docs: teach what 0.7.9 changed in the map, references and three help texts (#2571 )

The packaged capability map takes in 0.7.9's changes, and its header marker moves to capability-delta-v0.7.9. Two lines 0.7.9 made stale are corrected: an emit now opens or notes an intake row for queue.worker, and any registered person can settle an ask asked of someone else, recorded as themselves. It also covers indeterminate receipts, --closure-required-at, guidance placement for fresh Pi and Codex 0.164.0+ seats with the cases that still use the repository's AGENTS.md, what rig down takes back and keeps, the rebuild for wrapper and symlink Claude launches, and the daemon HTTP client reference. rig-spec's managed_blocks and guidance_merge rows and agent-spec's target row say where guidance normally goes. Help text: rig stream emit names the intake row and how to keep emits passive, rig send --verify says exit 1 can mean unconfirmed, and rig down says what it takes back and what it keeps. Docs and help text only. (cherry picked from commit 73cf8138e7)
docs(capability-map): teach what 0.7.8 added and drop three sentences it made false (#2568 )
2026-11-08 08:11:17 -10:00 · 2026-11-05 17:33:38 +00:00 · 2026-11-05 14:48:13 +00:00 · 2026-11-05 13:00:36 +00:00 · 2026-11-05 12:59:03 +00:00 · 2026-11-05 12:00:50 +00:00
683 changed files with 44763 additions and 2972 deletions
@@ -116,7 +116,7 @@ jobs:
    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
    # file-inode behaviour and release tags.
    runs-on: macos-latest
-    timeout-minutes: 45
+    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
@@ -8,6 +8,924 @@ deprecations, and behavioral changes. Breaking changes are called out explicitly

 ---

+## [0.7.9]
+
+OpenRig 0.7.9 follows through on 0.7.8. A person's typed words on a runner
+seat's permission ask now reach the agent, each permit OpenRig grants a runner
+by default is recorded, and a runner can keep a long, quiet turn reading
+working. New stream observations go to the queue worker by default. Fresh Pi
+seats, and fresh Codex seats on Codex 0.164.0 or later, can keep OpenRig's
+guidance out of your repository's `AGENTS.md`. There are fixes across delivery,
+asks, handover, install and recovery. It includes a repair for the OpenShell
+worker that wasn't usable in 0.7.8, but that repair hasn't run end to end in our
+release testing: see [the OpenShell worker](#the-openshell-worker-hasnt-run-end-to-end-in-079).
+
+### Before you upgrade
+
+- **Restart the daemon after installing:**
+  ```bash
+  npm install -g @openrig/cli@0.7.9
+  rig daemon stop && rig daemon start
+  ```
+  Four migrations (146 to 149) record a Pi seat's guidance file, what OpenRig
+  last wrote in each managed guidance block, an index for reading a rig's
+  outbox, and the stream intake position.
+  ([#2432](https://github.com/mvschwarz/openrig/pull/2432), [#2461](https://github.com/mvschwarz/openrig/pull/2461), [#2496](https://github.com/mvschwarz/openrig/pull/2496), [#2321](https://github.com/mvschwarz/openrig/pull/2321))
+- **Stream intake is on by default.** Each `rig stream emit` now opens an
+  intake row for the kernel queue worker (`queue.worker`), or adds a note to the
+  one still unclaimed. The row wakes the queue worker like any queue row, and
+  earlier stream history isn't replayed. **To keep 0.7.8's behaviour,** with no
+  intake rows, run this after installing: `rig config set stream.intake off`.
+  ([#2321](https://github.com/mvschwarz/openrig/pull/2321))
+- **The bundled openrig-core plugin advances from 0.1.24 to 0.1.25.** Its
+  seat-continuity-and-handover skill changed. Managed refresh preserves replaced
+  files under `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits
+  you still need from that copy. ([#2420](https://github.com/mvschwarz/openrig/pull/2420), [#2554](https://github.com/mvschwarz/openrig/pull/2554))
+- **If you run an OpenShell environment, rebuild its guest image** with this
+  release's helper (`daemon/assets/openshell/README.md`). An older helper
+  rejects the new startup step, and the error names the rebuild. ([#2418](https://github.com/mvschwarz/openrig/pull/2418))
+
+### Runner seats
+
+- **A person's typed words reach the agent, and the ask says what they do.** A
+  reply of just yes or no counts as the agent's allow or reject. "Any other
+  words choose nothing": OpenRig's default permits the request when the agent
+  offered an allow option, and the words come back whole in the read result as
+  `said`. Section 7 of `docs/reference/harness-runner-contract.md` lets a runner
+  queue them for the agent "as an ordinary prompt" after the current turn:
+  "They're never the answer." A runner that drops them still keeps the contract.
+  ([#2363](https://github.com/mvschwarz/openrig/pull/2363), [#2561](https://github.com/mvschwarz/openrig/pull/2561))
+- **Each permit OpenRig grants by default is recorded,** once, as a stream item
+  from the seat: when no one can be asked, and when an ask is closed without a
+  choice (a row passed to an agent seat included). The record names the tool
+  call, why no person answered (for a closed ask, who closed which row and how),
+  the option the agent got with its kind, and the conversation and request or
+  the ask. Read the records with `rig stream list --tag runner-permission-permit`,
+  or `--source <seat>`. A record has no destination, and one that can't be
+  written doesn't change the permit. Stream intake reads past it, so it opens no
+  intake row and wakes no one. ([#2361](https://github.com/mvschwarz/openrig/pull/2361), [#2563](https://github.com/mvschwarz/openrig/pull/2563))
+- **A working beat keeps a long, quiet turn reading working.** A runner may post
+  `active` / `liveness` while a prompt is outstanding and its agent is alive
+  (section 4); one that sends no beats behaves as before. The Pi runner and the
+  dsh example post it. ([#2370](https://github.com/mvschwarz/openrig/pull/2370), [#2336](https://github.com/mvschwarz/openrig/pull/2336), [#2399](https://github.com/mvschwarz/openrig/pull/2399), [#2388](https://github.com/mvschwarz/openrig/pull/2388))
+- **The conformance check** covers the beat, and no longer falsely fails a
+  correct runner on a busy machine (cases 1, 2 and 4b).
+  ([#2368](https://github.com/mvschwarz/openrig/pull/2368), [#2375](https://github.com/mvschwarz/openrig/pull/2375), [#2388](https://github.com/mvschwarz/openrig/pull/2388), [#2530](https://github.com/mvschwarz/openrig/pull/2530))
+- **Section 8 names ACP's `session/resume`,** and the dsh example reads
+  `DSH_SEAT_BIN` and `DSH_SEAT_HOME`, which a member's `env:` can set, and
+  reports dsh's real version. ([#2364](https://github.com/mvschwarz/openrig/pull/2364), [#2414](https://github.com/mvschwarz/openrig/pull/2414))
+
+### The OpenShell worker hasn't run end to end in 0.7.9
+
+0.7.9 includes a repair for the OpenShell worker that wasn't usable in 0.7.8,
+but it hasn't run end to end in our release testing. Don't rely on this path in
+0.7.9. What the repair changes:
+- **Startup reaches the guest through a hash-checked first-input file.** Nothing
+  is typed through the host viewer, so startup text can't reach the host shell
+  if the viewer exits.
+- **Readiness checks the guest's own execution,** and opening the viewer does
+  one identity check instead of re-checking every projected file.
+- **A failed owned delete reports the stage that failed,** and whether its
+  dispatch is unknown.
+- **The README** names the kernel operator `operator-agent@kernel`.
+
+([#2418](https://github.com/mvschwarz/openrig/pull/2418), [#2404](https://github.com/mvschwarz/openrig/pull/2404))
+
+### Assistants connected through a grant service (experimental)
+
+**Experimental and unsupported. Off by default. Use at your own risk.** This path
+needs a grant service that you supply and run; ordinary use of OpenRig doesn't
+need one. With `rig mcp serve --http --grant-service <url>`, a connected
+assistant can now claim, update and park the rows addressed to its own seat, and
+see its team with `rig_team`, within the scope its existing tools have. Serving
+MCP over HTTP behind your own tunnel "is like opening a port in your firewall."
+See `docs/reference/hosted-members.md`. ([#2384](https://github.com/mvschwarz/openrig/pull/2384))
+
+### For client authors
+
+- **New reads:** `GET /api/gateway/participants` (people and the default
+  person), `GET /api/queue/open-human-updates` (a person's open updates, without
+  Slack), `GET /api/queue/outbox/list?rig=<rig>` (a rig's messages in one
+  request), and `GET /api/gateway/slack/channels` and `/users` (a page of public
+  channels or of people, without the client holding the bot token).
+  ([#2495](https://github.com/mvschwarz/openrig/pull/2495), [#2497](https://github.com/mvschwarz/openrig/pull/2497), [#2496](https://github.com/mvschwarz/openrig/pull/2496), [#2501](https://github.com/mvschwarz/openrig/pull/2501))
+- **Settle exactly the decision a person reviewed:** `GET /api/queue/:qitemId`
+  returns `decisionRevision`, and answer, resolve, approve and deny take an
+  optional `expectedRevision`. A stale one gets 409 `decision_revision_changed`
+  with nothing written; a caller that sends none acts as before. ([#2448](https://github.com/mvschwarz/openrig/pull/2448))
+- **A client reference:** `docs/reference/daemon-http-clients.md`, with a recipe
+  for people, open updates and a rig's outbox. ([#2490](https://github.com/mvschwarz/openrig/pull/2490), [#2524](https://github.com/mvschwarz/openrig/pull/2524))
+
+### Seats, delivery and the TUI
+
+- **Delivery:**
+  - a Claude prompt suggestion isn't taken for a person's draft;
+  - a long line Claude wraps short of the box is still submitted;
+  - a guarded wake recovers its own paste instead of holding later deliveries;
+  - a wake isn't typed into Claude's open Theme picker, or refused because a
+    reply quotes a permission question;
+  - a seat that starts, or takes over a seat, with held messages is told about
+    them; each watchdog job holds one reminder, and handoffs pass a full held
+    quota;
+  - a reminder that couldn't reach its seat, for example after a reboot, stays
+    owed and retries;
+  - a stalled tmux client is ended after 30 seconds.
+  ([#2435](https://github.com/mvschwarz/openrig/pull/2435), [#2436](https://github.com/mvschwarz/openrig/pull/2436), [#2447](https://github.com/mvschwarz/openrig/pull/2447), [#2514](https://github.com/mvschwarz/openrig/pull/2514), [#2520](https://github.com/mvschwarz/openrig/pull/2520), [#2437](https://github.com/mvschwarz/openrig/pull/2437), [#2442](https://github.com/mvschwarz/openrig/pull/2442), [#2438](https://github.com/mvschwarz/openrig/pull/2438), [#2478](https://github.com/mvschwarz/openrig/pull/2478), [#2452](https://github.com/mvschwarz/openrig/pull/2452))
+- **Status and receipts:**
+  - an idle Claude with newer footer rows reads idle, and a busy Codex with a
+    quiet window reads working;
+  - window samples older than their bound no longer decide a seat's activity, so
+    a seat whose pane can't be read reads unknown, not its last verdict;
+  - `rig send --verify` and `rig walk` report unconfirmed when they can't see the
+    result, and uncertain sends and broadcast recipients read `indeterminate`;
+  - a broadcast that reached nobody doesn't say "Delivered";
+  - replies to `human@kernel`, `human@host` and people forwarded from another
+    host get a usable `rig queue create` hint.
+  ([#2470](https://github.com/mvschwarz/openrig/pull/2470), [#2500](https://github.com/mvschwarz/openrig/pull/2500), [#2558](https://github.com/mvschwarz/openrig/pull/2558), [#2509](https://github.com/mvschwarz/openrig/pull/2509), [#2510](https://github.com/mvschwarz/openrig/pull/2510), [#2505](https://github.com/mvschwarz/openrig/pull/2505), [#2507](https://github.com/mvschwarz/openrig/pull/2507), [#2512](https://github.com/mvschwarz/openrig/pull/2512), [#2359](https://github.com/mvschwarz/openrig/pull/2359), [#2493](https://github.com/mvschwarz/openrig/pull/2493), [#2504](https://github.com/mvschwarz/openrig/pull/2504))
+- **Guidance and handover:**
+  - an edit to a culture or startup file reaches the next start, and a block you
+    edited by hand is kept and named;
+  - a shared `CLAUDE.md` or `AGENTS.md` stops growing by a line each launch;
+  - a Claude seat loads openrig-core's skills once;
+  - a fresh or rebuild handover successor gets its guidance back for every
+    runtime and a list of its startup files, role first, and is marked when a
+    required file is missing;
+  - launched successors can be stopped, restarted and cleaned, and the rebuild
+    receipt reports its lineage record and the old process truthfully;
+  - a Claude launched through the native installer's symlink can be rebuilt, a
+    slow classic resume under a non-exec launch shell no longer lands in
+    attention, and a `local:` Claude seat gets its activity hooks back on a
+    contained resume; restores use the seat's launch directory.
+  ([#2441](https://github.com/mvschwarz/openrig/pull/2441), [#2443](https://github.com/mvschwarz/openrig/pull/2443), [#2432](https://github.com/mvschwarz/openrig/pull/2432), [#2461](https://github.com/mvschwarz/openrig/pull/2461), [#2376](https://github.com/mvschwarz/openrig/pull/2376), [#2433](https://github.com/mvschwarz/openrig/pull/2433), [#2457](https://github.com/mvschwarz/openrig/pull/2457), [#2387](https://github.com/mvschwarz/openrig/pull/2387), [#2402](https://github.com/mvschwarz/openrig/pull/2402), [#2474](https://github.com/mvschwarz/openrig/pull/2474), [#2458](https://github.com/mvschwarz/openrig/pull/2458), [#2466](https://github.com/mvschwarz/openrig/pull/2466), [#2440](https://github.com/mvschwarz/openrig/pull/2440), [#2420](https://github.com/mvschwarz/openrig/pull/2420), [#2371](https://github.com/mvschwarz/openrig/pull/2371), [#2518](https://github.com/mvschwarz/openrig/pull/2518), [#2479](https://github.com/mvschwarz/openrig/pull/2479), [#2373](https://github.com/mvschwarz/openrig/pull/2373))
+- **Asks and answers:**
+  - in a shared workspace, any registered person settles another's ask as
+    themselves, and the first answer wins everywhere;
+  - a person may have no connector binding, and is then asked on Steering and in
+    the Feed only;
+  - a click on a re-parked Slack ask records a new answer and wakes its asker;
+  - a Slack ask's post shows it was handled once its row settles;
+  - For You no longer offers Approve on an ask with questions.
+  ([#2386](https://github.com/mvschwarz/openrig/pull/2386), [#2419](https://github.com/mvschwarz/openrig/pull/2419), [#2421](https://github.com/mvschwarz/openrig/pull/2421), [#2472](https://github.com/mvschwarz/openrig/pull/2472), [#2415](https://github.com/mvschwarz/openrig/pull/2415))
+- **Compaction:** managed compaction reads a small Claude pane at a readable
+  size; a manual `rig compact` that times out says whether the restore map was
+  ready; a Pi seat shows a failed or cancelled compaction as such.
+  ([#2445](https://github.com/mvschwarz/openrig/pull/2445), [#2400](https://github.com/mvschwarz/openrig/pull/2400), [#2537](https://github.com/mvschwarz/openrig/pull/2537))
+- **Install, hosts and setup:**
+  - the openrig-upgrade skill backs up without the sqlite3 CLI when Node has
+    `node:sqlite`;
+  - preflight warns when a Codex seat's login shell can't find `rig`;
+  - the experiment config can be written where Node has no `process.getuid`;
+  - bundle unpack restores archived owner bits;
+  - the Pi Node check is bounded, and `rig doctor` no longer hangs on a port held
+    by a listener that never replies;
+  - a scoped launch on tmux 3.4 keeps its default command;
+  - the kernel's template survives a daemon restart;
+  - `rig host ls` reads your ssh config with `ssh -G`, which runs any
+    `Match exec` command in it, and `rig host pair` names the bearer token the
+    target needs;
+  - the install docs describe the installer's step-4 outcome and the first
+    kernel's provider choice.
+  ([#2394](https://github.com/mvschwarz/openrig/pull/2394), [#2522](https://github.com/mvschwarz/openrig/pull/2522), [#2449](https://github.com/mvschwarz/openrig/pull/2449), [#2475](https://github.com/mvschwarz/openrig/pull/2475), [#2451](https://github.com/mvschwarz/openrig/pull/2451), [#2549](https://github.com/mvschwarz/openrig/pull/2549), [#2557](https://github.com/mvschwarz/openrig/pull/2557), [#2471](https://github.com/mvschwarz/openrig/pull/2471), [#2488](https://github.com/mvschwarz/openrig/pull/2488), [#2491](https://github.com/mvschwarz/openrig/pull/2491), [#2551](https://github.com/mvschwarz/openrig/pull/2551), [#2560](https://github.com/mvschwarz/openrig/pull/2560))
+- **The CLI:**
+  - unknown `--state`, `--kind` and `--priority` values warn and still run;
+  - `rig workspace validate` prints a readable refusal, and `rig seat set-runtime`
+    says what to do for a seat with no pane;
+  - a cut `rig queue show` body says how to get the rest;
+  - `rig queue update --closure-required-at` moves a claimed row's deadline;
+  - `rig seat set-typing-guard` applies from an ordinary terminal, recorded as
+    unattributed;
+  - `rig scope` tells shipped, superseded and closed slices apart, flags a slice
+    name two missions share, and skips fenced examples;
+  - `rig context add <url>` installs into a new nested name;
+  - a retained stuck-sweep recovery names its current reason, and a refused
+    context-pressure setting says what it compared.
+  ([#2357](https://github.com/mvschwarz/openrig/pull/2357), [#2365](https://github.com/mvschwarz/openrig/pull/2365), [#2358](https://github.com/mvschwarz/openrig/pull/2358), [#2367](https://github.com/mvschwarz/openrig/pull/2367), [#2383](https://github.com/mvschwarz/openrig/pull/2383), [#2422](https://github.com/mvschwarz/openrig/pull/2422), [#2460](https://github.com/mvschwarz/openrig/pull/2460), [#2351](https://github.com/mvschwarz/openrig/pull/2351), [#2434](https://github.com/mvschwarz/openrig/pull/2434), [#2492](https://github.com/mvschwarz/openrig/pull/2492), [#2395](https://github.com/mvschwarz/openrig/pull/2395), [#2546](https://github.com/mvschwarz/openrig/pull/2546), [#2552](https://github.com/mvschwarz/openrig/pull/2552), [#2553](https://github.com/mvschwarz/openrig/pull/2553))
+- **Launch options:** `specs.builtins_visible: false` leaves built-in specs out
+  of the inventory (`rig specs ls --include-builtins` still lists them).
+  `plugin_channels` passes a Claude member's own plugin channels to
+  `--channels`; beside `claude_mcp: none` it warns that no channel could
+  register, and the member still launches. We haven't run it with a real channel
+  plugin. ([#2379](https://github.com/mvschwarz/openrig/pull/2379), [#2439](https://github.com/mvschwarz/openrig/pull/2439))
+- **The TUI and web UI:**
+  - body text reads on a light terminal, and the selected row shows in
+    16-colour mode;
+  - JUST FINISHED and RECENTLY FINISHED show what closed last, in the configured
+    time zone, even on a busy fleet;
+  - a fresh seat opened in tiles is sized to its tile, and grid fillers open your
+    login shell;
+  - in the web UI, the Topology filter no longer hangs, and the kernel card and
+    maintenance notice display correctly.
+  ([#2499](https://github.com/mvschwarz/openrig/pull/2499), [#2506](https://github.com/mvschwarz/openrig/pull/2506), [#2392](https://github.com/mvschwarz/openrig/pull/2392), [#2393](https://github.com/mvschwarz/openrig/pull/2393), [#2459](https://github.com/mvschwarz/openrig/pull/2459), [#2464](https://github.com/mvschwarz/openrig/pull/2464), [#2465](https://github.com/mvschwarz/openrig/pull/2465), [#2411](https://github.com/mvschwarz/openrig/pull/2411), [#2413](https://github.com/mvschwarz/openrig/pull/2413), [#2412](https://github.com/mvschwarz/openrig/pull/2412))
+- **Also:**
+  - transcript search scans a long line once instead of once per chunk, with the
+    same results;
+  - a Slack transport error has the bot token removed (see Known limits);
+  - the hook-review check recognises a kernel Codex pane that runs under a shell;
+  - the reference docs cover a Slack private-channel route, missed-message
+    recovery, checked stops and slice status words, the spec scan, bundle hashes
+    and the Pi selector path.
+  ([#2397](https://github.com/mvschwarz/openrig/pull/2397), [#2503](https://github.com/mvschwarz/openrig/pull/2503), [#2416](https://github.com/mvschwarz/openrig/pull/2416), [#2494](https://github.com/mvschwarz/openrig/pull/2494), [#2401](https://github.com/mvschwarz/openrig/pull/2401), [#2489](https://github.com/mvschwarz/openrig/pull/2489), [#2462](https://github.com/mvschwarz/openrig/pull/2462), [#2543](https://github.com/mvschwarz/openrig/pull/2543), [#2477](https://github.com/mvschwarz/openrig/pull/2477), [#2369](https://github.com/mvschwarz/openrig/pull/2369), [#2403](https://github.com/mvschwarz/openrig/pull/2403))
+
+### Behaviour that changed
+
+- **Stream intake is on by default** (above). `off` keeps 0.7.8's behaviour.
+- **Fresh Pi seats, and fresh Codex seats on 0.164.0 or later, get OpenRig's
+  guidance outside the repository `AGENTS.md`:** Pi in its own agent folder
+  (unless that file or folder is a link), Codex as launch developer
+  instructions. Codex still uses the repository file for a resume, fork,
+  restore or handover successor, an older or unknown version, or a config layer
+  that sets `developer_instructions` or can't be read. If only your shell
+  startup sets `CODEX_HOME`, OpenRig reads `~/.codex`, so a
+  `developer_instructions` in your home is replaced for that session; declare
+  the same absolute path as `CODEX_HOME` in the member's or rig's `env:` to have
+  it checked.
+- **`rig down`** removes OpenRig's own additions from a working folder once no
+  live seat uses them.
+- **After upgrading, the Slack connector edits asks that ended earlier** to show
+  they were handled, at Slack's edit rate: about an hour for 450 asks.
+  `rig slack status` shows pending edits.
+- **A later answer to a settled ask** gets 409 `qitem_already_terminal` and
+  records nothing.
+- **`rig send --verify`** reports unconfirmed and exits 1, not delivered, when it
+  can't see what its Enter did.
+- **`rig export` with no `-o`** writes `rig-export.yaml` beside an existing
+  `rig.yaml` instead of replacing it. ([#2356](https://github.com/mvschwarz/openrig/pull/2356))
+- **`rig workspace validate`** exits 1 for malformed optional frontmatter.
+  ([#2396](https://github.com/mvschwarz/openrig/pull/2396))
+- **An active rig name that matches more than one rig** makes `rig env down`,
+  `status` and `logs` list the matching rig IDs and stop, and
+  `rig doctor --spec` report conformance as unknown, instead of using the first
+  match. ([#2548](https://github.com/mvschwarz/openrig/pull/2548), [#2550](https://github.com/mvschwarz/openrig/pull/2550))
+- **New default kernels** start in `<workspace.root>/kernel`. Existing kernels
+  stay where they are; `docs/reference/agent-startup-guide.md` describes the
+  optional move.
+
+### Known limits
+
+- **OpenShell:** the repair hasn't run end to end in our release testing
+  (above). 0.7.8's requirements, cost note and cleanup limits still apply,
+  including "Never grant the guest access to the daemon's main API port
+  (normally 7433)." A same-generation reconciled launch opens no viewer, so run
+  `rig environment connect` yourself; non-text startup actions aren't supported
+  on environment seats.
+- **Grant-service assistants aren't woken:** "an item stays queued until its
+  receiver claims it."
+- **Open updates for a person** read a 1,001-row window, so a page can come back
+  short, marked `truncated`.
+- **Slack:** a private channel needs the documented route, which we don't test,
+  and direct messages aren't supported. The channel and people reads haven't
+  been run against a live Slack workspace. Redaction of the bot token from a
+  transport error can still leave a malformed token fragment shorter than six
+  characters, so review an error before sharing it.
+- **SSH host status** reads `unknown` behind a ProxyJump or ProxyCommand; that
+  isn't proof the connection is broken.
+- **Shared asks:** "a click's option written before its answer row … can stand
+  beside or inside the closer's answer without the first clicker's authorship."
+- **Permit records** last as long as stream retention keeps them. A permit a
+  runner makes on its own, when it can't reach OpenRig, is in its pane only. For
+  an ask opened before 0.7.9, a record may omit the option's kind.
+- **Existing seats** pick up Codex launch instructions and the single skill load
+  at their next fresh launch. A `CLAUDE.md` or `AGENTS.md` that already grew
+  isn't trimmed.
+- **Codex hooks after an upgrade:** Codex sessions kept open across the 0.7.8
+  upgrade showed "Hook failed — plugin contents changed; hook approval
+  required". The 0.7.9 behaviour, and hook recovery after a relaunch, haven't
+  been verified.
+- **With Node outside the login shell's PATH,** Codex seats can still report
+  `rig: command not found`; preflight now warns, and the getting-started guide
+  gives the `~/.profile` fix.
+- **Fixed or changed from 0.7.8's limits:** the dsh example's `env:` names, the
+  conformance check's false failures, a person's typed words, the README's
+  operator address, a rebuild behind a symlink, the rebuild receipt, a click on
+  a re-parked ask, and recording a permit made when no one can be asked: a
+  person's answer is recorded on the ask, and a default permit as the stream
+  item above.
+- **The other 0.7.8 limits, and the 0.7.7 and 0.7.6 limits, below still apply.**
+
+### Credits
+
+Thanks to @porterchild, @Mohsintl, @Nikhi00718, @oodadoudou, @AdityaxDeore,
+@w4rc0n, @genius8267, @Aschenbath, @DeryFerd, @mohitdixit02, @Vaishnavi220506,
+@Nikhila-Dhevi-R, @natefaerber, @dajiaohuang, @Aummadour, @KM199 and @Totopo27
+for merged contributions, and to @todie and @seanmcn, whose fork work is carried
+in [#2439](https://github.com/mvschwarz/openrig/pull/2439) and [#2400](https://github.com/mvschwarz/openrig/pull/2400). Thanks to @ziadeh, @billbenetti, @eisenbergjerry,
+@ch-davidriott, @puniserv, @oneandonlydean, @sabnanikl-dev, @gifflen,
+@pvl-agent, @EZotoff, @adam-nectar, @bpamiri, @tgrundtvig, @aanestesia,
+@AdamWhitehurst and @eisenrigbot for reports carried into this release. Thanks
+also to @z4cc, @hitianqi, @jimallen, @m3ac-AllbrittenJ and @lkraider for reports
+and field feedback.
+
+## [0.7.8]
+
+Published 2026-11-05 as `@openrig/[email protected]`, built from the commit tagged
+`v0.7.8` (`12df562c`).
+
+OpenRig 0.7.8 lets a person answer a runner seat's permission requests, with a
+conformance check and an example runner to build against. It includes 0.7.7's
+fixes plus repairs across seats, tmux, Slack and the TUI. It also includes a
+reference for running a Claude worker in an NVIDIA OpenShell sandbox, but that
+worker isn't usable in this release: see [the OpenShell reference](#the-openshell-reference-isnt-usable-in-078).
+
+### Before you upgrade
+
+- **Restart the daemon after installing:**
+  ```bash
+  npm install -g @openrig/cli@0.7.8
+  rig daemon stop && rig daemon start
+  ```
+  Four migrations (142 to 145) store a Claude seat's MCP opt-out, seat activity
+  grants, OpenShell environment bindings and the person chosen to answer a
+  seat's permission requests.
+  ([#2177](https://github.com/mvschwarz/openrig/pull/2177), [#2295](https://github.com/mvschwarz/openrig/pull/2295), [#2296](https://github.com/mvschwarz/openrig/pull/2296), [#2301](https://github.com/mvschwarz/openrig/pull/2301))
+- **The bundled openrig-core plugin advances from 0.1.23 to 0.1.24.** One line
+  of its seat-continuity skill changed. Managed refresh preserves replaced files
+  under `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits you
+  still need from that copy. ([#2287](https://github.com/mvschwarz/openrig/pull/2287))
+
+### Permissions for runner seats
+
+- **A runner seat's permission requests now reach a person, and the default is
+  permit.** The runner contract's first version refused every request. Section 7
+  of `docs/reference/harness-runner-contract.md` now covers who is asked:
+  - **With a default person,** "They get an ordinary ask in the Feed and on
+    Slack. No setup is needed."
+  - **To choose someone else,** run
+    `rig seat set-permissions-to <seat> --to <person> --reason "…"`. `--clear`
+    returns to the default.
+  - **When no one can be asked,** the request is "Permitted at once, with the
+    agent's own allow option."
+  - **Refusal is opt-in,** with `--deny`.
+
+  "A person's no is never a grant." An unanswered request "stays pending and
+  visible" until the agent's turn ends: "It's never timed out into a grant."
+  ([#2301](https://github.com/mvschwarz/openrig/pull/2301))
+- **A runner conformance check:**
+  `node docs/reference/runner-conformance/check-runner.mjs --runner '<runner command with {agent}>' --name <harness>`.
+  It covers the answered path, and needs Node and tmux but no daemon, model,
+  credentials or network.
+  ([#2303](https://github.com/mvschwarz/openrig/pull/2303), [#2306](https://github.com/mvschwarz/openrig/pull/2306))
+- **An example runner for DeepSeek Harness (`dsh`),** with its preset, is under
+  `docs/reference/community-harness-examples/dsh/`. OpenRig doesn't install it.
+  ([#2305](https://github.com/mvschwarz/openrig/pull/2305))
+- **A seat activity grant** lets a runner outside the host's hook setup report
+  activity for one seat and launch, without the install-wide hook token. ([#2295](https://github.com/mvschwarz/openrig/pull/2295))
+
+### The OpenShell reference isn't usable in 0.7.8
+
+0.7.8 includes `rig environment` (`setup`, `create`, `attach`) and a reference
+for binding a seat to an NVIDIA OpenShell sandbox (`daemon/assets/openshell/README.md`).
+**In our release testing the worker never became usable:** after the sandbox was
+created and the native process started, `rig environment connect` failed when its
+check timed out after 5 seconds, so no team work ran. Don't rely on this path in
+0.7.8.
+([#2296](https://github.com/mvschwarz/openrig/pull/2296), [#2300](https://github.com/mvschwarz/openrig/pull/2300), [#2378](https://github.com/mvschwarz/openrig/pull/2378))
+
+### Seats, delivery and the TUI
+
+- **Seats:**
+  - an isolated tmux server per OpenRig home
+    (`rig config set terminal.tmux_server isolated`);
+  - `claude_mcp: none` for a Claude member;
+  - resuming with a new token file;
+  - first starts on `rig launch --seats`;
+  - an accurate account record and kept effort after `rig provider switch`;
+  - skill copies, activity hooks and startup declarations kept across
+    `rig down`, resumes and exports;
+  - clearer stops for handover's `fork:<seat>`, a missing conversation,
+    `claude` not found, Codex restart refusals and failed unpins.
+  ([#1260](https://github.com/mvschwarz/openrig/pull/1260), [#2177](https://github.com/mvschwarz/openrig/pull/2177), [#2269](https://github.com/mvschwarz/openrig/pull/2269), [#2342](https://github.com/mvschwarz/openrig/pull/2342), [#2344](https://github.com/mvschwarz/openrig/pull/2344), [#2337](https://github.com/mvschwarz/openrig/pull/2337), [#2338](https://github.com/mvschwarz/openrig/pull/2338), [#2190](https://github.com/mvschwarz/openrig/pull/2190), [#2297](https://github.com/mvschwarz/openrig/pull/2297), [#2287](https://github.com/mvschwarz/openrig/pull/2287), [#2255](https://github.com/mvschwarz/openrig/pull/2255), [#2282](https://github.com/mvschwarz/openrig/pull/2282), [#2330](https://github.com/mvschwarz/openrig/pull/2330), [#2332](https://github.com/mvschwarz/openrig/pull/2332))
+- **tmux:**
+  - with `OPENRIG_TMUX_CONTROL=1`, no crash on tmux 3.3a to 3.7c when the
+    control client ends while another leaves;
+  - a submit key that a read-only client blocks is pasted instead.
+  ([#2317](https://github.com/mvschwarz/openrig/pull/2317), [#2325](https://github.com/mvschwarz/openrig/pull/2325), [#2345](https://github.com/mvschwarz/openrig/pull/2345))
+- **Wakes:**
+  - `OPENRIG_WAKE_SUSPEND` matches destinations with a colon;
+  - prompt escalations stay deliverable without a reachable person;
+  - reminders stop at a full quota;
+  - `human@kernel` raises no false finding;
+  - OpenRig's own Codex hooks are trusted when no choice is recorded;
+  - refusals name their fix.
+  ([#2353](https://github.com/mvschwarz/openrig/pull/2353), [#2343](https://github.com/mvschwarz/openrig/pull/2343), [#2281](https://github.com/mvschwarz/openrig/pull/2281), [#2286](https://github.com/mvschwarz/openrig/pull/2286), [#2294](https://github.com/mvschwarz/openrig/pull/2294), [#2290](https://github.com/mvschwarz/openrig/pull/2290), [#2284](https://github.com/mvschwarz/openrig/pull/2284), [#2280](https://github.com/mvschwarz/openrig/pull/2280), [#2273](https://github.com/mvschwarz/openrig/pull/2273), [#2202](https://github.com/mvschwarz/openrig/pull/2202))
+- **Slack and usage:**
+  - typed replies to parked decisions are recorded as answers;
+  - row bodies render Markdown;
+  - resolved decisions stop showing as live asks;
+  - OpenRouter charge retries aren't delayed.
+  ([#2293](https://github.com/mvschwarz/openrig/pull/2293), [#2299](https://github.com/mvschwarz/openrig/pull/2299), [#2316](https://github.com/mvschwarz/openrig/pull/2316), [#2349](https://github.com/mvschwarz/openrig/pull/2349), [#2314](https://github.com/mvschwarz/openrig/pull/2314))
+- **Hosts and setup:**
+  - `rig host edit` and `rig host remove`;
+  - a warning when another OS user's daemon holds the port;
+  - `rig daemon status` shows a pending start.
+  ([#2310](https://github.com/mvschwarz/openrig/pull/2310), [#2346](https://github.com/mvschwarz/openrig/pull/2346), [#2302](https://github.com/mvschwarz/openrig/pull/2302), [#2348](https://github.com/mvschwarz/openrig/pull/2348))
+- **The TUI and views:**
+  - agent pages show health and recent work;
+  - pod, spec and instance-table views read correctly;
+  - `rig terminal open mission:<id> --follow --provider herdr` follows a
+    mission.
+  ([#2263](https://github.com/mvschwarz/openrig/pull/2263), [#2264](https://github.com/mvschwarz/openrig/pull/2264), [#2265](https://github.com/mvschwarz/openrig/pull/2265), [#2266](https://github.com/mvschwarz/openrig/pull/2266), [#2327](https://github.com/mvschwarz/openrig/pull/2327), [#2260](https://github.com/mvschwarz/openrig/pull/2260), [#2289](https://github.com/mvschwarz/openrig/pull/2289))
+- **Also:**
+  - MCP text is cut between whole characters;
+  - an ACP cancel survives a failed note;
+  - long transcript lines read faster;
+  - there are Pi and kernel dashboard recovery guides.
+  ([#2268](https://github.com/mvschwarz/openrig/pull/2268), [#2262](https://github.com/mvschwarz/openrig/pull/2262), [#2274](https://github.com/mvschwarz/openrig/pull/2274), [#2186](https://github.com/mvschwarz/openrig/pull/2186), [#2275](https://github.com/mvschwarz/openrig/pull/2275))
+
+### Behaviour that changed
+
+- **A runner following section 7 gets answers or permits, not refusals.**
+  `--deny` keeps a seat refusing.
+- **On tmux older than 3.7c,** `OPENRIG_TMUX_CONTROL=1` uses spawned clients
+  instead of a control client.
+
+### Known limits
+
+- **No harness has run end to end under the contract yet.** The dsh example and
+  the conformance check were checked against stand-ins.
+- **The answer owner is a registered person.** "A colleague's answer is
+  followed on this host. If the ask is handed to another host, the request
+  waits, shown as needs input, until the agent's turn ends."
+- **`allow_always` from a permit:** with no one to ask, "If the agent offers
+  only `allow_always`, the harness then remembers a permission nobody chose."
+- **"Permits and answers aren't recorded beyond the runner's pane and the ask
+  itself."**
+- **Coming as follow-ups:** recording a permit made when no one can be asked,
+  and passing a person's typed words that aren't a plain yes or no to the agent.
+- **The dsh example keeps one hold per seat:** "if dsh asks twice in one turn,
+  settling one ask releases the hold while the other may still wait on a
+  person."
+- **The worker isn't usable** (above). The reference also requires NVIDIA
+  OpenShell 0.1.6, a Linux image, and an API-backed provider using
+  `ANTHROPIC_API_KEY`; subscription or OAuth credentials aren't supported.
+  "Provider registration and image construction can incur costs." The worker's
+  activity reads unknown, from pane sampling, never idle.
+- **The OpenShell README example uses `operator@kernel`;** the actual kernel
+  operator is `operator-agent@kernel`.
+- **"Never grant the guest access to the daemon's main API port (normally
+  7433)."** The guest-only listener is what confines a guest's reach. Its grant
+  only authorizes requests for its own seat and launch.
+- **The 0.7.7 and 0.7.6 limits below still apply.**
+
+### Credits
+
+Thanks to @Aschenbath, @dajiaohuang, @Vaishnavi220506, @Nikhila-Dhevi-R,
+@Nikhi00718, @oodadoudou, @DeryFerd, @ch-davidriott, @vanducng, @Ethereal49,
+@AdityaxDeore and @Mydudeclaps for merged contributions. Thanks to @salbang,
+@ziadeh, @davey64, @bpamiri and @oneandonlydean for reports carried into this
+release, and to @bpamiri for dsh-seat, whose fake agent the conformance check's
+stand-in follows.
+
+## [0.7.7]
+
+Published 2026-11-02 as `@openrig/[email protected]`, built from the commit tagged
+`v0.7.7` (`f3d8bac4`). 0.7.7 is a separate reliability patch for 0.7.6. Its three
+fixes are also in 0.7.8.
+
+OpenRig 0.7.7 is 0.7.6 with three reliability fixes for managed Claude seats: an
+idle prompt under Claude's "Update installed" line is recognized again, managed
+compaction no longer types into a message you haven't sent, and a Claude seat
+launched through a wrapper script can be rebuilt again.
+
+### Before you upgrade
+
+- **Restart the daemon after installing** so the fixes take effect:
+  ```bash
+  npm install -g @openrig/cli@0.7.7
+  rig daemon stop && rig daemon start
+  ```
+  There are no database migrations. The bundled openrig-core plugin stays at
+  0.1.23 with unchanged files.
+
+### Fixed
+
+- **A Claude seat under the "Update installed" line reads idle again.** After
+  Claude installs an update, it prints "✔ Update installed · /restart to apply"
+  (or "Restart to apply") below its mode bar. OpenRig didn't recognize that line,
+  so a seat at an empty prompt read unknown instead of idle, and managed
+  compaction waited. Both spellings are now recognized; lines that only look
+  similar still read unknown. ([#2311](https://github.com/mvschwarz/openrig/pull/2311))
+- **Managed compaction no longer types into a draft.** With the optional typing
+  guard off (the default), compaction's preparation prompt could be pasted onto
+  a message someone had typed but not sent. Now the preparation prompt,
+  `/compact` and the restore prompts check the input box first: typed or
+  unreadable input holds the step with a reason. A held restore prompt goes ahead
+  on its own once the box is empty; a manual `rig compact` says why it stopped,
+  to be retried once the box is empty. An empty box or Claude's own suggestion
+  goes ahead.
+  ([#2347](https://github.com/mvschwarz/openrig/pull/2347))
+- **A Claude seat launched through a wrapper script can be rebuilt again.** On
+  0.7.6, `rig seat handover --source rebuild` on a seat whose `claude` is a `#!`
+  script that starts the real Claude without `exec` stopped after 30 seconds with
+  "Waiting to confirm the new Claude process in this pane", though the new Claude
+  was running. The readiness check now also accepts the script's own direct child
+  when it names this launch's conversation; every other check is unchanged.
+  ([#2341](https://github.com/mvschwarz/openrig/issues/2341), [#2354](https://github.com/mvschwarz/openrig/pull/2354))
+- **A failed handover no longer moves the seat's resume target** to the new,
+  unprimed conversation while the seat keeps its previous occupant.
+  ([#2354](https://github.com/mvschwarz/openrig/pull/2354))
+
+### Known limits
+
+- **Other reasons managed compaction can wait are unchanged.**
+- **The draft check reads the input box just before pasting.** Typing that starts
+  in the same moment can still be appended to.
+- **A Claude seat whose current occupant generation was never registered,** such as
+  an adopted Claude carrying another generation, or a managed launch whose tenure
+  record failed to write, keeps its first conversation token, but later hooks don't
+  move it.
+- **The 0.7.6 known limits below still apply.**
+
+### Thanks
+
+- @oneandonlydean for the report and the evidence in #2341.
+
+## [0.7.6]
+
+OpenRig 0.7.6 lets one terminal workspace follow the current owners of a slice's
+open work through handoffs and completions. It also keeps more seat settings
+through expansion and restore, reports retained dead panes honestly, and repairs
+queue and Slack delivery paths.
+
+### Before you upgrade
+
+- **Restart the daemon after installing** so the new code and database updates
+  take effect:
+  ```bash
+  npm install -g @openrig/cli@0.7.6
+  rig daemon stop && rig daemon start
+  ```
+  Two migrations add the selected account-home path to nodes and the runner
+  declaration to sessions. Both have prefix 141; their distinct full filenames
+  identify them. ([#2143](https://github.com/mvschwarz/openrig/pull/2143), [#2239](https://github.com/mvschwarz/openrig/pull/2239))
+- **The bundled openrig-core plugin advances from 0.1.22 to 0.1.23.** Claude's
+  activity hook clears permission marks after a tool batch. Managed refresh
+  preserves replaced files under `$OPENRIG_HOME/backups/managed-refresh/<id>/`;
+  reapply local edits you still need from that copy. ([#2209](https://github.com/mvschwarz/openrig/pull/2209))
+
+### Follow the work in a slice
+
+- **Open `rig terminal open slice:<name-or-id> --follow --provider herdr`.**
+  Membership comes from pending, in-progress and blocked queue rows tagged with
+  that exact slice. Owners appear once with all their obligations listed;
+  unavailable owners and tile overflow stay named.
+  Handoffs retain the association unless their tags are replaced. New slice
+  views default to four automatic tiles; `--max-tiles` changes that. Known empty
+  slices stay following; incomplete reads retain the previous viewers. Pins,
+  drafts, unknown input and focus retain departed viewers, and closing a viewer
+  never stops its agent. Slice following targets the Linux Herdr 0.9.5 /
+  protocol 22 path. Mission following is not included.
+  ([#2259](https://github.com/mvschwarz/openrig/pull/2259))
+- **Named Herdr sessions use their configured endpoint throughout viewer and
+  follow operations.** The TUI's terminal action opens the agent, pod or rig
+  currently in view. ([#2205](https://github.com/mvschwarz/openrig/pull/2205), [#2232](https://github.com/mvschwarz/openrig/pull/2232))
+- **Client-visible HTTP change:** `/api/terminal/viewer/ensure` now returns 400
+  for `view_required` and `unknown_provider`, where it returned 200 with an
+  error body. Clients should continue reading the body code. Missing slice
+  identities return 404; ambiguous or unavailable identities return 409.
+  ([#2259](https://github.com/mvschwarz/openrig/pull/2259))
+
+- **When a slice's folder name repeats across missions, tag its work with the
+  slice's unique ID** (`rig queue create --slice <id>`) or add
+  `--mission <mission>`. A row tagged only with the shared name cannot be placed,
+  so the view reads incomplete until it is.
+  ([#2261](https://github.com/mvschwarz/openrig/pull/2261))
+
+- **A join refused before a pane split can join on a later refresh.** Hold
+  notices keep the seat and phase. The first notice keeps the original reason;
+  later notices can show a generic reason, while the original failure remains
+  in the journal. A created viewer whose attach has not yet run can continue
+  without replacing its pane.
+  ([#2271](https://github.com/mvschwarz/openrig/pull/2271))
+
+### Seats, accounts and harnesses
+
+- **Expansion keeps the member settings accepted by `rig up`,** including env,
+  effort and startup settings. Restores retain the model saved with
+  `rig seat set-model`. ([#2250](https://github.com/mvschwarz/openrig/pull/2250), [#2227](https://github.com/mvschwarz/openrig/pull/2227), [#2228](https://github.com/mvschwarz/openrig/pull/2228))
+- **Move a running Codex or Claude Code seat to an existing account home** with
+  `rig provider switch --seat <seat> --to-account <name> --account-home <dir>`;
+  preview with `--dry-run`. This starts a fresh conversation with a handover,
+  retaining the seat's address and work. `--clear-account-home` returns to the
+  configured defaults. ([#2143](https://github.com/mvschwarz/openrig/pull/2143))
+- **Claude subscription/API-key switching has a same-conversation path:**
+  `rig provider switch --seat <seat> --to-account api --api-key-file <abs>`;
+  return with `--to-account plan --token-file <abs>`. In-flight work is
+  interrupted. The API-key path remains unqualified; verify the resulting
+  account and conversation. A new Claude member can instead name a prepared
+  subscription token in its spec with `claude_token: {label: name, file: /abs/token}`.
+  ([#2191](https://github.com/mvschwarz/openrig/pull/2191), [#2246](https://github.com/mvschwarz/openrig/pull/2246))
+- **Relaunch retains the selected seat and its observed executable.** Codex
+  identity reads preserve OS argument boundaries, and in-place restart can
+  recognize a verified Node launcher named `MainThread`. This does not establish
+  that the reported #2200 restart refusal is fixed. ([#2196](https://github.com/mvschwarz/openrig/pull/2196), [#2212](https://github.com/mvschwarz/openrig/pull/2212), [#2247](https://github.com/mvschwarz/openrig/pull/2247))
+- **Managed seats inherit the daemon's SSH agent socket** for git over SSH;
+  check the daemon's agent with `ssh-add -l`. ([#2222](https://github.com/mvschwarz/openrig/pull/2222))
+- **Community presets can report turns and accept a declared model.**
+  `runner: true` with `launch_result: true` records runner activity per launch.
+  `passes_model: true` passes the requested model as `OPENRIG_MODEL`; it does not
+  observe the effective model. The Cursor and Hermes examples leave this off
+  pending native qualification. These are opt-in preset fields, not a completed
+  integration with every harness. ([#2239](https://github.com/mvschwarz/openrig/pull/2239), [#2243](https://github.com/mvschwarz/openrig/pull/2243))
+
+- **Draft integration author contracts** describe harness, runner and platform
+  duties, distinguishing implemented interfaces from proposals. Start at
+  [the author-contract entry point](docs/reference/author-contracts.md).
+  ([#2272](https://github.com/mvschwarz/openrig/pull/2272))
+
+### Delivery and Slack
+
+- **Original queue wakes retry after a selection prompt clears.** Retries identify
+  OpenRig as the sender, workflow entry keeps its caller, and prompt-blocked
+  alerts remain routable when the original sender is on another host.
+  ([#2235](https://github.com/mvschwarz/openrig/pull/2235), [#2229](https://github.com/mvschwarz/openrig/pull/2229), [#2237](https://github.com/mvschwarz/openrig/pull/2237))
+- **Work sent to a terminal-only seat gets a recovery finding for a person.**
+  Cross-host `rig queue create --verify` reads the destination's receipt;
+  unreadable receipts remain unconfirmed without replaying the create.
+  ([#2192](https://github.com/mvschwarz/openrig/pull/2192), [#2193](https://github.com/mvschwarz/openrig/pull/2193))
+- **Slack button answers resume decisions parked on the person asked.** Replies
+  Slack places outside a deleted thread are recorded at their actual location,
+  so the next reply reaches the right conversation. ([#2245](https://github.com/mvschwarz/openrig/pull/2245), [#2240](https://github.com/mvschwarz/openrig/pull/2240))
+- **Use `rig slack setup --reactions off` to stop acknowledgement emoji waking
+  agents.** The default remains `route`, and regenerating the app manifest
+  preserves the choice. Alert selection filters eligible notifications without
+  dropping older eligible asks behind an arbitrary row cap. ([#2241](https://github.com/mvschwarz/openrig/pull/2241), [#2183](https://github.com/mvschwarz/openrig/pull/2183))
+
+### Status, inventory and help
+
+- **A readiness deadline no longer ends a still-starting daemon.** The CLI
+  returns a nonzero pending result naming the child PID, launch endpoint and
+  log. It leaves the child running and retains the startup reservation, without
+  declaring readiness or allowing a duplicate start. Follow that pending
+  guidance before recovery. ([#2267](https://github.com/mvschwarz/openrig/pull/2267))
+- **A verified exited process in a retained pane reads `pane_exited`,** instead
+  of running and ready. Inventory avoids discarded graph loads, scopes startup
+  history to the requested rig's nodes, and reuses node identity for activity
+  reads. These changes make no universal latency claim. ([#2248](https://github.com/mvschwarz/openrig/pull/2248), [#2225](https://github.com/mvschwarz/openrig/pull/2225),
+  [#2226](https://github.com/mvschwarz/openrig/pull/2226), [#2236](https://github.com/mvschwarz/openrig/pull/2236))
+- **Completed mission labels reflect accepted proof**, without making proof
+  readiness complete a mission. Snapshot ages use UTC correctly; emoji stay
+  whole when TUI health, config and rig-table cells are shortened. ([#2249](https://github.com/mvschwarz/openrig/pull/2249),
+  [#2251](https://github.com/mvschwarz/openrig/pull/2251), [#2252](https://github.com/mvschwarz/openrig/pull/2252), [#2253](https://github.com/mvschwarz/openrig/pull/2253))
+- **Smaller command fixes:** chatroom tmux rig names stay literal; a trailing
+  slash in `OPENRIG_URL` still identifies the same daemon; a trailing slash in
+  the missions root no longer hides a slice's mission. `rig host doctor` names
+  the entry replies actually reach. ([#2218](https://github.com/mvschwarz/openrig/pull/2218), [#2220](https://github.com/mvschwarz/openrig/pull/2220), [#2221](https://github.com/mvschwarz/openrig/pull/2221), [#2214](https://github.com/mvschwarz/openrig/pull/2214))
+- **Help and contributor checks:** edge help explains deferred escalation
+  targets; section addressing ignores HTML comments; the guide covers shared
+  kernel-dashboard recovery. Install pins, help links and earlier release text
+  are corrected. Scenario fixtures honor send verification, execute tmux
+  directly, and reject unknown step verbs at schema load. ([#2204](https://github.com/mvschwarz/openrig/pull/2204), [#2211](https://github.com/mvschwarz/openrig/pull/2211),
+  [#2213](https://github.com/mvschwarz/openrig/pull/2213), [#2238](https://github.com/mvschwarz/openrig/pull/2238), [#2244](https://github.com/mvschwarz/openrig/pull/2244), [#2254](https://github.com/mvschwarz/openrig/pull/2254), [#2256](https://github.com/mvschwarz/openrig/pull/2256), [#2257](https://github.com/mvschwarz/openrig/pull/2257), [#2215](https://github.com/mvschwarz/openrig/pull/2215), [#2216](https://github.com/mvschwarz/openrig/pull/2216),
+  [#2217](https://github.com/mvschwarz/openrig/pull/2217))
+
+### Known limits
+
+- **The Codex hook-refresh refusal in [#2200](https://github.com/mvschwarz/openrig/issues/2200)
+  remains unresolved.** If `rig seat restart <seat> --keep-conversation` refuses,
+  nothing is stopped: leave the seat running and report the refusal with CLI
+  and daemon versions. A refused restart has not refreshed the hooks.
+- **A viewer whose attach already ran and then exited back to a shell is not
+  restarted automatically.** The whole slice view can hold until that tile is
+  resolved. No tested workaround is offered for that case.
+- **Following protects uncertain input by retaining tiles.** A larger workspace
+  or explicit `--max-tiles` can help with overflow. Protected Codex delivery can
+  still retain messages it cannot confirm before paste; retained is not
+  delivered. Disabling its typing guard removes protection and is not recovery.
+- **Internet-facing hosted members remain experimental, unsupported, off by
+  default and at your own risk.** Slice following does not require them.
+
+### Credits
+
+Thanks to @seanmcn, @DeryFerd, @Aschenbath, @Vaishnavi220506, @bradvin,
+@jay23606, @rudycelekli and @Nikhi00718 for merged contributions, and to
+@akushonkamen, @jcmurrayii, @KM199 and @pdurlej for contributed changes, reports
+and reproductions carried into this release.
+
+## [0.7.5]
+
+OpenRig 0.7.5 adds `rig terminal open qitem:<id> --follow`: keep one terminal
+workspace as a task's current owners join and leave. Joining viewers do not
+request focus; departures remove viewers, not the agents or conversations.
+Follow mode is scoped to Linux Herdr 0.9.5 / protocol 22. The exercised journey
+used shell stand-ins; real-agent follow qualification and active render cost
+are not established by that result. Changes since 0.7.4:
+
+### Before you upgrade
+
+- **Restart the daemon after installing** to run the new code and database
+  update. Migration 126 adds deferred `escalates_to` target addresses to the
+  edges table, preserving existing edges. Previously inert escalation edges
+  now affect recovery for seats without a delegation parent.
+  ```bash
+  npm install -g @openrig/cli@0.7.5
+  rig daemon stop && rig daemon start
+  ```
+- **The bundled openrig-core plugin goes from 0.1.21 to 0.1.22.** Its
+  `queue-handoff` skill teaches agents to park waits on CI or a long job with
+  a continuation and wake. As before, managed refresh preserves replaced
+  files under `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply any local
+  edits you still need from that copy. No setting is added or removed.
+- **A Codex hook-refresh refusal remains unresolved.** The earlier remedy
+  `rig seat restart <seat> --keep-conversation --reason "refresh hooks"`
+  (preview with `--plan`) was reported to refuse one Codex seat upgraded from
+  0.6.x. Its cause is unknown: the inspected 0.7.4 check already accepts the
+  reported process tree. [#2200](https://github.com/mvschwarz/openrig/issues/2200)
+  is not fixed in 0.7.5; this is not an established refusal of all staged-script
+  launches. A refused restart does not complete the hook refresh. If it
+  refuses, nothing is stopped: leave the seat running and report the refusal
+  with CLI and daemon versions. If Codex asks for hook review, review the
+  hooks you intend to enable.
+
+### Follow one task in one workspace
+
+- **Follow the current owners of a queue item:**
+  `rig terminal open qitem:<id> --follow --provider herdr`. The view derives
+  membership from the task's open rows and explicitly linked successors.
+  Joining seats get verified viewer tiles in the same workspace. A complete
+  empty task drains removable tiles and keeps the workspace; after retained
+  tiles are gone, following stops. Run `--follow` again to resume it.
+  ([#2199](https://github.com/mvschwarz/openrig/pull/2199))
+- **Keep control of the view:** `--pin`, `--unpin`, `--suppress`,
+  `--unsuppress`, `--suppression-ms` and `--max-tiles` adjust presentation.
+  `--no-follow` leaves the layout in place. The default is eight tiles,
+  four seconds of departure grace and twelve more seconds for a focused
+  leaver. Pins can exceed the cap; input-retained leavers do not consume a
+  joining seat's slot. See [terminal sessions](docs/reference/terminal-sessions.md).
+  ([#2199](https://github.com/mvschwarz/openrig/pull/2199))
+- **Uncertain input keeps its tile.** Typed drafts and unreadable composers
+  retain departed viewers, including Pi, terminal and community harness
+  seats whose input cannot be confirmed. Unpinning does not override that.
+  There is one delayed input recheck, then queue/session events or an explicit
+  follow command can reconsider it. Failed or incomplete reads retain the
+  previous view with an explanation. Activity hooks do not trigger renders.
+  ([#2199](https://github.com/mvschwarz/openrig/pull/2199))
+- **Protected Codex delivery no longer strands a message it can't submit.** On a
+  Codex seat whose typing guard is draft-aware or openrig-urgent, a message
+  whose complete text can't be confirmed visible before paste is retained, not
+  sent, instead of being pasted where it can't be submitted. The default (guard
+  off) is unchanged. Use a larger pane or a shorter message; turning the typing
+  guard off turns draft protection off and is not a recovery. Pastes over 1,000
+  code points are retained. Wrapped lines use a conservative bound, so most
+  wrapped wakes in common four-tile views can be retained even when they fit
+  natively; approximate standard-envelope examples are one-paragraph bodies over
+  about 115 characters at 80×22, 192 at 80×24, or 526 at 120×30 (examples, not
+  limits). A later resize is not atomic, and layouts with Codex's image-enabled
+  ambient pet are unqualified.
+  ([#2242](https://github.com/mvschwarz/openrig/pull/2242))
+- **Codex 0.164's two-row composer footer is recognized.** A departed Codex
+  agent's empty composer no longer reads as unconfirmed input that keeps its
+  tile. Delivery's draft-aware and openrig-urgent typing guards use the same
+  reader, so an empty Codex 0.164 composer there can now receive typed
+  delivery. ([#2206](https://github.com/mvschwarz/openrig/pull/2206))
+- **Clients can ensure a missing viewer without relaying out existing panes**
+  through `POST /api/terminal/viewer/ensure`. It rechecks task membership and
+  existing viewer identity before creating or reusing a tile. Preview names
+  `not-provisioned`, `verified` or `unconfirmed`; membership gives no input
+  authority. This path has the same Linux Herdr 0.9.5 / protocol 22 scope.
+  ([#2133](https://github.com/mvschwarz/openrig/pull/2133))
+- **An unconfirmed pane no longer counts as opened.** CLI and TUI output name
+  it as degraded with `pane_unconfirmed`, distinguish it from a skipped seat,
+  and omit its restart-command report. An all-unconfirmed open exits nonzero.
+  Inspect before retrying; this is not proof that nothing opened.
+  ([#2173](https://github.com/mvschwarz/openrig/pull/2173))
+
+### Fixes by what you see
+
+- **Slow successful sends have time to answer.** Local and HTTP `rig send`
+  wait 60 seconds, plus an explicit idle wait, instead of five seconds locally
+  or thirty over HTTP. A timeout still means unconfirmed. The advice now says
+  that a busy recipient may hold input off-screen: missing pane text does not
+  prove non-delivery, so reconcile before another send or duplicate queue item.
+  No automatic resend is added. This does not diagnose the daemon's latency.
+  ([#2198](https://github.com/mvschwarz/openrig/pull/2198))
+- **A wake that was unroutable before its seat had a pane is retried once the
+  binding exists,** through the row's existing wake intent. The outbox does
+  not send that same intent again after it is settled as delivered.
+  ([#2170](https://github.com/mvschwarz/openrig/pull/2170))
+- **A parentless seat's recovery can follow its declared `escalates_to`
+  address,** including another rig on the same daemon. A delegation parent
+  still takes precedence. Unavailable or ambiguous targets use the explained
+  fallback; an already-open recovery keeps its recorded owner. This is one
+  escalation hop, not cross-host routing.
+  ([#1772](https://github.com/mvschwarz/openrig/pull/1772))
+- **A stuck finding needs evidence to close.** Delivery, pickup or explicit
+  custody can resolve it; a changed reporting threshold, an unreadable
+  registry or a failed wake becoming unconfirmed cannot silently clear it.
+  ([#2153](https://github.com/mvschwarz/openrig/pull/2153))
+- **Fresh Claude handovers wait for the current launch.** Retained scrollback
+  or an echoed shell command cannot make a new process look ready. The context
+  packet waits for the matching process and Claude's complete drawn input frame.
+  ([#2159](https://github.com/mvschwarz/openrig/pull/2159))
+- **Runtime send refusals return HTTP 409 rather than 500.** A stale recorded
+  Claude pane names `rig reconcile-session <seat>` as the repair; nothing is
+  typed on that refusal. ([#2157](https://github.com/mvschwarz/openrig/pull/2157))
+- **`rig down` keeps a rig down after a rolled-back start.** It records the
+  explicit stop without rewriting the superseded session's history. The
+  `rig start --last` help now explains which rigs return and how an explicit
+  stop keeps them out; the kernel is not selected by `--last`.
+  ([#2166](https://github.com/mvschwarz/openrig/pull/2166))
+- **Status and configuration describe the selected rig.** `rig ps` reports
+  `periodicSnapshotActive` only for rigs the scheduler actually snapshots
+  ([#2168](https://github.com/mvschwarz/openrig/pull/2168)); the web Overview
+  reads the rig's current exported configuration instead of a same-named
+  library template ([#2188](https://github.com/mvschwarz/openrig/pull/2188)).
+- **Host labels and next steps are clearer.** The TUI shows the configured
+  local host name while retaining its stable identity
+  ([#2162](https://github.com/mvschwarz/openrig/pull/2162)). `rig host add` and
+  `pair` explain how to opt an HTTP host into remote Feed attention; registration
+  leaves that setting unchanged ([#2179](https://github.com/mvschwarz/openrig/pull/2179)).
+- **Small CLI corrections:** `attach --self` reads tmux's rewritten separators
+  ([#2178](https://github.com/mvschwarz/openrig/pull/2178)); transcript and
+  capture line counts use their normalized values on local and remote paths
+  ([#2164](https://github.com/mvschwarz/openrig/pull/2164)); stdio MCP warns on
+  out-of-range daemon ports while continuing to serve, without substituting a
+  port ([#2160](https://github.com/mvschwarz/openrig/pull/2160)).
+- **Notification adapters release unread HTTP response bodies,** without
+  changing their send result or waiting for cleanup. No performance improvement
+  is claimed here. ([#2172](https://github.com/mvschwarz/openrig/pull/2172))
+- **Scope audits agree on slice folders numbered 100 and above.** The guide
+  also explains that moving a slice reopens its proof judgments; a clean
+  structural audit is not a proof judgment.
+  ([#2194](https://github.com/mvschwarz/openrig/pull/2194))
+
+### Presets, hosted members and guides
+
+- **The `pi-tui` example runs Pi's own terminal UI as a community harness.**
+  It gives each seat its own Pi agent folder and passes startup input to Pi.
+  One Pi 1.4.0 / OpenRig 0.7.4 run showed a parked wake returning to the same
+  session and an unattended handoff to a second seat. It did not prove Pi
+  chooses that coordination by itself. Resume is not declared. Use it
+  unattended: a wake can submit a person's half-typed draft, and unrecognized
+  dialogs can receive the send. Busy-turn wakes and other Pi versions remain
+  unqualified. ([#2182](https://github.com/mvschwarz/openrig/pull/2182),
+  [#2184](https://github.com/mvschwarz/openrig/pull/2184))
+- **Interactive Pi setup is explicit:** copy the coordination skills and use
+  `delivery_hint: send_text` for a startup file that must reach a preset's
+  first input. A plain terminal seat does not receive queue wakes. Setting its
+  typing guard to `off` can type notices into a shell; keep the default for a
+  seat that can return to one. These are documented limits, not new guards.
+  ([#2174](https://github.com/mvschwarz/openrig/pull/2174),
+  [#2180](https://github.com/mvschwarz/openrig/pull/2180),
+  [#2181](https://github.com/mvschwarz/openrig/pull/2181),
+  [#2185](https://github.com/mvschwarz/openrig/pull/2185))
+- **Hosted-member guidance names its real reach.** A member without a wake
+  trigger checks work when its owner next starts a session; a listed tool is
+  not a grant, and completed work closes with `no-follow-on`. Hosted members
+  exposed over the internet remain **experimental, unsupported, off by default
+  and at your own risk**. The guide explains narrow grants and token revocation;
+  this terminal-follow release requires no internet exposure.
+  ([#2187](https://github.com/mvschwarz/openrig/pull/2187),
+  [#2189](https://github.com/mvschwarz/openrig/pull/2189))
+- **Publishing a team bundle:** add and declare a README after `rig export`,
+  then run `rig bundle check` at the revision being submitted
+  ([#2176](https://github.com/mvschwarz/openrig/pull/2176)). Queue guidance
+  teaches parking long waits with a continuation and wake
+  ([#2167](https://github.com/mvschwarz/openrig/pull/2167)).
+- **Contributor maintenance:** the test guide corrects installed-scenario
+  counts and cases ([#2165](https://github.com/mvschwarz/openrig/pull/2165));
+  the compaction receipt fixture shares one clock, with no product change
+  ([#2169](https://github.com/mvschwarz/openrig/pull/2169)). Published release
+  notes, the capability map and roadmap records were carried forward
+  ([#2161](https://github.com/mvschwarz/openrig/pull/2161),
+  [#2175](https://github.com/mvschwarz/openrig/pull/2175),
+  [#2197](https://github.com/mvschwarz/openrig/pull/2197)).
+
+### Limits carried forward
+
+- **Follow mode is Linux Herdr 0.9.5 / protocol 22 only.** Other platforms,
+  providers and selector kinds retain one-shot open. Its exercised journey
+  used shell stand-ins, not native agents. Active render cost is unmeasured.
+  The first workspace on an empty provider may gain focus, and a viewer can
+  resize the agent's terminal; `ignore-size` is not resize isolation.
+- **Unreadable composers retain departed tiles.** This includes input the
+  inspector cannot read on Pi, terminal or community harness seats; unpinning
+  alone does not establish that closing is safe.
+- **Escalation across rigs is same-daemon only.** Upgrade followed by snapshot
+  restore of deferred escalation targets has not been qualified.
+- **A webhook 2xx is acceptance of the ring, not pickup.** A hosted member's
+  activity remains unknown between calls. Principals record attribution, not
+  authentication. See [hosted members](docs/reference/hosted-members.md).
+- **Reviewed-history resume remains a client operation through startup review,**
+  not a CLI command. Kernel restore evidence lasts one daemon process.
+- **OpenClaw interrupted local turns are not recovered; Hermes has no declared
+  resume or measured idle gateway exit.** `rig down` stops a community harness's pane; survival of independently spawned
+  children remains untested. Inspect actual processes before relying on their exit.
+- **The reported Codex restart refusal in #2200 remains unresolved,** as do
+  the other 0.7.4 limits unless a change above names them fixed: Codex permission qualification
+  only on 0.164.0, earlier removed hook approvals, SSH tiles after a Herdr
+  restart, unqualified native cmux, Slack-only shared channels and the existing
+  browser-sizing and old Slack-thread limits. Isolated account-home switching
+  is not included.
+
+### Credits
+
+Thanks to @icey-zzz (#1772), @Aschenbath (#2153, #2159, #2162, #2169, #2179),
+@DeryFerd (#2164, #2165), @Nikhi00718 (#2172) and @dajiaohuang (#2188).
+Thanks also to @rudycelekli for the contribution from #1416 completed in #2160;
+to @AdamWhitehurst (#1544, #2049), @kevinhsykes (#2151), @aanestesia (#605),
+@todie (#1419) and @tgrundtvig (#21), whose reports led to fixes here; and to
+the other people whose reports and reviews led to these fixes.
+
 ## [0.7.4]

 OpenRig 0.7.4 lets an assistant you already use work as a member of your team.
@@ -667,10 +1585,11 @@ from the commit tagged `v0.7.3`. The changes since 0.7.2:
  current TUI sends it (a request without a seat identity); an older TUI's
  answer on someone else's ask is refused.
  ([#2006](https://github.com/mvschwarz/openrig/pull/2006))
- **A Codex seat's permission settings are passed as launch flags; that Codex
-  enforces them was not proven natively.** Going back to an older OpenRig keeps
-  them unread (see Before you upgrade). The Codex trust fixes stop new duplicate
-  hook groups but don't remove existing ones.
+- **A Codex seat's permission settings were enforced natively in our test with
+  Codex 0.164.0,** including after a managed restore and a restart. Other Codex
+  versions weren't tested. Going back to an older OpenRig keeps them unread (see
+  Before you upgrade). The Codex trust fixes stop new duplicate hook groups but
+  don't remove existing ones.
  ([#2048](https://github.com/mvschwarz/openrig/pull/2048),
  [#2035](https://github.com/mvschwarz/openrig/pull/2035))
 - **The cmux path wasn't tried in a real cmux**, and a remote host's rigs are
@@ -735,8 +1654,7 @@ reported [#1653](https://github.com/mvschwarz/openrig/issues/1653) (worked on in
 reported [#980](https://github.com/mvschwarz/openrig/issues/980) (addressed by
 [#2081](https://github.com/mvschwarz/openrig/pull/2081)); @rakoort, whose
 suggestion in [#1679](https://github.com/mvschwarz/openrig/issues/1679) became
-[#2086](https://github.com/mvschwarz/openrig/pull/2086) (the issue's main
-report is still open); @george661, whose
+[#2086](https://github.com/mvschwarz/openrig/pull/2086); @george661, whose
 [#1710](https://github.com/mvschwarz/openrig/issues/1710) led to
 [#2093](https://github.com/mvschwarz/openrig/pull/2093).

@@ -26,9 +26,9 @@ use:

 ```sh
 # Claude Code
-npx skills add https://github.com/mvschwarz/openrig/tree/v0.7.4/skills/rigs --skill rigs --agent claude-code
+npx skills add https://github.com/mvschwarz/openrig/tree/v0.7.9/skills/rigs --skill rigs --agent claude-code
 # Codex
-npx skills add https://github.com/mvschwarz/openrig/tree/v0.7.4/skills/rigs --skill rigs --agent codex
+npx skills add https://github.com/mvschwarz/openrig/tree/v0.7.9/skills/rigs --skill rigs --agent codex
 ```

 Then type `/rigs` in Claude Code, or `$rigs` in Codex, and say what you want built. The skill has your agent tell
@@ -68,14 +68,14 @@ Requires Node.js 22 or 24 and tmux, on macOS or Linux, and one working Claude Co

 ### Install it yourself

-This runs OpenRig's install script from the `v0.7.4` release. It checks Node.js and npm, installs the latest published `@openrig/cli` with `npm install -g`, runs the Node.js and SQLite check, then runs `rig setup --dry-run` and `rig setup`. The first line prints that plan and changes nothing:
+This runs OpenRig's install script from the `v0.7.9` release. It checks Node.js and npm, installs the latest published `@openrig/cli` with `npm install -g`, runs the Node.js and SQLite check, then runs `rig setup --dry-run` and `rig setup`. The first line prints that plan and changes nothing:

 ```bash
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.4/scripts/install.sh | sh -s -- --dry-run
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.4/scripts/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.9/scripts/install.sh | sh -s -- --dry-run
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.9/scripts/install.sh | sh
 ```

-If a provider isn't signed in yet, the last step reports `FAILED [4/4]`, and `rig setup` lists the sign-in under "Some steps need attention". If the only remaining failures are provider sign-ins, the install steps finished; sign in to each selected provider as below and continue.
+If the last step isn't ready, the installer reports `INSTALLED, SETUP NOT COMPLETE` and points to the details from `rig setup` above. Follow that output and any reported Fix, then rerun `rig setup`; the CLI does not need reinstalling. If the only remaining failures are provider sign-ins, sign in to each selected provider as below and continue.

 **Or step by step:**

@@ -6,11 +6,9 @@ This isn't a schedule or a promise: we release often, and an item ships when a g
 To see what's being worked on, by release and theme, open the [OpenRig roadmap board](https://github.com/users/mvschwarz/projects/1).
 Issues labelled `good first issue` are also listed on the [contribute page](https://github.com/mvschwarz/openrig/contribute).

-## Released in 0.7.4
+## Released in 0.7.8

-[0.7.4 is published](https://github.com/mvschwarz/openrig/releases/tag/v0.7.4): a first, experimental step toward every
-assistant you use working on one team. See its release notes for what shipped, the experimental and security notes for
-hosted members, upgrade instructions, contributor credits and the remaining testing gaps.
+[0.7.8 is published](https://github.com/mvschwarz/openrig/releases/tag/v0.7.8): it lets a person answer a runner seat's permission requests, with a conformance check and an example runner to build against. See its release notes for what shipped, known issues, upgrade instructions and contributor credits.

 ## How to help

@@ -49,7 +49,8 @@ COPY ${OPENRIG_TARBALL} /tmp/openrig.tgz
 RUN set -eux; \
    npm install -g /tmp/openrig.tgz; \
    rm -f /tmp/openrig.tgz; \
-    rig --version
+    rig --version; \
+    rig --help

 # --- layer 4: stub runtime assets (zero-token by construction; staged by the build verb into the
 #     build context as ./stub-assets/, hashed into the manifest via deriveStubAssetsHash) ---
@@ -398,6 +398,33 @@ adapter never closes a session on it and reports `rex_outcome_unknown`.
 Herdr and Rex build their layout trees from one grid helper
 (`buildTileGrid`, `tile-layout.ts`).

+### Tmux server selection
+
+Before reconciliation, `startup.ts` calls `selectTmuxServer` in
+`domain/tmux-server-selection.ts`. `terminal.tmux_server` defaults to `inherit`;
+`isolated` selects a socket derived from the canonical OpenRig home. The effective
+choice is persisted in `tmux-server.json`. A registered live seat, or an
+uninspectable old server, defers a requested change until a later restart.
+The persisted `pinned` flag and active marker make isolation and migration records
+mandatory, while ordinary inherited records remain advisory. Returning to inheritance
+commits an unpinned record before clearing the marker, so offline cleanup cannot reuse
+a stale inherited socket or keep enforcing a completed isolation choice.
+
+`TmuxAdapter` receives the selection's `executionArgs` for both shell and argv
+transports, including its direct probe/cleanup calls. They are empty for ordinary
+`inherit` mode, preserving tmux's environment-based selection; `serverArgs` still
+names the server for attachments. The opt-in control client uses the same execution
+arguments for its connection, probes and fallback commands. The same startup choice feeds node
+inventory, `TerminalService.status()` and previews, composed panes, shared TUI attachment and
+CLI viewer management. Inherited SSH panes retain the remote-tmux replacement
+wrapper and plain recovery command without requiring remote OpenRig. Isolated
+SSH panes resolve the remote instance through its own `rig terminal attach`.
+For isolation, self-attachment checks the caller's socket before binding;
+offline destruction reads the persisted socket before removing state.
+
+See [tmux server selection](../../reference/tmux-servers.md) for configuration
+loading, first-upgrade migration, discovery scope and platform behavior.
+
 ## 3. Resume honesty

 The daemon does not assume a harness resumed just because the launch command
@@ -65,6 +65,35 @@ resolve → project → deliver pre-launch files → persist replay context →

 ## 2. Execution and projection types

+The member's optional `claude_mcp: none` is normalized as `claudeMcp` and
+persisted independently in `nodes.claude_mcp` (migration 142). The
+expansion HTTP route preserves both `claude_mcp` and `claudeMcp`, including
+invalid values for the canonical validator to reject. An authored relaunch
+updates the seat choice after launch eligibility and startup-source resolution;
+an already-bound seat or a failed tmux launch keeps its prior value. Export
+describes the current runtime; a dormant choice on another runtime is omitted
+and must be restored in the Claude declaration when rebuilding from that export.
+The YAML export route names those agents in the existing `# Not carried:` report;
+the JSON export is unchanged. `rigspec-routes.test.ts` covers both pod-aware and
+legacy exports, omission controls and successful JSON export.
+
+The shared `StartupOrchestrator` reads the current seat record, so both an authored start
+and saved-context restore pass the choice to Claude. Legacy resume and handover
+successors read it separately; a runtime-switch successor reads it only when
+the target is Claude. `claude-mcp.ts` builds the strict empty-server arguments
+for the adapters, shutdown resume probes and displayed recovery commands,
+including the conversation picker. Shutdown skips a probe with an unreadable
+saved choice and keeps the resume token without adding a shutdown refusal.
+The native lineage selectors recognize these exact
+arguments without treating JSON contents as session options. Invalid stored
+values refuse launch. With no choice, the adapters add no MCP arguments.
+
+`claude-mcp-lifecycle.test.ts` exercises real schema/storage, export, snapshot
+and restore with simulated tmux/provider processes. `claude-mcp-launch.test.ts`
+executes managed and unmanaged shell commands against a private argv-printing
+fake, including fresh/resume/fork and legacy resume. These tests verify command
+plumbing and identity handling; they do not claim live provider enforcement.
+
 Restore/snapshot types are detailed in `lifecycle-snapshot-restore.md`; the
 spec/projection types live here.

@@ -461,6 +461,13 @@ in the current update window. Current-update coverage is independent of the
 receipt window, so an unavailable current reader cannot retain closed delivery
 history beyond a successful history read. Both reads leave queue state intact.

+Clients that need only current FYIs can use `GET /api/queue/open-human-updates`.
+It returns `{items, limit, truncated}` with open human-addressed updates, ordered
+critical then urgent then routine, without requiring a delivery receipt. `limit`
+defaults to 20 and accepts integers from 1 to 100. Optional `view` follows the
+same person perspective as `/api/attention`; a perspective read scans at most
+1000 rows and signals `truncated` when the window may omit matching items.
+
 - `/api/stream` (`server.ts:783`) — `POST /emit` (`routes/stream.ts:56`),
  `GET /list` (`:91`, including `sourceSession`, `hintDestination`, `hintTag`,
  `since`, `until` and `direction` filters), `GET /watch` + `/sse` SSE
@@ -293,7 +293,7 @@ cited here by number with the code that carries them):
  for one seat. `resume` captures an eligibility-checked `auto-rehydrate`
  snapshot when none exists and goes through `launchSingleNode`.
 - **Seat handover** — `rig seat handover <seat> --source
-  fresh|rebuild|fork:<id>|discovered:<id> --reason <reason> [--dry-run]`
+  fresh|rebuild|fork:<seat>|discovered:<id> --reason <reason> [--dry-run]`
  (the reason is required, dry run included; without it the command exits 2
  before contacting the daemon)
  (`packages/cli/src/commands/seat.ts:364`) calls
@@ -25,7 +25,7 @@ below `rig` (including groups and the hidden `restore apply` command), and
 **1,304 explicitly registered option objects**, including the root version
 option. Aliases do not add command objects; short/long spellings of one
 option do not add option objects. Commander-generated help is additional.
-These are counts for that source snapshot, not a claim about a deployed release.
+These are counts for that source snapshot, not a claim about a deployed release. The provider-switch and set-runtime rows include the later account-home options; those additions are not included in the snapshot counts. The `environment` section and the `host edit`, `host remove` and `terminal attach` rows were added later from source at `522d635c`, and aren't in the snapshot counts either. With `environment`, main registers 91 top-level commands.

 ## Reading this reference

@@ -350,10 +350,19 @@ the sections that were not read are `null`.
 | `rig host add` | — | `--id <id>` **required**<br>`--transport <transport>` **required**<br>`--target <target>`<br>`--user <user>`<br>`--url <url>`<br>`--bearer-env <name>`<br>`--bearer-file <path>`<br>`--notes <text>`<br>`--json` |
 | `rig host select <id>` | — | `--json` |
 | `rig host rename <name>` | — | `--json` |
+| `rig host edit <id>` | — | `--target <target>`<br>`--user <user>`<br>`--url <url>`<br>`--notes <text>`<br>`--json` |
+| `rig host remove <id>` | — | `--json` |
 | `rig host pair <url>` | — | `--id <id>`<br>`--timeout <seconds>`<br>`--human <address>`<br>`--json` |
 | `rig host list` | `ls` | `--json` |
 | `rig host doctor <id>` | — | `--posture <profile>`<br>`--public-addr <ip>`<br>`--json` |

+`rig host pair` needs the target daemon to run with `OPENRIG_AUTH_BEARER_TOKEN` set,
+even when it is bound to a tailnet address and so starts without one: pairing hands
+over that token. Without it, the target's `POST /api/hosts/pair-request` answers 409
+`pair_target_no_bearer`; it answers 409 `pair_human_required` when no single
+registered person can approve (none, or several with no default; name one with
+`--human`) (`packages/daemon/src/routes/hosts.ts:167-186`).
+
 Registration makes a host visible in topology; remote FEED attention remains opt-in.
 The human-readable success output of `host add` and `host pair` now includes the FEED
 next step alongside the existing `host doctor` suggestion. For an HTTP entry named
@@ -377,7 +386,7 @@ do not establish connectivity to a live peer.
 |---|---|---|
 | `rig ps` | — | `--json`<br>`--no-cleanup`<br>`--resources`<br>`--nodes`<br>`--full`<br>`--verbose`<br>`--limit <n>`<br>`--fields <list>`<br>`--summary`<br>`--filter <key=value>`<br>`--active`<br>`--running`<br>`-A, --all-rigs`<br>`--rig <name>`<br>`--session <name>`<br>`--include-archived`<br>`--host <id>`<br>`--all-hosts`<br>`--hosts <ids>` |

- `--nodes --json` — each seat carries the daemon's served `needsAttention` flag; the CLI doesn't re-derive it, and it is absent when an older daemon doesn't serve it. `arbitratedNeedsInput` and `needsInputEvidence` (`{ rung, observedAt }` or null) come with `--full`, or by name through `--fields`.
+- `--nodes --json` — each seat carries the daemon's served `needsAttention` flag; the CLI doesn't re-derive it, and it is absent when an older daemon doesn't serve it. `arbitratedNeedsInput` and `needsInputEvidence` (`{ rung, observedAt }` or null) come with `--full`, or by name through `--fields`. `startedWithoutRequired` lists the required startup files a handover's successor started without, and the compact read keeps it.

 ### roster

@@ -453,6 +462,11 @@ do not establish connectivity to a live peer.
 | `rig stream read` | — | `--limit <n>`<br>`--reader <session>`<br>`--json` |
 | `rig stream act <streamItemId>` | — | `--work <qitemId>`<br>`--decline <reason>`<br>`--duplicate <id>`<br>`--reader <session>`<br>`--json` |

+Stream intake: the `stream.intake` setting (default `queue.worker`, or a canonical `<seat>@<rig>`) receives each emitted item.
+It opens an intake row for that seat, which wakes it, or adds a note to that seat's intake row still pending; a `critical`
+or interrupting item makes the row urgent. `rig config set stream.intake off` keeps emits passive. A runner's
+default-permit record (tag `runner-permission-permit`) opens no row.
+
 ### queue

 | Invocation | Aliases | Declared options |
@@ -461,7 +475,7 @@ do not establish connectivity to a live peer.
 | `rig queue create` | — | `--source <session>`<br>`--destination <session>` **required**<br>`--body <text>`<br>`--body-file <path>`<br>`--body-context <ref>`<br>`--mission <id>`<br>`--slice <id>`<br>`--gate <role>`<br>`--priority <priority>`<br>`--tier <tier>`<br>`--tags <tags>`<br>`--expires-at <iso>`<br>`--id <qitemId>`<br>`--target-repo <name>`<br>`--summary <text>`<br>`--human-intent <intent>`<br>`--alert`<br>`--human-detail-file <path>`<br>`--reply-to <qitemId>`<br>`--human-questions-file <path>`<br>`--evidence-ref <path>`<br>`--host <id>`<br>`--no-nudge`<br>`--verify`<br>`--full`<br>`--json` |
 | `rig queue claim <qitemId>` | — | `--destination <session>`<br>`--full`<br>`--json` |
 | `rig queue unclaim <qitemId>` | — | `--destination <session>`<br>`--reason <text>`<br>`--full`<br>`--json` |
-| `rig queue update <qitemId>` | — | `--actor <session>`<br>`--state <state>`<br>`--reopen`<br>`--closure-reason <reason>`<br>`--closure-target <target>`<br>`--resolution <text>`<br>`--blocked-on <blocker>`<br>`--wake-watchdog <jobId>`<br>`--wake-after <duration>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--note <text>`<br>`--full`<br>`--json` |
+| `rig queue update <qitemId>` | — | `--actor <session>`<br>`--state <state>`<br>`--reopen`<br>`--closure-reason <reason>`<br>`--closure-target <target>`<br>`--closure-required-at <iso>`<br>`--resolution <text>`<br>`--blocked-on <blocker>`<br>`--wake-watchdog <jobId>`<br>`--wake-after <duration>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--note <text>`<br>`--full`<br>`--json` |
 | `rig queue block <qitemId>` | — | `--on <blocker>` **required**<br>`--actor <session>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--note <text>`<br>`--continuation <text>`<br>`--wake-watchdog <jobId>`<br>`--wake-after <duration>`<br>`--full`<br>`--json` |
 | `rig queue resolve <qitemId>` | — | `--decision <text>` **required**<br>`--actor <session>`<br>`--bearer <token>`<br>`--no-notify`<br>`--json` |
 | `rig queue handoff <qitemId>` | — | `--from <session>`<br>`--to <session>` **required**<br>`--body <text>`<br>`--body-file <path>`<br>`--note <text>`<br>`--priority <priority>`<br>`--tier <tier>`<br>`--tags <tags>`<br>`--gate <role>`<br>`--target-repo <name>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--alert`<br>`--host <id>`<br>`--no-nudge`<br>`--full`<br>`--json` |
@@ -485,7 +499,7 @@ do not establish connectivity to a live peer.
 | Invocation | Aliases | Declared options |
 |---|---|---|
 | `rig slack` | — | — |
-| `rig slack setup` | — | `--channel <id>`<br>`--inbound-destination <session>`<br>`--minimum-level-that-posts <level>`<br>`--minimum-level-that-interrupts <level>`<br>`--source-label <label>`<br>`--secrets-env-file <path>`<br>`--required-scopes <csv>`<br>`--reason <reason>`<br>`--actor <actor>` |
+| `rig slack setup` | — | `--channel <id>`<br>`--inbound-destination <session>`<br>`--minimum-level-that-posts <level>`<br>`--minimum-level-that-interrupts <level>`<br>`--source-label <label>`<br>`--secrets-env-file <path>`<br>`--required-scopes <csv>`<br>`--reactions <mode>`<br>`--reason <reason>`<br>`--actor <actor>` |
 | `rig slack status` | — | `--json` |
 | `rig slack manifest` | — | `--url`<br>`--json` |
 | `rig slack verify` | — | `--json` |
@@ -541,6 +555,7 @@ do not establish connectivity to a live peer.
 | `rig terminal open <view>` | — | `--provider <name>`<br>`--session <name>`<br>`--window`<br>`--expected-plan <id>`<br>`--json` |
 | `rig terminal views` | — | `--json` |
 | `rig terminal status` | — | `--provider <name>`<br>`--session <name>`<br>`--json` |
+| `rig terminal attach <session>` | — | `--read-only` |

 See [named terminal sessions](../reference/terminal-sessions.md) to select a
 Herdr session per request, including session-bound previews and window reuse.
@@ -628,7 +643,7 @@ Only Claude and Codex tenures can be woken.
 | Invocation | Aliases | Declared options |
 |---|---|---|
 | `rig specs` | — | — |
-| `rig specs ls` | — | `--kind <kind>`<br>`--json` |
+| `rig specs ls` | — | `--kind <kind>`<br>`--include-builtins`<br>`--json` |
 | `rig specs show <name-or-id>` | — | `--kind <kind>`<br>`--json` |
 | `rig specs preview <name-or-id>` | — | `--kind <kind>`<br>`--json` |
 | `rig specs add <path>` | — | `--json` |
@@ -697,6 +712,24 @@ Only Claude and Codex tenures can be woken.
 | `rig community-harness` | — | — |
 | `rig community-harness list` | — | `--json` |

+### environment
+
+| Invocation | Aliases | Declared options |
+|---|---|---|
+| `rig environment` | — | — |
+| `rig environment setup` | — | `--directory <path>` **required**<br>`--binding <id>`<br>`--seat <address>`<br>`--rig <name>`<br>`--mcp-url <url>`<br>`--guest-base-url <origin>`<br>`--artifact-root <path>`<br>`--json` |
+| `rig environment create <binding>` | — | `--seat <address>` **required**<br>`--node <id>`<br>`--gateway <ref>` **required**<br>`--workspace <ref>` **required**<br>`--name <name>` **required**<br>`--image <digest>` **required**<br>`--provider <ref>` **required**<br>`--policy <path>` **required**<br>`--guest-base-url <origin>` **required**<br>`--operation <id>`<br>`--json` |
+| `rig environment attach <binding>` | — | `--seat <address>` **required**<br>`--node <id>`<br>`--gateway <ref>` **required**<br>`--workspace <ref>` **required**<br>`--name <name>` **required**<br>`--image <digest>` **required**<br>`--provider <ref>` **required**<br>`--policy <path>` **required**<br>`--guest-base-url <origin>` **required**<br>`--operation <id>`<br>`--json`<br>`--resource-id <id>` **required**<br>`--fingerprint <value>` |
+| `rig environment inspect <binding>` | — | `--live`<br>`--json` |
+| `rig environment connect <binding>` | — | `--generation <id>` **required** |
+| `rig environment export <binding>` | — | `--request <path>` **required**<br>`--json` |
+| `rig environment checkpoint <binding>` | — | `--generation <id>` **required**<br>`--operation <id>` **required**<br>`--json` |
+| `rig environment recreate <binding>` | — | `--request <path>` **required**<br>`--json` |
+| `rig environment completion <binding>` | — | `--request <path>` **required**<br>`--json` |
+| `rig environment effect <binding>` | — | `--effect <name>` **required**<br>`--generation <id>`<br>`--resource-id <id>`<br>`--operation <id>` **required**<br>`--engine-socket <path>`<br>`--json` |
+
+It drives the maintained OpenShell reference; see the [OpenShell example](../reference/community-harness-examples/openshell/README.md).
+
 ### fork

 | Invocation | Aliases | Declared options |
@@ -794,8 +827,8 @@ Only Claude and Codex tenures can be woken.
 | `rig provider accounts` | — | `--json`<br>`--provider <p>`<br>`--account <a>` |
 | `rig provider bindings` | — | `--json`<br>`--provider <p>`<br>`--account <a>` |
 | `rig provider signals` | — | `--json`<br>`--provider <p>`<br>`--account <a>` |
-| `rig provider precheck` | — | `--seat <s>` **required**<br>`--to-account <a>`<br>`--token-file <path>`<br>`--stored-login`<br>`--json` |
-| `rig provider switch` | — | `--seat <s>` **required**<br>`--to-account <a>`<br>`--token-file <path>`<br>`--stored-login`<br>`--force-unsafe`<br>`--json` |
+| `rig provider precheck` | — | `--seat <s>` **required**<br>`--to-account <a>`<br>`--token-file <path>`<br>`--api-key-file <path>`<br>`--stored-login`<br>`--json` |
+| `rig provider switch` | — | `--seat <s>` **required**<br>`--to-account <a>`<br>`--token-file <path>`<br>`--api-key-file <path>`<br>`--stored-login`<br>`--force-unsafe`<br>`--clear-account-home`<br>`--account-home <path>`<br>`--reason <text>`<br>`--model <id>`<br>`--codex-config-profile <name>`<br>`--dry-run`<br>`--json` |
 | `rig provider moves` | — | `--seat <seat>`<br>`--limit <n>`<br>`--json` |
 | `rig provider moves report` | — | `--file <path>` **required**<br>`--to <seat>` **required**<br>`--follows <qitemId>`<br>`--evidence-ref <ref>`<br>`--json` |

@@ -984,9 +1017,10 @@ for input and receipt examples, rollback, and snapshot behavior.
 | `rig seat set-terminal-policy <seat>` | — | `--preset <preset>` **required**<br>`--helper <addresses...>`<br>`--rig-default`<br>`--reason <text>` **required**<br>`--operator <address>`<br>`--json`<br>`--peer-compaction <decision>`<br>`--peer-model <decision>`<br>`--self-compaction <decision>`<br>`--self-model <decision>`<br>`--openrig-compaction <decision>`<br>`--openrig-model <decision>` |
 | `rig seat set-permissions <seat>` | — | `--mode <mode>`<br>`--rules <file>`<br>`--codex-permissions <file>`<br>`--codex-profile <name>`<br>`--reason <text>` **required**<br>`--operator <address>`<br>`--json` |
 | `rig seat set-effort <seat>` | — | `--effort <level>`<br>`--clear`<br>`--reason <text>` **required**<br>`--operator <address>`<br>`--json` |
+| `rig seat set-permissions-to <seat>` | — | `--to <person>`<br>`--clear`<br>`--deny`<br>`--reason <text>` **required**<br>`--operator <address>`<br>`--json` |
 | `rig seat effort <seat>` | — | `--json` |
 | `rig seat set-model <seat>` | — | `--model <id>` **required**<br>`--reason <text>` **required**<br>`--operator <address>`<br>`--json` |
-| `rig seat set-runtime <seat>` | — | `--runtime <runtime>`<br>`--reason <text>`<br>`--model <id>`<br>`--effort <level>`<br>`--codex-config-profile <name>`<br>`--permission-mode <mode>`<br>`--confirm-timeout <seconds>`<br>`--dry-run`<br>`--confirm <switch-id>`<br>`--note <text>`<br>`--recover`<br>`--json` |
+| `rig seat set-runtime <seat>` | — | `--runtime <runtime>`<br>`--reason <text>`<br>`--model <id>`<br>`--effort <level>`<br>`--codex-config-profile <name>`<br>`--clear-account-home`<br>`--account-home <path>`<br>`--token-file <path>`<br>`--account-label <label>`<br>`--permission-mode <mode>`<br>`--confirm-timeout <seconds>`<br>`--dry-run`<br>`--confirm <switch-id>`<br>`--note <text>`<br>`--recover`<br>`--json` |
 | `rig seat set-cwd <seat>` | — | `--cwd <directory>` **required**<br>`--reason <text>` **required**<br>`--operator <address>`<br>`--json` |
 | `rig seat launch <seat>` | — | `--fresh` **required**<br>`--reason <text>`<br>`--plan`<br>`--stop`<br>`--operator <address>`<br>`--json` |
 | `rig seat restart <seat>` | — | `--keep-conversation` **required**<br>`--reason <text>`<br>`--plan`<br>`--verify`<br>`--expect-account <text>`<br>`--operator <address>`<br>`--host <id>`<br>`--json` |
@@ -168,6 +168,28 @@ Exit codes: 0 pass, 1 a leg failed, 2 lane busy, 3 the runner itself errored.

 ### Host mode: while you're writing a scenario

+The tmux server selection regression also uses these scaffold and lifecycle helpers
+in `packages/daemon/test/tmux-server-isolation-daemon.test.ts`. It runs a real stub
+seat through config changes, daemon restarts, capture, self-attachment and cleanup,
+while native socket observations verify that a personal namesake survives. The
+test also removes the effective-server record and verifies that `destroy --all`
+leaves the daemon, database and both servers' sessions intact before restoring
+the record and checking normal cleanup. The
+YAML grammar has no config-write or socket-inventory surface, so these assertions
+live in the Vitest integration test. It does not exercise a real provider model,
+SSH connection or graphical terminal window.
+
+`packages/daemon/test/tmux-server-two-instances.test.ts` adds two real daemons
+sharing a scratch OS home and inherited personal tmux server, with separate
+OpenRig homes, databases and ports. Both enable isolation and control mode. It
+checks same-named seats through inventory, capture and verified writes, observes
+the marked control session on each selected socket, then stops one instance and
+checks that the other instance's pane identity, control session and delivery still
+work. The personal namesake remains untouched. This test requires a tmux version
+that supports control mode and the built CLI and daemon. Like CI's package suites,
+it should run with scratch homes and outbound network restricted to localhost;
+scripted seats prove terminal routing and rendered delivery, not model receipt.
+
 ```sh
 npm run build    # the runner drives packages/cli/dist/bin-wrapper.js
 node --import tsx packages/daemon/scripts/run-scenarios.mjs     # the fixture scenario-*.yaml files
@@ -518,7 +540,7 @@ Before you start, two honest constraints:
 | registry | `host` | add/list/select/rename isolated entries that resolve to fixture endpoints. Pairing needs two container daemons. |
 | coordination | `parked` | An owed item with a stopped worker is reported. A held worker with a live wake is distinguished. |
 | coordination | `stream` | emit/list/show/archive an exact item. A restart and a bounded watch keep the order with no duplicates. |
-| coordination | `queue` | (partial) Next: handoff, block, resolve and unclaim, each with exact items and destinations. |
+| coordination | `queue` | (partial) handoff → successor owned by `--to` and source asserted closed (`handed-off`), block → parked blocked, resolve → unpark to in-progress (owner nudge suppressed), unclaim → pending with destination kept — each with exact items and destinations asserted via `expect queue` (`rig queue list --json --full --all`) in `queue-transitions-reach-exact-states.yaml`; baton restart coverage stays in `queue-baton-survives-restart.yaml`. |
 | coordination | `project` | Acquire a lease, classify one item twice, read one projection. The wrong holder cannot act. |
 | coordination | `view` | Register a view over known items. list/show return the exact filtered result after a mutation. |
 | coordination | `watchdog` | Register one short wake, see one response, stop it, prove no further deliveries. |
@@ -440,7 +440,7 @@ guidance:
 |-------|------|----------|---------|-------------|
 | `id` | string | yes | — | Resource identifier. A `rig-role` guidance resource is never merged; deliver a role with a `send_text` startup file. |
 | `path` | string | yes | — | Relative path to the guidance file. |
-| `target` | string | no | — | Parsed but not used: the runtime decides the file. Claude merges into the rig's `managed_blocks` file (`CLAUDE.md` by default, or `CLAUDE.local.md`); Codex, Pi and OMP merge into `<cwd>/AGENTS.md`. |
+| `target` | string | no | — | Parsed but not used: the runtime decides the file. Claude merges into the rig's `managed_blocks` file (`CLAUDE.md` by default, or `CLAUDE.local.md`); Codex, Pi and OMP merge into `<cwd>/AGENTS.md`, except that a fresh Pi seat normally uses its own agent folder's `AGENTS.md` and a fresh Codex 0.164.0+ seat normally gets launch developer instructions; the conditions are in [Codex guidance at launch](agent-startup-guide.md#codex-guidance-at-launch) and [Runtime Differences](agent-startup-guide.md#runtime-differences). |
 | `merge` | string | no | `managed_block` | Only `managed_block` is applied. Any other value, such as `append`, merges nothing. |

 ---
@@ -214,7 +214,7 @@ After the files, OpenRig sends a session-identity message (rig, pod, member, log
 | Delivery Hint | When | How | Use For |
 |---------------|------|-----|---------|
 | `auto` | Depends on the file | Resolved per file: a `SKILL.md` (or content starting `# SKILL`) is `skill_install`, any other `.md` is `guidance_merge`, and any other file is `send_text` | Default — let OpenRig decide |
-| `guidance_merge` | Before harness boot | Merged as a managed block into `AGENTS.md` (Codex, Pi) or `CLAUDE.md` (Claude; `CLAUDE.local.md` with the rig's `managed_blocks: { claude-code: CLAUDE.local.md }`) | Role guidance, culture, project context |
+| `guidance_merge` | Before harness boot | Merged as a managed block into the repository `AGENTS.md` (Codex, OMP), a fresh Pi seat's own agent-directory `AGENTS.md` (see [Runtime Differences](#runtime-differences)), or `CLAUDE.md` (Claude; `CLAUDE.local.md` with the rig's `managed_blocks: { claude-code: CLAUDE.local.md }`). A fresh launch of Codex 0.164.0 or later can carry it as launch developer instructions instead (see [Codex guidance at launch](#codex-guidance-at-launch)) | Role guidance, culture, project context |
 | `skill_install` | Before harness boot | Copied to runtime's skill directory | Skills |
 | `send_text` | After harness is ready | Sent as text to agent's terminal via tmux | Boot-time grounding, identity hints, instructions to read skills |

@@ -367,7 +367,15 @@ Each startup file and action specifies when it applies:
 - `restore` — delivered when a seat is restored without its earlier conversation: a restore whose resume falls back to a fresh conversation, or a retried start
 - Default: `[fresh_start, restore]` (both)

-**An exact resume delivers neither.** When a restore reopens the seat's saved conversation (`rig up <rig> --existing` with a resume token), OpenRig types no startup actions and delivers no startup files, `restore` ones included: the conversation already has them, and typing them again would add turns to it. The one exception: a managed guidance block missing from the guidance file is put back before the harness starts.
+**An exact resume delivers neither.** When a restore reopens the seat's saved conversation (`rig up <rig> --existing` with a resume token), OpenRig types no startup actions and delivers no startup files, `restore` ones included: the conversation already has them, and typing them again would add turns to it. The one exception: the guidance file's managed blocks are brought up to date before the harness starts. A missing block is put back, and a stale one is refreshed (see below).
+
+**A seat handover does the same put-back.** Before a fresh, fork or rebuild successor starts, the handover puts the seat's missing managed guidance blocks back in its guidance file from the saved startup context. That's the rig's Claude file (`CLAUDE.md`, or `CLAUDE.local.md` when the rig uses it) for Claude, and `AGENTS.md` for Codex, Pi and omp. So a seat rebuilt into a new working directory keeps its guidance.
+
+**A block you edited by hand is never overwritten.** OpenRig records what it last wrote in each managed block, so a launch, an exact resume, a handover or a runtime switch can refresh a block whose source file changed since. The record follows the file itself, so two links to one file share it. A block you've edited since OpenRig wrote it is left as you wrote it. The start's result names it (`guidance_block_edited`), and the seat is told in one line once it's ready, or in a handover's packet. A block OpenRig has no record of writing (any block written before these records were kept) that differs from its source works like this:
+- a launch replaces it, as launches always did, and names it (`guidance_block_refreshed_unrecorded`);
+- an exact resume or a handover leaves it, and names it as possibly stale (`guidance_block_may_be_stale`).
+
+An exact resume doesn't type anything into the resumed conversation. So there, the restore result names the block (`guidanceNotes`), but the seat isn't told.

 Use this to avoid re-sending context that a fresh conversation doesn't need twice. For example, a one-time project briefing might only apply on `fresh_start`, while identity grounding should apply on both, so a seat that comes back fresh gets it again.

@@ -528,6 +536,58 @@ This separates provider files, not OS users or accounts. Project-local resources
 still use the selected project directory; shared project and system settings
 remain shared.

+### Codex guidance at launch
+
+On a fresh launch of Codex 0.164.0 or later, OpenRig passes a seat's managed guidance (OpenRig's start file and the
+rig's and project's context, culture and SOP files) with the launch, as `-c developer_instructions=…`, instead of
+merging it into the repository `AGENTS.md`. Neither the tracked `AGENTS.md` nor the Codex home is written for it, and
+both still load as usual. The text opens: "OpenRig seat guidance for this session follows. Where it conflicts with
+AGENTS.md guidance in the repository or the Codex home, follow AGENTS.md."
+
+A launch value replaces a configured one, so this happens only when no Codex config layer OpenRig reads sets
+`developer_instructions`. OpenRig reads:
+
+- `/etc/codex/config.toml` and `/etc/codex/managed_config.toml`;
+- the Codex home's `config.toml`, profiles included, and the selected profile's `<profile>.config.toml`;
+- each `.codex/config.toml` from the seat's working directory up.
+
+The Codex home it reads is the seat's own (a `CODEX_HOME` in its `env:`, or a recorded account switch), else the
+daemon's `CODEX_HOME`, else `~/.codex`.
+
+The guidance still goes to the repository `AGENTS.md`, as before, when:
+
+- a layer OpenRig reads sets `developer_instructions`, or can't be read. A launch warning names the file;
+- the launch resumes or forks a conversation. Developer instructions on a resume haven't been tested, and an exact
+  resume puts the guidance back in the repository `AGENTS.md`;
+- the seat is restored, even when the restore starts a new conversation. A restore keeps the guidance file its launch
+  recorded, which for Codex is the repository `AGENTS.md`;
+- a handover successor starts (fresh, fork or rebuild). Its launch carries no guidance of its own, so the handover
+  first puts the seat's missing blocks back in the repository `AGENTS.md` from its saved startup context;
+- Codex is older than 0.164.0, or its version is unknown.
+
+A seat's role still arrives as startup text, and the seat-skills line, after the person's yes, still goes to
+`AGENTS.md`.
+
+A launch that carries developer instructions writes no new blocks to the repository `AGENTS.md`. But blocks an earlier
+handover or resume left there are refreshed from their sources, by the same rule as every other managed block. That
+matters because the launch text asks Codex to follow `AGENTS.md` where the two differ.
+
+**If your shell sets `CODEX_HOME`.** When neither the seat nor the daemon declares a `CODEX_HOME`, a seat's pane keeps
+its own, and OpenRig reads `~/.codex`. A `CODEX_HOME` that only your shell startup sets (in `~/.zshrc`, for example),
+with the daemon started without it, isn't seen. A `developer_instructions` set in that home is then replaced by the
+launch value for the session. To have it checked, declare that same absolute path as `CODEX_HOME` in the member's or
+rig's `env:` (see [Launch environment](rig-spec.md#launch-environment), "A seat's own account"). OpenRig then reads
+that home at the seat's next fresh launch, and a `developer_instructions` set there keeps the repository `AGENTS.md`.
+The seat keeps the same home and login.
+
+**What it doesn't cover.** OpenRig doesn't read Codex's packaged defaults, or MDM- or enterprise-managed settings. A
+`developer_instructions` set there may be replaced for the session. Legacy MDM-managed config ranks above launch flags,
+so it can override OpenRig's guidance, and the seat then gets none of it.
+
+**Not established.** The order Codex assembles developer instructions and `AGENTS.md` in, and how it settles every
+conflict, aren't established; the opening sentence asks it to follow `AGENTS.md`. The native behaviour was observed on
+Codex 0.164.0 alone, on fresh launches without tools.
+
 ### Runtime Differences

 **Claude Code:**
@@ -558,10 +618,17 @@ remain shared.
 - Can self-install dependencies from instructions but timer/recurring behavior is not reliably available

 **Pi and OMP:**
- Read `AGENTS.md` in the working directory; guidance is merged there, added to Pi's own system prompt
+- Read `AGENTS.md` in the working directory, added to Pi's own system prompt. Pi also reads the one in its agent
+  directory: on a fresh launch, a Pi seat's guidance is merged there, under OpenRig's state, not into the
+  repository's. When that file or its directory is a link, the repository `AGENTS.md` is used instead. A restore keeps
+  the file the seat launched with. OMP keeps its guidance in the repository `AGENTS.md`
 - Selected skills are projected into the seat's own agent directory under OpenRig's state, not into a shared
  workspace folder

+For Pi tool-selection diagnosis and deliberate in-place recovery, see
+[Pi tool-selection recovery](pi-tool-selection-recovery.md). It distinguishes
+configured, currently intended, registered and active tools, including the TUI/RPC boundary.
+
 **Terminal seats** (`builtin:terminal`) get no agent or profile layers and no startup proof.

 ### Claude compaction preparation directory
@@ -668,6 +735,29 @@ When authoring startup content, note which instructions are runtime-specific. Fo

 ---

+## Files OpenRig writes into a project
+
+These are the files OpenRig writes into a seat's working directory, and what `rig down` does with each. Paths are
+relative to that directory.
+
+| Path | When OpenRig writes it | What `rig down` does |
+| --- | --- | --- |
+| Managed blocks in `CLAUDE.md` (or the rig's `managed_blocks` file, such as `CLAUDE.local.md`) or `AGENTS.md` | Each launch merges the seat's guidance blocks. A fresh Codex launch that takes developer instructions puts them in its launch text instead: in `AGENTS.md` it adds only the seat-skills line, after your yes, and refreshes blocks already there. A fresh Pi seat writes its own agent-directory `AGENTS.md` outside the project, except when that folder or file is a link: then its guidance stays in the repository `AGENTS.md`. | Removes OpenRig's blocks, current or legacy, and keeps everything else. When nothing else is left, it deletes the file if the file began with an OpenRig block, or held only blocks in an older format. A block-only file isn't proof that OpenRig created it. The seat-skills line is kept if you edited it. |
+| `.openrig/context-collector.cjs` | Claude seats, at launch. | Removes it while its bytes are still the shipped collector's; otherwise keeps it and says so. |
+| `.claude/settings.local.json` | Claude seats, at launch: OpenRig's status line and its activity hooks are merged in, separately. Your own status line is never replaced, but the activity hooks are still merged beside it. A file that doesn't parse gets neither. | Removes OpenRig's status line and hooks and keeps the file, even if `{}` is all that's left. |
+| `.claude/settings.local.json` fragments and `.mcp.json` | When a profile or spec declares `claude_settings_fragment` or `claude_mcp_fragment`. | Leaves the merged content in place. |
+| `.claude/agents/`, `.claude/plugins/<id>/`, `.claude/extensions/<id>/`; `.agents/<id>.yaml`, `.codex/plugins/<id>/`, `.agents/extensions/<id>/` | When the seat's projection includes subagents, plugins or runtime resources (Claude, then Codex). | Leaves them in place. |
+| `.claude/skills/<id>/`, `.agents/skills/<id>/` | Only for a seat without seat storage. New Claude and Codex seats keep their skills under `$OPENRIG_HOME/state/seats/`, outside the project. | Leaves them in place. |
+| The managed compaction preparation folder described in [Claude compaction preparation directory](#claude-compaction-preparation-directory), with its `.gitignore` of `*` and each attempt's `RESTORE-MAP.md` | Managed Claude compaction, unless a preparation root is configured elsewhere. | Leaves it in place. |
+| `.rigged-checkpoint.md` | A restore that didn't resume a seat's native conversation (by choice or not) and had a checkpoint to hand it. | Leaves it in place. |
+
+`rig down` leaves a file alone while another seat still uses it: a running seat of the same rig, or any seat of
+another rig that isn't archived. That is decided file by file. A guidance file is kept while another seat's
+guidance targets the same file. The Claude settings and collector are kept while another Claude seat works in that
+directory. So another rig's Codex seat keeps `AGENTS.md` without keeping `CLAUDE.md` or the Claude settings. It
+removes `.openrig/` and `.claude/` only when they are empty.
+`rig down --delete` does nothing more to project files. OpenRig doesn't edit your project's own `.gitignore`.
+
 ## Patterns and Anti-Patterns

 ### Good Patterns
@@ -737,6 +827,32 @@ rig uses it, so it stays until then. To remove it sooner, by hand:
 3. Keep a copy of the file, remove only those lines, and compare the result with
   the copy: nothing else in the file should differ.

+**The kernel's own folder.** A newly created default kernel works in
+`<workspace.root>/kernel`, beside your projects (`<workspace.root>/projects` by
+default) rather than above them. Claude reads `CLAUDE.md` from a seat's folder
+and from every folder above it, so a kernel working in the workspace root put its
+guidance into every Claude project seat below it. If that folder can't be made,
+the new kernel works in the workspace root, as before.
+
+A kernel that already exists keeps its folders, usually `workspace.root`.
+Upgrading moves no seat, changes no restored conversation and removes no file.
+To move an existing kernel yourself, if you want to:
+
+1. Save the new folder for each kernel seat with `rig seat set-cwd <seat> --cwd
+   <workspace.root>/kernel --reason <text>`, using the absolute path. It creates
+   the folder ([details](#change-an-existing-seats-working-directory)).
+2. Choose when each seat adopts it. A seat keeps its current folder until it
+   starts again, and the new start doesn't continue its current native
+   conversation: `rig seat launch <seat> --fresh --stop --reason <text>` starts a
+   blank one, and `rig handover <seat> --source rebuild --reason <text>` carries
+   durable context into a new one. Nothing does this for you.
+3. Tidy the old `<workspace.root>/CLAUDE.md` (or `AGENTS.md`) by hand, once no
+   running rig's seat still works in that folder: a seat there still reads those
+   blocks, and `rig down` checks the same before it removes them. Remove only
+   OpenRig's managed blocks, each from its `<!-- BEGIN OpenRig MANAGED BLOCK: … -->`
+   line through its `END` line, as in the steps above, and keep everything else,
+   including your own text. Don't move or delete the whole file.
+
 **Separate project context from role**

 Don't put project documentation inside the role guidance. The role is about the agent's function; project context is about what the agent is working on. Use rig-level or pod-level startup files for project context.
@@ -23,7 +23,10 @@ Only the activity axis is served today. The session and resumability values are
 `activity-taxonomy.ts` but no surface reads them: `rig ps --nodes --full` shows the raw session
 STATUS, both node views show a LIFECYCLE of `running`, `detached`, `recoverable` or `attention_required` (`run`, `det`, `rec`,
 `att`), and node inventory serves `occupantLifecycle` (`active`, `retiring`, `retired`,
-`context_walled`, `compacted`, `crashed`, `unknown`).
+`context_walled`, `compacted`, `crashed`, `unknown`). Node inventory's `sessionStatus` is the
+recorded session status, with two observed corrections: a running session whose pane is verified
+to have exited (identity reason `pane_exited`) reads `exited`, with `startupStatus:
+"attention_required"`, and a running session confirmed missing reads `detached`.

 The axes never blend. Reachability is strict; revival optimism is a different field
 (omnigent's strict-liveness split). `unknown` is a first-class honest value — the oracle
@@ -59,6 +62,21 @@ the existing live-hook fallback in effect; lifecycle, startup, held and error si
 can independently raise attention. A false attention flag means no known trigger, not
 proof that an unobserved input box is clear.

+A handover whose successor started without a required file also raises attention. That's
+a projected guidance file or a guidance startup file marked `required` still missing from
+the guidance file, or, for a fresh or rebuild successor, a required `send_text` startup
+file that's missing. The seat serves `startedWithoutRequired` with each file's path, the
+table's reason column names each file, and the handover's own output says it's degraded.
+The mark belongs to that successor's session, so the seat's next launch or handover
+clears it. Time alone never does. Repairing the file in place doesn't clear it either,
+because no route delivers guidance into a running conversation.
+
+A fresh or rebuild successor's first turn opens with the seat's `send_text` startup files,
+the ones a fresh start delivers, as absolute paths with the role first. A pointer asks the
+successor to read the file; it isn't the pasted text a start sends. A fork successor
+carries its parent's conversation and gets no list. `send_text` startup actions, such as
+an `after_ready` preload, aren't run for a successor.
+
 The compact human table's ATTN column renders `yes`, `no`, or `?` when the flag is
 unavailable. Compact JSON retains `needsAttention`; use `--full` or
 `--fields needsAttention,arbitratedNeedsInput,needsInputEvidence` with `--json` for the
@@ -116,7 +134,10 @@ time-bounded evidence. Rungs, top down, with each rung's retirement condition:
  PER-HARNESS when that harness's hook rung earns trust through a measured agreement
  window in production — never by fixture pass alone (symmetric admission: a fixture
  pass admits a rung to TRIAL, where it is measured but not consulted; production agreement
-  promotes it). Undeclared and partial-coverage rungs are identity-only, which is also where
+  promotes it). For Codex, this fallback also accepts a fresh working status adjacent to
+  the composer, or an advancing counter across two fresh captures when output separates
+  them. This positive evidence expires after five seconds; unrecognized, frozen, old or
+  pre-occupant frames add nothing. It uses the existing pane capture. Undeclared and partial-coverage rungs are identity-only, which is also where
  a degraded rung goes, with one declared exception: for a pi or omp seat or a community
  harness, sampling is positive-only: a changing pane reads working, and a quiet one never reads idle on its
  own, since the pane can be quiet mid-turn.
@@ -0,0 +1,74 @@
+# Integration author contracts — DRAFT, first published with 0.7.6
+
+OpenRig composes agents into a team. An integration author supplies the pieces that let a new harness participate, or let an existing harness run in a new environment. This guide divides that work into two contracts:
+
+1. **[Harness and runner](harness-runner-contract.md):** launch the agent, report its conversation identity and activity, deliver input, handle permission requests and cancellation, and reopen the requested conversation.
+2. **[Execution and platform](execution-platform-contract.md):** choose placement, deliver files and credential references, distinguish owned from attached resources, preserve native state, return artifacts and reconcile shutdown.
+
+These are draft author responsibilities. Some use implemented OpenRig interfaces; others describe a proposed integration whose code remains with its author. Including the guide in release documentation does not make every described capability available.
+
+## Release and support status
+
+This draft was published with **OpenRig 0.7.6** (tag [`v0.7.6`](https://github.com/mvschwarz/openrig/tree/v0.7.6), source `c00c6321`). Its implemented-interface baseline is commit [`b6bd4633`](https://github.com/mvschwarz/openrig/tree/b6bd4633fbd94634a2b4bdef2574a6880f97be63). That base includes the runner declaration and `passes_model` changes. The published 0.7.6 adds release repairs and documentation on top of that base. **OpenRig 0.7.8** adds seat activity grants, OpenRig's side of the answered permission path and the maintained OpenShell reference driver (`rig environment`); the rows below that say 0.7.8 describe it. References below use the immutable base instead of a moving branch, except the community preset reference, which is the in-tree copy.
+
+| Area | Status | What the status means |
+|---|---|---|
+| Community launcher presets, RigSpec members and AgentSpec role/startup declarations | Implemented interfaces | They compose configuration. A launcher must implement its declared effects; successful parsing does not prove delivery or native behavior. |
+| `runner: true` with `launch_result: true` | Released in 0.7.6 | The declaration is retained at launch, and Core uses the runner identity/activity path. It does not supply a runner executable. |
+| `passes_model: true` | Released in 0.7.6 | Passes the declared model through `OPENRIG_MODEL`. It does not observe or verify the effective native model. Cursor and Hermes examples leave it off pending native qualification. |
+| The dsh/ACP input, cancellation and answered permission recipe (a person answers, and the default is permit) | OpenRig's side released in 0.7.8; runner side not qualified | OpenRig asks a person for a runner's permission requests and returns the answer. No end-to-end dsh integration is established, and the native verdict is pending. Native reopen capabilities and the tools-off case remain implementer questions. |
+| Exact native resume via an author launcher | Existing interface; integration-specific evidence | A requested conversation must reopen exactly or fail honestly. One provider/harness result does not establish portability to another. |
+| Environment preparation, projection, artifact export and owned-resource cleanup | OpenShell reference driver released in 0.7.8; generic seam proposed | The platform chapter makes the responsibilities reusable. Core ships one maintained reference driver, OpenShell 0.1.6, as `rig environment`. It doesn't provide a generic platform driver or `DeploySpec` loader. |
+| `HarnessSpec`, `DeploySpec`, generic lifecycle fields and wake-on-demand declarations | Proposed vocabulary or unsupported configuration | They are not new accepted YAML keys. Use existing composition and an explicit author implementation. |
+| Cross-host native resume, provider-wide cancellation or permission support | Unresolved unless qualified by an integration | Unsupported and untested are distinct from observed failure. Publish the actual boundary and version. |
+
+## How the pieces compose
+
+```mermaid
+flowchart TD
+  R["RigSpec: members, relationships, work arrangement"] --> A["AgentSpec: role, context and startup declarations"]
+  R --> H["Built-in runtime or community preset"]
+  H --> N["Harness / runner: native conversation and control"]
+  H --> P["Author platform integration: placement and resources"]
+  P --> N
+  P --> F["Workspace, retained state and returned artifacts"]
+  R --> S["Optional application services"]
+```
+
+**RigSpec remains the composer.** AgentSpec describes reusable agent intent; the runtime or preset selects how the native agent starts. An integration can surround that launch with an environment-specific wrapper. A bundled application's database or Compose service is software the team operates; it is distinct from the environment in which an agent executes.
+
+The terminal provider, native harness protocol and network connection also have different jobs. A terminal provider carries input and output; a runner understands native turn boundaries; a granted MCP or other connection exposes coordination operations. An HTTPS connection does not by itself provision compute, awaken a suspended application or establish native resume. Each integration states which of those effects it implements.
+
+| Owner | Responsibility |
+|---|---|
+| OpenRig Core | Team and work identity, queue records, existing launcher contracts, activity interpretation and declared configuration. |
+| Harness/runner author | Native launch and protocol, exact native reference, prompt framing, truthful activity, permission/cancel behavior and native resume. |
+| Platform integration author | Placement binding, destination projection, resource ownership, state transfer, artifact delivery and resource reconciliation. |
+| Operator / credential owner | Selected environments, grants, provider credentials and spending authority. |
+
+The queue records who owns work. It does not prove that an old provider process has stopped, that a new runtime consumed its history, or that guest bytes reached the consumer. Those observations belong in the launch, resume and export receipts alongside the work record. This division reuses the queue rather than creating another task system.
+
+## Start from an existing example
+
+For a terminal harness, begin with the [community preset reference](community-harness-presets.md) and the pinned [Cursor](https://github.com/mvschwarz/openrig/tree/b6bd4633fbd94634a2b4bdef2574a6880f97be63/docs/reference/community-harness-examples/cursor) or [Hermes](https://github.com/mvschwarz/openrig/tree/b6bd4633fbd94634a2b4bdef2574a6880f97be63/docs/reference/community-harness-examples/hermes) directory. Their presence is source guidance, not an effective-model or complete integration guarantee.
+
+For a structured runner, the [runner chapter](harness-runner-contract.md#2-declare-it-what-the-preset-says-fixed-at-launch) supplies a minimal preset, launch record and activity message. The executable named by the preset must still be implemented and installed by its author.
+
+For a contained worker, the [platform composition](execution-platform-contract.md#a-minimal-composition-using-existing-surfaces) pairs an ordinary coordinator with a worker preset. It uses existing member and preset fields. The wrapper must prepare or attach to the selected environment explicitly; declaring a runtime does not provision it. Its illustrated member list is a fragment, and its launcher is a skeleton, not a ready-to-run provider package.
+
+A rig bundle can carry declarations, roles and supporting scripts. Do not confuse those files with hydrated image layers, installed binaries, registered presets, credentials or live sessions. State what the recipient must supply.
+
+## Lifetime and recovery
+
+**Persistent** and **Non-persistent** describe execution lifetime. A non-persistent invocation has an explicit completion condition tied to its assigned work. **Durable** describes interruption recovery and is independent of that lifetime. An agent can run briefly and still resume its retained conversation later.
+
+Retaining a workspace and reconstruction material can restore useful competence without restoring the same native conversation. Label that as reconstruction. Native resume additionally requires the correct harness-qualified reference and supported native state. The platform chapter's measured example restored copied history into recreated containers on the same host; it does not establish new-host migration or RAM restoration.
+
+## Questions contributors can help resolve
+
+- At a pinned dsh version, which advertised method reopens a session, and can a useful first case run without permission requests?
+- Which additional harness would justify a shared protocol runner rather than a separate wrapper?
+- Which provider effects can use the existing projection, native-reference and lifecycle dispatch, and which need a new maintained interface?
+- What exact state and ownership must travel when compute is recreated or moved?
+
+These questions remain part of the draft. An unanswered contributor thread does not prevent authors from using the implemented interfaces or reviewing the proposed responsibilities. Compatibility claims should name versions, observed behavior and unsupported operations; they should not imply a support guarantee from a manifest alone.
@@ -8,4 +8,15 @@ Read `GET /api/seat/stop-precondition/:seatRef` immediately before an operator-c

 Pass `expected` unchanged in the body of the existing `POST /api/seat/stop/:seatRef`, alongside `reason` and optional `operator`. The contract marker lets clients detect support. `expected` is optional; a request without it retains the existing stop behavior. A malformed explicit value returns HTTP 400. A null session ID can describe an empty seat, but stopping it returns `no_session`.

-Checked stop requires the delivery guard. It refuses a changed node, latest session, binding or occupant before a terminal effect with HTTP 409 `selection_changed`. If the selection changes after client detach, the response reports `partialEffect: true` and no kill is sent. A kill failure or a failure to save stop state after a kill reports `stop_uncertain`; inspect the seat before retrying. Success retains the usual `seat`, `sessionName` and `sessionId` fields.
+Checked stop requires the delivery guard. It refuses a changed node, latest session, binding or occupant before a terminal effect with HTTP 409 `selection_changed`. A kill failure or a failure to save stop state after a kill reports `stop_uncertain`; inspect the seat before retrying. Success retains the usual `seat`, `sessionName` and `sessionId` fields.
+
+A `selection_changed` or `stop_uncertain` response from a checked stop says how far the stop got in `stopPhase`. A refusal before the stop starts carries neither `stopPhase` nor `partialEffect`, and nothing was sent. The stop detaches the seat's clients, checks the selection again, then kills the session:
+
+| `stopPhase` | What was sent to the seat |
+| --- | --- |
+| `none` | Nothing. |
+| `detach_attempted` | The client detach, which may not have finished. No kill. |
+| `detached` | The client detach. No kill. |
+| `kill_attempted` | The kill. |
+
+`partialEffect` is `true` whenever `stopPhase` isn't `none`, so on its own it doesn't say whether the kill went out. `selection_changed` with `stopPhase: "kill_attempted"` is a change seen after the kill, when the stop state is saved: the session was killed, so re-read the seat rather than offering the stop again.
@@ -11,3 +11,4 @@ launch_result: true
 resume: true
 startup_assisted: false
 first_input: true
+passes_model: false              # the launcher maps OPENRIG_MODEL for a new session; set true once checked with the real harness
@@ -34,6 +34,12 @@ chat_store() {
  printf '%s/chats/%s/%s/store.db' "$CURSOR_CONFIG_DIR" "$sum" "$1"
 }

+# The seat's declared model (OPENRIG_MODEL, when the preset sets passes_model) goes to a new chat only. A resumed chat isn't
+# passed one: whether Cursor's --resume keeps the chat's earlier model or takes a new one hasn't been checked.
+if [ -n "${OPENRIG_MODEL:-}" ] && [ -z "${OPENRIG_RESUME_REF:-}" ]; then
+  set -- --model "$OPENRIG_MODEL" "$@"
+fi
+
 # Preserve the file's exact bytes, including trailing newlines. A read error stops before the harness starts.
 if [ -n "${OPENRIG_FIRST_INPUT:-}" ]; then
  first_input=$(cat "$OPENRIG_FIRST_INPUT" && printf '.')
@@ -0,0 +1,96 @@
+# An example runner for DeepSeek Harness (dsh)
+
+`openrig-dsh-runner.mjs` is a small runner for the draft [harness and runner contract](../../harness-runner-contract.md).
+It runs in the seat's pane, hosts `dsh --profile acp` over ACP on stdio, and does the runner's part of each contract
+section:
+- **identity:** the launch record, written once the conversation is open;
+- **one prompt per block:** each submitted block becomes one `session/prompt`, using bracketed paste in a TTY;
+- **turn boundaries:** reported as activity hooks, with a working beat every 10 s through a long, quiet turn;
+- **cancel:** `/abort` or Ctrl-C sends `session/cancel`, and a turn reads cancelled only when dsh says so. Type `/abort`
+  in the seat's pane: one sent with `rig send` arrives inside a From/To envelope, so it's an ordinary prompt;
+- **permissions:** each request goes to a person through OpenRig;
+- **resume:** it reopens the exact conversation, or says honestly that it couldn't.
+
+It has no dependencies, and it isn't installed by OpenRig. Copy it with [`dsh.yaml`](dsh.yaml) and maintain both as your
+own. [bpamiri/dsh-seat](https://github.com/bpamiri/dsh-seat) is a fuller dsh runner by its own maintainer.
+
+## Set it up
+
+1. **Install dsh and Node.** Install Node 22 or later, then `npm i -g @deepseek-ai/[email protected]`. This is the version
+   it was written for, and it has been checked only against a stand-in agent.
+2. **Install the runner and preset.** Make the runner executable and put it on the seat's `PATH`. Copy `dsh.yaml` to
+   `$OPENRIG_HOME/community-harnesses/`. Then declare a member with `runtime: dsh`.
+3. **Give the seat credentials.** Each seat gets its own dsh home, at `$OPENRIG_HOME/state/dsh/<node>/home`, because dsh
+   rewrites its profile there on every start. Put a `.credentials.yaml` there, or put a provider key in the seat's
+   `env:`. To use a home you prepared yourself, set `DSH_SEAT_HOME` in the member's `env:`; `DSH_SEAT_BIN` there names
+   another `dsh` binary. The runner doesn't take dsh's own `DSH_HOME` from its environment, because your shell's startup
+   files run after the seat's `env:` and could set it. A member's `env:` can't set `OPENRIG_*` names, which OpenRig
+   reserves, but the runner still reads `OPENRIG_DSH_HOME` and `OPENRIG_DSH` when something exports them to it, such as
+   a preset `command` wrapper.
+
+The runner's own defaults for dsh:
+- **Uploads:** the seat home gets a `cordis.patch.yml` that turns off dsh's session-log and plugin-list uploads to
+  DeepSeek, and the runner starts dsh with `DSH_TELEMETRY_DISABLED=1`.
+- **Permission mode:** `DSH_PERMISSION_MODE` is `workspace-write` unless you set it.
+- **The hook token:** OpenRig's activity token isn't passed to dsh, whose shell tool inherits the runner's environment.
+- **Its version:** the launch record names dsh's version from `dsh --version`. If that fails or takes over 5 seconds, it
+  names the version dsh's ACP handshake reports, marked as such: dsh 0.2.1-rc.2 reports 0.0.1 there.
+
+## Permissions
+
+The runner submits each request to OpenRig, which asks one person:
+- the default person;
+- or the person chosen for the seat with `rig seat set-permissions-to <seat> --to <person> --reason "…"`.
+
+That person answers one of the options dsh offered, and the runner gives that answer to the same live request, once.
+
+**When the person answers in their own words** rather than with a choice, a yes or a no, OpenRig permits by default and
+passes their words back as `said`. The runner gives dsh its option as usual, shows the words in the pane, and queues
+them like any other message, so dsh gets them after the current turn and after any message already waiting. The words
+are never the answer.
+
+**When no one can be asked, the request is permitted** with dsh's own allow option: `allow_once` when dsh offers it,
+else `allow_always`. That's OpenRig's default. The runner does the same when OpenRig can't answer: an older OpenRig
+without this path, an OpenRig it can't reach, or a refusal other than `--deny`.
+
+**`allow_always` creates a standing grant in dsh.** OpenRig doesn't record or revoke it, which is why the runner prefers
+`allow_once`. Where dsh keeps the grant, and for how long, isn't checked.
+
+**The runner refuses** only when the seat's operator opted in to refusal, with `rig seat set-permissions-to <seat>
+--deny`, or when dsh offered no allow option. A refused request is shown in the pane, and the seat reads needs input
+until the next prompt.
+
+**The runner answers cancelled, holding nothing,** when the person says no and dsh offered no reject option, or when
+OpenRig says the request isn't the seat's current occupant's (for example, after a relaunch).
+
+## Before you declare resume
+
+The preset leaves `resume` out, so a restore stops and asks, and a fresh launch starts a new conversation.
+`rig seat restart --keep-conversation` is for Codex seats only. The runner reopens a conversation by the method dsh
+advertises: `session/resume`, or `session/load`. When dsh advertises neither, it tries `session/resume`. It never starts
+a new conversation on a resume.
+
+**Telling a missing conversation from one that won't reopen.** dsh `0.2.1-rc.2` answers `-32602` both for a
+conversation it doesn't have and for one already active elsewhere, so the runner never reads that error as missing.
+- **Only dsh's own not-found error (`-32002`) counts as missing.** Any other failure leaves the resume unconfirmed.
+- **When dsh advertises `session/list`** (it does), the runner first asks the list, following its pages. A conversation
+  the list names but that won't reopen stays unconfirmed, even on a not-found.
+- **An unlisted conversation is still reopened.** dsh's list can leave out a conversation another running dsh holds
+  unsaved, so it can't show a conversation is gone.
+
+**Limit:** dsh answers `-32602`, not `-32002`, for a conversation it doesn't have, so the runner can't report a missing
+dsh conversation as missing. It reads unconfirmed.
+
+Add `resume: true` after a real dsh has reopened a conversation and recalled what was said in it.
+
+## Check it without a model
+
+Point dsh's `DEEPSEEK_BASE_URL` at a local server that speaks DeepSeek's Anthropic-compatible Messages API. Then run the
+contract's real check:
+- a seat reads ready only after the handshake;
+- one multi-line message becomes one prompt;
+- the seat reads working, then idle;
+- a refused permission reads needs input;
+- `/abort` ends a turn as cancelled.
+
+`packages/daemon/test/community-harness-dsh-example.test.ts` runs the same cases against a stand-in agent.
@@ -0,0 +1,20 @@
+# Install as $OPENRIG_HOME/community-harnesses/dsh.yaml, with openrig-dsh-runner.mjs (executable) on the seat's PATH.
+format: 1
+name: dsh
+command: openrig-dsh-runner.mjs
+maintainer: Your name or team
+runner: true
+launch_result: true
+first_input: true
+limits:
+  - written for dsh 0.2.1-rc.2 (npm @deepseek-ai/dsh) over ACP protocol 1, with Node 22 or later, and checked against a stand-in agent only
+  - each seat gets its own dsh home under $OPENRIG_HOME/state/dsh/<node>/home, holding a patch that turns off dsh's session-log and plugin-list uploads to DeepSeek; give it credentials (.credentials.yaml there) or a provider key in the seat's env; set DSH_SEAT_HOME in the member's env to use a home you prepared, and DSH_SEAT_BIN for another dsh binary (a member's env can't set OPENRIG_* names, and the runner doesn't read dsh's own DSH_HOME)
+  - DSH_PERMISSION_MODE defaults to workspace-write; a permission request goes to the default person or the seat's override (rig seat set-permissions-to), is permitted with dsh's allow_once (else allow_always) when no one can be asked or OpenRig can't answer, and is refused and held as needs input only after --deny
+  - allow_always creates a standing grant in dsh, which OpenRig doesn't record or revoke; the runner prefers allow_once, and where dsh keeps the grant and for how long isn't checked
+  - resume isn't declared until a real dsh has reopened a conversation and recalled it; the runner reopens by the method dsh advertises and reports missing only on dsh's own not-found error, not when dsh's session list names the conversation; dsh answers -32602 for a missing conversation (and for one active elsewhere), so a missing dsh conversation reads unconfirmed
+  - a prompt whose whole text is /abort can't be sent; a Ctrl-C byte inside a paste also aborts; without a TTY, input is read line by line; this isn't a binary-safe channel
+  - one prompt at a time; a message that arrives mid-turn waits for the next turn
+  - the seat's model isn't passed; dsh uses its own configured model
+  - no guidance, skills or startup files are placed; dsh reads its own AGENTS.md and skill folders
+  - when the pane closes, the runner cancels a running turn and stops dsh; anything dsh's tools started may keep running
+  - fork unsupported
@@ -0,0 +1,626 @@
+#!/usr/bin/env node
+// Example OpenRig runner for DeepSeek Harness (dsh), not installed by OpenRig. Checked against a stand-in agent only;
+// written for dsh 0.2.1-rc.2 (npm @deepseek-ai/dsh), ACP protocol 1 and Node 22 or later. No dependencies.
+//
+// It follows docs/reference/harness-runner-contract.md: it hosts `dsh --profile acp` over ACP on stdio, writes the
+// launch record once the conversation is open, turns each submitted block into one prompt, reports turn boundaries as
+// activity hooks with a working beat through a long, quiet turn, cancels on /abort or Ctrl-C, and sends permission
+// requests to OpenRig: a person answers, or OpenRig permits when no one can be asked, and so does the runner when OpenRig
+// can't answer (refusing and holding needs input only when the seat opted in to refusal). Copy it and maintain it as your
+// own.
+
+import { execFileSync, spawn } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import { pathToFileURL } from "node:url";
+
+const RUNNER = "openrig-dsh-runner 1";
+const NAME = process.env.OPENRIG_RUNTIME || "dsh"; // the preset's name: OpenRig passes it, and checks the record against it
+const LIVENESS_SECONDS = 60;
+const BEAT_MS = 30_000;
+// The working beat (contract section 4): every 10 s, more often than half its 30 s lifetime.
+const WORK_LIVENESS_SECONDS = 30;
+const WORK_BEAT_MS = 10_000;
+const ACTIVE_EVERY_MS = 15_000;
+const POST_TIMEOUT_MS = 2_000;
+const WAIT_SECONDS = 25;
+const READ_TRIES = 3; // reads in a row that get no answer before the runner permits
+// Refusals that say the request certainly isn't the seat's current occupant's live one: cancel it, and hold nothing.
+const NOT_LIVE = ["stale_generation", "activity_grant_wrong_seat", "activity_grant_stale"];
+// A read's states that end the request, answered cancelled (an `answered` that reaches there names an option dsh didn't
+// offer). Any other state, like an unlisted status, permits.
+const ENDED = ["refused", "withdrawn", "stale", "answered"];
+const CANCELLED = { outcome: { outcome: "cancelled" } };
+const ACP_RESOURCE_NOT_FOUND = -32002;
+// The most pages of dsh's session list read before a resume; a longer list decides nothing.
+const LIST_PAGES = 50;
+
+const PASTE_START = "\x1b[200~";
+const PASTE_END = "\x1b[201~";
+
+/** Turns terminal bytes into submitted blocks. Everything up to an Enter outside a paste is one block, line breaks
+ *  included; a block that is exactly /abort, or a Ctrl-C byte, is the only control. */
+export class InputFramer {
+  #buffer = "";
+  #pasting = false;
+  #partial = "";
+
+  push(chunk) {
+    const events = [];
+    const data = this.#partial + chunk;
+    this.#partial = "";
+    let i = 0;
+    while (i < data.length) {
+      if (data[i] === "\x1b") {
+        const rest = data.slice(i);
+        if (rest.startsWith(PASTE_START) || rest.startsWith(PASTE_END)) {
+          this.#pasting = rest.startsWith(PASTE_START);
+          i += PASTE_START.length;
+          continue;
+        }
+        if (PASTE_START.startsWith(rest) || PASTE_END.startsWith(rest)) { this.#partial = rest; break; }
+        if (!this.#pasting) { i += escapeLength(rest); continue; } // arrow keys and the like
+      }
+      const ch = data[i];
+      i += 1;
+      if (ch === "\x03") { this.#buffer = ""; this.#pasting = false; events.push({ type: "abort" }); continue; }
+      if (this.#pasting) {
+        if (ch === "\r") { if (data[i] === "\n") i += 1; this.#buffer += "\n"; } else this.#buffer += ch;
+        continue;
+      }
+      if (ch === "\r" || ch === "\n") {
+        const text = this.#buffer;
+        this.#buffer = "";
+        if (text.trim() === "/abort") events.push({ type: "abort" });
+        else if (text.trim()) events.push({ type: "block", text });
+        continue;
+      }
+      if (ch === "\x7f" || ch === "\b") {
+        if (this.#buffer) { this.#buffer = this.#buffer.slice(0, -1); events.push({ type: "erase" }); }
+        continue;
+      }
+      if (ch >= " ") { this.#buffer += ch; events.push({ type: "echo", text: ch }); }
+    }
+    return events;
+  }
+}
+
+function escapeLength(rest) {
+  if (rest[1] === "[") {
+    let j = 2;
+    while (j < rest.length && !(rest.charCodeAt(j) >= 0x40 && rest.charCodeAt(j) <= 0x7e)) j += 1;
+    return Math.min(j + 1, rest.length);
+  }
+  return rest[1] === "O" ? Math.min(3, rest.length) : 1;
+}
+
+/** JSON-RPC 2.0 with the agent, one message per line on its stdio. */
+class AgentPeer {
+  #child;
+  #next = 1;
+  #waiting = new Map();
+  #requests = new Map();
+  #notifications = new Map();
+
+  constructor(child, onNoise) {
+    this.#child = child;
+    createInterface({ input: child.stdout }).on("line", (line) => {
+      let message;
+      try { message = JSON.parse(line); } catch { message = null; }
+      if (!message || typeof message !== "object") { if (line.trim()) onNoise(line); return; }
+      if (message.method === undefined) {
+        const waiter = this.#waiting.get(message.id);
+        if (!waiter) return;
+        this.#waiting.delete(message.id);
+        if (message.error) waiter.reject(Object.assign(new Error(message.error.message ?? "error"), { code: message.error.code }));
+        else waiter.resolve(message.result);
+        return;
+      }
+      if (message.id === undefined) { this.#notifications.get(message.method)?.(message.params ?? {}); return; }
+      const handler = this.#requests.get(message.method);
+      if (!handler) { this.#write({ id: message.id, error: { code: -32601, message: `Method not found: ${message.method}` } }); return; }
+      Promise.resolve().then(() => handler(message.params ?? {}, message.id)).then(
+        (result) => this.#write({ id: message.id, result }),
+        (error) => this.#write({ id: message.id, error: { code: error.code ?? -32603, message: error.message } }));
+    });
+  }
+
+  request(method, params) {
+    const id = this.#next++;
+    return new Promise((resolve, reject) => { this.#waiting.set(id, { resolve, reject }); this.#write({ id, method, params }); });
+  }
+
+  notify(method, params) { this.#write({ method, params }); }
+  onRequest(method, handler) { this.#requests.set(method, handler); }
+  onNotification(method, handler) { this.#notifications.set(method, handler); }
+
+  failAll(reason) {
+    for (const waiter of this.#waiting.values()) waiter.reject(new Error(reason));
+    this.#waiting.clear();
+  }
+
+  #write(message) {
+    if (this.#child.stdin.writable) this.#child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", ...message })}\n`);
+  }
+}
+
+const openrigHome = () => process.env.OPENRIG_HOME || join(homedir(), ".openrig");
+
+/** The daemon's base URL and the seat's token: from the environment, else from activity-endpoint.json. */
+function openrigEndpoint() {
+  const env = process.env;
+  let base = env.OPENRIG_URL || (env.OPENRIG_PORT ? `http://${env.OPENRIG_HOST || "127.0.0.1"}:${env.OPENRIG_PORT}` : "");
+  let token = env.OPENRIG_ACTIVITY_HOOK_TOKEN || "";
+  if (!base || !token) {
+    try {
+      const file = JSON.parse(readFileSync(join(openrigHome(), "activity-endpoint.json"), "utf8"));
+      base ||= file.baseUrl ?? "";
+      token ||= file.token ?? "";
+    } catch { /* no daemon has written one yet */ }
+  }
+  return base && token ? { base: base.replace(/\/+$/, ""), token } : null;
+}
+
+async function callOpenRig(method, path, body, timeoutMs) {
+  const endpoint = openrigEndpoint();
+  if (!endpoint) return { status: 0, body: null };
+  try {
+    const response = await fetch(`${endpoint.base}${path}`, {
+      method, signal: AbortSignal.timeout(timeoutMs),
+      headers: { authorization: `Bearer ${endpoint.token}`, ...(body ? { "content-type": "application/json" } : {}) },
+      ...(body ? { body: JSON.stringify(body) } : {}),
+    });
+    let parsed = null;
+    try { parsed = await response.json(); } catch { /* not JSON */ }
+    return { status: response.status, body: parsed };
+  } catch {
+    return { status: 0, body: null };
+  }
+}
+
+/** Activity posts go one at a time, in order, and never hold up the agent. */
+class Activity {
+  #sequence = 0;
+  #chain = Promise.resolve();
+
+  constructor(identity) { this.identity = identity; }
+
+  post(hookEvent, subtype, extra = {}) {
+    const body = { ...this.identity, sequence: ++this.#sequence, occurredAt: new Date().toISOString(), hookEvent, subtype, ...extra };
+    this.#chain = this.#chain.then(() => callOpenRig("POST", "/api/activity/hooks", body, POST_TIMEOUT_MS)).then(() => {}, () => {});
+  }
+
+  flushed() { return this.#chain; }
+}
+
+const UPLOADS_OFF = [
+  "# Written by openrig-dsh-runner for this seat; safe to edit, and an existing file is left alone.",
+  "# Don't attach this seat's session log, or its plugin package names and versions, to DeepSeek API requests.",
+  "- id: session-log-deepseek",
+  "  config:",
+  "    enabled: false",
+  "- id: plugin-package-inventory-deepseek",
+  "  config:",
+  "    enabled: false",
+  "",
+].join("\n");
+
+/** Each seat gets its own writable dsh home (dsh rewrites its profile there on every start). DSH_SEAT_HOME, which a rig
+ *  spec's env: can set, or OPENRIG_DSH_HOME names one you prepared yourself, which is used as it is. Not dsh's own
+ *  DSH_HOME: a person's shell startup files can export it, and they run after the seat's env:. */
+function seatHome() {
+  const prepared = process.env.OPENRIG_DSH_HOME || process.env.DSH_SEAT_HOME;
+  if (prepared) return prepared;
+  const seat = process.env.OPENRIG_NODE_ID || process.env.OPENRIG_SESSION_NAME || "default";
+  const home = join(openrigHome(), "state", "dsh", seat, "home");
+  mkdirSync(home, { recursive: true, mode: 0o700 });
+  const patch = join(home, "cordis.patch.yml");
+  if (!existsSync(patch)) writeFileSync(patch, UPLOADS_OFF, { mode: 0o600 });
+  return home;
+}
+
+/** dsh's version as its CLI reports it, or null when it can't say. dsh 0.2.1-rc.2's ACP handshake reports 0.0.1.
+ *  SIGKILL at the timeout, because a synchronous call waits for the child to exit, and a child can ignore SIGTERM. */
+function cliVersion(bin, env) {
+  try {
+    const out = execFileSync(bin, ["--version"], { encoding: "utf8", env, timeout: 5_000, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
+    return out.match(/\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?/)?.[0] ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function writeLaunchRecord(fields) {
+  const path = process.env.OPENRIG_LAUNCH_RESULT;
+  if (!path) return;
+  const record = { format: 1, attempt: process.env.OPENRIG_LAUNCH_ATTEMPT, harness: NAME, ...fields };
+  const temp = `${path}.${process.pid}.tmp`;
+  writeFileSync(temp, `${JSON.stringify(record)}\n`, { mode: 0o600 });
+  renameSync(temp, path);
+}
+
+const sleep = (ms) => new Promise((done) => setTimeout(done, ms));
+const say = (line) => process.stdout.write(`${line}\n`);
+const firstLine = (text) => {
+  const lines = text.split("\n");
+  return lines.length > 1 ? `${lines[0]} … (+${lines.length - 1} lines)` : lines[0];
+};
+
+async function main() {
+  const env = process.env;
+  const cwd = process.cwd();
+  let firstInput = null;
+  if (env.OPENRIG_FIRST_INPUT) {
+    try { firstInput = readFileSync(env.OPENRIG_FIRST_INPUT, "utf8"); } catch (error) {
+      console.error(`openrig-dsh-runner: the first startup turn couldn't be read (${error.message}); not starting`);
+      process.exit(2);
+    }
+  }
+
+  const home = seatHome();
+  const activity = new Activity({ sessionName: env.OPENRIG_SESSION_NAME, nodeId: env.OPENRIG_NODE_ID,
+    runtime: NAME, generation: env.OPENRIG_OCCUPANT_GENERATION });
+  const agentEnv = { ...env, DSH_HOME: home };
+  delete agentEnv.OPENRIG_ACTIVITY_HOOK_TOKEN; // dsh's shell tool inherits this environment
+  agentEnv.DSH_PERMISSION_MODE ??= "workspace-write";
+  if (agentEnv.DSH_TELEMETRY_DISABLED === undefined && agentEnv.DSH_TELEMETRY_MODE === undefined) agentEnv.DSH_TELEMETRY_DISABLED = "1";
+
+  // DSH_SEAT_BIN, which a rig spec's env: can set, or OPENRIG_DSH names another dsh binary.
+  const bin = env.OPENRIG_DSH || env.DSH_SEAT_BIN || "dsh";
+  const version = cliVersion(bin, agentEnv);
+  const child = spawn(bin, ["--profile", "acp"], { cwd, env: agentEnv, stdio: ["pipe", "pipe", "inherit"] });
+  child.stdin.on("error", () => {});
+  const peer = new AgentPeer(child, (line) => say(`[dsh] ${line}`));
+  const state = { sessionId: null, turn: 0, running: false, cancelRequestedAt: null, holding: false, refused: false, queue: [], asks: new Set(), lastActive: 0, asking: 0, waiting: 0, resolvedAsk: null };
+  const inflight = new Set();
+  const track = (promise) => { inflight.add(promise); promise.finally(() => inflight.delete(promise)); return promise; };
+  let agentExited = false;
+  let stopping = false;
+  let heartbeat;
+  let workBeat;
+  let tty = false;
+  // The turn may read working: it runs, nothing holds needs input, no permission request is being submitted or waits for its
+  // permission_resolved, and dsh is alive. The beat and the agent's own reports both go by it.
+  const working = () => state.running && !state.holding && state.asking === 0 && !state.resolvedAsk && !agentExited;
+
+  const restoreTty = () => {
+    if (!tty) return;
+    tty = false;
+    process.stdout.write("\x1b[?2004l");
+    try { process.stdin.setRawMode(false); } catch { /* already closed */ }
+  };
+  const finish = async (code) => {
+    clearInterval(heartbeat);
+    clearInterval(workBeat);
+    restoreTty();
+    await Promise.race([Promise.allSettled([...inflight, activity.flushed()]), sleep(2_000)]);
+    process.exit(code);
+  };
+  const fatal = async (message, code) => {
+    stopping = true;
+    say(`[openrig-dsh] ${message}`);
+    if (!agentExited) {
+      child.kill("SIGTERM");
+      await Promise.race([new Promise((done) => child.once("exit", done)), sleep(3_000)]);
+    }
+    await finish(code);
+  };
+  const postIdle = (subtype) => activity.post("Stop", subtype, { livenessSeconds: LIVENESS_SECONDS });
+  const withdraw = (askId, reason) => track(callOpenRig("POST", `/api/activity/permission-requests/${encodeURIComponent(askId)}/withdraw`, { reason }, POST_TIMEOUT_MS));
+
+  child.once("error", (error) => { agentExited = true; void fatal(`dsh couldn't be started (${error.message}); is it on PATH?`, 1); });
+  child.on("exit", (code, signal) => {
+    agentExited = true;
+    peer.failAll("dsh exited");
+    if (stopping) return;
+    for (const ask of state.asks) ask.end("exited");
+    say(`\n[openrig-dsh] dsh exited (code ${code ?? "none"}, signal ${signal ?? "none"})`);
+    activity.post("Stop", `${NAME}_exited`);
+    void finish(code === 0 ? 0 : 1);
+  });
+
+  peer.onNotification("session/update", (params) => {
+    if (params.sessionId !== state.sessionId || !params.update) return;
+    const update = params.update;
+    const reporting = working();
+    if (update.sessionUpdate === "agent_message_chunk") {
+      if (update.content?.type === "text") process.stdout.write(update.content.text);
+      if (reporting && Date.now() - state.lastActive >= ACTIVE_EVERY_MS) { state.lastActive = Date.now(); activity.post("active", "agent_message"); }
+    } else if (update.sessionUpdate === "tool_call") {
+      say(`\n[tool] ${update.title ?? "tool"} (${update.kind ?? "other"})`);
+      if (reporting) activity.post("PreToolUse", String(update.kind ?? "other"));
+    }
+  });
+
+  const refuse = (why) => {
+    state.holding = true;
+    state.refused = true; // the seat's own refusal holds needs input until the next prompt
+    say(`[permission] refused: ${why}. The seat reads needs input until the next prompt.`);
+    activity.post("Notification", "permission_prompt", { turnId: String(state.turn) });
+    return CANCELLED;
+  };
+
+  // The answered path: OpenRig opens one ask to the default person (or the seat's override, `rig seat
+  // set-permissions-to`), and the runner reads the answer back for this same live request. With no one to ask, OpenRig
+  // permits at once, and so does the runner when OpenRig can't answer. Only the seat's opt-in (`--deny`) refuses; a
+  // request OpenRig says isn't the current occupant's, or that a person said no to with no reject option, is cancelled.
+  const askOwner = async (requestId, toolCall, options) => {
+    const turn = state.turn;
+    const live = () => state.running && state.turn === turn && !state.cancelRequestedAt && !agentExited;
+    const submitted = await callOpenRig("POST", "/api/activity/permission-requests", {
+      sessionName: env.OPENRIG_SESSION_NAME, nodeId: env.OPENRIG_NODE_ID, generation: env.OPENRIG_OCCUPANT_GENERATION,
+      nativeRef: state.sessionId, turnId: String(turn), requestId: String(requestId), toolCall,
+      options: options.map((option) => ({ optionId: option.optionId, name: option.name ?? option.optionId, kind: option.kind })),
+      occurredAt: new Date().toISOString(),
+    }, 10_000);
+    const askId = submitted.body?.ok ? submitted.body.askId : undefined;
+    if (!live()) {
+      if (askId) withdraw(askId, state.cancelRequestedAt ? "turn_cancelled" : agentExited ? "exited" : "turn_ended");
+      return CANCELLED;
+    }
+    const offered = (optionId) => options.some((option) => option.optionId === optionId);
+    // No one can be asked: OpenRig's default is permit, with the agent's own allow option.
+    if (submitted.body?.ok && submitted.body.state === "permitted" && offered(submitted.body.optionId)) {
+      say(`[permission] permitted: ${submitted.body.reason ?? "no one can be asked"} (${submitted.body.optionId})`);
+      return { outcome: { outcome: "selected", optionId: submitted.body.optionId } };
+    }
+    // When OpenRig can't answer, nobody can be asked either, so the same default applies. allow_once is preferred, so
+    // dsh doesn't remember a permission nobody chose.
+    const allow = options.find((option) => option.kind === "allow_once") ?? options.find((option) => option.kind === "allow_always");
+    const permit = (why) => {
+      if (!allow) return refuse(`${why}, and the agent offered no allow option`);
+      state.holding = state.refused || state.waiting > 0; // another ask may still wait on a person
+      say(`[permission] permitted: ${why} (${allow.optionId})`);
+      return { outcome: { outcome: "selected", optionId: allow.optionId } };
+    };
+    // A person who answered in their own words: OpenRig passes them back as `said`. They join the prompt queue like any
+    // message, so dsh gets them after this turn and after any message already waiting. They're never the answer.
+    const passOn = (said) => {
+      if (typeof said !== "string" || !said.trim()) return;
+      say(`[permission] the person also wrote: ${firstLine(said)}`);
+      submit(`The person who answered your permission request (${toolCall.title}) also wrote:\n\n${said}`);
+    };
+    if (!askId) {
+      if (submitted.body?.code === "denied_by_seat") return refuse("the seat's operator chose to refuse its permission requests");
+      if (NOT_LIVE.includes(submitted.body?.code)) {
+        say(`[permission] cancelled: OpenRig says this isn't the seat's current request (${submitted.body.code})`);
+        return CANCELLED;
+      }
+      return permit(submitted.status === 404 ? "this OpenRig has no answered path"
+        : submitted.status === 0 ? "OpenRig couldn't be reached" : `OpenRig couldn't ask anyone (${submitted.body?.code ?? submitted.status})`);
+    }
+    state.holding = true; // OpenRig recorded the seat's permission prompt when it opened the ask
+    state.waiting += 1;
+    say(`[permission] OpenRig asked a person (${askId}); waiting for their answer`);
+    // This ask no longer waits on a person; the seat still needs input while another one does, or after its own refusal.
+    const stopWaiting = () => { state.waiting -= 1; state.holding = state.refused || state.waiting > 0; };
+    // The agent got an answer or a permit for this ask: once nothing else waits, permission_resolved says the turn goes on.
+    const resolved = () => { state.resolvedAsk = { turn, askId }; };
+    return new Promise((resolve) => {
+      let done = false; // the agent has its answer
+      let ended = false; // OpenRig was told the request is over
+      const ask = { end: (reason) => {
+        if (ended) return;
+        ended = true;
+        state.asks.delete(ask);
+        withdraw(askId, reason);
+        if (done) return;
+        done = true;
+        stopWaiting(); // the turn ended the person's ask
+        resolve(CANCELLED);
+      } };
+      state.asks.add(ask);
+      void (async () => {
+        let unanswered = 0;
+        while (!done) {
+          const read = await callOpenRig("GET", `/api/activity/permission-requests/${encodeURIComponent(askId)}?waitSeconds=${WAIT_SECONDS}`, null, (WAIT_SECONDS + 10) * 1_000);
+          if (done) return;
+          if (read.status === 0 && ++unanswered < READ_TRIES) { await sleep(2_000); continue; }
+          if (read.status === 200 && read.body?.state === "pending") { unanswered = 0; continue; }
+          done = true;
+          const answer = read.body ?? {};
+          // A person's option, or OpenRig's permit when they closed it without one.
+          if ((answer.state === "answered" || answer.state === "permitted") && offered(answer.optionId) && live()) {
+            state.asks.delete(ask);
+            stopWaiting();
+            say(`[permission] ${answer.state}: ${answer.optionId}`);
+            resolve({ outcome: { outcome: "selected", optionId: answer.optionId } });
+            resolved();
+            passOn(answer.said);
+          } else if (live() && (read.status === 200 ? !ENDED.includes(answer.state) : !NOT_LIVE.includes(answer.code))) {
+            // OpenRig stopped answering, or answered in a way the contract doesn't list: nobody can be asked. The ask stays
+            // tracked, so the turn's end still withdraws it.
+            stopWaiting();
+            resolve(permit(read.status === 0 ? "OpenRig couldn't be reached" : `OpenRig couldn't answer (${answer.code ?? read.status})`));
+            if (!state.refused) resolved(); // permitted, not refused for want of an allow option
+          } else {
+            state.asks.delete(ask);
+            stopWaiting(); // a person said no, or the request is over
+            say(`[permission] not answered (${answer.reason ?? answer.state ?? answer.code ?? read.status}); answered cancelled`);
+            resolve(CANCELLED);
+            passOn(answer.said);
+          }
+        }
+      })();
+    });
+  };
+
+  peer.onRequest("session/request_permission", (params, requestId) => {
+    if (params.sessionId !== state.sessionId) throw Object.assign(new Error(`no turn of conversation ${params.sessionId} runs here`), { code: -32602 });
+    const toolCall = { title: String(params.toolCall?.title ?? "a tool call"), kind: String(params.toolCall?.kind ?? "other") };
+    const options = Array.isArray(params.options) ? params.options : [];
+    say(`\n[permission] dsh asks: ${toolCall.title} (${toolCall.kind}); options ${options.map((option) => option.optionId).join(", ")}`);
+    if (!state.running || state.cancelRequestedAt) return CANCELLED;
+    state.asking += 1; // no beat while a permission request is open: it may be waiting on a person
+    return askOwner(requestId, toolCall, options).finally(() => { state.asking -= 1; setImmediate(settle); });
+  });
+
+  // Once nothing waits on a person or is being submitted, the seat holds no refusal of its own and dsh is alive, say the turn
+  // goes on. It goes out after the agent has its answer, and before the next beat.
+  const settle = () => {
+    const done = state.resolvedAsk;
+    if (!done || state.holding || state.asking > 0) return;
+    state.resolvedAsk = null;
+    if (state.running && state.turn === done.turn && !agentExited) activity.post("active", "permission_resolved", { turnId: String(done.turn), askId: done.askId });
+  };
+
+  const abort = () => {
+    if (!state.running) { say("[openrig-dsh] no turn is running"); return; }
+    if (state.cancelRequestedAt) return;
+    state.cancelRequestedAt = new Date().toISOString();
+    peer.notify("session/cancel", { sessionId: state.sessionId });
+    say(`\n[openrig-dsh] cancel requested at ${state.cancelRequestedAt}; the turn ends when dsh says so`);
+    if (!state.refused) state.holding = false; // the seat's own refusal holds until the next accepted prompt
+    for (const ask of state.asks) ask.end("turn_cancelled");
+  };
+
+  const runTurn = async (text) => {
+    state.running = true;
+    state.turn += 1;
+    state.holding = false;
+    state.refused = false;
+    state.waiting = 0;
+    state.resolvedAsk = null;
+    state.cancelRequestedAt = null;
+    state.lastActive = 0;
+    const turnId = String(state.turn);
+    say(`\nyou ▸ ${firstLine(text)}`);
+    activity.post("UserPromptSubmit", "accepted", { turnId });
+    let stopReason;
+    try {
+      const result = await peer.request("session/prompt", { sessionId: state.sessionId, prompt: [{ type: "text", text }] });
+      stopReason = String(result?.stopReason ?? "unreported");
+    } catch (error) {
+      if (agentExited) return;
+      say(`\n[openrig-dsh] the turn failed: ${error.message}`);
+      activity.post("Notification", "runtime_error", { turnId });
+      stopReason = "error";
+    }
+    state.running = false;
+    for (const ask of state.asks) ask.end("turn_ended");
+    say(`\n── turn end (${stopReason}) ──`);
+    if (state.holding) say("[openrig-dsh] a permission request was refused, so the seat reads needs input until the next prompt");
+    else postIdle(stopReason);
+    pump();
+  };
+
+  const pump = () => {
+    if (state.running || agentExited || state.queue.length === 0) return;
+    void runTurn(state.queue.shift());
+  };
+
+  const submit = (text) => {
+    if (agentExited) return;
+    state.queue.push(text);
+    if (state.running) say(`[queued: ${state.queue.length}] this goes to dsh after the current turn`);
+    pump();
+  };
+
+  // Handshake, then open or reopen the conversation, then report it. Nothing is read as ready before this.
+  let init;
+  try {
+    init = await peer.request("initialize", { protocolVersion: 1, clientCapabilities: {}, clientInfo: { name: "openrig-dsh-runner", version: "1" } });
+  } catch (error) {
+    return fatal(`dsh didn't complete the ACP handshake (${error.message})`, 1);
+  }
+  const capabilities = init?.agentCapabilities ?? {};
+  const reported = init?.agentInfo?.version ? `${init.agentInfo.version} (as its ACP handshake reports it)` : "(version not reported)";
+  const producer = `${RUNNER}; dsh ${version ?? reported}; ACP ${init?.protocolVersion ?? "?"}`;
+  const resumeRef = env.OPENRIG_RESUME_REF;
+  // Whether dsh's own session list names a conversation, following its pages: true, false when every page was read and
+  // none names it, or undefined when the list fails, answers in another shape, or runs past LIST_PAGES pages. An ACP
+  // cursor is an opaque string, possibly empty, passed back unchanged; an absent or null one ends the list.
+  const listsConversation = async (id) => {
+    let cursor;
+    for (let page = 0; page < LIST_PAGES; page += 1) {
+      let listing;
+      try { listing = await peer.request("session/list", cursor === undefined ? {} : { cursor }); } catch { return undefined; }
+      if (!Array.isArray(listing?.sessions) || listing.sessions.some((session) => typeof session?.sessionId !== "string")) return undefined;
+      if (listing.sessions.some((session) => session.sessionId === id)) return true;
+      if (listing.nextCursor === undefined || listing.nextCursor === null) return false;
+      if (typeof listing.nextCursor !== "string") return undefined;
+      cursor = listing.nextCursor;
+    }
+    return undefined;
+  };
+  if (resumeRef) {
+    // The method dsh advertises; with neither advertised, session/resume, the method dsh 0.2.1-rc.2 answered in its
+    // maintainer's checks. dsh 0.2.1-rc.2 answers -32602 both for a conversation it doesn't have and for one active
+    // elsewhere, so that error can't mean missing. Only dsh's own "not found" counts as missing, and not when dsh's list
+    // names the conversation. The list can't show a conversation is gone: one another running dsh holds unsaved may be
+    // left out, so an unlisted conversation is still reopened. Anything else leaves the resume unconfirmed.
+    const method = capabilities.sessionCapabilities?.resume ? "session/resume" : capabilities.loadSession ? "session/load" : "session/resume";
+    const listed = capabilities.sessionCapabilities?.list ? await listsConversation(resumeRef) === true : false;
+    try {
+      await peer.request(method, { sessionId: resumeRef, cwd, mcpServers: [] });
+    } catch (error) {
+      if (error.code === ACP_RESOURCE_NOT_FOUND && !listed) {
+        writeLaunchRecord({ error: "missing", producer });
+        return fatal(`dsh says conversation ${resumeRef} doesn't exist (${error.message}); no new one was started`, 3);
+      }
+      return fatal(`dsh couldn't reopen conversation ${resumeRef} (${method}: ${error.message}); the resume is unconfirmed and no new conversation was started`, 4);
+    }
+    state.sessionId = resumeRef;
+  } else {
+    try {
+      state.sessionId = (await peer.request("session/new", { cwd, mcpServers: [] }))?.sessionId ?? null;
+    } catch (error) {
+      return fatal(`dsh couldn't open a conversation (${error.message})`, 1);
+    }
+    if (!state.sessionId) return fatal("dsh opened a conversation without naming it", 1);
+  }
+  writeLaunchRecord({ nativeRef: state.sessionId, producer });
+  say(`[openrig-dsh] ready · ${producer} · conversation ${state.sessionId}`);
+  say(`[openrig-dsh] DSH_HOME ${home} · DSH_PERMISSION_MODE ${agentEnv.DSH_PERMISSION_MODE}`);
+  say("[openrig-dsh] each submitted message is one prompt; /abort or Ctrl-C cancels the running turn");
+
+  heartbeat = setInterval(() => { if (!state.running && !state.holding && !agentExited) postIdle("idle_heartbeat"); }, BEAT_MS);
+  // While a turn runs and nothing waits on a person: the turn is still outstanding and dsh is alive. Not progress.
+  workBeat = setInterval(() => {
+    if (working()) {
+      activity.post("active", "liveness", { turnId: String(state.turn), livenessSeconds: WORK_LIVENESS_SECONDS });
+    }
+  }, WORK_BEAT_MS);
+  for (const signal of ["SIGHUP", "SIGTERM"]) {
+    process.on(signal, () => {
+      if (state.running && !state.cancelRequestedAt) peer.notify("session/cancel", { sessionId: state.sessionId });
+      for (const ask of state.asks) ask.end("exited");
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), 3_000).unref();
+    });
+  }
+  process.on("SIGINT", abort);
+
+  const framer = new InputFramer();
+  if (process.stdin.isTTY) {
+    process.stdin.setRawMode(true);
+    process.stdout.write("\x1b[?2004h");
+    tty = true;
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      for (const event of framer.push(chunk)) {
+        if (event.type === "echo") process.stdout.write(event.text);
+        else if (event.type === "erase") process.stdout.write("\b \b");
+        else if (event.type === "abort") { process.stdout.write("\n"); abort(); }
+        else if (event.type === "block") { process.stdout.write("\n"); submit(event.text); }
+      }
+    });
+  } else {
+    createInterface({ input: process.stdin }).on("line", (line) => {
+      if (line.trim() === "/abort") abort();
+      else if (line.trim()) submit(line);
+    });
+  }
+
+  if (firstInput !== null) submit(firstInput);
+  else postIdle("idle_heartbeat");
+}
+
+const invoked = (() => {
+  try { return process.argv[1] ? pathToFileURL(realpathSync(process.argv[1])).href : null; } catch { return null; }
+})();
+if (invoked === import.meta.url) {
+  main().catch((error) => { console.error(`openrig-dsh-runner: ${error.stack ?? error}`); process.exit(1); });
+}
@@ -10,3 +10,4 @@ limits:
  - no guidance, skills or startup files are placed
  - needs-input and approval prompts are read from the screen only
 names_conversation: true
+passes_model: false              # the launcher maps OPENRIG_MODEL for a new session; set true once checked with the real harness
@@ -24,6 +24,21 @@ if ! grep -qs OPENRIG_SESSION_NAME "$HERMES_HOME/config.yaml"; then
  echo "openrig-hermes-launch: $HERMES_HOME/config.yaml doesn't pass OPENRIG_SESSION_NAME to Hermes's tools, so rig run from Hermes won't act as this seat; see config.yaml.example" >&2
 fi

+# The seat's declared model (OPENRIG_MODEL, when the preset sets passes_model): Hermes takes it only from config.yaml, and
+# Hermes v0.22.4 fixes a session's launch settings when it creates it. So it's written for a new session only, and only
+# into a config.yaml that is absent or empty: a seat's own config is left byte-for-byte as it is, whatever it says. On a
+# resume this launcher applies no OpenRig model.
+if [ -n "${OPENRIG_MODEL:-}" ] && [ -z "${OPENRIG_RESUME_REF:-}" ]; then
+  case "$OPENRIG_MODEL" in
+    ''|*[!A-Za-z0-9._:/@+-]*) echo "openrig-hermes-launch: not writing unusual model id \"$OPENRIG_MODEL\" into $HERMES_HOME/config.yaml" >&2 ;;
+    *) if [ -s "$HERMES_HOME/config.yaml" ]; then
+         echo "openrig-hermes-launch: the seat has its own $HERMES_HOME/config.yaml; OPENRIG_MODEL was not applied; set the model there" >&2
+       else
+         printf 'model: "%s"\n' "$OPENRIG_MODEL" >> "$HERMES_HOME/config.yaml"
+       fi ;;
+  esac
+fi
+
 if [ -n "${OPENRIG_RESUME_REF:-}" ]; then
  exec "$hermes" chat -c "$OPENRIG_RESUME_REF"
 fi
@@ -0,0 +1,5 @@
+# OpenShell reference driver
+
+Run `rig environment setup --help` to install the maintained OpenShell 0.1.6 / Claude Code reference from the packaged daemon assets. Its README, image recipe, endpoint-specific policy, example RigSpec/AgentSpecs and versioned driver schema are installed together. Setup prepares files and an ordinary scoped work grant; it does not create compute or launch a provider.
+
+This first cut supports explicit owned create or exact attached binding, required destination projection and verified JSON artifact return through authenticated MCP work tools. Explicit owned lifecycle operations retain separate observed receipts. Exact same-host recreate/restore requires verified private history and the selected checkpoint; attached native, storage and compute are preserved. A native process receipt is not a successful model-work claim. Existing unbound host runtimes retain their launch/projection paths.
@@ -4,6 +4,9 @@ A community harness is a coding harness an outside contributor maintains. You in
 rig member runs it by naming it as its `runtime`. OpenRig doesn't test these harnesses. It shows them as community
 harnesses, and it reads their activity only from what the screen shows.

+For what an integration author owns end to end, including a runner's duties and running a harness somewhere else, see
+the draft [integration author contracts](author-contracts.md).
+
 ## What a community harness gets

 What OpenRig does for a community-harness seat, capability by capability. **Partly** and **no** mean OpenRig shows that it doesn't know;
@@ -15,14 +18,14 @@ it never reads an unsupported capability as idle, working, ready or verified.
 | Delivery | yes | `rig send` and queue wakes paste the text into the pane and press Enter, as for any seat. A pane that's back at a shell is refused (`target_runtime_unverified`) and nothing is typed. OpenRig doesn't confirm the harness took the message; `rig send --verify` checks the pane afterwards. |
 | Identity | when declared | With `launch_result`, the conversation is shown as reported by its launcher; with `names_conversation`, as named by OpenRig. Neither is observed by OpenRig. Without either, the identity is unavailable. |
 | Resume | when declared | `resume: true` with one of the two above (see [Reopening a conversation](#reopening-a-conversation-resume-true)). Without it, a resume says `Resume is unsupported: community harness "<name>" is launch-only`, and a restore stops and asks. |
-| Activity | partly | Read from the screen only; there are no activity hooks. Work and attention the screen shows are kept, but a screen that looks idle reads `unknown`, never idle, because a quiet prompt can be an approval or a pause. |
+| Activity | partly | Read from the screen only; there are no activity hooks. Work and attention the screen shows are kept, but a screen that looks idle reads `unknown`, never idle, because a quiet prompt can be an approval or a pause. A [runner preset](#runner-presets-runner-true)'s own reports decide it instead. |
 | Attention | partly | Read from the screen: a permission question or numbered choice that OpenRig recognizes reads as needing attention, and `rig send` won't type into it. A prompt it doesn't recognize reads `unknown`. |
-| Approval | no | Approvals stay in the harness's own pane. OpenRig relays none, so a person answers them there. |
+| Approval | no | Approvals stay in the harness's own pane. OpenRig relays none, so a person answers them there. A [runner preset](#runner-presets-runner-true) is the exception: its runner submits the agent's permission requests to OpenRig, which asks a person, and the default is permit (section 7 of the [harness and runner contract](harness-runner-contract.md)). |
 | Cancel | no | OpenRig has no verb that cancels a running turn. `rig seat stop` and `rig down` end the seat's tmux session; anything the harness runs outside its pane, such as a gateway, is its own, and the preset's `limits` should say what keeps running. Restarting in place and switching harness are refused. |
 | Transport | yes | The seat is a tmux pane like any other, so `rig capture`, `rig send` and `--host` work as they do for any seat. |

 **Not placed:** guidance, skills and startup files (a launch warns that they weren't delivered), and the model: set it in the harness's own
-configuration.
+configuration, or let a launcher that opts in take the seat's declared model (`passes_model`, below).

 **Check that the harness answers on its own first.** Before writing a preset, start the harness in a terminal outside OpenRig, with the
 same configuration and credentials your launcher will give it, and send it one prompt. Use the folder your launcher gives the seat, not
@@ -48,6 +51,8 @@ launch_result: true             # optional: the launcher reports the conversatio
 resume: true                    # optional, needs one of those two; declare it only once your harness's resume is checked
 startup_assisted: true           # optional: startup submission needs a person's check (below)
 first_input: true                # optional: launcher takes the first turn from OPENRIG_FIRST_INPUT (below)
+# runner: true                  # optional, needs launch_result: the launcher reports the seat's activity (below)
+# passes_model: true            # optional: the launcher takes the seat's declared model from OPENRIG_MODEL (below)
 ```

 - **`command`** is a single program and its arguments. Shell syntax such as `|`, `&&`, `;`, redirections or `$(…)`
@@ -144,6 +149,45 @@ For a reported conversation, OpenRig also says so plainly when:
 - **the saved conversation isn't this harness's own** (a former runtime's id, say): it isn't passed to the launcher. A restore stops and asks, and elsewhere the resume says it isn't possible;
 - **the record's folder can't be made:** the launcher couldn't be told what to reopen, so nothing starts.

+## Runner presets (`runner: true`)
+
+A plain preset's seat reads its activity from the screen. A **runner** preset is for a launcher that hosts the agent itself
+and reports what it's doing, as OpenRig's own Pi runner does. The seat's activity then follows those reports.
+
+- **It needs `launch_result: true`.** A runner reports the conversation it opened in its launch record, so `runner: true`
+  without `launch_result` is refused.
+- **The declaration is fixed at launch.** Each launch, a restore's included, records on the session what the preset
+  declares at that moment. Editing the preset changes the next launch, not a running seat. A session recorded before this
+  field existed reads as plain.
+- **No record means attention.** When a runner's launch record doesn't arrive within the wait, or its folder can't be
+  made, the seat needs attention instead of reading ready. A plain `launch_result` preset still starts, with its identity
+  unavailable.
+- **Input is as for any seat.** A send pastes the text and presses Enter, so a runner should submit everything up to that
+  Enter as one prompt.
+
+**What the runner posts.** The runner posts each event to `POST /api/activity/hooks` with the local activity hook token,
+one at a time and in order, without making the agent wait. It finds the address and token in `OPENRIG_URL` (or
+`OPENRIG_PORT`) and `OPENRIG_ACTIVITY_HOOK_TOKEN`, or else in `$OPENRIG_HOME/activity-endpoint.json`. Every post names:
+- the seat, as `sessionName` and `nodeId`;
+- `runtime`, the preset's name;
+- `generation`, from `OPENRIG_OCCUPANT_GENERATION`;
+- an increasing `sequence`, and `occurredAt`;
+- `hookEvent` and `subtype`, as in the table.
+
+| The runner posts | When | The seat reads |
+|---|---|---|
+| `UserPromptSubmit` | it gave the agent a prompt | working |
+| `active` or `PreToolUse` | the agent is working | working |
+| `Notification` / `permission_prompt` | the agent asked for a permission | needs input |
+| `Stop` / the turn's stop reason | the turn ended | idle |
+| `Stop` / `<preset name>_exited` | the agent's process ended | unknown, never idle |
+
+- **The screen still counts,** but only as evidence of work: on its own it never reads the seat idle.
+- **The generation attributes a post; it isn't authentication.** A post with an earlier occupant's generation doesn't
+  count for the live seat. The hook token is one local token, so any process that holds it can post for any seat.
+- **A runner's full duties** (liveness, input, cancellation and permissions) are in the draft
+  [harness and runner contract](harness-runner-contract.md).
+
 ## An example: Hermes

 [`community-harness-examples/hermes/`](community-harness-examples/hermes/) has a preset and a small launcher for Hermes
@@ -241,8 +285,32 @@ on it, not Pi choosing by itself to park or hand work on.

 Copy both and maintain them as your own.

+## An example runner: dsh
+
+[`community-harness-examples/dsh/`](community-harness-examples/dsh/) has a runner preset (`runner: true`) and a small runner
+for DeepSeek Harness, which speaks ACP on stdio and has no terminal UI of its own. It's written for dsh 0.2.1-rc.2 and
+checked only against a stand-in agent.
+- **The runner:**
+  - it opens the conversation and writes the launch record;
+  - it turns each submitted block into one prompt;
+  - it reports turn boundaries as activity hooks;
+  - it cancels on `/abort` or Ctrl-C, as the [runner contract](harness-runner-contract.md) describes.
+- **Permissions:** it sends each request to OpenRig, which asks the default person or the seat's override.
+  - **When no one can be asked, or OpenRig can't answer,** it permits with dsh's own allow option (`allow_once`, else
+    `allow_always`), which is OpenRig's default. `allow_always` creates a standing grant in dsh.
+  - **It refuses and holds needs input** only after `--deny`. A person's no when dsh offered no reject option, or a
+    request OpenRig says isn't the current occupant's, is answered cancelled.
+- **Each seat gets its own dsh home,** with dsh's session-log and plugin-list uploads to DeepSeek turned off. Give that
+  home credentials, or put a provider key in the seat's environment.
+- **Resume isn't declared.** The runner reopens a conversation by the method dsh advertises, and reports one missing only
+  on dsh's own not-found error. Declare `resume: true` only after a real dsh has reopened a conversation and refused a
+  missing one.
+
+Its [README](community-harness-examples/dsh/README.md) has the setup and a check you can run without a model. Copy both
+and maintain them as your own.
+
 The launcher is the contributor's code, in the contributor's package. OpenRig runs no code from a preset and loads no
-module into its daemon. A preset that sets `launch_result`, `names_conversation`, `startup_assisted` or `first_input` is refused by an older
+module into its daemon. A preset that sets `launch_result`, `names_conversation`, `startup_assisted`, `first_input`, `runner` or `passes_model` is refused by an older
 OpenRig that doesn't know the field.

 ## Pass the first startup input at launch
@@ -255,6 +323,37 @@ OpenRig records `node.startup_first_input_passed` with the path and `submission:

 Presets without `first_input` and built-in runtimes keep their existing behavior. Older OpenRig versions reject this new field as unknown. The private input file remains for diagnostics; it can contain private startup context. A launcher that turns its contents into one argument is subject to the platform’s argument-size limit; the launcher must report a launch error rather than silently truncate the turn. The examples’ argument transport is covered with stand-ins; native unattended startup still requires qualification with the installed harness.

+## Pass the seat's declared model at launch
+
+A format-1 preset may set `passes_model: true` (a boolean, default false). Then a model declared for the seat (in the rig
+spec, or set later with `rig seat set-model`) reaches its launcher as `OPENRIG_MODEL`, on new and resumed launches alike. A seat that declares no model gets none,
+and an inherited `OPENRIG_MODEL` is cleared. The launcher maps it into its harness's own setting; Core knows no harness's
+model flag or config key.
+
+OpenRig keeps three things apart:
+- **requested:** the declared model, as `rig ps --nodes` shows it ("configured", or "not-declared");
+- **passed:** the launcher was handed the model. OpenRig records `node.startup_model_passed` with the model and whether the
+  launch was a resume only when the launch command's send succeeded, and a later failure of the launch doesn't undo that.
+  It never says passed from the declaration alone or for a launch that failed before anything was typed. When typing
+  began and the send then failed, the model's dispatch is uncertain: it isn't recorded as passed, and it isn't retyped;
+- **effective:** the model that actually runs. OpenRig doesn't observe it for a community harness, so it reads UNKNOWN.
+
+Passing a model never makes OpenRig pick a default, substitute another model, or retry with one. A model the harness
+refuses is the harness's own error.
+
+The examples apply the request for a new session only; on a resume, the example launcher doesn't apply it, and which
+model a resumed session runs stays unknown unless the harness's own evidence says otherwise:
+- **Cursor:** `--model "$OPENRIG_MODEL"` for a new chat. What a resumed chat runs hasn't been checked: the launcher leaving
+  out `--model` doesn't show that it keeps its earlier model.
+- **Hermes:** Hermes takes its model only from the seat's `config.yaml`, so for a new session the launcher writes
+  `model: "<id>"` there only when that file is absent or empty. A seat that has its own `config.yaml` keeps it
+  byte-for-byte, and the launcher says the model wasn't applied: set it in that file. A seat set up from
+  `config.yaml.example` already has a config, so set its model there. Hermes v0.22.4 fixes a session's
+  launch settings when it creates it (its own source), so a resumed Hermes session runs with what it was created with.
+
+Both example presets ship with `passes_model: false` until that mapping has been checked with the real harness. Presets
+without the field and built-in runtimes are unchanged, and older OpenRig versions reject it as unknown.
+
 ## Interactive Pi in a terminal seat: the coordination skills

 This is for a seat that runs interactive `pi` from a `runtime: terminal` member's startup, or from a community preset's
@@ -0,0 +1,203 @@
+# Writing a daemon client
+
+What a program that talks to the OpenRig daemon over HTTP needs and can't read from `rig --help`: how to find the
+daemon, its health route, which bearer token each route family checks, the event streams, and some route
+details. It describes the daemon as it is. It adds no promise beyond what each section says, and route shapes not
+listed here can change.
+
+## Finding the daemon
+
+`rig status --json` is the discovery surface. Its `daemon` object gives `state` and `reachable`, and `pid` and
+`port` when they are known: a stopped daemon's response has no `port`, and a running daemon found through
+`OPENRIG_URL` has no `pid`. `reachable` is `true` when the daemon answered its health probe, `false` when it is
+positively down, and `null` when that isn't confirmed (see `rig status` in
+[the command reference](../as-built/cli-reference.md#status)). It reads the recorded state and probes; it never
+starts a daemon.
+
+The CLI itself finds the daemon in these orders:
+
+- **Data commands** (everything that sends a request): `OPENRIG_URL` (or the legacy `RIGGED_URL`); else
+  `$OPENRIG_HOME/daemon.json` when it holds a valid `pid` and `port`; else the config keys `daemon.host` and
+  `daemon.port` (environment `OPENRIG_HOST` and `OPENRIG_PORT`), which default to `127.0.0.1:7433`.
+- **Status** (`rig status`, `rig daemon status`): `OPENRIG_URL` (or `RIGGED_URL`) first, probed directly; else
+  the state file below.
+- **Start and stop** (`rig daemon start`, `stop`): the state file, `$OPENRIG_HOME/daemon.json`, then the legacy
+  `~/.rigged/daemon.json`.
+
+`daemon.json` holds `pid`, `port`, `host`, `db` and `startedAt`. `rig daemon start` writes a new daemon's record
+only after its health check passes, so while a start is pending, the file holds no record of the new daemon: it
+may be missing, or hold an earlier daemon's stale record. It is the CLI's own state file, not a published
+contract: prefer `rig status --json`.
+
+## `GET /healthz`
+
+The liveness and identity read. It always returns `status: "ok"` and `pid`. Every other field is present only
+in the case named:
+
+| Field | When it is present |
+| --- | --- |
+| `euid` | On platforms with effective user ids. A self-report for the CLI's owner check, not authentication. |
+| `databaseWarnings` | When the daemon opened its database with warnings. |
+| `semver`, `commit`, `dirty`, `builtAt` | On a stamped (released) build; a development run has none. |
+| `selfHostId`, `selfHostIdSource` | After the boot reconcile has set this host's id. |
+| `eventLoop` | When the event-loop monitor runs: `lagMeanMs`, `lagP99Ms`, `utilization` (0 to 1), `lastTickAgeMs` and `healthy`. |
+| `routeTimings` | With `eventLoop`. |
+| `slowOperations` | When the slow-operation recorder runs. |
+| `bind` | The bind plan: `mode` (`explicit` or `default`), `hosts` (the addresses bound), `tailscaleDetected`, and `ignoredRoutingHost` when a routing value was ignored. |
+| `stuckSweep`, `wakeLadder` | The heartbeats of the stuck sweep and the wake ladder, when they run. |
+
+## Bearer tokens
+
+The daemon reads two tokens from its environment at start:
+
+- **`OPENRIG_AUTH_BEARER_TOKEN`** checks Mission Control's write routes (`POST /api/mission-control/action` and
+  `/notifications/test`), the `/api/hosts` writes (`add`, `update`, `remove`, `pair`), and the `/api/rig-mode`
+  binding writes. `rig host pair` hands this token to the paired machine, so a daemon that will be paired with
+  needs it set (see `rig host pair` in [the command reference](../as-built/cli-reference.md)).
+- **`OPENRIG_TERMINAL_BEARER_TOKEN`** checks every `/api/transport` and `/api/compaction` route, `POST
+  /api/terminal/follow` and `/viewer/ensure`, and every `GET /api/terminal/<name>` route, the terminal websocket
+  included. When the daemon is bound to an explicit address (`rig daemon start --host`) that isn't loopback or a
+  tailnet address, and this token isn't set, these routes check `OPENRIG_AUTH_BEARER_TOKEN` instead.
+
+A route whose token isn't set lets every request through. Send a token as `Authorization: Bearer <token>`; the
+`GET /api/terminal/<name>` routes, the websocket included, also take `?token=<token>`. The CLI sends the terminal token from `OPENRIG_TERMINAL_BEARER_TOKEN`,
+or else from the file `$OPENRIG_HOME/terminal-token`, which the person writes; the daemon doesn't create it.
+
+A wrong or missing token gets HTTP 401. The routes that check `OPENRIG_AUTH_BEARER_TOKEN`, and `/api/transport`
+and `/api/compaction`, answer `{ "error": "unauthorized", "message", "what_failed", "why_it_matters", "what_to_do" }`.
+The `GET /api/terminal/<name>` routes, the websocket included, answer `{ "error": "unauthorized", "hint" }`. A token
+doesn't get past the browser boundary's 403 refusals, which [Browser access](browser-access.md) describes.
+
+## Event streams
+
+All three are server-sent events (`text/event-stream`):
+
+- **`GET /api/events`**: the daemon's event log. `?rigId=` limits it to one rig. Each event carries `id: <seq>`.
+  Without `Last-Event-ID`, `?replay=<n>` first sends the newest `n` stored events (`0`: none, live events only);
+  `?replay=all`, no `replay`, or any other value sends the whole log first. A `Last-Event-ID` header (what
+  `EventSource` sends when it reconnects) sends the events after that id instead, whatever `replay` says.
+  Live events that arrive during the replay follow it, without duplicates.
+- **`GET /api/activity/events`**: live only, no replay or ids. Each message is named after its event type:
+  `seat.activity_changed`, `seat.rung_health`, `proof.judged` or `proof.sources_changed`. It tells a view to read
+  again; it carries no derived state.
+- **`GET /api/queue/sse`** (alias `/api/queue/watch`): live only, with `id: <seq>`, for `queue.created`,
+  `queue.handed_off`, `queue.claimed`, `queue.unclaimed`, `qitem.fallback_routed`, `qitem.closure_overdue`,
+  `inbox.absorbed` and `inbox.denied`.
+
+## People, asks and updates without Slack
+
+`GET /api/gateway/participants` returns the same JSON projection as `rig gateway participants --json`:
+`{ ok, participants, default, organizations, groups, warnings, participantFile }`. Pick a person by `kind: "person"`
+and use their `id` for a Feed `view`, or their `address` for the queue's `destinationSession`. The effective
+`default` is `{ id, source }`, or `{ id: null, reason }`; it does not establish who is using the client.
+Participant records omit connector credential pointers. Check `warnings` and `participantFile.error` for a partial
+registry read; an unreadable human registry returns HTTP 503. See [Gateway participants](gateway-participants.md).
+
+| Read | Meaning |
+| --- | --- |
+| `GET /api/queue/list?destinationSession=<address>&state=pending,in-progress,blocked&limit=100` | Open rows for exactly that address. `humanIntent: "update"` identifies an FYI; other values are asks. Each row has `qitemId`, `state`, `summary` and `body`. |
+| `GET /api/queue/open-human-updates?view=<person-id>&limit=20` | Open human FYIs, even when no Slack delivery receipt exists. Returns `{ items, limit, truncated, perspective? }`. |
+| `GET /api/queue/<qitemId>` and `/<qitemId>/transitions` | The current row and its history, including closed state and recorded outcome. Closing or acknowledging a row is different from delivering it. |
+| `GET /api/queue/human-updates?view=<person-id>&limit=20` | Existing delivered-update history: explicit FYIs with a recorded Slack posting receipt, including closed rows. Items add `deliveredAt` and `deliveryReceipt`. It is not the open-update inbox. |
+
+Both update lists accept integer `limit` values from 1 to 100 (default 20); invalid values return HTTP 400.
+Open FYIs are ordered by priority, then newest first. `view=all` (also the default) shows all perspectives;
+`view=default` selects the effective default person, or all when no default is available. A named view that cannot
+resolve a person has `perspective.basis: "unknown"` and no items when a registry is available. With no registered
+people there is no perspective filter: inspect `perspective` rather than assuming the requested view was applied.
+A person's view also includes instance or unassigned items when that person is the default. These are views on a
+trusted daemon, not per-person authentication or access control; existing daemon and browser access rules still apply.
+
+Always display `truncated: true` as incomplete, even if fewer than `limit` items arrive. A person-view scan examines
+at most 1,001 open updates (101 for delivered history) before filtering; older matching items may be outside that
+window. These endpoints have no pagination cursor. Reading an open update never posts it to Slack, acknowledges it,
+or manufactures a delivery receipt.
+
+For example, this Node client takes a daemon URL, a registered person id and a rig name. It uses no Slack API and
+makes only reads; use the daemon discovery and access rules above. In an ES module, `process.argv.slice(1)` is the
+argument list for `node --input-type=module -e '<code>' <url> <person-id> <rig>`:
+
+```js
+// client-people-example
+const [base, personId, rig] = process.argv.slice(1);
+async function get(path) {
+  const response = await fetch(new URL(path, base));
+  if (!response.ok) throw new Error(`${path}: HTTP ${response.status}`);
+  return response.json();
+}
+const registry = await get("/api/gateway/participants");
+const person = registry.participants.find(p => p.kind === "person" && p.id === personId);
+if (!person) throw new Error("Choose a registered person id");
+const rows = await get(`/api/queue/list?destinationSession=${encodeURIComponent(person.address)}&state=pending,in-progress,blocked&limit=100`);
+const updates = await get(`/api/queue/open-human-updates?view=${encodeURIComponent(person.id)}&limit=20`);
+const receipts = await get(`/api/queue/human-updates?view=${encodeURIComponent(person.id)}&limit=20`);
+const rigHistory = await get(`/api/queue/list?rig=${encodeURIComponent(rig)}&limit=100`);
+const messages = await get(`/api/queue/outbox/list?rig=${encodeURIComponent(rig)}&limit=100`);
+console.log(JSON.stringify({ participants: registry.participants, default: registry.default,
+  warnings: registry.warnings, participantFile: registry.participantFile,
+  asks: rows.filter(row => row.humanIntent !== "update"), updates, receipts, rigHistory, messages }, null, 2));
+```
+
+The queue and outbox lists are bounded snapshots, not subscriptions. A full queue list may need a larger `limit`.
+An outbox entry's `deliveryState` reports the send attempt; only `delivered` confirms delivery. A queue transition,
+an open FYI, or a closed ask is not that receipt. The rig-wide reads and their limits are described below; the existing
+`outbox/list?senderSession=<session>` read remains available.
+
+## Route details
+
+- **A rig's queue history:** `GET /api/queue/list?rig=<rig>&updatedSince=<ISO time>&sort=updated` returns the
+  rig's queue items (any whose source or destination seat is in the rig) updated at or after that time: open items
+  (`pending`, `in-progress`, `blocked`) first, then the rest by latest update. `limit` defaults to 100 and has no
+  upper cap. The list is cut after `limit` rows in that order, so when it comes back full, raise `limit` to read
+  them all. Each item's own history is `GET /api/queue/<qitemId>/transitions`. This read scans the queue table, so
+  read it occasionally rather than polling it. For live changes, treat `GET /api/queue/sse` events as hints to read
+  `queue/list?rig=` again. Not every event names both seats (`queue.claimed` and `queue.unclaimed` carry only the
+  destination), and not every state change is on that stream, so the events alone don't track a rig's items.
+- **A rig's messages:** `GET /api/queue/outbox/list?rig=<rig>` returns the messages sent from or to the rig's
+  seats, newest first; `?senderSession=<session>` still returns one sender's. One of the two is required; with
+  both, `senderSession` is used and `rig` is ignored. `limit` defaults to 100. No event is sent when a message is delivered, so read this list to see delivery
+  states.
+- **`GET /api/queue/recent-transitions`** returns at most 20 rows. A positive `limit` above 20 is capped at 20;
+  a missing, zero, negative or unparseable `limit` means 20.
+- **`POST /api/transport/send`** takes `urgent: true`, the same as `rig send --urgent`. The daemon records who
+  marked it from the sender identity, not from the body.
+- **`POST /api/scope/approve`** is what `rig scope slice approve` and `rig scope mission approve` call. The body
+  takes `scopeTier` (`slice` or `mission`), `scopePath`, and optionally `approvalScope` (`spec` or `delivery`, the
+  default), `missionsRoot`, `onBehalfOf`, `reApprove`, `reason` and `lockedArtifacts`. The approver is the
+  request's sender identity (`actorSession` in the body is recorded beside it, and a different value is
+  superseded). Success is 201 with `scopeTier`, `scopeId`, `scopePath`, `approvalScope`, `approvedBy`,
+  `approvedAt`, `onBehalfOf`, `actionId`, `freezeFired` and `reApproved`. Refusals include 400 for an invalid
+  `scopeTier`, `scopePath` or `approvalScope`, or a missing actor (`actor_required`); 503 `action_log_unavailable`;
+  and, from the approval itself, 404 `scope_not_found`, 409 `already_approved` or `nothing_to_reapprove`, 503
+  `workspace_not_configured`, 500 `audit_write_failed`, and 400 for its other refusals. An unexpected error is 500
+  `internal`.
+- **`POST /api/proof/judge`** is what `rig proof judge` calls. The body takes `scope`, `item`, `verdict`
+  (`accept`, `reject` or `withdraw`), `reason`, `expectedRevision` and `expectedPrevious` (a judgment id or
+  `null`), and optionally `evidence`, `expectedEvidence`, `subject`, `operationId`, `replace`, `project` and
+  `projectRoot`. The judge is the request's sender identity. The response is `judgment`, the slice's `readiness`,
+  `replayed` and `notification`: 201 for a new judgment, 200 when an `operationId` replays an earlier one.
+- **`POST /api/workflow/instantiate`** requires `specPath`, `rootObjective` and `createdBySession`, and takes
+  `entryOwnerSession`, `targetRig` and `scope` (see [Project workspace](project-workspace.md) for `scope`).
+  Success is 201 with `instance`, `spec`, `entryQitemId` and `entryOwnerSession`, any `advisories`, and
+  `scopeIgnored` when a scope wasn't applied.
+- **`GET /api/provider/usage`** returns `{ hostUsage }`, this host's usage rows (`host: "local"`, a `provider`
+  and a `state`). A Claude row's `windows` are the seats' status-line readings, one entry per reading, each with
+  its `window`, `usedPercent`, `resetsAt`, `asOf` and `seatSession`. A Codex row has `windows: []`. Treating the
+  readings as one account rests on the deployment assumption the row's `provenance` names (one account per
+  host), not on a measured identity. Readings whose reset times disagree are reported as `anomalies`, and the
+  row's `state` can then be `explicit_unknown`. Show the row's `state`, `anomalies` and each reading's seat and
+  `asOf` as reported, rather than merging readings that happen to match.
+- **Slack channels and people:** `GET /api/gateway/slack/channels` and `GET /api/gateway/slack/users` each return
+  one page from Slack, read with the daemon's configured bot token, which never leaves the daemon. Channels are
+  public and unarchived, as `{ id, name, isMember }`; people are `{ id, name, realName, displayName, isBot,
+  deleted }`, with no email. Pass `cursor` (the previous page's `nextCursor`, `null` on the last page) and
+  `limit` (default 100, at most 200). Inbound delivery needn't be enabled. Failures: 503 `slack_not_configured`
+  when no bot token resolves, which is different from an empty list; 403 `slack_missing_scope` with the scope
+  Slack names in `needed` (an older app may lack `users:read`); 429 `slack_rate_limited` with Slack's
+  `Retry-After`; otherwise 502. Each request is a live Slack call, so page through a list when someone opens a
+  chooser rather than polling it. Private channels and direct messages aren't listed.
+- **Slices are found by folder name alone.** `GET /api/slices/:name`, `/:name/doc/*`, `/:name/proof-asset/*` and
+  `GET /api/review/slice/:name` take only the name; the detail route reads `?mission` only together with
+  `?project`. When two missions have a slice folder of the same name, the daemon keeps the first one it finds:
+  that one is listed and served, and the other doesn't appear in `GET /api/slices` at all. Keep slice names unique
+  across missions, as [Project workspace](project-workspace.md) says.
@@ -0,0 +1,138 @@
+# Execution and platform integration contract — draft
+
+This chapter describes the placement and resource responsibilities of an integration author. The harness/runner chapter owns native protocol, model input, activity, attention, permission exchange and turn cancellation. This chapter owns where that harness runs, which files and credentials it can reach, how native state survives an environment change, and how results and resources return to their owners.
+
+**Status:** a design contract for authors, with an existing-compatible composition and one measured private implementation. Since 0.7.8, OpenRig also ships one maintained reference driver, OpenShell 0.1.6, as `rig environment` (see the [OpenShell example](community-harness-examples/openshell/README.md)). The measured baseline used OpenRig 0.7.4, OpenShell 0.1.6 and Claude Code 2.1.310. 0.7.6 published this draft; neither it nor the reference driver implements a generic environment driver, a `DeploySpec` loader or a cross-host native-resume guarantee. Proposed operations below are not commands or accepted configuration keys. Capability support must be stated for the actual integration and version.
+
+## Keep the identities and responsibilities separate
+
+RigSpec composes members, their AgentSpecs/profiles, runtimes, working directories and relationships. AgentSpec supplies reusable role, startup and context declarations. A built-in runtime or registered community preset supplies a launch path. An environment integration supplies placement and provider-specific resource handling around that path. Existing declarations do not automatically provision a remote filesystem, credentials or compute.
+
+| Identity or handle | Meaning and responsibility |
+|---|---|
+| Stable seat and work identity | The member's canonical address/node and owned work records. OpenRig retains this identity across executions; an environment IP or display name does not replace it. |
+| Native session identity | The harness's conversation token/UUID, qualified by harness and resume-reference type. The harness owns its format and resume semantics. |
+| Environment binding | The integration's durable record linking placement, immutable provider resource IDs, native-state location, projection and ownership. It is separate from the native session token. |
+| Execution generation | A particular launch/process instance, with observable process/start identity when available. A new process can resume an old conversation. |
+| Viewer/client | A terminal attachment or connection to an execution. Closing it need not stop either the native process or compute. |
+
+An application service bundled with a rig is a separate responsibility. An artifact browser or database in `RigSpec.services` serves the team's application; its presence does not place an agent inside that service. Bundling service definitions also does not bundle image bytes, native binaries, authenticated homes or live runtime state.
+
+## A minimal composition using existing surfaces
+
+The following is a **fragment of one pod** (`pods[].members`), using existing RigSpec fields, not a complete standalone RigSpec:
+
+```yaml
+pods:
+  - id: dev
+    label: Development
+    members:
+      - id: coordinator
+        agent_ref: local:agents/coordinator
+        profile: default
+        runtime: claude-code
+      - id: worker
+        agent_ref: local:agents/worker
+        profile: default
+        runtime: example-contained-claude
+```
+
+The worker runtime names an author-installed community preset. This preset shape uses existing fields exercised on the 0.7.4 baseline:
+
+```yaml
+format: 1
+name: example-contained-claude
+maintainer: Integration author
+command: ./scripts/launch-contained-worker
+launch_result: true
+resume: true
+startup_assisted: true
+limits:
+  - Requires an explicitly prepared environment binding and guest projection.
+  - Native resume is qualified only for the documented retained-state recipe.
+  - Viewer closure does not implement turn cancellation or resource deletion.
+```
+
+This is an integration skeleton, not an installed or qualified preset. The author must supply the executable, resolve its path against the actual launch working directory, register the preset in the existing OpenRig home, and prepare the member's host working directory. The launcher implements the preset's declared launch-result and typed-resume behavior; the runner chapter defines those mechanics. `startup_assisted` requires a startup-submission check; it does not hold back submission or establish successful context delivery or ingestion. A member's model setting is not automatically honored by a custom launcher: its resolved native model/effort must be explicit in that launcher's supported configuration. With `passes_model: true`, Core passes the declared model through `OPENRIG_MODEL`; the launcher must map and apply it. The effective model remains unknown to Core.
+
+For a contained worker, the launcher may resolve a private binding, create or attach to the selected resource, project explicit inputs, then connect to the native process inside it. In the measured recipe, OpenRig ran on the host, the plain coordinator used the built-in native runtime, and the worker used a private community launcher. The wrapper performed projection, provider-reference delivery, resume validation and artifact export explicitly. Those effects were not supplied by the preset declarations themselves. The integration must not assume host guidance/skills, hook paths or environment variables automatically reach a community runtime's guest.
+
+A downstream author can implement this composition today around a qualified provider API and native harness. It remains an author-maintained integration until maintained platform support is separately implemented and documented. Validate against the target OpenRig schema and effective launch configuration; a parsed field or successful process start alone does not establish its effect.
+
+## Placement and launch receipts
+
+Before mutation, resolve the selected host/provider, workspace, image/native versions, reachability, credential references, resource request and ownership. Record existing resources and the selected resource scope. Host headroom includes supervisors, gateway and other team members; a workload memory request is not proof of their combined cap. Report requested, admitted and observed resources separately. Do not infer enforced CPU/memory or isolation policy from accepted flags.
+
+Persist a launch intent before a create operation. Use an attempt/retry identity where the provider supports it; otherwise reconcile the original operation before another create. A public binding receipt carries only nonsecret values. If the harness's native resume reference works like a bearer credential (anyone holding it can reopen the conversation), keep it in secret-held receipt data, never in the public receipt. A useful public receipt identifies:
+
+- canonical seat, harness version and native resume-reference type;
+- provider/host/workspace, immutable environment ID and execution generation;
+- image/policy versions, requested resources and observed readiness;
+- inner working directory, private native-state location and projection manifest;
+- a public-safe native reference (never a bearer-like resume token), creator or attached-consumer disposition, and exact owned resource handles;
+- lifecycle operations supported, completion observations, pending effects and errors.
+
+A resource name or IP can be reused. Reconcile immutable ID, workspace and any available generation/fingerprint before acting. A lost response is **unconfirmed**, not success or absence. Record provider failures without exposing credentials. Readiness should identify what is ready: provider reachable, filesystem projected, native process started, team identity authenticated, or task completed.
+
+## Project files and credential references deliberately
+
+Stage only declared inputs: role/startup material, selected skills, current work context, schemas and required native settings. Preserve unmanaged files and report conflicts. Review every path-bearing setting for its destination: host-only hook scripts, interpreters, status collectors and loopback URLs may not exist or be reachable in the guest. Missing activity or permission transport must remain unsupported rather than being inferred from the base harness name.
+
+Distinguish three observations: host staging, destination delivery and native ingestion. A destination manifest can record relative path, byte count and hash; a useful task using the current context revision/nonce can show consumption. Neither observation substitutes for the other. Current working input may change between tasks while an earlier artifact stays immutable.
+
+Retained native history is a different data class from ordinary project context. Preserve its exact bytes through the harness's supported resume path; do not edit records or synthesize a conversation. Preserve a complete checkpoint prefix with byte length/hash if the harness may append after the checkpoint. Record which native-state files are required and which remain unavailable. Never substitute a fresh conversation seeded with a report while calling it native resume.
+
+Keep secret values out of RigSpec, preset YAML, bindings, argv and public receipts. The provider/credential owner supplies scoped references or native-supported credential helpers and controls revocation. A successful login, provider registration or model-list request is not evidence of usable inference credit or an authorized spend envelope. Do not infer subscription portability from a provider name or copy an authenticated owner home into a guest.
+
+Authenticate guest coordination through the actual granted member route. A shared source IP is not a seat identity. Record the grant-bound principal and scope separately from resource placement; distinct principals do not imply per-seat row ACLs or isolation between co-located secrets.
+
+## Own only the effects assigned to the integration
+
+Record **created** versus **attached** for each launch receipt. The creator may stop/delete the exact resource it created under the selected policy. An attached consumer normally closes only its own client and any separately identified process it owns; it must preserve the external environment, native session, workspace and shared services. Attachment must not silently transfer provider custody. An explicit owner-authorized transfer is a separate recorded action.
+
+Describe these effects independently:
+
+| Operation | Required distinction |
+|---|---|
+| Cancel a turn | Ask the runner to stop current work and observe its result. Unsupported cancellation must not be replaced silently by killing compute. |
+| Close a viewer | Release that client/connection; report whether native execution continues or is unknown. |
+| Stop native execution | End the identified native process and observe its exit. This is separate from task success. |
+| Stop compute | Release the documented provider allocation; identify retained storage and actual provider/process state. |
+| Delete an owned environment | Remove the exact creator-owned resource and reconcile final absence, including provider-managed dependents. |
+
+Use graceful shutdown first where supported, then only explicitly owned, identified handles for stronger termination. Never equate pane disappearance with process or resource release. Persistent/non-persistent lifetime describes when execution should stop; durability describes recovery. An explicit non-persistent completion condition must name its invocation/work scope. An unrelated queue closure or an empty queue is not permission to terminate a member, and no new lifecycle YAML syntax is specified here.
+
+## Resume exactly, or return an honest disposition
+
+A resume request identifies the seat, harness-qualified native reference, prior binding, expected environment boundary and retained state. Validate those before launching the native harness. Reject mismatched reference types, missing/changed history, wrong immutable resources, unavailable required files and duplicate active executions. Never use “latest” as a replacement for an exact requested conversation or silently start fresh on failure.
+
+Separate the outcomes: same native conversation resumed; new conversation rebuilt from artifacts; fresh launch; unsupported; refused; or unconfirmed. Environment continuity has its own outcome: same retained environment, recreated compute with copied state, different host, or unknown. A matching UUID alone does not show that native history was consumed.
+
+If a provider stops exposing file transfer after canonical-process exit, capture artifacts/history and publish any retained resume descriptor **while transfer is still available**. Verify destination bytes before shutdown. After completion, use host/provider observations instead of assuming guest exec still works. For recreated compute, explicitly transfer the retained checkpoint and required artifact into the successor environment and validate them before publishing its resume descriptor. A new environment ID is expected and must be recorded as a successor, not disguised as the old environment.
+
+The measured private recipe demonstrated this latter boundary: the original sandbox was deleted; copied native history and task bytes were restored into new containers on the same physical host; the native harness launched with `--resume` and the retained UUID. Its first new reply recalled a private conversation-only marker before tools, with no marker in the new input and no native-history tool read. It then verified artifact 1, used changed task context, produced artifact 2 and returned it for independent coordinator verification. This establishes one bounded native-return/work result. It does **not** establish new-host migration, RAM restoration, same-container stop/start, cgroup enforcement, general portability or shipped platform support.
+
+## Export results before teardown
+
+A guest path/hash note means bytes exist in a guest; it is not delivery to the consumer. Identify the actor holding the provider transfer handle. In the measured recipe that actor was the host wrapper, not the guest worker.
+
+The worker publishes its report once and records the task/path/hash on its existing child. The wrapper validates the binding, task, allowed path, file type, size and expected hash; transfers to a fresh host staging path; checks the returned bytes/schema/context; and publishes without overwriting an existing result. It records an actual consumer-accessible destination, hash, byte count and actor through the authenticated work route. The worker closes its child after the matching export receipt; the coordinator independently reads/verifies those bytes before closing its parent. An ambiguous transfer is reconciled by existing bytes/hash, not a new report or duplicate task.
+
+Complete exports before resource deletion. If output cannot be returned, preserve the exact resource/owner and failure state. Cleanup then reconciles the exact owned workload, supervisor, volumes and provider records to the intended stopped/absent state. Keep reused engines, caches, authenticated environments and attached resources. Revoke scoped credentials/grants through their owners and record remaining state. “Delete requested” and “absence verified” are different receipts.
+
+## Proposed generic platform seam — not implemented
+
+The existing composition need not acquire another YAML format to describe these responsibilities. If a maintained platform seam is selected, the following **design pseudocode** names the smallest useful operations; it is not a loader or API available in this release:
+
+```text
+prepare(placement, ownership, resourceRequest, credentialRefs) -> bindingReceipt
+project(binding, explicitFiles, nativeCheckpoint?) -> deliveryReceipt
+launch(binding, harnessLaunch, exactResumeRequest?) -> executionReceipt
+observe(binding, execution) -> observedState | unsupported | unconfirmed
+export(binding, artifactRequest) -> publicationReceipt
+shutdown(binding, execution, selectedEffect) -> effectReceipt
+```
+
+The provider implementation interprets its image/network/compute configuration. The runner interprets native protocol and control. Core would retain typed provenance and route the selected effects; it must not reinterpret arbitrary provider keys, leak secrets or collapse ownership into a stop boolean. Each mutating operation needs an attempt identity and reconciliation route; partial receipts remain useful after failure. Capability reporting must expose unsupported projection, cancellation, resume or cleanup rather than letting method names imply support.
+
+The most useful author evidence follows the real work path: exact resolved placement and native launch; delivered current context; authenticated work ownership; returned artifact bytes; exact resume boundary and consumed retained state; and final resource disposition. A parser pass, launcher success, viewer reconnect or same display name leaves the corresponding effect unconfirmed. These distinctions let an author implement and diagnose an integration; they do not create a new release gate or require another runtime campaign.
@@ -5,15 +5,31 @@ OpenRig's gateway can register **several people** and **shared channels**, group
 OpenRig doesn't enforce it. This page covers the commands, what the default is for, and what upgrading and rolling back
 do.

+For a remote client, `GET /api/gateway/participants` returns the same participant, organization, group, default and
+warning fields as `rig gateway participants --json`. Add `?organization=<id>` to filter the participant list; the default
+and organization and group maps still describe the whole registry. The result names the participant file and reports
+an unreadable side file without treating it as an empty one. If the human registry itself cannot be read, the route
+returns `503` with `error: "human_registry_unavailable"`. The result does not include connector secret pointers.
+
 ## Participants

 A participant is either:
- **a person**, registered with `rig gateway human add` as before, with their own Slack binding; or
+- **a person**, registered with `rig gateway human add`, with or without a connector binding; or
 - **a shared channel**: one vetted Slack channel registered as one participant, `<id>@external`, not a person per
  sender.

 People and channels share one address space: a channel can't take a person's id.

+A registered person is addressed as `<id>@external`, including without Slack: for example,
+`rig gateway human add alex --display-name "Alex" --delivery-class B` creates `alex@external`, reached in the Feed and Steering.
+`human@host` is the unnamed person at the terminal; `human@kernel` is also accepted as a human/gate address.
+These aliases (including `human-<name>@host` and `human-<name>@kernel`) are not agent sessions: reply with
+`rig queue create --destination human@host --human-intent update --summary "<one line>" --evidence-ref "<path>" --body "..." --verify`,
+substituting the sender's address and your summary, evidence path and reply. A reply destination doesn't identify
+who acted or determine who may answer an ask. Clients acting as a registered person name that person's
+`actorSession`; a seat identity header takes precedence. The terminal's primary-user authority records the unnamed
+`human@host` actor, not the person whose queue is being viewed.
+
 ```bash
 # An organization and a group inside it (one command each, create or update)
 rig gateway org set acme --name "Acme" --policy "Answer Acme's customers within a working day. Never promise a date."
@@ -59,30 +75,26 @@ never changes `workspace.operator_seat_name`, which keeps its own meaning.

 ## In the TUI: whose queue, and who acts

-The person at the terminal is the **primary user**: the default person, or, with several people and none chosen, the
-person at the terminal unnamed. Whatever the TUI shows, its acts are theirs.
+The person at the terminal is the **primary user**. The TUI records their acts as unnamed (`human@host`),
+whatever person's queue it shows or who is configured as the default.
 - **Opening:** with a chosen default, the TUI opens on that person's Feed. With none chosen, including a one-person
  install that never chose one, it opens on the topology, as before.
 - **Whose queue:** `whose <person>` shows one person's asks, `whose all` everyone's, and `whose default` the default
  person's. The Feed's first line says whose queue it shows and who acts.
- **Acting on someone else's ask** (answer, approve or resolve from the TUI) records both: the primary user as the actor,
-  and the person asked in the audit notes and the transition. The asking seat reads, for example, "Answered by
-  mike@external, the primary user at the terminal, on sarah@external's ask". With several people and none chosen, the
-  actor is `human@host`.
- **Viewing Sarah isn't acting as Sarah.** Only Sarah, from her own channel, answers as Sarah. Without the primary
-  user's authority, one registered person can't answer, approve, deny or resolve what was asked of another; that's
-  refused (`answer_not_recorded`) and nothing changes.
- With no one registered, the TUI and its acts are as before, except on a shared channel's ask or a row parked on a
-  channel: the TUI shows the act as `human@host`, the person at the terminal, and it's recorded that way, never as the
-  channel.
+- **Acting on someone else's ask** (answer, approve or resolve from the TUI) records both: the unnamed terminal
+  actor `human@host` and the person asked in the audit notes and transition. The asking seat reads, for example,
+  "Unattributed (human@host) answered sarah@external's ask".
+- **Viewing Sarah isn't acting as Sarah.** A registered person may answer, approve, deny or resolve another person's
+  ask as themselves; both the actor and person asked are recorded. No connector binding is required, and viewing
+  someone else's queue doesn't make its viewer that person.
 - **A shared channel never acts.** Its messages are correspondence, so nothing it says answers, approves, denies or
  resolves an ask, and a customer's earlier message in an ask's thread is never taken as its answer. A request without
  the primary user's authority that acts as a channel, with any Mission Control verb (including drop, route, hold, hand
  off and annotate), is refused (`answer_not_recorded`) and nothing changes.
- **Where the authority applies:** only on a request that carries no seat identity header, which is how the TUI calls
-  the daemon. Seats and the CLI send that header, so their acts stay theirs. This is the existing trusted-network
-  distinction, not an authentication check: a request that leaves the header out is taken as the terminal's, as any
-  such request already is.
+- **Where the authority applies:** primary-user authority is accepted only on a request that carries no seat identity
+  header, which is how the TUI calls the daemon. A headerless client can instead name a person's `actorSession` without
+  that authority. Seats and the CLI send the identity header, so their acts stay theirs. This is the existing
+  trusted-network distinction, not an authentication check.

 ## Shared-channel conversations

@@ -55,7 +55,8 @@ together in that home; it needs its own working sign-in and doesn't relocate `~/
 >   - Codex: hooks, workspace trust and team-selected config fragments (including MCP) in the selected
 >     `CODEX_HOME/config.toml`, default `~/.codex/config.toml`. These affect other Codex sessions using that home.
 >   - Claude Code: workspace trust in `~/.claude.json`, and activity hooks in the project's
->     `.claude/settings.local.json`, plus a status line unless you already have your own.
+>     `.claude/settings.local.json`, plus a status line unless you already have your own. `rig down` takes the hooks
+>     and status line back out once no Claude seat uses that directory.
 >   - Discovery skills go in `~/.claude/skills` and `~/.agents/skills`.
 >   - Each seat's `CLAUDE.md` or `AGENTS.md` gets OpenRig's managed blocks (culture, identity, onboarding). One more
 >     line, pointing an agent at its seat skills, is added only on a yes: saved at setup, or set where the daemon runs
@@ -75,8 +76,17 @@ You need Node.js 22 or 24 and tmux, on macOS or Linux, and one working Claude
 Code or Codex account: one is enough, since the kernel operator adapts the
 shipped `starter` team to whichever you have. On Linux, the distribution's own
 Node.js can be older (Ubuntu 24.04's is 18); install a supported version with
-[nvm](https://github.com/nvm-sh/nvm) (`nvm install 22`) or NodeSource. On a Mac
-with Apple silicon, use Node.js 22 (see the [compatibility
+[nvm](https://github.com/nvm-sh/nvm) (`nvm install 22`) or NodeSource.
+
+For a tarball or manual Node install on Linux, put its bin directory on PATH in
+`~/.profile`, for example `export PATH="/path/to/node/bin:$PATH"`, rather than only
+in an interactive `~/.bashrc`. Bash reads the first of `~/.bash_profile`,
+`~/.bash_login` and `~/.profile`; if one of the first two exists, source `~/.profile`
+there. Other shells use their own login file (for example, zsh's `~/.zprofile`).
+Check `bash -lc 'command -v node rig'`: both paths must appear in the output.
+Use Codex's tool shell for this check if it differs from Bash.
+
+On a Mac with Apple silicon, use Node.js 22 (see the [compatibility
 history](../releases/v0.5.15.md#known-compatibility-limitation)). On a Mac where
 you aren't an administrator, or where Homebrew belongs to another account (its
 `brew install` is refused), install Node.js in your own home folder with
@@ -191,16 +201,17 @@ You can also read [`skills/rigs/SKILL.md`](../../skills/rigs/SKILL.md) directly.
 script will do and changes nothing:

 ```sh
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.4/scripts/install.sh | sh -s -- --dry-run
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.9/scripts/install.sh | sh -s -- --dry-run
 ```

 The same command without `--dry-run`,
-`curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.4/scripts/install.sh | sh`, installs the
+`curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.7.9/scripts/install.sh | sh`, installs the
 latest published `@openrig/cli` with `npm install -g`,
 runs the Node.js and SQLite check, then `rig setup --dry-run` and `rig setup`. `rig setup` checks both Claude Code and
 Codex and may install a missing one, as described below. A failed step prints
-`FAILED [n/4] <command or check> (exit <code>)`. Where a provider isn't signed in yet, step 4 ends that way and
-`rig setup` lists each sign-in under "Some steps need attention". If the only remaining failures are provider
+`FAILED [n/4] <command or check> (exit <code>)` for steps 1–3. If step 4 is not ready, it reports
+`INSTALLED, SETUP NOT COMPLETE` and points to the details from `rig setup` above. Follow that output and any Fix, then rerun
+`rig setup`; the CLI does not need reinstalling. If the only remaining failures are provider
 sign-ins, the install steps finished: sign in to each selected provider as below, then continue at
 [Start the kernel](#start-the-kernel-and-check-its-state). To install only what the selected providers need, go step
 by step instead:
@@ -290,6 +301,17 @@ fine; if both accounts are authenticated, the kernel uses both even when your
 later project uses just one. A request to use only one provider for everything
 is a separate choice.

+`/api/kernel/status` retains the chosen template (`rig.yaml`,
+`rig-claude-only.yaml` or `rig-codex-only.yaml`) across daemon restarts and
+recovery, including starts with `--no-kernel`. It reads the rig's latest rig-spec
+bootstrap record, including a partial launch, so an older kernel's recorded
+selection is also available. This is the original selection; the rig's live spec
+describes its current configuration. The saved source must match a template under
+the current installation’s built-in specs directory. A custom project path with
+the same directory suffix, an old source path that can no longer be verified
+(for example, after a Node version change moves the global install), or a kernel
+without bootstrap history reports an unknown variant.
+
 **Started is not ready.** Read the `Kernel:` boot state in `rig status` and the
 individual seat state in `rig ps --nodes --rig kernel`. The view may open while
 agents finish starting; describe that state, without claiming they are ready.
@@ -482,7 +504,7 @@ different points in the same journey:
 | What you see | Why and what to do next |
 | --- | --- |
 | Codex offers to switch to a cheaper model near a rate limit | This is Codex's own menu. Ask the person to choose in the seat's terminal; do not silently change the team's configured model. OpenRig disables Codex's startup update check for managed launches, but does not answer this model-choice menu. |
-| A missing Node.js, npm or tmux; an install download or command fails | The named prerequisite or install step did not finish. Read its error and the [platform and provider instructions](#install-and-sign-in), resolve that step, then recheck it. `FAILED [4/4]` with only selected-provider sign-ins outstanding means the package installed but those logins still need the person. |
+| A missing Node.js, npm or tmux; an install download or command fails | The named prerequisite or install step did not finish. Read its error and the [platform and provider instructions](#install-and-sign-in), resolve that step, then recheck it. `INSTALLED, SETUP NOT COMPLETE` means the CLI is installed but setup needs attention; follow its output and any Fix, then rerun `rig setup`. |
 | The installing harness refuses a tool call or asks for permission | Its native rules, sandbox or automatic permission decision apply before OpenRig can run. Claude Code's [auto mode can deny calls](https://code.claude.com/docs/en/auto-mode-config) as well as approve them. Show the specific refusal and ask the person to review it in the harness permission controls or run that named step themselves. Keep their chosen restrictions; a refused call does not prove the OpenRig command failed. |
 | Herdr or Ghostty installation is unavailable or declined | Herdr is optional for the view: `--window` uses plain tmux when Herdr is absent, and its install failure is a warning. On macOS, Terminal.app is the fallback when supported Ghostty is absent. An explicitly requested Ghostty install can fail setup; resolve that install or decline it with `--no-ghostty`, preserving earlier choices. Address separate required-tool or login failures. Existing cmux remains supported. |
 | macOS asks for Automation access, or the window action is denied | The command asks the desktop terminal app to open a new surface. Let the person answer the system prompt. Read the error and inspect any new window before retrying an uncertain action; do not silently switch apps and open a duplicate. |
@@ -509,7 +531,12 @@ rig terminal open saved:kernel --provider herdr --json
 rig terminal open saved:kernel --provider cmux --json
 ```

-Use `rig terminal status --json` to inspect provider availability and liveness.
+Use `rig terminal status --json` to inspect provider availability, liveness and the
+daemon's effective tmux server. To keep managed seats out of your personal tmux
+session list, opt into [an isolated server](tmux-servers.md) with
+`rig config set terminal.tmux_server isolated`; existing live seats defer the
+switch until they are stopped and the daemon restarts.
+
 To keep rigs in separate Herdr sessions, select one explicitly:
 `rig terminal open future-prod-rig --provider herdr --session future-prod`.
 `--session default` selects Herdr's default session; omitting the option keeps
@@ -848,13 +875,47 @@ the lifecycle API without booting a new kernel, then stop the remaining rigs.
 | "Claude resume did not finish within Ns; Claude may still be starting, so the launch was kept" | A restored Claude seat was not interactive when the wait ended. Its pane and resume token are kept. Look at the pane; once Claude is up, run `rig seat clear-attention <seat>`. The wait is about `runtime.readiness_timeout_seconds` in total for each seat (default 30 s), counting the first 3.2 s, and the time adds up seat by seat in a restore. Raising the setting for slow fresh launches lengthens it. If `rig up` or `rig launch` times out at 120 s, that is not a rollback: check `rig ps` before running it again. |
 | Daemon is healthy, kernel is still starting | Read `rig status` and `rig ps --nodes --rig kernel`; kernel readiness is separate. |
 | Kernel seats fail within a second of the first start, and tmux reports "server exited unexpectedly" | Check that your tmux can capture a pane, then start the failed seats again; see the tmux check below this table. |
-| Shared terminal is absent | Inspect the existing kernel binding and recovery state; use standalone `rig tui` while resolving it. |
+| Shared terminal is absent | Check the kernel's `operator.human` terminal separately from its agents; recover only that seat as described below. Standalone `rig tui` remains available while resolving it. |
 | Viewing terminal was closed | Open the conversations again with `rig terminal open saved:kernel --window`; `rig tui --shared` is only the dashboard fallback if that window cannot open. Do not relaunch the team. |
 | Daemon restarted but tmux survived | Re-read `rig status` and the existing queue; a daemon restart is not a fresh project. |
 | Host reboot lost tmux sessions | Starting the daemon restores the kernel by itself when that start finds all of its seats lost; a kernel that was already down before the reboot stays down, and `rig start` names `rig up kernel --existing`. Check `rig status`, and if it reports the restore failed, run `rig up kernel --existing`. For other rigs, open `rig`, start the daemon if needed (press **S** if it opens on the work views), and select the existing rig and seats. Resume is the default; a fresh conversation needs a separate decision. |
 | Launch reports no usable snapshot | Inspect the existing rig and retained project files, then follow the same-seat recovery below. |
 | Work is waiting on a prompt or decision | Read the row, transition and named prompt; preserve the obligation until the missing decision arrives. |

+**When the shared kernel dashboard is missing.** The dashboard runs in the
+kernel's `operator.human` terminal seat. Restoring the operator, advisor and
+queue worker does not also restore an unselected terminal. Read
+`rig ps --nodes --rig kernel --json` and use the terminal's registered
+`canonicalSessionName` for the `operator.human` row. Replace `<dashboard-session>`
+in the commands below with that name. Check the actual pane with
+`rig capture "<dashboard-session>"`: a persisted running row alone does not prove
+that its tmux session is alive.
+A daemon or transport error is not proof that the terminal is absent.
+
+- If only the viewing window closed and the TUI is still running, reopen it
+  with `rig terminal open saved:kernel --window`.
+- If the TUI exited but its terminal shell remains, run `rig tui` once in that
+  existing pane. A fresh seat is unnecessary.
+- If the terminal session itself is absent, start only that existing seat:
+
+  ```sh
+  rig seat launch "<dashboard-session>" --fresh --reason "recover missing shared kernel dashboard"
+  ```
+
+  The terminal has no agent conversation to resume. Its fresh-start action
+  runs `rig tui` after the shell is ready; sibling agent sessions stay
+  unchanged. This command intentionally omits `--stop`, so it refuses to
+  replace a live occupant. Check the result before repeating it, then run
+  `rig capture "<dashboard-session>"` to confirm the TUI and
+  `rig ps --nodes --rig kernel --full` to check the seats. Once the dashboard
+  is running, open its view with `rig terminal open saved:kernel --window`.
+
+Opening `saved:kernel` places a view of existing sessions; it cannot create a
+missing terminal. Whole-kernel recovery is for the all-seats-lost case in the
+table, and `rig up kernel --existing` refuses a kernel with live sessions.
+A retained `excluded_from_subset` reason may come from an earlier subset
+restore; inspect its event before attributing it to the latest reboot.
+
 **When the kernel's seats all fail at the first start.** A report on Oracle Linux 10
 ([#980](https://github.com/mvschwarz/openrig/issues/980)) traced this to the distribution's packaged tmux, whose
 `tmux -V` prints `next-3.4`: its server exited on every `capture-pane -p`, also outside OpenRig. `rig setup` (its tmux
@@ -0,0 +1,451 @@
+# Harness and runner contract (DRAFT, published with 0.7.6)
+
+> **Status.** This is a draft for contributors.
+> - **Released in 0.7.6:** the `runner` field and OpenRig's side of declaration, identity and activity
+>   (sections 2-4).
+> - **Released in 0.7.8:** seat activity grants (section 4), and OpenRig's side of the answered permission path
+>   (section 7).
+> - **Runner-author behavior, not yet qualified:** the input, cancellation and permission recipe in sections 5-7, and
+>   the runner-side shutdown obligation in section 9. A dsh port implementing this recipe is not qualified.
+> - **Existing interfaces with author obligations:** launch-result identity, exact resume, first input and model
+>   handoff. These interfaces do not establish that a particular runner implements them correctly.
+> - **Unchanged:** plain community presets and the built-in runtimes (Claude Code, Codex, Pi, OMP, terminal).
+>
+> No harness has been run end to end under this contract yet, and the native verdict is pending. The first candidate
+> is dsh over ACP.
+>
+> Release status and pinned references are in the [joined author guide](author-contracts.md). The
+> [community presets reference](community-harness-presets.md) describes the implemented fields, including the runner
+> preset's exception for approvals; this chapter also labels runner-author behavior that isn't qualified.
+
+This chapter covers **which agent runs in a seat and how OpenRig talks to it**. *Where* that agent runs (a host, a
+sandbox, another machine) is the [execution platform chapter](execution-platform-contract.md). The two are separate on purpose:
+the same harness can run in many places, and one place can host many harnesses.
+
+## 1. Plain preset or runner preset?
+
+| | Plain community preset | Runner preset (`runner: true`) |
+|---|---|---|
+| **What runs in the pane** | The harness's own terminal app | A small program you maintain, *the runner*, which hosts the agent (for example an ACP agent over stdio) |
+| **How OpenRig reads activity** | From the screen: a changing screen reads working; a quiet one reads **unknown**, never idle | From the runner's reports: working, idle, needs input |
+| **How input arrives** | Typed into the app's prompt | Typed into the runner, which turns each submitted message into one agent prompt |
+| **Choose it when** | The harness has a usable terminal UI (Cursor, Hermes, OpenClaw examples) | The harness speaks a protocol rather than a screen (ACP, JSON-RPC, stream-JSON), or you can report turn boundaries reliably |
+
+**If your harness works well as a terminal app, a plain preset is enough. Use a runner only when you can report state
+honestly.** A runner that guesses is worse than a quiet screen read as unknown.
+
+**Vocabulary.** "Preset", "runner preset", `launch_result`, `resume`, `first_input` and `passes_model` are existing
+terms in 0.7.6. Broader names you may see in design discussion, such as *HarnessSpec*, are **proposals**, not file
+formats or loaders that exist.
+
+## 2. Declare it: what the preset says, fixed at launch
+
+```yaml
+# $OPENRIG_HOME/community-harnesses/dsh.yaml
+format: 1
+name: dsh
+command: dsh-seat              # your runner; it starts the agent itself
+maintainer: <you>
+runner: true                   # since 0.7.6
+launch_result: true            # required with runner
+resume: true                   # only after you've checked a real reopen and a refused missing one
+limits:
+  - permission requests go to a person through OpenRig (section 7), and are permitted when no one can be asked
+  - a prompt whose whole text is /abort can't be sent
+  - fork unsupported
+```
+
+- **`runner: true` requires `launch_result: true`,** and can't be combined with `names_conversation`.
+- **The declaration is fixed at launch.** Each launch, a restore's included, records what the preset declares at that
+  moment. Editing the preset changes the next launch, not a running seat.
+- **A preset without `runner` behaves exactly as today,** and so does a session recorded before the field existed.
+- **The other fields keep their existing meanings:**
+  - `first_input: true` passes the seat's first startup turn in a file named by `OPENRIG_FIRST_INPUT`;
+  - `passes_model: true` passes the seat's declared model as `OPENRIG_MODEL`.
+
+## 3. Identity: report the conversation once, in the launch record
+
+- **When:** after the agent has opened or reopened its conversation (for ACP: after `session/new`, `session/load` or
+  `session/resume`).
+- **How:** write the attempt's launch record to the path in `OPENRIG_LAUNCH_RESULT`, with the attempt from
+  `OPENRIG_LAUNCH_ATTEMPT`. The record is either the conversation:
+
+  ```json
+  {"format": 1, "attempt": "<OPENRIG_LAUNCH_ATTEMPT>", "harness": "dsh", "nativeRef": "<conversation id>", "producer": "dsh-seat 0.3.0; dsh 0.2.1-rc.2; ACP 1"}
+  ```
+
+  or the agent's own word that it doesn't exist:
+
+  ```json
+  {"format": 1, "attempt": "<OPENRIG_LAUNCH_ATTEMPT>", "harness": "dsh", "error": "missing", "producer": "dsh-seat 0.3.0"}
+  ```
+
+- **`producer` is free text** for your versions. There are no structured version or capability fields.
+- **The launch record is the only identity channel.** Don't report identity on the activity endpoint.
+- **No record means attention.** For a runner preset:
+  - **a new launch** with no usable record within OpenRig's wait leaves the seat needing attention, not ready. So does a
+    new launch where OpenRig can't create the record's folder: the runner still starts, without `OPENRIG_LAUNCH_RESULT`;
+  - **on a resume,** a folder OpenRig can't create means nothing starts, because the launcher can't be told what to
+    reopen. When the folder exists but no usable record arrives, the resume command has already been sent, and the
+    resume reads unconfirmed (section 8).
+- **OpenRig shows this identity as launcher-reported.** It doesn't observe the conversation itself.
+
+## 4. Activity: report turn boundaries
+
+Post each event to `POST <base>/api/activity/hooks` with `Authorization: Bearer <token>`.
+- **Finding the base and token:** take them from `OPENRIG_URL` (or `OPENRIG_PORT`, with `OPENRIG_HOST` defaulting to
+  `127.0.0.1`) and `OPENRIG_ACTIVITY_HOOK_TOKEN`, or else from `$OPENRIG_HOME/activity-endpoint.json`.
+- **Posting:** post one at a time, in order, with a short timeout. Never make the agent wait on a post.
+
+```json
+{"sessionName": "dev-builder@my-rig", "nodeId": "<node id>", "runtime": "dsh",
+ "generation": "<OPENRIG_OCCUPANT_GENERATION>", "sequence": 42, "occurredAt": "2026-10-29T12:00:00Z",
+ "hookEvent": "UserPromptSubmit", "subtype": "accepted", "turnId": "7"}
+```
+
+| When | `hookEvent` / `subtype` | The seat reads |
+|---|---|---|
+| You gave the agent the prompt for a submitted message | `UserPromptSubmit` / `accepted`, `turnId` = your prompt number | working |
+| The agent is working (message chunks, tool calls) | `active` / `agent_message`; `PreToolUse` / `<tool kind>` | working |
+| Optional working beat, from 0.7.9: the turn is still outstanding and the agent alive, with nothing new to report (a long tool or model call) | `active` / `liveness`, with `turnId`, `sequence` and `livenessSeconds` | working while beats keep coming |
+| From 0.7.9: you delivered an answer or permit to a request OpenRig had shown as needing input, and the agent continues the same turn (section 7) | `active` / `permission_resolved`, with `turnId` and `askId` | working |
+| You refused a permission request (section 7) | `Notification` / `permission_prompt` | needs input |
+| The turn ended | `Stop` / its stop reason (`end_turn`, `cancelled`, `max_tokens`, `refusal`) | idle. While you hold attention (section 7), don't post it: OpenRig reads any non-exit `Stop` as idle and clears needs input |
+| Optional idle heartbeat | `Stop` / `idle_heartbeat`, with `livenessSeconds` | idle while beats keep coming |
+| The agent process ended | `Stop` / `<preset name>_exited` | unknown, **never idle** |
+| Your runner or the agent hit an error | `Notification` / `runtime_error` | recorded, but not used as activity: the prior activity evidence keeps its usual lifetime. It doesn't itself request or clear attention |
+
+- **Liveness:** state `livenessSeconds` (a whole number of seconds from 1 to 3600; any other value is ignored) on every
+  idle `Stop`, the turn's end as well as each beat. OpenRig stops reading the seat idle after 2 × `livenessSeconds` without
+  a newer idle report. Without it, an idle report holds until your next post, even if your runner has died. Never send a
+  non-exit `Stop` or a beat while holding permission attention.
+- **Working evidence lasts 15 seconds.** A working post (`UserPromptSubmit`, `active`, `PreToolUse`) decides the seat's
+  activity for 15 s. After that the seat reads from its other evidence: the screen can still show work, but it never
+  reads a runner seat idle, so with nothing else the seat reads unknown.
+- **The working beat (from 0.7.9)** keeps a long, quiet turn reading working. It says only that this turn's prompt is
+  outstanding and the agent process you started is alive. It isn't progress.
+  - **When to beat:** only while a prompt is outstanding and the agent is alive, more often than every
+    `livenessSeconds` ÷ 2.
+  - **When to stop:** stop at once on the turn's `Stop`, on a permission request that needs a person, or on the agent's
+    exit, and post that boundary first.
+  - **`livenessSeconds`** is how long one beat counts as working. OpenRig clamps it to 5-60 s, and uses 30 s when a beat
+    has none. After that the beat stops counting, and the seat reads from its other evidence, as a working post's does.
+  - **A beat counts only when all of these hold:**
+    - it carries `generation`, equal to the seat's live occupant generation, and so did the `UserPromptSubmit` /
+      `accepted` post that opened its turn;
+    - its `turnId` is your latest `UserPromptSubmit` / `accepted` turn, and you haven't posted that turn's `Stop` or an
+      exit;
+    - it carries a `sequence`, greater than every earlier post's in the same generation that OpenRig counted, beats
+      included;
+    - the seat has no attention outstanding, such as a permission request waiting on a person.
+
+    So number every post with one `sequence` that rises across your whole runner process, beats included. OpenRig
+    orders your posts by `occurredAt`, then `sequence`. A post older than one OpenRig already counted changes nothing:
+    a late `Stop` for an earlier turn doesn't end the current one, and an older beat doesn't count. A post without a
+    valid `occurredAt` is dated when it arrives, by OpenRig's clock, so it can read older than it is when your clock
+    runs ahead. Give every post its `occurredAt`.
+  - **After you deliver an answer or permit** to a request OpenRig had shown as needing input (section 7; it created an
+    ask, and a permit at submit opens none), post `active` / `permission_resolved` with the turn's `turnId` and the
+    `askId`, before your next beat. That clears the seat's attention. So does any other working or idle post OpenRig
+    counts, and an operator's `rig seat clear-attention`. OpenRig doesn't match `permission_resolved` to its `askId`.
+    Beats are ignored until attention clears.
+  - **A beat that fails any of these is ignored.** The seat reads as it would without it. A beat never starts or extends
+    a turn, never clears attention, and never stands in for a `Stop`.
+  - **OpenRig keeps what it needs to judge beats in memory.** After a daemon restart, a beat already counted keeps its
+    lifetime, but new beats are ignored until your next accepted prompt, and the seat reads as it would without them.
+  - **A runner that sends no beats** behaves as before.
+- **Exit:** post `Stop` / `<preset name>_exited` only when you observe the agent's process exit.
+
+- **The screen still counts,** but only as evidence of work. On its own it never reads a runner seat idle.
+- **"Accepted" means your runner submitted its Nth prompt.** It isn't the agent's own acknowledgement, and it isn't
+  tied to a particular `rig send`.
+- **The generation attributes a post; it isn't authentication.**
+  - A post carrying an earlier occupant's generation never counts for the live seat.
+  - The hook token is one local token, so any process holding it can post for any seat.
+- **A seat activity grant** is what a runner in another environment, such as a sandbox guest, receives instead of the
+  local token. It arrives in the same `OPENRIG_ACTIVITY_HOOK_TOKEN`, with an `OPENRIG_URL` the guest can reach, and it
+  speaks only for its own seat and launch generation:
+  - with a grant, the generation is authenticated, and you may leave out `nodeId` and `generation`;
+  - a post for another seat is refused with `403 activity_grant_wrong_seat`;
+  - a post claiming another generation, or from an occupant that has since been replaced, is refused with
+    `409 activity_grant_stale`;
+  - a post before the launch has registered its occupant is refused with `409 activity_grant_pending`;
+  - a post with a revoked grant is refused with `401 activity_grant_revoked`, including a post whose grant was revoked
+    while its body was arriving.
+
+  A refused post records nothing, so the seat's activity stays as it was, or unknown.
+
+  **The guest's boundary is its listener, not the grant.** A guest reaches OpenRig only through a guest-only listener that
+  serves this route and section 7's three permission-request routes, and accepts only a grant. It must never reach the
+  daemon's main port. The grant scopes activity posts and permission requests, and the main port's other routes don't
+  check it.
+  - The listener is off by default. Turn it on with `OPENRIG_GUEST_ACTIVITY_PORT`, which must differ from the daemon's
+    main port or the daemon refuses to start.
+  - It binds `OPENRIG_GUEST_ACTIVITY_HOST`, default `127.0.0.1`: set it to an address the guest can reach.
+
+## 5. Input: one submitted message is one prompt
+
+Sections 5-7 specify the first dsh/ACP runner recipe; no runner has been qualified against it yet. They do not change
+permission or input handling in existing built-in runtimes or require every possible runner protocol to use ACP.
+
+- **Set up the pane:** put your TTY in raw mode and turn on bracketed paste (`\e[?2004h`).
+- **What arrives:** `rig send` and queue reminders paste the whole message, then press Enter. Everything up to that Enter
+  is **one block**, newlines included. Send it to the agent as **one** prompt (for ACP, one `session/prompt`).
+- **Never split a block,** and never act on lines inside it.
+- **Control input:** the only control is a block that is exactly `/abort`, or Ctrl-C typed outside a paste.
+  - Ordinary sends and reminders arrive inside a From/To envelope, so they never equal `/abort`, whatever lines they
+    contain.
+- **A message that arrives mid-turn** waits for the next turn. Report it as queued, never as steering the current turn.
+- **Limits to keep and to list under `limits`:**
+  - a prompt whose whole text is `/abort` can't be sent as a prompt;
+  - a Ctrl-C byte inside a paste also aborts;
+  - without a TTY, input is read line by line;
+  - this isn't a binary-safe channel.
+
+## 6. Cancel: requested isn't the same as done
+
+- **On `/abort` or Ctrl-C:** send the agent's cancel (for ACP, the `session/cancel` notification, which has no reply),
+  and record when you sent it.
+  - A person cancels by typing `/abort` in the seat's pane. A `/abort` sent with `rig send` arrives inside a From/To
+    envelope, so it's an ordinary prompt.
+- **Report "cancelled" only when the agent says so:** for ACP, when `session/prompt` returns `stopReason: "cancelled"`.
+  Then post `Stop` / `cancelled`.
+- **Whether the provider stopped work or spend is unknown.** Don't claim it.
+
+## 7. Permissions: a person answers, and the default is permit
+
+### The first version: refuse every request (history; still what `--deny` does)
+
+- **Refuse at once:** answer every permission request immediately with a refusal (for ACP,
+  `{"outcome": {"outcome": "cancelled"}}`).
+- **Make it visible:** show what was asked in the pane, and post `Notification` / `permission_prompt`.
+- **Hold that attention** as your last post through the end of the turn, so the seat reads needs input. Don't post the
+  turn's `Stop` or idle beats while holding it.
+- **It clears** when your next prompt is accepted, or when an operator clears it
+  (`rig seat clear-attention <session> --reason "…"`).
+- **Never leave a request pending.**
+- **What it couldn't do:**
+  - answer from the seat's permission setting;
+  - take answers typed into the pane;
+  - route an approval to another seat.
+
+  So a job that needed an edit or a command approved couldn't finish. The answered path below, added in 0.7.8,
+  replaces this as the default.
+- **Unknown requests from the agent:** answer with JSON-RPC `-32601` and carry on.
+
+### The answered path (0.7.8)
+
+**Only requests the agent actually makes reach anyone.** The harness's own permission mode decides that, and a harness
+that runs without asking gains no approval step. Ordinary conversation and `rig send` are unchanged.
+
+**What happens to a request, in the person's terms:**
+
+| Situation | What happens |
+|---|---|
+| **There's a default person** (chosen with `rig gateway default`, or the only registered person), and no override | They get an ordinary ask in the Feed and on Slack. No setup is needed. |
+| **The seat's operator chose someone** (`rig seat set-permissions-to <seat> --to <person> --reason "…"`) | That person gets the ask instead. |
+| **No one can be asked** | **Permitted at once**, with the agent's own allow option. No ask is opened, and OpenRig records the permit (below). That covers: no registered person; several and none the default; the chosen person no longer registered; the people unreadable; or options a person can't be shown (bad ids, or not 2-4). The agent's `allow_once` is used, else its `allow_always`. If the agent offers only `allow_always`, the harness then remembers a permission nobody chose. |
+| **The seat's operator opted in to refusal** (`rig seat set-permissions-to <seat> --deny --reason "…"`) | Refused at once and held as needs input, as in the first version. |
+
+**What the ask shows:**
+- the seat and the conversation;
+- the tool call, as the agent described it;
+- why this person was asked;
+- every option the agent offered, each with its native meaning. `allow_always` means the agent's harness remembers
+  the choice and allows similar requests without asking. OpenRig doesn't record or revoke that.
+
+**How a person answers, and what the agent gets:**
+
+| The person… | The agent gets |
+|---|---|
+| clicks an option: the asked person, any other registered person, or the primary user in the TUI | that option |
+| replies with just a yes ("yes", "ok", "allow", "go ahead" …) | the agent's allow (`allow_once`, else `allow_always`) |
+| replies with just a no ("no", "deny", "reject", "stop" …), or denies it in the Feed | the agent's reject (`reject_once`, else `reject_always`), or, with no reject option, cancelled. A person's no is never a grant |
+| routes or hands it to another person | the ask waits for that person, who gets the same options; their answer counts as if they'd been asked. The handoff itself never permits |
+| routes or hands it to an agent seat | that seat gets no options. The request waits until that row is closed, by the seat or a person. Closed as done without a choice (including a drop), or as failed, is no answer, so it's permitted. Closed as denied (the Feed's deny, `--closure-reason denied`, or the state `denied`) is a no. A row set to the state `canceled` cancels the request, and a further handoff is followed; a person it reaches gets the same options. Or the request waits until the agent's turn ends |
+| closes it without choosing: drop, approve, or other typed words | no answer, so the default applies: **permitted** with the agent's allow, and OpenRig records the permit (below) |
+| doesn't answer | the request **stays pending and visible** (the seat reads needs input) until the agent's turn ends. It's never timed out into a grant. |
+
+- **An answer reaches only the live request it was asked for,** once. A request from an earlier occupant reads
+  `stale`, and one withdrawn at the turn's end reads `withdrawn`. Neither can take a later answer.
+- **Text typed into the runner's pane, an agent's own text, and `rig send` are never an answer.** While a request waits
+  on a person, the seat reads needs input, and sends are normally refused. A send that does get through reaches the
+  agent as a prompt.
+- **From 0.7.9, each permit OpenRig decides by default is recorded,** once, as a stream item from the seat. That covers
+  no one to ask, and an ask closed without a choice (the row passed to an agent seat included). The record names:
+  - the tool call;
+  - why no person answered, including, for a closed ask, who closed which row and how;
+  - the option the agent got, with its kind. An `allow_always` option is marked as remembered by the agent's harness;
+  - the conversation and request, or the ask.
+
+  For an ask opened before 0.7.9, the record may omit the option kind and whether the harness remembers it.
+
+  Read the records with `rig stream list --tag runner-permission-permit`, or `--source <seat>`. A record wakes no one,
+  and one that can't be written doesn't change the permit.
+
+**The runner's protocol:**
+1. **Submit** the agent's live request to `POST <base>/api/activity/permission-requests`, with the same token or seat
+   grant as section 4:
+
+   ```json
+   {"sessionName": "dev-builder@my-rig", "nodeId": "<node id>", "generation": "<OPENRIG_OCCUPANT_GENERATION>",
+    "nativeRef": "<the conversation>", "turnId": "7", "requestId": "<the agent's JSON-RPC id>",
+    "toolCall": {"title": "Edit src/app.ts", "kind": "edit"},
+    "options": [{"optionId": "allow", "name": "Allow", "kind": "allow_once"},
+                {"optionId": "reject", "name": "Reject", "kind": "reject_once"}],
+    "occurredAt": "2026-10-30T12:00:00Z"}
+   ```
+
+   - **A person is asked:** the reply is `{"ok": true, "askId": "…", "created": true}`. OpenRig records the seat's
+     `permission_prompt`, so it reads needs input. Don't post it yourself.
+   - **No one can be asked:** the reply is `{"ok": true, "state": "permitted", "optionId": "…", "reason": "…"}`.
+     Deliver that option.
+   - **`requestId` and `turnId`** may be strings or numbers. Pass the agent's id unchanged: a number is read as its
+     decimal string, so `7` and `"7"` are the same request.
+   - **Resubmitting** the same generation, conversation and request id returns the same `askId`.
+2. **Read** the answer with `GET <base>/api/activity/permission-requests/<askId>?waitSeconds=25` (25 at most), and read
+   again until the agent's turn ends.
+   - **The `state`** is `pending` (read again, don't cancel), `answered` or `permitted` (each with `optionId`),
+     `refused` (with `reason`: `said_no` when the person said no and the agent offered no reject option, or
+     `no_allow_offered` when it was closed without a choice and the agent offered no allow option), `withdrawn` or
+     `stale`.
+   - **From 0.7.9, `said`,** with `permitted` or `refused` (`no_allow_offered`), is the person's own words, when they
+     answered in words that were neither a choice nor a plain yes or no. It never changes the outcome.
+   - **A seat grant reads and withdraws only its own launch's requests.** Once its occupant is replaced, the grant is
+     refused (`409 activity_grant_stale`), even during a read's wait.
+3. **Deliver** `{"outcome": {"outcome": "selected", "optionId": "<optionId>"}}` to the agent once, and only while that
+   request is still its live one. For `refused`, `withdrawn` or `stale`, answer `cancelled` and hold no attention: no
+   person is still waiting. A refusal of the read itself follows the refusals below. From 0.7.9, when the read carries
+   `said`, queue those words for the agent as an ordinary prompt: they reach it after the current turn, behind any prompt
+   already waiting. They're never the answer. A runner that drops them still keeps this contract.
+4. **Withdraw** when the turn is cancelled or ends, or the agent exits:
+   `POST <base>/api/activity/permission-requests/<askId>/withdraw` with
+   `{"reason": "turn_cancelled" | "turn_ended" | "exited"}`.
+   - A later answer isn't sent.
+   - A relaunch makes the earlier occupant's open requests stale on its own.
+
+**Refusals, at submit or while reading.** One rule covers both. Cancel only a request that certainly isn't the current
+occupant's live one, and hold no attention. Anything that may still be a live request permits, as when OpenRig can't
+answer. Only the seat's opt-in refuses and holds attention.
+
+| Code | Status | Meaning | The runner |
+|---|---|---|---|
+| `denied_by_seat` | 409 | The seat's operator opted in to refusal (`--deny`). | refuses and holds attention |
+| `options_unsupported` | 422 | No one can be asked, and the agent offered no allow option to permit. | refuses and holds attention |
+| `stale_generation` | 409 | With the activity token: the post isn't from the seat's current occupant. | answers `cancelled` |
+| `activity_grant_wrong_seat` | 403 | The grant speaks for another seat. | answers `cancelled` |
+| `activity_grant_stale` | 409 | The grant's launch generation no longer occupies the seat. | answers `cancelled` |
+| `activity_grant_revoked` | 401 | The grant was revoked while its launch generation still occupies the seat, or before it has registered, so this may still be the live request; a replaced occupant's grant reads `activity_grant_stale` instead, even once revoked. | permits |
+| `activity_grant_pending` | 409 | The grant's launch hasn't registered its occupant yet. | permits |
+| `duplicate_request` | 409 | This request id was already submitted in another turn; an agent may reuse an id. | permits |
+
+**When the runner can't get an answer from OpenRig,** nobody can be asked, so it permits with the agent's own allow
+option: `allow_once` when offered, else `allow_always`. Prefer `allow_once`, so the harness doesn't remember a
+permission nobody chose. Such a permit is the runner's own, so OpenRig has no record of it: the runner prints it in
+its pane. That covers:
+- an OpenRig without this path, which answers 404;
+- an OpenRig the runner can't reach, at submit or while reading (a runner may retry a read that got no answer a few
+  times first);
+- a refusal the table marks "permits", and any status or code this section doesn't list.
+
+**Limits of this path:**
+- **The answer owner is a registered person.** Choosing a seat (another agent) to answer is a later change.
+- **A colleague's answer is followed on this host.** If the ask is handed to another host, the request waits, shown as
+  needs input, until the agent's turn ends.
+- **An override or `--deny` is set with the command above, never in a rig spec.** A spec field is a possible later
+  change.
+- **A person's answer is recorded on the ask itself,** and a default permit as the stream item above. That item lasts as
+  long as stream retention keeps it. A permit the runner decides on its own is in its pane only.
+
+## 8. Resume: exactly the same conversation, or say honestly that you couldn't
+
+- On a resume, OpenRig passes the conversation to reopen in `OPENRIG_RESUME_REF`. Use the method your agent
+  advertises: ACP's `session/load` (capability `loadSession`), ACP's `session/resume` (capability
+  `sessionCapabilities.resume`, which dsh `0.2.1-rc.2` uses), or your agent's own reopen method, named with its
+  capability and pinned version in your `limits`.
+- **Telling "missing" from "won't reopen":** an agent may answer one error for both. dsh `0.2.1-rc.2` answers `-32602`
+  for a conversation it doesn't have and for one already active elsewhere. So don't read an error's code or text as
+  missing unless the agent defines it that way, as ACP's not-found `-32002` is.
+  - **Report missing only on the agent's own not-found,** and leave anything else unconfirmed.
+  - **When the agent advertises `sessionCapabilities.list`,** its `session/list` can show that a conversation exists:
+    one it lists but won't reopen is unconfirmed, even on a not-found. Follow `nextCursor` (an opaque string, possibly
+    empty), and treat a page you can't read as deciding nothing.
+  - **A list doesn't show that a conversation is gone,** unless your agent guarantees it lists every conversation. An
+    agent may leave out one that another running process holds unsaved; dsh `0.2.1-rc.2` can. So still try the reopen
+    for a conversation the list doesn't name.
+
+| What happened | Write in the launch record | What OpenRig does |
+|---|---|---|
+| The same conversation reopened | the same `nativeRef` | resumed |
+| The agent says it doesn't exist | `error: "missing"` | reports it missing; nothing new starts |
+| Anything else: a timeout, an error, or the working folder no longer matches the conversation's | no record, or an error other than `missing` | **unconfirmed**: the seat keeps its conversation and needs attention |
+| A different conversation opened | the other id | a mismatch; OpenRig doesn't switch to it |
+| OpenRig couldn't create the record's folder | (nothing to write) | nothing starts |
+
+- **Never start a new conversation on a resume.**
+- A conversation saved under another harness's runtime is never handed to your launcher.
+
+## 9. Context, model and shutdown: whose job is what
+
+| Responsibility | OpenRig does | Your preset or runner does |
+|---|---|---|
+| **First startup turn** | Writes it to a private file and passes `OPENRIG_FIRST_INPUT` (with `first_input: true`) | Gives those exact bytes to the agent through its own first-prompt route |
+| **Guidance, skills, startup files** | Doesn't place them for community harnesses; a launch warns that they weren't delivered | Puts whatever the agent needs where *your* harness reads it, or says in `limits` that it isn't supported |
+| **Model** | Passes the seat's declared model as `OPENRIG_MODEL` (with `passes_model: true`); never substitutes one | Maps it to the harness's own setting. OpenRig shows the effective model as unknown |
+| **Placing the agent somewhere else** (a sandbox, another machine) | See the [execution platform chapter](execution-platform-contract.md) | Keeps the runner independent of where it runs |
+| **Shutdown** | `rig seat stop` and `rig down` end the seat's tmux session at once: no graceful stop handshake reaches the runner, its pane just closes. OpenRig ends nothing outside that session, and does no external provider cleanup | **(Proposed)** When the runner's pane closes (a hangup) or it's asked to stop, it attempts where possible to cancel any running turn and end the agent process it started, and lists in `limits` anything that may keep running. Cleanup of external compute needs the platform owner to reconcile it |
+
+## 10. What counts as evidence
+
+- **Keep three things separate:**
+  - **`rig send --verify`** checks the pane before and after a send. It's pane evidence, not proof the agent received
+    or finished anything. Mirror each accepted prompt in your pane (for example `you ▸ …`); OpenRig doesn't yet promise
+    that `--verify` recognises it.
+  - **A turn ending isn't the work being done.** Task completion is whatever the work's own record says: a queue task
+    marked done, or an artifact written.
+  - **Your own tests** should run against a fake agent that covers each section above. The
+    [runner conformance check](runner-conformance/README.md) does that for you: point it at your runner, and it reports
+    which promises your runner keeps.
+- **The useful real check** for a maintainer:
+  - a seat starts and reads ready only after the handshake;
+  - one multi-line message becomes one prompt;
+  - the seat reads working, then idle;
+  - a refused permission reads needs input;
+  - `/abort` ends a turn as cancelled;
+  - a resume reopens the same conversation, and a missing one is refused, never replaced.
+
+  That's the same promotion test the presets reference describes, applied to these declarations. Passing it is
+  compatibility evidence for the versions you name, not certification.
+
+## Contributor checklist
+
+- [ ] The preset sets `runner: true` and `launch_result: true`, and not `names_conversation`.
+- [ ] After the agent opens or reopens its conversation, the runner writes the launch record, with versions in `producer`.
+- [ ] Activity posts carry `sessionName`, `nodeId`, `runtime`, `generation`, `sequence`, `occurredAt`, `hookEvent` and
+      `subtype`. They're sent in order and never block the agent.
+- [ ] One submitted message becomes exactly one prompt. Only a bare `/abort` block, or Ctrl-C outside a paste, is control.
+- [ ] Cancel records "requested" when sent, and "cancelled" only on the agent's own stop reason.
+- [ ] Every permission request goes to OpenRig's answered path, and the runner delivers the option that comes back: the
+      person's, or OpenRig's permit. When OpenRig can't answer (404, unreachable, or a refusal section 7's table marks
+      "permits"), the runner permits with the agent's `allow_once`, else `allow_always`. A refusal that says the request
+      isn't the current occupant's, or a `refused` answer, means answer `cancelled` and hold nothing. Only
+      `denied_by_seat`, or no allow option to permit, means refuse at once, show it, and hold needs input until the next
+      accepted prompt.
+- [ ] An agent exit posts `Stop` / `<preset name>_exited`, never a plain idle.
+- [ ] A resume reopens the exact conversation. It reports `missing` only on the agent's word, and otherwise leaves it
+      unconfirmed.
+- [ ] Unknown agent requests get `-32601`.
+- [ ] `limits` names the input limits, the permission limit, what keeps running after a stop, and anything not supported.
+
+## Open questions
+
+1. **Answered:** which method and capability does dsh advertise for reopening a session, at a pinned version? dsh
+   `0.2.1-rc.2` advertises `sessionCapabilities` `{close, list, resume}`, without `loadSession`, and reopens with
+   `session/resume` (section 8). This was observed with a stand-in model, not a real one.
+2. **For the dsh maintainer:** can dsh's ACP profile run with tools off? A first journey that needs no permission
+   answers is the simplest to check.
+3. **For OpenRig:** should a later version route permission requests to a chosen seat, as `rig acp run` already does
+   with queue tasks? 0.7.8 routes them to the default person, or to a person chosen for the seat (section 7). A chosen
+   seat is still open.
+4. **For OpenRig:** once a second ACP harness exists, should one shared ACP runner live in OpenRig rather than one per
+   harness?
@@ -107,6 +107,38 @@ OpenRig doesn't observe a hosted member between its calls, so it never reads idl

 `rig mcp token revoke grok` refuses its next request. The rows it worked, and their answers, stay.

+## Assistants connected through a grant service
+
+With `rig mcp serve --http --grant-service <url>`, an outside service answers each connection's key with its grant
+(`openrig.grant/v1`): the seat it acts as, its rigs, and the object/action pairs it may use. Each pair offers one tool,
+and nothing else is offered:
+
+| Pair | Tool |
+|---|---|
+| `queue`/`create`, `queue`/`show`, `queue`/`list` | `rig_queue_create`, `rig_queue_show`, `rig_queue_list` |
+| `queue`/`claim`, `queue`/`update` | `rig_queue_claim`, `rig_queue_update` |
+| `team`/`list` | `rig_team` |
+| `artifact`/`read` | `rig_artifact_read` |
+
+- **One seat per connected assistant:** the service gives each connection its own seat and keeps it across that
+  connection's reconnects. The seat must be one of the rig's nodes; a node created without a launch is enough. The caller
+  is exactly that seat.
+- **What it reaches:**
+  - It hands work to its rigs' other seats, never to a person or another host's seat.
+  - It reads the items it sent and the items addressed to it from those seats, never the team's internal items.
+  - With `queue`/`claim` and `queue`/`update`, it claims and closes only items addressed to its own seat that it can read,
+    and waits (blocked) only on an item it names and can read. Its answers hide what reading the item hides.
+- **Two assistants together:** a grant with `team`/`list` sees its rigs' seats with `rig_team`, and may address and hear from
+  another connected assistant's seat. A grant without it never reaches a seat in the service's caller form
+  (`cus-<id>-<connection>@<rig>`), so an existing connection keeps the reach it had.
+- **Messages are items:** a message is an item the receiver reads and closes, and a reply is an item back to its sender.
+- **What the sender can tell, from the item it reads:**
+  - **Queued:** the item exists and is `pending` with no claim.
+  - **Picked up:** the receiver's claim (`in-progress`).
+  - **Answered:** closed `done`, with the answer in `resolution`.
+  - Reading or listing an item records nothing, and nothing wakes an assistant, so an item stays queued until its receiver
+    claims it.
+
 ## Limits today

 - **Webhook triggers only:** OpenRig rings a webhook. Email and other triggers aren't supported yet. A member without a trigger
@@ -110,6 +110,17 @@ limitation: use the live spec-library commands to determine where a spec is
 served from, and do not infer convergence merely because the canonical
 directory exists.

+The spec library scans the built-in specs, `$OPENRIG_HOME/specs` and, when
+present, that legacy library. At any depth below them it skips directories
+named `.git`, `.worktrees`, `node_modules`, `dist`, `build`, `.turbo` and
+`.next`, which usually hold build output or dependencies (`SKIP_DIRS` in
+`packages/daemon/src/domain/spec-library-service.ts`). A spec inside one of
+them, such as `specs/build/rig.yaml`, isn't listed, and nothing reports that it
+was skipped. To list it, rename its directory and run `rig specs sync`.
+`rig specs add <directory>` copies a directory under its own name, so adding a
+directory named `build` doesn't help. `rig up <path-to-rig.yaml>` still launches
+a spec by its path, without the library.
+
 Config updates publish a complete replacement file atomically where directory
 permissions and the filesystem allow it. On POSIX systems, replacement preserves
 the existing owner, group, and read/write/execute permission bits. If creating or
@@ -107,6 +107,28 @@ rig queue create --destination <entityId>@external --human-intent update \
 - **`posted` means the connector posted it, not that they read it.** Don't say they saw it.
 - **If delivery fails or is indeterminate,** inspect that task before anything else. Never resend blindly.

+## If the timer cannot reach its recipient
+
+A `periodic-reminder` occurrence that definitely fails before input remains owed. The watchdog
+retries through its existing loop, using `queue.wake_retry_interval_seconds` and
+`queue.wake_retry_cap` (by default, three retries five minutes apart). A failed attempt does not
+advance the reminder to its next regular cycle. A confirmed send advances the normal interval;
+recovery does not replay every elapsed cycle.
+
+`rig watchdog show <jobId> --json` includes the failed attempt, its retained outbox IDs, retry
+time and next action. If input may have reached the recipient, that occurrence ends unconfirmed
+and is not automatically sent again. Inspect the recipient and exact outbox record before any
+manual replay. A recurring reminder keeps its next normal cycle under a new occurrence identity. A confirmed receipt survives a daemon restart, so
+finishing its accounting does not type the same occurrence twice.
+
+Exhausted retries end only the failed occurrence, with its cause and next action; a recurring
+reminder keeps its next normal cycle. A permanent transport failure leaves a terminal job:
+correct the destination and register a replacement reminder. A one-shot park timer records its
+failed or unconfirmed wake on the parked row before it ends. A retryable failure is recorded
+there while the timer stays armed. Deliberately held
+input keeps its existing retained-message custody. Condition watches and parked-owner policy
+behavior are unchanged. This does not replay failed occurrences recorded by older versions.
+
 ## "What are you watching for me?"

 List **every active state**, not just set-aside ones. A watch being checked can be in progress, and a new one can be
@@ -0,0 +1,84 @@
+# Pi tool-selection recovery
+
+Use this when a live Pi conversation has fewer active tools than its operator
+currently intends. This does not establish why the selection changed or that
+stock Pi/OpenRig lost tools. The motivating report used a customized Pi 1.4.0
+deployment; it is not a stock cross-platform reproduction.
+
+## Diagnose before changing the selection
+
+Confirm the exact seat, occupant and conversation, then use an idle boundary.
+Preserve pending work and reconcile unknown writes before any replacement.
+Keep four things separate:
+
+- **Configured:** the effective merged `defaultTools` setting. Do not infer it
+  from one settings file; retain any unresolved patterns or modifiers as such.
+- **Currently intended:** the tools the operator wants enabled now, including
+  deliberate exclusions. Configuration alone does not establish that intention.
+- **Registered:** names the current Pi runtime knows about.
+- **Active:** names returned by `getActiveTools`, which can differ from both.
+
+A live RPC connection does not prove the tools are usable. Record observation
+time and conversation binding; an unavailable query stays unknown. Reloading
+unchanged settings can retain session-disabled tools by design, so a reload
+that restores nothing is not itself evidence of accidental loss.
+
+## Choose the interface the seat actually has
+
+Pi 1.4.0 includes an opt-in selector at
+`packages/coding-agent/examples/extensions/tools.ts` in the Pi repository. Its
+`/tools` command remembers selection per branch and needs Pi's own TUI. Use it
+where that extension and native TUI are available. **Do not send `/tools` to an
+agent OpenRig drives over RPC**: that interface cannot operate the selector.
+
+For RPC seats, an optional [community-maintained helper][helper] provides
+read-only status and an explicit command that adds only named intended tools.
+It is maintained outside OpenRig, is not bundled, and this link is not a support
+claim. Loading it also registers the agent-callable `openrig_runtime_status` and
+`openrig_slots` tools; the latter reads a snapshot of the bound rig's agents and
+active queue items. It can add a prompt section when a guidance file is set.
+Review its [shared implementation][runtime] and
+[setup/capability limits][setup] before opting in through Pi's per-seat extension
+configuration. Keep the two helper files together; do not install the separate
+RepoStew application just to use the neutral bridge. Verify what the target
+session actually loaded after the supported activation path.
+
+With that helper already loaded, these are **Pi extension commands**, not new
+`rig` commands:
+
+```text
+/openrig-status
+/openrig-restore-tools read
+```
+
+For an agent OpenRig drives over RPC, send each extension command with
+`rig send <agent> --raw "<command>"` so it arrives without a messaging envelope;
+the usual interactive-prompt guard still applies.
+
+The second command means that `read` is intended now. It does not restore every
+configured default. If `bash` was deliberately disabled, leave it disabled
+unless the operator explicitly intends to add it too. With no names, this helper
+refuses to change the selection.
+
+## Verify the recovery
+
+1. Establish the explicit current intended names. Reject unregistered or hidden
+   requested tools before changing anything; do not infer replacement names.
+2. Preserve current active extras: `setActiveTools` **replaces** the selection,
+   so pass the union of current active names and only the requested names. It can
+   ignore names it cannot activate; sending the command is not proof of recovery.
+3. Read `getActiveTools` back. Retain a before/after receipt with the intended
+   names and any missing names, then make a harmless actual call to a recovered
+   tool within the existing task authority. Listed-active is not proof of usable
+   permissions or working execution.
+
+This changes tool selection, not permission policy, task authority or conversation
+identity. It does not automatically persist a new branch selection; verify again
+after branch navigation or reload. If the runtime cannot support or verify this
+in place, report that capability gap and follow its supported replacement path
+with retained work. Do not manufacture a fresh conversation or claim that another
+harness has Pi's capabilities.
+
+[helper]: https://github.com/dajiaohuang/repostew/blob/adf9f36c23e27cf40cf8dd2dae887972a0dc776b/skill/integrations/pi-openrig.js
+[runtime]: https://github.com/dajiaohuang/repostew/blob/adf9f36c23e27cf40cf8dd2dae887972a0dc776b/skill/integrations/pi-runtime.js
+[setup]: https://github.com/dajiaohuang/repostew/blob/adf9f36c23e27cf40cf8dd2dae887972a0dc776b/skill/references/harnesses/pi.md
@@ -17,7 +17,7 @@ npx skills add https://github.com/mvschwarz/openrig/tree/<release-tag>/skills/ri
 npx skills add https://github.com/mvschwarz/openrig/tree/<release-tag>/skills/rigs --skill rigs --agent codex
 ```

-For a new install, use the latest release's tag, for example `v0.7.4`. If OpenRig is already installed, use the tag
+For a new install, use the latest release's tag, for example `v0.7.9`. If OpenRig is already installed, use the tag
 that matches `rig --version`, or upgrade first. If the command fails with `npx: command not found`, Node.js isn't
 installed or isn't on your PATH yet (see [What you need](#what-you-need)). Then type `/rigs` in Claude Code, or `$rigs` in Codex, and say what
 you want built.
@@ -90,7 +90,8 @@ Use `codex` or `both` in place of `claude` to match the coding agents you use. A
 - it adds an OpenRig block to `~/.tmux.conf` (mouse support and longer scrollback).

 It doesn't start anything. It ends with a summary of what's done and what still needs you. A missing sign-in shows
-there: run `claude auth login` or `codex login`, then carry on.
+there: run `claude auth login` or `codex login`, then carry on. Setup also tries to record the selected providers
+for a new kernel's first boot; its summary warns if it could not save the choice.

 ### 3. Start OpenRig

@@ -100,12 +101,16 @@ rig status
 rig ps --nodes --rig kernel
 ```

-The daemon starts and boots the kernel with the coding agents you're signed in to, or both if you're signed in to both.
+On the kernel's first boot, the daemon uses the providers selected by `rig setup --providers` that are signed in.
+If no provider choice was recorded, it considers every signed-in provider. An existing kernel keeps its seats;
+changing the setup choice does not replace them. An `OPENRIG_PROVIDER_SELECTED` value in the daemon's environment
+takes precedence over the saved choice.

 **What starting OpenRig changes, for the coding agents you use** (paths are the usual defaults):
 - **For Codex:** hooks and trust in `~/.codex/config.toml`, when OpenRig or a Codex agent starts.
 - **For Claude Code:** workspace trust in `~/.claude.json`, and activity hooks in the project's
-  `.claude/settings.local.json`, plus a status line unless you already have your own.
+  `.claude/settings.local.json`, plus a status line unless you already have your own. `rig down` takes the hooks and
+  status line back out once no Claude seat uses that directory.
 - **For both:** small discovery skills in `~/.claude/skills` and `~/.agents/skills`.
 - **Kernel access:** by default the kernel gets broader permissions than a project team gets by default. On Codex
  that's full access with no approval prompts. On Claude Code, its file tools, web fetches and operational commands,
@@ -91,10 +91,10 @@ my-rig.rigbundle.sha256   — "a1b2c3d4..." (64-char hex SHA-256)
 The packer produces deterministic output:
 - Files are sorted alphabetically
 - A fixed mtime is used (`2026-01-01T00:00:00Z`)
- Portable mode normalizes uid/gid/mode
+- Portable mode omits machine-specific owner metadata; file mode bits can be retained
 - Maximum gzip compression (level 9)

-Identical staged bytes (including manifest timestamps and provenance) produce the same archive hash. Use the package digest to compare packaged file content independently of manifest metadata.
+Identical staged bytes and file modes (including identical manifest timestamps and provenance) produce the same archive hash. A mode change can change the archive hash even when the file contents are unchanged. Use the package digest to compare packaged file content independently of manifest metadata and file modes.

 ---

@@ -180,7 +180,7 @@ edges:
 | `non_interruptive` | boolean | no | — | Pod-aware rig launch-warning default. With full-bypass Claude/Codex seats, true accepts or hides supported harness warnings using launch flags. Explicit CLI choices override this field; this field overrides the machine default. It does not grant permissions, change native settings files, or bypass login. |
 | `permission_policy` | string | no | — | Permission policy attached to the rig. Either a built-in (`builtin:locked`, `builtin:standard`, `builtin:open`, `builtin:yolo`, `builtin:auto`) or a safe relative path to a custom policy file (resolved from this spec's directory; no `..`, no absolute, no empty segments, each segment `[A-Za-z0-9][A-Za-z0-9._-]*`), or `none`, a recorded choice of the floor. Absent uses the default floor with the scoped team launch allowances described below. A bare built-in name such as `yolo` is refused ("use 'builtin:yolo'"), and so is an explicit `null`. A custom file that is missing, unreadable or invalid isn't a validation error: it resolves to the floor, and preflight warns. A member may set its own `permission_policy` (not on a terminal member), which takes precedence over the rig-level one; there is no pod level. See "Attaching a permission policy" below. |
 | `env` | map | no | — | Launch environment for every seat in the rig: `NAME: value` pairs. A member's own `env` overrides it name by name. Names match `^[A-Z_][A-Z0-9_]*$`, names starting `OPENRIG_` are reserved, and values must be non-empty strings (quote numbers and booleans). Values are not secret. See "Launch environment" below. |
-| `managed_blocks` | map | no | `CLAUDE.md` | File that receives OpenRig's managed instruction blocks for Claude Code members. Only the `claude-code` key is accepted, with `CLAUDE.md` or `CLAUDE.local.md`. Codex, Pi and OMP members use `AGENTS.md`. See "Choosing the Claude instruction file" below. |
+| `managed_blocks` | map | no | `CLAUDE.md` | File that receives OpenRig's managed instruction blocks for Claude Code members. Only the `claude-code` key is accepted, with `CLAUDE.md` or `CLAUDE.local.md`. Codex, Pi and OMP members use `AGENTS.md`, except that a fresh Pi seat normally uses its own agent folder's `AGENTS.md` and a fresh Codex 0.164.0+ seat normally gets launch developer instructions; a link, a conflicting or unreadable Codex config layer, or a resume keeps the repository file. See [Codex guidance at launch](agent-startup-guide.md#codex-guidance-at-launch) and [Runtime Differences](agent-startup-guide.md#runtime-differences). See "Choosing the Claude instruction file" below. |
 | `workspace` | object | no | — | The rig's workspace: `workspace_root` (required), `repos[]` of `{name, path, kind}` with `kind` one of `user`, `project`, `knowledge`, `lab` or `delivery` and unique names, an optional `default_repo` naming one of them, and an optional `knowledge_root`. Relative repo paths resolve against `workspace_root`. |
 | `docs` | Doc[] | no | — | Documentation files that should travel with the rig. Included in rig bundles. Each entry has a `path` field (safe relative path). The engine does not consume these — they are for humans and agents setting up the environment before launch. |
 | `startup` | StartupBlock | no | — | Rig-level startup files and actions. Applied to all members via the startup layering model. |
@@ -526,6 +526,105 @@ only the stored `env:`. Seats may share a home. Live usage refresh (`rig provide
 daemon's own logins; reading each seat's home would need a native reader per home. OpenRig doesn't copy logins or conversation history between homes, so a conversation saved under a seat's earlier home
 doesn't resume after the seat moves to another one. The `openrig-user` skill has the setup steps.

+**A seat's own subscription token.** A Claude member can start on a prepared subscription token from its first launch,
+with no conversation to switch first. Name the token file beside its config dir:
+
+```yaml
+- id: dev
+  runtime: claude-code
+  env:
+    CLAUDE_CONFIG_DIR: /abs/claude-dev
+  claude_token: { label: dev-sub, file: /abs/tokens/dev.token }
+```
+
+The label and the absolute path are stored on the seat when the rig is created, as `rig provider switch --seat <seat>
+--to-account <label> --token-file <path>` stores them. Its launches run the same token step, which reads the file as
+Claude starts; a launch path that can't run it (a pane shell other than a POSIX one, for example) starts without it and
+warns. The file's contents never pass through OpenRig: validation doesn't read it, and they don't reach the spec, the
+seat's record or the launch command. A missing, empty or unreadable file doesn't refuse the spec; the seat starts on its
+config dir's stored login (or a token the daemon gives every seat) and says so. A launch also warns when a setting Claude
+Code ranks above the token would be used instead: an `apiKeyHelper`, or an outranking `env` entry in the user, project
+or local settings. Managed settings aren't inspected. `rig export` writes the seat's current reference, except for a seat
+with an account home or an API-key selection (select those again after import), so a later switch shows there, and `rig provider switch --stored-login` removes it. Only
+`claude-code` members and legacy flat nodes accept it, and there's no rig-level default.
+
+**Switching to an isolated account home.** A running Codex or Claude Code seat can change its native account home
+while staying in its rig:
+
+```sh
+rig provider switch --seat dev-impl@my-rig --to-account api-account \
+  --account-home /home/me/accounts/codex-api --model gpt-5.5 --reason "Use the API budget" --dry-run
+rig seat set-runtime dev-impl@my-rig --runtime claude-code \
+  --account-home /home/me/accounts/claude-api --model claude-sonnet-4-6 --reason "Codex limit"
+```
+
+The directory must already exist and contain the runtime's login or API settings. You choose the account and budget;
+OpenRig does not choose or create credentials. `--account-home` sets `CODEX_HOME` for Codex or `CLAUDE_CONFIG_DIR` for
+Claude Code before the successor starts.
+
+This switch starts a fresh conversation with a handover, even when the runtime stays the same. The existing
+subscription-login switch preserves the conversation. Once the successor confirms, OpenRig commits its home, runtime,
+model, profile and permission selection together. The seat keeps its address, edges, queue rows and claims. If OpenRig
+refuses the switch before cutover, the predecessor's configuration stays unchanged.
+
+For a Claude plan authenticated with `setup-token`, supply the token file with the home:
+
+```sh
+rig provider switch --seat dev-impl@my-rig --to-account claude-plan \
+  --account-home /home/me/accounts/claude-plan --token-file /home/me/credentials/claude-plan-token \
+  --reason "The plan reset"
+# Across runtimes, use set-runtime with --account-home, --token-file and --account-label.
+```
+
+To return to the seat's configured login:
+
+```sh
+rig provider switch --seat dev-impl@my-rig --clear-account-home --reason "The plan reset" --dry-run
+rig provider switch --seat dev-impl@my-rig --clear-account-home --reason "The plan reset"
+# Across runtimes: rig seat set-runtime dev-impl@my-rig --runtime claude-code --clear-account-home --reason "Return to configured login"
+```
+
+Clearing the selection also starts a successor with a fresh conversation and a handover. OpenRig removes the saved
+account-home override and its token reference only after the successor confirms. The successor starts with the member's
+or rig's configured home, falling back to the daemon's selection and then the native default, as an ordinary launch does.
+If there was no account-home override, OpenRig preserves any unrelated legacy per-seat token. Clear uses the current
+configuration; it does not remember a prior login or restore old credentials. Use clear on its own, without
+`--to-account`, `--stored-login`, `--account-home` or a new token reference.
+
+**Anthropic profile limitation.** An active or default profile in Anthropic's configuration directory can override a
+stored Claude login. `CLAUDE_CONFIG_DIR` does not isolate that directory, and OpenRig does not change `ANTHROPIC_CONFIG_DIR`
+or rewrite global profiles. Check or deselect the profile before using a stored-login account home, and verify the
+running account privately.
+
+An isolated Claude launch removes `ANTHROPIC_PROFILE`, `ANTHROPIC_FEDERATION_RULE_ID` and `ANTHROPIC_ORGANIZATION_ID`
+from its inherited environment. It also refuses profile selectors in the selected home's or project's settings `env`
+blocks. An explicit subscription token takes precedence over these selectors, including in the legacy
+subscription-token switch.
+
+OpenRig receives only the token's label and file path. The launch reads the token; if the required file is unusable, no agent
+starts. Selecting an API home without `--token-file` clears an older seat token reference when the selection commits.
+The home's API helper can stay in its user settings. For a selected plan token, OpenRig refuses a home whose API helper
+or credential environment would take precedence over that token. Both modes refuse project credential overrides.
+OpenRig leaves those settings unchanged.
+
+The selected home persists across managed launches and restores. These launches exclude inherited Claude/OpenAI
+credentials and routing variables so credentials from the daemon or shell cannot override the selected home. OpenRig
+refuses to launch if it cannot read the saved selection or the shell cannot enforce isolation. Launches without a home
+selection and existing subscription-login switches keep their behavior. A Claude seat using account-home mode must
+use that mode for later account changes too.
+
+User-managed provider settings can still affect authentication. After a real tool turn, check which account and billing
+identity the runtime used. Do not print tokens or the process environment. The configured home alone cannot verify the
+running account.
+
+Before downgrading to a version without account-home switching, stop the managed seats. Select their accounts using
+that version's supported setup before resuming. Older versions ignore the saved selection and may launch with inherited
+or default credentials. Rolling back the binary alone does not preserve the selected billing account.
+
+OpenRig leaves the imported team file unchanged. Exporting and reimporting a team does not preserve account-home
+isolation, so configure it explicitly for each new rig. If a switch is interrupted, inspect it with `rig seat status`
+and follow the printed recovery command. Wait until the outcome is known before starting another switch.
+
 **Do not put secrets in `env:` or `--env`.** The values are not secret, and nothing here encrypts or hides them (see #306):

 - Spec values are stored in OpenRig's database and in rig snapshots, and `rig export` and bundles copy them, so a secret put there by mistake travels with the rig.
@@ -534,6 +633,52 @@ doesn't resume after the seat moves to another one. The `openrig-user` skill has

 Use `env:` for settings only. Credentials belong in the provider's own login or a secret store the seat reads at run time.

+### Switching credentials while keeping the conversation
+
+`rig provider switch` resumes a running seat in its existing home and pane. A stopped Claude Code
+seat isn't relaunched: the switch saves the new reference for its next launch, but only when the
+launch it predicts resumes the seat's conversation. That prediction covers the snapshot that
+launch would use and restore's automatic periodic carry. It then prints the launch that resumes:
+`rig launch <rig> <seat> --snapshot-id <id>` for a saved conversation, or a plain
+`rig launch <rig> <seat>` when the resume comes through the periodic carry, which naming a
+snapshot would turn off. Otherwise it refuses and changes nothing. `rig provider precheck` gives
+the same answer.
+For Claude Code, select an API-key file, a subscription-token file, or the home's stored login:
+
+```sh
+rig provider precheck --seat dev-a@my-rig --to-account api-budget --api-key-file /secure/claude-api-key
+rig provider switch --seat dev-a@my-rig --to-account api-budget --api-key-file /secure/claude-api-key
+rig provider switch --seat dev-a@my-rig --to-account plan --token-file /secure/claude-plan-token
+rig provider switch --seat dev-a@my-rig --stored-login
+```
+
+The API-key file must be private (0600 or 0400), nonempty, and at most 8192 bytes, containing
+one key with optional surrounding whitespace. Only the reference is stored. The child reads the
+key at launch; key bytes never enter command arguments, snapshots or switch reports. Classic
+launches require a supported POSIX pane shell. Missing/invalid API-key files prevent launch.
+Settings that could override the key cause a refusal; OpenRig does not edit those settings.
+Native managed settings and a signed-in Claude gateway cannot be ruled out; Claude may require API-key approval before its
+first turn. Check `/status` after a real tool turn to confirm the authentication method.
+
+For Codex, a saved native API-key login is selected with the existing `--to-account <name>`
+path, exactly like a saved subscription login. Prepare it using native `codex login --with-api-key`
+with the key on stdin, then `rig auth save --codex-home <home> <name>`; never put a key in argv.
+Use the seat's existing home. Preparing a login replaces that home's active credentials, so do it
+before running seats there, or prepare/import a native auth profile separately. Switches preserve
+an outgoing credential copy and report peers sharing the home. A native keyring or administrator
+policy can override `auth.json`; the report remains unverified until native account verification.
+
+Select or clear an account home in a separate operation: `--api-key-file` cannot be combined with
+`--account-home` or `--clear-account-home`. A credential switch inside an already selected home
+keeps that home.
+
+Both paths retain the conversation and launch settings, interrupt in-flight work, and report
+uncertain restarts without retrying. They do not move account homes or start a fresh conversation.
+The caller chooses subscription-first order and configures/enforces the API budget; this command
+neither selects accounts automatically nor imposes a spending limit. Downgrade only after switching
+API-key Claude seats back to subscription credentials: older OpenRig versions cannot read the new
+credential kind correctly.
+
 ### Choosing the Claude instruction file

 OpenRig writes its instructions for Claude Code members into managed blocks in
@@ -597,17 +742,20 @@ directory's `CLAUDE.md`, including blocks written by other rigs.
 | `profile` | string | yes | — | Profile name from the referenced AgentSpec. Use `default` for the default profile. Exception: `none` for terminal nodes. |
 | `codex_config_profile` | string | no | — | Codex-only native profile passed as `-p <name>`; letters, numbers, `_`, `.`, `-`. Separate from the AgentSpec `profile`. With the normal launch mode, this replaces OpenRig's explicit workspace-write sandbox flag. A full-bypass policy instead emits danger-full-access and omits this profile argument. |
 | `codex_permissions` | mapping | no | — | Codex-only sandbox and approval envelope, emitted as explicit flags on every managed launch and resume; see [per-member Codex permissions](#per-member-codex-permissions). |
+| `claude_token` | mapping | no | — | Claude-only `{ label, file }`: the seat's own subscription token file, by absolute path, used from its first launch; see "A seat's own subscription token" under [launch environment](#launch-environment). |
 | `runtime` | string | yes | — | Agent runtime. Current supported values: `claude-code`, `codex`, `pi`, `omp`, `terminal`, `stub`. `stub` is a deterministic test harness, not an agent: a Node runner in the seat's tmux pane goes through the normal launch, skill projection, startup-file and readiness path, follows `<cwd>/.openrig/stub/script.json` when present, and calls no model. See "What a stub can and cannot prove" in `docs/as-built/test-layers.md`. |
 | `cwd` | string | yes | — | Working directory for the agent. A relative path resolves against the rig root (the directory containing the rig spec). If that path exists as written, it is used. Otherwise a leading `~` or `~/` expands to the home directory (`~user` does not) and `$VAR` / `${VAR}` expand from the daemon host's environment; a relative result still resolves against the rig root. A reference to an unset variable stays as written, so the cwd is that literal path and works only if it exists. Use `"."` for the rig root itself. Can be overridden at launch time with `rig up --cwd`. A cwd inside the OpenRig installation fails preflight unless `--cwd` is given. Editing this declaration does not update an existing seat; use [`rig seat set-cwd`](agent-startup-guide.md#change-an-existing-seats-working-directory) to save its future launch directory. |
 | `label` | string | no | — | Human-readable member name. Shown in UI when present. |
 | `model` | string | no | — | Model override. Runtime-specific (e.g., `claude-opus-4-6` for Claude Code). |
 | `effort` | string | no | — | Reasoning effort override, trimmed. Claude gets `--effort`, Codex `-c model_reasoning_effort=…`, Pi `--thinking` (see "Pi" below). A non-string value is ignored with an advisory. |
 | `advisor` | string | no | — | Claude-only Advisor model for this seat. Overrides the AgentSpec profile/default; blank or non-string values are ignored with an advisory. |
+| `claude_mcp` | `none` | no | normal loading | Claude members only. Disable MCP server loading for this agent on every launch and resume. Omit the field to keep Claude's normal configuration; see [Claude MCP loading](#claude-mcp-loading-runtime-claude-code). |
 | `permission_policy` | string | no | — | Member-level permission policy; overrides the rig's. Not valid on terminal members. |
 | `env` | map | no | — | Launch environment for this seat, laid over the rig's `env`. Same rules as the rig-level field. Valid on terminal members too. See "Launch environment" below. |
 | `agent_file` | string | no | — | Claude members only. A Claude agent definition (a `.md` file with `name` in its frontmatter) for this seat. It's copied into the seat's own storage and launched as `--agent openrig:<name>`. A path beside the spec: no `..`, not absolute. |
 | `append_system_prompt_file` | string | no | — | Claude members only. A prompt file appended to Claude's system prompt for this seat. It's copied into the seat's own storage and passed as `--append-system-prompt-file`. A path beside the spec. |
 | `plugin_dirs` | list | no | — | Claude members only. Claude plugin folders for this seat, each copied into the seat's own storage and loaded through `CLAUDE_CODE_PLUGIN_DIRS`. Paths beside the spec. Each is copied under its folder name, so two folders with the same name are refused; an empty list is none. A missing file or folder fails that seat's launch by name. `rig bundle create` carries all three; `rig export` names a seat whose additions it doesn't carry. |
+| `plugin_channels` | list | no | — | Claude members only. Plugin channels this agent registers for, as `plugin:<name>@<marketplace>` entries, passed as one `--channels` on every launch; see [Claude plugin channels](#claude-plugin-channels-runtime-claude-code). |
 | `role` | string | no | — | The seat's role, letters, digits, `_`, `.` and `-`. Not valid on terminal members. |
 | `restore_policy` | string | no | the AgentSpec's | Restore behavior. One of: `resume_if_possible`, `relaunch_fresh`, `checkpoint_only`. The default comes from the AgentSpec's `defaults.lifecycle` (else `resume_if_possible`) as narrowed by its profile; a member value may only narrow it further, in that order. |
 | `compaction_strategy` | string | no | — | `default-compaction`, `managed-compaction`, `handover` or `apprentice-handover`; `harness_native` and `pod_continuity` are accepted as deprecated aliases, and `custom_prompt` is refused. `managed-compaction` and `apprentice-handover` create their jobs only for `claude-code` seats; see [Codex compaction and sizing](agent-startup-guide.md#codex-compaction-and-sizing). |
@@ -616,6 +764,99 @@ directory's `CLAUDE.md`, including blocks written by other rigs.
 | `starter_ref` | object | no | — | `{ name }` of an agent starter (`^[a-zA-Z0-9][a-zA-Z0-9_-]*$`) whose files lead the seat's startup. Not valid on terminal members or with a fork. |
 | `startup` | StartupBlock | no | — | Member-level startup files and actions. Applied only to this member. |

+### Claude MCP loading (`runtime: claude-code`)
+
+Set `claude_mcp: none` on an individual member to launch it without MCP servers:
+
+```yaml
+members:
+  - id: reviewer
+    agent_ref: local:agents/reviewer
+    profile: default
+    runtime: claude-code
+    cwd: .
+    claude_mcp: none
+```
+
+OpenRig passes `--strict-mcp-config --mcp-config '{"mcpServers":{}}'` to
+Claude for this seat. Strict mode selects only the supplied empty server set,
+excluding servers from user, project, team and plugin configuration. It does
+not disable plugin skills or change the seat's permission mode. The choice is
+saved on the seat and carried through fresh starts, forks, resumes (including
+saved startup context) and handover successors. Export and bundle round trips
+preserve it. The same field is supported on legacy `nodes` declarations.
+
+Other agents in the same directory keep their own choices; OpenRig does not
+rewrite shared MCP configuration files. Omit the field for Claude's normal
+loading. A later launch from an authored spec without the field clears the
+seat's saved opt-out once the launch is accepted for startup; a rejected
+launch leaves the choice unchanged. Restarting from saved context keeps it.
+Only `none` is accepted, and the field is invalid on other runtimes. If the
+seat switches to another runtime, the Claude choice stays dormant and applies
+again if it switches back. A currently running Claude process is unaffected.
+Export describes the current runtime and omits a dormant Claude choice. YAML
+exports name each affected agent in a `# Not carried:` comment, which `rig export`
+also prints after writing the file; JSON exports keep their existing shape. If
+you rebuild from that export and switch back to Claude, restore `claude_mcp: none`
+in the Claude declaration. Re-check this setting after downgrading
+OpenRig too: older versions can ignore it.
+
+Shutdown resume probes and the displayed native recovery commands (including
+the conversation picker) also carry the saved MCP choice. If shutdown cannot
+read that choice, it skips the probe and retains the token; shutdown proceeds.
+
+This opt-out is incompatible with an active enterprise `managed-mcp.json`:
+[Claude rejects strict overrides of that managed server set](https://code.claude.com/docs/en/managed-mcp#servers-passed-with---mcp-config-or---strict-mcp-config).
+OpenRig keeps the requested opt-out flags, so startup and resume remain subject
+to that native refusal; it does not fall back to loading servers. Use a host
+without that managed configuration, or omit the opt-out to use the managed set.
+
+### Claude plugin channels (`runtime: claude-code`)
+
+Set `plugin_channels` on a Claude member to register that agent for channel
+notifications (messages a plugin's MCP server pushes into the session):
+
+```yaml
+members:
+  - id: support
+    agent_ref: local:agents/support
+    profile: default
+    runtime: claude-code
+    cwd: .
+    plugin_channels:
+      - plugin:example-channel@example-marketplace
+```
+
+OpenRig passes `--channels plugin:example-channel@example-marketplace` to this
+agent's Claude on every launch, resume, fork, restore and handover. Several
+entries follow one `--channels`, space-separated, and OpenRig's own session
+options come after them. Claude Code 2.1.316 hides `--channels` from
+`claude --help`, so it isn't listed there. An agent without the field gets no
+`--channels`, and nothing is added for other agents or other runtimes; there is
+no rig-wide or environment default.
+
+Each entry is `plugin:<name>@<marketplace>`, both names made of letters, digits,
+`.`, `_` and `-`, starting with a letter or digit. `server:` entries and Claude's
+`--dangerously-load-development-channels` aren't supported. Combining a non-empty
+channel list with `claude_mcp: none` produces a validation warning: that setting
+starts Claude without MCP servers (plugin servers included), so no channel could
+register. OpenRig keeps both settings and launches the member normally. Remove
+`claude_mcp: none` to use the channels, or remove `plugin_channels` to keep the MCP
+opt-out. OpenRig doesn't install plugins or marketplaces, or change the settings
+that admit a channel: whether each channel registers is Claude's decision (the plugin installed, and
+admitted by your organisation's channel settings or Claude's approved list).
+
+Selecting a channel for one agent doesn't isolate what the plugin shares with
+other agents. A token or other credential the plugin keeps in its own
+configuration is the same for every agent that loads that plugin.
+
+The selection is saved with the seat's other launch additions when the seat
+starts from the spec, and starting it from a spec without the field removes it.
+`rig seat launch --plan` and `rig skill loadout --seat` list it, a fork keeps it,
+and `rig bundle create` and `rig export` carry it in the member; a bundle's
+before-install view names each channel as a need. A running Claude process is
+unaffected.
+
 ### Claude Advisor (`runtime: claude-code`)

 Set `advisor` independently of the primary `model`:
@@ -805,19 +1046,21 @@ the modified topology, run `rig snapshot <rig-id>` and use its returned ID with

 Startup blocks can appear at three levels: rig, pod, and member. They are merged additively via the startup layering model (see [the layering model](agent-startup-guide.md#the-layering-model)). The rig's `culture_file` joins as a required file with the `auto` hint in the culture layer, on both fresh start and restore.

-`rig export` includes the rig's saved culture file and startup block, and now also
-writes each pod's saved startup files under that pod. The file order, delivery
-hints, required flags, orientation and `applies_on` selections are retained.
-Previously the saved pod file lists were omitted. Pods without a recorded file
-list, including older rigs, keep their existing export behavior; the exporter
-does not reconstruct declarations from a member's combined startup context.
+For member `startup:`, export uses that seat's retained launch recipe (or its pre-launch materialization) rather than guessing from projected files. If that source is unavailable or a member's files came from a different rig root, the YAML names the member's omitted startup; JSON export names omissions in the `X-OpenRig-Export-Warnings` response header. An older seat without a recipe may have had no member startup or an unretained one: inspect its source before re-importing. When member startup files are present in the export, `rig export` checks required paths against the output folder and warns for missing files. The export does not copy member startup files.
+
+`rig export` includes the rig's saved culture file and startup block, and writes
+saved pod startup files and actions under their pod. The file and action order,
+delivery hints, required flags, orientation and `applies_on` selections are retained.
+Pod actions are saved for export when a new rig is created; older rigs and pods
+added from a separate expansion may not have those declarations recorded. Export
+does not reconstruct them from a member's combined startup context; keep the source
+spec when those declarations are needed. This does not change which startup actions
+are inherited when a seat is added later.

 File paths remain relative to the exported spec's folder. When exporting to a
 different folder, supply the referenced startup files there or import with the
-original `--rig-root`. The CLI warns once per missing required rig or pod file;
-missing optional files do not trigger that warning. Pod startup actions and
-member startup blocks remain outside this export; keep the source spec when you
-need those declarations.
+original `--rig-root`. The CLI warns once per missing required rig, pod or member
+file; missing optional files do not trigger that warning.

 ### Files

@@ -834,7 +1077,7 @@ need those declarations.
 | Hint | Behavior |
 |------|----------|
 | `auto` | System chooses based on file type and context. |
-| `guidance_merge` | Merged as a managed block into the runtime's guidance file: for Claude, the `managed_blocks` file (`CLAUDE.md` or `CLAUDE.local.md`); for Codex, Pi and OMP, `AGENTS.md`. Delivered before harness boot. |
+| `guidance_merge` | Merged as a managed block into the runtime's guidance file: for Claude, the `managed_blocks` file (`CLAUDE.md` or `CLAUDE.local.md`); for Codex, Pi and OMP, `AGENTS.md`, except that a fresh Pi seat normally uses its own agent folder's and a fresh Codex 0.164.0+ seat normally gets launch developer instructions (the conditions are in [Codex guidance at launch](agent-startup-guide.md#codex-guidance-at-launch) and [Runtime Differences](agent-startup-guide.md#runtime-differences)). Delivered before harness boot. |
 | `skill_install` | Installed as a skill in the runtime's skill directory. Delivered before harness boot. |
 | `send_text` | Sent as text to the agent's terminal after the harness is ready. Requires the agent TUI to be active. |

@@ -1078,3 +1321,15 @@ These are the built-in specs shipped with OpenRig. Read them as worked examples.
 Also shipped, in the same tree: `launch/kernel`, OpenRig's own team, which starts automatically. `first-project` is
 starter's old name and still resolves to it. `workshop`, the four-agent middle team, is a rig bundle rather than a
 built-in. List the built-ins with `rig specs ls --kind rig`.
+
+To omit built-in rigs, agents and workflows from the shared spec inventory, run
+`rig config set specs.builtins_visible false`. This changes the CLI, TUI and other
+consumers of the library listing; user specs remain visible. Use
+`rig specs ls --include-builtins` to list them deliberately, and set the value
+back to `true` to restore the default. Explicit `show`, `preview`, and launch
+lookups can still find hidden built-ins. When built-ins are hidden and a user
+spec has the same name, the user spec wins the name lookup; use the built-in's
+ID from `rig specs ls --include-builtins --json` to select it. With built-ins visible,
+same-name matches remain ambiguous. This is an inventory preference, not an
+access-control boundary; other endpoints and on-disk files can still expose the
+built-ins.
@@ -0,0 +1,77 @@
+# Runner conformance check
+
+A runnable check for runner authors. Point it at your runner and it reports which promises of the
+[harness and runner contract](../harness-runner-contract.md) your runner keeps. It needs Node and tmux, and no OpenRig
+daemon, model, credentials or network.
+
+```sh
+node check-runner.mjs --runner 'my-runner --agent-command {agent}' --name my-harness --resume --first-input
+```
+
+- **`{agent}`** is replaced with the path of the fake ACP agent beside this file. Your runner starts it where it would
+  start your real agent. It accepts any arguments your runner adds.
+- **`--name`** is your preset's name, which your posts carry as `runtime`.
+- **`--resume` and `--first-input`** say your preset declares `resume: true` and `first_input: true`. Without them,
+  those cases are skipped, because OpenRig wouldn't pass that input.
+- **`--cases 2,4`** runs only some cases. `--json` prints a machine-readable report. `--keep` keeps each launch's
+  folder: the agent's message log, the launch record and the scenario.
+- **`--wait-ms 20000`** waits longer for each step (default 8000), for a runner whose agent takes a while to start. The check's shorter settling times, and the fake agent's own delays and holds, grow in proportion.
+- **`--pass-env NAME`** passes one more variable through. Otherwise the runner gets only `PATH`, `HOME`, `USER`,
+  `SHELL`, `LANG` and `TMPDIR`, plus the OpenRig variables.
+- **The exit status** is 0 when nothing fails, 1 when a case fails, and 2 for a usage or setup problem. An advisory result (4c, 7c) never changes it.
+
+In an installed OpenRig, the check is at `$(npm root -g)/@openrig/cli/daemon/docs/reference/runner-conformance/`.
+
+## How it runs
+
+- **Your runner** starts in a private tmux server, with the environment a runner-preset launch gives it:
+  `OPENRIG_URL`, `OPENRIG_ACTIVITY_HOOK_TOKEN`, `OPENRIG_SESSION_NAME`, `OPENRIG_NODE_ID`, `OPENRIG_RUNTIME`,
+  `OPENRIG_OCCUPANT_GENERATION`, `OPENRIG_LAUNCH_RESULT` and `OPENRIG_LAUNCH_ATTEMPT`, plus `OPENRIG_RESUME_REF` or
+  `OPENRIG_FIRST_INPUT` when a case needs them. `OPENRIG_HOME` is an empty folder, so nothing reaches a real OpenRig.
+- **The fake agent** speaks ACP v1 over stdio. Each case gives it a scenario, such as a slow handshake, a permission
+  request, a turn that ends cancelled, or an exit mid-turn. It logs every message in both directions. Its own request
+  ids are numbers, as JSON-RPC agents commonly use, so a runner passes them on unchanged.
+- **A local endpoint** stands in for `POST /api/activity/hooks`. It records each post, and refuses one without the
+  launch's bearer token, as OpenRig does.
+  - **In cases 4 and 4b,** it also stands in for the answered path's three routes: submit, read with `waitSeconds`, and
+    withdraw. It checks a submit the way OpenRig does: the seat and generation, `nativeRef` as a non-empty string, `turnId`
+    and `requestId` as a string or a number (a number reads as its decimal string). Options a person can't be shown (not
+    2-4 of them, ids that repeat or use other characters, or other kinds) are permitted with the agent's allow option, as OpenRig does. Each launch scripts the answer,
+    the permit or the refusal it gives, or closes the connection unanswered.
+  - **Where a launch scripts none of that,** those routes answer 404, as an OpenRig without the answered path does, so
+    the runner permits.
+- **Input arrives the way `rig send` delivers it:** the text is pasted as one bracketed paste with raw newlines, then
+  Enter is pressed. Ordinary messages carry a From/To envelope.
+
+## The cases
+
+| Case | Contract section | What it checks |
+|---|---|---|
+| 1 | 3 | No launch record until `session/new` is answered. Then a record holding format 1, this attempt, the preset's name, the agent's conversation id and a `producer` |
+| 1b | 3, 4 | A handshake that fails at `initialize` or `session/new` (an error or an exit) writes no conversation in a launch record, and posts no accepted prompt or idle report |
+| 2 | 5, 6 | One pasted block becomes exactly one `session/prompt`, byte for byte. A line reading `/abort` inside a block isn't control. A block sent mid-turn waits for the next turn. A block that is exactly `/abort`, or Ctrl-C outside a paste, sends one `session/cancel`. `Stop/cancelled` is posted only when the agent itself returns `cancelled` |
+| 3 | 4 | `UserPromptSubmit/accepted` with a `turnId`, then `Stop/end_turn`. Every post carries the contract's fields, the hook token, this seat's identity and a rising `sequence`. `livenessSeconds`, when given, is from 1 to 3600 |
+| 3b | 4 | **Optional, from 0.7.9; skipped when the runner sends no beat.** In a long, quiet turn, each `active/liveness` beat names the accepted turn, `sequence` rises with the runner's own `occurredAt` across every post, beats come more often than every `livenessSeconds` ÷ 2, and none follows the turn's `Stop`. While a person is asked, no beat is posted; after the answer, `active/permission_resolved` names the turn and the ask, before any beat. A permit at submit opens no ask, so the quiet turn's beats go on |
+| 4 | 7 | When no one can be asked, the request is permitted: an OpenRig without the answered path (404) at once, and one the runner can't reach, each get the agent's `allow_once` option, never its `allow_always` while `allow_once` is offered. The turn then reports as usual, with no `permission_prompt`. Only `denied_by_seat`, or a request with no allow option, is answered at once with a refusal, never an allow option. `Notification/permission_prompt` is then posted, and for `denied_by_seat` the pane shows what was asked (the tool call's title). No idle `Stop` or beat is posted while that attention is held, even when `/abort` then cancels the turn. The next prompt is accepted as usual |
+| 4b | 7 | The live request is submitted with the hook token, its `requestId` as the agent's JSON-RPC id, passed unchanged, the accepted prompt's `turnId`, this conversation and generation, and the agent's options as offered. The runner doesn't post `permission_prompt` itself for a created ask, and each read waits at most 25 s. The chosen option, allow or deny, reaches the agent once, and the turn then reports as usual. OpenRig's `permitted`, at submit or at a read, reaches the agent the same way, and a read that carries the person's own words (`said`) still gives the agent the read's option. A refusal is read by its code, never its status: one section 7's table marks "permits" (`duplicate_request`, `activity_grant_pending`, `activity_grant_revoked`), a read that gets no answer, and a status or read state the section doesn't list (500, `deferred`) each give the agent its `allow_once` option. A refusal saying the request isn't the current occupant's (`stale_generation` at submit, `activity_grant_stale` on a read), and a `refused` (`said_no`), stale or withdrawn read, give the agent `cancelled`, and the turn then ends as usual, with nothing held. With no answer, the request stays pending with no idle report after the turn's accepted prompt, and a pasted message isn't an answer. `/abort` withdraws it with `turn_cancelled`, and an answer after that isn't delivered. A turn's end or the agent's exit while it waits withdraws it with `turn_ended` or `exited`. Once the ask is withdrawn no person is still waiting, so the turn's end is reported as usual. An ask the runner permitted after a read got no answer, or an unlisted one, may still be open, so it's withdrawn at the turn's end too |
+| 4c | 7 | **Advisory.** A read's `said`, the words of a person who answered in words, is queued to the agent as a prompt, after the turn and after any prompt already waiting. Section 7 lets a runner drop them and still keep the contract, so this result is shown as met or not met and never counts as a pass or a fail, or toward the exit status |
+| 5 | 4 | Every post carries `OPENRIG_OCCUPANT_GENERATION` |
+| 6 | 8 | A resume asks the agent to reopen `OPENRIG_RESUME_REF` in the launch's working folder, and records that conversation. The agent's own not-found becomes `error: "missing"`. Any other failure is neither missing nor resumed. No case starts a new conversation |
+| 7 | 4 | An agent that dies mid-turn gets `Stop/<preset>_exited`, and no idle report for that turn. Posts are taken in the runner's own order, as OpenRig orders them (`occurredAt` when it's a time string, otherwise the post's arrival, then `sequence` when both are positive whole numbers), so an idle report from before the turn began doesn't count, however late it arrives |
+| 7b | 4 | A failed `session/prompt` posts `Notification/runtime_error`, not a permission request |
+| 7c | 9 | **Advisory.** Closing the pane ends the agent process. Section 9 marks this duty as proposed, and lets a runner list in `limits` what may keep running, so this result is shown as met or not met and never counts as a pass or a fail, or toward the exit status. The fake agent outlives a hangup here, so the runner has to end it |
+| 8 | 7 | An unknown request from the agent gets JSON-RPC `-32601`, and the next prompt still goes through |
+| 9 | 9 | `OPENRIG_FIRST_INPUT`'s exact bytes, newlines and spaces included, are the first prompt |
+
+## What it doesn't check
+
+- **How OpenRig reads your posts:** working, idle, needs input, unknown after an exit, a send refused while a
+  permission waits, and an earlier generation not counting. That's OpenRig's side of the contract, and its own tests
+  cover it.
+- **Your real agent:** a passing check isn't a run with your agent. Section 10's real check, with your agent under a
+  runner preset, is still the useful evidence. Passing this is evidence for the versions you ran, not certification.
+- **The model handoff:** `OPENRIG_MODEL` is mapped to your harness's own setting, with no wire this check can see.
+- **A resume for a preset without `resume`:** OpenRig doesn't pass `OPENRIG_RESUME_REF` to it.
+- **Restarting the agent after a failed handshake:** the contract doesn't rule on that.
+- **The chosen person's side of an ask:** who may answer, the Feed and Slack are OpenRig's side, and its own tests
+  cover them. Routing an ask to a seat is a later change.
@@ -0,0 +1,818 @@
+#!/usr/bin/env node
+// OpenRig runner conformance check: point it at your runner and see which promises of the runner contract
+// (docs/reference/harness-runner-contract.md) it keeps. It needs Node and tmux, and no OpenRig daemon:
+//   - your runner starts in a private tmux server, with the environment a runner-preset launch gives it;
+//   - the fake ACP agent beside this file stands in for your agent (your runner starts it where it would start the real one);
+//   - a small local endpoint stands in for OpenRig's activity route, and records what your runner posts;
+//   - input arrives the way `rig send` delivers it: one bracketed paste with raw newlines, then Enter.
+//
+//   node check-runner.mjs --runner '<command>' [--name <preset name>] [--resume] [--first-input]
+//                         [--cases 1,2,4] [--wait-ms 8000] [--pass-env NAME] [--json] [--keep]
+//
+// `{agent}` in the command is replaced with the fake agent's path, an executable that takes any arguments your runner
+// adds. For example: --runner 'my-runner --agent-command {agent}'. --resume and --first-input say your preset declares
+// `resume: true` and `first_input: true`; without them those cases are skipped, since OpenRig wouldn't pass that input.
+// The runner gets a clean environment: PATH, HOME, USER, SHELL, LANG and TMPDIR, the OpenRig variables, and any
+// --pass-env names. Exit status: 0 when nothing fails, 1 when a case fails, 2 for a usage or setup problem.
+//
+// It checks the runner's side only. How OpenRig reads those posts (working, idle, needs input) is OpenRig's own tests'
+// job, and one real run with your agent is still the useful check (section 10 of the contract). Passing this is
+// evidence for the versions you ran, not certification.
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const usage = "usage: node check-runner.mjs --runner '<command with {agent}>' [--name <preset>] [--resume] [--first-input] [--cases 1,2] [--wait-ms 8000] [--pass-env NAME] [--json] [--keep]";
+
+function parseArgs(argv) {
+  const opts = { name: "runner", cases: undefined, passEnv: [], resume: false, firstInput: false, json: false, keep: false, waitMs: 8000 };
+  for (let i = 0; i < argv.length; i += 1) {
+    const flag = argv[i];
+    const value = () => { if (i + 1 >= argv.length) throw new Error(`${flag} needs a value`); return argv[++i]; };
+    if (flag === "--runner") opts.runner = value();
+    else if (flag === "--name") opts.name = value();
+    else if (flag === "--cases") opts.cases = value().split(",").map((c) => c.trim()).filter(Boolean);
+    else if (flag === "--pass-env") opts.passEnv.push(value());
+    else if (flag === "--wait-ms") opts.waitMs = Number(value());
+    else if (flag === "--resume") opts.resume = true;
+    else if (flag === "--first-input") opts.firstInput = true;
+    else if (flag === "--json") opts.json = true;
+    else if (flag === "--keep") opts.keep = true;
+    else throw new Error(`unknown option ${flag}`);
+  }
+  if (!opts.runner) throw new Error("--runner is required");
+  if (!opts.runner.includes("{agent}")) throw new Error("--runner must contain {agent}, where your runner takes its agent command");
+  if (!/^[A-Za-z0-9._-]+$/.test(opts.name)) throw new Error("--name must be a preset name (letters, digits, '.', '_' or '-')");
+  if (!(opts.waitMs > 0)) throw new Error("--wait-ms must be a positive number");
+  return opts;
+}
+
+let opts;
+try { opts = parseArgs(process.argv.slice(2)); } catch (error) { console.error(`${error.message}\n${usage}`); process.exit(2); }
+if (spawnSync("tmux", ["-V"]).status !== 0) { console.error("tmux is required: the check drives your runner in a tmux pane, as OpenRig does."); process.exit(2); }
+
+const socket = `openrig-runner-check-${process.pid}`;
+const tmux = (...args) => spawnSync("tmux", ["-L", socket, ...args], { encoding: "utf8" });
+const sh = (value) => `'${String(value).replaceAll("'", "'\\''")}'`;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+// Settling times and per-step bounds grow with --wait-ms on a slow machine; they never shrink below these values. The
+// fake agent's own delays and holds grow by the same factor, so each settle keeps its place against what it measures.
+const scale = (ms) => Math.round(ms * Math.max(1, opts.waitMs / 8000));
+async function waitFor(read, ms = opts.waitMs) {
+  const deadline = Date.now() + ms;
+  for (;;) {
+    const value = read();
+    if (value) return value;
+    if (Date.now() > deadline) return undefined;
+    await sleep(50);
+  }
+}
+
+// The stand-in for OpenRig's activity route and, for a launch that scripts one, its answered permission routes (section 7).
+// Each launch has its own token; a request without one is refused, as OpenRig does.
+const posts = [];
+const tokens = new Map();
+const OPTION_ID = /^[A-Za-z0-9_-]{1,40}$/;
+const ANSWERABLE = new Set(["allow_once", "allow_always", "reject_once", "reject_always"]);
+const text = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+// A JSON-RPC id or prompt number as the runner passed it: a number reads as its decimal string, so 7 and "7" match.
+const idText = (value) => typeof value === "number" && Number.isFinite(value) ? String(value) : text(value);
+const server = createServer((req, res) => {
+  let raw = "";
+  req.on("data", (chunk) => { raw += chunk; });
+  req.on("end", () => {
+    const token = (req.headers.authorization ?? "").replace(/^Bearer /, "");
+    let body;
+    try { body = raw ? JSON.parse(raw) : undefined; } catch { body = undefined; }
+    const url = new URL(req.url, "http://stand-in");
+    posts.push({ at: Date.now(), method: req.method, path: url.pathname, query: Object.fromEntries(url.searchParams), token, body, raw });
+    const send = (status, payload) => res.writeHead(status, { "content-type": "application/json" }).end(JSON.stringify(payload));
+    const h = tokens.get(token);
+    if (req.method === "POST" && url.pathname === "/api/activity/hooks") {
+      if (!h) return send(401, { ok: false });
+      return body ? send(200, { ok: true }) : send(400, { ok: false, code: "invalid_json" });
+    }
+    const ask = url.pathname.match(/^\/api\/activity\/permission-requests(?:\/([^/]+)(\/withdraw)?)?$/);
+    if (!ask) return send(404, { ok: false, code: "not_found" });
+    if (!h) return send(401, { ok: false });
+    // Without a scripted ask, the stand-in is an OpenRig that predates the answered path: 404, so the runner permits.
+    if (!h.asks) return send(404, { ok: false, code: "not_found" });
+    // A scripted `drop` closes the connection unanswered: an OpenRig the runner can't reach.
+    const drop = req.method === "POST" && !ask[1] ? h.asks.script.submit?.drop : req.method === "GET" && h.asks.script.read?.drop;
+    if (drop) return void res.socket.destroy();
+    if (req.method === "POST" && !ask[1]) return submitAsk(h, body, raw, send);
+    const entry = h.asks.byId.get(decodeURIComponent(ask[1] ?? ""));
+    if (!entry) return send(404, { ok: false, code: "not_found" });
+    if (req.method === "GET" && h.asks.script.read) return send(h.asks.script.read.status, { ok: false, code: h.asks.script.read.code });
+    if (req.method === "POST" && ask[2]) {
+      if (!["turn_cancelled", "turn_ended", "exited"].includes(body?.reason)) return send(400, { ok: false, code: "invalid_permission_request" });
+      entry.withdrawn = body.reason;
+      entry.wake();
+      return send(200, { ok: true, ...askState(h, entry) });
+    }
+    if (req.method === "GET" && !ask[2]) {
+      const waitMs = Math.min(Number(url.searchParams.get("waitSeconds") ?? 0), 25) * 1000;
+      const reply = () => send(200, { ok: true, ...askState(h, entry) });
+      if (askState(h, entry).state !== "pending" || !(waitMs > 0)) return reply();
+      const timer = setTimeout(() => { entry.waiters.delete(reply); reply(); }, waitMs);
+      entry.waiters.add(() => { clearTimeout(timer); reply(); });
+      return undefined;
+    }
+    return send(404, { ok: false, code: "not_found" });
+  });
+});
+
+// What the scripted ask reads as now: an answer once its time has come, `withdrawn` after a withdraw, otherwise pending. A
+// `late` answer is what the stand-in reports after a withdraw, so a runner that keeps reading and delivers it is caught.
+function askState(h, entry) {
+  const script = h.asks.script;
+  if (entry.withdrawn) return script.late ?? { state: "withdrawn" };
+  if (script.answer && Date.now() >= entry.created + (script.answer.afterMs ?? 0)) {
+    const { state, optionId, reason, said } = script.answer;
+    return { state, ...(optionId ? { optionId } : {}), ...(reason ? { reason } : {}), ...(said ? { said } : {}) };
+  }
+  return { state: "pending" };
+}
+
+// Submit, checked as OpenRig checks it: the seat and generation, nativeRef as a string, turnId and requestId as a string
+// or a number. When no one can be asked, OpenRig permits with the agent's allow_once, else allow_always: here when the
+// script says so, or for options a person can't be shown (2-4 with distinct ids). With no allow option it refuses.
+function submitAsk(h, body, raw, send) {
+  const script = h.asks.script;
+  const problems = [];
+  if (!body) return send(400, { ok: false, code: "invalid_json" });
+  if (body.sessionName !== h.session) return send(404, { ok: false, code: "session_not_found" });
+  if (!text(body.nativeRef)) problems.push(`nativeRef must be a non-empty string (got ${JSON.stringify(body.nativeRef)})`);
+  for (const key of ["turnId", "requestId"]) if (!idText(body[key])) problems.push(`${key} must be a non-empty string or a number (got ${JSON.stringify(body[key])})`);
+  const options = Array.isArray(body.options) ? body.options : null;
+  if (!options) problems.push("options must be an array");
+  else if (options.some((o) => !text(o?.optionId) || !text(o?.name) || !text(o?.kind))) problems.push("each option needs optionId, name and kind");
+  h.asks.submitted.push({ body, problems });
+  if (problems.length) return send(400, { ok: false, code: "invalid_permission_request", error: problems.join("; ") });
+  if (body.generation !== h.generation) return send(409, { ok: false, code: "stale_generation" });
+  if (script.submit?.status) return send(script.submit.status, { ok: false, code: script.submit.code });
+  const allow = options.find((o) => o.kind === "allow_once") ?? options.find((o) => o.kind === "allow_always");
+  const permit = (reason) => allow ? send(200, { ok: true, state: "permitted", optionId: allow.optionId, reason })
+    : send(422, { ok: false, code: "options_unsupported" });
+  if (script.submit?.permitted) return permit("no one can be asked");
+  if (options.length < 2 || options.length > 4 || new Set(options.map((o) => o.optionId)).size !== options.length
+    || options.some((o) => !OPTION_ID.test(o.optionId) || !ANSWERABLE.has(o.kind))) return permit("these options can't be shown to a person");
+  const requestId = idText(body.requestId), turnId = idText(body.turnId);
+  const key = JSON.stringify([body.generation, text(body.nativeRef), requestId]);
+  const earlier = h.asks.byKey.get(key);
+  if (earlier) return send(200, { ok: true, askId: earlier.askId, created: false });
+  if ([...h.asks.byKey.values()].some((e) => e.requestId === requestId && e.turnId !== turnId)) return send(409, { ok: false, code: "duplicate_request" });
+  const entry = { askId: `ask-${h.label}-${h.asks.byKey.size + 1}`, requestId, turnId, created: Date.now(), waiters: new Set() };
+  entry.wake = () => { for (const w of [...entry.waiters]) w(); entry.waiters.clear(); };
+  if (script.answer) setTimeout(entry.wake, script.answer.afterMs ?? 0);
+  h.asks.byKey.set(key, entry);
+  h.asks.byId.set(entry.askId, entry);
+  return send(200, { ok: true, askId: entry.askId, created: true });
+}
+await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+const base = `http://127.0.0.1:${server.address().port}`;
+
+const launches = [];
+async function launch(label, { scenario = {}, env = {}, asks } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), `runner-check-${label}-`));
+  const cwd = join(dir, "work");
+  mkdirSync(cwd);
+  mkdirSync(join(dir, "home"));
+  mkdirSync(join(dir, "launch"));
+  const id = randomBytes(4).toString("hex");
+  const h = {
+    label, dir, cwd, token: randomBytes(16).toString("hex"), session: `check-${label}@runner-check`, nodeId: `node-${label}-${id}`,
+    generation: `gen-${id}`, attempt: `attempt-${id}`, recordPath: join(dir, "launch", "record.json"), agentLog: join(dir, "agent.jsonl"),
+    target: `check-${label}`,
+  };
+  if (asks) h.asks = { script: asks, byKey: new Map(), byId: new Map(), submitted: [] };
+  tokens.set(h.token, h);
+  writeFileSync(join(dir, "scenario.json"), JSON.stringify(scenario));
+  const agent = join(dir, "agent");
+  writeFileSync(agent, `#!/bin/sh\nexec ${sh(process.execPath)} ${sh(join(here, "fake-acp-agent.mjs"))} --scenario ${sh(join(dir, "scenario.json"))} --log ${sh(h.agentLog)} "$@"\n`);
+  chmodSync(agent, 0o755);
+  const vars = {
+    PATH: process.env.PATH, HOME: process.env.HOME, USER: process.env.USER, SHELL: process.env.SHELL, LANG: process.env.LANG,
+    TMPDIR: process.env.TMPDIR, TERM: "xterm-256color",
+    ...Object.fromEntries(opts.passEnv.map((name) => [name, process.env[name]])),
+    OPENRIG_HOME: join(dir, "home"), OPENRIG_URL: base, OPENRIG_ACTIVITY_HOOK_TOKEN: h.token, OPENRIG_SESSION_NAME: h.session,
+    OPENRIG_NODE_ID: h.nodeId, OPENRIG_RUNTIME: opts.name, OPENRIG_OCCUPANT_GENERATION: h.generation,
+    OPENRIG_LAUNCH_RESULT: h.recordPath, OPENRIG_LAUNCH_ATTEMPT: h.attempt, ...env,
+  };
+  const assignments = Object.entries(vars).filter(([, value]) => value !== undefined).map(([key, value]) => `${key}=${sh(value)}`).join(" ");
+  const command = opts.runner.replaceAll("{agent}", sh(agent));
+  writeFileSync(join(dir, "launch.sh"), `#!/bin/sh\ncd ${sh(cwd)} || exit 1\nexec /usr/bin/env -i ${assignments} /bin/sh -c ${sh(command)}\n`);
+  chmodSync(join(dir, "launch.sh"), 0o755);
+  const started = tmux("new-session", "-d", "-s", h.target, "-x", "200", "-y", "50", join(dir, "launch.sh"));
+  if (started.status !== 0) throw new Error(`tmux couldn't start the runner: ${started.stderr.trim()}`);
+  Object.assign(h, {
+    log: () => !existsSync(h.agentLog) ? [] : readFileSync(h.agentLog, "utf8").split("\n").filter(Boolean).map((line) => JSON.parse(line)),
+    received: (method) => h.log().filter((e) => e.dir === "in" && e.msg.method === method),
+    sent: (method) => h.log().filter((e) => e.dir === "out" && e.msg.method === method),
+    answerTo: (method) => { const ask = h.sent(method)[0]; return ask && h.log().find((e) => e.dir === "in" && e.msg.id === ask.msg.id && !e.msg.method); },
+    replyTo: (entry) => h.log().find((e) => e.dir === "out" && e.msg.id === entry.msg.id && !e.msg.method),
+    events: (event) => h.log().filter((e) => e.dir === "event" && e.event === event),
+    prompts: () => h.received("session/prompt").map((e) => (e.msg.params?.prompt ?? []).filter((b) => b.type === "text").map((b) => b.text).join("")),
+    posts: () => posts.filter((p) => p.path === "/api/activity/hooks" && (p.token === h.token || p.body?.sessionName === h.session)),
+    permissionCalls: (method, suffix = "") => posts.filter((p) => p.token === h.token && p.method === method
+      && p.path.startsWith("/api/activity/permission-requests") && p.path.endsWith(suffix)),
+    hooks: (event, subtype) => h.posts().filter((p) => p.body?.hookEvent === event && (subtype === undefined || p.body?.subtype === subtype)),
+    record: () => { if (!existsSync(h.recordPath)) return undefined; try { return JSON.parse(readFileSync(h.recordPath, "utf8")); } catch { return { unreadable: true }; } },
+    paste: (text) => {
+      const file = join(dir, `paste-${randomBytes(3).toString("hex")}`);
+      writeFileSync(file, text);
+      const buffer = `b-${randomBytes(3).toString("hex")}`;
+      tmux("load-buffer", "-b", buffer, file);
+      tmux("paste-buffer", "-t", h.target, "-b", buffer, "-d", "-r", "-p");
+      tmux("send-keys", "-t", h.target, "Enter");
+    },
+    keys: (...keys) => tmux("send-keys", "-t", h.target, ...keys),
+    stop: () => tmux("kill-session", "-t", h.target),
+    screen: () => tmux("capture-pane", "-p", "-t", h.target).stdout ?? "",
+  });
+  launches.push(h);
+  return h;
+}
+
+// An ordinary send arrives inside an envelope, so a line in it that reads /abort is still just text.
+const message = (h, body) => `From: checker@runner-check\nTo: ${h.session}\n---\n${body}`;
+const nonExitStops = (h, after = 0) => h.hooks("Stop").filter((p) => p.at >= after && !String(p.body?.subtype ?? "").endsWith("_exited"));
+// Whether post `a` comes before post `b` in the runner's own order, as OpenRig orders them: by `occurredAt` when it's a
+// non-blank string that reads as a time, otherwise by its arrival; then by `sequence`, when both carry a positive whole number.
+const postedAt = (p) => {
+  const value = p?.body?.occurredAt;
+  const t = typeof value === "string" && value.trim() ? Date.parse(value) : NaN;
+  return Number.isFinite(t) ? t : p?.at ?? 0;
+};
+const sequenceOf = (p) => { const value = p?.body?.sequence; return Number.isSafeInteger(value) && value > 0 ? value : null; };
+const precedes = (a, b) => postedAt(a) !== postedAt(b) ? postedAt(a) < postedAt(b)
+  : sequenceOf(a) !== null && sequenceOf(b) !== null && sequenceOf(a) < sequenceOf(b);
+// Non-exit Stops the runner posted after `post` in that order. An idle report from before the turn began (a runner may report
+// idle at startup) is never one made during it, however late its POST arrives.
+const stopsAfter = (h, post) => nonExitStops(h).filter((p) => !post || !precedes(p, post));
+const ready = (h, ms) => waitFor(() => h.record()?.nativeRef && h.record(), ms);
+
+function result(id, title, { proposed = false } = {}) {
+  const r = { id, title, status: "pass", checks: [], ...(proposed ? { proposed: true } : {}) };
+  r.check = (name, ok, detail) => { r.checks.push({ name, ok: Boolean(ok), ...(ok ? {} : { detail }) }); if (!ok) r.status = "fail"; return ok; };
+  r.skip = (reason) => { r.status = "skip"; r.reason = reason; return r; };
+  return r;
+}
+
+const cases = {
+  async "1"() {
+    const r = result("1", "Handshake: the launch record comes only after the conversation is open");
+    const h = await launch("1", { scenario: { newDelayMs: scale(2000), sessionId: "fake-session-1" } });
+    const asked = await waitFor(() => h.received("session/new")[0]);
+    if (!r.check("the runner opens a conversation with session/new", asked, "no session/new arrived")) return r;
+    // Until the agent's answer is logged, there must be no record. The agent logs each message before it sends it, so a
+    // record read before a log that still holds no answer was written before the answer went out. Reading against the
+    // agent's log, not after a fixed settle, keeps a busy machine from reading a correct runner's record as early.
+    let early;
+    await waitFor(() => {
+      const record = h.record();
+      if (h.replyTo(asked)) return true;
+      if (record) early = record;
+      return early;
+    }, scale(2000) + opts.waitMs);
+    r.check("no launch record while session/new is still unanswered", !early, `a record was written early: ${JSON.stringify(early)}`);
+    const record = await ready(h);
+    r.check("a launch record arrives after session/new is answered", record, `no record with a nativeRef at ${h.recordPath}`);
+    if (!record) return r;
+    const answered = h.replyTo(asked);
+    r.check("the record is written after the answer", answered && statSync(h.recordPath).mtimeMs >= answered.at - 5, "the record's time precedes the answer");
+    r.check("format 1, this attempt, this preset", record.format === 1 && record.attempt === h.attempt && record.harness === opts.name,
+      `format=${record.format} attempt=${record.attempt} harness=${record.harness}`);
+    r.check("nativeRef is the agent's conversation id", record.nativeRef === "fake-session-1", `nativeRef=${record.nativeRef}`);
+    r.check("producer names the runner's versions", typeof record.producer === "string" && record.producer.trim(), "no producer");
+    return r;
+  },
+
+  async "1b"() {
+    const r = result("1b", "A failed handshake writes no launch record and claims no turn");
+    for (const [label, scenario] of [["initialize error", { initialize: "error" }], ["initialize exit", { initialize: "exit" }],
+      ["session/new error", { newSession: "error" }], ["session/new exit", { newSession: "exit" }]]) {
+      const h = await launch(`1b-${label.replace(/[^a-z]+/g, "-")}`, { scenario });
+      await waitFor(() => h.events("exit")[0] || h.log().some((e) => e.dir === "out" && e.msg.error), opts.waitMs);
+      await sleep(scale(1500));
+      const record = h.record();
+      r.check(`${label}: no conversation in a launch record`, !record?.nativeRef, `record: ${JSON.stringify(record)}`);
+      r.check(`${label}: no accepted prompt or idle report`, h.hooks("UserPromptSubmit").length === 0 && nonExitStops(h).length === 0,
+        `posts: ${h.posts().map((p) => `${p.body?.hookEvent}/${p.body?.subtype}`).join(", ")}`);
+    }
+    return r;
+  },
+
+  async "2"() {
+    const r = result("2", "Input framing, queued messages and cancel");
+    const h = await launch("2", { scenario: { turns: [{}, { holdMs: scale(15000) }, { holdMs: scale(15000), ignoreCancel: true, endAfterCancelMs: scale(300) }, {}] } });
+    if (!r.check("the runner opens its conversation", await ready(h), "no launch record")) return r;
+    const block = message(h, "first line\n/abort\nthird line");
+    h.paste(block);
+    await waitFor(() => h.prompts().length >= 1);
+    await waitFor(() => nonExitStops(h).length >= 1, scale(3000));
+    await sleep(scale(500));
+    r.check("one pasted block is exactly one session/prompt", h.prompts().length === 1, `got ${h.prompts().length} prompts`);
+    r.check("the prompt holds the whole block, byte for byte", h.prompts()[0] === block, `got ${JSON.stringify(h.prompts()[0])}`);
+
+    h.paste(message(h, "please hold"));
+    if (!r.check("the next block starts the next turn", await waitFor(() => h.prompts().length >= 2), "no second prompt")) return r;
+    // A block that arrives while the agent works, with a line reading /abort, is still one message for later.
+    const queued = message(h, "sent while the agent works\n/abort\nstill part of the message");
+    h.paste(queued);
+    await sleep(scale(1200));
+    r.check("a block sent mid-turn waits for the next turn", h.prompts().length === 2, `got ${h.prompts().length} prompts during the turn`);
+    r.check("a line reading /abort inside a block isn't control", h.received("session/cancel").length === 0, "the runner sent session/cancel");
+
+    const before = Date.now();
+    h.paste("/abort");
+    const cancel = await waitFor(() => h.received("session/cancel")[0], scale(3000));
+    r.check("a block that is exactly /abort sends session/cancel", cancel, "no session/cancel");
+    const stopped = await waitFor(() => nonExitStops(h, before)[0], scale(3000));
+    r.check("the cancelled turn reports Stop/cancelled", stopped?.body?.subtype === "cancelled", `got ${stopped ? `Stop/${stopped.body.subtype}` : "no Stop"}`);
+    await sleep(scale(300));
+    r.check("one /abort sends one session/cancel", h.received("session/cancel").length === 1, `got ${h.received("session/cancel").length}`);
+    r.check("the waiting block becomes the next prompt", await waitFor(() => h.prompts()[2] === queued, scale(4000)), `prompts: ${JSON.stringify(h.prompts().slice(2))}`);
+
+    // The agent keeps this turn open until the cancel arrives and then ends it end_turn, so a runner that handles Ctrl-C
+    // late on a busy machine still has a turn to cancel. Only its delivery is timed, by the per-step bound.
+    const interrupted = Date.now();
+    await sleep(scale(200));
+    h.keys("C-c");
+    r.check("Ctrl-C outside a paste sends session/cancel", await waitFor(() => h.received("session/cancel").length >= 2), "no second session/cancel");
+    const ended = await waitFor(() => nonExitStops(h, interrupted)[0], scale(6000));
+    r.check("cancelled is reported only on the agent's own stop reason", ended?.body?.subtype === "end_turn",
+      `the agent ended the turn end_turn; the runner reported ${ended ? `Stop/${ended.body.subtype}` : "no Stop"}`);
+    return r;
+  },
+
+  async "3"() {
+    const r = result("3", "Activity: turn boundaries, posted in order with the seat's identity");
+    const h = await launch("3");
+    if (!r.check("the runner opens its conversation", await ready(h), "no launch record")) return r;
+    h.paste(message(h, "a short turn"));
+    const accepted = await waitFor(() => h.hooks("UserPromptSubmit", "accepted")[0]);
+    r.check("UserPromptSubmit/accepted when the prompt is given", accepted, `posts: ${h.posts().map((p) => p.body?.hookEvent).join(", ")}`);
+    r.check("the accepted post names a turnId", accepted && accepted.body.turnId !== undefined && accepted.body.turnId !== "", "no turnId");
+    const end = await waitFor(() => h.hooks("Stop", "end_turn")[0]);
+    r.check("Stop/end_turn when the turn ends", end, "no Stop/end_turn");
+    r.check("accepted comes before the turn's end", accepted && end && accepted.at <= end.at, "out of order");
+    const all = h.posts();
+    const missing = all.flatMap((p) => ["sessionName", "nodeId", "runtime", "generation", "sequence", "occurredAt", "hookEvent", "subtype"]
+      .filter((k) => p.body?.[k] === undefined).map((k) => `${p.body?.hookEvent ?? "?"} lacks ${k}`));
+    r.check("every post carries the contract's fields", missing.length === 0, missing.join("; "));
+    r.check("every post uses the hook token", all.every((p) => p.token === h.token), "a post without the bearer token");
+    r.check("every post names this seat and preset",
+      all.every((p) => p.body?.sessionName === h.session && p.body?.nodeId === h.nodeId && p.body?.runtime === opts.name),
+      all.map((p) => `${p.body?.sessionName}/${p.body?.nodeId}/${p.body?.runtime}`).join(", "));
+    const seqs = all.map((p) => Number(p.body?.sequence));
+    r.check("sequence rises with each post", seqs.every((s, i) => Number.isFinite(s) && (i === 0 || s > seqs[i - 1])), `sequences: ${seqs.join(", ")}`);
+    const beats = all.filter((p) => p.body?.livenessSeconds !== undefined);
+    r.check("livenessSeconds, when given, is a whole number from 1 to 3600",
+      beats.every((p) => Number.isInteger(p.body.livenessSeconds) && p.body.livenessSeconds >= 1 && p.body.livenessSeconds <= 3600),
+      beats.map((p) => p.body.livenessSeconds).join(", "));
+    return r;
+  },
+
+  // The optional working beat (section 4). When a runner posts active/liveness in a quiet turn, each beat names the open
+  // turn it belongs to, keeps the post order, comes often enough for its own lifetime, stops at the turn's end, and never
+  // runs while a person is asked; after an answer, active/permission_resolved comes before the next beat. Order is read
+  // from the runner's own sequence and times, so a slow delivery never reads as a broken runner.
+  async "3b"() {
+    const r = result("3b", "Working beat (optional): beats name their open turn, keep order, and stop at its end and while a person is asked");
+    const quiet = scale(22000);
+    const seqOf = (p) => Number(p?.body?.sequence);
+    const at = (p) => Date.parse(p.body.occurredAt);
+    const h = await launch("3b", { scenario: { turns: [{ silent: true, holdMs: quiet }, {}] } });
+    if (!r.check("the runner opens its conversation", await ready(h), "no launch record")) return r;
+    h.paste(message(h, "a long, quiet turn"));
+    const accepted = await waitFor(() => h.hooks("UserPromptSubmit", "accepted")[0]);
+    const end = await waitFor(() => h.hooks("Stop", "end_turn")[0], quiet + opts.waitMs);
+    await sleep(scale(11000)); // room for a beat a runner wrongly sends after the Stop
+    const beats = h.hooks("active", "liveness");
+    if (!beats.length) return r.skip("the runner sends no working beat in a quiet turn; the beat is optional (section 4)");
+    r.check("each beat names the turn it belongs to", accepted && beats.every((b) => b.body.turnId === accepted.body.turnId),
+      `turnIds: ${beats.map((b) => b.body.turnId).join(", ")}`);
+    // In the runner's own time order, not delivery's: a post delivered late still has to fit where the runner sent it.
+    const byTime = (a, b) => at(a) - at(b) || seqOf(a) - seqOf(b);
+    const timed = h.posts().slice().sort(byTime);
+    r.check("sequence rises with the runner's own time across every post, beats included",
+      timed.every((p, i) => Number.isFinite(seqOf(p)) && Number.isFinite(at(p)) && (i === 0 || seqOf(p) > seqOf(timed[i - 1]))),
+      `sequences in occurredAt order: ${timed.map(seqOf).join(", ")}`);
+    const life = (b) => (Number.isFinite(b.body.livenessSeconds) ? b.body.livenessSeconds : 30);
+    const inTurn = beats.filter((b) => !end || seqOf(b) < seqOf(end)).sort(byTime);
+    const gaps = inTurn.map((b, i) => at(b) - at(i === 0 ? accepted : inTurn[i - 1]));
+    r.check("beats come more often than every livenessSeconds / 2", inTurn.every((b, i) => gaps[i] <= life(b) * 500 + 1000),
+      `gaps by the runner's own times: ${gaps.join(", ")} ms`);
+    r.check("no beat after the turn's Stop", end && beats.every((b) => seqOf(b) < seqOf(end)),
+      `beats after Stop/end_turn: ${beats.filter((b) => end && seqOf(b) > seqOf(end)).length}`);
+
+    // A person is asked first, and answers after a while; the agent then carries on, quietly, in the same turn.
+    const p = await launch("3b-asked", { scenario: { turns: [{ permission: true, silent: true, holdMs: quiet }, {}] },
+      asks: { answer: { afterMs: scale(12000), state: "answered", optionId: "allow-once" } } });
+    if (!r.check("asked: the runner opens its conversation", await ready(p), "no launch record")) return r;
+    p.paste(message(p, "edit the notes"));
+    const submitted = await waitFor(() => p.permissionCalls("POST").find((c) => c.path === "/api/activity/permission-requests"), scale(5000));
+    if (!r.check("asked: the request is submitted", submitted, "no submit")) return r;
+    await waitFor(() => p.hooks("Stop", "end_turn")[0], scale(12000) + quiet + opts.waitMs);
+    const resolvedPost = p.hooks("active", "permission_resolved")[0];
+    const before = p.hooks("active", "liveness").filter((b) => at(b) > submitted.at && (!resolvedPost || seqOf(b) < seqOf(resolvedPost)));
+    r.check("asked: no beat while the ask waits on a person", before.length === 0, `${before.length} beats while it waited`);
+    r.check("asked: after the answer, active/permission_resolved names the turn and the ask, before any beat",
+      resolvedPost && resolvedPost.body.askId && resolvedPost.body.turnId === p.hooks("UserPromptSubmit", "accepted")[0]?.body.turnId,
+      resolvedPost ? `permission_resolved: ${JSON.stringify({ turnId: resolvedPost.body.turnId, askId: resolvedPost.body.askId })}` : "no permission_resolved");
+
+    // OpenRig permits at submit when no one can be asked: no ask opens, so nothing waits and the beats go on.
+    const q = await launch("3b-permitted", { scenario: { turns: [{ permission: true, silent: true, holdMs: quiet }, {}] },
+      asks: { submit: { permitted: true } } });
+    if (!r.check("permitted at submit: the runner opens its conversation", await ready(q), "no launch record")) return r;
+    q.paste(message(q, "edit the notes"));
+    const qEnd = await waitFor(() => q.hooks("Stop", "end_turn")[0], quiet + opts.waitMs);
+    const qBeats = q.hooks("active", "liveness").filter((b) => !qEnd || seqOf(b) < seqOf(qEnd));
+    r.check("permitted at submit: the quiet turn's beats go on, with no ask to resolve", qBeats.length > 0, "no beat in the quiet turn after the permit");
+    return r;
+  },
+
+  // Section 7's default is permit: when no one can be asked, the agent gets its own allow option at once, allow_once before
+  // allow_always. Only the seat's opt-in refusal (denied_by_seat), or a request with no allow option, is refused at once,
+  // shown, and held as needs input until the next prompt, even when the turn is cancelled.
+  async "4"() {
+    const r = result("4", "Permissions: permitted when no one can be asked; refused and held only on denied_by_seat or no allow option");
+    const option = (optionId, kind) => ({ optionId, name: optionId, kind });
+    const withAlways = [option("allow-once", "allow_once"), option("allow-always", "allow_always"), option("reject-once", "reject_once")];
+    const rejectOnly = [option("reject-once", "reject_once"), option("reject-always", "reject_always")];
+    const cells = [
+      // label, the stand-in's answered path (none: an OpenRig without it, which answers 404), the options, permitted, and
+      // whether /abort cancels the turn after the refusal
+      ["404", undefined, withAlways, true],
+      ["unreachable", { submit: { drop: true } }, withAlways, true],
+      ["denied_by_seat", { submit: { status: 409, code: "denied_by_seat" } }, withAlways, false],
+      ["denied_by_seat, then /abort", { submit: { status: 409, code: "denied_by_seat" } }, withAlways, false, true],
+      ["no allow option", undefined, rejectOnly, false],
+    ];
+    await Promise.all(cells.map(async ([label, asks, options, permitted, abort]) => {
+      const turns = [{ permission: { options }, holdMs: scale(abort ? 4000 : 1500) }, {}];
+      const h = await launch(`4-${label.replace(/[^a-z0-9]+/g, "-")}`, { scenario: { turns }, asks });
+      if (!r.check(`${label}: the runner opens its conversation`, await ready(h), "no launch record")) return;
+      h.paste(message(h, "edit the notes"));
+      const asked = await waitFor(() => h.sent("session/request_permission")[0]);
+      if (!r.check(`${label}: the agent's permission request is sent`, asked, "the turn never reached the request")) return;
+      // A runner may take a moment to find OpenRig unreachable; everything else is answered at once.
+      const answer = await waitFor(() => h.answerTo("session/request_permission"), scale(label === "unreachable" ? 10000 : 3000));
+      if (!r.check(`${label}: the request is answered, not left pending`, answer, "no answer")) return;
+      if (label !== "unreachable") r.check(`${label}: it's answered at once (within 2 s)`, answer.at - asked.at <= 2000, `${answer.at - asked.at} ms`);
+      const got = answer.msg.result?.outcome;
+      if (permitted) {
+        r.check(`${label}: the agent gets its allow_once option`, got?.outcome === "selected" && got.optionId === "allow-once",
+          `answer: ${JSON.stringify(answer.msg.result ?? answer.msg.error)}`);
+        r.check(`${label}: the turn's end is reported as usual`, await waitFor(() => h.hooks("Stop", "end_turn")[0], scale(4000)),
+          "no Stop/end_turn after the permit");
+        r.check(`${label}: nothing is held as needs input`, h.hooks("Notification", "permission_prompt").length === 0, "the runner posted permission_prompt");
+        return;
+      }
+      r.check(`${label}: the answer is a refusal, never an allow option`, got?.outcome === "cancelled",
+        `answer: ${JSON.stringify(answer.msg.result ?? answer.msg.error)}`);
+      const shown = await waitFor(() => h.hooks("Notification", "permission_prompt")[0], scale(3000));
+      r.check(`${label}: Notification/permission_prompt is posted`, shown, "no permission_prompt post");
+      if (label === "denied_by_seat") r.check(`${label}: what was asked is shown in the pane`, await waitFor(() => h.screen().includes("Edit notes.txt"), scale(3000)),
+        "the pane never showed the tool call's title, Edit notes.txt");
+      // A cancelled turn is still a turn's end: the refusal stays held until the next accepted prompt.
+      if (abort) {
+        h.paste("/abort");
+        r.check(`${label}: /abort sends session/cancel`, await waitFor(() => h.received("session/cancel")[0], scale(3000)), "no session/cancel");
+      }
+      await waitFor(() => h.log().some((e) => e.dir === "out" && e.msg.result?.stopReason), scale(abort ? 6000 : 4000));
+      await sleep(scale(800));
+      r.check(`${label}: no idle Stop or beat while holding that attention`, shown && nonExitStops(h, shown.at).length === 0,
+        `posted ${nonExitStops(h, shown?.at ?? 0).map((p) => `Stop/${p.body.subtype}`).join(", ")}`);
+      const next = Date.now();
+      h.paste(message(h, "carry on"));
+      r.check(`${label}: the next prompt is accepted as usual, which clears it`,
+        await waitFor(() => h.hooks("UserPromptSubmit", "accepted").some((p) => p.at >= next)), "no accepted post for the next prompt");
+    }));
+    return r;
+  },
+
+  // Section 7's answered path: the runner submits the live request, delivers the option that comes back (the person's
+  // answer, or OpenRig's permit) once while that request is live, and withdraws it when the turn or the agent ends.
+  async "4b"() {
+    const r = result("4b", "Answered permissions: the person's answer or OpenRig's permit reaches the live request, and nothing else does");
+    const options = ["allow-once", "reject-once"];
+    const submits = (h) => h.permissionCalls("POST").filter((p) => p.path === "/api/activity/permission-requests");
+    const withdraws = (h) => h.permissionCalls("POST", "/withdraw");
+    const answers = (h) => { const asked = h.sent("session/request_permission")[0];
+      return asked ? h.log().filter((e) => e.dir === "in" && e.msg.id === asked.msg.id && !e.msg.method) : []; };
+    const outcome = (h) => answers(h)[0]?.msg.result?.outcome;
+    const open = async (label, asks, turns = [{ permission: true }, {}]) => {
+      const h = await launch(`4b-${label}`, { scenario: { turns }, asks });
+      if (!await ready(h)) { r.check(`${label}: the runner opens its conversation`, false, "no launch record"); return undefined; }
+      h.paste(message(h, "edit the notes"));
+      await waitFor(() => h.sent("session/request_permission")[0]);
+      return h;
+    };
+
+    // An answer from the chosen person: the offered option, once, and the turn then reports as usual.
+    for (const [label, optionId] of [["allow", "allow-once"], ["deny", "reject-once"]]) {
+      const h = await open(label, { answer: { afterMs: 400, state: "answered", optionId } });
+      if (!h) continue;
+      const submitted = await waitFor(() => submits(h)[0], scale(3000));
+      if (!r.check(`${label}: the request is submitted to /api/activity/permission-requests`, submitted, "no submit")) continue;
+      const asked = h.sent("session/request_permission")[0];
+      // The submit isn't one of the runner's ordered activity posts, so it can arrive before the accepted prompt does.
+      const accepted = await waitFor(() => h.hooks("UserPromptSubmit", "accepted")[0], scale(3000));
+      const sent = submitted.body ?? {};
+      if (label === "allow") {
+        r.check("the submit passes OpenRig's checks", h.asks.submitted[0]?.problems.length === 0, h.asks.submitted[0]?.problems.join("; "));
+        r.check("it uses the hook token", submitted.token === h.token, "no bearer token");
+        r.check("requestId is the agent's JSON-RPC id", idText(sent.requestId) === String(asked?.msg.id), `requestId=${JSON.stringify(sent.requestId)}`);
+        r.check("turnId is the accepted prompt's", accepted && idText(sent.turnId) === String(accepted.body.turnId), `turnId=${JSON.stringify(sent.turnId)}`);
+        r.check("nativeRef and generation name this conversation and occupant", sent.nativeRef === h.record()?.nativeRef && sent.generation === h.generation,
+          `nativeRef=${sent.nativeRef} generation=${sent.generation}`);
+        r.check("the agent's options are passed on as offered", JSON.stringify((sent.options ?? []).map((o) => o.optionId)) === JSON.stringify(options),
+          JSON.stringify(sent.options));
+      }
+      const delivered = await waitFor(() => outcome(h), scale(4000));
+      r.check(`${label}: the agent gets the chosen option`, delivered?.outcome === "selected" && delivered.optionId === optionId, `got ${JSON.stringify(delivered)}`);
+      await waitFor(() => h.hooks("Stop", "end_turn")[0], scale(3000));
+      await sleep(scale(300));
+      r.check(`${label}: it's delivered once`, answers(h).length === 1, `${answers(h).length} answers`);
+      if (label === "allow") {
+        r.check("OpenRig records the prompt; the runner doesn't post permission_prompt itself", h.hooks("Notification", "permission_prompt").length === 0,
+          "the runner posted permission_prompt for a created ask");
+        const reads = h.permissionCalls("GET");
+        // Section 7 bounds the wait at 25 s and no lower; OpenRig's read takes 0 to 25 or none.
+        r.check("each read waits at most 25 s", reads.length > 0 && reads.every((p) => p.query.waitSeconds === undefined || Number(p.query.waitSeconds) <= 25),
+          reads.map((p) => p.query.waitSeconds ?? "(none)").join(", "));
+        r.check("after the answer, the turn's end is reported as usual", h.hooks("Stop", "end_turn").length > 0, "no Stop/end_turn after delivery");
+      }
+    }
+
+    // OpenRig's permit, at submit or at a read, is delivered like an answer. So is the runner's own permit when OpenRig
+    // can't give an answer: a refusal section 7's table marks "permits" (two of them 409s, like stale_generation, so the
+    // code decides, never the status; a revoked grant can still be the live occupant's, since one is reissued after a lost
+    // response), a read that gets no answer, or a status, code or read state the section doesn't list. A refusal saying
+    // the request isn't the current occupant's, and a refused, stale or withdrawn read, can't take an answer: the agent
+    // gets cancelled, and nothing is held.
+    const outcomes = [
+      ["permitted at submit", { submit: { permitted: true } }, "allow-once"],
+      ["permitted at read", { answer: { afterMs: 300, state: "permitted", optionId: "allow-once" } }, "allow-once"],
+      // A person's own words come back beside the outcome, and never change the option delivered.
+      ["permitted at read, with the person's words", { answer: { afterMs: 300, state: "permitted", optionId: "allow-once", said: "only the notes file" } }, "allow-once"],
+      ["duplicate_request", { submit: { status: 409, code: "duplicate_request" } }, "allow-once"],
+      ["activity_grant_pending", { submit: { status: 409, code: "activity_grant_pending" } }, "allow-once"],
+      ["activity_grant_revoked", { submit: { status: 401, code: "activity_grant_revoked" } }, "allow-once"],
+      ["unreachable read", { read: { drop: true } }, "allow-once"],
+      ["unlisted read status (500)", { read: { status: 500, code: "internal_error" } }, "allow-once"],
+      ["unlisted read state (deferred)", { answer: { afterMs: 300, state: "deferred" } }, "allow-once"],
+      ["stale_generation", { submit: { status: 409, code: "stale_generation" } }, null],
+      ["activity_grant_stale read", { read: { status: 409, code: "activity_grant_stale" } }, null],
+      ["refused read (said_no)", { answer: { afterMs: 300, state: "refused", reason: "said_no" } }, null],
+      ["stale ask", { answer: { afterMs: 300, state: "stale" } }, null],
+      ["withdrawn ask", { answer: { afterMs: 300, state: "withdrawn" } }, null],
+    ];
+    await Promise.all(outcomes.map(async ([label, asks, optionId]) => {
+      const h = await open(label.replace(/[^a-z0-9]+/g, "-"), asks, [{ permission: true, holdMs: scale(800) }, {}]);
+      if (!h) return;
+      // Section 7 sets no time limit for what follows a read, so the check waits its ordinary per-step bound (--wait-ms),
+      // and longer when the read got no answer, which a runner may retry a few times before it permits.
+      const got = await waitFor(() => outcome(h), label === "unreachable read" ? scale(10000) : opts.waitMs);
+      if (!optionId) {
+        r.check(`${label}: the agent gets cancelled`, got?.outcome === "cancelled", `got ${JSON.stringify(got)}`);
+        r.check(`${label}: nothing is held`, await waitFor(() => h.hooks("Stop", "end_turn")[0], scale(3000))
+          && !h.hooks("Notification", "permission_prompt").length, "no Stop/end_turn after the cancel, or the runner posted permission_prompt");
+        return;
+      }
+      r.check(`${label}: the agent gets its allow_once option`, got?.outcome === "selected" && got.optionId === optionId, `got ${JSON.stringify(got)}`);
+      await waitFor(() => h.hooks("Stop", "end_turn")[0], scale(3000));
+      await sleep(scale(300));
+      r.check(`${label}: it's delivered once`, answers(h).length === 1, `${answers(h).length} answers`);
+      r.check(`${label}: the turn's end is reported as usual`, h.hooks("Stop", "end_turn").length > 0, "no Stop/end_turn after the permit");
+      if (label === "permitted at submit") r.check(`${label}: there's no ask to read`, h.permissionCalls("GET").length === 0,
+        `${h.permissionCalls("GET").length} reads`);
+      // A read that got no answer leaves OpenRig's ask open, so it must not stay in the person's Feed after the turn.
+      if (label === "unreachable read" || label.startsWith("unlisted read")) r.check(`${label}: the ask is still withdrawn at the turn's end`,
+        await waitFor(() => withdraws(h).some((w) => w.body?.reason === "turn_ended"), scale(3000)), `withdraws: ${JSON.stringify(withdraws(h).map((w) => w.body))}`);
+    }));
+
+    // No answer: the request stays pending and visible, a pasted message isn't an answer, and /abort withdraws it, after
+    // which a late answer isn't delivered.
+    {
+      const h = await open("pending", { late: { state: "answered", optionId: "allow-once" } });
+      if (h) {
+        await sleep(scale(1500));
+        r.check("pending: the runner keeps reading the ask", h.permissionCalls("GET").length >= 1, "no read of the ask");
+        r.check("pending: nothing is delivered while no one has answered", answers(h).length === 0, `got ${JSON.stringify(outcome(h))}`);
+        const turn = h.hooks("UserPromptSubmit", "accepted").at(-1);
+        r.check("pending: no idle Stop while it waits", stopsAfter(h, turn).length === 0, stopsAfter(h, turn).map((p) => p.body.subtype).join(", "));
+        h.paste(message(h, "allow it"));
+        await sleep(scale(800));
+        r.check("pending: a pasted message isn't an answer", answers(h).length === 0, `got ${JSON.stringify(outcome(h))}`);
+        const abortedAt = Date.now();
+        h.paste("/abort");
+        const withdrawn = await waitFor(() => withdraws(h)[0], scale(3000));
+        r.check("pending: /abort withdraws the ask with turn_cancelled", withdrawn?.body?.reason === "turn_cancelled", `withdraw: ${JSON.stringify(withdrawn?.body)}`);
+        r.check("pending: the agent's request is answered cancelled", (await waitFor(() => outcome(h), scale(3000)))?.outcome === "cancelled",
+          `got ${JSON.stringify(outcome(h))}`);
+        // Once the ask is withdrawn no person is still waiting, so the cancelled turn's own end is reported as usual (the
+        // pasted message above runs as the next turn, so only that turn's Stop/cancelled counts). The contract doesn't
+        // order the Stop and the withdraw, so the Stop is any after /abort, not only one after the withdraw arrived.
+        r.check("pending: after /abort, the turn's end is reported, holding nothing",
+          await waitFor(() => h.hooks("Stop", "cancelled").some((p) => p.at >= abortedAt), scale(3000)), "no Stop/cancelled after /abort");
+        await sleep(scale(1200));
+        r.check("pending: an answer after the withdraw isn't delivered", answers(h).every((a) => a.msg.result?.outcome?.outcome !== "selected"),
+          `answers: ${JSON.stringify(answers(h).map((a) => a.msg.result))}`);
+      }
+    }
+    // The turn ending, or the agent exiting, while the ask waits also withdraws it.
+    for (const [label, permission, reason] of [["turn end", { waitMs: scale(1500) }, "turn_ended"], ["agent exit", { exitAfterMs: scale(1500) }, "exited"]]) {
+      const h = await open(label.replace(/[^a-z]+/g, "-"), {}, [{ permission }, {}]);
+      if (!h) continue;
+      const withdrawn = await waitFor(() => withdraws(h)[0], scale(4000));
+      r.check(`${label}: the ask is withdrawn with ${reason}`, withdrawn?.body?.reason === reason, `withdraw: ${JSON.stringify(withdrawn?.body)}`);
+      // The turn's own end: a Stop with the agent's own stop reason, after the agent answered that turn's session/prompt,
+      // on either side of the withdraw (the contract doesn't order them). A Stop posted before the turn ended doesn't count.
+      if (reason === "turn_ended") {
+        const turnEnd = await waitFor(() => {
+          const asked = h.sent("session/request_permission")[0];
+          const prompt = asked && h.received("session/prompt").filter((p) => p.at <= asked.at).at(-1);
+          return prompt && h.replyTo(prompt);
+        }, scale(4000));
+        const stopReason = turnEnd?.msg.result?.stopReason;
+        r.check(`${label}: nothing is held once the ask is withdrawn`,
+          stopReason && await waitFor(() => h.hooks("Stop", stopReason).some((p) => p.at >= turnEnd.at), scale(3000)),
+          `no Stop/${stopReason ?? "(no turn end)"} after the agent ended the turn`);
+      }
+    }
+    return r;
+  },
+
+  // Section 7: a person who answers in their own words gets them passed on. OpenRig carries them as the read's `said`, and
+  // a runner queues them for the agent like any other prompt, after the turn, never as the answer. A runner that drops
+  // them still keeps the contract, so the result is advisory.
+  async "4c"() {
+    const r = result("4c", "The person's words: a read's said is queued to the agent as a prompt (advisory)", { proposed: true });
+    const said = "Only the notes file, please. Leave the rest alone.";
+    const h = await launch("4c", { scenario: { turns: [{ permission: true }, {}] },
+      asks: { answer: { afterMs: 300, state: "permitted", optionId: "allow-once", said } } });
+    if (!r.check("the runner opens its conversation", await ready(h), "no launch record")) return r;
+    h.paste(message(h, "edit the notes"));
+    if (!r.check("the first turn ends", await waitFor(() => h.hooks("Stop", "end_turn")[0], scale(6000)), "no Stop/end_turn")) return r;
+    const later = await waitFor(() => h.prompts().slice(1).find((prompt) => prompt?.includes(said)), scale(4000));
+    r.check("the person's words are queued to the agent as a prompt, after the turn", later, `prompts: ${JSON.stringify(h.prompts())}`);
+    return r;
+  },
+
+  async "5"() {
+    const r = result("5", "Generation: every post carries the launch's occupant generation");
+    const h = await launch("5");
+    if (!r.check("the runner opens its conversation", await ready(h), "no launch record")) return r;
+    h.paste(message(h, "a short turn"));
+    await waitFor(() => h.hooks("Stop", "end_turn")[0]);
+    const all = h.posts();
+    r.check("the runner posted something", all.length > 0, "no posts");
+    r.check("generation is OPENRIG_OCCUPANT_GENERATION on every post", all.every((p) => p.body?.generation === h.generation),
+      all.map((p) => p.body?.generation).join(", "));
+    return r;
+  },
+
+  async "6"() {
+    const r = result("6", "Resume: the same conversation, or an honest missing or unconfirmed");
+    if (!opts.resume) return r.skip("the preset doesn't declare resume (--resume): OpenRig passes OPENRIG_RESUME_REF only to one that does");
+    const reopenCalls = (h) => [...h.received("session/load"), ...h.received("session/resume")];
+    {
+      const h = await launch("6-same", { scenario: { knownSessions: ["fake-old-1"] }, env: { OPENRIG_RESUME_REF: "fake-old-1" } });
+      const record = await ready(h);
+      const call = reopenCalls(h)[0];
+      r.check("same: the agent is asked to reopen OPENRIG_RESUME_REF", call?.msg.params?.sessionId === "fake-old-1",
+        call ? `asked for ${call.msg.params?.sessionId}` : "no session/load or session/resume");
+      r.check("same: in the launch's working folder", call && realpathSync(String(call.msg.params?.cwd ?? "")) === realpathSync(h.cwd),
+        `cwd=${call?.msg.params?.cwd}`);
+      r.check("same: the record reports that conversation", record?.nativeRef === "fake-old-1", `record: ${JSON.stringify(h.record())}`);
+      r.check("same: no new conversation starts", h.received("session/new").length === 0, "session/new was sent");
+    }
+    {
+      const h = await launch("6-missing", { scenario: { reopenError: "missing" }, env: { OPENRIG_RESUME_REF: "fake-gone" } });
+      const record = await waitFor(() => h.record());
+      r.check("missing: the agent's own not-found is reported as error: missing", record?.error === "missing" && !record.nativeRef,
+        `record: ${JSON.stringify(record)}`);
+      await sleep(scale(800));
+      r.check("missing: no new conversation starts", h.received("session/new").length === 0, "session/new was sent");
+    }
+    {
+      const h = await launch("6-other", { scenario: { reopenError: "error" }, env: { OPENRIG_RESUME_REF: "fake-elsewhere" } });
+      await waitFor(() => reopenCalls(h)[0] && h.log().some((e) => e.dir === "out" && e.msg.error));
+      await sleep(scale(2500));
+      const record = h.record();
+      r.check("other failure: not reported missing or resumed", !record || (record.error && record.error !== "missing" && !record.nativeRef),
+        `record: ${JSON.stringify(record)}`);
+      r.check("other failure: no new conversation starts", h.received("session/new").length === 0, "session/new was sent");
+    }
+    return r;
+  },
+
+  async "7"() {
+    const r = result("7", "Death mid-turn: Stop/<preset>_exited, never an idle report");
+    const h = await launch("7", { scenario: { turns: [{ exit: true }] } });
+    if (!r.check("the runner opens its conversation", await ready(h), "no launch record")) return r;
+    h.paste(message(h, "this turn kills the agent"));
+    const died = await waitFor(() => h.events("exit")[0]);
+    if (!r.check("the agent exits mid-turn", died, "the agent didn't exit")) return r;
+    const exited = await waitFor(() => h.hooks("Stop", `${opts.name}_exited`)[0], scale(4000));
+    r.check(`Stop/${opts.name}_exited is posted`, exited, `posts: ${h.posts().map((p) => `${p.body?.hookEvent}/${p.body?.subtype}`).join(", ")}`);
+    // Any idle report for the turn the agent died in counts, before or after the exit; one from before the turn doesn't.
+    const turn = h.hooks("UserPromptSubmit", "accepted")[0];
+    const idle = turn ? stopsAfter(h, turn) : nonExitStops(h, died.at);
+    r.check("no idle report for the turn it died in", idle.length === 0, idle.map((p) => p.body.subtype).join(", "));
+    return r;
+  },
+
+  async "7b"() {
+    const r = result("7b", "Errors: a failed prompt is a runtime error, not a permission request");
+    const h = await launch("7b", { scenario: { turns: [{ error: true }, {}] } });
+    if (!r.check("the runner opens its conversation", await ready(h), "no launch record")) return r;
+    h.paste(message(h, "this prompt fails"));
+    const posted = await waitFor(() => h.hooks("Notification", "runtime_error")[0]);
+    r.check("a failed session/prompt posts Notification/runtime_error", posted,
+      `posts: ${h.posts().map((p) => `${p.body?.hookEvent}/${p.body?.subtype}`).join(", ")}`);
+    r.check("it isn't reported as a permission request", h.hooks("Notification", "permission_prompt").length === 0, "permission_prompt posted");
+    return r;
+  },
+
+  // Section 9 marks this duty "(Proposed)", and a runner may list in `limits` what keeps running, so the result is reported
+  // on its own: never a pass or a fail, and never the exit status.
+  async "7c"() {
+    const r = result("7c", "Shutdown: closing the pane ends the agent (proposed in section 9; advisory)", { proposed: true });
+    const h = await launch("7c", { scenario: { stubborn: true } });
+    if (!r.check("the runner opens its conversation", await ready(h), "no launch record")) return r;
+    const pid = h.events("started")[0]?.pid;
+    h.stop();
+    const gone = await waitFor(() => { try { process.kill(pid, 0); return false; } catch { return true; } }, scale(5000));
+    r.check("closing the pane ends the agent process", gone, `agent pid ${pid} still running ${scale(5000) / 1000} s later; list it in limits if that's expected`);
+    if (!gone) try { process.kill(pid, "SIGKILL"); } catch { /* already gone */ }
+    return r;
+  },
+
+  async "8"() {
+    const r = result("8", "Unknown requests from the agent get -32601, and the runner carries on");
+    const h = await launch("8", { scenario: { unknownRequest: true } });
+    const answer = await waitFor(() => h.answerTo("fake/unknown_method"));
+    r.check("the unknown request is answered -32601", answer?.msg.error?.code === -32601, `answer: ${JSON.stringify(answer?.msg ?? null)}`);
+    if (!r.check("the runner opens its conversation", await ready(h), "no launch record")) return r;
+    h.paste(message(h, "still working?"));
+    r.check("the next prompt still goes through", await waitFor(() => h.prompts().length === 1), "no prompt after the unknown request");
+    return r;
+  },
+
+  async "9"() {
+    const r = result("9", "First input: OPENRIG_FIRST_INPUT's exact bytes are the first prompt");
+    if (!opts.firstInput) return r.skip("the preset doesn't declare first_input (--first-input): OpenRig passes no OPENRIG_FIRST_INPUT");
+    const dir = mkdtempSync(join(tmpdir(), "runner-check-first-"));
+    const file = join(dir, "first-input");
+    const text = "Read the plan first.\n\n  Then say ready.\n";
+    writeFileSync(file, text, { mode: 0o600 });
+    const h = await launch("9", { env: { OPENRIG_FIRST_INPUT: file } });
+    const first = await waitFor(() => h.prompts()[0]);
+    r.check("the first prompt is the file's bytes, newlines and spaces included", first === text, `got ${JSON.stringify(first)}`);
+    if (!opts.keep) rmSync(dir, { recursive: true, force: true });
+    return r;
+  },
+};
+
+const order = ["1", "1b", "2", "3", "3b", "4", "4b", "4c", "5", "6", "7", "7b", "7c", "8", "9"];
+const selected = opts.cases ?? order;
+const unknown = selected.filter((id) => !order.includes(id));
+if (unknown.length) { console.error(`unknown case ${unknown.join(", ")}; cases are ${order.join(", ")}`); process.exit(2); }
+let results;
+try {
+  results = await Promise.all(order.filter((id) => selected.includes(id)).map(async (id) => {
+    try { return await cases[id](); } catch (error) { return { id, title: id, status: "fail", checks: [{ name: "the case ran", ok: false, detail: error.message }] }; }
+  }));
+} finally {
+  tmux("kill-server");
+  server.close();
+  // A runner or agent can still be writing its last lines as its pane closes, so cleanup waits a moment and never fails the report.
+  await sleep(scale(300));
+  if (!opts.keep) for (const h of launches) try { rmSync(h.dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 }); } catch { /* left in the temp folder */ }
+}
+
+// A proposed duty's result is advisory: it says whether the runner met it, outside pass, fail and the exit status.
+for (const r of results) if (r.proposed && r.status !== "skip") { r.met = r.status === "pass"; r.status = "advisory"; }
+const summary = Object.fromEntries(["pass", "fail", "skip", "advisory"].map((s) => [s, results.filter((r) => r.status === s).length]));
+if (opts.json) {
+  console.log(JSON.stringify({ check: "openrig-runner-conformance", format: 1, runner: opts.runner, name: opts.name, results, summary }, null, 2));
+} else {
+  console.log(`OpenRig runner conformance check (docs/reference/harness-runner-contract.md)\nrunner: ${opts.runner}\npreset: ${opts.name}\n`);
+  for (const r of results) {
+    const label = r.status === "advisory" ? "NOTE" : r.status.toUpperCase();
+    const outcome = r.status === "advisory" ? (r.met ? ": met" : ": not met") : r.reason ? `: ${r.reason}` : "";
+    console.log(`${label.padEnd(5)} ${r.id.padEnd(3)} ${r.title}${outcome}`);
+    for (const c of r.checks.filter((c) => !c.ok)) console.log(`      x ${c.name}: ${c.detail}`);
+  }
+  console.log(`\n${summary.pass} pass, ${summary.fail} fail, ${summary.skip} skipped, ${summary.advisory} advisory (not counted)${opts.keep ? `; launch folders kept under ${tmpdir()}` : ""}`);
+}
+process.exit(summary.fail ? 1 : 0);
@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+// A scriptable fake ACP agent for the runner conformance check (check-runner.mjs). It speaks just enough of ACP v1 over
+// stdio, newline-delimited JSON-RPC, to exercise a runner without a model, credentials or the network. It was written
+// after the fake agent in bpamiri/dsh-seat (Apache-2.0), which showed the approach.
+//
+//   node fake-acp-agent.mjs --scenario <file.json> --log <file.jsonl> [any arguments the runner adds are ignored]
+//
+// The scenario says how to answer; the log records every message in and out, so the check can compare them.
+//   sessionId        the id `session/new` returns (default "fake-session-1")
+//   initialize       "error" or "exit" to fail the handshake there
+//   newSession       "error" or "exit" to fail `session/new`
+//   newDelayMs       wait this long before answering `session/new`
+//   knownSessions    ids `session/load` and `session/resume` reopen
+//   reopenError      "missing" (the agent's own "no such session") or "error", for an id it doesn't know
+//   unknownRequest   send the runner a request with a method it can't know, once, after `initialize`
+//   stubborn         keep running after a hangup or after input closes; only SIGTERM or SIGKILL ends it
+//   turns            one entry per `session/prompt`, in order (the last one repeats):
+//     holdMs         keep the turn open this long; `session/cancel` ends it early as "cancelled"
+//     silent         send no message chunk for this turn, so a held turn is entirely quiet (a long tool or model call)
+//     ignoreCancel   on `session/cancel`, keep the turn open and end it with stopReason (default end_turn) anyway, when
+//                    holdMs runs out or, with endAfterCancelMs, that long after the first cancel if that's sooner
+//     permission     ask `session/request_permission` first, then carry on whatever the answer. As an object:
+//                      options      the options offered (default: allow-once, allow_once; reject-once, reject_once)
+//                      waitMs       stop waiting for the answer after this long, and end the turn
+//                      exitAfterMs  exit with status 3 this long after asking, while the request waits
+//                    A `session/cancel` while the request waits ends the turn "cancelled" once it's answered.
+//     error          answer the prompt with a JSON-RPC error
+//     exit           exit with status 3 instead of answering
+//     stopReason     the stop reason to return (default "end_turn")
+import { appendFileSync, readFileSync } from "node:fs";
+import { createInterface } from "node:readline";
+
+const arg = (name) => { const i = process.argv.indexOf(name); return i > 0 ? process.argv[i + 1] : undefined; };
+const scenarioFile = arg("--scenario") ?? process.env.RUNNER_CHECK_SCENARIO;
+const logFile = arg("--log") ?? process.env.RUNNER_CHECK_AGENT_LOG;
+const scenario = scenarioFile ? JSON.parse(readFileSync(scenarioFile, "utf8")) : {};
+
+const log = (entry) => { if (logFile) appendFileSync(logFile, `${JSON.stringify({ at: Date.now(), ...entry })}\n`); };
+const send = (msg) => { log({ dir: "out", msg }); process.stdout.write(`${JSON.stringify(msg)}\n`); };
+const reply = (id, result) => send({ jsonrpc: "2.0", id, result });
+const fail = (id, code, message) => send({ jsonrpc: "2.0", id, error: { code, message } });
+const exit = (status, why) => { log({ dir: "event", event: "exit", status, why }); process.exit(status); };
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+log({ dir: "event", event: "started", pid: process.pid, cwd: process.cwd(), argv: process.argv.slice(2) });
+// Ctrl-C is the runner's to handle, so the agent never takes it as a signal. A stubborn agent also outlives a hangup and
+// its input closing, as some real agents do: only the runner ending it (SIGTERM or SIGKILL) stops it.
+process.on("SIGINT", () => log({ dir: "event", event: "signal", signal: "SIGINT" }));
+process.on("SIGHUP", () => scenario.stubborn ? log({ dir: "event", event: "signal", signal: "SIGHUP" }) : exit(0, "SIGHUP"));
+process.on("SIGTERM", () => exit(0, "SIGTERM"));
+
+let sessionId;
+let turn = 0;
+let nextId = 1;
+const answers = new Map();
+let cancelTurn = null;
+
+// Numbers, as JSON-RPC agents commonly use. A runner passes one on unchanged, and OpenRig reads it as its decimal string.
+function ask(method, params) {
+  const id = 1000 + nextId++;
+  send({ jsonrpc: "2.0", id, method, params });
+  return new Promise((resolve) => answers.set(id, resolve));
+}
+
+async function prompt(id, params) {
+  const spec = (scenario.turns ?? [])[Math.min(turn, (scenario.turns?.length ?? 1) - 1)] ?? {};
+  turn += 1;
+  if (spec.exit) exit(3, `turn ${turn}`);
+  if (spec.error) { fail(id, -32603, "fake agent: this turn fails"); return; }
+  if (!spec.silent) send({ jsonrpc: "2.0", method: "session/update",
+    params: { sessionId: params.sessionId, update: { sessionUpdate: "agent_message_chunk", content: { type: "text", text: `turn ${turn}` } } } });
+  let stopReason = spec.stopReason ?? "end_turn";
+  if (spec.permission) {
+    const p = typeof spec.permission === "object" ? spec.permission : {};
+    const asked = ask("session/request_permission", {
+      sessionId: params.sessionId,
+      toolCall: { toolCallId: `call-${turn}`, title: "Edit notes.txt", kind: "edit" },
+      options: p.options ?? [
+        { optionId: "allow-once", name: "Allow once", kind: "allow_once" },
+        { optionId: "reject-once", name: "Reject", kind: "reject_once" },
+      ],
+    });
+    if (p.exitAfterMs) setTimeout(() => exit(3, "while a permission request waits"), p.exitAfterMs);
+    let cancelled = false;
+    cancelTurn = () => { cancelled = true; };
+    const answer = await (p.waitMs ? Promise.race([asked, sleep(p.waitMs).then(() => null)]) : asked);
+    cancelTurn = null;
+    if (!answer) log({ dir: "event", event: "permission-wait-ended" });
+    if (cancelled) { reply(id, { stopReason: "cancelled" }); return; }
+  }
+  if (spec.holdMs) {
+    const cancelled = await new Promise((resolve) => {
+      const timer = setTimeout(() => { cancelTurn = null; resolve(false); }, spec.holdMs);
+      cancelTurn = () => {
+        if (!spec.ignoreCancel) { clearTimeout(timer); cancelTurn = null; resolve(true); return; }
+        if (spec.endAfterCancelMs === undefined) return;
+        cancelTurn = null;
+        setTimeout(() => { clearTimeout(timer); resolve(false); }, spec.endAfterCancelMs);
+      };
+    });
+    if (cancelled) stopReason = "cancelled";
+  }
+  reply(id, { stopReason });
+}
+
+async function reopen(id, params) {
+  if ((scenario.knownSessions ?? []).includes(params.sessionId)) { sessionId = params.sessionId; reply(id, null); return; }
+  if (scenario.reopenError === "missing") fail(id, -32002, `Session not found: ${params.sessionId}`);
+  else fail(id, -32603, "fake agent: reopen failed");
+}
+
+async function handle(msg) {
+  if (msg.id !== undefined && msg.method === undefined) { answers.get(msg.id)?.(msg); answers.delete(msg.id); return; }
+  switch (msg.method) {
+    case "initialize":
+      if (scenario.initialize === "exit") exit(2, "initialize");
+      if (scenario.initialize === "error") { fail(msg.id, -32603, "fake agent: initialize fails"); return; }
+      reply(msg.id, { protocolVersion: 1, agentCapabilities: { loadSession: true }, authMethods: [] });
+      if (scenario.unknownRequest) await ask("fake/unknown_method", { note: "a method no runner knows" });
+      return;
+    case "session/new":
+      if (scenario.newDelayMs) await sleep(scenario.newDelayMs);
+      if (scenario.newSession === "exit") exit(2, "session/new");
+      if (scenario.newSession === "error") { fail(msg.id, -32603, "fake agent: session/new fails"); return; }
+      sessionId = scenario.sessionId ?? "fake-session-1";
+      reply(msg.id, { sessionId });
+      return;
+    case "session/load":
+    case "session/resume":
+      await reopen(msg.id, msg.params ?? {});
+      return;
+    case "session/prompt":
+      await prompt(msg.id, msg.params ?? {});
+      return;
+    case "session/cancel":
+      cancelTurn?.();
+      return;
+    default:
+      if (msg.id !== undefined) fail(msg.id, -32601, `Method not found: ${msg.method}`);
+  }
+}
+
+const lines = createInterface({ input: process.stdin });
+lines.on("line", (line) => {
+  let msg;
+  try { msg = JSON.parse(line); } catch { log({ dir: "event", event: "garbage", line }); return; }
+  log({ dir: "in", msg });
+  void handle(msg);
+});
+lines.on("close", () => { if (scenario.stubborn) { log({ dir: "event", event: "stdin-closed" }); setInterval(() => {}, 60_000); } else exit(0, "stdin closed"); });
@@ -144,6 +144,23 @@ changes either. `rig scope` reads an `established` or `canonical` slice whose
 `verified:` is missing, has no source, names a tool-scaffolded placeholder, or is
 older than 90 days as `provisional`.

+A slice's frontmatter may also carry `status:`. `GET /api/slices` reports the
+bucket each word falls in as the slice's `status`, and its
+`?filter=all|active|done|blocked` filters on that bucket:
+
+| `status:` word | Bucket |
+| --- | --- |
+| `active`, `in-flight`, `ratified` | `active` |
+| `draft`, `draft-pending-orch-ratification`, `placeholder` | `draft` |
+| `done`, `shipped`, `promoted`, `closed` | `done` |
+| `blocked`, `parked-with-evidence` | `blocked` |
+
+Words are matched ignoring case. Any other word is matched by what it contains:
+`done`, `ship` or `close` makes it `done`; `block` or `park`, `blocked`; `draft`
+or `pending`, `draft`. A word that matches none of these counts as `active`, so a
+slice marked `complete` counts as `active`. A slice with no `status:` counts as
+`draft`.
+
 When the owning scope selects `proofPolicy.judges`, use `rig proof judge` to
 record an attributed accept, reject or withdraw decision on a contract item,
 and `rig proof show` to read derived readiness up through slice, mission and
@@ -178,9 +195,11 @@ missions whose `mission.yaml` carries `metadata.status: active` or
 a mission does not change the project's readiness. A `planned` mission stays
 outside the rollup, even after its slices are accepted, until someone changes
 its status to `active` (or `release-candidate` for a release that is ready to
-judge). Nothing changes the status automatically. Missions created before this
-default carry no status and are not counted either; add the line by hand to
-include them. It also writes `metadata.name`, the mission's folder name, which
+judge). Nothing changes the status automatically. A mission can also carry
+`metadata.status: complete`, which only `POST /api/missions/:missionId/complete`
+writes (no `rig` verb does); a `complete` mission is outside the rollup too.
+Missions created before this default carry no status and are not counted either;
+add the line by hand to include them. It also writes `metadata.name`, the mission's folder name, which
 the project lifecycle compiler requires; a mission created without it refuses to
 compile with `lifecycle_field_missing` until you add that line.

@@ -10,7 +10,7 @@ type: `openrig-urgent`, `urgent-only` and `sends-only`. Sibling seats keep their
 | `off` (default) | Existing delivery and prompt checks | Existing send result |
 | `draft-aware` | Paste into a recognized empty composer; check ownership again before Enter | Hold input and retain this attempt for inspection when bookkeeping is available |
 | `openrig-urgent` | OpenRig's own messages (watchdogs, scheduled wakes, notices) and anything marked urgent type, never over a draft | Other agents' messages are held, the sender is told, and held messages stay readable |
-| `urgent-only` | Only messages marked urgent type (`rig send --urgent`, or a queue item at priority urgent or critical), never over a draft | Everything else is held, the sender is told, and held messages stay readable |
+| `urgent-only` | Only messages marked urgent type (`rig send --urgent`, `urgent: true` on `POST /api/transport/send`, or a queue item at priority urgent or critical), never over a draft | Everything else is held, the sender is told, and held messages stay readable |
 | `sends-only` | Deliberate sends from people and agents type, as with `off`; a terminal member's typing isn't protected, because its shell input can't be read | OpenRig's own notices are held. A terminal member defaults to this level |
 | `hold` | No automatic terminal input, even at an empty prompt | Retain for inspection outside the pane |

@@ -111,8 +111,18 @@ their existing behaviour.

 ### Terminal delivery

-Run from a seat shell with `OPENRIG_SESSION_NAME` set; the daemon derives the
-audit actor from transport identity.
+`rig seat set-typing-guard` works from an ordinary terminal as well as from a
+seat's shell. The daemon takes the recorded actor from transport identity only:
+
+- From a managed seat's shell (`OPENRIG_SESSION_NAME` set), the preference and
+  its audit entry name that seat.
+- From a terminal with no seat identity, the change applies the same way, and
+  the preference and its audit entry record the actor as
+  `unattributed (no seat identity)`.
+
+Neither case takes an actor from the request body or from the target seat's name.
+`rig seat retire-held-message` still records the seat that retired a message, so
+run it from a seat's shell.

 ~~~sh
 rig seat set-typing-guard dev-impl@my-rig --mode draft-aware \
@@ -131,8 +141,21 @@ to finish. The API may return HTTP 202 with `pending: true`; wait for
 and effective modes and retains the text `Typing guard: on (hold)` for hold.

 A held send immediately returns `outcome: "retained"`, `sent: false`, its exact
-reason (such as `draft_input_busy`) and the saved attempt's `outboxIds`. No automatic
-retry is scheduled. Each explicit draft-aware request is a new attempt, including
+reason and the saved attempt's `outboxIds`. No automatic
+retry is scheduled. The reasons are:
+
+- `typing_guard_enabled`: the seat's mode holds this send (`hold`, or a level that
+  holds this kind of message).
+- `runtime_switch_in_progress`: the seat is switching runtime.
+- In `draft-aware` mode, a refusal before any input was written:
+  `draft_input_busy` (the input holds unsubmitted text), `draft_input_unknown` (the
+  input can't be read), `draft_input_changed` (the input or its target changed during
+  the delivery), `draft_wake_superseded`, `target_needs_input`,
+  `wait_for_idle_timeout`, `target_activity_unknown`, `target_runtime_unverified`,
+  `target_runtime_not_running`, `target_runtime_conflict`, `invalid_wait_for_idle`,
+  `invalid_dangerously_interact`, `dangerously_interact_requires_reason`,
+  `prompt_override_audit_unavailable`, `transport_unavailable`, `session_missing` or
+  `tmux_unavailable`. Each explicit draft-aware request is a new attempt, including
 one with a reused `deliveryId`; the result warns older callers that this field no
 longer deduplicates input. The CLI does not generate a deduplication key.

@@ -230,7 +253,9 @@ refuses Enter and is not replayed. Unsupported provider layouts remain held.
 Use off when that tradeoff is unsuitable.

 HTTP configuration uses `POST /api/seat/set-typing-guard/:seatRef` with
-`{mode, reason}` or `{enabled, reason}`. Status and held-message routes are
+`{mode, reason}` or `{enabled, reason}`. The `X-OpenRig-Session` header, when
+present, is the recorded actor; without it the change is recorded as
+`unattributed (no seat identity)`. Status and held-message routes are
 unchanged; no RigSpec field is required.

 ## Verification scope
@@ -99,8 +99,24 @@ So after installing, compare the granted scopes Slack shows for the app with all
 `rig slack manifest --json` lists.

 The app subscribes to messages in public channels it is a member of (`message.channels`), to
-mentions of the app (`app_mention`), and to emoji reactions (`reaction_added`). It does not request
-direct-message or private-channel access.
+mentions of the app (`app_mention`), and to emoji reactions (`reaction_added`). The manifest does
+not request direct-message or private-channel access.
+
+### Using a private channel
+
+The connector doesn't check whether a channel is public or private, so a private channel can be
+the default channel or a mapped one once the app can read it. OpenRig doesn't test this setup. In
+the app's settings:
+
+1. Under **OAuth & Permissions**, add the bot scopes `groups:history` (read messages in private
+   channels the app is in) and `groups:read` (read a private channel's details; `rig slack verify`
+   needs it to confirm the app is a member).
+2. Under **Event Subscriptions**, subscribe to the bot event `message.groups`.
+3. Reinstall the app to the workspace, then invite it to the private channel.
+4. To have `rig slack verify` require the new scopes too, run
+   `rig slack setup --required-scopes chat:write,channels:history,channels:read,groups:history,groups:read`.
+
+Direct messages are not supported.

 A reaction added to an ask reaches the agent that asked, as a note naming who reacted and with
 which emoji; the agent decides what it means. Every message OpenRig posted for the ask counts:
@@ -109,6 +125,14 @@ reaction on any other message, including a person's reply in the thread, is igno
 `reaction_added` event: add both under **OAuth & Permissions** and **Event Subscriptions**, then
 reinstall the app to the workspace.

+To have reactions ignored instead, run `rig slack setup --reactions off`. The agent that asked
+never hears of a reaction, including one still waiting to be retried, and a person answers an ask by
+typing a reply in its thread. Slack still sends the event and the manifest keeps it, so switching
+back with `--reactions route` needs no change to the app. Like any saved change, the setting reaches
+a running connector when it next rewires, which a daemon restart does (`rig daemon stop`, then
+`rig daemon start`). See [One channel per rig or seat](#one-channel-per-rig-or-seat-optional) for
+why disabling and re-enabling the connector isn't the same.
+
 The manifest also turns on **Interactivity**, so the human can answer a decision's structured
 questions by clicking a button (`rig queue create --human-questions-file`). In Socket Mode the
 clicks arrive over the same socket, so no request URL is needed. An app created from an older
@@ -158,6 +182,9 @@ rig slack channel-map list
 rig slack channel-map remove pr@my-rig
 ```

+A client can offer the channels to choose from with `GET /api/gateway/slack/channels`, which lists the public
+channels the bot token can see, with their ids ([Writing a daemon client](daemon-http-clients.md#route-details)).
+
 - **Which channel an item posts to.** The item's seat is matched exactly first (`pr@my-rig`),
  then its rig (`my-rig`). Anything unmapped posts to the default channel, so a config
  without a map behaves exactly as before. Aggregate delivery digests have no single seat and
@@ -199,7 +226,7 @@ rig slack channel-map remove pr@my-rig
    their routing also keeps the conversations separate: new messages in a seat's own channel
    still go to the inbound destination unless its entry names `--inbound`. A conversation shared
    on purpose is fine.
-  - Missed-message recovery (below) covers the default channel only.
+  - Missed-message recovery (below) covers the default channel and every mapped channel, except a channel relayed to another machine.

 Invite the app to every mapped channel (`/invite @OpenRig`). `rig slack verify` checks
 membership in the default channel and every mapped channel, and reports NOT ready until the
@@ -213,8 +240,9 @@ configuration matches the file.

 The map is stored as `channelMap` in `slack-connector.json`, as a list of `{ "match", "channel" }`
 entries, each with an optional `"inbound"` seat. Saving refuses any other field. A field written by a newer OpenRig is ignored when the
-connector reads the file, and `rig slack status` names it. Private channels and direct messages
-are not supported targets.
+connector reads the file, and `rig slack status` names it. A private channel can be a target once
+the app has the private-channel scopes ([Using a private channel](#using-a-private-channel)).
+Direct messages are not supported targets.

 ## Named bots (optional)

@@ -358,6 +386,36 @@ Quiet hours hold a person's routine asks while they're on, and post them once th

 ## Reconnect recovery and status

+When a posted ask is answered, closed, canceled or replaced elsewhere, the connector edits its
+original primary message with the status, time, actor and closure note. Buttons become option
+text and the answer hint disappears; the remaining content and reconciliation marker stay as
+posted. Supplemental messages are unchanged. This adds no post or reaction and needs no agent
+turn. Separate resolution notices retain their existing behavior.
+
+A deliberately reopened direct ask says **Open again**; its options remain as text. If it has
+no committed answer, it tells the person to reply in its thread. Otherwise it says **Earlier
+answer retained**: reopening does not accept a second answer. Earlier replaced parks remain
+historical; **Asked again** does not claim that the later ask has been posted. Edits reconcile
+the current state again after awaited Slack calls, so an obsolete close is not recorded as the
+current result after a reopen.
+
+Edits follow committed queue changes, with a startup catch-up for posted asks on retained queue
+rows. Each primary costs one exact-message read and one `chat.update`. The serial edit worker
+uses the recovery budget helpers (four calls, 100 entries, 15 seconds) and waits for the next
+budget window when exhausted. Slack's per-method `Retry-After` is retained across restarts.
+Only an acknowledged edit gets a success receipt. `rig slack status` shows queued reconciliation
+and the last edit failure. Transient failures retry with increasing waits, capped at an hour,
+behind other queued work. Permanent Slack failures (such as missing scope, a deleted original,
+an archived channel or an uneditable message) remain unfinished and are retried only on the next
+connector start. They do not keep consuming edit capacity. These edit calls have their own
+budget, separate from missed-message scanning below.
+
+The baseline already includes public-channel history access and `chat:write`. Private-channel
+reads may require `groups:history`, which the baseline does not grant; a refused read never
+counts as an edit. An unavailable/deleted original cannot be replaced by a new post. Startup
+catch-up cannot edit rows already removed by queue retention or posts without their original
+notification receipt and channel stamp.
+
 The daemon scans available top-level messages and replies broadcast with **Also send to
 channel** in the channels this machine owns: its default channel and its channel map's, except a
 channel it relays to another machine. It also scans replies in the threads it tracks in those
@@ -184,7 +184,7 @@ GET /api/terminal/preview?view=qitem:<id>&provider=herdr
 POST /api/terminal/open {"view":"qitem:<id>","provider":"herdr","expectedPlan":"<preview planId>"}
 ```

-Preview and open include `task: {qitemId, name, complete, issues, members}`. Each member
+Preview and open include `task: {kind:"qitem", id, qitemId, name, complete, issues, members}`. Each member
 names its structured `{hostId, nodeId}` key (null when unresolved), seat,
 contributing `obligations`, `availability` and `viewerStatus`. Stopped, missing,
 external and unresolved remote owners remain visible. Remote queues are not
@@ -300,9 +300,181 @@ small presentation provenance, separate from queue membership. Herdr display
 labels are not that provenance. Other providers/platforms remain unsupported
 for ensure-viewer until qualified; ordinary open retains its existing behavior.

-Writable tile clients use `tmux attach -f ignore-size`; read-only clients keep
-`-r` (which also implies ignore-size). This can avoid contributing to sizing
-when other clients establish the agent window's dimensions. It is **not resize
-isolation**: opening a tile can change the agent's terminal size when it is the
-only sizing client. Observers of a Herdr terminal do not themselves resize it;
+A writable tile attaches with `tmux attach -f ignore-size` when its session
+already has a client that sizes it, so the tile doesn't fight that client over
+the agent window's dimensions. When the session has no sizing client, as with a
+freshly launched seat, the tile attaches without the flag and sizes the window
+itself: tmux applies ignore-size across the whole server, so a session viewed
+only by ignore-size clients would otherwise keep its 80x24 creation size while
+any other session has a sizing client. Read-only clients keep `-r` (which also
+implies ignore-size), and the printed manual attach commands keep
+`-f ignore-size`. This is **not resize isolation**: opening a tile can change
+the agent's terminal size. Observers of a Herdr terminal do not themselves resize it;
 a controlling browser can. No cross-version resize guarantee is implied.
+
+To type into a seat without changing its size, send the text through OpenRig
+(`rig send`, or `POST /api/transport/send`): it is written to the pane with tmux
+buffers and keys, and no client attaches. There is no supported way to attach a
+writable client that is sure never to resize the agent's window.
+
+
+## Following a slice or mission's current work
+
+Use `rig terminal open slice:<name-or-id> --follow --provider herdr` to keep
+one workspace following the current destination owners of that slice's active
+queue rows. `pending`, `in-progress` and `blocked` rows count. A member can own
+several rows; `task.members[].obligations` preserves every row and state.
+
+A slice resolves within the daemon's configured slice index, by exact directory
+name or unique frontmatter `id`. Tags must name it exactly: `rig queue create
+--slice <name-or-id> ...` associates a row. Handoff inherits those tags unless
+replaced; merely linking an untagged child does not associate it. A mission-only
+tag does not put a row in every slice. No project is inferred from a tag or the
+caller's working directory. A bare name or ID claimed by multiple slices is
+`scope_ambiguous`; no first-match scope is selected. Selecting a unique key can
+still follow a slice whose other alias is reused: a row carrying that colliding
+alias must have exactly one `mission:` tag naming exactly one indexed claimant.
+Rows placed in another mission are excluded. Missing, contradictory or otherwise
+unplaceable mission/alias tags make the snapshot incomplete, retaining previous
+viewers. A unique alias on its own retains exact matching. Flat legacy slices
+without an indexed parent mission cannot disambiguate a colliding alias.
+
+Mission views use `mission:<directory-id>`, from the same configured index.
+A mission is known when its directory contains `slices/` (even empty) or a
+readable `mission.yaml` declaration. Its directory ID is its exact identity;
+mission frontmatter is not an alias. Membership is the union of active rows
+with that exact `mission:` tag and rows associated with any physically indexed
+child slice by its exact name or unique ID. Each row counts once even when it
+has both tags. Flat legacy slices without that parent association are not
+inferred into a mission. A child's historical status or composition activation
+flag does not remove its current obligations from the union. Duplicate mission
+IDs are ambiguous. Shared child names/IDs are omitted from bare slice matching;
+rows with one indexed claimant mission are placed through their mission tag.
+A direct mission tag takes precedence, including work tagged to both missions.
+Without that direct tag, a shared-key row with missing, contradictory or
+non-claimant mission tags is named in `issues` and makes the snapshot incomplete;
+known owners remain.
+The launcher reads this same terminal preview and submits its `expectedPlan`
+when opening, rather than using the review-agent roster.
+
+Slice and mission keys are case-sensitive and can include Unicode, plus signs and internal
+spaces. They cannot be empty or contain slash, backslash, control characters,
+or leading/trailing whitespace in the scope reader. The service trims the whole
+selector before composition, so a trailing selector space is accepted by
+preview/ensure with the same plan; ensure rejects a leading selector space.
+Prefer the exact canonical selector in every call. Pass it in JSON or a quoted
+CLI argument; encode it once as a GET query value. Do not double-decode it.
+
+Slice previews and open results use `task: {kind:"slice", id, name, complete,
+issues, members}`. `id` is the unique frontmatter id, or the directory name when
+no id is present. There is no synthetic `qitemId`. Preserve the preview's `view`
+for the ensure request. All successful previews, including qitem previews,
+include `capabilities: {ensureViewer:boolean}`. True means that the resolved
+view/provider implements ensure; the existing member, completeness, owner and
+`expectedPlan` checks still apply. A missing capability/task on an older daemon
+is unsupported scoped membership, not an empty team.
+
+Mission results use the same shape with `task.kind:"mission"`; `task.id` and
+`task.name` are the directory ID, with no synthetic `qitemId`. Ordinary mission
+preview/open uses this current-obligation membership too: past participants
+without active obligations are excluded, while unavailable current owners
+remain named. Follow, preview and ensure share the same authority.
+
+New slice and mission workspaces default to four automatic tiles; `--max-tiles` overrides
+that. Qitem views retain their eight-tile default. The full membership and
+obligation list remains available when tiles exceed capacity. Pins, drafts,
+unknown input and focus retention still protect departed viewers. Closing a
+viewer never stops its agent. Opening a tile can change the agent's dimensions.
+
+A known empty slice or mission remains enabled in the same workspace; later associated
+work can join it. An incomplete queue read (`task.complete:false` plus `issues`)
+retains previous viewers. A missing scope is `scope_not_found`, duplicate scope
+identity is `scope_ambiguous`, unreadable/capped index data is `scope_unavailable`,
+and an unavailable resolver is `scope_unsupported`. None is authoritative empty.
+Ensure of an incomplete snapshot returns `viewer_unconfirmed`; changed plans
+return `preview_changed` before provisioning.
+
+Ordinary ownership changes follow queue/session/node events. Node and directory
+changes under the primary configured index use the existing filesystem watcher,
+with a coalesced scope invalidation event. There is no repeating membership
+poll. Structural edits under additional legacy roots, or a filesystem where
+watching is unavailable, require `rig`'s existing slice refresh endpoint
+`POST /api/slices/refresh` or reopening the view. Missing or unreadable sources
+keep prior viewers; they never certify that the work disappeared.
+
+
+Scope identity reads are bounded to 4,096 directory entries, 16 KiB per selected
+node-header read, and 8 MiB of source bytes per index generation. The byte budget
+counts the bounded read, including text after short frontmatter. An index that
+exceeds these limits is too large for this read; use a smaller configured index
+or a qitem view. This is separate from unreadable or malformed sources.
+Queue membership reads are bounded to 50,000 active rows plus one lookahead,
+16 KiB of encoded tags per row and 8 MiB of aggregate encoded tags. They remain
+fresh on each render. Identities are reused within a scope-source generation
+only while the primary-root watcher is live and existing additional roots are
+covered by that root. A source event or explicit refresh invalidates them;
+errors discard the cache. Unavailable watching or an existing unwatched legacy
+root uses fresh bounded identity reads instead. Missing legacy roots are checked
+on each call so an appearing root cannot reuse an older cached identity set.
+
+Error bodies remain authoritative. `scope_unsupported` is HTTP 400,
+`scope_not_found` is 404, and `scope_ambiguous`/`scope_unavailable` are 409.
+An incomplete queue snapshot is a successful preview with `task.complete:false`;
+ensure returns `viewer_unconfirmed` without a provider effect. Unsupported
+ensure view kinds now return `view_required` (400), where they previously returned
+200 with an error body. Unsupported follow view kinds
+retain `follow_view_required` in a 200 `ok:false` body, as before. A changed
+preview remains `preview_changed` (409). During automatic refresh a missing or
+ambiguous scope retains the existing tiles and names the source problem in the
+explanation strip; refresh or reopen it under the current unambiguous key.
+
+
+## Reading or sending to an expected native conversation
+
+An application that selects an original Claude Code or Codex conversation can opt
+into an expected-identity check. The identity is the exact tuple `nodeId`, canonical
+`sessionName`, `runtime` (`claude-code` or `codex`) and native `nativeId`. A registry
+resume token by itself is not a current-process identity observation.
+
+Read `GET /api/sessions/:sessionName/generation-record-expected` with query fields
+`expectedNodeId`, `expectedRuntime`, `expectedNativeId` and optional `sinceBytes`.
+It resolves the verified current occupant and native process, opens that native
+record, checks its identity, and returns identity and bounded suffix bytes from
+the same opened file. Its existing byte cursor and `generationId` semantics match
+`generation-record`. Success adds `identityContract:1` and `checkedIdentity`, the
+exact expected tuple. Check both before displaying the suffix as that conversation.
+
+Send `POST /api/transport/send-expected` with the ordinary send body and a required
+`expectedIdentity` object containing those four fields. The check runs again after
+buffer preparation immediately before paste, and before Enter after any wait.
+A retained input stores the constraint in its outbox receipt; committed dispatch
+and reuse of its delivery ID cannot select a different original conversation or
+omit the stored constraint. Delivery IDs still do not deduplicate explicit input.
+Success adds `identityContract:1` and `checkedIdentity`. Retained is not sent;
+`checkedIdentity` is an observation at an input boundary, not model consumption.
+If replacement is observed after paste, the result reports `inputPhase:"written"`
+and `sent:true`, with Enter refused. Inspect that input before deciding what to do.
+
+Malformed expectations return 400 (`invalid_expected_identity`). A different
+observed identity returns 409 (`expected_identity_mismatch`); a missing or
+unverified identity returns 409 (`expected_identity_unavailable`). Conflicting
+reuse of a delivery ID returns 409 (`delivery_identity_conflict`). No conditional
+operation falls back to the replacement. Use these dedicated paths when detecting
+support: older daemons return 404 instead of silently ignoring an unknown field.
+Ordinary reads and sends without an expectation or an ID bound by an earlier
+conditional send keep their existing behavior. Reusing a bound ID also carries
+its stored constraint when the caller omits the expectation.
+
+While a runtime switch is preparing or confirmed, a conditional send returns
+409 `expected_identity_unavailable` with `sent:false` and `inputPhase:"not_reached"`.
+It retains neither the input nor the expectation. Retry the conditional endpoint
+with the original `expectedIdentity`; an ordinary send is not an identity-bound
+retry unless its ID already has a stored constraint. Ordinary sends during the
+switch keep their existing retained response.
+
+This is a finite process/record observation followed by a terminal write; tmux has
+no atomic native-conversation compare-and-write operation. A native conversation
+change after the final observation remains a race. The check does not turn a
+terminal attachment into a conversation pin: existing terminal viewers follow
+managed pane/session bindings and may display their replacement. Applications
+must keep that attachment limit separate from checked record reads and sends.
@@ -0,0 +1,166 @@
+# Choosing the tmux server for an OpenRig instance
+
+`terminal.tmux_server` controls where the daemon creates and reads managed seats.
+It accepts `inherit` (the default) or `isolated`. The environment override is
+`OPENRIG_TMUX_SERVER`.
+
+To keep managed seats out of your personal `tmux ls`, set this before starting a
+new instance, or before a deliberate restart of an existing daemon:
+
+```sh
+rig config set terminal.tmux_server isolated
+```
+
+The setting is read once at daemon startup. Changing it does not move a running
+seat. Inspect the effective choice with:
+
+```sh
+rig terminal status --json
+```
+
+The `tmux` object reports `requestedMode` (read at the last startup), effective
+`mode`, `socketPath`, `serverArgs`, `migrationPending`, and `blockingSessions`.
+The settings browser shows the configured value; terminal status shows what the
+running daemon actually uses.
+
+## Server identity and configuration
+
+In `inherit` mode, a new instance uses the launching shell's `TMUX` socket, or the
+default socket under `TMUX_TMPDIR` (otherwise `/tmp`) when outside tmux. Native
+commands retain tmux's existing environment-based selection. Printed attachments
+and terminal metadata name a non-default server so a new terminal can reach it.
+The default mode does not require a server record or an additional instance
+identity check to start the daemon or use existing attachment paths.
+
+In `isolated` mode, the socket is named `openrig-<hash>` under tmux's per-user
+directory. The hash identifies the canonical `OPENRIG_HOME`: different homes get
+different servers, and symlink aliases of one home share a server. Choose a short
+`TMUX_TMPDIR` before the first isolated start if your normal temporary path would
+exceed the platform's Unix socket path limit.
+
+When isolation is requested or active, the daemon records the effective socket in
+`OPENRIG_HOME/tmux-server.json` using an atomic, owner-only write. Keep this file
+and the durable `tmux-server.initialized` marker with the instance state. A later shell
+with different `TMUX` or `TMUX_TMPDIR` does not redirect an established isolated
+instance. An invalid or unreadable isolation record is reported rather than overwritten.
+If the record disappears while isolation is selected, startup and `destroy --all` stop before
+touching sessions. Restore the record from an instance backup, or inspect the
+running daemon's `rig terminal status --json` to recover its effective selection.
+An ordinary inherited instance may record its socket for a later migration, but
+missing, invalid or unwritable records do not prevent its normal startup.
+The record's `pinned` flag distinguishes a fixed isolated or migration socket
+from an advisory inherited record. Returning to ordinary inheritance commits
+`pinned: false` and removes the active marker; an interrupted update must not
+leave startup using one server and offline cleanup selecting another. A valid
+unpinned record takes precedence over a leftover marker. Legacy inherited records
+and the old `1` marker do not make ordinary inheritance depend on that file.
+
+A newly started server loads tmux's normal system and user configuration,
+including `~/.tmux.conf`; OpenRig does not substitute an empty configuration.
+Existing OpenRig session options, such as `terminal.status_bar`, still apply.
+An existing server does not reread its configuration merely because the daemon
+restarts. Settings and sessions in a separate personal server are left alone.
+
+## Existing teams and deferred migration
+
+At startup, the daemon checks the previously selected server before switching.
+If registered sessions still exist there, it keeps that server and reports a
+pending migration. Explicit `OPENRIG_HOME` ownership markers distinguish another
+instance's namesakes; unmarked legacy sessions are retained conservatively. If
+the old server cannot be inspected, the daemon also keeps it and reports why.
+
+Stop the listed sessions deliberately, then restart the daemon again to apply the
+new selection. Merely editing the setting or waiting for the last seat to stop
+does not switch a running daemon. The same rule applies when returning to
+`inherit` from isolation. A normal inherited start continues to follow its launching
+environment, as before. No
+live pane is moved, restarted or killed by server selection. Old viewing windows
+can be closed separately after their conversations have stopped.
+
+Bring a stopped team back with `rig up <name> --existing`. Its normal restoration
+rules still apply: a seat without usable provider history requires an explicit
+fresh-start choice before it launches.
+
+On the first upgrade from a version without a socket record, the old-server
+candidate comes from the launching environment. If live seats use a non-default
+server, start the upgraded daemon from that original server to establish its
+record, or stop those seats before changing servers. Earlier versions did not
+persist enough information to find an arbitrary old socket from a different shell.
+
+## Attachments, discovery and cleanup
+
+`rig capture`, managed launch/stop/recovery, terminal previews and desktop viewers
+use the effective server. `rig ps --nodes --json` includes `tmuxServerArgs` and a
+matching `tmuxAttachCommand` for bound tmux seats. `rig tui --shared` uses that
+metadata. To attach a terminal directly, use the canonical session name:
+
+```sh
+rig terminal attach '<session>'
+rig terminal attach --read-only -- '<session>'
+```
+
+These commands attach on the daemon's machine. They do not create a seat or
+switch somebody else's tmux client. A local CLI pointed at an HTTP remote daemon
+cannot attach a same-named local session. For an effectively isolated server,
+terminal attachment, shared TUI and desktop windows also compare the daemon's
+instance identity with the local durable identity before using local terminal
+tools. A loopback URL through a port forward does not bypass this isolation check;
+use the matching `OPENRIG_HOME` on the daemon's machine. Inherited servers retain
+the existing local-host checks without requiring a matching durable identity.
+SSH view tiles follow the viewing instance's effective mode. In `inherit`, they
+use remote tmux through `ssh -t`, including `-r` for read-only views, and keep the
+bounded, identity-checked reattachment when a seat's session is replaced. The
+remote host needs only tmux and a POSIX shell, not OpenRig. Copyable recovery
+commands remain plain `ssh -t ... tmux attach`. In `isolated`, tiles run
+`rig terminal attach` on the remote host,
+using that host's local instance and socket; both the remote CLI and daemon must
+support this command. The remote shell must select the right `OPENRIG_HOME` when
+using a custom home. Local socket paths are never sent to it, and an isolated
+attachment failure does not fall back to a same-named default-server session.
+An inherited view does not discover an isolated remote instance's socket; use
+the remote instance's `rig terminal attach` directly for that mixed setup.
+
+Discovery and adoption see the selected server. Existing sessions on another
+server are not imported automatically. `rig attach --self` reports its current
+socket and, for an isolated instance, rejects a different server before binding
+or adding a node; an older
+CLI without socket metadata must be updated to self-attach to an isolated
+instance. A shell outside tmux can still attach as `external_cli`.
+
+`rig destroy --all` reads the recorded effective server before stopping the daemon
+or removing its state when isolation or a deferred migration pins it. Ordinary
+`inherit` cleanup uses the invoking environment's normal tmux selection, as before;
+an old advisory socket is not used to redirect it. Cleanup kills only registered
+session names on the selected server.
+
+Dedicated selection requires POSIX tmux. On Windows, psmux retains its existing
+server behavior; requesting `isolated` produces a status note and a pending choice.
+
+## Two instances on one machine
+
+Isolation selects only a tmux server. Give each daemon its own OpenRig home,
+database and port as well. For example, from a directory where you want to keep
+the two instances:
+
+```sh
+mkdir -p .openrig-a .openrig-b
+env OPENRIG_HOME="$PWD/.openrig-a" OPENRIG_DB="$PWD/.openrig-a/rig.db" \
+  OPENRIG_PORT=5311 OPENRIG_TMUX_SERVER=isolated rig daemon start
+env OPENRIG_HOME="$PWD/.openrig-b" OPENRIG_DB="$PWD/.openrig-b/rig.db" \
+  OPENRIG_PORT=5312 OPENRIG_TMUX_SERVER=isolated rig daemon start
+```
+
+Use the same instance-specific environment for every subsequent command, including
+`rig up`, `rig terminal status --json`, attachment and `rig daemon stop`. Do not
+reuse a database between these homes. Other inherited `OPENRIG_*` variables still
+apply; start from a shell without selectors for another running instance.
+
+The operating-system home, provider credentials and provider conversation history
+remain shared unless configured separately. This setting does not isolate the
+filesystem or network. Both inherited and isolated servers support the opt-in
+`OPENRIG_TMUX_CONTROL=1` execution path; its control client connects to the same
+server as the daemon's other tmux commands. On servers older than tmux 3.7c, or
+whose version cannot be recognized as a fixed release, OpenRig uses spawned
+clients instead: starting a control client while another session is created can
+crash those servers (#2304). This avoids creating OpenRig's own control client;
+it cannot protect the server from other tools' control clients.
@@ -1,192 +1,328 @@
-# What changed in OpenRig 0.7.1
+# What changed in OpenRig 0.7.9

-This note is for an agent on an install that was just upgraded to 0.7.1. It lists only what behaves differently from
-0.7.0 and what to do about it. For everything OpenRig can do, read the capability map:
-`rig context get onboarding-width/public-what-you-can-do.md`. Each release replaces this file, so
-`rig context get reference/whats-new.md` describes the installed version once the upgraded daemon is running. Without
-a running daemon, read `$OPENRIG_HOME/reference/whats-new.md`. The daemon refreshes that copy when it starts, so right
-after an upgrade it can still hold the previous version's note.
+This note is for an agent on an install that was just upgraded to 0.7.9. OpenRig
+0.7.9 records default runner permits, passes a person's typed words to the
+agent, turns stream intake on by default, and moves guidance for fresh Pi seats,
+and fresh Codex seats on 0.164.0 or later, out of the repository's `AGENTS.md`.
+If you upgraded from 0.7.7 or
+earlier, also read "What changed in OpenRig 0.7.8" below. For the full
+capability map, read `rig context get onboarding-width/public-what-you-can-do.md`.
+After the upgraded daemon starts, `rig context get reference/whats-new.md`
+describes this version. Without a running daemon, read the packaged
+`daemon/docs/reference/whats-new.md`; `$OPENRIG_HOME/reference/whats-new.md` can
+still be the previous copy until startup.

 ## After the upgrade

- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Eight migrations run on the first start (124, 125,
-  127, 128, 129, 130, 131 and 135). Nine settings are added: `policies.claude_compaction.preparation_root` (unset),
-  `skills.router_line.enabled` (off), `decisions.enabled` (false), `decisions.consumers`, `decisions.template_dir`,
-  `retention.stream_days` (30), `retention.stream_max_items` (20000), `provider.selected` (empty) and
-  `daemon.db_conflict` (`warn`). None is removed.
- **Stream retention is on.** Stream items emitted after the upgrade are deleted after 30 days, or beyond the newest
-  20,000, unless a record names them (a classification, duplicate link, attempt or disposition). History from before the
-  upgrade is kept. Raise `retention.stream_days` or `retention.stream_max_items` to keep more.
- **The bundled openrig-core plugin goes from 0.1.17 to 0.1.18.** Startup replaces the installed plugin's changed files:
-  its Claude hook definitions, three hook scripts and the pre-compaction hook (so hooks start on a seat whose PATH has
-  no Node), and the `openrig-user`, `messaging-the-human` and `forming-an-openrig-mental-model` skills. As in
-  0.7.0, it first copies each file it replaces under `$OPENRIG_HOME/backups/managed-refresh/<id>/`, edited or not, and
-  logs `[plugin-vendor] preserved previous contents of <file> at <copy> before managed refresh`. A copy doesn't mean
-  anyone edited the file; if someone did, reapply the change from the copy.
- **Claude seats need Claude Code 2.1.280 or newer to see their team skills,** which now arrive as a per-seat plugin
-  through `CLAUDE_CODE_PLUGIN_DIRS` (below). OpenRig doesn't check the version. A running seat gets the new layout at its
-  next launch, restore or handover.
- **If a worktree's `.claude/settings.local.json` says `"defaultMode": "acceptEdits"` and the person didn't choose it,**
-  an earlier OpenRig wrote it when it added or freshly launched a managed Claude seat. 0.7.1 no longer writes it but
-  doesn't repair it; ask the person which mode they want and set it once.
+- **Restart the daemon** to load the new code: `rig daemon stop`, then
+  `rig daemon start`.
+  - **Migrations 146 to 149** record a Pi seat's guidance file, what OpenRig last
+    wrote in each managed guidance block, an index for reading a rig's outbox,
+    and the stream intake position.
+- **Tell the person that stream intake is on.** Each `rig stream emit` now opens
+  an intake row for the kernel queue worker (`queue.worker`), or adds a note to
+  the one still unclaimed, and the row wakes the queue worker like any queue row.
+  Earlier stream history isn't replayed. If they want 0.7.8's behaviour, with no
+  intake rows, run `rig config set stream.intake off`.
+- **The bundled openrig-core plugin goes from 0.1.24 to 0.1.25.** Its
+  seat-continuity-and-handover skill changed. Managed refresh preserves replaced
+  files under `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits
+  you still need from the preserved copy.
+- **Where seat guidance goes now:**
+  - a fresh Pi seat gets OpenRig's guidance in its own agent folder's
+    `AGENTS.md`, unless that file or folder is a link;
+  - a fresh Codex seat on Codex 0.164.0 or later gets it as launch developer
+    instructions, not in the repository `AGENTS.md`, when no config layer
+    OpenRig reads sets `developer_instructions`;
+  - a Codex resume, fork, restore or handover successor, an older or unknown
+    Codex, and a config layer that sets `developer_instructions` or can't be read
+    still use the repository `AGENTS.md`;
+  - if only the person's shell startup sets `CODEX_HOME`, OpenRig reads
+    `~/.codex`, so a `developer_instructions` set in their home is replaced for
+    that session. Declare the same absolute path as `CODEX_HOME` in the member's
+    or rig's `env:` to have it checked. `docs/reference/agent-startup-guide.md`
+    ("Codex guidance at launch") is the rule;
+  - a managed block a person edited by hand is kept and named
+    (`guidance_block_edited`), not replaced. Read the warning before you change
+    the block.
+- **Slack:** on the first start after upgrading, the connector edits the asks
+  that ended earlier to show they were handled, at Slack's edit rate: about an
+  hour for 450 asks. `rig slack status` shows pending edits.
+- **OpenShell:** rebuild a guest image built for 0.7.8 with this release's
+  helper; an older helper rejects the new startup step, and the error names the
+  rebuild.

-## New things you can do
+## Runner seats

- **Choose how much automatic input reaches a seat:** `rig seat set-typing-guard <seat> --mode <mode> --reason "…"`, where
-  `<mode>` adds `openrig-urgent` (OpenRig's own notices and anything urgent) and `urgent-only` between `off` and `hold`.
-  Mark a message urgent with `rig send --urgent`, or create the row at priority `urgent` or `critical`. Held input stays
-  readable (`rig seat held-messages`) and is never replayed.
- **Choose how far OpenRig and peers may act on a seat:** `rig seat set-terminal-policy <seat> --preset
-  no-peer-interventions|help-within-instructions|full-control --reason "…"`, with `--helper <addresses…>`,
-  `--rig-default` (seats added later), and exceptions such as `--peer-compaction deny` or `--openrig-model allow`.
-  Managed compaction and saved model or effort changes are checked; a denial is `terminal_policy_refused`. Other
-  interventions are guidance only.
- **Read a seat's planned permissions:** `rig seat status <seat>` shows what its next fresh managed launch will pass and
-  where each part comes from, and its terminal policy. `rig setup --router-line yes|no` decides whether OpenRig adds its
-  one line to shared guidance files.
- **Let a person choose whether every ask reaches Slack:** `rig gateway human set <id> slack-subscription
-  every-ask|urgent-only|unset`. Every ask is on the TUI's Feed either way. Under `urgent-only`, only an ask
-  created or handed off with `--alert` posts. An ask marked `--alert` stands out in Slack (an interrupt with a mention)
-  under either setting, so use it only for something only they can do, or an approval whose wait costs now.
- **Give one Claude member its own setup** in the rig spec: `agent_file`, `append_system_prompt_file`, `plugin_dirs` and
-  `advisor` (an Advisor model). They're copied into that seat's storage, never the project.
- **See a seat's own skills:** `rig skill loadout --seat <session|self>`.
- **Reach the team from an assistant without a shell:** the MCP server has 34 tools, including `rig_whoami`,
-  `rig_restore_status`, `rig_team`, `rig_telemetry_events`, following a handoff, reading a finished item's artifact and
-  deciding inside a person's decision room. `rig mcp serve --http` serves them over HTTP; `rig mcp token add <name>
-  --seat <session>` gives each caller its own seat.
- **Hand a row's task to an outside agent:** `rig acp run <row>` for an ACP agent (Hermes, OpenClaw).
-  `docs/reference/a2a-agents.md` covers A2A agents.
- **Run a community harness that names, reports or reopens its conversations:** preset fields `launch_result`, `resume`,
-  `names_conversation` and `startup_assisted`, with examples for Cursor, Hermes and OpenClaw under
-  `docs/reference/community-harness-examples/`.
- **Change one edge on a running rig:** `rig edge add <rig> <from> <to> --kind <kind>` and `rig edge remove <rig>
-  <edge-id>` (`--plan`, `--json`). A `delegates_to` change says when it moves who work routes to.
- **Run one spec as several rigs:** `rig up <spec> --name <rig>`.
- **Retune a watchdog in place:** `rig watchdog update <jobId> [--interval-seconds n] [--message text] [--spec path]`
-  keeps its id and attachments. The context watch takes `--threshold-tokens` or `--threshold-percent`.
- **Put restore maps where seats may write:** `rig config set policies.claude_compaction.preparation_root <abs path>`.
- **Pick a Herdr session:** `rig terminal open <view> --provider herdr --session <name>`.
- **Close a row with its artifact:** `rig queue update <id> --state done --evidence-ref <path>`.
- **File and read subscription move reports:** `rig provider moves report` and `rig provider moves`. `--host <id>` and
-  `--codex-home <dir>` on `rig auth status|list|switch` and `rig seat restart` act on another machine's Codex home.
- **Route stream observations with typed decisions (opt-in, off by default):** once `decisions.enabled` is true,
-  `decisions.consumers` includes `stream` and the intake seat has `OPENROUTER_API_KEY`, `rig project wake --decide`
-  gives each eligible stream observation one bounded typed decision during that seat's wake: create a row for a supplied
-  owner, join supplied work, or record a duplicate or no action. Anything uncertain, refused or failed goes to the
-  intake seat as its own disposition, and the model isn't asked again. `rig project decisions status` shows the state
-  without making a call. Without `--decide`, or with decisions off, nothing changes; turning decisions off no longer
-  strands an accepted create or join whose effect hadn't landed.
- **Read the stream as a subscriber:** `rig stream subscribe <seat>` (`--tags`, `--type`; re-subscribing keeps the
-  place), then `rig stream read` returns the next bounded page for the calling seat (at most 20 items and 64 KiB, with
-  `more`, `unread` and any `gap`). `rig stream subscriptions` lists readers; `rig stream unsubscribe <seat>` stops one.
-  `rig stream show <id>` says what became of an observation.
- **Keep the kernel to the harnesses you chose:** `rig setup --providers <list>` is now saved as `provider.selected`, and
-  the kernel starts seats only for those.
- **Stop a second daemon on a live database:** `rig config set daemon.db_conflict stop` refuses a start whose database a
-  matching live daemon already holds (the default `warn` only warns). `rig daemon start --allow-db-conflict` allows one
-  deliberate start.
+Section 7 of `docs/reference/harness-runner-contract.md` is the rule for
+permissions, and section 4 for activity. Read them before writing or changing a
+runner.
+- **Typed words:** a reply of just yes or no counts as the agent's allow or
+  reject. Any other words choose nothing: OpenRig's default permits the request
+  when the agent offered an allow option, and the read result carries the words
+  whole as `said`. A runner may queue them for the agent as an ordinary prompt
+  after the current turn, never as the answer; one that drops them still keeps
+  the contract. The ask now tells the person this.
+- **Permit records:** each permit OpenRig decides by default (no one to ask, or
+  an ask closed without a choice, including a row passed to an agent seat) is
+  recorded once, as a stream item from the seat, naming the tool call, why no
+  person answered and the option given. Read them with
+  `rig stream list --tag runner-permission-permit` or `--source <seat>`. A record
+  has no destination and never changes the permit. Stream intake reads past it, so
+  it opens no intake row and wakes no one.
+- **The working beat:** while a prompt is outstanding and the agent is alive, a
+  runner may post `active` / `liveness` so a long call keeps reading working.
+  After delivering an answer or permit, it posts `active` /
+  `permission_resolved`. A runner that sends no beats behaves as before. The Pi
+  runner and the dsh example post it.
+- **Check a runner** with
+  `node daemon/docs/reference/runner-conformance/check-runner.mjs --runner '<command with {agent}>' --name <harness>`.
+  It now covers the beat, and no longer falsely fails a correct runner on a busy
+  machine.
+- **The dsh example** reads `DSH_SEAT_BIN` and `DSH_SEAT_HOME` from the member's
+  `env:`, and section 8 names ACP's `session/resume`.

-## Behaviour that changed
+## OpenShell workers

- **Team skills live in each seat's own storage** (`$OPENRIG_HOME/state/seats/<rig id>/<logical seat>/<runtime>/`), not
-  in the project's `.claude/skills` or `.agents/skills`. Claude seats get them as a generated plugin (`openrig:<id>`),
-  Codex seats as their own catalog. If a link sits in that path, the seat starts without them and the result names
-  what wasn't delivered.
- **Urgent wakes are labelled:** an urgent or critical row's wake starts with `Urgent (marked by …):` at every seat. A
-  seat on `hold` gets one held notice per wake instead of re-nudges, and lifecycle work is refused at the middle levels as
-  at `hold`.
- **A daemon restart picks up a managed compaction where it stopped.** An owed restore step resumes, a `/compact` that
-  may have been sent is never sent again, and `rig compact --state` shows anything stranded or owed.
- **A Claude seat whose startup turn is refused** (an expired login, say) holds the rest of its startup context as owed.
-  A startup input sent before the refusal is noticed can still be submitted (see Known issues in the
-  [0.7.1 release notes](https://github.com/mvschwarz/openrig/releases/tag/v0.7.1)).
- **`rig send` refuses with `target_needs_input`** when a Claude seat's hook has just reported it running and its screen
-  shows an MCP enablement menu, a question or a permission prompt.
- **`rig down` asks before stopping the caller's own rig.** Without a terminal it exits 1, stops nothing and prints the
-  `--yes` command.
- **`rig up --plan` doesn't start a stopped daemon:** it exits 1 with `daemon_not_running` and names `rig daemon start`
-  and `--no-kernel`.
- **`rig daemon start`** waits up to 20 seconds for a slow daemon, and starts with a warning when only a secondary
-  listener, such as Tailscale's, can't be verified.
- **A seat joined with `rig attach` as an outside app** (Claude Desktop) stays attached through `rig down` and restore
-  (`left_attached`). To replace it, `rig unclaim <name>`, then launch.
- **New seats get the daemon's `OPENRIG_DB` and `TMUX_TMPDIR`.**
- **A rebuilt Codex seat keeps its observed permissions,** and a read-only Codex profile launches without OpenRig's
-  writable roots.
- **A seat's own role** goes only to that seat, never into a shared `CLAUDE.md` or `AGENTS.md`, and `rig down` returns
-  guidance files byte for byte.
- **Workflow actions** (`project`, `route`, `resume`, `abort`) record the calling agent; a request with neither identity
-  nor actor gets the shared `actor_required` error.
- **`rig provider moves` is back** for subscription move reports. It switches nothing.
- **`--dangerously-interact` into a seat's input box stops first** when the box already holds typed or pasted text: it
-  shows that text (apart from suggestions) and types nothing. Clear the box and retry, or pass `--type-without-checking`,
-  which clears nothing. Keys for a recognized native menu are sent as before.
- **A terminal seat gets exactly the text sent to it,** without the From/To lines (the result says `envelopeOmitted`).
-  A queue wake to a terminal seat types nothing and fails `failed:terminal-seat`; the row stays queued.
- **A daemon restart that can't see the seats' tmux server** no longer detaches seats whose recorded process still
-  runs, so it doesn't relaunch them beside themselves.
- **Provider credentials and the activity-hook token stay off tmux, shell and `env` command lines** at launch and
-  handover. A launch whose staging fails stops instead of falling back.
- **An answer retried from Slack or Steering** after an interrupted close reuses the first reply and finishes the
-  request once.
- **One bad row no longer stops the stuck sweep** from flagging the others; **a malformed unrelated diagnosis row** no
-  longer stops health diagnoses from listing.
+0.7.9 includes a repair for the OpenShell worker that wasn't usable in 0.7.8,
+but it hasn't run end to end in our release testing. Don't rely on this path in
+0.7.9. Startup now reaches the guest through a hash-checked first-input file,
+and nothing is typed through the host viewer. Readiness checks the guest's own
+execution, and a failed owned delete reports the stage that failed. If you set
+one up anyway, follow `daemon/assets/openshell/README.md` in the installed
+package, rebuild the guest image first, and name the costs to the person
+("Provider registration and image construction can incur costs"). "Never grant
+the guest access to the daemon's main API port (normally 7433)."

-## Output that changed shape
+## Assistants connected through a grant service (experimental)

- **`rig ps --nodes`** separates every cell with one space (the default row is 5 columns wider), adds an `ATTN` column
-  (`yes`, `no` or `?`) before `REASON`, and marks a `running` seat whose tmux couldn't be reached as unconfirmed.
- **`rig queue show --json`** no longer has `lastNudgeInputBox`, and send results no longer describe the input box.
- **`rig queue show` and `rig queue whoami`** print their human notices on stderr, so stdout is the JSON.
- **A claimed row whose owner waits on a person** reads pickup `needs-input`, with the reason.
- **`rig down --json`** adds `leftRunning`; `rig reconcile-session` says whether resume metadata was recorded.
- **`rig compact-plan`** labels its thresholds as its own and says whether automatic compaction is on.
- **A send held for a draft** in the seat's input box reports `inputPhase: "not_reached"`: it was never typed.
- **A stream body over 16 KiB** is stored truncated, ending `[truncated by OpenRig: kept N of M bytes]`, and reads mark it
-  `bodyTruncated`. `rig stream list --after <sortKey>` from a pruned item returns 410 `stream_cursor_expired`, naming
-  `--since` to resume, instead of an empty list.
+Experimental, unsupported, off by default, and at the person's own risk. With
+`rig mcp serve --http --grant-service <url>` and a grant service the person
+supplies and runs, a connected assistant can claim, update and park the rows
+addressed to its own seat, and see its team with `rig_team`, within the scope its
+existing tools have. Nothing wakes it: an item stays queued until its receiver
+claims it. Name the outside service, and the exposure of serving MCP over HTTP,
+to the person before you set this up. `docs/reference/hosted-members.md` is the
+rule.

-## What to stop doing
+## Other changes to act on

- **Don't read `lastNudgeInputBox`.** It's gone.
- **Don't parse `rig ps --nodes` by column position.** Use `--json`, with `--fields` to pick fields.
- **Don't look for a team seat's skills in the project folders.** Use `rig skill loadout --seat`.
- **Don't stop and re-register a watchdog to change it.** Use `rig watchdog update`.
- **Don't take a rig down to fix one edge.** Use `rig edge add` or `remove`.
- **Don't print `OPENRIG_ACTIVITY_*` values** while looking for identity. Use `rig whoami`.
- **Don't use `--dangerously-interact` to type over a half-written input box.** It stops and shows the text; choose
-  explicitly, or use `rig send --urgent` where the seat's interruption level allows it.
+- **Held messages:** a seat that starts, or takes over a seat, with held
+  messages is told how many there are. Read them with
+  `rig seat held-messages <seat>`.
+- **Unconfirmed sends:** `rig send --verify` now reports unconfirmed and exits 1
+  when it can't see what its Enter did, and `rig walk` reports unconfirmed
+  instead of lost. Inspect the recipient before any resend.
+- **Deadlines:** to accept a re-estimate without unclaiming the work, run
+  `rig queue update <id> --closure-required-at <ISO>`.
+- **Shared workspaces:** any registered person can settle another's ask as
+  themselves, and the first committed answer wins; a later answer gets 409
+  `qitem_already_terminal` and records nothing. A person registered with no
+  connector binding is asked on Steering and in the Feed only.
+- **Handover:** a fresh or rebuild successor's first turn lists its startup
+  files, role first. A successor that started without a required startup file is
+  marked in the seat list.
+- **Ambiguous rig names:** when an active rig name matches more than one rig,
+  `rig env down`, `status` and `logs` list the matching rig IDs and stop, and
+  `rig doctor --spec` reports conformance as unknown. Use the rig ID.
+- **Seat activity:** window samples older than their bound no longer decide a
+  seat's activity, so a seat whose pane can't be read reads unknown rather than
+  its last verdict. Treat unknown as unknown, not idle.
+- **Launch options:** `specs.builtins_visible: false` hides built-in specs
+  (`rig specs ls --include-builtins` still lists them); `plugin_channels` gives
+  one Claude member its own `--channels`, untested with a real channel plugin.
+- **Files:** `rig down` removes OpenRig's own additions from a working folder
+  once no live seat uses them. `rig export` with no `-o` writes
+  `rig-export.yaml` beside an existing `rig.yaml`. `rig workspace validate` exits
+  1 for malformed optional frontmatter.
+- **Kernels:** a new default kernel starts in `<workspace.root>/kernel`.
+  Existing kernels stay where they are. `docs/reference/agent-startup-guide.md`
+  explains the optional move; a fresh launch there starts a new native
+  conversation, so ask the person before moving.
+- **PATH:** if preflight warns that a Codex seat's login shell can't find `rig`,
+  follow its fix. `getting-started.md` explains the `~/.profile` line and how to
+  check it with `bash -lc 'command -v node rig'`.

-## Known gaps in 0.7.1
+## Limits to keep in view

- **A new Claude seat's startup text can stay in its input box unsent.** If a fresh Claude seat sits idle with text at
-  its prompt, press Enter in its pane, or ask the person to.
- **Claude seats on a macOS native install can read as needing attention after a restore.** Check the pane before
-  acting on it.
- **A Slack channel-mapping change needs a daemon restart.** Don't use `rig slack disable` then `enable` for it: enabling
-  marks any alerts waiting to post to Slack as already seen.
- **Ubuntu 22.04's tmux 3.2a:** the query known to crash its server is gone, but a narrower race remains. Avoid 3.2a
-  (`tmux -V`).
- **`rig daemon start` can take 20 to 40 seconds** before its listener warning, longer than the TUI's 30-second "restore
-  everything" wait. On a slow host, start the daemon yourself first.
- **A launch that warns "Scoped tmux environment unavailable; retaining the previous environment"** didn't give that seat
-  the clean environment. Check `env` in the seat before relying on OpenRig's variables.
- **Going back to 0.7.0 with a Slack subscription set:** 0.7.0 can't read a person file that holds one, and its people
-  registry stops loading. Save the choice first (`rig gateway human show <id> --json > <id>.json`), then run
-  `rig gateway human set <id> slack-subscription unset` (`urgent-only` becomes every-ask, as on 0.7.0); set it again after
-  returning to 0.7.1. A person file still holding a `subscriptions:` entry fails on 0.7.0 too. Don't restore an older
-  gateway folder or database instead: that can lose newer people, bindings and delivery records.
- **A Herdr tile over SSH** doesn't come back by itself after a Herdr restart. Reopen it with `rig terminal open <view>
-  --provider herdr`.
- **Delegated decisions:** the ask is created before the decision, so without quiet hours it can post to the person
-  first. Pair a decision room with quiet hours, or decide before asking.
- **`restore-check` still treats a missing startup file as rig-wide.** Trust `rig up --existing`'s per-seat result.
- **Managed Claude launch requires `/usr/bin/env` support for `-0` and `-u`** (option support checked on GNU coreutils
-  and macOS 15; BusyBox and older macOS unverified). Without the required option support, launch stops instead of
-  falling back to credential-bearing command-line arguments.
- **In draft-aware mode, an agent's multi-line message to a Claude seat can remain unsubmitted when the paste changes
-  Claude's footer hint.** OpenRig withholds Enter, leaving the text in the composer and later sends waiting. Observed on
-  Claude 2.1.309 with both 0.7.0 and the 0.7.1 pre-cut build; #14 remains open.
- **A Claude seat signed in with a long-lived token (`claude setup-token`) gets no usage reading.** The reader accepts
-  only claude.ai subscription logins and reports `not_subscription_login`.
+- **OpenShell** hasn't run end to end in our release testing (above). A
+  same-generation reconciled launch opens no viewer, so run
+  `rig environment connect` yourself; non-text startup actions aren't supported
+  on environment seats.
+- **Open updates for a person** read a 1,001-row window, so a page can come back
+  short, marked `truncated`.
+- **Slack:** a private channel needs the documented route, which isn't tested,
+  and direct messages aren't supported. The channel and people reads haven't
+  been run against a live Slack workspace. Redaction of the bot token from a
+  transport error can still leave a malformed token fragment shorter than six
+  characters, so review an error before sharing it.
+- **SSH host status** reads `unknown` behind a ProxyJump or ProxyCommand; that
+  isn't proof the connection is broken. `rig host ls` reads the ssh config with
+  `ssh -G`, which runs any `Match exec` command in it.
+- **Shared asks:** a click's option written before its answer row can stand
+  beside or inside the closer's answer without the first clicker's authorship.
+- **Permit records** last as long as stream retention keeps them. A permit a
+  runner makes on its own, when it can't reach OpenRig, is in its pane only. For
+  an ask opened before 0.7.9, a record may omit the option's kind.
+- **Existing seats** pick up Codex launch instructions and the single
+  openrig-core skill load at their next fresh launch. A `CLAUDE.md` or
+  `AGENTS.md` that already grew a line per launch isn't trimmed.
+- **Codex hooks after an upgrade:** Codex sessions kept open across the 0.7.8
+  upgrade showed "Hook failed — plugin contents changed; hook approval
+  required". The 0.7.9 behaviour, and hook recovery after a relaunch, haven't
+  been verified.
+- **0.7.8's limits** on the dsh `env:` names, conformance false failures, typed
+  words, the README's operator address, a symlinked rebuild, the rebuild receipt,
+  a re-parked click and unrecorded default permits are fixed or changed. The
+  other 0.7.8 and 0.7.7 limits below, and the
+  [0.7.6 limits](https://github.com/mvschwarz/openrig/releases/tag/v0.7.6), still
+  apply.
+
+---
+
+## What changed in OpenRig 0.7.8
+
+The changes from 0.7.7 to 0.7.8, published on 2026-11-05, for an install
+upgrading from 0.7.7 or earlier.
+
+### After the upgrade
+
+- **Restart the daemon** to load the new code: `rig daemon stop`, then
+  `rig daemon start`.
+  - **Migrations 142 to 145** store a Claude seat's MCP opt-out, seat activity
+    grants, OpenShell environment bindings and a seat's chosen permission person.
+- **The bundled openrig-core plugin goes from 0.1.23 to 0.1.24.** One skill line
+  changed. Managed refresh preserves replaced files under
+  `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits you still
+  need from the preserved copy.
+
+### Runner seats: a person answers permission requests
+
+Section 7 of `docs/reference/harness-runner-contract.md` is the rule. Read it
+before writing or changing a runner.
+- **Who is asked:**
+  - **the default person** (`rig gateway default`, or the only registered
+    person) gets an ordinary ask in the Feed and on Slack;
+  - **a chosen person,** after
+    `rig seat set-permissions-to <seat> --to <person> --reason "…"`. `--clear`
+    returns to the default;
+  - **no one:** when no one can be asked, the request is "Permitted at once,
+    with the agent's own allow option";
+  - **refusal** is opt-in, with `--deny`. `rig seat status` shows the choice.
+- **What a person's answer does:** a click gives that option, a plain yes gives
+  the allow, and a plain no gives the reject. "A person's no is never a grant."
+  An unanswered request stays pending until the agent's turn ends.
+- **The runner's protocol:**
+  - `POST /api/activity/permission-requests` submits the request;
+  - `GET …/<askId>?waitSeconds=25` reads the answer (25 at most);
+  - `POST …/<askId>/withdraw` withdraws it at the turn's end.
+
+  Deliver an answer once, only to the live request.
+- **Check a runner** with
+  `node daemon/docs/reference/runner-conformance/check-runner.mjs --runner '<command with {agent}>' --name <harness>`
+  from the installed package. It needs Node and tmux, and no daemon, model or
+  network.
+- **The worked example** is the dsh runner under
+  `daemon/docs/reference/community-harness-examples/dsh/`.
+- **A seat activity grant** lets a runner outside the host's hook setup report
+  activity for one seat and launch, without the install-wide hook token.
+
+### OpenShell workers
+
+0.7.8 includes `rig environment` (`setup`, `create`, `attach`) and a reference
+for binding a seat to an NVIDIA OpenShell sandbox (`daemon/assets/openshell/README.md`).
+**In our release testing the worker never became usable:** after the sandbox was
+created and the native process started, `rig environment connect` failed when its
+check timed out after 5 seconds, so no team work ran. Don't rely on this path in
+0.7.8; 0.7.9's repair is described above.
+
+**What it needs:**
+- NVIDIA OpenShell 0.1.6;
+- a Linux image;
+- an API-backed provider using `ANTHROPIC_API_KEY`. Subscription or OAuth
+  credentials aren't supported.
+
+"Provider registration and image construction can incur costs", so name them to
+the person before you start. "Never grant the guest access to the daemon's main
+API port (normally 7433)."
+
+### Other changes to act on
+
+- **Mission following:** `rig terminal open mission:<id> --follow --provider herdr`
+  follows a mission's current owners, with the same Herdr path as slices.
+- **Launch choices:**
+  - `claude_mcp: none` on a Claude member launches it without MCP servers;
+  - `rig config set terminal.tmux_server isolated` gives this OpenRig home its
+    own persistent tmux server.
+- **Hosts:** `rig host edit` and `rig host remove` correct or retire a host
+  entry. Use them instead of editing `hosts.yaml` by hand.
+- **Another user's daemon:** when `rig doctor` warns that the port is held by
+  another OS user's daemon, follow its fix (`rig config set daemon.port <free-port>`),
+  or set `OPENRIG_URL` to share that daemon on purpose.
+- **tmux control mode:** with `OPENRIG_TMUX_CONTROL=1`, OpenRig starts a control
+  client only on tmux 3.7c or newer, and uses spawned clients otherwise.
+- **Read-only tmux clients:** a submit key refused because of one goes through
+  the paste route.
+- **Slack:** a typed reply to a decision parked on its person is recorded as the
+  answer. Read the person's words; don't treat the close as approval.
+- **The TUI:** agent pages now show health findings and recently finished items,
+  and an agent spec's "not loaded in this view" means it wasn't read, not that
+  nothing runs it.
+
+### Limits to keep in view
+
+- **No harness has run end to end under the runner contract yet.** The dsh
+  example and the conformance check were checked against stand-ins.
+- **The answer owner is a registered person,** and a colleague's answer is
+  followed on this host only. A request handed to another host waits as needs
+  input until the turn ends.
+- **Permits and answers aren't recorded** beyond the runner's pane and the ask.
+  If the agent offers only `allow_always`, a permit makes its harness remember a
+  permission nobody chose.
+- **Coming as follow-ups:** recording permits made when no one can be asked, and
+  passing typed words that aren't a plain yes or no to the agent.
+- **The dsh example keeps one hold per seat:** two asks in one turn can leave one
+  waiting after the hold is released.
+- **An OpenShell worker's activity reads unknown,** sampled from the pane, never
+  idle.
+- **The 0.7.7 limits below, and the [0.7.6 limits](https://github.com/mvschwarz/openrig/releases/tag/v0.7.6), still apply.**
+
+---
+
+## What changed in OpenRig 0.7.7
+
+The changes from 0.7.6 to 0.7.7, a reliability patch for 0.7.6, published on
+2026-11-02. All three fixes are in 0.7.8.
+
+### The fixes
+
+- A Claude seat at an empty prompt reads idle again when Claude prints
+  "✔ Update installed · /restart to apply" (or "Restart to apply") below its mode
+  bar after installing an update. Before, that line hid the mode bar, so the seat
+  read unknown and managed compaction waited for an idle prompt it could not see.
+  Both spellings are recognized; lines that only look similar still read unknown.
+  ([#2311](https://github.com/mvschwarz/openrig/pull/2311))
+- Managed compaction checks the input box before it pastes its preparation
+  prompt, `/compact` or a restore prompt, even with the typing guard off. Typed,
+  unreadable or changed input holds that step. A manual `rig compact` then says it
+  stopped to preserve the input box; read `rig compact <seat> --state` and retry
+  once the box is empty. A held restore prompt waits and goes ahead on its own once
+  the box is empty. An empty box or a high-confidence suggestion goes ahead.
+  Ordinary `rig send` and the typing-guard defaults are unchanged.
+  ([#2347](https://github.com/mvschwarz/openrig/pull/2347))
+- A Claude seat whose `claude` is a `#!` wrapper that starts the real Claude without
+  `exec` can be rebuilt again (`rig seat handover --source rebuild`): readiness also
+  accepts the wrapper's direct child when it names this launch's conversation token,
+  and refuses every other process as before. A rebuild that fails no longer leaves
+  the seat's resume target on the new, unprimed conversation.
+  ([#2341](https://github.com/mvschwarz/openrig/issues/2341), [#2354](https://github.com/mvschwarz/openrig/pull/2354))
+
+### Limits to keep in view
+
+- Other reasons managed compaction can wait are unchanged.
+- The input-box check is a read just before the paste, not a lock: typing that
+  starts in the same moment can still be appended to.
+- If a seat's current occupant generation was never registered (an adopted Claude
+  with another generation, or a managed launch whose tenure record failed to write),
+  hooks don't move its resume token after the first one.
+- The [0.7.6 limits](https://github.com/mvschwarz/openrig/releases/tag/v0.7.6) still apply.
@@ -1,12 +1,12 @@
 {
  "name": "openrig",
-  "version": "0.7.1",
+  "version": "0.7.9",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "openrig",
-      "version": "0.7.1",
+      "version": "0.7.9",
      "license": "Apache-2.0",
      "workspaces": [
        "packages/daemon",
@@ -1136,7 +1136,6 @@
      "version": "1.32.2",
      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.2.tgz",
      "integrity": "sha512-SWsVtH/0vULSQStoZ6xxH2K09Li8fXYTMC64ZeogCdpZ3XSi1eCPOByV1OpuJxuI3OcmHhosDWYyii07tpPsLw==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@hono/node-server": "^1.19.9 || ^2.0.5",
@@ -2902,7 +2901,6 @@
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "mime-types": "^3.0.0",
@@ -3125,7 +3123,6 @@
      "version": "2.4.0",
      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz",
      "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "bytes": "^3.1.2",
@@ -3150,7 +3147,6 @@
      "version": "2.1.0",
      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=18"
@@ -3164,7 +3160,6 @@
      "version": "0.7.3",
      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -3226,7 +3221,6 @@
      "version": "3.1.2",
      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
@@ -3246,7 +3240,6 @@
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "es-errors": "^1.3.0",
@@ -3260,7 +3253,6 @@
      "version": "1.0.4",
      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "call-bind-apply-helpers": "^1.0.2",
@@ -3405,7 +3397,6 @@
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
      "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=18"
@@ -3419,7 +3410,6 @@
      "version": "1.0.5",
      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
@@ -3436,7 +3426,6 @@
      "version": "0.7.2",
      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
@@ -3452,7 +3441,6 @@
      "version": "1.2.2",
      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=6.6.0"
@@ -3462,7 +3450,6 @@
      "version": "2.8.6",
      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "object-assign": "^4",
@@ -3480,7 +3467,6 @@
      "version": "7.0.6",
      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "path-key": "^3.1.0",
@@ -3664,7 +3650,6 @@
      "version": "4.4.3",
      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "ms": "^2.1.3"
@@ -3699,7 +3684,6 @@
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
@@ -3745,7 +3729,6 @@
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "call-bind-apply-helpers": "^1.0.1",
@@ -3760,7 +3743,6 @@
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/electron-to-chromium": {
@@ -3773,7 +3755,6 @@
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
@@ -3796,7 +3777,6 @@
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.4"
@@ -3806,7 +3786,6 @@
      "version": "1.3.0",
      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.4"
@@ -3823,7 +3802,6 @@
      "version": "1.1.2",
      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "es-errors": "^1.3.0"
@@ -3887,7 +3865,6 @@
      "version": "1.0.3",
      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/estree-walker": {
@@ -3904,7 +3881,6 @@
      "version": "1.8.1",
      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
@@ -3914,7 +3890,6 @@
      "version": "3.0.7",
      "resolved": "https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz",
      "integrity": "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "eventsource-parser": "^3.0.1"
@@ -3927,7 +3902,6 @@
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.1.1.tgz",
      "integrity": "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=18.0.0"
@@ -3947,7 +3921,6 @@
      "version": "5.3.0",
      "resolved": "https://registry.npmjs.org/express/-/express-5.3.0.tgz",
      "integrity": "sha512-qCqy1xSoaugxOD4IVHb1ZWdkvCF2W3aE2okKouWj8VwJ+ztskSiXoBnCSJqfKT+cVPJhuJqe9YLbY425+Zh00g==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "accepts": "^2.0.0",
@@ -3991,7 +3964,6 @@
      "version": "8.7.1",
      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.1.tgz",
      "integrity": "sha512-2FXbqkygil3mZiXzEtM0IjE/UBmBNot0J1GEVrJT4JbrvwOSoEtqtO+wHbiMQELWe1eNvHoYRg2dkjOid+6JkA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "debug": "^4.4.3",
@@ -4011,7 +3983,6 @@
      "version": "2.1.0",
      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=18"
@@ -4113,7 +4084,6 @@
      "version": "2.1.1",
      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "debug": "^4.4.0",
@@ -4135,7 +4105,6 @@
      "version": "0.2.0",
      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
@@ -4158,7 +4127,6 @@
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
@@ -4213,7 +4181,6 @@
      "version": "1.3.0",
      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "call-bind-apply-helpers": "^1.0.2",
@@ -4247,7 +4214,6 @@
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "dunder-proto": "^1.0.1",
@@ -4286,7 +4252,6 @@
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.4"
@@ -4308,7 +4273,6 @@
      "version": "1.1.0",
      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.4"
@@ -4355,7 +4319,6 @@
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "depd": "~2.0.0",
@@ -4427,14 +4390,12 @@
      "version": "2.0.4",
      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true,
      "license": "ISC"
    },
    "node_modules/ip-address": {
      "version": "10.7.5",
      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.5.tgz",
      "integrity": "sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 12"
@@ -4444,7 +4405,6 @@
      "version": "1.9.1",
      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.10"
@@ -4518,7 +4478,6 @@
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/isbot": {
@@ -4534,7 +4493,6 @@
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "dev": true,
      "license": "ISC"
    },
    "node_modules/jiti": {
@@ -4550,7 +4508,6 @@
      "version": "6.2.2",
      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.2.tgz",
      "integrity": "sha512-d7kPDd34KO/YnzaDOlikGpOurfF0ByC2sEV4cANCtdqLlTfBlw2p14O/5d/zv40gJPbIQxfES3nSx1/oYNyuZQ==",
-      "dev": true,
      "license": "MIT",
      "funding": {
        "url": "https://github.com/sponsors/panva"
@@ -4626,7 +4583,6 @@
      "version": "8.0.2",
      "resolved": "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz",
      "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
-      "dev": true,
      "license": "BSD-2-Clause"
    },
    "node_modules/json5": {
@@ -4723,7 +4679,6 @@
      "version": "1.1.0",
      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.4"
@@ -4733,7 +4688,6 @@
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz",
      "integrity": "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
@@ -4747,7 +4701,6 @@
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=18"
@@ -4794,7 +4747,6 @@
      "version": "1.54.0",
      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
@@ -4804,7 +4756,6 @@
      "version": "3.0.2",
      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "mime-db": "^1.54.0"
@@ -4852,7 +4803,6 @@
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/mz": {
@@ -4888,7 +4838,6 @@
      "version": "1.1.0",
      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.1.0.tgz",
      "integrity": "sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "content-type": "^2.1.0"
@@ -4905,7 +4854,6 @@
      "version": "2.1.0",
      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=18"
@@ -4968,7 +4916,6 @@
      "version": "1.13.4",
      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.4"
@@ -4981,7 +4928,6 @@
      "version": "2.4.2",
      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.2.tgz",
      "integrity": "sha512-ATWUv387i+nLD49EiDoOft5scf32Vsdz3ktrQJG9bi7jRFmaXTssvyvj1EmeKVVgvesbqUtvQQvaS2TpTukAZQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "ee-first": "1.1.1"
@@ -4998,7 +4944,6 @@
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "dev": true,
      "license": "ISC",
      "dependencies": {
        "wrappy": "1"
@@ -5021,7 +4966,6 @@
      "version": "1.3.3",
      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
@@ -5031,7 +4975,6 @@
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=8"
@@ -5047,7 +4990,6 @@
      "version": "8.4.2",
      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
      "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
-      "dev": true,
      "license": "MIT",
      "funding": {
        "type": "opencollective",
@@ -5111,7 +5053,6 @@
      "version": "5.0.1",
      "resolved": "https://registry.npmjs.org/pkce-challenge/-/pkce-challenge-5.0.1.tgz",
      "integrity": "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=16.20.0"
@@ -5293,7 +5234,6 @@
      "version": "2.0.8",
      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "forwarded": "0.2.0",
@@ -5321,7 +5261,6 @@
      "version": "6.16.1",
      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
      "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
-      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
        "es-define-property": "^1.0.1",
@@ -5358,7 +5297,6 @@
      "version": "1.3.0",
      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
      "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
@@ -5372,7 +5310,6 @@
      "version": "3.0.2",
      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "bytes": "~3.1.2",
@@ -5388,7 +5325,6 @@
      "version": "0.7.3",
      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -5654,7 +5590,6 @@
      "version": "2.2.0",
      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "debug": "^4.4.0",
@@ -5701,7 +5636,6 @@
      "version": "2.1.2",
      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/saxes": {
@@ -5737,7 +5671,6 @@
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "debug": "^4.4.3",
@@ -5785,7 +5718,6 @@
      "version": "2.2.1",
      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "encodeurl": "^2.0.0",
@@ -5805,14 +5737,12 @@
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
-      "dev": true,
      "license": "ISC"
    },
    "node_modules/shebang-command": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "shebang-regex": "^3.0.0"
@@ -5825,7 +5755,6 @@
      "version": "3.0.0",
      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=8"
@@ -5835,7 +5764,6 @@
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "es-errors": "^1.3.0",
@@ -5855,7 +5783,6 @@
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "es-errors": "^1.3.0",
@@ -5872,7 +5799,6 @@
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "call-bound": "^1.0.2",
@@ -5891,7 +5817,6 @@
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "call-bound": "^1.0.2",
@@ -5946,7 +5871,6 @@
      "version": "2.0.2",
      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
@@ -6246,7 +6170,6 @@
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=0.6"
@@ -6314,7 +6237,6 @@
      "version": "2.1.0",
      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "content-type": "^2.0.0",
@@ -6333,7 +6255,6 @@
      "version": "2.1.0",
      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=18"
@@ -6377,7 +6298,6 @@
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
@@ -6475,7 +6395,6 @@
      "version": "1.1.2",
      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
@@ -7201,7 +7120,6 @@
      "version": "2.0.2",
      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "dev": true,
      "license": "ISC",
      "dependencies": {
        "isexe": "^2.0.0"
@@ -7234,7 +7152,6 @@
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "dev": true,
      "license": "ISC"
    },
    "node_modules/ws": {
@@ -7310,7 +7227,6 @@
      "version": "3.25.2",
      "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz",
      "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==",
-      "dev": true,
      "license": "ISC",
      "peerDependencies": {
        "zod": "^3.25.28 || ^4"
@@ -7346,13 +7262,14 @@
    },
    "packages/cli": {
      "name": "@openrig/cli",
-      "version": "0.7.1",
+      "version": "0.7.9",
      "hasInstallScript": true,
      "license": "Apache-2.0",
      "dependencies": {
        "@hono/node-server": "^1.13.0",
        "@hono/node-ws": "^1.3.1",
        "@modelcontextprotocol/node": "^2.1.2",
+        "@modelcontextprotocol/sdk": "^1.32.2",
        "@modelcontextprotocol/server": "^2.4.0",
        "ajv": "^8.18.0",
        "ajv-formats": "^3.0.1",
@@ -7373,7 +7290,6 @@
      },
      "devDependencies": {
        "@modelcontextprotocol/client": "^2.4.0",
-        "@modelcontextprotocol/sdk": "^1.32.2",
        "@types/node": "^22.0.0",
        "typescript": "^5.7.0",
        "vitest": "^3.0.0"
@@ -7384,7 +7300,7 @@
    },
    "packages/daemon": {
      "name": "@openrig/daemon",
-      "version": "0.7.1",
+      "version": "0.7.9",
      "license": "Apache-2.0",
      "dependencies": {
        "@hono/node-server": "^1.13.0",
@@ -7426,7 +7342,7 @@
    },
    "packages/ui": {
      "name": "@openrig/ui",
-      "version": "0.7.1",
+      "version": "0.7.9",
      "license": "Apache-2.0",
      "dependencies": {
        "@fontsource-variable/jetbrains-mono": "^5.2.8",
@@ -1,6 +1,6 @@
 {
  "name": "openrig",
-  "version": "0.7.1",
+  "version": "0.7.9",
  "private": true,
  "license": "Apache-2.0",
  "type": "module",
@@ -1,6 +1,6 @@
 {
  "name": "@openrig/cli",
-  "version": "0.7.1",
+  "version": "0.7.9",
  "type": "module",
  "description": "Build your own network of agents from Claude Code, Codex and Pi: persistent teams with roles, shared context and owned work.",
  "keywords": [
@@ -48,6 +48,7 @@
    "@hono/node-server": "^1.13.0",
    "@hono/node-ws": "^1.3.1",
    "@modelcontextprotocol/node": "^2.1.2",
+    "@modelcontextprotocol/sdk": "^1.32.2",
    "@modelcontextprotocol/server": "^2.4.0",
    "ajv": "^8.18.0",
    "ajv-formats": "^3.0.1",
@@ -64,7 +65,6 @@
  },
  "devDependencies": {
    "@modelcontextprotocol/client": "^2.4.0",
-    "@modelcontextprotocol/sdk": "^1.32.2",
    "@types/node": "^22.0.0",
    "typescript": "^5.7.0",
    "vitest": "^3.0.0"
@@ -179,7 +179,11 @@ export async function runAcpAssignment(queue: AcpQueue, options: AcpRunOptions):
      if (turnOver || cancelRequestedAt) return;
      cancelRequestedAt = new Date().toISOString();
      peer.notify("session/cancel", { sessionId });
-      await queue.update(row.qitemId, { note: `ACP run ${options.runId}: cancel requested at ${cancelRequestedAt}; upstream inference and spend are unknown unless the provider shows them` });
+      try {
+        await queue.update(row.qitemId, { note: `ACP run ${options.runId}: cancel requested at ${cancelRequestedAt}; upstream inference and spend are unknown unless the provider shows them` });
+      } catch (error) {
+        console.error(`[rig acp] could not record the cancel request: ${String(error)}`);
+      }
    });
    // A detach settles the turn here even when the agent keeps its stdout open after stdin closes.
    const detached = new Promise<never>((_, reject) => {
@@ -62,3 +62,16 @@ export function writeTextAtomically(path: string, content: string, label = "file
    if (owned) try { unlinkSync(temporary); } catch { /* Renamed or already removed. */ }
  }
 }
+
+/** Create a file, failing with EEXIST rather than replacing anything already at the path, even a dangling link. */
+export function writeNewText(path: string, content: string): void {
+  const fd = openSync(path, "wx", 0o666);
+  try {
+    writeFileSync(fd, content, "utf-8");
+  } catch (error) {
+    try { unlinkSync(path); } catch { /* Report the write failure. */ }
+    throw error;
+  } finally {
+    closeSync(fd);
+  }
+}
@@ -188,6 +188,29 @@ export class DaemonClient {
  private readonly sessionName?: string;
  private readonly principal?: DaemonClientOptions["principal"];

+  /** Isolated terminal tools require this home's durable identity, even on loopback. */
+  async isLocalInstance(): Promise<boolean> {
+    if (this.remoteTarget) return false;
+    const origin = (await import("./local-origin.js")).readLocalOrigin();
+    return !!origin && await this.matchesInstanceIdentity(origin);
+  }
+
+  private async matchesInstanceIdentity(origin: string): Promise<boolean> {
+    const controller = new AbortController();
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try {
+      const target = await Promise.race([
+        (async () => {
+          const res = await this.fetchImpl(`${this.baseUrl.replace(/\/+$/, "")}/healthz`, { signal: controller.signal });
+          return res.ok ? (await res.json() as { selfHostId?: unknown }).selfHostId : undefined;
+        })(),
+        new Promise<undefined>(resolve => { timer = setTimeout(() => resolve(undefined), Math.min(this.timeoutMs, 1000)); }),
+      ]);
+      return target === origin;
+    } catch { return false; }
+    finally { clearTimeout(timer); controller.abort(); }
+  }
+
  private async identityHeaders(): Promise<Record<string, string>> {
    const { headers, local } = await this.senderHeaders();
    // Only beside a seat this client was built for, and only to this host's own daemon: the endpoint itself must answer
@@ -11,7 +11,7 @@ function shellQuote(value: string): string {
  return `'${value.replace(/'/g, `'\\''`)}'`;
 }

-const defaultTmuxExec: TmuxExecFn = (cmd: string) => execSync(cmd, { encoding: "utf-8" }).trim();
+const defaultTmuxExec: TmuxExecFn = (cmd: string) => execSync(cmd, { encoding: "utf-8" }).replace(/\r?\n$/, "");

 // tmux writes a control character in its output as "_", so a newline between fields can't separate them, and a
 // session name may hold spaces or underscores. Ask for the two fixed-shape ids first; the rest of the line is the name.
@@ -20,7 +20,7 @@ const TMUX_CONTEXT_LINE = /^(%\d+) (@\d+) (.+)$/;

 export function resolveAttachContext(tmuxExec: TmuxExecFn = defaultTmuxExec):
  | { attachmentType: "external_cli" }
-  | { attachmentType: "tmux"; tmuxSession: string; tmuxWindow?: string; tmuxPane: string } {
+  | { attachmentType: "tmux"; tmuxSession: string; tmuxWindow?: string; tmuxPane: string; tmuxSocketPath?: string } {
  const tmuxPane = process.env["TMUX_PANE"];
  if (!tmuxPane) {
    return { attachmentType: "external_cli" };
@@ -31,7 +31,11 @@ export function resolveAttachContext(tmuxExec: TmuxExecFn = defaultTmuxExec):
    const match = TMUX_CONTEXT_LINE.exec(output.trim());
    if (match) {
      const [, resolvedPane, tmuxWindow, tmuxSession] = match;
-      return { attachmentType: "tmux", tmuxSession: tmuxSession!, tmuxWindow, tmuxPane: resolvedPane! };
+      // Read the socket separately: tmux replaces control-character delimiters,
+      // and session names and socket paths may both contain literal spaces.
+      const tmuxSocketPath = tmuxExec(`tmux display-message -p -t ${shellQuote(resolvedPane!)} '#{socket_path}'`).replace(/\r?\n$/, "");
+      return { attachmentType: "tmux", tmuxSession: tmuxSession!, tmuxWindow, tmuxPane: resolvedPane!,
+        ...(tmuxSocketPath ? { tmuxSocketPath } : {}) };
    }
  } catch {
    // Fall back to external_cli if tmux metadata cannot be resolved.
@@ -120,6 +124,7 @@ export function attachCommand(depsOverride?: StatusDeps): Command {
        body["tmuxSession"] = attachContext.tmuxSession;
        if (attachContext.tmuxWindow) body["tmuxWindow"] = attachContext.tmuxWindow;
        body["tmuxPane"] = attachContext.tmuxPane;
+        if (attachContext.tmuxSocketPath) body["tmuxSocketPath"] = attachContext.tmuxSocketPath;
      }
      if (opts.displayName) body["displayName"] = opts.displayName;

@@ -227,7 +227,8 @@ function renderBroadcastResults(data: Record<string, unknown>): void {
    if (r.ok) {
      console.log(`${r.sessionName}: sent`);
    } else {
-      console.log(`${r.sessionName}: FAILED — ${r.error ?? "unknown error"}`);
+      // A target that resolved to no sessions has no name to report.
+      console.log(`${r.sessionName ? `${r.sessionName}: ` : ""}FAILED — ${r.error ?? "unknown error"}`);
    }
    if (typeof r.managedCompaction?.notice === "string") console.log(`Notice: ${r.managedCompaction.notice}`);
  }
@@ -52,10 +52,13 @@ from --state, asking it to skip reading if it did not compact; a retry would com
 An explicit retry still waits for the live pane to be idle; no automatic retry follows
 cancellation. --skip-map skips only the map requirement for this one
 manual request. Cancel an active preparation before retrying or using --skip-map.
-Automatic preparation waits at most 25 minutes from prep delivery, using existing
-polls. A stopped attempt does not restart automatically; rerun this command to
-start a fresh attempt. Cancellation disarms future input; it cannot undo a command
-already submitted. Raw provider /compact and normal messages are unchanged.`);
+Automatic preparation allows 25 minutes from prep delivery for the map. A completed
+map stays armed for idle through the next retry interval (10 minutes by default),
+without another preparation prompt; --state includes idleDeadlineAt. A completed
+map that never reaches idle reports map_complete_seat_never_idle; an unfinished
+map reports preparation_incomplete. Manual requests still share one 180-second budget.
+Stopped attempts may retry automatically after the cooldown; cancellation does not.
+Cancellation disarms future input; it cannot undo a command already submitted. Raw provider /compact and normal messages are unchanged.`);

  const getDepsF = (): CompactDeps => depsOverride ?? {
    lifecycleDeps: realDeps(),
@@ -11,7 +11,7 @@ function summarizeSettings(store: ConfigStore): Record<ValidKey, ResolvedSetting
 }

 // These settings remain boot-only; capture interval/line settings reload live.
-const BOOT_ONLY_KEYS = ["daemon.port", "daemon.host", "daemon.db_conflict", "db.path"];
+const BOOT_ONLY_KEYS = ["daemon.port", "daemon.host", "daemon.db_conflict", "db.path", "terminal.tmux_server"];
 const BOOT_ONLY_PREFIXES = ["transcripts.enabled", "transcripts.path"];

 function isBootOnlyKey(key: string): boolean {
@@ -69,6 +69,7 @@ Keys:
  topology.root          the topology tree root (instance altitude at its top; default $OPENRIG_HOME/topology)
  context.root           addressable context library for 'rig context add' (default $OPENRIG_HOME/context)
  context.system_world   default System World, replacement manifest path, or disabled
+  specs.builtins_visible show built-ins in spec inventory (default true)
  skills.root            versioned skill catalog (default $OPENRIG_HOME/skills)
  skills.router_line.enabled  the person's yes to the seat-skills line (one line plus OpenRig's markers) in AGENTS.md / CLAUDE.md (default false)
  onboarding.default_pack.enabled  deliver the two-part fresh-seat mental-model pack (default on)
@@ -96,8 +97,10 @@ Keys:
                         wake_retry_interval_seconds, wake_retry_cap, wake_unconfirmed_window_minutes,
                         wake_swap_grace_seconds (S01 wake-or-escalate ladder),
                         wake_human_rung (always | explicit-only — post agent-to-agent escalations to a person;
-                           under explicit-only, an ask that needs a person must be addressed to the person;
-                           without a human registry, explicit-only posts everything, as always does)
+                           explicit-only posts rows addressed to a person; other agent work stays visible,
+                           permission prompts still reach a person,
+                           choice prompts follow this setting; unavailable human delivery stays a visible row;
+                           an unreadable registry does not suppress eligibility; delivery still needs a ready route)
  retention.*            enabled, transitions_days, watchdog_days,
                         watchdog_keep_per_job, batch_size
  launch.non_interruptive  accept harness first-launch warnings at full bypass for new rigs (default off)
@@ -106,6 +109,7 @@ Keys:
                         Turn on for custom setups that intentionally rely on tmux globals. Running agents are unchanged.
                         If the scoped boundary is unavailable, launch continues with its previous environment and a diagnostic.
  terminal.status_bar    show the inner tmux status bar on launch (default off)
+  terminal.tmux_server   inherit the launching server, or isolated per OpenRig home (restart required)
  terminal.history_limit rows of tmux scrollback per pane in the ~/.tmux.conf block rig setup writes (2000-1000000; default 10000).
                         To keep more: rig config set terminal.history_limit 50000, then rig setup. A running tmux server keeps
                         its old limit until it restarts or you run tmux source-file ~/.tmux.conf; before tmux 3.7 that changes new panes only
@@ -193,6 +197,7 @@ Precedence: CLI flag > environment variable > config file > default`)
        // SWEEP-c: boot-only key + running daemon = stale-until-restart; say so loudly.
        if (isBootOnlyKey(key) && (await probeDaemonRunning())) {
          console.error(`note: '${key}' is read at daemon BOOT — the running daemon keeps its current value; this takes effect on the next daemon restart (rig daemon stop && rig daemon start).`);
+          if (key === "terminal.tmux_server") console.error("note: surviving sessions keep their previous server until deliberately stopped; rig terminal status shows the effective selection and any pending migration.");
        }
      } catch (err) {
        console.error((err as Error).message);
@@ -194,6 +194,7 @@ async function installPackFromUrl(
    // Re-validate the on-disk staged pack, then publish atomically.
    validateContextPackManifestForInstall(join(staging, "manifest.yaml"));
    assertTreeHasNoSymlinks(staging);
+    mkdirSync(dirname(targetDir), { recursive: true });
    renameSync(staging, targetDir);
    return { targetDir, installName };
  } catch (err) {
@@ -345,13 +345,19 @@ export function daemonCommand(depsOverride?: LifecycleDeps): Command {
          console.log("Daemon PID is absent (stale state)");
          break;
        case "unverified":
+          // T2: a live start reservation names a launch in progress (listener not up yet).
+          if (status.startPending) {
+            const since = status.startPending.since ? ` since ${status.startPending.since}` : "";
+            console.log(`Daemon starting: launch reserved by pid ${status.startPending.pid}${since}; not listening yet`);
+          }
          // 1ae863d2 — C3 semantics: we could NOT confirm up or down; never claim stopped.
          if (status.siblingHint) {
            console.log("Daemon state UNVERIFIED — the resolved OPENRIG_HOME has no daemon state, but a live daemon appears under a sibling home:");
            console.log(`  resolved: ${status.siblingHint.resolvedHome}`);
            console.log(`  sibling:  ${status.siblingHint.siblingHome}`);
            console.log("  Fix: point OPENRIG_HOME at the right home (or check your shell env) — this CLI is likely resolving the wrong home.");
-          } else {
+          } else if (!status.startPending) {
+            // A pending start's probe was refused, not inconclusive; its line above says what is known.
            console.log("Daemon state UNVERIFIED — the probe timed out or was inconclusive (this is NOT evidence the daemon is down).");
            console.log("  Re-check with: rig daemon status  ·  direct: curl the daemon /healthz");
          }
@@ -18,6 +18,7 @@ import {
  type DestroyScope,
 } from "../destroy-helpers.js";
 import { stopDaemon } from "../daemon-lifecycle.js";
+import { readRecordedTmuxServerArgs } from "../tmux-attachment.js";

 export interface DestroyCommandDeps {
  configStore: Pick<ConfigStore, "resolve">;
@@ -116,6 +117,7 @@ function realDestroyDeps(): DestroyDeps {
    removePath: (targetPath: string) => rmSync(targetPath, { recursive: true, force: true }),
    mkdirp: (targetPath: string) => mkdirSync(targetPath, { recursive: true }),
    listManagedTmuxSessions: listManagedTmuxSessionsFromDb,
+    resolveTmuxServerArgs: readRecordedTmuxServerArgs,
    killTmuxSession: killTmuxSessionWithCli,
    sleep: (ms: number) => new Promise((resolve) => setTimeout(resolve, ms)),
    now: () => new Date(),
@@ -18,6 +18,7 @@ import { parse as parseYaml } from "yaml";
 import { compareSpecToLive, topologyFromRigSpec, topologyFromLiveLogicalIds } from "@openrig/daemon/spec-conformance";
 import { classifyNodeVersion } from "../node-support.js";
 import { checkProviderReadiness } from "../provider-auth.js";
+import { getOpenRigHome, readOpenRigUrl } from "../openrig-compat.js";

 interface DoctorCheck {
  name: string;
@@ -40,7 +41,12 @@ export interface DoctorDeps {
  env?: NodeJS.ProcessEnv;
  mkdirp?: (path: string) => void;
  checkWritable?: (path: string) => void;
-  fetch?: (url: string) => Promise<{ ok: boolean; json?: () => Promise<unknown> }>;
+  fetch?: (url: string, init?: { signal?: AbortSignal }) => Promise<{ ok: boolean; json?: () => Promise<unknown> }>;
+  /** The caller's effective user id, compared with the one the port's daemon reports. Absent: this process's own;
+   *  null: this platform has none. */
+  callerUid?: number | null;
+  /** How long each part of the port's /healthz response may take (default 2000 ms). */
+  ownerReportTimeoutMs?: number;
  /**
   * Build B — path to a rig spec to check against the RUNNING rig of the same name (`--spec`).
   *
@@ -57,6 +63,71 @@ export interface DoctorDeps {
 const DEFAULT_PORT = 7433;
 const CMUX_SOCKET_CONTROL_FIX = 'In cmux Settings > Automation, select "Automation mode" for Socket Control Mode, or set automation.socketControlMode to "automation" in ~/.config/cmux/cmux.json (older versions use ~/.config/cmux/settings.json; current cmux reads that legacy file only for keys absent from cmux.json). cmux reloads saved settings automatically; rerun `rig doctor` to re-probe without restarting the daemon.';

+/** The port's OpenRig daemon, judged by the OS user it reports. /healthz's pid and euid are the daemon's own report,
+ *  not authentication, and every line says so. Another user's daemon warns, since a share set up through config alone
+ *  looks the same and must keep working; it passes when OPENRIG_URL selects this endpoint on purpose. An owner that can't
+ *  be compared, or a body that doesn't arrive in time, warns too. Nothing is stopped or refused here. */
+async function listenerOwnerCheck(where: string, base: string, res: { json?: () => Promise<unknown> }, release: () => void,
+  deps: DoctorDeps): Promise<DoctorCheck> {
+  const env = deps.env ?? process.env;
+  const at = `Port ${where} (${base}, OpenRig home ${getOpenRigHome(env)})`;
+  const callerUid = deps.callerUid === undefined ? process.geteuid?.() : deps.callerUid ?? undefined;
+  const boundMs = deps.ownerReportTimeoutMs ?? 2000;
+  let reported: { pid?: unknown; euid?: unknown } = {};
+  let late = false;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const read = res.json ? res.json() : Promise.resolve(null);
+    // Releasing the request after the bound rejects the abandoned read; that's expected, not an error.
+    read.catch(() => {});
+    const body: unknown = await Promise.race([
+      read,
+      new Promise<null>(resolve => { timer = setTimeout(() => { late = true; resolve(null); }, boundMs); }),
+    ]);
+    if (body && typeof body === "object") reported = body as { pid?: unknown; euid?: unknown };
+  } catch { /* no readable body: the owner stays unknown */ }
+  finally { clearTimeout(timer); release(); }
+  const pid = Number.isSafeInteger(reported.pid) && (reported.pid as number) > 0 ? `, pid ${reported.pid as number}` : "";
+  const euid = Number.isSafeInteger(reported.euid) && (reported.euid as number) >= 0 ? reported.euid as number : undefined;
+  const ownDaemon = "To run your own, give this OpenRig home a free port and start its daemon there: rig config set daemon.port <free-port>, then rig daemon start.";
+  if (euid === undefined || callerUid === undefined) {
+    return {
+      name: "port", status: "warn",
+      message: `${at} is in use by an OpenRig daemon whose OS user is unknown.`,
+      reason: late
+        ? `Its /healthz report didn't finish within ${boundMs / 1000} s, so doctor can't tell whether it's yours or another user's on this machine.`
+        : euid === undefined
+          ? "It doesn't report an effective user id, so doctor can't tell whether it's yours or another user's on this machine."
+          : "This platform has no effective user id to compare, so doctor can't tell whether it's yours.",
+      fix: `Check that it's yours with rig daemon status. ${ownDaemon}`,
+    };
+  }
+  const reports = `the endpoint reports euid ${euid}${pid}`;
+  if (euid === callerUid) return { name: "port", status: "pass", message: `${at} is in use by your OpenRig daemon: ${reports}, the same as yours.` };
+  const users = `another OS user: ${reports}; your euid is ${callerUid}`;
+  if (sameEndpoint(readOpenRigUrl(env), base)) {
+    return { name: "port", status: "pass", message: `${at} is the endpoint OPENRIG_URL selects, served by an OpenRig daemon of ${users}.` };
+  }
+  return {
+    name: "port", status: "warn",
+    message: `${at} is in use by an OpenRig daemon of ${users}.`,
+    reason: `It isn't this OpenRig home's daemon, unless that user shares it with you: a command that reaches ${base} acts in that user's OpenRig. The pid and euid are the daemon's own report on /healthz, a self-report rather than authentication.`,
+    fix: `${ownDaemon} To use a shared daemon on purpose, set OPENRIG_URL to its address.`,
+  };
+}
+
+/** Whether OPENRIG_URL names this endpoint: the same scheme, host and port, with localhost read as 127.0.0.1. */
+function sameEndpoint(url: string | undefined, base: string): boolean {
+  if (!url) return false;
+  try {
+    const [a, b] = [new URL(url), new URL(base)];
+    const host = (u: URL) => u.hostname === "localhost" ? "127.0.0.1" : u.hostname;
+    return a.protocol === b.protocol && a.port === b.port && host(a) === host(b);
+  } catch {
+    return url === base;
+  }
+}
+
 function defaultCheckPort(port: number, host: string): Promise<boolean> {
  return new Promise((resolve) => {
    const socket = new net.Socket();
@@ -230,17 +301,32 @@ export function runDoctorChecks(deps: DoctorDeps, providerChecks: DoctorCheck[]
  const daemonPort = config.daemon.port ?? DEFAULT_PORT;
  const daemonBase = `http://${formatDaemonHostForUrl(daemonHost)}:${daemonPort}`;
  const fetchFn = deps.fetch ?? globalThis.fetch;
+  const healthHeaders = async (controller: AbortController) => {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try {
+      return await Promise.race([
+        fetchFn(`${daemonBase}/healthz`, { signal: controller.signal }),
+        new Promise<null>(resolve => { timer = setTimeout(() => { resolve(null); controller.abort(); }, deps.ownerReportTimeoutMs ?? 2000); }),
+      ]);
+    } finally { clearTimeout(timer); }
+  };
  const portCheck = deps.checkPort(daemonPort, daemonHost).then(async (available): Promise<DoctorCheck> => {
    if (available) {
      return { name: "port", status: "pass", message: `Port ${daemonHost}:${daemonPort} available.` };
    }
-    // Port in use — check if it's our daemon via healthz
+    // Port in use — check if it's an OpenRig daemon via healthz, and whose.
+    const owner = new AbortController();
    try {
-      const res = await fetchFn(`${daemonBase}/healthz`);
-      if (res.ok) {
-        return { name: "port", status: "pass", message: `Port ${daemonHost}:${daemonPort} in use by OpenRig daemon.` };
-      }
+      const res = await healthHeaders(owner);
+      if (!res) return {
+        name: "port", status: "warn",
+        message: `Port ${daemonHost}:${daemonPort} is in use by an unknown listener.`,
+        reason: "Its /healthz response headers did not arrive in time, so doctor cannot identify it.",
+        fix: `Check the listener on port ${daemonPort} or configure a free port for the daemon.`,
+      };
+      if (res.ok) return await listenerOwnerCheck(`${daemonHost}:${daemonPort}`, daemonBase, res, () => owner.abort(), deps);
    } catch { /* not our daemon */ }
+    finally { owner.abort(); }
    return {
      name: "port",
      status: "fail",
@@ -254,14 +340,15 @@ export function runDoctorChecks(deps: DoctorDeps, providerChecks: DoctorCheck[]
  const asyncChecks: Promise<DoctorCheck>[] = [portCheck];
  if (shellCmuxPassed) {
    const daemonCmuxCheck = (async (): Promise<DoctorCheck> => {
+      const health = new AbortController();
      try {
-        const healthRes = await fetchFn(`${daemonBase}/healthz`);
-        if (!healthRes.ok) {
+        const healthRes = await healthHeaders(health);
+        if (!healthRes?.ok) {
          return { name: "cmux_daemon", status: "skipped", message: "Daemon healthz not ok. Skipping daemon cmux check." };
        }
      } catch {
        return { name: "cmux_daemon", status: "skipped", message: "Daemon not reachable. Skipping daemon cmux check." };
-      }
+      } finally { health.abort(); }

      try {
        const cmuxRes = await fetchFn(`${daemonBase}/api/adapters/cmux/status`);
@@ -327,6 +414,12 @@ async function buildSpecConformanceCheck(deps: DoctorDeps): Promise<DoctorCheck>
  let liveIds: string[] | null;
  try { liveIds = deps.fetchLiveLogicalIds ? await deps.fetchLiveLogicalIds(rigName) : null; }
  catch (error) {
+    if (error instanceof AmbiguousLiveRigError) return {
+      name, status: "skipped",
+      message: `Multiple live rigs match '${rigName}': ${error.ids.join(", ")}; conformance unknown.`,
+      reason: "The spec name does not identify one live rig, so no topology was compared.",
+      fix: "Inspect the matching rig IDs with rig ps --json; use rig ps --nodes -A --json to inspect nodes.",
+    };
    if (error instanceof ForeignLocalDaemonError) return { name, status: "fail", message: error.message };
    throw error;
  }
@@ -411,6 +504,10 @@ function readTmuxMouseMode(deps: DoctorDeps): "on" | "off" | null {
  }
 }

+class AmbiguousLiveRigError extends Error {
+  constructor(readonly ids: string[]) { super("Multiple live rigs share the spec name"); }
+}
+
 /** Raw topology reads retain their existing headers; the owner policy is shared with the client. */
 export async function readLiveLogicalIds(base: string, rigName: string, ownerClient = new DaemonClient(base)): Promise<string[] | null> {
  try {
@@ -418,7 +515,10 @@ export async function readLiveLogicalIds(base: string, rigName: string, ownerCli
    const rigsRes = await fetch(`${base}/api/rigs`);
    if (!rigsRes.ok) return null;
    const rigs = (await rigsRes.json()) as Array<{ id?: string; name?: string }>;
-    const rig = rigs.find((r) => r.name === rigName);
+    const matches = rigs.filter((r) => r.name === rigName);
+    if (matches.length > 1) throw new AmbiguousLiveRigError(matches.map(r => r.id ?? "(missing id)"));
+    if (matches.length === 0) return null;
+    const rig = matches[0];
    if (!rig?.id) return null;
    await ownerClient.assertLocalOwner();
    const nodesRes = await fetch(`${base}/api/rigs/${rig.id}/nodes`);
@@ -426,7 +526,7 @@ export async function readLiveLogicalIds(base: string, rigName: string, ownerCli
    const nodes = (await nodesRes.json()) as Array<{ logicalId?: string | null }>;
    return nodes.map((n) => n.logicalId ?? "");
  } catch (error) {
-    if (error instanceof ForeignLocalDaemonError) throw error;
+    if (error instanceof ForeignLocalDaemonError || error instanceof AmbiguousLiveRigError) throw error;
    return null;
  }
 }
@@ -458,7 +558,7 @@ export function doctorCommand(depsOverride?: DoctorDeps): Command {
            const base = `http://${formatDaemonHostForUrl(cfg.daemon.host ?? "127.0.0.1")}:${cfg.daemon.port ?? DEFAULT_PORT}`;
            return await readLiveLogicalIds(base, rigName);
          } catch (error) {
-            if (error instanceof ForeignLocalDaemonError) throw error;
+            if (error instanceof ForeignLocalDaemonError || error instanceof AmbiguousLiveRigError) throw error;
            return null;
          }
        },
@@ -88,6 +88,8 @@ interface TeardownResult {
  keptSkills?: string[];
  /** Managed guidance blocks a person edited, kept in their file as `<file>: <block id>`. */
  keptGuidance?: string[];
+  /** Files in a Claude seat's cwd that keep OpenRig's additions because down couldn't safely change them, as `<file>: <why>`. */
+  keptFiles?: string[];
  /** Seats joined with `rig attach` as an external CLI, which OpenRig doesn't stop. */
  leftRunning?: string[];
  paneOnly?: string[];
@@ -145,6 +147,11 @@ Before running it, check who is working (rig ps --nodes --rig <rig>) and that th
 don't stop a team you didn't start unless asked. OpenRig snapshots the rig first (best-effort), and
 rig up <rig> --existing brings it back, resuming each seat's conversation where its harness allows. With
 --delete the rig record is removed too, so it can't be brought back that way.
+Once no live seat uses a working folder, rig down also takes back what OpenRig added there: its
+guidance blocks, and in a Claude seat's folder the status line, activity hooks and context collector.
+It keeps and lists an edited skills-line block, edited team skill files, and settings or a collector
+that don't match what OpenRig wrote or that another seat shares by a link. Any other guidance block
+goes even if someone edited it. rig up <rig> --existing puts the guidance back.
 When your resolved seat belongs to this rig, confirm before stopping it. Without a terminal,
 the command warns and exits without stopping; re-run with --yes to confirm explicitly.`);
  const getDepsF = () => depsOverride ?? { lifecycleDeps: realDeps(), clientFactory: (url: string) => new DaemonClient(url) };
@@ -295,6 +302,10 @@ the command warns and exits without stopping; re-run with --yes to confirm expli
        console.log(`Kept ${result.keptGuidance.length} edited OpenRig block(s) in guidance files; remove them by hand if you don't want them:`);
        for (const block of result.keptGuidance) console.log(`  ${block}`);
      }
+      if (result.keptFiles && result.keptFiles.length > 0) {
+        console.log(`Kept ${result.keptFiles.length} file(s) that still hold OpenRig's additions; check them by hand:`);
+        for (const file of result.keptFiles) console.log(`  ${file}`);
+      }

      if (result.leftRunning && result.leftRunning.length > 0) {
        console.log(`Not stopped: ${result.leftRunning.join(", ")}. Joined with rig attach as an external CLI, which OpenRig doesn't stop or check.`);
@@ -8,7 +8,7 @@ const LONG_RUNNING_TIMEOUT_MS = 45_000;

 export function envCommand(depsOverride?: StatusDeps): Command {
  const cmd = new Command("env")
-    .description("Inspect and control rig environment services for service-backed rigs and managed apps")
+    .description("Inspect and control rig services; for execution placement use rig environment")
    .addHelpText("after", `
 Examples:
  rig env status secrets-manager
@@ -30,9 +30,14 @@ Examples:
      throw new Error(error ?? `Failed to list rigs (HTTP ${summaries.status})`);
    }
    if (!Array.isArray(summaries.data)) throw new Error("The daemon returned an invalid rig summary.");
-    const match = summaries.data.find((r) => r.name === rigRef || r.id === rigRef);
-    if (!match) throw new Error(`Rig '${rigRef}' not found`);
-    return match.id;
+    const exactId = summaries.data.find((r) => r.id === rigRef);
+    if (exactId) return exactId.id;
+    const matches = summaries.data.filter((r) => r.name === rigRef);
+    if (matches.length > 1) {
+      throw new Error(`'${rigRef}' matches ${matches.length} rigs (${matches.map((r) => r.id).join(", ")}). Nothing was done; pass one of these ids instead.`);
+    }
+    if (matches.length === 0) throw new Error(`Rig '${rigRef}' not found`);
+    return matches[0]!.id;
  }

  // rig env status <rig>
@@ -0,0 +1,172 @@
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { Command } from "commander";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { DaemonClient } from "../client.js";
+import { getDaemonPath, getDaemonStatus, getDaemonUrl, daemonStatusGuard } from "../daemon-lifecycle.js";
+import { getOpenRigHome } from "../openrig-compat.js";
+import { addGrant, grantFor, mcpTokenFilePath, readGrants } from "../mcp-http.js";
+import { realDeps } from "./daemon.js";
+import type { StatusDeps } from "./status.js";
+
+export interface EnvironmentCommandDeps extends StatusDeps { home?: string; assets?: string }
+interface WorkConnection { version: 1; mcpUrl: string; seat: string; rig: string; grantName: string; artifactRoot: string; token: string }
+const managedId = (id: string): string => {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/.test(id)) throw new Error("A short binding identifier is required");
+  return id;
+};
+function preserveWrite(file: string, data: string | Buffer): void {
+  mkdirSync(resolve(file, ".."), { recursive: true, mode: 0o700 });
+  if (existsSync(file) || (() => { try { return lstatSync(file).isSymbolicLink(); } catch { return false; } })()) {
+    if (lstatSync(file).isSymbolicLink() || !lstatSync(file).isFile() || !readFileSync(file).equals(Buffer.from(data)))
+      throw new Error(`An existing file is preserved: ${file}`);
+    return;
+  }
+  writeFileSync(file, data, { flag: "wx", mode: 0o600 });
+}
+function connectionRef(home: string, bindingId: string): string { return join(home, "environment-secrets", managedId(bindingId), "work.json"); }
+function readConnection(file: string): WorkConnection {
+  const stat = lstatSync(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 16384 || (stat.mode & 0o077)) throw new Error("The managed work connection must be a private regular file");
+  const value = JSON.parse(readFileSync(file, "utf8")) as WorkConnection;
+  if (value.version !== 1 || typeof value.token !== "string" || !value.token || typeof value.mcpUrl !== "string") throw new Error("The work connection is invalid");
+  return value;
+}
+async function prepareWork(home: string, input: { bindingId: string; seat: string; rig: string; mcpUrl: string; artifactRoot: string }): Promise<string> {
+  const url = new URL(input.mcpUrl);
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash || !url.pathname.endsWith("/mcp"))
+    throw new Error("The work endpoint must be an HTTP(S) MCP URL without embedded credentials");
+  if (!/^[^\s@]+@[^\s@]+$/.test(input.seat) || !input.rig) throw new Error("A canonical seat and its rig are required");
+  const file = connectionRef(home, input.bindingId), grantName = `environment-${input.bindingId}`;
+  if (existsSync(file)) {
+    const prior = readConnection(file), grants = readGrants(mcpTokenFilePath(home)) ?? [];
+    const grant = grantFor(grants, prior.token);
+    if (!grant || grant.name !== grantName || prior.seat !== input.seat || prior.rig !== input.rig || prior.mcpUrl !== url.toString()
+      || prior.artifactRoot !== resolve(input.artifactRoot) || grant.seat !== input.seat || grant.owner || grant.workspace
+      || grant.rigs.length !== 1 || grant.rigs[0] !== input.rig || grant.roots.length !== 0) throw new Error("The existing managed work connection changed or was revoked; preserve it and reconcile before setup");
+    return file;
+  }
+  const token = await addGrant(mcpTokenFilePath(home), { name: grantName, seat: input.seat, rigs: [input.rig], roots: [], workspace: false, owner: false });
+  const data: WorkConnection = { version: 1, mcpUrl: url.toString(), seat: input.seat, rig: input.rig, grantName, artifactRoot: resolve(input.artifactRoot), token };
+  preserveWrite(file, JSON.stringify(data) + "\n");
+  return file;
+}
+
+export function environmentCommand(override?: EnvironmentCommandDeps): Command {
+  const cmd = new Command("environment").description("Explicit OpenShell execution placement and verified artifact return; not rig env (services)");
+  const deps = (): EnvironmentCommandDeps => override ?? { lifecycleDeps: realDeps(), clientFactory: url => new DaemonClient(url) };
+  const client = async () => { const d = deps(), status = await getDaemonStatus(d.lifecycleDeps); if (!daemonStatusGuard(status)) throw new Error("A reachable daemon is required"); return d.clientFactory(getDaemonUrl(status)); };
+  const home = () => deps().home ?? getOpenRigHome();
+  const report = (value: unknown) => console.log(JSON.stringify(value, null, 2));
+  const action = (fn: (...args: any[]) => Promise<void>) => async (...args: any[]) => { try { await fn(...args); } catch (error) { console.error((error as Error).message); process.exitCode = 1; } };
+  const checked = <T extends Record<string, any>>(res: { status: number; data: T }): T => { if (res.status >= 400) throw new Error(res.data?.error ?? `Environment request failed (${res.status})`); return res.data; };
+
+  cmd.command("setup").description("Inspect the pinned vendor CLI and install the maintained example without overwriting another preset")
+    .requiredOption("--directory <path>", "New or matching example directory")
+    .option("--binding <id>", "Prepare this binding's normal scoped MCP work connection")
+    .option("--seat <address>").option("--rig <name>").option("--mcp-url <url>", "Existing authenticated MCP HTTP listener, as reached by the guest")
+    .option("--guest-base-url <origin>", "Guest-only activity listener origin (not the main daemon API); required with work authority")
+    .option("--artifact-root <path>", "Host returned-artifact root, bound to this environment")
+    .option("--json", "JSON receipt; never credential values")
+    .action(action(async (opts: { directory: string; binding?: string; seat?: string; rig?: string; mcpUrl?: string; guestBaseUrl?: string; artifactRoot?: string }) => {
+      const binary = await promisify(execFile)("openshell", ["--version"], { timeout: 10_000, maxBuffer: 4096 });
+      if (!/\b0\.1\.6\b/.test(binary.stdout)) throw new Error("This reference requires OpenShell 0.1.6; no compute was prepared");
+      const root = resolve(opts.directory), assets = deps().assets ?? join(getDaemonPath(), "assets", "openshell");
+      const names = ["guest.py", "Dockerfile", "policy.yaml", "rig.yaml", "agents/worker/agent.yaml", "agents/worker/role.md", "agents/coordinator/agent.yaml", "agents/coordinator/role.md", "README.md", "driver-v1.schema.json", "claude-code-provider.yaml"];
+      for (const name of names) {
+        let data = readFileSync(join(assets, name));
+        if (name === "policy.yaml" && opts.mcpUrl && opts.guestBaseUrl) {
+          const mcp = new URL(opts.mcpUrl), activity = new URL(opts.guestBaseUrl);
+          if (![mcp, activity].every(url => ["http:", "https:"].includes(url.protocol) && !url.username && !url.password && !url.search && !url.hash)
+            || activity.pathname !== "/") throw new Error("Explicit guest endpoints without embedded credentials are required");
+          const mainPort = Number(process.env.OPENRIG_PORT ?? "7433");
+          const ports = [mcp, activity].map(url => Number(url.port || (url.protocol === "https:" ? 443 : 80)));
+          if (ports.includes(mainPort) || ports[0] === ports[1]) throw new Error("Select separate MCP and guest-only activity ports, never the daemon main port");
+          const policy = parseYaml(data.toString("utf8"));
+          for (const [name, url] of [["openrig_mcp", mcp], ["openrig_activity", activity]] as const) {
+            policy.network_policies[name].endpoints[0].host = url.hostname;
+            policy.network_policies[name].endpoints[0].port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+          }
+          data = Buffer.from(stringifyYaml(policy));
+        }
+        preserveWrite(join(root, name), data);
+      }
+      preserveWrite(join(home(), "community-harnesses", "openshell-claude.yaml"), readFileSync(join(assets, "preset.yaml")));
+      let ref: string | undefined;
+      if (opts.binding || opts.seat || opts.rig || opts.mcpUrl) {
+        if (!opts.binding || !opts.seat || !opts.rig || !opts.mcpUrl || !opts.guestBaseUrl) throw new Error("Preparing work authority needs --binding, --seat, --rig, --mcp-url and --guest-base-url together");
+        ref = await prepareWork(home(), { bindingId: opts.binding, seat: opts.seat, rig: opts.rig, mcpUrl: opts.mcpUrl, artifactRoot: resolve(opts.artifactRoot ?? join(root, "artifacts")) });
+      }
+      report({ version: 1, driver: "openshell", vendorVersion: "0.1.6", directory: root,
+        ...(ref ? { workConnectionRef: ref } : {}), effect: "reference and preset installed; no environment or native process created" });
+    }));
+
+  for (const verb of ["create", "attach"] as const) {
+    const sub = cmd.command(verb).argument("<binding>").description(verb === "create" ? "Journal intent, then explicitly create one owned sandbox; retries reconcile the same operation" : "Verify and bind an exact existing resource as an attached consumer")
+      .requiredOption("--seat <address>").option("--node <id>", "Existing node ID; otherwise claimed by the exact named seat on its first launch")
+      .requiredOption("--gateway <ref>").requiredOption("--workspace <ref>").requiredOption("--name <name>")
+      .requiredOption("--image <digest>").requiredOption("--provider <ref>").requiredOption("--policy <path>")
+      .requiredOption("--guest-base-url <origin>", "Guest-reachable guest-only activity listener origin (not the main daemon API)")
+      .option("--operation <id>", "Stable effect identity (default verb plus binding ID)").option("--json");
+    if (verb === "attach") sub.requiredOption("--resource-id <id>", "Immutable live resource ID").option("--fingerprint <value>", "Expected host-key fingerprint");
+    sub.action(action(async (binding: string, opts: Record<string, string>) => {
+      managedId(binding); const ref = connectionRef(home(), binding), work = readConnection(ref);
+      if (work.seat !== opts.seat) throw new Error("The managed work connection belongs to another seat; no provider operation was requested");
+      const body = { version: 1, bindingId: binding, operationId: opts.operation ?? `${verb}-${binding}`, nodeId: opts.node, seat: opts.seat,
+        baseRuntime: "claude-code", guestRoot: "/sandbox/openrig", guestBaseUrl: opts.guestBaseUrl, coordinationRef: ref, artifactRoot: work.artifactRoot,
+        placement: { gateway: opts.gateway, workspace: opts.workspace, name: opts.name, image: opts.image, provider: opts.provider, policy: realpathSync(opts.policy!) },
+        ...(verb === "attach" ? { resourceId: opts.resourceId, fingerprint: opts.fingerprint } : {}) };
+      const res = await (await client()).post<Record<string, any>>(`/api/environments/${verb}`, body, { timeoutMs: 120_000 });
+      report({ ...checked(res), operationId: body.operationId, effect: res.status === 202 ? "unconfirmed; reconcile this same operation" : "binding-confirmed; native launch not requested" });
+    }));
+  }
+  cmd.command("inspect").description("Read stored binding receipts or inspect the exact live resource").argument("<binding>").option("--live", "Observe the exact provider resource; unavailable is not absence").option("--json")
+    .action(action(async (binding: string, opts: { live?: boolean }) => report(checked(await (await client()).get<Record<string, any>>(`/api/environments/${encodeURIComponent(binding)}${opts.live ? "?live=true" : ""}`)))));
+  cmd.command("connect").argument("<binding>").requiredOption("--generation <id>").description("Open only the bound execution's viewer; closing it does not prove native or compute stopped")
+    .action(action(async (id: string, opts: { generation: string }) => {
+      // Launch and the guest latch already verify all projected files. Opening a viewer needs only one live
+      // resource lookup (the driver bounds it at 30s), not another serial validation of every startup file.
+      const c = await client(), b = checked(await c.get<Record<string, any>>(`/api/environments/${encodeURIComponent(id)}?live=true`, { timeoutMs: 35_000 }));
+      if (b.generation !== opts.generation) throw new Error("The selected environment generation changed; no viewer was opened");
+      const args = ["--gateway", b.placement.gateway, "--workspace", b.placement.workspace, "sandbox", "connect", b.placement.name];
+      await new Promise<void>((resolveExit, reject) => {
+        const child = spawn("openshell", args, { stdio: "inherit" });
+        child.once("error", reject); child.once("exit", code => code === 0 ? resolveExit() : reject(new Error(`The environment viewer exited ${code}; native and compute state require inspection`)));
+      });
+    }));
+  cmd.command("export").argument("<binding>").requiredOption("--request <path>", "Versioned artifact request JSON with operation/task/generation/path/hash/bytes/schema/context")
+    .option("--json").description("Transfer actual bytes through the existing authenticated MCP work route, never an activity token")
+    .action(action(async (binding: string, opts: { request: string }) => {
+      const work = readConnection(connectionRef(home(), binding)), request = JSON.parse(readFileSync(opts.request, "utf8"));
+      const transport = new StreamableHTTPClientTransport(new URL(work.mcpUrl), { requestInit: { headers: { Authorization: `Bearer ${work.token}` } } });
+      const mcp = new Client({ name: "openrig-environment-export", version: "1" });
+      try {
+        await mcp.connect(transport);
+        const result = await mcp.callTool({ name: "rig_environment_export", arguments: { ...request, bindingId: binding } });
+        if (result.isError) throw new Error((result.content as Array<{ text?: string }>).map(c => c.text ?? "").join("\n"));
+        report(result.structuredContent ?? result.content);
+      } finally { await mcp.close(); }
+    }));
+  cmd.command("checkpoint").argument("<binding>").requiredOption("--generation <id>", "Selected current execution generation")
+    .requiredOption("--operation <id>", "Stable private checkpoint identity").option("--json")
+    .description("Capture exact private native history and verified prior artifact references while the provider remains accessible")
+    .action(action(async (id: string, opts: { generation: string; operation: string }) => report(checked(await (await client()).post<Record<string, any>>(`/api/environments/${encodeURIComponent(id)}/checkpoint`, { operationId: opts.operation, generation: opts.generation }, { timeoutMs: 120_000 })))));
+  cmd.command("recreate").argument("<binding>").requiredOption("--request <path>", "JSON with operationId, predecessor generation, checkpointId, exact resumeType/resumeToken and same-host placement")
+    .option("--json").description("Explicitly create successor compute only after exact predecessor cleanup and retained state verification; native launch remains normal rig restore")
+    .action(action(async (id: string, opts: { request: string }) => report(checked(await (await client()).post<Record<string, any>>(`/api/environments/${encodeURIComponent(id)}/recreate`, JSON.parse(readFileSync(opts.request, "utf8")), { timeoutMs: 120_000 })))));
+  cmd.command("completion").argument("<binding>").requiredOption("--request <path>", "JSON selecting operationId, taskId, generation, exportOperationId and stop-native or stop-compute")
+    .option("--json").description("Select finite completion for one task, generation and required verified export; persistent defaults stay unchanged")
+    .action(action(async (id: string, opts: { request: string }) => report(checked(await (await client()).post<Record<string, any>>(`/api/environments/${encodeURIComponent(id)}/completion`, JSON.parse(readFileSync(opts.request, "utf8")))))));
+  cmd.command("effect").argument("<binding>").requiredOption("--effect <name>", "close-viewer, stop-native, stop-compute or delete-owned")
+    .option("--generation <id>", "Selected execution generation; omit only for delete-owned before any generation exists")
+    .option("--resource-id <id>", "Exact immutable compute ID; required for delete-owned without a generation").requiredOption("--operation <id>", "Stable effect identity; retries reconcile without another provider mutation")
+    .option("--engine-socket <path>", "Owned local rootless Podman socket, required to capture dependent identities before delete-owned").option("--json")
+    .description("Execute one selected effect and return its separate observed outcome; attached native/storage/compute are preserved")
+    .action(action(async (id: string, opts: { effect: string; generation?: string; resourceId?: string; operation: string; engineSocket?: string }) => report(checked(await (await client()).post<Record<string, any>>(`/api/environments/${encodeURIComponent(id)}/effect`, { effect: opts.effect, generation: opts.generation ?? null, ...(opts.resourceId ? { resourceId: opts.resourceId } : {}), operationId: opts.operation, engineSocket: opts.engineSocket }, { timeoutMs: 120_000 })))));
+  cmd.addHelpText("after", "\nStart with rig environment setup --help. Run from your managed seat, or set OPENRIG_SESSION_NAME to the acting member@rig in a plain shell for existing transport attribution (not authentication). --guest-base-url names the separate guest-only activity listener, reachable from the guest; never the main API. Create/attach are explicit effects; a 202 is unconfirmed. The first native start remains rig up with the installed openshell-claude preset. Checkpoint before stop, select effects explicitly, and recreate compute before exact normal rig restore. No unknown effect permits fresh-native fallback.\n");
+  return cmd;
+}
@@ -1,7 +1,7 @@
 import nodePath from "node:path";
 import fs from "node:fs";
 import { Command } from "commander";
-import { writeTextAtomically } from "../atomic-text-write.js";
+import { writeNewText, writeTextAtomically } from "../atomic-text-write.js";
 import { DaemonClient } from "../client.js";
 import { getDaemonStatus, getDaemonUrl , daemonStatusGuard} from "../daemon-lifecycle.js";
 import { realDeps } from "./daemon.js";
@@ -10,6 +10,8 @@ import { rigIdForHandle } from "../rig-handle.js";

 export interface ExportDeps extends StatusDeps {
  writeFile: (path: string, content: string) => void;
+  /** Must fail with EEXIST when the path is taken. */
+  writeNewFile?: (path: string, content: string) => void;
  exists?: (path: string) => boolean;
 }

@@ -37,18 +39,35 @@ function copyCulture(file: string, root: string, outDir: string): void {
  console.log(`Copied culture to ${target}`);
 }

+/** rig.yaml is also the name of an authored spec, and an export doesn't carry all of one (comments, a summary, startup
+ *  it couldn't read back). So a default export takes the first free name, created so that it can't replace a file that
+ *  appeared after the daemon was asked. Only a path the person named with -o may replace a file. */
+function writeDefaultExport(write: (path: string, content: string) => void, first: string, content: string): string {
+  for (let attempt = 1; ; attempt++) {
+    const path = attempt === 1 ? first : attempt === 2 ? "rig-export.yaml" : `rig-export-${attempt - 1}.yaml`;
+    try {
+      write(path, content);
+      if (attempt > 1) console.warn(`${first} already exists and was left unchanged. Use -o ${first} to replace it.`);
+      return path;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+    }
+  }
+}
+
 export function exportCommand(depsOverride?: ExportDeps): Command {
  const cmd = new Command("export").description("Export a rig spec as YAML");
  const getDeps = (): ExportDeps => depsOverride ?? {
    lifecycleDeps: realDeps(),
    clientFactory: (url: string) => new DaemonClient(url),
    writeFile: (p, content) => writeTextAtomically(p, content, "export"),
+    writeNewFile: writeNewText,
    exists: (p) => fs.existsSync(p),
  };

  cmd
    .argument("<rig>", "Rig name or ID to export")
-    .option("-o, --output <path>", "Output file path", "rig.yaml")
+    .option("-o, --output <path>", "Output file path, replacing any file there. Without it, an existing rig.yaml is kept and the export goes to an unused rig-export*.yaml", "rig.yaml")
    .action(async (rigId: string, opts: { output: string }) => {
      const deps = getDeps();
      const status = await getDaemonStatus(deps.lifecycleDeps);
@@ -67,9 +86,14 @@ export function exportCommand(depsOverride?: ExportDeps): Command {
        console.error(`Export failed: ${res.data}`);
        process.exitCode = 1;
      } else {
-        deps.writeFile(opts.output, res.data);
-        console.log(`Exported to ${opts.output}`);
-        for (const line of String(res.data).split("\n")) if (line.startsWith("# Not carried: ")) console.log(line.slice(2));
+        const written = cmd.getOptionValueSource("output") === "default"
+          ? writeDefaultExport(deps.writeNewFile ?? deps.writeFile, opts.output, res.data)
+          : (deps.writeFile(opts.output, res.data), opts.output);
+        console.log(`Exported to ${written}`);
+        for (const line of String(res.data).split("\n")) {
+          if (line.startsWith("# Not carried: ")) console.log(line.slice(2));
+          if (line.startsWith("# Member startup not carried for ")) console.warn(`Warning: ${line.slice(2)}`);
+        }

        // Check for referenced culture_file and startup files resolving from the output directory
        const checkExists = deps.exists ?? ((p) => fs.existsSync(p));
@@ -89,12 +113,12 @@ export function exportCommand(depsOverride?: ExportDeps): Command {
          const parsed = parse(res.data) as Record<string, unknown> | null;
          if (parsed && typeof parsed === "object") {
            if (parsed["name"] === "starter") {
-              console.warn("Warning: this export still installs as 'starter'. Before sharing, rename the team's name in rig.yaml; changing the bundle name alone does not rename the installed rig.");
+              console.warn(`Warning: this export still installs as 'starter'. Before sharing, rename the team's name in ${written}; changing the bundle name alone does not rename the installed rig.`);
            }
            const pods = parsed["pods"] as Array<{
              id?: string;
              startup?: ExportedStartupBlock;
-              members?: Array<{ id?: string; agent_ref?: string }>;
+              members?: Array<{ id?: string; agent_ref?: string; startup?: ExportedStartupBlock }>;
            }> | undefined;
            for (const pod of Array.isArray(pods) ? pods : []) {
              for (const member of Array.isArray(pod.members) ? pod.members : []) {
@@ -123,7 +147,7 @@ export function exportCommand(depsOverride?: ExportDeps): Command {

            const startupBlocks = [
              parsed["startup"] as ExportedStartupBlock | undefined,
-              ...(Array.isArray(pods) ? pods.map((pod) => pod.startup) : []),
+              ...(Array.isArray(pods) ? pods.flatMap((pod) => [pod.startup, ...(pod.members ?? []).map((member) => member.startup)]) : []),
            ];
            for (const startup of startupBlocks) {
              if (startup && Array.isArray(startup.files)) {
@@ -173,9 +173,9 @@ export function gatewayCommand(deps: GatewayCommandDeps = {}): Command {
    .command("add <entityId>")
    .description("Add a human fragment (verb-add-only; the fragment is truth, the registry is a GENERATED projection)")
    .requiredOption("--display-name <name>", "Human-readable display name")
-    .requiredOption(
+    .option(
      "--binding <kind:connectorRef:secretsRef:role[:handle=<id>]>",
-      "Connector binding (repeatable); role primary|secondary, EXACTLY ONE primary. connectorRef and secretsRef are config/vault labels (e.g. for Slack: slack:openrig-personal:file:<env-path>:primary:handle=<id>; tokens come from 'rig slack setup --secrets-env-file', never inline). Optional handle=<platform id> makes the binding inbound-resolvable (unique per kind); omit it for outbound-only.",
+      "Connector binding (repeatable); leave it out for a person with no connector, who's reached in the Feed and Steering only. With bindings, role primary|secondary, EXACTLY ONE primary. connectorRef and secretsRef are config/vault labels (e.g. for Slack: slack:openrig-personal:file:<env-path>:primary:handle=<id>; tokens come from 'rig slack setup --secrets-env-file', never inline). Optional handle=<platform id> makes the binding inbound-resolvable (unique per kind); omit it for outbound-only.",
      (v: string, acc: string[] = []) => { acc.push(v); return acc; },
    )
    .requiredOption("--delivery-class <A|B|C|D>", "Notification loudness class (the notifications register selection)")
@@ -188,7 +188,7 @@ export function gatewayCommand(deps: GatewayCommandDeps = {}): Command {
    .option("--policy <text>", "Readable policy for agents working with this person (text, not enforced)")
    .option("--policy-file <path>", "Read the policy text from a file")
    .option("--default", "Make this person the default: the one escalations, the notice digest and other unaddressed needs go to")
-    .action(async (entityId: string, opts: { displayName: string; binding: string[]; deliveryClass: string; away?: boolean; replace?: boolean; reason: string; actor?: string; organization?: string; group?: string[]; policy?: string; policyFile?: string; default?: boolean }) => {
+    .action(async (entityId: string, opts: { displayName: string; binding?: string[]; deliveryClass: string; away?: boolean; replace?: boolean; reason: string; actor?: string; organization?: string; group?: string[]; policy?: string; policyFile?: string; default?: boolean }) => {
      // LAZY import the narrow daemon surface at invocation (dep rail 2).
      const registry = await import("@openrig/daemon/gateway-human-registry");
      const { addHumanFragment, parseBindingSpec } = registry as unknown as {
@@ -209,7 +209,7 @@ export function gatewayCommand(deps: GatewayCommandDeps = {}): Command {
        if (unknownGroup) { console.error(`refused: no group "${unknownGroup}" — create it with rig gateway group set ${unknownGroup} --organization … --name …`); process.exitCode = 1; return; }
      }
      const bindings: Record<string, unknown>[] = [];
-      for (const spec of opts.binding) {
+      for (const spec of opts.binding ?? []) {
        const b = parseBindingSpec(spec);
        if (!b.ok) { console.error(`--binding: ${b.error}`); process.exitCode = 1; return; }
        bindings.push(b.binding);
@@ -284,8 +284,9 @@ Example:
      if (opts.json) { console.log(JSON.stringify({ ok: true, humans })); return; }
      if (res.humans.length === 0) { console.log("no human configured yet — register one: rig gateway human add <entityId> --display-name … --binding … --delivery-class …"); return; }
      for (const h of humans) {
-        const inbound = h.bindings.inboundResolvable ? "" : "  [outbound-only]";
-        console.log(`${h.entityId}  "${h.displayName}"  class=${h.deliveryClass}  ${h.availability}  bindings=${h.bindings.count} (primary ${h.bindings.primary.kind}:${h.bindings.primary.connectorRef})  delivery=${h.deliveryReadiness.state}${inbound}`);
+        const inbound = h.bindings.inboundResolvable || !h.bindings.primary ? "" : "  [outbound-only]";
+        const primary = h.bindings.primary ? `primary ${h.bindings.primary.kind}:${h.bindings.primary.connectorRef}` : "no connector: Feed and Steering only";
+        console.log(`${h.entityId}  "${h.displayName}"  class=${h.deliveryClass}  ${h.availability}  bindings=${h.bindings.count} (${primary})  delivery=${h.deliveryReadiness.state}${inbound}`);
        if (!h.deliveryReadiness.ready) console.log(`  delivery: ${h.deliveryReadiness.reason}${h.deliveryReadiness.nextAction ? `; next: ${h.deliveryReadiness.nextAction}` : ""}`);
        console.log(`  ${"unknown" in h.quiet ? `quiet: unknown (${h.quiet.unknown})` : describeQuiet(h.quiet)}`);
      }
@@ -731,17 +732,16 @@ Examples:
    .option("--json", "Complete records as JSON, including organizations and groups")
    .action(async (opts: { organization?: string; json?: boolean }) => {
      const registry = await import("@openrig/daemon/gateway-human-registry");
+      if (opts.json) {
+        const result = registry.participantsJsonView(undefined, opts.organization);
+        if (!result.ok) { console.error(`refused: ${result.error}`); process.exitCode = 1; return; }
+        console.log(JSON.stringify(result));
+        return;
+      }
      const view = registry.participantsView();
      if (!view.ok) { console.error(`refused: ${view.error}`); process.exitCode = 1; return; }
      const shown = opts.organization ? view.participants.filter((p) => p.organization?.id === opts.organization) : view.participants;
      const defaultPerson = view.default.person ? { id: view.default.person.entityId, source: view.default.source } : { id: null, reason: view.default.source === "none" ? view.default.reason : null };
-      if (opts.json) {
-        const side = registry.readParticipantsFile();
-        console.log(JSON.stringify({ ok: true, participants: shown, default: defaultPerson,
-          organizations: side.ok ? side.file.organizations : null, groups: side.ok ? side.file.groups : null,
-          warnings: view.warnings, participantFile: view.sideFile }));
-        return;
-      }
      if (!shown.length) console.log(opts.organization ? `no participants in organization "${opts.organization}"` : "no participants yet: rig gateway human add … registers a person, rig gateway channel add … a shared channel");
      for (const p of shown) {
        console.log(`${p.id}  ${p.kind}  "${p.displayName}"  ${p.address}${p.channel ? `  channel ${p.channel.channelId}` : ""}`);
@@ -1,12 +1,19 @@
 // OPR.0.4.4.13 — the host-registry verbs (add / list / doctor — arch
-// R13-2a: no edit/remove/tunnel/bootstrap verbs; hand-editing hosts.yaml
-// remains the path for exotica; the bootstrap ships as script + runbook).
-// OPR.0.4.6.MH1 FR-1 extends the family with `select` — the persisted
-// host-selection pointer (kubectl current-context shape). The pointer
-// lives in the config twins as `host.selected`; this verb is a THIN
-// CLIENT of the daemon config write (one write path for CLI+UI
+// R13-2a originally: no edit/remove/tunnel/bootstrap verbs; hand-editing
+// hosts.yaml remains the path for exotica; the bootstrap ships as script +
+// runbook). OPR.0.4.6.MH1 FR-1 extends the family with `select` — the
+// persisted host-selection pointer (kubectl current-context shape). The
+// pointer lives in the config twins as `host.selected`; this verb is a
+// THIN CLIENT of the daemon config write (one write path for CLI+UI
 // convergence, arch ruling); reads resolve from the local ConfigStore
 // (env > file > default — zero new daemon lookups on read paths).
+// Issue #2128 (maintainer-approved boundary) extends the family again with
+// `edit` and `remove`: the SAME parity-pinned writer contract as add — id
+// and transport stay fixed on an edit, unknown fields fail loud, empty
+// string clears an optional field, and remove deletes only the registry
+// entry (no credential files, no learned identity, no selection change).
+// When the selected host is edited or removed, the selection outcome is
+// shown plainly — never a silent switch.
 //
 // Secret hygiene (FR-1): every render carries bearer POINTERS (env var /
 // file NAMES) only — no code path in this file resolves a bearer value
@@ -17,8 +24,9 @@ import { existsSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { hostname as osHostname, userInfo } from "node:os";
 import { connect } from "node:net";
+import { execFile } from "node:child_process";
 import { getOpenRigHome } from "../openrig-compat.js";
-import { addHostEntry, defaultHostRegistryPath, loadHostRegistry, validateHostRegistry, hostDisplayTarget, resolveHost, resolveRemoteBearer, bearerAuthHeaders, type HostEntry, type HttpHostEntry } from "../host-registry.js";
+import { addHostEntry, updateHostEntry, removeHostEntry, defaultHostRegistryPath, loadHostRegistry, validateHostRegistry, hostDisplayTarget, resolveHost, resolveRemoteBearer, bearerAuthHeaders, type HostEntry, type HttpHostEntry, type SshHostEntry } from "../host-registry.js";
 import { runCrossHostCommand, type CrossHostResult } from "../cross-host-executor.js";
 import { recordHostObservation, loadHostBindings, describeBindingConflict, defaultHostBindingsPath, type HostObservationOutcome } from "../host-bindings.js";
 import { DaemonClient } from "../client.js";
@@ -160,15 +168,35 @@ function defaultDoctorDeps(): DoctorDeps {
  };
 }

+/** Where ssh would connect for this host, from `ssh -G`, which reads ssh config without connecting.
+ *  Null when ssh can't resolve the target or a ProxyJump/ProxyCommand sits in between, since no
+ *  direct dial stands for that transport. */
+export function resolveSshEndpoint(host: SshHostEntry, timeoutMs = 1500): Promise<{ hostname: string; port: number } | null> {
+  const args = [...(host.user ? ["-l", host.user] : []), "-G", host.target];
+  return new Promise((resolve) => {
+    execFile("ssh", args, { timeout: timeoutMs }, (error, stdout) => {
+      if (error) return resolve(null);
+      const conf = new Map(stdout.split("\n").map((line) => {
+        const i = line.indexOf(" ");
+        return [line.slice(0, i).toLowerCase(), line.slice(i + 1).trim()] as const;
+      }));
+      const proxied = ["proxyjump", "proxycommand"].some((k) => (conf.get(k) ?? "none") !== "none");
+      const hostname = conf.get("hostname");
+      const port = Number(conf.get("port"));
+      resolve(hostname && Number.isInteger(port) && !proxied ? { hostname, port } : null);
+    });
+  });
+}
+
 /** FR-1 doctor legs — each failing step maps to a DISTINCT actionable error:
 *  "SSH works but daemon is down" ≠ "daemon works but registry is wrong" ≠
 *  "remote rig binary missing/old". */
 /** OPR.0.4.6.MH1 FR-3 — the coarse ls status word: a BOUNDED tcp dial
- *  against the host's transport endpoint (ssh: target:22; http: the
- *  URL's host:port). Coarse by design (the kubectl STATUS / docker
- *  context ls precedent): reachable | unreachable | unknown — never a
- *  hang (hard timeout), never a guess (dial failure = unreachable,
- *  probe error/unparseable endpoint = unknown). */
+ *  against the host's transport endpoint (ssh: the host and port ssh itself
+ *  resolves, see resolveSshEndpoint; http: the URL's host:port). Coarse by
+ *  design (the kubectl STATUS / docker context ls precedent): reachable |
+ *  unreachable | unknown — never a hang (hard timeout), never a guess (dial
+ *  failure = unreachable, probe error/unparseable endpoint = unknown). */
 export async function probeHostStatus(
  host: HostEntry,
  tcpProbe: DoctorDeps["tcpProbe"],
@@ -178,8 +206,9 @@ export async function probeHostStatus(
    let target: string;
    let port: number;
    if (host.transport === "ssh") {
-      target = host.target;
-      port = 22;
+      const endpoint = await resolveSshEndpoint(host, timeoutMs);
+      if (!endpoint) return "unknown";
+      ({ hostname: target, port } = endpoint);
    } else {
      const u = new URL(host.url);
      target = u.hostname.replace(/^\[|\]$/g, "");
@@ -553,6 +582,7 @@ function printHostNextSteps(host: HostEntry): void {

 export function hostCommand(doctorDepsOverride?: DoctorDeps): Command {
  const cmd = new Command("host").description("Manage the multi-host registry (~/.openrig/hosts.yaml)");
+  const rewritesRegistry = "\nIt rewrites ~/.openrig/hosts.yaml from the fields it knows, so comments, formatting, unknown entry keys and other top-level keys aren't kept.";

  cmd
    .command("add")
@@ -566,6 +596,7 @@ export function hostCommand(doctorDepsOverride?: DoctorDeps): Command {
    .option("--bearer-file <path>", "File PATH holding the bearer token — http transport (optional pointer, never a value; at most one bearer flag)")
    .option("--notes <text>", "Free-form operator note")
    .option("--json", "JSON output")
+    .addHelpText("after", rewritesRegistry)
    .action((opts: { id: string; transport: string; target?: string; user?: string; url?: string; bearerEnv?: string; bearerFile?: string; notes?: string; json?: boolean }) => {
      const rawEntry: Record<string, unknown> = { id: opts.id, transport: opts.transport };
      if (opts.target !== undefined) rawEntry["target"] = opts.target;
@@ -687,10 +718,72 @@ export function hostCommand(doctorDepsOverride?: DoctorDeps): Command {
      console.log(`This host is now named: ${trimmed}`);
    });

+  cmd
+    .command("edit")
+    .description("Edit a host entry (id and transport stay fixed; an empty string clears an optional field)")
+    .argument("<id>", "A registered host id")
+    .option("--target <target>", "SSH target — ssh transport")
+    .option("--user <user>", "SSH user — ssh transport (empty string clears the value)")
+    .option("--url <url>", "Remote daemon base URL — http transport")
+    .option("--notes <text>", "Free-form operator note (empty string clears the value)")
+    .option("--json", "JSON output")
+    .addHelpText("after", rewritesRegistry)
+    .action((id: string, opts: { target?: string; user?: string; url?: string; notes?: string; json?: boolean }) => {
+      const changes: Record<string, unknown> = {};
+      if (opts.target !== undefined) changes["target"] = opts.target;
+      if (opts.user !== undefined) changes["user"] = opts.user;
+      if (opts.url !== undefined) changes["url"] = opts.url;
+      if (opts.notes !== undefined) changes["notes"] = opts.notes;
+
+      const res = updateHostEntry(id.trim(), changes);
+      if (!res.ok) {
+        console.error(res.error);
+        process.exitCode = 1;
+        return;
+      }
+      const wasSelected = readSelectedHost() === res.entry.id;
+      if (opts.json) {
+        console.log(JSON.stringify({ ok: true, path: res.path, entry: res.entry, wasSelected }));
+        return;
+      }
+      console.log(`Updated host '${res.entry.id}' (${res.entry.transport}) at ${res.path}`);
+      for (const key of Object.keys(changes) as string[]) {
+        const rec = (e: HostEntry) => e as unknown as Record<string, unknown>;
+        const before = rec(res.previous)[key];
+        const after = rec(res.entry)[key];
+        if (before !== after) {
+          console.log(`  ${key}: ${before === undefined ? "(unset)" : String(before)} → ${after === undefined ? "(cleared)" : String(after)}`);
+        }
+      }
+      if (wasSelected) console.log(`note: '${res.entry.id}' is the selected host — it was edited in place and the selection still points at it.`);
+    });
+
+  cmd
+    .command("remove")
+    .description("Remove a host entry (deletes only the registry entry — credential files, the learned identity and the selection stay as they are)")
+    .argument("<id>", "A registered host id")
+    .option("--json", "JSON output")
+    .addHelpText("after", rewritesRegistry)
+    .action((id: string, opts: { json?: boolean }) => {
+      const res = removeHostEntry(id.trim());
+      if (!res.ok) {
+        console.error(res.error);
+        process.exitCode = 1;
+        return;
+      }
+      const wasSelected = readSelectedHost() === res.entry.id;
+      if (opts.json) {
+        console.log(JSON.stringify({ ok: true, path: res.path, entry: res.entry, wasSelected }));
+        return;
+      }
+      console.log(`Removed host '${res.entry.id}' (${res.entry.transport}) from ${res.path}`);
+      if (wasSelected) console.log(`note: '${res.entry.id}' was the selected host — the selection still points at '${res.entry.id}' and was NOT changed. Pick another: rig host select <id>`);
+    });
+
  cmd
    .command("pair")
    .description("Pair with a remote host from one pasted address — one approval on the target, done (FR-6)")
-    .argument("<url>", "The target daemon's address (http[s]://host:port, or host:port)")
+    .argument("<url>", "The target daemon's address (http[s]://host:port, or host:port); that daemon must run with OPENRIG_AUTH_BEARER_TOKEN set")
    .option("--id <id>", "Registry id for the new host (default: derived from the hostname)")
    .option("--timeout <seconds>", "How long to wait for the target-side approval", "600")
    .option("--human <address>", "Registered @external approval recipient on the target (required when several exist)")
@@ -42,7 +42,7 @@ export function setExperiment(file: string, enabled: boolean, options: Partial<E
  const fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_NOFOLLOW, 0o600);
  try {
    const s = fs.fstatSync(fd);
-    if (!s.isFile() || s.nlink !== 1 || s.uid !== process.getuid?.()) throw Error("experiment config must be an owned regular file");
+    if (!s.isFile() || s.nlink !== 1 || (process.getuid !== undefined && s.uid !== process.getuid())) throw Error("experiment config must be an owned regular file");
    fs.ftruncateSync(fd, 0); fs.writeFileSync(fd, JSON.stringify(config, null, 2) + "\n");
  } finally { fs.closeSync(fd); }
  return config;
@@ -1,3 +1,4 @@
+import { accountHomePlanMatches } from "../lib/account-home-switch.js";
 import fs from "node:fs";
 import { Command } from "commander";
 import { DaemonClient, DaemonTimeoutError } from "../client.js";
@@ -22,8 +23,8 @@ export const USAGE_ACROSS_HOSTS_REFRESH_TIMEOUT_MS = 75_000;

 type Peer = { logicalId: string; sessionName: string | null; home?: "same" | "different" | "unknown"; effect: string; step?: string };
 type SeatView = { home?: string; activity?: string; peers: Peer[] };
-type SwitchReport = { home?: string; account: string; tokenFile?: string; conversation?: string | null; loginChanged: boolean; undo: string | null; peers: Peer[];
-  restart?: { recoveryCommand?: string; remainingStep?: string }; next?: string; warnings?: string[]; tokenApplied?: boolean };
+type SwitchReport = { credentialKind?: "api-key"; home?: string; account: string; tokenFile?: string; conversation?: string | null; loginChanged: boolean; undo: string | null; peers: Peer[];
+  restart?: { recoveryCommand?: string; remainingStep?: string }; next?: string; warnings?: string[]; tokenApplied?: boolean; effort?: string };

 // A switch waits as long as `rig seat restart` does: the seat's in-place restart runs inside it.
 const SWITCH_TIMEOUT_MS = 120_000;
@@ -38,23 +39,25 @@ function printSeat(seat: SeatView): void {
  }
 }

-type AccountOpts = { toAccount?: string; tokenFile?: string; storedLogin?: boolean };
+type AccountOpts = { toAccount?: string; tokenFile?: string; apiKeyFile?: string; storedLogin?: boolean };

 /** The account a switch names: a Codex login's saved name, a Claude token's label with its file, or a Claude seat's stored
 *  login. Null when neither --to-account nor --stored-login was given. */
-function targetAccount(opts: AccountOpts): { toAccount: string; tokenFile?: string | null } | null {
+function targetAccount(opts: AccountOpts): { toAccount: string; tokenFile?: string | null; apiKeyFile?: string } | null {
+  if (opts.apiKeyFile !== undefined && (opts.tokenFile !== undefined || opts.storedLogin)) return null;
  if (opts.storedLogin) return { toAccount: "stored-login", tokenFile: null };
  if (!opts.toAccount) return null;
-  return { toAccount: opts.toAccount, ...(opts.tokenFile !== undefined ? { tokenFile: opts.tokenFile } : {}) };
+  return { toAccount: opts.toAccount, ...(opts.tokenFile !== undefined ? { tokenFile: opts.tokenFile } : {}), ...(opts.apiKeyFile !== undefined ? { apiKeyFile: opts.apiKeyFile } : {}) };
 }

-function printClaude(claude: { label: string; tokenFile: string | null; checked: string[]; notChecked: string[]; instead?: string }): void {
-  console.log(`Claude token: ${claude.tokenFile ? `"${claude.label}", read from ${claude.tokenFile} when Claude starts` : "none (the config dir's stored login)"}`);
+function printClaude(claude: { credentialKind?: "api-key"; label: string; tokenFile: string | null; checked: string[]; notChecked: string[]; instead?: string }): void {
+  console.log(`Claude ${claude.credentialKind === "api-key" ? "API key" : "token"}: ${claude.tokenFile ? `"${claude.label}", read from ${claude.tokenFile} when Claude starts` : "none (the config dir's stored login)"}`);
  if (claude.instead) console.log(`instead of the stored login, the seat would use ${claude.instead}`);
  if (claude.checked.length) console.log(`checked for anything that outranks it: ${claude.checked.join("; ")}`);
  if (claude.notChecked.length) console.log(`not checked (the seat's /status shows what it uses): ${claude.notChecked.join("; ")}`);
 }

+/** Build provider views and account switches; an isolated-home switch first requires the daemon to acknowledge its plan. */
 export function providerCommand(depsOverride?: StatusDeps): Command {
  const cmd = new Command("provider").description(
    "Provider accounts and usage signals, and moving one Codex seat to another login saved in its Codex home",
@@ -510,6 +513,7 @@ export function providerCommand(depsOverride?: StatusDeps): Command {
    .requiredOption("--seat <s>", "The seat session")
    .option("--to-account <a>", "Codex: the login's saved name in the seat's Codex home (rig auth list --codex-home <home>). Claude: your label for the token")
    .option("--token-file <path>", "Claude: the absolute path of a 0600 file holding the seat's own subscription token; it's read only as Claude starts")
+    .option("--api-key-file <path>", "Claude: a file containing its API key; resume the same conversation and settings")
    .option("--stored-login", "Claude: move the seat back to its config dir's stored login")
    .option("--json", "Output as parseable JSON")
    .action(async (opts: AccountOpts & { seat: string; json?: boolean }) => {
@@ -525,7 +529,8 @@ export function providerCommand(depsOverride?: StatusDeps): Command {
        return;
      }
      const qs = new URLSearchParams({ seat: opts.seat, toAccount: target.toAccount,
-        ...(target.tokenFile === null ? { storedLogin: "1" } : target.tokenFile !== undefined ? { tokenFile: target.tokenFile } : {}) });
+        ...(target.tokenFile === null ? { storedLogin: "1" } : target.tokenFile !== undefined ? { tokenFile: target.tokenFile } : {}),
+        ...(target.apiKeyFile !== undefined ? { apiKeyFile: target.apiKeyFile } : {}) });
      const res = await client.get<{ safe: boolean; reasons?: string[]; message?: string; seat?: SeatView;
        claude?: Parameters<typeof printClaude>[0] }>(`/api/provider/precheck?${qs.toString()}`);
      if (handleHttpError(res, "precheck")) return;
@@ -541,12 +546,19 @@ export function providerCommand(depsOverride?: StatusDeps): Command {

  cmd
    .command("switch")
-    .description("Move one seat to another subscription login, keeping its conversation: a Codex seat to a login saved in its Codex home (Linux only), a Claude seat to its own token file")
+    .description("Move one seat to subscription or API credentials, keeping its conversation: a Codex seat to a login saved in its Codex home (Linux only), a Claude seat to its own token file")
    .requiredOption("--seat <s>", "The seat session")
    .option("--to-account <a>", "Codex: the login's saved name in the seat's Codex home (rig auth list --codex-home <home>). Claude: your label for the token")
    .option("--token-file <path>", "Claude: the absolute path of a 0600 file holding the seat's own subscription token; it's read only as Claude starts")
+    .option("--api-key-file <path>", "Claude: a file containing its API key; resume the same conversation and settings")
    .option("--stored-login", "Claude: move the seat back to its config dir's stored login")
    .option("--force-unsafe", "Kept for scripts; a seat's checks can't be overridden, since each means nothing safe to restart or no such login")
+    .option("--clear-account-home", "Return to member/rig/daemon/native login selection through a fresh successor")
+    .option("--account-home <path>", "Move to an isolated native account home with a fresh successor and handover; no shared login is changed")
+    .option("--reason <text>", "Required with --account-home or --clear-account-home")
+    .option("--model <id>", "With --account-home or --clear-account-home, the successor's model")
+    .option("--codex-config-profile <name>", "With --account-home or --clear-account-home, the successor's Codex profile")
+    .option("--dry-run", "With --account-home or --clear-account-home, show the plan without changing anything")
    .option("--json", "Output as parseable JSON")
    .addHelpText("after", `
 The daemon plans the seat's in-place restart first (rig seat restart --plan), so a refusal changes nothing. It then saves the
@@ -568,19 +580,43 @@ to a 0600 file holding the token>. Only the path is kept, as the seat's referenc
 so the token never passes through OpenRig. First the daemon checks that the file would apply and that nothing Claude Code ranks
 above the token is set (a cloud provider, ANTHROPIC_AUTH_TOKEN, ANTHROPIC_API_KEY, an apiKeyHelper), and refuses with each one
 and its remedy if it is. When the token applies, the launch also unsets those names for Claude's process, so the pane shell's
-own exports can't outrank it. It takes a snapshot and checks that the snapshot resumes the seat's conversation. Then, holding
-the seat so no other stop, launch or switch runs on it in between, it sets the reference and relaunches the seat from that
-snapshot in its own pane: Claude ends there, the pane and its scrollback stay, and restore resumes the same conversation in it.
-Work in flight when it stopped doesn't carry over. Only a refusal before Claude was touched reads as unchanged; a relaunch that
-doesn't report a resumed conversation reads unknown, with the snapshot's recovery command, and isn't retried.
+own exports can't outrank it. For a running seat, it takes a snapshot and checks that the snapshot resumes the seat's
+conversation. Then, holding the seat so no other stop, launch or switch runs on it in between, it sets the reference and
+relaunches the seat from that snapshot in its own pane: Claude ends there, the pane and its scrollback stay, and restore
+resumes the same conversation in it. Work in flight when it stopped doesn't carry over. Only a refusal before Claude was
+touched reads as unchanged; a relaunch that doesn't report a resumed conversation reads unknown, with the snapshot's recovery
+command, and isn't retried. The relaunch uses the seat's own effort choice (rig seat set-effort) when there is one; otherwise
+it asks to keep the running effort, and uses the seat's saved effort when it can't. The report's effort line says which.
+A stopped seat isn't relaunched, and no snapshot is taken: the reference is saved only when the seat's next launch would
+resume its conversation, and the report prints that launch (rig launch <rig> <seat> --snapshot-id <id>, or a plain rig launch
+when restore's periodic carry resumes it). Otherwise it refuses and nothing changes.
 Seats sharing the config dir keep their own login: Claude Code reads the token from that one process's environment and doesn't
 save it. That environment is Claude's, so the tools, hooks and MCP servers it starts inherit the token, and one that prints its
 environment writes it into the transcript. A token-authenticated seat can make model requests but can't use claude.ai
 connectors or Remote Control; its local MCP servers still work. --stored-login moves it back to the config dir's stored login;
 a CLAUDE_CODE_OAUTH_TOKEN the seat still receives outranks that login, and the report says which token it will use. Claude's
-/status shows token auth with no account email, so the label is yours, not an observed account.`)
-    .action(async (opts: AccountOpts & { seat: string; forceUnsafe?: boolean; json?: boolean }) => {
-      const target = targetAccount(opts);
+/status shows token auth with no account email, so the label is yours, not an observed account.
+For Claude API billing use --to-account <label> --api-key-file <absolute path to a 0600 file>. The key reaches only the
+resumed child's environment, never command arguments. API credentials fail closed if their file is unavailable. Existing
+model, permissions, config home and conversation are retained; in-flight work is interrupted. Claude may require native
+API-key approval before the first turn. OpenRig does not enforce API budgets or choose when to fall back.
+Codex can select a saved API-key auth profile with --to-account just like a subscription profile. Its shared-home effects
+and native credential-store requirements are unchanged. No fresh account home or conversation is created.
+Do not combine --api-key-file with --account-home or --clear-account-home; select a home and switch credentials separately.
+--clear-account-home returns to the configured member/rig/daemon/native home through a fresh successor with a handover.
+Use it without --to-account, --stored-login, --account-home or --token-file. It removes an account-home token reference
+only after confirmation; it does not restore historical login bytes. Anthropic active/default profiles live outside
+CLAUDE_CONFIG_DIR and are not isolated by an account home; check them before relying on a stored login.`)
+    .action(async (opts: AccountOpts & { seat: string; forceUnsafe?: boolean; json?: boolean; accountHome?: string; clearAccountHome?: boolean; reason?: string; model?: string; codexConfigProfile?: string; dryRun?: boolean }) => {
+      if (opts.apiKeyFile !== undefined && (opts.accountHome !== undefined || opts.clearAccountHome)) {
+        console.error("Use --api-key-file for an in-place credential switch; select or clear an account home in a separate switch.");
+        process.exitCode = 1; return;
+      }
+      if (opts.clearAccountHome && (opts.accountHome !== undefined || opts.tokenFile !== undefined || opts.toAccount !== undefined || opts.storedLogin)) {
+        console.error("Use --clear-account-home alone, without --account-home, --token-file, --to-account or --stored-login.");
+        process.exitCode = 1; return;
+      }
+      const target = opts.clearAccountHome ? { toAccount: "default" } : targetAccount(opts);
      if (!target) {
        console.error("Name the account: --to-account <name> (with --token-file <path> for a Claude seat), or --stored-login for a Claude seat.");
        process.exitCode = 1;
@@ -591,6 +627,85 @@ a CLAUDE_CODE_OAUTH_TOKEN the seat still receives outranks that login, and the r
        process.exitCode = 1;
        return;
      }
+      if (opts.accountHome !== undefined || opts.clearAccountHome) {
+        if (!opts.reason?.trim() || opts.storedLogin) {
+          console.error(opts.clearAccountHome ? "Pass --reason with --clear-account-home."
+            : "With --account-home pass --reason and --to-account, without --stored-login. A Claude subscription may also name --token-file.");
+          process.exitCode = 1;
+          return;
+        }
+        let preview: { status: number; data: Record<string, unknown> };
+        try {
+          const status = await client.get<{ runtime?: string }>(`/api/seat/status/${encodeURIComponent(opts.seat)}`);
+          const runtime = status.data.runtime;
+          if (status.status >= 400 || (runtime !== "codex" && runtime !== "claude-code")) {
+            const refusal = { ok: false, code: "account_home_preflight_failed", message: "The seat runtime could not be read; no switch was requested." };
+            if (opts.json) console.log(JSON.stringify(refusal)); else console.error(refusal.message);
+            process.exitCode = 1; return;
+          }
+          preview = await client.post<Record<string, unknown>>(`/api/seat/set-runtime/${encodeURIComponent(opts.seat)}`, {
+            runtime, ...(opts.clearAccountHome ? { clearAccountHome: true } : { accountHome: opts.accountHome }), reason: opts.reason, dryRun: true,
+            ...(opts.model !== undefined ? { model: opts.model } : {}),
+            ...(opts.codexConfigProfile !== undefined ? { codexConfigProfile: opts.codexConfigProfile } : {}),
+            ...(opts.tokenFile !== undefined ? { tokenFile: opts.tokenFile, accountLabel: opts.toAccount } : {}),
+          }, { timeoutMs: 30_000 });
+        } catch {
+          const refusal = { ok: false, code: "account_home_preflight_failed", message: "The read-only account-home preflight failed; no switch was requested." };
+          if (opts.json) console.log(JSON.stringify(refusal)); else console.error(refusal.message);
+          process.exitCode = 1; return;
+        }
+        const token = opts.tokenFile ? { label: opts.toAccount!, tokenFile: opts.tokenFile } : undefined;
+        if (!accountHomePlanMatches(preview.data, opts.clearAccountHome ? null : opts.accountHome!, token)) {
+          const refusal = { ok: false, code: "account_home_switch_unavailable", message: preview.data["message"]
+            ?? "The daemon did not acknowledge the selected account home and token. No switch was requested." };
+          if (opts.json) console.log(JSON.stringify(refusal)); else console.error(refusal.message);
+          process.exitCode = 1; return;
+        }
+        if (opts.dryRun) {
+          if (opts.json) console.log(JSON.stringify(preview.data));
+          else {
+            console.log(`Account-home plan for ${opts.seat}: ${opts.accountHome ?? "configured defaults"}. Nothing changed.`);
+            const settings = (preview.data["settings"] ?? {}) as Record<string, { value: string | null; source: string }>;
+            console.log(`Settings on ${String(preview.data["to"])}:`);
+            for (const [name, setting] of Object.entries(settings)) console.log(`  ${name}: ${setting.value ?? "none"} (${setting.source})`);
+            const permission = preview.data["permission"] as { mode: string; source: string } | undefined;
+            if (permission) console.log(`  permissions: ${permission.mode} (${permission.source})`);
+            const dropped = (preview.data["dropped"] as Array<{ setting: string; value: string }> | undefined) ?? [];
+            if (dropped.length) console.log(`Cleared from ${String(preview.data["from"])}: ${dropped.map(choice => `${choice.setting} ${choice.value}`).join("; ")}.`);
+            console.log("Costs:");
+            for (const cost of (preview.data["costs"] as string[] | undefined) ?? []) console.log(`  - ${cost}`);
+          }
+          return;
+        }
+        let result;
+        try {
+          result = await client.post<Record<string, unknown>>("/api/provider/switch", {
+            seat: opts.seat, ...(opts.clearAccountHome ? { clearAccountHome: true } : { ...target, accountHome: opts.accountHome }), reason: opts.reason, dryRun: false,
+            ...(opts.model !== undefined ? { model: opts.model } : {}),
+            ...(opts.codexConfigProfile !== undefined ? { codexConfigProfile: opts.codexConfigProfile } : {}),
+          }, { timeoutMs: 300_000 });
+        } catch (error) {
+          if (!(error instanceof DaemonTimeoutError)) throw error;
+          result = { status: 202, data: { ok: false, code: "runtime_switch_outcome_unknown",
+            message: `The daemon may still be switching. Inspect rig seat status ${opts.seat}; do not retry the switch.` } };
+        }
+        if (opts.json) console.log(JSON.stringify(result.data));
+        else if (result.data["recoveryPending"] === true) {
+          console.error(`Recovery is still pending for ${opts.seat}; the account-home switch is not complete.`);
+          if (typeof result.data["message"] === "string") console.error(result.data["message"]);
+          if (typeof result.data["guidance"] === "string") console.error(result.data["guidance"]);
+          for (const warning of (result.data["warnings"] as string[] | undefined) ?? []) console.error(`Warning: ${warning}`);
+        }
+        else if (result.data["ok"] === true) console.log(`Account-home switch for ${opts.seat}: ${opts.accountHome ?? "configured defaults"}. A fresh conversation carries the handover; the account is not verified until a real tool turn.`);
+        else console.error(result.data["message"] ?? "The account-home switch did not complete.");
+        process.exitCode = result.status >= 400 || result.data["ok"] !== true || result.data["recoveryPending"] === true ? 1 : 0;
+        return;
+      }
+      if (opts.dryRun || opts.reason || opts.model || opts.codexConfigProfile) {
+        console.error("--reason, --model, --codex-config-profile and --dry-run require --account-home or --clear-account-home.");
+        process.exitCode = 1;
+        return;
+      }
      type SwitchResponse = { status: number; data: { outcome?: string; reasons?: string[]; message?: string; seat?: SwitchReport } };
      let res: SwitchResponse;
      const startedAt = new Date().toISOString();
@@ -622,9 +737,10 @@ a CLAUDE_CODE_OAUTH_TOKEN the seat still receives outranks that login, and the r
            console.log("undo restores saved credential bytes only; sign-in is unverified. Saved credentials may expire, be revoked, or be superseded by refresh elsewhere. Restart the affected seat and use the existing account verification; fresh sign-in may be required.");
          }
        } else if (seat) {
-          console.log(`Claude token: ${seat.tokenFile ? `"${seat.account}", read from ${seat.tokenFile}` : "the config dir's stored login"}${seat.loginChanged
+          console.log(`Claude ${seat.credentialKind === "api-key" ? "API key" : "token"}: ${seat.tokenFile ? `"${seat.account}", read from ${seat.tokenFile}` : "the config dir's stored login"}${seat.loginChanged
            ? seat.tokenApplied === false ? " (reference saved; the token didn't take effect)" : " (set)" : ""}`);
          for (const warning of seat.warnings ?? []) console.log(`warning: ${warning}`);
+          if (seat.effort) console.log(`effort: ${seat.effort}`);
          if (seat.conversation) console.log(`conversation: ${seat.conversation}`);
          if (seat.undo) console.log(`to switch back: ${seat.undo}`);
        }
@@ -99,6 +99,8 @@ interface NodeEntry {
  blockedWorkCount?: number;
  /** OPR.0.3.4.11 — held reason from node.held event. */
  heldReason?: string | null;
+  /** #2456: the required startup files this occupant's handover started it without. */
+  startedWithoutRequired?: string[];
  agentActivity?: {
    state: "running" | "needs_input" | "idle" | "unknown";
    reason: string;
@@ -238,6 +240,7 @@ const ALLOWED_NODE_FIELDS = new Set([
  "needsInputEvidence",
  "contextUsage",
  "heldReason",
+  "startedWithoutRequired",
  "storedSessionStatus",
  "identityVerdict",
 ]);
@@ -705,6 +708,11 @@ export function formatDeclaredModel(model: string | null | undefined): string {
  return m.length > 0 ? m : "not-declared";
 }

+/** #2456: the attention reason for an occupant started without a required startup file. */
+function startedWithoutLine(files: string[]): string {
+  return `missing required ${files.map((file) => file.split("/").pop()).join(", ")}`;
+}
+
 export function compactNodeProjection(nodes: NodeEntry[]): Array<Record<string, unknown>> {
  return nodes.map((n) => {
    const keepDiagnostics = n.needsAttention !== false;
@@ -768,6 +776,7 @@ export function compactNodeProjection(nodes: NodeEntry[]): Array<Record<string,
    }
    // held/attention reason (short) when present.
    if (n.heldReason) compact.heldReason = n.heldReason;
+    if (n.startedWithoutRequired?.length) compact.startedWithoutRequired = n.startedWithoutRequired;
    if (keepDiagnostics && n.latestError) {
      compact.latestError = n.latestError;
    }
@@ -926,7 +935,7 @@ intentionallyStopped, startupStatus, restoreOutcome, lifecycleState, tmuxAttachC
 resumeCommand, latestError, terminalActive, hasAssignedWork,
 assignedWorkCount, pendingWorkCount, inProgressWorkCount, blockedWorkCount,
 agentActivity, needsAttention, arbitratedNeedsInput, needsInputEvidence,
-contextUsage, heldReason, storedSessionStatus, identityVerdict.
+contextUsage, heldReason, startedWithoutRequired, storedSessionStatus, identityVerdict.

 --host runs on a remote host declared in ~/.openrig/hosts.yaml (no current-rig
 default applied; the remote host's rigs are shown).
@@ -1358,7 +1367,8 @@ async function handleNodes(
    console.log(padCompactNodeRow("RIG", "SESSION", "LIFECYCLE", "ACTIVITY", "WORK", "REASON", "ATTN"));
    for (const n of humanList as NodeEntry[]) {
      const reason = missingSessionGuidance(n) ?? (n.needsAttention !== false || hasCurrentUsageLimit(n)
-        ? (n.latestError ? truncate(n.latestError, 40) : n.agentActivity?.reason ?? "—")
+        ? (n.latestError ? truncate(n.latestError, 40) : n.startedWithoutRequired?.length ? truncate(startedWithoutLine(n.startedWithoutRequired), 40)
+          : n.agentActivity?.reason ?? "—")
        : livenessUnconfirmed(n) ? "liveness unconfirmed" : "—");
      console.log(padCompactNodeRow(
        n.rigName,
@@ -1395,6 +1405,7 @@ async function handleNodes(
        formatContextUsage(n.contextUsage),
        n.restoreOutcome,
        missingSessionGuidance(n) ?? (n.latestError ? truncate(n.latestError, 30) : n.heldReason ? `held: ${truncate(n.heldReason, 25)}`
+          : n.startedWithoutRequired?.length ? truncate(startedWithoutLine(n.startedWithoutRequired), 30)
          : livenessUnconfirmed(n) ? "liveness unconfirmed" : "—"),
      ));
    }
@@ -356,10 +356,29 @@ function printResult(json: boolean, body: unknown, status: number): void {
  if (status >= 400) process.exitCode = status >= 500 ? 2 : 1;
 }

+// Priority is matched exactly where it matters (the founder view, attention ranks), so "Critical" would quietly file
+// the row as ordinary work. The daemon stores what it's given, so a documented value is normalized here. Other values
+// are kept as given: `high`, `normal` and `background` are in real use, and the mission view ranks some of them.
+const QUEUE_PRIORITIES = ["routine", "urgent", "critical"];
+function queuePriorityArg(value: string): string {
+  const lower = value.toLowerCase();
+  if (QUEUE_PRIORITIES.includes(lower)) return lower;
+  console.error(`Note: --priority '${value}' is outside the documented choices (${QUEUE_PRIORITIES.join(", ")}); keeping it as given.`);
+  return value;
+}
+
+/** #2276: the daemon's checks of a new row's human-facing fields (missing summary or evidence for a person,
+ *  notification, questions, reply-to). The queue repository raises them before the row's first write, inside the
+ *  create's transaction. A remote host's refusal arrives as remote_queue_write_failed instead, so it isn't one of these. */
+const PRE_WRITE_CREATE_REFUSALS = new Set([
+  "human_route_fields_required", "invalid_human_notification", "invalid_human_questions", "reply_to_requires_update", "reply_to_not_found",
+]);
+
 /** #1642: why a create provably wrote nothing, for the refusals that come before any write: the
 *  selected daemon refused the forward before contacting another host (its registry was unreadable,
- *  the host unknown or SSH-declared), or refused a local create to a rig it doesn't have. Any other
- *  failure, including a timeout or a remote's error, may follow a commit, so it returns null. */
+ *  the host unknown or SSH-declared), refused a local create to a rig it doesn't have, or refused the
+ *  new row's fields while validating it. Any other failure, including a timeout or a remote's error,
+ *  may follow a commit, so it returns null. */
 function provenCreateRefusal(status: number, body: unknown): string | null {
  if (!body || typeof body !== "object") return null;
  const { error, failureClass, hostId } = body as { error?: unknown; failureClass?: unknown; hostId?: unknown };
@@ -370,6 +389,9 @@ function provenCreateRefusal(status: number, body: unknown): string | null {
  if (status === 400 && error === "unknown_destination_rig") {
    return "the daemon refused it because the destination's rig doesn't exist on that daemon.";
  }
+  if (status === 400 && typeof error === "string" && PRE_WRITE_CREATE_REFUSALS.has(error)) {
+    return `the daemon refused it before writing anything (${error}).`;
+  }
  return null;
 }

@@ -628,6 +650,18 @@ async function printQueueItemResult(
 // IMPL-SPEC §2.3-2.4.
 const SHOW_BODY_PREVIEW_MAX_CODEPOINTS = 512;

+// A misspelled state ("in_progress") would otherwise read as an empty queue, not as a mistake: the list route matches
+// names as given. Each name is checked and trimmed the way the route trims it. This warns rather than refuses, so the
+// CLI's copy of the list doesn't stop it working with a newer daemon that knows more states.
+const QUEUE_STATE_NAMES = ["pending", "in-progress", "done", "blocked", "failed", "denied", "canceled", "handed-off"];
+function warnIfUnknownStates(value?: string): void {
+  const names = (value ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+  const unknown = names.filter((name) => !QUEUE_STATE_NAMES.includes(name));
+  if (unknown.length === 0) return;
+  const effect = unknown.length === names.length ? " Nothing is filed under these names, so an empty result doesn't mean an empty queue." : "";
+  console.error(`Warning: unrecognized --state '${unknown.join("', '")}'. Supported states: ${QUEUE_STATE_NAMES.join(", ")}.${effect}`);
+}
+
 // Commander option parser. InvalidArgumentError (like positiveIntArg/enumArg) is what Commander
 // renders as its usual "option ... argument ... is invalid" error; a plain Error would escape parse.
 const WAKE_DURATION_FORMAT = "must be a positive integer with an optional s, m or h suffix (for example 90s, 15m, 168h)";
@@ -669,6 +703,12 @@ export function previewBody(
  };
 }

+// Mark the cut inside the body so readers that discard metadata or stderr can request the complete brief.
+// Counts use code points, like the preview.
+export function previewCutMarker(qitemId: string, shownCodePoints: number, totalCodePoints: number): string {
+  return `…[cut at ${shownCodePoints} of ${totalCodePoints} chars; rig queue show ${shellQuote(qitemId)} --full]`;
+}
+
 function isRecordWithStringBody(v: unknown): v is Record<string, unknown> & { body: string } {
  return (
    typeof v === "object" &&
@@ -900,7 +940,7 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
    .option("--mission <id>", "First-class mission scope; translated to a mission:<id> tag (composes with --tags)")
    .option("--slice <id>", "First-class slice scope; translated to a slice:<id> tag (composes with --tags)")
    .option("--gate <role>", "OPR.0.4.3.16: mark this as a gate qitem; translated to a gate:<role> tag (role e.g. guard | spec-review | pm-lead | qa | human). The idle-gate watchdog reads this predicate. Composes with --tags.")
-    .option("--priority <priority>", "Priority: routine | urgent | critical", "routine")
+    .option("--priority <priority>", "Priority: routine | urgent | critical", queuePriorityArg, "routine")
    .option("--tier <tier>", "Tier (e.g. fast, routine, deep, critical) — drives SLA")
    .option("--tags <tags>", "Comma-separated tags (composes with --mission and --slice)")
    .option("--expires-at <iso>", "ISO timestamp at which the qitem expires")
@@ -1200,6 +1240,7 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
    .option("--reopen", "Explicitly acknowledge a deliberate terminal-to-active repair; requires --state and --note")
    .option("--closure-reason <reason>", "Required for state=done. --state canceled takes no reason, except 'superseded' (with --closure-target = the successor), which records a supersession, distinct from an abandoned cancel")
    .option("--closure-target <target>", "Required for handed_off_to, escalation, and superseded; blocked_on park records use state=blocked with --blocked-on")
+    .option("--closure-required-at <iso>", "Accept a revised closure deadline on an in-progress item; keeps the claim and records the old/new time and accepting actor")
    .option("--resolution <text>", "The outcome, stored on the row and shown by rig queue show. Needs --state done, canceled, denied, failed or handed-off, and non-blank text. Stored when the update closes an open row, after anything the row already has (a fallback line, an earlier outcome); a row that is already closed keeps what it has")
    .option("--blocked-on <blocker>", "For state=blocked: the blocker — a qitem id (must exist and be live), a human seat (FR-6 park; requires summary + evidence_ref), or a typed non-qitem gate 'fold:<what>' / 'auth:<what>' / 'external:<what>'")
    .option("--wake-watchdog <jobId>", "For state=blocked: attach an existing live watchdog id targeting the row owner")
@@ -1215,6 +1256,7 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
      reopen?: boolean;
      closureReason?: string;
      closureTarget?: string;
+      closureRequiredAt?: string;
      resolution?: string;
      blockedOn?: string;
      wakeWatchdog?: string;
@@ -1251,6 +1293,7 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
          reopen: opts.reopen,
          closureReason: opts.closureReason,
          closureTarget: opts.closureTarget,
+          ...(opts.closureRequiredAt !== undefined ? { closureRequiredAt: opts.closureRequiredAt } : {}),
          resolution: opts.resolution,
          blockedOn: opts.blockedOn,
          wakeWatchdogId: opts.wakeWatchdog,
@@ -1374,7 +1417,7 @@ workspace home that is deferred/not-imminent belongs in its mission/slice.`)
    .option("--body <text>", "New qitem body inline (use - to read from stdin; mutually exclusive with --body-file). Omit both to keep the source body.")
    .option("--body-file <path>", "Read the new qitem body from a file path (use - for stdin; mutually exclusive with --body). Kills the backtick-shell-corruption class.")
    .option("--note <text>", "Transition note")
-    .option("--priority <priority>", "Override priority for the new qitem")
+    .option("--priority <priority>", "Override priority for the new qitem: routine | urgent | critical", queuePriorityArg)
    .option("--tier <tier>", "Override tier for the new qitem")
    .option("--tags <tags>", "Comma-separated tags for the new qitem")
    .option("--gate <role>", "OPR.0.4.3.16: mark the new qitem as gate work; translated to a gate:<role> tag (e.g. guard | spec-review). The idle-gate watchdog reads this predicate. Composes with --tags.")
@@ -1478,7 +1521,7 @@ workspace home that is deferred/not-imminent belongs in its mission/slice.`)
    .option("--body <text>", "New qitem body inline (use - to read from stdin; mutually exclusive with --body-file). Omit both to keep the source body.")
    .option("--body-file <path>", "Read the new qitem body from a file path (use - for stdin; mutually exclusive with --body). Kills the backtick-shell-corruption class.")
    .option("--note <text>", "Transition note")
-    .option("--priority <priority>", "Override priority for the new qitem")
+    .option("--priority <priority>", "Override priority for the new qitem: routine | urgent | critical", queuePriorityArg)
    .option("--tier <tier>", "Override tier for the new qitem")
    .option("--tags <tags>", "Comma-separated tags for the new qitem")
    .option("--gate <role>", "OPR.0.4.3.16: mark the new qitem as gate work; translated to a gate:<role> tag (e.g. guard | spec-review). The idle-gate watchdog reads this predicate. Composes with --tags.")
@@ -1641,7 +1684,10 @@ workspace home that is deferred/not-imminent belongs in its mission/slice.`)
          ...(closingTransition === undefined ? [] : [omittedReadField("closingTransition", closingTransition)]),
        ];
        const view = readView(item, fullCommand, omitted);
-        const transformed = { ...record, body: preview, bodyBytes, bodyTruncated, readView: view };
+        const shownBody = bodyTruncated
+          ? `${preview}${previewCutMarker(qitemId, Array.from(preview).length, Array.from(item.body).length)}`
+          : preview;
+        const transformed = { ...record, body: shownBody, bodyBytes, bodyTruncated, readView: view };
        // Slice 15 P2: with output.compact on, the empty fields are left out and counted.
        const compact = compactOutputEnabled() ? compactShow(transformed) : null;
        printResult(json, compact ? compact.item : transformed, res.status);
@@ -1761,6 +1807,7 @@ Examples:
      }
      if (opts.destination) params.set("destinationSession", opts.destination);
      if (opts.source) params.set("sourceSession", opts.source);
+      warnIfUnknownStates(opts.state);
      if (opts.state) params.set("state", opts.state);
      if (opts.targetRepo) params.set("targetRepo", opts.targetRepo);
      if (opts.limit) params.set("limit", String(opts.limit));
@@ -213,7 +213,7 @@ function buildSliceLsCommand(): Command {
  const cmd = new Command("ls")
    .description("List slices in a mission (or across all missions)")
    .option("--mission <name>", "Restrict to a single mission")
-    .option("--state <state>", "Filter: active | closed | shipped | all", "active")
+    .option("--state <state>", "Filter: active (in flight, blocked included) | shipped (delivered in place: shipped or done) | closed (in closed/, or superseded, retired or closed in place) | all", "active")
    .option("--json", "Machine-readable output")
    .action(async (opts, command) => {
      const out = makeStdout();
@@ -727,12 +727,13 @@ function buildMissionLsCommand(): Command {
          id: m.id,
          path: m.absPath,
          activeSliceCount: m.activeSliceCount,
+          shippedSliceCount: m.shippedSliceCount,
          closedSliceCount: m.closedSliceCount,
        }));
        emit(out, { ok: true, count: rows.length, missions: rows }, json,
          rows.length === 0
            ? ["(no missions)"]
-            : rows.map((r) => `${r.name}    ${r.id ?? "—"}    active=${r.activeSliceCount}  closed=${r.closedSliceCount}`),
+            : rows.map((r) => `${r.name}    ${r.id ?? "—"}    active=${r.activeSliceCount}  shipped=${r.shippedSliceCount}  closed=${r.closedSliceCount}`),
        );
      } catch (err) {
        fail(err, json, out);
@@ -764,6 +765,7 @@ function buildMissionShowCommand(): Command {
            id: mission.id,
            path: mission.absPath,
            activeSliceCount: mission.activeSliceCount,
+            shippedSliceCount: mission.shippedSliceCount,
            closedSliceCount: mission.closedSliceCount,
            frontmatter: mission.frontmatter,
            trust,
@@ -778,6 +780,7 @@ function buildMissionShowCommand(): Command {
          out.write(`  id: ${mission.id ?? "—"}\n`);
          out.write(formatTrustLine(trust));
          out.write(`  active slices: ${mission.activeSliceCount}\n`);
+          out.write(`  shipped slices: ${mission.shippedSliceCount}\n`);
          out.write(`  closed slices: ${mission.closedSliceCount}\n`);
          out.write(`  path: ${mission.absPath}\n`);
          if (readme) {
@@ -1100,6 +1103,7 @@ function buildAuditCommand(): Command {
              frontmatter: {},
              id: null,
              activeSliceCount: 0,
+              shippedSliceCount: 0,
              closedSliceCount: 0,
            };
        const graph = buildMissionDependencyGraph(auditMission);
@@ -1232,6 +1236,8 @@ function buildAuditCommand(): Command {
        for (const sr of sliceResults) {
          const shadow = shadowedNodeFileFinding(path.join(slicesDir, sr.name), "slice");
          if (shadow) sr.result.findings.push(shadow);
+          const shared = sharedSliceNameFinding(missionsRoot, missionName, sr.name);
+          if (shared) sr.result.findings.push(shared);
        }

        const allFindings = [
@@ -2152,6 +2158,34 @@ function shadowedNodeFileFinding(dir: string, level: "mission" | "slice"): {
  };
 }

+/**
+ * Advisory-only: another mission has a slice folder of the same name. The slice list and the routes that
+ * find a slice by name keep one slice per name, so the others are hidden there with no sign they exist.
+ * Twin of the daemon's finding of the same name.
+ */
+function sharedSliceNameFinding(missionsRoot: string, missionName: string, sliceName: string): {
+  kind: "slice_name_shared"; severity: "low"; path: string; message: string; remediation: string;
+} | null {
+  let others: string[];
+  try {
+    others = fs.readdirSync(missionsRoot, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && !e.name.startsWith(".") && e.name !== missionName
+        && fs.statSync(path.join(missionsRoot, e.name, "slices", sliceName), { throwIfNoEntry: false })?.isDirectory() === true)
+      .map((e) => e.name)
+      .sort();
+  } catch {
+    return null;
+  }
+  if (others.length === 0) return null;
+  return {
+    kind: "slice_name_shared",
+    severity: "low",
+    path: path.join(missionsRoot, missionName, "slices", sliceName),
+    message: `Mission ${others.join(", ")} also ${others.length === 1 ? "has" : "have"} a slice named "${sliceName}". The slice list (GET /api/slices) and the routes that find a slice by name keep one slice per name, so all but one of these slices are hidden there.`,
+    remediation: "Rename one of the slice folders so each slice name is unique across missions. Advisory only — nothing is blocked.",
+  };
+}
+
 export function scopeCommand(): Command {
  const cmd = new Command("scope")
    .description("Scope tree primitive: missions, slices, sub-slices (per conventions/scope-and-versioning)")
@@ -1,3 +1,4 @@
+import { accountHomePlanMatches } from "../lib/account-home-switch.js";
 import { readFileSync } from "node:fs";
 import { Command } from "commander";
 import { DaemonClient, DaemonTimeoutError, terminalAuthHeaders } from "../client.js";
@@ -62,13 +63,15 @@ interface SeatStatusResponse {
  };
  session_status: string | null;
  launch_cwd?: string | null;
+  permissions_to?: string | null;
+  runner?: boolean;
  runtime_home?: {
    variable: string;
    home: string | null;
-    source: "member" | "rig" | "daemon" | "native_default";
+    source: "member" | "rig" | "daemon" | "native_default" | "account-switch";
    ignored?: { source: string; value: string };
  };
-  claude_token?: { label: string; token_file: string; file: "readable" | "unusable"; problem?: string; notice?: string };
+  claude_token?: { kind?: "api-key"; label: string; token_file: string; file: "readable" | "unusable"; problem?: string; notice?: string };
  session_reason?: string | null;
  startup_status: string | null;
  occupant_lifecycle: string;
@@ -156,19 +159,31 @@ interface SeatHandoverMutationResult {
  currentStatus: SeatHandoverPlan["currentStatus"];
  handoverAt: string;
  eventSeq: number;
+  /** What the successor was told on taking the seat, such as its held messages. */
+  warnings?: string[];
  /** OPR.0.5.5.5 — per-source execution record (wire mirror of the daemon shape). */
  sourceOutcome?:
    | { mode: "fork"; forkedFrom: string; forkId?: "captured" | "pending"; limit?: string }
    | { mode: "rebuild"; primedArtifacts: Array<{ address: string; label: string }>; gaps: string[]; emptyChainReason?: string; permissions?: { state: string; detail: string } };
  /** The restore packet was pasted and Enter pressed, but its submission couldn't be confirmed. */
  restorePacket?: { status: "unconfirmed"; reason: string };
+  /** #2456: the required startup files the successor started without, where a start would have failed. */
+  startedWithoutRequired?: string[];
  sideEffects: {
    departingSessionKilled: false;
+    /** Absent from an older daemon, whose receipt reported both side effects as a fixed false. */
+    departingProcess?: "ended-graceful" | "ended-forced" | "not-touched";
    startupContextDelivered: boolean;
-    provenanceRecordWritten: false;
+    provenanceRecordWritten: boolean;
  };
 }

+const DEPARTING_PROCESS_LINES = {
+  "ended-graceful": "The previous occupant's process exited on TERM; its tmux session was kept, and the successor runs in the same pane.",
+  "ended-forced": "The previous occupant's process didn't exit on TERM and was killed; its tmux session was kept, and the successor runs in the same pane.",
+  "not-touched": "The previous occupant's process wasn't touched: the successor was an existing session.",
+} as const;
+
 interface SeatSwitchClientResponse {
  seat_ref: string;
  session: string;
@@ -193,22 +208,28 @@ const LEVEL_WORDS: Record<string, string> = {
  "sends-only": "Deliberate sends from people and agents type; OpenRig's own notices are held.",
 };

+/** Show configured seat state, including selected account references, without claiming the running login is verified. */
 function printHuman(status: SeatStatusResponse): void {
  console.log(`Seat ${status.seat_ref}`);
  console.log(`Rig: ${status.rig_name}`);
  console.log(`Logical ID: ${status.logical_id}`);
  console.log(`Current occupant: ${display(status.current_occupant)}`);
  if (status.launch_cwd !== undefined) console.log(`Working directory for future launches: ${display(status.launch_cwd)}`);
+  // Only a runner submits permission requests; a plain seat's own prompts are its harness's.
+  if (status.permissions_to || status.runner) {
+    console.log(`Runner permission requests answered by: ${status.permissions_to === "deny" ? "no one: refused (--deny)" : status.permissions_to ?? "the default person"}`);
+  }
  if (status.runtime_home) {
    const h = status.runtime_home;
    const from = h.source === "member" || h.source === "rig" ? `the seat's own, from its ${h.source} env`
+      : h.source === "account-switch" ? "the seat's selected account home"
      : h.source === "daemon" ? "the daemon's" : "the native default";
    console.log(`Runtime home (${h.variable}) for launches: ${display(h.home)} (${from}; configured, not proof of the login a running session uses)`);
    if (h.ignored) console.log(`  Ignored: its ${h.ignored.source} env sets ${h.variable}=${h.ignored.value}, which isn't an absolute path`);
  }
  if (status.claude_token) {
    const t = status.claude_token;
-    console.log(`Claude subscription token: ${t.label}, read from ${t.token_file} at each launch (${t.file === "readable" ? "readable now" : "won't apply at the next launch"})`);
+    console.log(`Claude ${t.kind === "api-key" ? "API key" : "subscription token"}: ${t.label}, read from ${t.token_file} at each launch (${t.file === "readable" ? "readable now" : "won't apply at the next launch"})`);
    if (t.notice) console.log(`  ${t.notice}`);
  }
  if (status.typingGuard) {
@@ -306,7 +327,11 @@ function printHumanHandoverPlan(plan: SeatHandoverPlan): void {
 }

 function printHumanHandoverResult(result: SeatHandoverMutationResult): void {
-  console.log(`Seat handover complete: ${result.seat.ref}`);
+  // #2456: a successor that started without a required startup file isn't a plain success; a start would have failed.
+  const withoutRequired = result.startedWithoutRequired ?? [];
+  console.log(`Seat handover complete${withoutRequired.length > 0 ? ", degraded" : ""}: ${result.seat.ref}`);
+  for (const file of withoutRequired) console.log(`The successor started without required file ${file}.`);
+  if (withoutRequired.length > 0) console.log("rig ps --nodes shows the seat as needing attention until it's next launched.");
  console.log(`Rig: ${result.seat.rigName}`);
  console.log(`Logical ID: ${result.seat.logicalId}`);
  console.log(`Source: ${result.source.mode}${result.source.ref ? `:${result.source.ref}` : ""}`);
@@ -316,6 +341,14 @@ function printHumanHandoverResult(result: SeatHandoverMutationResult): void {
  console.log(`Current occupant: ${result.currentOccupant}`);
  console.log(`Handover result: ${display(result.currentStatus.handoverResult)}`);
  console.log("Seat binding and inventory provenance were updated.");
+  for (const warning of result.warnings ?? []) console.warn(`Warning: ${warning}`);
+  // An older daemon reports both side effects as a fixed false: say nothing rather than misreport them.
+  if (result.sideEffects.departingProcess) {
+    console.log(result.sideEffects.provenanceRecordWritten
+      ? "The handover's lineage record (occupant tenure) was written."
+      : "The handover's lineage record (occupant tenure) was NOT written; check the daemon log, which names the first such failure since the daemon started. The seat is already bound to the successor, so don't run the handover again.");
+    console.log(DEPARTING_PROCESS_LINES[result.sideEffects.departingProcess]);
+  }
  // OPR.0.5.5.5 — the per-source execution record: what actually carried context.
  if (result.sourceOutcome?.mode === "fork") {
    console.log(`Native fork of ${result.sourceOutcome.forkedFrom}: the successor carries the incumbent conversation from its first byte.`);
@@ -340,18 +373,18 @@ function printHumanHandoverResult(result: SeatHandoverMutationResult): void {
      // live successor agent.
      console.log("The captured startup context (restore packet) was delivered to the successor.");
    }
-    console.log("No conversation continuity, provenance markdown, or session stop was performed.");
+    console.log("No conversation continuity was carried: the successor started a fresh conversation.");
  } else if (result.restorePacket?.status === "unconfirmed") {
    // The packet was pasted and Enter pressed: the successor may already be working on it, so don't send it again.
    console.log(`The captured startup context (restore packet) was sent to the successor, but its submission is unconfirmed: ${result.restorePacket.reason}.`);
    console.log("Check the successor's screen before sending the context again; it may already be working on it.");
-    console.log("No conversation continuity, provenance markdown, or session stop was performed.");
+    console.log("No conversation continuity was carried: the successor started a fresh conversation.");
  } else if (result.source.mode === "fork") {
    console.log("No packet delivery: fork context rides the native conversation itself.");
  } else {
    // discovered handover: the operator-prepared successor is already live, so no
    // separate context delivery is performed.
-    console.log("No conversation continuity, startup context delivery, provenance markdown, or session stop was performed.");
+    console.log("OpenRig delivered no startup context and carried no conversation: the discovered successor was already running.");
  }
 }

@@ -378,6 +411,7 @@ function printSeatError(error: SeatStatusError, fallback: string): void {
  }
 }

+/** Build seat lifecycle commands, requiring acknowledged plans before isolated account-home changes. */
 export function seatCommand(depsOverride?: SeatDeps & { readStdin?: () => Promise<string>; host?: RunOnHostDeps }): Command {
  const cmd = new Command("seat")
    .description("Inspect OpenRig seat observability state");
@@ -435,6 +469,11 @@ when the current input contains a draft or cannot be read. It returns the exact
 reason and held message ID immediately, without automatic retry.
 Off (--enabled false) permits new automatic sends.

+This works from an ordinary terminal as well as from a seat's shell. From a
+managed seat's shell (OPENRIG_SESSION_NAME set), the change is recorded under
+that seat. From a terminal with no seat identity, it applies the same way and is
+recorded as "unattributed (no seat identity)".
+
 Between off (always interrupt) and hold (full quiet):
  openrig-urgent  OpenRig's own messages (watchdogs, scheduled wakes, notices) and
                  anything marked urgent type; other agents' messages are held.
@@ -529,7 +568,7 @@ Examples:
  cmd
    .command("handover")
    .argument("<seat>", "Canonical session name or logical seat ref")
-    .option("--source <source>", "Source: fresh (default; launches a new agent), discovered:<id> (operator-prepared), fork:<id> (native fork of the source conversation), or rebuild (fresh agent primed from the seat's durable artifacts).")
+    .option("--source <source>", "Source: fresh (default; launches a new agent), discovered:<id> (operator-prepared), fork:<seat> (native fork of that seat's conversation, by its session name), or rebuild (fresh agent primed from the seat's durable artifacts).")
    .option("--reason <reason>", "Why the handover is happening")
    .option("--operator <address>", "Operator initiating the handover")
    .option("--dry-run", "Plan the handover without changing topology")
@@ -669,7 +708,7 @@ identity remains unverified; a version number alone cannot clear it.
  // Thin CLI over the daemon's SeatLifecycleService; refusals print message +
  // guidance + match list exactly as the daemon named them.
  const runLifecycleVerb = async (
-    path: "set-terminal-policy" | "set-model" | "set-cwd" | "set-effort" | "set-permissions" | "launch" | "launch-plan" | "continue" | "stop" | "clean" | "restart" | "restart-plan" | "restart-verify",
+    path: "set-terminal-policy" | "set-model" | "set-cwd" | "set-effort" | "set-permissions" | "set-permissions-to" | "launch" | "launch-plan" | "continue" | "stop" | "clean" | "restart" | "restart-plan" | "restart-verify",
    seat: string,
    body: Record<string, unknown>,
    opts: { json?: boolean },
@@ -852,6 +891,49 @@ Examples:
      });
    });

+  cmd
+    .command("set-permissions-to")
+    .argument("<seat>", "Canonical session name or logical seat ref")
+    .option("--to <person>", "The registered person who answers this seat's runner permission requests instead of the default person, such as mike@external")
+    .option("--clear", "Remove the override: the default person answers again")
+    .option("--deny", "Opt in to refusing every runner permission request on this seat")
+    .requiredOption("--reason <text>", "Audit reason recorded on the node.permissions_to_changed event")
+    .option("--operator <address>", "Operator recorded on the audit event (required outside a managed seat)")
+    .option("--json", "JSON output for agents")
+    .description("Choose who answers a runner seat's permission requests instead of the default person, or opt in to refusing them (audited)")
+    .addHelpText("after", `
+A runner seat's agent can ask permission for a tool call. The runner sends the
+request to OpenRig, and one person gets an ordinary ask with every option the agent
+offered; the answer goes back to that one request. That person is the default person
+(rig gateway default), unless this override names someone else. When no one can be
+asked, OpenRig's default is to permit the request.
+
+Only a registered person can be chosen (rig gateway human list). A seat address is
+refused. --clear removes the override. --deny is the opt-in for a seat whose requests
+should all be refused. See docs/reference/harness-runner-contract.md, section 7.
+Examples:
+  rig seat set-permissions-to dev-runner@my-rig --to mike@external --reason "Mike approves tool calls"
+  rig seat set-permissions-to dev-runner@my-rig --deny --reason "high-stakes repo: refuse every request"
+  rig seat set-permissions-to dev-runner@my-rig --clear --reason "back to the default person" --json`)
+    .action(async (seat: string, opts: { to?: string; clear?: boolean; deny?: boolean; reason: string; operator?: string; json?: boolean }) => {
+      if ([Boolean(opts.clear), Boolean(opts.deny), opts.to !== undefined].filter(Boolean).length !== 1) {
+        console.error("Pass exactly one of --to <person>, --clear or --deny.");
+        process.exitCode = 1;
+        return;
+      }
+      const body = opts.clear ? { clear: true, reason: opts.reason, operator: opts.operator }
+        : opts.deny ? { deny: true, reason: opts.reason, operator: opts.operator }
+        : { to: opts.to, reason: opts.reason, operator: opts.operator };
+      await runLifecycleVerb("set-permissions-to", seat, body, opts, (data) => {
+        const s = data["seat"] as { logicalId?: string; rigName?: string } | undefined;
+        const name = `${s?.logicalId}@${s?.rigName}`;
+        const owner = (value: unknown) => value === "deny" ? "refused (--deny)" : typeof value === "string" ? value : "the default person";
+        console.log(data["changed"] === false
+          ? `${name}'s permission requests already go to ${owner(data["to"])}. No change recorded.`
+          : `${name}'s permission requests: ${owner(data["from"])} -> ${owner(data["to"])} (audited).`);
+      });
+    });
+
  cmd
    .command("effort")
    .argument("<seat>", "Canonical session name or logical seat ref")
@@ -919,6 +1001,10 @@ resume/successor launch reads it at call time. Examples:
    .option("--model <id>", "Target model; otherwise the seat's agent spec for the target, else the target's default")
    .option("--effort <level>", "Target effort, the target runtime's own level (not translated)")
    .option("--codex-config-profile <name>", "Codex configuration profile for a Codex successor")
+    .option("--clear-account-home", "Return to member/rig/daemon/native login selection through a fresh successor")
+    .option("--account-home <path>", "Isolated target CODEX_HOME or CLAUDE_CONFIG_DIR; also permits a fresh successor on the same runtime")
+    .option("--token-file <path>", "With a Claude account home, its required subscription token reference")
+    .option("--account-label <label>", "With --token-file, the selected account's label")
    .option("--permission-mode <mode>", "Target native permission choice; default: inherit the seat's member and rig policy")
    .option("--confirm-timeout <seconds>", "How long the successor has to confirm the handover (default 180)")
    .option("--dry-run", "Show the plan (settings, what is cleared, costs) without changing anything")
@@ -941,6 +1027,11 @@ effort, Codex profile and native permission choice are cleared, not mapped; two
 processes run until cutover; messages sent to the seat during the switch are
 held, not typed, and need sending again afterwards.
 Codex and Claude Code, single-pane seats only. --dry-run lists the details.
+A seat that has never started has no pane to switch: declare the other runtime for it in its rig spec and bring the team
+up again from that spec. That's a new generation of the seat, without this seat's edges, settings or queued work.
+--clear-account-home returns to configured member/rig/daemon/native selection; it does not restore historical credentials.
+It uses a fresh successor and clears an account-home token reference only after confirmation. Do not combine it with
+--account-home or a new token reference. Anthropic's global active/default profile is not isolated by CLAUDE_CONFIG_DIR.

 A seat can switch itself (its CLI may end when it retires; the daemon finishes).
  rig seat set-runtime dev-impl@my-rig --runtime claude-code --reason "Codex limit" --dry-run
@@ -948,7 +1039,11 @@ A seat can switch itself (its CLI may end when it retires; the daemon finishes).
  rig seat status dev-impl@my-rig            # an open or interrupted switch shows here
  rig seat set-runtime dev-impl@my-rig --recover`)
    .action(async (seat: string, opts: { runtime?: string; reason?: string; model?: string; effort?: string; codexConfigProfile?: string;
-      permissionMode?: string; confirmTimeout?: string; dryRun?: boolean; confirm?: string; note?: string; recover?: boolean; json?: boolean }) => {
+      permissionMode?: string; accountHome?: string; clearAccountHome?: boolean; tokenFile?: string; accountLabel?: string; confirmTimeout?: string; dryRun?: boolean; confirm?: string; note?: string; recover?: boolean; json?: boolean }) => {
+      if (opts.clearAccountHome && (opts.accountHome !== undefined || opts.tokenFile !== undefined || opts.accountLabel !== undefined || opts.runtime === undefined)) {
+        console.error("Use --clear-account-home with --runtime and without --account-home, --token-file or --account-label.");
+        process.exitCode = 1; return;
+      }
      const modes = [opts.confirm !== undefined, opts.recover === true, opts.runtime !== undefined].filter(Boolean).length;
      if (modes !== 1) {
        console.error("Pass exactly one of --runtime <runtime> (with --reason), --confirm <switch-id> (with --note), or --recover.");
@@ -980,19 +1075,42 @@ A seat can switch itself (its CLI may end when it retires; the daemon finishes).
      const client = deps.clientFactory(getDaemonUrl(daemon));
      const base = `/api/seat/set-runtime/${encodeURIComponent(seat)}`;
      let res;
+      let switchRequested = false;
      try {
        res = opts.confirm !== undefined
          ? await client.post<Record<string, unknown>>(`${base}/confirm`, { switchId: opts.confirm, note: opts.note })
          : opts.recover
            ? await client.post<Record<string, unknown>>(`${base}/recover`, {}, { timeoutMs: 60_000 })
-            : await client.post<Record<string, unknown>>(base, {
-              runtime: opts.runtime, reason: opts.reason, dryRun: opts.dryRun === true,
-              ...(opts.model !== undefined ? { model: opts.model } : {}), ...(opts.effort !== undefined ? { effort: opts.effort } : {}),
-              ...(opts.codexConfigProfile !== undefined ? { codexConfigProfile: opts.codexConfigProfile } : {}),
-              ...(opts.permissionMode !== undefined ? { permissionMode: opts.permissionMode } : {}),
-              ...(confirmTimeoutSeconds !== undefined ? { confirmTimeoutSeconds } : {}),
-            }, { timeoutMs: opts.dryRun ? 30_000 : ((confirmTimeoutSeconds ?? 180) + 120) * 1000 });
+            : await (async () => {
+              const body = {
+                runtime: opts.runtime, reason: opts.reason, dryRun: opts.dryRun === true,
+                ...(opts.model !== undefined ? { model: opts.model } : {}), ...(opts.effort !== undefined ? { effort: opts.effort } : {}),
+                ...(opts.codexConfigProfile !== undefined ? { codexConfigProfile: opts.codexConfigProfile } : {}),
+                ...(opts.permissionMode !== undefined ? { permissionMode: opts.permissionMode } : {}),
+                ...(opts.accountHome !== undefined ? { accountHome: opts.accountHome } : {}),
+                ...(opts.clearAccountHome ? { clearAccountHome: true } : {}),
+                ...(opts.tokenFile !== undefined ? { tokenFile: opts.tokenFile, accountLabel: opts.accountLabel ?? "selected-account" } : {}),
+                ...(confirmTimeoutSeconds !== undefined ? { confirmTimeoutSeconds } : {}),
+              };
+              if (opts.accountHome !== undefined || opts.clearAccountHome) {
+                const preview = await client.post<Record<string, unknown>>(base, { ...body, dryRun: true }, { timeoutMs: 30_000 });
+                const token = opts.tokenFile ? { label: opts.accountLabel ?? "selected-account", tokenFile: opts.tokenFile } : undefined;
+                if (!accountHomePlanMatches(preview.data, opts.clearAccountHome ? null : opts.accountHome!, token)) {
+                  return { status: 409, data: { ok: false, code: "account_home_switch_unavailable",
+                    message: preview.data["message"] ?? "The daemon did not acknowledge the selected account home and token. No switch was requested." } };
+                }
+                if (opts.dryRun) return preview;
+              }
+              switchRequested = true;
+              return client.post<Record<string, unknown>>(base, body,
+                { timeoutMs: opts.dryRun ? 30_000 : ((confirmTimeoutSeconds ?? 180) + 120) * 1000 });
+            })();
      } catch (err) {
+        if ((opts.accountHome !== undefined || opts.clearAccountHome) && !switchRequested) {
+          const refusal = { ok: false, code: "account_home_preflight_failed", message: "The read-only account-home preflight failed; no switch was requested." };
+          if (opts.json) console.log(JSON.stringify(refusal)); else console.error(refusal.message);
+          process.exitCode = 1; return;
+        }
        if (!(err instanceof DaemonTimeoutError) || opts.dryRun) throw err;
        const unknown = { ok: false as const, code: "runtime_switch_outcome_unknown", status: "unknown",
          message: "The CLI stopped waiting; the daemon may still be switching the seat.",
@@ -1026,7 +1144,12 @@ A seat can switch itself (its CLI may end when it retires; the daemon finishes).
      const label = (source: string) => source === "explicit" ? "as given" : source === "agent_spec" ? "from the seat's agent spec" : "the runtime's default";
      const settings = (data["settings"] ?? {}) as Record<string, { value: string | null; source: string }>;
      if (data["dryRun"]) console.log(`Runtime switch plan for ${name}: ${String(data["from"])} -> ${String(data["to"])}. Nothing changes until you run it without --dry-run.`);
+      else if (data["recoveryPending"] === true) console.log(`Recovery is still pending for ${name} (switch ${String(data["switchId"])}); the runtime switch is not complete.`);
      else console.log(`Switched ${name} from ${String(data["from"])} to ${String(data["to"])} (switch ${String(data["switchId"])}).`);
+      if (data["accountHome"] === null) console.log("Selected account home: configured defaults (member/rig, then daemon, then native)");
+      else if (data["accountHome"]) console.log(`Selected account home: ${String(data["accountHome"])}`);
+      const accountToken = data["accountToken"] as { label: string; tokenFile: string } | undefined;
+      if (accountToken) console.log(`Claude token reference: ${accountToken.label}, read from ${accountToken.tokenFile} at launch`);
      console.log(`Settings on ${String(data["to"])}:`);
      for (const [key, title] of [["model", "model"], ["effort", "effort"], ["advisor", "advisor"], ["codexConfigProfile", "Codex profile"]] as const) {
        const setting = settings[key];
@@ -1280,6 +1403,8 @@ session is refused (use rig unclaim). Stopping ends that agent's session and any
 work in progress: check it first (rig capture <seat>) and stop only a seat you
 own or were asked to stop. rig seat launch <seat> --fresh --reason <text> starts
 a fresh occupant there; it does not resume the stopped conversation.
+A community harness stop closes its managed pane; its native processes or compute
+may outlive it. Inspect their own lifecycle receipts.
 An intentionally stopped seat does not degrade an otherwise running rig.
 Running counts still exclude the stopped seat; stopping every seat leaves the
 rig stopped. Examples:
@@ -1290,6 +1415,7 @@ rig stopped. Examples:
        const s = data["seat"] as { logicalId?: string; rigName?: string } | undefined;
        console.log(`Stopped ${String(data["sessionName"])} (seat ${s?.logicalId}@${s?.rigName}).`);
        console.log("Session marked exited, binding cleared; siblings untouched. Relaunch via the normal launch surface.");
+        if (data["paneOnly"]) console.log("Only the community seat viewer was closed. Native execution, storage and compute may remain; inspect the selected environment or harness lifecycle.");
      });
    });

@@ -1464,7 +1590,7 @@ export function handoverCommand(depsOverride?: SeatDeps): Command {
  };
  return new Command("handover")
    .argument("<seat>", "Canonical session name or logical seat ref")
-    .option("--source <source>", "Successor source: fresh (default; launches a new agent), discovered:<id> (operator-prepared), fork:<id> (native fork of the source conversation), or rebuild (fresh agent primed from the seat's durable artifacts).")
+    .option("--source <source>", "Successor source: fresh (default; launches a new agent), discovered:<id> (operator-prepared), fork:<seat> (native fork of that seat's conversation, by its session name), or rebuild (fresh agent primed from the seat's durable artifacts).")
    .option("--reason <reason>", "Why the handover is happening")
    .option("--operator <address>", "Operator initiating the handover")
    .option("--dry-run", "Plan the handover without changing topology")
@@ -1472,8 +1598,8 @@ export function handoverCommand(depsOverride?: SeatDeps): Command {
    .description("Hand a seat to a successor: create -> deliver context -> verify continuity -> rebind")
    .addHelpText("after", `
 All four sources execute (OPR.0.5.5.5): fresh delivers a captured restore
-packet; discovered adopts an operator-prepared live session; fork:<id> launches
-a NATIVE FORK of the source conversation (the successor carries the incumbent
+packet; discovered adopts an operator-prepared live session; fork:<seat> launches
+a NATIVE FORK of that seat's conversation (the successor carries the incumbent
 context from its first byte); rebuild launches fresh and primes from the seat's
 durable artifact chain, recording exactly what it found. A source that cannot
 proceed (e.g. fork with no discoverable native id) refuses honestly before any
@@ -1,3 +1,4 @@
+import { isHumanSeatSessionRef } from "../session-name.js";
 import { Command } from "commander";
 import { resolveEffectiveHost } from "../host-selection.js";
 import { DaemonClient, DaemonConnectionError, terminalAuthHeaders } from "../client.js";
@@ -90,6 +91,9 @@ export function wrapSendBody(
  // renders EXACTLY AS RECEIVED — bare member@rig locally (copy-paste reply hint), and a
  // cross-host caller constructs the origin triple at the forwarding boundary before wrapping.
  const senderLabel = sender && sender.trim().length > 0 ? sender : SENDER_FALLBACK;
+  // Only reply classification uses the bare address; From and the destination retain the origin host.
+  const senderParts = senderLabel.split("@");
+  const personAddress = senderParts.length === 3 && senderParts[2] ? senderParts.slice(0, 2).join("@") : senderLabel;
  const header = [`From: ${senderLabel}`, renderToLine(recipient, meta?.scope)];
  if (meta?.stampISO) {
    // GHOST-STAGE (g): the sender's occupant generation rides the Sent: line as a short suffix
@@ -102,7 +106,9 @@ export function wrapSendBody(
  }
  const reply = senderLabel.endsWith("@external")
    ? `↩ Reply if needed: rig queue create --destination ${senderLabel}${meta?.replyToQitem ? ` --human-intent update --reply-to ${meta.replyToQitem}` : ""} --summary "<one line>" --body "..." --verify`
-    : `↩ Reply: rig send ${senderLabel} "..."`;
+    : isHumanSeatSessionRef(personAddress)
+      ? `↩ Reply if needed: rig queue create --destination ${senderLabel} --human-intent update --summary "<one line>" --evidence-ref "<path>" --body "..." --verify`
+      : `↩ Reply: rig send ${senderLabel} "..."`;
  return [...header, "---", body, "---", reply].join("\n");
 }

@@ -236,7 +242,7 @@ export function sendCommand(depsOverride?: SendDeps): Command {
    .option("--to <sessions>", "Multi-recipient: comma-list or repeated (--to a,b or --to a --to b)", collectSessions, [] as string[])
    .option("--pod <name>", "Send to every seat in a pod (fan-out, per-recipient results)")
    .option("--rig <name>", "Send to every seat in a rig (fan-out, per-recipient results)")
-    .option("--verify", "Verify pane only delivery by checking content after send")
+    .option("--verify", "Verify pane only delivery by checking content after send. Exit 1 can mean unconfirmed, not failed: the message may have arrived, so inspect with rig capture before any resend")
    .option("--force", "Back-compat no-op: a mid-task/busy pane already sends-with-advisory by default; --force never bypasses the interactive-prompt/permission guard")
    .option("--wait-for-idle <seconds>", "Wait until the target is explicitly idle before sending. If it's still busy, or its activity is unknown, when the wait ends, nothing is sent (exit 1) and nothing is kept to send later; put separate work in a queue row (rig queue create)")
    .option("--raw", "Send exact text/keystrokes without the From/To messaging envelope (still guarded against interactive prompts)")
@@ -565,7 +571,7 @@ agent@rig@host is sugar for --host when the suffix is a REGISTERED host id
        const envelope = !effect
          ? res.data
          : effectUnresolved(effect)
-            ? { ...res.data, verified: false, outcome: "staged-not-consumed", effectCheck: effect }
+            ? { ...res.data, verified: false, outcome: effectSubmissionUnconfirmed(effect) ? "submission-unconfirmed" : "staged-not-consumed", effectCheck: effect }
            : { ...res.data, effectCheck: effect };
        console.log(JSON.stringify(envelope));
        if (res.status >= 400) process.exitCode = res.status >= 500 ? 2 : 1;
@@ -632,7 +638,7 @@ agent@rig@host is sugar for --host when the suffix is a REGISTERED host id
 * recheck, then stops. Pure classification: no printing here.
 */
 type EffectCheck =
-  | { checked: true; state: "staged"; remedy: "submitted-cleared" | "submitted-still-staged" | "submit-refused"; detail?: string }
+  | { checked: true; state: "staged"; remedy: "submitted-cleared" | "submitted-still-staged" | "submit-refused" | "submit-unconfirmed"; detail?: string }
  | { checked: true; state: "no-staged-residual" }
  | { checked: false; why: string };

@@ -683,16 +689,26 @@ async function classifyDeliveryEffect(
  const probe = await detectStagedAtPrompt(client, session, identity);
  if (probe.state === "unchecked") return { checked: false, why: probe.why };
  if (probe.state === "not-staged") return { checked: true, state: "no-staged-residual" };
-  const enter = await client.post<Record<string, unknown>>("/api/transport/send", {
-    session,
-    submitOnly: true,
-    expectedStagedText: identity.expectedStagedText,
-    expectedStagedLineCount: identity.expectedLines,
-  }, transportRequestOptions(waitForIdleMs));
+  let enter: { status: number; data: Record<string, unknown> };
+  try {
+    enter = await client.post<Record<string, unknown>>("/api/transport/send", {
+      session,
+      submitOnly: true,
+      expectedStagedText: identity.expectedStagedText,
+      expectedStagedLineCount: identity.expectedLines,
+    }, transportRequestOptions(waitForIdleMs));
+  } catch (err) {
+    return { checked: true, state: "staged", remedy: "submit-unconfirmed", detail: (err as Error).message };
+  }
  if (enter.status >= 400) {
-    return { checked: true, state: "staged", remedy: "submit-refused", detail: (enter.data?.["error"] as string | undefined) ?? `HTTP ${enter.status}` };
+    const phase = enter.data?.["inputPhase"];
+    const reason = enter.data?.["reason"];
+    const unconfirmed = phase === "attempted" || phase === "written"
+      || (phase !== "not_reached" && enter.data?.["sent"] !== false && (reason === "submit_failed" || enter.status >= 500));
+    return { checked: true, state: "staged", remedy: unconfirmed ? "submit-unconfirmed" : "submit-refused", detail: (enter.data?.["error"] as string | undefined) ?? `HTTP ${enter.status}` };
  }
  const recheck = await detectStagedAtPrompt(client, session, identity);
+  if (recheck.state === "unchecked") return { checked: true, state: "staged", remedy: "submit-unconfirmed", detail: recheck.why };
  return recheck.state === "staged"
    ? { checked: true, state: "staged", remedy: "submitted-still-staged" }
    : { checked: true, state: "staged", remedy: "submitted-cleared" };
@@ -705,13 +721,17 @@ function effectHumanLines(effect: EffectCheck, session: string): string[] {
    return [`Note: the pane-effect check could not run (${effect.why}); the verdict above is transport-level only.`];
  }
  if (effect.state === "no-staged-residual") return [];
+  if (effect.remedy === "submit-unconfirmed") return [
+    `Delivery: submission unconfirmed — the text was staged before one guarded Enter attempt, but the result could not be confirmed (${effect.detail}). Inspect with: rig capture ${session}`,
+  ];
+  if (effect.remedy === "submit-refused") return [
+    `Delivery: unconfirmed — the guarded Enter was refused (${effect.detail}); the earlier staged observation may have changed. Inspect with: rig capture ${session}`,
+  ];
  const out = ["Delivery: staged, not consumed (checked: post-send pane capture; observed: the sent text is still at the prompt — typed, never submitted)"];
  if (effect.remedy === "submitted-cleared") {
    out.push("Remedy: one guarded Enter submitted — the staged text left the prompt.");
  } else if (effect.remedy === "submitted-still-staged") {
    out.push(`Remedy: one guarded Enter submitted, but the text is STILL at the prompt — not consumed; stopping here (one submit is the contract). Inspect with: rig capture ${session}`);
-  } else {
-    out.push(`Remedy: the single guarded Enter (submit path) was refused (${effect.detail}); stopping here — one submit is the contract. Inspect with: rig capture ${session}`);
  }
  return out;
 }
@@ -721,6 +741,10 @@ function effectUnresolved(effect: EffectCheck | undefined): boolean {
  return !!effect && effect.checked && effect.state === "staged" && effect.remedy !== "submitted-cleared";
 }

+function effectSubmissionUnconfirmed(effect: EffectCheck | undefined): boolean {
+  return !!effect && effect.checked && effect.state === "staged" && (effect.remedy === "submit-unconfirmed" || effect.remedy === "submit-refused");
+}
+
 /**
 * S3 (OPR.0.5.4.6) — the staged-at-prompt detector, walk's staged-evidence
 * primitive generalized to plain sends. POSITIVE evidence only: text rendered
@@ -754,7 +778,7 @@ async function detectStagedAtPrompt(
  for (let i = lines.length - 1; i >= 0; i--) {
    if (PROMPT_LINE_PATTERN.test(lines[i]!)) { lastPrompt = i; break; }
  }
-  if (lastPrompt === -1) return { state: "not-staged" };
+  if (lastPrompt === -1) return { state: "unchecked", why: "no input prompt was visible in the capture" };
  const inputRegionRaw = lines.slice(lastPrompt).join("\n").replace(PROMPT_LINE_PATTERN, "");
  // IDENTITY FIRST (round-2 F2, desk-binding): the literal-residual match uses
  // the daemon submit-precheck's own normalization (strip ALL whitespace,
@@ -1083,6 +1107,7 @@ async function runFanOutSend(params: {
  }
  const effectBySeat = new Map((effects ?? []).map((e) => [e.sessionName, e.effect]));
  const unresolvedCount = (effects ?? []).filter((e) => effectUnresolved(e.effect)).length;
+  const unconfirmedCount = (effects ?? []).filter((e) => effectSubmissionUnconfirmed(e.effect)).length;

  if (opts.json) {
    // Round-2 F1: ONE verdict per recipient — a staged-unresolved recipient's
@@ -1090,7 +1115,7 @@ async function runFanOutSend(params: {
    const rawResults = (res.data["results"] as Array<{ sessionName: string; ok: boolean; outcome?: string }> | undefined) ?? [];
    const encodedResults = rawResults.map((r) =>
      effectUnresolved(effectBySeat.get(r.sessionName))
-        ? { ...r, ok: false, verified: false, outcome: "staged-not-consumed", error: "staged, not consumed (pane effect); the one guarded submit did not clear it" }
+        ? { ...r, ok: false, verified: false, outcome: effectSubmissionUnconfirmed(effectBySeat.get(r.sessionName)) ? "submission-unconfirmed" : "staged-not-consumed", error: effectSubmissionUnconfirmed(effectBySeat.get(r.sessionName)) ? "delivery unconfirmed; inspect the recipient after the guarded submit attempt" : "staged, not consumed (pane effect); the one guarded submit did not clear it" }
        : r
    );
    // Round-3 (r2 row 00fb3a68): the machine-readable AGGREGATE derives from
@@ -1133,6 +1158,8 @@ async function runFanOutSend(params: {
    if (ec && ec.checked && ec.state === "staged") {
      if (ec.remedy === "submitted-cleared") {
        console.log(`${r.sessionName}: sent — staged at the prompt, cleared by one guarded Enter (consumed)`);
+      } else if (effectSubmissionUnconfirmed(ec)) {
+        console.log(`${r.sessionName}: ${effectHumanLines(ec, r.sessionName)[0]}`);
      } else {
        console.log(`${r.sessionName}: staged, not consumed — ${effectHumanLines(ec, r.sessionName).slice(-1)[0]}`);
      }
@@ -1145,7 +1172,7 @@ async function runFanOutSend(params: {
  }
  // The delivered count never includes a staged-unresolved recipient.
  const deliveredCount = Math.max(0, ((data["sent"] as number) ?? 0) - unresolvedCount);
-  console.log(`${deliveredCount}/${data["total"]} delivered${unresolvedCount > 0 ? `, ${unresolvedCount} staged-not-consumed` : ""}`);
+  console.log(`${deliveredCount}/${data["total"]} delivered${unresolvedCount - unconfirmedCount > 0 ? `, ${unresolvedCount - unconfirmedCount} staged-not-consumed` : ""}${unconfirmedCount > 0 ? `, ${unconfirmedCount} submission-unconfirmed` : ""}`);
  // S2 (OPR.0.5.4.3): surface additive advisories (e.g. the unknown-sender
  // sign-it notice) — an env-less operator must see it, not "sent" lines alone.
  const fanoutAdvisory = data["warning"] as string | undefined;
@@ -928,8 +928,24 @@ tmux scrollback:
      // OPR.0.3.3.04.2 (AC-1): the canonical ordered golden path. `rig setup` is
      // the primary surface for the new-operator sequence (status/doctor only
      // HINT back to it; the durable reference is docs/reference/getting-started.md).
+      // A failed doctor check also leaves setup not ready, so it's named below. So is the port check's warning, though setup
+      // stays ready: the configured port's daemon isn't confirmed as this user's, such as another user's daemon. Provider
+      // checks are the setup steps themselves, reused, so they aren't listed twice.
+      const stepIds = new Set(result.steps.map(step => step.id));
+      const doctorAttention = result.verification?.checks.filter(check => !stepIds.has(check.name)
+        && (check.status === "fail" || (check.name === "port" && check.status === "warn"))) ?? [];
+      const listChecks = () => {
+        for (const check of doctorAttention) {
+          console.log(`  ${check.name}: ${check.message}`);
+          if (check.fix) console.log(`    Fix: ${check.fix}`);
+        }
+      };
      if (result.ready) {
        console.log("\nSetup complete.\n");
+        if (doctorAttention.length) {
+          console.log("Some steps need attention:");
+          listChecks();
+        }
      } else {
        console.log("\nSome steps need attention:");
        if (opts.dryRun) console.log("Plan only: no setup changes were made; readiness was not checked.");
@@ -937,6 +953,7 @@ tmux scrollback:
          console.log(`  ${step.id}: ${step.message}`);
          if (step.fixHint) console.log(`    Fix: ${step.fixHint}`);
        }
+        listChecks();
        console.log("Only the harnesses selected for your project need a login; an unused harness does not (rerun with --providers to leave it out).");
        console.log("Run `rig doctor` to recheck the system and provider authentication.");
      }
@@ -186,6 +186,7 @@ export function slackCommand(deps: SlackDeps = {}): Command {
    .option("--source-label <label>", "label shown in the posted message footer (where the queue lives)")
    .option("--secrets-env-file <path>", "path to the 0600 env file with SLACK_BOT_TOKEN / SLACK_APP_TOKEN")
    .option("--required-scopes <csv>", "comma-separated bot scopes to require at verify time")
+    .option("--reactions <mode>", "what a person's emoji reaction on an OpenRig post does: route (default) makes a row for the seat that asked; off ignores reactions, so an acknowledging emoji costs no agent turn")
    .option("--reason <reason>", "Reason recorded with the configuration change", "configure human delivery")
    .option("--actor <actor>", "Named operator when outside a managed seat")
    .action(async (opts) => {
@@ -200,6 +201,7 @@ export function slackCommand(deps: SlackDeps = {}): Command {
        sourceLabel: opts.sourceLabel ?? cur.sourceLabel,
        secretsEnvFile: opts.secretsEnvFile ?? cur.secretsEnvFile,
        requiredScopes: opts.requiredScopes ? String(opts.requiredScopes).split(",").map((s: string) => s.trim()).filter(Boolean) : cur.requiredScopes,
+        ...(opts.reactions !== undefined ? { reactions: opts.reactions } : {}),
      };
      const { runChannelOperation, channelStateDigest } = await import("@openrig/daemon/gateway-slack");
      const result = await runChannelOperation({
@@ -249,6 +251,7 @@ export function slackCommand(deps: SlackDeps = {}): Command {
        log(`Daemon: ${observation.state}${observation.reason ? ` (${observation.reason})` : ""}`);
        const connector = observation.connector as { configurationDigest?: string; inboundReady?: boolean; outboundReady?: boolean;
          inboundRouting?: { fallback: string; destination: string };
+          settlement?: { pending: number; lastFailure: string | null };
          deadLetterBacklog?: number | null; deadLetterBacklogState?: string; deadLetterBacklogReason?: string;
          inbound?: InboundDeliveryStatus & { state?: string; generation?: number; lastEventAt?: string };
          recovery?: { state?: string; reason?: string; lastScanAt?: string; acceptedThisProcess?: number; deadLetteredThisProcess?: number;
@@ -259,6 +262,10 @@ export function slackCommand(deps: SlackDeps = {}): Command {
              backoff?: Record<string, number>; incomplete?: Record<string, number> };
            limits?: string[] } } | undefined;
        if (connector) {
+          if (connector.settlement) {
+            log(`  Ask edits: ${connector.settlement.pending} queued for reconciliation`);
+            if (connector.settlement.lastFailure) log(`  Last ask-edit failure: ${connector.settlement.lastFailure}`);
+          }
          if (connector.inboundRouting?.fallback === "local") log(`  Configured routing fallback: local to ${connector.inboundRouting.destination} (after forwarding, thread and channel routes)`);
          log(`  Socket: ${connector.inbound?.state ?? "unknown"}; generation ${connector.inbound?.generation ?? "unknown"}; last event ${connector.inbound?.lastEventAt ?? "unknown"}`);
          for (const line of socketDeliveryLines(connector.inbound)) log(`  ${line}`);
@@ -20,6 +20,14 @@ import { daemonMayAnswer } from "../daemon-reachability.js";
 import { realDeps } from "./daemon.js";
 import type { StatusDeps } from "./status.js";

+const KNOWN_SPEC_KINDS = ["rig", "agent", "workflow"] as const;
+
+function warnIfUnknownKind(kind?: string): void {
+  if (kind !== undefined && !KNOWN_SPEC_KINDS.includes(kind as (typeof KNOWN_SPEC_KINDS)[number])) {
+    console.error(`Warning: unrecognized --kind '${kind}'. Supported kinds: ${KNOWN_SPEC_KINDS.join(", ")}`);
+  }
+}
+
 interface LibraryEntry {
  id: string;
  kind: "rig" | "agent" | "workflow";
@@ -147,17 +155,27 @@ function installSpecSource(source: AddSpecSource, userRoot: string): string {
 export async function resolveLibrarySpec(
  client: DaemonClient,
  nameOrId: string,
-  opts?: { kind?: LibraryEntry["kind"] },
+  opts?: { kind?: string },
 ): Promise<LibraryEntry> {
-  const res = await client.get<LibraryEntry[]>(opts?.kind ? `/api/specs/library?kind=${opts.kind}` : "/api/specs/library");
-  const entries = res.data ?? [];
-
-  // Try exact ID match first
+  const url = opts?.kind !== undefined ? `/api/specs/library?kind=${encodeURIComponent(opts.kind)}` : "/api/specs/library";
+  const res = await client.get<LibraryEntry[]>(url);
+  const filterKind = (entries: LibraryEntry[]) =>
+    opts?.kind !== undefined && !KNOWN_SPEC_KINDS.includes(opts.kind as (typeof KNOWN_SPEC_KINDS)[number])
+      ? entries.filter((entry) => entry.kind === opts.kind)
+      : entries;
+  const visibleEntries = filterKind(res.data ?? []);
+  // An exact ID always wins, including when a visible name matches a hidden ID.
+  const visibleId = visibleEntries.find((entry) => entry.id === nameOrId);
+  if (visibleId) return visibleId;
+  const separator = opts?.kind !== undefined ? "&" : "?";
+  const all = await client.get<LibraryEntry[]>(`${url}${separator}include_builtins=true`);
+  const entries = filterKind(all.data ?? []);
  const byId = entries.find((e) => e.id === nameOrId);
  if (byId) return byId;

-  // Try name match
-  const byName = entries.filter((e) => e.name === nameOrId);
+  // Visible names take precedence over hidden built-ins with the same name.
+  const visibleNames = visibleEntries.filter((e) => e.name === nameOrId);
+  const byName = visibleNames.length ? visibleNames : entries.filter((e) => e.name === nameOrId);
  if (byName.length === 1) return byName[0]!;

  if (byName.length > 1) {
@@ -216,14 +234,23 @@ Examples:
  cmd.command("ls")
    .description("List library rigs, agents, and managed apps")
    .option("--kind <kind>", "Filter by kind (rig, agent, or workflow)")
+    .option("--include-builtins", "Include built-ins hidden by the visibility setting")
    .option("--json", "JSON output")
-    .action(async (opts: { kind?: string; json?: boolean }) => {
+    .action(async (opts: { kind?: string; json?: boolean; includeBuiltins?: boolean }) => {
      try {
+        warnIfUnknownKind(opts.kind);
        const client = await getClient();
-        const url = opts.kind ? `/api/specs/library?kind=${opts.kind}` : "/api/specs/library";
+        const params = new URLSearchParams();
+        if (opts.kind !== undefined) params.set("kind", opts.kind);
+        if (opts.includeBuiltins) params.set("include_builtins", "true");
+        const url = `/api/specs/library${params.size ? `?${params}` : ""}`;
        const res = await client.get<LibraryEntry[]>(url);
        if (res.status !== 200) throw new Error(`Daemon returned HTTP ${res.status}`);
-        const entries = res.data ?? [];
+        const rawEntries = res.data ?? [];
+        const entries =
+          opts.kind !== undefined && !KNOWN_SPEC_KINDS.includes(opts.kind as (typeof KNOWN_SPEC_KINDS)[number])
+            ? rawEntries.filter((e) => e.kind === opts.kind)
+            : rawEntries;

        if (opts.json) {
          console.log(JSON.stringify(entries, null, 2));
@@ -231,7 +258,11 @@ Examples:
        }

        if (entries.length === 0) {
-          console.log("No specs in library. Add specs with: rig specs add <path>");
+          if (opts.kind !== undefined) {
+            console.log(opts.kind ? `No ${opts.kind} specs found` : "No specs found");
+          } else {
+            console.log("No specs in library. Add specs with: rig specs add <path>");
+          }
          return;
        }

@@ -250,10 +281,11 @@ Examples:
    .description("Show spec metadata and path")
    .option("--kind <kind>", "Disambiguate by kind (rig, agent, or workflow)")
    .option("--json", "JSON output")
-    .action(async (nameOrId: string, opts: { kind?: LibraryEntry["kind"]; json?: boolean }) => {
+    .action(async (nameOrId: string, opts: { kind?: string; json?: boolean }) => {
      try {
+        warnIfUnknownKind(opts.kind);
        const client = await getClient();
-        const entry = await resolveLibrarySpec(client, nameOrId, opts.kind ? { kind: opts.kind } : undefined);
+        const entry = await resolveLibrarySpec(client, nameOrId, opts.kind !== undefined ? { kind: opts.kind } : undefined);

        if (opts.json) {
          console.log(JSON.stringify(entry, null, 2));
@@ -278,10 +310,11 @@ Examples:
    .description("Show structured spec review, including managed app details")
    .option("--kind <kind>", "Disambiguate by kind (rig, agent, or workflow)")
    .option("--json", "JSON output")
-    .action(async (nameOrId: string, opts: { kind?: LibraryEntry["kind"]; json?: boolean }) => {
+    .action(async (nameOrId: string, opts: { kind?: string; json?: boolean }) => {
      try {
+        warnIfUnknownKind(opts.kind);
        const client = await getClient();
-        const entry = await resolveLibrarySpec(client, nameOrId, opts.kind ? { kind: opts.kind } : undefined);
+        const entry = await resolveLibrarySpec(client, nameOrId, opts.kind !== undefined ? { kind: opts.kind } : undefined);
        const res = await client.get<Record<string, unknown>>(`/api/specs/library/${encodeURIComponent(entry.id)}/review`);
        const review = res.data;
        const teamChoice = entry.sourceType === "builtin" && entry.kind === "rig" && ["starter", "factory"].includes(entry.name)
@@ -20,7 +20,9 @@ export interface StatusDeps {
 function formatSnapshotAge(snapshotAt: string | null): string {
  if (!snapshotAt) return "none";
  const now = Date.now();
-  const then = new Date(snapshotAt).getTime();
+  // Snapshot times are SQLite `datetime('now')` stamps: UTC written without a zone, which Date reads as local time.
+  const then = Date.parse(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(?:\.\d+)?$/.test(snapshotAt)
+    ? `${snapshotAt.replace(" ", "T")}Z` : snapshotAt);
  const diffMs = now - then;
  const diffMin = Math.floor(diffMs / 60_000);
  if (diffMin < 1) return "just now";
@@ -104,7 +104,7 @@ export function streamCommand(depsOverride?: StreamDeps): Command {
    .description("Append a stream item")
    .requiredOption("--source <session>", "Source session (e.g. dev-build@starter)")
    .requiredOption("--body <text>", "Stream item body")
-    .option("--hint-destination <session>", "Hint at intended destination seat")
+    .option("--hint-destination <session>", "Hint at intended destination seat (the queue worker routes by this hint)")
    .option("--hint-type <type>", "Hint type (e.g. review, handoff, idea)")
    .option("--hint-urgency <urgency>", "Hint urgency (routine, urgent, critical)")
    .option("--hint-tags <tags>", "Comma-separated hint tags")
@@ -112,6 +112,11 @@ export function streamCommand(depsOverride?: StreamDeps): Command {
    .option("--interrupt", "Mark item as interrupting")
    .option("--id <streamItemId>", "Idempotent stream_item_id (skip if not provided)")
    .option("--json", "JSON output for agents")
+    .addHelpText("after", `
+Stream intake is on by default: the seat named by stream.intake (queue.worker unless set)
+gets an intake row for each item, which wakes it, or a note on its intake row still pending.
+--hint-urgency critical or --interrupt makes that row urgent. The reply names only the stream item.
+To keep emits passive: rig config set stream.intake off`)
    .action(async (opts: {
      source: string;
      body: string;
@@ -1,10 +1,11 @@
 // OPR.0.4.6.02 C3 — the `rig terminal` command family (the TUI-1 opaque verb +
-// the operator's terminal-provider-ride entry). Three subcommands, all hitting
+// the operator's terminal-provider-ride entry). The subcommands read
 // the ONE canonical daemon composer (`/api/terminal/...`):
 //
 //   rig terminal open <view> [--provider herdr|cmux|rex] [--json]
 //   rig terminal views [--json]
 //   rig terminal status [--provider herdr|cmux|rex] [--json]
+//   rig terminal attach <session> [--read-only]
 //
 // `<view>` resolves daemon-side: a rig name (per-rig derived) | `mission:<id>` |
 // `slice:<id>` (derived) | a saved-view id. The result is the ONE shared
@@ -22,8 +23,12 @@ import { getDaemonStatus, getDaemonUrl , daemonStatusGuard} from "../daemon-life
 import { realDeps } from "./daemon.js";
 import type { StatusDeps } from "./status.js";
 import { openTerminalWindow, type WindowDeps } from "../terminal-window.js";
+import { assertLocalTmux, attachTmux, isLocalTmuxHost, readTmuxServerArgs, type TmuxAttachment } from "../tmux-attachment.js";

-export interface TerminalDeps extends StatusDeps { windowDeps?: WindowDeps }
+export interface TerminalDeps extends StatusDeps {
+  windowDeps?: WindowDeps;
+  attachTmux?: (target: TmuxAttachment) => Promise<number>;
+}
 export interface FollowControls {
  enabled: boolean; maxTiles?: number; graceMs?: number; focusRetentionMs?: number;
  pin?: string[]; unpin?: string[]; suppress?: string[]; unsuppress?: string[]; suppressionMs?: number;
@@ -132,7 +137,7 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
    .option("--session <name>", "Herdr session on the daemon's host; --session default selects Herdr's default session")
    .option("--window", "Open a new desktop terminal tab/window (the default when --provider is omitted)")
    .option("--expected-plan <id>", "Open only if the view still matches this preview")
-    .option("--follow", "Keep one qitem:<id> workspace following current obligation owners (Linux Herdr 0.9.5/protocol 22)")
+    .option("--follow", "Keep one qitem:<id>, slice:<id-or-name> or mission:<id> workspace following current obligation owners (Linux Herdr 0.9.5/protocol 22)")
    .option("--no-follow", "Stop following and keep the existing workspace and tiles as a fixed layout")
    .option("--max-tiles <count>", "Following tile limit, 1–256; explicitly raise it to show more members", Number)
    .option("--pin <seats...>", "Retain these following tiles after they leave the task")
@@ -220,5 +225,31 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
      });
    });

+  cmd.command("attach <session>")
+    .description("Attach this terminal to a session on the selected daemon's tmux server")
+    .option("--read-only", "View the session without sending input")
+    .action(async (session: string, opts: { readOnly?: boolean }) => {
+      const deps = getDeps();
+      await withClient(deps, async client => {
+        try {
+          if (client.baseUrl && !isLocalTmuxHost(client.baseUrl)) {
+            throw new Error("Terminal attachment uses local tmux; run this command on the selected daemon's machine.");
+          }
+          const response = await client.get<{ tmux?: { mode?: "inherit" | "isolated"; serverArgs?: unknown } }>("/api/terminal/status");
+          if (response.status >= 400) throw new Error(`Cannot read the tmux server (HTTP ${response.status}).`);
+          if (response.data.tmux?.serverArgs === undefined) {
+            throw new Error("This daemon cannot report its tmux server. Update and restart it before using terminal attach.");
+          }
+          await assertLocalTmux(client, response.data.tmux.mode);
+          process.exitCode = await (deps.attachTmux ?? attachTmux)({
+            session, serverArgs: readTmuxServerArgs(response.data.tmux.serverArgs), readOnly: opts.readOnly ?? false,
+          });
+        } catch (error) {
+          console.error(error instanceof Error ? error.message : String(error));
+          process.exitCode = 1;
+        }
+      });
+    });
+
  return cmd;
 }
@@ -11,7 +11,7 @@ interface AgentLibraryEntry {
 /** Resolve the runtime's terminal seat or the shipped general-purpose agent. */
 export async function resolveDefaultAgentRef(client: DaemonClient, runtime: string): Promise<string> {
  if (runtime === "terminal") return "builtin:terminal";
-  const res = await client.get<AgentLibraryEntry[]>("/api/specs/library?kind=agent");
+  const res = await client.get<AgentLibraryEntry[]>("/api/specs/library?kind=agent&include_builtins=true");
  const entry = res.data?.find(
    (candidate) =>
      candidate.kind === "agent"
@@ -6,6 +6,7 @@ import { pathToFileURL } from "node:url";
 import { existsSync } from "node:fs";
 import { openMissionControl, USAGE_LINES, type FrontDoorIo } from "../front-door.js";
 import { sharedTuiTarget, attachSharedTui } from "../shared-tui.js";
+import type { TmuxAttachment } from "../tmux-attachment.js";

 /** The registry-entry shape `rig tui commands` serializes (REGISTRY I2, ruling 64f1dbdf).
 *  Structural mirror of the TUI's CommandEntry data fields (functions are not serialized). */
@@ -38,8 +39,8 @@ async function loadRegistryFromDist(baseDir: string): Promise<TuiCommandEntry[]>

 export function tuiCommand(io: FrontDoorIo & {
  loadRegistry?: () => Promise<TuiCommandEntry[]>;
-  sharedTarget?: () => Promise<string>;
-  attachShared?: (target: string) => Promise<number>;
+  sharedTarget?: () => Promise<TmuxAttachment>;
+  attachShared?: (target: TmuxAttachment) => Promise<number>;
 } = {}): Command {
  const cmd = new Command("tui")
    .description("open the status dashboard, not agent chat (--shared is the OpenRig view fallback)")
@@ -273,7 +273,7 @@ initial record is explicitly reported as unverified delivery.`)

            let verdict = await pollConsumed();
            if (verdict === "generation-rolled") {
-              failPiece(i, piece.label, "the seat's generation rolled mid-walk (a re-prime); the walk cannot continue into a different generation.");
+              failPiece(i, piece.label, "the seat's generation rolled mid-walk (a re-prime); delivery is unconfirmed. Inspect the recipient before any resend; the walk cannot continue into a different generation.");
              return;
            }
            if (verdict === "timeout") {
@@ -289,23 +289,39 @@ initial record is explicitly reported as unverified delivery.`)
                /\[Pasted text #\d+ \+\d+ lines\]/.test(pane)
              );
              if (stagedEvidence) {
-                const enter = await client.post<Record<string, unknown>>("/api/transport/send", {
-                  session: seat,
-                  submitOnly: true,
-                  expectedStagedText: piece.content, // FULL bytes — the transport checks the rendered literal residual for contiguous containment
-                  expectedStagedLineCount: piece.content.split("\n").length,
-                }, { headers: terminalAuthHeaders() });
+                let enter: { status: number; data: Record<string, unknown> };
+                try {
+                  enter = await client.post<Record<string, unknown>>("/api/transport/send", {
+                    session: seat,
+                    submitOnly: true,
+                    expectedStagedText: piece.content, // FULL bytes — the transport checks the rendered literal residual for contiguous containment
+                    expectedStagedLineCount: piece.content.split("\n").length,
+                  }, { headers: terminalAuthHeaders() });
+                } catch (error) {
+                  failPiece(i, piece.label, `the guarded submit result is unconfirmed (${(error as Error).message}); inspect the recipient before any resend.`);
+                  return;
+                }
                if (enter.status >= 400) {
-                  failPiece(i, piece.label, `typed but not consumed; the single submit retry was refused (${(enter.data?.["error"] as string | undefined) ?? `HTTP ${enter.status}`}).`);
+                  const phase = enter.data?.["inputPhase"], reason = enter.data?.["reason"];
+                  const unconfirmed = phase === "attempted" || phase === "written"
+                    || (phase !== "not_reached" && enter.data?.["sent"] !== false && (reason === "submit_failed" || enter.status >= 500));
+                  const detail = (enter.data?.["error"] as string | undefined) ?? `HTTP ${enter.status}`;
+                  failPiece(i, piece.label, unconfirmed
+                    ? `the guarded submit result is unconfirmed (${detail}); inspect the recipient before any resend.`
+                    : `the single guarded submit was refused (${detail}); the earlier staged observation may have changed. Inspect the recipient before any resend.`);
                  return;
                }
                verdict = await pollConsumed();
+                if (verdict === "generation-rolled") {
+                  failPiece(i, piece.label, "the seat's generation rolled after the guarded submit; delivery is unconfirmed. Inspect the recipient before any resend.");
+                  return;
+                }
                if (verdict !== "consumed") {
-                  failPiece(i, piece.label, `typed and staged, but not consumed even after the single submit retry — the piece never entered the seat's conversation record. Not re-sending (one retry is the contract).`);
+                  failPiece(i, piece.label, "no matching conversation record was observed within the verification window after the single submit retry; delivery is unconfirmed. Inspect the recipient before any resend.");
                  return;
                }
              } else {
-                failPiece(i, piece.label, `send reported ${sendOutcome === "ok" ? "success" : "a transport error"} but the piece is neither consumed in the generation record nor staged in the pane — delivery lost; consumption verification fails this walk closed.`);
+                failPiece(i, piece.label, `send reported ${sendOutcome === "ok" ? "success" : "a transport error"}, but no matching record or staged input was observed within the verification window. Delivery and consumption are unconfirmed; inspect the recipient before any resend.`);
                return;
              }
            }
@@ -87,7 +87,10 @@ export function workspaceCommand(depsOverride?: WorkspaceDeps): Command {
    .description(
      "Walk a workspace root, parse each .md file's YAML frontmatter, and emit a structured gap report. Advisory only — never modifies files. Default root: cwd.",
    )
-    .option("--kind <kind>", "Workspace kind to validate against: user | project | knowledge | lab | delivery")
+    .option(
+      "--kind <kind>",
+      "Workspace kind to validate against: user | project | knowledge | lab | delivery",
+    )
    .option("--no-recursive", "Do not descend into subdirectories")
    .option("--require-frontmatter", "Report a gap for every .md file without a frontmatter delimiter")
    .option("--max-files <n>", "Hard cap on .md files walked", "10000")
@@ -125,7 +128,13 @@ export function workspaceCommand(depsOverride?: WorkspaceDeps): Command {
            maxFiles,
          });
          if (res.status >= 400) {
-            console.error(JSON.stringify(res.data, null, 2));
+            if (opts.json) {
+              console.error(JSON.stringify(res.data, null, 2));
+            } else {
+              const data = res.data as { message?: string; error?: string } | null | undefined;
+              const msg = data?.message ?? data?.error ?? `Validate failed (HTTP ${res.status})`;
+              console.error(msg);
+            }
            process.exitCode = 1;
            return;
          }
@@ -13,6 +13,7 @@ import {
 // truth at ~/.openrig/config.json. Resolution stays env > file > default.

 export interface RiggedConfig {
+  specs: { builtinsVisible: boolean };
  launch: { nonInterruptive: boolean };
  daemon: { port: number; host: string; dbConflict?: "warn" | "stop" };
  // OPR.0.4.6.MH1 FR-1 — the persisted host-selection pointer.
@@ -165,6 +166,8 @@ export interface RiggedConfig {
  // `rig config get/set terminal.status_bar` surface + twin parity.
  terminal: {
    statusBar: boolean;
+    /** Applied at daemon startup; a live previous server is retained until drained. */
+    tmuxServer: "inherit" | "isolated";
    /** Rows of tmux scrollback per pane; `rig setup` writes it into the managed `~/.tmux.conf` block. */
    historyLimit: number;
    inheritTmuxEnvironment: boolean;
@@ -227,6 +230,10 @@ export interface RiggedConfig {
    wakeSwapGraceSeconds: number;
    wakeHumanRung: string;
  };
+  // Issue #1856 — stream intake setting
+  stream: {
+    intake: string;
+  };
 }

 const DEFAULT_WORKSPACE_ROOT = getDefaultOpenRigPath("workspace");
@@ -281,6 +288,7 @@ const DEFAULTS = {
  topology: { root: getDefaultOpenRigPath("topology") },
  // OPR.0.5.9.5 Wave B — canonical addressable context library.
  context: { root: getDefaultOpenRigPath("context"), systemWorld: "default" },
+  specs: { builtinsVisible: true },
  skills: { root: getDefaultOpenRigPath("skills"), routerLine: { enabled: false } },
  onboarding: { defaultPack: { enabled: true } },
  health: { contextPressure: { warningPercent: 95, criticalPercent: 99 } },
@@ -355,6 +363,7 @@ const DEFAULTS = {
  // OPR.0.4.6.02 S1 — inner-tmux status bar OFF at launch by default.
  terminal: {
    statusBar: false,
+    tmuxServer: "inherit",
    historyLimit: 10000,
    inheritTmuxEnvironment: false,
  },
@@ -385,6 +394,10 @@ const DEFAULTS = {
    consumers: "",
    templateDir: "",
  },
+  // Issue #1856 — stream intake default queue.worker; read live by the stream intake coordinator.
+  stream: {
+    intake: "queue.worker",
+  },
  // OPR.0.4.6.FS-1 W2 — retention defaults (twin of daemon getDefaultValue).
  retention: {
    enabled: true,
@@ -451,6 +464,7 @@ export const VALID_KEYS = [
  // OPR.0.5.9.5 Wave B — canonical context library; old key is refused.
  "context.root",
  "context.system_world",
+  "specs.builtins_visible",
  "skills.root",
  // OPR.0.7.0.13 (router): the person's recorded yes to OpenRig's one-line seat-skills bootstrap in AGENTS.md / CLAUDE.md.
  "skills.router_line.enabled",
@@ -504,6 +518,7 @@ export const VALID_KEYS = [
  // boolean (default off), lockstep with the daemon settings-store twin
  // (the parity test pins both). Flip is future-launches-only (BR-1).
  "terminal.status_bar",
+  "terminal.tmux_server",
  // The managed ~/.tmux.conf block's history-limit, written by `rig setup`; lockstep with the daemon twin.
  "terminal.history_limit",
  "terminal.inherit_tmux_environment",
@@ -533,6 +548,7 @@ export const VALID_KEYS = [
  // Slice 22 outcome 9 — stream retention: unreferenced items older than N days or beyond the newest N.
  "retention.stream_days",
  "retention.stream_max_items",
+  "stream.intake",
  "retention.batch_size",
  // S04 — pickup-receipt stall threshold; lockstep with the daemon settings-store twin.
  "queue.pickup_stall_threshold_minutes",
@@ -577,6 +593,7 @@ export const ENV_MAP: Record<ValidKey, { primary: string; legacy?: string }> = {
  "topology.root": { primary: "OPENRIG_TOPOLOGY_ROOT" },
  "context.root": { primary: "OPENRIG_CONTEXT_ROOT" },
  "context.system_world": { primary: "OPENRIG_CONTEXT_SYSTEM_WORLD" },
+  "specs.builtins_visible": { primary: "OPENRIG_SPECS_BUILTINS_VISIBLE" },
  "skills.root": { primary: "OPENRIG_SKILLS_ROOT" },
  "skills.router_line.enabled": { primary: "OPENRIG_SKILLS_ROUTER_LINE_ENABLED" },
  "onboarding.default_pack.enabled": { primary: "OPENRIG_ONBOARDING_DEFAULT_PACK_ENABLED" },
@@ -626,6 +643,7 @@ export const ENV_MAP: Record<ValidKey, { primary: string; legacy?: string }> = {
  "snapshots.periodic.retention_keep": { primary: "OPENRIG_SNAPSHOTS_PERIODIC_RETENTION_KEEP" },
  // OPR.0.4.6.02 S1 — net-new key; OPENRIG_* primary only (no RIGGED_* legacy).
  "terminal.status_bar": { primary: "OPENRIG_TERMINAL_STATUS_BAR" },
+  "terminal.tmux_server": { primary: "OPENRIG_TMUX_SERVER" },
  "terminal.history_limit": { primary: "OPENRIG_TERMINAL_HISTORY_LIMIT" },
  "terminal.inherit_tmux_environment": { primary: "OPENRIG_TERMINAL_INHERIT_TMUX_ENVIRONMENT" },
  "output.compact": { primary: "OPENRIG_OUTPUT_COMPACT" },
@@ -647,6 +665,7 @@ export const ENV_MAP: Record<ValidKey, { primary: string; legacy?: string }> = {
  "retention.watchdog_keep_per_job": { primary: "OPENRIG_RETENTION_WATCHDOG_KEEP_PER_JOB" },
  "retention.stream_days": { primary: "OPENRIG_RETENTION_STREAM_DAYS" },
  "retention.stream_max_items": { primary: "OPENRIG_RETENTION_STREAM_MAX_ITEMS" },
+  "stream.intake": { primary: "OPENRIG_STREAM_INTAKE" },
  "retention.batch_size": { primary: "OPENRIG_RETENTION_BATCH_SIZE" },
  "queue.pickup_stall_threshold_minutes": { primary: "OPENRIG_QUEUE_PICKUP_STALL_THRESHOLD_MINUTES" },
  "queue.stuck_sweep_interval_seconds": { primary: "OPENRIG_QUEUE_STUCK_SWEEP_INTERVAL_SECONDS" },
@@ -683,6 +702,7 @@ const KEY_TO_PATH: Record<ValidKey, string[]> = {
  "topology.root": ["topology", "root"],
  "context.root": ["context", "root"],
  "context.system_world": ["context", "systemWorld"],
+  "specs.builtins_visible": ["specs", "builtinsVisible"],
  "skills.root": ["skills", "root"],
  "skills.router_line.enabled": ["skills", "routerLine", "enabled"],
  "onboarding.default_pack.enabled": ["onboarding", "defaultPack", "enabled"],
@@ -724,6 +744,7 @@ const KEY_TO_PATH: Record<ValidKey, string[]> = {
  "snapshots.periodic.interval_seconds": ["snapshots", "periodic", "intervalSeconds"],
  "snapshots.periodic.retention_keep": ["snapshots", "periodic", "retentionKeep"],
  "terminal.status_bar": ["terminal", "statusBar"],
+  "terminal.tmux_server": ["terminal", "tmuxServer"],
  "terminal.history_limit": ["terminal", "historyLimit"],
  "terminal.inherit_tmux_environment": ["terminal", "inheritTmuxEnvironment"],
  "output.compact": ["output", "compact"],
@@ -744,6 +765,7 @@ const KEY_TO_PATH: Record<ValidKey, string[]> = {
  "retention.watchdog_keep_per_job": ["retention", "watchdogKeepPerJob"],
  "retention.stream_days": ["retention", "streamDays"],
  "retention.stream_max_items": ["retention", "streamMaxItems"],
+  "stream.intake": ["stream", "intake"],
  "retention.batch_size": ["retention", "batchSize"],
  "queue.pickup_stall_threshold_minutes": ["queue", "pickupStallThresholdMinutes"],
  "queue.stuck_sweep_interval_seconds": ["queue", "stuckSweepIntervalSeconds"],
@@ -950,6 +972,11 @@ function percentageConstraint(key: string) {
 }

 const KEY_CONSTRAINTS: Partial<Record<ValidKey, (raw: string, coerced: string | number | boolean) => void>> = {
+  "terminal.tmux_server": (raw) => {
+    if (raw !== "inherit" && raw !== "isolated") {
+      throw new Error(`Invalid value for terminal.tmux_server: must be "inherit" or "isolated", got "${raw}"`);
+    }
+  },
  "daemon.db_conflict": (raw) => {
    if (raw !== "warn" && raw !== "stop") throw new Error("daemon.db_conflict must be warn or stop");
  },
@@ -1102,6 +1129,12 @@ const KEY_CONSTRAINTS: Partial<Record<ValidKey, (raw: string, coerced: string |
      throw new Error(`Invalid value for retention.stream_max_items: must be an integer >= 1, got "${raw}"`);
    }
  },
+  "stream.intake": (raw) => {
+    const val = (raw ?? "").trim();
+    if (val !== "off" && val !== "queue.worker" && !/^[a-zA-Z0-9\-_.]+@[a-zA-Z0-9\-_.]+$/.test(val)) {
+      throw new Error(`Invalid value for stream.intake: must be "queue.worker", a canonical session (<seat>@<rig>), or "off", got "${raw}"`);
+    }
+  },
  "retention.batch_size": (raw, coerced) => {
    if (!/^-?\d+$/.test((raw ?? "").trim()) || typeof coerced !== "number" || !Number.isInteger(coerced) || coerced < 1) {
      throw new Error(`Invalid value for retention.batch_size: must be an integer >= 1, got "${raw}"`);
@@ -1248,6 +1281,7 @@ export class ConfigStore {
        root: v("context.root") as string,
        systemWorld: v("context.system_world") as string,
      },
+      specs: { builtinsVisible: v("specs.builtins_visible") as boolean },
      skills: {
        root: v("skills.root") as string,
        routerLine: { enabled: v("skills.router_line.enabled") as boolean },
@@ -1329,6 +1363,7 @@ export class ConfigStore {
      },
      terminal: {
        statusBar: v("terminal.status_bar") as boolean,
+        tmuxServer: v("terminal.tmux_server") as "inherit" | "isolated",
        historyLimit: v("terminal.history_limit") as number,
        inheritTmuxEnvironment: v("terminal.inherit_tmux_environment") as boolean,
      },
@@ -1373,6 +1408,9 @@ export class ConfigStore {
        wakeSwapGraceSeconds: v("queue.wake_swap_grace_seconds") as number,
        wakeHumanRung: v("queue.wake_human_rung") as string,
      },
+      stream: {
+        intake: v("stream.intake") as string,
+      },
    };
  }

@@ -1513,7 +1551,7 @@ export class ConfigStore {
      const critical = getNestedValue(fileConfig, KEY_TO_PATH["health.context_pressure.critical_percent"])
        ?? getDefaultValue("health.context_pressure.critical_percent", workspaceRoot);
      if ((warning as number) >= (critical as number)) {
-        throw new Error(`Invalid context-pressure policy: warning (${warning}) must be less than critical (${critical})`);
+        throw new Error(`Invalid context-pressure policy for the config-file pair: warning (${warning}) must be less than critical (${critical}). Unset file values use defaults; environment overrides apply when each process resolves configuration and are not part of this check.`);
      }
    }
    mkdirSync(dirname(this.configPath), { recursive: true });
@@ -1565,7 +1603,7 @@ export class ConfigStore {
        const critical = getNestedValue(fileConfig, KEY_TO_PATH["health.context_pressure.critical_percent"])
          ?? getDefaultValue("health.context_pressure.critical_percent", workspaceRoot);
        if ((warning as number) >= (critical as number)) {
-          throw new Error(`Invalid context-pressure policy: warning (${warning}) must be less than critical (${critical})`);
+          throw new Error(`Invalid context-pressure policy for the config-file pair: warning (${warning}) must be less than critical (${critical}). Unset file values use defaults; environment overrides apply when each process resolves configuration and are not part of this check.`);
        }
      }
      pruneEmptyAncestors(fileConfig, parentParts);
@@ -72,7 +72,9 @@ export function resolveCrossHostTarget(
  const suffix = rawTarget.slice(lastAt + 1);

  const unregisteredHint = suffix.length > 0
-    ? `no registered host '${suffix}' — if '${suffix}' was meant as a host, check \`rig host ls\``
+    ? `no registered host '${suffix}' — if '${suffix}' is another machine's self-id (the address a cross-host message shows), `
+      + `run \`rig host doctor <alias>\` for that machine's entry if it uses http (it learns the id), or set \`hostId: ${suffix}\` on that entry in hosts.yaml (any transport); `
+      + `\`rig host ls\` lists the registered hosts`
    : undefined;

  if (suffix.length === 0 || base.length === 0) {
@@ -62,6 +62,9 @@ export interface DaemonStatus {
  eventLoop?: DaemonEventLoopEvidence;
  /** #275 — the OS code behind a failed health probe (e.g. EPERM when a sandbox blocked it). */
  probeErrorCode?: string;
+  /** T2 — a refused listener under a live start reservation (daemon-start.lock): a launch is in
+   *  progress and not listening yet. `pid` is the live launcher (else child) PID; `since` its start. */
+  startPending?: { pid: number; since?: string };
 }

 /** "unknown": the process may exist but this shell can neither signal nor inspect it. */
@@ -137,6 +140,16 @@ export function statusGuardMessage(status: DaemonStatus): DaemonNotRunningError
      ...causeCode,
    };
  }
+  // A refused probe under a live start reservation: a launch is in progress and nothing is listening yet.
+  if (status.startPending) {
+    const since = status.startPending.since ? ` since ${status.startPending.since}` : "";
+    return {
+      fact: `Daemon is starting (launch reserved by pid ${status.startPending.pid}${since}); it isn't listening yet.`,
+      consequence: "This command needs a responsive daemon.",
+      action: "Wait, then re-check with 'rig daemon status'.",
+      ...causeCode,
+    };
+  }
  // unverified, or running-but-unhealthy: we do NOT know it is down.
  return {
    fact: "Daemon did not respond — it may be busy or stopped (state not confirmed).",
@@ -842,6 +855,13 @@ async function startOwnedDaemon(opts: StartOptions, deps: LifecycleDeps, lock: D
      if (unverified) {
        throw new StartupChildPendingError(`Daemon child ${pid} responds at ${healthzUrl}, but listener verification is incomplete: ${lastProbe} Child left running; startup reservation retained. Inspect 'rig daemon status', daemon-start.lock and daemon.log before recovery.`);
      }
+      // Expiring the readiness budget is not evidence that this owned child failed.
+      // Keep launch exclusion until an operator can inspect a slow pre-bind startup.
+      assertChild();
+      if (deps.isProcessAlive(pid!)) {
+        assertChild();
+        throw new StartupChildPendingError(`Daemon startup is pending after the readiness deadline (child PID ${pid}). Readiness is not confirmed; child left running and startup reservation retained. Last probe: ${lastProbe}. Launch endpoint: ${healthzUrl}. Inspect that URL and ${LOG_FILE}; this check does not publish readiness, adopt the child or release the reservation. To restart manually, stop child PID ${pid} and wait for exit; inspect ${path.join(OPENRIG_DIR, "daemon-start.lock")}, and only after both recorded launcher and child PIDs are absent, archive it and run 'rig daemon start'. 'rig daemon stop' cannot target this unpublished child, and another start remains blocked by the reservation.`);
+      }
      throw new Error(`${summarizeDaemonStartFailure(healthzUrl, deps.readFile(resolveLifecycleFile(deps, "daemon.log")))}. Last probe: ${lastProbe}`);
    }
    assertChild();
@@ -1036,6 +1056,40 @@ function findSiblingHome(deps: LifecycleDeps): DaemonStatus["siblingHint"] {
  return undefined;
 }

+/** T2 — read-only: the live launcher (else child) PID named by a start reservation, or undefined
+ *  when there is no reservation, it is unreadable, or every PID it names is dead. */
+function liveStartReservation(deps: LifecycleDeps): DaemonStatus["startPending"] {
+  try {
+    const file = path.join(deps.homeDir ?? OPENRIG_DIR, "daemon-start.lock");
+    const raw = deps.exists(file) ? deps.readFile(file) : null;
+    if (!raw) return undefined;
+    let launcherPid: number | undefined;
+    let childPid: number | undefined;
+    let since: string | undefined;
+    for (const line of raw.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        const rec = JSON.parse(line) as { launcherPid?: unknown; childPid?: unknown; startedAt?: unknown };
+        if (typeof rec.launcherPid === "number") launcherPid = rec.launcherPid;
+        if (typeof rec.childPid === "number") childPid = rec.childPid;
+        if (typeof rec.startedAt === "string") since = rec.startedAt;
+      } catch {
+        // partial line: keep whatever parsed
+      }
+    }
+    for (const pid of [launcherPid, childPid]) {
+      if (pid === undefined) continue;
+      const liveness: ProcessLiveness = deps.processLiveness
+        ? deps.processLiveness(pid)
+        : deps.isProcessAlive(pid) ? "alive" : "dead";
+      if (liveness !== "dead") return { pid, ...(since ? { since } : {}) };
+    }
+  } catch {
+    // best-effort only: a status read must never fail on the reservation
+  }
+  return undefined;
+}
+
 export async function getDaemonStatus(
  deps: LifecycleDeps,
  options: GetDaemonStatusOptions = {},
@@ -1088,9 +1142,13 @@ export async function getDaemonStatus(
      // 1ae863d2: the resolved home has NO daemon state — before asserting anything,
      // look for a live sibling home / HOME-MOVED marker (the wrong-home class).
      const siblingHint = findSiblingHome(deps);
-      if (siblingHint) return { state: "unverified", siblingHint, ...probeErrorCodeOf(err) };
-      return isRefusedError(err)
-        ? { state: "stopped" }
+      // T2: a refused listener under a live start reservation is a launch in progress, not down.
+      const refused = isRefusedError(err);
+      const startPending = refused ? liveStartReservation(deps) : undefined;
+      if (siblingHint) return { state: "unverified", siblingHint, ...probeErrorCodeOf(err), ...(startPending ? { startPending } : {}) };
+      if (refused && !startPending) return { state: "stopped" };
+      return refused
+        ? { state: "unverified", port: configured.port, host: configured.host, startPending, ...probeErrorCodeOf(err) }
        : { state: "unverified", port: configured.port, host: configured.host, ...probeErrorCodeOf(err) };
    }
  }
@@ -1118,7 +1176,12 @@ export async function getDaemonStatus(
      return { state: "running", port: state.port, host, pid: state.pid, healthy: ev.healthy, reason: ev.reason, eventLoop: ev.eventLoop, ...(ev.databaseWarnings ? { databaseWarnings: ev.databaseWarnings } : {}) };
    } catch (err) {
      // 1ae863d2: refusal = positive down; anything else (timeout/wedged/blocked) = unverified.
-      return isRefusedError(err) ? { state: "stopped" } : { state: "unverified", pid: state.pid, port: state.port, host, ...probeErrorCodeOf(err) };
+      // T2: unless a live start reservation says a launch is in progress.
+      if (isRefusedError(err)) {
+        const startPending = liveStartReservation(deps);
+        return startPending ? { state: "unverified", pid: state.pid, port: state.port, host, startPending, ...probeErrorCodeOf(err) } : { state: "stopped" };
+      }
+      return { state: "unverified", pid: state.pid, port: state.port, host, ...probeErrorCodeOf(err) };
    }
  }

@@ -58,13 +58,14 @@ export function getOfflineHelpPath(): string | undefined {
 }

 /** Whether a command should make its real request: false only when the daemon is confirmed down
- *  (stopped, a stale record, or a refused health probe, meaning nothing is listening), when this
+ *  (stopped, a stale record, or a refused health probe, meaning nothing is listening, including one under a
+ *  pending start, whose `startPending` is set only on a refused probe), when this
 *  machine blocked the health probe, or when a live sibling home suggests the request would reach
 *  another home's daemon. A daemon that is alive but busy (its health check slow, failing or
 *  reporting a starved loop) gets the request, under its normal timeout. */
 export function daemonMayAnswer(status: DaemonStatus): boolean {
  if (status.state === "stopped" || status.state === "stale") return false;
-  if (status.probeErrorCode === "ECONNREFUSED") return false;
+  if (status.probeErrorCode === "ECONNREFUSED" || status.startPending) return false;
  if (status.siblingHint || isBlockedConnectionCode(status.probeErrorCode)) return false;
  return true;
 }
@@ -59,7 +59,8 @@ export interface DestroyDeps {
  removePath: (path: string) => void;
  mkdirp: (path: string) => void;
  listManagedTmuxSessions: (dbPath: string) => string[];
-  killTmuxSession: (sessionName: string) => boolean;
+  resolveTmuxServerArgs?: (stateRoot: string) => string[];
+  killTmuxSession: (sessionName: string, serverArgs?: readonly string[]) => boolean;
  sleep: (ms: number) => Promise<void>;
  now: () => Date;
 }
@@ -179,6 +180,9 @@ function isLocalHost(host: string): boolean {
 }

 export async function executeDestroy(plan: DestroyPlan, deps: DestroyDeps): Promise<DestroyResult> {
+  // Resolve before stopping the daemon or moving its state. An unreadable record
+  // must not turn a managed-session cleanup into a kill on the caller's server.
+  const serverArgs = plan.scope === "all" ? deps.resolveTmuxServerArgs?.(plan.stateRoot) : undefined;
  const warnings = [...plan.warnings];
  const backupPaths: string[] = [];
  let stateRecreated = false;
@@ -239,7 +243,7 @@ export async function executeDestroy(plan: DestroyPlan, deps: DestroyDeps): Prom
  let tmuxMissing = 0;
  if (plan.scope === "all") {
    for (const sessionName of plan.managedTmuxSessions) {
-      if (deps.killTmuxSession(sessionName)) tmuxKilled += 1;
+      if (deps.killTmuxSession(sessionName, serverArgs)) tmuxKilled += 1;
      else tmuxMissing += 1;
    }
  }
@@ -284,9 +288,9 @@ export function findListeningPidWithLsof(port: number): number | null {
  }
 }

-export function killTmuxSessionWithCli(sessionName: string): boolean {
+export function killTmuxSessionWithCli(sessionName: string, serverArgs: readonly string[] = []): boolean {
  try {
-    execFileSync("tmux", ["kill-session", "-t", sessionName], { stdio: "ignore" });
+    execFileSync("tmux", [...serverArgs, "kill-session", "-t", `=${sessionName}`], { stdio: "ignore" });
    return true;
  } catch {
    return false;
@@ -161,7 +161,7 @@ export function recordHostObservation(args: {

 function recordUnderLock(alias: string, observedHostId: string, observedUrl: string | undefined, at: string, path: string): HostObservationOutcome {
  const file = loadHostBindings(path);
-  const existing = file.bindings[alias];
+  const existing = Object.hasOwn(file.bindings, alias) ? file.bindings[alias] : undefined;

  let result: HostObservationOutcome;
  if (!existing) {
@@ -372,3 +372,128 @@ export function addHostEntry(rawEntry: Record<string, unknown>, path: string = d
  }
  return { ok: true, path, entry };
 }
+
+// ---------------------------------------------------------------------------
+// OPR.0.4.6.MH1 FR-1 extension (issue #2128, maintainer boundary) — the
+// edit/remove write paths, through the SAME ONE write contract as add:
+// load-validate (a present-but-invalid registry is NEVER overwritten),
+// candidate through validateHostRegistry (add-time errors are load-time
+// errors, verbatim), atomic tmp+rename at 0600.
+//
+// Boundary pinned here: an edit keeps the host's id and transport FIXED;
+// unknown fields fail loud with the allowed set (a typo'd flag must never
+// silently no-op an edit); an empty string clears an OPTIONAL field (user,
+// notes) — clearing is how a wrong value is dropped, while required fields
+// (target, url) keep the validator's non-empty rule; remove deletes ONLY the
+// registry entry (no credential files, no learned identity, no selection).
+//
+// The daemon twin (packages/daemon/src/domain/hosts/hosts-registry-writer.ts)
+// mirrors updateHostEntry/removeHostEntry verbatim; byte parity is pinned by
+// packages/daemon/test/hosts-registry-parity.test.ts.
+// ---------------------------------------------------------------------------
+
+/** Fields an edit may touch, per transport. id/transport never appear here. */
+const EDITABLE_FIELDS: Record<"ssh" | "http", readonly string[]> = {
+  ssh: ["target", "user", "notes"],
+  http: ["url", "notes"],
+};
+
+/** Optional editable fields an empty string CLEARS (drops the key). */
+const CLEARABLE_FIELDS = new Set(["user", "notes"]);
+
+export type UpdateHostResult =
+  | { ok: true; path: string; entry: HostEntry; previous: HostEntry }
+  | { ok: false; error: string };
+
+export type RemoveHostResult =
+  | { ok: true; path: string; entry: HostEntry }
+  | { ok: false; error: string };
+
+/** The write-path load: MISSING is an error here (nothing to edit/remove) with
+ *  the loader's canonical message; INVALID is a loud refusal, never clobbered. */
+function loadExistingForWrite(path: string): { ok: true; existing: HostEntry[] } | { ok: false; error: string } {
+  const loaded = loadHostRegistry(path);
+  if (loaded.ok) return { ok: true, existing: loaded.registry.hosts };
+  const prefix = existsSync(path) ? "refusing to modify an invalid registry: " : "";
+  return { ok: false, error: prefix + loaded.error };
+}
+
+/** Unknown-id error for a WRITE: names the id, lists known ids (resolveHost's shape). */
+function unknownHostIdError(existing: HostEntry[], id: string): string {
+  const knownIds = existing.map(h => h.id).slice(0, 10);
+  const hint = knownIds.length > 0
+    ? ` Known host ids: ${knownIds.join(", ")}${existing.length > knownIds.length ? ` (+${existing.length - knownIds.length} more)` : ""}.`
+    : " (registry is empty)";
+  return `unknown host id '${id}'.${hint}`;
+}
+
+/** The atomic registry write the write contract shares (tmp+rename, 0600). */
+function writeRegistryFile(path: string, hosts: HostEntry[]): string | null {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = join(dirname(path), `.hosts.yaml.tmp-${process.pid}`);
+    writeFileSync(tmp, yaml().stringify({ hosts }), { mode: 0o600 });
+    renameSync(tmp, path);
+    return null;
+  } catch (err) {
+    return `failed to write host registry at ${path}: ${(err as Error).message}`;
+  }
+}
+
+/** Apply an edit to ONE entry: id/transport fixed, unknown fields refused,
+ *  empty string clears an optional field, then the WHOLE registry validates. */
+export function updateHostEntry(id: string, changes: Record<string, unknown>, path: string = defaultHostRegistryPath()): UpdateHostResult {
+  const loaded = loadExistingForWrite(path);
+  if (!loaded.ok) return loaded;
+  const idx = loaded.existing.findIndex(h => h.id === id);
+  if (idx === -1) return { ok: false, error: unknownHostIdError(loaded.existing, id) };
+  const previous = loaded.existing[idx]!;
+
+  if (changes["id"] !== undefined && changes["id"] !== id) {
+    return { ok: false, error: `an edit keeps the host's id fixed — '${id}' cannot become '${String(changes["id"])}'` };
+  }
+  if (changes["transport"] !== undefined) {
+    return { ok: false, error: `an edit keeps the host's transport fixed — '${id}' stays '${previous.transport}'` };
+  }
+  const allowed = EDITABLE_FIELDS[previous.transport];
+  const effective: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(changes)) {
+    if (key === "id") continue; // an id echo naming the same host is a no-op
+    if (!allowed.includes(key)) {
+      return { ok: false, error: `field '${key}' is not editable on an ${previous.transport} host (editable fields: ${allowed.join(", ")})` };
+    }
+    effective[key] = value;
+  }
+  if (Object.keys(effective).length === 0) {
+    return { ok: false, error: "no changes given" };
+  }
+
+  const updated = { ...previous } as Record<string, unknown>;
+  for (const [key, value] of Object.entries(effective)) {
+    if (CLEARABLE_FIELDS.has(key) && value === "") delete updated[key];
+    else updated[key] = value;
+  }
+  const candidate = loaded.existing.map((h, i) => (i === idx ? updated as unknown as HostEntry : h));
+  const validated = validateHostRegistry({ hosts: candidate }, path);
+  if (!validated.ok) return { ok: false, error: validated.error };
+  const entry = validated.registry.hosts.find(h => h.id === id);
+  if (!entry) return { ok: false, error: `host '${id}' did not survive validation` };
+  const writeError = writeRegistryFile(path, validated.registry.hosts);
+  if (writeError) return { ok: false, error: writeError };
+  return { ok: true, path, entry, previous };
+}
+
+/** Remove ONE entry — only the registry entry; nothing else is touched. */
+export function removeHostEntry(id: string, path: string = defaultHostRegistryPath()): RemoveHostResult {
+  const loaded = loadExistingForWrite(path);
+  if (!loaded.ok) return loaded;
+  const idx = loaded.existing.findIndex(h => h.id === id);
+  if (idx === -1) return { ok: false, error: unknownHostIdError(loaded.existing, id) };
+  const entry = loaded.existing[idx]!;
+  const remaining = loaded.existing.filter((_, i) => i !== idx);
+  const validated = validateHostRegistry({ hosts: remaining }, path);
+  if (!validated.ok) return { ok: false, error: validated.error };
+  const writeError = writeRegistryFile(path, validated.registry.hosts);
+  if (writeError) return { ok: false, error: writeError };
+  return { ok: true, path, entry };
+}
@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { environmentCommand, type EnvironmentCommandDeps } from "./commands/environment.js";
 import { Command } from "commander";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -143,6 +144,7 @@ export interface ProgramDeps {
  skillDeps?: StatusDeps;
  agentImageDeps?: StatusDeps;
  communityHarnessDeps?: StatusDeps;
+  environmentDeps?: EnvironmentCommandDeps;
  forkDeps?: StatusDeps;
  workspaceDeps?: WorkspaceDeps;
  whoamiDeps?: StatusDeps;
@@ -227,6 +229,7 @@ export function createProgram(depsOverride?: ProgramDeps): Command {
  program.addCommand(skillCommand(depsOverride?.skillDeps));
  program.addCommand(agentImageCommand(depsOverride?.agentImageDeps));
  program.addCommand(communityHarnessCommand(depsOverride?.communityHarnessDeps));
+  program.addCommand(environmentCommand(depsOverride?.environmentDeps));
  program.addCommand(forkCommand(depsOverride?.forkDeps));
  program.addCommand(workspaceCommand(depsOverride?.workspaceDeps));
  program.addCommand(rigModeCommand(depsOverride?.rigModeDeps));
@@ -65,6 +65,7 @@ export const COMMAND_LOADERS: ReadonlyMap<string, Load> = new Map<string, Load>(
  ["skill", async () => (await import("./commands/skill.js")).skillCommand()],
  ["agent-image", async () => (await import("./commands/agent-image.js")).agentImageCommand()],
  ["community-harness", async () => (await import("./commands/community-harness.js")).communityHarnessCommand()],
+  ["environment", async () => (await import("./commands/environment.js")).environmentCommand()],
  ["fork", async () => (await import("./commands/fork.js")).forkCommand()],
  ["workspace", async () => (await import("./commands/workspace.js")).workspaceCommand()],
  ["mode", async () => (await import("./commands/rig-mode.js")).rigModeCommand()],
@@ -0,0 +1,7 @@
+/** An older daemon can ignore new fields. A read-only plan must acknowledge the exact selection before a mutation. */
+export function accountHomePlanMatches(plan: Record<string, unknown>, home: string | null,
+  token?: { label: string; tokenFile: string }): boolean {
+  if (plan["ok"] !== true || plan["dryRun"] !== true || plan["accountHome"] !== home) return false;
+  const selected = plan["accountToken"] as { label?: unknown; tokenFile?: unknown } | null | undefined;
+  return token ? selected?.label === token.label && selected?.tokenFile === token.tokenFile : selected == null;
+}
@@ -62,6 +62,31 @@ function bodyStartIndex(lines: string[]): number {
  return 0; // unterminated frontmatter — treat as no frontmatter
 }

+/** Keep source indices while hiding code examples from the progress grammar. */
+function progressLines(lines: string[]): string[] {
+  let fence: { marker: string; length: number } | null = null;
+  const start = bodyStartIndex(lines);
+  return lines.map((line, i) => {
+    if (i < start) return "";
+    const match = line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
+    if (match) {
+      const marker = match[1]![0]!;
+      const length = match[1]!.length;
+      const tail = match[2]!;
+      if (fence) {
+        if (marker === fence.marker && length >= fence.length && /^[ \t\r]*$/.test(tail)) {
+          fence = null;
+          return line; // A new row may be inserted after the closing fence.
+        }
+      } else if (marker !== "`" || !tail.includes("`")) {
+        fence = { marker, length };
+      }
+      return "";
+    }
+    return fence ? "" : line;
+  });
+}
+
 export interface ProgressEditResult {
  content: string;
  changed: boolean;
@@ -92,32 +117,35 @@ export function addProgressRow(
  const newRow = `- [${statusIndicator(opts.status)}] ${text}`;
  const lines = content.split("\n");
  const start = bodyStartIndex(lines);
+  const visible = progressLines(lines);

  // Locate the target section heading.
  let sectionIdx = -1;
  for (let i = start; i < lines.length; i++) {
-    const h = lines[i]!.match(HEADING_RE);
+    const h = visible[i]!.match(HEADING_RE);
    if (h && h[1] === "##" && h[2]!.trim() === section) { sectionIdx = i; break; }
  }

  if (sectionIdx === -1) {
    // Create the section, appended after the last existing content.
    let end = lines.length;
-    while (end > start && lines[end - 1]!.trim() === "") end--;
+    while (end > start && visible[end - 1]!.trim() === "") end--;
    const head = lines.slice(0, end);
-    const rebuilt = [...head, "", `## ${section}`, "", newRow, ""].join("\n");
+    const suffix = lines.slice(end);
+    const rebuilt = [...head, "", `## ${section}`, "", newRow, "",
+      ...(suffix.some(line => line.trim() !== "") ? suffix : [])].join("\n");
    return { content: rebuilt, changed: true };
  }

  // Section block = [sectionIdx+1, nextHeadingOrEOF).
  let blockEnd = lines.length;
  for (let i = sectionIdx + 1; i < lines.length; i++) {
-    if (HEADING_RE.test(lines[i]!)) { blockEnd = i; break; }
+    if (HEADING_RE.test(visible[i]!)) { blockEnd = i; break; }
  }

  // Idempotency / conflict scan within the section.
  for (let i = sectionIdx + 1; i < blockEnd; i++) {
-    const cb = lines[i]!.match(ROW_RE);
+    const cb = visible[i]!.match(ROW_RE);
    if (cb && cb[3]!.trim() === text) {
      const current = indicatorToStatus(cb[2]!);
      if (current === opts.status) return { content, changed: false };
@@ -132,7 +160,7 @@ export function addProgressRow(
  // Insert after the last non-blank line in the section block.
  let insertAt = sectionIdx + 1;
  for (let i = sectionIdx + 1; i < blockEnd; i++) {
-    if (lines[i]!.trim() !== "") insertAt = i + 1;
+    if (visible[i]!.trim() !== "") insertAt = i + 1;
  }
  lines.splice(insertAt, 0, newRow);
  return { content: lines.join("\n"), changed: true };
@@ -155,10 +183,11 @@ export function setProgressRow(
  const text = opts.text.trim();
  const lines = content.split("\n");
  const start = bodyStartIndex(lines);
+  const visible = progressLines(lines);

  const matches: number[] = [];
  for (let i = start; i < lines.length; i++) {
-    const cb = lines[i]!.match(ROW_RE);
+    const cb = visible[i]!.match(ROW_RE);
    if (cb && cb[3]!.trim() === text) matches.push(i);
  }

@@ -31,7 +31,10 @@ export type FindingKind =
  // SPEC.md compatibility — a node carrying BOTH authored files. Advisory by
  // construction (low severity never flips the exit code): SPEC.md wins, and the
  // shadowed README.md is a state to notice, never a failure to gate on.
-  | "shadowed_node_file";
+  | "shadowed_node_file"
+  // Another mission has a slice folder of the same name, which the slice list and the name-only routes
+  // hide. Advisory (low severity): renaming is the person's call.
+  | "slice_name_shared";

 export interface AuditFinding {
  kind: FindingKind;
@@ -362,31 +362,23 @@ export function listMissions(missionsRoot: string): MissionInfo[] {
    const hasReadme = readmePath !== null;
    if (!hasReadme) continue;
    const frontmatter = readFrontmatter(readmePath);
-    const slicesDir = path.join(absPath, "slices");
-    const closedDir = path.join(absPath, "closed");
-    const activeSliceCount = countSliceDirs(slicesDir);
-    const closedSliceCount = countSliceDirs(closedDir);
    const id = pickIdFromFrontmatter(frontmatter);
-    out.push({
-      name: entry.name,
-      absPath,
-      readmePath: hasReadme ? readmePath : null,
-      frontmatter,
-      id,
-      activeSliceCount,
-      closedSliceCount,
-    });
+    out.push(withSliceCounts({ name: entry.name, absPath, readmePath, frontmatter, id }));
  }
  // Stable order: by mission name.
  out.sort((a, b) => a.name.localeCompare(b.name));
  return out;
 }

-function countSliceDirs(dir: string): number {
-  if (!fs.existsSync(dir)) return 0;
-  return fs.readdirSync(dir, { withFileTypes: true })
-    .filter((e) => e.isDirectory() && SLICE_DIRNAME_RE.test(e.name))
-    .length;
+/** The mission with each of its slices counted once, by its standing (the same one `slice ls` filters on). */
+function withSliceCounts(base: Omit<MissionInfo, "activeSliceCount" | "shippedSliceCount" | "closedSliceCount">): MissionInfo {
+  const mission: MissionInfo = { ...base, activeSliceCount: 0, shippedSliceCount: 0, closedSliceCount: 0 };
+  for (const { standing } of slicesWithStanding(mission)) {
+    if (standing === "active") mission.activeSliceCount++;
+    else if (standing === "shipped") mission.shippedSliceCount++;
+    else mission.closedSliceCount++;
+  }
+  return mission;
 }

 function pickIdFromFrontmatter(fm: Record<string, unknown>): string | null {
@@ -425,15 +417,7 @@ export function findMission(missionsRoot: string, identifier: string): MissionIn
 function buildMissionInfo(missionsRoot: string, absPath: string): MissionInfo {
  const readmePath = resolveNodeFile(absPath);
  const frontmatter = readmePath ? readFrontmatter(readmePath) : {};
-  return {
-    name: path.basename(absPath),
-    absPath,
-    readmePath,
-    frontmatter,
-    id: pickIdFromFrontmatter(frontmatter),
-    activeSliceCount: countSliceDirs(path.join(absPath, "slices")),
-    closedSliceCount: countSliceDirs(path.join(absPath, "closed")),
-  };
+  return withSliceCounts({ name: path.basename(absPath), absPath, readmePath, frontmatter, id: pickIdFromFrontmatter(frontmatter) });
 }

 // ---------------------------------------------------------------------
@@ -444,35 +428,35 @@ export function listSlices(
  mission: MissionInfo,
  state: SliceState,
 ): SliceInfo[] {
-  const dirs: Array<{ root: string; bucket: "active" | "closed" }> = [];
-  if (state === "active" || state === "shipped" || state === "all") {
-    dirs.push({ root: path.join(mission.absPath, "slices"), bucket: "active" });
-  }
-  if (state === "closed" || state === "all") {
-    dirs.push({ root: path.join(mission.absPath, "closed"), bucket: "closed" });
-  }
-  const out: SliceInfo[] = [];
-  for (const { root } of dirs) {
+  return slicesWithStanding(mission)
+    .filter(({ standing }) => state === "all" || standing === state)
+    .map(({ slice }) => slice);
+}
+
+/** Where a slice stands. In closed/, it's closed. In place: shipped (or done) is delivered; a closed or superseded
+ *  status, or a superseded or retired stage, is an exit, so closed; anything else, blocked work included, is active. */
+export function sliceStanding(slice: SliceInfo, inClosedFolder: boolean): Exclude<SliceState, "all"> {
+  if (inClosedFolder) return "closed";
+  const status = (slice.status ?? "").toLowerCase();
+  const stage = typeof slice.frontmatter.stage === "string" ? slice.frontmatter.stage.toLowerCase() : "";
+  if (status === "done" || status.startsWith("shipped")) return "shipped";
+  if (status.startsWith("closed") || status === "superseded" || stage === "superseded" || stage === "retired") return "closed";
+  return "active";
+}
+
+/** Every slice in the mission (slices/ and closed/), in order, each with its standing. */
+function slicesWithStanding(mission: MissionInfo): Array<{ slice: SliceInfo; standing: Exclude<SliceState, "all"> }> {
+  const out: Array<{ slice: SliceInfo; standing: Exclude<SliceState, "all"> }> = [];
+  for (const [folder, inClosedFolder] of [["slices", false], ["closed", true]] as const) {
+    const root = path.join(mission.absPath, folder);
    if (!fs.existsSync(root)) continue;
    for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
-      if (!entry.isDirectory()) continue;
-      const m = SLICE_DIRNAME_RE.exec(entry.name);
-      if (!m) continue;
-      const sliceInfo = buildSliceInfo(mission, root, entry.name);
-      out.push(sliceInfo);
+      if (!entry.isDirectory() || !SLICE_DIRNAME_RE.test(entry.name)) continue;
+      const slice = buildSliceInfo(mission, root, entry.name);
+      out.push({ slice, standing: sliceStanding(slice, inClosedFolder) });
    }
  }
-  out.sort((a, b) => (a.nn ?? Number.MAX_SAFE_INTEGER) - (b.nn ?? Number.MAX_SAFE_INTEGER) || a.name.localeCompare(b.name));
-  if (state === "active") {
-    // active = not in closed/, and not already delivered in-place.
-    return out.filter((s) => {
-      const st = (s.status ?? "").toLowerCase();
-      return st !== "done" && !st.startsWith("closed") && !st.startsWith("shipped");
-    });
-  }
-  if (state === "shipped") {
-    return out.filter((s) => (s.status ?? "").toLowerCase().startsWith("shipped"));
-  }
+  out.sort((a, b) => (a.slice.nn ?? Number.MAX_SAFE_INTEGER) - (b.slice.nn ?? Number.MAX_SAFE_INTEGER) || a.slice.name.localeCompare(b.slice.name));
  return out;
 }

@@ -30,7 +30,10 @@ export interface MissionInfo {
  /** Minted dot-ID for this mission (read from frontmatter if present,
   *  otherwise inferred from the folder name pattern). */
  id: string | null;
+  /** Slices in flight (blocked included); delivered in place; and closed (closed/, or an exit in place). Each slice is
+   *  counted once, by the standing `slice ls --state` filters on. */
  activeSliceCount: number;
+  shippedSliceCount: number;
  closedSliceCount: number;
 }

@@ -18,6 +18,15 @@ const WAIT_FOR_IDLE_REQUEST_OVERHEAD_MS = 5_000;
 /** The most text rig_context_get and rig_artifact_read return in one call; a longer file or section is cut, and says so. */
 const CONTEXT_TEXT_LIMIT = 48_000;

+/** Where a cut of text at end goes: one unit earlier when end falls inside a surrogate pair (an emoji, say), so the
+ *  cut text and the rest after it both hold whole characters. */
+function wholeCharEnd(text: string, end: number): number {
+  if (end <= 0 || end >= text.length) return end;
+  const before = text.charCodeAt(end - 1);
+  const after = text.charCodeAt(end);
+  return before >= 0xd800 && before <= 0xdbff && after >= 0xdc00 && after <= 0xdfff ? end - 1 : end;
+}
+
 type TextResult = {
  content: Array<{ type: "text"; text: string }>;
  isError?: true;
@@ -327,10 +336,11 @@ function scopeFor(access: McpAccess, seatOf: () => string | undefined): Scope {
  };
 }

-/** The grant service names an external caller's seat cus-<id>-caller@<rig>. v1 marks no seat as a caller, so an item
- *  from a seat of this shape is never the team's question to an external caller, and an external caller can't hand a
- *  task to one. The shape never grants anything. */
-const CALLER_SHAPED = /^cus-.+-caller@[^@]+$/;
+/** The grant service names each connected assistant's seat cus-<id>-<connection>@<rig> (an existing connection's is
+ *  cus-<id>-caller@<rig>). v1 marks no seat as a caller, so for a grant without team/list an item from a seat of this
+ *  shape is never the team's question to it, and it can't hand a task to one. The shape only refuses; it never grants
+ *  anything, and a grant with team/list doesn't read it. */
+const CALLER_SHAPED = /^cus-[^@]+-[^@]+@[^@]+$/;

 /** OpenRig's own tags that decide what a person asked about a row sees of its body: what Slack ingestion records about where
 *  the row came from and which parts of its body OpenRig wrote (the sender's channel, the attachments block, the body's
@@ -340,11 +350,15 @@ const CALLER_SHAPED = /^cus-.+-caller@[^@]+$/;
 const OPENRIG_PROVENANCE_TAG = /^(?:founder-slack|inbound|shared-channel|gate)$|^participant:|^slack-/;

 /** An external grant (openrig.grant/v1): a requester, narrower than a work grant. The grant's own seat is the
- *  only caller. It may hand tasks to its rigs' team seats (never a caller-shaped seat, a person or another host's
- *  seat), read the items it sent and the team's questions to it (never team-internal or another caller's items), follow
- *  a handed-on item only where it came back to it, and read the artifacts of its own items under its named roots. */
+ *  only caller. It may hand tasks to its rigs' other seats (never a person or another host's seat, and without team/list
+ *  never a caller-shaped seat), read the items it sent and those addressed to it from those seats (never team-internal
+ *  items or other callers' items between themselves), change only the items addressed to its own seat (with the claim and
+ *  update pairs), follow a handed-on item only where it came back to it, and read the artifacts of its own items under
+ *  its named roots. */
 function externalScope(access: McpAccess, seatOf: () => string | undefined): Scope {
  const rigs = new Set(access.rigs);
+  // team/list makes the caller one of its rigs' participants: it may reach another connected assistant's seat.
+  const participant = access.external?.objects.team?.includes("list") === true;
  const caller = (value: unknown): boolean => typeof value === "string" && value !== "" && value === seatOf();
  // A seat of one of its rigs on this instance: member@rig, never a person or another host's seat.
  const member = (value: unknown): boolean => {
@@ -352,17 +366,20 @@ function externalScope(access: McpAccess, seatOf: () => string | undefined): Sco
    const parts = value.split("@");
    return parts.length === 2 && parts[0] !== "" && parts[1] !== "external" && rigs.has(parts[1]!);
  };
-  const team = (value: unknown): boolean => member(value) && !caller(value) && !CALLER_SHAPED.test(value as string);
+  const team = (value: unknown): boolean => member(value) && !caller(value) && (participant || !CALLER_SHAPED.test(value as string));
  const field = (row: unknown, name: "sourceSession" | "destinationSession"): unknown => ((row ?? {}) as Record<string, unknown>)[name];
  const item = (row: unknown): boolean => caller(field(row, "sourceSession"))
    || (caller(field(row, "destinationSession")) && team(field(row, "sourceSession")));
  return {
    session: (value) => caller(value) || team(value),
    item,
-    owner: () => false,
+    // Only an item addressed to its exact seat, and one it may read, is its own to change; the daemon's claim also checks
+    // the claimant.
+    owner: (row) => caller(field(row, "destinationSession")) && item(row),
    rig: (name) => typeof name === "string" && rigs.has(name),
    root: (name) => typeof name === "string" && access.roots.includes(name),
-    // A task goes to the team: never to the caller itself or to another caller-shaped seat, which v1 can't tell apart.
+    // A task goes to another seat of its rigs: never to the caller itself, and without team/list never to another
+    // caller-shaped seat, which v1 can't tell apart.
    destination: team,
    successor: caller,
    artifact: (row) => caller(field(row, "sourceSession")),
@@ -399,7 +416,7 @@ function artifactView(source: string, read: FileRead, offset: number): Record<st
  const base = { available: true, source, root: read.root, path: read.path, size: read.size, mtime: read.mtime };
  if (read.binary) return { ...base, binary: true, note: "A binary file: not shown as text." };
  const text = read.content ?? "";
-  const end = offset + CONTEXT_TEXT_LIMIT;
+  const end = wholeCharEnd(text, offset + CONTEXT_TEXT_LIMIT);
  return {
    ...base, binary: false, offset, text: text.slice(offset, end), totalChars: text.length,
    truncated: text.length > end || read.truncated === true,
@@ -471,7 +488,8 @@ export type McpAccess = {

 /** The tool each external object/action pair offers. A pair not listed here offers nothing. */
 const EXTERNAL_TOOLS: Readonly<Record<string, Readonly<Record<string, string>>>> = {
-  queue: { create: "rig_queue_create", show: "rig_queue_show", list: "rig_queue_list" },
+  queue: { create: "rig_queue_create", show: "rig_queue_show", list: "rig_queue_list", claim: "rig_queue_claim", update: "rig_queue_update" },
+  team: { list: "rig_team" },
  artifact: { read: "rig_artifact_read" },
 };

@@ -514,6 +532,7 @@ export const MCP_OPERATIONS: ReadonlyArray<{ tool: string; routes: readonly stri
  { tool: "rig_queue_list", routes: ["GET /api/queue/list"], effect: "read", access: "work" },
  { tool: "rig_queue_claim", routes: ["POST /api/queue/:qitemId/claim"], effect: "destructive", access: "work" },
  { tool: "rig_queue_update", routes: ["POST /api/queue/:qitemId/update"], effect: "destructive", access: "work" },
+  { tool: "rig_environment_export", routes: ["GET /api/queue/:qitemId", "POST /api/environments/:bindingId/export"], effect: "additive", access: "work" },
  { tool: "rig_telemetry_events", routes: ["GET /api/telemetry/v1/events"], effect: "read", access: "owner" },
  { tool: "rig_whoami", routes: ["GET /api/whoami"], effect: "read", access: "work" },
  { tool: "rig_team", routes: ["GET /api/rigs/:rigId", "GET /api/rigs/:rigId/nodes", "GET /healthz"], effect: "read", access: "work" },
@@ -554,6 +573,16 @@ const SHARED_INSTRUCTIONS = [
 ];
 const INSTRUCTIONS = [...SHARED_INSTRUCTIONS, MEMBER_WORKFLOW].join("\n");
 const EXTERNAL_INSTRUCTIONS = SHARED_INSTRUCTIONS.join("\n");
+/** For an external grant that names claim and update: how it works the items addressed to it, messages included. */
+const EXTERNAL_INBOX_INSTRUCTIONS = [...SHARED_INSTRUCTIONS,
+  "Items addressed to your seat are yours: rig_queue_list with owned set lists them. For each, claim it (rig_queue_claim), do it, then close it done with closure reason no-follow-on and the answer in resolution (rig_queue_update); the sender reads that answer on the same item. A message is an item too: read it, close it done, and reply, when it needs one, with a new item to its sender. Nothing promises to wake you, so check your items again.",
+].join("\n");
+
+function instructionsFor(access: McpAccess | undefined): string {
+  if (!access?.external) return INSTRUCTIONS;
+  const tools = externalTools(access.external.objects);
+  return tools.has("rig_queue_claim") && tools.has("rig_queue_update") ? EXTERNAL_INBOX_INSTRUCTIONS : EXTERNAL_INSTRUCTIONS;
+}

 /**
 * Maps a DaemonResponse to MCP tool result.
@@ -606,7 +635,7 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
  const server = new McpServer({
    name: "openrig",
    version: CLI_VERSION,
-  }, { instructions: options.access?.external ? EXTERNAL_INSTRUCTIONS : INSTRUCTIONS });
+  }, { instructions: instructionsFor(options.access) });
  const { access } = options;
  const rostersFolder = options.rostersFolder ?? (() => nodePath.join(new ConfigStore().get("workspace.root") as string, "rosters"));
  const presenceFile = options.presenceFile ?? (() => mcpPresenceFilePath());
@@ -1335,7 +1364,10 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
      try {
        const denied = await itemOutOfScope(qitemId);
        if (denied) return denied;
-        return mapResult(await client.post(`/api/queue/${encodeURIComponent(qitemId)}/claim`, {}), undefined, { structured: true });
+        const res = await client.post(`/api/queue/${encodeURIComponent(qitemId)}/claim`, {});
+        // An external caller's claimed item goes through the same projection as show and list.
+        const view = externalView(scope);
+        return mapResult(view && res.status < 400 ? { ...res, data: projectForExternal(res.data, view) } : res, undefined, { structured: true });
      } catch (err) {
        return caught(err);
      }
@@ -1366,15 +1398,46 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
      try {
        const denied = await itemOutOfScope(qitemId, "owner");
        if (denied) return denied;
-        return mapResult(await client.post(`/api/queue/${encodeURIComponent(qitemId)}/update`, {
+        // An external caller waits only on an item it names and can read: parking on a person would ask them, parking on
+        // another item would say whether it exists, and a park that names nothing would restore a blocker the team set.
+        if (access?.external && (blockedOn || state === "blocked")) {
+          const blocker = blockedOn?.startsWith("qitem-") ? await client.get(`/api/queue/${encodeURIComponent(blockedOn)}`) : null;
+          if (!blocker || blocker.status >= 400 || !scope?.item(blocker.data)) return outOfScope(`Blocker ${blockedOn ?? "(none named)"}`);
+        }
+        const res = await client.post(`/api/queue/${encodeURIComponent(qitemId)}/update`, {
          state, closureReason, closureTarget, summary, evidenceRef, blockedOn, wakeAfterSeconds, transitionNote: note, resolution, reopen,
-        }), undefined, { structured: true });
+        });
+        // An external caller's updated item goes through the same projection as show and list.
+        const view = externalView(scope);
+        return mapResult(view && res.status < 400 ? { ...res, data: projectForExternal(res.data, view) } : res, undefined, { structured: true });
      } catch (err) {
        return caught(err);
      }
    },
  );

+  // Artifact publication uses this actual authenticated work caller, never a body actor or activity token.
+  if (offered("rig_environment_export")) server.registerTool(
+    "rig_environment_export",
+    {
+      description: "Transfer a bound worker's actual JSON artifact to the host, verify its bytes/schema/context and append a durable receipt to its existing work. Does not close work, stop compute or restore native history. Requires an authenticated HTTP work connection.",
+      inputSchema: z.object({
+        bindingId: z.string(), operationId: z.string(), taskId: z.string(), generation: z.string(), path: z.string(),
+        sha256: z.string(), bytes: z.number().int().positive().max(1048576),
+        schema: z.object({ format: z.literal("json-object/v1"), fields: z.record(z.string(), z.enum(["string", "number", "boolean"])), required: z.array(z.string()) }),
+        context: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])),
+      }),
+      annotations: ADDITIVE,
+    },
+    async ({ bindingId, ...input }) => {
+      if (!access) return { content: [{ type: "text" as const, text: "This export requires a validated HTTP work grant; a declared stdio/local identity is not authentication." }], isError: true };
+      try {
+        const denied = await itemOutOfScope(input.taskId, "owner"); if (denied) return denied;
+        return mapResult(await client.post(`/api/environments/${encodeURIComponent(bindingId)}/export`, input), undefined, { structured: true });
+      } catch (error) { return caught(error); }
+    },
+  );
+
  // 24. rig_telemetry_events — one bounded page of event metadata, the page `rig telemetry events` reads
  if (offered("rig_telemetry_events")) server.registerTool(
    "rig_telemetry_events",
@@ -1459,6 +1522,8 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
    },
    async ({ rigId }) => {
      try {
+        // An external caller names one of its grant's rigs, so a lookup never answers about another workspace's rig.
+        if (access?.external && !scope?.rig(rigId)) return outOfScope(`Rig ${rigId}`);
        const rig = await rigIdFor(client, rigId);
        if ("content" in rig) return rig;
        const id = encodeURIComponent(rig.id);
@@ -1479,7 +1544,9 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
          async (seat) => {
            const rows = await client.get(`/api/queue/list?${new URLSearchParams({ destinationSession: seat, compact: "1", limit: String(PRESENCE_ROWS) }).toString()}`)
              .then((res) => (res.status < 400 ? res.data : null), () => null);
-            return { lastCallAt: readPresence(presenceFile())[seat]?.lastCallAt ?? null, lastWake: newestWake(rows, seat),
+            // An external caller sees a ring only on an item it may read, so another pair's item isn't named.
+            const visible = access?.external && Array.isArray(rows) ? rows.filter((row) => scope?.item(row)) : rows;
+            return { lastCallAt: readPresence(presenceFile())[seat]?.lastCallAt ?? null, lastWake: newestWake(visible, seat),
              lastWakeScope: `the latest ring among its ${PRESENCE_ROWS} most recent rows` };
          });
        return mapResult({ status: 200, data: { ...view, hostedMembers: hosted.members, ...(hosted.note ? { hostedMembersNote: hosted.note } : {}) } }, undefined, { structured: true });
@@ -1581,7 +1648,7 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
        return mapResult({ status: 200, data: {
          address: found.address ?? address, packRef: found.packRef, filePath: found.filePath,
          ...(found.headerPath !== undefined ? { headerPath: found.headerPath } : {}),
-          text: cut ? text.slice(0, CONTEXT_TEXT_LIMIT) : text,
+          text: cut ? text.slice(0, wholeCharEnd(text, CONTEXT_TEXT_LIMIT)) : text,
          ...(cut ? { truncated: true, totalChars: text.length } : {}),
        } }, undefined, { structured: true });
      } catch (err) {
@@ -36,8 +36,8 @@ export function isFixtureScopedHome(home: string): boolean {
  return underTemp && /(^|\/)openrig-qa[^/]*/.test(home);
 }

-export function getOpenRigHome(): string {
-  const configured = readOpenRigEnv("OPENRIG_HOME", "RIGGED_HOME");
+export function getOpenRigHome(env: NodeJS.ProcessEnv = process.env): string {
+  const configured = readOpenRigEnv("OPENRIG_HOME", "RIGGED_HOME", env);
  if (configured !== undefined) return configured;
  return join(homedir(), ".openrig");
 }
@@ -7,6 +7,8 @@ export interface SeatLaunchAdditionsView {
  agentPromptReplacesDefault?: boolean;
  appendSystemPromptFile?: string;
  pluginDirs: string[];
+  /** #2044: absent from a daemon before it, and when the seat has none. */
+  pluginChannels?: string[];
  missing: string[];
  refused: string[];
 }
@@ -17,6 +19,7 @@ export function seatLaunchAdditionLines(additions: SeatLaunchAdditionsView | nul
    ...(additions.agent ? [`agent       ${additions.agent} (--agent${additions.agentPromptReplacesDefault ? "; its prompt replaces Claude's default system prompt" : ""})`] : []),
    ...(additions.appendSystemPromptFile ? [`prompt      ${additions.appendSystemPromptFile} (--append-system-prompt-file)`] : []),
    ...additions.pluginDirs.map((dir) => `plugin dir  ${dir} (CLAUDE_CODE_PLUGIN_DIRS)`),
+    ...(additions.pluginChannels ?? []).map((entry) => `channel     ${entry} (--channels)`),
    ...additions.missing.map((file) => `missing     ${file}: not passed to the launch`),
    ...additions.refused.map((reason) => `refused     ${reason}: not passed to the launch`),
  ];