pi-daddy 0.28.0 → 0.32.1

package/extensions/execution-occurrence.ts

@@ -1,5 +1,5 @@
-import { newExecutionId } from "../src/execution-id.ts";
-import { childSpawnId } from "../src/fanout.ts";
+import { newExecutionId } from "../src/kernel/execution-id.ts";
+import { childSpawnId } from "../src/kernel/fanout.ts";
 import type { GrantsSession } from "./session.ts";
 
 /** Readable logical position plus the unique identity used for every lifecycle join. */

package/extensions/executor-session.ts

@@ -1,9 +1,9 @@
-import { chooseExecutor, needsProbe, ENV_HERDR } from "../src/executor.ts";
-import { probeHerdr } from "../src/herdr-cli.ts";
+import { chooseExecutor, needsProbe, ENV_HERDR } from "../src/executors/executor.ts";
+import { probeHerdr } from "../src/executors/herdr-cli.ts";
 import type { GrantsSession } from "./session.ts";
 
 /** Settle one executor at session start; a later daemon change never relocates siblings. */
-export async function resolveExecutor(session:GrantsSession):Promise<void>{
- const raw=process.env[ENV_HERDR];
- session.executor=chooseExecutor(raw,needsProbe(raw)?await probeHerdr():null);
+export async function resolveExecutor(session: GrantsSession): Promise<void> {
+  const raw = process.env[ENV_HERDR];
+  session.executor = chooseExecutor(raw, needsProbe(raw) ? await probeHerdr() : null);
 }

package/extensions/fanout-outcome.ts

@@ -7,7 +7,7 @@
  * shape — a fix applied where it was found and not where it was duplicated — so the aggregation is now one
  * testable place rather than four inline blocks.
  */
-import { GovernanceRefusal, refusal } from "../src/refusals.ts";
+import { GovernanceRefusal, refusal } from "../src/kernel/refusals.ts";
 import { isCriticalAssuranceBlock, type DelegationOutcome } from "./execute-child.ts";
 
 /**
@@ -73,7 +73,7 @@ export function throwFanoutInfrastructure(
     throw new AggregateError(
       infrastructureErrors,
       `fan-out hit ${infrastructureErrors.length} infrastructure failures: ` +
-      infrastructureErrors.map((error) => String(error instanceof Error ? error.message : error)).join("; "),
+        infrastructureErrors.map((error) => String(error instanceof Error ? error.message : error)).join("; "),
     );
   }
 }
@@ -90,8 +90,10 @@ export function totalFanoutFailure(failed: readonly DelegationOutcome[], message
   if (codes.length === 1 && failed.every((outcome) => outcome.refusal)) {
     return new GovernanceRefusal(refusal(codes[0], message, { failed: failed.length }));
   }
-  return new GovernanceRefusal(refusal(
-    "FANOUT_FAILED", message,
-    { failed: failed.length, codes: codes.length > 0 ? codes.sort().join(",") : "none" },
-  ));
+  return new GovernanceRefusal(
+    refusal("FANOUT_FAILED", message, {
+      failed: failed.length,
+      codes: codes.length > 0 ? codes.sort().join(",") : "none",
+    }),
+  );
 }

package/extensions/grant-store-refusal.ts

@@ -1,8 +1,8 @@
-import { digestTask } from "../src/correlation.ts";
-import { newExecutionId } from "../src/execution-id.ts";
-import { appendRecord, buildRecord } from "../src/ledger.ts";
-import { WILDCARD } from "../src/pi-tools.ts";
-import { refusal } from "../src/refusals.ts";
+import { digestTask } from "../src/kernel/correlation.ts";
+import { newExecutionId } from "../src/kernel/execution-id.ts";
+import { appendRecord, buildRecord } from "../src/governance/ledger.ts";
+import { WILDCARD } from "../src/kernel/pi-tools.ts";
+import { refusal } from "../src/kernel/refusals.ts";
 import type { GrantsSession } from "./session.ts";
 
 interface RefusalUI {
@@ -13,7 +13,8 @@ interface RefusalUI {
 export async function reportGrantStoreRefusal(session: GrantsSession, ui: RefusalUI): Promise<void> {
   if (!session.grantStoreRefusal) return;
   const { reason, path } = session.grantStoreRefusal;
-  const message = `grants: stored grant ${path} is ${reason}; this session is refused with an empty grant. ` +
+  const message =
+    `grants: stored grant ${path} is ${reason}; this session is refused with an empty grant. ` +
     `Repair or remove the store, then restart pi.`;
   ui.notify(message, "error");
   if (!session.ledgerPath) return;
@@ -21,16 +22,27 @@ export async function reportGrantStoreRefusal(session: GrantsSession, ui: Refusa
     await appendRecord(
       { path: session.ledgerPath, strict: true },
       buildRecord({
-        executionId: newExecutionId(), parentExecutionId: null,
-        parentId: session.ownSpawnId, childId: `grant-store@${session.ownSpawnId}`,
-        depth: session.depth, agentType: "grant-store", requested: [WILDCARD], parentGrant: [],
+        executionId: newExecutionId(),
+        parentExecutionId: null,
+        parentId: session.ownSpawnId,
+        childId: `grant-store@${session.ownSpawnId}`,
+        depth: session.depth,
+        agentType: "grant-store",
+        requested: [WILDCARD],
+        parentGrant: [],
         result: { effective: [], denied: [WILDCARD], clipped: [], gatedBlocked: [], universal: [], subsumedBy: [] },
-        blocked: true, reason: message,
+        blocked: true,
+        reason: message,
         refusal: refusal("GRANT_STORE_INVALID", message, { reason }),
-        executor: session.executor.kind, taskDigest: digestTask("grant-store-load"), now: new Date(),
+        executor: session.executor.kind,
+        taskDigest: digestTask("grant-store-load"),
+        now: new Date(),
       }),
     );
   } catch (error) {
-    ui.notify(`grants: the stored-grant refusal could not be ledgered (${String(error)}); the session remains refused.`, "error");
+    ui.notify(
+      `grants: the stored-grant refusal could not be ledgered (${String(error)}); the session remains refused.`,
+      "error",
+    );
   }
 }

package/extensions/grants-command.ts

@@ -12,15 +12,14 @@
  * being whatever happened to be in scope.
  */
 
-import type { Capability } from "../src/resolve.ts";
-import type { ExecutorChoice } from "../src/executor.ts";
-import type { Catalog } from "../src/catalog.ts";
-import type { SkillDefinition } from "../src/definitions.ts";
+import type { Capability } from "../src/kernel/resolve.ts";
+import type { ExecutorChoice } from "../src/executors/executor.ts";
+import type { Catalog } from "../src/kernel/catalog.ts";
+import type { SkillDefinition } from "../src/kernel/definitions.ts";
 import type { GatedPlan } from "./run-delegation.ts";
-import type { VariantRunAccounting } from "./session.ts";
 import { handleConnectedCommand } from "./grants-connected-command.ts";
-import { loadApprovals, revokeAll, revokeApproval, type SubjectLookup } from "../src/approval-store.ts";
-import { verifyLedger } from "../src/ledger.ts";
+import { loadApprovals, revokeAll, revokeApproval, type SubjectLookup } from "../src/governance/approval-store.ts";
+import { verifyLedger } from "../src/governance/ledger.ts";
 
 export interface GrantsCommandContext {
   cwd: string;
@@ -63,10 +62,10 @@ export interface GrantsCommandContext {
    */
   runInit: () => Promise<void>;
   /** Open or reuse the read-only Herdr dashboard; injected so this diagnostic never becomes enforcement. */
-  openDashboard: () => Promise<{ kind: "opened" | "reused"; paneId: string; visibleBesideCaller: boolean } | { kind: "fallback"; frame: string; visibleBesideCaller: false }>;
-  /** Explicit same-process production host lifecycle; owns no model call and never cancels a child on stop. */
-  runHost: (target: string) => Promise<string>;
-  variantRuns: Map<string, VariantRunAccounting>;
+  openDashboard: () => Promise<
+    | { kind: "opened" | "reused"; paneId: string; visibleBesideCaller: boolean }
+    | { kind: "fallback"; frame: string; visibleBesideCaller: false }
+  >;
 }
 
 /**
@@ -76,18 +75,30 @@ export interface GrantsCommandContext {
 const PREVIEW_LIMIT = 12;
 
 /** The verbs `/grants` answers to. Anything else is refused rather than silently treated as no verb. */
-const KNOWN_SUBCOMMANDS: readonly string[] = ["work", "learning", "init", "host", "variants", "dashboard", "ledger", "approvals", "revoke"];
+const KNOWN_SUBCOMMANDS: readonly string[] = ["init", "dashboard", "ledger", "approvals", "revoke"];
 
 export const grantsCommand = {
   description:
     "Show this session's capability grant, delegation depth, and known agent-type ceilings; " +
-    "/grants work (setup/run/results) | /grants learning | /grants host [fresh-id]|stop | /grants dashboard | /grants approvals | /grants ledger",
-handler: async (args: string, ctx: any) => {
+    "/grants init | /grants dashboard | /grants approvals | /grants revoke | /grants ledger",
+  handler: async (args: string, ctx: any) => {
     // Everything this command may see, named in one place. Previously these were whatever happened to be in
     // the enclosing closure — which is how a diagnostic came to disagree with the enforcer (R-28).
     const {
-      cwd, governed, ownGrant, executor, observed, depth, maxDepth, ledgerPath,
-      catalog, definitions, sessionApprovals, inheritedApprovals, snapshotOf, previewDelegation, variantRuns,
+      cwd,
+      governed,
+      ownGrant,
+      executor,
+      observed,
+      depth,
+      maxDepth,
+      ledgerPath,
+      catalog,
+      definitions,
+      sessionApprovals,
+      inheritedApprovals,
+      snapshotOf,
+      previewDelegation,
     } = ctx.grants as GrantsCommandContext;
 
     const [sub, target] = args.trim().split(/\s+/).filter(Boolean);
@@ -97,22 +108,20 @@ handler: async (args: string, ctx: any) => {
       return;
     }
 
-    if(await handleConnectedCommand(sub,target,{runHost:ctx.grants.runHost,openDashboard:ctx.grants.openDashboard,ui:ctx.ui}))return;
-
-    if (sub === "variants") {
-      const lines=[`grants: ${variantRuns.size} retained primary/shadow run(s)`];
-      for(const run of variantRuns.values())lines.push(`  ${run.runId} ${run.state} — primary ${run.primaryExecutionId}; ${run.shadowExecutionIds.length} shadow(s)`+(!run.outcomes?"":` — ${run.outcomes.map(x=>`${x.role}:${x.ok?"completed":"failed"}`).join(", ")}`));
-      lines.push("  provider usage unavailable on the default child print transport; fan-out, output bytes and wall time remain controller-bounded");
-      lines.push("  opt-in measured no-tool sessions can retain Pi Usage for exact Sol/Terra attempts; this is not ordinary-child or subscription-billing coverage");
-      ctx.ui.notify(lines.join("\n"),"info");return;
-    }
+    if (
+      await handleConnectedCommand(sub, target, {
+        openDashboard: ctx.grants.openDashboard,
+        ui: ctx.ui,
+      })
+    )
+      return;
 
     if (sub === "ledger") {
       // The detector, made reachable. `verifyLedger` exists because nothing in this package had ever read
       // a ledger back, so a torn line was indistinguishable from a spawn that never happened — and a
       // check an operator cannot run is not a control.
       if (!ledgerPath) {
-        ctx.ui.notify("grants: no ledger — set PI_GRANTS_LEDGER to record grants and refusals.", "warning");
+        ctx.ui.notify("grants: no ledger — set PI_DADDY_LEDGER to record grants and refusals.", "warning");
         return;
       }
       const report = await verifyLedger(ledgerPath);
@@ -128,7 +137,7 @@ handler: async (args: string, ctx: any) => {
       ];
       for (const bad of report.corrupt.slice(0, 5)) lines.push(`    line ${bad.line}: ${bad.reason}`);
       // ADR-0031, and R-51's lesson applied on the day the field was added rather than a release later: a field
-      // the writer sets and no diagnostic reads is one that needs `jq`, and `docs/SPEC.md` claims the executor is
+      // the writer sets and no diagnostic reads is one that needs `jq`, and the README claims the executor is
       // announced "per child in the ledger". `unknown` is shown only when present, because on a fresh ledger it
       // is always zero and a permanent zero is noise; on an upgraded one it is the count of pre-0.16 lines, which
       // is worth seeing.
@@ -138,9 +147,8 @@ handler: async (args: string, ctx: any) => {
             ? ` · ${report.executors.unknown} not recorded (written before 0.16.0, which added the field)`
             : ""),
       );
-      if (report.workflowFacts > 0) {
-        lines.push(`  workflow   ${report.workflowFacts} provenance-labelled fact(s) — not counted as enforced children`);
-      }
+      if (report.retired > 0)
+        lines.push(`  retired    ${report.retired} event(s) of a kind written by an earlier version; valid history`);
       // R-51. ADR-0018 advertises that the ledger answers "did these four children run the same
       // instructions?" and "has this definition changed since?" — and nothing read `definitionDigest`, so
       // both needed hand-written jq and the second was not reproducible with `sha256sum` (the digest covers
@@ -152,7 +160,7 @@ handler: async (args: string, ctx: any) => {
           const here = definitions.get(d.name);
           const current = snapshotOf(d.name);
           // F4: compare the SOURCE too. A ledger path exported once in a shell profile is shared by every
-          // project — nothing scopes `PI_GRANTS_LEDGER` per project — so two different `deploy` definitions
+          // project — nothing scopes `PI_DADDY_LEDGER` per project — so two different `deploy` definitions
           // in two checkouts were reported as one definition that had CHANGED, and the NOTE below called it
           // a finding. `verifyLedger` has carried `source` all along; the listing simply never read it.
           const state =
@@ -262,7 +270,7 @@ handler: async (args: string, ctx: any) => {
       // (a deliberate simplification so it need not extend EntryVerdict); relabel those here so a
       // corrupt entry doesn't read as a timed-out one.
       //
-      // This mirrors `isValidEntryShape` in `src/approval-store.ts` (all four required fields) and
+      // This mirrors `isValidEntryShape` in `src/governance/approval-store.ts` (all four required fields) and
       // must be kept in step with it — it is a display-only relabeling of an entry the store already
       // dropped, not a second validity decision, so it stays here rather than moving into `src/`.
       for (const d of dropped) {
@@ -337,7 +345,7 @@ handler: async (args: string, ctx: any) => {
 
     const { valid } = await loadApprovals({ cwd, now: new Date(), snapshotOf });
     const lines = [
-      governed ? "grants: ACTIVE" : "grants: inactive (set PI_GRANTS_GRANT to govern this session)",
+      governed ? "grants: ACTIVE" : "grants: inactive (set PI_DADDY_GRANT to govern this session)",
       `  holding    ${ownGrant.join(", ") || "(nothing)"}${observed ? " (observed)" : " (inherited, not yet observed)"}`,
       // ADR-0031/0032. This screen named the grant, the depth, the ledger, the approvals and the catalog, and
       // never said WHERE children run — so an operator on a machine where herdr hosts their whole workspace
@@ -346,7 +354,7 @@ handler: async (args: string, ctx: any) => {
       // two facts about what a spawn will be sit together.
       `  executor   ${executor.disclosure}`,
       `  depth      ${depth} of max ${maxDepth}${maxDepth <= 0 ? " (spawning disabled)" : ""}`,
-      `  ledger     ${ledgerPath || "(not recording — set PI_GRANTS_LEDGER)"}`,
+      `  ledger     ${ledgerPath || "(not recording — set PI_DADDY_LEDGER)"}`,
       `  approvals  ${sessionApprovals.size} this session, ${valid.size} persisted` +
         `${inheritedApprovals.size > 0 ? `, ${inheritedApprovals.size} inherited` : ""}` +
         ` — /grants approvals`,

package/extensions/grants-connected-command.ts

@@ -1,19 +1,33 @@
 export interface GrantsConnectedCommandContext {
- runHost:(target:string)=>Promise<string>;
- openDashboard:()=>Promise<{kind:"opened"|"reused";paneId:string;visibleBesideCaller:boolean}|{kind:"fallback";frame:string;visibleBesideCaller:false}>;
- ui:{notify(message:string,level:"info"|"error"):void};
+  openDashboard: () => Promise<
+    | { kind: "opened" | "reused"; paneId: string; visibleBesideCaller: boolean }
+    | { kind: "fallback"; frame: string; visibleBesideCaller: false }
+  >;
+  ui: { notify(message: string, level: "info" | "error"): void };
 }
 /** Host lifecycle and pane placement live together; neither belongs in the capability-report renderer. */
-export async function handleConnectedCommand(sub:string|undefined,target:string|undefined,ctx:GrantsConnectedCommandContext):Promise<boolean>{
- if(sub==="host"){
-  try{ctx.ui.notify(`grants: ${await ctx.runHost(target??"")}`,"info");}
-  catch(error){ctx.ui.notify(`grants: host unavailable — ${error instanceof Error?error.message:String(error)}`,"error");}
-  return true;
- }
- if(sub==="dashboard"){
-  try{const opened=await ctx.openDashboard();ctx.ui.notify(opened.kind==="fallback"?opened.frame:`grants: dashboard ${opened.kind} in Herdr pane ${opened.paneId} without changing focus`+(opened.visibleBesideCaller?".":" (the existing pane is in another tab)."),"info");}
-  catch(error){ctx.ui.notify(`grants: dashboard unavailable — ${error instanceof Error?error.message:String(error)}`,"error");}
-  return true;
- }
- return false;
+export async function handleConnectedCommand(
+  sub: string | undefined,
+  target: string | undefined,
+  ctx: GrantsConnectedCommandContext,
+): Promise<boolean> {
+  if (sub === "dashboard") {
+    try {
+      const opened = await ctx.openDashboard();
+      ctx.ui.notify(
+        opened.kind === "fallback"
+          ? opened.frame
+          : `grants: dashboard ${opened.kind} in Herdr pane ${opened.paneId} without changing focus` +
+              (opened.visibleBesideCaller ? "." : " (the existing pane is in another tab)."),
+        "info",
+      );
+    } catch (error) {
+      ctx.ui.notify(
+        `grants: dashboard unavailable — ${error instanceof Error ? error.message : String(error)}`,
+        "error",
+      );
+    }
+    return true;
+  }
+  return false;
 }

package/extensions/grants.ts

@@ -11,7 +11,7 @@
  * four were defects of *scope*: a value that was whatever happened to be in the closure at one call site.
  * Each module now takes the session as an argument, so what it can see is written down.
  *
- * Propagation is race-free by construction — see `../src/propagation.ts`. Nothing per-child is pushed:
+ * Propagation is race-free by construction — see `src/kernel/propagation.ts`. Nothing per-child is pushed:
  * the environment carries only parent-level facts (identical for every sibling), never a value computed
  * for one specific spawn. It is published at session start, and republished whenever this session's own
  * approvals change (a human approves something new for the session) — never per spawn, never keyed to a
@@ -24,13 +24,12 @@ import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { WILDCARD } from "../src/pi-tools.ts";
-import { buildCatalog } from "../src/catalog.ts";
-import { ENV_WORKSPACE_REGISTRY } from "../src/workspace.ts";
-import { appendRecord, buildRecord } from "../src/ledger.ts";
-import { openPaneCount, reapOpenPanesAsync } from "../src/pane-reaper.ts";
-import {
-  ENV_GRANT, deriveOwnGrant, observeToolNames } from "../src/propagation.ts";
+import { WILDCARD } from "../src/kernel/pi-tools.ts";
+import { buildCatalog } from "../src/kernel/catalog.ts";
+import { ENV_WORKSPACE_REGISTRY } from "../src/kernel/workspace.ts";
+import { appendRecord, buildRecord } from "../src/governance/ledger.ts";
+import { openPaneCount, reapOpenPanesAsync } from "../src/executors/pane-reaper.ts";
+import { ENV_GRANT, deriveOwnGrant, observeToolNames } from "../src/kernel/propagation.ts";
 import { snapshotOf } from "./approvals.ts";
 import { registerDelegationTools } from "./delegation.ts";
 import { grantsCommand } from "./grants-command.ts";
@@ -43,15 +42,17 @@ import { resolveExecutor } from "./executor-session.ts";
 import { reportSessionStart } from "./session-report.ts";
 import { SPAWN_TOOLS, tripwireReason } from "./tripwire.ts";
 import { reportGrantStoreRefusal } from "./grant-store-refusal.ts";
-import { defaultDashboardPaths, offerDashboardHandshake, openDashboardCommand } from "../src/dashboard-handshake.ts";
-import { associateOrdinaryHost, ordinaryChildrenFor } from "../src/ordinary-children.ts";
-import { loadDeclaredWork } from "../src/work-command.ts";
-import { createDailyDashboardSession } from "./daily-dashboard-session.ts";
-import { createWorkSession } from "./work-session.ts";
-import { createLearningSession } from "./learning-session.ts";
-import { replacePublishedDailyWork, type PublishedDailyWork } from "./daily-work-session.ts";
-import { defaultActivityTimelinePath } from "../src/activity-timeline.ts";
+import {
+  defaultDashboardPaths,
+  offerDashboardHandshake,
+  openDashboardCommand,
+} from "../src/products/dashboard-handshake.ts";
+import { defaultActivityTimelinePath } from "../src/products/activity-timeline.ts";
 import { registerActivityTimeline } from "./activity-timeline.ts";
+import { legacyEnvironmentWarning } from "../src/kernel/env-names.ts";
+import { agentDir } from "../src/kernel/project-paths.ts";
+import { importLegacyLedger } from "../src/governance/ledger.ts";
+import { legacyProjectLedgerPath, projectLedgerPath } from "../src/kernel/project-paths.ts";
 export default function (pi: ExtensionAPI) {
   // The path pi loads as the extension, so a child granted `tool:delegate` can be started with `-e <this>`.
   const extensionPath = (() => {
@@ -63,20 +64,15 @@ export default function (pi: ExtensionAPI) {
   })();
   const observerExtensionPath = fileURLToPath(new URL("./activity-timeline.ts", import.meta.url));
   const session = createGrantsSession(extensionPath, undefined, observerExtensionPath);
-  associateOrdinaryHost(pi,session);
   registerActivityTimeline(pi, session);
-  const dailyHost=createDailyDashboardSession({ordinary:()=>ordinaryChildrenFor(pi),declared:()=>session.declaredWork,rebind:state=>{session.declaredWork=state;},cwd:()=>session.cwd,env:process.env,author:"local-operator"});
   const dashboardPluginRoot = fileURLToPath(new URL("../herdr-plugin/", import.meta.url));
-  const dashboardPaths = defaultDashboardPaths(
-    process.env.PI_CODING_AGENT_DIR?.trim() || join(homedir(), ".pi", "agent"),
-  );
+  const dashboardPaths = defaultDashboardPaths(agentDir());
   // Definitions are registered only after owner-bound session_start. Until then there is no delegation
   // dispatch surface; afterwards this callback refreshes their model-facing spawnable-definition text.
   const delegation = { refreshSpawnable: () => {} };
-  const publishedDailyWork: PublishedDailyWork = {};
-  const workSession=createWorkSession(session,dailyHost,()=>replacePublishedDailyWork(process.env,publishedDailyWork,session.declaredWork));
-  const learningSession=createLearningSession(dailyHost);
   pi.on("session_start", async (_event, ctx) => {
+    if (session.adoptedLegacyEnv.length > 0)
+      ctx.ui.notify(legacyEnvironmentWarning(session.adoptedLegacyEnv), "warning");
     // Real SDK contexts always supply SessionManager. The fallback keeps lightweight wiring fixtures
     // isolated; it cannot carry state into another extension instance.
     const owner = (ctx as { sessionManager?: object }).sessionManager ?? session;
@@ -91,40 +87,51 @@ export default function (pi: ExtensionAPI) {
     // this absolute identity verbatim, and resolve(abs) remains abs at every deeper session start.
     if (session.ledgerPath) session.ledgerPath = resolve(ctx.cwd, session.ledgerPath);
     try {
-      try {
-        replacePublishedDailyWork(process.env, publishedDailyWork, undefined);
-        session.declaredWork = (await loadDeclaredWork(join(ctx.cwd, ".pi", "work-current.json"))) ?? undefined;
-        replacePublishedDailyWork(process.env, publishedDailyWork, session.declaredWork);
-      } catch (error) {
-        session.declaredWork = undefined;
+      // ADR-0076 PR 3d: a pre-format project ledger is imported once into the record envelope, bodies verbatim, each
+      // record marked with its source line; the old file is left untouched. Happens before any spawn can append.
+      if (session.governed) {
+        // R-60: its own try — a failed import must not take session start down; it is reported and governance
+        // continues against the new ledger path (an append there still fails closed if that path is unwritable).
+        try {
+          const imported = await importLegacyLedger(legacyProjectLedgerPath(ctx.cwd), projectLedgerPath(ctx.cwd));
+          if (imported.imported > 0 || imported.stoppedAt !== null)
+            ctx.ui.notify(
+              `grants: imported ${imported.imported} record(s) from ${legacyProjectLedgerPath(ctx.cwd)} into ${projectLedgerPath(ctx.cwd)}` +
+                (imported.stoppedAt !== null
+                  ? `; stopped at unparsable source line ${imported.stoppedAt} (kept)`
+                  : "") +
+                "; the old file is untouched.",
+              imported.stoppedAt !== null ? "warning" : "info",
+            );
+        } catch (error) {
+          ctx.ui.notify(`grants: legacy ledger import failed: ${String(error)}`, "error");
+        }
+      }
+      // The one case the stored-grant lookup can get wrong (ADR-0030). The factory reads the store keyed by
+      // `process.cwd()` because it runs before any hook and therefore before `ctx` exists — and S-5 forces
+      // that ordering, since whether `delegate` is registered is decided there. Almost always the two agree.
+      // When they do not, the session is governed by a different directory's decision than the one it is
+      // working in, which is exactly the confusion a grant must never cause, so it is said out loud rather
+      // than left to be inferred from a surprising refusal. Sync, so it is not the R-60 shape.
+      // Inside no try of its own, and that is deliberate: it is synchronous, so it cannot be the R-60 shape. A
+      // reviewer noted it sits before the try that contains `resolveExecutor` — which is the right order, because
+      // this warning is about WHICH directory's grant was read and must reach the operator even if everything
+      // after it fails.
+      if (session.storeCwd !== ctx.cwd && process.env[ENV_GRANT] === undefined) {
         ctx.ui.notify(
-          `grants: declared work is invalid (${error instanceof Error ? error.message : String(error)}); ` +
-            `delegations remain unbound and no previous selection was substituted.`,
-          "error",
+          `grants: this session's stored grant was read for ${session.storeCwd}, but pi is working in ` +
+            `${ctx.cwd}. A grant belongs to a directory, so run /grants init here, or set PI_DADDY_GRANT ` +
+            `explicitly — the environment always wins.`,
+          "warning",
         );
       }
-    // The one case the stored-grant lookup can get wrong (ADR-0030). The factory reads the store keyed by
-    // `process.cwd()` because it runs before any hook and therefore before `ctx` exists — and S-5 forces
-    // that ordering, since whether `delegate` is registered is decided there. Almost always the two agree.
-    // When they do not, the session is governed by a different directory's decision than the one it is
-    // working in, which is exactly the confusion a grant must never cause, so it is said out loud rather
-    // than left to be inferred from a surprising refusal. Sync, so it is not the R-60 shape.
-    // Inside no try of its own, and that is deliberate: it is synchronous, so it cannot be the R-60 shape. A
-    // reviewer noted it sits before the try that contains `resolveExecutor` — which is the right order, because
-    // this warning is about WHICH directory's grant was read and must reach the operator even if everything
-    // after it fails.
-    if (session.storeCwd !== ctx.cwd && process.env[ENV_GRANT] === undefined) {
-      ctx.ui.notify(
-        `grants: this session's stored grant was read for ${session.storeCwd}, but pi is working in ` +
-          `${ctx.cwd}. A grant belongs to a directory, so run /grants init here, or set PI_GRANTS_GRANT ` +
-          `explicitly — the environment always wins.`,
-        "warning",
-      );
-    }
       try {
         await reportGrantStoreRefusal(session, ctx.ui);
       } catch (error) {
-        ctx.ui.notify(`grants: stored-grant refusal reporting failed (${String(error)}); the session remains refused.`, "error");
+        ctx.ui.notify(
+          `grants: stored-grant refusal reporting failed (${String(error)}); the session remains refused.`,
+          "error",
+        );
       }
       // Guarded together, and guarded at all because of R-60 rather than because either one throws today:
       // both loaders swallow their own filesystem errors, so this catch is currently unreachable. The point
@@ -152,16 +159,16 @@ export default function (pi: ExtensionAPI) {
         await resolveExecutor(session);
       } catch (error) {
         // Says what is actually true of the state left behind, which depends on the variable: with
-        // `PI_GRANTS_HERDR=1` the session holds a REFUSAL and every delegation fails, so telling the operator
+        // `PI_DADDY_HERDR=1` the session holds a REFUSAL and every delegation fails, so telling the operator
         // "using the captured subprocess" would be the opposite of what happens. The old wording asserted the
         // fallback unconditionally.
         ctx.ui.notify(
           `grants: could not settle which executor to use ` +
             `(${error instanceof Error ? error.message : String(error)}) — ` +
             (session.executor.refusal
-              ? `PI_GRANTS_HERDR=1 still demands herdr, so every delegation in this session will refuse. ` +
+              ? `PI_DADDY_HERDR=1 still demands herdr, so every delegation in this session will refuse. ` +
                 `Unset it to let this session probe, or set 0 to choose subprocesses.`
-              : `using the captured subprocess, which needs nothing installed. Set PI_GRANTS_HERDR=0 to make ` +
+              : `using the captured subprocess, which needs nothing installed. Set PI_DADDY_HERDR=0 to make ` +
                 `that explicit, or 1 to demand herdr panes.`),
           "warning",
         );
@@ -257,10 +264,6 @@ export default function (pi: ExtensionAPI) {
    * `exit` remains the backstop. SIGKILL still orphans panes, exactly as R-62 records, and no signal handler is
    * installed here for the reason R-62 gives: it would turn pi's "interrupt this turn" into "exit pi".
    */
-  pi.on("session_shutdown", async () => {
-    await workSession.close(); await dailyHost.close().catch(() => undefined);
-  });
-
   pi.on("agent_settled", async () => {
     try {
       if (session.executor.kind !== "herdr" || openPaneCount() === 0) return undefined;
@@ -354,7 +357,7 @@ export default function (pi: ExtensionAPI) {
     ...grantsCommand,
     // Built per invocation and spelled out field by field, rather than passing the session whole: what a
     // read-only diagnostic may see is a decision, and `GrantsCommandContext` is where it is recorded.
-    handler: (args, ctx) => /^learning(?:\s|$)/.test(args.trim()) ? learningSession.run(args.trim().slice(8).trim(),ctx).catch(error=>{ctx.ui.notify(String(error),"error");}) : /^work(?:\s|$)/.test(args.trim()) ? workSession.run(args.trim().slice(4).trim(),ctx).catch(error=>{ctx.ui.notify(String(error),"error");}) :
+    handler: (args, ctx) =>
       grantsCommand.handler(args, {
         ...ctx,
         grants: {
@@ -370,7 +373,6 @@ export default function (pi: ExtensionAPI) {
           definitions: session.definitions,
           sessionApprovals: session.sessionApprovals,
           inheritedApprovals: session.inheritedApprovals,
-          variantRuns: session.variantRuns,
           snapshotOf: (subject: string) => snapshotOf(session, subject),
           // The REAL delegation path, minus the one thing a diagnostic must never do. `ctx: null` is what
           // says so: stored approvals count exactly as they would for a spawn, and no human is asked
@@ -381,19 +383,17 @@ export default function (pi: ExtensionAPI) {
               await loadProjectDefinitions(session, ctx.cwd);
               delegation.refreshSpawnable();
             }),
-          runHost: (target: string) => dailyHost.run(target),
-          openDashboard: () => openDashboardCommand({
-            env: process.env,
-            pid: process.pid,
-            cwd: ctx.cwd,
-            ledgerPath: session.ledgerPath ?? defaultActivityTimelinePath(ctx.cwd),
-            pluginRoot: dashboardPluginRoot,
-            paneStatePath: dashboardPaths.paneStatePath,
-          }),
-          previewDelegation: (name: string) =>
-            planWithApprovals(session, { task: "(preview)", agent: name }, {}, null),
+          openDashboard: () =>
+            openDashboardCommand({
+              env: process.env,
+              pid: process.pid,
+              cwd: ctx.cwd,
+              ledgerPath: session.ledgerPath ?? defaultActivityTimelinePath(ctx.cwd),
+              pluginRoot: dashboardPluginRoot,
+              paneStatePath: dashboardPaths.paneStatePath,
+            }),
+          previewDelegation: (name: string) => planWithApprovals(session, { task: "(preview)", agent: name }, {}, null),
         },
       }),
   });
 }
-