pi-daddy 0.43.1 → 0.44.0

package/extensions/session.ts

@@ -14,14 +14,19 @@
  * copy of `ownGrant` before observation is exactly how a stale upper bound would become an enforced one.
  */
 import { randomUUID } from "node:crypto";
+import { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
+import type { discoverSkillPackages } from "../src/kernel/skill-packages.ts";
+import { collectBoundedReadFailures } from "../src/kernel/bounded-read-failures.ts";
 import { isEpisodeId, newEpisodeId } from "../src/kernel/episode-id.ts";
 import { parseInherited, type InheritableApproval } from "../src/kernel/approval.ts";
 import type { ApprovalBinding } from "../src/kernel/correlation.ts";
 import { createApprovalGateProvider } from "../src/governance/approval-prompt.ts";
-import { makeCatalog, skillPathsFromCatalog, type Catalog } from "../src/kernel/catalog.ts";
+import { makeCatalog, skillPathsFromCatalog, type CatalogLoaders, type Catalog } from "../src/kernel/catalog.ts";
 import type { SkillDefinition } from "../src/kernel/definitions.ts";
 import { DELEGATE_CAPABILITY, type DelegationContext } from "../src/kernel/delegate.ts";
-import { budgetFromEnv } from "../src/kernel/fanout.ts";
+import { capacityForLifecycle } from "./session-capacity.ts";
+import type { CapacityAllocator } from "../src/kernel/capacity.ts";
+import type { StructuredRefusal } from "../src/kernel/refusals.ts";
 import { chooseExecutor, ENV_HERDR, type ExecutorChoice } from "../src/executors/executor.ts";
 import { WILDCARD } from "../src/kernel/pi-tools.ts";
 import {
@@ -42,6 +47,7 @@ import {
   parseList,
 } from "../src/kernel/propagation.ts";
 import type { Capability } from "../src/kernel/resolve.ts";
+import { selectedDefinitions, type SelectedCommand } from "../src/kernel/selected-definitions.ts";
 import { loadDefinitions } from "../src/kernel/definitions.ts";
 import { buildCatalog } from "../src/kernel/catalog.ts";
 import { ENV_WORKSPACE_REGISTRY } from "../src/kernel/workspace.ts";
@@ -50,9 +56,9 @@ import { republishable } from "./approvals.ts";
 import { storedGrantSessionState } from "./stored-grant-session.ts";
 import { nativeSessionRootFromEnv, type NativeSessionHost } from "../src/executors/native-session-target.ts";
 import { createHandoffStager, type ParentSession } from "./context-staging.ts";
-import { createAdvisorSession, type AdvisorSession } from "./advisor-session.ts";
 import { join } from "node:path";
 import { readFileSync, statSync } from "node:fs";
+import { readBoundedTextSync } from "../src/kernel/bounded-read-sync.ts";
 import { agentDir, projectSettingsPath } from "../src/kernel/project-paths.ts";
 import { ENV_ALLOW_UNRESOLVED_MODELS } from "../src/kernel/model-preflight.ts";
 import { beginExtensionLifecycle, rememberChildPublication, type ReloadLifecycle } from "./reload-environment.ts";
@@ -67,7 +73,6 @@ import {
 } from "../src/kernel/workspace-pin.ts";
 import { loadWorkspaceRegistry } from "../src/kernel/workspace.ts";
 import { reconcileAcceptedWorkspaces } from "../src/governance/workspace-acceptance.ts";
-import { EpisodeCostGate, episodeCostCeilingFromSettings } from "../src/governance/episode-cost-gate.ts";
 import {
   definitionRuntimeSettingsFrom,
   parseConfiguredModel,
@@ -76,6 +81,13 @@ import {
   type DefinitionRuntimeSettings,
 } from "./definition-runtime.ts";
 
+/** Trusted composition dependencies, not inherited or requester-supplied authority. */
+export interface SessionDiscovery extends CatalogLoaders {
+  packages?: typeof discoverSkillPackages;
+  acceptanceRead?: (path: string) => Promise<string>;
+  canonicalise?: (path: string) => Promise<string>;
+}
+
 /**
  * Run governed children in herdr panes instead of captured child processes.
  *
@@ -109,13 +121,7 @@ import {
   ENV_ACTIVITY_ROOT,
   ENV_ACTIVITY_TASK,
 } from "../src/products/activity-timeline.ts";
-import {
-  ENV_HERDR_KEEP_PANE,
-  ENV_GOVERNANCE,
-  ENV_ADVISOR,
-  ENV_EPISODE_ID,
-  ENV_EPISODE_COST_CEILING,
-} from "../src/kernel/env-names.ts";
+import { ENV_HERDR_KEEP_PANE, ENV_GOVERNANCE, ENV_EPISODE_ID } from "../src/kernel/env-names.ts";
 export { ENV_HERDR_KEEP_PANE, ENV_GOVERNANCE } from "../src/kernel/env-names.ts";
 import { adoptLegacyEnvironment } from "../src/kernel/env-names.ts";
 
@@ -165,8 +171,10 @@ export interface GrantsSession extends NativeSessionHost {
   ownExecutionId?: string;
   /** Stable identity shared by this root session and every descendant. */
   episodeId: string;
-  /** Descendants this subtree may still create — the cardinality bound ADR-0008 never had. */
+  /** Configured active descendant capacity; use capacity.available for actual reservations. */
   fanoutBudget: number;
+  capacity: CapacityAllocator;
+  capacityRefusal?: StructuredRefusal;
   /** Whether delegation tools are active. Reconciled against the owner-bound root at session_start. */
   mayDelegate: boolean;
   /** True only after session_start binds this instance to ctx.sessionManager. */
@@ -178,10 +186,8 @@ export interface GrantsSession extends NativeSessionHost {
   /** Committed per-definition and global child runtime defaults. */
   readonly definitionRuntimeSettings: DefinitionRuntimeSettings;
   /** PD-7's future session controls write here; deliberately empty in this commit. */
+  currentThinking?: () => string;
   readonly definitionRuntimeOverrides: Map<string, DefinitionRuntimeChoice>;
-  readonly sessionModelPrompt: "ask" | "never";
-  sessionModelPrompted: boolean;
-  sessionModelPromptInFlight?: Promise<void>;
   /** Path to this extension, so a child granted `tool:delegate` can delegate in turn. */
   readonly extensionPath?: string;
   /** Hook-only observer path for leaf children; it exposes no tools. */
@@ -194,8 +200,6 @@ export interface GrantsSession extends NativeSessionHost {
    * context handoff (ADR-0078): its file path for `fork`, its message turns for `pruned`.
    */
   parentSession?: ParentSession;
-  /** ADR-0077: the session's advisor, off unless the environment enables one. Never consulted for authority. */
-  advisorSession: AdvisorSession;
   /** Root identity keyed to ctx.sessionManager once session_start supplies it. */
   reloadLifecycle: ReloadLifecycle;
   /** Approval keys approved for this session. In memory only — this dies with the process. */
@@ -213,8 +217,6 @@ export interface GrantsSession extends NativeSessionHost {
   inheritedApprovals: Map<string, string | undefined>;
   /** ONE single-flight queue for the whole session — see `obtainApprovals` for why it lives here. */
   readonly approvalGateFor: ReturnType<typeof createApprovalGateProvider>;
-  /** One cumulative cost threshold shared by every child in this episode. */
-  readonly episodeCostGate: EpisodeCostGate;
   /** Set at `session_start`; `process.cwd()` until then. */
   cwd: string;
   /** This session's own grant. Starts as the inherited upper bound, tightened once tools are observed. */
@@ -222,6 +224,7 @@ export interface GrantsSession extends NativeSessionHost {
   observed: boolean;
   observedTools: string[] | null;
   /** ADR-0016: `SKILL.md` definitions, keyed by name. The format this package spawns from now. */
+  ensureDefinitions?: () => Promise<void>;
   definitions: Map<string, SkillDefinition>;
   /**
    * Definitions discovery dropped, and why — reported at session start (ADR-0076, rule 8).
@@ -248,6 +251,10 @@ export interface GrantsSession extends NativeSessionHost {
   workspaceSkips: string[];
   /** Which registry ids this machine has accepted, and which it has not. Reported, and drives `/grants`. */
   workspaceAcceptance?: { accepted: string[]; firstUse: boolean; unaccepted: string[] };
+  /** Trusted discovery dependencies supplied by composition, never inherited authority. */
+  readonly discovery: SessionDiscovery;
+  /** Exact unresolved discovery failure/capability; physical recovery never rewrites the failed outcome. */
+  discoveryCleanupFailure?: BoundedReadCleanupError;
   catalog: Catalog;
   /**
    * The in-flight catalog build, so `delegate` can wait for it instead of racing it.
@@ -327,7 +334,9 @@ export interface GrantsSession extends NativeSessionHost {
  * Failing to establish is not an error: a machine with no registry has no workspaces to route to, and the
  * absent pin refuses anything that tries. That is the same direction as every other failure in this mechanism.
  */
-async function establishRootPin(session: GrantsSession): Promise<void> {
+async function establishRootPin(session: GrantsSession, lifecycle: ReloadLifecycle): Promise<void> {
+  assertDiscoveryHealthy(session, lifecycle);
+  if (lifecycle.workspacePinFailure) throw lifecycle.workspacePinFailure;
   if (session.pinSettled) return;
   // **One assignment, at the end, on every path.** Review found the previous shape — assign at each `return`
   // — missing two of five exits: the `catch` around an unreadable registry, which is precisely the state a
@@ -339,26 +348,34 @@ async function establishRootPin(session: GrantsSession): Promise<void> {
   // settled with nothing settled — routing nowhere, which is safe, but with the LIFECYCLE unset, so the next
   // reload would mint again. Review could construct no throw today; "currently unreachable" is exactly the
   // property this feature has now been wrong about four times, and the ordering costs nothing.
-  const settled = await settleWorkspacePin(session);
+  // Charge/publish BEFORE invoking trusted loaders: reentrant startup/init/reload joins the same owner.
+  lifecycle.workspacePinAcquisition ??= Promise.resolve().then(async () => {
+    const settled = await settleWorkspacePin(session, lifecycle);
+    assertDiscoveryHealthy(session, lifecycle);
+    lifecycle.workspacePin = settled;
+    return settled;
+  });
+  const settled = await lifecycle.workspacePinAcquisition;
+  assertDiscoveryHealthy(session, lifecycle);
   session.pinSettled = true;
   session.workspacePin = settled;
-  session.reloadLifecycle.workspacePin = settled;
 }
 
 /**
- * What this session's destination pin IS (ADR-0042). Every path returns a map; none writes anything.
+ * What this session's destination pin IS (ADR-0042). Ordinary unavailable registries settle an empty map;
+ * physical reader cleanup failures instead retain their exact rejected outcome on the owning lifecycle.
  *
- * An empty map means "settled, and you may route nowhere", which is different from never having settled and
- * is what every failure resolves to. The distinction that matters is not empty-versus-absent but
+ * An empty map means "settled, and you may route nowhere", which is different from never having settled.
+ * The distinction that matters is not empty-versus-absent but
  * settled-versus-not, and settling happens exactly once per owner.
  */
-async function settleWorkspacePin(session: GrantsSession): Promise<WorkspacePins> {
+async function settleWorkspacePin(session: GrantsSession, lifecycle: ReloadLifecycle): Promise<WorkspacePins> {
   // Settled by an EARLIER SESSION OBJECT for this same owner — an extension reload. Adopting rather than
   // re-deriving is the point: a root may mint, but only once, and only from the registry as it stood before
   // any child had a chance to rewrite it.
-  if (session.reloadLifecycle.workspacePin) return session.reloadLifecycle.workspacePin;
+  if (lifecycle.workspacePin) return lifecycle.workspacePin;
 
-  const raw = session.reloadLifecycle.root[ENV_WORKSPACE_PIN];
+  const raw = lifecycle.root[ENV_WORKSPACE_PIN];
   const inherited = parseWorkspacePin(raw);
   // Inherited, so it is authority and is kept exactly as it arrived — including an empty one, which says
   // "your parent established a pin and gave you none of it".
@@ -379,51 +396,159 @@ async function settleWorkspacePin(session: GrantsSession): Promise<WorkspacePins
   const registryPath = process.env[ENV_WORKSPACE_REGISTRY];
   if (!registryPath) return new Map();
   try {
-    const registry = await loadWorkspaceRegistry(registryPath);
+    let registry: Awaited<ReturnType<typeof loadWorkspaceRegistry>>;
+    try {
+      registry = await (session.discovery.registry ?? loadWorkspaceRegistry)(registryPath);
+    } catch (error) {
+      if (error instanceof BoundedReadCleanupError) throw error;
+      assertDiscoveryHealthy(session, lifecycle);
+      // Only registry unavailability is soft: the catalog reports it, and settling prevents later reminting.
+      return new Map();
+    }
+    assertDiscoveryHealthy(session, lifecycle);
     // **The id SET, which the destination pin does not cover.** ADR-0042 bound what an id means; a child
     // holding `tool:write` inherits the registry path and can append an id of its own, and the NEXT root
     // session mints a pin for it. Measured: a child-created id reached the catalog, the pin and a real route
     // with no operator action. So an id nobody accepted is not pinned, and therefore not routable.
-    const acceptance = await reconcileAcceptedWorkspaces(registryPath, Object.keys(registry.workspaces));
-    session.workspaceAcceptance = acceptance;
-    for (const id of acceptance.unaccepted)
-      session.workspaceSkips.push(`${id} — it is in the registry but this machine has never accepted it`);
+    const acceptance = await reconcileAcceptedWorkspaces(
+      registryPath,
+      Object.keys(registry.workspaces),
+      process.env,
+      session.discovery.acceptanceRead,
+      () => assertDiscoveryHealthy(session, lifecycle),
+    );
+    assertDiscoveryHealthy(session, lifecycle);
+    const skips = acceptance.unaccepted.map(
+      (id) => `${id} — it is in the registry but this machine has never accepted it`,
+    );
     const accepted = new Set(acceptance.accepted);
     const narrowed = {
       workspaces: Object.fromEntries(Object.entries(registry.workspaces).filter(([id]) => accepted.has(id))),
     };
-    return await establishWorkspacePin(narrowed, realpath, (id, reason) =>
-      session.workspaceSkips.push(`${id} — ${reason}`),
+    const pins = await establishWorkspacePin(
+      narrowed,
+      async (path) => {
+        assertDiscoveryHealthy(session, lifecycle);
+        try {
+          return await (session.discovery.canonicalise ?? realpath)(path);
+        } finally {
+          assertDiscoveryHealthy(session, lifecycle);
+        }
+      },
+      (id, reason) => {
+        assertDiscoveryHealthy(session, lifecycle);
+        skips.push(`${id} — ${reason}`);
+      },
     );
-  } catch {
-    // An unreadable registry is already reported by the catalog and at session start. It does NOT follow that
-    // nothing is blocked — an earlier draft of this comment claimed that and review measured it false, because
-    // a grant supplied through `PI_DADDY_GRANT` never passes the catalog and `workspace:` is exempt from the
-    // unknown check anyway. A session can genuinely hold `workspace:w1` and be refused for want of a pin.
-    // Returning an empty map SETTLES it, so a later reload cannot mint over a registry that has since changed.
-    return new Map();
+    assertDiscoveryHealthy(session, lifecycle);
+    session.workspaceAcceptance = acceptance;
+    for (const skip of skips) session.workspaceSkips.push(skip);
+    return pins;
+  } catch (error) {
+    if (error instanceof BoundedReadCleanupError) {
+      lifecycle.workspacePinFailure = error;
+      throw error;
+    }
+    throw error;
   }
 }
 
-export async function loadProjectDefinitions(session: GrantsSession, cwd: string): Promise<void> {
-  await establishRootPin(session);
+/** Publish a safely observed rejection for delegation, never a fulfilled prior catalog. The extension reports it. */
+export function recordDiscoveryCleanupFailure(
+  session: GrantsSession,
+  error: BoundedReadCleanupError,
+  lifecycle = session.reloadLifecycle,
+): BoundedReadCleanupError {
+  const failure = collectBoundedReadFailures([lifecycle.discoveryCleanupFailure, error])!;
+  lifecycle.discoveryCleanupFailure = failure;
+  if (session.reloadLifecycle === lifecycle) session.discoveryCleanupFailure = failure;
+  return failure;
+}
+
+export function retainDiscoveryCleanupFailure(
+  session: GrantsSession,
+  error: BoundedReadCleanupError,
+  lifecycle = session.reloadLifecycle,
+): void {
+  const failure = recordDiscoveryCleanupFailure(session, error, lifecycle);
+  if (session.reloadLifecycle === lifecycle) {
+    session.catalogReady = Promise.reject(failure);
+    void session.catalogReady.then(undefined, () => undefined);
+  }
+}
+
+/** Terminal owner state, checked independently of a replaceable catalog promise and after every wait. */
+export function assertDiscoveryHealthy(session: GrantsSession, lifecycle = session.reloadLifecycle): void {
+  const failure =
+    lifecycle.discoveryCleanupFailure ??
+    lifecycle.workspacePinFailure ??
+    (session.reloadLifecycle === lifecycle ? session.discoveryCleanupFailure : undefined);
+  if (failure) throw failure;
+  if (session.reloadLifecycle !== lifecycle) throw new Error("discovery owner replaced before publication");
+}
+
+async function delegationCatalog(session: GrantsSession): Promise<Catalog> {
+  const lifecycle = session.reloadLifecycle;
+  assertDiscoveryHealthy(session, lifecycle);
+  const catalog = await session.catalogReady;
+  assertDiscoveryHealthy(session, lifecycle);
+  return catalog;
+}
+
+export async function loadProjectDefinitions(
+  session: GrantsSession,
+  cwd: string,
+  lifecycle = session.reloadLifecycle,
+  selected?: readonly SelectedCommand[],
+): Promise<void> {
+  try {
+    assertDiscoveryHealthy(session, lifecycle);
+    await loadProjectDiscovery(session, cwd, lifecycle, selected);
+  } catch (error) {
+    if (error instanceof BoundedReadCleanupError) retainDiscoveryCleanupFailure(session, error, lifecycle);
+    throw error;
+  }
+}
+
+async function loadProjectDiscovery(
+  session: GrantsSession,
+  cwd: string,
+  lifecycle: ReloadLifecycle,
+  selected?: readonly SelectedCommand[],
+): Promise<void> {
+  await establishRootPin(session, lifecycle);
   const skips: string[] = [];
-  session.definitions = await loadDefinitions(cwd, (_path, reason) => skips.push(reason));
+  assertDiscoveryHealthy(session, lifecycle);
+  const snapshot = selected === undefined ? undefined : await selectedDefinitions(selected);
+  const definitions =
+    snapshot?.definitions ??
+    (await (session.discovery.definitions ?? loadDefinitions)(cwd, (_path, reason) => skips.push(reason)));
+  if (snapshot) skips.push(...snapshot.skips);
+  assertDiscoveryHealthy(session, lifecycle);
+  const ready = buildCatalog(
+    {
+      ...(snapshot ? { snapshot } : {}),
+      cwd,
+      observedTools: session.observedTools,
+      // ADR-0035: `workspace:<id>` is a capability, so the registered ids belong in the catalog the same way
+      // discovered definitions do — for `/grants` to list what this session may route to and for `init` to
+      // scaffold them. Read live rather than cached at load, because the registry is an operator file.
+      registryPath: process.env[ENV_WORKSPACE_REGISTRY],
+    },
+    session.discovery,
+  );
+  session.catalogReady = ready;
+  const catalog = await ready;
+  assertDiscoveryHealthy(session, lifecycle);
+  session.definitions = definitions;
   session.definitionSkips = skips;
-  session.catalogReady = buildCatalog({
-    cwd,
-    observedTools: session.observedTools,
-    // ADR-0035: `workspace:<id>` is a capability, so the registered ids belong in the catalog the same way
-    // discovered definitions do — for `/grants` to list what this session may route to and for `init` to
-    // scaffold them. Read live rather than cached at load, because the registry is an operator file.
-    registryPath: process.env[ENV_WORKSPACE_REGISTRY],
-  });
-  session.catalog = await session.catalogReady;
+  session.catalog = catalog;
 }
 export function createGrantsSession(
   extensionPath: string | undefined,
   lifecycle?: ReloadLifecycle,
   observerExtensionPath?: string,
+  discovery: SessionDiscovery = {},
 ): GrantsSession {
   // ADR-0076 PR 3b: legacy PI_GRANTS_* names are adopted BEFORE the first environment read and before the
   // reload snapshot, or an operator on the old names would get an ungoverned wildcard root (review finding).
@@ -459,34 +584,18 @@ export function createGrantsSession(
   // G7 / A-S4 + B-I4: strict, three-way parsing that fails CLOSED. A malformed bound used to yield
   // `NaN`, and every comparison against `NaN` is false, so depth limiting switched itself off.
   const bounds = depthConfig(environment[ENV_DEPTH], environment[ENV_MAX_DEPTH]);
-  const costConfig = episodeCostConfiguration(storeCwd, environment[ENV_EPISODE_COST_CEILING]);
   const runtimeConfig = projectDefinitionRuntimeConfiguration(storeCwd);
   const depth = bounds.depth;
-  const maxDepth = costConfig.malformed || runtimeConfig.malformed ? 0 : bounds.maxDepth;
+  const maxDepth = runtimeConfig.malformed ? 0 : bounds.maxDepth;
   const emptyCatalog = makeCatalog([]);
-  // ADR-0077. The environment decides whether there is an advisor at all; the project's settings block may only
-  // narrow it. The block IS read — the first version passed `undefined` and every narrowing the release advertised
-  // was dead code reachable only from tests, which review measured: `enabled: false` turned nothing off.
-  //
-  // Read from `storeCwd` for `loadStoredGrantStateSync`'s reason: this factory runs before any hook, so `ctx.cwd`
-  // does not exist yet. Reading a workspace-writable file here is safe precisely because it can only narrow.
-  const advisorSession = createAdvisorSession({
-    block: projectAdvisorBlock(storeCwd, environment),
-    episodeId,
-    ...(storedLedger ? { ledgerPath: storedLedger } : {}),
-  });
+  const capacityState = capacityForLifecycle(activeLifecycle, environment[ENV_FANOUT]);
   const session: GrantsSession = {
-    advisorSession,
     adoptedLegacyEnv,
     governed,
     inherited,
     depth,
     maxDepth,
-    malformedBounds: [
-      ...bounds.malformed,
-      ...(costConfig.malformed ? [costConfig.malformed] : []),
-      ...(runtimeConfig.malformed ? [runtimeConfig.malformed] : []),
-    ],
+    malformedBounds: [...bounds.malformed, ...(runtimeConfig.malformed ? [runtimeConfig.malformed] : [])],
     definitionSkips: [],
     workspacePin: undefined,
     pinSettled: false,
@@ -511,9 +620,9 @@ export function createGrantsSession(
     ownSpawnId: environment[ENV_PARENT_ID]?.trim() || `d${depth}`,
     ownExecutionId: environment[ENV_EXECUTION_ID]?.trim() || undefined,
     episodeId,
-    // The cardinality bound ADR-0008 never had: it attenuates downward like depth, so a subtree can never
-    // create more descendants than its root was given — with no shared state, no lock and no counter file.
-    fanoutBudget: budgetFromEnv(environment[ENV_FANOUT]),
+    fanoutBudget: capacityState.allocator.total,
+    capacity: capacityState.allocator,
+    capacityRefusal: capacityState.refusal,
     /**
      * Review finding S-5, fixed. The comment on the tools has always claimed conditional registration; the
      * call was unconditional, `DELEGATE_CAPABILITY` was imported and never used, and "withhold it and the
@@ -528,8 +637,6 @@ export function createGrantsSession(
     modelResolutionCache: new Map<string, boolean>(),
     definitionRuntimeSettings: runtimeConfig.settings,
     definitionRuntimeOverrides: new Map<string, DefinitionRuntimeChoice>(),
-    sessionModelPrompt: runtimeConfig.prompt,
-    sessionModelPrompted: false,
     extensionPath,
     observerExtensionPath,
     activityRootId,
@@ -538,12 +645,12 @@ export function createGrantsSession(
     sessionApprovalBindings: new Map<string, ApprovalBinding>(),
     inheritedApprovals: parseInherited(environment[ENV_APPROVED]),
     approvalGateFor: createApprovalGateProvider(),
-    episodeCostGate: new EpisodeCostGate(costConfig.ceiling),
     cwd: process.cwd(),
     ownGrant: deriveOwnGrant(inherited, null),
     observed: false,
     observedTools: null,
     definitions: new Map<string, SkillDefinition>(),
+    discovery: Object.freeze({ ...discovery }),
     catalog: emptyCatalog,
     catalogReady: Promise.resolve(emptyCatalog),
     delegationContext: async (approved?: InheritableApproval[]) => ({
@@ -560,21 +667,17 @@ export function createGrantsSession(
       // one through the same builder `publishChildEnv` uses. Read here rather than in the kernel so there is
       // one place that knows the environment is where a session's own pin lives.
       ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
-      // ADR-0078: composition reads, the kernel decides. Called only for a mode that survived the gate.
-      // `options` is forwarded, and its absence is why the second decision point was dead in production: a
-      // one-parameter arrow is assignable to a two-parameter type, so the ids reached here and were discarded while
-      // the advisor had already been asked. Review measured it. `test/pruning-advice.test.ts` now goes through this
-      // function rather than calling the stager directly.
+      // Context is staged only after its capability survives the ceiling, grant and gate.
       stageHandoff: (granted, options) =>
         createHandoffStager({
           cwd: session.cwd,
           forkRoot: join(agentDir(), "context-forks"),
           ...(session.parentSession ? { parentSession: session.parentSession } : {}),
         })(granted, options),
-      catalog: await session.catalogReady,
+      catalog: await delegationCatalog(session),
       // R-32: where each granted skill lives, so `planSpawn` can pass `--skill` for those and only those.
       // Derived from the catalog's own `source`, so it cannot drift from what was discovered.
-      skillPaths: skillPathsFromCatalog(await session.catalogReady),
+      skillPaths: skillPathsFromCatalog(await delegationCatalog(session)),
       // ADR-0016: operator-authored SKILL.md definitions, so `delegate({agent})` can name one.
       definitions: session.definitions,
       // The herdr executor drives the child after starting it, so its plan must NOT carry `--print`.
@@ -603,7 +706,14 @@ export function createGrantsSession(
       }
       session.publishChildEnv();
     },
-    reconcileEnvironment: (environment, lifecycle) => reconcileSessionEnvironment(session, environment, lifecycle),
+    reconcileEnvironment: (environment, lifecycle) => {
+      if (session.reloadLifecycle !== lifecycle) {
+        session.pinSettled = false;
+        session.workspacePin = undefined;
+        session.discoveryCleanupFailure = lifecycle.discoveryCleanupFailure;
+      }
+      reconcileSessionEnvironment(session, environment, lifecycle);
+    },
     publishChildEnv: () => {
       const env = childEnv({
         ownGrant: session.ownGrant,
@@ -629,66 +739,17 @@ export function createGrantsSession(
   return session;
 }
 
-/**
- * The `advisor` block of `.pi/pi-daddy/settings.json`, or undefined.
- *
- * Unreadable, absent or malformed all yield undefined: this file is the reviewable record, not authority, and the
- * only thing it can do to an advisor is turn one off. A parse failure therefore costs nothing worth reporting.
- */
-export function reconcileAdvisorSession(session: GrantsSession, environment: NodeJS.ProcessEnv): void {
-  session.advisorSession = createAdvisorSession({
-    block: projectAdvisorBlock(session.storeCwd, environment),
-    episodeId: session.episodeId,
-    ...(session.ledgerPath ? { ledgerPath: session.ledgerPath } : {}),
-    env: environment,
-  });
-}
-
-function episodeCostConfiguration(cwd: string, inherited: string | undefined): { ceiling: number; malformed?: string } {
-  if (inherited !== undefined) {
-    const value = Number(inherited);
-    return Number.isFinite(value) && value > 0
-      ? { ceiling: value }
-      : { ceiling: episodeCostCeilingFromSettings(undefined), malformed: ENV_EPISODE_COST_CEILING };
-  }
-  const path = projectSettingsPath(cwd);
-  try {
-    const stats = statSync(path);
-    if (!stats.isFile() || stats.size > 1024 * 1024) {
-      return { ceiling: episodeCostCeilingFromSettings(undefined), malformed: "settings.json episodeCostCeiling" };
-    }
-    const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
-    if (parsed && typeof parsed === "object" && Object.hasOwn(parsed, "episodeCostCeiling")) {
-      const value = (parsed as Record<string, unknown>).episodeCostCeiling;
-      if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
-        return { ceiling: episodeCostCeilingFromSettings(undefined), malformed: "settings.json episodeCostCeiling" };
-      }
-    }
-    return { ceiling: episodeCostCeilingFromSettings(parsed) };
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-      return { ceiling: episodeCostCeilingFromSettings(undefined) };
-    }
-    return { ceiling: episodeCostCeilingFromSettings(undefined), malformed: "settings.json episodeCostCeiling" };
-  }
-}
-
 function projectDefinitionRuntimeConfiguration(cwd: string): {
   settings: DefinitionRuntimeSettings;
-  prompt: "ask" | "never";
   malformed?: string;
 } {
-  const empty = { settings: definitionRuntimeSettingsFrom(undefined), prompt: "ask" as const };
+  const empty = { settings: definitionRuntimeSettingsFrom(undefined) };
   try {
     const path = projectSettingsPath(cwd);
-    const stats = statSync(path);
-    if (!stats.isFile() || stats.size > 1024 * 1024) return { ...empty, malformed: "settings.json model defaults" };
-    const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
+    const parsed: unknown = JSON.parse(readBoundedTextSync(path, { maxBytes: 1024 * 1024 }).text);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return { ...empty, malformed: "settings.json model defaults" };
     const root = parsed as Record<string, unknown>;
-    if (root.sessionModelPrompt !== undefined && !["ask", "never"].includes(String(root.sessionModelPrompt)))
-      return { ...empty, malformed: "settings.json sessionModelPrompt" };
     const candidates = [root.defaults, ...(Array.isArray(root.definitions) ? root.definitions : [])];
     for (const candidate of candidates) {
       if (candidate === undefined) continue;
@@ -702,28 +763,10 @@ function projectDefinitionRuntimeConfiguration(cwd: string): {
     }
     return {
       settings: definitionRuntimeSettingsFrom(root),
-      prompt: root.sessionModelPrompt === "never" ? "never" : "ask",
     };
   } catch (error) {
+    if (error instanceof BoundedReadCleanupError) throw error;
     if ((error as NodeJS.ErrnoException).code === "ENOENT") return empty;
     return { ...empty, malformed: "settings.json model defaults" };
   }
 }
-
-function projectAdvisorBlock(cwd: string, env: NodeJS.ProcessEnv = process.env): unknown {
-  // Only when an advisor could exist at all. This runs in every session including every child, before any hook, and
-  // a child can never use the result because `PI_DADDY_ADVISOR` is stripped from it.
-  if (!env[ENV_ADVISOR]?.trim()) return undefined;
-  try {
-    const path = projectSettingsPath(cwd);
-    // Bounded and type-checked first: this is the third unbounded session-start read AGENTS.md warns about, and the
-    // only one whose path a governed child holding `tool:write` can replace with a FIFO — which would hang pi
-    // before any hook exists to report it.
-    const stats = statSync(path);
-    if (!stats.isFile() || stats.size > 1024 * 1024) return undefined;
-    const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
-    return typeof parsed === "object" && parsed !== null ? (parsed as Record<string, unknown>).advisor : undefined;
-  } catch {
-    return undefined;
-  }
-}

package/extensions/workspace-runtime.ts

@@ -184,6 +184,7 @@ export async function releaseDelegationWorkspace(input: {
   reason: string;
   /** Deliberately keep the lease: a herdr writer tab would not close, so the pane may still be live. */
   retain?: boolean;
+  onObservationFailure?: (error: unknown) => void;
 }): Promise<LeaseReleaseOutcome | "retained" | undefined> {
   if (!input.prepared) return undefined;
   // A retained lease writes no `state: "released"`, so the record stays `active` and the NEXT owner reads
@@ -197,7 +198,7 @@ export async function releaseDelegationWorkspace(input: {
     : await input.prepared.lease.release(input.reason);
   if (input.ledgerPath) {
     await appendLedgerEvent(
-      { path: input.ledgerPath, strict: true },
+      { path: input.ledgerPath, strict: !input.onObservationFailure, onFailure: input.onObservationFailure },
       buildWorkspaceLeaseEvent({
         ...(input.episodeId ? { episodeId: input.episodeId } : {}),
         executionId: input.executionId,

package/native/README.md

@@ -0,0 +1,25 @@
+# Captured worker artifact
+
+The packaged Linux x64 helper is built from `worker.c` with the official Zig 0.14.1 compiler
+archive and static musl target pinned in `toolchain.json`. No system compiler or libc is used.
+The distribution is published at <https://ziglang.org/download/>; the archive SHA-256 was checked
+against <https://ziglang.org/download/index.json>. `provenance.json` records all build inputs,
+output bytes/hash and the unmodified license files copied from that archive.
+
+From `packages/pi-daddy`, `npm run build:worker` downloads and hash-checks the pinned archive,
+extracts it into a fresh temporary directory, rebuilds, and writes the binary, checksum,
+provenance, license copies and `src/executors/worker-artifact.ts`. Node 22.19+ and `tar` are required.
+`node scripts/build-worker.ts --verify` repeats the build in a new directory and compares every
+output byte without modifying tracked files; CI runs this on each Node matrix leg. An existing
+archive can be supplied with `PI_DADDY_WORKER_TOOLCHAIN_ARCHIVE`; it must pass the same hash check.
+The temporary compiler is removed after each run. The verified archive cache is under the OS
+temporary directory; it is never part of the npm package.
+
+The runtime verifies the opened executable against the SHA-256 constant compiled into its
+JavaScript before executing that same held descriptor. The adjacent checksum is for independent
+verification, never runtime authority. This binds the artifact to the reviewed package contents;
+it does not protect a package whose JavaScript was modified by the same user.
+
+The build checks ELF64/x86-64 and absence of dynamic/interpreter program headers. Runtime still
+requires the qualified Linux kernel facilities: subreaper, pidfds and `/proc` child enumeration.
+No compiler runs during package installation or execution.

package/native/linux-x64/worker.sha256

@@ -0,0 +1 @@
+981a45591b1de790501ef531f6b0ccc8299b1e9a2d08a7970ccaeeecb9868798