docs: name keep_saved's restore limit in the capability map

The on_restore line said keep_saved "keeps the saved copy". 0.7.11's own
known limits say a skill whose source changed between rig down and the
restore comes back missing, named in the restore's warnings, and nothing
since has fixed it. The map now says so.

CHANGELOG.md

@@ -26,7 +26,7 @@ OpenRig. Two repairs aren't in this release: see Known limits.
   seat's own `OPENRIG_NODE_ID`, on the server and session it read. A terminal
   OpenRig didn't create, a mismarked one or a replaced one is left running, and
   `rig down` exits 2 naming it and how to stop it yourself. A seat joined with
-  `rig attach --self` is in that group. ([#2962](https://github.com/mvschwarz/openrig/pull/2962))
+  `rig attach --self` from a tmux pane is in that group. ([#2962](https://github.com/mvschwarz/openrig/pull/2962))
 - **openrig-core is 0.1.28.** A Codex session kept running across the upgrade
   can ask for hook approval until it's relaunched.
 
@@ -62,9 +62,10 @@ OpenRig. Two repairs aren't in this release: see Known limits.
 
 - Queue content can be erased for closed-work retention and account deletion,
   and a retried create can't bring erased work back. ([#2837](https://github.com/mvschwarz/openrig/pull/2837), [#2843](https://github.com/mvschwarz/openrig/pull/2843))
-- Each send records what's known about its delivery in one
+- A send records what's known about its delivery in one
   `transport.delivery_evidence` event: what was admitted, what reached the
-  input, what the screen check showed, and for which occupant. ([#2937](https://github.com/mvschwarz/openrig/pull/2937), [#2943](https://github.com/mvschwarz/openrig/pull/2943))
+  input, what the screen check showed, and for which occupant. The record is
+  best effort, so a missing one doesn't show there was no send. ([#2937](https://github.com/mvschwarz/openrig/pull/2937), [#2943](https://github.com/mvschwarz/openrig/pull/2943))
 - `rig queue create` advises on an unresolved scope, slice lists show observed
   queue counts, a proof policy can require every listed judge, the execution
   ladder shows each slice's recorded status, `rig queue show` names a handed-off
@@ -150,7 +151,7 @@ OpenRig. Two repairs aren't in this release: see Known limits.
   It doesn't keep a stored host or boot identity, doesn't guard against another
   program running as you, and a daemon restart between losing the tmux server
   and the stop wasn't exercised. For an adopted session, such as a seat joined
-  with `rig attach --self`, `rig seat stop` still suggests `rig down`, which
+  with `rig attach --self` from a tmux pane, `rig seat stop` still suggests `rig down`, which
   leaves that terminal running too. Release it with `rig unclaim <session>`
   (that leaves its process running), then close it in its own terminal. ([#2962](https://github.com/mvschwarz/openrig/pull/2962))
 - **Codex working counter:** a capture that doesn't name its pane keeps the old

docs/as-built/arteries.md

@@ -116,3 +116,5 @@ When a regression reaches a release, add one line: date, issue, artery, and whic
 - 2026-10-24, B6 (0.7.1 candidate `7badb557`), launch and resume (Codex hook trust): after an upgrade from 0.7.0, a Codex seat stopped at "Hooks need review: 6", because Codex 0.164 asks to approve a plugin's whole content again. Caught at the cut, before publication, by a native upgrade run with a real Codex. Missed by source tests and stub scenarios (a stub can't see the real Codex binary) and by the installed-upgrade check (no real Codex). Fixed in #1948. Scenario owed: a cheap real-agent Codex upgrade with approval renewal.
 - 2026-10-24, pane-only attention (#1876 on the 0.7.1 candidate), native observation: a Codex seat waiting at a prompt that only its pane showed read as working, with no attention signal. Caught at the cut, before publication, by real work on a test machine. Missed by fixtures that all carried hook signals. Fixed in #1946. Scenario owed: a stub pane showing a selector with no hook event must read as needing attention.
 - 2026-10-25, #1955, delivery (send readiness): approval-prompt text that a working Claude seat quoted in its own output read as a waiting prompt, so sends and queue wakes to that seat were refused. This one was present since 0.7.0, so it did reach a release; it was found during the 0.7.1 cut by real work on a test machine. Missed by classifier fixtures that had no working pane quoting prompt text. Fixed in #1955 for 0.7.2.
+- 2026-11-10, F4 (0.7.11, #2662 leg (a)), delivery (draft-aware, under Claude's update banner): beneath Claude's bare update banner, a draft-aware delivery pasted the message and withheld Enter, leaving it in the composer, where 0.7.10 held it. Caught at the cut by a native delivery run and accepted with disclosure, so it reached 0.7.11. Missed by footer-grammar fixtures that had no paste hint beside the update notice. Fixed in #2786 for 0.7.12.
+- 2026-11-10, Pi case 1c (0.7.11, #2630), launch (Pi account home): a Pi seat with its own Pi login and a declared absolute `PI_CODING_AGENT_DIR` stopped at launch even with an `auth.json` there, with a misleading missing-account-file error, where 0.7.10 started it. Found at the cut by source and function-level tests, not natively, and accepted with disclosure, so it reached 0.7.11. Not fixed: #2803 (0.7.12) makes the launch error name the real cause, and the stop stands. Scenario owed: a Pi seat with its own login and a declared account home.

docs/reference/getting-started.md

@@ -866,8 +866,8 @@ What it costs:
 ## Stop your teams
 
 `rig down <rig-name>` ends that rig's agent sessions and work in progress.
-A terminal OpenRig didn't start, such as a seat joined with `rig attach --self`,
-is left running: `rig down` names it with the commands to stop it by hand, and
+A terminal OpenRig didn't start, such as a seat joined with `rig attach --self`
+from a tmux pane, is left running: `rig down` names it with the commands to stop it by hand, and
 exits 2.
 Read `rig ps --nodes --rig <rig-name>` first so you can see who will stop;
 `rig down` also prints the rig's recorded agent sessions and their activity

docs/reference/tmux-servers.md

@@ -110,8 +110,8 @@ To move a team that runs on an older server:
    on it, yours included, has ended.
 3. Stop each rig deliberately with `rig down <rig>`. Its seats' sessions end, and a
    turn in progress stops. Queue rows, rigs and seats stay as they are. A session
-   OpenRig didn't start, such as a seat joined with `rig attach --self`, is left
-   running and `rig down` exits 2; stop it with the commands it prints, or it stays on
+   OpenRig didn't start, such as a seat joined with `rig attach --self` from a tmux
+   pane, is left running and `rig down` exits 2; stop it with the commands it prints, or it stays on
    the old server.
 4. Restart the daemon with `OPENRIG_TMUX_CONTROL=1` in its environment.
    `rig terminal status --json` should show `migrationPending: false`. If it's still

packages/daemon/context-packs-src/onboarding-width/public-what-you-can-do.md

@@ -148,9 +148,10 @@ unseen — which makes messages the one delivery channel that never gets skipped
   A seat's typing guard and `--wait-for-idle` retain their checks. Managed compaction follows the
   ordinary draft default and explicit operator protections; it separately reconciles its own
   uncertain `/compact` write before sending restore input. Draft detection isn't complete.
-  **Each send records one `transport.delivery_evidence` event**: what was admitted, what reached
-  the input, what the screen check showed, and for which occupant. Read it as what was known about
-  the delivery, not proof the agent read it; where the input landed can read unknown.
+  **Each send records one `transport.delivery_evidence` event**, best effort: what was admitted, what
+  reached the input, what the screen check showed, and for which occupant. Read it as what was known
+  about the delivery, not proof the agent read it; where the input landed can read unknown, and a
+  missing record doesn't show there was no send.
 - **`rig send --raw`** — send exact text or keystrokes without the From/To envelope;
   the interactive-prompt guard still applies. To deliberately drive an interactive prompt,
   **`--dangerously-interact --reason "<why>"`** is the explicit override and implies raw text.
@@ -684,7 +685,7 @@ not have to tear one down to change it, and you rarely have to start from nothin
   someone edited it.
   **Since 0.7.12 it stops only a tmux session that carries the seat's own `OPENRIG_NODE_ID`**, on the
   server and session it read. A terminal OpenRig didn't create, a mismarked or replaced one, or a seat
-  joined with `rig attach --self` is left running, and `rig down` exits 2 naming it and the manual way
+  joined with `rig attach --self` from a tmux pane is left running, and `rig down` exits 2 naming it and the manual way
   to stop it. Teardown is incomplete for those terminals: if one is yours, look at it and stop it
   yourself, then run `rig down` again.
 - **`rig launch <rig> [seat]`** — one seat is down; start just that one, without disturbing the
@@ -790,6 +791,9 @@ version, from checking the environment to a useful report to the OpenRig team.
   `Daemon starting: launch reserved by pid N since T; not listening yet` in `rig daemon status`, not stopped.
   A start reservation left from an earlier boot is archived by the next start; don't clear it by
   hand.
+- **`rig config set daemon.seat_poll_interval_ms <1000-2000>`** slows how often the daemon reads each seat's
+  activity (default 1000), trading activity freshness for daemon CPU on a large fleet. It's read at daemon start,
+  so restart the daemon to apply it. Near 2000, a slow tmux read can let a working Codex seat briefly read idle.
 - **A busy daemon isn't a down one.** The CLI refuses only when the daemon is confirmed down
   (stopped, stale, a refused probe), its probe is blocked, or it's a sibling home; a busy daemon
   gets the real request. A write that then times out says its outcome is **unknown**: check its
@@ -1270,6 +1274,11 @@ reaching them is ordinary work rather than an escalation.
   a person can decide directly in the TUI's pairing settings. A relay connector that can't accept
   incoming connections can pull instead (`OPENRIG_RELAY_MODE=pull` in the relay secrets file); push
   stays the default, and a person's connector binding can be unset.
+- **The `relay` gateway connector** carries a registered person's questions, updates and notices to a
+  bridge process you run, over loopback HTTP, and takes their replies back with the sender resolved
+  against their bindings. It's off until a person has a relay binding (`rig gateway human add <id> …
+  --binding "relay:<connectorRef>:file:<absolute env file>:primary"`), and the bridge, with its reach to
+  any messaging platform, is yours (`docs/reference/gateway-relay.md`).
 - **`rig gateway channel add <id> --display-name <name> --binding
   slack:<connectorRef>:<secretsRef>:<channelId>`** — a Slack shared channel as one participant,
   `<id>@external` (Slack only). Anyone writing there reaches the team, registered or not. Each row
@@ -1439,6 +1448,12 @@ your circumstances is configuration, and the ones that are not, another agent ca
 - **Move to an existing account home** with `rig provider switch --seat <seat> --to-account <name>
   --account-home <dir> --reason "<why>"` (preview with `--dry-run`). It starts a fresh conversation with a handover
   and retains the seat's address and work. `--clear-account-home --reason "<why>"` returns to configured defaults.
+- **A Pi seat switches accounts** with `rig provider switch --seat <pi seat> --to-account <name> --account-home <dir>
+  --reason "<why>"` (`--dry-run` shows the plan), through a confirmed successor that keeps its model, effort and
+  wrapper. A Pi seat that declares an absolute `PI_CODING_AGENT_DIR` in its `env:` uses that folder as its account
+  home on launch, restart, resume and restore, and needs a readable `auth.json` there, or the launch stops; remove
+  the declaration to keep the managed seat login. A seat that has its own Pi login as well stops at launch even with
+  an `auth.json` there, and the error says why (for example, that the existing login isn't a managed account link).
 - **Claude subscription/API-key switching resumes the same conversation and interrupts work:**
   `rig provider switch --seat <seat> --to-account api --api-key-file <abs>`; return with
   `--to-account plan --token-file <abs>`. The API-key path remains unqualified; verify the resulting
@@ -1580,6 +1595,9 @@ your circumstances is configuration, and the ones that are not, another agent ca
   selected plugin's skills there (into `.claude/skills/` or `.agents/skills/` only for a seat
   without that storage), so don't copy them by hand; read the `plugin_skill_*` warnings if one
   is missing. TDD is no longer a default skill.
+- **`on_restore: follow_source`** on a spec's `resources.skills[]` entry refreshes that skill from its source when
+  a Claude or Codex seat is restored, keeping its conversation; `keep_saved`, the default, keeps the saved copy, but a
+  skill whose source changed after `rig down` comes back missing, named in the restore's warnings.
 - **`rig startup-proof submit`** — answer an explicitly selected authenticated startup challenge.
   Startup adds no proof exercise by default. Declare `startup_proof` with `authenticated` or
   `none` in the applicable startup layers; see `docs/reference/rig-spec.md#startup-block/startup-proof-selection`.