mirror-mind 0.36.0 → 0.36.2

package/docs/releases/index.md

@@ -12,6 +12,8 @@ Future release notes should use the structure defined in [Release Notes](../proc
 
 ## Releases
 
+- [v0.36.2 — Clearing Out What Another Home Copied](v0.36.2.md) — patch release of one Change Request, CR154, finishing what v0.36.1 began: `mirror conversations imported` lists the Pi conversations an earlier version imported, by the folder each session came from and beside how many sessions the home logged live there, and `remove` deletes the ones you name, only on `--apply` and after a verified backup. `discard-current` no longer fails on a conversation a Soul Mode integration names. No migration.
+- [v0.36.1 — A Home Keeps Only Its Own Pi Sessions](v0.36.1.md) — patch release of one Change Request, CR153: session maintenance imports no Pi session, so the Mirror homes on one machine no longer copy each other's Pi conversations; a home's Pi conversations are the ones the Pi extension logged into it. `PI_SESSIONS_DIR` is inert. Conversations an earlier version imported stay, and the note shows how to list them. Update every install that has a home. No migration.
 - [v0.36.0 — Five Runtimes, and a Home's Extensions on Every One](v0.36.0.md) — minor release closing CV21.DS10: Grok Build is the fifth runtime, at its honest L3 through the canonical plugin in two printed steps, measured live on grok 1.0.62. With it, CV21.DS5.US2: a home's installed extensions reach Claude Code, Codex, Antigravity, and Grok Build as one generated plugin per home, chosen by measurement on all four. Three Change Requests found by use: an extension's settings file (`extensions/<id>.env`, merged under the environment for the one spawned process), a quiet exit on a closed pipe, and a `bind` that refuses what it cannot bind. No migration.
 - [v0.35.0 — Four Runtimes, One Successor](v0.35.0.md) — minor release closing CV21.DS8: the Gemini CLI integration no longer ships and Antigravity stands in its place, the gate met by DS7's live L4 on agy 1.4.2. Four runtimes — Pi, Claude Code, Codex, Antigravity — named everywhere; the cutoff recorded in full, with the four hook entries a Gemini CLI user deletes and v0.34.0 as the last release that carries the integration; a retired-surface guard keeps it removed. No migration.
 - [v0.34.0 — Codex Through the Canonical Plugin](v0.34.0.md) — minor release closing CV21.DS4: Codex runs Mirror through the canonical plugin, installed in two commands from a marketplace the package ships, measured live at L4 on Codex 0.163.0. The v0.32.1 wrapper wiring no longer ships; `runtime diagnose` and `runtime update` say when Codex's cached plugin copy is behind and name the re-add that brings it level. No migration.

package/docs/releases/v0.36.1.md

@@ -0,0 +1,137 @@
+---
+digest: >
+  v0.36.1 is a patch release of one Change Request, CR153. Session
+  maintenance used to read Pi's session directory and import every session a
+  home did not already track, so on a machine with more than one Mirror home
+  each home copied the other's Pi conversations and titled them again through
+  the provider. Maintenance now imports no Pi session: a home's Pi
+  conversations are the ones the Pi extension logged into it, as they
+  happened, and `PI_SESSIONS_DIR` is no longer read. Conversations an earlier
+  version imported stay where they are, and this note shows how to list them.
+  Update every install that has a home. No migration.
+---
+
+# v0.36.1 — A Home Keeps Only Its Own Pi Sessions
+
+**Date:** 2026-10-21
+
+## Highlights
+
+- **Session maintenance imports no Pi session**
+  ([CR153](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr153-a-home-s-pi-backfill-imports-another-home-s-sessions.md)).
+  It used to read every file in Pi's session directory and import each one the home
+  did not track, every session another Mirror home on the same machine had logged
+  among them. A home's Pi conversations are now exactly the ones the Pi extension
+  logged into it, as they happened.
+- **Nothing in Mirror reads Pi's session files.** Not your history from before Mirror,
+  not sessions you run without it, and not another home's. `PI_SESSIONS_DIR` is inert:
+  a `.env` that sets it keeps working, and it changes nothing.
+- **What was already imported stays.** This release removes the cause, not the copies;
+  [Upgrading](#upgrading) shows how to list them.
+- **Update every install that has a home.** A home is safe from a neighbour's
+  maintenance only once the install that neighbour runs carries this release.
+
+## Where We Started
+
+The import is older than the idea of two homes on one machine. It existed to fill a
+gap: a Pi session the extension never logged reached the home anyway, at the next
+maintenance. v0.32.0 narrowed it to sessions newer than the home, so a new home would
+not swallow a lifetime of Pi history. Nothing scoped it to the home.
+
+CV21.DS5.US3's live route exposed it. A Claude Code cell ran on the real `HOME` against
+a scratch home born that evening, and two seconds into its first session, maintenance
+imported four of the person's Pi sessions from that day, from both of their real homes,
+and titled them through the provider. The route closed its own hole the same evening;
+the product's was CR153.
+
+Measured before planning, read-only, on the maintainer's two homes, one a copy of the
+other since July: each had taken the other's Pi conversations all along, 543 between
+them, and both were still doing it. Titling them took 411 provider calls. No memory
+came from any of them, because extraction needs a journey and an import carries none,
+but every one listed as the newest conversation, since an import's start is the moment
+it was imported. The gap the import existed to fill came up once in three months.
+
+## What Changed
+
+**The decision.** Three ways out were weighed: a claim recorded at session start, so a
+home imports only sessions it saw begin; a mark written into each Pi session file, so a
+home imports only files carrying its name; or no import at all. The claim would have
+kept the one recovery in three months for a table, a migration, and a claim lifecycle.
+The mark would have left every home reading every other home's files at every start.
+Retiring the import is the only option in which no home reads Pi's files at all, and
+it gives up almost nothing
+([decision](../project/decisions.md#session-maintenance-imports-no-pi-session-a-home-holds-the-pi-conversations-it-logged-live)).
+
+**The change.** The Pi backfill, the import seam only it still used, and v0.32.0's
+birth floor are deleted, and a retired-surface guard keeps them deleted. The tests came
+first: three cases — a session in Pi's default directory, one under `PI_SESSIONS_DIR`,
+and the full `session-start` the SessionStart hooks run — failed on the old code, each
+importing a session another home had logged, and pass now. The Navigator then ran the
+published 0.36.0 beside the change on the same session: the old version took it and
+the new one did not. On the real Pi history the new one took nothing, and a live Pi
+session against a scratch home was logged as before.
+
+### What you will notice
+
+- The maintenance report has four lines: `Closed stale conversations`, `Retitled pending
+  conversations`, `Extracted pending conversations`, and `Finished deferred close tails`.
+- If you have run more than one home on this machine, each may hold Pi conversations
+  the other logged. They are not removed.
+- A Pi session you run without Mirror's extension never appears in Mirror. Run Pi with
+  the Mirror package, and its sessions are logged as they happen.
+
+## Upgrading
+
+```bash
+mirror runtime update          # or: npm install -g mirror-mind
+```
+
+Update every install that has a home: the package, and each clone. There is no
+database migration, and no runtime wiring changes.
+
+To list the Pi conversations an earlier version imported into a home, read-only:
+
+```bash
+sqlite3 ~/.mirror-minds/<user>/memory.db \
+  "SELECT id, title, started_at FROM conversations
+    WHERE interface = 'pi' AND julianday(started_at) >= julianday(ended_at)
+    ORDER BY started_at"
+```
+
+An import gives itself away: it started when it was imported, after its last message.
+The home's dated backups and its pre-write backup hold the same rows.
+
+## Conscious Exclusions
+
+- **Removing what was imported.** A command that lists and removes those conversations
+  is [CR154](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr154-a-home-cannot-list-or-remove-the-pi-conversations-it-imported.md).
+- **A session whose logging never reached the core** is now simply missing from the
+  home, with an error line in `mirror-logger.log` and nowhere else. `runtime diagnose`
+  reading those lines is
+  [CR155](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr155-runtime-diagnose-does-not-read-the-pi-extension-s-error-lines.md).
+- **A home made by copying another's database** is the same home twice — the same ids,
+  the same history. The docs saying so is
+  [CR156](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr156-a-home-made-by-copying-another-s-database-is-the-same-home-twice.md).
+- **Importing a Pi session on request.** If it is wanted, it is a feature with its own
+  story, not something maintenance does in the background.
+- **The transcript backfill** matches a session's replies by time window — the same
+  shape, inside one home. That is
+  [CR151](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr151-the-transcript-backfill-writes-a-session-s-replies-into-other-sessions-conversations.md),
+  its own change.
+
+## What We Learned
+
+The import decided ownership from an absence: a session the home did not track was the
+home's to take. That was true while a machine had one home, and it stopped being true
+on the day a second home appeared, with nothing to mark the day.
+
+The leak was also invisible to the check that should have caught it. The first look at
+the real homes asked by journey, and an import has no journey. Measured by construction
+instead — an import starts after its own last message — the same homes held 543. A
+measurement taken before planning turned "consider pulling it first" into a fact about
+the maintainer's own data.
+
+## Next Horizon
+
+CR154: a home lists, and on request removes, the Pi conversations an earlier version
+imported. Then CV21.DS5.TS4 and DS11, and CV21's own release.

package/docs/releases/v0.36.2.md

@@ -0,0 +1,130 @@
+---
+digest: >
+  v0.36.2 is a patch release of one Change Request, CR154, which finishes what
+  v0.36.1 began. v0.36.1 stopped Mirror importing Pi sessions, but the
+  conversations an earlier version had imported stayed, and the only way to
+  see them was a SQL query. `mirror conversations imported` now lists them by
+  the folder each session came from, beside how many Pi sessions the home
+  logged live there, and `remove` deletes the ones you name, only on
+  `--apply` and only after a verified backup. With it, `discard-current` no
+  longer fails on a conversation a Soul Mode integration names. No migration.
+---
+
+# v0.36.2 — Clearing Out What Another Home Copied
+
+**Date:** 2026-10-21
+
+## Highlights
+
+- **`mirror conversations imported` shows what an earlier version imported**
+  ([CR154](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr154-a-home-cannot-list-or-remove-the-pi-conversations-it-imported.md)):
+  one line per folder the session came from, with how many conversations were imported
+  from it and how many Pi sessions this home logged live there. A folder where the home
+  logged nothing live is most likely another home's work. `--project <text>` lists a
+  folder's conversations.
+- **`remove` deletes what you name, and nothing else.** Ids, or every import of one
+  folder, written exactly as the listing prints it. It is a dry run until `--apply`;
+  `--apply` takes a dated backup, verifies it, and removes in one transaction. Memories
+  and provider-call records that named a removed conversation are kept, unlinked, and
+  the report names the backups that still hold copies.
+- **A typo cannot widen a removal.** Every option is declared, and one the command does
+  not know is refused before the database opens.
+- **`discard-current` works on a Soul Mode conversation.** It failed with `FOREIGN KEY
+  constraint failed` on any conversation a Soul Mode integration named. Deleting a
+  conversation now decides every table that references one, and a test reads the
+  schema so the next such table cannot be missed.
+
+## Where We Started
+
+v0.36.1 stopped session maintenance from importing Pi sessions, the defect that let the
+Mirror homes on one machine copy each other's conversations. It removed the cause and
+said so: the copies stayed, and the note gave a SQL query to list them. Deleting them
+was the person's decision, and no command could carry it out — `discard-current`
+removes only the current conversation.
+
+## What Changed
+
+**One command, folders first.** A home can hold hundreds of imports, and the decision a
+person makes is about where they came from, so the listing leads with folders. The
+folder is the directory the Pi session file lived in, read from the path the home
+stored; Mirror reads no Pi file to learn it. Beside each folder, the number of Pi
+sessions the home logged live from it. On the maintainer's production home, 96 imports
+came from one development worktree and 76 from the development checkout, where it had
+logged none live, and 3 from its own workspace, where it had logged 714. In a home made
+by copying another, the copied rows count as its own, which blurs the number.
+
+**Removal is careful by construction.** A dry run first, with the exact command that
+applies it to the same home. On `--apply`, the set is decided read-only; a refusal or
+an empty set stops there, with no backup. Then the dated archive, verified; then one
+transaction that decides the set again and refuses if it moved. An id must name exactly
+one imported conversation, by its full id or by a prefix of at least eight characters:
+a live conversation, an unknown id, or an ambiguous prefix refuses the whole command.
+
+**A review before any code.** Five personas reviewed the plan. The database architect
+found that the deletion `discard-current` used, the one this command meant to reuse,
+missed one of the six tables that reference a conversation, so with foreign keys on, a
+conversation a Soul Mode integration named could not be deleted at all — measured on a
+scratch home, then fixed for both commands. The security engineer found that under the
+listing's lenient parser, a typo such as `--projet` would drop the folder filter and
+remove every import in the home; the command parses strictly, with the parser `backup`
+and `repair-encoding` already used.
+
+**Validated on a copy of the real thing.** On a scratch home made from a fresh backup of
+the maintainer's development home, the command listed 515 imports from 22 folders
+and 5 of unknown origin, refused the typo, and removed the 418 from the production workspace's folder with their
+21,901 messages. Live conversations, memories, and provider-call records kept their
+counts.
+
+### What you will notice
+
+- A new command, `mirror conversations imported`, and its `remove`.
+- `discard-current` deletes a conversation that a Soul Mode integration names.
+
+## Upgrading
+
+```bash
+mirror runtime update          # or: npm install -g mirror-mind
+```
+
+There is no database migration, and no runtime wiring changes. Then, if you ran more
+than one home:
+
+```bash
+mirror conversations imported
+mirror conversations imported --project <text>
+mirror conversations imported remove --all --project <folder>
+mirror conversations imported remove --all --project <folder> --apply
+```
+
+Start with the folders where "logged live here" is 0, and look at a folder's
+conversations before removing them. The dated backups made since the import, and the
+pre-write backup, keep copies until you delete them or they age out (30 days for an
+archive).
+
+## Conscious Exclusions
+
+- **Telling another home's copy from a gap this home filled for itself.** That takes
+  both homes' databases, and no home reads another's. The folders and the logged-live
+  counts are the evidence a person decides on.
+- **Removing anything from backups.**
+- **Options before the subcommand.** `mirror conversations --db-path X imported` shows
+  the plain listing and removes nothing; that is
+  [CR096](../project/refinement/rs009-cv22-front-door-routing-correctness/cr096-conversations-lists-instead-of-appending-when-options-come-first.md)'s
+  class.
+- **A tool for models.** No MCP tool and no skill runs this command: a person does.
+
+## What We Learned
+
+Reusing a routine is a claim about it. The deletion `discard-current` used was correct
+for the tables it knew, and wrong the day another table began to reference a
+conversation. The question that found it — which tables reference a conversation? — is
+now a test that asks the schema, not a person's memory.
+
+A lenient parser is harmless in a listing and dangerous in a deletion: the same ignored
+token is a no-op in one and a wider removal in the other.
+
+## Next Horizon
+
+CV21.DS5.TS4, then DS11 and CV21's own release. Captured and open: CR155, `runtime
+diagnose` reading the Pi extension's error lines; CR156, what copying a home makes;
+CR157, three settings `REFERENCE.md` lists that nothing reads.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.36.0",
+  "version": "0.36.2",
   "description": "Mirror Mind: a local-first memory and identity framework for agentic AI runtimes (Pi, Claude Code, Codex, Antigravity)",
   "license": "MIT",
   "repository": {

package/plugins/mirror-mind/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.36.0",
+  "version": "0.36.2",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
   "author": {
     "name": "Mirror Mind"

package/plugins/mirror-mind/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mirror-mind",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
-  "version": "0.36.0",
+  "version": "0.36.2",
   "mcpServers": {
     "mirror-mind": {
       "command": "/bin/sh",

package/ts/src/conversation/conversationDeletion.ts

@@ -0,0 +1,45 @@
+// What deleting a conversation means, in one place (CR154, review findings D1
+// and E2).
+//
+// Ported as Python's `ConversationService.delete_conversations` for one id, and
+// private to `logger.ts` while `discard-current` was its only caller. CR154's
+// removal of imported Pi conversations is the second, so it lives here now.
+//
+// Six tables reference a conversation, and each gets a decision: what is only
+// the conversation's own is deleted with it, and what outlives it is kept with
+// its link cleared -- a memory extracted from the conversation is still a
+// memory, a provider call still happened, a session row still names its
+// session, an identity integration is still part of the identity. Foreign keys
+// are on (`database.ts`), so a table without a decision makes the conversation
+// undeletable: before CR154 the routine missed `identity_integrations`, and
+// `discard-current` failed with `FOREIGN KEY constraint failed` on any
+// conversation a Soul Mode integration named. `conversationDeletion.test.ts`
+// reads the schema's foreign keys and fails when a table appears that the
+// lists below do not decide.
+
+import type { WritableDatabase } from "#db/database.ts";
+
+/** Every table that references `conversations(id)`, by what deletion does to its rows. */
+export const CONVERSATION_REFERENCES = {
+  /** The conversation's own rows: deleted with it. */
+  deleted: ["conversation_embeddings", "messages"],
+  /** Rows that outlive it: kept, their `conversation_id` set to null. */
+  unlinked: ["identity_integrations", "llm_calls", "memories", "runtime_sessions"],
+} as const;
+
+/**
+ * Delete one conversation: its own rows first, then the links that outlive
+ * it, then the conversation. Runs no transaction of its own -- every caller
+ * wraps it in one with whatever else must move together.
+ */
+export function deleteConversation(db: WritableDatabase, conversationId: string): void {
+  for (const table of CONVERSATION_REFERENCES.deleted) {
+    db.prepare(`DELETE FROM ${table} WHERE conversation_id = ?`).run(conversationId);
+  }
+  for (const table of CONVERSATION_REFERENCES.unlinked) {
+    db.prepare(`UPDATE ${table} SET conversation_id = NULL WHERE conversation_id = ?`).run(
+      conversationId,
+    );
+  }
+  db.prepare("DELETE FROM conversations WHERE id = ?").run(conversationId);
+}

package/ts/src/conversation/importedConversations.ts

@@ -0,0 +1,288 @@
+// The Pi conversations an earlier version imported rather than logged (CR154).
+//
+// Until v0.36.1, session maintenance copied Pi session files into the home and
+// imported each as a closed conversation (CR153 retired that). On a machine
+// with two homes, each took the other's sessions, along with sessions of Pi run
+// without Mirror and of scratch homes. This module lets a person see them and
+// remove the ones they choose. It reads no Pi file: everything it knows, the
+// home already holds.
+//
+// An import is told apart by construction: the import stamped `started_at` when
+// it copied the session and `ended_at` from the session's last message, so an
+// import starts at or after its own end, and a live conversation never does.
+// Both instants must carry a zone. A conversation with a zone-less timestamp is
+// never an import, whatever the order says: the comparison would be a guess,
+// and the guess would offer a live conversation for removal.
+//
+// Where an import came from is the directory of its session file, read from
+// the path its runtime-session row stored (Pi names a project's directory
+// `--<path with / as ->--`; the wrapping dashes are dropped). Beside it, how
+// many Pi sessions this home logged live from the same directory -- the one
+// number that tells another home's work (none logged live here) from this
+// home's own gaps. It blurs in a home made by copying another: the copied rows
+// count as its own.
+
+import { basename, dirname } from "node:path";
+import { deleteConversation } from "#conversation/conversationDeletion.ts";
+import { type Database, type WritableDatabase, withTransaction } from "#db/database.ts";
+
+/** The folder of an import with no runtime-session row left to say where it came from. */
+export const UNKNOWN_FOLDER = "(unknown)";
+
+/** How much of an id a person must give to name one conversation: what the listing prints. */
+export const MIN_ID_PREFIX = 8;
+
+export interface ImportedConversation {
+  id: string;
+  title: string | null;
+  /** When it was imported: the conversation's `started_at`. */
+  importedAt: string;
+  /** The session's last message: the conversation's `ended_at`. */
+  endedAt: string;
+  messageCount: number;
+  folder: string;
+}
+
+export interface FolderSummary {
+  folder: string;
+  imported: number;
+  messages: number;
+  /** Pi sessions this home logged live from the folder; null for the unknown folder. */
+  loggedLive: number | null;
+}
+
+export interface ImportsSummary {
+  conversations: number;
+  messages: number;
+  firstImportedAt: string | null;
+  lastImportedAt: string | null;
+  /** Most imported first, then by name; the unknown folder last. */
+  folders: FolderSummary[];
+}
+
+/** Ids, each a full id or a prefix of at least `MIN_ID_PREFIX`; or every import, of one folder or all. */
+export type ImportRemovalRequest =
+  | { readonly ids: readonly string[] }
+  | { readonly all: true; readonly folder: string | null };
+
+export type ImportRemovalPlan =
+  | { ok: true; conversations: ImportedConversation[] }
+  | { ok: false; refusal: string };
+
+export interface ImportRemovalResult {
+  conversations: ImportedConversation[];
+  messages: number;
+}
+
+/** The plan refused the request inside the removal's transaction. */
+export class ImportRemovalRefusedError extends Error {
+  constructor(refusal: string) {
+    super(refusal);
+    this.name = "ImportRemovalRefusedError";
+  }
+}
+
+/** The set the transaction found is not the set the person was shown. */
+export class ImportRemovalSetMovedError extends Error {
+  constructor() {
+    super("the imports to remove changed since they were listed");
+    this.name = "ImportRemovalSetMovedError";
+  }
+}
+
+const ZONED = /(?:Z|[+-]\d{2}:\d{2})$/;
+
+/** An import starts at or after its own last message; both instants carry a zone. */
+export function isImportShaped(startedAt: string, endedAt: string | null): boolean {
+  if (endedAt === null || !ZONED.test(startedAt) || !ZONED.test(endedAt)) return false;
+  const started = Date.parse(startedAt);
+  const ended = Date.parse(endedAt);
+  if (Number.isNaN(started) || Number.isNaN(ended)) return false;
+  return started >= ended;
+}
+
+/** The directory a Pi session file lived in, from its stored path; Pi's wrapping dashes dropped. */
+export function sessionFolder(sessionPath: string | null): string {
+  if (!sessionPath) return UNKNOWN_FOLDER;
+  const parent = dirname(sessionPath);
+  const name = basename(parent);
+  if (parent === "." || parent === sessionPath || !name) return UNKNOWN_FOLDER;
+  return name.length > 4 && name.startsWith("--") && name.endsWith("--") ? name.slice(2, -2) : name;
+}
+
+function nullableString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+/** Every Pi import in the home, newest import first. */
+export function listImportedPiConversations(db: Database): ImportedConversation[] {
+  // SQL narrows to the shape; `isImportShaped` decides, zones included.
+  const rows = db
+    .prepare(
+      `SELECT c.id, c.title, c.started_at, c.ended_at,
+              (SELECT COUNT(*) FROM messages m WHERE m.conversation_id = c.id) AS message_count,
+              (SELECT r.session_id FROM runtime_sessions r
+                WHERE r.conversation_id = c.id ORDER BY r.rowid LIMIT 1) AS session_path
+         FROM conversations c
+        WHERE c.interface = 'pi' AND c.ended_at IS NOT NULL
+          AND julianday(c.started_at) >= julianday(c.ended_at)
+        ORDER BY julianday(c.started_at) DESC, c.id`,
+    )
+    .all();
+  const imports: ImportedConversation[] = [];
+  for (const row of rows) {
+    const startedAt = String(row.started_at);
+    const endedAt = nullableString(row.ended_at);
+    if (endedAt === null || !isImportShaped(startedAt, endedAt)) continue;
+    imports.push({
+      id: String(row.id),
+      title: nullableString(row.title),
+      importedAt: startedAt,
+      endedAt,
+      messageCount: Number(row.message_count),
+      folder: sessionFolder(nullableString(row.session_path)),
+    });
+  }
+  return imports;
+}
+
+/** Pi sessions this home logged live, by the folder their session file lived in. */
+export function countLiveSessionsByFolder(db: Database): Map<string, number> {
+  const rows = db
+    .prepare(
+      `SELECT r.session_id, c.started_at, c.ended_at
+         FROM runtime_sessions r JOIN conversations c ON c.id = r.conversation_id
+        WHERE r.interface = 'pi' AND c.interface = 'pi'`,
+    )
+    .all();
+  const counts = new Map<string, number>();
+  for (const row of rows) {
+    if (isImportShaped(String(row.started_at), nullableString(row.ended_at))) continue;
+    const folder = sessionFolder(nullableString(row.session_id));
+    counts.set(folder, (counts.get(folder) ?? 0) + 1);
+  }
+  return counts;
+}
+
+/** Totals and one line per folder, for the listing. */
+export function summarizeImports(
+  imports: readonly ImportedConversation[],
+  loggedLive: ReadonlyMap<string, number>,
+): ImportsSummary {
+  const byFolder = new Map<string, FolderSummary>();
+  let messages = 0;
+  let first: string | null = null;
+  let last: string | null = null;
+  for (const item of imports) {
+    messages += item.messageCount;
+    if (first === null || Date.parse(item.importedAt) < Date.parse(first)) first = item.importedAt;
+    if (last === null || Date.parse(item.importedAt) > Date.parse(last)) last = item.importedAt;
+    const summary = byFolder.get(item.folder) ?? {
+      folder: item.folder,
+      imported: 0,
+      messages: 0,
+      loggedLive: item.folder === UNKNOWN_FOLDER ? null : (loggedLive.get(item.folder) ?? 0),
+    };
+    summary.imported += 1;
+    summary.messages += item.messageCount;
+    byFolder.set(item.folder, summary);
+  }
+  const folders = [...byFolder.values()].sort((a, b) => {
+    if ((a.folder === UNKNOWN_FOLDER) !== (b.folder === UNKNOWN_FOLDER)) {
+      return a.folder === UNKNOWN_FOLDER ? 1 : -1;
+    }
+    return b.imported - a.imported || a.folder.localeCompare(b.folder);
+  });
+  return {
+    conversations: imports.length,
+    messages,
+    firstImportedAt: first,
+    lastImportedAt: last,
+    folders,
+  };
+}
+
+function refuse(refusal: string): ImportRemovalPlan {
+  return { ok: false, refusal };
+}
+
+/**
+ * What a request names, decided once for the dry run and again inside the
+ * removal's transaction. Any id that does not name exactly one import refuses
+ * the whole request: nothing is removed on a partial match.
+ */
+export function planImportRemoval(db: Database, request: ImportRemovalRequest): ImportRemovalPlan {
+  const imports = listImportedPiConversations(db);
+  if ("all" in request) {
+    if (request.folder === null) return { ok: true, conversations: imports };
+    const named = imports.filter((item) => item.folder === request.folder);
+    if (named.length === 0) {
+      return refuse(
+        `no imported conversations from folder '${request.folder}' in this home: the listing names the folders that have them, exactly`,
+      );
+    }
+    return { ok: true, conversations: named };
+  }
+
+  const byId = new Map(imports.map((item) => [item.id, item]));
+  const chosen = new Map<string, ImportedConversation>();
+  // `substr` rather than LIKE: an id the person types is matched as written,
+  // never as a pattern.
+  const matching = db.prepare("SELECT id FROM conversations WHERE substr(id, 1, ?) = ?");
+  for (const given of request.ids) {
+    if (given.length < MIN_ID_PREFIX) {
+      return refuse(
+        `'${given}' is too short: give at least ${MIN_ID_PREFIX} characters of a conversation id, as the listing prints them`,
+      );
+    }
+    const matches = matching.all(given.length, given).map((row) => String(row.id));
+    if (matches.length === 0) return refuse(`no conversation '${given}' in this home`);
+    if (matches.length > 1) {
+      return refuse(`'${given}' matches ${matches.length} conversations: give more of the id`);
+    }
+    const id = matches[0] as string;
+    const imported = byId.get(id);
+    if (imported === undefined) {
+      return refuse(
+        `conversation ${id.slice(0, MIN_ID_PREFIX)} is not an imported Pi conversation; this command removes only those`,
+      );
+    }
+    chosen.set(id, imported);
+  }
+  return { ok: true, conversations: imports.filter((item) => chosen.has(item.id)) };
+}
+
+function sameIds(a: readonly string[], b: readonly string[]): boolean {
+  if (a.length !== b.length) return false;
+  const sortedA = [...a].sort();
+  const sortedB = [...b].sort();
+  return sortedA.every((id, index) => id === sortedB[index]);
+}
+
+/**
+ * Remove what the request names, in one transaction: all or nothing. The set is
+ * decided again inside the transaction and must be the one the person was
+ * shown (`expectedIds`); if it moved, nothing is removed. Each import's session
+ * row goes with it -- it bound nothing but the import -- and the conversation
+ * goes through the shared deletion.
+ */
+export function removeImportedConversations(
+  db: WritableDatabase,
+  request: ImportRemovalRequest,
+  expectedIds: readonly string[],
+): ImportRemovalResult {
+  return withTransaction(db, () => {
+    const plan = planImportRemoval(db, request);
+    if (!plan.ok) throw new ImportRemovalRefusedError(plan.refusal);
+    const ids = plan.conversations.map((item) => item.id);
+    if (!sameIds(ids, expectedIds)) throw new ImportRemovalSetMovedError();
+    const removeSessionRows = db.prepare("DELETE FROM runtime_sessions WHERE conversation_id = ?");
+    let messages = 0;
+    for (const item of plan.conversations) {
+      removeSessionRows.run(item.id);
+      deleteConversation(db, item.id);
+      messages += item.messageCount;
+    }
+    return { conversations: plan.conversations, messages };
+  });
+}