pi-daddy 0.43.1 → 0.44.0

package/extensions/grants.ts

@@ -25,7 +25,8 @@ import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { WILDCARD } from "../src/kernel/pi-tools.ts";
-import { buildCatalog } from "../src/kernel/catalog.ts";
+import { makeCatalog, classifyToolNames } from "../src/kernel/catalog.ts";
+import { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 import { ENV_WORKSPACE_REGISTRY } from "../src/kernel/workspace.ts";
 import { appendRecord, buildRecord } from "../src/governance/ledger.ts";
 import { openPaneCount, reapOpenPanesAsync } from "../src/executors/pane-reaper.ts";
@@ -35,13 +36,20 @@ import { registerDelegationTools } from "./delegation.ts";
 import { grantsCommand } from "./grants-command.ts";
 import { runInit } from "./init-command.ts";
 import { planWithApprovals } from "./run-delegation.ts";
-import { createGrantsSession, loadProjectDefinitions, reconcileAdvisorSession, type GrantsSession } from "./session.ts";
+import {
+  createGrantsSession,
+  loadProjectDefinitions,
+  assertDiscoveryHealthy,
+  recordDiscoveryCleanupFailure,
+  retainDiscoveryCleanupFailure,
+  type GrantsSession,
+} from "./session.ts";
 import { acceptWorkspaces } from "../src/governance/workspace-acceptance.ts";
 import { loadWorkspaceRegistry } from "../src/kernel/workspace.ts";
 import { bindReloadLifecycle } from "./reload-environment.ts";
 import { reconcileActiveDelegationTools } from "./delegation-activation.ts";
 import { resolveExecutor } from "./executor-session.ts";
-import { reportSessionStart } from "./session-report.ts";
+import { reportSelectedDefinitions, reportSessionStart, type SessionReportContext } from "./session-report.ts";
 import { SPAWN_TOOLS, tripwireReason } from "./tripwire.ts";
 import { reportGrantStoreRefusal } from "./grant-store-refusal.ts";
 import {
@@ -58,7 +66,8 @@ import { legacyProjectLedgerPath, projectLedgerPath } from "../src/kernel/projec
 import { resolveDefinitionRuntime } from "./definition-runtime.ts";
 import { changeSessionModels, renderSessionModels } from "./session-model-prompt.ts";
 import { ensureDashboardSessionServer } from "./dashboard-session-server.ts";
-export default function (pi: ExtensionAPI) {
+/** Optional trusted session injection is composition-only, never provider payload input. */
+export default function (pi: ExtensionAPI, trustedSession?: GrantsSession) {
   // The path pi loads as the extension, so a child granted `tool:delegate` can be started with `-e <this>`.
   const extensionPath = (() => {
     try {
@@ -68,13 +77,34 @@ export default function (pi: ExtensionAPI) {
     }
   })();
   const observerExtensionPath = fileURLToPath(new URL("./activity-timeline.ts", import.meta.url));
-  const session = createGrantsSession(extensionPath, undefined, observerExtensionPath);
+  const session = trustedSession ?? createGrantsSession(extensionPath, undefined, observerExtensionPath);
+  session.currentThinking = typeof pi.getThinkingLevel === "function" ? () => pi.getThinkingLevel() : undefined;
   registerActivityTimeline(pi, session);
   const dashboardPluginRoot = fileURLToPath(new URL("../herdr-plugin/", import.meta.url));
   const dashboardPaths = defaultDashboardPaths(agentDir());
   // Definitions are registered only after owner-bound session_start. Until then there is no delegation
   // dispatch surface; afterwards this callback refreshes their model-facing spawnable-definition text.
   const delegation = { refreshSpawnable: () => {} };
+  // Supported public discovery is ready at the first real request/tool execution, not session_start.
+  let selectedReady: Promise<void> | undefined;
+  let selectedReportContext: SessionReportContext | undefined;
+  if (typeof pi.getCommands === "function")
+    session.ensureDefinitions = () =>
+      (selectedReady ??= (async () => {
+        const lifecycle = session.reloadLifecycle;
+        await loadProjectDefinitions(session, session.cwd, lifecycle, pi.getCommands());
+        assertDiscoveryHealthy(session, lifecycle);
+        delegation.refreshSpawnable();
+        if (selectedReportContext)
+          try {
+            await reportSelectedDefinitions(session, selectedReportContext);
+          } catch (error) {
+            console.error("grants: selected resource report unavailable", error);
+          }
+      })());
+  pi.on("before_agent_start", async () => {
+    await session.ensureDefinitions?.();
+  });
   pi.on("session_start", async (_event, ctx) => {
     if (session.adoptedLegacyEnv.length > 0)
       ctx.ui.notify(legacyEnvironmentWarning(session.adoptedLegacyEnv), "warning");
@@ -84,6 +114,8 @@ export default function (pi: ExtensionAPI) {
     const reload = bindReloadLifecycle(owner, session.reloadLifecycle);
     session.reconcileEnvironment(reload.environment, reload.lifecycle);
     session.ownerBound = true;
+    selectedReady = undefined;
+    selectedReportContext = ctx;
     // ADR-0078: the parent's own session, for a granted `pruned` or `fork` handoff. Read-only, and only ever
     // read after the mode has survived the gate.
     const manager = owner as Partial<import("./context-staging.ts").ParentSession>;
@@ -96,7 +128,6 @@ export default function (pi: ExtensionAPI) {
     // execution tree across workspaces. Resolve it once at the root's actual pi cwd; descendants inherit
     // this absolute identity verbatim, and resolve(abs) remains abs at every deeper session start.
     if (session.ledgerPath) session.ledgerPath = resolve(ctx.cwd, session.ledgerPath);
-    reconcileAdvisorSession(session, reload.environment);
     try {
       // ADR-0076 PR 3d: a pre-format project ledger is imported once into the record envelope, bodies verbatim, each
       // record marked with its source line; the old file is left untouched. Happens before any spawn can append.
@@ -105,6 +136,7 @@ export default function (pi: ExtensionAPI) {
         // continues against the new ledger path (an append there still fails closed if that path is unwritable).
         try {
           const imported = await importLegacyLedger(legacyProjectLedgerPath(ctx.cwd), projectLedgerPath(ctx.cwd));
+          if (session.reloadLifecycle !== reload.lifecycle) return undefined;
           if (imported.imported > 0 || imported.stoppedAt !== null)
             ctx.ui.notify(
               `grants: imported ${imported.imported} record(s) from ${legacyProjectLedgerPath(ctx.cwd)} into ${projectLedgerPath(ctx.cwd)}` +
@@ -115,6 +147,7 @@ export default function (pi: ExtensionAPI) {
               imported.stoppedAt !== null ? "warning" : "info",
             );
         } catch (error) {
+          if (session.reloadLifecycle !== reload.lifecycle) return undefined;
           ctx.ui.notify(`grants: legacy ledger import failed: ${String(error)}`, "error");
         }
       }
@@ -139,11 +172,13 @@ export default function (pi: ExtensionAPI) {
       try {
         await reportGrantStoreRefusal(session, ctx.ui);
       } catch (error) {
+        if (session.reloadLifecycle !== reload.lifecycle) return undefined;
         ctx.ui.notify(
           `grants: stored-grant refusal reporting failed (${String(error)}); the session remains refused.`,
           "error",
         );
       }
+      if (session.reloadLifecycle !== reload.lifecycle) return undefined;
       // Guarded together, and guarded at all because of R-60 rather than because either one throws today:
       // both loaders swallow their own filesystem errors, so this catch is currently unreachable. The point
       // is that "currently" is not a property anyone can rely on — `verifyLedger` was also harmless until
@@ -152,16 +187,28 @@ export default function (pi: ExtensionAPI) {
       // delegate by `tools:`, and an operator whose `agent:` spawns have all started failing deserves to
       // know it was the *scan* that broke rather than the grant.
       try {
-        await loadProjectDefinitions(session, ctx.cwd);
+        await loadProjectDefinitions(session, ctx.cwd, reload.lifecycle, session.ensureDefinitions ? [] : undefined);
       } catch (error) {
-        ctx.ui.notify(
-          `grants: could not read this project's definitions or capability catalog ` +
-            `(${error instanceof Error ? error.message : String(error)}) — no SKILL.md definition can be ` +
-            `spawned this session, and delegation by tools: is unaffected. Governance itself is unaffected: ` +
-            `it is enforced by --tools when a child is spawned.`,
-          "error",
-        );
+        if (session.reloadLifecycle !== reload.lifecycle) return undefined;
+        if (error instanceof BoundedReadCleanupError) {
+          try {
+            ctx.ui.notify(
+              `grants: discovery cleanup failed — ${error.message}; delegation remains failed until a new owner.`,
+              "error",
+            );
+          } catch (diagnosticError) {
+            console.error("grants: startup cleanup diagnostic failed", error, diagnosticError);
+          }
+        } else
+          ctx.ui.notify(
+            `grants: could not read this project's definitions or capability catalog ` +
+              `(${error instanceof Error ? error.message : String(error)}) — no SKILL.md definition can be ` +
+              `spawned this session, and delegation by tools: is unaffected. Governance itself is unaffected: ` +
+              `it is enforced by --tools when a child is spawned.`,
+            "error",
+          );
       }
+      if (session.reloadLifecycle !== reload.lifecycle) return undefined;
       // ADR-0031: probe once, HERE, before anything reports — so the disclosure line can name the executor,
       // and so a demanded-but-unreachable herdr is reported before the operator's first prompt rather than at
       // their first delegation. Its own try, because a failure here must not cancel the controls after it
@@ -169,6 +216,7 @@ export default function (pi: ExtensionAPI) {
       try {
         await resolveExecutor(session);
       } catch (error) {
+        if (session.reloadLifecycle !== reload.lifecycle) return undefined;
         // Says what is actually true of the state left behind, which depends on the variable: with
         // `PI_DADDY_HERDR=1` the session holds a REFUSAL and every delegation fails, so telling the operator
         // "using the captured subprocess" would be the opposite of what happens. The old wording asserted the
@@ -184,10 +232,12 @@ export default function (pi: ExtensionAPI) {
           "warning",
         );
       }
+      if (session.reloadLifecycle !== reload.lifecycle) return undefined;
       session.publishChildEnv();
       // The definitions now exist, so the `delegate` schema can finally name them (R-39). pi serialises a
       // tool's schema at REQUEST time, not at registration — measured — which is what makes this reach the
       // model at all.
+      if (session.reloadLifecycle !== reload.lifecycle) return undefined;
       delegation.refreshSpawnable();
       // Everything an operator is TOLD at session start now lives in `./session-report.ts`. Lifted because
       // this file had reached 398 of the 400-line ceiling and ADR-0032 adds a control to it; the split is the
@@ -203,6 +253,7 @@ export default function (pi: ExtensionAPI) {
       try {
         await reportSessionStart(session, ctx);
       } catch (error) {
+        if (session.reloadLifecycle !== reload.lifecycle) return undefined;
         ctx.ui.notify(
           // Names the CHECKS as well as the display lines. The first version listed only "the grant, the
           // executor and the spawnable definitions" — which understated it: a throw partway through the reporter
@@ -218,9 +269,12 @@ export default function (pi: ExtensionAPI) {
           "warning",
         );
       }
+      if (session.reloadLifecycle !== reload.lifecycle) return undefined;
       // Explicit installation handshake. It only runs in a Herdr-hosted TUI, asks once, and the only branch
       // that links software is the literal human choice "Install and open".
       try {
+        const sessionEndpoint = await ensureDashboardSessionServer(session);
+        if (session.reloadLifecycle !== reload.lifecycle) return undefined;
         await offerDashboardHandshake({
           mode: ctx.mode,
           env: process.env,
@@ -230,10 +284,12 @@ export default function (pi: ExtensionAPI) {
           pluginRoot: dashboardPluginRoot,
           preferencePath: dashboardPaths.preferencePath,
           paneStatePath: dashboardPaths.paneStatePath,
-          sessionEndpoint: await ensureDashboardSessionServer(session),
+          sessionEndpoint,
           ui: ctx.ui,
         });
+        if (session.reloadLifecycle !== reload.lifecycle) return undefined;
       } catch (error) {
+        if (session.reloadLifecycle !== reload.lifecycle) return undefined;
         ctx.ui.notify(
           `grants: dashboard installation handshake could not run (${error instanceof Error ? error.message : String(error)}). ` +
             `Nothing was installed; /grants dashboard will report manual setup.`,
@@ -241,6 +297,7 @@ export default function (pi: ExtensionAPI) {
         );
       }
     } catch (error) {
+      if (session.reloadLifecycle !== reload.lifecycle) return undefined;
       // Rule 8 — fail closed, and be LOUD about it. Swallowing is still right: a startup fault must not
       // reach the agent loop. Swallowing SILENTLY is what let R-60 exist, and would let the next one exist
       // too, because every control added above this line is cancelled by any throw before it with no trace.
@@ -252,8 +309,8 @@ export default function (pi: ExtensionAPI) {
             `may refuse. The grant itself is unaffected: it is enforced by --tools when a child is spawned.`,
           "error",
         );
-      } catch {
-        /* a UI that cannot be notified is the one failure there is nowhere to report */
+      } catch (diagnosticError) {
+        console.error("grants: session-start diagnostic failed", error, diagnosticError);
       }
     }
     return undefined;
@@ -288,7 +345,7 @@ export default function (pi: ExtensionAPI) {
 
   // Observe this session's real tool surface once, and tighten the grant to it. Authoritative because
   // it is exactly what pi sent the model.
-  pi.on("before_provider_request", (event) => {
+  pi.on("before_provider_request", (event, ctx) => {
     try {
       if (session.observed) return undefined;
       const names = observeToolNames(event.payload);
@@ -303,15 +360,17 @@ export default function (pi: ExtensionAPI) {
       // Refresh the catalog now that the real tool surface is known — this is the only moment extension
       // tools become visible, so it is the only moment `ext:`/`tool:` grants can be validated.
       // Keep the handle: a concurrent `delegate` awaits this rather than reading a half-built catalog.
-      // The `catch` resolves to the CURRENT catalog rather than rejecting, so a failed refresh degrades
-      // to the previous view instead of failing every delegation in the session.
-      session.catalogReady = buildCatalog({
-        cwd: session.cwd,
-        observedTools: names,
-        registryPath: process.env[ENV_WORKSPACE_REGISTRY],
-      })
-        .then((c) => (session.catalog = c))
-        .catch(() => session.catalog);
+      const lifecycle = session.reloadLifecycle;
+      assertDiscoveryHealthy(session, lifecycle);
+      session.catalogReady = session.catalogReady.then((catalog) => {
+        assertDiscoveryHealthy(session, lifecycle);
+        const next = makeCatalog([...catalog.entries, ...classifyToolNames(names)], catalog.registryRefusal);
+        session.catalog = next;
+        return next;
+      });
+      void session.catalogReady.catch((error: unknown) => {
+        if (error instanceof BoundedReadCleanupError) recordDiscoveryCleanupFailure(session, error, lifecycle);
+      });
     } catch {
       /* never throw into the agent loop */
     }
@@ -370,8 +429,10 @@ export default function (pi: ExtensionAPI) {
     ...grantsCommand,
     // Built per invocation and spelled out field by field, rather than passing the session whole: what a
     // read-only diagnostic may see is a decision, and `GrantsCommandContext` is where it is recorded.
-    handler: (args, ctx) =>
-      grantsCommand.handler(args, {
+    handler: async (args, ctx) => {
+      // Named revocation validates the current definition. Emergency revoke-all needs no resource acquisition.
+      if (args.trim() !== "revoke --all") await session.ensureDefinitions?.();
+      return grantsCommand.handler(args, {
         ...ctx,
         grants: {
           cwd: session.cwd,
@@ -382,11 +443,6 @@ export default function (pi: ExtensionAPI) {
           depth: session.depth,
           maxDepth: session.maxDepth,
           ledgerPath: session.ledgerPath,
-          advisor: {
-            decider: session.advisorSession.deciderName,
-            taskEgress: session.advisorSession.settings.taskEgress,
-            ...(session.advisorSession.settings.refusal ? { refusal: session.advisorSession.settings.refusal } : {}),
-          },
           ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
           ...(session.workspaceAcceptance ? { unacceptedWorkspaces: session.workspaceAcceptance.unaccepted } : {}),
           // Injected rather than imported, so `/grants` takes its one writing ability visibly from here.
@@ -413,8 +469,11 @@ export default function (pi: ExtensionAPI) {
           // (R-38). Passing `ctx` here would let `/grants` raise a dialog, and passing `hasUI: false` would
           // make every gated definition report "no interactive user" instead of what actually blocks it.
           runInit: () =>
-            runInit(session, ctx, async () => {
-              await loadProjectDefinitions(session, ctx.cwd);
+            runInit(session, ctx, async (lifecycle) => {
+              assertDiscoveryHealthy(session, lifecycle);
+              if (session.ensureDefinitions) await session.ensureDefinitions();
+              else await loadProjectDefinitions(session, ctx.cwd, lifecycle);
+              assertDiscoveryHealthy(session, lifecycle);
               delegation.refreshSpawnable();
             }),
           openDashboard: async () =>
@@ -434,7 +493,15 @@ export default function (pi: ExtensionAPI) {
             input(title: string, placeholder?: string): Promise<string | undefined>;
             notify(message: string, type?: "info" | "warning" | "error"): void;
           }) => {
-            await changeSessionModels(session, { hasUI: ctx.hasUI, ...ui });
+            const lifecycle = session.reloadLifecycle;
+            await changeSessionModels(
+              session,
+              { hasUI: ctx.hasUI, ...ui },
+              {
+                assertHealthy: () => assertDiscoveryHealthy(session, lifecycle),
+                onReadCleanup: (error) => retainDiscoveryCleanupFailure(session, error, lifecycle),
+              },
+            );
             return renderSessionModels(session);
           },
           runtimeFor: (name: string) =>
@@ -446,6 +513,7 @@ export default function (pi: ExtensionAPI) {
               piModel: ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : undefined,
             }),
         },
-      }),
+      });
+    },
   });
 }

package/extensions/init-command.ts

@@ -13,7 +13,9 @@ import { PI_PROJECT_DIR } from "../src/kernel/project-paths.ts";
 import { registeredWorkspaceIds } from "../src/kernel/workspace.ts";
 import { grantStorePath, projectLedgerPath, saveGrant } from "../src/governance/grant-store.ts";
 import { expandSubsumed, SUBSUMPTION, type Capability } from "../src/kernel/resolve.ts";
-import type { GrantsSession } from "./session.ts";
+import { assertDiscoveryHealthy, retainDiscoveryCleanupFailure, type GrantsSession } from "./session.ts";
+import type { ReloadLifecycle } from "./reload-environment.ts";
+import { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 
 /**
  * `/grants init` — scaffold, ask about what is withheld, store grant + ledger consent, apply both now.
@@ -34,15 +36,40 @@ export async function runInit(
   /**
    * Reload definitions and the catalog, and re-describe the delegation tools.
    *
+   * Refresh selected definitions for the live grant. New Pi resource references still need explicit /reload.
    * **Without this the grant goes live and the definitions do not** — `session.definitions` and the catalog
    * are read at `session_start`, which is before `init` wrote a single file, so a session would hold
    * `agent:review` while believing no definition of that name exists. `/grants` showed `0 skill,
    * 0 agent-type` and no verdicts, and the model would have been told `Available: none` — R-39 exactly,
    * reintroduced by a feature whose whole selling point is "no restart". Found by running it.
    */
-  refresh: () => Promise<void>,
+  refresh: (lifecycle: ReloadLifecycle) => Promise<void>,
 ): Promise<void> {
-  const packages = await discoverSkillPackages(ctx.cwd);
+  const lifecycle = session.reloadLifecycle;
+  try {
+    await runOwnedInit(session, ctx, refresh, lifecycle);
+  } catch (error) {
+    if (error instanceof BoundedReadCleanupError) {
+      retainDiscoveryCleanupFailure(session, error, lifecycle);
+      try {
+        ctx.ui.notify(`grants: init cleanup failed — ${error.message}; init did not complete.`, "error");
+      } catch (diagnosticError) {
+        console.error("grants: init cleanup diagnostic failed", error, diagnosticError);
+      }
+    }
+    throw error;
+  }
+}
+
+async function runOwnedInit(
+  session: GrantsSession,
+  ctx: any,
+  refresh: (lifecycle: ReloadLifecycle) => Promise<void>,
+  lifecycle: ReloadLifecycle,
+): Promise<void> {
+  assertDiscoveryHealthy(session, lifecycle);
+  const packages = await (session.discovery?.packages ?? discoverSkillPackages)(ctx.cwd);
+  assertDiscoveryHealthy(session, lifecycle);
   if (packages.length === 0) {
     ctx.ui.notify(
       "grants: no enabled configured skills or unregistered npm skill packages found. Install and enable one — e.g. " +
@@ -52,14 +79,18 @@ export async function runInit(
     return;
   }
 
-  const plan = planInit(
-    packages,
-    ctx.cwd,
-    await registeredWorkspaceIds(undefined, (reason) =>
-      ctx.ui.notify(`grants: workspace registry unreadable, scaffolding no workspaces — ${reason}`, "warning"),
-    ),
+  const workspaces = await registeredWorkspaceIds(
+    undefined,
+    (reason) => {
+      assertDiscoveryHealthy(session, lifecycle);
+      ctx.ui.notify(`grants: workspace registry unreadable, scaffolding no workspaces — ${reason}`, "warning");
+    },
+    session.discovery?.registry,
   );
+  assertDiscoveryHealthy(session, lifecycle);
+  const plan = planInit(packages, ctx.cwd, workspaces);
   const outcome = await applyInit(plan);
+  assertDiscoveryHealthy(session, lifecycle);
   const lines = [
     `grants: ${plan.skills.length} definition(s) from ${packages.map((p) => `${p.name}@${p.version}`).join(", ")}`,
     `  using ${plan.skills.filter((s) => s.referenced).length} enabled definition(s) in place; no copies`,
@@ -77,6 +108,7 @@ export async function runInit(
   const alreadyConferred: string[] = [];
 
   for (const [capability, neededBy] of plan.withheldCapabilities) {
+    assertDiscoveryHealthy(session, lifecycle);
     // **Do not ask a question whose answer cannot matter.** `tool:bash` subsumes `write`, `edit` and
     // `edit-diff` (`SUBSUMPTION`, `src/kernel/resolve.ts`), so once bash is granted those are already conferred.
     // The first version asked anyway: an operator could answer *no* to `tool:write`, watch `/grants` allow
@@ -114,6 +146,7 @@ export async function runInit(
             : "it is not gated, so no dialog at spawn time"),
       ["No", "Yes"],
     );
+    assertDiscoveryHealthy(session, lifecycle);
     if (answer === "Yes") {
       grant.add(capability);
       granted.push(capability);
@@ -125,9 +158,11 @@ export async function runInit(
     }
   }
 
+  assertDiscoveryHealthy(session, lifecycle);
   const finalGrant = [...grant].sort();
   const ledger = projectLedgerPath(ctx.cwd);
   const saved = await saveGrant(ctx.cwd, finalGrant, { projectLedger: true });
+  assertDiscoveryHealthy(session, lifecycle);
   if (saved !== "saved") {
     lines.push(
       `  NOT STORED — ${saved === "busy" ? "another session holds the grant store" : "the store could not be written"}. ` +
@@ -142,7 +177,8 @@ export async function runInit(
   session.adoptGrant(finalGrant, ledger);
   // Order matters: the grant first, then the reload, because `refreshSpawnable` filters the definitions it
   // advertises through `maySpawnDefinition` against the grant the session now holds.
-  await refresh();
+  await refresh(lifecycle);
+  assertDiscoveryHealthy(session, lifecycle);
 
   lines.push(
     `  stored at ${grantStorePath(ctx.cwd)} — outside this project, so no child can rewrite it`,
@@ -164,12 +200,16 @@ export async function runInit(
         `${plan.settingsPath}. Which worktree a child starts in is not something a package can declare for you.`,
     );
   }
-  if ((await settingsIgnoredByGit(plan.settingsPath)) === true)
+  const settingsIgnored = await settingsIgnoredByGit(plan.settingsPath);
+  assertDiscoveryHealthy(session, lifecycle);
+  if (settingsIgnored === true)
     lines.push(
       `  NOTE: git ignores ${plan.settingsPath} (your root .gitignore covers ${PI_PROJECT_DIR}/), so the reviewable record ` +
         `cannot be committed until you add: ${GITIGNORE_REINCLUDE_LINES.join("  ")}`,
     );
-  lines.push(`  live now (${finalGrant.length} capabilities) — no restart. /grants shows the verdicts.`);
+  lines.push(`  grant live now (${finalGrant.length} capabilities). /grants shows current selected definitions.`);
+  if (session.ensureDefinitions)
+    lines.push("  Newly added skill resources require /reload before selection; the current snapshot stays pinned.");
   ctx.ui.notify(lines.join("\n"), "info");
 }
 

package/extensions/reload-environment.ts

@@ -1,8 +1,12 @@
+import type { OwnerCapacity } from "./session-capacity.ts";
 import { GRANT_ENV_KEYS } from "../src/kernel/propagation.ts";
+import type { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 
 /** The root baseline and latest child publication for one real Pi session owner. */
 export interface ReloadLifecycle {
   root: Record<string, string | undefined>;
+  /** Never replaced for the same owner, even when an explicit root environment changes. */
+  capacity?: OwnerCapacity;
   published?: Record<string, string | undefined>;
   activityRootId?: string;
   episodeId?: string;
@@ -20,6 +24,12 @@ export interface ReloadLifecycle {
    * than its child publication", so it is where settled-ness belongs.
    */
   workspacePin?: ReadonlyMap<string, string>;
+  /** Failed pin acquisition stays failed for this owner even after explicit physical cleanup or reload. */
+  workspacePinFailure?: BoundedReadCleanupError;
+  /** One charged acquisition per actual owner, published before trusted loader callbacks. */
+  workspacePinAcquisition?: Promise<ReadonlyMap<string, string>>;
+  /** Catalog failure is terminal for this lifecycle too, not merely one extension object. */
+  discoveryCleanupFailure?: BoundedReadCleanupError;
 }
 type SessionOwner = object;
 
@@ -62,7 +72,7 @@ export function bindReloadLifecycle(
   environment: NodeJS.ProcessEnv;
 } {
   const holder = state();
-  const existing = holder.owners.get(owner);
+  let existing = holder.owners.get(owner);
   if (!existing) {
     holder.owners.set(owner, provisional);
     return { lifecycle: provisional, environment: withRoot(provisional.root) };
@@ -82,7 +92,16 @@ export function bindReloadLifecycle(
     // silently ignored for the pin, so a session reconciled to depth 1 — believing itself a descendant —
     // kept a root-minted pin naming a workspace the replacement root never granted. Deleting it makes the
     // next `establishRootPin` re-settle from the new root, which for a descendant means minting nothing.
-    if (!same(current, existing.root)) delete existing.workspacePin;
+    if (!same(current, existing.root)) {
+      // Pending old-root operations keep THEIR original owner; they cannot publish/fault this replacement.
+      existing = {
+        root: current,
+        activityRootId: existing.activityRootId,
+        episodeId: existing.episodeId,
+        capacity: existing.capacity,
+      };
+      holder.owners.set(owner, existing);
+    }
     existing.root = current;
   }
   return { lifecycle: existing, environment: withRoot(existing.root) };

package/extensions/retired-inputs.ts

@@ -0,0 +1,7 @@
+/** Closed compatibility list. Preparation precedes Pi schema validation; active arguments still validate. */
+export function withoutRetiredDelegationArguments<T>(args: unknown): T {
+  if (args === null || typeof args !== "object" || Array.isArray(args)) return args as T;
+  const clean = { ...(args as Record<string, unknown>) };
+  delete clean.episodeCostCeiling;
+  return clean as T;
+}