pi-daddy 0.26.0 → 0.27.0

package/src/dashboard-cli.ts

@@ -10,6 +10,8 @@ import { parseDashboardLedger } from "./dashboard-projection.ts";
 import { renderDashboard } from "./dashboard-render.ts";
 import { createDailyViewReader, isDailyViewReader, readDailyView, type DailyViewOptions } from "./daily-view.ts";
 import { renderDailyView } from "./daily-view-render.ts";
+import { renderDailyPanel, panelLines, learningSummary, type PanelAction, type WorkPresentation } from "./daily-panel.ts";
+import { createDashboardMenu } from "./dashboard-menu.ts";
 import { projectWorkLedger, type WorkProjectionContext } from "./work-ledger.ts";
 import { parseRetentionJson } from "./retention-json.ts";
 import { createInterface } from "node:readline";
@@ -49,6 +51,7 @@ export interface DashboardFrameOptions {
   debrief?: DebriefPresenter;
   debriefJson?: boolean;
   connected?: DashboardConnection;
+  actionMenu?: ReturnType<typeof createDashboardMenu>;
 }
 export async function dashboardHostAction(host:DashboardConnection,line:string){
   if(!isDashboardConnection(host)||Buffer.byteLength(line)>60000)throw Error("genuine bounded dashboard connection required");
@@ -60,10 +63,10 @@ export async function dashboardHostAction(host:DashboardConnection,line:string){
 
 /** A fulfilled host call is not necessarily an applied native effect; keep those facts distinct in the UI. */
 export function dashboardActionFeedback(command:string,outcome:unknown):string{
-  const value=outcome&&typeof outcome==="object"?outcome as {state?:unknown;result?:unknown}:{};
+  const value=outcome&&typeof outcome==="object"?outcome as {state?:unknown;result?:unknown;error?:unknown;reason?:unknown}:{};
   const state=typeof value.state==="string"?value.state:"unrecognised host response";
   if(state==="failed-or-unknown"||state==="readback-only")return `NO ACTION CLAIM: ${command} returned ${state}; inspect/reconcile explicitly.`;
-  if(state!=="acknowledged")return `NOT APPLIED: ${command} returned ${state}.`;
+  if(state!=="acknowledged")return `NOT APPLIED: ${command} returned ${state}.${typeof (value.error??value.reason)==="string"?` ${String(value.error??value.reason).slice(0,1024)}`:""}`;
   const result=value.result&&typeof value.result==="object"?value.result as {application?:unknown}:null;
   // A retained records[] snapshot has no outer dashboard request correlation. Never select an old receipt.
   const nativeApplication=typeof result?.application==="string"?result.application:undefined;
@@ -110,15 +113,14 @@ export async function dashboardFrame(options: DashboardFrameOptions): Promise<st
   if(options.connected){
     if(!isDashboardConnection(options.connected))throw Error("original dashboard connection required");
     let view:Awaited<ReturnType<DashboardConnection["frame"]>>;
-    try{view=await options.connected.frame();}catch(error){return `PI-DADDY — CONNECTED HOST ERROR\n${error instanceof Error ? error.message : String(error)}\nNo prior acceptance, presentation or continuity substituted. No action retried.`;}
+    try{view=await options.connected.frame();}catch(error){options.actionMenu?.clear();return panelLines(["PI-DADDY — Disconnected", "The original host is unavailable. No action was retried.", "Return to Pi: /grants host, then /grants dashboard.", ...(options.details?[String(error)]:[])],options.width);}
     if(options.dailyJson||options.debriefJson)return JSON.stringify(view);
     const source=view.source as {daily?:Parameters<typeof renderDailyView>[0]}|null;
-    const actions=(view.actions as {key:string;label:string}[]|undefined)??[];
-    const hostError=typeof view.error==="string"&&view.error?`HOST ERROR — ${view.error}`:null;
-    return ["PI-DADDY — CONNECTED HOST (snapshot; identity/acceptance not authenticated)",hostError,source?.daily?renderDailyView(source.daily,options.width):"Source unavailable; no previous acceptance substituted.",
-      view.debrief?renderDebrief(view.debrief as Parameters<typeof renderDebrief>[0],options.width):"Debrief deferred/closed. No implicit presentation or steering.",
-      `Host control ${view.control}; acknowledgement ${view.acknowledgement}. Attention reserved ${view.attention.attentionUsed}/5 (not proof of delivery). Tip ${view.tip}.`,
-      actions.length?`ACTIONS — type one command and Enter\n${actions.map(action=>`  ${action.key} — ${action.label}`).join("\n")}`:"ACTIONS — none currently authorized; refresh never acts."].filter((line):line is string=>Boolean(line)).join("\n\n");
+    const actions=(view.actions as PanelAction[]|undefined)??[];
+    const menu=(options.actionMenu??createDashboardMenu()).show(view.tip,actions);
+    const learning=view.debrief?["Retained review open below"]:learningSummary(view.learning);
+    const summary=source?.daily?renderDailyPanel(source.daily,options.width,{details:options.details,connected:true,presentation:view.presentation as WorkPresentation|null,error:view.error,controls:view.controls,control:view.control,actions:menu,learning}):panelLines(["PI-DADDY — Needs you","Work observation unavailable. Capture current work or open Details.",...menu.map(a=>`${a.choice}  ${a.label}`)],options.width);
+    return [summary,view.debrief?renderDebrief(view.debrief as Parameters<typeof renderDebrief>[0],options.width):"",options.details?panelLines([`Host control ${view.control}; acknowledgement ${view.acknowledgement}. Attention reserved ${view.attention.attentionUsed}/5. Tip ${view.tip}.`,JSON.stringify(view.controls),JSON.stringify(view.learning),...actions.map(a=>`${a.key} — ${a.label}`)],options.width):""].filter(Boolean).join("\n\n");
   }
   if (options.debrief || options.debriefJson) {
     if (!isDebriefPresenter(options.debrief)) return "PI-DADDY — DEBRIEF UNAVAILABLE: genuine presenter/host missing";
@@ -128,7 +130,7 @@ export async function dashboardFrame(options: DashboardFrameOptions): Promise<st
     try {
       if (options.dailyReader !== undefined && !isDailyViewReader(options.dailyReader)) throw new TypeError("untrusted daily reader callback");
       const view = await (options.dailyReader ?? readDailyView)(options.dailyView);
-      return options.dailyJson ? JSON.stringify(view) : renderDailyView(view, options.width);
+      return options.dailyJson ? JSON.stringify(view) : renderDailyPanel(view, options.width, { details: options.details });
     } catch {
       return "PI-DADDY — DAILY VIEW UNAVAILABLE\nInvalid or unavailable read-only input. No previous acceptance or continuity was substituted.";
     }
@@ -227,6 +229,8 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
     if (!host.debrief) await debrief.open({ mode: "manual", userPresent: true }); // Explicit CLI fixture only; never override a host deferral.
   }
   const dailyReader = createDailyViewReader();
+  const actionMenu=createDashboardMenu();
+  let details=cli.details;
   let previous = "";
   let feedback = "";
   let input: ReturnType<typeof createInterface> | null = null;
@@ -237,13 +241,13 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
       protocol,
       color: cli.color,
       width: process.stdout.columns || 80,
-      details: cli.details,
+      details, actionMenu,
       dailyView, dailyReader, dailyJson: cli.dailyJson, debrief, debriefJson: cli.debriefJson, connected,
     });
-    const rendered = feedback ? `${frame}\n\n${feedback}` : frame;
+    const rendered = feedback ? `${panelLines([feedback], process.stdout.columns || 80)}\n\n${frame}` : frame;
     if (rendered === previous && !clear) return;
     previous = rendered;
-    const prompt = "COMMAND — type an exact listed key, then Enter (refresh never acts): ";
+    const prompt = "Action number / d Details, then Enter: ";
     const draft = input?.line ?? "";
     process.stdout.write(clear ? `\u001b]0;PI-DADDY\u0007\u001b[2J\u001b[H${rendered}\n\n${input ? prompt + draft : ""}` : `${rendered}\n`);
     if (input) input.setPrompt(prompt);
@@ -253,7 +257,7 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
     await draw(false);
     return;
   }
-  input = debrief || connected ? createInterface({ input: process.stdin, output: process.stdout, terminal: true }) : null;
+  input = createInterface({ input: process.stdin, output: process.stdout, terminal: Boolean(process.stdin.isTTY) });
   await draw(true);
   let drawing = false;
   const redraw = (): void => {
@@ -264,10 +268,18 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
   let acting = false;
   input?.on("line", line => {
     if (acting) return; // never replay a line typed while the prior exact command is still settling.
+    if(line.trim().toLowerCase()==="d"){details=!details;redraw();return;}
     acting = true;
-    feedback = `COMMAND ${line.trim() || "(empty)"} — applying the displayed exact request…`;
-    void (connected?dashboardHostAction(connected,line):debriefAction(debrief!, line)).then(outcome => {
-      feedback = connected ? dashboardActionFeedback(line.trim() || "command", outcome) : `ACKNOWLEDGED: ${line.trim() || "command"}. Refreshed state is shown below.`;
+    let label=line.trim()||"(empty)";
+    const act=async()=>{
+      if(connected&&/^\d+$/.test(line.trim())){const selected=actionMenu.select(line.trim());label=selected.label;return connected.humanAction(selected.key,{tip:selected.tip,requestDigest:selected.requestDigest});}
+      if(connected)return dashboardHostAction(connected,line);
+      if(debrief)return debriefAction(debrief,line);
+      throw Error("Read-only snapshot; no controls connected");
+    };
+    feedback = `Action ${label} — awaiting acknowledgement…`;
+    void act().then(outcome => {
+      feedback = connected ? dashboardActionFeedback(label, outcome) : `ACKNOWLEDGED: ${label}. Refreshed state is shown below.`;
     }).catch(error => {
       feedback = `REJECTED: ${error instanceof Error ? error.message : String(error)}. No command was retried; inspect the refreshed offered keys.`;
     }).finally(() => { acting = false; redraw(); });

package/src/dashboard-host-contract.ts

@@ -32,6 +32,8 @@ export interface DashboardHostConfig {
   budgetDigest: string; experimentDigest: string | null; harnessArtifactDigest: string;
   ordinaryDigest?: string;
   learningLifecycleId?: string;
+  /** Explicit host journal, while reusing the original trust store/attention across host lifetimes. */
+  journalDirectory?: string;
 }
 export interface DashboardHostRequest { version: "1.0"; requestId: string; hostDigest: string; expectedTip: string; selectionDigest: string; operation: "observe" | "present" | "presented" | "defer" | "debrief" | "dispatch" | "intent" | "cancel" | "dispatch-reconcile" | "intent-reconcile" | "ordinary-cancel"; payload: unknown }
 export interface DashboardHostAuthority {

package/src/dashboard-host-transport.ts

@@ -13,10 +13,13 @@ export async function serveDashboardHost(path:string,host:DashboardHost){
   if(!isDashboardHost(host))throw Error("original dashboard host required");await parent(path);const clients=new Set<Socket>(),tasks=new Set<Promise<void>>();
   const server=createServer(socket=>{if(clients.size>=4){socket.destroy();return;}clients.add(socket);socket.on("close",()=>clients.delete(socket));socket.on("error",()=>{});socket.setTimeout(5000,()=>socket.destroy());let size=0,used=false;const chunks:Buffer[]=[];
     socket.on("data",bytes=>{if(used)return;size+=bytes.length;if(size>65536){socket.destroy();return;}chunks.push(bytes);if(bytes.at(-1)!==10)return;used=true;
-      const task=(async()=>{try{const text=new TextDecoder("utf-8",{fatal:true}).decode(Buffer.concat(chunks));const r=parseRetentionJson(text,65536) as {operation:string;request?:DashboardHostRequest;key?:string};let result:unknown;
+      const task=(async()=>{try{const text=new TextDecoder("utf-8",{fatal:true}).decode(Buffer.concat(chunks));const r=parseRetentionJson(text,65536) as {operation:string;request?:DashboardHostRequest;key?:string;expected?:{tip:string;requestDigest:string}};let result:unknown;
         if(Object.keys(r).join()==="operation"&&r.operation==="frame")result=await host.frame();
         else if(Object.keys(r).sort().join()==="operation,request"&&r.operation==="action")result=await host.action(dashboardHostRequest(r.request!));
-        else if(Object.keys(r).sort().join()==="key,operation"&&r.operation==="human-action"&&typeof r.key==="string")result=await host.humanAction(r.key);
+        else if(["key,operation","expected,key,operation"].includes(Object.keys(r).sort().join())&&r.operation==="human-action"&&typeof r.key==="string"){
+          if(r.expected&&(!/^[a-f0-9]{64}$/.test(r.expected.tip)||!/^[a-f0-9]{64}$/.test(r.expected.requestDigest)||Object.keys(r.expected).sort().join()!=="requestDigest,tip"))throw Error("exact displayed action required");
+          result=await host.humanAction(r.key,r.expected);
+        }
         else throw Error("closed dashboard protocol required");
         const output=JSON.stringify({ok:true,result})+"\n";if(Buffer.byteLength(output)>512*1024)throw Error("dashboard frame bound exceeded");socket.end(output);
       }catch{socket.end(JSON.stringify({ok:false,error:"refused or acknowledgement unknown; explicit readback only"})+"\n");}})();tasks.add(task);void task.finally(()=>tasks.delete(task));
@@ -28,7 +31,7 @@ export async function serveDashboardHost(path:string,host:DashboardHost){
 }
 /** Explicit operator-selected endpoint. Socket ownership is access policy, not module/human authentication. */
 export function connectDashboardHost(path:string):DashboardConnection{
-  const call=async(operation:string,payload:{request?:DashboardHostRequest;key?:string}={})=>{await parent(path);const s=await lstat(path);if(!s.isSocket()||s.mode&0o077||s.uid!==process.getuid?.())throw Error("private original dashboard endpoint unavailable");
+  const call=async(operation:string,payload:{request?:DashboardHostRequest;key?:string;expected?:{tip:string;requestDigest:string}}={})=>{await parent(path);const s=await lstat(path);if(!s.isSocket()||s.mode&0o077||s.uid!==process.getuid?.())throw Error("private original dashboard endpoint unavailable");
     return new Promise<any>((resolve,reject)=>{const socket=createConnection(path);let size=0,done=false;const chunks:Buffer[]=[];const fail=(e:unknown)=>{if(!done){done=true;socket.destroy();reject(e);}};
       socket.setTimeout(5000,()=>fail(Error("dashboard acknowledgement timeout; do not repeat action")));socket.on("error",fail);socket.on("connect",()=>socket.write(JSON.stringify({operation,...payload})+"\n"));
       socket.on("data",b=>{size+=b.length;if(size>512*1024){fail(Error("dashboard frame limit"));return;}chunks.push(b);});
@@ -36,5 +39,5 @@ export function connectDashboardHost(path:string):DashboardConnection{
       socket.on("close",()=>{if(!done)fail(Error("dashboard disconnected; acknowledgement unknown"));});
     });
   };
-  const api={frame:()=>call("frame"),action:(r:DashboardHostRequest)=>call("action",{request:dashboardHostRequest(r)}),humanAction:(key:string)=>call("human-action",{key})};connections.add(api);return Object.freeze(api);
+  const api={frame:()=>call("frame"),action:(r:DashboardHostRequest)=>call("action",{request:dashboardHostRequest(r)}),humanAction:(key:string,expected?:{tip:string;requestDigest:string})=>call("human-action",{key,...(expected?{expected}:{})})};connections.add(api);return Object.freeze(api);
 }

package/src/dashboard-host.ts

@@ -1,3 +1,4 @@
+import type { WorkPresentation } from "./daily-panel.ts";
 import { isOrdinaryChildren, holdOrdinaryDispatch, type OrdinaryChildren, type OrdinaryCancellation } from "./ordinary-children.ts";
 import { loadedDashboardHarnessDigest } from "./dashboard-harness.ts";
 import { join, isAbsolute } from "node:path";
@@ -22,6 +23,11 @@ export type DashboardHost=ReturnType<typeof openDashboardHost>;
 export interface DashboardHostOptions { ordinary?:OrdinaryChildren; harness:DashboardHarness; config:DashboardHostConfig; budget:GovernedBudgetBinding; experiment?:ReturnType<typeof openExperiment>; authority:()=>DashboardHostAuthority|null;
   /** Exact actions constructed and authorized by the owner; the dashboard exposes only human labels/keys. */
   humanActions?:(context:{hostDigest:string;selectionDigest:string;tip:string;observations:readonly {sourceId:string;checkpointId:string}[];preparedPresentationDigest:string|null})=>readonly {key:string;label:string;request:DashboardHostRequest}[]|Promise<readonly {key:string;label:string;request:DashboardHostRequest}[]>;
+  /** Read-only, digest-bound local outcome labels. Never grants acceptance or control. */
+  presentation?: () => WorkPresentation | null | Promise<WorkPresentation | null>;
+  currentWork?: () => Promise<import("./daily-view.ts").DailyView>;
+  learningView?: () => unknown;
+  afterObservation?: (observation: import("./dashboard-observation.ts").DashboardObservation) => void;
   /** Explicit approved observation effect only; refresh/frame never invokes it. */
   beforeObservation?:(sourceId:string)=>Promise<void>;
   /** Owner callback after the exact intent journal reports applied; failure keeps host acknowledgement unknown. */
@@ -30,7 +36,8 @@ export interface DashboardHostOptions { ordinary?:OrdinaryChildren; harness:Dash
   presence?:()=>{present:boolean;closing:boolean;evidenceDigest:string;expiresAt:number}|null;
 }
 function configuration(input:DashboardHostConfig){
-  const c=detached(input);controlShape(c,["version","trustDirectory","trustPolicyId","archiveRoot","scope","author","policyPath","policySha256","sources","selection","cases","blind","budgetDigest","experimentDigest","harnessArtifactDigest",...(Object.hasOwn(c,"ordinaryDigest")?["ordinaryDigest"]:[]),...(Object.hasOwn(c,"learningLifecycleId")?["learningLifecycleId"]:[])]);
+  const c=detached(input);controlShape(c,["version","trustDirectory","trustPolicyId","archiveRoot","scope","author","policyPath","policySha256","sources","selection","cases","blind","budgetDigest","experimentDigest","harnessArtifactDigest",...(Object.hasOwn(c,"ordinaryDigest")?["ordinaryDigest"]:[]),...(Object.hasOwn(c,"learningLifecycleId")?["learningLifecycleId"]:[]),...(Object.hasOwn(c,"journalDirectory")?["journalDirectory"]:[])]);
+  if(c.journalDirectory!==undefined&&(typeof c.journalDirectory!=="string"||!isAbsolute(c.journalDirectory)))throw Error("explicit host journal directory required");
   if(Object.hasOwn(c,"ordinaryDigest")&&!sha(c.ordinaryDigest))throw Error("invalid ordinary binding digest");
   if(Object.hasOwn(c,"learningLifecycleId")&&!sha(c.learningLifecycleId))throw Error("invalid learning lifecycle manifest");
   if(c.version!=="producer-dashboard-host-v1"||![c.trustDirectory,c.archiveRoot,c.policyPath].every(p=>typeof p==="string"&&isAbsolute(p))||![c.trustPolicyId,c.policySha256,c.budgetDigest,c.harnessArtifactDigest].every(sha)||!(c.experimentDigest===null||sha(c.experimentDigest))||typeof c.scope!=="string"||!c.scope||c.scope.length>128||typeof c.author!=="string"||!c.author||c.author.length>256||!Array.isArray(c.sources)||c.sources.length<1||c.sources.length>32||new Set(c.sources.map(s=>s.id)).size!==c.sources.length||c.sources.filter(s=>s.kind==="work").length>1||c.sources.some(s=>!/^[a-zA-Z0-9:_-]{1,128}$/.test(s.id)||!["work","retention","facts"].includes(s.kind)))throw Error("invalid explicit dashboard host binding");
@@ -43,7 +50,7 @@ export function createDashboardHost(options:DashboardHostOptions){
   if(!a?.hostDigests.includes(dashboardHostDigest(c)))throw Error("independent exact host authority required");
   const trust=h.openTrustLifecycle(c.trustDirectory),view=trust.inspect(Date.now());
   if(view.policyId!==c.trustPolicyId)throw Error("trust policy changed");
-  h.learningJournal(join(c.trustDirectory,"producer-host"),{type:"producer-host-initial",config:c});
+  h.learningJournal(c.journalDirectory??join(c.trustDirectory,"producer-host"),{type:"producer-host-initial",config:c});
   return openDashboardHost(options);
 }
 /** Existing native writers + original controllers; no model, launch, authority-file loader or PID recovery. */
@@ -53,7 +60,7 @@ export function openDashboardHost(options:DashboardHostOptions){
   const budget=openResourceBudget(options.budget),experiment=options.experiment,ordinary=options.ordinary;
   if(ordinary&&(!isOrdinaryChildren(ordinary)||ordinary.bindingDigest!==c.ordinaryDigest))throw Error("original ordinary controller binding required");
   if(resourceBindingDigest(budget.binding)!==c.budgetDigest||experiment&&(!isExperimentController(experiment)||experimentBindingDigest(experiment.binding)!==c.experimentDigest))throw Error("original controller binding required");
-  const trust=h.openTrustLifecycle(c.trustDirectory),journal=h.learningJournal(join(c.trustDirectory,"producer-host"));
+  const trust=h.openTrustLifecycle(c.trustDirectory),journal=h.learningJournal(c.journalDirectory??join(c.trustDirectory,"producer-host"));
   const initial=journal.read()[0].value;
   if(initial.type!=="producer-host-initial"||dataDigest(initial.config)!==hostDigest)throw Error("host store binding changed; no new budget");
   const trustInput=trust.history()[0].value.input as {archiveRoot:string;component:unknown;exposure:{attentionRemaining:number}|null};
@@ -62,7 +69,7 @@ export function openDashboardHost(options:DashboardHostOptions){
   const observation=dashboardObservations(h,c,journal.read),history=()=>journal.read();
   const append=(value:Record<string,unknown>)=>journal.append(history().at(-1)!.id,value);
   const saved=():DebriefCheckpoint|null=>{const rows=history().filter(e=>e.value.type==="checkpoint");return rows.length?detached(rows.at(-1)!.value.checkpoint) as DebriefCheckpoint:null;};
-  let presenter:DebriefPresenter|undefined,busy=false,poisoned=false,presentationRevision:number|null=null,presenceDigest:string|null=null,attentionDeferred:string|null=null,presentationAcknowledged=false;
+  let presenter:DebriefPresenter|undefined,busy=false,poisoned=false,stopped=false,presentationRevision:number|null=null,presenceDigest:string|null=null,attentionDeferred:string|null=null,presentationAcknowledged=false;
   const ordinaryDispatchHoldKey=dataDigest({hostDigest,control:"pause-new-ordinary-dispatch"});
   // A host frame is a read-only snapshot: ordinary children may attach or settle without advancing this journal.
   // Within one tip, a key keeps its first exact request; humanAction revalidates it against current native authority.
@@ -88,39 +95,60 @@ export function openDashboardHost(options:DashboardHostOptions){
       return {key:x.key,label:x.label,operation:request.operation,request};});
   };
   const api={hostDigest,selectionDigest,
+    /** Same owner gate as action: checking stop cannot race a newly admitted effect. Never releases a hold. */
+    async stop(){
+      if(stopped)return;if(busy)throw Error("Cannot stop: dashboard operation busy; wait for its acknowledgement first");busy=true;
+      try{
+        const rows=history();
+        if(poisoned||rows.some(e=>e.value.type==="host-failure")||rows.some(e=>e.value.type==="claim"&&!rows.some(r=>r.value.type==="result"&&r.value.requestId===e.value.requestId)))throw Error("Cannot stop: acknowledgement unknown; retain this original host for readback. Do not repeat effects. Ending the whole Pi session does not reconcile or release this hold.");
+        if(c.ordinaryDigest&&!ordinary)throw Error("Cannot stop: original ordinary boundary unavailable; no recovery");
+        const dispatch=await budget.controls(null).inspect();
+        if(dispatch.admission==="blocked-pending")throw Error("Cannot stop: pending original control requires explicit reconciliation, then resume before stopping");
+        if(dispatch.paused||ordinary&&(ordinary.inspect() as {admission:string}).admission!=="open")throw Error("Cannot stop: resume new work in the original dashboard first. Any pending intent also needs its original reconciliation; no hold was released.");
+        stopped=true;presenter?.close();presentationRevision=null;
+      }finally{busy=false;}
+    },
+    /** Final owner-session disposal only, not /grants host stop. Disconnects without resolving/releasing any control. */
+    endSession(){stopped=true;presenter?.close();presentationRevision=null;},
     async frame(){
       const rows=history(),tip=rows.at(-1)!.id,a=authority();let source:unknown=null,error:string|null=null;
       let selection=c.selection,selectionState="current-control-snapshot";
       try{selection=await currentSelection();}catch(e){error=String(e);selectionState="unavailable-host-declaration-only";}
-      try{source=await observation.view(selectionState==="current-control-snapshot"?a:null,selection);}catch(e){error=String(e);}
+      try{source=await observation.view(selectionState==="current-control-snapshot"?a:null,selection);
+        if(options.currentWork)source={...(source as object),daily:await options.currentWork()};
+      }catch(e){error=String(e);}
       let debrief:unknown=null;
       if(a&&presenter&&presentationRevision!==null&&presence()?.evidenceDigest===presenceDigest){try{await paused(presentationRevision);debrief=presenter.view();}catch{debrief=null;}}
       let controls:unknown=null;try{controls=await nativeRead();}catch(e){error=String(e);}
       let learning:unknown=null;if(c.learningLifecycleId)try{learning=h.readLearningLifecycle(c.archiveRoot,c.learningLifecycleId);}catch(e){error=String(e);}
-      const attention=trust.inspect(Date.now());let actions:{key:string;label:string;operation:string}[]=[];
+      let presentation:WorkPresentation|null=null;try{presentation=await options.presentation?.()??null;}catch(e){error=String(e);}
+      if(options.learningView)try{learning=options.learningView();}catch(e){learning={state:"deferred",reason:String(e)};}
+      const attention=trust.inspect(Date.now());let actions:{key:string;label:string;operation:string;requestDigest:string}[]=[];
       try{const available=await availableHumanActions();
         // A frame that completed after its captured tip is stale and cannot replace a newer display generation.
-        if(history().at(-1)!.id===tip){
+        if(!stopped&&history().at(-1)!.id===tip){
           if(!displayedActions||displayedActions.tip!==tip)displayedActions={tip,actions:new Map()};
           const additions=available.filter(action=>!displayedActions!.actions.has(action.key));
           if(displayedActions.actions.size+additions.length>MAX_DISPLAYED_ACTIONS_PER_TIP)throw Error("displayed dashboard action capacity exhausted");
           const shown=available.filter(action=>{const prior=displayedActions!.actions.get(action.key);
             if(prior&&dashboardHostRequestDigest(prior.request)!==dashboardHostRequestDigest(action.request))return false;
             if(!prior)displayedActions!.actions.set(action.key,action);return true;});
-          actions=shown.map(({key,label,operation})=>({key,label,operation}));
+          actions=shown.map(({key,label,operation,request})=>({key,label,operation,requestDigest:dashboardHostRequestDigest(request)}));
         }}catch(e){error=String(e);}
-      return freeze(detached({version:"producer-dashboard-frame-v1",hostDigest,selectionDigest:dashboardSelectionDigest(selection),selectionState,tip,source,controls,learning,debrief,attention,error,actions,
+      return freeze(detached({version:"producer-dashboard-frame-v1",hostDigest,selectionDigest:dashboardSelectionDigest(selection),selectionState,tip,source,controls,learning,debrief,attention,error,actions,presentation,
         requests:rows.filter(e=>["claim","result","presentation","defer","ordinary-intent-pending"].includes(String(e.value.type))).map(e=>e.value),
         control:rows.some(e=>e.value.type==="host-failure")?"failed":rows.some(e=>e.value.type==="claim"&&!rows.some(r=>r.value.type==="result"&&r.value.requestId===e.value.requestId))?"unknown":"not-assessed",
         acknowledgement:poisoned?"unknown":"readback-only",identity:"independently-declared-host; not human/module authentication",activeBranch:null,acceptance:"not-assessed",freshness:"snapshot-unknown",workerInteractions:0}));
     },
     /** Explicit reconciliation is read-only. A retained claim is never replayed as an effect. */
     reconcile:()=>api.frame(),
-    async humanAction(key:string){const tip=history().at(-1)!.id;if(!displayedActions||displayedActions.tip!==tip)throw Error("dashboard actions must be displayed at the current tip");
+    async humanAction(key:string,expected?:{tip:string;requestDigest:string}){const tip=history().at(-1)!.id;if(expected&&expected.tip!==tip)throw Error("displayed action is stale; select again");if(!displayedActions||displayedActions.tip!==tip)throw Error("dashboard actions must be displayed at the current tip");
       const found=displayedActions.actions.get(key);if(!found)throw Error(`unknown dashboard action ${JSON.stringify(key)}`);
+      if(expected&&dashboardHostRequestDigest(found.request)!==expected.requestDigest)throw Error("displayed action identity changed; no effect attempted");
       const current=(await availableHumanActions()).find(action=>action.key===key);if(!current||current.label!==found.label||dashboardHostRequestDigest(current.request)!==dashboardHostRequestDigest(found.request))throw Error("displayed dashboard action changed; no effect attempted");return api.action(found.request);},
     async action(input:DashboardHostRequest){
       const request=dashboardHostRequest(input),digest=dashboardHostRequestDigest(request);
+      if(stopped)throw Error("dashboard host stopped; no effect attempted");
       if(busy||poisoned)throw Error("dashboard operation busy or acknowledgement unknown");busy=true;let attempted=false;
       try{
         const rows=history(),old=rows.find(e=>e.value.type==="claim"&&e.value.requestId===request.requestId);
@@ -135,7 +163,7 @@ export function openDashboardHost(options:DashboardHostOptions){
         try{
           if(request.operation==="observe"){
             const sourceId=(request.payload as {sourceId?:unknown})?.sourceId;if(typeof sourceId!=="string")throw Error("exact observation source required");await options.beforeObservation?.(sourceId);
-            const captured=observation.observe(request.payload,a!,selection);append({type:"observation",observation:captured});result=captured;
+            const captured=observation.observe(request.payload,a!,selection);append({type:"observation",observation:captured});options.afterObservation?.(captured);result=captured;
           }else if(request.operation==="present"){
             const p=detached(request.payload) as {userPresent:boolean;closing:boolean;evidenceDigest:string;dispatchRevision:number};
             if(Object.keys(p).sort().join()!=="closing,dispatchRevision,evidenceDigest,userPresent"||!sha(p.evidenceDigest)||typeof p.userPresent!=="boolean"||typeof p.closing!=="boolean"||!Number.isSafeInteger(p.dispatchRevision))throw Error("explicit presence/boundary evidence required");
@@ -165,8 +193,10 @@ export function openDashboardHost(options:DashboardHostOptions){
               const port=budget.controls(a!.dispatch),ordinaryHold=ordinary&&["pause-dispatch","resume-dispatch"].includes(native.action)?holdOrdinaryDispatch(ordinary,ordinaryDispatchHoldKey):undefined;
               if(request.operation==="dispatch-reconcile"&&(await port.inspect()).records.find(r=>r.request.requestId===native.requestId)?.digest!==dispatchRequestDigest(native))throw Error("exact original dispatch reconciliation required");
               result=request.operation==="dispatch"?await port.request(native):await port.reconcile(native.requestId);
-              const record=(result as {records:{request:{requestId:string};decision:string;application:string}[]}).records.find(r=>r.request.requestId===native.requestId);
-              if(ordinaryHold&&(record?.decision!=="approved"||native.action==="resume-dispatch"&&record.application==="applied"))ordinaryHold.release();
+              const snapshot=result as import("./dispatch-control.ts").DispatchSnapshot,record=snapshot.records.find(r=>r.request.requestId===native.requestId);
+              if(!record)throw Error("native dispatch application acknowledgement unavailable");
+              // A denied resume must not undo an earlier pause/pending control. Release only after final host sync.
+              if(ordinaryHold&&(native.action==="resume-dispatch"&&record.decision==="approved"&&record.application==="applied"||record.application==="not-applied"&&snapshot.admission==="enabled"))releaseOrdinary=ordinaryHold.release;
             }else if(request.operation==="intent"||request.operation==="intent-reconcile"){
               const native=detached(intentRequest(request.payload as IntentRequest)) as IntentRequest,port=budget.intentControls(a!.dispatch),digest=intentRequestDigest(native);
               if(c.ordinaryDigest&&!ordinary)throw Error("original ordinary boundary unavailable; no recovery");
@@ -202,6 +232,11 @@ export function openDashboardHost(options:DashboardHostOptions){
             }else throw Error("unsupported dashboard operation");
           }
         }catch(error){presenter?.close();presentationRevision=null;append({type:"result",requestId:request.requestId,state:"failed-or-unknown",reason:String(error)});throw error;}
+        if(["dispatch","dispatch-reconcile","intent","intent-reconcile"].includes(request.operation)&&result&&typeof result==="object"){
+          const snapshot=result as {records?:{requestId?:string;request?:{requestId:string};application?:string}[]},nativeId=(request.payload as {requestId:string}).requestId;
+          const applied=snapshot.records?.find(r=>(r.requestId??r.request?.requestId)===nativeId);
+          if(applied?.application)result={...result,application:applied.application,nativeRequestId:nativeId};
+        }
         append({type:"result",requestId:request.requestId,state:"acknowledged",resultDigest:dataDigest(result??null)});releaseOrdinary?.();return {state:"acknowledged",result};
       }catch(error){if(attempted){poisoned=true;try{if(history().some(e=>e.value.type==="claim"&&e.value.requestId===request.requestId))append({type:"host-failure",requestId:request.requestId,reason:String(error)});}catch{/* Failure recording also unacknowledged; no claim of no effects. */}}throw error;}finally{busy=false;}
     }

package/src/dashboard-menu.ts

@@ -0,0 +1,28 @@
+import type { PanelAction } from "./daily-panel.ts";
+/** Numbers never acquire another meaning during repaint, including after a new journal tip. */
+export function createDashboardMenu() {
+  const ids = new Map<string, string>();
+  const choices = new Map<string, { key: string; tip: string; requestDigest: string; label: string }>();
+  let current = new Set<string>();
+  return {
+    show(tip: string, actions: readonly PanelAction[]) {
+      current = new Set();
+      return actions.map(action => {
+        if (!action.requestDigest) return { choice: action.key, label: action.label };
+        const identity = JSON.stringify([tip, action.key, action.requestDigest, action.label]);
+        let choice = ids.get(identity);
+        if (!choice) {
+          if (ids.size >= 32768) throw Error("Action menu capacity reached; reopen the panel. No choice was remapped.");
+          choice = String(ids.size + 1); ids.set(identity, choice);
+          choices.set(choice, { key: action.key, tip, requestDigest: action.requestDigest, label: action.label });
+        }
+        current.add(choice); return { choice, label: action.label };
+      });
+    },
+    select(choice: string) {
+      if (!current.has(choice)) throw Error("That action is no longer displayed; select a current number.");
+      return choices.get(choice)!;
+    },
+    clear() { current.clear(); },
+  };
+}

package/src/index.ts

@@ -45,7 +45,8 @@ export { renderDebrief, debriefAction as dashboardDebriefAction } from "./debrie
 export { type ReviewPort, type ReviewRequest, type BlindPort, type BlindChoice } from "./debrief-contract.ts";
 export { readDailyView, createDailyViewReader, DAILY_VIEW_VERSION, type DailyView, type DailyViewOptions,
   type DailyAttempt, type DailyObligation } from "./daily-view.ts";
-export { renderDailyView } from "./daily-view-render.ts";
+export { renderDailyView, renderDailyDetails } from "./daily-view-render.ts";
+export { renderDailyPanel, type PanelOptions, type WorkPresentation } from "./daily-panel.ts";
 export { parseArchiveProjection, ARCHIVE_PROJECTION_VERSION } from "./daily-view-input.ts";
 export { bindWorkIntent } from "./intent-application.ts";
 export { intentRequestDigest, parseIntentRequest, type IntentRequest, type IntentSelection, type IntentPriority,
@@ -154,6 +155,11 @@ export {
 } from "./dashboard-projection.ts";
 
 export { renderDashboard, type DashboardRenderOptions } from "./dashboard-render.ts";
+export { declareWork, loadDeclaredWork, type DeclaredWorkState } from "./work-command.ts";
+export { workSetup, recordWorkSetup, selectRecordedWork, loadWorkSetup, listWorkSetups, workPresentation, type WorkSetup, type WorkTaskSetup, type RecordedWorkSetup } from "./work-setup.ts";
+export { runWorkSetup, inspectWorkRun, type WorkRunResult, type WorkRunInitial, type WorkPolicyPin } from "./work-run.ts";
+export { workPolicy, workPolicyDigest, policyForSetup, createWorkPolicyRegistry, openWorkPolicyRegistry, workPolicyActivationDigest, type WorkPolicy, type WorkPolicyRegistry, type WorkPolicyActivation } from "./work-policy-registry.ts";
+export { learningHarness, bindLearningConnection, loadLearningConnection, bindLearningAdoption, learningScopeDigest, type LearningConnection, type LearningWorkspace } from "./learning-connection.ts";
 
 export {
   runMeasuredAgentSession,

package/src/learning-connection.ts

@@ -0,0 +1,70 @@
+import { join, resolve } from "node:path";
+import { intentKey } from "./intent-control.ts";
+import { loadDeclaredWork, type DeclaredWorkState } from "./work-command.ts";
+import { readProductJson, writeProductJson } from "./product-files.ts";
+import { loadedDashboardHarnessDigest } from "./dashboard-harness.ts";
+import type { DashboardHarness } from "./dashboard-host-contract.ts";
+import { buildAdoptionBinding, type AdoptionAuthority, type AdoptionBinding, type AdoptionFacts, type AdoptionReceipt, type RollbackRequest, type ProductionObservation } from "./vendor/adoption.ts";
+
+export interface LearningConfiguration { archiveRoot: string; scopeDigest: string; population: string; author: string }
+export interface LearningUI { select(title: string, choices: string[]): Promise<string | undefined>; input(title: string, initial?: string): Promise<string | undefined>; editor(title: string, text: string): Promise<string | undefined>; confirm(title: string, detail: string): Promise<boolean>; notify(text: string, level?: "info" | "warning" | "error"): void }
+export interface LearningComparisonContext { caseReference: unknown | null; hypothesisManifestId: string | null; adoptionBinding: AdoptionBinding | null }
+export interface LearningWorkspace {
+  configuration(): LearningConfiguration;
+  inspect(now: number): { version: string; configuration: LearningConfiguration; cases: { name: string; title: string; state?: string; reason?: string }[]; comparisons: { name: string; title: string; state?: string; reason?: string }[]; trust: Record<string, unknown>; [key: string]: unknown };
+  dashboardBinding(): { trustDirectory: string | null; trustPolicyId: string | null };
+  bindCases(input: { name: string; title: string; version: 2 | 3; batchId: string }): unknown;
+  comparisonContext(name: string): LearningComparisonContext;
+  linkComparisonContext(name:string, context:LearningComparisonContext):unknown;
+  hypotheses(): {name:string;manifestId:string;hypothesis:{id:string}}[];
+  decisionStatus(name:string):{current:{disposition:string}|null};
+  reveal(name:string):{manifestId:string;choice:{kind:string;labels:readonly string[]};arms:readonly {label:string;configuration:{configuration:string}}[]};
+  preparedAdoption(name: string): AdoptionReceipt | null;
+  previewObservation(name: string, input: ProductionObservation): { observation: ProductionObservation; classification: unknown; digest: string };
+  observe(name: string, input: ProductionObservation, authorized: readonly string[]): { manifestId: string };
+  prepareAdoption(name: string, authority: AdoptionAuthority | null, facts: AdoptionFacts, now: number): AdoptionReceipt;
+  linkActivation(name: string, manifest: string, independentlyAuthorized: readonly string[]): unknown;
+  previewRollback(name: string, reason: "operator-request" | "confirmed-escape", evidence: string[], expiresAt?: number): RollbackRequest;
+  prepareRollback(name: string, request: RollbackRequest, authority: AdoptionAuthority | null, now: number, current: { adoptionId: string; candidateDigest: string; scopeDigest: string }): unknown;
+  linkRollback(name: string, manifest: string, independentlyAuthorized: readonly string[]): unknown;
+}
+export interface LearningHarness extends DashboardHarness {
+  createLearningWorkspace(directory: string, input: LearningConfiguration): LearningWorkspace;
+  openLearningWorkspace(directory: string): LearningWorkspace;
+  runLearningWizard(input: { directory: string; cwd: string; ui: LearningUI }): Promise<unknown>;
+}
+export function learningHarness(harness: DashboardHarness): LearningHarness {
+  if (!loadedDashboardHarnessDigest(harness) || ["createLearningWorkspace", "openLearningWorkspace", "runLearningWizard"].some(key => typeof (harness as unknown as Record<string, unknown>)[key] !== "function")) throw Error("Learning services are unavailable in the loaded skill-harness. Load the compatible learning-workspace-v1 release and start a fresh Pi session (the existing immutable bridge survives /reload); no private adapter is needed.");
+  return harness as LearningHarness;
+}
+/** Author only the missing binding from validated public readback after a durable choice. No authority is generated. */
+export function bindLearningAdoption(workspace:LearningWorkspace,name:string,input:{candidateDigest:string;rollbackCandidateDigest:string;assessmentPolicyDigest:string;expiresAt:number}):AdoptionBinding {
+  const context=workspace.comparisonContext(name);
+  if(context.adoptionBinding)throw Error("Adoption proposal is already bound; it cannot be replaced");
+  if(!context.caseReference||!context.hypothesisManifestId)throw Error("Link the comparison's original confirmed case and hypothesis in Learning first");
+  const original=workspace.hypotheses().find(h=>h.manifestId===context.hypothesisManifestId);
+  if(!original||workspace.decisionStatus(name).current?.disposition!=="adopt")throw Error("Retained original hypothesis and explicit adopt intent required");
+  const reveal=workspace.reveal(name);
+  if(!["one","tie"].includes(reveal.choice.kind)||!reveal.arms.some(a=>reveal.choice.labels.includes(a.label)&&a.configuration.configuration===input.candidateDigest))throw Error("Candidate is not the exact configuration selected by the full-artifact quality choice");
+  const binding=buildAdoptionBinding({...input,hypothesisDigest:original.hypothesis.id,experimentDigest:reveal.manifestId,scopeDigest:workspace.configuration().scopeDigest,activationBoundary:"next-orders"});
+  workspace.linkComparisonContext(name,{...context,adoptionBinding:binding});return binding;
+}
+export interface LearningConnection { version: "producer-learning-connection-v1"; directory: string; configuration: LearningConfiguration; selection: DeclaredWorkState["selectedSnapshot"] }
+export const learningScopeDigest = (state: DeclaredWorkState) => state.selectedSnapshot.snapshot.digest;
+export async function bindLearningConnection(cwd: string, state: DeclaredWorkState, directory: string, harness: LearningHarness, author: string): Promise<LearningConnection> {
+  if (resolve(directory) !== directory) throw Error("absolute learning workspace directory required");
+  const current=await loadDeclaredWork(state.statePath);
+  if(intentKey(current?.selectedSnapshot??null)!==intentKey(state.selectedSnapshot))throw Error("selected work changed before learning connection; reopen Learning");
+  const configuration = harness.openLearningWorkspace(directory).configuration();
+  if (configuration.scopeDigest !== learningScopeDigest(state) || configuration.author !== author) throw Error("learning workspace belongs to another work scope or author; not rebound");
+  const connection: LearningConnection = { version: "producer-learning-connection-v1", directory, configuration, selection: state.selectedSnapshot };
+  await writeProductJson(join(resolve(cwd), ".pi", "learning-workspace.json"), connection, true); return connection;
+}
+export async function loadLearningConnection(cwd: string, state: DeclaredWorkState, harness: LearningHarness, author: string): Promise<{ connection: LearningConnection; workspace: LearningWorkspace } | null> {
+  const c = await readProductJson(join(resolve(cwd), ".pi", "learning-workspace.json")) as LearningConnection | null;
+  if (!c) return null;
+  if (Object.keys(c).sort().join() !== "configuration,directory,selection,version" || c.version !== "producer-learning-connection-v1" || typeof c.directory !== "string" || resolve(c.directory) !== c.directory || intentKey(c.selection) !== intentKey(state.selectedSnapshot)) throw Error("Learning connection is stale for selected work. Reconnect deliberately with /grants learning; no evidence was carried forward.");
+  const workspace = harness.openLearningWorkspace(c.directory), actual = workspace.configuration();
+  if (intentKey(actual) !== intentKey(c.configuration) || actual.scopeDigest !== learningScopeDigest(state) || actual.author !== author) throw Error("learning archive/population/scope/author mismatch");
+  return { connection: c, workspace };
+}

package/src/measured-order.ts

@@ -11,6 +11,11 @@ import { freezeWork } from "./work-ledger-json.ts";
 const ID=/^[a-zA-Z0-9:_-]{1,128}$/,HEX=/^[a-f0-9]{64}$/;
 const hash=(value:unknown)=>createHash("sha256").update(typeof value==="string"?value:intentKey(value)).digest("hex");
 const exact=(value:object,keys:string[])=>Object.keys(value).sort().join()===keys.sort().join();
+type JournalJson=null|boolean|number|string|JournalJson[]|{[key:string]:JournalJson};
+class JournalSerializationError extends Error {constructor(){super("invalid measured order journal value");this.name="JournalSerializationError";}}
+/** Result evidence is not work/intent input: provider money is finite decimal Number data, not an integer schema field. */
+function journalKey(value:unknown):string{try{const ancestors=new Set<object>();const copy=(v:unknown,depth:number):JournalJson=>{if(v===null||typeof v==="boolean"||typeof v==="string")return v;if(typeof v==="number"){if(Number.isFinite(v))return v;throw new JournalSerializationError();}if(!v||typeof v!=="object"||depth>16||ancestors.has(v))throw new JournalSerializationError();ancestors.add(v);let result:JournalJson;if(Array.isArray(v)){if(Object.getPrototypeOf(v)!==Array.prototype||v.length>256)throw new JournalSerializationError();const fields=Object.getOwnPropertyDescriptors(v);if(Reflect.ownKeys(fields).length!==v.length+1)throw new JournalSerializationError();result=[];for(let i=0;i<v.length;i++){const field=fields[String(i)];if(!field||!Object.hasOwn(field,"value")||!field.enumerable)throw new JournalSerializationError();result.push(copy(field.value,depth+1));}}else{if(Object.getPrototypeOf(v)!==Object.prototype&&Object.getPrototypeOf(v)!==null)throw new JournalSerializationError();const fields=Object.getOwnPropertyDescriptors(v),object:Record<string,JournalJson>=Object.create(null);for(const key of Reflect.ownKeys(fields)){if(typeof key!=="string")throw new JournalSerializationError();const field=fields[key];if(!Object.hasOwn(field,"value")||!field.enumerable)throw new JournalSerializationError();Object.defineProperty(object,key,{value:copy(field.value,depth+1),enumerable:true});}result=object;}ancestors.delete(v);return result;},emit=(v:JournalJson):string=>v===null||typeof v!=="object"?JSON.stringify(v):Array.isArray(v)?`[${v.map(emit).join(",")}]`:`{${Object.keys(v).sort().map(key=>`${JSON.stringify(key)}:${emit(v[key])}`).join(",")}}`;return emit(copy(value,1));}catch(error){if(error instanceof JournalSerializationError)throw error;throw new JournalSerializationError();}}
+const journalHash=(value:unknown)=>createHash("sha256").update(journalKey(value)).digest("hex");
 export type MeasuredOutputContract={version:"measured-output-exact-v1";expectedSha256:string}|{version:"measured-output-json-projection-v1";requiredKeys:string[];textFields:string[];arrayField:string;minItems:number;maxItems:number;itemRequiredFields:string[];projectionFields:string[];expectedProjectionSha256:string};
 export interface MeasuredOrderAttempt extends Omit<MeasuredSessionInput,"budget"|"attempt"|"signal">{attemptId:string;includeDependencies:boolean;qualification:MeasuredOutputContract}
 export interface MeasuredOrderNode {nodeId:string;dependencies:string[];attempts:MeasuredOrderAttempt[]}
@@ -49,8 +54,8 @@ export async function createMeasuredOrder(input:{directory:string;budget:Governe
 function checkedBinding(input:MeasuredOrderBinding):MeasuredOrderBinding{const b=JSON.parse(intentKey(input)) as MeasuredOrderBinding,identity={directory:b.directory,directoryDevice:b.directoryDevice,directoryInode:b.directoryInode,journalDevice:b.journalDevice,journalInode:b.journalInode};if(!exact(b,["version","directory","directoryDevice","directoryInode","journalDevice","journalInode","budget","order","digest"])||b.version!=="measured-order-binding-v1"||!isAbsolute(b.directory)||resolve(b.directory)!==b.directory||![b.directoryDevice,b.directoryInode,b.journalDevice,b.journalInode].every(x=>/^\d+$/.test(x))||b.digest!==hash({...identity,budgetDigest:resourceBindingDigest(b.budget),orderDigest:measuredOrderDigest(checkedOrder(b.order,b.budget))}))throw Error("invalid measured order binding");return b;}
 async function pinnedJournal(binding:MeasuredOrderBinding,writable=false){const path=paths(binding.directory).journal,handle=await open(path,(writable?constants.O_RDWR|constants.O_APPEND:constants.O_RDONLY)|constants.O_NOFOLLOW);try{const st=await handle.stat({bigint:true});if(!st.isFile()||st.nlink!==1n||(st.mode&0o077n)||String(st.dev)!==binding.journalDevice||String(st.ino)!==binding.journalInode)throw Error("measured order binding changed");return handle;}catch(error){await handle.close();throw error;}}
 async function linked(binding:MeasuredOrderBinding){const st=await lstat(paths(binding.directory).journal,{bigint:true});if(!st.isFile()||st.nlink!==1n||String(st.dev)!==binding.journalDevice||String(st.ino)!==binding.journalInode||(await realpath(paths(binding.directory).journal))!==paths(binding.directory).journal)throw Error("measured order binding changed");}
-function parseJournal(text:string):JournalEvent[]{if(text&&!text.endsWith("\n"))throw Error("incomplete measured order journal");const rows=text?text.trimEnd().split("\n").map(line=>{const row=JSON.parse(line) as JournalEvent;if(intentKey(row)!==line)throw Error("noncanonical measured order journal");return row;}):[];let prior:string|null=null;for(let i=0;i<rows.length;i++){const row=rows[i],copy={...row} as any,claimed=copy.digest;delete copy.digest;if(row.sequence!==i||row.previousDigest!==prior||claimed!==hash(copy))throw Error("invalid measured order journal");prior=claimed;}return rows;}
-async function appendJournal(binding:MeasuredOrderBinding,event:Omit<JournalEvent,"sequence"|"previousDigest"|"digest">){const path=paths(binding.directory).journal;return withFileLock(path,"measured order",async()=>{const handle=await pinnedJournal(binding,true);try{const rows=parseJournal(await handle.readFile("utf8")),base={...event,sequence:rows.length,previousDigest:rows.at(-1)?.digest??null} as any,record={...base,digest:hash(base)} as JournalEvent;await linked(binding);await handle.writeFile(intentKey(record)+"\n");await handle.sync();return record;}finally{await handle.close();}});}
+function parseJournal(text:string):JournalEvent[]{if(text&&!text.endsWith("\n"))throw Error("incomplete measured order journal");const rows=text?text.trimEnd().split("\n").map(line=>{const row=JSON.parse(line) as JournalEvent;if(journalKey(row)!==line)throw Error("noncanonical measured order journal");return row;}):[];let prior:string|null=null;for(let i=0;i<rows.length;i++){const row=rows[i],copy={...row} as any,claimed=copy.digest;delete copy.digest;if(row.sequence!==i||row.previousDigest!==prior||claimed!==journalHash(copy))throw Error("invalid measured order journal");prior=claimed;}return rows;}
+async function appendJournal(binding:MeasuredOrderBinding,event:Omit<JournalEvent,"sequence"|"previousDigest"|"digest">){const path=paths(binding.directory).journal;return withFileLock(path,"measured order",async()=>{const handle=await pinnedJournal(binding,true);try{const rows=parseJournal(await handle.readFile("utf8")),base={...event,sequence:rows.length,previousDigest:rows.at(-1)?.digest??null} as any,record={...base,digest:journalHash(base)} as JournalEvent;await linked(binding);await handle.writeFile(journalKey(record)+"\n");await handle.sync();return record;}finally{await handle.close();}});}
 function project(order:MeasuredOrder,events:JournalEvent[],currentOwner:string):MeasuredOrderNodeView[]{const rows=new Map<string,MeasuredOrderNodeView>();const evaluate=(node:MeasuredOrderNode):MeasuredOrderNodeView=>{const prior=rows.get(node.nodeId);if(prior)return prior;const row:MeasuredOrderNodeView={nodeId:node.nodeId,state:"exhausted",action:"none",attemptId:null,outputSha256:null,unknownClaim:null};if(node.dependencies.some(id=>evaluate(order.nodes.find(n=>n.nodeId===id)!).state!=="satisfied")){row.state="dependency-blocked";row.action="wait";rows.set(node.nodeId,row);return row;}
  for(const attempt of node.attempts){const claim=events.find(e=>e.type==="claim"&&e.attemptId===attempt.attemptId) as Extract<JournalEvent,{type:"claim"}>|undefined;if(!claim){row.state="eligible";row.action="dispatch";row.attemptId=attempt.attemptId;break;}const result=events.find(e=>e.type==="result"&&e.attemptId===attempt.attemptId) as Extract<JournalEvent,{type:"result"}>|undefined;const acknowledged=events.some(e=>e.type==="acknowledge-unknown"&&e.request.attemptId===attempt.attemptId&&e.request.claimDigest===claim.digest&&e.request.claimOwner===claim.owner);if(!result){if(claim.owner!==currentOwner){if(acknowledged)continue;row.state="unknown";row.action="acknowledge";row.unknownClaim={owner:claim.owner,digest:claim.digest};}else{row.state="running";row.action="wait";}row.attemptId=attempt.attemptId;break;}if(result.state==="unknown"){if(!acknowledged){row.state="unknown";row.action="acknowledge";row.attemptId=attempt.attemptId;row.unknownClaim={owner:claim.owner,digest:claim.digest};break;}continue;}if(result.state==="completed"){row.state="satisfied";row.outputSha256=result.outputSha256;row.attemptId=attempt.attemptId;break;}}
  rows.set(node.nodeId,row);return row;};return order.nodes.map(evaluate);}
@@ -62,6 +67,6 @@ export function openMeasuredOrder(input:MeasuredOrderBinding,hostAuthority:Measu
   if(!selected||!claim)return inspect();const node=binding.order.nodes.find(n=>n.attempts.some(a=>a.attemptId===selected!.attemptId))!,index=node.attempts.findIndex(a=>a.attemptId===selected!.attemptId),controller=new AbortController();let state:Extract<JournalEvent,{type:"result"}>["state"]="failed",result:unknown=null,outputSha256:string|null=null;
   try{const accounting=await openResourceBudget(binding.budget).inspect(),parent=[...node.attempts.slice(0,index)].reverse().find(a=>accounting.reservations.some(r=>r.attemptId===a.attemptId))??null,events=await read();let prompt=selected.prompt;if(selected.includeDependencies)for(const dependency of node.dependencies){const dependencyNode=binding.order.nodes.find(n=>n.nodeId===dependency)!,prior=dependencyNode.attempts.map(a=>events.find(e=>e.type==="result"&&e.attemptId===a.attemptId)).find((e):e is Extract<JournalEvent,{type:"result"}>=>e?.type==="result"&&e.state==="completed"),output=(prior?.result as {output?:unknown})?.output;if(!prior||typeof output!=="string"||hash(output)!==prior.outputSha256)throw Error("sealed dependency output unavailable");prompt+=`\n\n<sealed-dependency node=${JSON.stringify(dependency)} sha256=${JSON.stringify(prior.outputSha256)}>\n${output}\n</sealed-dependency>`;}
    result=await runMeasuredAgentSession({budget:binding.budget,attempt:{attemptId:selected.attemptId,orderId:binding.order.orderId,experimentId:`${binding.order.orderId}:${node.nodeId}`,kind:parent?"retry":"primary",parentAttemptId:parent?.attemptId??null},model:selected.model,thinkingLevel:selected.thinkingLevel,prompt,deadlineMs:selected.deadlineMs,terminationGraceMs:selected.terminationGraceMs,maxRetainedOutputBytes:selected.maxRetainedOutputBytes,maxOutputTokens:selected.maxOutputTokens,signal:controller.signal},host);const qualified=qualifyMeasuredOutput((result as {output:string}).output,selected.qualification);outputSha256=qualified.outputSha256;state=qualified.eligible?"completed":"mismatch";}catch(error){result=error instanceof MeasuredSessionFailure?error.evidence:{errorType:error instanceof Error?error.name:"unknown",errorCode:typeof error==="object"&&error&&"code" in error?String(error.code):null,message:error instanceof Error?error.message:"unknown"};state=error instanceof MeasuredSessionUnknownError?"unknown":error instanceof MeasuredSessionFailure&&(error.evidence as {state?:string})?.state==="cancelled"?"cancelled":"failed";}
-  await appendJournal(binding,{type:"result",attemptId:selected.attemptId,owner:claim.owner,state,outputSha256,result} as Omit<JournalEvent,"sequence"|"previousDigest"|"digest">);return inspect();},
+  let event={type:"result" as const,attemptId:selected.attemptId,owner:claim.owner,state,outputSha256,result} as Omit<JournalEvent,"sequence"|"previousDigest"|"digest">;try{journalKey(event);}catch(error){if(!(error instanceof JournalSerializationError))throw error;event={type:"result",attemptId:selected.attemptId,owner:claim.owner,state:"failed",outputSha256,result:{errorType:"JournalSerializationError",errorCode:"MEASURED_RESULT_SERIALIZATION_FAILED",message:"measured result could not be durably serialized"}} as Omit<JournalEvent,"sequence"|"previousDigest"|"digest">;journalKey(event);}await appendJournal(binding,event);return inspect();},
   async acknowledgeUnknown(request:MeasuredOrderAcknowledgement,authority:MeasuredOrderAuthority|null){const digest=measuredOrderAcknowledgementDigest(request);if(authority?.authorityDigest!==binding.order.authorityDigest||!authority.acknowledgementDigests.includes(digest)||request.bindingDigest!==binding.digest)throw Error("independent exact acknowledgement authority required");await read();await withFileLock(p.journal,"measured order acknowledgement",async()=>{const handle=await pinnedJournal(binding,true);try{const events=parseJournal(await handle.readFile("utf8")),claim=events.find(e=>e.type==="claim"&&e.attemptId===request.attemptId) as Extract<JournalEvent,{type:"claim"}>|undefined,result=events.find(e=>e.type==="result"&&e.attemptId===request.attemptId) as Extract<JournalEvent,{type:"result"}>|undefined;if(!claim||claim.owner!==request.claimOwner||claim.digest!==request.claimDigest||!(result?.state==="unknown"||!result&&claim.owner!==owner)||events.some(e=>e.type==="acknowledge-unknown"&&e.request.attemptId===request.attemptId))throw Error("exact current unknown claim required");const base={type:"acknowledge-unknown",sequence:events.length,previousDigest:events.at(-1)!.digest,request} as const,record={...base,digest:hash(base)};await linked(binding);await handle.writeFile(intentKey(record)+"\n");await handle.sync();}finally{await handle.close();}});return inspect();}});
 }

package/src/model-preflight.ts

@@ -2,6 +2,15 @@ import { refusal, type StructuredRefusal } from "./refusals.ts";
 
 export const ENV_ALLOW_UNRESOLVED_MODELS = "PI_GRANTS_ALLOW_UNRESOLVED_MODELS";
 
+/** Pi's resolved catalogue carries provider support in thinkingLevelMap. Never silently clamp a user's choice. */
+export function supportedModelEfforts(model: { reasoning: boolean; thinkingLevelMap?: Partial<Record<string, string | null>> }): ("off"|"minimal"|"low"|"medium"|"high"|"xhigh"|"max")[] {
+  if (!model.reasoning) return ["off"];
+  return (["off","minimal","low","medium","high","xhigh","max"] as const).filter(level => {
+    const mapped=model.thinkingLevelMap?.[level];
+    return mapped!==null && ((level!=="xhigh"&&level!=="max") || mapped!==undefined);
+  });
+}
+
 export interface ModelCatalogue {
   find(provider: string, modelId: string): unknown;
 }

package/src/product-files.ts

@@ -0,0 +1,34 @@
+import { lstat, mkdir, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { readDailySnapshot } from "./daily-view-input.ts";
+import { parseRetentionJson } from "./retention-json.ts";
+import { runWithFinalizers } from "./finalization.ts";
+
+export const privateDirectory = (path:string) => directory(path,true);
+/** Pi's shared resource directory may be searchable; retained text files/subdirectories remain owner-only. */
+export const projectProductDirectory = (path:string) => directory(path,false);
+async function directory(path: string, ownerOnly:boolean): Promise<void> {
+  if (resolve(path) !== path) throw Error("absolute canonical product directory required");
+  try { await mkdir(path, { mode: 0o700 }); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error; }
+  const state = await lstat(path);
+  if (!state.isDirectory() || state.isSymbolicLink() || state.mode & (ownerOnly?0o077:0o022) || state.uid !== process.getuid?.() || await realpath(path) !== path) throw Error(`owned non-writable${ownerOnly?" private":""} directory required: ${path}; existing permissions were not changed`);
+}
+export async function readProductJson(path: string, limit = 128 * 1024): Promise<unknown | null> {
+  try { const state = await lstat(path); if (!state.isFile() || state.isSymbolicLink() || state.mode & 0o077 || state.uid !== process.getuid?.() || state.nlink !== 1 || await realpath(path) !== path) throw Error(`private regular product file required: ${path}`); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return null; throw error; }
+  const snapshot = await readDailySnapshot(path, limit);
+  if (snapshot.status !== "read") throw Error(`product file unavailable: ${path}`);
+  const state = await lstat(path);
+  if (state.mode & 0o077 || state.uid !== process.getuid?.() || state.nlink !== 1 || await realpath(path) !== path) throw Error(`private regular product file required: ${path}`);
+  return parseRetentionJson(new TextDecoder("utf-8", { fatal: true }).decode(snapshot.bytes), limit);
+}
+export async function writeProductJson(path: string, value: unknown, replace = false): Promise<void> {
+  await (basename(dirname(path))===".pi"?projectProductDirectory:privateDirectory)(dirname(path));
+  const text = JSON.stringify(value, null, 2) + "\n";
+  if (Buffer.byteLength(text) > 128 * 1024) throw Error("product file bound exceeded");
+  if (!replace) { await writeFile(path, text, { mode: 0o600, flag: "wx" }); return; }
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  await runWithFinalizers(async()=>{await writeFile(temporary, text, { mode: 0o600, flag: "wx" }); await rename(temporary, path);},[{label:"product temporary cleanup",run:async()=>{await rm(temporary,{force:true});}}]);
+}