pi-daddy 0.25.1 → 0.26.0

package/extensions/session.ts

@@ -37,6 +37,7 @@ import {
   ENV_LEDGER,
   ENV_MAX_DEPTH,
   ENV_PARENT_ID,
+  GRANT_ENV_KEYS,
   parseList,
 } from "../src/propagation.ts";
 import type { Capability } from "../src/resolve.ts";
@@ -49,6 +50,8 @@ import { storedGrantSessionState } from "./stored-grant-session.ts";
 import { nativeSessionRootFromEnv, type NativeSessionHost } from "../src/native-session-target.ts";
 import { ENV_ALLOW_UNRESOLVED_MODELS } from "../src/model-preflight.ts";
 import type { DeclaredWorkState } from "../src/work-command.ts";
+import { beginExtensionLifecycle, rememberChildPublication, type ReloadLifecycle } from "./reload-environment.ts";
+import { reconcileSessionEnvironment } from "./session-environment.ts";
 /**
  * Run governed children in herdr panes instead of captured child processes.
  *
@@ -93,14 +96,15 @@ export interface GrantsSession extends NativeSessionHost {
    */
   governed: boolean;
   /** The upper bound handed down by the delegator, before this session's own tools are observed. */
-  readonly inherited: Capability[];
-  readonly depth: number;
-  readonly maxDepth: number;
+  inherited: Capability[];
+  depth: number;
+  maxDepth: number;
   /** Bound variables that could not be read as non-negative integers — spawning is disabled, loudly. */
-  readonly malformedBounds: string[];
-  readonly gated: Capability[];
+  malformedBounds: string[];
+  gated: Capability[];
   /** Resolved against the actual pi cwd at session start, then inherited verbatim by every descendant. */
   ledgerPath?: string;
+  ledgerFromEnvironment: boolean;
   /**
    * Which executor runs this session's children — ADR-0031.
    *
@@ -114,15 +118,17 @@ export interface GrantsSession extends NativeSessionHost {
    */
   executor: ExecutorChoice;
   /** This session's readable logical ledger identity; children descend from it (F8). */
-  readonly ownSpawnId: string;
+  ownSpawnId: string;
   /** Unique identity when this session is itself a governed child; roots have no governed parent. */
-  readonly ownExecutionId?: string;
+  ownExecutionId?: string;
   /** Descendants this subtree may still create — the cardinality bound ADR-0008 never had. */
-  readonly fanoutBudget: number;
-  /** Whether `delegate` / `delegate_all` are registered at all (S-5). Decided on the INHERITED grant. */
-  readonly mayDelegate: boolean;
+  fanoutBudget: number;
+  /** Whether delegation tools are active. Reconciled against the owner-bound root at session_start. */
+  mayDelegate: boolean;
+  /** True only after session_start binds this instance to ctx.sessionManager. */
+  ownerBound: boolean;
   /** Operator escape hatch for custom model resolution. Exact `1`, read once for the session. */
-  readonly allowUnresolvedModels: boolean;
+  allowUnresolvedModels: boolean;
   /** Results from pi's synchronous model catalogue, shared by every delegation in this session. */
   readonly modelResolutionCache: Map<string, boolean>;
   /** Path to this extension, so a child granted `tool:delegate` can delegate in turn. */
@@ -130,7 +136,8 @@ export interface GrantsSession extends NativeSessionHost {
   declaredWork?: DeclaredWorkState; // Explicit operator selection; absence leaves execution visibly unbound.
   /** Primary-return fan-outs retained by this original session; bounded and human-readable via /grants variants. */
   readonly variantRuns: Map<string, VariantRunAccounting>;
-
+  /** Root identity keyed to ctx.sessionManager once session_start supplies it. */
+  reloadLifecycle: ReloadLifecycle;
   /** Approval keys approved for this session. In memory only — this dies with the process. */
   readonly sessionApprovals: Set<string>;
   /** Exact bindings for correlated approvals; these never inherit across a delegation boundary. */
@@ -143,10 +150,9 @@ export interface GrantsSession extends NativeSessionHost {
    * needs `session.definitions`, which does not exist until `session_start` — and this object is built
    * before any hook has run.
    */
-  readonly inheritedApprovals: Map<string, string | undefined>;
+  inheritedApprovals: Map<string, string | undefined>;
   /** ONE single-flight queue for the whole session — see `obtainApprovals` for why it lives here. */
   readonly approvalGateFor: ReturnType<typeof createApprovalGateProvider>;
-
   /** Set at `session_start`; `process.cwd()` until then. */
   cwd: string;
   /** This session's own grant. Starts as the inherited upper bound, tightened once tools are observed. */
@@ -194,7 +200,7 @@ export interface GrantsSession extends NativeSessionHost {
    */
   readonly storeCwd: string;
   /** Invalid stored state fails closed and is reported/ledgered during session_start. */
-  readonly grantStoreRefusal?: { reason: GrantStoreRefusalReason; path: string };
+  grantStoreRefusal?: { reason: GrantStoreRefusalReason; path: string };
   /**
    * Adopt the project choice made DURING the session — grant plus optional default ledger — without restart.
    *
@@ -207,6 +213,7 @@ export interface GrantsSession extends NativeSessionHost {
    * widen its own session's ceiling by calling something.
    */
   adoptGrant(grant: Capability[], projectLedger?: string): void;
+  reconcileEnvironment(environment: NodeJS.ProcessEnv, lifecycle: ReloadLifecycle): void;
 }
 
 /**
@@ -238,7 +245,10 @@ export async function loadProjectDefinitions(session: GrantsSession, cwd: string
   session.catalog = await session.catalogReady;
 }
 
-export function createGrantsSession(extensionPath: string | undefined): GrantsSession {
+export function createGrantsSession(extensionPath: string | undefined, lifecycle?: ReloadLifecycle): GrantsSession {
+  const started = lifecycle ? undefined : beginExtensionLifecycle();
+  const activeLifecycle = lifecycle ?? started!.lifecycle;
+  const environment = lifecycle ? process.env : started!.environment;
   // Governance is opt-in: with PI_GRANTS_GRANT unset AND no stored grant for this directory, the session
   // holds the wildcard and nothing is blocked. This extension must never silently tighten a normal
   // workflow.
@@ -252,22 +262,21 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
   // and therefore before `ctx` exists. That ordering is forced by S-5: whether `delegate` is registered at
   // all is decided here, and a grant arriving later could not inform it. `session_start` re-checks the two
   // against each other and says so if they differ, which is the only case this can get wrong.
-  const grantRaw = process.env[ENV_GRANT];
+  const grantRaw = environment[ENV_GRANT];
   const storeCwd = process.cwd();
   // One root-only store read supplies both decisions made by `/grants init`. A child always has ENV_GRANT,
   // so it cannot activate a ledger merely because its routed cwd happens to have a v2 store (ADR-0037).
   const storedState = storedGrantSessionState(grantRaw, storeCwd);
   const { governed, inherited, refusal: grantStoreRefusal } = storedState;
-  const ledgerRaw = process.env[ENV_LEDGER];
+  const ledgerRaw = environment[ENV_LEDGER];
   // Capture provenance before publishChildEnv writes this session's derived default into process.env. A later
   // `/grants init` for ctx.cwd must not mistake our own publication for an operator override.
   const ledgerFromEnvironment = ledgerRaw !== undefined;
   const storedLedger = storedState.defaultLedger;
   // G7 / A-S4 + B-I4: strict, three-way parsing that fails CLOSED. A malformed bound used to yield
   // `NaN`, and every comparison against `NaN` is false, so depth limiting switched itself off.
-  const bounds = depthConfig(process.env[ENV_DEPTH], process.env[ENV_MAX_DEPTH]);
+  const bounds = depthConfig(environment[ENV_DEPTH], environment[ENV_MAX_DEPTH]);
   const { depth, maxDepth } = bounds;
-
   const emptyCatalog = makeCatalog([]);
 
   const session: GrantsSession = {
@@ -281,41 +290,41 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
     // did. Inside a session the operator already chose to govern, handing a child `bash` hands it an
     // ungoverned-descendant escape hatch, and doing that silently is what changes here.
     // `PI_GRANTS_GATED=""` turns the default off; absent and empty are deliberately distinguishable.
-    gated: governed ? gatedFromEnv(process.env[ENV_GATED]) : parseList(process.env[ENV_GATED]),
+    gated: governed ? gatedFromEnv(environment[ENV_GATED]) : parseList(environment[ENV_GATED]),
     // Presence wins, including an explicitly empty value for a one-run opt-out. The store is eligible only
     // when ENV_GRANT was absent above, preserving the environment as the child's single authority channel.
     ledgerPath: ledgerRaw !== undefined ? ledgerRaw : storedLedger,
+    ledgerFromEnvironment,
     // The un-probed reading. `resolveExecutor` replaces it at session start; until then a `1` already reads as
     // a refusal, which is the safe direction — a delegation that somehow ran before the probe would refuse
     // rather than quietly use the wrong executor.
-    executor: chooseExecutor(process.env[ENV_HERDR], null),
+    executor: chooseExecutor(environment[ENV_HERDR], null),
     // `ownSpawnId` comes from the parent (F8), so ids form one tree across process boundaries instead of
     // every level restarting at `d0` and the ledger becoming unjoinable.
-    ownSpawnId: process.env[ENV_PARENT_ID]?.trim() || `d${depth}`,
-    ownExecutionId: process.env[ENV_EXECUTION_ID]?.trim() || undefined,
+    ownSpawnId: environment[ENV_PARENT_ID]?.trim() || `d${depth}`,
+    ownExecutionId: environment[ENV_EXECUTION_ID]?.trim() || undefined,
     // The cardinality bound ADR-0008 never had: it attenuates downward like depth, so a subtree can never
     // create more descendants than its root was given — with no shared state, no lock and no counter file.
-    fanoutBudget: budgetFromEnv(process.env[ENV_FANOUT]),
+    fanoutBudget: budgetFromEnv(environment[ENV_FANOUT]),
     /**
      * Review finding S-5, fixed. The comment on the tools has always claimed conditional registration; the
      * call was unconditional, `DELEGATE_CAPABILITY` was imported and never used, and "withhold it and the
      * child is a leaf" was simply untrue on this path.
      *
-     * Decided on the INHERITED grant rather than `ownGrant`, because registration happens at load time,
-     * before any tools are observed. An ungoverned session registers it as before.
+     * Provisional before owner binding; session_start recomputes it from that owner's root before activation.
      */
     mayDelegate: !governed || inherited.includes(DELEGATE_CAPABILITY) || inherited.includes(WILDCARD),
-    allowUnresolvedModels: process.env[ENV_ALLOW_UNRESOLVED_MODELS] === "1",
+    ownerBound: false,
+    allowUnresolvedModels: environment[ENV_ALLOW_UNRESOLVED_MODELS] === "1",
     nativeSessionRoot: nativeSessionRootFromEnv(process.env),
     modelResolutionCache: new Map<string, boolean>(),
     extensionPath,
     variantRuns: new Map(),
-
+    reloadLifecycle: activeLifecycle,
     sessionApprovals: new Set<string>(),
     sessionApprovalBindings: new Map<string, ApprovalBinding>(),
-    inheritedApprovals: parseInherited(process.env[ENV_APPROVED]),
+    inheritedApprovals: parseInherited(environment[ENV_APPROVED]),
     approvalGateFor: createApprovalGateProvider(),
-
     cwd: process.cwd(),
     ownGrant: deriveOwnGrant(inherited, null),
     observed: false,
@@ -323,7 +332,6 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
     definitions: new Map<string, SkillDefinition>(),
     catalog: emptyCatalog,
     catalogReady: Promise.resolve(emptyCatalog),
-
     delegationContext: async (approved?: InheritableApproval[]) => ({
       ownGrant: session.ownGrant,
       depth: session.depth,
@@ -360,12 +368,13 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
       session.ownGrant = grant;
       // An environment ledger remains the explicit answer. Otherwise init's v2 choice becomes live now,
       // before publishChildEnv gives the same absolute path to descendants.
-      if (!ledgerFromEnvironment && projectLedger !== undefined) {
+      if (!session.ledgerFromEnvironment && projectLedger !== undefined) {
         session.ledgerPath = projectLedger;
       }
       session.publishChildEnv();
     },
 
+    reconcileEnvironment: (environment, lifecycle) => reconcileSessionEnvironment(session, environment, lifecycle),
     publishChildEnv: () => {
       const env = childEnv({
         ownGrant: session.ownGrant,
@@ -378,9 +387,11 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
         // descendants too. Previously it exported its own observed tool surface as their grant.
         governed: session.governed,
       });
+      // Clear omitted fields: another owner's provenance must never reach this session's children.
+      for (const key of GRANT_ENV_KEYS) delete process.env[key];
       for (const [key, value] of Object.entries(env)) process.env[key] = value;
+      rememberChildPublication(session.reloadLifecycle);
     },
   };
-
   return session;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.25.1",
+  "version": "0.26.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",
@@ -248,6 +248,7 @@
     "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.check.json",
     "test": "node scripts/unit-tests.ts",
+    "test:dashboard-pty": "if [ \"$(uname -s)\" = Linux ]; then python3 test/dashboard-cli-pty.py; else echo 'dashboard PTY probe requires Unix pty/Unix sockets'; fi",
     "test:integration": "node --test test-integration/*.it.ts",
     "test:integration:ci": "node --test test-integration/approval.it.ts test-integration/governance.it.ts",
     "contracts:generate": "node scripts/generate-ledger-v3-contract.ts",

package/src/chain.ts

@@ -156,6 +156,8 @@ export interface ChainStep {
   agent?: string;
   tools?: string[];
   model?: string;
+  /** Requested Pi thinking level; validated by the same schema as delegate/delegate_all. */
+  thinking?: string;
   correlation?: import("./correlation.ts").CorrelationMetadata;
   workspace?: { workspace_id: string; access: import("./workspace.ts").WorkspaceAccess };
 }

package/src/daily-dashboard-host.ts

@@ -70,14 +70,14 @@ export async function startDailyDashboardHost(input:DailyDashboardHostInput){
     const native=intentRequest({version:"intent-request-v1",requestId:`${p.key}:${intentState.revision}`,bindingDigest:config.budgetDigest,expectedRevision:intentState.revision,expectedSelection:intentState.selection,action:p.action,events:p.events,selection:p.selection,priorities:p.priorities});dispatchDigests.add(intentRequestDigest(native));
     const proposed=request(context,"intent",native,`host-intent:${p.key}:${intentState.revision}`);requestDigests.add(dashboardHostRequestDigest(proposed));return {key:p.key,label:p.label,request:proposed};
    });
-   const ordinary=input.ordinary.inspect() as {revision:number;children:{target:OrdinaryTarget;state:string}[]},accounting=await openResourceBudget(budget).inspect(),presence=input.presence?.();
+   const ordinary=input.ordinary.inspect() as {revision:number;children:{target:OrdinaryTarget;state:string;abortRequested:boolean}[]},accounting=await openResourceBudget(budget).inspect(),presence=input.presence?.();
    const presentation:{key:string;label:string;request:DashboardHostRequest}[]=[];
    if(context.preparedPresentationDigest){const shown=request(context,"presented",{frameDigest:context.preparedPresentationDigest},`host-presented:${state.revision}:${context.tip.slice(0,12)}`);requestDigests.add(dashboardHostRequestDigest(shown));presentation.push({key:"acknowledge-case-cards",label:"Acknowledge these case cards are visible",request:shown});}
    else if(presence?.present===true&&presence.closing===true&&presence.expiresAt>Date.now()&&state.paused&&accounting.active===0&&!ordinary.children.some(row=>row.state==="active")){const present=request(context,"present",{userPresent:true,closing:true,evidenceDigest:presence.evidenceDigest,dispatchRevision:state.revision},`host-present:${state.revision}:${context.tip.slice(0,12)}`);requestDigests.add(dashboardHostRequestDigest(present));presentation.push({key:"prepare-case-cards",label:"Prepare up to five retained case cards",request:present});}
-   const cancellations=ordinary.children.filter(row=>row.state==="active").sort((a,b)=>a.target.executionId.localeCompare(b.target.executionId)).slice(0,8).map(row=>{
+   const cancellations=ordinary.children.filter(row=>row.state==="active"&&!row.abortRequested).sort((a,b)=>a.target.executionId.localeCompare(b.target.executionId)).slice(0,8).map(row=>{
     const native=ordinaryCancellation({version:"ordinary-cancel-v1",requestId:`cancel:${row.target.executionId.slice(5)}`,bindingDigest:input.ordinary.bindingDigest,expectedRevision:ordinary.revision,target:row.target});ordinaryDigests.add(ordinaryCancellationDigest(native));
     const cancel=request(context,"ordinary-cancel",native,`host-cancel:${row.target.executionId.slice(5)}:${ordinary.revision}`);requestDigests.add(dashboardHostRequestDigest(cancel));
-    return {key:`cancel-${row.target.executionId.replace(":","-")}`,label:`Cancel running attempt ${row.target.executionId}`,request:cancel};
+    return {key:`cancel-${row.target.executionId.replace(":","-")}-${ordinary.revision.toString(36)}`,label:`Cancel running attempt ${row.target.executionId}`,request:cancel};
    });
    return [{key,label:state.paused?"Resume new governed dispatch":"Pause new governed dispatch; running children continue",request:hostRequest},{key:"refresh-current-work",label:reboundSnapshotId?`Capture rebound declared work; next dispatch uses ${reboundSnapshotId}`:"Capture current declared work and attempts",request:refresh},...intents,...presentation,...cancellations];
  },afterIntentApplied:async selection=>{const rebound=await rebindDeclaredWork(declaredState,selection);declaredState=rebound;workSelection=selection;reboundSnapshotId=selection.snapshot.id;await input.onDeclaredWorkChanged?.(rebound);},presence:input.presence});

package/src/dashboard-cli.ts

@@ -58,6 +58,20 @@ export async function dashboardHostAction(host:DashboardConnection,line:string){
   return host.humanAction(command);
 }
 
+/** A fulfilled host call is not necessarily an applied native effect; keep those facts distinct in the UI. */
+export function dashboardActionFeedback(command:string,outcome:unknown):string{
+  const value=outcome&&typeof outcome==="object"?outcome as {state?:unknown;result?:unknown}:{};
+  const state=typeof value.state==="string"?value.state:"unrecognised host response";
+  if(state==="failed-or-unknown"||state==="readback-only")return `NO ACTION CLAIM: ${command} returned ${state}; inspect/reconcile explicitly.`;
+  if(state!=="acknowledged")return `NOT APPLIED: ${command} returned ${state}.`;
+  const result=value.result&&typeof value.result==="object"?value.result as {application?:unknown}:null;
+  // A retained records[] snapshot has no outer dashboard request correlation. Never select an old receipt.
+  const nativeApplication=typeof result?.application==="string"?result.application:undefined;
+  if(nativeApplication==="applied")return `ACKNOWLEDGED: ${command}; native application applied.`;
+  if(nativeApplication)return `ACKNOWLEDGED: ${command}; native application ${nativeApplication}, so no applied effect is claimed.`;
+  return `ACKNOWLEDGED: ${command}; refreshed state is shown below (no native application claim).`;
+}
+
 function shellQuote(value: string): string {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
@@ -96,14 +110,15 @@ export async function dashboardFrame(options: DashboardFrameOptions): Promise<st
   if(options.connected){
     if(!isDashboardConnection(options.connected))throw Error("original dashboard connection required");
     let view:Awaited<ReturnType<DashboardConnection["frame"]>>;
-    try{view=await options.connected.frame();}catch{return "PI-DADDY — CONNECTED HOST UNAVAILABLE\nNo prior acceptance, presentation or continuity substituted. No action retried.";}
+    try{view=await options.connected.frame();}catch(error){return `PI-DADDY — CONNECTED HOST ERROR\n${error instanceof Error ? error.message : String(error)}\nNo prior acceptance, presentation or continuity substituted. No action retried.`;}
     if(options.dailyJson||options.debriefJson)return JSON.stringify(view);
     const source=view.source as {daily?:Parameters<typeof renderDailyView>[0]}|null;
     const actions=(view.actions as {key:string;label:string}[]|undefined)??[];
-    return ["PI-DADDY — CONNECTED HOST (snapshot; identity/acceptance not authenticated)",source?.daily?renderDailyView(source.daily,options.width):"Source unavailable; no previous acceptance substituted.",
+    const hostError=typeof view.error==="string"&&view.error?`HOST ERROR — ${view.error}`:null;
+    return ["PI-DADDY — CONNECTED HOST (snapshot; identity/acceptance not authenticated)",hostError,source?.daily?renderDailyView(source.daily,options.width):"Source unavailable; no previous acceptance substituted.",
       view.debrief?renderDebrief(view.debrief as Parameters<typeof renderDebrief>[0],options.width):"Debrief deferred/closed. No implicit presentation or steering.",
-      `Attention reserved ${view.attention.attentionUsed}/5 (not proof of delivery). Tip ${view.tip}.`,
-      actions.length?`ACTIONS — type one command and Enter\n${actions.map(action=>`  ${action.key} — ${action.label}`).join("\n")}`:"ACTIONS — none currently authorized; refresh never acts."].join("\n\n");
+      `Host control ${view.control}; acknowledgement ${view.acknowledgement}. Attention reserved ${view.attention.attentionUsed}/5 (not proof of delivery). Tip ${view.tip}.`,
+      actions.length?`ACTIONS — type one command and Enter\n${actions.map(action=>`  ${action.key} — ${action.label}`).join("\n")}`:"ACTIONS — none currently authorized; refresh never acts."].filter((line):line is string=>Boolean(line)).join("\n\n");
   }
   if (options.debrief || options.debriefJson) {
     if (!isDebriefPresenter(options.debrief)) return "PI-DADDY — DEBRIEF UNAVAILABLE: genuine presenter/host missing";
@@ -213,6 +228,8 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
   }
   const dailyReader = createDailyViewReader();
   let previous = "";
+  let feedback = "";
+  let input: ReturnType<typeof createInterface> | null = null;
   const draw = async (clear: boolean): Promise<void> => {
     const frame = await dashboardFrame({
       cwd,
@@ -223,15 +240,20 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
       details: cli.details,
       dailyView, dailyReader, dailyJson: cli.dailyJson, debrief, debriefJson: cli.debriefJson, connected,
     });
-    if (frame === previous && !clear) return;
-    previous = frame;
-    process.stdout.write(clear ? `\u001b]0;PI-DADDY\u0007\u001b[2J\u001b[H${frame}` : `${frame}\n`);
+    const rendered = feedback ? `${frame}\n\n${feedback}` : frame;
+    if (rendered === previous && !clear) return;
+    previous = rendered;
+    const prompt = "COMMAND — type an exact listed key, then Enter (refresh never acts): ";
+    const draft = input?.line ?? "";
+    process.stdout.write(clear ? `\u001b]0;PI-DADDY\u0007\u001b[2J\u001b[H${rendered}\n\n${input ? prompt + draft : ""}` : `${rendered}\n`);
+    if (input) input.setPrompt(prompt);
   };
 
   if (cli.once) {
     await draw(false);
     return;
   }
+  input = debrief || connected ? createInterface({ input: process.stdin, output: process.stdout, terminal: true }) : null;
   await draw(true);
   let drawing = false;
   const redraw = (): void => {
@@ -239,13 +261,16 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
     drawing = true;
     void draw(true).finally(() => { drawing = false; });
   };
-  const input = debrief || connected ? createInterface({ input: process.stdin, terminal: false }) : null;
   let acting = false;
   input?.on("line", line => {
-    if (acting) return;
+    if (acting) return; // never replay a line typed while the prior exact command is still settling.
     acting = true;
-    void (connected?dashboardHostAction(connected,line):debriefAction(debrief!, line)).catch(() => { process.stderr.write("Debrief action refused or acknowledgement unknown; inspect/reconcile explicitly.\n"); })
-      .finally(() => { acting = false; redraw(); });
+    feedback = `COMMAND ${line.trim() || "(empty)"} — applying the displayed exact request…`;
+    void (connected?dashboardHostAction(connected,line):debriefAction(debrief!, line)).then(outcome => {
+      feedback = connected ? dashboardActionFeedback(line.trim() || "command", outcome) : `ACKNOWLEDGED: ${line.trim() || "command"}. Refreshed state is shown below.`;
+    }).catch(error => {
+      feedback = `REJECTED: ${error instanceof Error ? error.message : String(error)}. No command was retried; inspect the refreshed offered keys.`;
+    }).finally(() => { acting = false; redraw(); });
   });
   const timer = setInterval(redraw, DASHBOARD_REFRESH_MS);
   process.on("SIGWINCH", redraw);

package/src/dashboard-host.ts

@@ -14,6 +14,9 @@ import { dashboardHostDigest, dashboardHostRequest, dashboardHostRequestDigest,
   type DashboardHarness, type DashboardHostConfig, type DashboardHostRequest, type DashboardHostAuthority } from "./dashboard-host-contract.ts";
 export * from "./dashboard-host-contract.ts";
 const hosts=new WeakSet<object>();
+/** Ordinary retention caps rows and cancellations at 1,024 each: attach, settle and cancel can advance 3,072 revisions.
+ * At eight visible targets per revision that is 24,576 immutable cancellation meanings; fixed controls fit inside 32,768. */
+const MAX_DISPLAYED_ACTIONS_PER_TIP=32_768;
 export const isDashboardHost=(value:unknown):value is DashboardHost=>typeof value==="object"&&value!==null&&hosts.has(value);
 export type DashboardHost=ReturnType<typeof openDashboardHost>;
 export interface DashboardHostOptions { ordinary?:OrdinaryChildren; harness:DashboardHarness; config:DashboardHostConfig; budget:GovernedBudgetBinding; experiment?:ReturnType<typeof openExperiment>; authority:()=>DashboardHostAuthority|null;
@@ -61,7 +64,9 @@ export function openDashboardHost(options:DashboardHostOptions){
   const saved=():DebriefCheckpoint|null=>{const rows=history().filter(e=>e.value.type==="checkpoint");return rows.length?detached(rows.at(-1)!.value.checkpoint) as DebriefCheckpoint:null;};
   let presenter:DebriefPresenter|undefined,busy=false,poisoned=false,presentationRevision:number|null=null,presenceDigest:string|null=null,attentionDeferred:string|null=null,presentationAcknowledged=false;
   const ordinaryDispatchHoldKey=dataDigest({hostDigest,control:"pause-new-ordinary-dispatch"});
-  let displayedActions:null|{tip:string;actions:{key:string;label:string;operation:DashboardHostRequest["operation"];request:DashboardHostRequest}[];digest:string}=null;
+  // A host frame is a read-only snapshot: ordinary children may attach or settle without advancing this journal.
+  // Within one tip, a key keeps its first exact request; humanAction revalidates it against current native authority.
+  let displayedActions:null|{tip:string;actions:Map<string,{key:string;label:string;operation:DashboardHostRequest["operation"];request:DashboardHostRequest}>}=null;
   const presence=()=>{const p=options.presence?.();return p&&p.present===true&&p.closing===true&&sha(p.evidenceDigest)&&Number.isFinite(p.expiresAt)&&p.expiresAt>Date.now()?p:null;};
   const persistence:DebriefPersistence={durability:"host-owned",load:saved,compareAndSwap(expected,next){
     const rows=history(),previous=saved();if((previous?dataDigest(previous):null)!==expected)throw Error("stale attention CAS");
@@ -93,9 +98,17 @@ export function openDashboardHost(options:DashboardHostOptions){
       let controls:unknown=null;try{controls=await nativeRead();}catch(e){error=String(e);}
       let learning:unknown=null;if(c.learningLifecycleId)try{learning=h.readLearningLifecycle(c.archiveRoot,c.learningLifecycleId);}catch(e){error=String(e);}
       const attention=trust.inspect(Date.now());let actions:{key:string;label:string;operation:string}[]=[];
-      try{const available=await availableHumanActions(),digest=dataDigest(available.map(({key,label,operation,request})=>({key,label,operation,requestDigest:dashboardHostRequestDigest(request)})));
-        if(displayedActions?.tip===tip&&displayedActions.digest!==digest)throw Error("displayed dashboard actions changed before journal advance");
-        displayedActions={tip,actions:available,digest};actions=available.map(({key,label,operation})=>({key,label,operation}));}catch(e){error=String(e);}
+      try{const available=await availableHumanActions();
+        // A frame that completed after its captured tip is stale and cannot replace a newer display generation.
+        if(history().at(-1)!.id===tip){
+          if(!displayedActions||displayedActions.tip!==tip)displayedActions={tip,actions:new Map()};
+          const additions=available.filter(action=>!displayedActions!.actions.has(action.key));
+          if(displayedActions.actions.size+additions.length>MAX_DISPLAYED_ACTIONS_PER_TIP)throw Error("displayed dashboard action capacity exhausted");
+          const shown=available.filter(action=>{const prior=displayedActions!.actions.get(action.key);
+            if(prior&&dashboardHostRequestDigest(prior.request)!==dashboardHostRequestDigest(action.request))return false;
+            if(!prior)displayedActions!.actions.set(action.key,action);return true;});
+          actions=shown.map(({key,label,operation})=>({key,label,operation}));
+        }}catch(e){error=String(e);}
       return freeze(detached({version:"producer-dashboard-frame-v1",hostDigest,selectionDigest:dashboardSelectionDigest(selection),selectionState,tip,source,controls,learning,debrief,attention,error,actions,
         requests:rows.filter(e=>["claim","result","presentation","defer","ordinary-intent-pending"].includes(String(e.value.type))).map(e=>e.value),
         control:rows.some(e=>e.value.type==="host-failure")?"failed":rows.some(e=>e.value.type==="claim"&&!rows.some(r=>r.value.type==="result"&&r.value.requestId===e.value.requestId))?"unknown":"not-assessed",
@@ -104,7 +117,7 @@ export function openDashboardHost(options:DashboardHostOptions){
     /** Explicit reconciliation is read-only. A retained claim is never replayed as an effect. */
     reconcile:()=>api.frame(),
     async humanAction(key:string){const tip=history().at(-1)!.id;if(!displayedActions||displayedActions.tip!==tip)throw Error("dashboard actions must be displayed at the current tip");
-      const found=displayedActions.actions.find(action=>action.key===key);if(!found)throw Error(`unknown dashboard action ${JSON.stringify(key)}`);
+      const found=displayedActions.actions.get(key);if(!found)throw Error(`unknown dashboard action ${JSON.stringify(key)}`);
       const current=(await availableHumanActions()).find(action=>action.key===key);if(!current||current.label!==found.label||dashboardHostRequestDigest(current.request)!==dashboardHostRequestDigest(found.request))throw Error("displayed dashboard action changed; no effect attempted");return api.action(found.request);},
     async action(input:DashboardHostRequest){
       const request=dashboardHostRequest(input),digest=dashboardHostRequestDigest(request);

package/src/init.ts

@@ -22,7 +22,7 @@
  * for, rather than a grant nobody decided.
  */
 
-import { mkdir, open, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, open, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { agentCapability, workspaceCapability } from "./capabilities.ts";
 import { ceilingForDefinition } from "./definitions.ts";
@@ -372,6 +372,23 @@ async function replace(path: string, content: string, outcome: InitOutcome): Pro
  */
 export async function applyInit(plan: InitPlan, options: { force?: boolean } = {}): Promise<InitOutcome> {
   const outcome: InitOutcome = { written: [], kept: [], failed: [] };
+  const projectPi = join(plan.grantEnvPath, "..");
+  try {
+    // A new project gets a private control directory. Existing operator/Pi state is never chmodded or reused.
+    await mkdir(projectPi, { mode: 0o700 });
+    const created = await lstat(projectPi);
+    if (!created.isDirectory() || created.isSymbolicLink()) throw Error("private .pi directory creation failed");
+  } catch (error) {
+    if ((error as { code?: string }).code !== "EEXIST") {
+      outcome.failed.push({ path: projectPi, error: error instanceof Error ? error.message : String(error) });
+      return outcome;
+    }
+    const existing = await lstat(projectPi);
+    if (existing.isSymbolicLink() || !existing.isDirectory()) {
+      outcome.failed.push({ path: projectPi, error: "existing .pi state is not a directory; it was not followed or changed" });
+      return outcome;
+    }
+  }
   const force = options.force === true;
   for (const skill of plan.skills) {
     if (force) await replace(skill.targetPath, skill.content, outcome);

package/src/propagation.ts

@@ -285,7 +285,8 @@ export function childEnv(input: ChildEnvInput): Record<string, string> {
   // whatever was there before — the parent's own, unclamped `PI_GRANTS_APPROVED` — visible to every child.
   // `parseList("")` is `[]`, so an empty value reads back exactly as an absent one.
   env[ENV_APPROVED] = inheritApprovals(input.approved ?? [], inheritable).join(",");
-  if (input.ledgerPath) env[ENV_LEDGER] = input.ledgerPath;
+  // Empty is an explicit one-run ledger opt-out and must overwrite a prior publication too.
+  if (input.ledgerPath !== undefined) env[ENV_LEDGER] = input.ledgerPath;
   return env;
 }
 

package/src/work-command.ts

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import {
   appendWorkLedgerEventOnce,
@@ -101,8 +101,15 @@ export async function declareWork(input: DeclareWorkInput): Promise<WorkFrozen<D
   }
   if (!ID.test(input.id) || typeof input.outcome !== "string" || !input.outcome.trim()) throw new TypeError("work declaration requires an identifier and non-empty outcome");
   const resolved = paths(input), outcomeDigest = sha256(input.outcome.trim());
-  await mkdir(dirname(resolved.ledgerPath), { recursive: true, mode: 0o700 });
-  await mkdir(dirname(resolved.statePath), { recursive: true, mode: 0o700 });
+  const projectPi = dirname(resolved.ledgerPath);
+  try {
+    // Create only a new project control directory as private; never chmod or repurpose an existing one.
+    await mkdir(projectPi, { mode: 0o700 });
+  } catch (error) {
+    if ((error as { code?: string }).code !== "EEXIST") throw error;
+    const existing = await lstat(projectPi);
+    if (!existing.isDirectory() || existing.isSymbolicLink()) throw Error("existing .pi state is not a directory; it was not followed or changed");
+  }
   return withFileLock(resolved.statePath, "declared work", async () => {
     const existing = await loadDeclaredWork(resolved.statePath);
     if (existing) {