chore(release): prepare 0.6.13 version and installer pins

The root, cli, daemon and ui packages and the lockfile read 0.6.13; tui keeps
its own version. README and getting-started pin the v0.6.13 install script
and describe its ending when rig setup isn't ready.

CHANGELOG.md

@@ -8,6 +8,212 @@ deprecations, and behavioral changes. Breaking changes are called out explicitly
 
 ---
 
+## [0.6.13]
+
+0.6.13 is the quick follow-up to 0.6.12: fixes found by running teams on it
+every day, plus documentation. A Claude seat handed over in place waits for the
+new Claude before its packet is typed, Slack recovers missed messages in mapped
+channels, recent threads and relayed channels, Pi seats honour their reasoning
+effort, an OMP seat can be retried after a provider hiccup, and an existing seat
+can move to a new working folder. It is built from the commit tagged `v0.6.13`.
+The changes since 0.6.12:
+
+### Before you upgrade
+
+- Restart the daemon after upgrading the CLI (`rig daemon stop`, then `rig
+  daemon start`). Migration `117` runs on every upgrade: it adds an empty,
+  Codex-only `provider_account_readings` table, which fills only with
+  `provider.usage_windows` on (off by default) and then keeps each resolved
+  Codex account's readings across a restart
+  ([#1535](https://github.com/mvschwarz/openrig/pull/1535)). There is no
+  migration `116`. From 0.6.11 or earlier, 0.6.12's twelve migrations run first.
+- Expect the bundled openrig-core plugin to go from 0.1.13 to 0.1.14: generated
+  Claude hook commands call the daemon's Node by its absolute path, and existing
+  bare-`node` entries refresh automatically
+  ([#1545](https://github.com/mvschwarz/openrig/pull/1545)).
+- Expect a rig name containing a dot to be refused before anything launches,
+  including when you add a member to an existing one or retry its first start,
+  because tmux would rename the session
+  ([#1500](https://github.com/mvschwarz/openrig/pull/1500)).
+- Expect a Pi seat's `effort` to reach Pi as `--thinking` from its next managed
+  launch, restore or handover
+  ([#1528](https://github.com/mvschwarz/openrig/pull/1528)); managed Claude
+  seats to receive `EDITOR`, `VISUAL`, `DISPLAY`, `XAUTHORITY` and an absolute
+  `WAYLAND_DISPLAY` from their next launch
+  ([#1546](https://github.com/mvschwarz/openrig/pull/1546)); and the shipped
+  agent specs' role file to count as the seat's role after a fresh launch
+  ([#1522](https://github.com/mvschwarz/openrig/pull/1522)).
+- Expect `rig restore-check` to report caveats where it was green for hooks,
+  still exiting 0 ([#1537](https://github.com/mvschwarz/openrig/pull/1537)), and
+  Slack recovery to scan threads inside its seven-day window once from their
+  root on the first start
+  ([#1536](https://github.com/mvschwarz/openrig/pull/1536)).
+- Expect new output, with nothing removed: a model line per seat after `rig ps
+  --nodes`'s table ([#1493](https://github.com/mvschwarz/openrig/pull/1493)), an
+  input-box note on `rig capture`'s stderr
+  ([#1490](https://github.com/mvschwarz/openrig/pull/1490)), the
+  `caller_cancelled` send refusal
+  ([#1513](https://github.com/mvschwarz/openrig/pull/1513)), and JSON fields
+  `modelObservation`, `inputBox`, `signIn`, the Codex restart report's gate
+  fields and `/api/attention` update items
+  ([#1508](https://github.com/mvschwarz/openrig/pull/1508),
+  [#1502](https://github.com/mvschwarz/openrig/pull/1502),
+  [#1054](https://github.com/mvschwarz/openrig/pull/1054)).
+
+### Highlights
+
+- Check a fresh in-place Claude handover's ready result against the current
+  screen, so the packet waits for the successor instead of reaching a shell
+  ([#1553](https://github.com/mvschwarz/openrig/pull/1553), part of
+  [#1544](https://github.com/mvschwarz/openrig/issues/1544)).
+- Recover Slack messages in the channel map's channels, replies in tracked
+  threads whose root was posted or which closed in the last seven days, and
+  channels a hub relays to a machine without its own connection; recovered
+  replies land late and never answer a decision, and a rate limit holds its
+  method across a restart
+  ([#1536](https://github.com/mvschwarz/openrig/pull/1536),
+  [#739](https://github.com/mvschwarz/openrig/issues/739)).
+- Send a Pi seat's `effort` as `--thinking`, with `rig seat set-effort` and `rig
+  seat effort` for Pi ([#1528](https://github.com/mvschwarz/openrig/pull/1528));
+  let an OMP seat take an ordinary retry after a typed transient provider
+  failure ([#1550](https://github.com/mvschwarz/openrig/pull/1550)).
+- Add `rig seat set-cwd <seat> --cwd <absolute-path> --reason <text>` to save an
+  existing seat's working folder for its next fresh launch or rebuild handover
+  ([#1498](https://github.com/mvschwarz/openrig/pull/1498), finishing
+  [#1154](https://github.com/mvschwarz/openrig/pull/1154)).
+- Show the model each seat was last seen using in `rig ps --nodes`, `rig roster
+  show` and `rig roster find`
+  ([#1493](https://github.com/mvschwarz/openrig/pull/1493)).
+- Type nothing later for a send whose caller went away before input started
+  ([#1513](https://github.com/mvschwarz/openrig/pull/1513)); read Claude Code's
+  MCP approval menu ([#1549](https://github.com/mvschwarz/openrig/pull/1549)),
+  Codex's current folder-trust panel
+  ([#1494](https://github.com/mvschwarz/openrig/pull/1494)) and a Codex pane's
+  old menu above an empty composer
+  ([#1548](https://github.com/mvschwarz/openrig/pull/1548)) correctly.
+- Read Linux processes from `/proc` on a worker thread instead of forking `ps`
+  ([#1385](https://github.com/mvschwarz/openrig/pull/1385)).
+
+### Seats, launch and restore
+
+- Prove a Claude launched through a wrapper script by its executable path
+  ([#1540](https://github.com/mvschwarz/openrig/pull/1540)); clear a failed
+  restore's warning after a ready fresh launch
+  ([#1527](https://github.com/mvschwarz/openrig/pull/1527)); read a complete
+  idle screen as idle through terminal repaints
+  ([#1521](https://github.com/mvschwarz/openrig/pull/1521)).
+- Name the Codex startup screen that stopped `rig seat restart
+  --keep-conversation`
+  ([#1502](https://github.com/mvschwarz/openrig/pull/1502)); print the Pi/OMP
+  READY line once per ready transition
+  ([#1401](https://github.com/mvschwarz/openrig/pull/1401)); and report a
+  guidance block's real file in the node-detail API
+  ([#1523](https://github.com/mvschwarz/openrig/pull/1523)).
+
+### Sends, wakes and queue
+
+- Send one message for a seat's parked rows that fall due in the same pass
+  ([#1507](https://github.com/mvschwarz/openrig/pull/1507)); route a stuck-item
+  finding on a person's item to the agent that closed it
+  ([#1495](https://github.com/mvschwarz/openrig/pull/1495), finishing
+  [#1177](https://github.com/mvschwarz/openrig/pull/1177)); and trim spaces in
+  `rig queue list --state`
+  ([#1501](https://github.com/mvschwarz/openrig/pull/1501)).
+
+### Status, TUI and web UI
+
+- Show a sign-in fact on each provider account row
+  ([#1508](https://github.com/mvschwarz/openrig/pull/1508)); show open updates
+  for a person in the TUI's Feed
+  ([#1054](https://github.com/mvschwarz/openrig/pull/1054)); open a seat's
+  terminal in the Herdr the shared TUI is viewed from, on Linux
+  ([#1356](https://github.com/mvschwarz/openrig/pull/1356)); and show an aborted
+  workflow as aborted in the web UI
+  ([#1276](https://github.com/mvschwarz/openrig/pull/1276)).
+- Keep a Codex account's last reading, its reset and its last observed
+  exhaustion across a daemon restart, shown as history rather than a current
+  reading, and show an expectation, never a reading, when a window's reset has
+  passed ([#1535](https://github.com/mvschwarz/openrig/pull/1535)).
+
+### Workflows, commands and messages
+
+- Clear a redriven workflow's old completion time
+  ([#1517](https://github.com/mvschwarz/openrig/pull/1517)); accept a rig name
+  in `rig grow` and `rig remove`
+  ([#1407](https://github.com/mvschwarz/openrig/pull/1407)); give working cmux
+  remedies in `rig doctor`
+  ([#1514](https://github.com/mvschwarz/openrig/pull/1514)) and real remedies
+  for an edited projected file
+  ([#1512](https://github.com/mvschwarz/openrig/pull/1512)); and print the
+  daemon's message from `rig provider`
+  ([#1510](https://github.com/mvschwarz/openrig/pull/1510)).
+
+### Off by default
+
+- Keep the refocus work packet off for both runtimes, and bound its fields when
+  `OPENRIG_REFOCUS_WORK_PACKET=1` turns it on
+  ([#1542](https://github.com/mvschwarz/openrig/pull/1542)).
+
+### Guidance and docs
+
+- Correct the README's machine effects
+  ([#1510](https://github.com/mvschwarz/openrig/pull/1510)); say one working
+  account is enough and list what starting OpenRig writes
+  ([#1539](https://github.com/mvschwarz/openrig/pull/1539)); give a standard Mac
+  user a user-local Node.js route and say what the registry's checks decide
+  ([#1557](https://github.com/mvschwarz/openrig/pull/1557)); explain an adopted
+  seat's restart refusal
+  ([#1509](https://github.com/mvschwarz/openrig/pull/1509)) and comparing token
+  use across machines ([#1505](https://github.com/mvschwarz/openrig/pull/1505));
+  and list the community-built Rig HQ viewer
+  ([#1515](https://github.com/mvschwarz/openrig/pull/1515)).
+
+### Dependency and install-script changes
+
+- End the one-line installer with `INSTALLED, SETUP NOT COMPLETE` when `rig
+  setup` isn't ready, keeping setup's exit status
+  ([#1547](https://github.com/mvschwarz/openrig/pull/1547)).
+
+### Tests and repository checks
+
+- Tie managed `/compact` and parked refocus to their hook effects in tests
+  ([#1538](https://github.com/mvschwarz/openrig/pull/1538)); remove a test
+  fixture's calendar expiry
+  ([#1559](https://github.com/mvschwarz/openrig/pull/1559)); and carry 0.6.12's
+  versions and release text onto development main
+  ([#1558](https://github.com/mvschwarz/openrig/pull/1558)).
+
+### Known limitations
+
+- A fresh in-place Claude handover can still report ready early when the screen,
+  pane or process can't be read or proven
+  ([#1553](https://github.com/mvschwarz/openrig/pull/1553)).
+- Slack recovery doesn't catch up older open threads, doesn't prune its thread
+  coverage file yet, and one Slack app across machines hasn't run on two real
+  machines ([#1536](https://github.com/mvschwarz/openrig/pull/1536),
+  [#1436](https://github.com/mvschwarz/openrig/pull/1436)).
+- Managed compaction's 600-character budget rests on one comparison, nothing
+  confirms compaction ran, two hook runs for one seat aren't serialized, and the
+  plugin's manifest hooks still call bare `node`
+  ([#1483](https://github.com/mvschwarz/openrig/pull/1483),
+  [#1344](https://github.com/mvschwarz/openrig/pull/1344),
+  [#1475](https://github.com/mvschwarz/openrig/pull/1475),
+  [#1545](https://github.com/mvschwarz/openrig/pull/1545)).
+- `rig seat set-cwd` checks the new folder once, and background work can use it
+  before you switch ([#1498](https://github.com/mvschwarz/openrig/pull/1498)).
+- `rig policy current` and plain `rig ps` don't show a policy stored with
+  `--seat` ([#1285](https://github.com/mvschwarz/openrig/pull/1285)); `rig up
+  --env` isn't forwarded for flat-node specs or v1 bundles
+  ([#1294](https://github.com/mvschwarz/openrig/pull/1294)); the draft-aware
+  guard can delay other work for a seat
+  ([#1481](https://github.com/mvschwarz/openrig/pull/1481)).
+- On a Mac with more than one user account, a second user's `rig` commands can
+  reach the first user's daemon on its default port; this release doesn't change
+  that.
+- Managed compaction, refocus after a compaction and snapshot restore behave as
+  in 0.6.12, and 0.6.12's other carried limitations still apply
+  ([#1483](https://github.com/mvschwarz/openrig/pull/1483)).
+
 ## [0.6.12]
 
 0.6.12 is a fix release about recovery and everyday operation, most of it from

README.md

@@ -22,14 +22,14 @@ Not setting this up today? Get the next walkthrough and occasional OpenRig updat
 
 Requires Node.js 22 or 24 and tmux, on macOS or Linux, and one working Claude Code or Codex account: one is enough, since the kernel operator adapts the shipped `starter` team to whichever you have. On Linux, the distribution's own Node.js can be older (Ubuntu 24.04's is 18); install a supported version with [nvm](https://github.com/nvm-sh/nvm) (`nvm install 22`) or NodeSource. On a Mac with Apple silicon, use Node.js 22 ([compatibility history](docs/releases/v0.5.15.md#known-compatibility-limitation)). On a Mac where you aren't an administrator, or where Homebrew belongs to another account (its `brew install` is refused), install Node.js in your own home folder with [nvm](https://github.com/nvm-sh/nvm): run `touch ~/.zshrc` (a new Mac account has none, and nvm's installer only adds itself to a profile file that already exists), then the install command on nvm's page, open a new terminal, and run `nvm install 22`. That needs no administrator password, and `npm install -g` then installs into your nvm folder. On Windows, use WSL2, the Windows route OpenRig supports; native Windows isn't supported. OpenRig's automated tests don't run on WSL2 yet; see [one user's working setup](docs/reference/getting-started.md#wsl2-a-reported-working-setup). Launching a rig writes provider hooks and workspace trust settings. Before running the commands below, read [what OpenRig changes on your machine](#what-openrig-changes-on-your-machine) and back up the relevant files.
 
-**One command.** This runs OpenRig's install script from the `v0.6.12` release. It checks Node.js and npm, installs the latest published `@openrig/cli` with `npm install -g`, runs the Node.js and SQLite check, then runs `rig setup --dry-run` and `rig setup`. The first line prints that plan and changes nothing:
+**One command.** This runs OpenRig's install script from the `v0.6.13` release. It checks Node.js and npm, installs the latest published `@openrig/cli` with `npm install -g`, runs the Node.js and SQLite check, then runs `rig setup --dry-run` and `rig setup`. The first line prints that plan and changes nothing:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.12/scripts/install.sh | sh -s -- --dry-run
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.12/scripts/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.13/scripts/install.sh | sh -s -- --dry-run
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.13/scripts/install.sh | sh
 ```
 
-If a provider isn't signed in yet, the last step reports `FAILED [4/4]`, and `rig setup` lists the sign-in under "Some steps need attention". If the only remaining failures are provider sign-ins, the install steps finished; sign in to each selected provider as below and continue.
+If `rig setup` doesn't finish ready, for example because a provider isn't signed in yet, the script ends with `INSTALLED, SETUP NOT COMPLETE`: the CLI is installed, and `rig setup` lists what's left under "Some steps need attention". If the only items left are provider sign-ins, sign in to each selected provider as below and continue; run `rig setup` again rather than reinstalling the CLI.
 
 **Or step by step:**
 

docs/reference/getting-started.md

@@ -131,19 +131,20 @@ You can also read [`skills/rigs/SKILL.md`](../../skills/rigs/SKILL.md) directly.
 script will do and changes nothing:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.12/scripts/install.sh | sh -s -- --dry-run
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.13/scripts/install.sh | sh -s -- --dry-run
 ```
 
 The same command without `--dry-run`,
-`curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.12/scripts/install.sh | sh`, installs the
+`curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.13/scripts/install.sh | sh`, installs the
 latest published `@openrig/cli` with `npm install -g`,
 runs the Node.js and SQLite check, then `rig setup --dry-run` and `rig setup`. `rig setup` checks both Claude Code and
-Codex and may install a missing one, as described below. A failed step prints
-`FAILED [n/4] <command or check> (exit <code>)`. Where a provider isn't signed in yet, step 4 ends that way and
-`rig setup` lists each sign-in under "Some steps need attention". If the only remaining failures are provider
-sign-ins, the install steps finished: sign in to each selected provider as below, then continue at
-[Start the kernel](#start-the-kernel-and-check-its-state). To install only what the selected providers need, go step
-by step instead:
+Codex and may install a missing one, as described below. A failed step among the first three prints
+`FAILED [n/4] <command or check> (exit <code>)`. When `rig setup` (step 4) doesn't finish ready, for example because a
+provider isn't signed in yet, the script ends with `INSTALLED, SETUP NOT COMPLETE (exit <code>)`: the CLI is
+installed, and `rig setup` lists what's left under "Some steps need attention". If the only items left are provider
+sign-ins, sign in to each selected provider as below, then continue at
+[Start the kernel](#start-the-kernel-and-check-its-state); run `rig setup` again rather than reinstalling the CLI. To
+install only what the selected providers need, go step by step instead:
 
 ### Choose your providers
 

docs/reference/whats-new.md

@@ -1,7 +1,7 @@
-# What changed in OpenRig 0.6.12
+# What changed in OpenRig 0.6.13
 
-This note is for an agent on an install that was just upgraded to 0.6.12. It lists only what behaves differently from
-0.6.11 and what to do about it. For everything OpenRig can do, read the capability map:
+This note is for an agent on an install that was just upgraded to 0.6.13. It lists only what behaves differently from
+0.6.12 and what to do about it. For everything OpenRig can do, read the capability map:
 `rig context get onboarding-width/public-what-you-can-do.md`. Each release replaces this file, so
 `rig context get reference/whats-new.md` describes the installed version once the upgraded daemon is running. Without
 a running daemon, read `$OPENRIG_HOME/reference/whats-new.md`. The daemon refreshes that copy when it starts, so right
@@ -9,181 +9,108 @@ after an upgrade it can still hold the previous version's note.
 
 ## After the upgrade
 
-- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Twelve migrations run on the first start,
-  whatever you use: `100`, `104`, `105`, `107` to `115`. They add columns and tables for the typing guard's modes, a
-  seat's saved effort, Claude's cost estimate, Pi usage, mode and posture categories, workflow scope, seat environment
-  values, the Codex `--no-daemon` record and `sessions.agent_app`; build two indexes for recent queue activity (about
-  10 to 12 MB on a long-running install); and rebuild the Slack thread map. There are no migrations `102` or `106`.
-- **Claude seats now run the openrig-core plugin's hooks.** The bundled plugin goes from 0.1.9 to 0.1.13. A Claude
-  seat whose plugins include `openrig-core` (every shipped agent spec selects it) starts with `CLAUDE_CODE_PLUGIN_DIRS`
-  pointing at OpenRig's copy, so the activity relay, the compaction save and restore hooks and refocus actually run. It
-  needs Claude Code 2.1.280 or later, which nothing checks. A running seat picks it up at its next launch, restore or
-  handover. The refocus hook may take up to 60 seconds, so a hung refocus can hold a prompt that long.
-- **Six new settings, all off except one:** `output.whoami_peers` (8, used only while `output.compact` is on),
-  `bundle.services_enabled`, `provider.subscription_moves`, `usage.pi_cost_facts`, `usage.pi_openrouter_charge` and
-  `transport.verify_input_box`. See "Off by default" below.
+- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Migration `117` runs on every upgrade: it adds
+  an empty, Codex-only `provider_account_readings` table. It fills only with `provider.usage_windows` on (off by
+  default), and then keeps each resolved Codex account's readings across a restart. There's no migration `116`.
+  Coming from 0.6.11 or earlier, 0.6.12's twelve migrations run first.
+- **The bundled openrig-core plugin goes from 0.1.13 to 0.1.14.** Generated Claude hook commands in a project's
+  `.claude/settings.local.json` call the daemon's Node by its absolute path; existing bare-`node` entries refresh on
+  their own, and a person's wrapper is kept. The plugin's own manifest hooks still call bare `node`.
+- **Seats pick up some changes only at their next launch:** a Pi seat's `effort` (sent as `--thinking`), a managed
+  Claude seat's `EDITOR`, `VISUAL`, `DISPLAY`, `XAUTHORITY` and `WAYLAND_DISPLAY`, and the shipped agent specs' role
+  file as the seat's role. Use `rig seat launch <seat> --fresh --stop --reason "<why>"` only when the person wants it
+  now; don't relaunch a working team just to pick these up.
+- **Slack recovery's first pass after the upgrade** scans tracked threads inside the seven-day window once from their
+  root. Replies that already landed aren't delivered twice; recovered ones land as late rows that never answer a
+  decision.
 
 ## Output that changed shape
 
-- **Exit codes:** eleven client-fixable `rig queue update` refusals now answer HTTP 400 and exit 1 instead of 500 and
-  exit 2 (`blocker_not_found`, `blocker_not_live` and `blocker_malformed` still exit 2). `rig ask` exits 1 for an
-  unknown or ambiguous rig. `rig compact` exits 1 (was 2) for `pane_unknown_protected`, and its route answers 409 (was
-  502). Over the shared transport, a write that throws without a code makes `rig send` exit 1 with HTTP 409 instead of 2
-  with 500, and a guarded send whose text was written returns `sent: true` with `inputPhase: "written"`.
-- **`rig compact` and `rig compact --state` add a `compact` result:** `submitted_unconfirmed` (shown as "submitted,
-  unconfirmed"), `uncertain` or `not_sent`. "Submitted" means `/compact` and Enter reached the seat, not that compaction
-  ran.
-- **`rig capture --lines N --json`** adds `activity: "unknown"` and `activityNote` when lines were cut.
-- **`rig start --last --json`** carries `keptDown` (always) and `warnings` (`seat_status_unreadable`).
-- **`rig queue show <id> --full`** on a closed row adds `closingTransition`; plain `rig queue show` on such a row reads
-  `readView.complete: false` and lists it in `omittedFields`. `rig queue show` returns `resolution` when a close stored
-  one.
-- **After `rig down`,** `rig ps`, the TUI and the rig summary read the rig `stopped`, not recoverable, and
-  `hasLiveAgents` can read `false`.
-- **`rig seat status`** reads `Typing guard: on (hold)` for hold, and its JSON's `desired` and `effective` mean hold only;
-  `desiredMode` and `effectiveMode` give the mode.
-- **`rig usage top`** measures tokens and rates within one conversation and one window, so figures can drop and more
-  seats read `insufficient_samples`.
-- **The execution view** binds a row to a mission by its exact `mission:` tag first; `q1_lanes[].waiting` and
-  `folded.merge_report` are new.
-- **Smaller:** `rig create --json` carries `detail` on failure; `rig status --json` is new; `rig mcp serve` lists 23 tools
-  (five queue tools added); a JSON body of `null` gets 400 `invalid_json`; `GET /api/events` takes `?replay=`; a Slack
-  seat post's sender line ends `on <host id>`; `rig ps --nodes` `resumeCommand` can carry `--no-daemon`.
+- **`rig ps --nodes`** prints one line per seat after the table: `Model (<session>): configured <m>; last observed
+  <model> (<source>; native record <time>)`, or `UNKNOWN (<reason>)`. JSON carries `modelObservation`; compact output
+  is `[model, source, time]`, `{status: "unknown", reason}`, or `null` from an older daemon. Roster
+  `live.observedModel` is now filled in.
+- **`rig capture`** writes `[rig capture: <seat>: input box: <hint>]` to stderr for a Claude Code or Codex seat; stdout
+  is unchanged. `--json` and the MCP tool carry `inputBox` (`status`, `confidence`, `cursor`, regions, `evidence`,
+  `hint`). It's a heuristic: `unknown` means unknown.
+- **`rig provider status`** rows carry a sign-in fact (`usable`, `needs sign-in`, `unknown`; JSON `signIn`). A
+  signed-in Claude login never reads better than `unknown`. A signed-out Codex login reports `not_signed_in`, not
+  `rpc_error`.
+- **`rig provider status`** (with `provider.usage_windows` on) Codex rows keep their last reading across a daemon
+  restart as history (`retained: "before_restart"`), labelled "kept from before the daemon restarted; not a current
+  reading", with availability unknown until a fresh read. Rows add `accountHistory` (`linked`, or `unknown`; every
+  Claude row is `unknown`), `lastObservedExhausted`, `retained` and, on an inactive account, `savedProfile: "not
+  linked"`. A window whose reset has passed gains `expectation`: planning, not a reading. Run `rig provider status
+  --refresh` before telling anyone an account has room.
+- **`rig send`** can refuse with `caller_cancelled` (HTTP 409, `sent: false`, `inputPhase: "not_reached"`) when its
+  caller went away before input started.
+- **`rig seat restart --keep-conversation`** reports name a Codex startup screen: `Codex startup gate (<kind>): …`, and
+  JSON gains `codexNoDaemonFlag`, `processMode` (always `unknown` for now) and `account.startupGateKind`.
+- **`rig restore-check`**'s hook check can read `ready_with_caveats` where it read green; the exit code is still 0.
+- **`GET /api/attention`** adds `queue-update:<qitemId>` items and a `"queue updates"` source.
+- **The node-detail API's `targetPath`** names the file a guidance block is really in, or `""`; `declaredTarget` and
+  `effectiveTarget` are new.
+- **`rig grow --json`'s `rigId`** is the resolved id, and `rig grow` and `rig remove` can return `rig_ambiguous`.
+- **The one-line installer** ends with `INSTALLED, SETUP NOT COMPLETE (exit N)` when `rig setup` isn't ready.
 
 ## Seats and restore
 
-- **`rig start --last` leaves down a rig stopped on purpose** (`rig down` or `rig seat stop`) and prints how to bring it
-  back: `rig start --rigs <rig>`, or `rig up '<name>' --existing`.
-- **An ordinary terminal seat relaunches fresh on restore** and re-runs its startup actions; don't answer `--fresh` for
-  it. A missing required startup file for such a seat blocks the whole restore before anything launches.
-- **Restore stops a seat whose current runtime differs from its snapshot's,** before launching it; `--fresh` doesn't
-  bypass it. Restore from a snapshot taken with the seat's current runtime.
-- **A slow Claude restore ends `attention_required`, not failed:** "Claude resume did not finish within Ns; Claude may
-  still be starting, so the launch was kept". Look at the pane, and once Claude is up run `rig seat clear-attention`.
-  Each such seat can add up to about the readiness timeout, one after another, so `rig up` can pass its 120-second
-  wait while the daemon keeps working: check `rig ps` before running it again.
-- **"Returned to a shell" now means the process tree shows an idle shell.** "The pane shows a shell that is not a proven
-  idle shell; a launch script may still be starting …" means the seat may still be coming up. A Pi or OMP seat at a
-  bare shell reads `attention_required`.
-- **A Codex fork whose new conversation ID arrives late** stops at `attention_required` with its startup context kept;
-  let it finish starting, then run `rig seat continue <seat>`. A handover to a Codex fork can complete with `Fork id:
-  PENDING`.
-- **A seat whose startup failed for a recoverable reason** becomes ready after a successful send or capture.
-- **`rig launch` takes a rig's name as well as its ID;** a name two active rigs share stops with `rig_ambiguous`.
-- **`rig add`, single-seat `rig launch` and `rig launch --seats` wait up to 120 seconds.** A timeout still isn't a
-  rollback.
-- **A runtime `--version` check gives up after 30 seconds.** `rig bootstrap` blocks on a runtime that's installed but
-  fails its check, reported apart from one that's missing; `rig up`'s preflight fails a Claude, Codex or OMP check that
-  doesn't answer (a warning for Pi).
-- **Claude login detection:** only a current refusal reads `login_required`, not the "Not logged in" footer alone.
-- **Model pins:** `fable` now names `claude-fable-5-1`, a trailing `[1m]` is set aside, and pinned Pi seats are checked
-  (a `:high`-style thinking suffix is accepted).
-- **A custom permission policy saved with CRLF line endings** now takes effect at the next launch or restore, instead
-  of the advisory floor.
-- **`rig scope mission create`** writes `status: planned`; set it `active` to count it in `rig proof show --project`.
-  With `--workspace <project>`, missions go under the project's declared `missions.root`.
+- **A fresh in-place Claude handover** checks a ready result from the old pane's history against the current screen,
+  so the packet waits for the successor. It can still admit early when the screen, pane or process can't be read or
+  proven: check that the successor read its packet.
+- **A Claude launched through a wrapper script** is proven by its executable path; a restored auto-mode seat resumes
+  ready.
+- **After a failed restore, a ready `rig seat launch --fresh`** clears the old restore warning, and `rig seat
+  clear-attention` no longer refuses for it.
+- **A complete idle Claude Code or Codex screen** reads `idle` through terminal repaints.
+- **Claude Code's MCP-server approval menu** reads `mcp_gate` and needs input; a restore doesn't call it ready, and an
+  ordinary send is refused instead of pasted. A fresh running hook still sends into it.
+- **Codex's "Trust this folder?" panel** reads `trust_gate` during launch, resume and restore.
+- **A rig name with a dot** is refused at launch, at adding a member and at a first-start retry.
 
 ## Sends, wakes and the queue
 
-- **A send to a pane in tmux copy or view mode** leaves the mode and delivers; `pane_in_mode` means the pane couldn't
-  leave its mode. Leave it in that pane, then send again.
-- **`rig send --dangerously-interact` types exactly what you give it.** Enter is added only for a complete answer
-  staged in a recognised Claude Code or Codex input box; anywhere else, put CR in the payload. With `--verify` it reads
-  unchecked.
-- **A Codex seat reads "needs you" only when a real prompt is visible;** a pending permission request reads
-  `permission_request_pending` first, and an unreadable pane gets `permission_request_unverified` after a grace.
-  Codex's `»` prompt is recognised.
-- **Managed `/compact` is short enough to run and is sent only to an idle seat.** Confirm compaction by effect: the
-  restore request, or the drop in context.
-- **A held-back (`retained`) wake doesn't use up a one-shot park timer;** it's tried again at the interval. You don't
-  need to re-arm after one.
-- **A retired watchdog doesn't deliver a late wake.** A row parked on its owner's own repeating reminder reads
-  `servedByOwnReminder` in `rig parked` and draws no extra parked-owner wake.
-- **`rig queue update <id> --summary "<text>"`** alone corrects a row's subject. Close with **`--resolution
-  "<outcome>"`** to store the outcome on the row.
-- **`rig remove` and `rig shrink`** keep a seat that gets work while stopping (409, `retained: true`) unless
-  `--fallback` takes it. A stale `rig unclaim` is refused with `session_not_current`.
+- **A send whose caller went away** types nothing, then or later, if no input had started.
+- **An old numbered menu in a Codex pane's scrollback** no longer blocks a send when a complete empty input box sits
+  below the status row.
+- **An OMP seat** whose turn ended with a typed transient provider failure (408, 429, 500, 502, 503, 504 or 529) can
+  take an ordinary `rig send` retry; nothing retries on its own.
+- **Parked rows for one seat that fall due in the same pass** arrive as one message naming each row.
+- **A stuck-item finding on a person's item that an agent closed** goes to that agent, not the person.
+- **`rig queue list --state "pending, in-progress"`** matches both states.
 
 ## New things you can do
 
-- **Set one seat's reasoning effort:** `rig seat set-effort <seat> --effort <level> --reason "<why>"` (or `--clear`); it
-  applies at the next managed launch, not to the running process. Check it with `rig seat effort <seat>`.
-- **Change a seat's stored permission policy:** `rig policy apply <policy> --seat <seat> --reason "<why>"`. `rig policy
-  current` and plain `rig ps` don't show it; `rig seat status` does.
-- **Give seats environment values:** `env:` on the rig or a member in `rig.yaml`, or `rig up <spec> --env KEY=VALUE` for
-  one launch. Never put secrets there.
-- **Scope a workflow run:** `--project`, `--mission`, `--slice` and `--tags` on `rig workflow instantiate` and `run`;
-  write a target as `member@{rig}` to follow the bound rig.
-- **Read cost:** `rig usage cost [--seat <session>] [--json]`. A missing figure is never $0, and Claude's figure is an
-  estimate, not an invoice.
-- **Hand work over without a shell:** `rig mcp serve` with `OPENRIG_SESSION_NAME` set gives `rig_queue_create`,
-  `rig_queue_show`, `rig_queue_list`, `rig_queue_claim` and `rig_queue_update`. Nothing wakes that agent.
-- **`rig status --json`:** treat `daemon.reachable: null` as unconfirmed, not down.
-- OpenRig 0.6.12 adds `rig community-harness list` for installed community-harness presets, showing their maintainer
-  and declared limits. These harnesses are not tested by OpenRig. Support is launch-only: no resume or fork, no
-  resource projection or startup-file delivery, and identity remains unconfirmed. A quiet screen is not proof that the
-  seat is idle. (#1392, #1518)
-- **Guidance:** the `rigs` skill offers to join the team before the first operator message, and offers Codex users one
-  removable rules file; `delegating-work` says to brief a peer by the model `rig ps --nodes --json` shows; the operator
-  reads `$OPENRIG_HOME/reference/keeping-a-watch.md` when asked to watch or remind, including a low-allowance warning.
-- User-visible text says "harness" for the agent software around a model, and "community harness" for one an outside
-  contributor maintains; `docs/reference/topology-naming.md` defines the terms. (#1506)
+- **Move a seat to a new working folder:** `rig seat set-cwd <seat> --cwd <absolute-path> --reason <text>` saves it
+  for the next fresh launch or rebuild handover; the running agent doesn't move. Switch promptly with `rig seat launch
+  <seat> --fresh --stop --reason "<why>"` or a rebuild handover, and not after a `rig down`/`rig up` or fork handover.
+- **Set a Pi seat's effort:** `rig seat set-effort <seat> --effort <level> --reason "<why>"` and `rig seat effort
+  <seat>` now work for Pi.
+- **See which model a seat was using:** `rig ps --nodes`, `rig roster show`, `rig roster find`.
+- **Use a rig name in `rig grow` and `rig remove`.**
+- **Slack:** missed messages in mapped channels, recent threads and relayed channels are recovered; `rig slack status`
+  shows a line per channel and a thread line.
 
 ## Off by default
 
-- **`output.compact`** now also shortens `rig queue show` and `rig queue transitions` (`--full` for everything) and
-  bounds `rig whoami --json` peers to `output.whoami_peers` (`--all-peers` lists all).
-- **`provider.usage_windows`** now also shows Claude's windows, each seat's configured account and, with
-  `--all-hosts` or `--hosts`, every registered machine's windows. A Claude account's current availability always reads
-  `unknown`: don't tell a person an account has room from a seat's reading.
-- **`usage.pi_cost_facts`** and **`usage.pi_openrouter_charge`** take effect when a Pi seat next launches or resumes, not
-  at once; what was recorded stays visible after they're turned off.
-- **`provider.subscription_moves`** enables `rig provider moves`. The `openrig-user` skill's section for it mentions apps
-  that don't ship in this release.
-- **`bundle.services_enabled`**, **`transport.verify_input_box`**, the per-seat draft-aware typing guard (`rig seat
-  set-typing-guard <seat> --mode draft-aware`), `rig bundle create --include-login-files`, `OPENRIG_TMUX_CONTROL=1`
-  and `OPENRIG_REFOCUS_BUDGET_MS` (4500 to 52000) each act only when chosen.
-- **The daemon runs tmux without `/bin/sh`** on Linux and macOS; `OPENRIG_TMUX_SHELL=1` at daemon start keeps the old
-  path.
+- **The refocus work packet** stays off for Claude Code and Codex. With `OPENRIG_REFOCUS_WORK_PACKET=1`, its fields
+  are bounded (about 160 characters per summary, 20 held and 10 next rows, about 1,500 characters per section).
 
 ## What to stop doing
 
-- **Stop looking up a rig's ID before `rig launch`;** the name works.
-- **Stop expecting `rig start --last` to bring back a rig taken down on purpose;** use `rig start --rigs <rig>` or `rig
-  up '<name>' --existing`.
-- **Stop counting on `--dangerously-interact` to press Enter;** put CR in the payload.
-- **Stop taking the preparation prompt's delivery as the compaction's result;** read the `compact` result and confirm by
-  effect.
-- **Stop answering `--fresh` for an ordinary terminal seat on every restore.**
-- **Stop branching on exit 2 for a fixable `rig queue update` refusal;** it's exit 1.
-- **Stop recreating a seat, or editing the database, to change its permission policy;** use `rig policy apply --seat`.
+- **Don't read `FAILED [4/4]` from the installer as a failed install:** the script now says `INSTALLED, SETUP NOT
+  COMPLETE`, and the fix is `rig setup` again, not a reinstall.
+- **Don't rely on Slack recovery for older open threads:** only threads whose root or close is within seven days are
+  caught up.
 
-## Known gaps in 0.6.12
+## Known gaps in 0.6.13
 
-- **Managed compaction's 600-character budget** rests on one comparison on Claude Code 2.1.282, and nothing confirms
-  compaction ran.
-- **The plugin hooks haven't run through this path in a real session,** and two hook runs for one seat aren't
-  serialized: a post-compaction record can be lost or a refocus delivered twice.
-- **One Slack app across machines was simulated in one process,** never run on two real machines. Relayed events are
-  trusted from the calling daemon, and `rig slack verify` on the hub doesn't check relayed channels.
-- **`env:` values aren't secret,** and members added with `rig grow` can't carry a member-level `env:`.
-- **`rig up --env` is not forwarded for flat-node specs or v1 bundles,** although the launch may succeed. Do not rely on
-  the flag for those formats in this release.
-- **The draft-aware guard waits for idle inside the seat's delivery lease,** which can delay other work for that seat.
-- **With `bundle.services_enabled` on, `rig up <file>.rigbundle` installs into the current folder** when no `--target` is
-  given.
-- **`rig seat restart --keep-conversation` supports Linux only,** and hasn't been re-run on 0.6.12.
-- **The rig status API can call a running rig `blocked`** because of one seat that isn't running: it folds a restore
-  forecast into current status.
-- **A Codex seat can keep reading as at its usage limit** in a constructed screen case not seen in a real session.
-- **After `rig scope slice create` says it couldn't verify membership, the slice was kept.** Check `mission.yaml` before
-  creating it again.
-- **A Claude Code seat whose permission request was approved automatically can still read "needs input";** the Codex
-  case is fixed.
-- **Codex team seats aren't asked before lifecycle commands yet.**
-- **The send gate trusts the most recently recorded hook;** `rig capture` shows the real screen.
-- **A launched team still writes into its working folder;** the operator says what changes before you agree.
-- **After a restart, `rig status` shows `Kernel: skipped` whatever the kernel seats' state.** Read them with
-  `rig ps --nodes --rig kernel --full`.
-- **`rig tui --shared` still attaches on the default tmux server,** so use `rig tui` when the daemon runs on a non-default
-  tmux socket.
+- **On a Mac with more than one user account,** a second user's `rig` commands can reach the first user's daemon on
+  its default port (7433). Running each user's daemon on its own port lets both work but doesn't keep them apart.
+- **Managed compaction, refocus after a compaction and snapshot restore** behave as in 0.6.12: confirm a compaction by
+  its restore request or the drop in context, and check that a restored seat is really working.
+- **A fresh in-place Claude handover** can still report ready early when the screen, pane or process can't be read or
+  proven.
+- **One Slack app across machines** hasn't run on two real machines, and Slack recovery doesn't catch up older open
+  threads.
+- **`rig seat set-cwd`** checks the new folder once; switch promptly.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "openrig",
-  "version": "0.6.12",
+  "version": "0.6.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "openrig",
-      "version": "0.6.12",
+      "version": "0.6.13",
       "license": "Apache-2.0",
       "workspaces": [
         "packages/daemon",
@@ -7068,7 +7068,7 @@
     },
     "packages/cli": {
       "name": "@openrig/cli",
-      "version": "0.6.12",
+      "version": "0.6.13",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -7103,7 +7103,7 @@
     },
     "packages/daemon": {
       "name": "@openrig/daemon",
-      "version": "0.6.12",
+      "version": "0.6.13",
       "license": "Apache-2.0",
       "dependencies": {
         "@hono/node-server": "^1.13.0",
@@ -7145,7 +7145,7 @@
     },
     "packages/ui": {
       "name": "@openrig/ui",
-      "version": "0.6.12",
+      "version": "0.6.13",
       "license": "Apache-2.0",
       "dependencies": {
         "@fontsource-variable/jetbrains-mono": "^5.2.8",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openrig",
-  "version": "0.6.12",
+  "version": "0.6.13",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/cli",
-  "version": "0.6.12",
+  "version": "0.6.13",
   "type": "module",
   "description": "Build your own network of agents from Claude Code, Codex and Pi: persistent teams with roles, shared context and owned work.",
   "keywords": [

packages/daemon/context-packs-src/onboarding-width/public-what-you-can-do.md

@@ -11,7 +11,7 @@ not know exists.** So the point of what follows is not skill. It is recognition:
 lands, something rhymes, and you go check instead of building.
 
 Eighty-eight top-level verbs ship (capability canon refreshed through
-`capability-delta-v0.6.12`). This marker describes the pack's teaching, not publication or live
+`capability-delta-v0.6.13`). This marker describes the pack's teaching, not publication or live
 adoption. Read this once for shape, and let it make you suspicious that a thing already exists.
 Model-divergence proclamations are live product (trust them; pins use canonical
 model IDs).
@@ -32,6 +32,11 @@ one command away. Your memory of the fleet is a claim about the past.
   filters to running and **hides detached, exited and attention states** — which are exactly the
   cells you were scanning for. A seat whose tmux session is confirmed gone reads `detached`
   (activity reason `session_missing`), and `rig ps --nodes` says to restore or relaunch it.
+  `rig ps --nodes` also shows the model each seat was last seen using (`modelObservation`, with its
+  source and time), or unknown; it never shows the configured model in its place. A Claude seat at
+  Claude Code's MCP-server approval menu reads as needing input (`mcp_gate`), a Codex seat at its
+  folder-trust panel reads `trust_gate`, and an OMP seat whose turn ended with a typed transient
+  provider failure reads idle and takes an ordinary retry.
   **`rig ps --resources`** shows this host's load and transcript capture cost.
 - **`rig ps --all-hosts --nodes -A`** — the same across every registered machine. Rollup-only
   unless you ask for nodes.
@@ -74,7 +79,7 @@ one command away. Your memory of the fleet is a claim about the past.
 - **`rig roster list` / `show` / `find`** — who across your rigs and hosts is recommended for a
   kind of work, from JSON rosters in `<workspace.root>/rosters`. Read-only: it dispatches nothing
   and does not claim anyone is available. The built-in starter and factory leads publish their
-  team's roster at first start.
+  team's roster at first start. `show` and `find` include each seat's last observed model.
 - **`rig telemetry events` / `transitions` / `tenures <node-id>`** — past events, queue
   transitions and a seat's occupants, one bounded page at a time with gaps reported. Reach for it
   before querying the database yourself.
@@ -98,7 +103,9 @@ unseen — which makes messages the one delivery channel that never gets skipped
   that seat aren't held behind it; N is a deadline from the start of the wait.
   Over `--host` to an http-registered host, a send that may have reached the remote reads
   `remote-outcome-unknown` ("Delivery UNCONFIRMED"): check the target with `rig capture <session>
-  --host <id>` before any resend. Only a host that was never reached reads as unreachable.
+  --host <id>` before any resend. Only a host that was never reached reads as unreachable. A send
+  whose caller goes away (Ctrl-C, or its own timeout) before input starts is refused with
+  `caller_cancelled` and never types later.
 - **`rig send --raw`** — send exact text or keystrokes without the From/To envelope;
   the interactive-prompt guard still applies. To deliberately drive an interactive prompt,
   **`--dangerously-interact --reason "<why>"`** is the explicit override and implies raw text.
@@ -116,7 +123,9 @@ unseen — which makes messages the one delivery channel that never gets skipped
   every seat in one call. `--lines N` is the last N lines (stderr says how many earlier lines were
   cut); `--history-plus-pane` gives the older N history lines plus the whole pane. A short capture
   doesn't prove a seat is idle: a capture that cut lines says activity is unknown (`activity:
-  "unknown"` in `--json`), so read `rig ps --nodes` for it.
+  "unknown"` in `--json`), so read `rig ps --nodes` for it. For a Claude Code or Codex seat, stderr
+  notes whether the input box's text looks typed or like a faint harness suggestion (`inputBox` in
+  `--json`); it's a heuristic, and `unknown` means unknown.
 - **`rig transcript <seat>`** — what has been *said* in a seat, and **seat-scoped rather than
   session-scoped**: one file spanning every agent generation that has occupied it, so it reaches
   back through handovers. Capped (`transcripts.lines`, default 1000 — raise it for depth), and
@@ -170,7 +179,10 @@ unseen — which makes messages the one delivery channel that never gets skipped
 - **`rig slack`** — inspect and manage one connector implementation. Use registered-human
   readiness for the delivery decision and `queue create --verify` for its receipt; connector
   setup or verification is not an outbound human message. After a connection gap the daemon
-  catches up on missed channel messages and marks them late; `rig slack status` shows the
+  catches up on missed messages in the channels this machine owns (its default channel, its
+  channel map's, and on a relayed machine each channel the hub has relayed to it) and on replies
+  in tracked threads whose root or close is within seven days; recovered replies are marked late
+  and never answer a decision. `rig slack status` shows the
   connection, the catch-up state, and the count of retained retry records for inbound messages,
   reactions and click answers (kept across restarts, not a distinct-message count). A retained alert whose row closed before its retry isn't
   posted; the row says why. Its `Delivery:` line says whether events are confirmed arriving;
@@ -389,7 +401,8 @@ not have to tear one down to change it, and you rarely have to start from nothin
 - **`rig up <source>`** — make a whole rig exist and run: from a spec you wrote, a shipped starter
   by name, a bundle someone handed you, a GitHub folder link (pinned to one commit), or a stopped
   rig. `rig up` with a pod-aware spec on a stopped team's name replaces that team (the earlier one
-  is archived), so check `rig ps --nodes` first. Launch-created `AGENTS.md` or `CLAUDE` files now show in `git status`.
+  is archived), so check `rig ps --nodes` first. A rig name containing a dot is refused before
+  launch, because tmux would rename its sessions. Launch-created `AGENTS.md` or `CLAUDE` files now show in `git status`.
   `rig up <rig> --existing` puts back the OpenRig guidance blocks `rig down` removed before a
   resumed seat starts. A seat still missing one makes the rig `partially_restored` (its node lists
   `guidanceGaps`) and `rig up` exits 1. A seat that wasn't running at the snapshot, but whose
@@ -432,7 +445,7 @@ not have to tear one down to change it, and you rarely have to start from nothin
   which conversation Codex is on now. If the conversation was changed inside the running Codex,
   the restart may refuse or resume the earlier one, so look at the pane (`rig capture <seat>`) first.
 - **`rig add`** / **`rig expand`** — graft one more member, or a whole new pod, onto a rig that is
-  already running. `rig add` takes the rig's name or ID; a name two active rigs share is refused
+  already running. `rig add`, `rig grow` and `rig remove` take the rig's name or ID; a name two active rigs share is refused
   with `rig_ambiguous` and the candidates. `rig grow --new-pod` and `rig expand` are one ingress; choose by input shape.
 - **`rig remove`** / **`rig shrink`** — take a seat, or an entire pod, out of a running topology.
   If it holds active work, pass `--fallback <live-seat>` to reroute before mutation; without a
@@ -566,7 +579,7 @@ version, from checking the environment to a useful report to the OpenRig team.
   reasoning effort for its next launch, restore, handover or in-place Codex restart without
   touching its spec or its peers; nothing restarts. **`rig seat effort <seat>`** reports what was
   requested, what's saved, what the running process was launched with and what the session
-  recorded (NOT VERIFIED until the seat takes a turn).
+  recorded (NOT VERIFIED until the seat takes a turn). It works for Pi seats too, sent as `--thinking`.
 - **`rig seat set-typing-guard <seat> --mode off|draft-aware|hold --reason <text>`** — choose
   ordinary automatic delivery, immediate retention when input is busy/unreadable, or holding all automatic
   input. `--enabled true|false` remains compatible: true selects hold, false selects off.
@@ -587,6 +600,8 @@ version, from checking the environment to a useful report to the OpenRig team.
   `submitted, unconfirmed` (it reached the seat, not proof compaction ran), `uncertain` (not
   replayed) or `not sent`, so confirm by effect. Claude seats that select `openrig-core` load its
   hooks; a seat can give a slow refocus more time with `OPENRIG_REFOCUS_BUDGET_MS` (4500 to 52000).
+  The refocus work packet stays off by default for Claude Code and Codex;
+  `OPENRIG_REFOCUS_WORK_PACKET=1` turns it on, with each field bounded.
 - **Know what compaction costs before you reach for it.** On some runtimes what comes back has
   enough context left to believe it knows everything and not enough to actually know anything — and
   **the compacted agent is the only one who knows it happened**, while every other seat keeps
@@ -894,7 +909,12 @@ your circumstances is configuration, and the ones that are not, another agent ca
   windows, listed once per allowance and never added up; `--refresh` (optionally `--provider
   codex|claude`) reads the logins now. A Claude account's current availability reads `unknown`,
   because nothing links a seat's reading to the login it used: read each window as that seat's
-  reading, and don't tell a person an account has room from it. With `provider.subscription_moves`
+  reading, and don't tell a person an account has room from it. Each account row also carries a
+  sign-in fact (`usable`, `needs sign-in` or `unknown`); a signed-in Claude login never reads
+  better than `unknown`. A Codex account's last reading, its reset and its last observed exhaustion
+  survive a daemon restart as history (`retained: "before_restart"`), never a current reading; a
+  window whose reset has passed shows an `expectation`, which is planning, not a reading. Run `rig provider status --refresh`
+  before telling anyone an account has room. With `provider.subscription_moves`
   on (off by default), `rig provider moves` records and lists moves of a Codex home's seats between
   subscriptions.
 - **Codex configuration fragments** — a `codex_config_fragment` must open with a table header and

packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/daemon",
-  "version": "0.6.12",
+  "version": "0.6.13",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

packages/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/ui",
-  "version": "0.6.12",
+  "version": "0.6.13",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",