feat(core): add first-class Pi session indexing (#23)

Pi cannot be read as another linear JSONL stream. Its history is a tree with
a durable leaf, orphan roots, branch summaries, and two compaction forms, so
the active context is something the format states rather than something line
order implies. The adapter keeps those semantics inside itself and projects
the result into the existing canonical tables.

Sessions are keyed by (normalized header cwd, header id) rather than by path,
because Pi's --session-id lookup is project-local: two projects may reuse an
id, while a move or an identical copy is still one session. Discovery covers
both layouts Pi writes and fingerprints each file by mtime, ctime, size and
inode, so a rewrite that preserves mtime is not read as unchanged.

Abandoned branches are preserved rather than dropped. Visibility becomes
three-state -- visible, inactive, hidden -- and helpers return only visible
rows until includeInactive asks for the superseded path, labeling every row
so a caller knows which it holds. Usage counts all three, because an
abandoned call still spent tokens; message_count reports only the visible
transcript.

A committed MIT-licensed oracle transcribed from Pi 0.83.0 pins the context
algorithms, and a fixed-seed differential runs 512 generated sessions against
it on every test run. Schema changes are additive.

tests/provider-settings.test.mjs

@@ -1,6 +1,13 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 
+import {
+  createConfiguredBuiltinProviderRuntime,
+  readPersistedProviderSettings,
+} from '../packages/core/src/provider-settings.ts';
 import { createProviderRegistry } from '../packages/core/src/providers/registry.ts';
 import {
   buildSourceCatalog,
@@ -8,10 +15,10 @@ import {
   setPersistedSetting,
 } from '../app/src/main/provider-settings.ts';
 
-function provider(id, defaultRoot, color) {
+function provider(id, defaultRoot, color, descriptor = {}) {
   return {
     name: id,
-    descriptor: { id, name: `${id} name`, vendor: `${id} vendor`, defaultRoot, color },
+    descriptor: { id, name: `${id} name`, vendor: `${id} vendor`, defaultRoot, color, ...descriptor },
     watchRoots: () => [],
     discover: () => [],
     *parse() { yield* []; return null; },
@@ -73,3 +80,147 @@ test('removing a generic provider root restores its descriptor default', () => {
   assert.equal(setPersistedSetting(persisted, 'providerRoots.gamma', null), true);
   assert.deepEqual(resolveProviderRoots(registry, persisted), { gamma: '/default/gamma' });
 });
+
+test('source catalog surfaces exact provider issues without hiding indexed sessions', () => {
+  const registry = createProviderRegistry([
+    provider('alpha', '/default/alpha', '#112233'),
+  ]);
+
+  assert.deepEqual(buildSourceCatalog({
+    registry,
+    roots: { alpha: '/custom/alpha' },
+    stats: new Map([
+      ['alpha', { sessionCount: 2, lastIndexed: '2026-07-20T10:00:00.000Z' }],
+    ]),
+    sourceIssues: [{
+      provider: 'alpha',
+      path: '/custom/alpha/locked',
+      error: 'EACCES: permission denied',
+    }],
+    pathExists: () => true,
+  }), [{
+    id: 'alpha',
+    name: 'alpha name',
+    vendor: 'alpha vendor',
+    color: '#112233',
+    path: '/custom/alpha',
+    settingKey: 'providerRoots.alpha',
+    exists: true,
+    sessionCount: 2,
+    lastIndexed: '2026-07-20T10:00:00.000Z',
+    status: 'warn',
+    statusText: 'Index issue: /custom/alpha/locked — EACCES: permission denied',
+  }]);
+});
+
+test('an ambiguous provider default stays omitted until the user selects a root', () => {
+  const registry = createProviderRegistry([
+    provider('relative', '/fallback/relative', '#999999', {
+      requiresExplicitRoot: true,
+      rootResolutionReason: 'Relative runtime setting needs an explicit folder',
+    }),
+  ]);
+
+  assert.deepEqual(resolveProviderRoots(registry), {});
+  assert.deepEqual(resolveProviderRoots(registry, {
+    providerRoots: { relative: '/fallback/relative' },
+  }), {
+    relative: '/fallback/relative',
+  });
+  assert.deepEqual(buildSourceCatalog({
+    registry,
+    roots: {},
+    pathExists: () => true,
+  }), [{
+    id: 'relative',
+    name: 'relative name',
+    vendor: 'relative vendor',
+    color: '#999999',
+    path: '/fallback/relative',
+    settingKey: 'providerRoots.relative',
+    exists: true,
+    sessionCount: 0,
+    lastIndexed: '',
+    status: 'error',
+    statusText: 'Relative runtime setting needs an explicit folder',
+  }]);
+});
+
+test('provider roots expand a persisted home-relative path before registry construction', () => {
+  const registry = createProviderRegistry([
+    provider('alpha', '/default/alpha', '#112233'),
+  ]);
+
+  assert.deepEqual(resolveProviderRoots(
+    registry,
+    { providerRoots: { alpha: '~/custom/sessions' } },
+    { homeDir: '/home/probe' },
+  ), {
+    alpha: '/home/probe/custom/sessions',
+  });
+});
+
+test('relative provider roots never depend on the Obelisk process cwd', () => {
+  const registry = createProviderRegistry([
+    provider('alpha', '/default/alpha', '#112233'),
+    provider('explicit', '/fallback/explicit', '#445566', { requiresExplicitRoot: true }),
+  ]);
+
+  assert.deepEqual(resolveProviderRoots(registry, {
+    providerRoots: { alpha: './alpha', explicit: '../explicit' },
+  }), {});
+});
+
+test('an invalid persisted root disables that provider instead of selecting its default', () => {
+  const runtime = createConfiguredBuiltinProviderRuntime({
+    providerRoots: { claude: './relative-claude' },
+  }, {
+    homeDir: '/home/probe',
+    baseRoots: { claude: '/default/claude' },
+  });
+  const claude = runtime.registry.get('claude');
+  let issue;
+
+  assert.equal(runtime.roots.claude, undefined);
+  assert.equal(claude.descriptor.requiresExplicitRoot, true);
+  assert.deepEqual(claude.watchRoots('/default/claude'), []);
+  assert.deepEqual(claude.discover({
+    lastCursor: () => null,
+    reportIncompleteInventory(value) {
+      issue = value;
+    },
+  }), []);
+  assert.deepEqual(issue, {
+    path: '/default/claude',
+    error: 'Configured claude root must be absolute or start with ~',
+  });
+});
+
+test('malformed provider root containers cannot select defaults and are repairable', () => {
+  const registry = createProviderRegistry([
+    provider('alpha', '/default/alpha', '#112233'),
+  ]);
+
+  assert.deepEqual(resolveProviderRoots(registry, { providerRoots: [] }), {});
+  assert.deepEqual(resolveProviderRoots(registry, { providerRoots: 'invalid' }), {});
+
+  const persisted = { providerRoots: [] };
+  assert.equal(setPersistedSetting(persisted, 'providerRoots.alpha', '/custom/alpha'), true);
+  assert.deepEqual(persisted.providerRoots, { alpha: '/custom/alpha' });
+});
+
+test('settings reader rejects malformed provider root containers', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'obelisk-provider-settings-'));
+  const settingsPath = join(directory, 'settings.json');
+  try {
+    for (const providerRoots of [[], 'invalid']) {
+      writeFileSync(settingsPath, JSON.stringify({ providerRoots }));
+      const result = readPersistedProviderSettings(settingsPath);
+      assert.equal(result.ok, false);
+      assert.deepEqual(result.settings, {});
+      assert.match(result.error, /providerRoots are not an object/);
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+});