ci(workflows): stop persisting checkout credentials in the portability report (#2894)

The portability report workflow's actions/checkout step now sets persist-credentials: false, as the six checkouts in tests.yml already do, so the job's GITHUB_TOKEN isn't left in the workspace git config. The job only runs scripts/portability-report.mjs, which reads the local diff between the pull request's base and head and writes the step summary; it never fetches, pushes or makes an authenticated request, and fetch-depth: 0 still gives it both commits. The report's output is unchanged. Thanks to @DeryFerd for the change.

.github/workflows/portability-report.yml

@@ -20,6 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           fetch-depth: 0
       - uses: actions/setup-node@v4
         with:

CHANGELOG.md

@@ -8,328 +8,356 @@ deprecations, and behavioral changes. Breaking changes are called out explicitly
 
 ---
 
-## [0.7.11]
+## [0.7.10]
 
-OpenRig 0.7.11 is a patch for people running their own agent teams, cut from
-main `220e27a9`. Its biggest change: an ordinary send or work notice now goes
-into a person's typed draft by default instead of being refused (see Behaviour
-that changed). A person can now work with their team from their own coding
-agent through the new `openrig` plugin or from an ACP app such as Zed or T3
-Code, and, as an experiment that's off by default, answer the team's questions
-from an assistant connected through a grant service. A prepared managed compaction waits for an idle moment instead
-of asking again, and a restore stopped at a prompt clears itself. There are
-fixes across the queue, workflows, launch and speed under load, many
-contributed or reported by people using OpenRig. The OpenShell worker's cleanup
-still fails against OpenShell 0.1.6: see Known limits.
+Published 2026-11-08 as `@openrig/[email protected]`, built from the commit tagged
+`v0.7.10` (`a226b1b6`).
+
+OpenRig 0.7.10 is a patch for people running their own agent teams. After a
+managed compaction, a step held because OpenRig can't read the seat's input box
+now goes in after two idle polls instead of waiting with no end. Wakes and sends
+get through a seat pane left in more than one tmux mode, and `rig exec` hands a
+queue row's task to Claude Code or Codex as one finite run that outlives the
+command (not yet run with a real adapter). Installing through the rigs skill tries a user-writable npm prefix
+before a project-local install, and agent spec advisories now show at launch.
+There are fixes across refocus, routing, status and speed under load, many
+contributed by people using OpenRig. The OpenShell worker now does real work and
+exports results, but its cleanup still fails against OpenShell 0.1.6, so don't
+rely on cleanup or recreate yet: see [the OpenShell worker](#the-openshell-worker-in-0710).
 
 ### Before you upgrade
 
-- **Back up your database first.** Five new migrations run at the daemon's
-  first start: 150 (node launch wrapper), 151 (Pi account switches), 152
-  (workflow instance spec), 153 (events retention marks) and 154 (workflow
-  instance root objective). 0.7.10 had none. With the daemon stopped, copy the
-  file `$OPENRIG_DB` names. Going back to 0.7.10 after these migrations isn't
-  established.
 - **Restart the daemon after installing:**
   ```bash
-  npm install -g @openrig/cli@0.7.11
+  npm install -g @openrig/cli@0.7.10
   rig daemon stop && rig daemon start
   ```
-- **The openrig-core plugin moves from 0.1.26 to 0.1.27.** <!-- CONFIRM: openrig-core 0.1.27 at the final base -->
-  Its activity relay and refocus hooks changed, as did the refocusing,
-  openrig-user and openrig-skills skills. Replaced files are kept under
+  This release adds no migrations.
+- **The bundled openrig-core plugin advances from 0.1.25 to 0.1.26.** Its Claude
+  hooks add a `PermissionRequest` hook that reports permission requests to seat
+  status, and its refocus hook and the refocusing skill's trace script changed.
+  Managed refresh preserves replaced files under
   `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits you still
-  need from there. ([#2743](https://github.com/mvschwarz/openrig/pull/2743), [#2717](https://github.com/mvschwarz/openrig/pull/2717), [#2735](https://github.com/mvschwarz/openrig/pull/2735), [#2657](https://github.com/mvschwarz/openrig/pull/2657), [#2647](https://github.com/mvschwarz/openrig/pull/2647), [#2619](https://github.com/mvschwarz/openrig/pull/2619))
-- **Sends now join a person's draft** (`transport.draft_delivery` = `deliver`).
-  To keep the old refusal, run `rig config set transport.draft_delivery refuse`. ([#2645](https://github.com/mvschwarz/openrig/pull/2645))
-- **A Pi seat that declares an absolute `PI_CODING_AGENT_DIR`** in its `env:`
-  now uses it as its account home and needs a readable `auth.json` there, or
-  the launch stops. Prepare one, or remove the declaration to keep the managed
-  seat login. ([#2630](https://github.com/mvschwarz/openrig/pull/2630))
+  need from that copy. ([#2615](https://github.com/mvschwarz/openrig/pull/2615), [#2562](https://github.com/mvschwarz/openrig/pull/2562), [#2582](https://github.com/mvschwarz/openrig/pull/2582), [#2587](https://github.com/mvschwarz/openrig/pull/2587))
+- **Check your agent specs:** `rig agent validate <path>` now prints each
+  advisory. A profile's `uses.<category>` written as a single value now selects
+  that resource instead of being dropped, so a member using that profile fails to
+  resolve if the resource pool doesn't hold it (see Behaviour that changed).
+  ([#2585](https://github.com/mvschwarz/openrig/pull/2585), [#2606](https://github.com/mvschwarz/openrig/pull/2606))
+- **If you run an OpenShell environment, rebuild its guest image** with this
+  release's `guest.py` (`daemon/assets/openshell/README.md` describes the build).
+  The CA repair below is in that file, which the image carries. ([#2602](https://github.com/mvschwarz/openrig/pull/2602))
 
-### Sends and drafts
+### Finite runs: `rig exec`
 
-- **A send now goes into a person's typed draft.** Under the new
-  `transport.draft_delivery` setting's default, `deliver`, an ordinary
-  `rig send` or work notice to a seat whose prompt holds a person's typed draft
-  pastes the message at the cursor and submits the combined input as one
-  prompt, and the send's result says whether submission was confirmed.
-  `refuse` (also `OPENRIG_TRANSPORT_DRAFT_DELIVERY` in the daemon's
-  environment) restores the old refusal where OpenRig detects the draft, from
-  the next send with no restart. Menus, permission prompts, a seat's typing
-  guard, managed compaction and `--wait-for-idle` still refuse or wait under
-  either value. ([#2645](https://github.com/mvschwarz/openrig/pull/2645))
-- **A draft only the input box shows is caught:** an ordinary Claude Code or
-  Codex send reads the box once before pasting (three tmux calls, within
-  500 ms). Under `refuse` the send is refused before any input; under `deliver`
-  the result says it joined the draft. ([#2653](https://github.com/mvschwarz/openrig/pull/2653))
-- **Claude seats showing a statusLine or the background task panel** read as a
-  normal composer under the draft-aware typing guard, so an empty box gets the
-  delivery instead of `draft_input_unknown`. ([#2703](https://github.com/mvschwarz/openrig/pull/2703))
-- **The bare `✔ Update installed · Restart to update` row** of Claude Code
-  2.1.319 in a narrow pane is recognised, so an idle seat's empty prompt reads
-  empty and wakes go through under the draft-aware guard. Checked against the
-  row as reported, not a live pane. ([#2662](https://github.com/mvschwarz/openrig/pull/2662))
-- **A full held-message quota no longer drops a sender's later wakes:** the
-  sender's newest held message retires its earlier ones, listed as `coalesced`
-  in `rig seat held-messages <seat>` and readable with `--id`. ([#2701](https://github.com/mvschwarz/openrig/pull/2701))
-- **Seats stopped while they owe work** don't get a burst of undeliverable
-  wakes at each daemon start; the start-up log says `waiting=N (not replayed: …)`. ([#2620](https://github.com/mvschwarz/openrig/pull/2620))
+- **`rig exec` runs one turn of a queue row's task on Claude Code or Codex**
+  through its maintained ACP adapter, in a connector that outlives the command.
+  `rig exec harnesses` shows the versions installed,
+  `rig exec run <row> --harness claude` (or `codex`) starts it (`--plan` starts
+  nothing, `--wait` waits), and `rig exec status` and `rig exec cancel` follow
+  it. ([#2597](https://github.com/mvschwarz/openrig/pull/2597))
+- **One run per row, and the row stays open.** Running it again returns the
+  row's run instead of sending the task twice; `--again` starts another turn once
+  it has ended. A run whose connector died without recording an outcome reads
+  `interrupted`, outcome unknown. The outcome is the agent's report, and
+  accepting the work stays with you. `--wait` exits 0 for `completed`, 2 for any
+  other outcome and 3 when you stop waiting; a Ctrl-C there stops the wait, not
+  the run. ([#2597](https://github.com/mvschwarz/openrig/pull/2597), [#2601](https://github.com/mvschwarz/openrig/pull/2601))
+- **An ACP run's outcome note,** `rig acp run`'s included, carries the usage and
+  cost the agent reported, each with its source, or unknown. ([#2597](https://github.com/mvschwarz/openrig/pull/2597))
+- **`docs/reference/acp-agents.md`** covers both adapters
+  (`@agentclientprotocol/claude-agent-acp` 0.101.0 and
+  `@agentclientprotocol/codex-acp` 2.5.0): installing them, which native
+  versions run, and how their permissions, refusals and cancels differ. ([#2596](https://github.com/mvschwarz/openrig/pull/2596))
 
-### Compaction, restore and handover
+### The OpenShell worker in 0.7.10
 
-- **A prepared managed compaction waits for its window.** When the restore map
-  is complete but `/compact` couldn't go in (a draft, a tmux mode, no idle
-  moment), the attempt is held as `prepared` and sends `/compact` at the next
-  idle moment instead of asking the seat to prepare again about every 11
-  minutes. `rig compact --state` shows the hold and `--cancel` disarms it. A
-  busy seat isn't asked again after an ended attempt, across a restart too. ([#2698](https://github.com/mvschwarz/openrig/pull/2698), [#2716](https://github.com/mvschwarz/openrig/pull/2716))
-- **A restore stopped at a prompt clears itself** (such as Claude's resume
-  selection) once the seat runs the conversation it was restoring, using the
-  check `rig seat clear-attention` runs. The docs cover the manual route. ([#2711](https://github.com/mvschwarz/openrig/pull/2711), [#2674](https://github.com/mvschwarz/openrig/pull/2674))
-- **A Codex helper inside a Claude seat** (such as `codex exec` from its Bash
-  tool) no longer becomes the seat's resume token, so a restart resumes the
-  Claude conversation instead of failing with `no_conversation_found`. ([#2740](https://github.com/mvschwarz/openrig/pull/2740))
-- **A Claude rebuild handover checks its priming packet:** if it's still
-  staged, the handover reports the submission unconfirmed and says to submit
-  the existing packet once, never to resend or rerun. ([#2650](https://github.com/mvschwarz/openrig/pull/2650))
-- **Restoring a Claude seat's activity hooks** finds the agent's own source from
-  its saved launch recipe, not a same-name agent in the rig's folder. ([#2617](https://github.com/mvschwarz/openrig/pull/2617))
-- **`on_restore: follow_source`** on a spec's `resources.skills[]` entry
-  refreshes that skill from its source when a Claude or Codex seat is restored,
-  keeping its conversation; `keep_saved` stays the default. ([#2626](https://github.com/mvschwarz/openrig/pull/2626))
+**The OpenShell worker hasn't run end to end on 0.7.10. Don't rely on this path
+yet.**
 
-### Your own coding agent
+0.7.10 changes the two things our release testing on 0.7.9 found. Tested against
+OpenShell 0.1.6, the first fix holds and the second doesn't:
+- **The guest's CA settings reach its Claude.** The guest launcher built
+  Claude's environment from scratch with only the provider settings, so a CA the
+  OpenShell exec supplied never arrived, and API calls failed with
+  `SELF_SIGNED_CERT_IN_CHAIN`. It now also passes `NODE_EXTRA_CA_CERTS`,
+  `SSL_CERT_FILE`, `REQUESTS_CA_BUNDLE` and `CURL_CA_BUNDLE`, each only when the
+  exec supplies it. Nothing else is copied, and nothing turns TLS checks off.
+  With OpenShell 0.1.6 the guest now authenticates, does useful work, makes a
+  verified export and completes its task.
+  Rebuild the guest image to get it (above). ([#2602](https://github.com/mvschwarz/openrig/pull/2602))
+- **Deleting an owned environment reads Podman's inventory.** The cleanup step
+  asked for routes Podman serves only under a version prefix, misread the "Not
+  Found" reply, and never sent the delete. It now uses routes Podman serves
+  without one, and a volume counts as gone only when one complete volume listing
+  leaves it out. Any other answer stops as `environment_cleanup_unconfirmed`,
+  with the HTTP status. The maintained cleanup still fails against OpenShell
+  0.1.6, which doesn't mount a workspace volume (see Known limits). ([#2603](https://github.com/mvschwarz/openrig/pull/2603))
 
-- **The `openrig` plugin,** shipped beside openrig-core, lets a person work with
-  their local team from their own Claude Code or Codex: hand it work, follow
-  it, answer the team's questions about it, and read the result. Claude Code:
-  `claude plugin marketplace add "$(npm root -g)/@openrig/cli/daemon/assets/plugins/openrig"`,
-  then `claude plugin install openrig@openrig-app`. Codex: the same
-  `codex plugin marketplace add` path, `codex plugin add openrig@openrig-app`, then
-  `codex mcp add openrig --env OPENRIG_SESSION_NAME=<address> -- rig mcp serve --front-door`.
-  The plugin's README has the steps. ([#2647](https://github.com/mvschwarz/openrig/pull/2647))
-- **VS Code, Copilot CLI and Cursor** install it too, with no seat; the README
-  and `rig_whoami` say to add your own `rig mcp serve --front-door` server with
-  `OPENRIG_SESSION_NAME` set and turn the plugin's off. A seatless app can still
-  create a task, send and post, as `unknown-mcp-<8 hex>`. ([#2683](https://github.com/mvschwarz/openrig/pull/2683), [#2709](https://github.com/mvschwarz/openrig/pull/2709), [#2718](https://github.com/mvschwarz/openrig/pull/2718), [#2657](https://github.com/mvschwarz/openrig/pull/2657))
-- **Answers are recorded exactly as the person typed them.** ([#2733](https://github.com/mvschwarz/openrig/pull/2733))
-- **Marketplace files at the repository root** let Claude Code's
-  `/plugin marketplace add mvschwarz/openrig`, and directories that take a public
-  Git repo, install it from GitHub (marketplace `openrig-app`). ([#2719](https://github.com/mvschwarz/openrig/pull/2719))
+An exact restore hasn't been shown: recreate and restore can't run while the
+cleanup fails.
 
-### ACP apps: `rig acp serve`
+### Compaction, delivery and terminals
 
-- **OpenRig as an agent in ACP apps:** `rig acp serve --to <member@rig>` runs
-  on stdio for an app that launches a custom agent (Zed's `agent_servers`, T3
-  Code). A prompt becomes a queue row, each row the work reaches shows as a
-  step, and the closing resolution is the reply. Nothing runs until an app
-  starts it, and it talks to the daemon `rig` uses. ([#2648](https://github.com/mvschwarz/openrig/pull/2648), [#2714](https://github.com/mvschwarz/openrig/pull/2714))
-- **The team's questions reach the app** while a turn is open, as a permission
-  request or a one-choice form, and the choice is the person's answer. Sessions
-  can be listed and reopened, and a question left unanswered there is named as
-  still open in the TUI and Slack. ([#2651](https://github.com/mvschwarz/openrig/pull/2651), [#2708](https://github.com/mvschwarz/openrig/pull/2708), [#2686](https://github.com/mvschwarz/openrig/pull/2686), [#2712](https://github.com/mvschwarz/openrig/pull/2712))
-- **The `@openrig/acp` launcher** (`openrig-acp`) runs the matching
-  `@openrig/cli`'s `rig acp serve` for the ACP registry's `npx` launch, with a
-  new `acp.to` setting for the receiver. `npm run pack:release` packs it beside
-  the CLI; these changes don't publish it or submit its listing. ([#2655](https://github.com/mvschwarz/openrig/pull/2655), [#2715](https://github.com/mvschwarz/openrig/pull/2715))
+- **A held post-compaction step now goes in.** Each step after a managed
+  compaction (the turn boundary, the restore request, the audit) went only into
+  an input box that read empty, so a box OpenRig couldn't read held the restore
+  request on every poll, and the seat sat idle without its restore. Now, after
+  two idle polls in a row that can't read the box, the next poll sends the step,
+  and `rig compact <seat> --state` and `rig seat status` say it went in over a
+  box OpenRig couldn't read, never that the box was empty. Some cases still hold
+  (see Known limits). ([#2576](https://github.com/mvschwarz/openrig/pull/2576), refs [#2575](https://github.com/mvschwarz/openrig/issues/2575))
+- **Wakes and sends leave every tmux mode.** A pane scrolled into copy mode, with
+  run-shell output, a chooser, customize or clock mode on top, kept a mode after
+  one cancel, and the send was refused until someone left it by hand. Delivery
+  now runs tmux's `copy-mode -q`, which leaves them all, with a single cancel
+  where that fails (tmux before 3.1a), and a refusal names why leaving failed.
+  ([#2594](https://github.com/mvschwarz/openrig/pull/2594))
+- **A scrolled pane with a stale record no longer blocks delivery.** tmux
+  reuses pane IDs after a server restart, so a stale binding, from another rig
+  for example, can name the same pane as a live seat. Leaving the mode was
+  addressed by that raw pane ID, which then matched two seats, so it was
+  refused before anything was written and the send failed with nothing sent.
+  Leaving the mode now goes through the seat's address, as the text and Enter
+  writes already did. The stale binding itself is unchanged.
+  ([#2644](https://github.com/mvschwarz/openrig/pull/2644))
+- **A writable rig, pod or seat view sizes the pane it shows,** instead of
+  keeping an older attached client's size. Read-only views are unchanged. ([#2614](https://github.com/mvschwarz/openrig/pull/2614))
+- **Herdr views kept across an upgrade keep working,** on Linux Herdr 0.9.5 /
+  protocol 22. A viewer or follow view kept from 0.7.5 through 0.7.9 now counts
+  as the same attachment when only OpenRig's tile script changed, and moves to
+  the current command, so the viewer stays confirmed and the follow view goes on
+  adding and closing tiles. A kept viewer that's already running keeps its
+  earlier sizing for as long as it runs, its own re-attaches included; writable
+  viewers opened after the upgrade size their pane. A different session, tmux,
+  server or read-only setting still holds the view, as before. Checked against
+  the scripts those releases used, not yet with a live Herdr. It follows
+  @natefaerber's approach in
+  [#2467](https://github.com/mvschwarz/openrig/pull/2467). ([#2634](https://github.com/mvschwarz/openrig/pull/2634))
 
-### People and connected assistants
+### Coordination and status
 
-- **Assistants connected through a grant service** (experimental, unsupported,
-  off by default: you serve `rig mcp serve --http --grant-service <url>` behind
-  your own TLS tunnel, and an outside service grants each connection):
-  `rig_question_list` and `rig_question_answer` let a registered person answer
-  the team's questions as their own; `--task-destination <member@rig>` names
-  the receiver for `rig_queue_create`, and a bare seat name resolves. ([#2735](https://github.com/mvschwarz/openrig/pull/2735), [#2638](https://github.com/mvschwarz/openrig/pull/2638), [#2750](https://github.com/mvschwarz/openrig/pull/2750))
-- **The `relay` gateway connector** sends questions, updates and notices to an
-  operator-owned bridge over loopback HTTP and takes replies back. It's off
-  unless you add a relay binding, and the bridge, with its reach to a messaging
-  platform, is yours (`docs/reference/gateway-relay.md`). ([#2624](https://github.com/mvschwarz/openrig/pull/2624))
-- **The web UI's For You feed** answers a local ask's questions on its card. ([#2612](https://github.com/mvschwarz/openrig/pull/2612))
+- **Routing and receipts:**
+  - a send to `<seat>@<rig>@<this host's ID>` goes to this host even when a
+    remote host is selected;
+  - `rig broadcast` prints `UNCONFIRMED`, not `FAILED`, for a recipient its text
+    or Enter may have reached, and points to `rig capture` before any resend;
+  - `rig seat stop`, `clean` and in-place restart, when they refuse a seat
+    handed over before 0.7.9, say why and no longer suggest `rig unclaim`;
+  - `rig roster show` and `find` read a seat's activity as unknown
+    ("Conflicting activity observations") when two routes to it disagree;
+  - `rig seat set-runtime` finds a pod seat's authored recap.
+  ([#2600](https://github.com/mvschwarz/openrig/pull/2600), [#2572](https://github.com/mvschwarz/openrig/pull/2572), [#2574](https://github.com/mvschwarz/openrig/pull/2574), [#2593](https://github.com/mvschwarz/openrig/pull/2593))
+- **Refocus:** unresolved typed work, and a `rig queue whoami` that timed out,
+  print a named trace gap with project-level orientation, labelled as not
+  evidence of a current mission, instead of counting as a refocus failure.
+  ([#2582](https://github.com/mvschwarz/openrig/pull/2582), [#2587](https://github.com/mvschwarz/openrig/pull/2587))
+- **Updates to people:** the stuck sweep no longer files an informational update
+  to a registered person as an unclaimed obligation, unless its quiet-hours hold
+  was orphaned. ([#2586](https://github.com/mvschwarz/openrig/pull/2586))
+- **Slack:** `rig slack status` shows relay attempts to another host still
+  awaiting a response. It's a count for the current connector at that moment, so
+  zero doesn't prove nothing is in flight. ([#2569](https://github.com/mvschwarz/openrig/pull/2569))
+- **Permission requests in seat status:** `rig seat status` shows a Claude
+  seat's latest permission request as openrig-core's hook observed it, with
+  Claude's own suggested rules labelled as suggestions. Nothing is applied,
+  approved or stored. ([#2562](https://github.com/mvschwarz/openrig/pull/2562))
 
-### Queue, workflows and status
+### Install, specs and errors
 
-- **One `unclaimed-backlog` notice** replaces a finding per row for a seat that
-  reads without claiming and has no escalation route or delegation parent. ([#2752](https://github.com/mvschwarz/openrig/pull/2752))
-- **Claims read `working`, not stalled,** for up to 60 minutes while a Claude
-  owner has a live background shell, and 20 while a managed restore is owed. ([#2675](https://github.com/mvschwarz/openrig/pull/2675))
-- **`rig queue show`, `list`, `transitions`, `update` and `block` take
-  `--host <id>`,** as `create` and `handoff` did; `claim` doesn't. ([#2678](https://github.com/mvschwarz/openrig/pull/2678))
-- **Cross-host handoffs** that override a claim wake the claimer, and a close
-  to an unverifiable successor names `rig queue handoff`. ([#2734](https://github.com/mvschwarz/openrig/pull/2734), [#2621](https://github.com/mvschwarz/openrig/pull/2621))
-- **Code results:** an `openrig.code-result/v1` manifest as `evidenceRef` gives
-  `rig_artifact_read` and the new `rig queue artifact` the commit pair to diff. ([#2659](https://github.com/mvschwarz/openrig/pull/2659))
-- **Workflows:** a run keeps its own spec when another pod's copy reuses the id
-  and version; the root objective is kept and printed as `objective:`;
-  `rig workflow unregister` removes versions; `trace --full` returns the whole
-  trail. ([#2696](https://github.com/mvschwarz/openrig/pull/2696), [#2738](https://github.com/mvschwarz/openrig/pull/2738), [#2676](https://github.com/mvschwarz/openrig/pull/2676), [#2667](https://github.com/mvschwarz/openrig/pull/2667))
-- **Activity:** a helper harness inside a seat no longer reports its turns as
-  the seat's, and a resumed seat no longer reads a false model divergence. ([#2743](https://github.com/mvschwarz/openrig/pull/2743), [#2664](https://github.com/mvschwarz/openrig/pull/2664))
-- **Also:** refocus traces projects outside `workspace.root`; a timed-out
-  `rig stream emit` names a retry that can't duplicate; `rig context
-  reconstruction inspect` and `view` read an exact revision from local stores.
-  ([#2717](https://github.com/mvschwarz/openrig/pull/2717), [#2619](https://github.com/mvschwarz/openrig/pull/2619), [#2207](https://github.com/mvschwarz/openrig/pull/2207))
-
-### Launch, install and setup
-
-- **A Claude launcher script that execs the native installer's symlink**
-  becomes ready after a launch or rebuild, and `--no-chrome` is recognised. ([#2751](https://github.com/mvschwarz/openrig/pull/2751))
-- **`launch_wrapper`,** an argv prefix whose launcher prepares the environment
-  and execs the agent, works for local Claude Code, Pi and Codex seats; a
-  wrapped seat never starts unwrapped. ([#2746](https://github.com/mvschwarz/openrig/pull/2746), [#2609](https://github.com/mvschwarz/openrig/pull/2609))
-- **`rig provider switch --seat <pi seat> --account-home <dir>`** moves a Pi
-  seat to another account through a confirmed successor, keeping its model,
-  effort and wrapper; `--dry-run` shows the plan. ([#2630](https://github.com/mvschwarz/openrig/pull/2630))
-- **Claude seats that load openrig-core themselves** stop loading its skills
-  twice: the next launch removes OpenRig's unchanged copies. ([#2660](https://github.com/mvschwarz/openrig/pull/2660))
-- **Also:** a short permission-hook policy name; `rig attach --self` outside
-  tmux adds the rig; `rig host pair --timeout` holds the request that long;
-  `rig config set` names a masking variable; daemon start and stop treat a
-  probe the OS blocked as unknown; a bare piped `rig` skips the compile cache.
-  ([#2640](https://github.com/mvschwarz/openrig/pull/2640), [#2641](https://github.com/mvschwarz/openrig/pull/2641), [#2692](https://github.com/mvschwarz/openrig/pull/2692), [#2547](https://github.com/mvschwarz/openrig/pull/2547), [#2502](https://github.com/mvschwarz/openrig/pull/2502), [#2643](https://github.com/mvschwarz/openrig/pull/2643))
-
-### Terminals and views
-
-- **Herdr follow views** work on macOS too (protocol 22), open a labelled
-  snapshot where live following isn't supported, and show a cleaner strip. ([#2663](https://github.com/mvschwarz/openrig/pull/2663), [#2706](https://github.com/mvschwarz/openrig/pull/2706))
-- **Closing the herdr-core terminal that started OpenRig** no longer ends the
-  daemon or its seats (per herdr-core's documented behaviour; a real close
-  wasn't exercised). ([#2737](https://github.com/mvschwarz/openrig/pull/2737))
-- **Also:** terminal snapshots keep colours; a reattach during a broker
-  teardown works; a home under a symlinked parent records its real path;
-  `rig doctor` says why tmux control mode is off. ([#2654](https://github.com/mvschwarz/openrig/pull/2654), [#2671](https://github.com/mvschwarz/openrig/pull/2671), [#2633](https://github.com/mvschwarz/openrig/pull/2633), [#2707](https://github.com/mvschwarz/openrig/pull/2707))
+- **The rigs skill's install step,** when npm's global prefix isn't writable,
+  now has the agent point npm's prefix at a folder the person owns whose `bin` is
+  on their login PATH, or use a version manager's Node, saying first what that
+  changes, and install inside the project only if neither works. ([#2611](https://github.com/mvschwarz/openrig/pull/2611))
+- **Plain `rig` works in managed Codex seats however OpenRig was installed,**
+  with a Codex that supports `allow_login_shell` (checked in Codex's source at
+  0.162.1 and 0.166); not yet run with a live Codex seat. OpenRig now passes Codex `-c allow_login_shell=false`, so tool commands run in
+  a non-login shell and inherit the environment their pane's shell set up,
+  OpenRig's command folder included. To defer to Codex's own setting instead,
+  run `rig config set launch.codex_login_shell true`; it applies at each seat's
+  next launch, and a restart in place keeps the running choice. ([#2613](https://github.com/mvschwarz/openrig/pull/2613))
+- **Agent spec advisories show where you'll see them:** `rig up`, a fresh restore
+  and a first-start retry report each as a launch warning naming the member,
+  spec and path, and `rig agent validate` prints them whether or not the spec is
+  valid. They never stop a launch. ([#2606](https://github.com/mvschwarz/openrig/pull/2606))
+- **An unknown key under a profile's `uses`,** such as a typo,
+  gets an advisory instead of being ignored silently. ([#2618](https://github.com/mvschwarz/openrig/pull/2618))
+- **Clearer errors:**
+  - a rejected terminal-token request says "Terminal auth failed" and names
+    `OPENRIG_TERMINAL_BEARER_TOKEN`, or `OPENRIG_AUTH_BEARER_TOKEN` when
+    terminal auth falls back to it;
+  - the TUI shows the daemon's own message when it refuses a launch;
+  - `rig doctor` gives up on its cmux status and `--spec` topology reads after 2
+    seconds each, so a listener that never answers can't hold it.
+  ([#2577](https://github.com/mvschwarz/openrig/pull/2577), [#2556](https://github.com/mvschwarz/openrig/pull/2556), [#2564](https://github.com/mvschwarz/openrig/pull/2564))
+- **Docs:** a Codex config fragment can't install a named Codex profile, with
+  how to keep a profile with full access or a `codex_permissions` envelope; and
+  a Claude seat that selects openrig-core loads its skills with the plugin.
+  ([#2604](https://github.com/mvschwarz/openrig/pull/2604), [#2584](https://github.com/mvschwarz/openrig/pull/2584))
 
 ### Speed under load
 
-- **The stuck sweep** batches its reads and yields every 50 rows: on a copy of
-  a busy 340 MB database, a pass went from 10.2–11.4 s to 5.1–5.5 s and the
-  longest stall from about 10 s to 0.57 s. ([#2649](https://github.com/mvschwarz/openrig/pull/2649))
-- **`view.changed` events are no longer stored,** so the `events` table grows
-  about a third as fast on the busy host measured, and opt-in
-  `retention.events_days` prunes eight history-only event types. ([#2695](https://github.com/mvschwarz/openrig/pull/2695), [#2699](https://github.com/mvschwarz/openrig/pull/2699))
-- **The web UI** loads the newest 100 events instead of the whole log. ([#2704](https://github.com/mvschwarz/openrig/pull/2704))
-- **`daemon.seat_poll_interval_ms`** (1000 to 2000) trades activity freshness
-  for daemon CPU on large fleets. ([#2688](https://github.com/mvschwarz/openrig/pull/2688))
-- **Also:** with `OPENRIG_TMUX_CONTROL=1`, short sends and `set-option` use the
-  control client; the idle-shell check reads the plain process table; skill
-  catalog Git reads time out after five seconds. ([#2636](https://github.com/mvschwarz/openrig/pull/2636), [#2690](https://github.com/mvschwarz/openrig/pull/2690), [#2713](https://github.com/mvschwarz/openrig/pull/2713))
+- **The execution view** (`GET /api/views/execution`, behind the TUI's execution
+  view and `rig view show execution`) reads the review registry once per request
+  instead of once per slice, and yields to the event loop while it does. Its
+  other synchronous steps are unchanged. ([#2578](https://github.com/mvschwarz/openrig/pull/2578))
+- **A queue listing** looks recovery rows up through one index per listing
+  instead of a scan for each listed row. It hasn't been measured on a live
+  daemon. ([#2588](https://github.com/mvschwarz/openrig/pull/2588))
+- **The event notification drain** reads pages of at most 500 rows instead of
+  the whole remaining tail. It bounds rows per read, not bytes, and still runs to
+  the end synchronously; no latency change on a live install is claimed.
+  ([#2610](https://github.com/mvschwarz/openrig/pull/2610))
 
-### Docs and tests
+### For runner authors and integrators
 
-Daemon HTTP clients and bearer tokens ([#2652](https://github.com/mvschwarz/openrig/pull/2652)), the 0.7.10 capability map on
-main ([#2736](https://github.com/mvschwarz/openrig/pull/2736)), a neutral TUI demo snapshot ([#2724](https://github.com/mvschwarz/openrig/pull/2724)), a web UI editor timer
-([#2689](https://github.com/mvschwarz/openrig/pull/2689)), and test and CI fixes ([#2753](https://github.com/mvschwarz/openrig/pull/2753), [#2681](https://github.com/mvschwarz/openrig/pull/2681), [#2685](https://github.com/mvschwarz/openrig/pull/2685), [#2673](https://github.com/mvschwarz/openrig/pull/2673), [#2628](https://github.com/mvschwarz/openrig/pull/2628)).
+- **The runner contract says what has run with a real runner.**
+  `docs/reference/harness-runner-contract.md` and the dsh example say what has
+  run natively, at what scope, and what hasn't; any other runner, provider or
+  path stays unqualified until shown. The 0.7.8 Known limits line below that said
+  no harness had run end to end is struck and corrected in place.
+  ([#2592](https://github.com/mvschwarz/openrig/pull/2592), [#2595](https://github.com/mvschwarz/openrig/pull/2595))
+- **Telemetry:** `docs/reference/telemetry.md` says OpenRig's guarantee ends at
+  its finite reads, versioned by `schemaVersion` 1, and links the separately
+  maintained openrig-telemetry exporter, which OpenRig doesn't test or
+  guarantee. ([#2589](https://github.com/mvschwarz/openrig/pull/2589))
+- **Also:** the real-tmux transport test waits for the shell's prompt before
+  typing. ([#2559](https://github.com/mvschwarz/openrig/pull/2559))
 
 ### Behaviour that changed
 
-- **Sends and work notices that were refused with `prompt_draft` now go
-  through by default, joined to the person's draft** (above).
-  `rig config set transport.draft_delivery refuse` restores the old refusal
-  where OpenRig detects the draft, from the next send with no restart; under
-  `refuse`, a draft only the input box shows now refuses too. ([#2645](https://github.com/mvschwarz/openrig/pull/2645), [#2653](https://github.com/mvschwarz/openrig/pull/2653))
-- **A Pi seat with an absolute `PI_CODING_AGENT_DIR`** uses it as its account
-  home on launch, restart, resume and restore; no `auth.json`, no launch. ([#2630](https://github.com/mvschwarz/openrig/pull/2630))
-- **`/api/events` no longer emits `view.changed`,** live or replayed, so new
-  ones leave the web UI's log, activity feed and For You and the historical
-  telemetry export; the view streams still carry them. ([#2695](https://github.com/mvschwarz/openrig/pull/2695))
-- **The stuck sweep** files one backlog notice where it filed one per row,
-  skips `stalled-after-claim` inside the two windows above, re-checks each
-  rule just before filing, and skips overlapping ticks. ([#2752](https://github.com/mvschwarz/openrig/pull/2752), [#2675](https://github.com/mvschwarz/openrig/pull/2675), [#2649](https://github.com/mvschwarz/openrig/pull/2649))
-- **Managed compaction:** a prepared attempt stays `waiting`, and a manual
-  `rig compact` over it reads `already_in_progress`. ([#2698](https://github.com/mvschwarz/openrig/pull/2698), [#2716](https://github.com/mvschwarz/openrig/pull/2716))
-- **The daemon and seats no longer inherit `HC_SCOPE`, `HC_TERMINAL_ID` or
-  `HC_TERMINAL_SOCKET`;** one already running keeps them until restarted. ([#2737](https://github.com/mvschwarz/openrig/pull/2737))
-- **Also:** each sender keeps one live held message per seat; daemon start
-  doesn't re-send a failed wake to a seat with no receiver; restores record
-  `restore.outcome_reconciled` themselves; `rig terminal open --follow` returns
-  `follow_unsupported` with a snapshot. ([#2701](https://github.com/mvschwarz/openrig/pull/2701), [#2620](https://github.com/mvschwarz/openrig/pull/2620), [#2711](https://github.com/mvschwarz/openrig/pull/2711), [#2663](https://github.com/mvschwarz/openrig/pull/2663))
-- **MCP and ACP:** an empty or placeholder seat value means no seat; the
-  seatless `rig_whoami` text changed; `--front-door` is `front-door/v2`;
-  grant-service callers' `destination` is optional; `rig acp serve` gives
-  form-taking apps a form, leads step titles with the latest note, and asks
-  nothing after a cancel. ([#2657](https://github.com/mvschwarz/openrig/pull/2657), [#2709](https://github.com/mvschwarz/openrig/pull/2709), [#2718](https://github.com/mvschwarz/openrig/pull/2718), [#2733](https://github.com/mvschwarz/openrig/pull/2733), [#2638](https://github.com/mvschwarz/openrig/pull/2638), [#2750](https://github.com/mvschwarz/openrig/pull/2750), [#2708](https://github.com/mvschwarz/openrig/pull/2708), [#2686](https://github.com/mvschwarz/openrig/pull/2686), [#2655](https://github.com/mvschwarz/openrig/pull/2655))
-- **CLI:** `rig attach --self` outside tmux records `<name>@<rig>`;
-  `rig host pair` keeps a request for its `--timeout`; `rig config set` and
-  `reset` name environment overrides; `rig daemon start` and `stop` refuse when
-  a blocked probe leaves identity or liveness unknown; `--host` receipts print
-  a runnable command. ([#2641](https://github.com/mvschwarz/openrig/pull/2641), [#2692](https://github.com/mvschwarz/openrig/pull/2692), [#2547](https://github.com/mvschwarz/openrig/pull/2547), [#2502](https://github.com/mvschwarz/openrig/pull/2502), [#2678](https://github.com/mvschwarz/openrig/pull/2678))
-- **Seat launches:** unchanged OpenRig copies of openrig-core's skills are
-  removed, with warnings; the permission hook reads the installed policy lists
-  on each call; model divergence reads pending until the new occupant's record.
-  ([#2660](https://github.com/mvschwarz/openrig/pull/2660), [#2640](https://github.com/mvschwarz/openrig/pull/2640), [#2664](https://github.com/mvschwarz/openrig/pull/2664))
+- **Managed Codex seats run tool commands in a non-login shell** (above).
+  Inherited setup isn't re-run for each command, so setup that lives only in
+  login or rc files (such as `~/.bashrc` lines your login file doesn't source, or
+  a tmux `default-command` that doesn't start a login shell), shell functions and
+  aliases may be missing from tool commands. A model request for `login: true`
+  gets Codex's own refusal, "login shell is disabled by config". With
+  `launch.codex_login_shell` on, OpenRig omits its override rather than forcing
+  login shells, so a login file that sets `PATH` outright can then hide `rig`.
+  ([#2613](https://github.com/mvschwarz/openrig/pull/2613))
+- **A held post-compaction step goes in after two idle polls that can't read the
+  input box** (above). A draft OpenRig can't recognise in that box may receive
+  the restore text. ([#2576](https://github.com/mvschwarz/openrig/pull/2576))
+- **A send or wake leaves every tmux mode in a seat's pane,** including a
+  chooser, customize or clock mode a person has open, where before it was
+  refused. ([#2594](https://github.com/mvschwarz/openrig/pull/2594))
+- **A send to `<seat>@<rig>@<this host's ID>`** goes to this host, not the
+  selected remote host. ([#2600](https://github.com/mvschwarz/openrig/pull/2600))
+- **A profile's `uses.<category>` written as a single value** (for example
+  `uses.skills: review`) used to validate and then be dropped. It now counts as a
+  one-item list, with an advisory suggesting list syntax: a member using that
+  profile gets the resource, or fails to resolve with "not found in resource
+  pool" when the pool doesn't hold it. Other malformed `uses` shapes are
+  advisories, not new errors. ([#2585](https://github.com/mvschwarz/openrig/pull/2585))
+- **`rig up` can print new warnings,** one per agent spec advisory, and
+  `rig agent validate` prints them. ([#2606](https://github.com/mvschwarz/openrig/pull/2606))
+- **`rig broadcast`** prints `UNCONFIRMED` for a recipient it may have reached;
+  its exit code and `N/M delivered` count are unchanged. ([#2572](https://github.com/mvschwarz/openrig/pull/2572))
+- **`rig roster show` and `find`** read conflicting activity as unknown.
+  ([#2574](https://github.com/mvschwarz/openrig/pull/2574))
+- **The refocus hook** no longer counts unresolved typed work or a timed-out
+  `rig queue whoami` as a failure, and a timed-out refocus clears the pending
+  post-compaction retry. ([#2582](https://github.com/mvschwarz/openrig/pull/2582), [#2587](https://github.com/mvschwarz/openrig/pull/2587))
+- **The stuck sweep** no longer flags informational updates to registered people
+  as unclaimed obligations. ([#2586](https://github.com/mvschwarz/openrig/pull/2586))
+- **A rejected terminal-token request** gets "Terminal auth failed" instead of
+  "Mission Control auth failed"; its status code and fields are unchanged.
+  ([#2577](https://github.com/mvschwarz/openrig/pull/2577))
 
 ### Known limits
 
-- **OpenShell:** the CA fix holds on OpenShell 0.1.6; the maintained cleanup
-  (`delete-owned`) still fails against OpenShell 0.1.6, because 0.1.6 doesn't
-  mount a workspace volume for a custom image, until a fix and its native run
-  land; recreate and restore haven't run. Never give the guest the daemon's
-  main API port (normally 7433). After a same-generation reconciled launch,
-  run `rig environment connect` yourself.
-- **Drafts:** detection isn't complete. Under `refuse`, an unreadable input box
-  lets the send go ahead, so an undetected draft goes with the message; under
-  `deliver`, a result may not mention a draft it joined. ([#2645](https://github.com/mvschwarz/openrig/pull/2645), [#2653](https://github.com/mvschwarz/openrig/pull/2653))
-- **A post-compaction step can still hold** when the box reads as typed, under
-  draft-aware delivery or the typing guard, or after a lost `/compact`. Run
-  `rig compact <seat> --cancel`, then send a restore request naming the newest
-  restore map, marker and packet. ([#2575](https://github.com/mvschwarz/openrig/issues/2575))
-- **Draft-aware delivery to Claude:** a message held as `draft_input_unknown`
-  still isn't retried. Whether managed compaction now gets past the banner
-  (`target_activity_unknown`) wasn't retested. ([#2605](https://github.com/mvschwarz/openrig/issues/2605))
-- **Claude provider switch:** the failure reported in [#2341](https://github.com/mvschwarz/openrig/issues/2341) ("The probe pane
-  returned to a shell instead of staying inside the runtime") isn't shown fixed.
-- **`rig exec`:** checked with Claude Code and Codex through their ACP
-  adapters. A cancel is acknowledged, not settled, and says nothing about
-  further spend. Cancel with `rig exec cancel`, not `rig acp cancel`.
-- **ACP apps:** checked in T3 Code (Beta) 0.1.7 and with a scripted client; the
-  unanswered-question notice hasn't run in a live app, nor the note-first step
-  title in Zed. A cancel stops waiting; the work carries on. ([#2648](https://github.com/mvschwarz/openrig/pull/2648), [#2686](https://github.com/mvschwarz/openrig/pull/2686), [#2712](https://github.com/mvschwarz/openrig/pull/2712))
-- **The `openrig` plugin** hasn't run in Claude Desktop, the Codex app or
-  Copilot CLI. A seatless app can't claim, update, hand off or answer
-  questions, and everyone using the app on a machine acts as its seat. ([#2647](https://github.com/mvschwarz/openrig/pull/2647), [#2657](https://github.com/mvschwarz/openrig/pull/2657), [#2683](https://github.com/mvschwarz/openrig/pull/2683))
-- **Grant-service assistants** still aren't woken: an item stays queued until
-  its receiver claims it. **Relay:** "Accepted by bridge" means the bridge has
-  it, not the person, and a failed send replays only at a restart. ([#2735](https://github.com/mvschwarz/openrig/pull/2735), [#2624](https://github.com/mvschwarz/openrig/pull/2624))
-- **Event retention** can't be undone, and the database file doesn't shrink. ([#2699](https://github.com/mvschwarz/openrig/pull/2699))
-- **Claude `launch_wrapper`** hasn't run with zsh, on macOS arm64 or with a real
-  installed Claude; an alias or shell function named `claude` fails closed. ([#2746](https://github.com/mvschwarz/openrig/pull/2746))
-- **Going back to 0.7.10:** besides the migrations, an older permission hook
-  gives named-policy Claude sessions no decision until relaunched. ([#2640](https://github.com/mvschwarz/openrig/pull/2640))
-- **Codex hooks:** a session kept running across an upgrade can show "Hook
-  failed — plugin contents changed; hook approval required" until relaunched,
-  and 0.7.11 changes openrig-core again. `rig seat restart --keep-conversation`
-  refuses a Codex seat launched with developer instructions (`settings_drift`).
-- **Codex hook setup:** with smol-toml 1.9.x and an existing `hooks.json`,
-  OpenRig can leave its activity hooks and trust records unchanged. The range
-  (`^1.8.0`) still permits 1.9.x; the repository lockfile uses 1.8.0. ([#2720](https://github.com/mvschwarz/openrig/issues/2720))
-- **Claude Code 2.1.319 starts in auto mode by default,** so a new Claude seat
-  may act without asking; manual mode restores asking.
-- **Also:** permission requests in seat status show only the latest, in memory
-  for five minutes, and suggested rules can contain sensitive values; Slack
-  private channels need the documented, untested route, direct messages aren't
-  supported and people reads haven't run live; a Codex snapshot restore writes
-  OpenRig's guidance blocks into a tracked `AGENTS.md` (check `git status`); a
-  scheduled reminder that fails before input isn't retried; SSH host status
-  reads `unknown` behind ProxyJump or ProxyCommand; advisories don't show on a
-  native resume; seats handed over before 0.7.9 refuse stop, restart and
-  clean; after a project-local install, plain `rig` isn't found in the TUI's
-  own shell; with Claude Code 2.1.319, `rig up` can wrongly say "Startup prompt
-  still staged … press Enter"; two npm installs into one folder at once once
-  left a partial install, cause unknown.
-- **Fixed or changed from 0.7.10's known issues:** the bare update banner
-  ([#2662](https://github.com/mvschwarz/openrig/pull/2662)) and the Claude launcher-script readiness timeout with `--no-chrome`
-  ([#2751](https://github.com/mvschwarz/openrig/pull/2751)). 0.7.10's OpenShell limit is superseded by the one above.
-- **The earlier limits below that 0.7.11 doesn't fix or change still apply.**
+- **OpenShell:** maintained cleanup (`delete-owned`) fails against OpenShell
+  0.1.6, which doesn't mount a workspace volume, so recreate and restore can't
+  run (above). A cleanup error that's thrown still omits its stage and whether
+  its delete was sent, and the inventory is a snapshot, not an atomic read.
+  0.7.8's requirements, cost note
+  and cleanup limits still apply, including "Never grant the guest access to the
+  daemon's main API port (normally 7433)." A same-generation reconciled launch
+  opens no viewer, so run `rig environment connect` yourself; non-text startup
+  actions aren't supported on environment seats. ([#2603](https://github.com/mvschwarz/openrig/pull/2603))
+- **`rig exec`:** no real adapter has run under it yet; one run per row,
+  detached ownership and reconciling were checked against a stand-in agent.
+  Concurrent runs, long or background tasks, recovery across a reboot, MCP
+  servers and Windows aren't covered. A cancel is acknowledged, not settled, and
+  says nothing about further spend. Cancel an exec run with `rig exec cancel`:
+  `rig acp cancel` given its ID while it's still requested can signal the wrong
+  process. A Ctrl-C just before the connector is launched isn't caught by
+  `--wait`.
+  ([#2597](https://github.com/mvschwarz/openrig/pull/2597), [#2601](https://github.com/mvschwarz/openrig/pull/2601))
+- **After a managed compaction, a step can still hold:** when the input box
+  reads as typed, with or without a suggestion; on a seat whose draft-aware
+  delivery or typing guard holds OpenRig's input; and after a `/compact` whose
+  result was lost. To take over by hand, run `rig compact <seat> --cancel`, then
+  send the seat a restore request naming its newest restore map, its restore
+  marker and its packet; a step already being pasted can still land. Which
+  reading the reported seat's box gave isn't established, so the report stays
+  open. ([#2575](https://github.com/mvschwarz/openrig/issues/2575))
+- **Draft-aware delivery to Claude:** on 0.7.8 with Claude Code 2.1.319,
+  deliveries to idle Claude agents, queue wakes included, were reported held at
+  an empty prompt when a narrow pane showed
+  `✔ Update installed · Restart to update` on its own line. 0.7.10 still doesn't
+  recognize that bare banner, though it recognizes `/rc` and the full versioned
+  banner. A message the draft-aware delivery path holds isn't replayed
+  automatically by that path. ([#2605](https://github.com/mvschwarz/openrig/issues/2605))
+- **Grant-service assistants aren't woken:** "an item stays queued until its
+  receiver claims it."
+- **Open updates for a person** read a 1,001-row window, so a page can come back
+  short, marked `truncated`.
+- **Slack:** a private channel needs the documented route, which we don't test,
+  and direct messages aren't supported. The channel and people reads, and a
+  click on a re-parked ask, haven't been run against a live Slack workspace.
+  Redaction of the bot token from a transport error can still leave a malformed
+  token fragment shorter than six characters, so review an error before sharing
+  it. ([#2503](https://github.com/mvschwarz/openrig/pull/2503))
+- **SSH host status** reads `unknown` behind a ProxyJump or ProxyCommand; that
+  isn't proof the connection is broken. ([#2488](https://github.com/mvschwarz/openrig/pull/2488))
+- **Shared asks:** "a click's option written before its answer row … can stand
+  beside or inside the closer's answer without the first clicker's authorship."
+- **Existing seats** last launched fresh before 0.7.9 pick up Codex launch
+  instructions and the single skill load at their next fresh launch. A
+  `CLAUDE.md` or `AGENTS.md` that already grew isn't trimmed.
+- **Permit records** last as long as stream retention keeps them. A permit a
+  runner makes on its own, when it can't reach OpenRig, is in its pane only. For
+  an ask opened before 0.7.9, a record may omit the option's kind. ([#2361](https://github.com/mvschwarz/openrig/pull/2361))
+- **Permission requests in seat status** show only the latest one, held in
+  memory for five minutes and lost on a daemon restart. Claude's suggested rules
+  can contain sensitive values, and `rig seat status` and both seat-status routes
+  can return them. ([#2562](https://github.com/mvschwarz/openrig/pull/2562))
+- **Agent spec advisories** don't show for a native resume that continues a
+  saved conversation, since it doesn't reload the spec. ([#2606](https://github.com/mvschwarz/openrig/pull/2606))
+- **Seats handed over before 0.7.9** keep their adopted origin until a later
+  launched handover or managed launch records a new session, so until then
+  `rig seat stop`, `restart` and `clean` refuse them; the refusal now says so.
+  ([#2440](https://github.com/mvschwarz/openrig/pull/2440), [#2572](https://github.com/mvschwarz/openrig/pull/2572))
+- **Codex hooks after an upgrade:** Codex sessions kept running across the
+  upgrade to 0.7.9 showed "Hook failed — plugin contents changed; hook approval
+  required" until relaunched; in that upgrade test, one seat restarted with
+  OpenRig's managed restart showed no review afterwards. 0.7.10 changes
+  openrig-core's files again.
+- **The runner contract** has run natively only at the scope its status section
+  states (`docs/reference/harness-runner-contract.md`); any other runner,
+  provider or path is unqualified until shown.
+- **Fixed or changed from 0.7.9's limits:** the OpenShell worker's CA settings
+  (fixed, and shown working with OpenShell 0.1.6) and owned-delete inventory
+  (changed, but the cleanup still fails against 0.1.6; see above), a
+  restore request held after a managed compaction, `rig broadcast`'s `FAILED`
+  for an uncertain recipient, the refusal for a seat handed over before 0.7.9,
+  where to read what has run under the runner contract, and Codex seats'
+  `rig: command not found` (now a non-login shell by default; see Behaviour that
+  changed).
+- **The 0.7.8 limits that 0.7.9 didn't fix or change, and the 0.7.7 and 0.7.6
+  limits, below still apply.**
 
 ### Credits
 
-Thanks to @billbenetti, @seanmcn, @smota, @Aummadour, @dajiaohuang, @w4rc0n,
-@Mohsintl, @twotnguyen, @ziadeh and @Nikhi00718 for merged contributions.
-Thanks to @billbenetti for the reports behind [#2752](https://github.com/mvschwarz/openrig/pull/2752), [#2660](https://github.com/mvschwarz/openrig/pull/2660) and [#2738](https://github.com/mvschwarz/openrig/pull/2738), to
-@pr0xc3nt4ur1 for the report behind [#2740](https://github.com/mvschwarz/openrig/pull/2740) and [#2743](https://github.com/mvschwarz/openrig/pull/2743), to @oneandonlydean for
-the process chain behind [#2751](https://github.com/mvschwarz/openrig/pull/2751), and to @niklasbaldi for the report and cause
-behind [#2654](https://github.com/mvschwarz/openrig/pull/2654).
+Thanks to @dajiaohuang, @Aummadour, @billbenetti, @smota, @Nikhila-Dhevi-R and
+@Vaishnavi220506 for merged contributions, and to @AlephCasara, whose work on a
+fork pointed us to the unpaged event notification drain
+([#2610](https://github.com/mvschwarz/openrig/pull/2610)), and to @natefaerber, whose
+approach in [#2467](https://github.com/mvschwarz/openrig/pull/2467) the Herdr view fix follows. Thanks to
+@billbenetti, @KM199, @ziadeh, @dajiaohuang, @jajabong, @george661 and
+@aanestesia for reports carried into this release, and to @smota for the
+OpenTelemetry discussion behind [#2589](https://github.com/mvschwarz/openrig/pull/2589).
 
 ## [0.7.9]
 

README.md

@@ -26,9 +26,9 @@ use:
 
 ```sh
 # Claude Code
-npx skills add https://github.com/mvschwarz/openrig/tree/v0.7.11/skills/rigs --skill rigs --agent claude-code
+npx skills add https://github.com/mvschwarz/openrig/tree/v0.7.5/skills/rigs --skill rigs --agent claude-code
 # Codex
-npx skills add https://github.com/mvschwarz/openrig/tree/v0.7.11/skills/rigs --skill rigs --agent codex
+npx skills add https://github.com/mvschwarz/openrig/tree/v0.7.5/skills/rigs --skill rigs --agent codex
 ```
 
 Then type `/rigs` in Claude Code, or `$rigs` in Codex, and say what you want built. The skill has your agent tell
@@ -68,11 +68,11 @@ Requires Node.js 22 or 24 and tmux, on macOS or Linux, and one working Claude Co
 
 ### Install it yourself
 
-This runs OpenRig's install script from the `v0.7.11` release. It checks Node.js and npm, installs the latest published `@openrig/cli` with `npm install -g`, runs the Node.js and SQLite check, then runs `rig setup --dry-run` and `rig setup`. The first line prints that plan and changes nothing:
+This runs OpenRig's install script from the `v0.7.5` release. It checks Node.js and npm, installs the latest published `@openrig/cli` with `npm install -g`, runs the Node.js and SQLite check, then runs `rig setup --dry-run` and `rig setup`. The first line prints that plan and changes nothing:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.11/scripts/install.sh | sh -s -- --dry-run
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.11/scripts/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.5/scripts/install.sh | sh -s -- --dry-run
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.5/scripts/install.sh | sh
 ```
 
 If the last step isn't ready, the installer reports `INSTALLED, SETUP NOT COMPLETE` and points to the details from `rig setup` above. Follow that output and any reported Fix, then rerun `rig setup`; the CLI does not need reinstalling. If the only remaining failures are provider sign-ins, sign in to each selected provider as below and continue.

ROADMAP.md

@@ -6,9 +6,9 @@ This isn't a schedule or a promise: we release often, and an item ships when a g
 To see what's being worked on, by release and theme, open the [OpenRig roadmap board](https://github.com/users/mvschwarz/projects/1).
 Issues labelled `good first issue` are also listed on the [contribute page](https://github.com/mvschwarz/openrig/contribute).
 
-## Released in 0.7.9
+## Released in 0.7.10
 
-[0.7.9 is published](https://github.com/mvschwarz/openrig/releases/tag/v0.7.9): it follows through on 0.7.8. A person's typed words on a runner seat's permission ask now reach the agent, each permit OpenRig grants a runner by default is recorded, and a runner can keep a long, quiet turn reading working. See its release notes for what shipped, known issues, upgrade instructions and contributor credits.
+[0.7.10 is published](https://github.com/mvschwarz/openrig/releases/tag/v0.7.10): it is a patch for people running their own agent teams. A step held after a managed compaction now goes in instead of waiting forever. See its release notes for what shipped, known issues, upgrade instructions and contributor credits.
 
 ## How to help
 

docs/as-built/architecture/adapters-and-runtimes.md

@@ -398,6 +398,21 @@ adapter never closes a session on it and reports `rex_outcome_unknown`.
 Herdr and Rex build their layout trees from one grid helper
 (`buildTileGrid`, `tile-layout.ts`).
 
+`HerdrAppProvider` (`herdr-app-provider.ts`) opens a view in a herdr-app
+window (one provider per app home, cached in `startup.ts`). In the daemon it is
+used only when named (`resolveHerdrAppProvider` in `terminal-service.ts`). Its
+transport (`herdr-app-transport.ts`) sends one JSON line per
+connection to `<app home>/herdr-app.sock` and reads the window's own "did not
+answer" as `unknown`. A view is a child of OpenRig's stack in a derived
+`layouts/rig.json` (`deriveRigLayout`, `herdr-app-layout.ts`), written
+atomically, with viewers started by `hc run --bg --no-parent` and journalled
+first (`herdr-app-state.ts`). Removal rewrites the file before a viewer ends,
+and ends it only after the `rig-strip` mod's acknowledgement
+(`<app home>/openrig/ack.json`) shows a layout without it. An `hc events`
+watcher (`startup.ts`) turns a viewer that ended elsewhere into an ended cell.
+Its four mods ship in `packages/daemon/assets/herdr-app/mods/` and are
+installed by `herdr-app-install.ts`.
+
 ### Tmux server selection
 
 Before reconciliation, `startup.ts` calls `selectTmuxServer` in

docs/as-built/architecture/coordination-primitive.md

@@ -237,7 +237,9 @@ The sweep reports six finding kinds. Its custody check covers closures that
 name a successor qitem or a seat (`closure_reason = handed_off_to`) in the last
 24 hours, plus older closures with open findings. A seat target is satisfied by
 a local successor carrying this row's lineage, and any target by a
-`custody-verified: <target> …` note on the closed row. A new custody finding for
+`custody-verified:` note on the closed row: per note, its first word that names one
+of the row's targets exactly (or a comma list of them) is what it verifies, and later
+mentions don't count; the finding prints each target's note. A new custody finding for
 a human destination goes to the agent that closed the item, using the closing
 transition from active or archived history. Later notes and notification
 receipts do not change that owner. If the closing actor is missing, human, system
@@ -278,7 +280,13 @@ canceled, no-follow-on, escalation, superseded}`. The reasons
 `closure_target` (`:86`):
 
 - `handed_off_to` — work continues with a different seat (`closure_target` =
-  new owner).
+  new owner). `rig queue show` on such a row names the row the handoff made in
+  `successors` (rows whose `handedOffFrom` is this row, and a local row its
+  closure target names), or says in `successorNote` why none is named. A
+  cross-host successor is named as recorded (`<id>@<host>`); nothing stored
+  changes. Past 20 such rows the newest 20 are named, with
+  `successorsTruncated: true`. A scoped MCP caller doesn't get these fields;
+  `rig_queue_show`'s scope-checked `successor` answers it instead.
 - `blocked_on` — an active `state=blocked` park record, rejected with `state=done`.
   To wait for a qitem, use `rig queue block <id> --on <child>` or
   `rig queue update <id> --state blocked --blocked-on <child>`; the item returns

docs/as-built/architecture/lifecycle-snapshot-restore.md

@@ -160,8 +160,9 @@ Restore behavior, each point checked in `restore-orchestrator.ts`:
   `:780`; if `status === "restoring"` the node is skipped with a warning and
   reported as `fresh`, `:783–785`; `degraded` only adds a warning).
 - Reuses the seat's durably bound tmux session name when the prior binding
-  has a usable one (`:840`), and otherwise falls back to the derived name
-  with a warning (`:869`).
+  has a usable one, and otherwise falls back to the derived name. A missing
+  binding after the latest session's recorded intentional exit is quiet;
+  unclean/legacy missing bindings and incomplete or invalid binding rows still warn.
 - Replays restore-safe startup using persisted startup context;
   prefilters missing optional artifacts into warnings; **hard-fails a node if
   a required startup file is missing** (`:1161` — status `"failed"`, error

docs/as-built/architecture/transport-and-transcripts.md

@@ -169,9 +169,19 @@ Routes: `packages/daemon/src/routes/{transport,transcripts,ask,chat,whoami}.ts`
      posture, one for each mode OpenRig can launch: bypass
      (`⏵⏵ bypass permissions on (shift+tab to cycle) · ← for agents`), accept
      edits (OpenRig's default), auto, don't ask, plan, and default
-     (`⏸ manual mode on · ← for agents`); no statusLine row between the
-     closing rule and the footer (OpenRig's statusLine collector prints
-     nothing); a blank, effort or tmux-notice row above the box; and above
+     (`⏸ manual mode on · ← for agents`); between the closing rule and the
+     footer, either no row (OpenRig's statusLine collector prints nothing) or
+     the rows a person's own statusLine prints, with the indicator Claude
+     draws at the right of the first one (`● high · /effort`), trusted only by
+     position, as the composer reader trusts them (#2703, #2798): the closing
+     rule is the first rule above the footer, the frame above it must check
+     out, and no row between them may be blank or look like a menu or dialog
+     (`❯`, `›` or `»` anywhere in the row, a row that starts with a numbered
+     choice such as `1. ` or `2) `, with or without a border or gutter before
+     it, a box corner, or a row framed by side borders); so a statusLine that
+     uses `›`, `»` or `❯` as a separator, prints a blank row or starts a row
+     with a number and a dot reads `unknown`; a blank, effort or tmux-notice
+     row above the box; and above
      that, in the status slot, the completion row of the seat's last turn
      (`✻ <verb> for <duration> · done <time>` at column 0, matched by the
      Claude Code 2.1.296 bundle's grammar: one of its eight past-tense verbs,
@@ -204,13 +214,15 @@ Routes: `packages/daemon/src/routes/{transport,transcripts,ask,chat,whoami}.ts`
      status row, `esc to interrupt`, `paste again to expand`, a queued label,
      Codex's pending-input headers or `↳` rows, a spinner). Any other frame,
      including every running, streaming, steer-preview, paste-hint or unknown
-     layout, another seat's name, a statusLine that prints a row, a background
-     shell in the footer and a fullscreen renderer with a statusLine (which
-     reserves a row for it), reads `seat: not-idle` or
-     `unknown`, and the send reads unconfirmed. This holds when a running turn
-     hides its signal (Codex hides its `• Working` row while it streams;
-     Claude Code shows only `paste again to expand` in its footer for 8 s
-     after a paste, and no `esc to interrupt` under a statusLine). So a send to
+     layout, another seat's name, a second rule drawn under the box, a blank,
+     prompt-, menu- or dialog-shaped row between the closing rule and the
+     footer (so a fullscreen renderer that reserves a blank row for the
+     statusLine reads as before), and a background shell in the footer, reads
+     `seat: not-idle` or `unknown`, and the send reads unconfirmed. This
+     holds when a running turn hides its signal (Codex hides its `• Working`
+     row while it streams; Claude Code shows only `paste again to expand` in
+     its footer for 8 s after a paste, and no `esc to interrupt` under a
+     statusLine). So a send to
      a busy or unknown seat always reads unconfirmed.
 
      **Versions.** The layouts were recorded from Claude Code 2.1.296 and
@@ -272,7 +284,13 @@ Routes: `packages/daemon/src/routes/{transport,transcripts,ask,chat,whoami}.ts`
      characters never widen it. Any other break, and a break inside a word of
      the text, reads `ambiguous` and the send stays unconfirmed. A collapsed paste label, Claude's
      queued-messages label or `Try "…"` suggestion, or another draft is never
-     the message. The default `--verify` matcher above is unchanged.
+     the message. The default `--verify` matcher above is unchanged. Claude
+     Code's box ends at the last rule on the screen; the rows under it up to
+     the footer are a person's statusLine, read by position with the same
+     rule as the seat check above (#2798), so a box with statusLine rows
+     under it reads as one without them, and a blank, prompt-, menu- or
+     dialog-shaped row there leaves it `unrecognized`. The startup Enter
+     guard reads the same region.
    - **The box is empty after Enter on the same pane process.** The capture
      after Enter must show the box empty, with the pane process
      (`#{pane_pid}`) and the seat's binding unchanged.

docs/as-built/architecture/workflow-runtime.md

@@ -84,6 +84,15 @@ Diagnostic-only rows, moved sources, and versions retained for unfinished
 work have separate paths in `readThrough`, `writeDiagnostic`, and
 `isPinnedByUnfinishedWork`.
 
+Only instantiate (and `rig workflow run`, which posts to the same route) and
+the workflows-folder scan register specs through `readThrough`.
+`WorkflowRuntime.validate` (`rig workflow validate`, `POST /validate`) reads
+the file with `WorkflowSpecCache.readFromDisk`: the same file and parse
+checks, in memory, with no `workflow_specs` write. A spec that was only
+validated from outside the workflows folder is not listed by
+`rig workflow specs` and is not found by its bare name; its path still
+instantiates (#2726).
+
 ## Durable state
 
 The migration files record the storage evolution; they are not a count of

docs/as-built/cli-reference.md

@@ -9,23 +9,23 @@ applies-when: |
   the source that implements a command. Use command help for invocation details.
 siblings: [README.md, codemap.md]
 prerequisite-reads: [../reference/help.md]
-last-verified-against-source: 34fdcb80543903b054a982cc48bb302ae6871682
-last-updated: 2026-10-26
+last-verified-against-source: b29a70f14fc11797d46cbd9f12d4e61a523c3d06
+last-updated: 2026-11-09
 ---
 
 # CLI Reference — Registered Commands and Options
 
-Verified against source commit `34fdcb80543903b054a982cc48bb302ae6871682`.
+Verified against source commit `e1dedbf531b6db9961b4c77c0a74564e58274a50`.
 The inventory below comes from the actual Commander tree returned by
 [`createProgram()`](../../packages/cli/src/index.ts), not a grep of command
 strings or an installed CLI from a different commit.
 
-There are **90 top-level registrations**, **410 registered command objects**
+There are **92 top-level registrations**, **440 registered command objects**
 below `rig` (including groups and the hidden `restore apply` command), and
-**1,304 explicitly registered option objects**, including the root version
+**1,460 explicitly registered option objects**, including the root version
 option. Aliases do not add command objects; short/long spellings of one
 option do not add option objects. Commander-generated help is additional.
-These are counts for that source snapshot, not a claim about a deployed release. The provider-switch and set-runtime rows include the later account-home options; those additions are not included in the snapshot counts. The `environment` section and the `host edit`, `host remove` and `terminal attach` rows were added later from source at `522d635c`, and aren't in the snapshot counts either. With `environment`, main registers 91 top-level commands.
+These are counts for that source snapshot, not a claim about a deployed release. Every registered family is inside the snapshot: the `exec` and `environment` families, the `roster` and `telemetry` rows, and the `host edit`, `host remove` and `terminal attach` rows that earlier snapshots listed as later additions are all counted here, as are the herdr-app provider's `terminal close` row and its `--app-home` options.
 
 ## Reading this reference
 
@@ -188,7 +188,7 @@ the sections that were not read are `null`.
 |---|---|---|
 | `rig gateway` | — | — |
 | `rig gateway human` | — | — |
-| `rig gateway human add <entityId>` | — | `--display-name <name>` **required**<br>`--binding <kind:connectorRef:secretsRef:role[:handle=<id>]>` **required** (repeatable)<br>`--delivery-class <A\|B\|C\|D>` **required**<br>`--away`<br>`--replace`<br>`--reason <reason>`<br>`--actor <actor>`<br>`--organization <id>`<br>`--group <id>` (repeatable)<br>`--policy <text>`<br>`--policy-file <path>`<br>`--default` |
+| `rig gateway human add <entityId>` | — | `--display-name <name>` **required**<br>`--binding <kind:connectorRef:secretsRef:role[:handle=<id>]>` (repeatable; without one, the person is reached in the Feed and Steering only)<br>`--delivery-class <A\|B\|C\|D>` **required**<br>`--away`<br>`--replace`<br>`--reason <reason>`<br>`--actor <actor>`<br>`--organization <id>`<br>`--group <id>` (repeatable)<br>`--policy <text>`<br>`--policy-file <path>`<br>`--default` |
 | `rig gateway human list` | — | `--json` |
 | `rig gateway human quiet` | — | — |
 | `rig gateway human quiet set <entityId>` | — | `--daily <window>`<br>`--until <time>`<br>`--tz <zone>`<br>`--actor <actor>`<br>`--json` |
@@ -226,6 +226,7 @@ the sections that were not read are `null`.
   `groups`, `warnings` and `participantFile`. `default` with no argument prints the current default and its source
   (`chosen` or `only-person`), or `null` with the reason. See `docs/reference/gateway-participants.md`.
 - `human set <entityId> slack-subscription <value>` — sets the person's Slack subscription: `every-ask` (the default) posts every ask to them to Slack; `urgent-only` posts only asks created with `--alert`, and other asks wait on Steering and the TUI; `unset` removes the authored subscription so the default applies. `human show` prints the value with its origin, `authored` or `default` (`slack-subscription: every-ask (default)`); `--json` carries it as `record.slackSubscription` `{ value, source }`.
+- `human set <entityId> binding.<n> <spec|unset>` — replaces `binding.<n>` with a full `kind:connectorRef:secretsRef:role[:handle=<id>]` spec, or removes that slot when `<value>` is `unset`. Removing a binding keeps the person, their preferences, their other bindings and their open questions, and prints `remainingBindings` (with their shifted `binding.<n>` slot indexes; the primary's slot shifts down too when a lower-index secondary is removed) plus `note`. No replacement `primary` is chosen silently: unsetting a `primary` while secondary bindings remain is refused, teaching how to replace the primary slot in place, promote an existing secondary binding (first save that binding's full spec from `rig gateway human show <entityId> --json`, then unset that secondary slot, then find the primary's current slot in `remainingBindings` or `rig gateway human show <entityId> --json` and set it to the saved spec with role `primary` — promotion replaces the former primary binding, and its connector reference and inbound handle are not retained as a secondary), or unset the secondary slots first using their current slot indexes from `remainingBindings` or `rig gateway human show <entityId>` and finish at `binding.0` when removing every binding. Removing the last binding makes the current delivery episode inactive so new missing-post findings stop (an already-open recovery item for an undelivered notice may remain, and the current delivery-outcome display may disappear while historical receipt notes remain); it does not answer, close or cancel open questions, cancel or reroute already-prepared deliveries, or retract anything a bridge has already accepted.
 
 ### parked
 
@@ -367,6 +368,21 @@ The request stays open on the target for as long as `--timeout` waits (600 secon
 approval says how long and until when, in UTC. A target older than this CLI ignores the timeout and keeps the request
 10 minutes.
 
+On a 0.7.11 or later target, its person approves the request by answering its question with Approve: in the TUI
+(`rig tui`, then `attention`: open it), on Steering, or with Slack's Approve button. From an agent seat on the target,
+`rig queue update <id> --state done --closure-reason no-follow-on --resolution approve` approves. `rig queue update` acts
+as a managed seat, so it refuses in a plain terminal. To refuse a pairing, answer Deny, let it expire (nothing is
+persisted), or `rig queue update <id> --state denied` from an agent seat. A typed reply, even "yes", is kept as the
+person's words and doesn't approve: it closes the request, and the requester is told it was denied. An agent seat's
+close without `--resolution approve` denies too.
+
+A 0.7.10 or earlier target asks no question. Its person approves with the request's Approve, in the TUI (`rig tui`,
+then `attention`: open it; the TUI from 0.7.1) or on Steering, and from an agent seat `rig queue update <id> --state done
+--closure-reason no-follow-on` approves. There, every close that leaves the request `done` approves it, whatever its
+closure reason: a typed reply, or an agent seat's `rig queue update <id> --state done --closure-reason denied`,
+included. To refuse a pairing on such a target, let it expire, or from an agent seat set the request `denied`
+(`rig queue update <id> --state denied`); a `canceled` or `failed` state refuses too.
+
 Registration makes a host visible in topology; remote FEED attention remains opt-in.
 The human-readable success output of `host add` and `host pair` now includes the FEED
 next step alongside the existing `host doctor` suggestion. For an HTTP entry named
@@ -406,7 +422,7 @@ do not establish connectivity to a live peer.
 | Invocation | Aliases | Declared options |
 |---|---|---|
 | `rig mcp` | — | — |
-| `rig mcp serve` | — | `--port <port>`<br>`--http`<br>`--bind <host:port>`<br>`--grant-service <url>`<br>`--grant-service-header-file <path>`<br>`--oauth-resource <url>`<br>`--oauth-issuer <url>` |
+| `rig mcp serve` | — | `--port <port>`<br>`--http`<br>`--bind <host:port>`<br>`--grant-service <url>`<br>`--grant-service-header-file <path>`<br>`--oauth-resource <url>`<br>`--oauth-issuer <url>`<br>`--front-door`<br>`--task-destination <seat>` |
 | `rig mcp token` | — | — |
 | `rig mcp token add <name>` | — | `--seat <session>` **required**<br>`--rig <name...>`<br>`--root <name...>`<br>`--workspace`<br>`--owner` |
 | `rig mcp token list` | — | `--json` |
@@ -491,7 +507,7 @@ default-permit record (tag `runner-permission-permit`) opens no row.
 | `rig queue create` | — | `--source <session>`<br>`--destination <session>` **required**<br>`--body <text>`<br>`--body-file <path>`<br>`--body-context <ref>`<br>`--mission <id>`<br>`--slice <id>`<br>`--gate <role>`<br>`--priority <priority>`<br>`--tier <tier>`<br>`--tags <tags>`<br>`--expires-at <iso>`<br>`--id <qitemId>`<br>`--target-repo <name>`<br>`--summary <text>`<br>`--human-intent <intent>`<br>`--alert`<br>`--human-detail-file <path>`<br>`--reply-to <qitemId>`<br>`--human-questions-file <path>`<br>`--evidence-ref <path>`<br>`--host <id>`<br>`--no-nudge`<br>`--verify`<br>`--full`<br>`--json` |
 | `rig queue claim <qitemId>` | — | `--destination <session>`<br>`--full`<br>`--json` |
 | `rig queue unclaim <qitemId>` | — | `--destination <session>`<br>`--reason <text>`<br>`--full`<br>`--json` |
-| `rig queue update <qitemId>` | — | `--actor <session>`<br>`--state <state>`<br>`--reopen`<br>`--closure-reason <reason>`<br>`--closure-target <target>`<br>`--closure-required-at <iso>`<br>`--resolution <text>`<br>`--blocked-on <blocker>`<br>`--wake-watchdog <jobId>`<br>`--wake-after <duration>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--note <text>`<br>`--host <id>`<br>`--full`<br>`--json` |
+| `rig queue update <qitemId>` | — | `--actor <session>`<br>`--state <state>`<br>`--reopen`<br>`--closure-reason <reason>`<br>`--closure-target <target>`<br>`--closure-required-at <iso>`<br>`--resolution <text>`<br>`--blocked-on <blocker>`<br>`--wake-watchdog <jobId>`<br>`--wake-after <duration>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--note <text>`<br>`--source <name@external>`<br>`--host <id>`<br>`--full`<br>`--json` |
 | `rig queue block <qitemId>` | — | `--on <blocker>` **required**<br>`--actor <session>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--note <text>`<br>`--continuation <text>`<br>`--wake-watchdog <jobId>`<br>`--wake-after <duration>`<br>`--host <id>`<br>`--full`<br>`--json` |
 | `rig queue resolve <qitemId>` | — | `--decision <text>` **required**<br>`--actor <session>`<br>`--bearer <token>`<br>`--no-notify`<br>`--json` |
 | `rig queue handoff <qitemId>` | — | `--from <session>`<br>`--to <session>` **required**<br>`--body <text>`<br>`--body-file <path>`<br>`--note <text>`<br>`--priority <priority>`<br>`--tier <tier>`<br>`--tags <tags>`<br>`--gate <role>`<br>`--target-repo <name>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--alert`<br>`--host <id>`<br>`--no-nudge`<br>`--full`<br>`--json` |
@@ -510,6 +526,7 @@ default-permit record (tag `runner-permission-permit`) opens no row.
 | `rig queue inbox-pending <destinationSession>` | — | `--json` |
 | `rig queue outbox-record` | — | `--sender <session>`<br>`--destination <session>` **required**<br>`--body <text>`<br>`--body-file <path>`<br>`--tags <tags>`<br>`--urgency <urgency>`<br>`--audit <pointer>`<br>`--id <outboxId>`<br>`--json` |
 | `rig queue outbox-list <senderSession>` | — | `--limit <n>`<br>`--json` |
+| `rig queue erase` | — | `--members <file>`<br>`--rig <id>`<br>`--ids <file>`<br>`--action <action>` (`delete`, `scrub`)<br>`--routine`<br>`--apply`<br>`--actor <session>`<br>`--json` |
 
 ### slack
 
@@ -569,13 +586,16 @@ default-permit record (tag `runner-permission-permit`) opens no row.
 | Invocation | Aliases | Declared options |
 |---|---|---|
 | `rig terminal` | — | — |
-| `rig terminal open <view>` | — | `--provider <name>`<br>`--session <name>`<br>`--window`<br>`--expected-plan <id>`<br>`--json` |
+| `rig terminal open <view>` | — | `--provider <name>`<br>`--session <name>`<br>`--window`<br>`--app-home <dir>`<br>`--expected-plan <id>`<br>`--follow`<br>`--no-follow`<br>`--max-tiles <count>`<br>`--pin <seats...>`<br>`--unpin <seats...>`<br>`--suppress <seats...>`<br>`--unsuppress <seats...>`<br>`--suppression-ms <ms>`<br>`--grace-ms <ms>`<br>`--focus-retention-ms <ms>`<br>`--json` |
 | `rig terminal views` | — | `--json` |
-| `rig terminal status` | — | `--provider <name>`<br>`--session <name>`<br>`--json` |
+| `rig terminal close <view>` | — | `--app-home <dir>`<br>`--json` |
+| `rig terminal status` | — | `--provider <name>`<br>`--session <name>`<br>`--app-home <dir>`<br>`--json` |
 | `rig terminal attach <session>` | — | `--read-only` |
 
 See [named terminal sessions](../reference/terminal-sessions.md) to select a
 Herdr session per request, including session-bound previews and window reuse.
+herdr-app views (`--provider herdr-app`, plain `rig terminal open <view>` inside an answering herdr-app terminal versus `--window` for a desktop window, `close`, `--app-home`) are in
+[herdr-app](../reference/herdr-app.md).
 
 ### watchdog
 
@@ -674,6 +694,9 @@ Only Claude and Codex tenures can be woken.
 | Invocation | Aliases | Declared options |
 |---|---|---|
 | `rig context` | — | — |
+| `rig context reconstruction` | — | — |
+| `rig context reconstruction inspect` | — | `--store <absolute-path>`<br>`--store-map <file>`<br>`--project <id>`<br>`--mission <id>`<br>`--slice <id>`<br>`--cwd <path>`<br>`--item <id>`<br>`--category <name>`<br>`--tag <name>`<br>`--check-sources`<br>`--max-bytes <bytes>`<br>`--json` |
+| `rig context reconstruction view` | — | `--store <absolute-path>`<br>`--store-map <file>`<br>`--project <id>`<br>`--mission <id>`<br>`--slice <id>`<br>`--cwd <path>`<br>`--item <id>`<br>`--category <name>`<br>`--tag <name>`<br>`--check-sources`<br>`--max-bytes <bytes>`<br>`--json` |
 | `rig context work-install` | — | `--project <id>`<br>`--mission <id>`<br>`--slice <id>`<br>`--deliver`<br>`--runtime <runtime>`<br>`--cwd <path>`<br>`--topology <ids>`<br>`--apply-skills`<br>`--json` |
 | `rig context trace` | — | `--rig <rig>` **required**<br>`--pod <pod>`<br>`--seat <seat>`<br>`--name <file>` **required**<br>`--json` |
 | `rig context compose` | — | `--out <ref>` **required**<br>`--from <files...>` **required** |

docs/as-built/test-layers.md

@@ -8,7 +8,7 @@ applies-when: |
   read it before claiming a stub-agent scenario covers a behaviour.
 siblings: [arteries.md, README.md, codemap.md]
 last-verified-against-source: e8f0ab340db773392ec8be75b072d1c0f3068a50
-last-updated: 2026-10-08
+last-updated: 2026-11-09
 ---
 
 # Test layers: what to run before you push, and what each layer proves
@@ -448,9 +448,12 @@ not as current status.
 
 ## Help wanted: command families without a behavioural scenario
 
-> This list may be stale. It was taken from the `rig --help` tree of 0.6.3: 85 visible
-> top-level families. At `e8f0ab34`, `packages/cli/src/index.ts` registers 87 top-level
-> commands; `roster` and `telemetry` were added since and have no row yet. Before picking one up, check `packages/test-system/scenarios/`, the cases in
+> This list may be stale. The tables below cover the families that have a proposed first
+> check: at `b29a70f14`, the Commander tree returned by `createProgram()`
+> (`packages/cli/src/index.ts`) registers 92 top-level families, 87 of which have a row
+> below (7 of them marked partial); `roster` and `telemetry` now have rows too. These 5
+> families still have no row: `acp`, `community-harness`, `edge`, `environment`, `exec`.
+> Before picking one up, check `packages/test-system/scenarios/`, the cases in
 > `scripts/run-pr-scenarios.sh`, and the current `rig --help`.
 > One scenario doesn't cover a family's every option, sequence or platform. A `--help`
 > check only proves the command is discoverable. Existing unit tests are not counted here.
@@ -522,6 +525,8 @@ Before you start, two honest constraints:
 | reads | `status` | Two rigs in different states. Status matches their exact identities and transitions. |
 | reads | `ps` | Two rigs with overlapping seat names. Rig and node filters return exactly the intended members. |
 | reads | `usage` | Deterministic stub telemetry. top and series respect seat and time bounds. Missing data isn't reported as zero. |
+| reads | `roster` | A scratch workspace with two rigs and a rosters folder: `rig roster find` returns the expected specialists, and an empty folder reports none without an error. |
+| reads | `telemetry` | Deterministic retained-metadata fixtures: one bounded page returns exactly the recorded rows, and a history gap is named rather than skipped silently. |
 | reads | `health` | Known fresh, stale and cleared findings. Scope, explain and diagnosis values match the fixture. |
 | continuity | `snapshot` | Snapshot two seats. Rig, membership and snapshot bytes survive a daemon restart. |
 | continuity | `restore` | Restore after a daemon and tmux reset. Seat identity and nonce answers survive. |

docs/reference/community-harness-examples/omo/omo.yaml

@@ -0,0 +1,14 @@
+# Install as $OPENRIG_HOME/community-harnesses/omo.yaml.
+# OmO Native (npm omo-ai 5.1.48) on the senpi engine — a Pi fork speaking Pi's RPC protocol.
+# With protocol: pi-rpc, OpenRig runs OmO through its Pi runner: structured activity, prompt/steer,
+# transcript isolation, and session file resumption.
+format: 1
+name: omo
+command: omo
+maintainer: Your name or team
+protocol: pi-rpc
+resume: true
+limits:
+  - checked with omo 5.1.48 (senpi engine 2026.10.25-2)
+  - credentials resolved via omo's agent directory or models.json
+  - models declared via provider/id format (e.g. zai/glm-5.3-flash, openrouter/...)

docs/reference/community-harness-presets.md

@@ -53,6 +53,7 @@ startup_assisted: true           # optional: startup submission needs a person's
 first_input: true                # optional: launcher takes the first turn from OPENRIG_FIRST_INPUT (below)
 # runner: true                  # optional, needs launch_result: the launcher reports the seat's activity (below)
 # passes_model: true            # optional: the launcher takes the seat's declared model from OPENRIG_MODEL (below)
+# launch_wrapper: true          # optional: a runner applies OPENRIG_LAUNCH_WRAPPER to its native child (below)
 ```
 
 - **`command`** is a single program and its arguments. Shell syntax such as `|`, `&&`, `;`, redirections or `$(…)`
@@ -164,6 +165,10 @@ and reports what it's doing, as OpenRig's own Pi runner does. The seat's activit
   unavailable.
 - **Input is as for any seat.** A send pastes the text and presses Enter, so a runner should submit everything up to that
   Enter as one prompt.
+- **`launch_wrapper: true` declares wrapper support and requires `runner: true`.** A member with a wrapper and a runner preset without this flag is refused at preflight and launch (not schema validation):
+  `launch_wrapper unsupported: the community preset "<runtime>" runs a runner without launch_wrapper: true; no agent started. Add launch_wrapper: true to the preset if its runner applies OPENRIG_LAUNCH_WRAPPER, or remove launch_wrapper from this member.` See the
+  [harness and runner contract](harness-runner-contract.md#2-declare-it-what-the-preset-says-fixed-at-launch)
+  for the environment handoff, native-child execution and refusal requirements.
 
 **What the runner posts.** The runner posts each event to `POST /api/activity/hooks` with the local activity hook token,
 one at a time and in order, without making the agent wait. It finds the address and token in `OPENRIG_URL` (or
@@ -188,6 +193,37 @@ one at a time and in order, without making the agent wait. It finds the address
 - **A runner's full duties** (liveness, input, cancellation and permissions) are in the draft
   [harness and runner contract](harness-runner-contract.md).
 
+## Pi-compatible RPC harnesses (`protocol: pi-rpc`)
+
+For a community harness that is a fork of Pi or speaks Pi's CLI and JSONL RPC protocol (such as OmO Native on senpi or Prime Agent), set `protocol: pi-rpc`.
+
+```yaml
+format: 1
+name: omo
+command: omo
+maintainer: Your name or team
+protocol: pi-rpc
+resume: true                   # only after you've checked a real reopen
+limits:
+  - checked with omo 5.1.48 (senpi engine 2026.10.25-2)
+```
+
+- **OpenRig runs the harness through its existing Pi runner.** Instead of screen scraping, the harness runs under `pi-runner` inside the seat's pane. The runner provides input buffering, paste framing, prompt/steer RPC queueing, clean transcript mirroring, and typed activity hook reporting to the daemon.
+- **`command` is the executable.** OpenRig resolves `command` (e.g. `omo` or `/usr/local/bin/senpi`) against the seat pane's environment, resolving symlinks and version-manager shims (such as `mise`) safely.
+- **Session identity and resume come from the runner.** Transcripts and sessions are persisted as JSONL files under `$OPENRIG_HOME/state/pi/<session>/sessions/`, and the fork's `get_state` reports the session file, so `launch_result` and `names_conversation` aren't needed.
+  - **With `resume: true`** declared, resuming or restoring a seat continues that exact session file via `--session <file>`. Without it, the preset is launch-only; a restore that would resume its saved conversation waits for a fresh-start decision.
+  - **A fork that reports no session file** reads as needing attention, and the launch doesn't read ready.
+  - **A resume that comes up on another session file** is refused, and that file's identity isn't recorded, so the seat keeps the one it asked for. The seat reads as needing attention.
+- **Launch arguments a fork must accept.** When spawned under `pi-runner`, the executable named by `command` must accept Pi's core CLI arguments:
+  - `--mode rpc`
+  - `--session-dir <dir>`
+  - `--name <session-name>`
+  - `--approve` or `--no-approve` (depending on seat trust)
+  - And conditionally when configured or resuming/forking: `--model <provider/id>`, `--thinking <level>`, `--session <sessionFile>`, or `--fork <sessionFile>`.
+  Forks that reject these flags cannot currently run with `protocol: pi-rpc`.
+- **Skills, guidance, and model passthrough.** Skills are projected into `<agentDir>/skills/` and managed guidance into `AGENTS.md`. For a fork that reads Pi's variables (`PI_CODING_AGENT_DIR`, etc.), declared models are passed as `--model provider/id` with provider API key allowlisting, and effort is passed as `--thinking <level>`. Usage is not reported for a fork, and extension dialogs are handled as Pi's (cancelled when an extension requests interactive confirmation in a managed pane).
+- **Mutual exclusions:** `protocol: pi-rpc` manages session identity and activity through the Pi runner; it cannot be combined with `runner: true`, `launch_result: true`, `names_conversation: true`, `startup_assisted: true`, or `first_input: true`.
+
 ## An example: Hermes
 
 [`community-harness-examples/hermes/`](community-harness-examples/hermes/) has a preset and a small launcher for Hermes
@@ -310,9 +346,27 @@ Its [README](community-harness-examples/dsh/README.md) has the setup and a check
 and maintain them as your own.
 
 The launcher is the contributor's code, in the contributor's package. OpenRig runs no code from a preset and loads no
-module into its daemon. A preset that sets `launch_result`, `names_conversation`, `startup_assisted`, `first_input`, `runner` or `passes_model` is refused by an older
+module into its daemon. A preset that sets `launch_result`, `names_conversation`, `startup_assisted`, `first_input`, `runner`, `passes_model` or `launch_wrapper` is refused by an older
 OpenRig that doesn't know the field.
 
+## Community-maintained runner: nodecode (@smota)
+
+A runner preset for [nodecode](https://nodecode.ai), a self-modifying Common Lisp agent with a headless JSON-lines mode
+(`nodecode rpc`). Listed here so it can be found; it isn't certified, shipped with OpenRig or supported by OpenRig's maintainers.
+
+| | |
+|---|---|
+| Maintainer | [@smota](https://github.com/smota) |
+| Repository | [smota/openrig-nodecode](https://github.com/smota/openrig-nodecode), Apache-2.0, no npm dependencies |
+| Tested with | Unreleased OpenRig `main` at `7078c754d` (its package version reads 0.7.1), built from source without fork-only commits; nodecode `0.1.13+98dd6dc80`; Node 22.23.4. Not tested on a released OpenRig (none knows `launch_wrapper`). |
+| Needs | an OpenRig that knows `launch_wrapper` (this file documents it). OpenRig 0.7.10 and earlier refuse the preset with "unknown field launch_wrapper". |
+| Test record | connector `d8dd4e6`: 95 unit checks (fake and native nodecode), `npm run test:live` (6 steps against the author's daemon built from that `main`) and an opt-in native permission-question proof with a seeded `:NOBODY` failure; results are the author's, not reproduced by OpenRig |
+| Declares | `launch_result`, `runner`, `resume`, `first_input`, `passes_model`, `launch_wrapper` |
+| Resume | `nodecode rpc <session>`; a session the gateway doesn't know is refused with `error: "missing"` (exit 3) and never replaced. The installer adds `--resume-policy last-completed`: when the session's last turn failed or was cancelled, the runner moves the head back to the last completed turn before taking input, so a resumed seat continues from its last good state; `--resume-policy head` (the bare runner's default) resumes at the head as left. Pass either flag to `scripts/install-preset.mjs` to choose. |
+| Reports | `active`, `PreToolUse`, `Stop` and `session_identity` to `/api/activity/hooks`; permission questions through `/api/activity/permission-requests` |
+| Fork commits | none needed. Stock `main` accepts the runner's `session_identity` report (the hook answers ok and the identity event is published) but does not persist a community resume token from it; the seat's identity reads unconfirmed, as for any community harness. Two fork-only daemon commits (`be17fa528`, `cbb109b62`) add that plus model and context readings, and are not part of this entry. |
+| Limits | no turn cancel; permissions bridged from nodecode's `organism.questions` only, and that proof is driven by a model prompt, so it is opt-in; a question reaches OpenRig only when every choice reads as allow or reject (once or always), others are answered in the pane by typing the exact choice, and only the first four choices are offered through OpenRig; model, provider and effort apply to fresh sessions, a resumed one stays pinned; its gateway keeps running after `rig down`; the installed preset runs each seat in its own nodecode profile (`--seat-profile auto`, sharing the operator's memories and skills), while the bare runner uses the operator's organism unless `--profile` is set; `node` must be on the pane's `PATH` |
+
 ## Pass the first startup input at launch
 
 A format-1 preset may set `first_input: true` (a boolean, default false). OpenRig composes the same initial identity turn it would otherwise paste, including the first merged text file, durable-obligation guidance and any selected orientation challenge. Before launch it writes that text to a per-attempt 0600 file under its own `state/first-input/` folder and passes the path as `OPENRIG_FIRST_INPUT`. The typed launch command carries the path, not the text; an argument-based launcher still puts the text in the native harness’s argv.

docs/reference/edge-types.md

@@ -44,13 +44,15 @@ All other edge kinds (`can_observe`, `collaborates_with`, `escalates_to`) do NOT
 
 `delegates_to` also names a seat's orchestrator for the queue: the source of the `delegates_to` edge into a seat. The
 wake ladder escalates an unacknowledged row to that orchestrator, and stuck-row findings and recovery go to it. A seat
-with no incoming `delegates_to` edge has no default orchestrator. `spawned_by` plays no part here.
+with no incoming `delegates_to` edge has no default orchestrator. A seat with several incoming `delegates_to` edges has
+no single orchestrator either: its recovery goes to its declared `escalates_to` destination, or keeps the existing
+fallback, and the recovery says the parents were ambiguous. `spawned_by` plays no part here.
 
 ### Fallback escalation across rigs
 
-A seat with **no declared `delegates_to` parent** may declare one `escalates_to` destination. The wake ladder and
-stuck sweep use it for new recovery rows; they do not move the original obligation or reassign an already-open recovery. A stopped or unbound declared
-parent still takes precedence, preserving the existing parent route and its fallback.
+A seat with **no declared `delegates_to` parent, or several**, may declare one `escalates_to` destination. The wake ladder and
+stuck sweep use it for new recovery rows; they do not move the original obligation or reassign an already-open recovery. A
+single stopped or unbound declared parent still takes precedence, preserving the existing parent route and its fallback.
 
 ```yaml
 edges:

docs/reference/gateway-relay.md

@@ -23,12 +23,19 @@ OpenRig does not embed third-party messaging platform SDKs (such as WhatsApp, Ma
 ## 1. System Topology & Custody Boundaries
 
 ### Outbound Custody & Recovery
-- OpenRig enqueues outbound decisions to a local `DispatchBuffer` before issuing any HTTP `POST` to `OPENRIG_RELAY_URL`.
-- Each logical decision freezes its complete `relayEnvelope` onto the parent `DispatchBuffer` entry before the first network attempt, with no self-imposed outbound 64 KiB cap or multi-part splitting.
-- Transport is at-least-once: OpenRig sends the complete JSON envelope in a single HTTP `POST` per attempt with `deliveryId = <decisionId>` (preserving the full `body`, `humanDetail`, `humanQuestions`/options, `summary` overflow, and digest `items` without silent clipping).
-- An HTTP `2xx` response from the bridge acknowledges durable bridge custody of that complete envelope (`deliveryId`). The bridge must persist each envelope by `deliveryId` and deduplicate replayed `deliveryId`s idempotently.
-- OpenRig records the logical queue acceptance receipt (`relay-owner-notification-accepted` with `deliveryId`) and drains the decision from `DispatchBuffer` once the HTTP `POST` returns `2xx`. Bridge acceptance confirms custody by the bridge process only (and is projected as `accepted` / `"Accepted by bridge"`, whereas Slack posts use `posted` / `"Delivered"`). It does not indicate downstream platform delivery, posting, or human receipt.
-- Failed dispatches remain in OpenRig's `DispatchBuffer` and record a relay-specific failure transition note (`relay-owner-notification-transport-failed` naming the `connectorRef`, distinct from Slack's `slack-owner-notification-transport-failed`). Replays after a lost ACK or daemon/bridge restart re-send the exact frozen `relayEnvelope` with the same `deliveryId` and bytes. If the relay subsystem stops while an outbound HTTP `POST` is in flight (or before it starts), the transport aborts cleanly (`stopped`) without recording a false failure transition note or false acceptance receipt, retaining the buffered decision for replay on restart. There is currently no periodic background timer redriving outbound dispatches on timeout.
+- OpenRig enqueues outbound decisions to a local `DispatchBuffer` before issuing any HTTP `POST` to `OPENRIG_RELAY_URL` (in `push` mode) or holding the decision for connector pull (in `pull` mode).
+- Each logical decision freezes its complete `relayEnvelope` onto the parent `DispatchBuffer` entry before the first delivery pass, with no self-imposed outbound 64 KiB cap or multi-part splitting.
+- **Push mode (`OPENRIG_RELAY_MODE=push`, default)**:
+  - Transport is at-least-once: OpenRig sends the complete JSON envelope in a single HTTP `POST` per attempt with `deliveryId = <decisionId>` (preserving the full `body`, `humanDetail`, `humanQuestions`/options, `summary` overflow, and digest `items` without silent clipping).
+  - An HTTP `2xx` response from the bridge acknowledges durable bridge custody of that complete envelope (`deliveryId`). The bridge must persist each envelope by `deliveryId` and deduplicate replayed `deliveryId`s idempotently.
+  - OpenRig records the logical queue acceptance receipt (`relay-owner-notification-accepted` with `deliveryId`) and drains the decision from `DispatchBuffer` once the HTTP `POST` returns `2xx`.
+  - Failed dispatches remain in OpenRig's `DispatchBuffer` and record a relay-specific failure transition note (`relay-owner-notification-transport-failed` naming the `connectorRef`, distinct from Slack's `slack-owner-notification-transport-failed`). Replays after a lost ACK or daemon/bridge restart re-send the exact frozen `relayEnvelope` with the same `deliveryId` and bytes. If the relay subsystem stops while an outbound HTTP `POST` is in flight (or before it starts), the transport aborts cleanly (`stopped`) without recording a false failure transition note or false acceptance receipt, retaining the buffered decision for replay on restart. There is currently no periodic background timer redriving outbound dispatches on timeout.
+- **Pull mode (`OPENRIG_RELAY_MODE=pull`)**:
+  - Client-only connectors that do not bind a listening HTTP server set `OPENRIG_RELAY_MODE=pull`. A pull profile is ready with `OPENRIG_RELAY_INBOUND_TOKEN` alone (`OPENRIG_RELAY_URL` and `OPENRIG_RELAY_OUTBOUND_TOKEN` are optional and unused in pull mode).
+  - Outbound decisions remain in `DispatchBuffer` awaiting connector pull and are never treated as failed push destinations (`relay-owner-notification-transport-failed` is not recorded). While the outbox lists a notice (staged in `DispatchBuffer` and `relay-attempted-decisions.jsonl` for its `connectorRef`), it is not a missing post for up to **24 hours** (`PULL_OUTBOX_NEVER_POSTED_WINDOW_MS`) and reads `never-posted` (`undelivered-human-notice`) if still unacknowledged after that. A notice the outbox does not list (never staged, staging failed, or its `DispatchBuffer` or seen stores are unreadable, so the outbox answers `503`) uses the usual 120-second window (`NEVER_POSTED_WINDOW_MS`). This is reporting only: nothing is held, refused or re-sent.
+  - The connector lists its pending complete envelopes via `GET /api/gateway/relay/outbox` (read-only; no consumer leases, read receipts, or required polling cadences) and acknowledges durable custody via `POST /api/gateway/relay/outbox/ack`.
+  - An acknowledgment on `POST /api/gateway/relay/outbox/ack` has the exact same custody meaning as a push `2xx`: OpenRig records `relay-owner-notification-accepted` (closing informational `update` items as delivered), marks its local outbound seen/delivered guards, and drains the decision from `DispatchBuffer`. Duplicate acknowledgments reconcile idempotently (`alreadyAccepted: true`), and retries after a partial local write failure finish the remaining receipt and drain sequence.
+- **Custody boundary (both modes)**: Bridge acceptance (via push `2xx` or pull `POST /api/gateway/relay/outbox/ack`) confirms durable custody of the complete envelope by the connector only (projected as `accepted` / `"Accepted by bridge"`, whereas Slack posts use `posted` / `"Delivered"`). It does not mean posted, seen, answered, or approved.
 
 ### Inbound Custody & Resolution
 - The operator bridge posts replies to `POST /api/gateway/relay/inbound`.
@@ -54,21 +61,29 @@ Each relay connector loads configuration from an absolute file referenced by the
 
 ### Required Secrets Keys
 
+**Push mode (`OPENRIG_RELAY_MODE=push`, default when omitted):**
 ```ini
 OPENRIG_RELAY_URL=http://127.0.0.1:8088/webhook
 OPENRIG_RELAY_OUTBOUND_TOKEN=sec_outbound_token_value
 OPENRIG_RELAY_INBOUND_TOKEN=sec_inbound_token_value
 ```
 
-- `OPENRIG_RELAY_URL`: Must use `http:`, loopback host (`127.0.0.1/8`, `::1`, or `localhost`), without URL credentials or hash fragments. Redirects (3xx) are rejected.
-- `OPENRIG_RELAY_OUTBOUND_TOKEN`: Non-empty Bearer token sent by OpenRig on outbound requests to the bridge.
-- `OPENRIG_RELAY_INBOUND_TOKEN`: Non-empty Bearer token required on inbound requests from the bridge. Must be unique across different configured relay connector profiles (`connectorRef`); sharing the same inbound token across multiple relay profiles is rejected as ambiguous (`not-ready`). Using the same token value for both `OPENRIG_RELAY_OUTBOUND_TOKEN` and `OPENRIG_RELAY_INBOUND_TOKEN` within a single profile is allowed, with a redacted readiness warning explaining why separate directional tokens are recommended so an outbound capture cannot authenticate inbound replies.
+**Pull mode (`OPENRIG_RELAY_MODE=pull`):**
+```ini
+OPENRIG_RELAY_MODE=pull
+OPENRIG_RELAY_INBOUND_TOKEN=sec_inbound_token_value
+```
+
+- `OPENRIG_RELAY_MODE`: Optional mode selector (`push` or `pull`; defaults to `push` when omitted). Any other value is rejected as `not-ready`.
+- `OPENRIG_RELAY_URL`: Required in `push` mode; ignored/unused in `pull` mode (`endpointUrl: null`). When required, must use `http:`, loopback host (`127.0.0.1/8`, `::1`, or `localhost`), without URL credentials or hash fragments. Redirects (3xx) are rejected.
+- `OPENRIG_RELAY_OUTBOUND_TOKEN`: Required in `push` mode; ignored/unused in `pull` mode. Non-empty Bearer token sent by OpenRig on outbound HTTP `POST` requests to the bridge.
+- `OPENRIG_RELAY_INBOUND_TOKEN`: Non-empty Bearer token required in both `push` and `pull` modes to authenticate connector requests (`GET /api/gateway/relay/outbox`, `POST /api/gateway/relay/outbox/ack`, and `POST /api/gateway/relay/inbound`). Must be unique across different configured relay connector profiles (`connectorRef`); sharing the same inbound token across multiple relay profiles is rejected as ambiguous (`not-ready`). Using the same token value for both `OPENRIG_RELAY_OUTBOUND_TOKEN` and `OPENRIG_RELAY_INBOUND_TOKEN` within a single `push` profile is allowed, with a redacted readiness warning explaining why separate directional tokens are recommended so an outbound capture cannot authenticate inbound replies.
 
 ---
 
 ## 3. Wire Protocol Specifications
 
-### Outbound Envelope (`POST <OPENRIG_RELAY_URL>`)
+### Outbound Envelope (`POST <OPENRIG_RELAY_URL>` or `GET /api/gateway/relay/outbox`)
 
 ```json
 {
@@ -93,6 +108,13 @@ OPENRIG_RELAY_INBOUND_TOKEN=sec_inbound_token_value
 - `replyRef`: Fixed-size opaque base64url token (`<= 4,096` characters for any supported ID lengths — `246`–`266` characters in protocol v1, hashing the canonical frozen `RelayReplyRefPayload` and binding `connectorHash`, `mode`, and optional `digest: true`) for actionable decisions; `null` for informational updates (and `null` at the top level of multi-item digests).
 - `items`: Present when `outcome` is `"digest"`. Array of objects with `qitemId`, `notificationKey`, `summary`, optional `body`, and per-item `replyRef` (or `null`).
 
+### Pull Outbox Endpoints (`GET /api/gateway/relay/outbox` & `POST /api/gateway/relay/outbox/ack`)
+
+Both endpoints require a direct loopback TCP peer (`127.0.0.1/8` or `::1`), reject browser cross-origin headers (`403`), and authenticate the caller via `Authorization: Bearer <OPENRIG_RELAY_INBOUND_TOKEN>` (`401`). If the human registry, `DispatchBuffer` (`pendingStrict()`), or outbound `SeenStore` cannot be read, both return `503` (`human_registry_unavailable`, `dispatch_buffer_unavailable`, `seen_store_unavailable`, `queue_store_unavailable`, or `receipt_write_failed`) rather than returning an empty `deliveries` array.
+
+- **`GET /api/gateway/relay/outbox?limit=<1..200>`** (default `50`): Returns `{ "ok": true, "connectorRef": "<ref>", "deliveries": [ <RelayOutboundEnvelope>, ... ] }` with complete pending envelopes from `DispatchBuffer` belonging to the authenticated `connectorRef` in FIFO buffer order. Strictly read-only (no leases or read receipts).
+- **`POST /api/gateway/relay/outbox/ack`**: Closed JSON object `{ "deliveryId": "<decisionId>" }` accepting any non-empty string `deliveryId` the outbox can list, within the 64 KiB request-body size bound (`413 payload_too_large`); unknown fields or an empty or non-string `deliveryId` return `400 invalid_envelope`. Finishes any remaining `relay-owner-notification-accepted` transition receipts, marks `slack-outbound-seen.jsonl` and `relay-delivered-decisions.jsonl`, releases the in-memory outbound poll guard, and drains `deliveryId` from `DispatchBuffer`. Returns `200 { "ok": true, "deliveryId": "<id>", "connectorRef": "<ref>", "alreadyAccepted": false }` (`"alreadyAccepted": true` on duplicate ack for the same `connectorRef`, or `404 unknown_delivery` if unknown or owned by another connector; duplicate and unknown acks are answered from `relay-delivered-decisions.jsonl` and `relay-attempted-decisions.jsonl`, and the transition receipt scan runs only when those disagree). On any `503` partial failure, a retry with the same `deliveryId` finishes the remaining receipt and drain steps.
+
 ### Inbound Envelope (`POST /api/gateway/relay/inbound`)
 
 ```json
@@ -172,7 +194,10 @@ rig gateway human set alice binding.0 "relay:local-bridge:file:$HOME/.config/ope
 ```
 
 > [!NOTE]
-> `rig gateway human set alice binding.<n>` requires a full binding specification string. Supplying `unset` is not supported for binding slots. To reassign a participant, overwrite the slot with a full binding string or remove and re-add the human fragment.
+> `rig gateway human set alice binding.<n>` accepts either a full binding specification string or `unset` to remove that binding slot:
+> - **One-primary rule:** No replacement primary is chosen silently. If removing a `primary` binding would leave other bindings, the command refuses. To replace the primary in place, set its slot to the new primary spec; to promote an existing secondary binding, first save that binding's full spec (`kind:connectorRef:secretsRef:role[:handle=<id>]`) from `rig gateway human show <entityId> --json`, then unset that secondary slot, then find the primary's current slot in `remainingBindings` (or `rig gateway human show <entityId> --json`, since the primary's slot shifts down when a lower-index secondary is removed) and set it to the saved spec with role `primary` (promotion replaces the former primary binding; its connector reference and inbound handle are not retained as a secondary); to remove every binding, unset the secondary bindings first using their current slot indexes from `remainingBindings` or `rig gateway human show <entityId>`, then finish at `binding.0` (once all secondaries are gone, the primary is at `binding.0`).
+> - **Shifted slot indexes:** Removal returns `remainingBindings` with their new `binding.<n>` slot numbers (the primary's slot shifts down too when a lower-index secondary is removed). Because indexes shift down after removal, do not blindly retry `binding.0 unset`; inspect `remainingBindings`, the operation receipt, or `rig gateway human show <entityId>` before retrying.
+> - **What removal does:** Removing a binding keeps the person, their preferences, their other bindings, and their open questions. Removing the last binding makes the current delivery episode inactive, so new missing-post findings stop (an already-open recovery item for an undelivered notice may remain); the current delivery-outcome display may disappear too, while historical receipt notes remain. It does not answer, close, or cancel open questions, cancel or reroute already-prepared deliveries, or retract anything a bridge has already accepted. A person with no binding needs a daemon from the release that accepts one (v0.7.9+); do not roll back past it while any fragment has `connectorBindings: []`.
 
 Operator notices use the existing default person. If several people are registered, choose the recipient explicitly when needed:
 
@@ -203,7 +228,11 @@ rig daemon status
 In `rig gateway human show <entityId> --json`, `deliveryReadiness.state` reports `ready` when the binding configuration and local secrets file are valid. This confirms local readiness, not whether the operator bridge process is currently running.
 
 ### Step 5: Removing Bindings or Participants
-Before removing a participant, ensure any pending queue items and conversations assigned to them are resolved.
+To remove a connector binding while keeping the participant, their preferences, their other bindings, and their open questions, unset the binding slot:
+```bash
+rig gateway human set alice binding.0 unset --reason "retire relay bridge"
+```
+Before removing a participant altogether, ensure any pending queue items and conversations assigned to them are resolved:
 ```bash
 rig gateway human remove alice
 ```

docs/reference/getting-started.md

@@ -201,11 +201,11 @@ You can also read [`skills/rigs/SKILL.md`](../../skills/rigs/SKILL.md) directly.
 script will do and changes nothing:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.11/scripts/install.sh | sh -s -- --dry-run
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.5/scripts/install.sh | sh -s -- --dry-run
 ```
 
 The same command without `--dry-run`,
-`curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.11/scripts/install.sh | sh`, installs the
+`curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.5/scripts/install.sh | sh`, installs the
 latest published `@openrig/cli` with `npm install -g`,
 runs the Node.js and SQLite check, then `rig setup --dry-run` and `rig setup`. `rig setup` checks both Claude Code and
 Codex and may install a missing one, as described below. A failed step prints
@@ -816,6 +816,19 @@ option, the seat's agent spec for the target runtime, or the runtime's own
 default), what is cleared, and the costs below. Nothing changes until you run it
 without `--dry-run`.
 
+Use `--runtime pi` to move a Claude Code or Codex seat to Pi; use `--runtime
+claude-code` or `--runtime codex` to move back. Pi uses a fresh managed state
+directory. Select a prepared Pi account with `--account-home /absolute/path`
+(the directory must contain readable `auth.json`), or use the target's configured
+login. A source account override or Claude token is cleared only at commit;
+credentials are never converted between runtimes. Pi-to-Pi account changes keep
+Pi settings, but cross-runtime switches resolve settings afresh for the target.
+
+A configured `launch_wrapper` carries across runtime switches among Pi, Codex
+and Claude Code. It must support each successor executable and preserve that
+runtime's credential environment. A wrapped Pi seat cannot switch to Claude
+Code; set `launch_wrapper: []` in the authored spec and re-apply it first.
+
 The new runtime takes over before the old one stops. Its successor starts beside
 the current occupant, reads a handover (the seat's recap, its open rows and the
 predecessor's screen), and confirms it with `rig seat set-runtime <seat>
@@ -847,7 +860,7 @@ What it costs:
   again afterwards to reach whoever holds the seat.
 - **Leftover files after a failed switch.** The target runtime's prepared seat
   storage and projections can remain.
-- **Codex and Claude Code, single-pane seats.** Startup slash commands aren't
+- **Codex, Claude Code and Pi, single-pane seats.** Startup slash commands aren't
   run by a switch; the dry run lists them.
 
 ## Stop your teams
@@ -886,6 +899,8 @@ the lifecycle API without booting a new kernel, then stop the remaining rigs.
 | "Readiness timeout after 30s — harness did not become interactive" | The harness took longer than the readiness window. Raise it for the next launch with `rig config set runtime.readiness_timeout_seconds <1-600>`, then relaunch that seat. |
 | "Claude resume did not finish within Ns; Claude may still be starting, so the launch was kept" | A restored Claude seat was not interactive when the wait ended. Its pane and resume token are kept. Look at the pane; once Claude is up, run `rig seat clear-attention <seat>`. The wait is about `runtime.readiness_timeout_seconds` in total for each seat (default 30 s), counting the first 3.2 s, and the time adds up seat by seat in a restore. Raising the setting for slow fresh launches lengthens it. If `rig up` or `rig launch` times out at 120 s, that is not a rollback: check `rig ps` before running it again. |
 | Daemon is healthy, kernel is still starting | Read `rig status` and `rig ps --nodes --rig kernel`; kernel readiness is separate. |
+| `rig status`, `rig terminal open` or `rig daemon start --wait-for-kernel` says a seat "needs attention" or "is waiting on a person" | The daemon flags that seat, and the line gives its recorded reason: a startup that failed or stopped at a sign-in, trust or other gate, a held message, a missing required file, or a question. "Is waiting on a person" means the daemon sees a live question you can answer in that seat's terminal. Look at it with `rig capture <seat>` or in its tile, then follow the row above that matches its message. "Couldn't check" means the check itself failed; it says nothing either way. |
+| A Codex seat, including the kernel's operator, answers every turn with a model error such as "… not supported when using Codex with a ChatGPT account" | Its Codex sign-in works, but that account can't run the model; the kernel picks its runtimes from the providers chosen at setup and their sign-ins, not from which models an account can run. If Claude Code is signed in, move just that seat: `rig seat set-runtime <seat> --runtime claude-code --reason "<model> isn't available to this Codex account"` (`--dry-run` first). Otherwise give it a model the account can run with `rig seat set-model <seat> --model <id> --reason "…"`, then start it again with `rig seat launch <seat> --fresh --stop --reason "…"` and check the model it reports. |
 | Kernel seats fail within a second of the first start, and tmux reports "server exited unexpectedly" | Check that your tmux can capture a pane, then start the failed seats again; see the tmux check below this table. |
 | Shared terminal is absent | Check the kernel's `operator.human` terminal separately from its agents; recover only that seat as described below. Standalone `rig tui` remains available while resolving it. |
 | Viewing terminal was closed | Open the conversations again with `rig terminal open saved:kernel --window`; `rig tui --shared` is only the dashboard fallback if that window cannot open. Do not relaunch the team. |

docs/reference/harness-runner-contract.md

@@ -39,14 +39,19 @@ This chapter covers **which agent runs in a seat and how OpenRig talks to it**.
 sandbox, another machine) is the [execution platform chapter](execution-platform-contract.md). The two are separate on purpose:
 the same harness can run in many places, and one place can host many harnesses.
 
-## 1. Plain preset or runner preset?
+## 1. Plain preset, runner preset, or OpenRig-hosted protocol runner?
 
-| | Plain community preset | Runner preset (`runner: true`) |
-|---|---|---|
-| **What runs in the pane** | The harness's own terminal app | A small program you maintain, *the runner*, which hosts the agent (for example an ACP agent over stdio) |
-| **How OpenRig reads activity** | From the screen: a changing screen reads working; a quiet one reads **unknown**, never idle | From the runner's reports: working, idle, needs input |
-| **How input arrives** | Typed into the app's prompt | Typed into the runner, which turns each submitted message into one agent prompt |
-| **Choose it when** | The harness has a usable terminal UI (Cursor, Hermes, OpenClaw examples) | The harness speaks a protocol rather than a screen (ACP, JSON-RPC, stream-JSON), or you can report turn boundaries reliably |
+| | Plain community preset | Runner preset (`runner: true`) | OpenRig-hosted protocol runner (`protocol: pi-rpc`) |
+|---|---|---|---|
+| **What runs in the pane** | The harness's own terminal app | A small program you maintain, *the runner*, which hosts the agent (for example an ACP agent over stdio) | OpenRig's own Pi runner, which starts your binary (`command`) in Pi's RPC mode |
+| **How OpenRig reads activity** | From the screen: a changing screen reads working; a quiet one reads **unknown**, never idle | From the runner's reports: working, idle, needs input | From the Pi runner's reports, through the same channel as built-in Pi; identity is the session file Pi's `get_state` reports |
+| **How input arrives** | Typed into the app's prompt | Typed into the runner, which turns each submitted message into one agent prompt; a message sent mid-turn waits | Pi's input: a submitted block is a prompt, a message sent while busy steers the current turn, `/followup` queues after it and `/abort` cancels it |
+| **Choose it when** | The harness has a usable terminal UI (Cursor, Hermes, OpenClaw examples) | The harness speaks a protocol rather than a screen (ACP, JSON-RPC, stream-JSON), or you can report turn boundaries reliably | Your harness is a Pi fork, or speaks Pi's CLI and JSONL RPC protocol |
+
+**For the third shape, you promise your binary's Pi-RPC compatibility at a version you name in `limits`.** OpenRig doesn't
+test each fork. It can't be combined with `runner`, `launch_result`, `names_conversation`, `startup_assisted` or
+`first_input`. The flags it must accept are in
+[Pi-compatible RPC harnesses](community-harness-presets.md#pi-compatible-rpc-harnesses-protocol-pi-rpc).
 
 **If your harness works well as a terminal app, a plain preset is enough. Use a runner only when you can report state
 honestly.** A runner that guesses is worse than a quiet screen read as unknown.
@@ -78,7 +83,20 @@ limits:
 - **A preset without `runner` behaves exactly as today,** and so does a session recorded before the field existed.
 - **The other fields keep their existing meanings:**
   - `first_input: true` passes the seat's first startup turn in a file named by `OPENRIG_FIRST_INPUT`;
-  - `passes_model: true` passes the seat's declared model as `OPENRIG_MODEL`.
+  - `passes_model: true` passes the seat's declared model as `OPENRIG_MODEL`;
+  - `launch_wrapper: true` declares that the runner applies a member's configured wrapper to its native child.
+
+**Launch wrapper.** `launch_wrapper` is an optional boolean in format 1 and requires `runner: true`. When the member
+has a wrapper and its runner preset declares `launch_wrapper: true`, OpenRig passes `OPENRIG_LAUNCH_WRAPPER` as a JSON array of resolved argv strings.
+The runner must exec its native child as `<argv...> <agent> <args>`, preserving argument boundaries, and keep its own
+process outside the wrapper. The runner must remove `OPENRIG_LAUNCH_WRAPPER` from the environment it passes to the wrapper
+and native child; the handoff belongs to the runner only. The wrapper must `exec` the agent in place. If wrapping fails,
+the runner must never fall back to an unwrapped spawn. A runner preset without the flag is refused at preflight and launch (not schema validation) when a wrapper is
+configured: `launch_wrapper unsupported: the community preset "<runtime>" runs a runner without launch_wrapper: true; no agent started. Add launch_wrapper: true to the preset if its runner applies OPENRIG_LAUNCH_WRAPPER, or remove launch_wrapper from this member.`
+A plain preset needs no flag: OpenRig prefixes its command
+immediately before the preset's native command, after OpenRig's launcher assignments (for example,
+`/usr/bin/env OPENRIG_LAUNCH_RESULT=… <wrapper> <preset.command>`), at the same seam as Codex. OpenRig never sets
+`OPENRIG_LAUNCH_WRAPPER` for a plain preset and removes any inherited value.
 
 ## 3. Identity: report the conversation once, in the launch record
 

docs/reference/health-diagnosis.md

@@ -91,7 +91,11 @@ and `severity=info`. CLI/TUI call this **needs diagnosis**, not a confirmed
 warning. Enabled diagnosis policy admits one bounded packet even though the
 product denominator is unknown. Ordinary unavailable/stale detector records
 remain ineligible. Diagnosis and human-notification traffic are excluded from
-the numerator and cannot recursively generate another investigation.
+the numerator and cannot recursively generate another investigation. So is the
+daemon's own bookkeeping: transitions by system actors (`*@system` and the
+bare `system` of claim handover) and daemon notes recorded under any actor
+(`auto-unparked:`, `blocker custody moved `, `park wake `, `parked-owner `).
+The reported `transitionIds` are the counted transitions.
 
 The agent reads the actual evidence, including beyond the supplied references,
 and resolves the semantic outcome granularity and consequence boundary. Use the

docs/reference/help.md

@@ -97,6 +97,24 @@ missing tools or logins, kernel startup, a closed viewing terminal and recovery
 before choosing an action. A healthy daemon doesn't by itself mean the project's seats are ready: check
 `rig ps --nodes --rig <rig-name>`.
 
+If the whole team stopped when a herdr terminal closed, OpenRig or its tmux server was started from inside that
+terminal: herdr-core ends every process started there when the terminal closes. `rig daemon start` no longer passes a
+herdr terminal's scope on, but processes started before that keep it until they restart. OpenRig never restarts them
+for you; restart at a time you choose, from a terminal outside herdr.
+
+With `terminal.tmux_server` at its default (`inherit`), OpenRig puts seats on the tmux server of the shell that
+started it, usually your own default server. If that server was already running, and you had started it from a herdr
+terminal, it carries that terminal's scope. OpenRig can't prevent this, because the server is yours.
+The same applies when a command like `rig chatroom watch`, run in a herdr terminal, starts the default server. Start
+tmux outside herdr, or use `terminal.tmux_server isolated` (see `tmux-servers.md`), which gives OpenRig a server it
+starts itself.
+
+The daemon keeps `HC_SESSION` and `HC_SOCKET`. The herdr-core they select is the one the herdr-app provider starts
+viewers in; `rig terminal status --provider herdr-app` names it (`core` and `assumption`), as do open failures
+(`viewer_start_failed`, `herdr_app_unavailable`) and the note when a window has not confirmed showing a view. If your
+herdr-app window is attached to a different herdr-core than the daemon's, its viewers will not appear there; start the
+daemon with that core's `HC_SESSION` and `HC_SOCKET`.
+
 ### The agent is waiting for permission or can't reach the daemon
 
 Read [Have your agent configure permissions](getting-started.md#have-your-agent-configure-permissions)

docs/reference/herdr-app.md

@@ -0,0 +1,145 @@
+# OpenRig views in herdr-app
+
+herdr-app (Herdr 2, the desktop app on herdr-core) can show OpenRig's terminal views inside its own window. A view
+opens as a **Rig view**: an equal grid of the view's seats, each with a title row (`<agent> · <slice>`), padded to a
+full grid. Rig views live in OpenRig's own herdr-app layout, **Rig** (`layouts/rig.json`), beside your tabs. A strip
+above them switches between **Your tabs** and each view.
+
+Nothing here needs a desktop display or SSH: the view opens in the herdr-app window the request came from.
+herdr-app has to run on the same machine as the OpenRig daemon: OpenRig reaches it through its control socket
+(`<app home>/herdr-app.sock`) and writes its mods and layout into that app home. An app on another machine, connected
+to this machine's herdr-core over SSH, isn't supported.
+
+## Set up
+
+Nothing to install by hand: opening a view installs OpenRig's four mods (rig-strip, rig-cell-header, rig-pad,
+rig-ended) and updates them when OpenRig is updated.
+
+- The mods go to `<app home>/mods/rig-*`. The app home is herdr-app's own: `HERDR_APP_HOME`, else
+  `$XDG_CONFIG_HOME/herdr-app`, else `~/.config/herdr-app`. `--app-home <dir>` on `rig terminal open` names another.
+- OpenRig owns only the files it ships there (recorded in `<app home>/openrig/mods.json`). An update replaces those
+  and nothing else in the folder. Mods you install yourself, from any source, are never touched.
+- To move between a view's cells from the keyboard, bind the strip's actions in `keys.json`, section `layout:rig`
+  (your agent can add it, as for any herdr-app key):
+  `"layout:rig": { "alt-left": "rig-strip.left", "alt-right": "rig-strip.right", "alt-up": "rig-strip.up", "alt-down": "rig-strip.down" }`.
+  In the Rig layout these replace herdr-app's `global` defaults for the same keys (`pane.go`, `agent.prev`/`agent.next`),
+  which keep working on your other layouts. A key bound in `terminal` wins while a cell has focus, so pick keys that
+  aren't bound there. Once you edit `keys.json`, herdr-app treats it as yours and stops adding new default shortcuts.
+- An open never replaces a mod you changed: that folder stays as it is, the view opens anyway, and the open's notes
+  name the folder and why. Only a mod a view needs that is missing and can't be installed stops an open.
+
+## Open a view
+
+- **From the TUI inside herdr-app:** Terminals, choose a view (Enter previews it), then **Open terminals**. The TUI
+  recognises that it runs in a herdr-core terminal of a herdr-app window on this machine, and the preview and the
+  open both use that window, so the plan you previewed is the one that opens. The preview says the view opens in
+  this window; it shows no desktop or SSH recipe. A shared TUI viewed from a herdr-app terminal does the same. The
+  kernel view opens in its narrow arrangement there (one seat per page): the window's width isn't the TUI's.
+- **From a shell:** `--provider herdr-app` opens the view in the herdr-app window you run it in. Inside a herdr-app terminal, plain `rig terminal open <view>` does the same when that window is answering. `--window` always asks for a new desktop window.
+
+  | Command | Where the view opens |
+  |---|---|
+  | `rig terminal open <view> --provider herdr-app [--app-home <dir>]` | In the herdr-app window this runs in (requires the window to answer). |
+  | `rig terminal open <view>` | Inside a herdr-app terminal when the window is answering, in that herdr-app window; otherwise a desktop window. |
+  | `rig terminal open <view> --window` | Always asks for a new desktop terminal window, even inside a herdr-app terminal. |
+
+The herdr-app window must be answering on its socket (`<app home>/herdr-app.sock`); otherwise an explicit open fails and says
+so. Finding the socket file is how OpenRig guesses you are in a herdr-app window; whether the window is reachable is
+checked by asking it. When a plain `rig terminal open <view>` in a herdr-app terminal finds that the socket does not
+answer, it says so and opens a desktop window instead; `--provider herdr-app` never
+falls back to a desktop window or an SSH recipe.
+
+What an open does, in order:
+
+1. Each viewer is recorded first (`$OPENRIG_HOME/private/herdr-app/clients/`), then started by herdr-core outside
+   every tab (`hc run --bg --no-parent`, labelled `openrig.*`). A local viewer runs the view's tile for its seat, as in
+   [terminal sessions](terminal-sessions.md): it shows the seat. An interactive cell starts with the read-only tile and
+   takes no input until herdr-app has shown the view (step 3); then its writable tile takes over, and the first thing
+   you type attaches it. A read-only cell only shows. A seat on another host opens as its own ssh attachment, writable
+   or read-only as that view composes it. If the seat's session ends, the viewer says so and waits; it never leaves a
+   shell in the cell.
+2. One atomic write of `layouts/rig.json`: your current layout, with OpenRig's stack beside your tab block. Your own
+   layout file is never written. A `rig.json` OpenRig didn't write is never overwritten.
+3. The Rig layout is shown, the view is selected once herdr-app confirms it shows the new file, and the keyboard
+   goes to the first live cell. Once herdr-app has acknowledged the layout with the view, OpenRig writes the gate file
+   of each of the view's interactive cells, on every page (including pages the strip hasn't shown yet, since the strip
+   moves between pages on its own), and each cell takes input a fraction of a second later (it checks every 0.2 s).
+   Anything that reached a cell before that, typed or written to its terminal (`hc send`), is dropped, not delivered
+   late. The open reports a view herdr-app
+   hasn't confirmed as unconfirmed, not opened; its viewers keep running and it stays in the Rig layout, and its cells
+   take input once herdr-app shows it. OpenRig keeps watching for 10 minutes, across a daemon restart; if herdr-app
+   hasn't shown it by then, each interactive cell says so, takes no input, and names the command that opens the view
+   again (`rig terminal open <view> --provider herdr-app`).
+
+Other layouts and other herdr-app windows don't show Rig views. Each window (app home) has its own.
+
+## The keyboard
+
+- An open puts the keyboard on the new view's first live cell.
+- Entering a view again (a click in the strip, or herdr-app restarting with it shown) returns the keyboard to the cell
+  you were last in there, else the first live cell.
+- **Your tabs** gives the keyboard back to your own pane.
+- OpenRig's own rewrites (another view opening or closing, a cell ending) never move the keyboard, whether you are in
+  a view or in your tabs.
+- Typing in an interactive cell, once the view is shown, attaches its tile to the seat; after 30 seconds without a key
+  it goes back to showing it. When the seat's session is replaced (a handover, a fresh launch, a restart), the tile follows the same seat to
+  its new session, as every OpenRig tile does.
+
+## What OpenRig keeps in the app home
+
+All under `<app home>/openrig/`:
+
+| File | What it holds |
+|---|---|
+| `mods.json` | The files OpenRig shipped to `mods/rig-*`, so an update replaces only those. |
+| `ack.json` | Written by the strip: the last layout revision herdr-app shows and the terminals it references. A viewer ends only once this shows its cell is gone. |
+| `strip.json` | Written by the strip: the cell you were last in per view, and the view shown. herdr-app gives a mod new storage whenever its props change, which is every OpenRig write, so this is kept as a file. |
+
+## Close a view
+
+```sh
+rig terminal close <rv-id> [--app-home <dir>]     # the id is in the open result's `space`
+```
+
+The view's cells leave `rig.json` first. A viewer ends only after herdr-app confirms it shows a layout without it, or
+when the Rig layout isn't shown (herdr-app then reads the new file when it is). Only viewers OpenRig started (its
+record, its labels and its exact command all match) are ended. Seats are never touched. Anything uncertain is left
+running and named in the result.
+
+If a viewer ends some other way (killed outside OpenRig, herdr-core restarted), OpenRig rewrites its cell as an
+ended cell straight away. Views OpenRig recorded keep that owner across a daemon restart: when the daemon starts, it
+reconciles each app home it has views in (a viewer that ended while it was down is rewritten then) and finishes any
+pending ends. If `hc events` can't run (herdr-core missing or down), the watcher tries again after 5 s, then waits
+twice as long each time, up to 5 minutes. Stopping the daemon ends only its own `hc events` watcher and timers; viewers
+and views stay.
+
+## Which herdr-core
+
+```sh
+rig terminal status --provider herdr-app [--app-home <dir>]
+```
+
+`core` and `assumption` in the result name the herdr-core the daemon's `hc` runner starts and ends viewers in: the
+daemon's `HC_SESSION` (else `default`) and `HC_SOCKET` if set when the daemon started. The herdr-app window must be a
+client of that same core. Terminal addresses are per core, so a window attached to another core would show other
+terminals, or none, in the view's cells. Open failures (`herdr_app_unavailable`, `viewer_start_failed`) and the note
+when a window has not acknowledged a write also name the daemon's core (`HC_SESSION`/`HC_SOCKET`) so a mismatch is
+visible straight away.
+
+A status or a preview only reads: it starts no herdr-core process and creates nothing. OpenRig watches herdr-core's
+events (`hc events`) and creates its viewers folder only when it opens or closes a view, or when it starts with views
+already recorded.
+
+## Limits
+
+- A Rig view is a layout inside herdr-app, not a herdr tab: other windows and other layouts don't show it.
+- Following a task (`--follow`) isn't available in herdr-app yet.
+- When a viewer ends unexpectedly, herdr-app removes its block and collapses the layout, which briefly opens the Files
+  panel on that cell's folder until OpenRig's rewrite restores the layout. Viewers start in OpenRig's own empty
+  folder (`$OPENRIG_HOME/private/herdr-app/viewers`). Planned closes never trigger this.
+- OpenRig doesn't yet check that the window runs on the daemon's herdr-core (`core` in `rig terminal status`); it
+  relies on both using the same session on the same machine.
+- `POST /api/terminal/open` (and `POST /api/terminal/close`) carries no bearer middleware, matching the daemon's other
+  open routes; an open writes `mods/rig-*`, `openrig/mods.json` and `layouts/rig.json` into the named `--app-home` once
+  `herdr-app` answers a `status` request on `<app home>/herdr-app.sock`.
+- Runtime-tested on Linux only; macOS and Windows haven't been tried on real machines.

docs/reference/hosted-members.md

@@ -86,8 +86,14 @@ entry. The entry holds secret names, never values:
 These facts stay separate on the row:
 - **Wake:** with a trigger, the row's wake result is `wake-accepted:webhook (<url_ref>) answered <status>` when the trigger took the
   ring, or `failed:webhook …`. Accepted means the tool's trigger answered, not that the member read the row.
-  - With no trigger, the result is `unroutable`, and OpenRig tells the person: the operator seat when it's a person, else whoever
-    created the row.
+  - With no trigger, the result is `unroutable`. The member finds work by reading its own inbox and picks a row up by claiming
+    it, so a row gets no finding of its own. Work it leaves unclaimed past the stuck sweep's unclaimed age
+    (`queue.stuck_sweep_unclaimed_age_minutes`, 60 by default) is listed in one standing notice per member. The notice goes to
+    the operator seat when it's a person, else the rows' creator when they all share one, else the operator agent, else the
+    member itself. A notice to a creator lists only that creator's rows: when another creator's row joins, the notice moves to
+    the next recipient. It says whether the member has read its own pending inbox recently: a check-in, never a receipt or a
+    claim. A member with a declared route (a delegation parent or `escalates_to`) gets one finding per unclaimed row at that
+    route instead.
   - It tells the person too when the member was rung but hasn't claimed the work by the stuck sweep's unclaimed age
     (`queue.stuck_sweep_unclaimed_age_minutes`, 60 by default).
   - The member sees new work when it checks: when it's rung, when its person asks it to, or on a schedule the tool runs.
@@ -95,7 +101,7 @@ These facts stay separate on the row:
 - **Result:** the closing transition and its resolution, or the handoff.
 - **Notification:** where a person asked, Slack's posted receipt. A posted notice isn't the person's acknowledgment.
 
-**On the team:** `rig_team` lists the rig's hosted members (roster entries marked hosted that aren't one of its nodes), with their capabilities and caveat, no pane, and activity `unknown`.
+**On the team:** `rig_team` lists the rig's hosted members (roster entries marked hosted that aren't one of its nodes), with their capabilities and caveat, no pane, and activity `unknown`. With an external grant offering `team/list`, call it without `rigId` to discover the connected team. It selects the grant's sole rig, or returns only its granted names when a choice is needed.
 OpenRig doesn't observe a hosted member between its calls, so it never reads idle. `rig roster find` shows it the same way.
 - **Presence:** each entry carries `presence`, which says what OpenRig last saw of the member. It isn't pickup, and `null` means unknown:
   - `lastCallAt`: its last authenticated call to this host's `rig mcp serve --http`, recorded at most once a minute in
@@ -129,6 +135,10 @@ and nothing else is offered:
   - It reads the items it sent and the items addressed to it from those seats, never the team's internal items.
   - With `queue`/`claim` and `queue`/`update`, it claims and closes only items addressed to its own seat that it can read,
     and waits (blocked) only on an item it names and can read. Its answers hide what reading the item hides.
+- **A first task without a seat address:** with `--task-destination <member@rig>` on the same `rig mcp serve`, a
+  `rig_queue_create` that leaves out `destination` goes to that receiver. The operator sets it; a caller can't. It must be
+  exactly one existing local node within that request's grant, or nothing is written. An explicit `destination` works as
+  before.
 - **Two assistants together:** a grant with `team`/`list` sees its rigs' seats with `rig_team`, and may address and hear from
   another connected assistant's seat. A grant without it never reaches a seat in the service's caller form
   (`cus-<id>-<connection>@<rig>`), so an existing connection keeps the reach it had.
@@ -137,8 +147,8 @@ and nothing else is offered:
   - **Queued:** the item exists and is `pending` with no claim.
   - **Picked up:** the receiver's claim (`in-progress`).
   - **Answered:** closed `done`, with the answer in `resolution`.
-  - Reading or listing an item records nothing, and nothing wakes an assistant, so an item stays queued until its receiver
-    claims it.
+  - Reading or listing an item records nothing on the item, and nothing wakes an assistant, so an item stays queued until its
+    receiver claims it. A member listing its own pending inbox records only a check-in time, which the notice above reads.
 
 ### A person answering the team's questions through their assistant
 
@@ -148,7 +158,8 @@ pair, the person's assistant can read the team's questions waiting on them and s
 Steering. The caller's seat is never taken for a person: without `person`, the `question` pair offers nothing, and an
 unusable `person` withholds only these two tools while the grant's other tools keep working.
 
-- **Register the person** on the instance, once: `rig gateway human add <entity_id> --display-name "<name>" --default`.
+- **Register the person** on the instance, once:
+  `rig gateway human add <entity_id> --display-name "<name>" --delivery-class B --default`.
   Without `--binding`, they're asked in the Feed and on Steering only. As the default person, today's asks addressed to no
   registered person (such as `human@host`) are theirs too.
 - **`rig_question_list`** shows what Steering shows that person as answerable: an ask addressed to them, or a row parked on
@@ -179,5 +190,6 @@ unusable `person` withholds only these two tools while the grant's other tools k
 ## Limits today
 
 - **Webhook triggers only:** OpenRig rings a webhook. Email and other triggers aren't supported yet. A member without a trigger
-  isn't rung, and its person is told instead.
+  isn't rung; work it leaves unclaimed past the unclaimed age is listed in one notice instead, which goes to its person, else
+  its rows' shared creator, the operator agent or the member itself.
 - **It can't act as a person:** it works rows addressed to its seat, a person's request to it included. It can't settle an ask addressed to a person, or hand work to one, except through a grant service's grant that names its person, which records that person's own answers (above).

docs/reference/keeping-a-watch.md

@@ -59,7 +59,9 @@ rig queue block <task> --on external:<what you check> --wake-after 1h \
 ```
 
 `--on` is always required; `external:<what>` names the outside thing you're waiting on. The timer first fires after
-the interval, not now.
+the interval, not now. Left without `--wake-after` (or `--wake-watchdog`), the task is still set aside, but nothing
+will wake you, and the reply says so with a `park_without_wake` advisory. Set it aside again with `--wake-after` to add
+the timer.
 
 **4. Say back what you set, in one or two plain lines:** what you'll check, how often, how they'll be told, and when
 it stops. For example: "I'll check the release PR every hour and message you here once it merges. Then I'll stop."

docs/reference/queue-erasure.md

@@ -0,0 +1,161 @@
+# Queue erasure: closed-work retention and account deletion
+
+A daemon that serves several accounts sometimes needs to remove queue content for good: closed work after its retention window, or everything that belongs to an account when the account is deleted. `rig queue erase` and three retention settings do that.
+
+Erasure can't be undone. Run every scope as a dry run first, without `--apply`. The dry run prints exactly what `--apply` would erase and changes nothing.
+
+## What is erased
+
+A queue row is erased in one of two ways:
+
+- **Scrub.** The row's content is removed, and the row itself stays, marked `contentErasedAt`. A retried create with the same id still finds the row, so it makes no new work. If anything writes to the row after its scrub (a note, a summary, a reopen and close), the next run erases that content too.
+- **Delete.** The row and everything linked to it are removed. Only its id is kept, in an erased-id record with no endpoints and no content. A later create that reuses the id is refused with `qitem_erased` (409), so a retried or forwarded create can't bring the work back.
+
+| A scrub clears | A scrub keeps |
+|---|---|
+| body, summary, resolution, tags, blocker text, chain of record, evidence reference, human detail, questions and answers, delegated decision, the input-box reading | id, source and destination, state, priority, tier, times, closure reason, handoff links |
+| a closure's target when it's a reason or note, in the row, both transition tables and events. That's every target under a reason other than the two at right, and any target under those two that isn't a session address or a queue id | a closure's target that names a successor: under `handed_off_to` or `superseded`, shaped as a session address (`member@rig`, optionally `@host`) or a queue id (`qitem-…`) |
+| transition notes and recorded principals, live and archived | each transition's state, actor and time |
+| events' `summary`, `reason` and `error` (the event keeps its type and ids, marked `contentErased`) | |
+| mission-control audit text and snapshots | |
+
+**The row's own copies go with it:**
+- its transitions;
+- events whose payload names it;
+- its mission-control audit rows.
+
+**Copies held with someone else go only when they're the owner's.** These are outbox and inbox entries that point at the row or wake for it, and stream reader actions and dispositions that name it (including `duplicate_of`). For account deletion, the owner is the account: both of a copy's sessions must be members. Otherwise the owner is the row's own source and destination. Any other copy is kept and listed under `keptCopies`:
+- `mixed`: one of its sessions is the owner's;
+- `foreign`: none of them are.
+
+**A row a workflow still references is never erased.** That covers a step trail, a frontier binding, a failure record, or a live instance's frontier. It's reported under `gaps` with the code `workflow-reference`.
+
+## Scopes
+
+Name exactly one.
+
+| Scope | Erases | Action |
+|---|---|---|
+| `--members <file>` | Account deletion. Every row whose source and destination are both in the file, in any state, open work included. Add `--rig <id>` for the account rig's own records | delete |
+| `--ids <file>` | Exactly the listed rows. A report's `qitems` entries, or a ledger's lines, keep each entry's own action. A ledger's entries are replayed only for the batches that committed (below) | `--action delete` (default for plain ids) or `--action scrub` |
+| `--routine` | Closed rows past this daemon's retention windows (below) | scrub, then delete |
+
+A file is one entry per line (blank lines and `#` comments are skipped; a line starting with `{` is a JSON entry) or a JSON array.
+
+**Account deletion is exact.**
+- The members file is the account's recorded membership: the exact session names of its seats, including departed ones. List every address form the account used, such as a host-suffixed form. Names are compared as given, never by pattern, so a row addressed through an unlisted form is neither erased nor reported.
+- **Mixed rows:** a row with exactly one member endpoint is reported under `mixed` (with which endpoint is the member) and left untouched. Deciding who owns it is a separate decision. A row rerouted out of the account while the run is under way (by a fallback, say) is kept too, and reported as `changed-during-run`.
+- **After the rows:** account deletion also removes outbox and inbox entries between two members that no row owns, and the members' stream items. An entry with one member endpoint, or a stream item something still references, is counted and left.
+
+**The account's rig.** A rig's own records outlive the rig. Events are kept past rig and node deletion by design, and snapshots, node and seat records and watchdog jobs have no key that cascades. `--rig <id>`, given with `--members`, erases them:
+- the rig's events, including those of its nodes;
+- snapshots, operation correlations and bootstrap runs;
+- seat identity verdicts, delivery-guard changes, environment bindings and usage records for its nodes and member sessions;
+- watchdog jobs aimed at a member, with their history;
+- stream subscriptions and thread maps of member sessions.
+
+Records that name the account but also belong elsewhere are counted under `rig.left` and kept. These are a member's watchdog job aimed outside the account, a workflow instance or spec bound to the rig, classifier leases and custom views.
+- **While the rig exists,** its sessions and the members must match both ways, or the run is refused (`erase_rig_mismatch`). Every member's session name must carry the rig's name (departed members included), and every current session of the rig must be a member, so the rig holds no one else's seat.
+- **On that verified run,** the rig's id and name are recorded with a digest of the membership.
+- **Once the rig is removed,** the same command, with the same membership, uses that record to erase what's left under the rig's id. This includes the events the removal wrote, and the record still lets it count records bound to the rig's name.
+- **When nothing of the rig is left,** the record becomes a completion receipt: the rig's name is cleared, and its id, the membership digest and the time stay. An identical rerun, after a lost response say, still verifies and reports the same clean result, with `rig.completedAt`. The receipt is kept for good. It holds no content.
+- **A removed rig's id that was never verified** with this membership erases nothing keyed by it. Those records are counted under `rig.left`, the name-bound tables are listed under `rig.unknown`, and the run isn't clean.
+
+**Retention windows** (`rig config set …`, read at the daily sweep and at daemon start):
+
+| Setting | Default | Effect |
+|---|---|---|
+| `retention.closed_content_days` | `0` (off) | Scrub closed rows this many days after they closed |
+| `retention.closed_metadata_days` | `0` (off) | Delete closed rows, keeping only their ids, this many days after they closed |
+| `retention.erasure_ledger` | empty (none) | An absolute file path, on local disk, since each batch appends to it while it holds the daemon. Every applied erasure, by the sweep or the command, appends each row's id, action and batch id there, one JSON line each, before anything in its batch changes, then a commit line once the batch commits (an abort line if it rolls back). A path that can't be written stops the run before it changes anything |
+
+- **Closed** means `done`, `canceled`, `denied` or `handed-off`. `failed` and open work are never touched by the windows.
+- **Age:** a row's age counts from when it entered its final closed state. A note on a closed row doesn't restart it, and a row reopened and closed again counts from its latest close.
+- **Running them now:** `rig queue erase --routine --apply` runs the windows immediately. `retention.enabled false` turns off the whole sweep, these windows included.
+- **When the sweep's erasure stops on an error,** that's logged, and the sweep's other passes still run.
+
+## Account deletion, in order
+
+1. Revoke the account's access.
+2. Keep its exact membership list and rig id.
+3. Run `rig queue erase --members <file> --rig <id>` as a dry run, then with `--apply`. Rerun until `complete` is true.
+4. Remove the rig.
+5. Rerun the same command with `--apply`, to erase the records the removal wrote.
+6. The account is deleted only when the report's `clean` is true. Otherwise its `mixed`, `gaps`, `keptCopies`, `unlinked` and `rig.left` or `rig.unknown` entries need a decision. Rerunning won't resolve them.
+
+## Output
+
+The command prints one JSON report (`--json` makes it a single line):
+
+| Field | Meaning |
+|---|---|
+| `applied` | `false` for a dry run |
+| `complete` | the run finished. `false` when it stopped at its batch limit or on an error; rerun the same command to continue |
+| `clean` | `complete`, and nothing was left: no `mixed` rows, mixed `keptCopies`, `gaps`, `unreadableEvents`, left-over entries, or rig records left or unknown. Only a clean report means the scope is fully erased. It's about this run's scope: a routine or members run's `clean` isn't affected by the ledger's other batches, and only a replay (`--ids` with a ledger) reports a batch it can't show committed, as the gap `ledger-unresolved` |
+| `error` | why the run stopped (`stage` and `message`). Everything listed in `qitems` was committed before it; the command exits 2 |
+| `qitems` | each row erased (or that would be), with its `action` and `state` |
+| `mixed` | members scope: rows with one member endpoint, left untouched |
+| `keptCopies` | copies of erased rows held with someone else, kept: `table`, `id`, `qitemId`, `ownership` (`mixed` or `foreign`) |
+| `gaps` | rows not erased and why: `workflow-reference`; `not-found` for an id to scrub that doesn't exist; `changed-during-run` for a row that no longer qualified when its batch ran (reopened, rerouted out of the account, or written to so it left its window) or an absent id created since selection; `unreadable-event` for a row an unreadable event names; `ledger-unresolved` for a replayed entry whose batch can't be shown to have committed |
+| `skipped` | ids scope, a ledger replay: entries whose batch rolled back, with the batch id; not replayed |
+| `ledger` | an applied run with a ledger: batches whose missing commit line it wrote from the database's record (`reconciled`) |
+| `alreadyAbsent` | ids to delete with no row; their erased-id record is written (again), and they're listed once it's committed. They're rechecked as the record is written, so an id created during the run is reported as `changed-during-run` instead |
+| `unreadableEvents` | events naming a selected row whose payload can't be read: `seq` and the row ids found in its text. They're kept, since what they hold can't be inspected, and so are the rows they name, so every rerun reports them again until the event is repaired or removed. The run isn't clean |
+| `linked` | counts of the copies erased with the rows |
+| `unlinked` | members scope: entries and stream items erased that no row owned, plus those left (`mixedEntries`, `referencedStreamItems`) |
+| `rig` | members scope with `--rig`: `found`, `verified`, records erased per table (`erased`, counted as each chunk commits), records left (`left`), tables that can't be counted (`unknown`), and `completedAt` once the rig's erasure is complete |
+
+**How a run works:**
+- **Selection:** a run selects everything first and writes nothing.
+- **Events:** it reads the events table once, in small windows, to find each row's events.
+- **Batches:** each batch, of up to 100 rows, is one transaction. It rechecks its rows, writes their ledger lines, then changes their events, copies and rows.
+  - **The recheck drops** a row that a workflow has taken up, or that an unreadable event names. For account deletion, it also drops a row that is no longer between two members. For a routine run, it drops one that was reopened or no longer falls in the same window.
+  - **Each dropped row** is reported in `gaps`.
+  - **The current endpoints** decide whose its copies are.
+- **How long it holds the daemon:** the batch caps rows, not events or copies, so a row with many of either makes its batch longer. On a copy of a store with 2.4 million events, the longest single hold in a first routine run was about 0.25 s. With a ledger, a run doesn't read the ledger file: it reads the end of the file (one byte) and the database's record of batches still missing a commit line, so the ledger's size doesn't add to the hold.
+- **Stopping:** a run that stops leaves whole batches done, events included. A rerun picks up the rest, and erasing a row a second time changes nothing.
+- **Ledger lines and commits:** a batch's lines are written before its first change, so they can name rows that a rolled-back batch never erased. Each batch therefore also records its id in the database, in its own transaction, and appends a commit line (`{"batch": …, "committed": true}`) after it commits, or an abort line (`"committed": false`) when it rolls back.
+  - **A missing commit line:** a run that can't write one stops once the committed batch is reported. The database's record notes when each batch's commit line was written. Each applied run with a ledger writes the commit line for any recorded batch still without one, from the record alone, without reading the ledger file. It lists those under `ledger.reconciled`.
+  - **Neither line nor record:** a batch with neither, such as one whose transaction was cut off by a crash, is never decided from the database: on a restored database, a batch committed after the backup looks exactly like one that rolled back. A replay reports its entries as `ledger-unresolved` and doesn't apply them, until an operator resolves it by appending its commit or abort line once they know which.
+  - **A line cut short:** a full disk, say, can cut a line short. Each run starts the ledger on a fresh line first, so the cut line can't fuse with the next one. A replay refuses the file until that line is deleted. That's safe: an entry line's batch rolled back when its write failed, and a commit line is written again from the record.
+
+**Refusals**, with nothing erased:
+
+| Code | Cause |
+|---|---|
+| `erase_scope_required` | no scope named |
+| `erase_scope_conflict` | more than one scope |
+| `erase_members_invalid` | an empty list, or names with surrounding spaces |
+| `erase_rig_invalid` | a rig without `--members`, or an empty rig id |
+| `erase_rig_mismatch` | the rig exists, and its sessions and the members don't match both ways |
+| `erase_ids_invalid` | an empty ids list, or ids with surrounding spaces |
+| `erase_action_invalid` | an action other than `delete` or `scrub` |
+| `erase_routine_off` | both windows are `0` |
+
+The command records who ran it from `OPENRIG_SESSION_NAME`, or from `--actor <session>` when that isn't set.
+
+## Restores and backups
+
+A restored database can bring erased content back: rows, copies, rig records and the erased-id records themselves. It can even bring back a row that was still open when the backup was taken and was closed and erased later. Before a restored daemon serves anyone, replay what was erased after the backup was taken:
+
+1. **Keep a ledger.** Set `retention.erasure_ledger` to a file outside the backed-up data. Every applied erasure appends its ids, actions and batch there before changing anything, and a commit line once the batch commits. That covers the daily windows, `--routine`, `--ids` and account deletion's rows.
+2. **Replay the ledger:** `rig queue erase --ids <ledger> --apply`. It replays exactly the batches that committed, each line with its own action, so a scrub is replayed as a scrub, never promoted to a deletion.
+   - **What's replayed:** a row that was open in the backup and erased later is erased by its id, and other open work isn't touched.
+   - **What's skipped:** a batch with an abort line was never erased, and is listed under `skipped`.
+   - **What's left:** a batch with neither line, which the restored database doesn't record either, is reported as `ledger-unresolved` and not replayed. The run isn't clean until an operator decides it.
+3. **Replay account deletions:** rerun `rig queue erase --members <file> --rig <id> --apply` for each account deleted since the backup, from its membership list and rig id. Keep those outside the backed-up data until every backup taken before the deletion has expired. This also covers the copies and rig records the ledger doesn't list.
+4. **Rerun the windows:** `rig queue erase --routine --apply`.
+
+Backup expiry is the deployment's own schedule. Content erased from the live database stays in backups until they expire.
+
+## What this doesn't cover
+
+These stores need their own handling where a deployment uses them:
+- terminal transcripts;
+- daemon and service logs;
+- gateway and Slack stores and Slack's own copies;
+- downloaded files and artifacts;
+- chat messages (removed with their rig);
+- events tied neither to a row nor to the account's rig.
+
+The rig itself (its nodes, sessions and bindings) is removed by removing the rig, between the two runs above.

docs/reference/quickstart.md

@@ -17,7 +17,7 @@ npx skills add https://github.com/mvschwarz/openrig/tree/<release-tag>/skills/ri
 npx skills add https://github.com/mvschwarz/openrig/tree/<release-tag>/skills/rigs --skill rigs --agent codex
 ```
 
-For a new install, use the latest release's tag, for example `v0.7.11`. If OpenRig is already installed, use the tag
+For a new install, use the latest release's tag, for example `v0.7.5`. If OpenRig is already installed, use the tag
 that matches `rig --version`, or upgrade first. If the command fails with `npx: command not found`, Node.js isn't
 installed or isn't on your PATH yet (see [What you need](#what-you-need)). Then type `/rigs` in Claude Code, or `$rigs` in Codex, and say what
 you want built.

docs/reference/rig-spec.md

@@ -587,9 +587,13 @@ rig provider switch --seat pi-worker@my-rig --to-account work \
 rig provider switch --seat pi-worker@my-rig --clear-account-home --reason "Return to configured login"
 ```
 
+When switching into Pi with `--clear-account-home`, OpenRig restores the seat's original Pi login only if no effective member or rig Pi account home is configured. A member's `PI_CODING_AGENT_DIR` shadows the rig's value; if the member value is relative, it is ignored and the rig home does not take effect.
+
 Pi account changes work with or without `launch_wrapper`. The wrapper receives the successor's managed Pi directory;
-it must preserve the selected credentials if you want OpenRig's account choice to apply. Switching a seat between Pi
-and another runtime is not supported by this account-home feature.
+it must preserve the selected credentials if you want OpenRig's account choice to apply.
+Use `rig seat set-runtime <seat> --runtime <runtime> --reason "Change provider"` with `pi`, `codex` or `claude-code` for cross-runtime switches.
+Those resolve the target's settings afresh rather than keeping the source model or effort;
+see [runtime switching](getting-started.md#move-a-seat-to-the-other-runtime).
 
 This switch starts a fresh conversation with a handover, even when the runtime stays the same. The existing
 subscription-login switch preserves the conversation. Once the successor confirms, OpenRig commits its home, runtime,
@@ -779,7 +783,7 @@ directory's `CLAUDE.md`, including blocks written by other rigs.
 | `effort` | string | no | — | Reasoning effort override, trimmed. Claude gets `--effort`, Codex `-c model_reasoning_effort=…`, Pi `--thinking` (see "Pi" below). A non-string value is ignored with an advisory. |
 | `advisor` | string | no | — | Claude-only Advisor model for this seat. Overrides the AgentSpec profile/default; blank or non-string values are ignored with an advisory. |
 | `claude_mcp` | `none` | no | normal loading | Claude members only. Disable MCP server loading for this agent on every launch and resume. Omit the field to keep Claude's normal configuration; see [Claude MCP loading](#claude-mcp-loading-runtime-claude-code). |
-| `launch_wrapper` | string[] | no | — | Local built-in `pi`, `codex` and `claude-code` members only. Literal argument prefix applied to the native executable and its arguments on fresh launch, relaunch, rebuild, resume, fork, restore and handover; `[]` explicitly clears a stored wrapper when re-applying an authored spec, while omitting the key leaves an existing seat's stored choice unchanged. See [Launch wrapper](#launch-wrapper-runtime-pi-and-codex). |
+| `launch_wrapper` | string[] | no | — | Local `pi`, `codex`, `claude-code` and community-harness members; runner presets must declare wrapper support. Literal argument prefix applied to the native executable and its arguments on fresh launch, relaunch, rebuild, resume, fork, restore and handover; `[]` explicitly clears a stored wrapper when re-applying an authored spec, while omitting the key leaves an existing seat's stored choice unchanged. See [Launch wrapper](#launch-wrapper-runtime-pi-and-codex). |
 | `permission_policy` | string | no | — | Member-level permission policy; overrides the rig's. Not valid on terminal members. |
 | `env` | map | no | — | Launch environment for this seat, laid over the rig's `env`. Same rules as the rig-level field. Valid on terminal members too. See "Launch environment" below. |
 | `agent_file` | string | no | — | Claude members only. A Claude agent definition (a `.md` file with `name` in its frontmatter) for this seat. It's copied into the seat's own storage and launched as `--agent openrig:<name>`. A path beside the spec: no `..`, not absolute. |
@@ -917,9 +921,11 @@ This requires a Claude Code version that supports `--advisor`. OpenRig never wri
 choose different Advisors. When Advisor is unset, no flag is emitted and Claude's
 own defaults/settings apply. Other runtimes ignore this field.
 
-### Launch wrapper (`runtime: pi` and `codex`)
+<a id="launch-wrapper-runtime-pi-and-codex"></a>
 
-Set `launch_wrapper` on a local built-in `pi`, `codex` or `claude-code` member to prefix its native executable and arguments with a literal argv vector:
+### Launch wrapper (`runtime: pi`, `codex` and `claude-code`)
+
+Set `launch_wrapper` on a local `pi`, `codex`, `claude-code` or community-harness member to prefix its native executable and arguments with a literal argv vector:
 
 ```yaml
 members:
@@ -931,7 +937,7 @@ members:
     launch_wrapper: ["launcher", "exec", "--profile", "seat-a", "--"]
 ```
 
-- **Scope and literal argv:** Local built-in `pi`, `codex` and `claude-code` members, including legacy flat nodes, support `launch_wrapper`; other runtimes reject it, including `[]`. Each fork uses its target member's own selection. Arguments are literal strings without NUL, CR or LF; spaces, quotes, metacharacters and empty non-executable arguments are preserved.
+- **Scope and literal argv:** Local `pi`, `codex`, `claude-code` and supported community-harness members support `launch_wrapper`; legacy flat nodes support it only on `pi`, `codex` and `claude-code`. Other runtimes, including the maintained `openshell-claude` environment path, reject it, including `[]`. Community preset capability and execution requirements are defined in the [runner contract](harness-runner-contract.md#2-declare-it-what-the-preset-says-fixed-at-launch). Each fork uses its target member's own selection. Arguments are literal strings without NUL, CR or LF; spaces, quotes, metacharacters and empty non-executable arguments are preserved.
 - **Executable resolution:** `launch_wrapper[0]` must be an absolute path or bare command name. Preflight and launch resolve it using the daemon's launch `PATH` and working directory, before adding the seat's `rig` bin directory. Relative paths containing `/`, aliases and functions are unsupported for the wrapper itself.
 - **Native child and `exec` contract:** The wrapper prefixes the resolved Codex entry, prefixes the resolved Pi child executable inside the host runner, or prefixes the real Claude executable and native arguments. Managed Claude applies it after rebuilding the environment; pinned continuations retain their executable. The wrapper must `exec` its child in place, preserving working directory, environment, signals, exit status and TTY stdio (Claude/Codex) or RPC pipes (Pi). Supervising wrappers are unsupported.
 - **Classic Claude lookup:** Wrapped classic launch supports bash, zsh, sh and dash and requires `command -v claude` to resolve to an executable file; aliases and functions refuse with `launch_wrapper unavailable; no agent started.` To keep custom flags or environment, put them in a `#!` script named `claude` on `PATH`; the wrapper runs that script ([#1477](https://github.com/mvschwarz/openrig/issues/1477)).
@@ -1015,7 +1021,7 @@ This is human-authored (you choose the pod/member IDs) and system-validated (the
 | `spawned_by` | Source was spawned by target; the target launches first. Constrains launch order. | Child → parent in hierarchical topologies |
 | `can_observe` | Source can observe target's output. Does NOT constrain launch order. | Reviewer → implementer, monitor → worker |
 | `collaborates_with` | Peer collaboration relationship. Does NOT constrain launch order. | Co-equal peers working together |
-| `escalates_to` | Fallback queue escalation for a seat without a declared delegation parent. Does NOT constrain launch order. | Local member or same-daemon `pod-member@rig` address |
+| `escalates_to` | Fallback queue escalation for a seat without a single declared delegation parent (none, or several). Does NOT constrain launch order. | Local member or same-daemon `pod-member@rig` address |
 
 A named `escalates_to` target may be in another rig on the same daemon and need not exist at import time.
 See [fallback escalation across rigs](edge-types.md#fallback-escalation-across-rigs) for precedence, single-hop delivery,
@@ -1358,7 +1364,7 @@ spec can pass `rig spec validate` and then fail at preflight or import. Run
 24. Startup action `idempotent` is a required boolean.
 25. Non-idempotent actions must not include `restore` in `applies_on`.
 26. `applies_on` values must be from: `fresh_start`, `restore`.
-27. `launch_wrapper` is valid only on `pi`, `codex` and `claude-code` members (`[]` included); it must be an array of strings without NUL/CR/LF, and `launch_wrapper[0]` (when non-empty) must be an absolute path or a bare command name on the daemon `PATH`.
+27. `launch_wrapper` is valid on `pi`, `codex`, `claude-code` and supported community-harness members (`[]` included); see the [runner contract](harness-runner-contract.md#2-declare-it-what-the-preset-says-fixed-at-launch) for community capability requirements. It must be an array of strings without NUL/CR/LF, and `launch_wrapper[0]` (when non-empty) must be an absolute path or a bare command name on the daemon `PATH`.
 
 ---
 

docs/reference/runner-conformance/README.md

@@ -13,6 +13,8 @@ node check-runner.mjs --runner 'my-runner --agent-command {agent}' --name my-har
 - **`--name`** is your preset's name, which your posts carry as `runtime`.
 - **`--resume` and `--first-input`** say your preset declares `resume: true` and `first_input: true`. Without them,
   those cases are skipped, because OpenRig wouldn't pass that input.
+- **`--launch-wrapper`** says your preset declares `launch_wrapper: true` and enables case 10 from the
+  [runner contract](../harness-runner-contract.md#2-declare-it-what-the-preset-says-fixed-at-launch).
 - **`--cases 2,4`** runs only some cases. `--json` prints a machine-readable report. `--keep` keeps each launch's
   folder: the agent's message log, the launch record and the scenario.
 - **`--wait-ms 20000`** waits longer for each step (default 8000), for a runner whose agent takes a while to start. The check's shorter settling times, and the fake agent's own delays and holds, grow in proportion.
@@ -62,6 +64,7 @@ In an installed OpenRig, the check is at `$(npm root -g)/@openrig/cli/daemon/doc
 | 7c | 9 | **Advisory.** Closing the pane ends the agent process. Section 9 marks this duty as proposed, and lets a runner list in `limits` what may keep running, so this result is shown as met or not met and never counts as a pass or a fail, or toward the exit status. The fake agent outlives a hangup here, so the runner has to end it |
 | 8 | 7 | An unknown request from the agent gets JSON-RPC `-32601`, and the next prompt still goes through |
 | 9 | 9 | `OPENRIG_FIRST_INPUT`'s exact bytes, newlines and spaces included, are the first prompt |
+| 10 | 2 | The native child runs through the configured wrapper, preserving literal arguments, without inheriting the runner's wrapper handoff |
 
 ## What it doesn't check
 

docs/reference/runner-conformance/check-runner.mjs

@@ -6,12 +6,12 @@
 //   - a small local endpoint stands in for OpenRig's activity route, and records what your runner posts;
 //   - input arrives the way `rig send` delivers it: one bracketed paste with raw newlines, then Enter.
 //
-//   node check-runner.mjs --runner '<command>' [--name <preset name>] [--resume] [--first-input]
+//   node check-runner.mjs --runner '<command>' [--name <preset name>] [--resume] [--first-input] [--launch-wrapper]
 //                         [--cases 1,2,4] [--wait-ms 8000] [--pass-env NAME] [--json] [--keep]
 //
 // `{agent}` in the command is replaced with the fake agent's path, an executable that takes any arguments your runner
 // adds. For example: --runner 'my-runner --agent-command {agent}'. --resume and --first-input say your preset declares
-// `resume: true` and `first_input: true`; without them those cases are skipped, since OpenRig wouldn't pass that input.
+// `resume: true` and `first_input: true`; --launch-wrapper declares `launch_wrapper: true`. Without a declaration, its case is skipped.
 // The runner gets a clean environment: PATH, HOME, USER, SHELL, LANG and TMPDIR, the OpenRig variables, and any
 // --pass-env names. Exit status: 0 when nothing fails, 1 when a case fails, 2 for a usage or setup problem.
 //
@@ -27,10 +27,10 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const here = dirname(fileURLToPath(import.meta.url));
-const usage = "usage: node check-runner.mjs --runner '<command with {agent}>' [--name <preset>] [--resume] [--first-input] [--cases 1,2] [--wait-ms 8000] [--pass-env NAME] [--json] [--keep]";
+const usage = "usage: node check-runner.mjs --runner '<command with {agent}>' [--name <preset>] [--resume] [--first-input] [--launch-wrapper] [--cases 1,2] [--wait-ms 8000] [--pass-env NAME] [--json] [--keep]";
 
 function parseArgs(argv) {
-  const opts = { name: "runner", cases: undefined, passEnv: [], resume: false, firstInput: false, json: false, keep: false, waitMs: 8000 };
+  const opts = { name: "runner", cases: undefined, passEnv: [], resume: false, firstInput: false, launchWrapper: false, json: false, keep: false, waitMs: 8000 };
   for (let i = 0; i < argv.length; i += 1) {
     const flag = argv[i];
     const value = () => { if (i + 1 >= argv.length) throw new Error(`${flag} needs a value`); return argv[++i]; };
@@ -41,6 +41,7 @@ function parseArgs(argv) {
     else if (flag === "--wait-ms") opts.waitMs = Number(value());
     else if (flag === "--resume") opts.resume = true;
     else if (flag === "--first-input") opts.firstInput = true;
+    else if (flag === "--launch-wrapper") opts.launchWrapper = true;
     else if (flag === "--json") opts.json = true;
     else if (flag === "--keep") opts.keep = true;
     else throw new Error(`unknown option ${flag}`);
@@ -178,7 +179,7 @@ await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
 const base = `http://127.0.0.1:${server.address().port}`;
 
 const launches = [];
-async function launch(label, { scenario = {}, env = {}, asks } = {}) {
+async function launch(label, { scenario = {}, env = {}, asks, launchWrapper = false } = {}) {
   const dir = mkdtempSync(join(tmpdir(), `runner-check-${label}-`));
   const cwd = join(dir, "work");
   mkdirSync(cwd);
@@ -196,6 +197,13 @@ async function launch(label, { scenario = {}, env = {}, asks } = {}) {
   const agent = join(dir, "agent");
   writeFileSync(agent, `#!/bin/sh\nexec ${sh(process.execPath)} ${sh(join(here, "fake-acp-agent.mjs"))} --scenario ${sh(join(dir, "scenario.json"))} --log ${sh(h.agentLog)} "$@"\n`);
   chmodSync(agent, 0o755);
+  h.agent = agent;
+  if (launchWrapper) {
+    h.wrapperLog = join(dir, "wrapper.json");
+    const wrapper = join(dir, "wrapper.sh");
+    writeFileSync(wrapper, `#!/bin/sh\nrecord=$1\ntag=$2\nseparator=$3\nshift 3\n${sh(process.execPath)} -e 'const [file, tag, separator, ...argv] = process.argv.slice(1); require("node:fs").writeFileSync(file, JSON.stringify({tag, separator, argv, launchWrapper: process.env.OPENRIG_LAUNCH_WRAPPER ?? null}));' "$record" "$tag" "$separator" "$@"\nexec "$@"\n`);
+    env = { ...env, OPENRIG_LAUNCH_WRAPPER: JSON.stringify(["/bin/sh", wrapper, h.wrapperLog, "literal ' $ ; space", "--"]) };
+  }
   const vars = {
     PATH: process.env.PATH, HOME: process.env.HOME, USER: process.env.USER, SHELL: process.env.SHELL, LANG: process.env.LANG,
     TMPDIR: process.env.TMPDIR, TERM: "xterm-256color",
@@ -781,9 +789,22 @@ const cases = {
     if (!opts.keep) rmSync(dir, { recursive: true, force: true });
     return r;
   },
+  async "10"() {
+    const r = result("10", "Launch wrapper: the runner wraps its native child and scrubs the handoff environment");
+    if (!opts.launchWrapper) return r.skip("the preset doesn't declare launch_wrapper (--launch-wrapper): OpenRig passes no OPENRIG_LAUNCH_WRAPPER");
+    const h = await launch("10", { launchWrapper: true });
+    r.check("the wrapped child opens its conversation", await ready(h), "no launch record");
+    const seen = existsSync(h.wrapperLog) ? JSON.parse(readFileSync(h.wrapperLog, "utf8")) : undefined;
+    r.check("the wrapper receives literal arguments and the native child command", seen?.tag === "literal ' $ ; space" && seen?.separator === "--"
+      && seen?.argv?.[0] === h.agent, JSON.stringify(seen ?? null));
+    r.check("OPENRIG_LAUNCH_WRAPPER is absent from the wrapper and child environment", seen?.launchWrapper === null
+      && h.events("started")[0]?.launchWrapper === null, "wrapper handoff leaked to native child");
+    return r;
+  },
+
 };
 
-const order = ["1", "1b", "2", "3", "3b", "4", "4b", "4c", "5", "6", "7", "7b", "7c", "8", "9"];
+const order = ["1", "1b", "2", "3", "3b", "4", "4b", "4c", "5", "6", "7", "7b", "7c", "8", "9", "10"];
 const selected = opts.cases ?? order;
 const unknown = selected.filter((id) => !order.includes(id));
 if (unknown.length) { console.error(`unknown case ${unknown.join(", ")}; cases are ${order.join(", ")}`); process.exit(2); }

docs/reference/runner-conformance/fake-acp-agent.mjs

@@ -42,7 +42,7 @@ const fail = (id, code, message) => send({ jsonrpc: "2.0", id, error: { code, me
 const exit = (status, why) => { log({ dir: "event", event: "exit", status, why }); process.exit(status); };
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
-log({ dir: "event", event: "started", pid: process.pid, cwd: process.cwd(), argv: process.argv.slice(2) });
+log({ dir: "event", event: "started", pid: process.pid, cwd: process.cwd(), argv: process.argv.slice(2), launchWrapper: process.env.OPENRIG_LAUNCH_WRAPPER ?? null });
 // Ctrl-C is the runner's to handle, so the agent never takes it as a signal. A stubborn agent also outlives a hangup and
 // its input closing, as some real agents do: only the runner ending it (SIGTERM or SIGKILL) stops it.
 process.on("SIGINT", () => log({ dir: "event", event: "signal", signal: "SIGINT" }));

docs/reference/sdlc-conventions.md

@@ -161,10 +161,25 @@ or `pending`, `draft`. A word that matches none of these counts as `active`, so
 slice marked `complete` counts as `active`. A slice with no `status:` counts as
 `draft`.
 
+`rig view show execution` shows the slice's own `status:` word (from its
+`SPEC.md`, or a legacy `README.md`) and that word's bucket beside each slice's
+ladder as `recorded_status` (`word: null` when there's none). Like the scopes
+views, it never reads `PROGRESS.md`; `GET /api/slices` lets a `status:` in
+`PROGRESS.md` frontmatter override the node file's. It's the team's record, not
+verified, so it never turns a rung true or makes a slice next-up.
+The ladder's rungs read Part B records: plan lock, `candidate:<sha>` rows, review
+artifacts and an EC-3 `worktree_path=` row. On this flow they read `INDETERMINATE`
+(plan lock reads `false`), and `q4_records` says once for the mission that no
+build is recorded. Built means a Git commit, so work that isn't a commit never
+reads built.
+
 When the owning scope selects `proofPolicy.judges`, use `rig proof judge` to
 record an attributed accept, reject or withdraw decision on a contract item,
 and `rig proof show` to read derived readiness up through slice, mission and
-project. The nearest slice, mission or project policy selects authorized judges;
+project. The nearest slice, mission or project policy selects authorized judges.
+By default an item's latest judgment from any of them decides it; with
+`proofPolicy.everyJudge: true`, every listed judge's own current accept is
+required, and `rig proof show` lists each judge's own latest judgment either way.
 `rig proof --help` describes setup, selectors and evidence requirements. In a
 multi-project workspace catalog, name the project with `--project <id>` or a
 `<id>:` scope prefix (`alpha:m0/slices/01-t001`); unqualified scopes use the

docs/reference/seat-delivery.md

@@ -153,12 +153,16 @@ drive a recognized native menu as before. Otherwise, with the delivery guard
 attached, it reads the visible composer under the seat's lease immediately before
 pasting, after buffer preparation. Empty input proceeds. A recognized dim
 suggestion is displayed separately and counts as empty; typed or pasted text
-(author unknown) stops the send with `override_input_present`. An unreadable input
-stops with `override_input_unknown`, never an empty-input claim. Both return single-send HTTP
+(author unknown) stops the send with `override_input_present`: single-send HTTP
 409, `sent: false`, and caller-only `existingInput` evidence (visible rows, suggestion
 rows, cursor/dimensions and target binding). A collapsed paste shows its label,
 not the hidden contents. OpenRig neither holds nor retries this stopped override.
 
+An input that can't be read doesn't stop the override. The answer is typed and
+nothing is cleared. The result reports `existingInput` with classification
+`unreadable`, never empty, and a warning that the answer may join or submit
+existing text.
+
 Inspect the shown input in the native terminal, deliberately clear the prompt with
 native/tmux controls, then issue the send again. Manual clearing runs outside
 OpenRig's lease and observation checks and is not recorded. For a deliberate
@@ -356,7 +360,10 @@ accounting. Historical outbox receipts do not suppress a lone reminder or preven
 message tells its recipient that delivery may repeat after an unconfirmed attempt. Its job history records the
 current transport result; an unknown write is not proof that nothing arrived.
 
-The transport still protects approval/question prompts, human drafts and recipient identity. Scheduler timing,
+The transport still protects approval/question prompts and recipient identity. Under the default
+`transport.draft_delivery` (`deliver`), an ordinary send or work notice that meets a person's draft at a Claude Code or
+Codex prompt is pasted into it and the combined input is submitted, unless the seat's typing guard holds input
+(`draft-aware`, `openrig-urgent`, `urgent-only` or `hold`). With `refuse`, a draft refuses the send. Scheduler timing,
 current parked-row eligibility and stop checks still apply. This changes message retries, not the idempotence of
 structured continuity actions such as creating a cutover baton.
 

docs/reference/slack-app-setup.md

@@ -66,7 +66,14 @@ not fill in; if so, follow the form.
     asked at RECORD stays on Steering and the Feed without a post. Running it again reuses each ask's
     one decision rather than making another, so an ask whose post is confirmed isn't posted again. As
     with any Slack post, one whose earlier attempt Slack couldn't confirm may post once more, marked as
-    a possible repeat. `--wait <seconds>` (default 10) is how long it waits for Slack receipts.
+    a possible repeat. An ask OpenRig can't fully check still posts, once per gateway run, through the
+    person's delivery rules, so a readable quiet window still holds it. That's an ask whose attempt
+    record can't be read, whose state can't be checked, or whose person's quiet hours can't be read.
+    The Slack post can show "Delivery may repeat after an earlier unconfirmed attempt.", "OpenRig
+    couldn't check that this ask is still open." and "OpenRig couldn't read your quiet hours." These
+    supplementary notes are omitted if they do not fit. The row and command also report when the
+    person's quiet-hours setting couldn't be read. An ask that is no longer open isn't posted. `--wait <seconds>` (default 10) is how long it waits for
+    Slack receipts.
 
 ## What the app asks for
 
@@ -377,11 +384,18 @@ Quiet hours hold a person's routine asks while they're on, and post them once th
   wake-ladder alerts. These reach the person exactly as they would outside quiet. An ask below the posting level is only
   logged, as at any time.
 - **When quiet ends,** each held ask that never started posts once, on its own, with no mention. One that no longer applies
-  isn't posted, and its row says why: it closed, a newer notification replaced it, its recipient changed, or it's now below
-  the posting level.
+  isn't posted, and its row says why: it closed, a newer notification replaced it, its recipient changed, its person has no
+  connector any more (it stays on Steering and the Feed), or it's now below the posting level.
 - **A post that may already be in Slack**, confirmed or only partly sent, isn't held: it finishes as itself, in its own
   thread.
-- **If quiet hours can't be read,** nothing is posted to that person until they can.
+- **If quiet hours can't be read,** that isn't a quiet window. An ask that would post goes to its usual destination with
+  no mention, and the post says "OpenRig couldn't read your quiet hours."; the ask's row records it. The person's other
+  delivery settings still decide: an escalation, a digest, an ask below the posting level, and a quiet window that can be
+  read work as before. This covers ordinary posts and digests, and asks already held for quiet hours: while the quiet
+  hours can't be read, the next release check (within about a minute) posts each of them, with no mention and the same
+  line, even if the window may still be on. The line is supplementary: a post at Slack's text or block limit leaves it
+  out, and the ask's row and `rig slack post-open-asks` still say the quiet hours couldn't be read. A person reached
+  through a relay waits until their quiet hours can be read, as before, because that post can't carry the line.
 
 ## Reconnect recovery and status
 
@@ -405,9 +419,11 @@ budget window when exhausted. Slack's per-method `Retry-After` is retained acros
 Only an acknowledged edit gets a success receipt. `rig slack status` shows queued reconciliation
 and the last edit failure. Transient failures retry with increasing waits, capped at an hour,
 behind other queued work. Permanent Slack failures (such as missing scope, a deleted original,
-an archived channel or an uneditable message) remain unfinished and are retried only on the next
-connector start. They do not keep consuming edit capacity. These edit calls have their own
-budget, separate from missed-message scanning below.
+an archived channel or an uneditable message) remain unfinished. A deleted original is recorded
+on the row and never asked about again; a new post of the same ask is tried afresh. The others,
+which a scope, membership, a different bot token or an upgrade can fix, are retried on the next
+connector start. A message is uneditable when the configured token didn't post it. They do not keep consuming edit capacity. These edit calls have their own budget,
+separate from missed-message scanning below.
 
 The baseline already includes public-channel history access and `chat:write`. Private-channel
 reads may require `groups:history`, which the baseline does not grant; a refused read never
@@ -454,9 +470,18 @@ not covered by that margin. A corrupt or unreadable checkpoint leaves recovery u
 and preserves the existing file; live inbound continues.
 
 Each pass admits at most four history calls, 100 entries and 15 seconds of work, with a
-five-second request ceiling. Channels and threads take turns within that one budget, so with many
-tracked threads each thread is scanned every few passes; `rig slack status` shows how far behind
-the oldest waiting thread is. Work already started on a message, such as
+five-second request ceiling. Channels and threads take turns within that one budget. Each tracked
+thread is scanned once after each start and after each Socket Mode reconnect that followed a gap
+(not a refresh Slack overlaps with the old connection), which catches replies sent while no
+connection was up; replies while connected arrive live. A thread the pass at the connect itself
+reaches is scanned once more, since that pass stops five seconds short of the connect. Those scans go in need order: a thread
+leaving the seven-day window within six hours first, since once it leaves a missed reply is never
+recovered; then threads whose ask still waits on the person (its queue row is pending, in progress
+or blocked) before the rest, each newest first. The order comes from the saved checkpoints, so a
+restart starts with the newest open ask, not the oldest thread. After that a thread is scanned again
+only as a backstop, hourly while its ask waits on the person and daily otherwise. A machine the hub
+relays to can't see a gap in relayed events, so there a settled thread's backstop is three hours. `rig slack status` shows how far behind the oldest waiting thread is and how
+many threads are settled. Work already started on a message, such as
 an attachment transfer, is not cancelled by these limits or by a stop, and a new
 pass waits for it to finish. Rate limits retain Slack's Retry-After across restart, and hold back
 only the method Slack limited (channel history or thread replies).
@@ -465,8 +490,8 @@ When Slack reports a plan history limit, recovery still lands the available page
 and advances normally, retaining an older-history limitation in status across restarts.
 Missing bot credentials, history scope, membership, retention limits and API
 failures appear as recovery limitations. A tracked thread Slack can't find stays incomplete in
-status, with no further call, until its thread mapping changes or the daemon restarts or rewires
-the connector; that isn't proof the thread was deleted. No additional scope is required to keep
+status and is asked again at most once a day, across restarts; that isn't proof the thread was
+deleted. No additional scope is required to keep
 live delivery working. Threads nobody tracks, older open threads, threads closed more than seven
 days ago and other channels remain outside this recovery scope; global chronological order is
 not promised. This change does not replay intervals already checkpointed before broadcast-reply

docs/reference/terminal-sessions.md

@@ -72,16 +72,52 @@ verified viewer mapping.
 
 New tiles keep their place when a seat's tmux session is replaced. They wait up
 to 30 seconds for the same session name and managed seat identity to return,
-then reattach with the original read-only setting. This uses the shared tile
-command for Herdr, cmux, Rex and plain tmux, including SSH tiles. In-place
-handover and restart keep the existing attachment.
+then show the new session with the original read-only setting. This uses the
+shared tile command for Herdr, cmux, Rex and plain tmux, including SSH tiles.
+In-place handover and restart keep showing the same session.
 
-A deliberate detach closes the tile after about two seconds. A different seat
-under the old name is never followed. If no replacement returns in time, or a
+Writable tiles attach immediately, as in 0.7.10. Their visible terminal sizes
+the agent's PTY under tmux's normal client sizing policy, and resizing the
+terminal reflows new output. Read-only tiles remain observers: they neither
+resize nor type into another seat. An ordinary tmux detach ends the writable
+tile without stopping the agent. A replacement with a different managed seat
+identity is not followed. If no replacement returns in time, or a
 session has no managed identity, reopen the rig view with
 `rig terminal open rig:<name> --window` (or your explicit provider). Views
 opened before this change must be closed and reopened to get this behavior.
 
+As in published 0.7.10, Enter or Ctrl-C typed while a new writable tile is still
+attaching can close that viewer. The agent keeps running; reopen the view.
+Once attached, keys and paste use native tmux input handling.
+
+## Sizing and older views
+
+Use tmux's inherited `window-size latest` policy for the terminal most recently
+used to control sizing. OpenRig does not change a person's global tmux policy.
+A deliberate `window-size manual` setting remains an explicit fixed-size choice.
+OpenRig's temporary layout and readable-capture pins release by unsetting the
+window's local `window-size` option; they do not restore an old local override.
+With the last pin released, the window inherits the global policy again.
+
+Browser terminals do not pin the agent's PTY by default. For an explicit fixed
+90-by-27 browser terminal, use `rig config set terminal.fixed_geometry true`.
+Set it to `false` to return to the default. This applies to newly created browser
+brokers after existing browser subscribers disconnect; it does not configure
+native Herdr tiles. A temporary readable capture uses
+`rig capture <seat> --readable` or `--size <columns>x<rows>` and releases its pin
+when the capture finishes. It does not unset a manually fixed window it did not
+pin.
+
+Kept writable 0.7.8/0.7.9 viewers can retain an old `ignore-size` attach, and
+pre-reflow 0.7.11 viewers can retain the old mirrored display. Changing saved
+argv cannot change that running client. Close only the owned Herdr viewer pane
+and open a fresh view with `rig terminal open <view> --provider herdr`; the
+agent's tmux session and conversation keep running. For a retained `--follow`
+canvas, first select `--no-follow`, then close its owned viewer panes and open
+a fresh ordinary view. Continuing that old following canvas is not an automatic
+live-client migration. Existing 0.7.10 sizing clients and read-only viewers do
+not need this step.
+
 ## Desktop windows and previews
 
 ```sh
@@ -153,6 +189,10 @@ timed out, OpenRig closes nothing: the result says `rex_outcome_unknown`, or
 adds a note when other pages opened, and names the session to check in Rex
 before retrying. `rig terminal status` gives Rex about a second to answer.
 
+## herdr-app
+
+`--provider herdr-app` opens the view in the herdr-app window you run it in. Inside a herdr-app terminal, plain `rig terminal open <view>` does the same when that window is answering (finding the socket file is how OpenRig guesses you are in a herdr-app window, and whether the window is reachable is checked by asking it). `--window` always asks for a new desktop window. See [OpenRig views in herdr-app](herdr-app.md).
+
 ## HTTP API
 
 - `POST /api/terminal/open`: `{ view, provider?: "herdr", session?: string, expectedPlan?: string }`.
@@ -240,8 +280,8 @@ opening; the result explains why. A failed endpoint/identity read or an existing
 canvas stays unconfirmed, preserving it instead of creating a fallback view.
 Other providers and selector kinds retain ordinary one-shot open. Use
 `--provider herdr --json` to operate without opening a desktop window, and
-`--session <name>` to select that endpoint. Opening a tile can change the
-agent's terminal size; `ignore-size` does not guarantee isolation.
+`--session <name>` to select that endpoint. Typing in a tile can change the
+agent's terminal size while you type.
 
 ```bash
 rig terminal open qitem:example --follow --provider herdr --json
@@ -321,17 +361,22 @@ small presentation provenance, separate from queue membership. Herdr display
 labels are not that provenance. Other providers/platforms remain unsupported
 for ensure-viewer until qualified; ordinary open retains its existing behavior.
 
-A writable tile attaches with `tmux attach -f ignore-size` when its session
-already has a client that sizes it, so the tile doesn't fight that client over
-the agent window's dimensions. When the session has no sizing client, as with a
-freshly launched seat, the tile attaches without the flag and sizes the window
-itself: tmux applies ignore-size across the whole server, so a session viewed
-only by ignore-size clients would otherwise keep its 80x24 creation size while
-any other session has a sizing client. Read-only clients keep `-r` (which also
-implies ignore-size), and the printed manual attach commands keep
-`-f ignore-size`. This is **not resize isolation**: opening a tile can change
-the agent's terminal size. Observers of a Herdr terminal do not themselves resize it;
-a controlling browser can. No cross-version resize guarantee is implied.
+A tmux window has one size, and a tmux client narrower than it sees only the
+left part of each line. So a tile shows its seat without attaching to it: about
+once a second it reads the seat's screen with `tmux capture-pane`, redraws only
+after tmux records new activity, and lets the tile's own terminal wrap each
+line. A tile narrower than the agent's window still shows whole lines, and
+showing a seat never changes its size. A rule drawn across the window is cut to
+the tile's width. A read-only tile only shows the seat. In a writable tile, the
+first thing you type or paste attaches the tile and goes through tmux as it
+would in any attached client: a paste arrives as one paste, and tmux's prefix
+works (prefix then `[` to scroll back, for example). The tile sizes the window
+while you use it, as any client you type in does; after 30 seconds without a
+key it detaches and shows the seat again. A tile that's only showing has no
+scrollback of its own. If the seat's tmux server restarts, a tile shows the
+seat again only when the same managed seat returns. The printed manual attach commands
+keep `-f ignore-size`. Observers of a Herdr terminal do not themselves resize
+it; a controlling browser can. No cross-version resize guarantee is implied.
 
 To type into a seat without changing its size, send the text through OpenRig
 (`rig send`, or `POST /api/transport/send`): it is written to the pane with tmux

docs/reference/whats-new.md

@@ -1,159 +1,94 @@
-# What changed in OpenRig 0.7.11
+# What changed in OpenRig 0.7.1
 
-This note is for an agent on an install that was just upgraded to 0.7.11.
-OpenRig 0.7.11 sends ordinary messages and work notices into a person's typed
-draft by default instead of refusing them, lets a person reach the team from
-their own coding agent (the `openrig` plugin) or an ACP app (`rig acp serve`),
-holds a prepared managed compaction until the seat is idle, and clears a
-restore that stopped at a prompt. It adds five database migrations. The
-OpenShell worker's cleanup still fails against OpenShell 0.1.6. If you upgraded
-from 0.7.9 or earlier, also read "What changed in OpenRig 0.7.10" below, and
-from 0.7.8 or earlier, "What changed in OpenRig 0.7.9" too. For the full
-capability map, read `rig context get onboarding-width/public-what-you-can-do.md`.
-After the upgraded daemon starts, `rig context get reference/whats-new.md`
-describes this version. Without a running daemon, read the packaged
-`daemon/docs/reference/whats-new.md`; `$OPENRIG_HOME/reference/whats-new.md` can
-still be the previous copy until startup.
+This note is for an agent on an install that was just upgraded to 0.7.1. It lists only what behaves differently from
+0.7.0 and what to do about it. For everything OpenRig can do, read the capability map:
+`rig context get onboarding-width/public-what-you-can-do.md`. Each release replaces this file, so
+`rig context get reference/whats-new.md` describes the installed version once the upgraded daemon is running. Without
+a running daemon, read `$OPENRIG_HOME/reference/whats-new.md`. The daemon refreshes that copy when it starts, so right
+after an upgrade it can still hold the previous version's note.
 
 ## After the upgrade
 
-- **Back up the database, then restart the daemon.** Five migrations run on
-  the daemon's first start: 150 (node launch wrapper), 151 (Pi account
-  switches), 152 (workflow instance spec), 153 (events retention marks) and 154
-  (workflow instance root objective). If `$OPENRIG_DB` isn't backed up yet,
-  copy that file (`rig config get db.path` shows it) with the daemon stopped,
-  then `rig daemon start`. Going back to 0.7.10 after these migrations isn't
-  established.
-- **New settings:** `transport.draft_delivery` (`deliver`), `acp.to` (empty),
-  `daemon.seat_poll_interval_ms` (1000) and `retention.events_days` (`0`, keeps
-  every event). `rig config` shows each with its source.
-- **The openrig-core plugin moves from 0.1.26 to 0.1.27.** <!-- CONFIRM: openrig-core 0.1.27 at the final base -->
-  Its activity relay and refocus hooks changed, as did the refocusing,
-  openrig-user and openrig-skills skills. Managed refresh preserves replaced
-  files under `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits
-  you still need from the preserved copy.
-- **Tell the person sends now join their drafts** (below). To keep the refusal,
-  run `rig config set transport.draft_delivery refuse`; it applies from the
-  next send, with no restart.
-- **Pi seats:** a Pi seat that declares an absolute `PI_CODING_AGENT_DIR` in its
-  `env:` now uses it as its account home and needs a readable `auth.json`
-  there, or the launch stops. Prepare one, or remove the declaration to keep
-  the managed seat login. Ask the person before changing their spec.
-- **herdr-core terminals:** new starts no longer inherit `HC_SCOPE`,
-  `HC_TERMINAL_ID` or `HC_TERMINAL_SOCKET`; a daemon or tmux server already
-  running with them keeps them until it's restarted.
-- **Claude seats that load openrig-core themselves** lose OpenRig's unchanged
-  copies of its skills at their next launch, so each skill loads once; the
-  launch result warns with the copies removed or kept.
+- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Eight migrations run on the first start (124, 125,
+  127, 128, 129, 130, 131 and 135). Nine settings are added: `policies.claude_compaction.preparation_root` (unset),
+  `skills.router_line.enabled` (off), `decisions.enabled` (false), `decisions.consumers`, `decisions.template_dir`,
+  `retention.stream_days` (30), `retention.stream_max_items` (20000), `provider.selected` (empty) and
+  `daemon.db_conflict` (`warn`). None is removed.
+- **Stream retention is on.** Stream items emitted after the upgrade are deleted after 30 days, or beyond the newest
+  20,000, unless a record names them (a classification, duplicate link, attempt or disposition). History from before the
+  upgrade is kept. Raise `retention.stream_days` or `retention.stream_max_items` to keep more.
+- **The bundled openrig-core plugin goes from 0.1.17 to 0.1.18.** Startup replaces the installed plugin's changed files:
+  its Claude hook definitions, three hook scripts and the pre-compaction hook (so hooks start on a seat whose PATH has
+  no Node), and the `openrig-user`, `messaging-the-human` and `forming-an-openrig-mental-model` skills. As in
+  0.7.0, it first copies each file it replaces under `$OPENRIG_HOME/backups/managed-refresh/<id>/`, edited or not, and
+  logs `[plugin-vendor] preserved previous contents of <file> at <copy> before managed refresh`. A copy doesn't mean
+  anyone edited the file; if someone did, reapply the change from the copy.
+- **Claude seats need Claude Code 2.1.280 or newer to see their team skills,** which now arrive as a per-seat plugin
+  through `CLAUDE_CODE_PLUGIN_DIRS` (below). OpenRig doesn't check the version. A running seat gets the new layout at its
+  next launch, restore or handover.
+- **If a worktree's `.claude/settings.local.json` says `"defaultMode": "acceptEdits"` and the person didn't choose it,**
+  an earlier OpenRig wrote it when it added or freshly launched a managed Claude seat. 0.7.1 no longer writes it but
+  doesn't repair it; ask the person which mode they want and set it once.
 
-## Sends and drafts
+## New things you can do
 
-- **Under `deliver` (the default),** an ordinary `rig send` or work notice to a
-  seat whose prompt holds a person's typed draft pastes the message at the
-  cursor and submits the combined input as one prompt. The result says whether
-  submission was confirmed and, when OpenRig saw the draft, that it joined it.
-  An unset, unreadable or invalid value follows `deliver`.
-- **Still refused or held under either value:** menus, permission prompts, a
-  seat's typing guard (`draft-aware`, `hold`), managed compaction's sends and
-  `--wait-for-idle`.
-- **Under `refuse`,** a send is refused, and a work notice retried once the
-  prompt is clear, where OpenRig detects the draft. Claude Code and Codex sends
-  now also read the input box before pasting, so a draft only the box shows
-  refuses too (`target_needs_input` / `prompt_draft`).
-- **The draft-aware typing guard** reads a Claude composer with a statusLine or
-  the background task panel, and Claude Code 2.1.319's bare
-  `✔ Update installed · Restart to update` row in a narrow pane, so an empty box
-  gets the wake instead of `draft_input_unknown`.
-- **Held messages coalesce:** a sender's newest held message at a seat retires
-  its earlier ones. Read them with `rig seat held-messages <seat>` (each with
-  `--id <id>`); an older backlog clears at that sender's next held message or
-  with `rig seat retire-held-message`.
-- **Stopped seats aren't woken at each daemon start:** their rows stay owed, and
-  the start-up log says `waiting=N (not replayed: …)`. That isn't delivery.
+- **Choose how much automatic input reaches a seat:** `rig seat set-typing-guard <seat> --mode <mode> --reason "…"`, where
+  `<mode>` adds `openrig-urgent` (OpenRig's own notices and anything urgent) and `urgent-only` between `off` and `hold`.
+  Mark a message urgent with `rig send --urgent`, or create the row at priority `urgent` or `critical`. Held input stays
+  readable (`rig seat held-messages`) and is never replayed.
+- **Choose how far OpenRig and peers may act on a seat:** `rig seat set-terminal-policy <seat> --preset
+  no-peer-interventions|help-within-instructions|full-control --reason "…"`, with `--helper <addresses…>`,
+  `--rig-default` (seats added later), and exceptions such as `--peer-compaction deny` or `--openrig-model allow`.
+  Managed compaction and saved model or effort changes are checked; a denial is `terminal_policy_refused`. Other
+  interventions are guidance only.
+- **Read a seat's planned permissions:** `rig seat status <seat>` shows what its next fresh managed launch will pass and
+  where each part comes from, and its terminal policy. `rig setup --router-line yes|no` decides whether OpenRig adds its
+  one line to shared guidance files.
+- **Let a person choose whether every ask reaches Slack:** `rig gateway human set <id> slack-subscription
+  every-ask|urgent-only|unset`. Every ask is on the TUI's Feed either way. Under `urgent-only`, only an ask
+  created or handed off with `--alert` posts. An ask marked `--alert` stands out in Slack (an interrupt with a mention)
+  under either setting, so use it only for something only they can do, or an approval whose wait costs now.
+- **Give one Claude member its own setup** in the rig spec: `agent_file`, `append_system_prompt_file`, `plugin_dirs` and
+  `advisor` (an Advisor model). They're copied into that seat's storage, never the project.
+- **See a seat's own skills:** `rig skill loadout --seat <session|self>`.
+- **Reach the team from an assistant without a shell:** the MCP server has 34 tools, including `rig_whoami`,
+  `rig_restore_status`, `rig_team`, `rig_telemetry_events`, following a handoff, reading a finished item's artifact and
+  deciding inside a person's decision room. `rig mcp serve --http` serves them over HTTP; `rig mcp token add <name>
+  --seat <session>` gives each caller its own seat.
+- **Hand a row's task to an outside agent:** `rig acp run <row>` for an ACP agent (Hermes, OpenClaw).
+  `docs/reference/a2a-agents.md` covers A2A agents.
+- **Run a community harness that names, reports or reopens its conversations:** preset fields `launch_result`, `resume`,
+  `names_conversation` and `startup_assisted`, with examples for Cursor, Hermes and OpenClaw under
+  `docs/reference/community-harness-examples/`.
+- **Change one edge on a running rig:** `rig edge add <rig> <from> <to> --kind <kind>` and `rig edge remove <rig>
+  <edge-id>` (`--plan`, `--json`). A `delegates_to` change says when it moves who work routes to.
+- **Run one spec as several rigs:** `rig up <spec> --name <rig>`.
+- **Retune a watchdog in place:** `rig watchdog update <jobId> [--interval-seconds n] [--message text] [--spec path]`
+  keeps its id and attachments. The context watch takes `--threshold-tokens` or `--threshold-percent`.
+- **Put restore maps where seats may write:** `rig config set policies.claude_compaction.preparation_root <abs path>`.
+- **Pick a Herdr session:** `rig terminal open <view> --provider herdr --session <name>`.
+- **Close a row with its artifact:** `rig queue update <id> --state done --evidence-ref <path>`.
+- **File and read subscription move reports:** `rig provider moves report` and `rig provider moves`. `--host <id>` and
+  `--codex-home <dir>` on `rig auth status|list|switch` and `rig seat restart` act on another machine's Codex home.
+- **Route stream observations with typed decisions (opt-in, off by default):** once `decisions.enabled` is true,
+  `decisions.consumers` includes `stream` and the intake seat has `OPENROUTER_API_KEY`, `rig project wake --decide`
+  gives each eligible stream observation one bounded typed decision during that seat's wake: create a row for a supplied
+  owner, join supplied work, or record a duplicate or no action. Anything uncertain, refused or failed goes to the
+  intake seat as its own disposition, and the model isn't asked again. `rig project decisions status` shows the state
+  without making a call. Without `--decide`, or with decisions off, nothing changes; turning decisions off no longer
+  strands an accepted create or join whose effect hadn't landed.
+- **Read the stream as a subscriber:** `rig stream subscribe <seat>` (`--tags`, `--type`; re-subscribing keeps the
+  place), then `rig stream read` returns the next bounded page for the calling seat (at most 20 items and 64 KiB, with
+  `more`, `unread` and any `gap`). `rig stream subscriptions` lists readers; `rig stream unsubscribe <seat>` stops one.
+  `rig stream show <id>` says what became of an observation.
+- **Keep the kernel to the harnesses you chose:** `rig setup --providers <list>` is now saved as `provider.selected`, and
+  the kernel starts seats only for those.
+- **Stop a second daemon on a live database:** `rig config set daemon.db_conflict stop` refuses a start whose database a
+  matching live daemon already holds (the default `warn` only warns). `rig daemon start --allow-db-conflict` allows one
+  deliberate start.
 
-## Compaction, restore and handover
+## Behaviour that changed
 
-- **A prepared managed compaction is held, not re-requested.** When the map is
-  complete but `/compact` couldn't go in, the attempt stays `waiting`, marked
-  `prepared`, and sends `/compact` at the next idle moment with an empty box.
-  `rig compact <seat> --state` shows it; a manual `rig compact` reads
-  `already_in_progress`; `--cancel` disarms it. It ends on a context dip, a
-  conversation change, a stale map (`prepared_map_stale`: 15 points of growth or
-  2 hours) or a map that stops reading ready.
-- **A full restore stopped at a prompt clears itself** once the seat runs the
-  conversation it was restoring. If a seat still reads `attention_required`, run
-  `rig seat clear-attention <seat>`, with `--reason` after a partial restore or
-  a community harness's assisted startup. `proof_superseded` means the restore
-  changed mid-check.
-- **A Codex helper inside a Claude seat** no longer takes the seat's resume
-  token (`transcript_not_this_session`).
-- **A Claude rebuild handover may report its priming packet unconfirmed.**
-  Submit the existing packet once, only if it's still staged. Never resend it
-  blindly or rerun the handover.
-- **`on_restore: follow_source`** on a spec's `resources.skills[]` entry
-  refreshes that skill from its source on restore; `keep_saved` is the default.
-
-## Working with the team from outside
-
-- **The `openrig` plugin** lets a person use their own Claude Code or Codex
-  with their local team: hand it work, follow it, answer the team's questions
-  in their own words, and read the result. Install it from the package
-  (`claude plugin marketplace add "$(npm root -g)/@openrig/cli/daemon/assets/plugins/openrig"`,
-  then `claude plugin install openrig@openrig-app`) or from this repository on
-  GitHub. Everyone using the app on a machine acts as the seat it names.
-- **VS Code, Copilot CLI and Cursor** start its server with no seat: add your
-  own `rig mcp serve --front-door` server with `OPENRIG_SESSION_NAME` set and
-  turn the plugin's off. A seatless app can create tasks, send and post as
-  `unknown-mcp-<8 hex>`, but can't claim, update, hand off or answer.
-- **ACP apps:** `rig acp serve --to <member@rig>` (or the `acp.to` setting)
-  makes the team an agent in an app that launches a custom ACP agent, such as
-  Zed or T3 Code. Nothing runs until an app starts it, and it uses the daemon
-  `rig` uses. A question left unanswered in the app stays open in the TUI and
-  Slack. The `@openrig/acp` launcher is packed beside the CLI but not published
-  by these changes. See `docs/reference/acp-agents.md`.
-- **Assistants through a grant service** are experimental, unsupported and off
-  by default: they need your own internet-reachable `rig mcp serve --http
-  --grant-service <url>` and an outside grant service. A registered person can
-  answer the team's questions from one, and `--task-destination <member@rig>`
-  names where its tasks go (`docs/reference/hosted-members.md`).
-- **The `relay` gateway connector** is off unless you add a relay binding. It
-  hands questions and updates to a bridge the operator runs on loopback;
-  "Accepted by bridge" isn't delivery (`docs/reference/gateway-relay.md`).
-
-## OpenShell workers
-
-The CA fix holds on OpenShell 0.1.6; the maintained cleanup (`delete-owned`)
-still fails against OpenShell 0.1.6, because 0.1.6 doesn't mount a workspace
-volume for a custom image, until a fix and its native run land; recreate and
-restore haven't run. "Never grant the guest access to the daemon's main API
-port (normally 7433)."
-
-## Other changes to act on
-
-- **Rows on another host:** `rig queue show`, `list`, `transitions`, `update`
-  and `block` take `--host <id>`; `claim` doesn't, since only the destination
-  seat on its own host claims. `--host` never follows `rig host select`.
-- **A seat's unclaimed backlog:** a seat with no escalation route or delegation
-  parent gets one `unclaimed-backlog` notice. To route its findings to a
-  watching seat:
-  `rig edge add <rig> <root seat's logical id> <watching seat> --kind escalates_to`.
-- **Claims read `working`** for up to 60 minutes while a Claude owner has a
-  live background shell, and 20 while a managed restore is owed.
-- **A cross-host handoff that overrides your claim** wakes you with the
-  successor's id: stop and coordinate with that seat.
-- **Code results:** set an `openrig.code-result/v1` manifest as `evidenceRef`;
-  `rig queue artifact <qitemId>` and `rig_artifact_read` return the commit pair.
-- **Workflows:** runs keep their own spec; `rig workflow unregister
-  <name>[@<version>]` (or `--prune-missing`) removes registered versions;
-  `rig workflow trace <id> --full` returns the whole trail; `show`, `trace` and
-  `status` print `objective:`.
-- **`rig stream emit` timeouts:** repeat with the same `--id`, or check with
-  `rig stream list` before emitting again.
-- **Launch and setup:** `launch_wrapper` works for local Claude Code, Pi and
-  Codex seats; `rig provider switch --seat <pi seat> --account-home <dir>`
-  switches a Pi seat's account (`--dry-run` first); `rig config set` says when
-  an environment variable masks the saved value.
-- **`view.changed` is no longer stored,** and `/api/events` no longer sends it.
 - **Old history-only events can be pruned, if you choose to.** `retention.events_days` (default `0`, which keeps every
   event) turns on a pass in the retention sweep (at daemon start and daily) that deletes `view.changed`,
   `snapshot.created`, `watchdog.evaluation_fired` and the `queue.created`, `queue.updated`, `queue.claimed`,
@@ -172,523 +107,105 @@ port (normally 7433)."
 - **With pruning on, `rig telemetry events` reports the pruned ranges.** A page that spans pruned events inside the
   retained window has a `retained_sequence_gap` for each missing seq range and `coverage.status` `partial` (it used to be
   `retained_window`); events pruned from the start of the log show up as `before_retained_floor`.
-- **Large fleets:** `daemon.seat_poll_interval_ms` (up to 2000) lowers CPU at
-  the cost of activity freshness; keep 1000 if tmux is slow.
-- **Terminals:** Herdr follow views work on macOS (protocol 22) and open a
-  snapshot (`follow_unsupported`) where live following isn't supported.
 
-## Limits to keep in view
+- **Team skills live in each seat's own storage** (`$OPENRIG_HOME/state/seats/<rig id>/<logical seat>/<runtime>/`), not
+  in the project's `.claude/skills` or `.agents/skills`. Claude seats get them as a generated plugin (`openrig:<id>`),
+  Codex seats as their own catalog. If a link sits in that path, the seat starts without them and the result names
+  what wasn't delivered.
+- **Urgent wakes are labelled:** an urgent or critical row's wake starts with `Urgent (marked by …):` at every seat. A
+  seat on `hold` gets one held notice per wake instead of re-nudges, and lifecycle work is refused at the middle levels as
+  at `hold`.
+- **A daemon restart picks up a managed compaction where it stopped.** An owed restore step resumes, a `/compact` that
+  may have been sent is never sent again, and `rig compact --state` shows anything stranded or owed.
+- **A Claude seat whose startup turn is refused** (an expired login, say) holds the rest of its startup context as owed.
+  A startup input sent before the refusal is noticed can still be submitted (see Known issues in the
+  [0.7.1 release notes](https://github.com/mvschwarz/openrig/releases/tag/v0.7.1)).
+- **`rig send` refuses with `target_needs_input`** when a Claude seat's hook has just reported it running and its screen
+  shows an MCP enablement menu, a question or a permission prompt.
+- **`rig down` asks before stopping the caller's own rig.** Without a terminal it exits 1, stops nothing and prints the
+  `--yes` command.
+- **`rig up --plan` doesn't start a stopped daemon:** it exits 1 with `daemon_not_running` and names `rig daemon start`
+  and `--no-kernel`.
+- **`rig daemon start`** waits up to 20 seconds for a slow daemon, and starts with a warning when only a secondary
+  listener, such as Tailscale's, can't be verified.
+- **A seat joined with `rig attach` as an outside app** (Claude Desktop) stays attached through `rig down` and restore
+  (`left_attached`). To replace it, `rig unclaim <name>`, then launch.
+- **New seats get the daemon's `OPENRIG_DB` and `TMUX_TMPDIR`.**
+- **A rebuilt Codex seat keeps its observed permissions,** and a read-only Codex profile launches without OpenRig's
+  writable roots.
+- **A seat's own role** goes only to that seat, never into a shared `CLAUDE.md` or `AGENTS.md`, and `rig down` returns
+  guidance files byte for byte.
+- **Workflow actions** (`project`, `route`, `resume`, `abort`) record the calling agent; a request with neither identity
+  nor actor gets the shared `actor_required` error.
+- **`rig provider moves` is back** for subscription move reports. It switches nothing.
+- **`--dangerously-interact` into a seat's input box stops first** when the box already holds typed or pasted text: it
+  shows that text (apart from suggestions) and types nothing. Clear the box and retry, or pass `--type-without-checking`,
+  which clears nothing. Keys for a recognized native menu are sent as before.
+- **A terminal seat gets exactly the text sent to it,** without the From/To lines (the result says `envelopeOmitted`).
+  A queue wake to a terminal seat types nothing and fails `failed:terminal-seat`; the row stays queued.
+- **A daemon restart that can't see the seats' tmux server** no longer detaches seats whose recorded process still
+  runs, so it doesn't relaunch them beside themselves.
+- **Provider credentials and the activity-hook token stay off tmux, shell and `env` command lines** at launch and
+  handover. A launch whose staging fails stops instead of falling back.
+- **An answer retried from Slack or Steering** after an interrupted close reuses the first reply and finishes the
+  request once.
+- **One bad row no longer stops the stuck sweep** from flagging the others; **a malformed unrelated diagnosis row** no
+  longer stops health diagnoses from listing.
 
-- **OpenShell:** cleanup, recreate and restore (above).
-- **Drafts:** detection isn't complete. Under `refuse`, an unreadable input box
-  lets the send go ahead; under `deliver`, a result may not mention a draft.
-- **A post-compaction step can still hold** when the box reads as typed, under
-  draft-aware delivery or the typing guard, or after a lost `/compact`. Run
-  `rig compact <seat> --cancel`, then send a restore request naming the newest
-  restore map, marker and packet.
-- **A message held as `draft_input_unknown`** isn't retried, and whether
-  managed compaction gets past the update banner wasn't retested.
-- **Claude provider switch:** the "probe pane returned to a shell" failure in
-  [#2341](https://github.com/mvschwarz/openrig/issues/2341) isn't shown fixed;
-  the launcher-script rebuild timeout and `--no-chrome` are fixed.
-- **ACP apps** were checked in T3 Code (Beta) 0.1.7 and with a scripted client;
-  the unanswered-question notice hasn't run in a live app. A cancel stops
-  waiting; the team's work carries on.
-- **The `openrig` plugin** hasn't run in Claude Desktop, the Codex app or
-  Copilot CLI. **Grant-service assistants** still aren't woken.
-- **Claude `launch_wrapper`** hasn't run with zsh, on macOS arm64 or with a real
-  installed Claude; an alias or shell function named `claude` fails closed.
-- **Going back to 0.7.10** isn't established; an older permission hook also
-  gives named-policy Claude sessions no decision until they're relaunched.
-- **The other 0.7.10 limits below still apply:** `rig exec` cancels,
-  permission requests in seat status, Codex hooks (including
-  `rig seat restart --keep-conversation` refusing a Codex seat launched with
-  developer instructions), smol-toml 1.9.x, Slack, Claude Code 2.1.319's auto
-  mode, Codex snapshot restores and `AGENTS.md`, unretried reminders, SSH host
-  status, advisories on a native resume, seats handed over before 0.7.9, `rig`
-  in the TUI's shell after a project-local install, the "Startup prompt still
-  staged" message, and a partial install from two npm installs at once.
-  0.7.10's bare-banner and launcher-script limits are fixed, and its OpenShell
-  limit is replaced by the one above.
+## Output that changed shape
 
----
+- **`rig ps --nodes`** separates every cell with one space (the default row is 5 columns wider), adds an `ATTN` column
+  (`yes`, `no` or `?`) before `REASON`, and marks a `running` seat whose tmux couldn't be reached as unconfirmed.
+- **`rig queue show --json`** no longer has `lastNudgeInputBox`, and send results no longer describe the input box.
+- **`rig queue show` and `rig queue whoami`** print their human notices on stderr, so stdout is the JSON.
+- **A claimed row whose owner waits on a person** reads pickup `needs-input`, with the reason.
+- **`rig down --json`** adds `leftRunning`; `rig reconcile-session` says whether resume metadata was recorded.
+- **`rig compact-plan`** labels its thresholds as its own and says whether automatic compaction is on.
+- **A send held for a draft** in the seat's input box reports `inputPhase: "not_reached"`: it was never typed.
+- **A stream body over 16 KiB** is stored truncated, ending `[truncated by OpenRig: kept N of M bytes]`, and reads mark it
+  `bodyTruncated`. `rig stream list --after <sortKey>` from a pruned item returns 410 `stream_cursor_expired`, naming
+  `--since` to resume, instead of an empty list.
 
-## What changed in OpenRig 0.7.10
+## What to stop doing
 
-The changes from 0.7.9 to 0.7.10, published on 2026-11-08, for an install
-upgrading from 0.7.9 or earlier. 0.7.10 added `rig exec` for finite runs on
-Claude Code or Codex, sent a held post-compaction step after two idle polls that
-can't read the input box, left every tmux mode before a delivery, and showed
-agent spec advisories at launch. Its OpenShell line below is corrected.
+- **Don't read `lastNudgeInputBox`.** It's gone.
+- **Don't parse `rig ps --nodes` by column position.** Use `--json`, with `--fields` to pick fields.
+- **Don't look for a team seat's skills in the project folders.** Use `rig skill loadout --seat`.
+- **Don't stop and re-register a watchdog to change it.** Use `rig watchdog update`.
+- **Don't take a rig down to fix one edge.** Use `rig edge add` or `remove`.
+- **Don't print `OPENRIG_ACTIVITY_*` values** while looking for identity. Use `rig whoami`.
+- **Don't use `--dangerously-interact` to type over a half-written input box.** It stops and shows the text; choose
+  explicitly, or use `rig send --urgent` where the seat's interruption level allows it.
 
-### After the upgrade
+## Known gaps in 0.7.1
 
-- **Restart the daemon** to load the new code: `rig daemon stop`, then
-  `rig daemon start`. This release adds no migrations.
-- **The bundled openrig-core plugin goes from 0.1.25 to 0.1.26.** Its Claude
-  hooks add a `PermissionRequest` hook that reports permission requests to seat
-  status, and its refocus hook and the refocusing skill's trace script changed.
-  Managed refresh preserves replaced files under
-  `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits you still
-  need from the preserved copy.
-- **Check agent specs before relaunching seats:** run `rig agent validate <path>`
-  and read any `agent spec advisory` line. A profile's `uses.<category>` written
-  as a single value now selects that resource; if the resource pool doesn't hold
-  it, a member using that profile fails to resolve with "not found in resource
-  pool". Ask the person before you change their spec.
-- **Codex hooks:** a Codex seat kept running across the upgrade can show "Hook
-  failed — plugin contents changed; hook approval required" until relaunched; in
-  0.7.9's upgrade test, one seat restarted with OpenRig's managed restart showed
-  no review afterwards.
-- **OpenShell:** rebuild a guest image with this release's `guest.py` before
-  using it; the CA repair is in that file, which the image carries.
-- **Codex tool commands use a non-login shell:** managed Codex seats now pass
-  Codex `-c allow_login_shell=false`, so plain `rig` works however OpenRig was
-  installed, with a Codex that supports `allow_login_shell` (checked in Codex's
-  source at 0.162.1 and 0.166); not yet run with a live Codex seat. Setup that lives only in login or rc files, and shell functions and
-  aliases, may be missing from tool commands, and a model request for
-  `login: true` gets Codex's refusal, "login shell is disabled by config". To
-  defer to Codex's own setting, run `rig config set launch.codex_login_shell
-  true`; a login file that sets `PATH` outright can then hide `rig`. It applies
-  at each seat's next launch, and a restart in place keeps the running choice.
-  ([#2613](https://github.com/mvschwarz/openrig/pull/2613))
-
-### Finite runs: `rig exec`
-
-`docs/reference/acp-agents.md` is the rule. Read it before handing a row to
-Claude Code or Codex.
-- **Install the adapters first:** `@agentclientprotocol/claude-agent-acp`
-  0.101.0 and `@agentclientprotocol/codex-acp` 2.5.0, as that page shows.
-  `rig exec harnesses` reports the adapter and native versions it finds.
-- **Run:** `rig exec run <row> --harness claude` (or `codex`). `--plan` shows
-  what would run and starts nothing; `--wait` waits for the outcome. A connector
-  owns the run, so leaving `--wait` or closing the terminal doesn't stop it.
-  Running it again returns the row's run instead of sending the task twice;
-  `--again` starts another turn once that run has ended.
-- **Read the outcome** with `rig exec status <runId|row>`. `interrupted` means
-  the connector died without recording an outcome, so the outcome is unknown. A
-  `completed` turn is the agent's report, not finished work: check the work
-  before you close the row. `--wait` exits 0 for `completed`, 2 for any other
-  outcome and 3 when you stop waiting.
-- **Cancel** with `rig exec cancel <runId>`, not `rig acp cancel`. An
-  acknowledgement isn't a settled shutdown, and it says nothing about further
-  spend.
-- **Usage and cost** the agent reported are on the row's outcome note, for
-  `rig acp run` too, each with its source; what it didn't report reads unknown.
-
-### Compaction and delivery
-
-- **A held post-compaction step goes in.** After two idle polls in a row that
-  can't read a seat's input box, the next poll sends the step (the turn
-  boundary, the restore request or the audit). `rig compact <seat> --state` and
-  `rig seat status` say it went in over a box OpenRig couldn't read; they never
-  call that box empty. A draft OpenRig can't recognise in that box may receive
-  the restore text.
-- **Still held:** a box that reads as typed, with or without a suggestion; a
-  seat whose draft-aware delivery or typing guard holds OpenRig's input; and the
-  step after a `/compact` whose result was lost. To take over a held restore by
-  hand, run `rig compact <seat> --cancel`, then send the seat a restore request
-  naming its newest restore map, its restore marker and its packet. A step
-  already being pasted can still land.
-- **tmux modes:** a send or wake now leaves every tmux mode in a seat's pane,
-  including a chooser, customize or clock mode a person has open. If a send is
-  still refused for a tmux mode, the refusal names why leaving failed.
-- **A scrolled pane with a stale record:** leaving the mode now goes through the
-  seat's address, so a stale binding naming the same reused tmux pane, from
-  another rig for example, no longer makes the send fail with nothing sent.
-- **Herdr views kept across an upgrade keep working,** on Linux Herdr 0.9.5 /
-  protocol 22. A viewer or follow view kept from 0.7.5 through 0.7.9 now counts
-  as the same attachment when only OpenRig's tile script changed, and moves to
-  the current command, so the viewer stays confirmed and the follow view goes on
-  adding and closing tiles. A kept viewer that's already running keeps its
-  earlier sizing for as long as it runs, its own re-attaches included; writable
-  viewers opened after the upgrade size their pane. A different session, tmux,
-  server or read-only setting still holds the view, as before. Checked against
-  the scripts those releases used, not yet with a live Herdr. It follows
-  @natefaerber's approach in
-  [#2467](https://github.com/mvschwarz/openrig/pull/2467). ([#2634](https://github.com/mvschwarz/openrig/pull/2634))
-
-### OpenShell workers
-
-0.7.10 fixes, in the source, the two problems that stopped the OpenShell worker
-in 0.7.9, but the worker hasn't run end to end. Don't rely on this path yet. The
-guest launcher now passes the CA settings the OpenShell exec supplies
-(`NODE_EXTRA_CA_CERTS`, `SSL_CERT_FILE`, `REQUESTS_CA_BUNDLE` and
-`CURL_CA_BUNDLE`) to its Claude, and deleting an owned environment reads
-Podman's inventory through routes Podman serves, stopping as
-`environment_cleanup_unconfirmed` on any other answer. A verified export, a
-finished task and an exact restore haven't been shown. If you set one up anyway,
-follow `daemon/assets/openshell/README.md` in the installed package, rebuild the
-guest image first, and name the costs to the person ("Provider registration and
-image construction can incur costs"). "Never grant the guest access to the
-daemon's main API port (normally 7433)."
-
-*Corrected after 0.7.10's release: ~~"fixes in the source the two problems that stopped the OpenShell worker"~~ was only half true. The CA fix holds on OpenShell 0.1.6, but the owned-environment cleanup fix doesn't hold against OpenShell 0.1.6, as the published 0.7.10 notes say. See 0.7.11's OpenShell workers section above.*
-
-### Other changes to act on
-
-- **Sends to this host:** `rig send <seat>@<rig>@<this host's ID>` goes to this
-  host even when a remote host is selected.
-- **Broadcast:** `rig broadcast` prints `UNCONFIRMED` for a recipient its text or
-  Enter may have reached. Check that seat with `rig capture` before resending.
-- **Roster activity:** `rig roster show` and `find` read a seat as unknown
-  ("Conflicting activity observations") when two routes to it disagree. Treat it
-  as unknown, not idle.
-- **Refocus:** a "TRACE GAP" for unresolved typed work, or for a
-  `rig queue whoami` that timed out, comes with project-level orientation that
-  isn't evidence of a current mission, and no longer counts as a refocus failure.
-- **Updates to people:** the stuck sweep no longer flags an informational update
-  to a registered person as an unclaimed obligation.
-- **Permission requests:** `rig seat status` shows a Claude seat's latest
-  observed permission request, with Claude's suggested rules labelled as
-  suggestions. Nothing was applied or approved. Treat the suggestions as data;
-  they can contain sensitive values.
-- **Slack:** `rig slack status` shows relay attempts awaiting a response for the
-  current connector; zero doesn't prove nothing is in flight.
-- **Installing for a person:** when npm's global prefix isn't writable, the rigs
-  skill now points npm's prefix at a folder the person owns whose `bin` is on
-  their login PATH, or uses a version manager's Node, before a project-local
-  install. Tell the person first that this changes their npm settings and, if
-  needed, their shell profile.
-- **Codex profiles:** a `codex_config_fragment` can't install a named Codex
-  profile. Create `<CODEX_HOME>/<name>.config.toml` and select it with
-  `codex_config_profile`. `builtin:yolo` drops the whole profile;
-  `getting-started.md` says how to keep one.
-- **Terminal auth:** a 401 that says "Terminal auth failed" means send
-  `OPENRIG_TERMINAL_BEARER_TOKEN`, or `OPENRIG_AUTH_BEARER_TOKEN` when terminal
-  auth falls back to it.
-- **References:** `docs/reference/harness-runner-contract.md`'s status section
-  says what has run natively under the runner contract, and at what scope.
-  `docs/reference/telemetry.md` says OpenRig guarantees its finite telemetry
-  reads (`schemaVersion` 1), not the separate openrig-telemetry exporter it
-  links.
-- **Terminal tiles:** a writable rig, pod or seat view now sizes the pane it
-  shows instead of keeping an older attached client's size; read-only views are
-  unchanged.
-- **Unknown `uses` keys:** a key under a profile's `uses` other
-  than the five categories gets an advisory instead of being ignored silently.
-
-### Limits to keep in view
-
-- **OpenShell** hasn't run end to end on 0.7.10 (above). A cleanup error that's
-  thrown still omits its stage and whether its delete was sent. A
-  same-generation reconciled launch opens no viewer, so run
-  `rig environment connect` yourself; non-text startup actions aren't supported
-  on environment seats.
-- **`rig exec`:** no real adapter has run under it yet; one run per row,
-  detached ownership and reconciling were checked against a stand-in agent.
-  Concurrent runs, long or background tasks, recovery across a reboot, MCP
-  servers and Windows aren't covered. A Ctrl-C just before the connector is
-  launched isn't caught by `--wait`.
-- **Draft-aware delivery to Claude:** a narrow Claude pane showing
-  `✔ Update installed · Restart to update` on its own line can still hold
-  deliveries at an empty prompt, queue wakes included; 0.7.10 doesn't recognize
-  that bare banner. A held message isn't replayed automatically by that path.
-- **Seats handed over before 0.7.9** keep their adopted origin until a later
-  launched handover or managed launch records a new session. Until then
-  `rig seat stop`, `clean` and in-place restart refuse them, and now say why.
-  Don't use `rig unclaim` to get around it: that ends OpenRig's management of
-  the seat.
-- **Permission requests in seat status** show only the latest one, held in
-  memory for five minutes and lost on a daemon restart.
-- **Agent spec advisories** don't show for a native resume that continues a
-  saved conversation.
-- **The other 0.7.9 limits below still apply:** open updates for a person, Slack,
-  SSH host status, shared asks, permit records, existing seats, Codex hooks, and
-  grant-service assistants not being woken. 0.7.9's limits on a restore request
-  held after compaction, `rig broadcast`'s `FAILED`, what has run under the
-  runner contract, and Codex seats' `rig: command not found` are fixed or
-  changed. The 0.7.8 limits below that 0.7.9
-  didn't fix or change, and the
-  [0.7.7](https://github.com/mvschwarz/openrig/releases/tag/v0.7.7) and
-  [0.7.6](https://github.com/mvschwarz/openrig/releases/tag/v0.7.6) limits, still
-  apply.
-
----
-
-## What changed in OpenRig 0.7.9
-
-The changes from 0.7.8 to 0.7.9, published on 2026-11-06, for an install
-upgrading from 0.7.8 or earlier.
-
-### After the upgrade
-
-- **Restart the daemon** to load the new code: `rig daemon stop`, then
-  `rig daemon start`.
-  - **Migrations 146 to 149** record a Pi seat's guidance file, what OpenRig last
-    wrote in each managed guidance block, an index for reading a rig's outbox,
-    and the stream intake position.
-- **Tell the person that stream intake is on.** Each `rig stream emit` now opens
-  an intake row for the kernel queue worker (`queue.worker`), or adds a note to
-  the one still unclaimed, and the row wakes the queue worker like any queue row.
-  Earlier stream history isn't replayed. If they want 0.7.8's behaviour, with no
-  intake rows, run `rig config set stream.intake off`.
-- **The bundled openrig-core plugin goes from 0.1.24 to 0.1.25.** Its
-  seat-continuity-and-handover skill changed. Managed refresh preserves replaced
-  files under `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits
-  you still need from the preserved copy.
-- **Where seat guidance goes now:**
-  - a fresh Pi seat gets OpenRig's guidance in its own agent folder's
-    `AGENTS.md`, unless that file or folder is a link;
-  - a fresh Codex seat on Codex 0.164.0 or later gets it as launch developer
-    instructions, not in the repository `AGENTS.md`, when no config layer
-    OpenRig reads sets `developer_instructions`;
-  - a Codex resume, fork, restore or handover successor, an older or unknown
-    Codex, and a config layer that sets `developer_instructions` or can't be read
-    still use the repository `AGENTS.md`;
-  - if only the person's shell startup sets `CODEX_HOME`, OpenRig reads
-    `~/.codex`, so a `developer_instructions` set in their home is replaced for
-    that session. Declare the same absolute path as `CODEX_HOME` in the member's
-    or rig's `env:` to have it checked. `docs/reference/agent-startup-guide.md`
-    ("Codex guidance at launch") is the rule;
-  - a managed block a person edited by hand is kept and named
-    (`guidance_block_edited`), not replaced. Read the warning before you change
-    the block.
-- **Slack:** on the first start after upgrading, the connector edits the asks
-  that ended earlier to show they were handled, at Slack's edit rate: about an
-  hour for 450 asks. `rig slack status` shows pending edits.
-- **OpenShell:** rebuild a guest image built for 0.7.8 with this release's
-  helper; an older helper rejects the new startup step, and the error names the
-  rebuild.
-
-### Runner seats
-
-Section 7 of `docs/reference/harness-runner-contract.md` is the rule for
-permissions, and section 4 for activity. Read them before writing or changing a
-runner.
-- **Typed words:** a reply of just yes or no counts as the agent's allow or
-  reject. Any other words choose nothing: OpenRig's default permits the request
-  when the agent offered an allow option, and the read result carries the words
-  whole as `said`. A runner may queue them for the agent as an ordinary prompt
-  after the current turn, never as the answer; one that drops them still keeps
-  the contract. The ask now tells the person this.
-- **Permit records:** each permit OpenRig decides by default (no one to ask, or
-  an ask closed without a choice, including a row passed to an agent seat) is
-  recorded once, as a stream item from the seat, naming the tool call, why no
-  person answered and the option given. Read them with
-  `rig stream list --tag runner-permission-permit` or `--source <seat>`. A record
-  has no destination and never changes the permit. Stream intake reads past it, so
-  it opens no intake row and wakes no one.
-- **The working beat:** while a prompt is outstanding and the agent is alive, a
-  runner may post `active` / `liveness` so a long call keeps reading working.
-  After delivering an answer or permit, it posts `active` /
-  `permission_resolved`. A runner that sends no beats behaves as before. The Pi
-  runner and the dsh example post it.
-- **Check a runner** with
-  `node daemon/docs/reference/runner-conformance/check-runner.mjs --runner '<command with {agent}>' --name <harness>`.
-  It now covers the beat, and no longer falsely fails a correct runner on a busy
-  machine.
-- **The dsh example** reads `DSH_SEAT_BIN` and `DSH_SEAT_HOME` from the member's
-  `env:`, and section 8 names ACP's `session/resume`.
-
-### OpenShell workers
-
-0.7.9 includes a repair for the OpenShell worker that wasn't usable in 0.7.8,
-but the worker still doesn't work in 0.7.9. Don't rely on this path in 0.7.9.
-Startup reaches the guest through a hash-checked first-input file, and nothing
-is typed through the host viewer. Readiness checks the guest's own execution,
-and a failed owned delete reports the stage that failed. Release testing on
-0.7.9 then found two more problems: the guest's Claude couldn't reach its model
-(`SELF_SIGNED_CERT_IN_CHAIN`), because the guest launcher left out the CA
-settings the OpenShell exec supplies, and deleting an owned environment never
-sent the delete, because its inventory step misread a "Not Found" reply. 0.7.10's
-fixes for both are described above. "Never grant the guest access to the
-daemon's main API port (normally 7433)."
-
-### Assistants connected through a grant service (experimental)
-
-Experimental, unsupported, off by default, and at the person's own risk. With
-`rig mcp serve --http --grant-service <url>` and a grant service the person
-supplies and runs, a connected assistant can claim, update and park the rows
-addressed to its own seat, and see its team with `rig_team`, within the scope its
-existing tools have. Nothing wakes it: an item stays queued until its receiver
-claims it. Name the outside service, and the exposure of serving MCP over HTTP,
-to the person before you set this up. `docs/reference/hosted-members.md` is the
-rule.
-
-### Other changes to act on
-
-- **Held messages:** a seat that starts, or takes over a seat, with held
-  messages is told how many there are. Read them with
-  `rig seat held-messages <seat>`.
-- **Unconfirmed sends:** `rig send --verify` now reports unconfirmed and exits 1
-  when it can't see what its Enter did, and `rig walk` reports unconfirmed
-  instead of lost. Inspect the recipient before any resend.
-- **Deadlines:** to accept a re-estimate without unclaiming the work, run
-  `rig queue update <id> --closure-required-at <ISO>`.
-- **Shared workspaces:** any registered person can settle another's ask as
-  themselves, and the first committed answer wins; a later answer gets 409
-  `qitem_already_terminal` and records nothing. A person registered with no
-  connector binding is asked on Steering and in the Feed only.
-- **Handover:** a fresh or rebuild successor's first turn lists its startup
-  files, role first. A successor that started without a required startup file is
-  marked in the seat list.
-- **Ambiguous rig names:** when an active rig name matches more than one rig,
-  `rig env down`, `status` and `logs` list the matching rig IDs and stop, and
-  `rig doctor --spec` reports conformance as unknown. Use the rig ID.
-- **Seat activity:** window samples older than their bound no longer decide a
-  seat's activity, so a seat whose pane can't be read reads unknown rather than
-  its last verdict. Treat unknown as unknown, not idle.
-- **Launch options:** `specs.builtins_visible: false` hides built-in specs
-  (`rig specs ls --include-builtins` still lists them); `plugin_channels` gives
-  one Claude member its own `--channels`, untested with a real channel plugin.
-- **Files:** `rig down` removes OpenRig's own additions from a working folder
-  once no live seat uses them. `rig export` with no `-o` writes
-  `rig-export.yaml` beside an existing `rig.yaml`. `rig workspace validate` exits
-  1 for malformed optional frontmatter.
-- **Kernels:** a new default kernel starts in `<workspace.root>/kernel`.
-  Existing kernels stay where they are. `docs/reference/agent-startup-guide.md`
-  explains the optional move; a fresh launch there starts a new native
-  conversation, so ask the person before moving.
-- **PATH:** if preflight warns that a Codex seat's login shell can't find `rig`,
-  follow its fix. `getting-started.md` explains the `~/.profile` line and how to
-  check it with `bash -lc 'command -v node rig'`.
-
-### Limits to keep in view
-
-- **OpenShell:** the worker doesn't work in 0.7.9 (above). A same-generation
-  reconciled launch opens no viewer, so run `rig environment connect` yourself;
-  non-text startup actions aren't supported on environment seats.
-- **Open updates for a person** read a 1,001-row window, so a page can come back
-  short, marked `truncated`.
-- **Slack:** a private channel needs the documented route, which isn't tested,
-  and direct messages aren't supported. The channel and people reads haven't
-  been run against a live Slack workspace. Redaction of the bot token from a
-  transport error can still leave a malformed token fragment shorter than six
-  characters, so review an error before sharing it.
-- **SSH host status** reads `unknown` behind a ProxyJump or ProxyCommand; that
-  isn't proof the connection is broken. `rig host ls` reads the ssh config with
-  `ssh -G`, which runs any `Match exec` command in it.
-- **Shared asks:** a click's option written before its answer row can stand
-  beside or inside the closer's answer without the first clicker's authorship.
-- **Permit records** last as long as stream retention keeps them. A permit a
-  runner makes on its own, when it can't reach OpenRig, is in its pane only. For
-  an ask opened before 0.7.9, a record may omit the option's kind.
-- **Existing seats** pick up Codex launch instructions and the single
-  openrig-core skill load at their next fresh launch. A `CLAUDE.md` or
-  `AGENTS.md` that already grew a line per launch isn't trimmed.
-- **Codex hooks after an upgrade:** Codex sessions kept running across the
-  upgrade show "Hook failed — plugin contents changed; hook approval required"
-  until relaunched.
-- **0.7.8's limits** on the dsh `env:` names, conformance false failures, typed
-  words, the README's operator address, a symlinked rebuild, the rebuild receipt,
-  a re-parked click and unrecorded default permits are fixed or changed. The
-  other 0.7.8 limits below, and the
-  [0.7.7](https://github.com/mvschwarz/openrig/releases/tag/v0.7.7) and
-  [0.7.6](https://github.com/mvschwarz/openrig/releases/tag/v0.7.6) limits, still
-  apply.
-
----
-
-## What changed in OpenRig 0.7.8
-
-The changes from 0.7.7 to 0.7.8, published on 2026-11-05, for an install
-upgrading from 0.7.7 or earlier.
-
-### After the upgrade
-
-- **Restart the daemon** to load the new code: `rig daemon stop`, then
-  `rig daemon start`.
-  - **Migrations 142 to 145** store a Claude seat's MCP opt-out, seat activity
-    grants, OpenShell environment bindings and a seat's chosen permission person.
-- **The bundled openrig-core plugin goes from 0.1.23 to 0.1.24.** One skill line
-  changed. Managed refresh preserves replaced files under
-  `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits you still
-  need from the preserved copy.
-
-### Runner seats: a person answers permission requests
-
-Section 7 of `docs/reference/harness-runner-contract.md` is the rule. Read it
-before writing or changing a runner.
-- **Who is asked:**
-  - **the default person** (`rig gateway default`, or the only registered
-    person) gets an ordinary ask in the Feed and on Slack;
-  - **a chosen person,** after
-    `rig seat set-permissions-to <seat> --to <person> --reason "…"`. `--clear`
-    returns to the default;
-  - **no one:** when no one can be asked, the request is "Permitted at once,
-    with the agent's own allow option";
-  - **refusal** is opt-in, with `--deny`. `rig seat status` shows the choice.
-- **What a person's answer does:** a click gives that option, a plain yes gives
-  the allow, and a plain no gives the reject. "A person's no is never a grant."
-  An unanswered request stays pending until the agent's turn ends.
-- **The runner's protocol:**
-  - `POST /api/activity/permission-requests` submits the request;
-  - `GET …/<askId>?waitSeconds=25` reads the answer (25 at most);
-  - `POST …/<askId>/withdraw` withdraws it at the turn's end.
-
-  Deliver an answer once, only to the live request.
-- **Check a runner** with
-  `node daemon/docs/reference/runner-conformance/check-runner.mjs --runner '<command with {agent}>' --name <harness>`
-  from the installed package. It needs Node and tmux, and no daemon, model or
-  network.
-- **The worked example** is the dsh runner under
-  `daemon/docs/reference/community-harness-examples/dsh/`.
-- **A seat activity grant** lets a runner outside the host's hook setup report
-  activity for one seat and launch, without the install-wide hook token.
-
-### OpenShell workers
-
-0.7.8 includes `rig environment` (`setup`, `create`, `attach`) and a reference
-for binding a seat to an NVIDIA OpenShell sandbox (`daemon/assets/openshell/README.md`).
-**In our release testing the worker never became usable:** after the sandbox was
-created and the native process started, `rig environment connect` failed when its
-check timed out after 5 seconds, so no team work ran. Don't rely on this path in
-0.7.8; the later repairs are described above.
-
-**What it needs:**
-- NVIDIA OpenShell 0.1.6;
-- a Linux image;
-- an API-backed provider using `ANTHROPIC_API_KEY`. Subscription or OAuth
-  credentials aren't supported.
-
-"Provider registration and image construction can incur costs", so name them to
-the person before you start. "Never grant the guest access to the daemon's main
-API port (normally 7433)."
-
-### Other changes to act on
-
-- **Mission following:** `rig terminal open mission:<id> --follow --provider herdr`
-  follows a mission's current owners, with the same Herdr path as slices.
-- **Launch choices:**
-  - `claude_mcp: none` on a Claude member launches it without MCP servers;
-  - `rig config set terminal.tmux_server isolated` gives this OpenRig home its
-    own persistent tmux server.
-- **Hosts:** `rig host edit` and `rig host remove` correct or retire a host
-  entry. Use them instead of editing `hosts.yaml` by hand.
-- **Another user's daemon:** when `rig doctor` warns that the port is held by
-  another OS user's daemon, follow its fix (`rig config set daemon.port <free-port>`),
-  or set `OPENRIG_URL` to share that daemon on purpose.
-- **tmux control mode:** with `OPENRIG_TMUX_CONTROL=1`, OpenRig starts a control
-  client only on tmux 3.7c or newer, and uses spawned clients otherwise.
-- **Read-only tmux clients:** a submit key refused because of one goes through
-  the paste route.
-- **Slack:** a typed reply to a decision parked on its person is recorded as the
-  answer. Read the person's words; don't treat the close as approval.
-- **The TUI:** agent pages now show health findings and recently finished items,
-  and an agent spec's "not loaded in this view" means it wasn't read, not that
-  nothing runs it.
-
-### Limits to keep in view
-
-- ~~**No harness has run end to end under the runner contract yet.** The dsh
-  example and the conformance check were checked against stand-ins.~~ *Corrected
-  after release:* 0.7.8's release testing ran a real dsh 0.2.1-rc.2 through the
-  shipped dsh example runner for a person's allow-once and reject-once, and
-  through an outside runner, dsh-seat 0.3.0, for launch, queue work, multiline
-  input, activity, cancel and exact resume. The conformance check itself runs
-  against a stand-in agent.
-- **The answer owner is a registered person,** and a colleague's answer is
-  followed on this host only. A request handed to another host waits as needs
-  input until the turn ends.
-- **Permits and answers aren't recorded** beyond the runner's pane and the ask.
-  If the agent offers only `allow_always`, a permit makes its harness remember a
-  permission nobody chose.
-- **Coming as follow-ups:** recording permits made when no one can be asked, and
-  passing typed words that aren't a plain yes or no to the agent.
-- **The dsh example keeps one hold per seat:** two asks in one turn can leave one
-  waiting after the hold is released.
-- **An OpenShell worker's activity reads unknown,** sampled from the pane, never
-  idle.
-- **The [0.7.7](https://github.com/mvschwarz/openrig/releases/tag/v0.7.7) and
-  [0.7.6](https://github.com/mvschwarz/openrig/releases/tag/v0.7.6) limits still apply.**
+- **A new Claude seat's startup text can stay in its input box unsent.** If a fresh Claude seat sits idle with text at
+  its prompt, press Enter in its pane, or ask the person to.
+- **Claude seats on a macOS native install can read as needing attention after a restore.** Check the pane before
+  acting on it.
+- **A Slack channel-mapping change needs a daemon restart.** Don't use `rig slack disable` then `enable` for it: enabling
+  marks any alerts waiting to post to Slack as already seen.
+- **Ubuntu 22.04's tmux 3.2a:** the query known to crash its server is gone, but a narrower race remains. Avoid 3.2a
+  (`tmux -V`).
+- **`rig daemon start` can take 20 to 40 seconds** before its listener warning, longer than the TUI's 30-second "restore
+  everything" wait. On a slow host, start the daemon yourself first.
+- **A launch that warns "Scoped tmux environment unavailable; retaining the previous environment"** didn't give that seat
+  the clean environment. Check `env` in the seat before relying on OpenRig's variables.
+- **Going back to 0.7.0 with a Slack subscription set:** 0.7.0 can't read a person file that holds one, and its people
+  registry stops loading. Save the choice first (`rig gateway human show <id> --json > <id>.json`), then run
+  `rig gateway human set <id> slack-subscription unset` (`urgent-only` becomes every-ask, as on 0.7.0); set it again after
+  returning to 0.7.1. A person file still holding a `subscriptions:` entry fails on 0.7.0 too. Don't restore an older
+  gateway folder or database instead: that can lose newer people, bindings and delivery records.
+- **A Herdr tile over SSH** doesn't come back by itself after a Herdr restart. Reopen it with `rig terminal open <view>
+  --provider herdr`.
+- **Delegated decisions:** the ask is created before the decision, so without quiet hours it can post to the person
+  first. Pair a decision room with quiet hours, or decide before asking.
+- **`restore-check` still treats a missing startup file as rig-wide.** Trust `rig up --existing`'s per-seat result.
+- **Managed Claude launch requires `/usr/bin/env` support for `-0` and `-u`** (option support checked on GNU coreutils
+  and macOS 15; BusyBox and older macOS unverified). Without the required option support, launch stops instead of
+  falling back to credential-bearing command-line arguments.
+- **In draft-aware mode, an agent's multi-line message to a Claude seat can remain unsubmitted when the paste changes
+  Claude's footer hint.** OpenRig withholds Enter, leaving the text in the composer and later sends waiting. Observed on
+  Claude 2.1.309 with both 0.7.0 and the 0.7.1 pre-cut build; #14 remains open.
+- **A Claude seat signed in with a long-lived token (`claude setup-token`) gets no usage reading.** The reader accepts
+  only claude.ai subscription logins and reports `not_subscription_login`.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "openrig",
-  "version": "0.7.11",
+  "version": "0.7.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "openrig",
-      "version": "0.7.11",
+      "version": "0.7.1",
       "license": "Apache-2.0",
       "workspaces": [
         "packages/daemon",
@@ -7298,7 +7298,7 @@
     },
     "packages/cli": {
       "name": "@openrig/cli",
-      "version": "0.7.11",
+      "version": "0.7.1",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -7336,7 +7336,7 @@
     },
     "packages/daemon": {
       "name": "@openrig/daemon",
-      "version": "0.7.11",
+      "version": "0.7.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@hono/node-server": "^1.13.0",
@@ -7379,7 +7379,7 @@
     },
     "packages/ui": {
       "name": "@openrig/ui",
-      "version": "0.7.11",
+      "version": "0.7.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@fontsource-variable/jetbrains-mono": "^5.2.8",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openrig",
-  "version": "0.7.11",
+  "version": "0.7.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

packages/acp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/acp",
-  "version": "0.7.11",
+  "version": "0.7.1",
   "description": "OpenRig as an agent in ACP apps: starts rig acp serve from the @openrig/cli it pins.",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@openrig/cli": "0.7.11"
+    "@openrig/cli": "0.7.1"
   },
   "license": "Apache-2.0",
   "author": {

packages/acp/registry/agent.json

@@ -1,7 +1,7 @@
 {
   "id": "openrig",
   "name": "OpenRig",
-  "version": "0.7.11",
+  "version": "0.7.1",
   "description": "Send work to your OpenRig team of agents and follow it through to the result",
   "repository": "https://github.com/mvschwarz/openrig",
   "website": "https://openrig.dev",
@@ -12,7 +12,7 @@
   "license_url": "https://github.com/mvschwarz/openrig/blob/main/LICENSE",
   "distribution": {
     "npx": {
-      "package": "@openrig/[email protected]1"
+      "package": "@openrig/[email protected]"
     }
   }
 }

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/cli",
-  "version": "0.7.11",
+  "version": "0.7.1",
   "type": "module",
   "description": "Build your own network of agents from Claude Code, Codex and Pi: persistent teams with roles, shared context and owned work.",
   "keywords": [

packages/cli/src/commands/capture.ts

@@ -54,9 +54,9 @@ export const READABLE_REQUEST_TIMEOUT_MS = 15_000;
 /** What happened to the window after a readable read, as far as OpenRig knows. */
 export function readableRelease(release: string | undefined): string {
   switch (release) {
-    case "given-back": return "its window was then given back its size and its own window-size";
+    case "given-back": return "its size was put back and its window-size override was unset";
     case "kept-by-another-holder": return "a web terminal opened on it meanwhile and holds its window now; it gives the window back when it closes";
-    case "failed": return "giving its window back failed; a later readable capture or web terminal visit gives it back";
+    case "failed": return "giving its window back failed; a later readable capture can retry releasing its pin";
     default: return "its window's record had changed, so OpenRig left the window as it found it";
   }
 }
@@ -122,7 +122,7 @@ function renderCapture(data: Record<string, unknown>): void {
     const readable = r["readable"] as { resized?: boolean; width?: number; height?: number; reason?: string; release?: string; sizeBack?: string } | undefined;
     if (readable?.resized === true) {
       const after = readable.release === "given-back" && readable.sizeBack
-        ? `its own window-size was given back, but ${readable.sizeBack}`
+        ? `its window-size override was unset, but ${readable.sizeBack}`
         : readableRelease(readable.release);
       console.error(`[rig capture: ${r["sessionName"]}: read at ${readable.width}x${readable.height}; ${after}]`);
     } else if (readable?.resized === false) console.error(`[rig capture: ${r["sessionName"]}: not resized for reading: ${readable.reason}]`);
@@ -190,11 +190,11 @@ Supported notes:
     "[rig capture: ...: pane WxH is smaller than 80x24, ...]" note on stderr says the prompt may be
     cut off and suggests --readable. --json has it as promptPane: width, height and hint.
   - --readable (or --size WxH) reads a seat whose pane is smaller than that: it resizes the seat's
-    window, waits for the seat to redraw, captures, then puts the window back, both its size and
-    its own window-size setting, so Herdr, tmux attach and other clients size it as before. The
+    window, waits for the seat to redraw, captures, then puts its size back and unsets the temporary
+    window-size override, so Herdr, tmux attach and other clients size it again. The
     seat redraws twice, and anyone watching it sees the resize briefly. A window that's already big
     enough is read as it is, and so is one whose size is pinned (window-size manual, as while the
-    web terminal shows it), one whose sizing can't be read, and one with several panes. With --rig
+    web terminal has opted into fixed geometry), one whose sizing can't be read, and one with several panes. With --rig
     or --pod, small seats are read at that size for up to 8 seconds in all, and the rest as they
     are. A stderr note says which; --json has it as readable.
   - --lines N shows at most the last N lines, counted up from the last non-blank line. When lines

packages/cli/src/commands/config.ts

@@ -107,6 +107,14 @@ Keys:
                          than N days; 0 keeps them (default). Removed events no longer replay from /api/events, leave
                          the telemetry export, the log and the feed, and can't be brought back. Read at the next sweep
                          (daily and at daemon start)
+  retention.closed_content_days  remove the content of closed queue work (done, canceled, denied, handed-off) N
+                         days after it closed; the row stays, without content. 0 keeps it (default). Can't be undone
+  retention.closed_metadata_days  delete closed queue rows N days after they closed, keeping only their ids so a retry
+                         can't recreate them. 0 keeps them (default). Both read at the next sweep; "rig queue erase
+                         --routine --apply" runs them now
+  retention.erasure_ledger  an absolute file where queue erasure appends each erased id and its action, one JSON
+                         line each, before it commits them; keep it outside backups and replay it with "rig queue
+                         erase --ids <file> --apply" after a restore. Empty keeps no ledger (default)
   launch.non_interruptive  accept harness first-launch warnings at full bypass for new rigs (default off)
   launch.codex_login_shell  defer to Codex's own login-shell setting in managed Codex seats (default off)
                          Off adds allow_login_shell=false: tool commands inherit the seat's environment, so plain rig
@@ -119,6 +127,7 @@ Keys:
                          POSIX launches otherwise start from daemon + seat environment, preserving shell startup.
                          Turn on for custom setups that intentionally rely on tmux globals. Running agents are unchanged.
                          If the scoped boundary is unavailable, launch continues with its previous environment and a diagnostic.
+  terminal.fixed_geometry  use 90x27 web geometry while subscribed (default off; other viewers share the pinned size)
   terminal.status_bar    show the inner tmux status bar on launch (default off)
   terminal.tmux_server   inherit the launching server, or isolated per OpenRig home (restart required)
   terminal.history_limit rows of tmux scrollback per pane in the ~/.tmux.conf block rig setup writes (2000-1000000; default 10000).

packages/cli/src/commands/daemon.ts

@@ -267,13 +267,19 @@ export function daemonCommand(depsOverride?: LifecycleDeps): Command {
         // need a kernel-ready signal opt in here.
         if (opts.waitForKernel) {
           const { waitForKernelReady, skippedKernelMessage } = await import("../daemon-lifecycle.js");
+          const { attentionLines, checkKernelAttention } = await import("../seat-attention.js");
+          const { DaemonClient } = await import("../client.js");
           const timeoutMs = opts.waitForKernelMs && /^\d+$/.test(opts.waitForKernelMs)
             ? parseInt(opts.waitForKernelMs, 10)
             : 60_000;
           const baseUrl = `http://${formatDaemonHostForUrl(state.host ?? "127.0.0.1")}:${state.port}`;
           const result = await waitForKernelReady(baseUrl, timeoutMs);
+          // A kernel seat held at a startup prompt or sign-in keeps the kernel short of ready: name it and why.
+          const heldLines = result.kernelState !== "ready" && result.kernelState !== "skipped"
+            ? attentionLines(await checkKernelAttention(new DaemonClient(baseUrl)), "pane").map(line => `  ${line}`) : [];
           if (result.ok) {
             console.log(`Kernel ${result.kernelState}; variant=${result.variant ?? "(none)"}`);
+            for (const line of heldLines) console.log(line);
           } else if (result.kernelState === "skipped") {
             // Skipped on purpose, so neither a timeout nor an auth problem: say why, and the way back.
             console.error(skippedKernelMessage(result.detail));
@@ -287,6 +293,7 @@ export function daemonCommand(depsOverride?: LifecycleDeps): Command {
                 "\n" +
                 "Fix: inspect `rig ps --rig kernel` for stalled agents, or run `claude auth status` / `codex login status` to confirm runtime auth.",
             );
+            for (const line of heldLines) console.error(line);
             process.exitCode = 1;
           }
         }

packages/cli/src/commands/gateway.ts

@@ -567,9 +567,14 @@ Examples:
 
   human
     .command("set <entityId> <field> <value>")
-    .description("Edit one field through the verb (same validation as add; re-projection immediate). Fields: display-name, delivery-class, away, availability (available|focus|away|off, or unset), slack-subscription (the person's Slack subscription: every-ask, the default, posts every ask to Slack too; urgent-only posts only asks created with --alert, the rest wait on Steering and the TUI; or unset), binding.<n>; and, kept in the participant side file: organization (an id, or unset), groups (comma-separated ids, or unset), policy (text, @<path> to read a file, or unset)")
+    .description("Edit one field through the verb (same validation as add; re-projection immediate). Fields: display-name, delivery-class, away, availability (available|focus|away|off, or unset), slack-subscription (the person's Slack subscription: every-ask, the default, posts every ask to Slack too; urgent-only posts only asks created with --alert, the rest wait on Steering and the TUI; or unset), binding.<n> (a full kind:connectorRef:secretsRef:role[:handle=<id>] spec, or unset to remove that binding); and, kept in the participant side file: organization (an id, or unset), groups (comma-separated ids, or unset), policy (text, @<path> to read a file, or unset)")
     .option("--reason <reason>", "Reason recorded with connector binding changes", "update human binding")
     .option("--actor <actor>", "Named operator when outside a managed seat")
+    .addHelpText("after", `
+Removing a connector binding (binding.<n> unset):
+  - The one-primary rule stays: no replacement primary is chosen silently. If removing a primary binding would leave other bindings, the command refuses. To replace the primary in place, set its slot to the new primary spec; to promote an existing secondary binding, first save that binding's full spec (kind:connectorRef:secretsRef:role[:handle=<id>]) from rig gateway human show <entityId> --json, then unset that secondary slot, then find the primary's current slot in remainingBindings (or rig gateway human show <entityId> --json, since the primary's slot shifts down when a lower-index secondary is removed) and set it to the saved spec with role primary (promotion replaces the former primary binding; its connector reference and inbound handle are not retained as a secondary); to remove every binding, unset the secondary bindings first using their current slot indexes from remainingBindings or rig gateway human show <entityId>, then finish at binding.0 (once all secondaries are gone, the primary is at binding.0).
+  - Remaining bindings are printed with their shifted binding.<n> slot indexes (the primary's slot shifts down too when a lower-index secondary is removed). Because indexes shift after removal, do not blindly retry 'binding.0 unset'; check remainingBindings, the receipt, or 'rig gateway human show <entityId>' before retrying.
+  - Removing a binding keeps the person, their preferences, their other bindings and their open questions. Removing the last binding makes the current delivery episode inactive, so new missing-post findings stop (an already-open recovery item for an undelivered notice may remain); the current delivery-outcome display may disappear too, while historical receipt notes remain. It does not answer, close or cancel open questions, cancel or reroute already-prepared deliveries, or retract anything a bridge has already accepted.`)
     .action(async (entityId: string, field: string, value: string, opts: { reason: string; actor?: string }) => {
       const registry = await import("@openrig/daemon/gateway-human-registry");
       if (field === "organization" || field === "groups" || field === "policy") {
@@ -602,7 +607,19 @@ Examples:
               return { value: res, after: { digest }, effect: digest === prior ? "no-op" : "applied" };
             },
           });
-          console.log(JSON.stringify({ ok: true, entityId, field, path: result.value.path, receipt: result.receipt }));
+          console.log(JSON.stringify({
+            ok: true,
+            entityId,
+            field,
+            path: result.value.path,
+            receipt: result.receipt,
+            ...(value === "unset"
+              ? {
+                  remainingBindings: result.value.remainingBindings ?? [],
+                  note: result.value.note,
+                }
+              : {}),
+          }));
         } catch (error) { console.error(`refused: ${(error as Error).message}`); process.exitCode = 1; }
         return;
       }

packages/cli/src/commands/host.ts

@@ -884,7 +884,8 @@ export function hostCommand(doctorDepsOverride?: DoctorDeps): Command {
       if (!opts.json) {
         console.log(`Pairing code: ${issued.code}`);
         console.log(`Waiting for approval on the target (its attention queue carries item ${issued.approvalQitemId ?? "?"}).`);
-        console.log(`On the target: rig queue update ${issued.approvalQitemId ?? "<qitem-id>"} --state done --closure-reason no-follow-on`);
+        console.log("On the target, its person approves it by answering the pairing request with Approve: in the TUI (rig tui, then attention), on Steering, or with Slack's Approve button. On a 0.7.11 or later target a typed reply doesn't approve; on an older target any typed reply approves.");
+        console.log(`From an agent seat on the target instead: rig queue update ${issued.approvalQitemId ?? "<qitem-id>"} --state done --closure-reason no-follow-on --resolution approve (it needs a managed seat; a plain terminal is refused).`);
       }
 
       // A note names the bound actually used so a clamped value is not silently absorbed.

packages/cli/src/commands/launch.ts

@@ -35,7 +35,7 @@ type LaunchResponse = {
 // operator must act). These are NOT successful launches — never print "Launched" for
 // them; exit non-zero. Mirrors the daemon's NON_RUNNING_LAUNCH_STATUSES.
 const NON_RUNNING_LAUNCH_STATUSES = new Set(["awaiting-decision", "attention_required", "failed", "left_attached"]);
-function launchStatusRunning(status: string): boolean {
+export function launchStatusRunning(status: string): boolean {
   return !NON_RUNNING_LAUNCH_STATUSES.has(status);
 }
 

packages/cli/src/commands/proof.ts

@@ -143,6 +143,11 @@ export function proofCommand(): Command {
 The selected daemon owns show/judge. Scope addresses are mission/slices/slice#item.
 The project owner selects proofPolicy: { judges: [exact-seat-address] } in the
 owning slice.yaml, mission.yaml or project.yaml (nearest wins; no default gate roles).
+By default an item's latest judgment from any listed judge decides it. Add
+everyJudge: true to require every listed judge's own current accept: one judge's
+accept then can't hide another's reject, withdraw, missing judgment or stale
+evidence. Turning it on is a policy change, so earlier judgments must be recorded
+again. rig proof show lists each judge's own latest judgment either way.
 The contract is the authored ## Proof contract. A sole item needs no # selector.
 
 Example (existing evidence, no copied hashes or operation key):
@@ -163,9 +168,17 @@ checkboxes do not accept an item under the selected proof policy.
     if (cmd.opts().workspace) throw new Error("--workspace applies to proof add. Select the judgment daemon using OPENRIG_URL; proof show reports its scope basis.");
     return new DaemonClient();
   };
-  const response = async (r: { status: number; data: unknown }): Promise<Record<string, any>> => {
+  // A path_escape response names the supported routes to another workspace's tree.
+  const projectSelected = (project: unknown, scope: unknown) => Boolean(project) || /^[^/:]+:/.test(typeof scope === "string" ? scope : "");
+  const escapeHint = (project: boolean) => project
+    ? "\nThe scope is outside that project's missions root; name a mission/slice path inside it."
+    : "\nThe scope is outside the selected daemon workspace. For a catalog project, pass --project <id> or prefix the scope with <project>:."
+      + " To use another daemon's workspace, select that daemon with OPENRIG_URL.";
+  const response = async (r: { status: number; data: unknown }, project = false): Promise<Record<string, any>> => {
     const data = r.data as Record<string, any>;
-    if (r.status >= 400) throw new Error(`${data.error ?? r.status}: ${data.message ?? "Read the named source and retry"}`);
+    if (r.status >= 400) {
+      throw new Error(`${data.error ?? r.status}: ${data.message ?? "Read the named source and retry"}${data.error === "path_escape" ? escapeHint(project) : ""}`);
+    }
     return data;
   };
   const projectHelp = "Workspace-catalog project id; resolves the scope under that project's missions root (same as a <project>:<scope> prefix)";
@@ -175,7 +188,7 @@ checkboxes do not accept an item under the selected proof policy.
     .action(async (scope, opts) => {
       try {
         const query = new URLSearchParams({ ...(opts.project ? { project: opts.project } : {}), ...(scope ? { scope } : {}) }).toString();
-        const data = await response(await client().get(`/api/proof${query ? `?${query}` : ""}`));
+        const data = await response(await client().get(`/api/proof${query ? `?${query}` : ""}`), projectSelected(opts.project, scope));
         console.log(opts.json ? JSON.stringify(data) : JSON.stringify(data, null, 2));
       } catch (e) { console.error(e instanceof Error ? e.message : String(e)); process.exitCode = 1; }
     });
@@ -196,7 +209,7 @@ checkboxes do not accept an item under the selected proof policy.
         const refs = [...new Set<string>([...opts.evidence, ...(opts.comparison ? [opts.comparison] : [])])];
         const query = new URLSearchParams({ ...(opts.project ? { project: opts.project } : {}), scope });
         for (const ref of refs) query.append("evidence", ref);
-        const c = client(), view = await response(await c.get(`/api/proof?${query}`));
+        const c = client(), view = await response(await c.get(`/api/proof?${query}`), projectSelected(opts.project, scope));
         const items = view.items as Array<{ id: string; text: string; index: number; revision: string; judgment: { id: string } | null }> | undefined;
         const item = selector ? items?.find(i => i.id === selector || i.text === selector || String(i.index) === selector) : items?.length === 1 ? items[0] : undefined;
         if (!item) throw new Error("Select one current item with scope#item; rig proof show lists IDs, text and indices");
@@ -209,7 +222,7 @@ checkboxes do not accept an item under the selected proof policy.
           operationId: opts.operationId, replace: opts.replace === true, ...(opts.project ? { project: opts.project } : {}),
           // Pin the project root the prepared read resolved; the daemon refuses (409 project_changed) if it moved.
           ...((view.project as { root?: string } | undefined)?.root ? { projectRoot: (view.project as { root: string }).root } : {}) };
-        const result = await response(await c.post("/api/proof/judge", body));
+        const result = await response(await c.post("/api/proof/judge", body), projectSelected(opts.project, scope));
         console.log(opts.json ? JSON.stringify(result) : JSON.stringify(result, null, 2));
       } catch (e) { console.error(e instanceof Error ? e.message : String(e)); process.exitCode = 1; }
     });

packages/cli/src/commands/provider.ts

@@ -605,7 +605,7 @@ and native credential-store requirements are unchanged. No fresh account home or
 Do not combine --api-key-file with --account-home or --clear-account-home; select a home and switch credentials separately.
 Pi seats support --account-home with an existing readable auth.json, or --clear-account-home, through a fresh successor
 with a handover. Their current model and effort are retained unless overridden. Pi account changes work with or without
-a launch_wrapper; changing a seat between Pi and another runtime is not supported.
+a launch_wrapper. To change runtime, use rig seat set-runtime with --runtime pi, codex or claude-code.
 --clear-account-home returns to the configured member/rig/daemon/native home through a fresh successor with a handover.
 Use it without --to-account, --stored-login, --account-home or --token-file. It removes an account-home token reference
 only after confirmation; it does not restore historical login bytes. Anthropic active/default profiles live outside

packages/cli/src/commands/ps.ts

@@ -43,7 +43,7 @@ interface PsEntry {
   isArchived?: boolean;
 }
 
-interface NodeEntry {
+export interface NodeEntry {
   /** Served daemon attention, never re-derived here. Missing on an older daemon. */
   needsAttention?: boolean;
   arbitratedNeedsInput?: boolean | null;
@@ -716,6 +716,26 @@ function startedWithoutLine(files: string[]): string {
   return `missing required ${files.map((file) => file.split("/").pop()).join(", ")}`;
 }
 
+/** Why a seat that needs attention does, from what the daemon recorded: a missing session, a startup error, a held
+ *  message, a missing required file, or the served needs-input reason. Otherwise "reason unavailable". */
+export function attentionReason(n: NodeEntry): string {
+  return missingSessionGuidance(n) ?? n.latestError ?? (n.heldReason ? `held: ${n.heldReason}` : null)
+    ?? (n.startedWithoutRequired?.length ? startedWithoutLine(n.startedWithoutRequired) : null)
+    ?? questionReason(n) ?? "reason unavailable";
+}
+
+/** Whether the daemon serves a live question for the seat, with its own precedence: the arbitrated needs-input answer,
+ *  and the hook only when there's none. A served "no" beats a stale hook. */
+export function servesQuestion(n: NodeEntry): boolean {
+  return n.arbitratedNeedsInput ?? (n.agentActivity?.state === "needs_input");
+}
+
+/** The served question's reason, with the daemon's precedence: the arbitrated answer, and the hook only without one. */
+export function questionReason(n: NodeEntry): string | null {
+  return n.arbitratedNeedsInput === true ? n.activityState?.needsInput.reason ?? null
+    : n.arbitratedNeedsInput == null && n.agentActivity?.state === "needs_input" ? n.agentActivity.reason : null;
+}
+
 export function compactNodeProjection(nodes: NodeEntry[]): Array<Record<string, unknown>> {
   return nodes.map((n) => {
     const keepDiagnostics = n.needsAttention !== false;
@@ -1370,8 +1390,12 @@ async function handleNodes(
   if (useCompact) {
     console.log(padCompactNodeRow("RIG", "SESSION", "LIFECYCLE", "ACTIVITY", "WORK", "REASON", "ATTN"));
     for (const n of humanList as NodeEntry[]) {
+      // With the daemon's attention flag set, a live question shows its own reason rather than a recorded error. Without
+      // that flag (an older daemon), the order stays as it was, so a startup failure isn't hidden by a hook. The question's
+      // reason is shown whole, as the activity reason always was: it's what a person reads to know what to answer.
       const reason = missingSessionGuidance(n) ?? (n.needsAttention !== false || hasCurrentUsageLimit(n)
-        ? (n.latestError ? truncate(n.latestError, 40) : n.startedWithoutRequired?.length ? truncate(startedWithoutLine(n.startedWithoutRequired), 40)
+        ? (n.needsAttention === true && servesQuestion(n) ? questionReason(n) ?? "reason unavailable"
+          : n.latestError ? truncate(n.latestError, 40) : n.startedWithoutRequired?.length ? truncate(startedWithoutLine(n.startedWithoutRequired), 40)
           : n.agentActivity?.reason ?? "—")
         : livenessUnconfirmed(n) ? "liveness unconfirmed" : "—");
       console.log(padCompactNodeRow(

packages/cli/src/commands/queue.ts

@@ -4,7 +4,7 @@ import { Command, InvalidArgumentError } from "commander";
 import { DaemonClient, DaemonConnectionError, DaemonTimeoutError, DaemonResponseError, remoteDaemonClient, type DaemonResponse } from "../client.js";
 import { getDaemonStatus, getDaemonUrl , daemonStatusGuard, resolveOriginSelfHostId } from "../daemon-lifecycle.js";
 import { readOpenRigEnv } from "../openrig-compat.js";
-import { sessionRigOf, isHumanSeatSessionRef } from "../session-name.js";
+import { sessionRigOf, isHumanSeatSessionRef, parseSessionName } from "../session-name.js";
 import { realDeps } from "./daemon.js";
 import { enumArg, positiveIntArg } from "../cli-error.js";
 import type { StatusDeps } from "./status.js";
@@ -890,6 +890,54 @@ function requireSeatSession(ignoredFlag: string): string | undefined {
   return undefined;
 }
 
+/** The flags `rig queue update` takes that write more than a note. `--source` records a note only (#2866). */
+const UPDATE_STATE_WRITE_FLAGS = [
+  ["state", "--state"], ["reopen", "--reopen"], ["closureReason", "--closure-reason"], ["closureTarget", "--closure-target"],
+  ["closureRequiredAt", "--closure-required-at"], ["resolution", "--resolution"], ["blockedOn", "--blocked-on"],
+  ["wakeWatchdog", "--wake-watchdog"], ["wakeAfter", "--wake-after"], ["summary", "--summary"], ["evidenceRef", "--evidence-ref"],
+] as const;
+
+/**
+ * #2866: who appends a `rig queue update` note. Inside a managed seat it is the seat (the X-OpenRig-Session header the
+ * DaemonClient stamps), whatever --source says. Outside one, a routine can name itself with --source <name>@external:
+ * it rides the body as the declared actor, which the daemon records as claimed:v1 because no header names a seat, so
+ * the note is attributed to an external actor and never to a seat, and OPENRIG_SESSION_NAME is never forged. The
+ * external path records a note only, on the local daemon (the caller refuses a --host that resolves to another host).
+ * Returns the body actor to send (undefined = the header decides), or false after printing why nothing was sent.
+ */
+function resolveUpdateActor(source: string | undefined, opts: Record<string, unknown>): { actorSession?: string } | false {
+  const refuse = (message: string): false => { console.error(message); process.exitCode = 1; return false; };
+  // Trimmed like the DaemonClient's header (senderIdentityHeaders): a blank env is no seat, so the two never disagree.
+  const seat = readOpenRigEnv("OPENRIG_SESSION_NAME", "RIGGED_SESSION_NAME")?.trim() || undefined;
+  if (source !== undefined) {
+    const trimmed = source.trim();
+    if (parseSessionName(trimmed).kind !== "external") {
+      return refuse(`--source must be <name>@external (got '${source}'): it names a routine outside any seat, never a seat. Nothing was sent.`);
+    }
+    const writes = UPDATE_STATE_WRITE_FLAGS.filter(([key]) => opts[key] !== undefined).map(([, flag]) => flag);
+    if (opts.note === undefined || writes.length > 0) {
+      return refuse(`--source records a note only: pass --note and nothing else that writes${writes.length > 0 ? ` (got ${writes.join(", ")})` : ""}. ` +
+        "Changing a row needs a seat. Nothing was sent.");
+    }
+    if (seat) {
+      process.stderr.write(`warning: --source ${trimmed} is ignored: this runs in the seat ${seat}, which is the note's actor.\n`);
+      return {};
+    }
+    return { actorSession: trimmed };
+  }
+  if (seat) return {};
+  const noteOnly = opts.note !== undefined && UPDATE_STATE_WRITE_FLAGS.every(([key]) => opts[key] === undefined);
+  return refuse(noteOnly
+    ? "notes need a seat; an external routine can pass --source <name>@external. OPENRIG_SESSION_NAME is not set, so " +
+      "there's no seat to act as: run this from a managed seat, or add --source <name>@external to record the note as " +
+      "that external routine (claimed, never a seat). --actor is ignored: the actor is the seat's own identity."
+    : "OPENRIG_SESSION_NAME is not set, so there's no seat to act as. Run this from a managed seat, or set " +
+      "OPENRIG_SESSION_NAME to the seat's session name (for example dev-impl@my-rig). --actor is ignored: the actor is " +
+      "the seat's own identity. Changing a row needs a seat, and notes need a seat; an external routine can pass " +
+      "--source <name>@external for a note only. A person answering an ask addressed to them (a host pairing approval, " +
+      "say) does it in the TUI (rig tui, then attention) or in Steering, not with this command.");
+}
+
 function extractRigName(sessionName: string): string | undefined {
   // OPR.0.4.6.MH1 FR-8: the shared parse contract (greedy first-@ rig).
   return sessionRigOf(sessionName);
@@ -1299,11 +1347,13 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
     .option("--summary <text>", "Summary persisted onto the item (human-seat parks, or standalone summary update without --state)")
     .option("--evidence-ref <path>", "Pointer to the durable artifact, persisted onto the item on a human-seat park or a done close (--state done). For a code result, a JSON file of kind openrig.code-result/v1 (repo, base and revision as full commit ids, paths) lets a reader diff it exactly")
     .option("--note <text>", "Transition note for the audit log")
+    .option("--source <name@external>", "Outside a managed seat: the external routine that appends the --note, recorded as an external actor (claimed:v1), never a seat; note only, on this host's daemon (a --host that resolves to another host is refused). A managed seat stays the actor. Like any note, it resets the item's stall and notification timing (and its recovery and operator episodes) and advances a claimed item's last activity, but never resets how long an unclaimed item has waited")
     .option("--host <id>", QUEUE_HOST_ROW_OPTION_HELP)
     .option("--full", "Print the whole response row(s) as today, even when output.compact is on (the receipt's waiting keeps only blocker and nextBackstop)")
     .option("--json", "JSON output for agents")
     .action(async (qitemId: string, opts: {
       actor?: string;
+      source?: string;
       state?: string;
       reopen?: boolean;
       closureReason?: string;
@@ -1338,11 +1388,21 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
       // P21 I3 reconcile: the actor is DERIVED from the seat env (X-OpenRig-Session, stamped by
       // DaemonClient) — --actor is deprecated + ignored, no body actorSession. Verify the env (the
       // header source) or the daemon returns 400 actor_required (no seat identity to record; P18 retired the 401 refusal). Matches `resolve`.
-      if (!requireSeatSession("actor")) return;
+      // #2866: outside a seat, --source <name>@external names the routine appending a note (the declared body actor).
+      const actor = resolveUpdateActor(opts.source, opts);
+      if (!actor) return;
       const deps = getDeps();
       await withClient(deps, async (local) => {
         const target = await queueHostTarget(deps, local, opts.host, true);
         if ("error" in target) return emitHostResolutionError(target, opts.json ?? false);
+        if (actor.actorSession !== undefined && target.remote) {
+          // #2866: the other host would record the routine bare, indistinguishable from a routine of its own (a
+          // forwarded create stamps the origin; this path doesn't). A --host that resolves locally is fine.
+          console.error(`--source with --host ${target.remote} is not supported: that host would record ${actor.actorSession} ` +
+            "without the host it ran on. Run the routine on the host that holds the row. Nothing was sent.");
+          process.exitCode = 1;
+          return;
+        }
         const res = await target.client.post<unknown>(`/api/queue/${encodeURIComponent(qitemId)}/update`, {
           state: opts.state,
           reopen: opts.reopen,
@@ -1356,6 +1416,7 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
           summary: opts.summary,
           evidenceRef: opts.evidenceRef,
           transitionNote: opts.note,
+          ...actor,
         }, target.options);
         await printQueueItemResult(target.client, qitemId, opts.json ?? false, res.data, res.status, writeReceipt(opts.full, { verb: "update" }), target.remote);
       }, remoteHostOf(opts.host) !== undefined, remoteHostOf(opts.host));
@@ -1999,6 +2060,100 @@ Examples:
       });
     });
 
+  cmd
+    .command("erase")
+    .description("Erase queue rows in one exact scope: an account's rows, a list of ids, or the closed-work retention windows; a dry run unless --apply")
+    .option("--members <file>", "Account deletion: the account's recorded session names (exact, departed seats included), one per line or a JSON array")
+    .option("--rig <id>", "With --members: the account rig's id. Also erases the rig's own records that outlive it (events, snapshots, node and seat records); refused unless every member is a session of it")
+    .option("--ids <file>", "These qitem ids, one per line or a JSON array; a report's qitems entries, or an erasure ledger's JSON lines, keep each one's action")
+    .option("--action <action>", "With --ids: delete (default) removes each row and keeps only its id; scrub removes its content and keeps the row", enumArg(["delete", "scrub"]))
+    .option("--routine", "Run this daemon's closed-work windows now (retention.closed_content_days, retention.closed_metadata_days)")
+    .option("--apply", "Erase. Without it the command reports what would be erased and changes nothing")
+    .option("--actor <session>", "Who is erasing, when OPENRIG_SESSION_NAME isn't set (recorded as a claimed identity)")
+    .option("--json", "JSON output for agents")
+    .addHelpText("after", [
+      "",
+      "Name exactly one scope. What each one erases:",
+      "  --members  every row whose source and destination are both members, in any state, deleted with its transitions,",
+      "             outbox and inbox copies, stream actions, events and audit rows; then member-to-member outbox and inbox",
+      "             entries no row owns, and the members' stream items. A row with one member endpoint is reported under",
+      "             mixed and left untouched. With --rig, also the rig's own events, snapshots and node and seat records.",
+      "  --ids      the listed rows, deleted or scrubbed (a report's qitems entries keep their action); a deleted id",
+      "             that's already gone keeps (or regains) its id marker.",
+      "  --routine  closed rows (done, canceled, denied, handed-off) past the windows, aged from when they closed.",
+      "A deleted row keeps only its id, and a create that reuses that id is refused (qitem_erased). A row a workflow still",
+      "references is reported under gaps and left. Output is JSON: clean (true only when nothing was left), complete,",
+      "qitems, mixed, gaps, alreadyAbsent, linked, unlinked and rig. Refusals: erase_scope_required, erase_scope_conflict,",
+      "erase_members_invalid, erase_rig_invalid, erase_rig_mismatch, erase_ids_invalid, erase_action_invalid,",
+      "erase_routine_off. A run that stops on an error returns what it committed, with error.stage, and exits 2.",
+      "Reference: docs/reference/queue-erasure.md",
+    ].join("\n"))
+    .action(async (opts: { members?: string; rig?: string; ids?: string; action?: string; routine?: boolean; apply?: boolean; actor?: string; json?: boolean }) => {
+      const list = (flag: string, path: string): unknown[] | undefined => {
+        let text: string;
+        try {
+          text = fs.readFileSync(path, "utf8");
+        } catch (err) {
+          console.error(`--${flag} ${path}: can't be read (${err instanceof Error ? err.message : String(err)}). Nothing was erased.`);
+          process.exitCode = 1;
+          return undefined;
+        }
+        if (text.trimStart().startsWith("[")) {
+          try {
+            const parsed: unknown = JSON.parse(text);
+            if (Array.isArray(parsed)) return parsed;
+          } catch { /* reported below */ }
+          console.error(`--${flag} ${path}: not a JSON array. Nothing was erased.`);
+          process.exitCode = 1;
+          return undefined;
+        }
+        // One entry per line: a plain id or session, or (an erasure ledger's line) a JSON object.
+        const entries: unknown[] = [];
+        for (const line of text.split(/\r?\n/).map((entry) => entry.trim()).filter((entry) => entry.length > 0 && !entry.startsWith("#"))) {
+          if (!line.startsWith("{")) {
+            entries.push(line);
+            continue;
+          }
+          try {
+            entries.push(JSON.parse(line));
+          } catch {
+            console.error(`--${flag} ${path}: a line isn't valid JSON (${line.slice(0, 60)}). Nothing was erased.`);
+            process.exitCode = 1;
+            return undefined;
+          }
+        }
+        return entries;
+      };
+      const body: Record<string, unknown> = { apply: opts.apply === true };
+      if (opts.members !== undefined) {
+        const members = list("members", opts.members);
+        if (!members) return;
+        body.members = members;
+      }
+      // Sent as given: the daemon refuses a rig without members (erase_rig_invalid), never drops it.
+      if (opts.rig !== undefined) body.rig = opts.rig;
+      if (opts.ids !== undefined) {
+        const ids = list("ids", opts.ids);
+        if (!ids) return;
+        body.ids = ids;
+        if (opts.action) body.action = opts.action;
+      }
+      if (opts.routine) body.routine = true;
+      if (!readOpenRigEnv("OPENRIG_SESSION_NAME", "RIGGED_SESSION_NAME")) {
+        if (!opts.actor) {
+          console.error("OPENRIG_SESSION_NAME is not set and --actor wasn't given, so there's no one to record as erasing. Nothing was erased.");
+          process.exitCode = 1;
+          return;
+        }
+        body.actorSession = opts.actor;
+      }
+      const deps = getDeps();
+      await withClient(deps, async (client) => {
+        const res = await client.post<unknown>("/api/queue/erase", body);
+        printResult(opts.json ?? false, res.data, res.status);
+      });
+    });
+
   // ---- Inbox subcommands ----
 
   cmd

packages/cli/src/commands/scope.ts

@@ -2186,6 +2186,17 @@ function sharedSliceNameFinding(missionsRoot: string, missionName: string, slice
   };
 }
 
+/** Show the inherited workspace route because Commander lists a parent option only in the parent's help. */
+export function scopeWorkspaceHelp(tier: "slice" | "mission", verb?: string): string {
+  return `
+Workspace: the parent option --workspace selects the missions root this command reads.
+  rig scope --workspace <project root> ${tier} ${verb ?? "<verb>"} ...
+A project root uses its project.yaml missions.root, else its missions/ folder; a
+folder named missions is used as is. Use it for a catalog project, for example
+$(rig config get workspace.projects_root)/<project>. Without --workspace,
+OPENRIG_WORK_ROOT applies, then the configured workspace.slices_root.`;
+}
+
 export function scopeCommand(): Command {
   const cmd = new Command("scope")
     .description("Scope tree primitive: missions, slices, sub-slices (per conventions/scope-and-versioning)")
@@ -2216,6 +2227,10 @@ export function scopeCommand(): Command {
   mission.addCommand(buildMissionVerifiedCommand());
   mission.addCommand(buildApproveCommand("mission"));
   cmd.addCommand(mission);
+  for (const [tier, group] of [["slice", slice], ["mission", mission]] as const) {
+    group.addHelpText("after", scopeWorkspaceHelp(tier));
+    for (const verb of group.commands) verb.addHelpText("after", scopeWorkspaceHelp(tier, verb.name()));
+  }
   cmd.addCommand(buildResolveNotesCommand());
   cmd.addCommand(buildAuditCommand());
 

packages/cli/src/commands/seat.ts

@@ -1035,13 +1035,13 @@ resume/successor launch reads it at call time. Examples:
   cmd
     .command("set-runtime")
     .argument("<seat>", "Canonical session name or logical seat ref")
-    .option("--runtime <runtime>", "codex or claude-code")
+    .option("--runtime <runtime>", "codex, claude-code or pi")
     .option("--reason <text>", "Why the seat moves; recorded with the switch")
     .option("--model <id>", "Target model; otherwise the seat's agent spec for the target, else the target's default")
     .option("--effort <level>", "Target effort, the target runtime's own level (not translated)")
     .option("--codex-config-profile <name>", "Codex configuration profile for a Codex successor")
     .option("--clear-account-home", "Return to member/rig/daemon/native login selection through a fresh successor")
-    .option("--account-home <path>", "Isolated target CODEX_HOME or CLAUDE_CONFIG_DIR; also permits a fresh successor on the same runtime")
+    .option("--account-home <path>", "Target Codex/Claude home or Pi account directory containing auth.json; also permits a same-runtime successor")
     .option("--token-file <path>", "With a Claude account home, its required subscription token reference")
     .option("--account-label <label>", "With --token-file, the selected account's label")
     .option("--permission-mode <mode>", "Target native permission choice; default: inherit the seat's member and rig policy")
@@ -1051,7 +1051,7 @@ resume/successor launch reads it at call time. Examples:
     .option("--note <text>", "With --confirm: what you'll do first")
     .option("--recover", "Finish an interrupted switch from its record")
     .option("--json", "JSON output for agents")
-    .description("Move a live Codex or Claude Code seat to the other runtime, successor first")
+    .description("Move a live Codex, Claude Code or Pi seat to another runtime, successor first")
     .addHelpText("after", `
 The seat keeps its address, connections, queue rows and claims. Its successor
 starts on the target runtime beside the current occupant, reads a handover, and
@@ -1065,7 +1065,7 @@ later converge reports a deferred change_runtime); the source runtime's model,
 effort, Codex profile and native permission choice are cleared, not mapped; two
 processes run until cutover; messages sent to the seat during the switch are
 held, not typed, and need sending again afterwards.
-Codex and Claude Code, single-pane seats only. --dry-run lists the details.
+Codex, Claude Code and Pi, single-pane seats only. --dry-run lists the details.
 A seat that has never started has no pane to switch: declare the other runtime for it in its rig spec and bring the team
 up again from that spec. That's a new generation of the seat, without this seat's edges, settings or queued work.
 --clear-account-home returns to configured member/rig/daemon/native selection; it does not restore historical credentials.
@@ -1437,12 +1437,16 @@ Examples:
     .option("--json", "JSON output for agents")
     .description("Stop exactly one LIVE managed seat (kills only that seat's tmux session; audited)")
     .addHelpText("after", `
-Siblings are untouched. A dead seat is refused (use rig seat clean); an adopted
-session is refused (use rig unclaim). A seat handed over (fresh, fork or rebuild)
-before OpenRig 0.7.9 still reads adopted and is refused too, until its next launched
-handover or managed launch; the refusal says so. Stopping ends that agent's session and any
-work in progress: check it first (rig capture <seat>) and stop only a seat you
-own or were asked to stop. rig seat launch <seat> --fresh --reason <text> starts
+Siblings are untouched. A dead seat is refused (use rig seat clean). An adopted
+session is refused: to end only it, run rig unclaim <session> (it releases the
+session and leaves its process running), then end that process in its own
+terminal. rig down <rig> ends every seat in its rig, so it is the route only
+for a one-seat rig.
+A seat handed over (fresh, fork or rebuild) before OpenRig 0.7.9 still reads
+adopted and is refused too, until its next launched handover or managed launch;
+the refusal says so. Stopping ends that agent's session and any work in progress:
+check it first (rig capture <seat>) and stop only a seat you own or were asked to
+stop. rig seat launch <seat> --fresh --reason <text> starts
 a fresh occupant there; it does not resume the stopped conversation.
 A community harness stop closes its managed pane; its native processes or compute
 may outlive it. Inspect their own lifecycle receipts.

packages/cli/src/commands/send.ts

@@ -246,7 +246,7 @@ export function sendCommand(depsOverride?: SendDeps): Command {
     .option("--force", "Back-compat no-op: a mid-task/busy pane already sends-with-advisory by default; --force never bypasses the interactive-prompt/permission guard")
     .option("--wait-for-idle <seconds>", "Wait until the target is explicitly idle before sending. If it's still busy, or its activity is unknown, when the wait ends, nothing is sent (exit 1) and nothing is kept to send later; put separate work in a queue row (rig queue create)")
     .option("--raw", "Send exact text/keystrokes without the From/To messaging envelope (still guarded against interactive prompts)")
-    .option("--dangerously-interact", "DANGEROUS: type an answer as keystrokes into an interactive prompt (implies --raw; requires --reason). Letters can select menu shortcuts; CR/ESC act as keys. Enter is added only for the complete visibly staged answer.")
+    .option("--dangerously-interact", "DANGEROUS: type an answer as keystrokes into an interactive prompt (implies --raw; requires --reason). Letters can select menu shortcuts; CR/ESC act as keys. Enter is added for the complete visibly staged answer, or away from a recognized prompt when the input box can't be found or read.")
     .option("--type-without-checking", "With --dangerously-interact: type without reading or clearing existing input; may join or submit that text")
     .option("--reason <text>", "Why the prompt is being driven (required with --dangerously-interact; recorded in the audit log)")
     .option("--urgent", "Mark this message urgent: it types at seats whose interruption level holds other messages. Anyone may mark one; the recipient sees who did")
@@ -322,8 +322,10 @@ would run the envelope lines; the output says so. Use
 --dangerously-interact --reason "<why>" to DELIBERATELY drive a prompt (select an
 option or approve a permission) — the only override of the prompt guard; it
 implies --raw and is audit-logged. The answer is typed as keystrokes: letters may
-be menu shortcuts, and CR/ESC act as keys. An Enter is added only when the complete
-answer is visibly staged in a recognized text input. Combining --verify with
+be menu shortcuts, and CR/ESC act as keys. An Enter is added when the complete
+answer is visibly staged in a recognized text input, and, away from a recognized
+prompt or menu, when the input box can't be found or read (the result says so).
+Combining --verify with
 --dangerously-interact never adds an automatic submit retry, even when the daemon
 did not detect a prompt or did not report its disposition. Unknown consumption
 is not a send failure. On a managed seat with the delivery guard attached, a
@@ -332,7 +334,10 @@ pasted text stops the send and is shown only to you, separately from recognized
 dim suggestions. Collapsed paste contents and unrecognized inputs are not known.
 Inspect the native terminal, deliberately clear its prompt with native/tmux
 controls, then retry. Manual clearing runs outside OpenRig's lease and observation
-checks and is not recorded. --type-without-checking explicitly skips this read;
+checks and is not recorded. An input that can't be read doesn't stop the send:
+the answer is typed, nothing is cleared, the result says the input couldn't be
+read, and the answer may join or submit what is there.
+--type-without-checking explicitly skips this read;
 it does not clear anything and may join or submit existing text. Human typing
 can still race a capture and paste; the check is not atomic.
 
@@ -1134,9 +1139,11 @@ async function runFanOutSend(params: {
   }
 
   const data = res.data;
-  const results = (data["results"] as Array<{ sessionName: string; ok: boolean; error?: string; outcome?: string; envelopeOmitted?: boolean; managedCompaction?: { notice?: unknown }; existingInput?: unknown }>) ?? [];
-  // Context beside a recipient's own result: it was in a managed compaction or restore when the send ran.
+  const results = (data["results"] as Array<{ sessionName: string; ok: boolean; error?: string; outcome?: string; envelopeOmitted?: boolean; managedCompaction?: { notice?: unknown }; existingInput?: unknown; warning?: string }>) ?? [];
+  // Context beside a recipient's own result: its own advisory (such as unreadable input), and whether
+  // it was in a managed compaction or restore when the send ran.
   const printNotice = (r: (typeof results)[number]) => {
+    if (r.warning) console.log(`${r.sessionName}: Advisory: ${r.warning}`);
     if (typeof r.managedCompaction?.notice === "string") console.log(`Notice: ${r.managedCompaction.notice}`);
   };
   // Round-2 F1 (desk-binding): ONE verdict line per recipient. A

packages/cli/src/commands/slack.ts

@@ -122,7 +122,7 @@ const CHANNEL_MAP_APPLY =
 const POST_OPEN_ASKS = "`rig slack post-open-asks`";
 
 type OpenAskOutcome = "posted" | "already-posted" | "queued" | "held" | "below-floor" | "no-longer-active" | "superseded"
-  | "recipient-changed" | "state-unavailable" | "transport-failed" | "uncertain";
+  | "recipient-changed" | "no-connector" | "state-unavailable" | "transport-failed" | "uncertain";
 interface OpenAsk { qitemId: string; recipient: string; summary: string | null; outcome: OpenAskOutcome; detail?: string }
 interface PostOpenAsksResponse { ok: boolean; asks: OpenAsk[] }
 
@@ -135,6 +135,7 @@ const OUTCOME_LABEL: Record<OpenAskOutcome, string> = {
   "no-longer-active": "no longer active",
   superseded: "superseded",
   "recipient-changed": "recipient changed",
+  "no-connector": "no connector (Steering and the Feed only)",
   "state-unavailable": "state unavailable",
   "transport-failed": "transport failed",
   uncertain: "uncertain",
@@ -258,7 +259,7 @@ export function slackCommand(deps: SlackDeps = {}): Command {
             coverage?: { coverageStart: string; coveredThrough: string; pending?: { upper: string; nextLatest: string }; nextRetryAt?: number } | null;
             channels?: Array<{ channel?: string | null; state?: string; reason?: string; lastScanAt?: string;
               coverage?: { coverageStart: string; coveredThrough: string; nextRetryAt?: number } | null }>;
-            threads?: { state?: string; reason?: string; tracked?: number; scanned?: number; pending?: number; oldestPendingSeconds?: number | null;
+            threads?: { state?: string; reason?: string; tracked?: number; scanned?: number; pending?: number; settled?: number; settledRescanHours?: number; oldestPendingSeconds?: number | null;
               backoff?: Record<string, number>; incomplete?: Record<string, number> };
             limits?: string[] } } | undefined;
         if (connector) {
@@ -288,6 +289,7 @@ export function slackCommand(deps: SlackDeps = {}): Command {
             const behind = threads.oldestPendingSeconds != null ? ` (oldest ${Math.round(threads.oldestPendingSeconds / 60)} min behind)` : "";
             log(`  Thread recovery: ${threads.state ?? "unknown"}${threads.reason ? ` (${threads.reason})` : ""}; ${threads.tracked ?? 0} tracked (open, or closed within seven days); `
               + `${threads.scanned ?? 0} scanned, ${threads.pending ?? 0} waiting their turn${behind}`
+              + `${threads.settled ? `, ${threads.settled} settled (nobody waiting; rescanned ${!threads.settledRescanHours || threads.settledRescanHours === 24 ? "daily" : `every ${threads.settledRescanHours} hours`})` : ""}`
               + `${reasons(threads.backoff) ? `; backing off: ${reasons(threads.backoff)}` : ""}${reasons(threads.incomplete) ? `; incomplete: ${reasons(threads.incomplete)}` : ""}`);
           }
           log(`  Recovery counts since connector start: accepted ${recovery?.acceptedThisProcess ?? "unknown"}; dead-lettered ${recovery?.deadLetteredThisProcess ?? "unknown"} (custody, not delivery)`);

packages/cli/src/commands/status.ts

@@ -11,6 +11,7 @@ import {
 import { readLifecycleDescription } from "../daemon-lifecycle-status.js";
 import { realDeps } from "./daemon.js";
 import { ConfigStore } from "../config-store.js";
+import { attentionLines, checkKernelAttention } from "../seat-attention.js";
 
 export interface StatusDeps {
   lifecycleDeps: LifecycleDeps;
@@ -136,8 +137,12 @@ export function statusCommand(depsOverride?: StatusDeps): Command {
       } catch {
         // config resolution unavailable - null rather than a guess.
       }
+      // A kernel short of ready: its seats that need attention, and any it couldn't check (never read as none).
+      const attention = kernelRes?.status === 200 && kernelRes.data?.kernel_state && kernelRes.data.kernel_state !== "ready"
+        ? await checkKernelAttention(client) : null;
       const kernel = kernelRes && kernelRes.status === 200 && kernelRes.data?.kernel_state
-        ? { state: kernelRes.data.kernel_state, lastBootFailure: kernelRes.data.last_boot_failure ?? null }
+        ? { state: kernelRes.data.kernel_state, lastBootFailure: kernelRes.data.last_boot_failure ?? null,
+          ...(attention && (attention.attention.length || attention.unknown.length) ? { attention } : {}) }
         : { state: kernelRes && kernelRes.status === 503 ? "not_tracked" : "unknown", lastBootFailure: null };
       const daemon = { state: "running", reachable: true, pid: status.pid, port: status.port, healthy: true };
       if (summaryRes.status !== 200) {
@@ -163,6 +168,10 @@ export function statusCommand(depsOverride?: StatusDeps): Command {
       if (failure) {
         console.log(`  Recovered from an earlier boot failure (${failure.state}${failure.at ? ` at ${failure.at}` : ""}): ${failure.detail ?? "no detail recorded"}`);
       }
+      // A kernel seat held at a startup prompt or sign-in keeps the kernel short of ready: name it and why.
+      if (kernelRes.data.kernel_state !== "ready") {
+        for (const line of attentionLines(await checkKernelAttention(client), "pane")) console.log(`  ${line}`);
+      }
     } else if (kernelRes && kernelRes.status === 503) {
       console.log("Kernel: not tracked (no kernel-boot tracker wired)");
     } else {

packages/cli/src/commands/terminal.ts

@@ -24,10 +24,40 @@ import { realDeps } from "./daemon.js";
 import type { StatusDeps } from "./status.js";
 import { openTerminalWindow, type WindowDeps } from "../terminal-window.js";
 import { assertLocalTmux, attachTmux, isLocalTmuxHost, readTmuxServerArgs, type TmuxAttachment } from "../tmux-attachment.js";
+import { attentionLines, checkSeatAttention } from "../seat-attention.js";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { homedir } from "node:os";
+
+/** herdr-app's home, resolved the way herdr-app resolves it (as the TUI does). */
+function herdrAppHome(env: NodeJS.ProcessEnv): string {
+  return env["HERDR_APP_HOME"] || join(env["XDG_CONFIG_HOME"] || join(env["HOME"] || homedir(), ".config"), "herdr-app");
+}
 
 export interface TerminalDeps extends StatusDeps {
   windowDeps?: WindowDeps;
   attachTmux?: (target: TmuxAttachment) => Promise<number>;
+  /** This process's environment (herdr-app context); injectable for tests. */
+  env?: NodeJS.ProcessEnv;
+  socketExists?: (path: string) => boolean;
+}
+
+/**
+ * The herdr-app client a command addresses, or null when it doesn't use herdr-app: `--provider herdr-app` opens the
+ * view in the herdr-app window you run it in. Inside a herdr-app terminal, plain `rig terminal open <view>` does the
+ * same when that window is answering (its socket file is a hint; the window is asked before it is chosen). `--window`
+ * always asks for a new desktop window.
+ */
+export function herdrAppClient(opts: { provider?: string; window?: boolean; appHome?: string }, deps: TerminalDeps):
+  { appHome: string; ambient: boolean } | null {
+  if (opts.window) return null;
+  const env = deps.env ?? process.env;
+  const named = opts.provider?.trim();
+  const exists = deps.socketExists ?? existsSync;
+  const ambient = !named
+    && !!env["HC_TERMINAL_ID"] && !!env["HC_TERMINAL_SOCKET"] && exists(join(herdrAppHome(env), "herdr-app.sock"));
+  if (named !== "herdr-app" && !ambient) return null;
+  return { appHome: opts.appHome ? resolve(opts.appHome) : herdrAppHome(env), ambient };
 }
 export interface FollowControls {
   enabled: boolean; maxTiles?: number; graceMs?: number; focusRetentionMs?: number;
@@ -44,6 +74,8 @@ export interface OpenViewResult {
   session?: string;
   ok: boolean;
   opened: string[];
+  /** Opened seats on another host, with that host: complete when sent, so its absence (an older daemon) means unknown. */
+  remote?: Array<{ seat: string; host: string }>;
   absent: { seat: string; host: string | null; reason: string }[];
   degraded: { seat: string; host: string; reason: string; code?: "pane_unconfirmed" }[];
   pages: number;
@@ -106,6 +138,23 @@ function humanOpen(r: OpenViewResult): string {
   return lines.join("\n");
 }
 
+/** Names the opened seats that need attention (a startup prompt, a sign-in, a failed start), so a held seat doesn't
+ *  read as an open that failed for no reason. Local seats are checked on this daemon; a seat on another host, or one
+ *  whose host the result doesn't say, is reported unchecked, never matched to a local seat of the same name. */
+async function withHeldSeats(client: DaemonClient, r: OpenViewResult): Promise<OpenViewResult> {
+  const seats = [...new Set([...r.opened, ...(r.following?.tiles.map(t => t.seat) ?? [])])];
+  if (!Array.isArray(r.remote)) {
+    // An older daemon names opened seats without saying which are remote: none can be checked locally by name.
+    const lines = seats.length ? attentionLines({ attention: [], unknown: seats.map(seat => ({ seat, why: "the daemon didn't say which host each tile is on" })) }, "tile") : [];
+    return lines.length ? { ...r, notes: [...(r.notes ?? []), ...lines] } : r;
+  }
+  const remote = new Map(r.remote.map(({ seat, host }) => [seat, host]));
+  const check = await checkSeatAttention(client, seats.filter(seat => !remote.has(seat)));
+  for (const [seat, host] of remote) check.unknown.push({ seat, why: `it's on host ${host}, which this daemon doesn't check` });
+  const lines = attentionLines(check, "tile");
+  return lines.length ? { ...r, notes: [...(r.notes ?? []), ...lines] } : r;
+}
+
 /** A successful existing-workspace selection also needs no new panes. */
 function printOpen(json: boolean, r: OpenViewResult, status: number): void {
   if (json) {
@@ -121,7 +170,7 @@ function printOpen(json: boolean, r: OpenViewResult, status: number): void {
 export function terminalCommand(depsOverride?: TerminalDeps): Command {
   const cmd = new Command("terminal").description(
     "Open the OpenRig view and agent conversations in terminal tiles",
-  ).addHelpText("after", "\nThe OpenRig TUI and operator (after install, and whenever the person wants their agents):\n  rig terminal open saved:kernel --window\n  Opens the window itself on the daemon's desktop; an agent can run it from its shell.\n  Inside Rex it opens a Rex session and shows it in the Rex app; otherwise it uses herdr when installed, else the same layout in plain tmux.\n  Herdr needs a terminal the person can see; TUI navigation does not open one.\n  Over headless SSH, give the exact connection/attach command for a new terminal/tab.\n  Only if the window cannot open: rig tui --shared is the dashboard-only fallback.\n  On a desktop, the agent opens the view; it does not finish by printing a command to copy.\n");
+  ).addHelpText("after", "\nThe OpenRig TUI and operator (after install, and whenever the person wants their agents):\n  rig terminal open saved:kernel --window\n  Opens the window itself on the daemon's desktop; an agent can run it from its shell.\n  Inside a herdr-app terminal, omit --window to open in that window.\n  Inside Rex it opens a Rex session and shows it in the Rex app; otherwise it uses herdr when installed, else the same layout in plain tmux.\n  Herdr needs a terminal the person can see; TUI navigation does not open one.\n  Over headless SSH, give the exact connection/attach command for a new terminal/tab.\n  Only if the window cannot open: rig tui --shared is the dashboard-only fallback.\n  On a desktop, the agent opens the view; it does not finish by printing a command to copy.\n");
 
   const getDeps = (): TerminalDeps =>
     depsOverride ?? {
@@ -133,9 +182,10 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
     .command("open")
     .argument("<view>", "a rig name, pod:<rig>/<pod>, seat:<rig>/<logical-id>, mission:<id>, slice:<id>, qitem:<id> (current local obligation owners), or a saved-view id")
     .description("Open a desktop terminal showing the view's live agents as interactive tiles")
-    .option("--provider <name>", "herdr, cmux or rex: open in the running provider without a desktop window; each open adds a new workspace (inside Herdr, --window reuses a matching one); tmux requires --window. Inside Rex, the default opens in Rex")
+    .option("--provider <name>", "herdr, herdr-app, cmux or rex: open in the running provider without a desktop window; each open adds a new workspace (inside Herdr, --window reuses a matching one), and herdr-app opens a Rig view in the herdr-app window this runs in, which must be answering; tmux requires --window. Inside Rex, the default opens in Rex")
     .option("--session <name>", "Herdr session on the daemon's host; --session default selects Herdr's default session")
-    .option("--window", "Open a new desktop terminal tab/window (the default when --provider is omitted)")
+    .option("--window", "Open a new desktop terminal tab/window (the default when --provider is omitted outside herdr-app); inside a herdr-app terminal --window still asks for a desktop window, and plain open reuses herdr-app")
+    .option("--app-home <dir>", "herdr-app: the client to open in (default: herdr-app's own home, from HERDR_APP_HOME or ~/.config/herdr-app)")
     .option("--expected-plan <id>", "Open only if the view still matches this preview")
     .option("--follow", "Keep one qitem:<id>, slice:<id-or-name> or mission:<id> workspace following current obligation owners (Linux/macOS Herdr protocol 22)")
     .option("--no-follow", "Stop following and keep the existing workspace and tiles as a fixed layout")
@@ -148,7 +198,7 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
     .option("--grace-ms <ms>", "Departure grace, default 4000, at most 60000", Number)
     .option("--focus-retention-ms <ms>", "Extra focused-reading retention, default 12000, at most 300000", Number)
     .option("--json", "JSON output for agents")
-    .action(async (view: string, opts: { provider?: string; session?: string; json?: boolean; window?: boolean; expectedPlan?: string;
+    .action(async (view: string, opts: { provider?: string; session?: string; json?: boolean; window?: boolean; expectedPlan?: string; appHome?: string;
       follow?: boolean; maxTiles?: number; pin?: string[]; unpin?: string[]; suppress?: string[]; unsuppress?: string[];
       suppressionMs?: number; graceMs?: number; focusRetentionMs?: number }) => {
       const deps = getDeps();
@@ -157,12 +207,51 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
       const hasControls = [maxTiles, pin, unpin, suppress, unsuppress, suppressionMs, graceMs, focusRetentionMs].some(v => v !== undefined);
       const following: FollowControls | undefined = opts.follow !== undefined || hasControls
         ? { enabled: opts.follow !== false, maxTiles, pin, unpin, suppress, unsuppress, suppressionMs, graceMs, focusRetentionMs } : undefined;
+      const herdrApp = herdrAppClient(opts, deps);
       await withClient(deps, async (client) => {
+        // An ambient herdr-app terminal does not claim --follow; only an explicit --provider herdr-app errors with follow_unsupported.
+        let selectedHerdrApp = herdrApp?.ambient && following ? null : herdrApp;
+        let ambientFallbackNote: string | undefined;
+        if (selectedHerdrApp?.ambient) {
+          const probe = await client.get<{
+            available?: boolean;
+            launch?: { socketPath?: string };
+            providers?: Array<{ status?: { available?: boolean; launch?: { socketPath?: string } } }>;
+          }>(
+            `/api/terminal/status?provider=herdr-app&appHome=${encodeURIComponent(selectedHerdrApp.appHome)}`,
+          );
+          const report = probe.data?.providers?.[0]?.status ?? probe.data;
+          if (probe.status >= 400 || typeof report?.available !== "boolean") {
+            const socketPath = report?.launch?.socketPath ?? join(selectedHerdrApp.appHome, "herdr-app.sock");
+            ambientFallbackNote = `herdr-app's socket exists at ${socketPath} but the daemon could not confirm whether it is answering (HTTP ${probe.status}); opening a desktop window instead. Use --provider herdr-app to require it.`;
+            console.error(ambientFallbackNote);
+            selectedHerdrApp = null;
+          } else if (!report.available) {
+            const socketPath = report.launch?.socketPath ?? join(selectedHerdrApp.appHome, "herdr-app.sock");
+            ambientFallbackNote = `herdr-app's socket exists at ${socketPath} but it isn't answering; opening a desktop window instead. Use --provider herdr-app to require it.`;
+            console.error(ambientFallbackNote);
+            selectedHerdrApp = null;
+          }
+        }
+        if (selectedHerdrApp) {
+          // herdr-app: a fresh Rig view in that client's own window, through the daemon. No desktop window.
+          if (following) { printResult(opts.json ?? false, { ok: false, provider: "herdr-app", code: "follow_unsupported", error: "Following isn't available in herdr-app yet; open the view without --follow." }, 400); return; }
+          const { appHome } = selectedHerdrApp;
+          const res = await client.post<OpenViewResult>("/api/terminal/open", { view, provider: "herdr-app",
+            herdrApp: { appHome },
+            ...(opts.expectedPlan !== undefined ? { expectedPlan: opts.expectedPlan } : {}) }, { timeoutMs: TERMINAL_OPEN_TIMEOUT_MS });
+          if (!Array.isArray(res.data?.opened)) { printResult(opts.json ?? false, res.data, res.status); return; }
+          printOpen(opts.json ?? false, await withHeldSeats(client, res.data), res.status);
+          return;
+        }
         // Herdr's control socket can answer with no desktop client attached.
         // The default requests a desktop; an explicit provider reuses its workspace.
+        // --window never selects herdr-app
         if (following?.enabled !== false && (opts.window || !opts.provider)) {
-          const result = await openTerminalWindow(client, view, opts.provider, deps.windowDeps, opts.expectedPlan, session, following);
-          printOpen(opts.json ?? false, result, 200);
+          const windowProvider = opts.provider?.trim() === "herdr-app" ? undefined : opts.provider;
+          const result = await openTerminalWindow(client, view, windowProvider, deps.windowDeps, opts.expectedPlan, session, following);
+          const out = ambientFallbackNote ? { ...result, notes: [...(result.notes ?? []), ambientFallbackNote] } : result;
+          printOpen(opts.json ?? false, await withHeldSeats(client, out), 200);
           return;
         }
         let expectedPlan = opts.expectedPlan;
@@ -187,7 +276,7 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
           printResult(opts.json ?? false, res.data, res.status);
           return;
         }
-        printOpen(opts.json ?? false, res.data, res.status);
+        printOpen(opts.json ?? false, await withHeldSeats(client, res.data), res.status);
       });
     });
 
@@ -203,18 +292,38 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
       });
     });
 
+  cmd
+    .command("close <view>")
+    .description("Close a herdr-app Rig view (rv-…): its cells leave the layout, then only its own viewers end; seats keep running")
+    .option("--app-home <dir>", "herdr-app home the view is in (default: herdr-app's own)")
+    .option("--json", "JSON output for agents")
+    .action(async (view: string, opts: { appHome?: string; json?: boolean }) => {
+      const deps = getDeps();
+      const env = deps.env ?? process.env;
+      await withClient(deps, async (client) => {
+        const res = await client.post<OpenViewResult>("/api/terminal/close", { view, provider: "herdr-app",
+          herdrApp: { appHome: opts.appHome ? resolve(opts.appHome) : herdrAppHome(env) } }, { timeoutMs: TERMINAL_OPEN_TIMEOUT_MS });
+        if (opts.json) { printResult(true, res.data, res.status); return; }
+        console.log(res.data?.ok ? `Closed Rig view ${view}.` : `Not closed: ${res.data?.error ?? `HTTP ${res.status}`}`);
+        for (const note of res.data?.notes ?? []) console.log(`  ${note}`);
+        if (res.status >= 400) process.exitCode = 1;
+      });
+    });
+
   cmd
     .command("status")
     .description("Show terminal provider availability + liveness (doctor)")
-    .option("--provider <name>", "restrict to one provider (herdr / cmux / rex)")
+    .option("--provider <name>", "restrict to one provider (herdr / herdr-app / cmux / rex)")
     .option("--session <name>", "Inspect a named Herdr session on the daemon's host")
+    .option("--app-home <dir>", "herdr-app: the client to inspect (default: herdr-app's own home)")
     .option("--json", "JSON output for agents")
-    .action(async (opts: { provider?: string; session?: string; json?: boolean }) => {
+    .action(async (opts: { provider?: string; session?: string; appHome?: string; json?: boolean }) => {
       const deps = getDeps();
       await withClient(deps, async (client) => {
         let path = opts.provider
           ? `/api/terminal/status?provider=${encodeURIComponent(opts.provider)}`
           : "/api/terminal/status";
+        if (opts.provider === "herdr-app") path += `&appHome=${encodeURIComponent(opts.appHome ? resolve(opts.appHome) : herdrAppHome(deps.env ?? process.env))}`;
         const session = opts.session?.trim();
         if (session !== undefined) path += `${opts.provider ? "&" : "?"}session=${encodeURIComponent(session)}`;
         const res = await client.get<{ session?: string; error?: string }>(path);

packages/cli/src/commands/up.ts

@@ -11,6 +11,7 @@ import { getDaemonStatus, getDaemonUrl, startDaemon, type LifecycleDeps, daemonS
 import { shouldAutoStartDaemon } from "../daemon-reachability.js";
 import { prepareDaemonAutoStart } from "../daemon-auto-start.js";
 import { freshSeatCommand, launchFreshSeat } from "../fresh-seat-command.js";
+import { launchStatusRunning } from "./launch.js";
 import type { StartOptions } from "../daemon-lifecycle.js";
 import { realDeps } from "./daemon.js";
 import type { StatusDeps } from "./status.js";
@@ -120,6 +121,17 @@ snapshot, resuming seats where their harness allows; it refuses while any of its
 whose rig name already exists starts a new team in place of the stopped one, which
 is archived, and refuses if the old one may still be running. To bring a stopped
 team back with its conversations, run rig up <rig-name> --existing, not the spec.
+
+After a restore, rig up exits 0 only when the rig came back whole (rigResult
+fully_restored). It exits 1 when it didn't (partially_restored, failed or
+not_attempted), including when every seat is running but some started fresh
+without their conversation, or came back with a guidance or restore gap. With
+--json, read rigResult and each node's status, noConversation, guidanceGaps and
+restoreGaps to tell these apart: a seat with a gap keeps its own status, such as
+resumed, and a fresh seat marked noConversation (a terminal seat) lost nothing.
+A refused request exits 1 for a conflict (HTTP 409, such as a rig still running
+or a restore not attempted) and 2 for any other refusal (400, 404 or 500, such
+as no rig by that name or a failed boot).
 `);
   const getDepsF = () => depsOverride ?? { lifecycleDeps: realDeps(), clientFactory: (url: string) => new DaemonClient(url) };
 
@@ -706,7 +718,7 @@ team back with its conversations, run rig up <rig-name> --existing, not the spec
         }
         console.log(`Rig "${rigName ?? rigId}" restored (ID: ${rigId})`);
         if (rigResult) console.log(`Result: ${rigResult}`);
-        const nodes = (res.data["nodes"] as Array<{ logicalId: string; status: string; error?: string }>) ?? [];
+        const nodes = (res.data["nodes"] as Array<{ logicalId: string; status: string; error?: string; noConversation?: true; guidanceGaps?: string[]; restoreGaps?: string[] }>) ?? [];
         for (const n of nodes) {
           // OPR.0.3.4.2 — the five-term vocabulary renders distinctly; the
           // awaiting-decision reason is part of the line (not a dead end), and so is a failed seat's (such as a seat held
@@ -717,6 +729,16 @@ team back with its conversations, run rig up <rig-name> --existing, not the spec
             console.log(`  ${n.logicalId}: ${n.status}`);
           }
         }
+        // Every seat running still exits 1 when the restore isn't whole; say why, so nobody retries a start that worked.
+        if (rigResult === "partially_restored" && nodes.length > 0 && nodes.every((n) => launchStatusRunning(n.status))) {
+          const fresh = nodes.filter((n) => (n.status === "fresh" || n.status === "fresh-primed") && !n.noConversation).length;
+          const gapped = nodes.filter((n) => (n.guidanceGaps?.length ?? 0) > 0 || (n.restoreGaps?.length ?? 0) > 0).map((n) => n.logicalId);
+          const reasons = [
+            ...(fresh > 0 ? [`${fresh} started fresh without their conversation`] : []),
+            ...(gapped.length > 0 ? [`${gapped.join(", ")} came back with a gap named in a warning`] : []),
+          ];
+          console.log(`${nodes.length === 1 ? "The one seat is" : `All ${nodes.length} seats are`} running${reasons.length > 0 ? `; ${reasons.join("; ")}` : ""}. The restore isn't whole, so rig up exits 1.`);
+        }
         const warnings = (res.data["warnings"] as string[]) ?? [];
         for (const w of warnings) {
           console.error(`  warning: ${w}`);

packages/cli/src/commands/workflow-errors.ts

@@ -72,7 +72,7 @@ export function describeDaemonRejection(body: unknown, instanceHint?: string): T
       return {
         fact: "The failed step no longer exists in the cached workflow spec.",
         consequence: "The spec drifted after this instance failed; rebinding would route a step the workflow no longer declares.",
-        action: "Restore the step in the spec (re-validate to refresh the cache) or instantiate a fresh run.",
+        action: "Restore the step in the spec (then re-register it through the workflows-folder scan or an instantiate by path to refresh the cache) or instantiate a fresh run.",
       };
     case "instance_version_conflict":
       return {

packages/cli/src/commands/workflow.ts

@@ -172,7 +172,7 @@ export function workflowCommand(depsOverride?: WorkflowDeps): Command {
 
   cmd
     .command("validate <specPath>")
-    .description("Validate a workflow spec file (returns structured ok/error report)")
+    .description("Validate a workflow spec file in memory, without registering it (returns structured ok/error report)")
     .option("--json", "JSON output for agents")
     .addHelpText("after", `
 Examples:

packages/cli/src/config-store.ts

@@ -170,6 +170,7 @@ export interface RiggedConfig {
     tmuxServer: "inherit" | "isolated";
     /** Rows of tmux scrollback per pane; `rig setup` writes it into the managed `~/.tmux.conf` block. */
     historyLimit: number;
+    fixedGeometry: boolean;
     inheritTmuxEnvironment: boolean;
   };
   // Slice 15 (OPR.0.7.0.15) — the ONE switch for compact command-output
@@ -221,6 +222,9 @@ export interface RiggedConfig {
     streamDays: number;
     streamMaxItems: number;
     eventsDays: number;
+    closedContentDays: number;
+    closedMetadataDays: number;
+    erasureLedger: string;
     batchSize: number;
   };
   // S04 (OPR.0.5.5.4) — pickup-receipt stall threshold (twin of the daemon settings-store).
@@ -370,6 +374,7 @@ const DEFAULTS = {
     statusBar: false,
     tmuxServer: "inherit",
     historyLimit: 10000,
+    fixedGeometry: false,
     inheritTmuxEnvironment: false,
   },
   // Slice 15 — compact command-output defaults OFF until the switch is on.
@@ -415,6 +420,9 @@ const DEFAULTS = {
     streamDays: 30,
     streamMaxItems: 20000,
     eventsDays: 0,
+    closedContentDays: 0,
+    closedMetadataDays: 0,
+    erasureLedger: "",
     batchSize: 500,
   },
   // S04 — pickup-receipt stall threshold default (twin of daemon getDefaultValue).
@@ -533,6 +541,7 @@ export const VALID_KEYS = [
   "terminal.tmux_server",
   // The managed ~/.tmux.conf block's history-limit, written by `rig setup`; lockstep with the daemon twin.
   "terminal.history_limit",
+  "terminal.fixed_geometry",
   "terminal.inherit_tmux_environment",
   // Slice 15 — compact command-output defaults; lockstep with the daemon twin.
   "output.compact",
@@ -565,6 +574,12 @@ export const VALID_KEYS = [
   "retention.stream_max_items",
   // The history-only event types of `events` older than N days, 0 (default) keeps them; lockstep with the daemon twin.
   "retention.events_days",
+  // Closed queue work: content erased N days after it closed, then the row (only its id kept); 0 (default) keeps them;
+  // lockstep with the daemon twin.
+  "retention.closed_content_days",
+  "retention.closed_metadata_days",
+  // Queue erasure's ledger file (JSON lines of erased ids and actions); empty keeps none; lockstep with the daemon twin.
+  "retention.erasure_ledger",
   "stream.intake",
   "retention.batch_size",
   // S04 — pickup-receipt stall threshold; lockstep with the daemon settings-store twin.
@@ -664,6 +679,7 @@ export const ENV_MAP: Record<ValidKey, { primary: string; legacy?: string }> = {
   "terminal.status_bar": { primary: "OPENRIG_TERMINAL_STATUS_BAR" },
   "terminal.tmux_server": { primary: "OPENRIG_TMUX_SERVER" },
   "terminal.history_limit": { primary: "OPENRIG_TERMINAL_HISTORY_LIMIT" },
+  "terminal.fixed_geometry": { primary: "OPENRIG_TERMINAL_FIXED_GEOMETRY" },
   "terminal.inherit_tmux_environment": { primary: "OPENRIG_TERMINAL_INHERIT_TMUX_ENVIRONMENT" },
   "output.compact": { primary: "OPENRIG_OUTPUT_COMPACT" },
   "output.whoami_peers": { primary: "OPENRIG_OUTPUT_WHOAMI_PEERS" },
@@ -687,6 +703,9 @@ export const ENV_MAP: Record<ValidKey, { primary: string; legacy?: string }> = {
   "retention.stream_days": { primary: "OPENRIG_RETENTION_STREAM_DAYS" },
   "retention.stream_max_items": { primary: "OPENRIG_RETENTION_STREAM_MAX_ITEMS" },
   "retention.events_days": { primary: "OPENRIG_RETENTION_EVENTS_DAYS" },
+  "retention.closed_content_days": { primary: "OPENRIG_RETENTION_CLOSED_CONTENT_DAYS" },
+  "retention.closed_metadata_days": { primary: "OPENRIG_RETENTION_CLOSED_METADATA_DAYS" },
+  "retention.erasure_ledger": { primary: "OPENRIG_RETENTION_ERASURE_LEDGER" },
   "stream.intake": { primary: "OPENRIG_STREAM_INTAKE" },
   "retention.batch_size": { primary: "OPENRIG_RETENTION_BATCH_SIZE" },
   "queue.pickup_stall_threshold_minutes": { primary: "OPENRIG_QUEUE_PICKUP_STALL_THRESHOLD_MINUTES" },
@@ -770,6 +789,7 @@ const KEY_TO_PATH: Record<ValidKey, string[]> = {
   "terminal.status_bar": ["terminal", "statusBar"],
   "terminal.tmux_server": ["terminal", "tmuxServer"],
   "terminal.history_limit": ["terminal", "historyLimit"],
+  "terminal.fixed_geometry": ["terminal", "fixedGeometry"],
   "terminal.inherit_tmux_environment": ["terminal", "inheritTmuxEnvironment"],
   "output.compact": ["output", "compact"],
   "output.whoami_peers": ["output", "whoamiPeers"],
@@ -792,6 +812,9 @@ const KEY_TO_PATH: Record<ValidKey, string[]> = {
   "retention.stream_days": ["retention", "streamDays"],
   "retention.stream_max_items": ["retention", "streamMaxItems"],
   "retention.events_days": ["retention", "eventsDays"],
+  "retention.closed_content_days": ["retention", "closedContentDays"],
+  "retention.closed_metadata_days": ["retention", "closedMetadataDays"],
+  "retention.erasure_ledger": ["retention", "erasureLedger"],
   "stream.intake": ["stream", "intake"],
   "retention.batch_size": ["retention", "batchSize"],
   "queue.pickup_stall_threshold_minutes": ["queue", "pickupStallThresholdMinutes"],
@@ -1178,6 +1201,24 @@ const KEY_CONSTRAINTS: Partial<Record<ValidKey, (raw: string, coerced: string |
       throw new Error(`Invalid value for retention.events_days: must be an integer >= 0 (0 keeps the events), got "${raw}"`);
     }
   },
+  // 0 (the default) keeps closed work; a positive day count turns its erasure on (queue-erasure).
+  "retention.closed_content_days": (raw, coerced) => {
+    if (!/^-?\d+$/.test((raw ?? "").trim()) || typeof coerced !== "number" || !Number.isInteger(coerced) || coerced < 0) {
+      throw new Error(`Invalid value for retention.closed_content_days: must be an integer >= 0 (0 keeps the content), got "${raw}"`);
+    }
+  },
+  "retention.closed_metadata_days": (raw, coerced) => {
+    if (!/^-?\d+$/.test((raw ?? "").trim()) || typeof coerced !== "number" || !Number.isInteger(coerced) || coerced < 0) {
+      throw new Error(`Invalid value for retention.closed_metadata_days: must be an integer >= 0 (0 keeps the rows), got "${raw}"`);
+    }
+  },
+  // Empty (the default) keeps no erasure ledger; otherwise an absolute file path, kept outside the backed-up data.
+  "retention.erasure_ledger": (raw) => {
+    const value = (raw ?? "").trim();
+    if (value !== "" && !value.startsWith("/")) {
+      throw new Error(`Invalid value for retention.erasure_ledger: must be empty or an absolute file path, got "${raw}"`);
+    }
+  },
   "retention.batch_size": (raw, coerced) => {
     if (!/^-?\d+$/.test((raw ?? "").trim()) || typeof coerced !== "number" || !Number.isInteger(coerced) || coerced < 1) {
       throw new Error(`Invalid value for retention.batch_size: must be an integer >= 1, got "${raw}"`);
@@ -1415,6 +1456,7 @@ export class ConfigStore {
         statusBar: v("terminal.status_bar") as boolean,
         tmuxServer: v("terminal.tmux_server") as "inherit" | "isolated",
         historyLimit: v("terminal.history_limit") as number,
+        fixedGeometry: v("terminal.fixed_geometry") as boolean,
         inheritTmuxEnvironment: v("terminal.inherit_tmux_environment") as boolean,
       },
       output: {
@@ -1449,6 +1491,9 @@ export class ConfigStore {
         streamDays: v("retention.stream_days") as number,
         streamMaxItems: v("retention.stream_max_items") as number,
         eventsDays: v("retention.events_days") as number,
+        closedContentDays: v("retention.closed_content_days") as number,
+        closedMetadataDays: v("retention.closed_metadata_days") as number,
+        erasureLedger: v("retention.erasure_ledger") as string,
         batchSize: v("retention.batch_size") as number,
       },
       queue: {

packages/cli/src/lib/scope/logical-checkbox.ts

@@ -46,6 +46,7 @@ export function parseLogicalCheckboxes(block: string | null): LogicalCheckboxIte
   if (!block) return [];
   const lines = block.split(/\r?\n/);
   const out: LogicalCheckboxItem[] = [];
+  let fence: { marker: string; length: number } | null = null;
   let current: { checked: boolean; parts: string[]; indent: number; sourceLine: number } | null = null;
 
   const flush = () => {
@@ -56,6 +57,18 @@ export function parseLogicalCheckboxes(block: string | null): LogicalCheckboxIte
 
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i]!;
+    // Fenced examples do not declare proof items or shift evidence indexes.
+    const marker = line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
+    if (fence) {
+      if (marker && marker[1]![0] === fence.marker && marker[1]!.length >= fence.length
+        && /^[ \t]*$/.test(marker[2]!)) fence = null;
+      continue;
+    }
+    if (marker && (marker[1]![0] !== "`" || !marker[2]!.includes("`"))) {
+      flush();
+      fence = { marker: marker[1]![0]!, length: marker[1]!.length };
+      continue;
+    }
     const m = line.match(CHECKBOX_LINE);
     if (m) {
       flush();

packages/cli/src/lib/scope/scope-fs.ts

@@ -410,7 +410,8 @@ export function findMission(missionsRoot: string, identifier: string): MissionIn
   throw new ScopeCliError({
     fact: `Mission "${identifier}" not found under ${missionsRoot}.`,
     consequence: "Command did not run.",
-    action: "List available missions with: rig scope mission ls",
+    action: "List available missions with: rig scope mission ls. "
+      + "For a mission in another workspace, such as a catalog project, select its tree with the parent option: rig scope --workspace <project root> mission <verb> <mission>",
   });
 }
 
@@ -528,10 +529,15 @@ export function findSlice(
       // Walk up to find the owning mission.
       const owningMissionPath = findOwningMission(missionsRoot, candidate);
       if (!owningMissionPath) {
+        const workspace = workspaceHoldingSlice(missionsRoot, candidate);
         const error = new ScopeCliError({
           fact: `Slice path "${slicePath}" resolved to ${candidate} but no parent mission was found.`,
           consequence: "Cannot determine mission context for this slice.",
-          action: "Ensure the slice lives under <missionsRoot>/<mission>/{slices,closed}/.",
+          action: workspace
+            ? `The slice is in another workspace's missions tree (${workspace.missionsRoot}), not under ${missionsRoot}. `
+              + `Select that tree with the parent --workspace option, for example: rig scope --workspace ${quoteArg(workspace.option)} slice <verb> ${quoteArg(slicePath)}`
+            : "Ensure the slice lives under <missionsRoot>/<mission>/{slices,closed}/. "
+              + "For a slice in another workspace, such as a catalog project, select its tree with the parent option: rig scope --workspace <project root> slice <verb> <slice-path>",
         });
         if (!hintedName) throw error;
         firstContextError ??= error;
@@ -551,6 +557,33 @@ export function findSlice(
   });
 }
 
+/** POSIX single-quoting for a path shown in a command. */
+function quoteArg(value: string): string {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+
+/**
+ * For a slice directory the selected missions root does not hold, the --workspace value that
+ * selects the nearest missions tree that does: the project root when that resolves to the tree,
+ * else the missions folder itself. Each value is checked with resolveMissionsRoot, so the named
+ * option is one that works. Null when no ancestor is a readable missions tree.
+ */
+function workspaceHoldingSlice(selectedRoot: string, sliceDir: string): { option: string; missionsRoot: string } | null {
+  const selected = path.resolve(selectedRoot);
+  const target = path.resolve(sliceDir);
+  for (let root = path.dirname(target); root !== path.dirname(root); root = path.dirname(root)) {
+    if (root === selected || !walkToMission(root, target)) continue;
+    for (const option of [path.dirname(root), root]) {
+      try {
+        if (path.resolve(resolveMissionsRoot({ override: option, strictOverride: true })) === root) return { option, missionsRoot: root };
+      } catch {
+        // Not a workspace for this tree; try the next form.
+      }
+    }
+  }
+  return null;
+}
+
 function findOwningMission(missionsRoot: string, slicePath: string): string | null {
   // path.dirname never ends in a separator, so compare against the normalized root
   // (a configured or --workspace root may be written as `/w/missions/`); resolve the

packages/cli/src/mcp-server.ts

@@ -305,6 +305,18 @@ function projectForExternal<T>(row: T, view: ExternalView): T {
   return fields as T;
 }
 
+/** A handed-on item as a scoped caller receives it: without the daemon's own successor fields (successors,
+ *  successorsTruncated, successorNote), which name rows and remote ids regardless of this caller's scope. Its answer is
+ *  show's scope-checked successor (successorOf). */
+function withoutDaemonSuccessors<T>(row: T): T {
+  if (!row || typeof row !== "object" || Array.isArray(row)) return row;
+  const fields = { ...(row as Record<string, unknown>) };
+  delete fields.successors;
+  delete fields.successorsTruncated;
+  delete fields.successorNote;
+  return fields as T;
+}
+
 /** What an authenticated non-owner caller may reach: its own seat, its rigs' seats, the items they send or own (to read),
  *  the items they own (to change), and its shared roots. A person (<entityId>@external) is never in a non-owner's scope. */
 function scopeFor(access: McpAccess, seatOf: () => string | undefined): Scope {
@@ -391,6 +403,18 @@ function externalScope(access: McpAccess, seatOf: () => string | undefined): Sco
   };
 }
 
+/** The daemon's root_unknown names every shared root it has. A scoped caller learns only the ones it may read: the
+ *  daemon's roots its grant names, or none when that list can't be read. Every other answer passes as it is. */
+function scopedRootUnknown(res: DaemonResponse<unknown>, scope: Scope): DaemonResponse<unknown> {
+  const data = (res.data ?? {}) as Record<string, unknown>;
+  if (data.error !== "root_unknown") return res;
+  const roots = Array.isArray(data.configuredRoots)
+    ? data.configuredRoots.filter((name): name is string => typeof name === "string" && scope.root(name)) : [];
+  const named = typeof data.rootName === "string" ? ` '${data.rootName}'` : "";
+  return { status: res.status, data: { error: "root_unknown", ...(named ? { rootName: data.rootName } : {}), configuredRoots: roots,
+    message: `Shared root${named} is not configured on this daemon. Shared roots this connection may read: ${roots.join(", ") || "(none)"}.` } };
+}
+
 /** A target outside an authenticated caller's scope. It names the kind of target only, never the record. */
 function outOfScope(what: string, hint?: string): TextResult {
   const message = `${what} is outside what this connection may reach.${hint ? ` ${hint}` : ""}`;
@@ -609,8 +633,9 @@ const EXTERNAL_INBOX_INSTRUCTIONS = [...SHARED_INSTRUCTIONS,
 function instructionsFor(access: McpAccess | undefined, frontDoor = false): string {
   if (!access?.external) return frontDoor ? FRONT_DOOR_INSTRUCTIONS : INSTRUCTIONS;
   const tools = externalTools(access.external);
-  if (tools.has("rig_queue_claim") && tools.has("rig_queue_update")) return EXTERNAL_INBOX_INSTRUCTIONS;
-  return tools.has("rig_question_list") || tools.has("rig_question_answer") ? EXTERNAL_PERSON_INSTRUCTIONS : EXTERNAL_INSTRUCTIONS;
+  const instructions = tools.has("rig_queue_claim") && tools.has("rig_queue_update") ? EXTERNAL_INBOX_INSTRUCTIONS
+    : tools.has("rig_question_list") || tools.has("rig_question_answer") ? EXTERNAL_PERSON_INSTRUCTIONS : EXTERNAL_INSTRUCTIONS;
+  return tools.has("rig_team") ? `Discover the team this grant connects you to by calling rig_team without rigId. A sole granted rig is selected automatically; with several, it returns the granted names to choose from.\n${instructions}` : instructions;
 }
 
 /** A configured default must identify exactly one existing local node. No topology relationship, name convention
@@ -1420,9 +1445,10 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
         const view = externalView(scope);
         let successor = handedOn ? await successorOf(client, qitemId, row.closureTarget, view ? scope!.item : undefined) : undefined;
         if (scope && !view && successor && "destinationSession" in successor && !scope.successor(successor.destinationSession)) successor = { unknown: true, code: "out_of_scope" };
+        const shownItem = scope ? withoutDaemonSuccessors(item.data) : item.data;
         const data = view
-          ? { item: projectForExternal(item.data, view), transitions: Array.isArray(transitions.data) ? transitions.data.map((t) => projectForExternal(t, view)) : transitions.data }
-          : { item: item.data, transitions: transitions.data };
+          ? { item: projectForExternal(shownItem, view), transitions: Array.isArray(transitions.data) ? transitions.data.map((t) => projectForExternal(t, view)) : transitions.data }
+          : { item: shownItem, transitions: transitions.data };
         return mapResult({ status: 200, data: { ...data, ...(handedOn ? { successor } : {}) } }, undefined, { structured: true });
       } catch (err) {
         return caught(err);
@@ -1679,18 +1705,33 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
   if (offered("rig_team")) server.registerTool(
     "rig_team",
     {
-      description: "Show a rig's team: its lead, the rig's one delegates_to root (the seat that delegates to others and that nothing delegates to: the seat to delegate to), and each seat's pod, role, runtime, delegation (reportsTo, delegatesTo) and activity as the daemon reports it. Activity the daemon doesn't know reads unknown, never idle. hostedMembers are the rig's members that live outside a terminal (roster entries marked hosted): their authored capabilities and limits, with no pane and activity unknown.",
+      description: "Show a rig's team. For an external grant, omit rigId to use its sole rig or see its granted names to choose from. The answer includes its lead, the rig's one delegates_to root (the seat that delegates to others and that nothing delegates to: the seat to delegate to), and each seat's pod, role, runtime, delegation (reportsTo, delegatesTo) and activity as the daemon reports it. Activity the daemon doesn't know reads unknown, never idle. hostedMembers are the rig's members that live outside a terminal (roster entries marked hosted): their authored capabilities and limits, with no pane and activity unknown.",
       inputSchema: z.object({
-        rigId: z.string().describe("Rig name or identifier"),
+        rigId: z.string().optional().describe("Rig name or identifier; optional for an external grant to discover its team"),
       }),
       annotations: READ_ONLY,
     },
     async ({ rigId }) => {
       try {
+        const inferred = rigId === undefined && !!access?.external;
+        if (rigId === undefined) {
+          if (!access?.external) {
+            const message = "Pass a rig name or identifier as rigId.";
+            return errorResult(message, "rig_required", message);
+          }
+          const rigs = [...new Set(access.rigs)];
+          if (rigs.length !== 1) return mapResult({ status: 200, data: { rigs,
+            message: rigs.length ? "Choose one of this grant's rigs and pass its name as rigId." : "This grant names no rigs; ask the connection operator to check its scope." } }, undefined, { structured: true });
+          rigId = rigs[0]!;
+        }
         // An external caller names one of its grant's rigs, so a lookup never answers about another workspace's rig.
         if (access?.external && !scope?.rig(rigId)) return outOfScope(`Rig ${rigId}`);
         const rig = await rigIdFor(client, rigId);
         if ("content" in rig) return rig;
+        if (inferred && !rig.resolved) {
+          const message = `No rig could be resolved from this grant's scope: ${rigId}. Check the connection's scope with its operator.`;
+          return errorResult(message, "scoped_rig_unresolved", message, { rigs: [rigId] });
+        }
         const id = encodeURIComponent(rig.id);
         const detail = await client.get(`/api/rigs/${id}`);
         if (detail.status >= 400) return mapResult(detail);
@@ -1839,7 +1880,7 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
       try {
         const read = async (source: string, rootName: string, inside: string): Promise<TextResult> => {
           const res = await client.get(`/api/files/read?${new URLSearchParams({ root: rootName, path: inside }).toString()}`);
-          if (res.status >= 400) return mapResult(res);
+          if (res.status >= 400) return mapResult(scope ? scopedRootUnknown(res, scope) : res);
           return mapResult({ status: 200, data: artifactView(source, (res.data ?? {}) as FileRead, offset ?? 0) }, undefined, { structured: true });
         };
         if (scope && root && !scope.root(root)) return outOfScope(`Root ${root}`);

packages/cli/src/seat-attention.ts

@@ -0,0 +1,110 @@
+// Seats that need attention, named where a command shows or reports them, so a held seat doesn't read as a view or
+// kernel that failed for no reason (D#52). This reads the daemon's own attention flag and recorded reason from the
+// node route `rig ps --nodes` uses; it detects nothing itself. A check that couldn't be made is reported as unknown,
+// never as "nothing needs attention".
+
+import type { DaemonClient } from "./client.js";
+import { attentionReason, questionReason, servesQuestion, type NodeEntry } from "./commands/ps.js";
+
+export interface SeatAttention {
+  seat: string;
+  reason: string;
+  /** The daemon serves a live question for this seat (needs-input), so a person can answer it there. Otherwise the
+   *  flag is broader: a failed or gated startup, a recorded error, a held message or a missing required file. */
+  waitingOnPerson: boolean;
+}
+
+export interface AttentionCheck {
+  attention: SeatAttention[];
+  /** Seats whose attention couldn't be read, and why. */
+  unknown: Array<{ seat: string; why: string }>;
+}
+
+function failure(res: { status: number; data?: unknown }): string {
+  const error = (res.data as { error?: unknown } | null | undefined)?.error;
+  return `HTTP ${res.status}${typeof error === "string" && error ? `: ${error}` : ""}`;
+}
+
+/** The given local seats (session names, `member@rig`) checked against the daemon's node inventory. A rig whose read
+ *  fails leaves its seats unknown and keeps the other rigs' answers. */
+export async function checkSeatAttention(client: DaemonClient, seats: readonly string[]): Promise<AttentionCheck> {
+  const check: AttentionCheck = { attention: [], unknown: [] };
+  const byRig = new Map<string, Set<string>>();
+  for (const seat of seats) {
+    const at = seat.lastIndexOf("@");
+    if (at <= 0 || at === seat.length - 1) { check.unknown.push({ seat, why: "not a seat@rig name" }); continue; }
+    const rig = seat.slice(at + 1);
+    if (!byRig.has(rig)) byRig.set(rig, new Set());
+    byRig.get(rig)!.add(seat);
+  }
+  if (byRig.size === 0) return check;
+  const unknownAll = (why: string) => { for (const wanted of byRig.values()) for (const seat of wanted) check.unknown.push({ seat, why }); };
+  let rigs: Array<{ rigId: string; rigName?: string; name?: string }>;
+  try {
+    const res = await client.get<Array<{ rigId: string; rigName?: string; name?: string }>>("/api/ps");
+    if (res.status >= 400 || !Array.isArray(res.data)) { unknownAll(`the rig list couldn't be read (${failure(res)})`); return check; }
+    rigs = res.data;
+  } catch (err) {
+    unknownAll(`the rig list couldn't be read (${err instanceof Error ? err.message : String(err)})`);
+    return check;
+  }
+  for (const [rigName, wanted] of byRig) {
+    const matches = rigs.filter(rig => (rig.rigName ?? rig.name) === rigName);
+    if (matches.length === 0) { for (const seat of wanted) check.unknown.push({ seat, why: `no rig named ${rigName} on this daemon` }); continue; }
+    const found = new Set<string>();
+    const failures: string[] = [];
+    for (const rig of matches) {
+      let nodes: NodeEntry[];
+      try {
+        const res = await client.get<NodeEntry[]>(`/api/rigs/${encodeURIComponent(rig.rigId)}/nodes`);
+        if (res.status >= 400 || !Array.isArray(res.data)) { failures.push(`${rigName}'s seats couldn't be read (${failure(res)})`); continue; }
+        nodes = res.data;
+      } catch (err) {
+        failures.push(`${rigName}'s seats couldn't be read (${err instanceof Error ? err.message : String(err)})`);
+        continue;
+      }
+      for (const node of nodes) {
+        const seat = node.canonicalSessionName;
+        if (!seat || !wanted.has(seat) || found.has(seat)) continue;
+        found.add(seat);
+        if (node.needsAttention === undefined) { check.unknown.push({ seat, why: "the daemon served no attention evidence for it" }); continue; }
+        if (!node.needsAttention) continue;
+        const question = servesQuestion(node);
+        // A live question names its own reason. An older recorded error would describe something else.
+        check.attention.push({ seat, reason: question ? questionReason(node) ?? "reason unavailable" : attentionReason(node), waitingOnPerson: question });
+      }
+    }
+    for (const seat of wanted) {
+      if (!found.has(seat)) check.unknown.push({ seat, why: failures[0] ?? `not in ${rigName}'s seats on this daemon` });
+    }
+  }
+  return check;
+}
+
+/** The kernel's seats that aren't ready, checked the same way. */
+export async function checkKernelAttention(client: DaemonClient): Promise<AttentionCheck> {
+  try {
+    const res = await client.get<{ agents?: Array<{ session_name?: string; startup_status?: string; down?: boolean }> }>("/api/kernel/status");
+    if (res.status >= 400) return { attention: [], unknown: [{ seat: "kernel", why: `the kernel status couldn't be read (${failure(res)})` }] };
+    const unready = (res.data?.agents ?? [])
+      .filter(agent => agent.startup_status !== "ready" || agent.down)
+      .flatMap(agent => agent.session_name ? [agent.session_name] : []);
+    return unready.length ? checkSeatAttention(client, unready) : { attention: [], unknown: [] };
+  } catch (err) {
+    return { attention: [], unknown: [{ seat: "kernel", why: `the kernel status couldn't be read (${err instanceof Error ? err.message : String(err)})` }] };
+  }
+}
+
+/** One line per seat that needs attention, then one line per reason a check couldn't be made. */
+export function attentionLines(check: AttentionCheck, where: "tile" | "pane"): string[] {
+  const lines = check.attention.map(({ seat, reason, waitingOnPerson }) => waitingOnPerson
+    ? `${seat} is waiting on a person: ${reason}. Answer it in its ${where === "tile" ? "tile" : "terminal"}, or read it with: rig capture ${seat}`
+    : `${seat} needs attention: ${reason}. Look at it ${where === "tile" ? "in its tile " : ""}with: rig capture ${seat}`);
+  const byWhy = new Map<string, string[]>();
+  for (const { seat, why } of check.unknown) byWhy.set(why, [...(byWhy.get(why) ?? []), seat]);
+  for (const [why, seats] of byWhy) {
+    const named = seats.length > 5 ? `${seats.slice(0, 5).join(", ")} and ${seats.length - 5} more` : seats.join(", ");
+    lines.push(`Couldn't check whether ${named} ${seats.length === 1 ? "needs" : "need"} attention: ${why}.`);
+  }
+  return lines;
+}

packages/cli/src/terminal-window.ts

@@ -19,6 +19,8 @@ interface Preview {
   tmux?: { mode: "inherit" | "isolated" };
   status: { launch?: { socketPath: string; session?: string } };
   composed: { id: string; localTmuxServer?: readonly string[]; opened: Pane[]; pages: Pane[][]; columns?: number; kernelLayout?: string; spaceLabel?: string; absent: OpenViewResult["absent"]; degraded: OpenViewResult["degraded"] };
+  /** The composed view's remote tiles, complete; an older daemon's preview omits it, so their hosts are unknown. */
+  remote?: Array<{ seat: string; host: string }>;
 }
 
 export interface WindowDeps {
@@ -300,7 +302,7 @@ export async function openTerminalWindow(client: DaemonClient, view: string, req
       return failed("The daemon did not confirm the requested Herdr session. Update the daemon before opening a named session.");
     }
     const launchTarget = preview.data.status.launch;
-    let { composed, planId } = preview.data;
+    let { composed, planId, remote } = preview.data;
     await assertLocalTmux(client, preview.data.tmux?.mode, "The window launcher must run on the daemon's own desktop; its instance identity could not be confirmed locally.");
     const tmuxServer = readTmuxServerArgs(composed.localTmuxServer);
     if (expectedPlan !== undefined && expectedPlan !== planId) {
@@ -320,7 +322,7 @@ export async function openTerminalWindow(client: DaemonClient, view: string, req
         if (JSON.stringify(readTmuxServerArgs(next.data.composed.localTmuxServer)) !== JSON.stringify(tmuxServer)) {
           throw new Error("The daemon's tmux server changed while opening the window; refresh the preview before retrying.");
         }
-        ({ composed, planId } = next.data);
+        ({ composed, planId, remote } = next.data);
         if (!composed.opened.length) throw new Error("No conversations are attachable after opening the terminal.");
       }
       if (composed.kernelLayout) windowNotes.push(viewportColumns === undefined
@@ -520,25 +522,27 @@ export async function openTerminalWindow(client: DaemonClient, view: string, req
         pane = placeholder;
       } else pane = (await runTmux([...args, "-P", "-F", "#{pane_id}", `env -u TMUX ${first.paneCommand}`])).trim();
       // Nested source clients on this server can make a new window too narrow to split.
-      // Use the viewer's configured detached size, then restore normal client resizing.
+      // Use the viewer's detached size only while splitting; always release to inherited client sizing.
       const [width, height] = (await runTmux(["show-options", "-Av", "-t", viewer, "default-size"])).trim().split("x");
-      const sizing = (await runTmux(["show-options", "-Awv", "-t", pane, "window-size"])).trim();
-      await runTmux(["resize-window", "-t", pane, "-x", width!, "-y", height!]);
-      await runTmux(["select-pane", "-t", pane, "-T", first.label]);
-      for (const item of page.slice(1)) {
-        pane = (await runTmux(["split-window", "-d", "-h", "-t", pane, "-P", "-F", "#{pane_id}", `env -u TMUX ${item.paneCommand}`])).trim();
-        await runTmux(["select-pane", "-t", pane, "-T", item.label]);
-        await runTmux(["select-layout", "-t", `${viewer}:${name}`, "even-horizontal"]);
+      try {
+        await runTmux(["resize-window", "-t", pane, "-x", width!, "-y", height!]);
+        await runTmux(["select-pane", "-t", pane, "-T", first.label]);
+        for (const item of page.slice(1)) {
+          pane = (await runTmux(["split-window", "-d", "-h", "-t", pane, "-P", "-F", "#{pane_id}", `env -u TMUX ${item.paneCommand}`])).trim();
+          await runTmux(["select-pane", "-t", pane, "-T", item.label]);
+          await runTmux(["select-layout", "-t", `${viewer}:${name}`, "even-horizontal"]);
+        }
+        await runTmux(["select-layout", "-t", `${viewer}:${name}`, composed.columns === page.length ? "even-horizontal" : "tiled"]);
+      } finally {
+        await runTmux(["set-option", "-wu", "-t", `${viewer}:${name}`, "window-size"]);
       }
-      await runTmux(["select-layout", "-t", `${viewer}:${name}`, composed.columns === page.length ? "even-horizontal" : "tiled"]);
-      await runTmux(["set-option", "-w", "-t", `${viewer}:${name}`, "window-size", sizing]);
     }
     await runTmux(["select-window", "-t", `${viewer}:view-1`]);
     if (!window) {
       windowAttempted = true;
       window = await launchWindow(`env -u TMUX ${tmuxCommand} attach-session -t ${shellQuote(`=${viewer}`)}`);
     }
-    return { provider, ok: true, opened: composed.opened.map(pane => pane.seat), absent: composed.absent, degraded: composed.degraded, pages: composed.pages.length, window, notes: [`Viewing session: ${viewer}. Existing conversations were preserved.`, ...windowNotes, "Check the new terminal shows the intended view; window creation alone is not visual confirmation."] };
+    return { provider, ok: true, opened: composed.opened.map(pane => pane.seat), ...(Array.isArray(remote) ? { remote } : {}), absent: composed.absent, degraded: composed.degraded, pages: composed.pages.length, window, notes: [`Viewing session: ${viewer}. Existing conversations were preserved.`, ...windowNotes, "Check the new terminal shows the intended view; window creation alone is not visual confirmation."] };
   } catch (err) {
     if (windowAttempted && /-1743\b/.test(`${(err as Error).message} ${(err as { stderr?: string }).stderr ?? ""}`)) {
       windowNotes.push("macOS denied Automation access. In System Settings > Privacy & Security > Automation, allow the calling app to control the terminal app before trying again.");

packages/cli/test/capture.test.ts

@@ -185,7 +185,7 @@ describe("Capture CLI", () => {
       const { out, err } = await run(["read@my-rig", "--readable"]);
       expect(requests.at(-1)!.readable).toEqual({ width: 120, height: 40 });
       expect(out).toEqual(["line1\nline2\n"]);
-      expect(err).toEqual(["[rig capture: read@my-rig: read at 120x40; its window was then given back its size and its own window-size]"]);
+      expect(err).toEqual(["[rig capture: read@my-rig: read at 120x40; its size was put back and its window-size override was unset]"]);
     });
 
     it("says so when a web terminal took the window over meanwhile, instead of claiming a give-back", async () => {
@@ -195,7 +195,7 @@ describe("Capture CLI", () => {
 
     it("says when the size couldn't be put back, without claiming it was", async () => {
       const { err } = await run(["sizeback@my-rig", "--readable"]);
-      expect(err).toEqual(["[rig capture: sizeback@my-rig: read at 120x40; its own window-size was given back, but putting its size back failed: busy]"]);
+      expect(err).toEqual(["[rig capture: sizeback@my-rig: read at 120x40; its window-size override was unset, but putting its size back failed: busy]"]);
     });
 
     it("a readable request waits out the daemon's readable budget; other captures keep the usual wait", async () => {

packages/cli/test/config-store-extended.test.ts

@@ -44,7 +44,7 @@ function clearEnv(): () => void {
     // its custom home into default-path resolution; UNSETTING it would fall through
     // to the REAL ~/.openrig (foreign on-box state) — so tests set a fresh tmp home.
     "OPENRIG_HOME", "RIGGED_HOME",
-    "OPENRIG_PORT", "OPENRIG_HOST", "OPENRIG_DB", "OPENRIG_TMUX_SERVER", "OPENRIG_DAEMON_DB_CONFLICT",
+    "OPENRIG_PORT", "OPENRIG_HOST", "OPENRIG_DB", "OPENRIG_TMUX_SERVER", "OPENRIG_TERMINAL_FIXED_GEOMETRY", "OPENRIG_DAEMON_DB_CONFLICT",
     "OPENRIG_TRANSCRIPTS_ENABLED", "OPENRIG_TRANSCRIPTS_PATH",
     "OPENRIG_TRANSCRIPTS_LINES", "OPENRIG_TRANSCRIPTS_POLL_INTERVAL_SECONDS",
     "OPENRIG_WORKSPACE_ROOT", "OPENRIG_WORKSPACE_SLICES_ROOT",
@@ -188,6 +188,7 @@ describe("ConfigStore — extended namespaces (User Settings v0)", () => {
       "terminal.status_bar",
       "terminal.tmux_server",
       "terminal.history_limit",
+      "terminal.fixed_geometry",
       "terminal.inherit_tmux_environment",
       // Slice 15 (OPR.0.7.0.15) — compact command-output defaults switch.
       "output.compact",
@@ -216,6 +217,9 @@ describe("ConfigStore — extended namespaces (User Settings v0)", () => {
       "retention.stream_days", // slice 22 outcome 9: stream retention
       "retention.stream_max_items",
       "retention.events_days", // the history-only event types of events
+      "retention.closed_content_days", // closed-work erasure: content
+      "retention.closed_metadata_days", // closed-work erasure: the row, keeping its id
+      "retention.erasure_ledger", // queue erasure's replay ledger file
       "stream.intake",
       "retention.batch_size",
       "queue.pickup_stall_threshold_minutes",

packages/cli/test/daemon-start-wait-for-kernel.test.ts

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { waitForKernelReady, type KernelReadyResult } from "../src/daemon-lifecycle.js";
 import { daemonCommand } from "../src/commands/daemon.js";
+import { checkKernelAttention } from "../src/seat-attention.js";
 
 vi.mock("../src/daemon-lifecycle.js", async (original) => {
   const actual = await original<typeof import("../src/daemon-lifecycle.js")>();
@@ -14,14 +15,22 @@ vi.mock("../src/daemon-lifecycle.js", async (original) => {
     waitForKernelReady: vi.fn(),
   };
 });
+// The held-seat read goes to the daemon this start reports; never a real one from a test.
+vi.mock("../src/seat-attention.js", async (original) => ({
+  ...await original<typeof import("../src/seat-attention.js")>(),
+  checkKernelAttention: vi.fn(async () => ({ attention: [], unknown: [] })),
+}));
 vi.mock("../src/system-preflight.js", () => ({ SystemPreflight: class { run = async () => ({ ready: true, checks: [] }); }, quietPreflightExec: async () => "" }));
 let home: string;
 let errors: string[];
+let logs: string[];
 beforeEach(() => {
   home = mkdtempSync(join(tmpdir(), "daemon-start-wait-for-kernel-"));
   vi.stubEnv("OPENRIG_HOME", home);
   errors = [];
-  vi.spyOn(console, "log").mockImplementation(() => {});
+  logs = [];
+  vi.mocked(checkKernelAttention).mockResolvedValue({ attention: [], unknown: [] });
+  vi.spyOn(console, "log").mockImplementation((...args: unknown[]) => { logs.push(args.join(" ")); });
   vi.spyOn(console, "error").mockImplementation((...args: unknown[]) => { errors.push(args.join(" ")); });
 });
 afterEach(() => { vi.restoreAllMocks(); vi.unstubAllEnvs(); rmSync(home, { recursive: true, force: true }); process.exitCode = undefined; });
@@ -57,3 +66,19 @@ it("a kernel still booting at the deadline keeps the timeout and its fix", async
   expect(out).toContain("Fix: inspect `rig ps --rig kernel` for stalled agents");
   expect(process.exitCode).toBe(1);
 });
+
+it("a partial_ready kernel names the seat that needs attention and why, and any it couldn't check (D#52)", async () => {
+  vi.mocked(checkKernelAttention).mockResolvedValue({
+    attention: [{ seat: "advisor-lead@kernel", reason: "Startup requires attention: Login expired · Please run /login", waitingOnPerson: false }],
+    unknown: [{ seat: "queue-worker@kernel", why: "not in kernel's seats on this daemon" }] });
+  await startWaiting({ ok: true, kernelState: "partial_ready", variant: "claude-only" });
+  expect(logs).toContain("Kernel partial_ready; variant=claude-only");
+  expect(logs).toContain("  advisor-lead@kernel needs attention: Startup requires attention: Login expired · Please run /login. Look at it with: rig capture advisor-lead@kernel");
+  expect(logs).toContain("  Couldn't check whether queue-worker@kernel needs attention: not in kernel's seats on this daemon.");
+  expect(process.exitCode).toBeUndefined();
+});
+
+it("a ready kernel asks nothing more of the daemon", async () => {
+  await startWaiting({ ok: true, kernelState: "ready", variant: "claude-only" });
+  expect(checkKernelAttention).not.toHaveBeenCalled();
+});

packages/cli/test/gateway-human-lifecycle-verb.test.ts

@@ -221,6 +221,89 @@ describe("rig gateway human lifecycle verbs (S12)", () => {
     if (loaded.ok) expect(loaded.entities[0]!.prefs.deliveryClass).toBe("D");
   });
 
+  it("set binding.<n> unset refuses primary removal when secondary bindings exist, then unsets secondary and sole primary with remainingBindings + note", async () => {
+    const addRes = addHumanFragment(
+      {
+        entityId: "ana",
+        class: "human",
+        displayName: "Ana",
+        address: "ana@external",
+        connectorBindings: [
+          { kind: "slack", connectorRef: "main", secretsRef: "vault://slack/ana-secret", role: "primary", handle: "U0ANA" },
+          { kind: "slack", connectorRef: "backup", secretsRef: "vault://slack/ana-backup-secret", role: "secondary" },
+        ],
+        prefs: { deliveryClass: "A" },
+      },
+      home,
+    );
+    expect(addRes.ok).toBe(true);
+
+    // 1. Refuse unsetting primary binding.0 while binding.1 remains
+    errSpy.mockClear();
+    const p1 = program();
+    p1.exitOverride();
+    await p1.parseAsync(["node", "rig", "gateway", "human", "set", "ana", "binding.0", "unset", "--reason", "try remove primary"]);
+    expect(process.exitCode).toBe(1);
+    const refusal = errSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(refusal).toContain("no replacement is chosen silently");
+    expect(refusal).toContain('To replace the primary, set binding.0 to the new primary spec: rig gateway human set ana binding.0 "<kind:connectorRef:secretsRef:primary[:handle=<id>]>"');
+    expect(refusal).toContain("To promote one of the other bindings (binding.1), first save that binding's full spec (kind:connectorRef:secretsRef:role[:handle=<id>]) from rig gateway human show ana --json, then unset that secondary slot, then find the primary's current slot in remainingBindings (or rig gateway human show ana --json, since unsetting a lower slot shifts the primary down) and set it to the saved spec with role primary (promotion replaces the former primary binding; its connector reference and inbound handle are not retained as a secondary).");
+    expect(refusal).toContain("To remove every binding, unset the secondary bindings first using their current slot indexes from remainingBindings or rig gateway human show ana, then finish at binding.0 (once all secondaries are gone, the primary is at binding.0).");
+    expect(refusal).not.toContain("--replace");
+
+    // 2. Unset secondary binding.1 -> succeeds, prints remainingBindings[0] = binding.0 and note without secrets
+    process.exitCode = undefined;
+    logSpy.mockClear();
+    const p2 = program();
+    p2.exitOverride();
+    await p2.parseAsync(["node", "rig", "gateway", "human", "set", "ana", "binding.1", "unset", "--reason", "drop backup binding"]);
+    expect(process.exitCode).toBeUndefined();
+    const out1Raw = logSpy.mock.calls.at(-1)![0] as string;
+    expect(out1Raw).not.toContain("ana-secret");
+    const out1 = JSON.parse(out1Raw) as {
+      ok: boolean;
+      entityId: string;
+      field: string;
+      receipt: { effect: string };
+      remainingBindings: Array<Record<string, unknown>>;
+      note: string;
+    };
+    expect(out1.ok).toBe(true);
+    expect(out1.entityId).toBe("ana");
+    expect(out1.field).toBe("binding.1");
+    expect(out1.receipt.effect).toBe("applied");
+    expect(out1.remainingBindings).toEqual([
+      { slot: "binding.0", kind: "slack", connectorRef: "main", role: "primary", handle: "U0ANA", inboundResolvable: true },
+    ]);
+    expect(out1.note).toContain("Remaining binding(s): binding.0: slack:main role=primary handle=U0ANA");
+    expect(out1.note).toContain("Binding slot indexes shift after removal");
+
+    // 3. Unset sole remaining primary binding.0 -> succeeds, leaves connectorBindings: []
+    logSpy.mockClear();
+    const p3 = program();
+    p3.exitOverride();
+    await p3.parseAsync(["node", "rig", "gateway", "human", "set", "ana", "binding.0", "unset", "--reason", "remove last binding"]);
+    expect(process.exitCode).toBeUndefined();
+    const out2 = JSON.parse(logSpy.mock.calls.at(-1)![0] as string) as {
+      ok: boolean;
+      remainingBindings: unknown[];
+      note: string;
+    };
+    expect(out2.ok).toBe(true);
+    expect(out2.remainingBindings).toEqual([]);
+    expect(out2.note).toContain("Remaining bindings: none");
+    expect(out2.note).toContain("Removing the last binding makes the current delivery episode inactive, so new missing-post findings stop (an already-open recovery item for an undelivered notice may remain)");
+    expect(out2.note).toContain("It does not answer, close or cancel open questions, cancel or reroute already-prepared deliveries, or retract anything a bridge has already accepted");
+
+    const loaded = loadHumanRegistry(home);
+    expect(loaded.ok).toBe(true);
+    if (loaded.ok) {
+      const ana = loaded.entities.find((e) => e.entityId === "ana")!;
+      expect(ana.connectorBindings).toEqual([]);
+      expect(ana.prefs.deliveryClass).toBe("A");
+    }
+  });
+
   it("set with a bad enum exits 1 and names the allowed set", async () => {
     const p = program();
     p.exitOverride();

packages/cli/test/host-pair.test.ts

@@ -81,6 +81,10 @@ describe("rig host pair (OPR.0.4.6.MH1 FR-6)", () => {
       expect(JSON.parse(out.join("\n"))).toMatchObject({ ok: true, entry: { id: "vps-a", transport: "http" } });
     } else {
       expect(out.join("\n")).toContain("Pairing code: 424242");
+      // The person on the target answers the request with Approve (TUI, Steering, Slack); an agent seat names the choice.
+      expect(out.join("\n")).toContain("On the target, its person approves it by answering the pairing request with Approve: in the TUI (rig tui, then attention), on Steering, or with Slack's Approve button. On a 0.7.11 or later target a typed reply doesn't approve; on an older target any typed reply approves.");
+      expect(out.join("\n")).toContain("From an agent seat on the target instead: rig queue update qitem-1 --state done --closure-reason no-follow-on --resolution approve");
+      expect(out.join("\n")).not.toContain("On the target: rig queue update");
       expect(out.join("\n")).toContain("Paired. Host 'vps-a' registered");
       expect(out.join("\n")).toContain("rig host doctor vps-a");
       expect(out.join("\n")).toContain("rig config set feed.subscriptions.vps-a.enabled true");

packages/cli/test/logical-checkbox-fences.test.ts

@@ -0,0 +1,43 @@
+import { describe, it, expect } from "vitest";
+import { parseLogicalCheckboxes } from "../src/lib/scope/logical-checkbox.js";
+
+import { parseProofContract } from "../src/commands/proof.js";
+
+describe("proof-contract fenced examples", () => {
+  it.each(["```", "~~~"])("excludes examples inside %s fences and keeps source lines", (marker) => {
+    const block = [
+      "- [ ] first promise",
+      "  continued",
+      `${marker}markdown`,
+      "- [x] example only",
+      marker,
+      "- [x] second promise",
+    ].join("\n");
+    expect(parseLogicalCheckboxes(block)).toEqual([
+      { checked: false, rawText: "first promise continued", sourceLine: 1 },
+      { checked: true, rawText: "second promise", sourceLine: 6 },
+    ]);
+  });
+
+  it("keeps shorter, mismatched and annotated closers inside the example", () => {
+    const block = ["````md", "```", "~~~", "```` text", "- [ ] example", "`````", "- [ ] real"].join("\n");
+    expect(parseLogicalCheckboxes(block)).toEqual([
+      { checked: false, rawText: "real", sourceLine: 7 },
+    ]);
+  });
+
+  it("does not treat inline backticks as an opener", () => {
+    expect(parseLogicalCheckboxes("```inline```\n- [ ] real")).toEqual([
+      { checked: false, rawText: "real", sourceLine: 2 },
+    ]);
+  });
+
+  it("keeps evidence positions stable through the proof-contract reader", () => {
+    const document = "## Proof contract\n- [ ] first\n```md\n- [x] example\n```\n- [ ] second\n";
+    expect(parseProofContract(document)).toEqual(["first", "second"]);
+  });
+
+  it("ignores the remainder of an unclosed example", () => {
+    expect(parseLogicalCheckboxes("~~~md\n- [ ] example")).toEqual([]);
+  });
+});

packages/cli/test/mcp-http-daemon.test.ts

@@ -34,6 +34,7 @@ describe("rig mcp serve --http on the daemon's routes", () => {
   let db: Database.Database;
   let home: string;
   let shared: string;
+  let otherShared: string;
   let repo: QueueRepository;
   let bus: EventBus;
   /** Registered people a test sets; null reads the instance's registry, as the daemon does. */
@@ -52,6 +53,7 @@ describe("rig mcp serve --http on the daemon's routes", () => {
     migrate(db, ALL_MIGRATIONS);
     home = fs.mkdtempSync(path.join(os.tmpdir(), "mcp-http-"));
     shared = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "mcp-http-shared-")));
+    otherShared = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "mcp-http-acct-b-")));
     process.env.OPENRIG_HOME = home;
     // The env seat a local caller is declared as; an authenticated caller must never act as it.
     process.env.OPENRIG_SESSION_NAME = "env-seat@elsewhere";
@@ -68,7 +70,8 @@ describe("rig mcp serve --http on the daemon's routes", () => {
       appDeps: {
         sessionTransport: { resolveSessions: async (target: unknown) => { resolved.push(target); return { ok: false, code: "not_found", error: "inert fixture" }; }, send: inert, capture: inert, broadcast: inert } as never,
         queueRepo: repo,
-        filesAllowlist: [{ name: "proof", canonicalPath: shared }],
+        // Two shared roots, as one daemon serving two accounts has: proof, and another account's acct-b.
+        filesAllowlist: [{ name: "proof", canonicalPath: shared }, { name: "acct-b", canonicalPath: otherShared }],
       },
     });
     const { app } = setup;
@@ -84,6 +87,7 @@ describe("rig mcp serve --http on the daemon's routes", () => {
     db.close();
     fs.rmSync(home, { recursive: true, force: true });
     fs.rmSync(shared, { recursive: true, force: true });
+    fs.rmSync(otherShared, { recursive: true, force: true });
     if (saved.home === undefined) delete process.env.OPENRIG_HOME; else process.env.OPENRIG_HOME = saved.home;
     if (saved.session === undefined) delete process.env.OPENRIG_SESSION_NAME; else process.env.OPENRIG_SESSION_NAME = saved.session;
   });
@@ -242,7 +246,18 @@ describe("rig mcp serve --http on the daemon's routes", () => {
     const own = (await asCarol("rig_queue_create", { destination: "impl@team", body: "hand this on" })).structured.qitemId as string;
     const handoff = await fetch(`${daemonUrl}/api/queue/${own}/handoff`, { method: "POST", headers: { "Content-Type": "application/json", "X-OpenRig-Session": "impl@team" }, body: JSON.stringify({ toSession: "qa@other", nudge: false }) });
     expect(handoff.status).toBe(201);
+    const next = ((await handoff.json()) as { created: { qitemId: string } }).created.qitemId;
     expect((await asCarol("rig_queue_show", { qitemId: own })).structured.successor).toEqual({ unknown: true, code: "out_of_scope" });
+    // Nor do the daemon's own successor fields, which it fills without a caller's scope (here: 21 successors, so the list
+    // is cut too).
+    const more = db.prepare(`INSERT INTO queue_items (qitem_id, ts_created, ts_updated, source_session, destination_session, state, priority, body, handed_off_from)
+      VALUES (?, '2026-10-26T00:00:00.000Z', '2026-10-26T00:00:00.000Z', 'impl@team', 'qa@other', 'pending', 'routine', 'x', ?)`);
+    for (let n = 0; n < 20; n++) more.run(`qitem-more-${n}`, own);
+    expect(await (await fetch(`${daemonUrl}/api/queue/${own}`)).json()).toMatchObject({ successorsTruncated: true, successors: expect.arrayContaining([expect.objectContaining({ qitemId: next })]) });
+    const handedOn = await asCarol("rig_queue_show", { qitemId: own });
+    for (const derived of ["successors", "successorsTruncated", "successorNote"]) expect(handedOn.structured.item).not.toHaveProperty(derived);
+    expect(handedOn.text).not.toContain(next);
+    expect(handedOn.text).not.toContain("qitem-more-");
 
     // Artifacts: a root outside the grant is out of reach, directly or through an item.
     fs.writeFileSync(path.join(shared, "report.md"), "ARTIFACT body");
@@ -254,6 +269,30 @@ describe("rig mcp serve --http on the daemon's routes", () => {
     expect(viaItem.text).not.toContain("ARTIFACT body");
   });
 
+  it("a scoped grant's root_unknown names only the shared roots it may read, and an unscoped caller still sees them all", async () => {
+    // The grant names proof and a root this daemon no longer shares; acct-b is another account's.
+    const dana = await grant("dana", { roots: ["proof", "stale"] });
+    const owner = await grant("owner", { owner: true });
+    const served = await listen();
+    const asDana = await connect(served.url, dana);
+    const asOwner = await connect(served.url, owner);
+    const withRef = await repo.create({ sourceSession: "dana@team", destinationSession: "impl@team", body: "x", nudge: false } as never);
+    db.prepare("UPDATE queue_items SET evidence_ref = ? WHERE qitem_id = ?").run("report.md", withRef.qitemId);
+
+    for (const args of [{ root: "stale", path: "report.md" }, { qitemId: withRef.qitemId, root: "stale" }]) {
+      const scoped = await asDana("rig_artifact_read", args);
+      expect(scoped.structured).toMatchObject({ ok: false, code: "root_unknown",
+        message: "Shared root 'stale' is not configured on this daemon. Shared roots this connection may read: proof." });
+      expect(JSON.parse(scoped.text)).toEqual({ error: "root_unknown", rootName: "stale", configuredRoots: ["proof"],
+        message: "Shared root 'stale' is not configured on this daemon. Shared roots this connection may read: proof." });
+    }
+
+    const unscoped = await asOwner("rig_artifact_read", { root: "stale", path: "report.md" });
+    expect(unscoped.structured).toMatchObject({ code: "root_unknown" });
+    expect(JSON.parse(unscoped.text)).toMatchObject({ rootName: "stale", configuredRoots: ["proof", "acct-b"] });
+    expect(unscoped.text).toContain("acct-b");
+  });
+
   it("a hosted member works its own rows as its grant's seat, shows on the team with activity unknown, and keeps its record after revoke", async () => {
     // The team has a lead with a node. The hosted member (a tool outside any terminal) has a roster entry and a grant, no node.
     const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "mcp-http-workspace-"));

packages/cli/test/mcp-http-grant-service-daemon.test.ts

@@ -963,6 +963,7 @@ describe("rig mcp serve --http --grant-service on the daemon's routes", () => {
     expect(shown.structured.item).toMatchObject({ state: "handed-off", closureReason: "handed_off_to", handedOffTo: null, closureTarget: null,
       closingTransition: { closureReason: "handed_off_to", closureTarget: null, transitionNote: "handed on (out of scope)" } });
     expect(shown.structured.successor).toEqual({ unknown: true, code: "out_of_scope" });
+    for (const derived of ["successors", "successorsTruncated", "successorNote"]) expect(shown.structured.item).not.toHaveProperty(derived);
     expect(JSON.stringify((await asExternal("rig_queue_list", { all: true })).structured)).not.toContain("impl@team-a");
 
     // A cross-host successor's parties can't be checked here: its id and host stay hidden.
@@ -970,6 +971,7 @@ describe("rig mcp serve --http --grant-service on the daemon's routes", () => {
     db.prepare("UPDATE queue_items SET state = 'handed-off', closure_reason = 'handed_off_to', closure_target = 'qitem-far01@other-host', handed_off_to = 'impl@team-a@other-host' WHERE qitem_id = ?").run(remote);
     const far = await asExternal("rig_queue_show", { qitemId: remote });
     expect(far.structured.successor).toEqual({ unknown: true, code: "out_of_scope" });
+    expect(far.structured.item).not.toHaveProperty("successorNote");
     expect(far.text).not.toContain("other-host");
 
     // A successor addressed to the caller but sent by another caller-shaped seat isn't the team's; nor is a sibling the

packages/cli/test/mcp-http-grant-service-network.test.ts

@@ -132,10 +132,12 @@ describe("agent network increment A: OAuth-connected assistants work with each o
     const served = await listen();
     const a = await connect(served.url, A);
     const b = await connect(served.url, B);
-    const team = await a("rig_team", { rigId: RIG });
+    const team = await a("rig_team");
     expect(team.isError).toBe(false);
     expect(team.text).toContain(B.seat);
     expect(team.text).toContain(LEAD);
+    expect(team.structured.rig.name).toBe(RIG);
+    expect((await b("rig_team")).structured.rig.name).toBe(RIG);
 
     const sent = await a("rig_queue_create", { destination: B.seat, body: "Critique this plan.", tags: ["review"] });
     expect(sent.isError).toBe(false);

packages/cli/test/mcp-queue-daemon.test.ts

@@ -149,6 +149,8 @@ describe("MCP queue tools on the daemon's queue routes", () => {
 
     const shown = await desk("rig_queue_show", { qitemId });
     expect(shown.data.item).toMatchObject({ state: "handed-off" });
+    // An unscoped caller gets the daemon's successor fields as they are.
+    expect(shown.data.item.successors).toEqual([{ qitemId: next, destinationSession: "qa@team", state: "pending", via: "handedOffFrom" }]);
     expect(shown.structured).toMatchObject({ successor: { qitemId: next, destinationSession: "qa@team", state: "pending" } });
     expect(shown.data.successor).toEqual((shown.structured as { successor: unknown }).successor);
     const onward = await desk("rig_queue_list", { handedOffFrom: qitemId });

packages/cli/test/mcp-rig-names.test.ts

@@ -4,7 +4,7 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
-import { createMcpServer } from "../src/mcp-server.js";
+import { type McpAccess, createMcpServer } from "../src/mcp-server.js";
 import { DaemonClient, type DaemonResponse } from "../src/client.js";
 
 const RIG_ID = "01M5F0YZQXETQ4YVH3MJVQPQXQ";
@@ -14,7 +14,7 @@ const REMOVED_ID = "01M5F0REMOVEDRIGIDXXXXXXXX";
 let close: (() => Promise<void>) | undefined;
 afterEach(async () => { await close?.(); close = undefined; });
 
-async function connect(rigs: Array<{ id: string; name: string }>) {
+async function connect(rigs: Array<{ id: string; name: string }>, access?: McpAccess) {
   const requests: string[] = [];
   const snapshots: Record<string, unknown[]> = { [RIG_ID]: [{ id: "snap-1" }], [REMOVED_ID]: [{ id: "snap-old" }] };
   const known = new Set(rigs.map((r) => r.id));
@@ -24,6 +24,8 @@ async function connect(rigs: Array<{ id: string; name: string }>) {
     if (path.startsWith("/api/rigs/summary")) return { status: 200, data: rigs.map((r) => ({ ...r, archivedAt: null })) };
     const snaps = /^\/api\/rigs\/([^/]+)\/snapshots$/.exec(path);
     if (snaps) return { status: 200, data: snapshots[snaps[1]!] ?? [] };
+    const detail = /^\/api\/rigs\/([^/]+)$/.exec(path);
+    if (detail && known.has(detail[1]!)) return { status: 200, data: { rig: rigs.find(r => r.id === detail[1]), representative: null } };
     const nodes = /^\/api\/rigs\/([^/]+)\/nodes$/.exec(path);
     if (nodes && known.has(nodes[1]!)) return { status: 200, data: [{ logicalId: "work.worker" }] };
     return { status: 404, data: { error: "Rig not found" } };
@@ -35,7 +37,7 @@ async function connect(rigs: Array<{ id: string; name: string }>) {
     return { status: 404, data: { error: "Rig not found" } };
   }) as DaemonClient["post"];
 
-  const server = createMcpServer(client);
+  const server = createMcpServer(client, { access });
   const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
   const mcp = new Client({ name: "test", version: "1.0.0" });
   await server.connect(serverTransport);
@@ -45,7 +47,7 @@ async function connect(rigs: Array<{ id: string; name: string }>) {
     const result = await mcp.callTool({ name, arguments: args }) as { content: Array<{ text: string }>; isError?: boolean };
     return { text: result.content[0]!.text, isError: result.isError === true };
   };
-  return { call, requests };
+  return { call, requests, instructions: mcp.getInstructions(), tools: (await mcp.listTools()).tools };
 }
 
 describe("MCP rig tools accept a rig name", () => {
@@ -93,3 +95,59 @@ describe("MCP rig tools accept a rig name", () => {
     expect(requests).toContain(`GET /api/rigs/${RIG_ID}/nodes`);
   });
 });
+
+const external = (rigs: string[]): McpAccess => ({ principal: "fixture-caller@solo", owner: false, rigs, roots: [], workspace: false, external: { objects: { team: ["list"] } } });
+
+describe("external team discovery within the grant", () => {
+  it.each([["solo"], ["solo", "solo"]])("uses a sole granted rig without a name (scope %j)", async (...rigs) => {
+    const { call, instructions, tools } = await connect([{ id: RIG_ID, name: "solo" }, { id: OTHER_ID, name: "outside" }], external(rigs));
+    const result = await call("rig_team", {});
+    expect(result.isError).toBe(false);
+    expect(JSON.parse(result.text).rig).toEqual({ id: RIG_ID, name: "solo" });
+    expect(result.text).not.toContain("outside");
+    expect(instructions?.slice(0, 512)).toContain("rig_team without rigId");
+    expect(tools.map(t => t.name)).toEqual(["rig_team"]);
+  });
+
+  it("offers only the granted names when a choice is needed, without looking up other rigs", async () => {
+    const { call, requests } = await connect([{ id: RIG_ID, name: "solo" }, { id: OTHER_ID, name: "outside" }], external(["solo", "second"]));
+    const result = await call("rig_team", {});
+    expect(result.isError).toBe(false);
+    expect(JSON.parse(result.text).rigs).toEqual(["solo", "second"]);
+    expect(result.text).not.toContain("outside");
+    expect(requests).toEqual([]);
+  });
+
+  it("names an empty grant scope without guessing another rig", async () => {
+    const { call, requests } = await connect([{ id: RIG_ID, name: "outside" }], external([]));
+    const result = await call("rig_team", {});
+    expect(result.isError).toBe(false);
+    expect(JSON.parse(result.text)).toMatchObject({ rigs: [], message: expect.stringContaining("no rigs") });
+    expect(result.text).not.toContain("outside");
+    expect(requests).toEqual([]);
+  });
+
+  it("names an unresolved sole grant and does not read a different rig", async () => {
+    const { call, requests } = await connect([{ id: OTHER_ID, name: "outside" }], external(["missing"]));
+    const result = await call("rig_team", {});
+    expect(result.isError).toBe(true);
+    expect(result.text).toContain("missing");
+    expect(result.text).not.toContain("outside");
+    expect(requests).not.toContain(`GET /api/rigs/${OTHER_ID}`);
+  });
+
+  it("still asks an unscoped owner for a rig rather than guessing one", async () => {
+    const { call, requests } = await connect([{ id: RIG_ID, name: "solo" }]);
+    const result = await call("rig_team", {});
+    expect(result.isError).toBe(true);
+    expect(result.text).toContain("Pass a rig name or identifier");
+    expect(requests).toEqual([]);
+  });
+
+  it("keeps explicit granted reads and out-of-scope refusal unchanged", async () => {
+    const { call, requests } = await connect([{ id: RIG_ID, name: "solo" }, { id: OTHER_ID, name: "outside" }], external(["solo"]));
+    expect((await call("rig_team", { rigId: "solo" })).isError).toBe(false);
+    expect((await call("rig_team", { rigId: "outside" })).isError).toBe(true);
+    expect(requests).not.toContain(`GET /api/rigs/${OTHER_ID}`);
+  });
+});

packages/cli/test/mcp-server.test.ts

@@ -354,6 +354,29 @@ describe("MCP Server", () => {
     await cleanup();
   });
 
+  it("rig_artifact_read: an external grant's root_unknown names only its own shared roots, or none when the daemon's list can't be read", async () => {
+    let listed = true;
+    const getFn = vi.fn(async (p: string) => {
+      if (p === "/api/queue/q-ext") return { status: 200, data: { qitemId: "q-ext", sourceSession: "cus-a1-caller@team", destinationSession: "lead@team", evidenceRef: "report.md" } };
+      if (p === "/api/files/roots") return { status: 200, data: { roots: [{ name: "proof", path: "/shared/proof" }, { name: "acct-b", path: "/shared/acct-b" }] } };
+      if (p.startsWith("/api/files/read?root=stale&")) return { status: 400, data: { error: "root_unknown",
+        message: "allowlist root 'stale' is not configured. Allowlist configured roots: proof, acct-b.", rootName: "stale", ...(listed ? { configuredRoots: ["proof", "acct-b"] } : {}) } };
+      return { status: 404, data: {} };
+    });
+    await setup({ get: getFn }, { seat: "cus-a1-caller@team",
+      access: { principal: "cus_A1", owner: false, rigs: ["team"], roots: ["proof", "stale"], workspace: false, external: { objects: { artifact: ["read"] } } } });
+    const named = await mcpClient.callTool({ name: "rig_artifact_read", arguments: { qitemId: "q-ext", root: "stale" } });
+    expect(named.structuredContent).toMatchObject({ ok: false, code: "root_unknown",
+      message: "Shared root 'stale' is not configured on this daemon. Shared roots this connection may read: proof." });
+    expect(JSON.stringify(named.content)).not.toContain("acct-b");
+    listed = false;
+    const unlisted = await mcpClient.callTool({ name: "rig_artifact_read", arguments: { qitemId: "q-ext", root: "stale" } });
+    expect(unlisted.structuredContent).toMatchObject({ code: "root_unknown",
+      message: "Shared root 'stale' is not configured on this daemon. Shared roots this connection may read: (none)." });
+    expect(JSON.stringify(unlisted.content)).not.toContain("acct-b");
+    await cleanup();
+  });
+
   it("a front door gets front-door instructions, not the member workflow, and its declared seat with no session reads as itself", async () => {
     try {
       vi.stubEnv("OPENRIG_SESSION_NAME", "claude-app@my-rig");

packages/cli/test/proof-project-flag.test.ts

@@ -3,10 +3,12 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 
 const calls: Array<{ method: string; url: string; body?: Record<string, unknown> }> = [];
 let readExtra: Record<string, unknown> = {};
+let readFailure: { status: number; data: Record<string, unknown> } | null = null;
 vi.mock("../src/client.js", () => ({
   DaemonClient: class {
     async get(url: string) {
       calls.push({ method: "GET", url });
+      if (readFailure) return readFailure;
       return { status: 200, data: { items: [{ id: "i1", text: "Prove it.", index: 1, revision: "r1", judgment: null }], ...readExtra } };
     }
     async post(url: string, body: Record<string, unknown>) {
@@ -18,7 +20,7 @@ vi.mock("../src/client.js", () => ({
 const { proofCommand } = await import("../src/commands/proof.js");
 
 const run = (args: string[]) => proofCommand().parseAsync(["node", "proof", ...args]);
-beforeEach(() => { calls.length = 0; readExtra = {}; vi.spyOn(console, "log").mockImplementation(() => {}); });
+beforeEach(() => { calls.length = 0; readExtra = {}; readFailure = null; vi.spyOn(console, "log").mockImplementation(() => {}); });
 
 describe("rig proof --project (#132)", () => {
   it("show passes --project and the scope as query parameters", async () => {
@@ -51,3 +53,41 @@ describe("rig proof --project (#132)", () => {
     expect(calls[3]!.body).not.toHaveProperty("projectRoot");
   });
 });
+
+describe("O2: a path_escape scope names the routes to another workspace", () => {
+  const escape = { status: 400, data: { error: "path_escape", message: "Path escapes /w/missions; paths must stay within the selected workspace" } };
+  const shown = async (args: string[]): Promise<string> => {
+    const errors: string[] = [];
+    vi.spyOn(console, "error").mockImplementation((text: unknown) => { errors.push(String(text)); });
+    readFailure = escape;
+    await run(args);
+    process.exitCode = undefined;
+    return errors.join("\n");
+  };
+
+  it("without a project, names --project, the <project>: prefix and OPENRIG_URL, not rig scope", async () => {
+    const text = await shown(["show", "/other/projects/alpha/missions/m1/slices/01-x"]);
+    expect(text).toContain("path_escape: Path escapes /w/missions");
+    expect(text).toContain("For a catalog project, pass --project <id> or prefix the scope with <project>:.");
+    expect(text).toContain("To use another daemon's workspace, select that daemon with OPENRIG_URL.");
+    expect(text).not.toContain("rig scope");
+  });
+
+  it("with --project or a <project>: prefix, says the scope is outside that project's tree", async () => {
+    for (const args of [["show", "/x/slices/01-x", "--project", "alpha"], ["judge", "alpha:/x/slices/01-x#1", "--verdict", "accept", "--reason", "r"]]) {
+      const text = await shown(args);
+      expect(text).toContain("The scope is outside that project's missions root");
+      expect(text).not.toContain("pass --project");
+    }
+  });
+
+  it("another daemon error keeps its message without the hint", async () => {
+    readFailure = null;
+    const errors: string[] = [];
+    vi.spyOn(console, "error").mockImplementation((text: unknown) => { errors.push(String(text)); });
+    readFailure = { status: 404, data: { error: "scope_missing", message: "Select an existing mission or slice directory" } };
+    await run(["show", "m0/slices/01-t001"]);
+    process.exitCode = undefined;
+    expect(errors.join("\n")).toBe("scope_missing: Select an existing mission or slice directory");
+  });
+});

packages/cli/test/ps-compact.test.ts

@@ -401,6 +401,29 @@ describe("OPR.0.4.0.25 — rig ps token-safe defaults", () => {
     } finally { Object.assign(node, original); }
   });
 
+  it.each([
+    // A served question on a seat that also carries a recorded startup error: the question's reason.
+    { arbitrated: true, questionReason: "permission_prompt", expected: "permission_prompt" },
+    // A served question whose reason isn't served: never the recorded error.
+    { arbitrated: true, questionReason: null, expected: "reason unavailable" },
+    // A served "no" with a stale needs_input hook: no question, so the recorded error leads as before.
+    { arbitrated: false, questionReason: null, expected: "startup failure" },
+  ])("REASON names a live question's reason over a recorded error, with the daemon's precedence (arbitrated: $arbitrated)", async ({ arbitrated, questionReason, expected }) => {
+    const node = RIG_B_NODES[0]!;
+    const original = { ...node };
+    Object.assign(node, { needsAttention: true, arbitratedNeedsInput: arbitrated, startupStatus: "failed", latestError: "startup failure",
+      activityState: { activity: "needs_input", display: "needs input", needsInput: { count: arbitrated ? 1 : 0, reason: questionReason }, decidedBy: "hook" },
+      agentActivity: { ...node.agentActivity, state: "needs_input", reason: "approval_pending" } });
+    try {
+      const text = await captureLogs(() => makeCmd().parseAsync(["node", "rig", "ps", "--nodes", "--rig", "openrig-comms"]).then(() => {}));
+      expect(text.logs.find((line) => line.includes(node.canonicalSessionName))).toMatch(new RegExp(`yes\\s+${expected}\\s*$`));
+    } finally {
+      // Restore the shared fixture exactly, including dropping keys it didn't have (activityState).
+      for (const key of Object.keys(node)) if (!(key in original)) Reflect.deleteProperty(node, key);
+      Object.assign(node, original);
+    }
+  });
+
   it.each([[false, false], [true, false], [false, true]])("shows current limits without hiding startup failures (stale: %s, failed: %s)", async (stale, failed) => {
     const node = RIG_B_NODES[0]!;
     const original = { agentActivity: node.agentActivity, startupStatus: node.startupStatus, latestError: node.latestError, needsAttention: node.needsAttention };

packages/cli/test/queue-erase.test.ts

@@ -0,0 +1,116 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import type { QueueDeps } from "../src/commands/queue.js";
+import { createProgram } from "../src/index.js";
+
+// `rig queue erase`: the file it reads, the request it sends, and what it refuses before sending anything.
+vi.mock("../src/daemon-lifecycle.js", async () => {
+  const actual = await vi.importActual<Record<string, unknown>>("../src/daemon-lifecycle.js");
+  return {
+    ...actual,
+    getDaemonStatus: vi.fn(async () => ({ state: "running", healthy: true, pid: 1234, port: 7433 })),
+    getDaemonUrl: vi.fn(() => "http://localhost:7433"),
+  };
+});
+
+function makeDeps(response: { status: number; data: unknown } = { status: 200, data: { ok: true } }) {
+  const posts: Array<{ path: string; body: unknown }> = [];
+  const deps = {
+    lifecycleDeps: {} as QueueDeps["lifecycleDeps"],
+    clientFactory: () => ({
+      post: vi.fn(async (urlPath: string, body: unknown) => {
+        posts.push({ path: urlPath, body });
+        return response;
+      }),
+    }) as unknown as ReturnType<QueueDeps["clientFactory"]>,
+  } as QueueDeps;
+  return { deps, posts };
+}
+
+describe("rig queue erase", () => {
+  let dir: string;
+  let errors: string[];
+  beforeEach(() => {
+    vi.unstubAllEnvs();
+    vi.stubEnv("OPENRIG_SESSION_NAME", "ops-admin@n-ops");
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "queue-erase-"));
+    errors = [];
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    vi.spyOn(console, "error").mockImplementation((...args) => errors.push(args.join(" ")));
+    process.exitCode = undefined;
+  });
+  const run = (deps: QueueDeps, ...args: string[]) => createProgram({ queueDeps: deps }).parseAsync(["node", "rig", "queue", "erase", ...args]);
+
+  it("reads a members file (one per line, comments skipped) and sends a dry run unless --apply", async () => {
+    const file = path.join(dir, "members.txt");
+    fs.writeFileSync(file, "# account n-acct\na-one@n-acct\n\n  b-two@n-acct  \n");
+    const { deps, posts } = makeDeps();
+    await run(deps, "--members", file);
+    await run(deps, "--members", file, "--apply");
+    expect(posts).toEqual([
+      { path: "/api/queue/erase", body: { apply: false, members: ["a-one@n-acct", "b-two@n-acct"] } },
+      { path: "/api/queue/erase", body: { apply: true, members: ["a-one@n-acct", "b-two@n-acct"] } },
+    ]);
+  });
+
+  it("reads ids as a JSON array and passes the action", async () => {
+    const file = path.join(dir, "ids.json");
+    fs.writeFileSync(file, JSON.stringify(["qitem-1", "qitem-2"]));
+    const { deps, posts } = makeDeps();
+    await run(deps, "--ids", file, "--action", "scrub", "--apply");
+    expect(posts).toEqual([{ path: "/api/queue/erase", body: { apply: true, ids: ["qitem-1", "qitem-2"], action: "scrub" } }]);
+  });
+
+  it("passes the account rig with the members, and a ledger of report entries as given", async () => {
+    const members = path.join(dir, "members.json");
+    fs.writeFileSync(members, JSON.stringify(["a-one@n-acct"]));
+    const ledger = path.join(dir, "ledger.json");
+    const entries = [{ qitemId: "qitem-1", action: "scrub", state: "done" }, "qitem-2"];
+    fs.writeFileSync(ledger, JSON.stringify(entries));
+    const { deps, posts } = makeDeps();
+    await run(deps, "--members", members, "--rig", "rig-acct-id", "--apply");
+    await run(deps, "--ids", ledger, "--apply");
+    expect(posts).toEqual([
+      { path: "/api/queue/erase", body: { apply: true, members: ["a-one@n-acct"], rig: "rig-acct-id" } },
+      { path: "/api/queue/erase", body: { apply: true, ids: entries } },
+    ]);
+  });
+
+  it("reads an erasure ledger's JSON lines as given: entries that keep their action and batch, and commit lines", async () => {
+    const ledger = path.join(dir, "ledger.jsonl");
+    fs.writeFileSync(ledger, '{"qitemId":"qitem-1","action":"scrub","reason":"retention-content","erasedAt":"t","batch":"b1"}\n{"batch":"b1","committed":true,"at":"t"}\n# a comment\n{"qitemId":"qitem-2","action":"delete"}\n');
+    const { deps, posts } = makeDeps();
+    await run(deps, "--ids", ledger, "--apply");
+    expect(posts).toEqual([{ path: "/api/queue/erase", body: { apply: true, ids: [
+      { qitemId: "qitem-1", action: "scrub", reason: "retention-content", erasedAt: "t", batch: "b1" }, { batch: "b1", committed: true, at: "t" },
+      { qitemId: "qitem-2", action: "delete" },
+    ] } }]);
+    fs.writeFileSync(ledger, '{"qitemId": broken\n');
+    process.exitCode = undefined;
+    await run(deps, "--ids", ledger, "--apply");
+    expect(process.exitCode).toBe(1);
+    expect(posts).toHaveLength(1);
+  });
+
+  it("sends nothing when its file can't be read, or when there's no one to record as erasing", async () => {
+    const { deps, posts } = makeDeps();
+    await run(deps, "--members", path.join(dir, "missing.txt"));
+    expect(process.exitCode).toBe(1);
+    vi.stubEnv("OPENRIG_SESSION_NAME", "");
+    process.exitCode = undefined;
+    await run(deps, "--routine");
+    expect(process.exitCode).toBe(1);
+    expect(posts).toEqual([]);
+    expect(errors.join("\n")).toMatch(/Nothing was erased/);
+    await run(deps, "--routine", "--actor", "erase-runner@n-ops");
+    expect(posts).toEqual([{ path: "/api/queue/erase", body: { apply: false, routine: true, actorSession: "erase-runner@n-ops" } }]);
+  });
+
+  it("a daemon refusal exits nonzero", async () => {
+    const { deps } = makeDeps({ status: 400, data: { error: "erase_scope_required", message: "Name one scope" } });
+    await run(deps);
+    expect(process.exitCode).toBe(1);
+  });
+});

packages/cli/test/queue-update-external-source.test.ts

@@ -0,0 +1,215 @@
+// #2866 — `rig queue update --source <name>@external`: a routine running outside any managed seat can append a
+// NOTE as itself, recorded as an external actor (claimed:v1), never as a seat. A REAL `queueCommand` invocation
+// talks over LOOPBACK HTTP to the real queueRoutes + QueueRepository on a fully migrated test DB, so the recorded
+// transition (actor + provenance) is read back from the store, not from a stubbed response.
+import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach, vi } from "vitest";
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+import type Database from "better-sqlite3";
+import { createDb } from "../../daemon/src/db/connection.js";
+import { migrate } from "../../daemon/src/db/migrate.js";
+import { ALL_MIGRATIONS } from "../../daemon/src/db/all-migrations.js";
+import { EventBus } from "../../daemon/src/domain/event-bus.js";
+import { QueueRepository } from "../../daemon/src/domain/queue-repository.js";
+import { queueRoutes } from "../../daemon/src/routes/queue.js";
+import { DaemonClient } from "../src/client.js";
+import { queueCommand } from "../src/commands/queue.js";
+import { STATE_FILE } from "../src/daemon-lifecycle.js";
+
+let db: Database.Database;
+let repo: QueueRepository;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let server: any;
+let port = 0;
+const seenHeaders: Array<string | undefined> = [];
+const SELF_HOST_ID = "this-host";
+const REMOTE_URL = "http://127.0.0.1:9";
+const remoteCalls: string[] = [];
+
+// Same hermetic isolation as queue-update-metadata-reject-cli.test.ts: ambient OPENRIG_URL / RIGGED_URL /
+// OPENRIG_PORT win over the injected state file, so they are removed for the CLI-invocation window only.
+const AMBIENT_KEYS = ["OPENRIG_URL", "RIGGED_URL", "OPENRIG_PORT"] as const;
+const savedEnv: Record<string, string | undefined> = {};
+function neutralizeAmbient(): void { for (const k of AMBIENT_KEYS) { savedEnv[k] = process.env[k]; delete process.env[k]; } }
+function restoreAmbient(): void { for (const k of AMBIENT_KEYS) { if (savedEnv[k] === undefined) delete process.env[k]; else process.env[k] = savedEnv[k]; } }
+
+beforeAll(async () => {
+  db = createDb();
+  migrate(db, ALL_MIGRATIONS);
+  const bus = new EventBus(db);
+  repo = new QueueRepository(db, bus, { validateRig: () => true });
+  const app = new Hono();
+  app.use("*", async (c, next) => {
+    seenHeaders.push(c.req.header("x-openrig-session"));
+    c.set("eventBus" as never, bus); c.set("queueRepo" as never, repo); await next();
+  });
+  // The daemon's own host id, as /healthz reports it: a `--host` naming it resolves to this daemon (queueHostTarget).
+  app.get("/healthz", (c) => c.json({ ok: true, selfHostId: SELF_HOST_ID }));
+  app.route("/api/queue", queueRoutes());
+  await new Promise<void>((resolve) => { server = serve({ fetch: app.fetch, hostname: "127.0.0.1", port: 0 }, (info: { port: number }) => { port = info.port; resolve(); }); });
+});
+
+afterAll(async () => {
+  restoreAmbient();
+  if (server) await new Promise<void>((resolve) => server.close(() => resolve()));
+  db?.close();
+});
+
+function loopbackUrl(): string { return `http://127.0.0.1:${port}`; }
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function deps(): any {
+  return {
+    // One registered http host besides this daemon, so `--host other-host` resolves to a truly remote target.
+    hostRegistryLoader: () => ({ ok: true, registry: { hosts: [{ id: "other-host", transport: "http", url: REMOTE_URL }] } }),
+    lifecycleDeps: { spawn: () => ({ pid: 1, unref() {} }), fetch: async () => ({ ok: true }), kill: () => true, readFile: (p: string) => (p === STATE_FILE ? JSON.stringify({ pid: 1, port, host: "127.0.0.1", db: "x", startedAt: "x" }) : null), writeFile() {}, removeFile() {}, exists: (p: string) => p === STATE_FILE, mkdirp() {}, openForAppend: () => 3, isProcessAlive: () => true },
+    clientFactory: (url: string) => {
+      // The remote host's client is built but must never be called: every method records the call and fails.
+      if (url === REMOTE_URL) {
+        return new Proxy({}, { get: (_t, prop) => async () => { remoteCalls.push(String(prop)); throw new Error(`remote ${String(prop)} called`); } });
+      }
+      if (url !== loopbackUrl()) throw new Error(`test-isolation guard: clientFactory url '${url}' !== loopback '${loopbackUrl()}'`);
+      return new DaemonClient(url);
+    },
+  };
+}
+
+async function runCli(args: string[]): Promise<{ out: string; exit: number | undefined }> {
+  const out: string[] = [];
+  const ol = console.log, oe = console.error, ow = process.stderr.write;
+  console.log = (...a: unknown[]) => { out.push(a.join(" ")); };
+  console.error = (...a: unknown[]) => { out.push(a.join(" ")); };
+  process.stderr.write = ((chunk: string | Uint8Array) => { out.push(String(chunk)); return true; }) as typeof process.stderr.write;
+  process.exitCode = undefined;
+  neutralizeAmbient();
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  try { await queueCommand(deps() as any).parseAsync(["node", "rig", ...args]); }
+  finally { restoreAmbient(); console.log = ol; console.error = oe; process.stderr.write = ow; }
+  const exit = process.exitCode; process.exitCode = 0;
+  return { out: out.join("\n"), exit };
+}
+
+type TransitionRow = { actor_session: string; state: string; transition_note: string | null; identity_provenance: string | null };
+const transitions = (id: string) => db.prepare(
+  "SELECT actor_session, state, transition_note, identity_provenance FROM queue_transitions WHERE qitem_id = ? ORDER BY rowid",
+).all(id) as TransitionRow[];
+
+describe("#2866 rig queue update --source <name>@external (note only, external actor)", () => {
+  let id: string;
+  beforeEach(async () => {
+    // Outside any managed seat: neither seat env is set, so the CLI stamps no X-OpenRig-Session header.
+    vi.stubEnv("OPENRIG_SESSION_NAME", "");
+    vi.stubEnv("RIGGED_SESSION_NAME", "");
+    seenHeaders.length = 0;
+    remoteCalls.length = 0;
+    id = (await repo.create({ sourceSession: "orch@rig", destinationSession: "dev-x@rig", body: "work" })).qitemId;
+  });
+  afterEach(() => { vi.unstubAllEnvs(); });
+
+  it("records the note with the external routine as its actor (claimed:v1), never a seat, and leaves the state alone", async () => {
+    const before = repo.getByIdOrThrow(id);
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", "nudged the owner", "--json"]);
+    expect(exit, out).toBeFalsy();
+    const last = transitions(id).at(-1)!;
+    expect(last).toMatchObject({ actor_session: "routine-nightly@external", transition_note: "nudged the owner", identity_provenance: "claimed:v1" });
+    expect(last.state).toBe(before.state);
+    expect(repo.getByIdOrThrow(id).state).toBe(before.state);
+    // No seat identity was forged on the wire: the request carried no X-OpenRig-Session header.
+    expect(seenHeaders.length).toBeGreaterThan(0);
+    expect(seenHeaders.every((h) => h === undefined)).toBe(true);
+  });
+
+  it("without a seat and without --source, says notes need a seat and names --source; nothing is sent", async () => {
+    const beforeTxns = transitions(id).length;
+    const { out, exit } = await runCli(["update", id, "--note", "nudged the owner"]);
+    expect(exit).toBe(1);
+    expect(out.startsWith("notes need a seat; an external routine can pass --source <name>@external")).toBe(true);
+    expect(seenHeaders).toEqual([]);
+    expect(transitions(id).length).toBe(beforeTxns);
+  });
+
+  it("without a seat, a state change still needs one: refused before any request, and the error names --source for notes", async () => {
+    const before = repo.getByIdOrThrow(id);
+    const { out, exit } = await runCli(["update", id, "--state", "done", "--closure-reason", "no-follow-on"]);
+    expect(exit).toBe(1);
+    expect(out).toContain("OPENRIG_SESSION_NAME is not set, so there's no seat to act as");
+    expect(out).toContain("notes need a seat; an external routine can pass --source <name>@external");
+    // D#52: a person approving their own ask (a host pairing) is pointed at the TUI or Steering.
+    expect(out).toContain("A person answering an ask addressed to them (a host pairing approval, say) does it in the TUI (rig tui, then attention) or in Steering");
+    expect(seenHeaders).toEqual([]);
+    expect(repo.getByIdOrThrow(id)).toEqual(before);
+  });
+
+  it("a blank seat env is no seat: the --source note is recorded as the external routine, not dropped", async () => {
+    vi.stubEnv("OPENRIG_SESSION_NAME", "   ");
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", "blank env", "--json"]);
+    expect(exit, out).toBeFalsy();
+    expect(out).not.toContain("is ignored");
+    expect(transitions(id).at(-1)).toMatchObject({ actor_session: "routine-nightly@external", identity_provenance: "claimed:v1" });
+  });
+
+  it.each(["local", SELF_HOST_ID])("accepts --host %s, which resolves to this daemon: the note is recorded as the external routine", async (host) => {
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", `via --host ${host}`, "--host", host, "--json"]);
+    expect(exit, out).toBeFalsy();
+    expect(transitions(id).at(-1)).toMatchObject({ actor_session: "routine-nightly@external", transition_note: `via --host ${host}`, identity_provenance: "claimed:v1" });
+  });
+
+  it("refuses --source with a --host that resolves to another host (it would lose the routine's origin); nothing is written", async () => {
+    const beforeTxns = transitions(id).length;
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", "x", "--host", "other-host"]);
+    expect(exit).toBe(1);
+    expect(out).toContain("--source with --host other-host is not supported");
+    expect(out).toContain("Nothing was sent");
+    // Only the self-id probe reached this daemon; nothing was posted here or to the other host.
+    expect(remoteCalls).toEqual([]);
+    expect(transitions(id).length).toBe(beforeTxns);
+  });
+
+  it.each(["dev-x@rig", "routine-nightly", "routine@externalx", "human@kernel"])("refuses --source %s (not <name>@external); nothing is sent", async (source) => {
+    const beforeTxns = transitions(id).length;
+    const { out, exit } = await runCli(["update", id, "--source", source, "--note", "nudged the owner"]);
+    expect(exit).toBe(1);
+    expect(out).toContain("--source must be <name>@external");
+    expect(seenHeaders).toEqual([]);
+    expect(transitions(id).length).toBe(beforeTxns);
+  });
+
+  // Every flag of the update verb that writes more than a note, one case each (UPDATE_STATE_WRITE_FLAGS in queue.ts).
+  it.each([
+    ["--state", ["--state", "in-progress"]],
+    ["--reopen", ["--reopen"]],
+    ["--closure-reason", ["--closure-reason", "no-follow-on"]],
+    ["--closure-target", ["--closure-target", "next@rig"]],
+    ["--closure-required-at", ["--closure-required-at", "2030-01-01T00:00:00Z"]],
+    ["--resolution", ["--state", "done", "--closure-reason", "no-follow-on", "--resolution", "finished"]],
+    ["--blocked-on", ["--state", "blocked", "--blocked-on", "external:x"]],
+    ["--wake-watchdog", ["--wake-watchdog", "job-1"]],
+    ["--wake-after", ["--wake-after", "15m"]],
+    ["--summary", ["--summary", "new subject"]],
+    ["--evidence-ref", ["--evidence-ref", "/proof.md"]],
+  ] as const)("refuses --source with %s: it records a note only; nothing is sent", async (_label, extra) => {
+    const before = repo.getByIdOrThrow(id);
+    const beforeTxns = transitions(id).length;
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", "x", ...extra]);
+    expect(exit).toBe(1);
+    expect(out).toContain("--source records a note only");
+    expect(seenHeaders).toEqual([]);
+    expect(transitions(id).length).toBe(beforeTxns);
+    expect(repo.getByIdOrThrow(id)).toEqual(before);
+  });
+
+  it("refuses --source without --note; nothing is sent", async () => {
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external"]);
+    expect(exit).toBe(1);
+    expect(out).toContain("--source records a note only");
+    expect(seenHeaders).toEqual([]);
+  });
+
+  it("inside a managed seat the seat stays the actor (transport:v1); --source does not override it", async () => {
+    vi.stubEnv("OPENRIG_SESSION_NAME", "dev-x@rig");
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", "seat note", "--json"]);
+    expect(exit, out).toBeFalsy();
+    expect(transitions(id).at(-1)).toMatchObject({ actor_session: "dev-x@rig", transition_note: "seat note", identity_provenance: "transport:v1" });
+    expect(out).toContain("warning: --source routine-nightly@external is ignored: this runs in the seat dev-x@rig");
+  });
+});

packages/cli/test/scope-commands.test.ts

@@ -1367,6 +1367,29 @@ describe("--help is present on every command (HG-12)", () => {
   });
 });
 
+describe("slice and mission verb help names the parent --workspace option", () => {
+  const helpOf = (cmd: Command): string => {
+    let out = "";
+    cmd.configureOutput({ writeOut: (text) => { out += text; } });
+    cmd.outputHelp();
+    return out;
+  };
+
+  it("every slice and mission verb, and each tier, shows the rig scope --workspace route", () => {
+    const cmd = scopeCommand();
+    for (const tierName of ["slice", "mission"] as const) {
+      const tier = cmd.commands.find((c) => c.name() === tierName)!;
+      expect(helpOf(tier)).toContain(`rig scope --workspace <project root> ${tierName} <verb> ...`);
+      for (const verb of tier.commands) {
+        const help = helpOf(verb);
+        expect(help, `${tierName} ${verb.name()}`).toContain(`rig scope --workspace <project root> ${tierName} ${verb.name()} ...`);
+        expect(help, `${tierName} ${verb.name()}`).toContain("$(rig config get workspace.projects_root)/<project>");
+        expect(help, `${tierName} ${verb.name()}`).not.toContain("~/.openrig");
+      }
+    }
+  });
+});
+
 describe("rig scope audit ordinal naming", () => {
   let root: string;
   let mission: string;

packages/cli/test/scope-fs.test.ts

@@ -512,6 +512,36 @@ describe("findSlice + resolution variants", () => {
   it("3-part error when slice not found (HG-10)", () => {
     expect(() => findSlice(missionsRoot, "99-missing", "release-0.3.2")).toThrow(/not found/);
   });
+
+  it("O2: an absolute slice in another workspace's missions tree names the --workspace that selects it", () => {
+    const project = path.join(root, "projects", "alpha");
+    const slice = path.join(project, "missions", "m1", "slices", "01-x");
+    writeFile(path.join(project, "missions", "m1", "SPEC.md"), "---\nid: ALPHA.99.0.1\n---\nbody");
+    writeFile(path.join(slice, "SPEC.md"), "---\nid: ALPHA.99.0.1.1\n---\nbody");
+    let error: unknown;
+    try { findSlice(missionsRoot, slice); } catch (err) { error = err; }
+    expect(error).toBeInstanceOf(ScopeCliError);
+    expect((error as ScopeCliError).fact).toBe(`Slice path "${slice}" resolved to ${slice} but no parent mission was found.`);
+    expect((error as ScopeCliError).action).toBe(
+      `The slice is in another workspace's missions tree (${path.join(project, "missions")}), not under ${missionsRoot}. `
+      + `Select that tree with the parent --workspace option, for example: rig scope --workspace '${project}' slice <verb> '${slice}'`,
+    );
+    // The named option works: that workspace resolves the slice.
+    expect(findSlice(resolveMissionsRoot({ override: project, strictOverride: true }), slice).id).toBe("ALPHA.99.0.1.1");
+  });
+
+  it("O2: a slice outside any missions tree keeps the old advice and adds the --workspace route", () => {
+    const scratch = path.join(root, "07-target");
+    fs.mkdirSync(scratch);
+    expect(() => findSlice(missionsRoot, scratch)).toThrow(
+      "Ensure the slice lives under <missionsRoot>/<mission>/{slices,closed}/. For a slice in another workspace, such as a catalog project, "
+      + "select its tree with the parent option: rig scope --workspace <project root> slice <verb> <slice-path>",
+    );
+  });
+
+  it("O2: a mission not found names the --workspace route", () => {
+    expect(() => findMission(missionsRoot, "absent")).toThrow("rig scope --workspace <project root> mission <verb> <mission>");
+  });
 });
 
 describe("BC-2 BLOCK 2 — findMission rejects README-less directories", () => {

packages/cli/test/seat-attention.test.ts

@@ -0,0 +1,138 @@
+import { expect, it, vi } from "vitest";
+import { attentionLines, checkKernelAttention, checkSeatAttention } from "../src/seat-attention.js";
+
+type Reply = { status: number; data: unknown } | Error;
+function client(routes: Record<string, Reply>) {
+  const get = vi.fn(async (url: string) => {
+    const reply = routes[url];
+    if (reply instanceof Error) throw reply;
+    return reply ?? { status: 404, data: { error: "not found" } };
+  });
+  return { get, client: { get } as unknown as Parameters<typeof checkSeatAttention>[0] };
+}
+
+const LOGIN = "Startup requires attention: Login expired · Please run /login";
+const nodes = [
+  // A live question the daemon serves (needs-input), with its own reason.
+  { canonicalSessionName: "question@r", needsAttention: true, arbitratedNeedsInput: true, startupStatus: "ready", latestError: null,
+    activityState: { activity: "needs_input", display: "needs input", needsInput: { count: 1, reason: "selection_prompt" }, decidedBy: "pane" } },
+  // Broad attention that isn't a question: a ready seat started without required guidance.
+  { canonicalSessionName: "guidance@r", needsAttention: true, arbitratedNeedsInput: false, startupStatus: "ready", latestError: null,
+    startedWithoutRequired: ["/seat/AGENTS.md"] },
+  // A failed start: a readiness timeout, as a dialog the startup check doesn't recognise leaves it.
+  { canonicalSessionName: "failed@r", needsAttention: true, startupStatus: "failed",
+    latestError: "Readiness timeout after 30s — harness did not become interactive: unknown" },
+  // An expired sign-in at startup.
+  { canonicalSessionName: "login@r", needsAttention: true, startupStatus: "attention_required", latestError: LOGIN },
+  { canonicalSessionName: "fine@r", needsAttention: false, startupStatus: "ready", latestError: null },
+  // An older daemon that serves no attention evidence.
+  { canonicalSessionName: "old@r", startupStatus: "ready", latestError: null },
+];
+
+it("honours the daemon's needs-input precedence: a served 'no' beats a stale hook; the hook counts only without an answer", async () => {
+  const precedence = [
+    // Broad attention (missing guidance), the arbitrated answer is no question, and a stale needs_input hook remains.
+    { canonicalSessionName: "stale@r", needsAttention: true, arbitratedNeedsInput: false, startupStatus: "ready", latestError: null,
+      startedWithoutRequired: ["/seat/AGENTS.md"], agentActivity: { state: "needs_input", reason: "permission_prompt" } },
+    // The same stale hook as the only reason: its reason isn't revived either.
+    { canonicalSessionName: "staleonly@r", needsAttention: true, arbitratedNeedsInput: false, startupStatus: "ready", latestError: null,
+      agentActivity: { state: "needs_input", reason: "permission_prompt" } },
+    // No arbitrated answer: the hook decides, with its reason.
+    { canonicalSessionName: "hook@r", needsAttention: true, arbitratedNeedsInput: null, startupStatus: "ready", latestError: null,
+      agentActivity: { state: "needs_input", reason: "permission_prompt" } },
+  ];
+  const { client: c } = client({ "/api/ps": { status: 200, data: [{ rigId: "r1", rigName: "r" }] }, "/api/rigs/r1/nodes": { status: 200, data: [...nodes, ...precedence] } });
+  const check = await checkSeatAttention(c, ["stale@r", "staleonly@r", "hook@r", "question@r"]);
+  expect(check.attention).toEqual([
+    { seat: "question@r", reason: "selection_prompt", waitingOnPerson: true },
+    { seat: "stale@r", reason: "missing required AGENTS.md", waitingOnPerson: false },
+    { seat: "staleonly@r", reason: "reason unavailable", waitingOnPerson: false },
+    { seat: "hook@r", reason: "permission_prompt", waitingOnPerson: true },
+  ]);
+});
+
+it("labels only a served live question as waiting on a person; the broad flag reads 'needs attention' with its reason", async () => {
+  const { client: c } = client({ "/api/ps": { status: 200, data: [{ rigId: "r1", rigName: "r" }] }, "/api/rigs/r1/nodes": { status: 200, data: nodes } });
+  const check = await checkSeatAttention(c, ["question@r", "guidance@r", "failed@r", "login@r", "fine@r", "old@r"]);
+  expect(check.attention).toEqual([
+    { seat: "question@r", reason: "selection_prompt", waitingOnPerson: true },
+    { seat: "guidance@r", reason: "missing required AGENTS.md", waitingOnPerson: false },
+    { seat: "failed@r", reason: "Readiness timeout after 30s — harness did not become interactive: unknown", waitingOnPerson: false },
+    { seat: "login@r", reason: LOGIN, waitingOnPerson: false },
+  ]);
+  expect(check.unknown).toEqual([{ seat: "old@r", why: "the daemon served no attention evidence for it" }]);
+  expect(attentionLines(check, "tile")).toEqual([
+    "question@r is waiting on a person: selection_prompt. Answer it in its tile, or read it with: rig capture question@r",
+    "guidance@r needs attention: missing required AGENTS.md. Look at it in its tile with: rig capture guidance@r",
+    "failed@r needs attention: Readiness timeout after 30s — harness did not become interactive: unknown. Look at it in its tile with: rig capture failed@r",
+    `login@r needs attention: ${LOGIN}. Look at it in its tile with: rig capture login@r`,
+    "Couldn't check whether old@r needs attention: the daemon served no attention evidence for it.",
+  ]);
+});
+
+it("an unreadable rig list leaves every seat unknown, not unflagged", async () => {
+  const { client: c } = client({ "/api/ps": { status: 503, data: { error: "busy" } } });
+  const check = await checkSeatAttention(c, ["a@r", "b@r"]);
+  expect(check).toEqual({ attention: [], unknown: [
+    { seat: "a@r", why: "the rig list couldn't be read (HTTP 503: busy)" },
+    { seat: "b@r", why: "the rig list couldn't be read (HTTP 503: busy)" }] });
+  expect(attentionLines(check, "pane")).toEqual(["Couldn't check whether a@r, b@r need attention: the rig list couldn't be read (HTTP 503: busy)."]);
+});
+
+it("one rig's failed read keeps the other rig's answers and leaves only its own seats unknown", async () => {
+  const { client: c } = client({
+    "/api/ps": { status: 200, data: [{ rigId: "a1", rigName: "a" }, { rigId: "b1", rigName: "b" }] },
+    "/api/rigs/a1/nodes": { status: 200, data: [{ canonicalSessionName: "x@a", needsAttention: true, startupStatus: "attention_required", latestError: LOGIN }] },
+    "/api/rigs/b1/nodes": new Error("socket hang up"),
+  });
+  const check = await checkSeatAttention(c, ["x@a", "y@b"]);
+  expect(check.attention).toEqual([{ seat: "x@a", reason: LOGIN, waitingOnPerson: false }]);
+  expect(check.unknown).toEqual([{ seat: "y@b", why: "b's seats couldn't be read (socket hang up)" }]);
+});
+
+it("a seat that isn't in this daemon's inventory is unknown, never 'fine'", async () => {
+  const { client: c } = client({ "/api/ps": { status: 200, data: [{ rigId: "r1", rigName: "r" }] }, "/api/rigs/r1/nodes": { status: 200, data: [] } });
+  const check = await checkSeatAttention(c, ["gone@r", "x@elsewhere"]);
+  expect(check.unknown).toEqual([
+    { seat: "gone@r", why: "not in r's seats on this daemon" },
+    { seat: "x@elsewhere", why: "no rig named elsewhere on this daemon" }]);
+});
+
+it("an unreadable kernel status is reported, not read as no held seat", async () => {
+  const { client: c } = client({ "/api/kernel/status": { status: 503, data: { error: "kernel_boot_tracker_unavailable" } } });
+  expect(await checkKernelAttention(c)).toEqual({ attention: [],
+    unknown: [{ seat: "kernel", why: "the kernel status couldn't be read (HTTP 503: kernel_boot_tracker_unavailable)" }] });
+});
+
+it("keeps a long unknown list to one bounded line per reason", () => {
+  const unknown = ["a", "b", "c", "d", "e", "f", "g"].map(name => ({ seat: `${name}@r`, why: "down" }));
+  expect(attentionLines({ attention: [], unknown }, "pane"))
+    .toEqual(["Couldn't check whether a@r, b@r, c@r, d@r, e@r and 2 more need attention: down."]);
+});
+
+it("a seat waiting on a person names its question, not an older recorded error; the needs-attention order is unchanged", async () => {
+  const OLD = "Readiness timeout after 30s — harness did not become interactive: unknown";
+  const seats = [
+    // A live question, served by the arbitrated answer, on a seat that also carries an older startup error.
+    { canonicalSessionName: "asked@r", needsAttention: true, arbitratedNeedsInput: true, startupStatus: "failed", latestError: OLD,
+      activityState: { activity: "needs_input", display: "needs input", needsInput: { count: 1, reason: "permission_prompt" }, decidedBy: "hook" } },
+    // A live question from the hook alone (no arbitrated answer), with the same older error.
+    { canonicalSessionName: "hooked@r", needsAttention: true, arbitratedNeedsInput: null, startupStatus: "failed", latestError: OLD,
+      agentActivity: { state: "needs_input", reason: "elicitation_dialog" } },
+    // A live question whose reason isn't served: never the older error.
+    { canonicalSessionName: "unsaid@r", needsAttention: true, arbitratedNeedsInput: true, startupStatus: "failed", latestError: OLD,
+      activityState: { activity: "needs_input", display: "needs input", needsInput: { count: 1, reason: null }, decidedBy: "hook" } },
+    // No question: the recorded error still leads.
+    { canonicalSessionName: "broad@r", needsAttention: true, arbitratedNeedsInput: false, startupStatus: "failed", latestError: OLD,
+      agentActivity: { state: "needs_input", reason: "permission_prompt" } },
+  ];
+  const { client: c } = client({ "/api/ps": { status: 200, data: [{ rigId: "r1", rigName: "r" }] }, "/api/rigs/r1/nodes": { status: 200, data: seats } });
+  const check = await checkSeatAttention(c, ["asked@r", "hooked@r", "unsaid@r", "broad@r"]);
+  expect(check.attention).toEqual([
+    { seat: "asked@r", reason: "permission_prompt", waitingOnPerson: true },
+    { seat: "hooked@r", reason: "elicitation_dialog", waitingOnPerson: true },
+    { seat: "unsaid@r", reason: "reason unavailable", waitingOnPerson: true },
+    { seat: "broad@r", reason: OLD, waitingOnPerson: false },
+  ]);
+  expect(attentionLines(check, "tile")[0]).toBe("asked@r is waiting on a person: permission_prompt. Answer it in its tile, or read it with: rig capture asked@r");
+});

packages/cli/test/seat-set-runtime.test.ts

@@ -67,6 +67,13 @@ const plan = {
 describe("rig seat set-runtime", () => {
   afterEach(() => vi.restoreAllMocks());
 
+  it("passes a Pi target and its selected account through the existing dry-run workflow", async () => {
+    const { calls, exitCode } = await run({ status: 200, data: { ...plan, to: "pi", accountHome: "/accounts/pi" } },
+      ["dev.impl@my-rig", "--runtime", "pi", "--account-home", "/accounts/pi", "--reason", "Change runtime", "--dry-run"]);
+    expect(calls[0]!.body).toMatchObject({ runtime: "pi", accountHome: "/accounts/pi", reason: "Change runtime", dryRun: true });
+    expect(exitCode).toBeFalsy();
+  });
+
   it("an older daemon cannot silently ignore the chosen home and execute a switch", async () => {
     const { calls, exitCode } = await run({ status: 200, data: plan }, ["dev.impl@my-rig", "--runtime", "claude-code",
       "--account-home", "/accounts/claude-api", "--reason", "Plan limit", "--json"]);

packages/cli/test/send.test.ts

@@ -402,6 +402,31 @@ describe("Send CLI", () => {
     expect(logs.join("\n")).not.toContain("typed, never submitted");
   });
 
+  it("fan-out text output keeps each recipient's own advisory, such as unreadable input", async () => {
+    const unreadable = "Input could not be read and was not cleared; this send may join or submit existing text.";
+    const client = {
+      post: async (path: string) => {
+        if (path === "/api/transport/broadcast") return { status: 200, data: {
+          total: 2, sent: 2, failed: 0, results: [
+            { sessionName: "worker@test", ok: true, existingInput: { classification: "unreadable", fullContentsVisible: false }, warning: unreadable },
+            { sessionName: "sibling@test", ok: true, existingInput: { classification: "unreadable", fullContentsVisible: false }, warning: `${unreadable} No trailing Enter.` },
+          ],
+        } };
+        throw new Error("unexpected request");
+      },
+    } as unknown as DaemonClient;
+    const { logs } = await captureLogs(async () => {
+      await makeCmd({ ...runningDeps(port), clientFactory: () => client }).parseAsync([
+        "node", "rig", "send", "--to", "worker@test,sibling@test", "1", "--dangerously-interact", "--reason", "fixture",
+      ]);
+    });
+    const output = logs.join("\n");
+    expect(output).toContain(`worker@test: Advisory: ${unreadable}`);
+    expect(output).toContain(`sibling@test: Advisory: ${unreadable} No trailing Enter.`);
+    expect(output).toContain("worker@test: Existing input: unreadable");
+    expect(output).toContain("2/2 delivered");
+  });
+
   it("reports a fan-out refusal as unconfirmed alongside a successful recipient", async () => {
     let submits = 0;
     const client = {

packages/cli/test/status.test.ts

@@ -49,10 +49,17 @@ function createDaemonServer(
   summaryData: unknown[],
   cmuxStatus: unknown,
   kernelStatus?: { code: number; body: unknown },
+  more: Record<string, unknown> = {},
 ) {
   const server = http.createServer((req, res) => {
     const url = new URL(req.url!, "http://localhost");
 
+    if (url.pathname in more) {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(more[url.pathname]));
+      return;
+    }
+
     if (url.pathname === "/api/rigs/summary") {
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify(summaryData));
@@ -252,6 +259,47 @@ describe("rig status", () => {
       }
     });
 
+    it("names a kernel seat that needs attention, and why, under a partial_ready kernel (D#52)", async () => {
+      const held = createDaemonServer([], { available: false }, {
+        code: 200,
+        body: { kernel_state: "partial_ready", agents: [
+          { session_name: "advisor-lead@kernel", runtime: "claude-code", startup_status: "attention_required" },
+          { session_name: "operator-agent@kernel", runtime: "claude-code", startup_status: "ready" },
+        ] },
+      }, {
+        "/api/ps": [{ rigId: "k1", rigName: "kernel" }],
+        "/api/rigs/k1/nodes": [
+          { canonicalSessionName: "advisor-lead@kernel", needsAttention: true, startupStatus: "attention_required",
+            latestError: "Startup requires attention: Login expired · Please run /login" },
+          { canonicalSessionName: "operator-agent@kernel", needsAttention: false, startupStatus: "ready", latestError: null },
+        ],
+      });
+      const heldPort = await held.listen();
+      try {
+        const deps = () => ({
+          lifecycleDeps: mockLifecycleDeps({
+            exists: vi.fn((p: string) => p === STATE_FILE),
+            readFile: vi.fn((p: string) => (p === STATE_FILE ? JSON.stringify(runningState(heldPort)) : null)),
+            fetch: vi.fn(async () => ({ ok: true })),
+          }),
+          clientFactory: (baseUrl: string) => new DaemonClient(baseUrl),
+        });
+        const human = new Command();
+        human.addCommand(statusCommand(deps()));
+        const output = (await captureLogs(() => human.parseAsync(["node", "rig", "status"]))).join("\n");
+        expect(output).toContain("Kernel: partial_ready");
+        expect(output).toContain("  advisor-lead@kernel needs attention: Startup requires attention: Login expired · Please run /login. Look at it with: rig capture advisor-lead@kernel");
+        expect(output).not.toContain("operator-agent@kernel needs attention");
+        const json = new Command();
+        json.addCommand(statusCommand(deps()));
+        const parsed = JSON.parse((await captureLogs(() => json.parseAsync(["node", "rig", "status", "--json"]))).join("\n"));
+        expect(parsed.kernel.attention).toEqual({ unknown: [], attention: [
+          { seat: "advisor-lead@kernel", reason: "Startup requires attention: Login expired · Please run /login", waitingOnPerson: false }] });
+      } finally {
+        await held.close();
+      }
+    });
+
     it("marks the workspace root as an override when OPENRIG_WORKSPACE_ROOT is set", async () => {
       const prev = process.env.OPENRIG_WORKSPACE_ROOT;
       process.env.OPENRIG_WORKSPACE_ROOT = process.cwd(); // a real existing dir

packages/cli/test/terminal-herdr-app.test.ts

@@ -0,0 +1,180 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { herdrAppClient, terminalCommand, type TerminalDeps } from "../src/commands/terminal.js";
+import type { DaemonClient } from "../src/client.js";
+
+vi.mock("../src/daemon-lifecycle.js", async () => {
+  const actual = await vi.importActual<Record<string, unknown>>("../src/daemon-lifecycle.js");
+  return {
+    ...actual,
+    getDaemonStatus: vi.fn(async () => ({ state: "running", healthy: true, pid: 1234, port: 7433 })),
+    getDaemonUrl: vi.fn(() => "http://localhost:7433"),
+  };
+});
+
+const inApp = { HC_TERMINAL_ID: "t4", HC_TERMINAL_SOCKET: "/run/core.sock", HERDR_APP_HOME: "/apps/h" };
+const deps = (env: NodeJS.ProcessEnv, socket = true) => ({
+  env, socketExists: (p: string) => socket && p === "/apps/h/herdr-app.sock",
+}) as Parameters<typeof herdrAppClient>[1];
+
+afterEach(() => vi.restoreAllMocks());
+
+describe("rig terminal open: when herdr-app is the target", () => {
+  it("--provider herdr-app resolves herdr-app's home (or explicit --app-home)", () => {
+    expect(herdrAppClient({ provider: "herdr-app" }, deps(inApp))).toEqual({ appHome: "/apps/h", ambient: false });
+    expect(herdrAppClient({ provider: "herdr-app", appHome: "/x" }, deps({}))).toEqual({ appHome: "/x", ambient: false });
+  });
+
+  it("with neither --provider nor --window: a herdr-app terminal whose window socket exists chooses herdr-app", () => {
+    expect(herdrAppClient({}, deps(inApp))).toEqual({ appHome: "/apps/h", ambient: true });
+    expect(herdrAppClient({}, deps({ HERDR_APP_HOME: "/apps/h" }))).toBeNull();
+    expect(herdrAppClient({}, deps(inApp, false))).toBeNull(); // markers alone invent no endpoint
+  });
+
+  it("--window and other named providers keep their meaning", () => {
+    expect(herdrAppClient({ window: true }, deps(inApp, true))).toBeNull();
+    expect(herdrAppClient({ provider: "herdr-app", window: true }, deps(inApp, true))).toBeNull();
+    expect(herdrAppClient({ provider: "herdr" }, deps(inApp))).toBeNull();
+    expect(herdrAppClient({ provider: "cmux" }, deps(inApp))).toBeNull();
+    const openCmd = terminalCommand().commands.find((c) => c.name() === "open");
+    const windowOpt = openCmd?.options.find((o) => o.long === "--window");
+    expect(windowOpt?.description).toContain("still asks for a desktop window");
+    const providerOpt = openCmd?.options.find((o) => o.long === "--provider");
+    expect(providerOpt?.description).not.toContain(")(");
+    expect(providerOpt?.description).not.toContain(") (");
+  });
+
+  it("probing an ambient herdr-app window: answering opens in herdr-app; unanswering or unconfirmed status falls back to desktop with an accurate note; explicit --provider herdr-app does not fall back", async () => {
+    const runOpen = async (args: string[], env: NodeJS.ProcessEnv, probeReply: { status: number; available?: boolean }) => {
+      const posts: Array<{ path: string; body: unknown }> = [];
+      const gets: string[] = [];
+      const logs: string[] = [];
+      const errs: string[] = [];
+      vi.spyOn(console, "log").mockImplementation((m) => { logs.push(String(m)); });
+      vi.spyOn(console, "error").mockImplementation((m) => { errs.push(String(m)); });
+      const client = {
+        baseUrl: "http://localhost:7433",
+        get: async (path: string) => {
+          gets.push(path);
+          if (path.startsWith("/api/terminal/status?provider=herdr-app")) {
+            return probeReply.available === undefined
+              ? { status: probeReply.status, data: { error: "not_found" } }
+              : { status: probeReply.status, data: { providers: [{ name: "herdr-app", status: { available: probeReply.available, launch: { socketPath: "/apps/h/herdr-app.sock" } } }] } };
+          }
+          if (path === "/api/terminal/status" || path.startsWith("/api/terminal/status?provider=herdr")) {
+            return {
+              status: 200,
+              data: {
+                available: true,
+                launch: { binary: "/bin/herdr", socketPath: "/tmp/h.sock", session: "default" },
+                providers: [{ name: "herdr", liveness: { alive: true }, status: { available: true, launch: { binary: "/bin/herdr", socketPath: "/tmp/h.sock", session: "default" } } }],
+              },
+            };
+          }
+          if (path.startsWith("/api/terminal/preview")) {
+            return {
+              status: 200,
+              data: {
+                planId: "p1",
+                status: { launch: { socketPath: "/tmp/h.sock" } },
+                composed: {
+                  id: "slice:s1",
+                  pages: [[{ seat: "dev.build@demo", label: "dev.build", readOnly: false, paneCommand: "tmux attach -t =dev.build@demo" }]],
+                  opened: [{ seat: "dev.build@demo", label: "dev.build", paneCommand: "tmux attach -t =dev.build@demo" }],
+                  absent: [],
+                  degraded: [],
+                },
+              },
+            };
+          }
+          return { status: 200, data: {} };
+        },
+        post: async (path: string, body: unknown) => {
+          posts.push({ path, body });
+          const b = body as { provider?: string };
+          if (path === "/api/terminal/follow") {
+            return { status: 200, data: { provider: "herdr", ok: true, workspaceId: "ws-1", opened: ["dev.build@demo"], absent: [], degraded: [], pages: 1 } };
+          }
+          if (b.provider === "herdr-app" && probeReply.available !== true) {
+            return { status: 200, data: { provider: "herdr-app", ok: false, code: "herdr_app_unavailable", error: "herdr-app is not answering", opened: [], absent: [], degraded: [], pages: 0 } };
+          }
+          return { status: 200, data: { provider: b.provider ?? "herdr", ok: true, opened: ["dev.build@demo"], absent: [], degraded: [], pages: 1 } };
+        },
+      } as unknown as DaemonClient;
+      const cmdDeps: TerminalDeps = {
+        env,
+        socketExists: (p: string) => p === "/apps/h/herdr-app.sock",
+        lifecycleDeps: {} as TerminalDeps["lifecycleDeps"],
+        clientFactory: () => client,
+        windowDeps: {
+          env: { DISPLAY: ":0", TERM_PROGRAM: "herdr", HERDR_SOCKET_PATH: "/tmp/h.sock" },
+          platform: "linux",
+          exists: () => true,
+          exec: async (_file: string, execArgs: string[]) => {
+            if (execArgs[1] === "command -v herdr") return "/bin/herdr\n";
+            return JSON.stringify({
+              result: {
+                running: true,
+                socket: "/tmp/h.sock",
+                workspaces: [{ workspace_id: "ws-1", label: "s1", focused: true }],
+                tabs: [{ workspace_id: "ws-1", tab_id: "tb-1", label: "s1" }],
+                tab: { workspace_id: "ws-1", tab_id: "tb-1" },
+              },
+            });
+          },
+          launch: async () => {},
+          sleep: async () => {},
+          id: () => "id1",
+          herdrConfig: () => "/tmp/herdr.json",
+        },
+      };
+      await terminalCommand(cmdDeps).parseAsync(["node", "terminal", "open", ...args]);
+      return { posts, gets, logs, errs };
+    };
+
+    // 1. Ambient + available:true -> opens in herdr-app
+    const okAmbient = await runOpen(["rig:demo", "--json"], inApp, { status: 200, available: true });
+    expect(okAmbient.gets).toContain("/api/terminal/status?provider=herdr-app&appHome=%2Fapps%2Fh");
+    expect(okAmbient.posts).toEqual([{ path: "/api/terminal/open", body: { view: "rig:demo", provider: "herdr-app", herdrApp: { appHome: "/apps/h" } } }]);
+    expect(okAmbient.errs).toEqual([]);
+
+    // 2. Ambient + available:false -> desktop fallback, stderr + notes, no /api/terminal/open with herdr-app
+    const staleAmbient = await runOpen(["rig:demo", "--json"], inApp, { status: 200, available: false });
+    expect(staleAmbient.gets).toContain("/api/terminal/status?provider=herdr-app&appHome=%2Fapps%2Fh");
+    expect(staleAmbient.posts.some((p) => (p.body as { provider?: string })?.provider === "herdr-app")).toBe(false);
+    expect(staleAmbient.errs[0]).toContain("herdr-app's socket exists at /apps/h/herdr-app.sock but it isn't answering; opening a desktop window instead. Use --provider herdr-app to require it.");
+    const parsed = JSON.parse(staleAmbient.logs[0]!) as { notes?: string[] };
+    expect(parsed.notes).toContain("herdr-app's socket exists at /apps/h/herdr-app.sock but it isn't answering; opening a desktop window instead. Use --provider herdr-app to require it.");
+
+    // 3. Ambient + status route 404/4xx -> says the daemon could not confirm, not "isn't answering"
+    const unconfirmedAmbient = await runOpen(["rig:demo", "--json"], inApp, { status: 404 });
+    expect(unconfirmedAmbient.posts.some((p) => (p.body as { provider?: string })?.provider === "herdr-app")).toBe(false);
+    expect(unconfirmedAmbient.errs[0]).toContain("the daemon could not confirm whether it is answering (HTTP 404)");
+    expect(unconfirmedAmbient.errs[0]).not.toContain("isn't answering");
+
+    // 4. Explicit --provider herdr-app + available:false -> still herdr-app, fails loudly, no fallback
+    const explicitFlag = await runOpen(["rig:demo", "--provider", "herdr-app", "--json"], inApp, { status: 200, available: false });
+    expect(explicitFlag.gets).toEqual([]);
+    expect(explicitFlag.posts).toEqual([{ path: "/api/terminal/open", body: { view: "rig:demo", provider: "herdr-app", herdrApp: { appHome: "/apps/h" } } }]);
+    expect(JSON.parse(explicitFlag.logs[0]!)).toMatchObject({ ok: false, provider: "herdr-app", code: "herdr_app_unavailable" });
+
+    // 5. Ambient (no --provider) + --follow -> falls through to the existing Herdr follow path (never follow_unsupported)
+    const ambientFollow = await runOpen(["slice:s1", "--follow", "--json"], inApp, { status: 200, available: true });
+    expect(ambientFollow.gets.some((g) => g.startsWith("/api/terminal/status?provider=herdr-app"))).toBe(false);
+    expect(ambientFollow.posts).toEqual([
+      { path: "/api/terminal/follow", body: { view: "slice:s1", provider: "herdr", enabled: true } },
+    ]);
+    expect(JSON.parse(ambientFollow.logs[0]!)).toMatchObject({ ok: true, provider: "herdr", workspaceId: "ws-1" });
+
+    // 6. Explicit --provider herdr-app + --follow -> returns follow_unsupported
+    const explicitFollow = await runOpen(["slice:s1", "--provider", "herdr-app", "--follow", "--json"], inApp, { status: 200, available: true });
+    expect(explicitFollow.gets).toEqual([]);
+    expect(explicitFollow.posts).toEqual([]);
+    expect(JSON.parse(explicitFollow.logs[0]!)).toMatchObject({ ok: false, provider: "herdr-app", code: "follow_unsupported" });
+
+    // 7. Explicit --provider herdr-app + --window -> --window wins and opens a desktop window (never herdr-app)
+    const explicitWindow = await runOpen(["rig:demo", "--provider", "herdr-app", "--window", "--json"], inApp, { status: 200, available: true });
+    expect(explicitWindow.gets.some((g) => g.startsWith("/api/terminal/status?provider=herdr-app"))).toBe(false);
+    expect(explicitWindow.posts.some((p) => (p.body as { provider?: string })?.provider === "herdr-app")).toBe(false);
+    expect(JSON.parse(explicitWindow.logs[0]!)).toMatchObject({ ok: true, provider: "herdr" });
+  });
+});

packages/cli/test/terminal-open-held-seats.test.ts

@@ -0,0 +1,82 @@
+import { Command } from "commander";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+import { terminalCommand, type TerminalDeps } from "../src/commands/terminal.js";
+
+vi.mock("../src/daemon-lifecycle.js", async () => ({
+  ...await vi.importActual<Record<string, unknown>>("../src/daemon-lifecycle.js"),
+  getDaemonStatus: vi.fn(async () => ({ state: "running", healthy: true, pid: 1234, port: 7433 })),
+  getDaemonUrl: vi.fn(() => "http://localhost:7433"),
+}));
+
+// D#52: a kernel advisor held at an expired sign-in opened as a tile, and nothing said why it wasn't answering.
+const ADVISOR_HELD = "Startup requires attention: Login expired · Please run /login";
+
+function fixture(opts: { advisorNeedsAttention?: boolean; psStatus?: number; remote?: Array<{ seat: string; host: string }>; olderDaemon?: boolean } = {}) {
+  const advisorHeld = opts.advisorNeedsAttention ?? true;
+  const get = vi.fn(async (url: string) => url === "/api/ps"
+    ? (opts.psStatus ? { status: opts.psStatus, data: { error: "busy" } } : { status: 200, data: [{ rigId: "k1", rigName: "kernel" }, { rigId: "o1", rigName: "other" }] })
+    : url === "/api/rigs/k1/nodes" ? { status: 200, data: [
+      { canonicalSessionName: "advisor-lead@kernel", needsAttention: advisorHeld, startupStatus: advisorHeld ? "attention_required" : "ready",
+        latestError: advisorHeld ? ADVISOR_HELD : null },
+      { canonicalSessionName: "operator-agent@kernel", needsAttention: false, startupStatus: "ready", latestError: null },
+    ] }
+    : { status: 404, data: null });
+  const post = vi.fn(async () => ({ status: 200, data: { provider: "herdr", ok: true,
+    // A current daemon always says which opened seats are remote (an empty list: all local); an older one doesn't.
+    opened: ["operator-agent@kernel", "advisor-lead@kernel"], ...(opts.olderDaemon ? {} : { remote: opts.remote ?? [] }), absent: [], degraded: [], pages: 2 } }));
+  const deps: TerminalDeps = { lifecycleDeps: {} as TerminalDeps["lifecycleDeps"],
+    clientFactory: () => ({ baseUrl: "http://localhost:7433", get, post }) as unknown as ReturnType<TerminalDeps["clientFactory"]> };
+  return { get, post, run: (args: string[]) => new Command().addCommand(terminalCommand(deps)).parseAsync(["terminal", ...args], { from: "user" }) };
+}
+
+let logs: string[];
+beforeEach(() => {
+  logs = []; process.exitCode = undefined;
+  vi.spyOn(console, "log").mockImplementation((...args) => logs.push(args.join(" ")));
+});
+afterEach(() => { process.exitCode = undefined; vi.restoreAllMocks(); });
+
+it("names an opened seat that needs attention, with the daemon's reason, and keeps the open a success", async () => {
+  const f = fixture();
+  await f.run(["open", "kernel", "--provider", "herdr", "--json"]);
+  const result = JSON.parse(logs[0]!);
+  expect(result).toMatchObject({ ok: true, opened: ["operator-agent@kernel", "advisor-lead@kernel"] });
+  expect(result.notes).toEqual([`advisor-lead@kernel needs attention: ${ADVISOR_HELD}. Look at it in its tile with: rig capture advisor-lead@kernel`]);
+  // Only the rigs the opened seats belong to are read.
+  expect(f.get.mock.calls.map(([url]) => url)).toEqual(["/api/ps", "/api/rigs/k1/nodes"]);
+  expect(process.exitCode).toBeUndefined();
+});
+
+it("shows the same line in the human output", async () => {
+  await fixture().run(["open", "kernel", "--provider", "herdr"]);
+  expect(logs.join("\n")).toContain(`  note: advisor-lead@kernel needs attention: ${ADVISOR_HELD}. Look at it in its tile with: rig capture advisor-lead@kernel`);
+});
+
+it("adds nothing when no opened seat needs attention", async () => {
+  await fixture({ advisorNeedsAttention: false }).run(["open", "kernel", "--provider", "herdr", "--json"]);
+  expect(JSON.parse(logs[0]!).notes).toBeUndefined();
+});
+
+it("says the check couldn't be made, rather than nothing, and the open still succeeds", async () => {
+  await fixture({ psStatus: 503 }).run(["open", "kernel", "--provider", "herdr", "--json"]);
+  const result = JSON.parse(logs[0]!);
+  expect(result.notes).toEqual(["Couldn't check whether operator-agent@kernel, advisor-lead@kernel need attention: the rig list couldn't be read (HTTP 503: busy)."]);
+  expect(result.ok).toBe(true); expect(process.exitCode).toBeUndefined();
+});
+
+it("never gives a remote tile a same-named local seat's reason", async () => {
+  // The local advisor-lead@kernel is held; the opened advisor-lead@kernel tile is the one on host vm1.
+  const f = fixture({ remote: [{ seat: "advisor-lead@kernel", host: "vm1" }] });
+  await f.run(["open", "saved:fleet", "--provider", "herdr", "--json"]);
+  expect(JSON.parse(logs[0]!).notes).toEqual(["Couldn't check whether advisor-lead@kernel needs attention: it's on host vm1, which this daemon doesn't check."]);
+});
+
+it("an older daemon's result without host provenance checks no seat by name, even with a same-named local seat held", async () => {
+  // The older daemon names its remote advisor-lead@kernel tile by seat alone; the local one is held.
+  const f = fixture({ olderDaemon: true });
+  await f.run(["open", "saved:fleet", "--provider", "herdr", "--json"]);
+  const result = JSON.parse(logs[0]!);
+  expect(result.notes).toEqual(["Couldn't check whether operator-agent@kernel, advisor-lead@kernel need attention: the daemon didn't say which host each tile is on."]);
+  expect(f.get).not.toHaveBeenCalled();
+  expect(result.ok).toBe(true); expect(process.exitCode).toBeUndefined();
+});

packages/cli/test/terminal-window-tmux.test.ts

@@ -72,6 +72,7 @@ it.each([
   expect(tmux(viewer, ["list-panes", "-s", "-t", `=openrig-view-${id}`, "-F", "#{pane_dead}"]).trim().split("\n")).toEqual(Array(19).fill("0"));
   for (const page of [1, 2]) {
     expect(tmux(viewer, ["show-options", "-Awv", "-t", `openrig-view-${id}:view-${page}`, "window-size"]).trim()).toBe("latest");
+    expect(tmux(viewer, ["show-options", "-wv", "-t", `openrig-view-${id}:view-${page}`, "window-size"]).trim()).toBe("");
   }
 }, 40_000);
 

packages/cli/test/terminal-window.test.ts

@@ -309,6 +309,20 @@ describe("desktop terminal view", () => {
     expect(f.deps.launch).not.toHaveBeenCalled();
   });
 
+  it("carries the preview's remote list, so an opened tile's other host isn't mistaken for a local seat", async () => {
+    const f = fixture({ herdr: false });
+    Object.assign(f.preview, { remote: [{ seat: "advisor", host: "edge" }] });
+    const result = await openTerminalWindow(f.client, "saved:kernel", undefined, f.deps);
+    expect(result).toMatchObject({ ok: true, opened: ["tui", "advisor", "operator"], remote: [{ seat: "advisor", host: "edge" }] });
+  });
+
+  it("an older daemon's preview without a remote list leaves provenance unknown, never local", async () => {
+    const f = fixture({ herdr: false });
+    const result = await openTerminalWindow(f.client, "saved:kernel", undefined, f.deps);
+    expect(result.ok).toBe(true);
+    expect(result.remote).toBeUndefined();
+  });
+
   it("creates only a new tmux viewer with the composed three-column ordering", async () => {
     const f = fixture({ herdr: false });
     const result = await openTerminalWindow(f.client, "saved:kernel", undefined, f.deps);

packages/cli/test/terminal.test.ts

@@ -80,12 +80,12 @@ describe("rig terminal CLI", () => {
     process.exitCode = undefined;
   });
 
-  it("registers open/views/status/attach subcommands", () => {
+  it("registers open/close/views/status/attach subcommands", () => {
     const { deps } = makeDeps();
     const program = createProgram({ terminalDeps: deps });
     const cmd = program.commands.find((c) => c.name() === "terminal");
     expect(cmd).toBeDefined();
-    expect(cmd!.commands.map((c) => c.name()).sort()).toEqual(["attach", "open", "status", "views"]);
+    expect(cmd!.commands.map((c) => c.name()).sort()).toEqual(["attach", "close", "open", "status", "views"]);
   });
 
   it.each([false, true])("attaches using the daemon's effective server, preserving read-only=%s", async readOnly => {

packages/cli/test/up-restore-decision.test.ts

@@ -387,4 +387,95 @@ describe("rig up --existing — resume-original default (OPR.0.3.4.2)", () => {
     expect(output).toContain("e: failed");
     expect(exitCode).toBe(1);
   });
+
+  it("every seat running, some fresh without their conversation: one line says so, and the exit stays 1", async () => {
+    respond = () => ({
+      status: "restored", rigId: "rig-1", rigName: "myrig", rigResult: "partially_restored",
+      nodes: [
+        { logicalId: "orch.lead", status: "resumed" },
+        { logicalId: "dev.impl", status: "fresh-primed" },
+        { logicalId: "dev.qa", status: "fresh" },
+        { logicalId: "infra.shell", status: "fresh", noConversation: true },
+      ],
+      warnings: [],
+    });
+    const { logs, exitCode } = await captureLogs(async () => {
+      await makeCmd().parseAsync(["node", "rig", "up", "myrig", "--existing"]);
+    });
+    expect(logs).toContain("All 4 seats are running; 2 started fresh without their conversation. The restore isn't whole, so rig up exits 1.");
+    expect(exitCode).toBe(1);
+  });
+
+  it("one seat running fresh: the line reads for one seat", async () => {
+    respond = () => ({
+      status: "restored", rigId: "rig-1", rigName: "myrig", rigResult: "partially_restored",
+      nodes: [{ logicalId: "dev.impl", status: "fresh-primed" }],
+      warnings: [],
+    });
+    const { logs } = await captureLogs(async () => {
+      await makeCmd().parseAsync(["node", "rig", "up", "myrig", "--existing"]);
+    });
+    expect(logs).toContain("The one seat is running; 1 started fresh without their conversation. The restore isn't whole, so rig up exits 1.");
+  });
+
+  it("every seat running with a guidance or restore gap: the line names those seats and points at the warnings", async () => {
+    respond = () => ({
+      status: "restored", rigId: "rig-1", rigName: "myrig", rigResult: "partially_restored",
+      nodes: [
+        { logicalId: "orch.lead", status: "resumed", guidanceGaps: ["openrig-core"] },
+        { logicalId: "dev.impl", status: "resumed", restoreGaps: ["claude_activity_hooks: the current selection could not be re-applied: no Claude runtime adapter was available."] },
+        { logicalId: "dev.qa", status: "resumed" },
+      ],
+      warnings: ["Restore activity hooks: the current selection could not be re-applied: no Claude runtime adapter was available."],
+    });
+    const { logs, exitCode } = await captureLogs(async () => {
+      await makeCmd().parseAsync(["node", "rig", "up", "myrig", "--existing"]);
+    });
+    expect(logs).toContain("All 3 seats are running; orch.lead, dev.impl came back with a gap named in a warning. The restore isn't whole, so rig up exits 1.");
+    expect(exitCode).toBe(1);
+  });
+
+  it("a seat that isn't running gets no all-running line", async () => {
+    respond = () => ({
+      status: "restored", rigId: "rig-1", rigName: "myrig", rigResult: "partially_restored",
+      nodes: [
+        { logicalId: "dev.impl", status: "fresh" },
+        { logicalId: "ext.cli", status: "left_attached", error: "attached with rig attach; left as it is" },
+      ],
+      warnings: [],
+    });
+    const { logs, exitCode } = await captureLogs(async () => {
+      await makeCmd().parseAsync(["node", "rig", "up", "myrig", "--existing"]);
+    });
+    expect(logs.join("\n")).not.toContain("seats are running");
+    expect(exitCode).toBe(1);
+  });
+
+  it("a whole restore prints no summary line and exits 0", async () => {
+    respond = () => ({
+      status: "restored", rigId: "rig-1", rigName: "myrig", rigResult: "fully_restored",
+      nodes: [
+        { logicalId: "orch.lead", status: "resumed" },
+        { logicalId: "infra.shell", status: "fresh", noConversation: true },
+      ],
+      warnings: [],
+    });
+    const { logs, exitCode } = await captureLogs(async () => {
+      await makeCmd().parseAsync(["node", "rig", "up", "myrig", "--existing"]);
+    });
+    expect(logs.join("\n")).not.toContain("seats are running");
+    expect(exitCode).toBeUndefined();
+  });
+
+  it("help says what exit 1 means after a restore and where to look", () => {
+    let text = "";
+    const cmd = upCommand(deps());
+    cmd.configureOutput({ writeOut: (s) => { text += s; } });
+    cmd.outputHelp();
+    const help = text.replace(/\s+/g, " ");
+    expect(help).toContain("After a restore, rig up exits 0 only when the rig came back whole (rigResult fully_restored).");
+    expect(help).toContain("It exits 1 when it didn't (partially_restored, failed or not_attempted), including when every seat is running but some started fresh without their conversation, or came back with a guidance or restore gap.");
+    expect(help).toContain("read rigResult and each node's status, noConversation, guidanceGaps and restoreGaps to tell these apart");
+    expect(help).toContain("A refused request exits 1 for a conflict (HTTP 409, such as a rig still running or a restore not attempted) and 2 for any other refusal (400, 404 or 500, such as no rig by that name or a failed boot).");
+  });
 });

packages/daemon/assets/herdr-app/mods/rig-cell-header/main.js

@@ -0,0 +1,15 @@
+// OpenRig's Rig view cell header: the `<agent> · <slice>` title over a viewer, drawn like herdr's own pane header
+// (30 px, theme colours) and independent of terminal titles, so tmux `set-titles` can't overwrite it.
+// props: { title, detail, seat }
+import { View, div } from "gpui-kit";
+import { h_flex } from "gpui-base";
+import { props, theme } from "herdr";
+
+export default class RigCellHeader extends View {
+  render() {
+    const t = theme(), p = props() ?? {};
+    return h_flex().id("rig-cell-header").size_full().px(10).gap(8).items_center().bg(t.background).text_size(12)
+      .child(div().flex_none().truncate().max_w(320).font_medium().text_color(t.foreground).child(p.title ?? ""))
+      .child(div().flex_1().truncate().text_color(t.dim).child(p.detail ?? ""));
+  }
+}

packages/daemon/assets/herdr-app/mods/rig-cell-header/mod.json

@@ -0,0 +1 @@
+{ "place": "none" }

packages/daemon/assets/herdr-app/mods/rig-ended/main.js

@@ -0,0 +1,14 @@
+// OpenRig's Rig view cell for a viewer that ended. OpenRig writes it in place of the terminal block, so the layout
+// never references a dead terminal. props: { title }
+import { View, div } from "gpui-kit";
+import { v_flex } from "gpui-base";
+import { props, theme } from "herdr";
+
+export default class RigEnded extends View {
+  render() {
+    const t = theme(), p = props() ?? {};
+    return v_flex().id("rig-ended").size_full().items_center().justify_center().gap(4).bg(t.canvas).text_size(12)
+      .child(div().text_color(t.muted).child(`${p.title ?? "This viewer"} ended`))
+      .child(div().text_color(t.dim).child("Its seat is not touched. Open the view again to reattach."));
+  }
+}

packages/daemon/assets/herdr-app/mods/rig-ended/mod.json

@@ -0,0 +1 @@
+{ "place": "none" }

packages/daemon/assets/herdr-app/mods/rig-pad/main.js

@@ -0,0 +1,10 @@
+// OpenRig's Rig view padding cell: fills an equal grid when the seats don't.
+import { View, div } from "gpui-kit";
+import { theme } from "herdr";
+
+export default class RigPad extends View {
+  render() {
+    const t = theme();
+    return div().id("rig-pad").size_full().bg(t.canvas);
+  }
+}

packages/daemon/assets/herdr-app/mods/rig-pad/mod.json

@@ -0,0 +1 @@
+{ "place": "none" }

packages/daemon/assets/herdr-app/mods/rig-strip/main.js

@@ -0,0 +1,153 @@
+// OpenRig's Rig view strip: the header of the `rig-work` stack in OpenRig's Rig layout (layouts/rig.json).
+// Installed and updated by OpenRig when it opens a view; OpenRig writes its props on every layout write.
+//
+// - Pills: the person's tabs, then OpenRig's views. A click shows that stack child (layout.select).
+// - Entering a view (a click here, an explicit open, or a restart with one shown) focuses the cell the person was
+//   last in, else the first live cell. Never on a rewrite, never while the person is elsewhere.
+//   herdr-app reloads this strip whenever its props change, which is every OpenRig write, and keys a mod's storage by
+//   its props. So what the strip must remember (the cell per view, the child last shown, the revision it was shown
+//   with) lives in <app home>/openrig/strip.json. A reload with a new revision and the same shown child is a rewrite:
+//   nothing moves. The same revision is a restart: the shown view gets its remembered cell back.
+// - Keys: `rig-strip.left|right|up|down`, when the person binds them (keys.json section `layout:rig`), move the
+//   keyboard between a view's live cells; pad and ended cells are skipped.
+// - Acknowledgement: OpenRig stamps each write with a revision. When this strip renders a revision, its own shown
+//   layout carries that write, so it records the revision and the terminals the shown layout still references in
+//   <app home>/openrig/ack.json. OpenRig ends a viewer only after that record shows its cell is gone.
+//
+// props: { stack, main, revision, views: [{ id, name, rows: [[terminal|null, ...], ...] }] }
+import { View, div } from "gpui-kit";
+import { h_flex } from "gpui-base";
+import { props, theme, run, focused, layout, nextCommand, appHome, readTextFile, writeTextFile } from "herdr";
+
+function find(node, id) {
+  if (!node || typeof node !== "object") return null;
+  if (node.id === id) return node;
+  for (const child of node.children ?? []) { const hit = find(child, id); if (hit) return hit; }
+  return null;
+}
+
+function terminalsIn(node, out = []) {
+  if (!node || typeof node !== "object") return out;
+  if (typeof node.content?.terminal === "string") out.push(node.content.terminal);
+  for (const child of node.children ?? []) terminalsIn(child, out);
+  return out;
+}
+
+export default class RigStrip extends View {
+  init(_p, cx) {
+    const path = `${appHome()}/openrig/strip.json`;
+    readTextFile(path)
+      .then((text) => {
+        const state = JSON.parse(text);
+        if (!state || typeof state !== "object" || Array.isArray(state)) throw new Error("strip.json root is not an object");
+        this.saved = text;
+        this.state = state;
+      })
+      .catch(() => { this.saved = null; this.state = {}; })
+      .finally(() => { this.state ??= {}; this.state.cells ??= {}; this.loaded = true; cx.notify(); });
+    cx.spawn(async (cx) => {
+      for (;;) {
+        const command = await nextCommand();
+        if (command !== "focus") this.move(command);
+        cx.notify();
+      }
+    });
+  }
+
+  shown() {
+    const p = props() ?? {};
+    return find(layout(), p.stack)?.active ?? null;
+  }
+
+  view(id) {
+    return ((props() ?? {}).views ?? []).find((v) => v.id === id) ?? null;
+  }
+
+  move(dir) {
+    const view = this.view(this.shown());
+    const at = focused()?.terminal;
+    const step = { left: [0, -1], right: [0, 1], up: [-1, 0], down: [1, 0] }[dir];
+    if (!view || !at || !step) return;
+    const rows = view.rows;
+    let r = rows.findIndex((row) => row.includes(at));
+    if (r < 0) return;
+    let c = rows[r].indexOf(at);
+    for (;;) {
+      r += step[0]; c += step[1];
+      if (r < 0 || r >= rows.length || c < 0 || c >= rows[r].length) return;
+      if (rows[r][c]) { run("pane.focus", { terminal: rows[r][c] }); return; }
+    }
+  }
+
+  /** Records the strip's state; one write at a time, the latest state wins. */
+  persist() {
+    const text = JSON.stringify(this.state) + "\n";
+    if (text === this.saved || this.saving) { this.dirty = text !== this.saved && this.saving; return; }
+    this.saving = true;
+    const path = `${appHome()}/openrig/strip.json`;
+    readTextFile(path).catch(() => null)
+      .then((current) => writeTextFile(path, text, current))
+      .then(() => { this.saved = text; })
+      .catch((e) => console.log(`rig-strip: could not record its state: ${e}`))
+      .finally(() => { this.saving = false; if (this.dirty) { this.dirty = false; this.persist(); } });
+  }
+
+  enter(view) {
+    const live = view.rows.flat().filter(Boolean);
+    const remembered = this.state.cells[view.id];
+    const target = live.includes(remembered) ? remembered : live[0];
+    if (target) { run("pane.focus", { terminal: target }); this.state.cells[view.id] = target; }
+  }
+
+  // Focus only when the person enters a view: a change of the shown child, or a restart with one shown. A reload
+  // caused by an OpenRig write (a new revision, the same shown child) moves nothing, unless the cell the person was in
+  // has just ended while they are in that view: then the keyboard goes to a live cell instead of a dead one.
+  follow() {
+    if (!this.loaded) return;
+    const shown = this.shown(), view = this.view(shown), revision = (props() ?? {}).revision ?? null;
+    const remembered = view ? this.state.cells[view.id] : undefined;
+    const lost = !!(view && remembered && !view.rows.flat().includes(remembered));
+    if (!this.settled) {
+      this.settled = true;
+      const restart = revision === this.state.revision;
+      if (view && (shown !== this.state.shown || restart || lost)) this.enter(view);
+    } else if (view && (shown !== this.state.shown || lost)) this.enter(view);
+    this.state.shown = shown;
+    this.state.revision = revision;
+    const at = focused()?.terminal;
+    if (view && at && view.rows.some((row) => row.includes(at))) this.state.cells[view.id] = at;
+    for (const id of Object.keys(this.state.cells)) if (!this.view(id)) delete this.state.cells[id];
+    this.persist();
+  }
+
+  acknowledge() {
+    const p = props() ?? {};
+    if (!p.revision || p.revision === this.acked || this.acking) return;
+    const shown = layout();
+    // The shown layout carries this very write: its strip props hold the revision being acknowledged.
+    if (find(shown, p.stack)?.header?.content?.props?.revision !== p.revision) return;
+    this.acking = true;
+    const path = `${appHome()}/openrig/ack.json`;
+    const record = JSON.stringify({ revision: p.revision, terminals: terminalsIn(shown), at: new Date().toISOString() }) + "\n";
+    // A missing ack.json reads as null; any other read failure must not stop the acknowledgement either.
+    readTextFile(path).catch(() => null)
+      .then((current) => writeTextFile(path, record, current))
+      .then(() => { this.acked = p.revision; })
+      .catch((e) => console.log(`rig-strip: could not record revision ${p.revision}: ${e}`))
+      .finally(() => { this.acking = false; });
+  }
+
+  render() {
+    const t = theme(), p = props() ?? {};
+    this.follow();
+    this.acknowledge();
+    const active = this.shown();
+    const pill = (id, name) => div().id(`v-${id}`).px(10).h(24).flex().items_center().rounded(6).text_size(12)
+      .bg(id === active ? t.selected : t.chrome).text_color(id === active ? t.foreground : t.muted)
+      .hover((s) => s.bg(t.hover))
+      .on_click(() => run("layout.select", { stack: p.stack, child: id })).child(name);
+    return h_flex().id("rig-strip").size_full().px(8).gap(4).items_center().bg(t.chrome).border_b(1).border_color(t.border)
+      .child(pill(p.main ?? "main", "Your tabs"))
+      .children((p.views ?? []).map((v) => pill(v.id, v.name)));
+  }
+}

packages/daemon/assets/herdr-app/mods/rig-strip/mod.json

@@ -0,0 +1 @@
+{ "place": "none" }

packages/daemon/assets/openshell/README.md

@@ -128,7 +128,7 @@ Startup uses a private, hash-checked `control/first-input.txt` file and a bounde
 
 The placement name is supplied by the caller. Create refuses an already-listed name, and each binding retains its one selected name; OpenRig does not reserve names globally across bindings. Immediately before stop/delete, OpenRig checks the saved immutable identity, then the pinned vendor call addresses the name and workspace. A deliberate reuse of that name between inspection and the vendor call could affect the replacement. The pinned CLI has no expected-id condition for these calls. Later reconciliation cannot undo that mutation.
 
-Exact restore onto recreated compute stages the current resolved role, skills, plugins and required startup files as destination files, including files originally intended only for a fresh start. Declared context changes, additions and removals are allowed. Current source and destination bytes are verified through the ordinary projection checks; a missing or stale required destination refuses launch. Startup actions and text are not replayed into the conversation. The checkpoint pins the original native history and verified artifact bytes, which remain separate and unchanged; it does not freeze the context.
+Exact restore onto recreated compute stages the current resolved role, skills, plugins and required startup files as destination files, including files originally intended only for a fresh start. Declared context changes, additions and removals are allowed. Current source and destination bytes are verified through the ordinary projection checks; a missing or stale required destination refuses launch. Saved startup actions are not resent, but the restored guest's first input asks it to read the projected `CLAUDE.md` and its startup files again, so it takes in its startup content again and strict recall after a restore isn't met. The checkpoint pins the original native history and verified artifact bytes, which remain separate and unchanged; it does not freeze the context.
 
 A pending finite-completion attempt records its last outcome and attempt time in the existing operation receipt. Queue events and boot/manual checks observe it at most once per 60 seconds; there is no new polling timer. Eligibility is checked again after the driver's identity await, immediately before its stop command. A known refusal before dispatch releases only the unstarted effect claim; an uncertain dispatched request is never replayed. With no pending selection, a queue event performs one filtered query and no provider call; the operation table has no additional index or migration in this increment.