minutes as the shell tool renders a span: 18m, 25h, 6d.