docs(permissions): match grant-file help and load log

Author: TheGreatAxios

docs/IMPLEMENTATION.md

@@ -437,7 +437,7 @@ Printed by `corbits --help` / `-h` from `CLI_HELP_TEXT` in `src/config/index.ts`
 | `resume --pick` / `--list`                 | —                          | Interactive session picker                                                                                                                                                                                                                   |
 | `--cwd <dir>`                              | `process.cwd()`            | Working directory                                                                                                                                                                                                                            |
 | `--config <path>`                          | `~/.corbits/settings.json` | Active settings file for provider definitions and TUI persistence such as `/yolo`; composes with (does not exclude) home-level codex/xai OAuth credentials                                                                                   |
-| `--permissions <path>`                     | —                          | Process-only grant file. Its `approvals` replace user-global and provider-model grants for this process and are not merged with `~/.corbits/permissions.json`. Missing, unreadable, invalid JSON, or a wildcard-only pattern fails at start. |
+| `--permissions <path>`                     | —                          | Process-only grant file. Its `approvals` replace user-global and provider-model grants for this process and are not merged with `~/.corbits/permissions.json`. Session and project grants still apply; project entries still need trust confirmation. Missing, unreadable, invalid JSON, or a wildcard-only pattern fails at start. |
 | `--provider <name>`                        | from settings              | Select a configured provider                                                                                                                                                                                                                 |
 | `--model <id>`                             | provider default           | Select a model for the active provider                                                                                                                                                                                                       |
 | `--profile <name>`                         | —                          | Settings profile                                                                                                                                                                                                                             |

src/permission/store.ts

@@ -341,8 +341,9 @@ export async function loadPermissionsFile(path: string): Promise<Approval[]> {
     throw new Error(`--permissions file must be a JSON object: ${path}`);
   }
   const approvals = (parsed as Record<string, unknown>).approvals;
-  // Startup, seed, and every /permissions reseed funnel through here, so one
-  // log line names the active grant source for the whole process lifetime.
+  // loadConfig, seed, and /permissions list and reseed each call this loader
+  // on their own, so every load logs. A single process-lifetime line would
+  // hide a later read.
   const canonicalPath = await canonicalGrantFilePath(path);
   const list =
     approvals === undefined ? [] : parseApprovalList(approvals, path);