fix(delivery): ignore Claude's drawn cursor blank (#2933)

For #2925. On an idle Claude seat with the typing guard set to draft-aware, every automatic delivery was held as draft_input_busy while rig capture read the input box as empty. The guard's strict reader counted Claude's own drawn cursor, a single inverse-video blank at the start of the composer, as typed text; the capture annotation already trimmed it. The strict reader now recognises that one drawn blank at the start of a one-row Claude composer and reads the box as empty. Real draft text, ordinary spaces, a moved cursor and multi-row input keep the existing protection, and the explicit draft-aware mode's handling of unreadable input is unchanged. No new refusal or timeout. Reproduced in an isolated 68x31 tmux 3.6 pane with the reported frame: unchanged main held the send, and with the change the message submits once while a real draft stays untouched. It doesn't explain the reported delay of about fifteen minutes before the first hold.

.github/workflows/portability-report.yml

@@ -20,6 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           fetch-depth: 0
       - uses: actions/setup-node@v4
         with:

CHANGELOG.md

@@ -8,398 +8,6 @@ deprecations, and behavioral changes. Breaking changes are called out explicitly
 
 ---
 
-## [0.7.11]
-
-OpenRig 0.7.11 is a patch for people running their own agent teams, cut from
-main `b40bc71c`. Its biggest change: an ordinary send or work notice now goes
-into a person's typed draft by default instead of being refused (see Behaviour
-that changed). A person can now work with their team from their own coding
-agent through the new `openrig` plugin or from an ACP app such as Zed or T3
-Code, and, as an experiment that's off by default, answer the team's questions
-from an assistant connected through a grant service. A prepared managed compaction waits for an idle moment instead
-of asking again, and a restore stopped at a prompt clears itself. On Linux, a
-daemon run as a systemd user service no longer takes its seats down when its
-unit stops or restarts, and writable terminal tiles reflow text when the screen resizes. There
-are fixes across the queue, workflows, launch and speed under load, many
-contributed or reported by people using OpenRig. The OpenShell worker's
-maintained cleanup now works on OpenShell 0.1.6, but the worker still isn't end
-to end: see Known limits.
-
-### Before you upgrade
-
-- **Back up your database first.** Five new migrations run at the daemon's
-  first start: 150 (node launch wrapper), 151 (Pi account switches), 152
-  (workflow instance spec), 153 (events retention marks) and 154 (workflow
-  instance root objective). 0.7.10 had none. With the daemon stopped, copy the
-  file `$OPENRIG_DB` names. Going back to 0.7.10 after these migrations isn't
-  established.
-- **Restart the daemon after installing:**
-  ```bash
-  npm install -g @openrig/cli@0.7.11
-  rig daemon stop && rig daemon start
-  ```
-- **Linux, with the daemon run as a systemd user service:** the seats move into
-  their own scope only when their tmux server next starts fresh. Until then the
-  server stays in the daemon's unit, so stopping or restarting that unit still
-  takes the seats down, as before. ([#2749](https://github.com/mvschwarz/openrig/pull/2749))
-- **The openrig-core plugin moves from 0.1.26 to 0.1.27.**
-  Its activity relay and refocus hooks changed, as did the refocusing,
-  openrig-user and openrig-skills skills. Replaced files are kept under
-  `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits you still
-  need from there. ([#2756](https://github.com/mvschwarz/openrig/pull/2756), [#2743](https://github.com/mvschwarz/openrig/pull/2743), [#2717](https://github.com/mvschwarz/openrig/pull/2717), [#2735](https://github.com/mvschwarz/openrig/pull/2735), [#2657](https://github.com/mvschwarz/openrig/pull/2657), [#2647](https://github.com/mvschwarz/openrig/pull/2647), [#2619](https://github.com/mvschwarz/openrig/pull/2619))
-- **Sends now join a person's draft** (`transport.draft_delivery` = `deliver`).
-  To keep the old refusal, run `rig config set transport.draft_delivery refuse`. ([#2645](https://github.com/mvschwarz/openrig/pull/2645))
-- **A Pi seat that declares an absolute `PI_CODING_AGENT_DIR`** in its `env:`
-  now uses it as its account home and needs a readable `auth.json` there, or
-  the launch stops. Prepare one, or remove the declaration to keep the managed
-  seat login. ([#2630](https://github.com/mvschwarz/openrig/pull/2630))
-
-### Sends and drafts
-
-- **A send now goes into a person's typed draft.** Under the new
-  `transport.draft_delivery` setting's default, `deliver`, an ordinary
-  `rig send` or work notice to a seat whose prompt holds a person's typed draft
-  pastes the message at the cursor and submits the combined input as one
-  prompt, and the send's result says whether submission was confirmed.
-  `refuse` (also `OPENRIG_TRANSPORT_DRAFT_DELIVERY` in the daemon's
-  environment) restores the old refusal where OpenRig detects the draft, from
-  the next send with no restart. Menus, permission prompts, a seat's typing
-  guard, managed compaction and `--wait-for-idle` still refuse or wait under
-  either value. ([#2645](https://github.com/mvschwarz/openrig/pull/2645))
-- **A draft only the input box shows is caught:** an ordinary Claude Code or
-  Codex send reads the box once before pasting (three tmux calls, within
-  500 ms). Under `refuse` the send is refused before any input; under `deliver`
-  the result says it joined the draft. ([#2653](https://github.com/mvschwarz/openrig/pull/2653))
-- **Claude seats showing a statusLine or the background task panel** read as a
-  normal composer under the draft-aware typing guard, so an empty box gets the
-  delivery instead of `draft_input_unknown`. ([#2703](https://github.com/mvschwarz/openrig/pull/2703))
-- **The bare `✔ Update installed · Restart to update` row** of Claude Code
-  2.1.319 in a narrow pane is recognised, so an idle seat's empty prompt reads
-  empty and wakes go through under the draft-aware guard. Checked against the
-  row as reported, not a live pane. ([#2662](https://github.com/mvschwarz/openrig/pull/2662))
-- **A full held-message quota no longer drops a sender's later wakes:** the
-  sender's newest held message retires its earlier ones, listed as `coalesced`
-  in `rig seat held-messages <seat>` and readable with `--id`. ([#2701](https://github.com/mvschwarz/openrig/pull/2701))
-- **Seats stopped while they owe work** don't get a burst of undeliverable
-  wakes at each daemon start; the start-up log says `waiting=N (not replayed: …)`. ([#2620](https://github.com/mvschwarz/openrig/pull/2620))
-
-### Compaction, restore and handover
-
-- **A prepared managed compaction waits for its window.** When the restore map
-  is complete but `/compact` couldn't go in (a draft, a tmux mode, no idle
-  moment), the attempt is held as `prepared` and sends `/compact` at the next
-  idle moment instead of asking the seat to prepare again about every 11
-  minutes. `rig compact --state` shows the hold and `--cancel` disarms it. A
-  busy seat isn't asked again after an ended attempt, across a restart too. ([#2698](https://github.com/mvschwarz/openrig/pull/2698), [#2716](https://github.com/mvschwarz/openrig/pull/2716))
-- **The final `/compact` waits out the preparation's own fresh activity:** its
-  guarded send now allows the 15-second hook freshness window plus the 8-second
-  capture budget (23 seconds, against 9), so a seat that's already idle, such
-  as one out of context, gets `/compact` instead of a refusal. A busy seat can
-  wait up to about 14 seconds longer; the attempt's deadline still limits it. ([#2764](https://github.com/mvschwarz/openrig/pull/2764))
-- **A restore stopped at a prompt clears itself** (such as Claude's resume
-  selection) once the seat runs the conversation it was restoring, using the
-  check `rig seat clear-attention` runs. The docs cover the manual route. ([#2711](https://github.com/mvschwarz/openrig/pull/2711), [#2674](https://github.com/mvschwarz/openrig/pull/2674))
-- **A queue wake refused at a prompt no longer goes in right after "Compacted"**
-  while the compaction still owes its turn boundary and restore request. It
-  goes in at the seat's next idle moment after that step clears, as a recovered
-  notification. ([#2666](https://github.com/mvschwarz/openrig/pull/2666))
-- **A Codex helper inside a Claude seat** (such as `codex exec` from its Bash
-  tool) no longer becomes the seat's resume token, so a restart resumes the
-  Claude conversation instead of failing with `no_conversation_found`. ([#2740](https://github.com/mvschwarz/openrig/pull/2740))
-- **A Claude rebuild handover checks its priming packet:** if it's still
-  staged, the handover reports the submission unconfirmed and says to submit
-  the existing packet once, never to resend or rerun. ([#2650](https://github.com/mvschwarz/openrig/pull/2650))
-- **Restoring a Claude seat's activity hooks** finds the agent's own source from
-  its saved launch recipe, not a same-name agent in the rig's folder. ([#2617](https://github.com/mvschwarz/openrig/pull/2617))
-- **`on_restore: follow_source`** on a spec's `resources.skills[]` entry
-  refreshes that skill from its source when a Claude or Codex seat is restored,
-  keeping its conversation; `keep_saved` stays the default. ([#2626](https://github.com/mvschwarz/openrig/pull/2626))
-
-### Your own coding agent
-
-- **The `openrig` plugin,** shipped beside openrig-core, lets a person work with
-  their local team from their own Claude Code or Codex: hand it work, follow
-  it, answer the team's questions about it, and read the result. Claude Code:
-  `claude plugin marketplace add "$(npm root -g)/@openrig/cli/daemon/assets/plugins/openrig"`,
-  then `claude plugin install openrig@openrig-app`. Codex: the same
-  `codex plugin marketplace add` path, `codex plugin add openrig@openrig-app`, then
-  `codex mcp add openrig --env OPENRIG_SESSION_NAME=<address> -- rig mcp serve --front-door`.
-  The plugin's README has the steps. ([#2647](https://github.com/mvschwarz/openrig/pull/2647))
-- **VS Code, Copilot CLI and Cursor** install it too, with no seat; the README
-  and `rig_whoami` say to add your own `rig mcp serve --front-door` server with
-  `OPENRIG_SESSION_NAME` set and turn the plugin's off. A seatless app can still
-  create a task, send and post, as `unknown-mcp-<8 hex>`. ([#2683](https://github.com/mvschwarz/openrig/pull/2683), [#2709](https://github.com/mvschwarz/openrig/pull/2709), [#2718](https://github.com/mvschwarz/openrig/pull/2718), [#2657](https://github.com/mvschwarz/openrig/pull/2657))
-- **Answers are recorded exactly as the person typed them.** ([#2733](https://github.com/mvschwarz/openrig/pull/2733))
-- **Marketplace files at the repository root** let Claude Code's
-  `/plugin marketplace add mvschwarz/openrig`, and directories that take a public
-  Git repo, install it from GitHub (marketplace `openrig-app`). ([#2719](https://github.com/mvschwarz/openrig/pull/2719))
-
-### ACP apps: `rig acp serve`
-
-- **OpenRig as an agent in ACP apps:** `rig acp serve --to <member@rig>` runs
-  on stdio for an app that launches a custom agent (Zed's `agent_servers`, T3
-  Code). A prompt becomes a queue row, each row the work reaches shows as a
-  step, and the closing resolution is the reply. Nothing runs until an app
-  starts it, and it talks to the daemon `rig` uses. ([#2648](https://github.com/mvschwarz/openrig/pull/2648), [#2714](https://github.com/mvschwarz/openrig/pull/2714))
-- **The team's questions reach the app** while a turn is open, as a permission
-  request or a one-choice form, and the choice is the person's answer. Sessions
-  can be listed and reopened, and a question left unanswered there is named as
-  still open in the TUI and Slack. ([#2651](https://github.com/mvschwarz/openrig/pull/2651), [#2708](https://github.com/mvschwarz/openrig/pull/2708), [#2686](https://github.com/mvschwarz/openrig/pull/2686), [#2712](https://github.com/mvschwarz/openrig/pull/2712))
-- **The `@openrig/acp` launcher** (`openrig-acp`) runs the matching
-  `@openrig/cli`'s `rig acp serve` for the ACP registry's `npx` launch, with a
-  new `acp.to` setting for the receiver. `npm run pack:release` packs it beside
-  the CLI at the same version. ([#2655](https://github.com/mvschwarz/openrig/pull/2655), [#2715](https://github.com/mvschwarz/openrig/pull/2715))
-
-### People and connected assistants
-
-- Denying or dropping a host pairing request in Steering now gives the requesting machine no access; in 0.7.9 and 0.7.10, that action could return the daemon access token. ([#2884](https://github.com/mvschwarz/openrig/pull/2884))
-- **Pairing answers now reach the target's kernel operator.** On a 0.7.11 target with a receiving kernel operator, typed words and Approve or Deny choices in the TUI, Steering or Slack are replies for that agent to read. Receiving a reply neither grants nor denies access. The operator acts on clear intent with `rig host approve <code>` or `rig host deny <code>` and asks back when the answer is unclear. The commands also work from a plain terminal on the target; they use its operator bearer (`OPENRIG_AUTH_BEARER_TOKEN`, or `--bearer <token>`). ([#2900](https://github.com/mvschwarz/openrig/pull/2900))
-- **An Approve click on an operator-owned request waits for the operator to act.** A stopped operator keeps ownership; the answer waits in its queue. A stopped or unknown running state is named with the terminal route, without claiming the answer was read. If there is no operator, it cannot receive answers, or OpenRig cannot determine one, the request names that case and uses the agent-free path: Approve and Deny decide directly, and replies lead to another ask rather than denial. File-only replies and the literal `[file reply]` have no words stored on the agent-free ask; they still do not deny it.
-- **TUI answers use the daemon's operator bearer when configured.** Ordinary terminal calls keep their separate terminal credential. A missing or wrong action credential leaves the answer unrecorded and shows what to set; this does not weaken the daemon's authentication.
-- **Receipt, clarification and outcome are separate steps.** Receipts, agent-free re-asks and outcomes inferred from clicks or closes need the requesting machine to keep polling. An explicit `rig host approve` or `rig host deny` attempts its outcome update directly. An expiry timer closes the ask even if polling stopped; an unanswered expired ask gets no further update. Requests and decisions live in daemon memory, so a restart drops an open request. Approval still must be collected before expiry. This target-side change does not change older targets.
-
-- **Assistants connected through a grant service** (experimental, unsupported,
-  off by default: you serve `rig mcp serve --http --grant-service <url>` behind
-  your own TLS tunnel, and an outside service grants each connection):
-  `rig_question_list` and `rig_question_answer` let a registered person answer
-  the team's questions as their own; `--task-destination <member@rig>` names
-  the receiver for `rig_queue_create`, and a bare seat name resolves. ([#2735](https://github.com/mvschwarz/openrig/pull/2735), [#2638](https://github.com/mvschwarz/openrig/pull/2638), [#2750](https://github.com/mvschwarz/openrig/pull/2750))
-- **The `relay` gateway connector** sends questions, updates and notices to an
-  operator-owned bridge over loopback HTTP and takes replies back. It's off
-  unless you add a relay binding, and the bridge, with its reach to a messaging
-  platform, is yours (`docs/reference/gateway-relay.md`). ([#2624](https://github.com/mvschwarz/openrig/pull/2624))
-- **The web UI's For You feed** answers a local ask's questions on its card. ([#2612](https://github.com/mvschwarz/openrig/pull/2612))
-
-### Queue, workflows and status
-
-- **One `unclaimed-backlog` notice** replaces a finding per row for a seat that
-  reads without claiming and has no escalation route or delegation parent. ([#2752](https://github.com/mvschwarz/openrig/pull/2752))
-- **Claims read `working`, not stalled,** for up to 60 minutes while a Claude
-  owner has a live background shell, and 20 while a managed restore is owed. ([#2675](https://github.com/mvschwarz/openrig/pull/2675))
-- **`rig queue show`, `list`, `transitions`, `update` and `block` take
-  `--host <id>`,** as `create` and `handoff` did; `claim` doesn't. ([#2678](https://github.com/mvschwarz/openrig/pull/2678))
-- **Cross-host handoffs** that override a claim wake the claimer, and a close
-  to an unverifiable successor names `rig queue handoff`. ([#2734](https://github.com/mvschwarz/openrig/pull/2734), [#2621](https://github.com/mvschwarz/openrig/pull/2621))
-- **Code results:** an `openrig.code-result/v1` manifest as `evidenceRef` gives
-  `rig_artifact_read` and the new `rig queue artifact` the commit pair to diff. ([#2659](https://github.com/mvschwarz/openrig/pull/2659))
-- **Workflows:** a run keeps its own spec when another pod's copy reuses the id
-  and version; the root objective is kept and printed as `objective:`;
-  `rig workflow unregister` removes versions; `trace --full` returns the whole
-  trail. ([#2696](https://github.com/mvschwarz/openrig/pull/2696), [#2738](https://github.com/mvschwarz/openrig/pull/2738), [#2676](https://github.com/mvschwarz/openrig/pull/2676), [#2667](https://github.com/mvschwarz/openrig/pull/2667))
-- **Activity:** a helper harness inside a seat no longer reports its turns as
-  the seat's, and a resumed seat no longer reads a false model divergence. ([#2743](https://github.com/mvschwarz/openrig/pull/2743), [#2664](https://github.com/mvschwarz/openrig/pull/2664))
-- **Also:** refocus traces projects outside `workspace.root`; a timed-out
-  `rig stream emit` names a retry that can't duplicate; `rig context
-  reconstruction inspect` and `view` read an exact revision from local stores.
-  ([#2717](https://github.com/mvschwarz/openrig/pull/2717), [#2619](https://github.com/mvschwarz/openrig/pull/2619), [#2207](https://github.com/mvschwarz/openrig/pull/2207))
-
-### Launch, install and setup
-
-- **On Linux, a daemon run as a systemd user service starts the seats' tmux
-  server in its own user scope** (`openrig-tmux-<id>.scope`, with
-  `OOMPolicy=continue` from systemd 253), so stopping or restarting the
-  daemon's unit no longer ends the seats, and their memory no longer counts
-  against it. A daemon started from a login session, or a failed `systemd-run`,
-  starts the server as before with one log line giving the reason; macOS and
-  Windows are unchanged. ([#2749](https://github.com/mvschwarz/openrig/pull/2749))
-- **A Claude seat whose launch passes `--settings` JSON written with spaces**
-  (such as `{"env": {…}}` from a proxy alias) can be verified again: OpenRig
-  reads the value whole, so it finds the seat's conversation. ([#2665](https://github.com/mvschwarz/openrig/pull/2665))
-- **A Claude launcher script that execs the native installer's symlink**
-  becomes ready after a launch or rebuild, and `--no-chrome` is recognised. ([#2751](https://github.com/mvschwarz/openrig/pull/2751))
-- **`launch_wrapper`,** an argv prefix whose launcher prepares the environment
-  and execs the agent, works for local Claude Code, Pi and Codex seats; a
-  wrapped seat never starts unwrapped. ([#2746](https://github.com/mvschwarz/openrig/pull/2746), [#2609](https://github.com/mvschwarz/openrig/pull/2609))
-- **`rig provider switch --seat <pi seat> --to-account <name> --account-home <dir> --reason "<why>"`**
-  moves a Pi seat to another account through a confirmed successor, keeping its
-  model, effort and wrapper; `--dry-run` shows the plan. A Pi seat whose spec
-  declares its account home starts, resumes and switches accounts again: on the
-  first 0.7.11 candidate it didn't start, because the staged command began with
-  shell setup that `exec` can't run. ([#2630](https://github.com/mvschwarz/openrig/pull/2630), [#2782](https://github.com/mvschwarz/openrig/pull/2782))
-- **Claude seats that load openrig-core themselves** stop loading its skills
-  twice: the next launch removes OpenRig's unchanged copies. ([#2660](https://github.com/mvschwarz/openrig/pull/2660))
-- **Also:** a short permission-hook policy name; `rig attach --self` outside
-  tmux adds the rig; `rig host pair --timeout` holds the request that long;
-  `rig config set` names a masking variable; daemon start and stop treat a
-  probe the OS blocked as unknown; a bare piped `rig` skips the compile cache.
-  ([#2640](https://github.com/mvschwarz/openrig/pull/2640), [#2641](https://github.com/mvschwarz/openrig/pull/2641), [#2692](https://github.com/mvschwarz/openrig/pull/2692), [#2547](https://github.com/mvschwarz/openrig/pull/2547), [#2502](https://github.com/mvschwarz/openrig/pull/2502), [#2643](https://github.com/mvschwarz/openrig/pull/2643))
-
-### Terminals and views
-
-- **Writable tiles reflow with the screen.** They attach as in 0.7.10: the screen
-  in use sizes the seat, and text reflows on resize. They stay attached until
-  detached or closed. Read-only tiles keep showing the seat without attaching,
-  typing into it or resizing it. Fixed web geometry is opt-in through
-  `terminal.fixed_geometry` (off by default).
-  ([#2868](https://github.com/mvschwarz/openrig/pull/2868), [#2757](https://github.com/mvschwarz/openrig/pull/2757), [#2821](https://github.com/mvschwarz/openrig/pull/2821))
-- **Herdr follow views** work on macOS too (protocol 22), open a labelled
-  snapshot where live following isn't supported, and show a cleaner strip. ([#2663](https://github.com/mvschwarz/openrig/pull/2663), [#2706](https://github.com/mvschwarz/openrig/pull/2706))
-- **Closing the herdr-core terminal that started OpenRig** no longer ends the
-  daemon or its seats (per herdr-core's documented behaviour; a real close
-  wasn't exercised). ([#2737](https://github.com/mvschwarz/openrig/pull/2737))
-- **Also:** terminal snapshots keep colours; a reattach during a broker
-  teardown works; a home under a symlinked parent records its real path;
-  `rig doctor` says why tmux control mode is off. ([#2654](https://github.com/mvschwarz/openrig/pull/2654), [#2671](https://github.com/mvschwarz/openrig/pull/2671), [#2633](https://github.com/mvschwarz/openrig/pull/2633), [#2707](https://github.com/mvschwarz/openrig/pull/2707))
-
-### Speed under load
-
-- **The stuck sweep** batches its reads and yields every 50 rows: on a copy of
-  a busy 340 MB database, a pass went from 10.2–11.4 s to 5.1–5.5 s and the
-  longest stall from about 10 s to 0.57 s. ([#2649](https://github.com/mvschwarz/openrig/pull/2649))
-- **`view.changed` events are no longer stored,** so the `events` table grows
-  about a third as fast on the busy host measured, and opt-in
-  `retention.events_days` prunes eight history-only event types. ([#2695](https://github.com/mvschwarz/openrig/pull/2695), [#2699](https://github.com/mvschwarz/openrig/pull/2699))
-- **The web UI** loads the newest 100 events instead of the whole log. ([#2704](https://github.com/mvschwarz/openrig/pull/2704))
-- **`daemon.seat_poll_interval_ms`** (1000 to 2000) trades activity freshness
-  for daemon CPU on large fleets. ([#2688](https://github.com/mvschwarz/openrig/pull/2688))
-- **Also:** with `OPENRIG_TMUX_CONTROL=1`, short sends and `set-option` use the
-  control client; the idle-shell check reads the plain process table; skill
-  catalog Git reads time out after five seconds. ([#2636](https://github.com/mvschwarz/openrig/pull/2636), [#2690](https://github.com/mvschwarz/openrig/pull/2690), [#2713](https://github.com/mvschwarz/openrig/pull/2713))
-
-### Docs and tests
-
-Daemon HTTP clients and bearer tokens ([#2652](https://github.com/mvschwarz/openrig/pull/2652)), the 0.7.10 capability map on
-main ([#2736](https://github.com/mvschwarz/openrig/pull/2736)), a neutral TUI demo snapshot ([#2724](https://github.com/mvschwarz/openrig/pull/2724)), a web UI editor timer
-([#2689](https://github.com/mvschwarz/openrig/pull/2689)), and test and CI fixes ([#2753](https://github.com/mvschwarz/openrig/pull/2753), [#2681](https://github.com/mvschwarz/openrig/pull/2681), [#2685](https://github.com/mvschwarz/openrig/pull/2685), [#2673](https://github.com/mvschwarz/openrig/pull/2673), [#2628](https://github.com/mvschwarz/openrig/pull/2628)).
-
-### Behaviour that changed
-
-- **Sends and work notices that were refused with `prompt_draft` now go
-  through by default, joined to the person's draft** (above).
-  `rig config set transport.draft_delivery refuse` restores the old refusal
-  where OpenRig detects the draft, from the next send with no restart; under
-  `refuse`, a draft only the input box shows now refuses too. ([#2645](https://github.com/mvschwarz/openrig/pull/2645), [#2653](https://github.com/mvschwarz/openrig/pull/2653))
-- **A Pi seat with an absolute `PI_CODING_AGENT_DIR`** uses it as its account
-  home on launch, restart, resume and restore; no `auth.json`, no launch. ([#2630](https://github.com/mvschwarz/openrig/pull/2630))
-- **`/api/events` no longer emits `view.changed`,** live or replayed, so new
-  ones leave the web UI's log, activity feed and For You and the historical
-  telemetry export; the view streams still carry them. ([#2695](https://github.com/mvschwarz/openrig/pull/2695))
-- **The stuck sweep** files one backlog notice where it filed one per row,
-  skips `stalled-after-claim` inside the two windows above, re-checks each
-  rule just before filing, and skips overlapping ticks. ([#2752](https://github.com/mvschwarz/openrig/pull/2752), [#2675](https://github.com/mvschwarz/openrig/pull/2675), [#2649](https://github.com/mvschwarz/openrig/pull/2649))
-- **Managed compaction:** a prepared attempt stays `waiting`, and a manual
-  `rig compact` over it reads `already_in_progress`. ([#2698](https://github.com/mvschwarz/openrig/pull/2698), [#2716](https://github.com/mvschwarz/openrig/pull/2716))
-- **The daemon and seats no longer inherit `HC_SCOPE`, `HC_TERMINAL_ID` or
-  `HC_TERMINAL_SOCKET`;** one already running keeps them until restarted. ([#2737](https://github.com/mvschwarz/openrig/pull/2737))
-- **On Linux, the seats' tmux server runs in its own systemd user scope** when
-  the daemon is a user service (above): the daemon unit's stop, restart and
-  memory accounting no longer cover the seats. ([#2749](https://github.com/mvschwarz/openrig/pull/2749))
-- **Read-only terminal tiles** show the seat without attaching and end with
-  tmux's own error if they cannot read it. Writable tiles use the ordinary
-  sizing attach; detaching ends that viewer, while the agent keeps running.
-  ([#2757](https://github.com/mvschwarz/openrig/pull/2757), [#2868](https://github.com/mvschwarz/openrig/pull/2868))
-- **Also:** each sender keeps one live held message per seat; daemon start
-  doesn't re-send a failed wake to a seat with no receiver; restores record
-  `restore.outcome_reconciled` themselves; `rig terminal open --follow` returns
-  `follow_unsupported` with a snapshot. ([#2701](https://github.com/mvschwarz/openrig/pull/2701), [#2620](https://github.com/mvschwarz/openrig/pull/2620), [#2711](https://github.com/mvschwarz/openrig/pull/2711), [#2663](https://github.com/mvschwarz/openrig/pull/2663))
-- **MCP and ACP:** an empty or placeholder seat value means no seat; the
-  seatless `rig_whoami` text changed; `--front-door` is `front-door/v2`;
-  grant-service callers' `destination` is optional; `rig acp serve` gives
-  form-taking apps a form, leads step titles with the latest note, and asks
-  nothing after a cancel. ([#2657](https://github.com/mvschwarz/openrig/pull/2657), [#2709](https://github.com/mvschwarz/openrig/pull/2709), [#2718](https://github.com/mvschwarz/openrig/pull/2718), [#2733](https://github.com/mvschwarz/openrig/pull/2733), [#2638](https://github.com/mvschwarz/openrig/pull/2638), [#2750](https://github.com/mvschwarz/openrig/pull/2750), [#2708](https://github.com/mvschwarz/openrig/pull/2708), [#2686](https://github.com/mvschwarz/openrig/pull/2686), [#2655](https://github.com/mvschwarz/openrig/pull/2655))
-- **CLI:** `rig attach --self` outside tmux records `<name>@<rig>`;
-  `rig host pair` keeps a request for its `--timeout`; `rig config set` and
-  `reset` name environment overrides; `rig daemon start` and `stop` refuse when
-  a blocked probe leaves identity or liveness unknown; `--host` receipts print
-  a runnable command. ([#2641](https://github.com/mvschwarz/openrig/pull/2641), [#2692](https://github.com/mvschwarz/openrig/pull/2692), [#2547](https://github.com/mvschwarz/openrig/pull/2547), [#2502](https://github.com/mvschwarz/openrig/pull/2502), [#2678](https://github.com/mvschwarz/openrig/pull/2678))
-- **Seat launches:** unchanged OpenRig copies of openrig-core's skills are
-  removed, with warnings; the permission hook reads the installed policy lists
-  on each call; model divergence reads pending until the new occupant's record.
-  ([#2660](https://github.com/mvschwarz/openrig/pull/2660), [#2640](https://github.com/mvschwarz/openrig/pull/2640), [#2664](https://github.com/mvschwarz/openrig/pull/2664))
-
-### Known limits
-
-- **OpenShell:** on OpenShell 0.1.6 the maintained cleanup (`delete-owned`)
-  now works for a custom image, and recreate and an exact resume passed in our
-  native run. A restored guest still receives its startup text again, so strict
-  recall after a restore isn't met, and the worker isn't end to end. The CA fix
-  holds on 0.1.6. Never give the guest the daemon's main API port (normally
-  7433). After a same-generation reconciled launch, run
-  `rig environment connect` yourself. ([#2755](https://github.com/mvschwarz/openrig/pull/2755))
-- **Drafts:** detection isn't complete. Under `refuse`, an unreadable input box
-  lets the send go ahead, so an undetected draft goes with the message; under
-  `deliver`, a result may not mention a draft it joined. ([#2645](https://github.com/mvschwarz/openrig/pull/2645), [#2653](https://github.com/mvschwarz/openrig/pull/2653))
-- **A post-compaction step can still hold** when the box reads as typed, under
-  draft-aware delivery or the typing guard, or after a lost `/compact`. Run
-  `rig compact <seat> --cancel`, then send a restore request naming the newest
-  restore map, marker and packet. A queue wake refused at a prompt now waits for
-  that step, but recovery at daemon start and a new handoff's wake don't check
-  for it yet. ([#2575](https://github.com/mvschwarz/openrig/issues/2575), [#2666](https://github.com/mvschwarz/openrig/pull/2666))
-- **Draft-aware delivery to Claude:** a message held as `draft_input_unknown`
-  still isn't retried. Whether managed compaction now gets past the banner
-  (`target_activity_unknown`) wasn't retested. ([#2605](https://github.com/mvschwarz/openrig/issues/2605))
-- **Claude provider switch:** the failure reported in [#2341](https://github.com/mvschwarz/openrig/issues/2341) ("The probe pane
-  returned to a shell instead of staying inside the runtime") isn't shown fixed.
-- **`rig exec`:** checked with Claude Code and Codex through their ACP
-  adapters. A cancel is acknowledged, not settled, and says nothing about
-  further spend. Cancel with `rig exec cancel`, not `rig acp cancel`.
-- **ACP apps:** checked in T3 Code (Beta) 0.1.7 and with a scripted client; the
-  unanswered-question notice hasn't run in a live app, nor the note-first step
-  title in Zed. A cancel stops waiting; the work carries on. ([#2648](https://github.com/mvschwarz/openrig/pull/2648), [#2686](https://github.com/mvschwarz/openrig/pull/2686), [#2712](https://github.com/mvschwarz/openrig/pull/2712))
-- **The `openrig` plugin** hasn't run in Claude Desktop, the Codex app or
-  Copilot CLI. A seatless app can't claim, update, hand off or answer
-  questions, and everyone using the app on a machine acts as its seat. ([#2647](https://github.com/mvschwarz/openrig/pull/2647), [#2657](https://github.com/mvschwarz/openrig/pull/2657), [#2683](https://github.com/mvschwarz/openrig/pull/2683))
-- **Grant-service assistants** still aren't woken: an item stays queued until
-  its receiver claims it. **Relay:** "Accepted by bridge" means the bridge has
-  it, not the person, and a failed send replays only at a restart. ([#2735](https://github.com/mvschwarz/openrig/pull/2735), [#2624](https://github.com/mvschwarz/openrig/pull/2624))
-- **Event retention** can't be undone, and the database file doesn't shrink. ([#2699](https://github.com/mvschwarz/openrig/pull/2699))
-- **`keep_saved` skills:** a skill whose source changes between `rig down` and
-  the restore comes back missing, named in the restore's warnings; an edited seat
-  copy is kept. ([#2626](https://github.com/mvschwarz/openrig/pull/2626))
-- **Read-only terminal tiles** each run one tmux command a second while
-  showing. The earlier eight-tile showing measurement used about 6–8% of one
-  core on an Apple Silicon Mac mini, against about 0.2% for attached 0.7.10
-  tiles. This polling cost no longer applies to writable tiles. ([#2757](https://github.com/mvschwarz/openrig/pull/2757))
-- **Early writable-tile input:** as in 0.7.10, Enter or Ctrl-C typed while a
-  new tile is still attaching can close that viewer. The agent keeps running;
-  reopen the view. Once attached, tmux handles input and paste directly.
-  ([#2868](https://github.com/mvschwarz/openrig/pull/2868))
-- **Kept writable tiles from 0.7.8, 0.7.9 or pre-reflow 0.7.11** keep their old
-  client. Manually refresh them: close only their owned viewer and reopen with
-  `rig terminal open`. For a `--follow` view, use `--no-follow` first, then open
-  a fresh view. This does not touch the agent or its conversation; it is not an
-  automatic migration. Existing 0.7.10 plain and read-only tiles stay as they are.
-  ([#2868](https://github.com/mvschwarz/openrig/pull/2868))
-- **Claude `launch_wrapper`** hasn't run with zsh, on macOS arm64 or with a real
-  installed Claude; an alias or shell function named `claude` fails closed. ([#2746](https://github.com/mvschwarz/openrig/pull/2746))
-- **Going back to 0.7.10:** besides the migrations, an older permission hook
-  gives named-policy Claude sessions no decision until relaunched. ([#2640](https://github.com/mvschwarz/openrig/pull/2640))
-- **Codex hooks:** a session kept running across an upgrade can show "Hook
-  failed — plugin contents changed; hook approval required" until relaunched,
-  and 0.7.11 changes openrig-core again. `rig seat restart --keep-conversation`
-  refuses a Codex seat launched with developer instructions (`settings_drift`).
-- **Codex hook setup:** with smol-toml 1.9.x and an existing `hooks.json`,
-  OpenRig can leave its activity hooks and trust records unchanged. The range
-  (`^1.8.0`) still permits 1.9.x; the repository lockfile uses 1.8.0. ([#2720](https://github.com/mvschwarz/openrig/issues/2720))
-- **Claude Code 2.1.319 starts in auto mode by default,** so a new Claude seat
-  may act without asking; manual mode restores asking.
-- **Also:** permission requests in seat status show only the latest, in memory
-  for five minutes, and suggested rules can contain sensitive values; Slack
-  private channels need the documented, untested route, direct messages aren't
-  supported and people reads haven't run live; a Codex snapshot restore writes
-  OpenRig's guidance blocks into a tracked `AGENTS.md` (check `git status`); a
-  scheduled reminder that fails before input isn't retried; SSH host status
-  reads `unknown` behind ProxyJump or ProxyCommand; advisories don't show on a
-  native resume; seats handed over before 0.7.9 refuse stop, restart and
-  clean; after a project-local install, plain `rig` isn't found in the TUI's
-  own shell; with Claude Code 2.1.319, `rig up` can wrongly say "Startup prompt
-  still staged … press Enter"; two npm installs into one folder at once once
-  left a partial install, cause unknown.
-- **Fixed or changed from 0.7.10's known issues:** the bare update banner
-  ([#2662](https://github.com/mvschwarz/openrig/pull/2662)) and the Claude launcher-script readiness timeout with `--no-chrome`
-  ([#2751](https://github.com/mvschwarz/openrig/pull/2751)). 0.7.10's OpenShell limit is superseded by the one above.
-- **The earlier limits below that 0.7.11 doesn't fix or change still apply.**
-
-### Credits
-
-Thanks to @billbenetti, @seanmcn, @smota, @Aummadour, @dajiaohuang, @w4rc0n,
-@Mohsintl, @twotnguyen, @ziadeh and @Nikhi00718 for merged contributions.
-Thanks to @billbenetti for the reports behind [#2752](https://github.com/mvschwarz/openrig/pull/2752), [#2660](https://github.com/mvschwarz/openrig/pull/2660), [#2738](https://github.com/mvschwarz/openrig/pull/2738), [#2749](https://github.com/mvschwarz/openrig/pull/2749), [#2666](https://github.com/mvschwarz/openrig/pull/2666) and [#2665](https://github.com/mvschwarz/openrig/pull/2665), to
-@pr0xc3nt4ur1 for the report behind [#2740](https://github.com/mvschwarz/openrig/pull/2740) and [#2743](https://github.com/mvschwarz/openrig/pull/2743), to @oneandonlydean for
-the process chain behind [#2751](https://github.com/mvschwarz/openrig/pull/2751), and to @niklasbaldi for the report and cause
-behind [#2654](https://github.com/mvschwarz/openrig/pull/2654).
-Thanks also to @ziadeh for the reports behind [#2622](https://github.com/mvschwarz/openrig/issues/2622) and [#2486](https://github.com/mvschwarz/openrig/issues/2486), and to @mlc-factory-bot for the reports behind [#2605](https://github.com/mvschwarz/openrig/issues/2605) and [#2607](https://github.com/mvschwarz/openrig/issues/2607).
-
 ## [0.7.10]
 
 Published 2026-11-08 as `@openrig/[email protected]`, built from the commit tagged

README.md

@@ -519,6 +519,9 @@ OpenRig is open source and self-hosted, with Claude Code and Codex in the same t
 
 - **Website**: [openrig.dev](https://openrig.dev)
 - **Docs**: [openrig.dev/docs](https://openrig.dev/docs) ([documentation index for agents](https://openrig.dev/llms.txt))
+- **What's new**: [openrig.dev/whats-new](https://openrig.dev/whats-new) (every release, in plain words)
+- **Features**: [openrig.dev/features](https://openrig.dev/features)
+- **Integrations**: [openrig.dev/integrations](https://openrig.dev/integrations) (assistants, harnesses and environments, with setup and test status)
 - **Blog**: [openrig.dev/blog](https://openrig.dev/blog) · [Why I Built OpenRig](https://esoteric.run/blog/why-i-built-openrig)
 - **Open Specification**: [openrig.dev/specs](https://openrig.dev/specs)
 - **Videos**: [youtube.com/@openrig](https://www.youtube.com/@openrig)

docs/as-built/architecture/adapters-and-runtimes.md

@@ -398,6 +398,21 @@ adapter never closes a session on it and reports `rex_outcome_unknown`.
 Herdr and Rex build their layout trees from one grid helper
 (`buildTileGrid`, `tile-layout.ts`).
 
+`HerdrAppProvider` (`herdr-app-provider.ts`) opens a view in a herdr-app
+window (one provider per app home, cached in `startup.ts`). In the daemon it is
+used only when named (`resolveHerdrAppProvider` in `terminal-service.ts`). Its
+transport (`herdr-app-transport.ts`) sends one JSON line per
+connection to `<app home>/herdr-app.sock` and reads the window's own "did not
+answer" as `unknown`. A view is a child of OpenRig's stack in a derived
+`layouts/rig.json` (`deriveRigLayout`, `herdr-app-layout.ts`), written
+atomically, with viewers started by `hc run --bg --no-parent` and journalled
+first (`herdr-app-state.ts`). Removal rewrites the file before a viewer ends,
+and ends it only after the `rig-strip` mod's acknowledgement
+(`<app home>/openrig/ack.json`) shows a layout without it. An `hc events`
+watcher (`startup.ts`) turns a viewer that ended elsewhere into an ended cell.
+Its four mods ship in `packages/daemon/assets/herdr-app/mods/` and are
+installed by `herdr-app-install.ts`.
+
 ### Tmux server selection
 
 Before reconciliation, `startup.ts` calls `selectTmuxServer` in

docs/as-built/architecture/coordination-primitive.md

@@ -237,7 +237,9 @@ The sweep reports six finding kinds. Its custody check covers closures that
 name a successor qitem or a seat (`closure_reason = handed_off_to`) in the last
 24 hours, plus older closures with open findings. A seat target is satisfied by
 a local successor carrying this row's lineage, and any target by a
-`custody-verified: <target> …` note on the closed row. A new custody finding for
+`custody-verified:` note on the closed row: per note, its first word that names one
+of the row's targets exactly (or a comma list of them) is what it verifies, and later
+mentions don't count; the finding prints each target's note. A new custody finding for
 a human destination goes to the agent that closed the item, using the closing
 transition from active or archived history. Later notes and notification
 receipts do not change that owner. If the closing actor is missing, human, system
@@ -278,7 +280,13 @@ canceled, no-follow-on, escalation, superseded}`. The reasons
 `closure_target` (`:86`):
 
 - `handed_off_to` — work continues with a different seat (`closure_target` =
-  new owner).
+  new owner). `rig queue show` on such a row names the row the handoff made in
+  `successors` (rows whose `handedOffFrom` is this row, and a local row its
+  closure target names), or says in `successorNote` why none is named. A
+  cross-host successor is named as recorded (`<id>@<host>`); nothing stored
+  changes. Past 20 such rows the newest 20 are named, with
+  `successorsTruncated: true`. A scoped MCP caller doesn't get these fields;
+  `rig_queue_show`'s scope-checked `successor` answers it instead.
 - `blocked_on` — an active `state=blocked` park record, rejected with `state=done`.
   To wait for a qitem, use `rig queue block <id> --on <child>` or
   `rig queue update <id> --state blocked --blocked-on <child>`; the item returns

docs/as-built/architecture/lifecycle-snapshot-restore.md

@@ -160,8 +160,9 @@ Restore behavior, each point checked in `restore-orchestrator.ts`:
   `:780`; if `status === "restoring"` the node is skipped with a warning and
   reported as `fresh`, `:783–785`; `degraded` only adds a warning).
 - Reuses the seat's durably bound tmux session name when the prior binding
-  has a usable one (`:840`), and otherwise falls back to the derived name
-  with a warning (`:869`).
+  has a usable one, and otherwise falls back to the derived name. A missing
+  binding after the latest session's recorded intentional exit is quiet;
+  unclean/legacy missing bindings and incomplete or invalid binding rows still warn.
 - Replays restore-safe startup using persisted startup context;
   prefilters missing optional artifacts into warnings; **hard-fails a node if
   a required startup file is missing** (`:1161` — status `"failed"`, error

docs/as-built/architecture/transport-and-transcripts.md

@@ -169,9 +169,19 @@ Routes: `packages/daemon/src/routes/{transport,transcripts,ask,chat,whoami}.ts`
      posture, one for each mode OpenRig can launch: bypass
      (`⏵⏵ bypass permissions on (shift+tab to cycle) · ← for agents`), accept
      edits (OpenRig's default), auto, don't ask, plan, and default
-     (`⏸ manual mode on · ← for agents`); no statusLine row between the
-     closing rule and the footer (OpenRig's statusLine collector prints
-     nothing); a blank, effort or tmux-notice row above the box; and above
+     (`⏸ manual mode on · ← for agents`); between the closing rule and the
+     footer, either no row (OpenRig's statusLine collector prints nothing) or
+     the rows a person's own statusLine prints, with the indicator Claude
+     draws at the right of the first one (`● high · /effort`), trusted only by
+     position, as the composer reader trusts them (#2703, #2798): the closing
+     rule is the first rule above the footer, the frame above it must check
+     out, and no row between them may be blank or look like a menu or dialog
+     (`❯`, `›` or `»` anywhere in the row, a row that starts with a numbered
+     choice such as `1. ` or `2) `, with or without a border or gutter before
+     it, a box corner, or a row framed by side borders); so a statusLine that
+     uses `›`, `»` or `❯` as a separator, prints a blank row or starts a row
+     with a number and a dot reads `unknown`; a blank, effort or tmux-notice
+     row above the box; and above
      that, in the status slot, the completion row of the seat's last turn
      (`✻ <verb> for <duration> · done <time>` at column 0, matched by the
      Claude Code 2.1.296 bundle's grammar: one of its eight past-tense verbs,
@@ -204,13 +214,15 @@ Routes: `packages/daemon/src/routes/{transport,transcripts,ask,chat,whoami}.ts`
      status row, `esc to interrupt`, `paste again to expand`, a queued label,
      Codex's pending-input headers or `↳` rows, a spinner). Any other frame,
      including every running, streaming, steer-preview, paste-hint or unknown
-     layout, another seat's name, a statusLine that prints a row, a background
-     shell in the footer and a fullscreen renderer with a statusLine (which
-     reserves a row for it), reads `seat: not-idle` or
-     `unknown`, and the send reads unconfirmed. This holds when a running turn
-     hides its signal (Codex hides its `• Working` row while it streams;
-     Claude Code shows only `paste again to expand` in its footer for 8 s
-     after a paste, and no `esc to interrupt` under a statusLine). So a send to
+     layout, another seat's name, a second rule drawn under the box, a blank,
+     prompt-, menu- or dialog-shaped row between the closing rule and the
+     footer (so a fullscreen renderer that reserves a blank row for the
+     statusLine reads as before), and a background shell in the footer, reads
+     `seat: not-idle` or `unknown`, and the send reads unconfirmed. This
+     holds when a running turn hides its signal (Codex hides its `• Working`
+     row while it streams; Claude Code shows only `paste again to expand` in
+     its footer for 8 s after a paste, and no `esc to interrupt` under a
+     statusLine). So a send to
      a busy or unknown seat always reads unconfirmed.
 
      **Versions.** The layouts were recorded from Claude Code 2.1.296 and
@@ -272,7 +284,13 @@ Routes: `packages/daemon/src/routes/{transport,transcripts,ask,chat,whoami}.ts`
      characters never widen it. Any other break, and a break inside a word of
      the text, reads `ambiguous` and the send stays unconfirmed. A collapsed paste label, Claude's
      queued-messages label or `Try "…"` suggestion, or another draft is never
-     the message. The default `--verify` matcher above is unchanged.
+     the message. The default `--verify` matcher above is unchanged. Claude
+     Code's box ends at the last rule on the screen; the rows under it up to
+     the footer are a person's statusLine, read by position with the same
+     rule as the seat check above (#2798), so a box with statusLine rows
+     under it reads as one without them, and a blank, prompt-, menu- or
+     dialog-shaped row there leaves it `unrecognized`. The startup Enter
+     guard reads the same region.
    - **The box is empty after Enter on the same pane process.** The capture
      after Enter must show the box empty, with the pane process
      (`#{pane_pid}`) and the seat's binding unchanged.

docs/as-built/architecture/workflow-runtime.md

@@ -84,6 +84,15 @@ Diagnostic-only rows, moved sources, and versions retained for unfinished
 work have separate paths in `readThrough`, `writeDiagnostic`, and
 `isPinnedByUnfinishedWork`.
 
+Only instantiate (and `rig workflow run`, which posts to the same route) and
+the workflows-folder scan register specs through `readThrough`.
+`WorkflowRuntime.validate` (`rig workflow validate`, `POST /validate`) reads
+the file with `WorkflowSpecCache.readFromDisk`: the same file and parse
+checks, in memory, with no `workflow_specs` write. A spec that was only
+validated from outside the workflows folder is not listed by
+`rig workflow specs` and is not found by its bare name; its path still
+instantiates (#2726).
+
 ## Durable state
 
 The migration files record the storage evolution; they are not a count of

docs/as-built/architecture/workspace-primitive.md

@@ -387,14 +387,28 @@ that selects by mission. A slice's `qitemIds` come first from rows tagged
 project-scoped indexer only rows tagged `project:<id>` count, so untagged
 historical rows are not attributed to a selected project.
 
-> Source: `domain/slices/slice-indexer.ts:2–15` (contract + no new state),
-> `:238` (TTL), `:297–299` (`isReady`), `:331–336` (`invalidate`),
-> `:457–472` (`reconcileComposition`), `:476–521` (`readSliceLocations`;
-> first name wins `:478–483`; nested-vs-flat `:495–517`), `:61–88`
-> (`SliceRecord`: `missionId` `:65`, `slicePath` `:67`, `qitemIds` `:77`,
-> `proofPacket` `:81`), `:90–111` (`SliceListEntry`, which carries
-> `qitemCount` / `hasProofPacket` instead), `:865–875` and `:936–946` (queue
-> membership; project filter `:870`, `:942`); `domain/workspace/project-catalog.ts:132–138`
+The `GET /api/slices` response keeps that legacy `qitemCount` separate from
+`queueCounts`, eight current-state counts (or `null` when the listed
+mission/project scope cannot be resolved or catalog/candidate-root discovery is
+incomplete). `queueCounts` matches exact typed tags in one uncapped queue scan
+and is recomputed on every request; `?refresh` invalidates the separate listing
+cache, not a queue-count snapshot. A row may omit `project:` or `mission:` only
+when its remaining scope tokens identify exactly one physical slice with a
+resolved project and mission across the configured indexer roots and the
+catalog projects' missions roots. If catalog/project resolution or a candidate
+root cannot be read completely, counts stay `null` rather than treating unseen
+candidates as absent. Ambiguous matches count nowhere, including matches hidden
+by first-wins listing or a list filter. An explicit mismatched project or
+mission never counts. Physical candidates are used for counting only and do
+not change which slice is listed or served.
+
+> Source: `domain/slices/slice-indexer.ts` (read-only/no-new-state module
+> contract; `SliceRecord.qitemIds` / `SliceRecord.proofPacket`;
+> `DEFAULT_CACHE_TTL_MS`; `isReady()`; `invalidate()`;
+> `reconcileComposition()`; `readSliceLocations()`;
+> `observedQueueCounts()` physical-candidate matching and the shared queue
+> scan; `toListEntry()` / `matchQitems()` legacy membership);
+> `domain/workspace/project-catalog.ts:132–138`
 > (`belongsToProject`); startup `startup.ts:1705`, `:1718` (`OPENRIG_SLICES_ROOT`
 > first), `:1725–1730`, `:1743–1748`, proof-source watch `:1762–1765`
 > (`domain/proof/source-watch.ts:16`); default
@@ -433,7 +447,16 @@ handlers (`grep -c -E 'app\.(get|post)\(' packages/daemon/src/routes/slices.ts`)
   `?boundToWorkflow=<name>:<version>` lens narrows to slices bound to a
   workflow instance (400 `boundToWorkflow_invalid` without the colon). Each
   slice row carries `readiness`, and a `missions` sidecar carries authored
-  mission status and readiness. Rows sort by last activity, newest first.
+  mission status and readiness. The list row also keeps legacy `qitemCount`
+  separate from `queueCounts`: the latter has one count for each supported
+  queue state, or `null` when the row's project/mission scope is unresolved.
+  It counts rows whose exact typed tags match one physical slice with a
+  resolved project and mission across all configured roots. A missing
+  `project:` or `mission:` is accepted only when the remaining tags select
+  exactly one such candidate; ambiguous candidates count nowhere, even if
+  first-wins discovery or the status filter exposes only one
+  listed row. Explicit mismatched qualifiers never count. Counting does not
+  change list or filter behavior. Rows sort by last activity, newest first.
 - `POST /refresh` — drops the indexer caches, no daemon restart.
 - `GET /:name/proof-asset/*` — serves a proof asset from the slice's matched
   dogfood-evidence directory; rejects `..` (400); `Cache-Control: public,

docs/as-built/cli-reference.md

@@ -9,23 +9,23 @@ applies-when: |
   the source that implements a command. Use command help for invocation details.
 siblings: [README.md, codemap.md]
 prerequisite-reads: [../reference/help.md]
-last-verified-against-source: 34fdcb80543903b054a982cc48bb302ae6871682
-last-updated: 2026-10-26
+last-verified-against-source: b29a70f14fc11797d46cbd9f12d4e61a523c3d06
+last-updated: 2026-11-09
 ---
 
 # CLI Reference — Registered Commands and Options
 
-Verified against source commit `34fdcb80543903b054a982cc48bb302ae6871682`.
+Verified against source commit `e1dedbf531b6db9961b4c77c0a74564e58274a50`.
 The inventory below comes from the actual Commander tree returned by
 [`createProgram()`](../../packages/cli/src/index.ts), not a grep of command
 strings or an installed CLI from a different commit.
 
-There are **90 top-level registrations**, **410 registered command objects**
+There are **92 top-level registrations**, **440 registered command objects**
 below `rig` (including groups and the hidden `restore apply` command), and
-**1,304 explicitly registered option objects**, including the root version
+**1,460 explicitly registered option objects**, including the root version
 option. Aliases do not add command objects; short/long spellings of one
 option do not add option objects. Commander-generated help is additional.
-These are counts for that source snapshot, not a claim about a deployed release. The provider-switch and set-runtime rows include the later account-home options; those additions are not included in the snapshot counts. The `environment` section and the `host edit`, `host remove` and `terminal attach` rows were added later from source at `522d635c`, and aren't in the snapshot counts either. With `environment`, main registers 91 top-level commands.
+These are counts for that source snapshot, not a claim about a deployed release. Every registered family is inside the snapshot: the `exec` and `environment` families, the `roster` and `telemetry` rows, and the `host edit`, `host remove` and `terminal attach` rows that earlier snapshots listed as later additions are all counted here, as are the herdr-app provider's `terminal close` row and its `--app-home` options.
 
 ## Reading this reference
 
@@ -188,7 +188,7 @@ the sections that were not read are `null`.
 |---|---|---|
 | `rig gateway` | — | — |
 | `rig gateway human` | — | — |
-| `rig gateway human add <entityId>` | — | `--display-name <name>` **required**<br>`--binding <kind:connectorRef:secretsRef:role[:handle=<id>]>` **required** (repeatable)<br>`--delivery-class <A\|B\|C\|D>` **required**<br>`--away`<br>`--replace`<br>`--reason <reason>`<br>`--actor <actor>`<br>`--organization <id>`<br>`--group <id>` (repeatable)<br>`--policy <text>`<br>`--policy-file <path>`<br>`--default` |
+| `rig gateway human add <entityId>` | — | `--display-name <name>` **required**<br>`--binding <kind:connectorRef:secretsRef:role[:handle=<id>]>` (repeatable; without one, the person is reached in the Feed and Steering only)<br>`--delivery-class <A\|B\|C\|D>` **required**<br>`--away`<br>`--replace`<br>`--reason <reason>`<br>`--actor <actor>`<br>`--organization <id>`<br>`--group <id>` (repeatable)<br>`--policy <text>`<br>`--policy-file <path>`<br>`--default` |
 | `rig gateway human list` | — | `--json` |
 | `rig gateway human quiet` | — | — |
 | `rig gateway human quiet set <entityId>` | — | `--daily <window>`<br>`--until <time>`<br>`--tz <zone>`<br>`--actor <actor>`<br>`--json` |
@@ -226,6 +226,7 @@ the sections that were not read are `null`.
   `groups`, `warnings` and `participantFile`. `default` with no argument prints the current default and its source
   (`chosen` or `only-person`), or `null` with the reason. See `docs/reference/gateway-participants.md`.
 - `human set <entityId> slack-subscription <value>` — sets the person's Slack subscription: `every-ask` (the default) posts every ask to them to Slack; `urgent-only` posts only asks created with `--alert`, and other asks wait on Steering and the TUI; `unset` removes the authored subscription so the default applies. `human show` prints the value with its origin, `authored` or `default` (`slack-subscription: every-ask (default)`); `--json` carries it as `record.slackSubscription` `{ value, source }`.
+- `human set <entityId> binding.<n> <spec|unset>` — replaces `binding.<n>` with a full `kind:connectorRef:secretsRef:role[:handle=<id>]` spec, or removes that slot when `<value>` is `unset`. Removing a binding keeps the person, their preferences, their other bindings and their open questions, and prints `remainingBindings` (with their shifted `binding.<n>` slot indexes; the primary's slot shifts down too when a lower-index secondary is removed) plus `note`. No replacement `primary` is chosen silently: unsetting a `primary` while secondary bindings remain is refused, teaching how to replace the primary slot in place, promote an existing secondary binding (first save that binding's full spec from `rig gateway human show <entityId> --json`, then unset that secondary slot, then find the primary's current slot in `remainingBindings` or `rig gateway human show <entityId> --json` and set it to the saved spec with role `primary` — promotion replaces the former primary binding, and its connector reference and inbound handle are not retained as a secondary), or unset the secondary slots first using their current slot indexes from `remainingBindings` or `rig gateway human show <entityId>` and finish at `binding.0` when removing every binding. Removing the last binding makes the current delivery episode inactive so new missing-post findings stop (an already-open recovery item for an undelivered notice may remain, and the current delivery-outcome display may disappear while historical receipt notes remain); it does not answer, close or cancel open questions, cancel or reroute already-prepared deliveries, or retract anything a bridge has already accepted.
 
 ### parked
 
@@ -363,7 +364,7 @@ even when it is bound to a tailnet address and so starts without one: pairing ha
 over that token. Without it, the target's `POST /api/hosts/pair-request` answers 409
 `pair_target_no_bearer`; it answers 409 `pair_human_required` when no single
 registered person can approve (none, or several with no default; name one with
-`--human`) (`packages/daemon/src/routes/hosts.ts:324-343`).
+`--human`) (`packages/daemon/src/routes/hosts.ts:379-398`).
 
 The request stays open on the target for as long as `--timeout` waits (600 seconds by default), and the person's
 approval says how long and until when, in UTC. A target older than this CLI ignores the timeout and keeps the request
@@ -395,6 +396,13 @@ the person's own reply, or `--state denied`, refuses. To refuse a pairing, answe
 `rig host deny`, or let it expire (nothing is persisted). At its deadline a request's ask closes as expired, even when the requester stopped waiting, so a late click there isn't
 accepted. The decisions live in the daemon's memory, as the requests do, so a daemon restart drops an open request.
 
+A 0.7.10 or earlier target asks no question. Its person approves with the request's Approve, in the TUI (`rig tui`,
+then `attention`: open it; the TUI from 0.7.1) or on Steering, and from an agent seat `rig queue update <id> --state done
+--closure-reason no-follow-on` approves. There, every close that leaves the request `done` approves it, whatever its
+closure reason: a typed reply, or an agent seat's `rig queue update <id> --state done --closure-reason denied`,
+included. To refuse a pairing on such a target, let it expire, or from an agent seat set the request `denied`
+(`rig queue update <id> --state denied`); a `canceled` or `failed` state refuses too.
+
 Registration makes a host visible in topology; remote FEED attention remains opt-in.
 The human-readable success output of `host add` and `host pair` now includes the FEED
 next step alongside the existing `host doctor` suggestion. For an HTTP entry named
@@ -434,7 +442,7 @@ do not establish connectivity to a live peer.
 | Invocation | Aliases | Declared options |
 |---|---|---|
 | `rig mcp` | — | — |
-| `rig mcp serve` | — | `--port <port>`<br>`--http`<br>`--bind <host:port>`<br>`--grant-service <url>`<br>`--grant-service-header-file <path>`<br>`--oauth-resource <url>`<br>`--oauth-issuer <url>` |
+| `rig mcp serve` | — | `--port <port>`<br>`--http`<br>`--bind <host:port>`<br>`--grant-service <url>`<br>`--grant-service-header-file <path>`<br>`--oauth-resource <url>`<br>`--oauth-issuer <url>`<br>`--front-door`<br>`--task-destination <seat>` |
 | `rig mcp token` | — | — |
 | `rig mcp token add <name>` | — | `--seat <session>` **required**<br>`--rig <name...>`<br>`--root <name...>`<br>`--workspace`<br>`--owner` |
 | `rig mcp token list` | — | `--json` |
@@ -519,7 +527,7 @@ default-permit record (tag `runner-permission-permit`) opens no row.
 | `rig queue create` | — | `--source <session>`<br>`--destination <session>` **required**<br>`--body <text>`<br>`--body-file <path>`<br>`--body-context <ref>`<br>`--mission <id>`<br>`--slice <id>`<br>`--gate <role>`<br>`--priority <priority>`<br>`--tier <tier>`<br>`--tags <tags>`<br>`--expires-at <iso>`<br>`--id <qitemId>`<br>`--target-repo <name>`<br>`--summary <text>`<br>`--human-intent <intent>`<br>`--alert`<br>`--human-detail-file <path>`<br>`--reply-to <qitemId>`<br>`--human-questions-file <path>`<br>`--evidence-ref <path>`<br>`--host <id>`<br>`--no-nudge`<br>`--verify`<br>`--full`<br>`--json` |
 | `rig queue claim <qitemId>` | — | `--destination <session>`<br>`--full`<br>`--json` |
 | `rig queue unclaim <qitemId>` | — | `--destination <session>`<br>`--reason <text>`<br>`--full`<br>`--json` |
-| `rig queue update <qitemId>` | — | `--actor <session>`<br>`--state <state>`<br>`--reopen`<br>`--closure-reason <reason>`<br>`--closure-target <target>`<br>`--closure-required-at <iso>`<br>`--resolution <text>`<br>`--blocked-on <blocker>`<br>`--wake-watchdog <jobId>`<br>`--wake-after <duration>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--note <text>`<br>`--host <id>`<br>`--full`<br>`--json` |
+| `rig queue update <qitemId>` | — | `--actor <session>`<br>`--state <state>`<br>`--reopen`<br>`--closure-reason <reason>`<br>`--closure-target <target>`<br>`--closure-required-at <iso>`<br>`--resolution <text>`<br>`--blocked-on <blocker>`<br>`--wake-watchdog <jobId>`<br>`--wake-after <duration>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--note <text>`<br>`--source <name@external>`<br>`--host <id>`<br>`--full`<br>`--json` |
 | `rig queue block <qitemId>` | — | `--on <blocker>` **required**<br>`--actor <session>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--note <text>`<br>`--continuation <text>`<br>`--wake-watchdog <jobId>`<br>`--wake-after <duration>`<br>`--host <id>`<br>`--full`<br>`--json` |
 | `rig queue resolve <qitemId>` | — | `--decision <text>` **required**<br>`--actor <session>`<br>`--bearer <token>`<br>`--no-notify`<br>`--json` |
 | `rig queue handoff <qitemId>` | — | `--from <session>`<br>`--to <session>` **required**<br>`--body <text>`<br>`--body-file <path>`<br>`--note <text>`<br>`--priority <priority>`<br>`--tier <tier>`<br>`--tags <tags>`<br>`--gate <role>`<br>`--target-repo <name>`<br>`--summary <text>`<br>`--evidence-ref <path>`<br>`--alert`<br>`--host <id>`<br>`--no-nudge`<br>`--full`<br>`--json` |
@@ -538,6 +546,7 @@ default-permit record (tag `runner-permission-permit`) opens no row.
 | `rig queue inbox-pending <destinationSession>` | — | `--json` |
 | `rig queue outbox-record` | — | `--sender <session>`<br>`--destination <session>` **required**<br>`--body <text>`<br>`--body-file <path>`<br>`--tags <tags>`<br>`--urgency <urgency>`<br>`--audit <pointer>`<br>`--id <outboxId>`<br>`--json` |
 | `rig queue outbox-list <senderSession>` | — | `--limit <n>`<br>`--json` |
+| `rig queue erase` | — | `--members <file>`<br>`--rig <id>`<br>`--ids <file>`<br>`--action <action>` (`delete`, `scrub`)<br>`--routine`<br>`--apply`<br>`--actor <session>`<br>`--json` |
 
 ### slack
 
@@ -597,13 +606,16 @@ default-permit record (tag `runner-permission-permit`) opens no row.
 | Invocation | Aliases | Declared options |
 |---|---|---|
 | `rig terminal` | — | — |
-| `rig terminal open <view>` | — | `--provider <name>`<br>`--session <name>`<br>`--window`<br>`--expected-plan <id>`<br>`--json` |
+| `rig terminal open <view>` | — | `--provider <name>`<br>`--session <name>`<br>`--window`<br>`--app-home <dir>`<br>`--expected-plan <id>`<br>`--follow`<br>`--no-follow`<br>`--max-tiles <count>`<br>`--pin <seats...>`<br>`--unpin <seats...>`<br>`--suppress <seats...>`<br>`--unsuppress <seats...>`<br>`--suppression-ms <ms>`<br>`--grace-ms <ms>`<br>`--focus-retention-ms <ms>`<br>`--json` |
 | `rig terminal views` | — | `--json` |
-| `rig terminal status` | — | `--provider <name>`<br>`--session <name>`<br>`--json` |
+| `rig terminal close <view>` | — | `--app-home <dir>`<br>`--json` |
+| `rig terminal status` | — | `--provider <name>`<br>`--session <name>`<br>`--app-home <dir>`<br>`--json` |
 | `rig terminal attach <session>` | — | `--read-only` |
 
 See [named terminal sessions](../reference/terminal-sessions.md) to select a
 Herdr session per request, including session-bound previews and window reuse.
+herdr-app views (`--provider herdr-app`, plain `rig terminal open <view>` inside an answering herdr-app terminal versus `--window` for a desktop window, `close`, `--app-home`) are in
+[herdr-app](../reference/herdr-app.md).
 
 ### watchdog
 
@@ -702,6 +714,9 @@ Only Claude and Codex tenures can be woken.
 | Invocation | Aliases | Declared options |
 |---|---|---|
 | `rig context` | — | — |
+| `rig context reconstruction` | — | — |
+| `rig context reconstruction inspect` | — | `--store <absolute-path>`<br>`--store-map <file>`<br>`--project <id>`<br>`--mission <id>`<br>`--slice <id>`<br>`--cwd <path>`<br>`--item <id>`<br>`--category <name>`<br>`--tag <name>`<br>`--check-sources`<br>`--max-bytes <bytes>`<br>`--json` |
+| `rig context reconstruction view` | — | `--store <absolute-path>`<br>`--store-map <file>`<br>`--project <id>`<br>`--mission <id>`<br>`--slice <id>`<br>`--cwd <path>`<br>`--item <id>`<br>`--category <name>`<br>`--tag <name>`<br>`--check-sources`<br>`--max-bytes <bytes>`<br>`--json` |
 | `rig context work-install` | — | `--project <id>`<br>`--mission <id>`<br>`--slice <id>`<br>`--deliver`<br>`--runtime <runtime>`<br>`--cwd <path>`<br>`--topology <ids>`<br>`--apply-skills`<br>`--json` |
 | `rig context trace` | — | `--rig <rig>` **required**<br>`--pod <pod>`<br>`--seat <seat>`<br>`--name <file>` **required**<br>`--json` |
 | `rig context compose` | — | `--out <ref>` **required**<br>`--from <files...>` **required** |
@@ -710,7 +725,7 @@ Only Claude and Codex tenures can be woken.
 | `rig context preview <name-or-ref>` | — | `--json` |
 | `rig context get <name-or-ref>` | — | `--json` |
 | `rig context profile <name-or-ref>` | — | `--situation <situation>` **required**<br>`--runtime <runtime>`<br>`--profile <profile>`<br>`--budget <tokens>`<br>`--rig <rig>`<br>`--seat <seat>`<br>`--mission <mission>`<br>`--slice <slice>`<br>`--json` |
-| `rig context recap-write` | — | `--rig <rig>` **required**<br>`--seat <seat>` **required**<br>`--file <path>` **required** |
+| `rig context recap-write` | — | `--rig <rig>` (default: the calling seat's rig)<br>`--seat <seat>` (default: the calling seat; the part of its session name before `@`)<br>`--file <path>` **required** |
 | `rig context sync` | — | `--json` |
 | `rig context add <source>` | — | `--name <name>`<br>`--git`<br>`--checkout`<br>`--pack <path>`<br>`--json` |
 | `rig context source` | — | — |
@@ -1110,6 +1125,28 @@ off, draft-aware and hold modes, immediate refusal results and held-message insp
 |---|---|---|
 | `rig handover <seat>` | — | `--source <source>`<br>`--reason <reason>`<br>`--operator <address>`<br>`--dry-run`<br>`--json` |
 
+A rebuild starts a new native conversation and primes it from durable artifacts. In the JSON result,
+`currentStatus.continuityOutcome` describes the executed source (`rebuilt`, `forked`, `fresh`, or unknown
+for a discovered successor); `sourceOutcome` lists the rebuild artifacts and gaps or the fork origin.
+The legacy `continuityTransferred` field is always `false`, not a transfer verdict. A complete binding
+does not prove a lineage write: `sideEffects.provenanceRecordWritten` reads back this handover's occupant
+tenure. If it is false, inspect the daemon log; do not repeat a handover whose seat is already bound.
+
+For Codex rebuilds, `sourceOutcome.permissions` distinguishes an emitted predecessor policy, a saved
+successor selection, and an unverified fallback. A saved `--codex-permissions` envelope wins over the
+observed predecessor policy and retains the usual launch additions: workspace-write adds Git metadata,
+seat-folder and pod-state writable roots; read-only adds none. The result describes this launch policy,
+not an observed exact difference. A supported observed predecessor policy is carried without fresh
+directory additions when no newer saved selection replaces it.
+An unreadable or unsupported predecessor policy does not stop the rebuild; without a saved envelope,
+the ordinary launch settings apply and the result reports the missing comparison. Emitted arguments
+are not proof of the successor's native enforcement, and the named Codex config profile still loads.
+
+`sourceOutcome.model.requested` is the seat's configured Codex model pin, or `null` for the runtime's
+configuration/default. A rebuild reapplies that choice rather than the predecessor's in-pane model;
+`predecessorCompared: false` explicitly reports that no native model comparison was performed. This
+reports launch intent, not the model actually used by the successor. Older daemons omit this object.
+
 ### startup-proof
 
 | Invocation | Aliases | Declared options |

docs/as-built/test-layers.md

@@ -8,7 +8,7 @@ applies-when: |
   read it before claiming a stub-agent scenario covers a behaviour.
 siblings: [arteries.md, README.md, codemap.md]
 last-verified-against-source: e8f0ab340db773392ec8be75b072d1c0f3068a50
-last-updated: 2026-10-08
+last-updated: 2026-11-09
 ---
 
 # Test layers: what to run before you push, and what each layer proves
@@ -448,9 +448,12 @@ not as current status.
 
 ## Help wanted: command families without a behavioural scenario
 
-> This list may be stale. It was taken from the `rig --help` tree of 0.6.3: 85 visible
-> top-level families. At `e8f0ab34`, `packages/cli/src/index.ts` registers 87 top-level
-> commands; `roster` and `telemetry` were added since and have no row yet. Before picking one up, check `packages/test-system/scenarios/`, the cases in
+> This list may be stale. The tables below cover the families that have a proposed first
+> check: at `b29a70f14`, the Commander tree returned by `createProgram()`
+> (`packages/cli/src/index.ts`) registers 92 top-level families, 87 of which have a row
+> below (7 of them marked partial); `roster` and `telemetry` now have rows too. These 5
+> families still have no row: `acp`, `community-harness`, `edge`, `environment`, `exec`.
+> Before picking one up, check `packages/test-system/scenarios/`, the cases in
 > `scripts/run-pr-scenarios.sh`, and the current `rig --help`.
 > One scenario doesn't cover a family's every option, sequence or platform. A `--help`
 > check only proves the command is discoverable. Existing unit tests are not counted here.
@@ -522,6 +525,8 @@ Before you start, two honest constraints:
 | reads | `status` | Two rigs in different states. Status matches their exact identities and transitions. |
 | reads | `ps` | Two rigs with overlapping seat names. Rig and node filters return exactly the intended members. |
 | reads | `usage` | Deterministic stub telemetry. top and series respect seat and time bounds. Missing data isn't reported as zero. |
+| reads | `roster` | A scratch workspace with two rigs and a rosters folder: `rig roster find` returns the expected specialists, and an empty folder reports none without an error. |
+| reads | `telemetry` | Deterministic retained-metadata fixtures: one bounded page returns exactly the recorded rows, and a history gap is named rather than skipped silently. |
 | reads | `health` | Known fresh, stale and cleared findings. Scope, explain and diagnosis values match the fixture. |
 | continuity | `snapshot` | Snapshot two seats. Rig, membership and snapshot bytes survive a daemon restart. |
 | continuity | `restore` | Restore after a daemon and tmux reset. Seat identity and nonce answers survive. |

docs/reference/agent-spec.md

@@ -459,10 +459,8 @@ skills:
 
 An unknown `on_restore` value produces an advisory and uses `keep_saved`; it does not invalidate the spec.
 
-A restore keeps the skills a seat was launched with where it can. With `keep_saved`, it puts back a missing copy only
-while its recorded source still has the saved bytes, and never takes today's bytes from the source: if `rig down`
-removed an unchanged copy and the source has changed since, the skill stays missing and the restore names it in its
-warnings. With `follow_source`, before the seat's session starts, the restore reads the seat's agent
+A restore keeps the skills a seat was launched with. With `keep_saved`, it puts back the saved copy and never takes
+today's bytes from the source. With `follow_source`, before the seat's session starts, the restore reads the seat's agent
 spec as it is now, using the saved launch recipe and rig folder, and:
 
 - replaces the seat's copy with the source folder as it is now, and records it, so `rig down` removes it and the next

docs/reference/agent-startup-guide.md

@@ -204,7 +204,7 @@ Startup content is merged additively through layers. Each layer adds to what the
 4. Rig layer       — from the RigSpec's top-level startup block
 5. Pod layer       — from the pod's startup block
 6. Member layer    — from the member's startup block in the RigSpec
-7. Operator layer  — added by OpenRig: openrig-start.md and, on a fresh start, the onboarding pack
+7. Operator layer  — added by OpenRig: openrig-start.md, openrig-context-entry.md and, on a fresh start, the onboarding pack
 ```
 
 A member with a `starter_ref` gets that agent starter's files in front of the agent layer. Terminal seats
@@ -220,7 +220,7 @@ A member with a `starter_ref` gets that agent starter's files in front of the ag
 | Rig | Rig spec author | Rig-wide context for all agents | Project documentation |
 | Pod | Rig spec author | Pod-specific coordination context | Pod SOP, intra-pod workflow |
 | Member | Rig spec author | Individual member overrides | Member-specific instructions, cwd-specific context |
-| Operator | OpenRig system | System-injected runtime content | `openrig-start.md` (optional delivery); on a fresh start, `openrig-onboarding-01.md` and `-02.md` unless `onboarding.default_pack.enabled` is false |
+| Operator | OpenRig system | System-injected runtime content | `openrig-start.md` (optional delivery); `openrig-context-entry.md`, a pointer to the skills router, help and declared context, for every seat; on a fresh start, `openrig-onboarding-01.md` and `-02.md` unless `onboarding.default_pack.enabled` is false |
 
 After the files, OpenRig sends a session-identity message (rig, pod, member, logical ID) once the seat is ready.
 
@@ -423,8 +423,30 @@ running seat only through the action in the last column.
 | Working directory | `rig seat set-cwd`, shown by `rig seat status` as **Working directory for future launches** | The directory it started in | `rig seat launch --fresh --stop` (a blank conversation) or `rig handover --source rebuild` (durable context); [details](#change-an-existing-seats-working-directory) |
 | Launch wrapper (`launch_wrapper`) | Member `launch_wrapper` in `rig.yaml` (`pi`, `codex` and `claude-code` only; `launch_wrapper: []` clears, omitting retains on existing-seat apply; surfaced as `launchWrapper` in `rig ps --nodes --json` when set; no live `rig seat` edit verb) | The literal wrapper argv that prefixes the resolved Codex entry or Claude executable (preserving TTY stdio) or the resolved Pi child executable inside OpenRig's host runner (preserving RPC pipes and runner lifecycle) when that session launched; a configured prefix is not proof of isolation, tooling, memory or governance | Supported spec create/recreate/apply flow, then the seat's next managed launch, resume, restore or handover (fails closed when wrapper support is unavailable; never falls back to bare child launch; [details](rig-spec.md#launch-wrapper-runtime-pi-and-codex)) |
 | Startup files and skills | The spec's startup files, skills and actions | What its conversation read when it started; editing a file afterwards doesn't reach it | A fresh launch or a handover delivers them again; for the running seat, send or walk the change (`rig walk <seat> --through <files>`) |
+| Guidance blocks (`CLAUDE.md`, `AGENTS.md`) | The seat's startup selection, which OpenRig merges into its guidance file as managed blocks at each start and restore | `rig seat status` **Guidance**: when OpenRig wrote each of its blocks, before or after the session's recorded startup finish (for a claimed session, when OpenRig recorded it). That's chronology, not what the agent has: the harness reads the file earlier in startup, Claude Code reloads it after `/compact` or `/clear`, Codex reads it at session start, and the agent can read it, or be sent it, at any time. OpenRig doesn't record what an agent read | Claude: its next compaction, `/clear` or restart. Codex: its next start. Without either, [tell it](#new-guidance-for-a-running-seat) |
 | Tools (MCP servers, plugins) | Selected fragments, merged into the harness's own config (`.mcp.json` for Claude, `config.toml` for Codex) | Unknown to OpenRig: registered isn't active, Claude asks before it uses a new server, and no OpenRig command reports which tools a running harness loaded | Check in the harness itself (Claude Code's `/mcp`); a running session may need a restart to pick up newly written config ([runtime config disclosure](#runtime-config-disclosure)) |
 
+### New guidance for a running seat
+
+There are three ways for a seat to pick up new guidance:
+
+1. **Tell it.** `rig send <seat> "Read <file>: <why>"`, or `rig walk <seat> --through <files>` for several. The seat's
+   interruption settings can hold a message; `rig send` may report `retained, not delivered`.
+2. **The refocus hook**, where the seat runs OpenRig's `openrig-core` hooks (**Refocus** in `rig seat status` shows whether
+   the hook has recorded it). The hook's content comes from `OPENRIG_REFOCUS_CONTENT_REF` (a `rig context get` address),
+   else `OPENRIG_REFOCUS_CONTENT_FILE`, else `refocus/REFOCUS.md` under `OPENRIG_HOME`, else the shipped default. After
+   compaction the hook waits for an eligible prompt. For managed Claude compaction it skips the acknowledgement boundary,
+   and other prompts can arrive first and be skipped while restore is pending. Claude can also refocus after the
+   conversation grows past the hook's size threshold.
+3. **Its guidance file, loaded again:** for Claude at its next compaction, `/clear` or start, for Codex at its next start.
+   **Guidance** in `rig seat status` shows which of OpenRig's blocks were written after the session's recorded startup finish.
+
+A file pointer leaves the read to the seat, under its own permission settings. `rig walk` reads the named files in the
+calling process and sends their contents. A seat whose harness asks before reading a file outside its project (its own
+`LEARNED.md` under the topology root, a plugin's skill) waits at that prompt until someone answers it, even though a hook
+could deliver an excerpt of the same file. Finding a file, a hook picking it up, and the agent reading and using it are
+separate facts.
+
 Per harness: Claude Code's and Codex's permission choices are in the setup reference
 ([Claude Code](getting-started.md#claude-code-a-different-launch-flag),
 [Codex](getting-started.md#codex-select-sandbox-and-approvals-together)), Codex homes are

docs/reference/community-harness-examples/omo/omo.yaml

@@ -0,0 +1,14 @@
+# Install as $OPENRIG_HOME/community-harnesses/omo.yaml.
+# OmO Native (npm omo-ai 5.1.48) on the senpi engine — a Pi fork speaking Pi's RPC protocol.
+# With protocol: pi-rpc, OpenRig runs OmO through its Pi runner: structured activity, prompt/steer,
+# transcript isolation, and session file resumption.
+format: 1
+name: omo
+command: omo
+maintainer: Your name or team
+protocol: pi-rpc
+resume: true
+limits:
+  - checked with omo 5.1.48 (senpi engine 2026.10.25-2)
+  - credentials resolved via omo's agent directory or models.json
+  - models declared via provider/id format (e.g. zai/glm-5.3-flash, openrouter/...)

docs/reference/community-harness-presets.md

@@ -53,6 +53,7 @@ startup_assisted: true           # optional: startup submission needs a person's
 first_input: true                # optional: launcher takes the first turn from OPENRIG_FIRST_INPUT (below)
 # runner: true                  # optional, needs launch_result: the launcher reports the seat's activity (below)
 # passes_model: true            # optional: the launcher takes the seat's declared model from OPENRIG_MODEL (below)
+# launch_wrapper: true          # optional: a runner applies OPENRIG_LAUNCH_WRAPPER to its native child (below)
 ```
 
 - **`command`** is a single program and its arguments. Shell syntax such as `|`, `&&`, `;`, redirections or `$(…)`
@@ -164,6 +165,10 @@ and reports what it's doing, as OpenRig's own Pi runner does. The seat's activit
   unavailable.
 - **Input is as for any seat.** A send pastes the text and presses Enter, so a runner should submit everything up to that
   Enter as one prompt.
+- **`launch_wrapper: true` declares wrapper support and requires `runner: true`.** A member with a wrapper and a runner preset without this flag is refused at preflight and launch (not schema validation):
+  `launch_wrapper unsupported: the community preset "<runtime>" runs a runner without launch_wrapper: true; no agent started. Add launch_wrapper: true to the preset if its runner applies OPENRIG_LAUNCH_WRAPPER, or remove launch_wrapper from this member.` See the
+  [harness and runner contract](harness-runner-contract.md#2-declare-it-what-the-preset-says-fixed-at-launch)
+  for the environment handoff, native-child execution and refusal requirements.
 
 **What the runner posts.** The runner posts each event to `POST /api/activity/hooks` with the local activity hook token,
 one at a time and in order, without making the agent wait. It finds the address and token in `OPENRIG_URL` (or
@@ -188,6 +193,37 @@ one at a time and in order, without making the agent wait. It finds the address
 - **A runner's full duties** (liveness, input, cancellation and permissions) are in the draft
   [harness and runner contract](harness-runner-contract.md).
 
+## Pi-compatible RPC harnesses (`protocol: pi-rpc`)
+
+For a community harness that is a fork of Pi or speaks Pi's CLI and JSONL RPC protocol (such as OmO Native on senpi or Prime Agent), set `protocol: pi-rpc`.
+
+```yaml
+format: 1
+name: omo
+command: omo
+maintainer: Your name or team
+protocol: pi-rpc
+resume: true                   # only after you've checked a real reopen
+limits:
+  - checked with omo 5.1.48 (senpi engine 2026.10.25-2)
+```
+
+- **OpenRig runs the harness through its existing Pi runner.** Instead of screen scraping, the harness runs under `pi-runner` inside the seat's pane. The runner provides input buffering, paste framing, prompt/steer RPC queueing, clean transcript mirroring, and typed activity hook reporting to the daemon.
+- **`command` is the executable.** OpenRig resolves `command` (e.g. `omo` or `/usr/local/bin/senpi`) against the seat pane's environment, resolving symlinks and version-manager shims (such as `mise`) safely.
+- **Session identity and resume come from the runner.** Transcripts and sessions are persisted as JSONL files under `$OPENRIG_HOME/state/pi/<session>/sessions/`, and the fork's `get_state` reports the session file, so `launch_result` and `names_conversation` aren't needed.
+  - **With `resume: true`** declared, resuming or restoring a seat continues that exact session file via `--session <file>`. Without it, the preset is launch-only; a restore that would resume its saved conversation waits for a fresh-start decision.
+  - **A fork that reports no session file** reads as needing attention, and the launch doesn't read ready.
+  - **A resume that comes up on another session file** is refused, and that file's identity isn't recorded, so the seat keeps the one it asked for. The seat reads as needing attention.
+- **Launch arguments a fork must accept.** When spawned under `pi-runner`, the executable named by `command` must accept Pi's core CLI arguments:
+  - `--mode rpc`
+  - `--session-dir <dir>`
+  - `--name <session-name>`
+  - `--approve` or `--no-approve` (depending on seat trust)
+  - And conditionally when configured or resuming/forking: `--model <provider/id>`, `--thinking <level>`, `--session <sessionFile>`, or `--fork <sessionFile>`.
+  Forks that reject these flags cannot currently run with `protocol: pi-rpc`.
+- **Skills, guidance, and model passthrough.** Skills are projected into `<agentDir>/skills/` and managed guidance into `AGENTS.md`. For a fork that reads Pi's variables (`PI_CODING_AGENT_DIR`, etc.), declared models are passed as `--model provider/id` with provider API key allowlisting, and effort is passed as `--thinking <level>`. Usage is not reported for a fork, and extension dialogs are handled as Pi's (cancelled when an extension requests interactive confirmation in a managed pane).
+- **Mutual exclusions:** `protocol: pi-rpc` manages session identity and activity through the Pi runner; it cannot be combined with `runner: true`, `launch_result: true`, `names_conversation: true`, `startup_assisted: true`, or `first_input: true`.
+
 ## An example: Hermes
 
 [`community-harness-examples/hermes/`](community-harness-examples/hermes/) has a preset and a small launcher for Hermes
@@ -310,9 +346,27 @@ Its [README](community-harness-examples/dsh/README.md) has the setup and a check
 and maintain them as your own.
 
 The launcher is the contributor's code, in the contributor's package. OpenRig runs no code from a preset and loads no
-module into its daemon. A preset that sets `launch_result`, `names_conversation`, `startup_assisted`, `first_input`, `runner` or `passes_model` is refused by an older
+module into its daemon. A preset that sets `launch_result`, `names_conversation`, `startup_assisted`, `first_input`, `runner`, `passes_model` or `launch_wrapper` is refused by an older
 OpenRig that doesn't know the field.
 
+## Community-maintained runner: nodecode (@smota)
+
+A runner preset for [nodecode](https://nodecode.ai), a self-modifying Common Lisp agent with a headless JSON-lines mode
+(`nodecode rpc`). Listed here so it can be found; it isn't certified, shipped with OpenRig or supported by OpenRig's maintainers.
+
+| | |
+|---|---|
+| Maintainer | [@smota](https://github.com/smota) |
+| Repository | [smota/openrig-nodecode](https://github.com/smota/openrig-nodecode), Apache-2.0, no npm dependencies |
+| Tested with | Unreleased OpenRig `main` at `7078c754d` (its package version reads 0.7.1), built from source without fork-only commits; nodecode `0.1.13+98dd6dc80`; Node 22.23.4. Not tested on a released OpenRig (none knows `launch_wrapper`). |
+| Needs | an OpenRig that knows `launch_wrapper` (this file documents it). OpenRig 0.7.10 and earlier refuse the preset with "unknown field launch_wrapper". |
+| Test record | connector `d8dd4e6`: 95 unit checks (fake and native nodecode), `npm run test:live` (6 steps against the author's daemon built from that `main`) and an opt-in native permission-question proof with a seeded `:NOBODY` failure; results are the author's, not reproduced by OpenRig |
+| Declares | `launch_result`, `runner`, `resume`, `first_input`, `passes_model`, `launch_wrapper` |
+| Resume | `nodecode rpc <session>`; a session the gateway doesn't know is refused with `error: "missing"` (exit 3) and never replaced. The installer adds `--resume-policy last-completed`: when the session's last turn failed or was cancelled, the runner moves the head back to the last completed turn before taking input, so a resumed seat continues from its last good state; `--resume-policy head` (the bare runner's default) resumes at the head as left. Pass either flag to `scripts/install-preset.mjs` to choose. |
+| Reports | `active`, `PreToolUse`, `Stop` and `session_identity` to `/api/activity/hooks`; permission questions through `/api/activity/permission-requests` |
+| Fork commits | none needed. Stock `main` accepts the runner's `session_identity` report (the hook answers ok and the identity event is published) but does not persist a community resume token from it; the seat's identity reads unconfirmed, as for any community harness. Two fork-only daemon commits (`be17fa528`, `cbb109b62`) add that plus model and context readings, and are not part of this entry. |
+| Limits | no turn cancel; permissions bridged from nodecode's `organism.questions` only, and that proof is driven by a model prompt, so it is opt-in; a question reaches OpenRig only when every choice reads as allow or reject (once or always), others are answered in the pane by typing the exact choice, and only the first four choices are offered through OpenRig; model, provider and effort apply to fresh sessions, a resumed one stays pinned; its gateway keeps running after `rig down`; the installed preset runs each seat in its own nodecode profile (`--seat-profile auto`, sharing the operator's memories and skills), while the bare runner uses the operator's organism unless `--profile` is set; `node` must be on the pane's `PATH` |
+
 ## Pass the first startup input at launch
 
 A format-1 preset may set `first_input: true` (a boolean, default false). OpenRig composes the same initial identity turn it would otherwise paste, including the first merged text file, durable-obligation guidance and any selected orientation challenge. Before launch it writes that text to a per-attempt 0600 file under its own `state/first-input/` folder and passes the path as `OPENRIG_FIRST_INPUT`. The typed launch command carries the path, not the text; an argument-based launcher still puts the text in the native harness’s argv.

docs/reference/daemon-http-clients.md

@@ -210,3 +210,17 @@ an open FYI, or a closed ask is not that receipt. The rig-wide reads and their l
   `?project`. When two missions have a slice folder of the same name, the daemon keeps the first one it finds:
   that one is listed and served, and the other doesn't appear in `GET /api/slices` at all. Keep slice names unique
   across missions, as [Project workspace](project-workspace.md) says.
+- **Queue state counts on `GET /api/slices`:** every list row has `queueCounts`, a current, uncapped count by
+  `pending`, `in-progress`, `done`, `blocked`, `failed`, `denied`, `canceled` and `handed-off`; it is `null` when
+  the row's project/mission scope cannot be resolved or catalog/candidate-root discovery is incomplete. This is
+  separate from the existing `qitemCount` display membership field. Counts match exact typed `project:`,
+  `mission:` and `slice:` tags in one shared queue scan. Physical candidates include configured indexer roots
+  and every catalog project's missions root. A row may omit `project:` or `mission:` only when its remaining
+  tags identify exactly one physical slice with a resolved project and mission. Ambiguous matches count nowhere,
+  even if first-wins discovery or a list filter leaves only one row visible; an explicit mismatched project or
+  mission never counts. Several `slice:` or `mission:` tags on one row count only when they all name the same
+  physical slice or mission (a slice's folder name and its frontmatter `id:`, say); a row that names two distinct
+  slices, missions or projects counts nowhere, while `qitemCount` can include it under several tagged slices,
+  subject to the existing project filter and the newest 500 rows per slice. Counts are recomputed on every list
+  request. `?refresh=1|true` invalidates the separate listing cache, not a stored queue-count snapshot. This
+  resolution does not change the returned slice list or filters.

docs/reference/edge-types.md

@@ -44,13 +44,15 @@ All other edge kinds (`can_observe`, `collaborates_with`, `escalates_to`) do NOT
 
 `delegates_to` also names a seat's orchestrator for the queue: the source of the `delegates_to` edge into a seat. The
 wake ladder escalates an unacknowledged row to that orchestrator, and stuck-row findings and recovery go to it. A seat
-with no incoming `delegates_to` edge has no default orchestrator. `spawned_by` plays no part here.
+with no incoming `delegates_to` edge has no default orchestrator. A seat with several incoming `delegates_to` edges has
+no single orchestrator either: its recovery goes to its declared `escalates_to` destination, or keeps the existing
+fallback, and the recovery says the parents were ambiguous. `spawned_by` plays no part here.
 
 ### Fallback escalation across rigs
 
-A seat with **no declared `delegates_to` parent** may declare one `escalates_to` destination. The wake ladder and
-stuck sweep use it for new recovery rows; they do not move the original obligation or reassign an already-open recovery. A stopped or unbound declared
-parent still takes precedence, preserving the existing parent route and its fallback.
+A seat with **no declared `delegates_to` parent, or several**, may declare one `escalates_to` destination. The wake ladder and
+stuck sweep use it for new recovery rows; they do not move the original obligation or reassign an already-open recovery. A
+single stopped or unbound declared parent still takes precedence, preserving the existing parent route and its fallback.
 
 ```yaml
 edges:

docs/reference/gateway-participants.md

@@ -76,6 +76,24 @@ go to:
 `rig gateway default` shows the current default; `rig gateway default --clear` clears the choice. Choosing a default
 never changes `workspace.operator_seat_name`, which keeps its own meaning.
 
+## The default receiving agent
+
+The default person is who OpenRig asks. The default receiving agent is the agent that reads what a person answers when
+nothing else reads it: a request with no owner of its own, such as a host pairing request or a mode's scheduled end, and
+a Slack message no thread or channel route claims. It is:
+1. the agent chosen in `agents.operator_session` (`rig config set agents.operator_session <seat>@<rig>`; a person's
+   address there is ignored);
+2. otherwise the kernel operator, `operator-agent@kernel`, when this host has that seat, running or stopped;
+3. otherwise none, and the request says no agent reads answers on this host.
+
+A stopped receiving agent stays the receiver: answers wait for it, and the person is told it isn't running. OpenRig
+never picks whichever seat happens to be running. The TUI shows the effective agent, where it came from and its state
+under Settings > Agents & runtime ("Default receiving agent"). It never replaces the default person.
+
+For Slack, `rig slack setup --inbound-destination default-receiver` (the default for a new setup) sends unrouted
+messages to the default receiving agent, read when the connector starts. A destination already saved in the connector
+config, `operator-agent@kernel` included, is kept as chosen; pass `default-receiver` to switch it.
+
 ## In the TUI: whose queue, and who acts
 
 The person at the terminal is the **primary user**. The TUI records their acts as unnamed (`human@host`),

docs/reference/gateway-relay.md

@@ -23,12 +23,19 @@ OpenRig does not embed third-party messaging platform SDKs (such as WhatsApp, Ma
 ## 1. System Topology & Custody Boundaries
 
 ### Outbound Custody & Recovery
-- OpenRig enqueues outbound decisions to a local `DispatchBuffer` before issuing any HTTP `POST` to `OPENRIG_RELAY_URL`.
-- Each logical decision freezes its complete `relayEnvelope` onto the parent `DispatchBuffer` entry before the first network attempt, with no self-imposed outbound 64 KiB cap or multi-part splitting.
-- Transport is at-least-once: OpenRig sends the complete JSON envelope in a single HTTP `POST` per attempt with `deliveryId = <decisionId>` (preserving the full `body`, `humanDetail`, `humanQuestions`/options, `summary` overflow, and digest `items` without silent clipping).
-- An HTTP `2xx` response from the bridge acknowledges durable bridge custody of that complete envelope (`deliveryId`). The bridge must persist each envelope by `deliveryId` and deduplicate replayed `deliveryId`s idempotently.
-- OpenRig records the logical queue acceptance receipt (`relay-owner-notification-accepted` with `deliveryId`) and drains the decision from `DispatchBuffer` once the HTTP `POST` returns `2xx`. Bridge acceptance confirms custody by the bridge process only (and is projected as `accepted` / `"Accepted by bridge"`, whereas Slack posts use `posted` / `"Delivered"`). It does not indicate downstream platform delivery, posting, or human receipt.
-- Failed dispatches remain in OpenRig's `DispatchBuffer` and record a relay-specific failure transition note (`relay-owner-notification-transport-failed` naming the `connectorRef`, distinct from Slack's `slack-owner-notification-transport-failed`). Replays after a lost ACK or daemon/bridge restart re-send the exact frozen `relayEnvelope` with the same `deliveryId` and bytes. If the relay subsystem stops while an outbound HTTP `POST` is in flight (or before it starts), the transport aborts cleanly (`stopped`) without recording a false failure transition note or false acceptance receipt, retaining the buffered decision for replay on restart. There is currently no periodic background timer redriving outbound dispatches on timeout.
+- OpenRig enqueues outbound decisions to a local `DispatchBuffer` before issuing any HTTP `POST` to `OPENRIG_RELAY_URL` (in `push` mode) or holding the decision for connector pull (in `pull` mode).
+- Each logical decision freezes its complete `relayEnvelope` onto the parent `DispatchBuffer` entry before the first delivery pass, with no self-imposed outbound 64 KiB cap or multi-part splitting.
+- **Push mode (`OPENRIG_RELAY_MODE=push`, default)**:
+  - Transport is at-least-once: OpenRig sends the complete JSON envelope in a single HTTP `POST` per attempt with `deliveryId = <decisionId>` (preserving the full `body`, `humanDetail`, `humanQuestions`/options, `summary` overflow, and digest `items` without silent clipping).
+  - An HTTP `2xx` response from the bridge acknowledges durable bridge custody of that complete envelope (`deliveryId`). The bridge must persist each envelope by `deliveryId` and deduplicate replayed `deliveryId`s idempotently.
+  - OpenRig records the logical queue acceptance receipt (`relay-owner-notification-accepted` with `deliveryId`) and drains the decision from `DispatchBuffer` once the HTTP `POST` returns `2xx`.
+  - Failed dispatches remain in OpenRig's `DispatchBuffer` and record a relay-specific failure transition note (`relay-owner-notification-transport-failed` naming the `connectorRef`, distinct from Slack's `slack-owner-notification-transport-failed`). Replays after a lost ACK or daemon/bridge restart re-send the exact frozen `relayEnvelope` with the same `deliveryId` and bytes. If the relay subsystem stops while an outbound HTTP `POST` is in flight (or before it starts), the transport aborts cleanly (`stopped`) without recording a false failure transition note or false acceptance receipt, retaining the buffered decision for replay on restart. There is currently no periodic background timer redriving outbound dispatches on timeout.
+- **Pull mode (`OPENRIG_RELAY_MODE=pull`)**:
+  - Client-only connectors that do not bind a listening HTTP server set `OPENRIG_RELAY_MODE=pull`. A pull profile is ready with `OPENRIG_RELAY_INBOUND_TOKEN` alone (`OPENRIG_RELAY_URL` and `OPENRIG_RELAY_OUTBOUND_TOKEN` are optional and unused in pull mode).
+  - Outbound decisions remain in `DispatchBuffer` awaiting connector pull and are never treated as failed push destinations (`relay-owner-notification-transport-failed` is not recorded). While the outbox lists a notice (staged in `DispatchBuffer` and `relay-attempted-decisions.jsonl` for its `connectorRef`), it is not a missing post for up to **24 hours** (`PULL_OUTBOX_NEVER_POSTED_WINDOW_MS`) and reads `never-posted` (`undelivered-human-notice`) if still unacknowledged after that. A notice the outbox does not list (never staged, staging failed, or its `DispatchBuffer` or seen stores are unreadable, so the outbox answers `503`) uses the usual 120-second window (`NEVER_POSTED_WINDOW_MS`). This is reporting only: nothing is held, refused or re-sent.
+  - The connector lists its pending complete envelopes via `GET /api/gateway/relay/outbox` (read-only; no consumer leases, read receipts, or required polling cadences) and acknowledges durable custody via `POST /api/gateway/relay/outbox/ack`.
+  - An acknowledgment on `POST /api/gateway/relay/outbox/ack` has the exact same custody meaning as a push `2xx`: OpenRig records `relay-owner-notification-accepted` (closing informational `update` items as delivered), marks its local outbound seen/delivered guards, and drains the decision from `DispatchBuffer`. Duplicate acknowledgments reconcile idempotently (`alreadyAccepted: true`), and retries after a partial local write failure finish the remaining receipt and drain sequence.
+- **Custody boundary (both modes)**: Bridge acceptance (via push `2xx` or pull `POST /api/gateway/relay/outbox/ack`) confirms durable custody of the complete envelope by the connector only (projected as `accepted` / `"Accepted by bridge"`, whereas Slack posts use `posted` / `"Delivered"`). It does not mean posted, seen, answered, or approved.
 
 ### Inbound Custody & Resolution
 - The operator bridge posts replies to `POST /api/gateway/relay/inbound`.
@@ -54,21 +61,29 @@ Each relay connector loads configuration from an absolute file referenced by the
 
 ### Required Secrets Keys
 
+**Push mode (`OPENRIG_RELAY_MODE=push`, default when omitted):**
 ```ini
 OPENRIG_RELAY_URL=http://127.0.0.1:8088/webhook
 OPENRIG_RELAY_OUTBOUND_TOKEN=sec_outbound_token_value
 OPENRIG_RELAY_INBOUND_TOKEN=sec_inbound_token_value
 ```
 
-- `OPENRIG_RELAY_URL`: Must use `http:`, loopback host (`127.0.0.1/8`, `::1`, or `localhost`), without URL credentials or hash fragments. Redirects (3xx) are rejected.
-- `OPENRIG_RELAY_OUTBOUND_TOKEN`: Non-empty Bearer token sent by OpenRig on outbound requests to the bridge.
-- `OPENRIG_RELAY_INBOUND_TOKEN`: Non-empty Bearer token required on inbound requests from the bridge. Must be unique across different configured relay connector profiles (`connectorRef`); sharing the same inbound token across multiple relay profiles is rejected as ambiguous (`not-ready`). Using the same token value for both `OPENRIG_RELAY_OUTBOUND_TOKEN` and `OPENRIG_RELAY_INBOUND_TOKEN` within a single profile is allowed, with a redacted readiness warning explaining why separate directional tokens are recommended so an outbound capture cannot authenticate inbound replies.
+**Pull mode (`OPENRIG_RELAY_MODE=pull`):**
+```ini
+OPENRIG_RELAY_MODE=pull
+OPENRIG_RELAY_INBOUND_TOKEN=sec_inbound_token_value
+```
+
+- `OPENRIG_RELAY_MODE`: Optional mode selector (`push` or `pull`; defaults to `push` when omitted). Any other value is rejected as `not-ready`.
+- `OPENRIG_RELAY_URL`: Required in `push` mode; ignored/unused in `pull` mode (`endpointUrl: null`). When required, must use `http:`, loopback host (`127.0.0.1/8`, `::1`, or `localhost`), without URL credentials or hash fragments. Redirects (3xx) are rejected.
+- `OPENRIG_RELAY_OUTBOUND_TOKEN`: Required in `push` mode; ignored/unused in `pull` mode. Non-empty Bearer token sent by OpenRig on outbound HTTP `POST` requests to the bridge.
+- `OPENRIG_RELAY_INBOUND_TOKEN`: Non-empty Bearer token required in both `push` and `pull` modes to authenticate connector requests (`GET /api/gateway/relay/outbox`, `POST /api/gateway/relay/outbox/ack`, and `POST /api/gateway/relay/inbound`). Must be unique across different configured relay connector profiles (`connectorRef`); sharing the same inbound token across multiple relay profiles is rejected as ambiguous (`not-ready`). Using the same token value for both `OPENRIG_RELAY_OUTBOUND_TOKEN` and `OPENRIG_RELAY_INBOUND_TOKEN` within a single `push` profile is allowed, with a redacted readiness warning explaining why separate directional tokens are recommended so an outbound capture cannot authenticate inbound replies.
 
 ---
 
 ## 3. Wire Protocol Specifications
 
-### Outbound Envelope (`POST <OPENRIG_RELAY_URL>`)
+### Outbound Envelope (`POST <OPENRIG_RELAY_URL>` or `GET /api/gateway/relay/outbox`)
 
 ```json
 {
@@ -93,6 +108,13 @@ OPENRIG_RELAY_INBOUND_TOKEN=sec_inbound_token_value
 - `replyRef`: Fixed-size opaque base64url token (`<= 4,096` characters for any supported ID lengths — `246`–`266` characters in protocol v1, hashing the canonical frozen `RelayReplyRefPayload` and binding `connectorHash`, `mode`, and optional `digest: true`) for actionable decisions; `null` for informational updates (and `null` at the top level of multi-item digests).
 - `items`: Present when `outcome` is `"digest"`. Array of objects with `qitemId`, `notificationKey`, `summary`, optional `body`, and per-item `replyRef` (or `null`).
 
+### Pull Outbox Endpoints (`GET /api/gateway/relay/outbox` & `POST /api/gateway/relay/outbox/ack`)
+
+Both endpoints require a direct loopback TCP peer (`127.0.0.1/8` or `::1`), reject browser cross-origin headers (`403`), and authenticate the caller via `Authorization: Bearer <OPENRIG_RELAY_INBOUND_TOKEN>` (`401`). If the human registry, `DispatchBuffer` (`pendingStrict()`), or outbound `SeenStore` cannot be read, both return `503` (`human_registry_unavailable`, `dispatch_buffer_unavailable`, `seen_store_unavailable`, `queue_store_unavailable`, or `receipt_write_failed`) rather than returning an empty `deliveries` array.
+
+- **`GET /api/gateway/relay/outbox?limit=<1..200>`** (default `50`): Returns `{ "ok": true, "connectorRef": "<ref>", "deliveries": [ <RelayOutboundEnvelope>, ... ] }` with complete pending envelopes from `DispatchBuffer` belonging to the authenticated `connectorRef` in FIFO buffer order. Strictly read-only (no leases or read receipts).
+- **`POST /api/gateway/relay/outbox/ack`**: Closed JSON object `{ "deliveryId": "<decisionId>" }` accepting any non-empty string `deliveryId` the outbox can list, within the 64 KiB request-body size bound (`413 payload_too_large`); unknown fields or an empty or non-string `deliveryId` return `400 invalid_envelope`. Finishes any remaining `relay-owner-notification-accepted` transition receipts, marks `slack-outbound-seen.jsonl` and `relay-delivered-decisions.jsonl`, releases the in-memory outbound poll guard, and drains `deliveryId` from `DispatchBuffer`. Returns `200 { "ok": true, "deliveryId": "<id>", "connectorRef": "<ref>", "alreadyAccepted": false }` (`"alreadyAccepted": true` on duplicate ack for the same `connectorRef`, or `404 unknown_delivery` if unknown or owned by another connector; duplicate and unknown acks are answered from `relay-delivered-decisions.jsonl` and `relay-attempted-decisions.jsonl`, and the transition receipt scan runs only when those disagree). On any `503` partial failure, a retry with the same `deliveryId` finishes the remaining receipt and drain steps.
+
 ### Inbound Envelope (`POST /api/gateway/relay/inbound`)
 
 ```json
@@ -172,7 +194,10 @@ rig gateway human set alice binding.0 "relay:local-bridge:file:$HOME/.config/ope
 ```
 
 > [!NOTE]
-> `rig gateway human set alice binding.<n>` requires a full binding specification string. Supplying `unset` is not supported for binding slots. To reassign a participant, overwrite the slot with a full binding string or remove and re-add the human fragment.
+> `rig gateway human set alice binding.<n>` accepts either a full binding specification string or `unset` to remove that binding slot:
+> - **One-primary rule:** No replacement primary is chosen silently. If removing a `primary` binding would leave other bindings, the command refuses. To replace the primary in place, set its slot to the new primary spec; to promote an existing secondary binding, first save that binding's full spec (`kind:connectorRef:secretsRef:role[:handle=<id>]`) from `rig gateway human show <entityId> --json`, then unset that secondary slot, then find the primary's current slot in `remainingBindings` (or `rig gateway human show <entityId> --json`, since the primary's slot shifts down when a lower-index secondary is removed) and set it to the saved spec with role `primary` (promotion replaces the former primary binding; its connector reference and inbound handle are not retained as a secondary); to remove every binding, unset the secondary bindings first using their current slot indexes from `remainingBindings` or `rig gateway human show <entityId>`, then finish at `binding.0` (once all secondaries are gone, the primary is at `binding.0`).
+> - **Shifted slot indexes:** Removal returns `remainingBindings` with their new `binding.<n>` slot numbers (the primary's slot shifts down too when a lower-index secondary is removed). Because indexes shift down after removal, do not blindly retry `binding.0 unset`; inspect `remainingBindings`, the operation receipt, or `rig gateway human show <entityId>` before retrying.
+> - **What removal does:** Removing a binding keeps the person, their preferences, their other bindings, and their open questions. Removing the last binding makes the current delivery episode inactive, so new missing-post findings stop (an already-open recovery item for an undelivered notice may remain); the current delivery-outcome display may disappear too, while historical receipt notes remain. It does not answer, close, or cancel open questions, cancel or reroute already-prepared deliveries, or retract anything a bridge has already accepted. A person with no binding needs a daemon from the release that accepts one (v0.7.9+); do not roll back past it while any fragment has `connectorBindings: []`.
 
 Operator notices use the existing default person. If several people are registered, choose the recipient explicitly when needed:
 
@@ -203,7 +228,11 @@ rig daemon status
 In `rig gateway human show <entityId> --json`, `deliveryReadiness.state` reports `ready` when the binding configuration and local secrets file are valid. This confirms local readiness, not whether the operator bridge process is currently running.
 
 ### Step 5: Removing Bindings or Participants
-Before removing a participant, ensure any pending queue items and conversations assigned to them are resolved.
+To remove a connector binding while keeping the participant, their preferences, their other bindings, and their open questions, unset the binding slot:
+```bash
+rig gateway human set alice binding.0 unset --reason "retire relay bridge"
+```
+Before removing a participant altogether, ensure any pending queue items and conversations assigned to them are resolved:
 ```bash
 rig gateway human remove alice
 ```

docs/reference/getting-started.md

@@ -816,6 +816,19 @@ option, the seat's agent spec for the target runtime, or the runtime's own
 default), what is cleared, and the costs below. Nothing changes until you run it
 without `--dry-run`.
 
+Use `--runtime pi` to move a Claude Code or Codex seat to Pi; use `--runtime
+claude-code` or `--runtime codex` to move back. Pi uses a fresh managed state
+directory. Select a prepared Pi account with `--account-home /absolute/path`
+(the directory must contain readable `auth.json`), or use the target's configured
+login. A source account override or Claude token is cleared only at commit;
+credentials are never converted between runtimes. Pi-to-Pi account changes keep
+Pi settings, but cross-runtime switches resolve settings afresh for the target.
+
+A configured `launch_wrapper` carries across runtime switches among Pi, Codex
+and Claude Code. It must support each successor executable and preserve that
+runtime's credential environment. A wrapped Pi seat cannot switch to Claude
+Code; set `launch_wrapper: []` in the authored spec and re-apply it first.
+
 The new runtime takes over before the old one stops. Its successor starts beside
 the current occupant, reads a handover (the seat's recap, its open rows and the
 predecessor's screen), and confirms it with `rig seat set-runtime <seat>
@@ -847,7 +860,7 @@ What it costs:
   again afterwards to reach whoever holds the seat.
 - **Leftover files after a failed switch.** The target runtime's prepared seat
   storage and projections can remain.
-- **Codex and Claude Code, single-pane seats.** Startup slash commands aren't
+- **Codex, Claude Code and Pi, single-pane seats.** Startup slash commands aren't
   run by a switch; the dry run lists them.
 
 ## Stop your teams
@@ -886,6 +899,8 @@ the lifecycle API without booting a new kernel, then stop the remaining rigs.
 | "Readiness timeout after 30s — harness did not become interactive" | The harness took longer than the readiness window. Raise it for the next launch with `rig config set runtime.readiness_timeout_seconds <1-600>`, then relaunch that seat. |
 | "Claude resume did not finish within Ns; Claude may still be starting, so the launch was kept" | A restored Claude seat was not interactive when the wait ended. Its pane and resume token are kept. Look at the pane; once Claude is up, run `rig seat clear-attention <seat>`. The wait is about `runtime.readiness_timeout_seconds` in total for each seat (default 30 s), counting the first 3.2 s, and the time adds up seat by seat in a restore. Raising the setting for slow fresh launches lengthens it. If `rig up` or `rig launch` times out at 120 s, that is not a rollback: check `rig ps` before running it again. |
 | Daemon is healthy, kernel is still starting | Read `rig status` and `rig ps --nodes --rig kernel`; kernel readiness is separate. |
+| `rig status`, `rig terminal open` or `rig daemon start --wait-for-kernel` says a seat "needs attention" or "is waiting on a person" | The daemon flags that seat, and the line gives its recorded reason: a startup that failed or stopped at a sign-in, trust or other gate, a held message, a missing required file, or a question. "Is waiting on a person" means the daemon sees a live question you can answer in that seat's terminal. Look at it with `rig capture <seat>` or in its tile, then follow the row above that matches its message. "Couldn't check" means the check itself failed; it says nothing either way. |
+| A Codex seat, including the kernel's operator, answers every turn with a model error such as "… not supported when using Codex with a ChatGPT account" | Its Codex sign-in works, but that account can't run the model; the kernel picks its runtimes from the providers chosen at setup and their sign-ins, not from which models an account can run. If Claude Code is signed in, move just that seat: `rig seat set-runtime <seat> --runtime claude-code --reason "<model> isn't available to this Codex account"` (`--dry-run` first). Otherwise give it a model the account can run with `rig seat set-model <seat> --model <id> --reason "…"`, then start it again with `rig seat launch <seat> --fresh --stop --reason "…"` and check the model it reports. |
 | Kernel seats fail within a second of the first start, and tmux reports "server exited unexpectedly" | Check that your tmux can capture a pane, then start the failed seats again; see the tmux check below this table. |
 | Shared terminal is absent | Check the kernel's `operator.human` terminal separately from its agents; recover only that seat as described below. Standalone `rig tui` remains available while resolving it. |
 | Viewing terminal was closed | Open the conversations again with `rig terminal open saved:kernel --window`; `rig tui --shared` is only the dashboard fallback if that window cannot open. Do not relaunch the team. |

docs/reference/harness-runner-contract.md

@@ -39,14 +39,19 @@ This chapter covers **which agent runs in a seat and how OpenRig talks to it**.
 sandbox, another machine) is the [execution platform chapter](execution-platform-contract.md). The two are separate on purpose:
 the same harness can run in many places, and one place can host many harnesses.
 
-## 1. Plain preset or runner preset?
+## 1. Plain preset, runner preset, or OpenRig-hosted protocol runner?
 
-| | Plain community preset | Runner preset (`runner: true`) |
-|---|---|---|
-| **What runs in the pane** | The harness's own terminal app | A small program you maintain, *the runner*, which hosts the agent (for example an ACP agent over stdio) |
-| **How OpenRig reads activity** | From the screen: a changing screen reads working; a quiet one reads **unknown**, never idle | From the runner's reports: working, idle, needs input |
-| **How input arrives** | Typed into the app's prompt | Typed into the runner, which turns each submitted message into one agent prompt |
-| **Choose it when** | The harness has a usable terminal UI (Cursor, Hermes, OpenClaw examples) | The harness speaks a protocol rather than a screen (ACP, JSON-RPC, stream-JSON), or you can report turn boundaries reliably |
+| | Plain community preset | Runner preset (`runner: true`) | OpenRig-hosted protocol runner (`protocol: pi-rpc`) |
+|---|---|---|---|
+| **What runs in the pane** | The harness's own terminal app | A small program you maintain, *the runner*, which hosts the agent (for example an ACP agent over stdio) | OpenRig's own Pi runner, which starts your binary (`command`) in Pi's RPC mode |
+| **How OpenRig reads activity** | From the screen: a changing screen reads working; a quiet one reads **unknown**, never idle | From the runner's reports: working, idle, needs input | From the Pi runner's reports, through the same channel as built-in Pi; identity is the session file Pi's `get_state` reports |
+| **How input arrives** | Typed into the app's prompt | Typed into the runner, which turns each submitted message into one agent prompt; a message sent mid-turn waits | Pi's input: a submitted block is a prompt, a message sent while busy steers the current turn, `/followup` queues after it and `/abort` cancels it |
+| **Choose it when** | The harness has a usable terminal UI (Cursor, Hermes, OpenClaw examples) | The harness speaks a protocol rather than a screen (ACP, JSON-RPC, stream-JSON), or you can report turn boundaries reliably | Your harness is a Pi fork, or speaks Pi's CLI and JSONL RPC protocol |
+
+**For the third shape, you promise your binary's Pi-RPC compatibility at a version you name in `limits`.** OpenRig doesn't
+test each fork. It can't be combined with `runner`, `launch_result`, `names_conversation`, `startup_assisted` or
+`first_input`. The flags it must accept are in
+[Pi-compatible RPC harnesses](community-harness-presets.md#pi-compatible-rpc-harnesses-protocol-pi-rpc).
 
 **If your harness works well as a terminal app, a plain preset is enough. Use a runner only when you can report state
 honestly.** A runner that guesses is worse than a quiet screen read as unknown.
@@ -78,7 +83,20 @@ limits:
 - **A preset without `runner` behaves exactly as today,** and so does a session recorded before the field existed.
 - **The other fields keep their existing meanings:**
   - `first_input: true` passes the seat's first startup turn in a file named by `OPENRIG_FIRST_INPUT`;
-  - `passes_model: true` passes the seat's declared model as `OPENRIG_MODEL`.
+  - `passes_model: true` passes the seat's declared model as `OPENRIG_MODEL`;
+  - `launch_wrapper: true` declares that the runner applies a member's configured wrapper to its native child.
+
+**Launch wrapper.** `launch_wrapper` is an optional boolean in format 1 and requires `runner: true`. When the member
+has a wrapper and its runner preset declares `launch_wrapper: true`, OpenRig passes `OPENRIG_LAUNCH_WRAPPER` as a JSON array of resolved argv strings.
+The runner must exec its native child as `<argv...> <agent> <args>`, preserving argument boundaries, and keep its own
+process outside the wrapper. The runner must remove `OPENRIG_LAUNCH_WRAPPER` from the environment it passes to the wrapper
+and native child; the handoff belongs to the runner only. The wrapper must `exec` the agent in place. If wrapping fails,
+the runner must never fall back to an unwrapped spawn. A runner preset without the flag is refused at preflight and launch (not schema validation) when a wrapper is
+configured: `launch_wrapper unsupported: the community preset "<runtime>" runs a runner without launch_wrapper: true; no agent started. Add launch_wrapper: true to the preset if its runner applies OPENRIG_LAUNCH_WRAPPER, or remove launch_wrapper from this member.`
+A plain preset needs no flag: OpenRig prefixes its command
+immediately before the preset's native command, after OpenRig's launcher assignments (for example,
+`/usr/bin/env OPENRIG_LAUNCH_RESULT=… <wrapper> <preset.command>`), at the same seam as Codex. OpenRig never sets
+`OPENRIG_LAUNCH_WRAPPER` for a plain preset and removes any inherited value.
 
 ## 3. Identity: report the conversation once, in the launch record
 

docs/reference/health-diagnosis.md

@@ -91,7 +91,11 @@ and `severity=info`. CLI/TUI call this **needs diagnosis**, not a confirmed
 warning. Enabled diagnosis policy admits one bounded packet even though the
 product denominator is unknown. Ordinary unavailable/stale detector records
 remain ineligible. Diagnosis and human-notification traffic are excluded from
-the numerator and cannot recursively generate another investigation.
+the numerator and cannot recursively generate another investigation. So is the
+daemon's own bookkeeping: transitions by system actors (`*@system` and the
+bare `system` of claim handover) and daemon notes recorded under any actor
+(`auto-unparked:`, `blocker custody moved `, `park wake `, `parked-owner `).
+The reported `transitionIds` are the counted transitions.
 
 The agent reads the actual evidence, including beyond the supplied references,
 and resolves the semantic outcome granularity and consequence boundary. Use the

docs/reference/help.md

@@ -97,6 +97,24 @@ missing tools or logins, kernel startup, a closed viewing terminal and recovery
 before choosing an action. A healthy daemon doesn't by itself mean the project's seats are ready: check
 `rig ps --nodes --rig <rig-name>`.
 
+If the whole team stopped when a herdr terminal closed, OpenRig or its tmux server was started from inside that
+terminal: herdr-core ends every process started there when the terminal closes. `rig daemon start` no longer passes a
+herdr terminal's scope on, but processes started before that keep it until they restart. OpenRig never restarts them
+for you; restart at a time you choose, from a terminal outside herdr.
+
+With `terminal.tmux_server` at its default (`inherit`), OpenRig puts seats on the tmux server of the shell that
+started it, usually your own default server. If that server was already running, and you had started it from a herdr
+terminal, it carries that terminal's scope. OpenRig can't prevent this, because the server is yours.
+The same applies when a command like `rig chatroom watch`, run in a herdr terminal, starts the default server. Start
+tmux outside herdr, or use `terminal.tmux_server isolated` (see `tmux-servers.md`), which gives OpenRig a server it
+starts itself.
+
+The daemon keeps `HC_SESSION` and `HC_SOCKET`. The herdr-core they select is the one the herdr-app provider starts
+viewers in; `rig terminal status --provider herdr-app` names it (`core` and `assumption`), as do open failures
+(`viewer_start_failed`, `herdr_app_unavailable`) and the note when a window has not confirmed showing a view. If your
+herdr-app window is attached to a different herdr-core than the daemon's, its viewers will not appear there; start the
+daemon with that core's `HC_SESSION` and `HC_SOCKET`.
+
 ### The agent is waiting for permission or can't reach the daemon
 
 Read [Have your agent configure permissions](getting-started.md#have-your-agent-configure-permissions)

docs/reference/herdr-app.md

@@ -0,0 +1,145 @@
+# OpenRig views in herdr-app
+
+herdr-app (Herdr 2, the desktop app on herdr-core) can show OpenRig's terminal views inside its own window. A view
+opens as a **Rig view**: an equal grid of the view's seats, each with a title row (`<agent> · <slice>`), padded to a
+full grid. Rig views live in OpenRig's own herdr-app layout, **Rig** (`layouts/rig.json`), beside your tabs. A strip
+above them switches between **Your tabs** and each view.
+
+Nothing here needs a desktop display or SSH: the view opens in the herdr-app window the request came from.
+herdr-app has to run on the same machine as the OpenRig daemon: OpenRig reaches it through its control socket
+(`<app home>/herdr-app.sock`) and writes its mods and layout into that app home. An app on another machine, connected
+to this machine's herdr-core over SSH, isn't supported.
+
+## Set up
+
+Nothing to install by hand: opening a view installs OpenRig's four mods (rig-strip, rig-cell-header, rig-pad,
+rig-ended) and updates them when OpenRig is updated.
+
+- The mods go to `<app home>/mods/rig-*`. The app home is herdr-app's own: `HERDR_APP_HOME`, else
+  `$XDG_CONFIG_HOME/herdr-app`, else `~/.config/herdr-app`. `--app-home <dir>` on `rig terminal open` names another.
+- OpenRig owns only the files it ships there (recorded in `<app home>/openrig/mods.json`). An update replaces those
+  and nothing else in the folder. Mods you install yourself, from any source, are never touched.
+- To move between a view's cells from the keyboard, bind the strip's actions in `keys.json`, section `layout:rig`
+  (your agent can add it, as for any herdr-app key):
+  `"layout:rig": { "alt-left": "rig-strip.left", "alt-right": "rig-strip.right", "alt-up": "rig-strip.up", "alt-down": "rig-strip.down" }`.
+  In the Rig layout these replace herdr-app's `global` defaults for the same keys (`pane.go`, `agent.prev`/`agent.next`),
+  which keep working on your other layouts. A key bound in `terminal` wins while a cell has focus, so pick keys that
+  aren't bound there. Once you edit `keys.json`, herdr-app treats it as yours and stops adding new default shortcuts.
+- An open never replaces a mod you changed: that folder stays as it is, the view opens anyway, and the open's notes
+  name the folder and why. Only a mod a view needs that is missing and can't be installed stops an open.
+
+## Open a view
+
+- **From the TUI inside herdr-app:** Terminals, choose a view (Enter previews it), then **Open terminals**. The TUI
+  recognises that it runs in a herdr-core terminal of a herdr-app window on this machine, and the preview and the
+  open both use that window, so the plan you previewed is the one that opens. The preview says the view opens in
+  this window; it shows no desktop or SSH recipe. A shared TUI viewed from a herdr-app terminal does the same. The
+  kernel view opens in its narrow arrangement there (one seat per page): the window's width isn't the TUI's.
+- **From a shell:** `--provider herdr-app` opens the view in the herdr-app window you run it in. Inside a herdr-app terminal, plain `rig terminal open <view>` does the same when that window is answering. `--window` always asks for a new desktop window.
+
+  | Command | Where the view opens |
+  |---|---|
+  | `rig terminal open <view> --provider herdr-app [--app-home <dir>]` | In the herdr-app window this runs in (requires the window to answer). |
+  | `rig terminal open <view>` | Inside a herdr-app terminal when the window is answering, in that herdr-app window; otherwise a desktop window. |
+  | `rig terminal open <view> --window` | Always asks for a new desktop terminal window, even inside a herdr-app terminal. |
+
+The herdr-app window must be answering on its socket (`<app home>/herdr-app.sock`); otherwise an explicit open fails and says
+so. Finding the socket file is how OpenRig guesses you are in a herdr-app window; whether the window is reachable is
+checked by asking it. When a plain `rig terminal open <view>` in a herdr-app terminal finds that the socket does not
+answer, it says so and opens a desktop window instead; `--provider herdr-app` never
+falls back to a desktop window or an SSH recipe.
+
+What an open does, in order:
+
+1. Each viewer is recorded first (`$OPENRIG_HOME/private/herdr-app/clients/`), then started by herdr-core outside
+   every tab (`hc run --bg --no-parent`, labelled `openrig.*`). A local viewer runs the view's tile for its seat, as in
+   [terminal sessions](terminal-sessions.md): it shows the seat. An interactive cell starts with the read-only tile and
+   takes no input until herdr-app has shown the view (step 3); then its writable tile takes over, and the first thing
+   you type attaches it. A read-only cell only shows. A seat on another host opens as its own ssh attachment, writable
+   or read-only as that view composes it. If the seat's session ends, the viewer says so and waits; it never leaves a
+   shell in the cell.
+2. One atomic write of `layouts/rig.json`: your current layout, with OpenRig's stack beside your tab block. Your own
+   layout file is never written. A `rig.json` OpenRig didn't write is never overwritten.
+3. The Rig layout is shown, the view is selected once herdr-app confirms it shows the new file, and the keyboard
+   goes to the first live cell. Once herdr-app has acknowledged the layout with the view, OpenRig writes the gate file
+   of each of the view's interactive cells, on every page (including pages the strip hasn't shown yet, since the strip
+   moves between pages on its own), and each cell takes input a fraction of a second later (it checks every 0.2 s).
+   Anything that reached a cell before that, typed or written to its terminal (`hc send`), is dropped, not delivered
+   late. The open reports a view herdr-app
+   hasn't confirmed as unconfirmed, not opened; its viewers keep running and it stays in the Rig layout, and its cells
+   take input once herdr-app shows it. OpenRig keeps watching for 10 minutes, across a daemon restart; if herdr-app
+   hasn't shown it by then, each interactive cell says so, takes no input, and names the command that opens the view
+   again (`rig terminal open <view> --provider herdr-app`).
+
+Other layouts and other herdr-app windows don't show Rig views. Each window (app home) has its own.
+
+## The keyboard
+
+- An open puts the keyboard on the new view's first live cell.
+- Entering a view again (a click in the strip, or herdr-app restarting with it shown) returns the keyboard to the cell
+  you were last in there, else the first live cell.
+- **Your tabs** gives the keyboard back to your own pane.
+- OpenRig's own rewrites (another view opening or closing, a cell ending) never move the keyboard, whether you are in
+  a view or in your tabs.
+- Typing in an interactive cell, once the view is shown, attaches its tile to the seat; after 30 seconds without a key
+  it goes back to showing it. When the seat's session is replaced (a handover, a fresh launch, a restart), the tile follows the same seat to
+  its new session, as every OpenRig tile does.
+
+## What OpenRig keeps in the app home
+
+All under `<app home>/openrig/`:
+
+| File | What it holds |
+|---|---|
+| `mods.json` | The files OpenRig shipped to `mods/rig-*`, so an update replaces only those. |
+| `ack.json` | Written by the strip: the last layout revision herdr-app shows and the terminals it references. A viewer ends only once this shows its cell is gone. |
+| `strip.json` | Written by the strip: the cell you were last in per view, and the view shown. herdr-app gives a mod new storage whenever its props change, which is every OpenRig write, so this is kept as a file. |
+
+## Close a view
+
+```sh
+rig terminal close <rv-id> [--app-home <dir>]     # the id is in the open result's `space`
+```
+
+The view's cells leave `rig.json` first. A viewer ends only after herdr-app confirms it shows a layout without it, or
+when the Rig layout isn't shown (herdr-app then reads the new file when it is). Only viewers OpenRig started (its
+record, its labels and its exact command all match) are ended. Seats are never touched. Anything uncertain is left
+running and named in the result.
+
+If a viewer ends some other way (killed outside OpenRig, herdr-core restarted), OpenRig rewrites its cell as an
+ended cell straight away. Views OpenRig recorded keep that owner across a daemon restart: when the daemon starts, it
+reconciles each app home it has views in (a viewer that ended while it was down is rewritten then) and finishes any
+pending ends. If `hc events` can't run (herdr-core missing or down), the watcher tries again after 5 s, then waits
+twice as long each time, up to 5 minutes. Stopping the daemon ends only its own `hc events` watcher and timers; viewers
+and views stay.
+
+## Which herdr-core
+
+```sh
+rig terminal status --provider herdr-app [--app-home <dir>]
+```
+
+`core` and `assumption` in the result name the herdr-core the daemon's `hc` runner starts and ends viewers in: the
+daemon's `HC_SESSION` (else `default`) and `HC_SOCKET` if set when the daemon started. The herdr-app window must be a
+client of that same core. Terminal addresses are per core, so a window attached to another core would show other
+terminals, or none, in the view's cells. Open failures (`herdr_app_unavailable`, `viewer_start_failed`) and the note
+when a window has not acknowledged a write also name the daemon's core (`HC_SESSION`/`HC_SOCKET`) so a mismatch is
+visible straight away.
+
+A status or a preview only reads: it starts no herdr-core process and creates nothing. OpenRig watches herdr-core's
+events (`hc events`) and creates its viewers folder only when it opens or closes a view, or when it starts with views
+already recorded.
+
+## Limits
+
+- A Rig view is a layout inside herdr-app, not a herdr tab: other windows and other layouts don't show it.
+- Following a task (`--follow`) isn't available in herdr-app yet.
+- When a viewer ends unexpectedly, herdr-app removes its block and collapses the layout, which briefly opens the Files
+  panel on that cell's folder until OpenRig's rewrite restores the layout. Viewers start in OpenRig's own empty
+  folder (`$OPENRIG_HOME/private/herdr-app/viewers`). Planned closes never trigger this.
+- OpenRig doesn't yet check that the window runs on the daemon's herdr-core (`core` in `rig terminal status`); it
+  relies on both using the same session on the same machine.
+- `POST /api/terminal/open` (and `POST /api/terminal/close`) carries no bearer middleware, matching the daemon's other
+  open routes; an open writes `mods/rig-*`, `openrig/mods.json` and `layouts/rig.json` into the named `--app-home` once
+  `herdr-app` answers a `status` request on `<app home>/herdr-app.sock`.
+- Runtime-tested on Linux only; macOS and Windows haven't been tried on real machines.

docs/reference/hosted-members.md

@@ -86,8 +86,14 @@ entry. The entry holds secret names, never values:
 These facts stay separate on the row:
 - **Wake:** with a trigger, the row's wake result is `wake-accepted:webhook (<url_ref>) answered <status>` when the trigger took the
   ring, or `failed:webhook …`. Accepted means the tool's trigger answered, not that the member read the row.
-  - With no trigger, the result is `unroutable`, and OpenRig tells the person: the operator seat when it's a person, else whoever
-    created the row.
+  - With no trigger, the result is `unroutable`. The member finds work by reading its own inbox and picks a row up by claiming
+    it, so a row gets no finding of its own. Work it leaves unclaimed past the stuck sweep's unclaimed age
+    (`queue.stuck_sweep_unclaimed_age_minutes`, 60 by default) is listed in one standing notice per member. The notice goes to
+    the operator seat when it's a person, else the rows' creator when they all share one, else the operator agent, else the
+    member itself. A notice to a creator lists only that creator's rows: when another creator's row joins, the notice moves to
+    the next recipient. It says whether the member has read its own pending inbox recently: a check-in, never a receipt or a
+    claim. A member with a declared route (a delegation parent or `escalates_to`) gets one finding per unclaimed row at that
+    route instead.
   - It tells the person too when the member was rung but hasn't claimed the work by the stuck sweep's unclaimed age
     (`queue.stuck_sweep_unclaimed_age_minutes`, 60 by default).
   - The member sees new work when it checks: when it's rung, when its person asks it to, or on a schedule the tool runs.
@@ -95,7 +101,7 @@ These facts stay separate on the row:
 - **Result:** the closing transition and its resolution, or the handoff.
 - **Notification:** where a person asked, Slack's posted receipt. A posted notice isn't the person's acknowledgment.
 
-**On the team:** `rig_team` lists the rig's hosted members (roster entries marked hosted that aren't one of its nodes), with their capabilities and caveat, no pane, and activity `unknown`.
+**On the team:** `rig_team` lists the rig's hosted members (roster entries marked hosted that aren't one of its nodes), with their capabilities and caveat, no pane, and activity `unknown`. With an external grant offering `team/list`, call it without `rigId` to discover the connected team. It selects the grant's sole rig, or returns only its granted names when a choice is needed.
 OpenRig doesn't observe a hosted member between its calls, so it never reads idle. `rig roster find` shows it the same way.
 - **Presence:** each entry carries `presence`, which says what OpenRig last saw of the member. It isn't pickup, and `null` means unknown:
   - `lastCallAt`: its last authenticated call to this host's `rig mcp serve --http`, recorded at most once a minute in
@@ -129,6 +135,10 @@ and nothing else is offered:
   - It reads the items it sent and the items addressed to it from those seats, never the team's internal items.
   - With `queue`/`claim` and `queue`/`update`, it claims and closes only items addressed to its own seat that it can read,
     and waits (blocked) only on an item it names and can read. Its answers hide what reading the item hides.
+- **A first task without a seat address:** with `--task-destination <member@rig>` on the same `rig mcp serve`, a
+  `rig_queue_create` that leaves out `destination` goes to that receiver. The operator sets it; a caller can't. It must be
+  exactly one existing local node within that request's grant, or nothing is written. An explicit `destination` works as
+  before.
 - **Two assistants together:** a grant with `team`/`list` sees its rigs' seats with `rig_team`, and may address and hear from
   another connected assistant's seat. A grant without it never reaches a seat in the service's caller form
   (`cus-<id>-<connection>@<rig>`), so an existing connection keeps the reach it had.
@@ -137,8 +147,8 @@ and nothing else is offered:
   - **Queued:** the item exists and is `pending` with no claim.
   - **Picked up:** the receiver's claim (`in-progress`).
   - **Answered:** closed `done`, with the answer in `resolution`.
-  - Reading or listing an item records nothing, and nothing wakes an assistant, so an item stays queued until its receiver
-    claims it.
+  - Reading or listing an item records nothing on the item, and nothing wakes an assistant, so an item stays queued until its
+    receiver claims it. A member listing its own pending inbox records only a check-in time, which the notice above reads.
 
 ### A person answering the team's questions through their assistant
 
@@ -148,7 +158,8 @@ pair, the person's assistant can read the team's questions waiting on them and s
 Steering. The caller's seat is never taken for a person: without `person`, the `question` pair offers nothing, and an
 unusable `person` withholds only these two tools while the grant's other tools keep working.
 
-- **Register the person** on the instance, once: `rig gateway human add <entity_id> --display-name "<name>" --default`.
+- **Register the person** on the instance, once:
+  `rig gateway human add <entity_id> --display-name "<name>" --delivery-class B --default`.
   Without `--binding`, they're asked in the Feed and on Steering only. As the default person, today's asks addressed to no
   registered person (such as `human@host`) are theirs too.
 - **`rig_question_list`** shows what Steering shows that person as answerable: an ask addressed to them, or a row parked on
@@ -179,5 +190,6 @@ unusable `person` withholds only these two tools while the grant's other tools k
 ## Limits today
 
 - **Webhook triggers only:** OpenRig rings a webhook. Email and other triggers aren't supported yet. A member without a trigger
-  isn't rung, and its person is told instead.
+  isn't rung; work it leaves unclaimed past the unclaimed age is listed in one notice instead, which goes to its person, else
+  its rows' shared creator, the operator agent or the member itself.
 - **It can't act as a person:** it works rows addressed to its seat, a person's request to it included. It can't settle an ask addressed to a person, or hand work to one, except through a grant service's grant that names its person, which records that person's own answers (above).

docs/reference/keeping-a-watch.md

@@ -59,7 +59,9 @@ rig queue block <task> --on external:<what you check> --wake-after 1h \
 ```
 
 `--on` is always required; `external:<what>` names the outside thing you're waiting on. The timer first fires after
-the interval, not now.
+the interval, not now. Left without `--wake-after` (or `--wake-watchdog`), the task is still set aside, but nothing
+will wake you, and the reply says so with a `park_without_wake` advisory. Set it aside again with `--wake-after` to add
+the timer.
 
 **4. Say back what you set, in one or two plain lines:** what you'll check, how often, how they'll be told, and when
 it stops. For example: "I'll check the release PR every hour and message you here once it merges. Then I'll stop."

docs/reference/queue-erasure.md

@@ -0,0 +1,161 @@
+# Queue erasure: closed-work retention and account deletion
+
+A daemon that serves several accounts sometimes needs to remove queue content for good: closed work after its retention window, or everything that belongs to an account when the account is deleted. `rig queue erase` and three retention settings do that.
+
+Erasure can't be undone. Run every scope as a dry run first, without `--apply`. The dry run prints exactly what `--apply` would erase and changes nothing.
+
+## What is erased
+
+A queue row is erased in one of two ways:
+
+- **Scrub.** The row's content is removed, and the row itself stays, marked `contentErasedAt`. A retried create with the same id still finds the row, so it makes no new work. If anything writes to the row after its scrub (a note, a summary, a reopen and close), the next run erases that content too.
+- **Delete.** The row and everything linked to it are removed. Only its id is kept, in an erased-id record with no endpoints and no content. A later create that reuses the id is refused with `qitem_erased` (409), so a retried or forwarded create can't bring the work back.
+
+| A scrub clears | A scrub keeps |
+|---|---|
+| body, summary, resolution, tags, blocker text, chain of record, evidence reference, human detail, questions and answers, delegated decision, the input-box reading | id, source and destination, state, priority, tier, times, closure reason, handoff links |
+| a closure's target when it's a reason or note, in the row, both transition tables and events. That's every target under a reason other than the two at right, and any target under those two that isn't a session address or a queue id | a closure's target that names a successor: under `handed_off_to` or `superseded`, shaped as a session address (`member@rig`, optionally `@host`) or a queue id (`qitem-…`) |
+| transition notes and recorded principals, live and archived | each transition's state, actor and time |
+| events' `summary`, `reason` and `error` (the event keeps its type and ids, marked `contentErased`) | |
+| mission-control audit text and snapshots | |
+
+**The row's own copies go with it:**
+- its transitions;
+- events whose payload names it;
+- its mission-control audit rows.
+
+**Copies held with someone else go only when they're the owner's.** These are outbox and inbox entries that point at the row or wake for it, and stream reader actions and dispositions that name it (including `duplicate_of`). For account deletion, the owner is the account: both of a copy's sessions must be members. Otherwise the owner is the row's own source and destination. Any other copy is kept and listed under `keptCopies`:
+- `mixed`: one of its sessions is the owner's;
+- `foreign`: none of them are.
+
+**A row a workflow still references is never erased.** That covers a step trail, a frontier binding, a failure record, or a live instance's frontier. It's reported under `gaps` with the code `workflow-reference`.
+
+## Scopes
+
+Name exactly one.
+
+| Scope | Erases | Action |
+|---|---|---|
+| `--members <file>` | Account deletion. Every row whose source and destination are both in the file, in any state, open work included. Add `--rig <id>` for the account rig's own records | delete |
+| `--ids <file>` | Exactly the listed rows. A report's `qitems` entries, or a ledger's lines, keep each entry's own action. A ledger's entries are replayed only for the batches that committed (below) | `--action delete` (default for plain ids) or `--action scrub` |
+| `--routine` | Closed rows past this daemon's retention windows (below) | scrub, then delete |
+
+A file is one entry per line (blank lines and `#` comments are skipped; a line starting with `{` is a JSON entry) or a JSON array.
+
+**Account deletion is exact.**
+- The members file is the account's recorded membership: the exact session names of its seats, including departed ones. List every address form the account used, such as a host-suffixed form. Names are compared as given, never by pattern, so a row addressed through an unlisted form is neither erased nor reported.
+- **Mixed rows:** a row with exactly one member endpoint is reported under `mixed` (with which endpoint is the member) and left untouched. Deciding who owns it is a separate decision. A row rerouted out of the account while the run is under way (by a fallback, say) is kept too, and reported as `changed-during-run`.
+- **After the rows:** account deletion also removes outbox and inbox entries between two members that no row owns, and the members' stream items. An entry with one member endpoint, or a stream item something still references, is counted and left.
+
+**The account's rig.** A rig's own records outlive the rig. Events are kept past rig and node deletion by design, and snapshots, node and seat records and watchdog jobs have no key that cascades. `--rig <id>`, given with `--members`, erases them:
+- the rig's events, including those of its nodes;
+- snapshots, operation correlations and bootstrap runs;
+- seat identity verdicts, delivery-guard changes, environment bindings and usage records for its nodes and member sessions;
+- watchdog jobs aimed at a member, with their history;
+- stream subscriptions and thread maps of member sessions.
+
+Records that name the account but also belong elsewhere are counted under `rig.left` and kept. These are a member's watchdog job aimed outside the account, a workflow instance or spec bound to the rig, classifier leases and custom views.
+- **While the rig exists,** its sessions and the members must match both ways, or the run is refused (`erase_rig_mismatch`). Every member's session name must carry the rig's name (departed members included), and every current session of the rig must be a member, so the rig holds no one else's seat.
+- **On that verified run,** the rig's id and name are recorded with a digest of the membership.
+- **Once the rig is removed,** the same command, with the same membership, uses that record to erase what's left under the rig's id. This includes the events the removal wrote, and the record still lets it count records bound to the rig's name.
+- **When nothing of the rig is left,** the record becomes a completion receipt: the rig's name is cleared, and its id, the membership digest and the time stay. An identical rerun, after a lost response say, still verifies and reports the same clean result, with `rig.completedAt`. The receipt is kept for good. It holds no content.
+- **A removed rig's id that was never verified** with this membership erases nothing keyed by it. Those records are counted under `rig.left`, the name-bound tables are listed under `rig.unknown`, and the run isn't clean.
+
+**Retention windows** (`rig config set …`, read at the daily sweep and at daemon start):
+
+| Setting | Default | Effect |
+|---|---|---|
+| `retention.closed_content_days` | `0` (off) | Scrub closed rows this many days after they closed |
+| `retention.closed_metadata_days` | `0` (off) | Delete closed rows, keeping only their ids, this many days after they closed |
+| `retention.erasure_ledger` | empty (none) | An absolute file path, on local disk, since each batch appends to it while it holds the daemon. Every applied erasure, by the sweep or the command, appends each row's id, action and batch id there, one JSON line each, before anything in its batch changes, then a commit line once the batch commits (an abort line if it rolls back). A path that can't be written stops the run before it changes anything |
+
+- **Closed** means `done`, `canceled`, `denied` or `handed-off`. `failed` and open work are never touched by the windows.
+- **Age:** a row's age counts from when it entered its final closed state. A note on a closed row doesn't restart it, and a row reopened and closed again counts from its latest close.
+- **Running them now:** `rig queue erase --routine --apply` runs the windows immediately. `retention.enabled false` turns off the whole sweep, these windows included.
+- **When the sweep's erasure stops on an error,** that's logged, and the sweep's other passes still run.
+
+## Account deletion, in order
+
+1. Revoke the account's access.
+2. Keep its exact membership list and rig id.
+3. Run `rig queue erase --members <file> --rig <id>` as a dry run, then with `--apply`. Rerun until `complete` is true.
+4. Remove the rig.
+5. Rerun the same command with `--apply`, to erase the records the removal wrote.
+6. The account is deleted only when the report's `clean` is true. Otherwise its `mixed`, `gaps`, `keptCopies`, `unlinked` and `rig.left` or `rig.unknown` entries need a decision. Rerunning won't resolve them.
+
+## Output
+
+The command prints one JSON report (`--json` makes it a single line):
+
+| Field | Meaning |
+|---|---|
+| `applied` | `false` for a dry run |
+| `complete` | the run finished. `false` when it stopped at its batch limit or on an error; rerun the same command to continue |
+| `clean` | `complete`, and nothing was left: no `mixed` rows, mixed `keptCopies`, `gaps`, `unreadableEvents`, left-over entries, or rig records left or unknown. Only a clean report means the scope is fully erased. It's about this run's scope: a routine or members run's `clean` isn't affected by the ledger's other batches, and only a replay (`--ids` with a ledger) reports a batch it can't show committed, as the gap `ledger-unresolved` |
+| `error` | why the run stopped (`stage` and `message`). Everything listed in `qitems` was committed before it; the command exits 2 |
+| `qitems` | each row erased (or that would be), with its `action` and `state` |
+| `mixed` | members scope: rows with one member endpoint, left untouched |
+| `keptCopies` | copies of erased rows held with someone else, kept: `table`, `id`, `qitemId`, `ownership` (`mixed` or `foreign`) |
+| `gaps` | rows not erased and why: `workflow-reference`; `not-found` for an id to scrub that doesn't exist; `changed-during-run` for a row that no longer qualified when its batch ran (reopened, rerouted out of the account, or written to so it left its window) or an absent id created since selection; `unreadable-event` for a row an unreadable event names; `ledger-unresolved` for a replayed entry whose batch can't be shown to have committed |
+| `skipped` | ids scope, a ledger replay: entries whose batch rolled back, with the batch id; not replayed |
+| `ledger` | an applied run with a ledger: batches whose missing commit line it wrote from the database's record (`reconciled`) |
+| `alreadyAbsent` | ids to delete with no row; their erased-id record is written (again), and they're listed once it's committed. They're rechecked as the record is written, so an id created during the run is reported as `changed-during-run` instead |
+| `unreadableEvents` | events naming a selected row whose payload can't be read: `seq` and the row ids found in its text. They're kept, since what they hold can't be inspected, and so are the rows they name, so every rerun reports them again until the event is repaired or removed. The run isn't clean |
+| `linked` | counts of the copies erased with the rows |
+| `unlinked` | members scope: entries and stream items erased that no row owned, plus those left (`mixedEntries`, `referencedStreamItems`) |
+| `rig` | members scope with `--rig`: `found`, `verified`, records erased per table (`erased`, counted as each chunk commits), records left (`left`), tables that can't be counted (`unknown`), and `completedAt` once the rig's erasure is complete |
+
+**How a run works:**
+- **Selection:** a run selects everything first and writes nothing.
+- **Events:** it reads the events table once, in small windows, to find each row's events.
+- **Batches:** each batch, of up to 100 rows, is one transaction. It rechecks its rows, writes their ledger lines, then changes their events, copies and rows.
+  - **The recheck drops** a row that a workflow has taken up, or that an unreadable event names. For account deletion, it also drops a row that is no longer between two members. For a routine run, it drops one that was reopened or no longer falls in the same window.
+  - **Each dropped row** is reported in `gaps`.
+  - **The current endpoints** decide whose its copies are.
+- **How long it holds the daemon:** the batch caps rows, not events or copies, so a row with many of either makes its batch longer. On a copy of a store with 2.4 million events, the longest single hold in a first routine run was about 0.25 s. With a ledger, a run doesn't read the ledger file: it reads the end of the file (one byte) and the database's record of batches still missing a commit line, so the ledger's size doesn't add to the hold.
+- **Stopping:** a run that stops leaves whole batches done, events included. A rerun picks up the rest, and erasing a row a second time changes nothing.
+- **Ledger lines and commits:** a batch's lines are written before its first change, so they can name rows that a rolled-back batch never erased. Each batch therefore also records its id in the database, in its own transaction, and appends a commit line (`{"batch": …, "committed": true}`) after it commits, or an abort line (`"committed": false`) when it rolls back.
+  - **A missing commit line:** a run that can't write one stops once the committed batch is reported. The database's record notes when each batch's commit line was written. Each applied run with a ledger writes the commit line for any recorded batch still without one, from the record alone, without reading the ledger file. It lists those under `ledger.reconciled`.
+  - **Neither line nor record:** a batch with neither, such as one whose transaction was cut off by a crash, is never decided from the database: on a restored database, a batch committed after the backup looks exactly like one that rolled back. A replay reports its entries as `ledger-unresolved` and doesn't apply them, until an operator resolves it by appending its commit or abort line once they know which.
+  - **A line cut short:** a full disk, say, can cut a line short. Each run starts the ledger on a fresh line first, so the cut line can't fuse with the next one. A replay refuses the file until that line is deleted. That's safe: an entry line's batch rolled back when its write failed, and a commit line is written again from the record.
+
+**Refusals**, with nothing erased:
+
+| Code | Cause |
+|---|---|
+| `erase_scope_required` | no scope named |
+| `erase_scope_conflict` | more than one scope |
+| `erase_members_invalid` | an empty list, or names with surrounding spaces |
+| `erase_rig_invalid` | a rig without `--members`, or an empty rig id |
+| `erase_rig_mismatch` | the rig exists, and its sessions and the members don't match both ways |
+| `erase_ids_invalid` | an empty ids list, or ids with surrounding spaces |
+| `erase_action_invalid` | an action other than `delete` or `scrub` |
+| `erase_routine_off` | both windows are `0` |
+
+The command records who ran it from `OPENRIG_SESSION_NAME`, or from `--actor <session>` when that isn't set.
+
+## Restores and backups
+
+A restored database can bring erased content back: rows, copies, rig records and the erased-id records themselves. It can even bring back a row that was still open when the backup was taken and was closed and erased later. Before a restored daemon serves anyone, replay what was erased after the backup was taken:
+
+1. **Keep a ledger.** Set `retention.erasure_ledger` to a file outside the backed-up data. Every applied erasure appends its ids, actions and batch there before changing anything, and a commit line once the batch commits. That covers the daily windows, `--routine`, `--ids` and account deletion's rows.
+2. **Replay the ledger:** `rig queue erase --ids <ledger> --apply`. It replays exactly the batches that committed, each line with its own action, so a scrub is replayed as a scrub, never promoted to a deletion.
+   - **What's replayed:** a row that was open in the backup and erased later is erased by its id, and other open work isn't touched.
+   - **What's skipped:** a batch with an abort line was never erased, and is listed under `skipped`.
+   - **What's left:** a batch with neither line, which the restored database doesn't record either, is reported as `ledger-unresolved` and not replayed. The run isn't clean until an operator decides it.
+3. **Replay account deletions:** rerun `rig queue erase --members <file> --rig <id> --apply` for each account deleted since the backup, from its membership list and rig id. Keep those outside the backed-up data until every backup taken before the deletion has expired. This also covers the copies and rig records the ledger doesn't list.
+4. **Rerun the windows:** `rig queue erase --routine --apply`.
+
+Backup expiry is the deployment's own schedule. Content erased from the live database stays in backups until they expire.
+
+## What this doesn't cover
+
+These stores need their own handling where a deployment uses them:
+- terminal transcripts;
+- daemon and service logs;
+- gateway and Slack stores and Slack's own copies;
+- downloaded files and artifacts;
+- chat messages (removed with their rig);
+- events tied neither to a row nor to the account's rig.
+
+The rig itself (its nodes, sessions and bindings) is removed by removing the rig, between the two runs above.

docs/reference/rig-spec.md

@@ -587,9 +587,13 @@ rig provider switch --seat pi-worker@my-rig --to-account work \
 rig provider switch --seat pi-worker@my-rig --clear-account-home --reason "Return to configured login"
 ```
 
+When switching into Pi with `--clear-account-home`, OpenRig restores the seat's original Pi login only if no effective member or rig Pi account home is configured. A member's `PI_CODING_AGENT_DIR` shadows the rig's value; if the member value is relative, it is ignored and the rig home does not take effect.
+
 Pi account changes work with or without `launch_wrapper`. The wrapper receives the successor's managed Pi directory;
-it must preserve the selected credentials if you want OpenRig's account choice to apply. Switching a seat between Pi
-and another runtime is not supported by this account-home feature.
+it must preserve the selected credentials if you want OpenRig's account choice to apply.
+Use `rig seat set-runtime <seat> --runtime <runtime> --reason "Change provider"` with `pi`, `codex` or `claude-code` for cross-runtime switches.
+Those resolve the target's settings afresh rather than keeping the source model or effort;
+see [runtime switching](getting-started.md#move-a-seat-to-the-other-runtime).
 
 This switch starts a fresh conversation with a handover, even when the runtime stays the same. The existing
 subscription-login switch preserves the conversation. Once the successor confirms, OpenRig commits its home, runtime,
@@ -691,7 +695,7 @@ first turn. Check `/status` after a real tool turn to confirm the authentication
 
 For Codex, a saved native API-key login is selected with the existing `--to-account <name>`
 path, exactly like a saved subscription login. Prepare it using native `codex login --with-api-key`
-with the key on stdin, then `rig auth save --codex-home <home> <name>`; never put a key in argv.
+with the key on stdin, then `CODEX_HOME=<home> rig auth save <name>`; never put a key in argv.
 Use the seat's existing home. Preparing a login replaces that home's active credentials, so do it
 before running seats there, or prepare/import a native auth profile separately. Switches preserve
 an outgoing credential copy and report peers sharing the home. A native keyring or administrator
@@ -779,7 +783,7 @@ directory's `CLAUDE.md`, including blocks written by other rigs.
 | `effort` | string | no | — | Reasoning effort override, trimmed. Claude gets `--effort`, Codex `-c model_reasoning_effort=…`, Pi `--thinking` (see "Pi" below). A non-string value is ignored with an advisory. |
 | `advisor` | string | no | — | Claude-only Advisor model for this seat. Overrides the AgentSpec profile/default; blank or non-string values are ignored with an advisory. |
 | `claude_mcp` | `none` | no | normal loading | Claude members only. Disable MCP server loading for this agent on every launch and resume. Omit the field to keep Claude's normal configuration; see [Claude MCP loading](#claude-mcp-loading-runtime-claude-code). |
-| `launch_wrapper` | string[] | no | — | Local built-in `pi`, `codex` and `claude-code` members only. Literal argument prefix applied to the native executable and its arguments on fresh launch, relaunch, rebuild, resume, fork, restore and handover; `[]` explicitly clears a stored wrapper when re-applying an authored spec, while omitting the key leaves an existing seat's stored choice unchanged. See [Launch wrapper](#launch-wrapper-runtime-pi-and-codex). |
+| `launch_wrapper` | string[] | no | — | Local `pi`, `codex`, `claude-code` and community-harness members; runner presets must declare wrapper support. Literal argument prefix applied to the native executable and its arguments on fresh launch, relaunch, rebuild, resume, fork, restore and handover; `[]` explicitly clears a stored wrapper when re-applying an authored spec, while omitting the key leaves an existing seat's stored choice unchanged. See [Launch wrapper](#launch-wrapper-runtime-pi-and-codex). |
 | `permission_policy` | string | no | — | Member-level permission policy; overrides the rig's. Not valid on terminal members. |
 | `env` | map | no | — | Launch environment for this seat, laid over the rig's `env`. Same rules as the rig-level field. Valid on terminal members too. See "Launch environment" below. |
 | `agent_file` | string | no | — | Claude members only. A Claude agent definition (a `.md` file with `name` in its frontmatter) for this seat. It's copied into the seat's own storage and launched as `--agent openrig:<name>`. A path beside the spec: no `..`, not absolute. |
@@ -917,9 +921,11 @@ This requires a Claude Code version that supports `--advisor`. OpenRig never wri
 choose different Advisors. When Advisor is unset, no flag is emitted and Claude's
 own defaults/settings apply. Other runtimes ignore this field.
 
-### Launch wrapper (`runtime: pi` and `codex`)
+<a id="launch-wrapper-runtime-pi-and-codex"></a>
 
-Set `launch_wrapper` on a local built-in `pi`, `codex` or `claude-code` member to prefix its native executable and arguments with a literal argv vector:
+### Launch wrapper (`runtime: pi`, `codex` and `claude-code`)
+
+Set `launch_wrapper` on a local `pi`, `codex`, `claude-code` or community-harness member to prefix its native executable and arguments with a literal argv vector:
 
 ```yaml
 members:
@@ -931,7 +937,7 @@ members:
     launch_wrapper: ["launcher", "exec", "--profile", "seat-a", "--"]
 ```
 
-- **Scope and literal argv:** Local built-in `pi`, `codex` and `claude-code` members, including legacy flat nodes, support `launch_wrapper`; other runtimes reject it, including `[]`. Each fork uses its target member's own selection. Arguments are literal strings without NUL, CR or LF; spaces, quotes, metacharacters and empty non-executable arguments are preserved.
+- **Scope and literal argv:** Local `pi`, `codex`, `claude-code` and supported community-harness members support `launch_wrapper`; legacy flat nodes support it only on `pi`, `codex` and `claude-code`. Other runtimes, including the maintained `openshell-claude` environment path, reject it, including `[]`. Community preset capability and execution requirements are defined in the [runner contract](harness-runner-contract.md#2-declare-it-what-the-preset-says-fixed-at-launch). Each fork uses its target member's own selection. Arguments are literal strings without NUL, CR or LF; spaces, quotes, metacharacters and empty non-executable arguments are preserved.
 - **Executable resolution:** `launch_wrapper[0]` must be an absolute path or bare command name. Preflight and launch resolve it using the daemon's launch `PATH` and working directory, before adding the seat's `rig` bin directory. Relative paths containing `/`, aliases and functions are unsupported for the wrapper itself.
 - **Native child and `exec` contract:** The wrapper prefixes the resolved Codex entry, prefixes the resolved Pi child executable inside the host runner, or prefixes the real Claude executable and native arguments. Managed Claude applies it after rebuilding the environment; pinned continuations retain their executable. The wrapper must `exec` its child in place, preserving working directory, environment, signals, exit status and TTY stdio (Claude/Codex) or RPC pipes (Pi). Supervising wrappers are unsupported.
 - **Classic Claude lookup:** Wrapped classic launch supports bash, zsh, sh and dash and requires `command -v claude` to resolve to an executable file; aliases and functions refuse with `launch_wrapper unavailable; no agent started.` To keep custom flags or environment, put them in a `#!` script named `claude` on `PATH`; the wrapper runs that script ([#1477](https://github.com/mvschwarz/openrig/issues/1477)).
@@ -1015,7 +1021,7 @@ This is human-authored (you choose the pod/member IDs) and system-validated (the
 | `spawned_by` | Source was spawned by target; the target launches first. Constrains launch order. | Child → parent in hierarchical topologies |
 | `can_observe` | Source can observe target's output. Does NOT constrain launch order. | Reviewer → implementer, monitor → worker |
 | `collaborates_with` | Peer collaboration relationship. Does NOT constrain launch order. | Co-equal peers working together |
-| `escalates_to` | Fallback queue escalation for a seat without a declared delegation parent. Does NOT constrain launch order. | Local member or same-daemon `pod-member@rig` address |
+| `escalates_to` | Fallback queue escalation for a seat without a single declared delegation parent (none, or several). Does NOT constrain launch order. | Local member or same-daemon `pod-member@rig` address |
 
 A named `escalates_to` target may be in another rig on the same daemon and need not exist at import time.
 See [fallback escalation across rigs](edge-types.md#fallback-escalation-across-rigs) for precedence, single-hop delivery,
@@ -1358,7 +1364,7 @@ spec can pass `rig spec validate` and then fail at preflight or import. Run
 24. Startup action `idempotent` is a required boolean.
 25. Non-idempotent actions must not include `restore` in `applies_on`.
 26. `applies_on` values must be from: `fresh_start`, `restore`.
-27. `launch_wrapper` is valid only on `pi`, `codex` and `claude-code` members (`[]` included); it must be an array of strings without NUL/CR/LF, and `launch_wrapper[0]` (when non-empty) must be an absolute path or a bare command name on the daemon `PATH`.
+27. `launch_wrapper` is valid on `pi`, `codex`, `claude-code` and supported community-harness members (`[]` included); see the [runner contract](harness-runner-contract.md#2-declare-it-what-the-preset-says-fixed-at-launch) for community capability requirements. It must be an array of strings without NUL/CR/LF, and `launch_wrapper[0]` (when non-empty) must be an absolute path or a bare command name on the daemon `PATH`.
 
 ---
 

docs/reference/runner-conformance/README.md

@@ -13,6 +13,8 @@ node check-runner.mjs --runner 'my-runner --agent-command {agent}' --name my-har
 - **`--name`** is your preset's name, which your posts carry as `runtime`.
 - **`--resume` and `--first-input`** say your preset declares `resume: true` and `first_input: true`. Without them,
   those cases are skipped, because OpenRig wouldn't pass that input.
+- **`--launch-wrapper`** says your preset declares `launch_wrapper: true` and enables case 10 from the
+  [runner contract](../harness-runner-contract.md#2-declare-it-what-the-preset-says-fixed-at-launch).
 - **`--cases 2,4`** runs only some cases. `--json` prints a machine-readable report. `--keep` keeps each launch's
   folder: the agent's message log, the launch record and the scenario.
 - **`--wait-ms 20000`** waits longer for each step (default 8000), for a runner whose agent takes a while to start. The check's shorter settling times, and the fake agent's own delays and holds, grow in proportion.
@@ -62,6 +64,7 @@ In an installed OpenRig, the check is at `$(npm root -g)/@openrig/cli/daemon/doc
 | 7c | 9 | **Advisory.** Closing the pane ends the agent process. Section 9 marks this duty as proposed, and lets a runner list in `limits` what may keep running, so this result is shown as met or not met and never counts as a pass or a fail, or toward the exit status. The fake agent outlives a hangup here, so the runner has to end it |
 | 8 | 7 | An unknown request from the agent gets JSON-RPC `-32601`, and the next prompt still goes through |
 | 9 | 9 | `OPENRIG_FIRST_INPUT`'s exact bytes, newlines and spaces included, are the first prompt |
+| 10 | 2 | The native child runs through the configured wrapper, preserving literal arguments, without inheriting the runner's wrapper handoff |
 
 ## What it doesn't check
 

docs/reference/runner-conformance/check-runner.mjs

@@ -6,12 +6,12 @@
 //   - a small local endpoint stands in for OpenRig's activity route, and records what your runner posts;
 //   - input arrives the way `rig send` delivers it: one bracketed paste with raw newlines, then Enter.
 //
-//   node check-runner.mjs --runner '<command>' [--name <preset name>] [--resume] [--first-input]
+//   node check-runner.mjs --runner '<command>' [--name <preset name>] [--resume] [--first-input] [--launch-wrapper]
 //                         [--cases 1,2,4] [--wait-ms 8000] [--pass-env NAME] [--json] [--keep]
 //
 // `{agent}` in the command is replaced with the fake agent's path, an executable that takes any arguments your runner
 // adds. For example: --runner 'my-runner --agent-command {agent}'. --resume and --first-input say your preset declares
-// `resume: true` and `first_input: true`; without them those cases are skipped, since OpenRig wouldn't pass that input.
+// `resume: true` and `first_input: true`; --launch-wrapper declares `launch_wrapper: true`. Without a declaration, its case is skipped.
 // The runner gets a clean environment: PATH, HOME, USER, SHELL, LANG and TMPDIR, the OpenRig variables, and any
 // --pass-env names. Exit status: 0 when nothing fails, 1 when a case fails, 2 for a usage or setup problem.
 //
@@ -27,10 +27,10 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const here = dirname(fileURLToPath(import.meta.url));
-const usage = "usage: node check-runner.mjs --runner '<command with {agent}>' [--name <preset>] [--resume] [--first-input] [--cases 1,2] [--wait-ms 8000] [--pass-env NAME] [--json] [--keep]";
+const usage = "usage: node check-runner.mjs --runner '<command with {agent}>' [--name <preset>] [--resume] [--first-input] [--launch-wrapper] [--cases 1,2] [--wait-ms 8000] [--pass-env NAME] [--json] [--keep]";
 
 function parseArgs(argv) {
-  const opts = { name: "runner", cases: undefined, passEnv: [], resume: false, firstInput: false, json: false, keep: false, waitMs: 8000 };
+  const opts = { name: "runner", cases: undefined, passEnv: [], resume: false, firstInput: false, launchWrapper: false, json: false, keep: false, waitMs: 8000 };
   for (let i = 0; i < argv.length; i += 1) {
     const flag = argv[i];
     const value = () => { if (i + 1 >= argv.length) throw new Error(`${flag} needs a value`); return argv[++i]; };
@@ -41,6 +41,7 @@ function parseArgs(argv) {
     else if (flag === "--wait-ms") opts.waitMs = Number(value());
     else if (flag === "--resume") opts.resume = true;
     else if (flag === "--first-input") opts.firstInput = true;
+    else if (flag === "--launch-wrapper") opts.launchWrapper = true;
     else if (flag === "--json") opts.json = true;
     else if (flag === "--keep") opts.keep = true;
     else throw new Error(`unknown option ${flag}`);
@@ -178,7 +179,7 @@ await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
 const base = `http://127.0.0.1:${server.address().port}`;
 
 const launches = [];
-async function launch(label, { scenario = {}, env = {}, asks } = {}) {
+async function launch(label, { scenario = {}, env = {}, asks, launchWrapper = false } = {}) {
   const dir = mkdtempSync(join(tmpdir(), `runner-check-${label}-`));
   const cwd = join(dir, "work");
   mkdirSync(cwd);
@@ -196,6 +197,13 @@ async function launch(label, { scenario = {}, env = {}, asks } = {}) {
   const agent = join(dir, "agent");
   writeFileSync(agent, `#!/bin/sh\nexec ${sh(process.execPath)} ${sh(join(here, "fake-acp-agent.mjs"))} --scenario ${sh(join(dir, "scenario.json"))} --log ${sh(h.agentLog)} "$@"\n`);
   chmodSync(agent, 0o755);
+  h.agent = agent;
+  if (launchWrapper) {
+    h.wrapperLog = join(dir, "wrapper.json");
+    const wrapper = join(dir, "wrapper.sh");
+    writeFileSync(wrapper, `#!/bin/sh\nrecord=$1\ntag=$2\nseparator=$3\nshift 3\n${sh(process.execPath)} -e 'const [file, tag, separator, ...argv] = process.argv.slice(1); require("node:fs").writeFileSync(file, JSON.stringify({tag, separator, argv, launchWrapper: process.env.OPENRIG_LAUNCH_WRAPPER ?? null}));' "$record" "$tag" "$separator" "$@"\nexec "$@"\n`);
+    env = { ...env, OPENRIG_LAUNCH_WRAPPER: JSON.stringify(["/bin/sh", wrapper, h.wrapperLog, "literal ' $ ; space", "--"]) };
+  }
   const vars = {
     PATH: process.env.PATH, HOME: process.env.HOME, USER: process.env.USER, SHELL: process.env.SHELL, LANG: process.env.LANG,
     TMPDIR: process.env.TMPDIR, TERM: "xterm-256color",
@@ -781,9 +789,22 @@ const cases = {
     if (!opts.keep) rmSync(dir, { recursive: true, force: true });
     return r;
   },
+  async "10"() {
+    const r = result("10", "Launch wrapper: the runner wraps its native child and scrubs the handoff environment");
+    if (!opts.launchWrapper) return r.skip("the preset doesn't declare launch_wrapper (--launch-wrapper): OpenRig passes no OPENRIG_LAUNCH_WRAPPER");
+    const h = await launch("10", { launchWrapper: true });
+    r.check("the wrapped child opens its conversation", await ready(h), "no launch record");
+    const seen = existsSync(h.wrapperLog) ? JSON.parse(readFileSync(h.wrapperLog, "utf8")) : undefined;
+    r.check("the wrapper receives literal arguments and the native child command", seen?.tag === "literal ' $ ; space" && seen?.separator === "--"
+      && seen?.argv?.[0] === h.agent, JSON.stringify(seen ?? null));
+    r.check("OPENRIG_LAUNCH_WRAPPER is absent from the wrapper and child environment", seen?.launchWrapper === null
+      && h.events("started")[0]?.launchWrapper === null, "wrapper handoff leaked to native child");
+    return r;
+  },
+
 };
 
-const order = ["1", "1b", "2", "3", "3b", "4", "4b", "4c", "5", "6", "7", "7b", "7c", "8", "9"];
+const order = ["1", "1b", "2", "3", "3b", "4", "4b", "4c", "5", "6", "7", "7b", "7c", "8", "9", "10"];
 const selected = opts.cases ?? order;
 const unknown = selected.filter((id) => !order.includes(id));
 if (unknown.length) { console.error(`unknown case ${unknown.join(", ")}; cases are ${order.join(", ")}`); process.exit(2); }

docs/reference/runner-conformance/fake-acp-agent.mjs

@@ -42,7 +42,7 @@ const fail = (id, code, message) => send({ jsonrpc: "2.0", id, error: { code, me
 const exit = (status, why) => { log({ dir: "event", event: "exit", status, why }); process.exit(status); };
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
-log({ dir: "event", event: "started", pid: process.pid, cwd: process.cwd(), argv: process.argv.slice(2) });
+log({ dir: "event", event: "started", pid: process.pid, cwd: process.cwd(), argv: process.argv.slice(2), launchWrapper: process.env.OPENRIG_LAUNCH_WRAPPER ?? null });
 // Ctrl-C is the runner's to handle, so the agent never takes it as a signal. A stubborn agent also outlives a hangup and
 // its input closing, as some real agents do: only the runner ending it (SIGTERM or SIGKILL) stops it.
 process.on("SIGINT", () => log({ dir: "event", event: "signal", signal: "SIGINT" }));

docs/reference/sdlc-conventions.md

@@ -161,10 +161,25 @@ or `pending`, `draft`. A word that matches none of these counts as `active`, so
 slice marked `complete` counts as `active`. A slice with no `status:` counts as
 `draft`.
 
+`rig view show execution` shows the slice's own `status:` word (from its
+`SPEC.md`, or a legacy `README.md`) and that word's bucket beside each slice's
+ladder as `recorded_status` (`word: null` when there's none). Like the scopes
+views, it never reads `PROGRESS.md`; `GET /api/slices` lets a `status:` in
+`PROGRESS.md` frontmatter override the node file's. It's the team's record, not
+verified, so it never turns a rung true or makes a slice next-up.
+The ladder's rungs read Part B records: plan lock, `candidate:<sha>` rows, review
+artifacts and an EC-3 `worktree_path=` row. On this flow they read `INDETERMINATE`
+(plan lock reads `false`), and `q4_records` says once for the mission that no
+build is recorded. Built means a Git commit, so work that isn't a commit never
+reads built.
+
 When the owning scope selects `proofPolicy.judges`, use `rig proof judge` to
 record an attributed accept, reject or withdraw decision on a contract item,
 and `rig proof show` to read derived readiness up through slice, mission and
-project. The nearest slice, mission or project policy selects authorized judges;
+project. The nearest slice, mission or project policy selects authorized judges.
+By default an item's latest judgment from any of them decides it; with
+`proofPolicy.everyJudge: true`, every listed judge's own current accept is
+required, and `rig proof show` lists each judge's own latest judgment either way.
 `rig proof --help` describes setup, selectors and evidence requirements. In a
 multi-project workspace catalog, name the project with `--project <id>` or a
 `<id>:` scope prefix (`alpha:m0/slices/01-t001`); unqualified scopes use the

docs/reference/seat-delivery.md

@@ -153,12 +153,16 @@ drive a recognized native menu as before. Otherwise, with the delivery guard
 attached, it reads the visible composer under the seat's lease immediately before
 pasting, after buffer preparation. Empty input proceeds. A recognized dim
 suggestion is displayed separately and counts as empty; typed or pasted text
-(author unknown) stops the send with `override_input_present`. An unreadable input
-stops with `override_input_unknown`, never an empty-input claim. Both return single-send HTTP
+(author unknown) stops the send with `override_input_present`: single-send HTTP
 409, `sent: false`, and caller-only `existingInput` evidence (visible rows, suggestion
 rows, cursor/dimensions and target binding). A collapsed paste shows its label,
 not the hidden contents. OpenRig neither holds nor retries this stopped override.
 
+An input that can't be read doesn't stop the override. The answer is typed and
+nothing is cleared. The result reports `existingInput` with classification
+`unreadable`, never empty, and a warning that the answer may join or submit
+existing text.
+
 Inspect the shown input in the native terminal, deliberately clear the prompt with
 native/tmux controls, then issue the send again. Manual clearing runs outside
 OpenRig's lease and observation checks and is not recorded. For a deliberate
@@ -356,7 +360,10 @@ accounting. Historical outbox receipts do not suppress a lone reminder or preven
 message tells its recipient that delivery may repeat after an unconfirmed attempt. Its job history records the
 current transport result; an unknown write is not proof that nothing arrived.
 
-The transport still protects approval/question prompts, human drafts and recipient identity. Scheduler timing,
+The transport still protects approval/question prompts and recipient identity. Under the default
+`transport.draft_delivery` (`deliver`), an ordinary send or work notice that meets a person's draft at a Claude Code or
+Codex prompt is pasted into it and the combined input is submitted, unless the seat's typing guard holds input
+(`draft-aware`, `openrig-urgent`, `urgent-only` or `hold`). With `refuse`, a draft refuses the send. Scheduler timing,
 current parked-row eligibility and stop checks still apply. This changes message retries, not the idempotence of
 structured continuity actions such as creating a cutover baton.
 

docs/reference/slack-app-setup.md

@@ -66,7 +66,14 @@ not fill in; if so, follow the form.
     asked at RECORD stays on Steering and the Feed without a post. Running it again reuses each ask's
     one decision rather than making another, so an ask whose post is confirmed isn't posted again. As
     with any Slack post, one whose earlier attempt Slack couldn't confirm may post once more, marked as
-    a possible repeat. `--wait <seconds>` (default 10) is how long it waits for Slack receipts.
+    a possible repeat. An ask OpenRig can't fully check still posts, once per gateway run, through the
+    person's delivery rules, so a readable quiet window still holds it. That's an ask whose attempt
+    record can't be read, whose state can't be checked, or whose person's quiet hours can't be read.
+    The Slack post can show "Delivery may repeat after an earlier unconfirmed attempt.", "OpenRig
+    couldn't check that this ask is still open." and "OpenRig couldn't read your quiet hours." These
+    supplementary notes are omitted if they do not fit. The row and command also report when the
+    person's quiet-hours setting couldn't be read. An ask that is no longer open isn't posted. `--wait <seconds>` (default 10) is how long it waits for
+    Slack receipts.
 
 ## What the app asks for
 
@@ -377,11 +384,18 @@ Quiet hours hold a person's routine asks while they're on, and post them once th
   wake-ladder alerts. These reach the person exactly as they would outside quiet. An ask below the posting level is only
   logged, as at any time.
 - **When quiet ends,** each held ask that never started posts once, on its own, with no mention. One that no longer applies
-  isn't posted, and its row says why: it closed, a newer notification replaced it, its recipient changed, or it's now below
-  the posting level.
+  isn't posted, and its row says why: it closed, a newer notification replaced it, its recipient changed, its person has no
+  connector any more (it stays on Steering and the Feed), or it's now below the posting level.
 - **A post that may already be in Slack**, confirmed or only partly sent, isn't held: it finishes as itself, in its own
   thread.
-- **If quiet hours can't be read,** nothing is posted to that person until they can.
+- **If quiet hours can't be read,** that isn't a quiet window. An ask that would post goes to its usual destination with
+  no mention, and the post says "OpenRig couldn't read your quiet hours."; the ask's row records it. The person's other
+  delivery settings still decide: an escalation, a digest, an ask below the posting level, and a quiet window that can be
+  read work as before. This covers ordinary posts and digests, and asks already held for quiet hours: while the quiet
+  hours can't be read, the next release check (within about a minute) posts each of them, with no mention and the same
+  line, even if the window may still be on. The line is supplementary: a post at Slack's text or block limit leaves it
+  out, and the ask's row and `rig slack post-open-asks` still say the quiet hours couldn't be read. A person reached
+  through a relay waits until their quiet hours can be read, as before, because that post can't carry the line.
 
 ## Reconnect recovery and status
 
@@ -405,9 +419,11 @@ budget window when exhausted. Slack's per-method `Retry-After` is retained acros
 Only an acknowledged edit gets a success receipt. `rig slack status` shows queued reconciliation
 and the last edit failure. Transient failures retry with increasing waits, capped at an hour,
 behind other queued work. Permanent Slack failures (such as missing scope, a deleted original,
-an archived channel or an uneditable message) remain unfinished and are retried only on the next
-connector start. They do not keep consuming edit capacity. These edit calls have their own
-budget, separate from missed-message scanning below.
+an archived channel or an uneditable message) remain unfinished. A deleted original is recorded
+on the row and never asked about again; a new post of the same ask is tried afresh. The others,
+which a scope, membership, a different bot token or an upgrade can fix, are retried on the next
+connector start. A message is uneditable when the configured token didn't post it. They do not keep consuming edit capacity. These edit calls have their own budget,
+separate from missed-message scanning below.
 
 The baseline already includes public-channel history access and `chat:write`. Private-channel
 reads may require `groups:history`, which the baseline does not grant; a refused read never
@@ -454,9 +470,18 @@ not covered by that margin. A corrupt or unreadable checkpoint leaves recovery u
 and preserves the existing file; live inbound continues.
 
 Each pass admits at most four history calls, 100 entries and 15 seconds of work, with a
-five-second request ceiling. Channels and threads take turns within that one budget, so with many
-tracked threads each thread is scanned every few passes; `rig slack status` shows how far behind
-the oldest waiting thread is. Work already started on a message, such as
+five-second request ceiling. Channels and threads take turns within that one budget. Each tracked
+thread is scanned once after each start and after each Socket Mode reconnect that followed a gap
+(not a refresh Slack overlaps with the old connection), which catches replies sent while no
+connection was up; replies while connected arrive live. A thread the pass at the connect itself
+reaches is scanned once more, since that pass stops five seconds short of the connect. Those scans go in need order: a thread
+leaving the seven-day window within six hours first, since once it leaves a missed reply is never
+recovered; then threads whose ask still waits on the person (its queue row is pending, in progress
+or blocked) before the rest, each newest first. The order comes from the saved checkpoints, so a
+restart starts with the newest open ask, not the oldest thread. After that a thread is scanned again
+only as a backstop, hourly while its ask waits on the person and daily otherwise. A machine the hub
+relays to can't see a gap in relayed events, so there a settled thread's backstop is three hours. `rig slack status` shows how far behind the oldest waiting thread is and how
+many threads are settled. Work already started on a message, such as
 an attachment transfer, is not cancelled by these limits or by a stop, and a new
 pass waits for it to finish. Rate limits retain Slack's Retry-After across restart, and hold back
 only the method Slack limited (channel history or thread replies).
@@ -465,8 +490,8 @@ When Slack reports a plan history limit, recovery still lands the available page
 and advances normally, retaining an older-history limitation in status across restarts.
 Missing bot credentials, history scope, membership, retention limits and API
 failures appear as recovery limitations. A tracked thread Slack can't find stays incomplete in
-status, with no further call, until its thread mapping changes or the daemon restarts or rewires
-the connector; that isn't proof the thread was deleted. No additional scope is required to keep
+status and is asked again at most once a day, across restarts; that isn't proof the thread was
+deleted. No additional scope is required to keep
 live delivery working. Threads nobody tracks, older open threads, threads closed more than seven
 days ago and other channels remain outside this recovery scope; global chronological order is
 not promised. This change does not replay intervals already checkpointed before broadcast-reply

docs/reference/terminal-sessions.md

@@ -189,6 +189,10 @@ timed out, OpenRig closes nothing: the result says `rex_outcome_unknown`, or
 adds a note when other pages opened, and names the session to check in Rex
 before retrying. `rig terminal status` gives Rex about a second to answer.
 
+## herdr-app
+
+`--provider herdr-app` opens the view in the herdr-app window you run it in. Inside a herdr-app terminal, plain `rig terminal open <view>` does the same when that window is answering (finding the socket file is how OpenRig guesses you are in a herdr-app window, and whether the window is reachable is checked by asking it). `--window` always asks for a new desktop window. See [OpenRig views in herdr-app](herdr-app.md).
+
 ## HTTP API
 
 - `POST /api/terminal/open`: `{ view, provider?: "herdr", session?: string, expectedPlan?: string }`.

docs/reference/whats-new.md

@@ -1,194 +1,94 @@
-# What changed in OpenRig 0.7.11
+# What changed in OpenRig 0.7.1
 
-This note is for an agent on an install that was just upgraded to 0.7.11.
-OpenRig 0.7.11 sends ordinary messages and work notices into a person's typed
-draft by default instead of refusing them, lets a person reach the team from
-their own coding agent (the `openrig` plugin) or an ACP app (`rig acp serve`),
-holds a prepared managed compaction until the seat is idle, and clears a
-restore that stopped at a prompt. On Linux, a daemon run as a systemd user
-service keeps its seats when its unit restarts. It adds five database
-migrations. On OpenShell 0.1.6 the worker's maintained cleanup now works, but
-the worker still isn't end to end. If you upgraded
-from 0.7.9 or earlier, also read "What changed in OpenRig 0.7.10" below, and
-from 0.7.8 or earlier, "What changed in OpenRig 0.7.9" too. For the full
-capability map, read `rig context get onboarding-width/public-what-you-can-do.md`.
-After the upgraded daemon starts, `rig context get reference/whats-new.md`
-describes this version. Without a running daemon, read the packaged
-`daemon/docs/reference/whats-new.md`; `$OPENRIG_HOME/reference/whats-new.md` can
-still be the previous copy until startup.
+This note is for an agent on an install that was just upgraded to 0.7.1. It lists only what behaves differently from
+0.7.0 and what to do about it. For everything OpenRig can do, read the capability map:
+`rig context get onboarding-width/public-what-you-can-do.md`. Each release replaces this file, so
+`rig context get reference/whats-new.md` describes the installed version once the upgraded daemon is running. Without
+a running daemon, read `$OPENRIG_HOME/reference/whats-new.md`. The daemon refreshes that copy when it starts, so right
+after an upgrade it can still hold the previous version's note.
 
 ## After the upgrade
 
-- **Back up the database, then restart the daemon.** Five migrations run on
-  the daemon's first start: 150 (node launch wrapper), 151 (Pi account
-  switches), 152 (workflow instance spec), 153 (events retention marks) and 154
-  (workflow instance root objective). If `$OPENRIG_DB` isn't backed up yet,
-  copy that file (`rig config get db.path` shows it) with the daemon stopped,
-  then `rig daemon start`. Going back to 0.7.10 after these migrations isn't
-  established.
-- **New settings:** `transport.draft_delivery` (`deliver`), `acp.to` (empty),
-  `daemon.seat_poll_interval_ms` (1000) and `retention.events_days` (`0`, keeps
-  every event). `rig config` shows each with its source.
-- **The openrig-core plugin moves from 0.1.26 to 0.1.27.**
-  Its activity relay and refocus hooks changed, as did the refocusing,
-  openrig-user and openrig-skills skills. Managed refresh preserves replaced
-  files under `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits
-  you still need from the preserved copy.
-- **Linux, with the daemon as a systemd user service:** the seats move into
-  their own scope only when their tmux server next starts fresh; until then,
-  stopping or restarting the daemon's unit still takes them down.
-- **Tell the person sends now join their drafts** (below). To keep the refusal,
-  run `rig config set transport.draft_delivery refuse`; it applies from the
-  next send, with no restart.
-- **Pi seats:** a Pi seat that declares an absolute `PI_CODING_AGENT_DIR` in its
-  `env:` now uses it as its account home and needs a readable `auth.json`
-  there, or the launch stops. Prepare one, or remove the declaration to keep
-  the managed seat login. Ask the person before changing their spec.
-- **herdr-core terminals:** new starts no longer inherit `HC_SCOPE`,
-  `HC_TERMINAL_ID` or `HC_TERMINAL_SOCKET`; a daemon or tmux server already
-  running with them keeps them until it's restarted.
-- **Claude seats that load openrig-core themselves** lose OpenRig's unchanged
-  copies of its skills at their next launch, so each skill loads once; the
-  launch result warns with the copies removed or kept.
+- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Eight migrations run on the first start (124, 125,
+  127, 128, 129, 130, 131 and 135). Nine settings are added: `policies.claude_compaction.preparation_root` (unset),
+  `skills.router_line.enabled` (off), `decisions.enabled` (false), `decisions.consumers`, `decisions.template_dir`,
+  `retention.stream_days` (30), `retention.stream_max_items` (20000), `provider.selected` (empty) and
+  `daemon.db_conflict` (`warn`). None is removed.
+- **Stream retention is on.** Stream items emitted after the upgrade are deleted after 30 days, or beyond the newest
+  20,000, unless a record names them (a classification, duplicate link, attempt or disposition). History from before the
+  upgrade is kept. Raise `retention.stream_days` or `retention.stream_max_items` to keep more.
+- **The bundled openrig-core plugin goes from 0.1.17 to 0.1.18.** Startup replaces the installed plugin's changed files:
+  its Claude hook definitions, three hook scripts and the pre-compaction hook (so hooks start on a seat whose PATH has
+  no Node), and the `openrig-user`, `messaging-the-human` and `forming-an-openrig-mental-model` skills. As in
+  0.7.0, it first copies each file it replaces under `$OPENRIG_HOME/backups/managed-refresh/<id>/`, edited or not, and
+  logs `[plugin-vendor] preserved previous contents of <file> at <copy> before managed refresh`. A copy doesn't mean
+  anyone edited the file; if someone did, reapply the change from the copy.
+- **Claude seats need Claude Code 2.1.280 or newer to see their team skills,** which now arrive as a per-seat plugin
+  through `CLAUDE_CODE_PLUGIN_DIRS` (below). OpenRig doesn't check the version. A running seat gets the new layout at its
+  next launch, restore or handover.
+- **If a worktree's `.claude/settings.local.json` says `"defaultMode": "acceptEdits"` and the person didn't choose it,**
+  an earlier OpenRig wrote it when it added or freshly launched a managed Claude seat. 0.7.1 no longer writes it but
+  doesn't repair it; ask the person which mode they want and set it once.
 
-## Sends and drafts
+## New things you can do
 
-- **Under `deliver` (the default),** an ordinary `rig send` or work notice to a
-  seat whose prompt holds a person's typed draft pastes the message at the
-  cursor and submits the combined input as one prompt. The result says whether
-  submission was confirmed and, when OpenRig saw the draft, that it joined it.
-  An unset, unreadable or invalid value follows `deliver`.
-- **Still refused or held under either value:** menus, permission prompts, a
-  seat's typing guard (`draft-aware`, `hold`), managed compaction's sends and
-  `--wait-for-idle`.
-- **Under `refuse`,** a send is refused, and a work notice retried once the
-  prompt is clear, where OpenRig detects the draft. Claude Code and Codex sends
-  now also read the input box before pasting, so a draft only the box shows
-  refuses too (`target_needs_input` / `prompt_draft`).
-- **The draft-aware typing guard** reads a Claude composer with a statusLine or
-  the background task panel, and Claude Code 2.1.319's bare
-  `✔ Update installed · Restart to update` row in a narrow pane, so an empty box
-  gets the wake instead of `draft_input_unknown`.
-- **Held messages coalesce:** a sender's newest held message at a seat retires
-  its earlier ones. Read them with `rig seat held-messages <seat>` (each with
-  `--id <id>`); an older backlog clears at that sender's next held message or
-  with `rig seat retire-held-message`.
-- **Stopped seats aren't woken at each daemon start:** their rows stay owed, and
-  the start-up log says `waiting=N (not replayed: …)`. That isn't delivery.
+- **Choose how much automatic input reaches a seat:** `rig seat set-typing-guard <seat> --mode <mode> --reason "…"`, where
+  `<mode>` adds `openrig-urgent` (OpenRig's own notices and anything urgent) and `urgent-only` between `off` and `hold`.
+  Mark a message urgent with `rig send --urgent`, or create the row at priority `urgent` or `critical`. Held input stays
+  readable (`rig seat held-messages`) and is never replayed.
+- **Choose how far OpenRig and peers may act on a seat:** `rig seat set-terminal-policy <seat> --preset
+  no-peer-interventions|help-within-instructions|full-control --reason "…"`, with `--helper <addresses…>`,
+  `--rig-default` (seats added later), and exceptions such as `--peer-compaction deny` or `--openrig-model allow`.
+  Managed compaction and saved model or effort changes are checked; a denial is `terminal_policy_refused`. Other
+  interventions are guidance only.
+- **Read a seat's planned permissions:** `rig seat status <seat>` shows what its next fresh managed launch will pass and
+  where each part comes from, and its terminal policy. `rig setup --router-line yes|no` decides whether OpenRig adds its
+  one line to shared guidance files.
+- **Let a person choose whether every ask reaches Slack:** `rig gateway human set <id> slack-subscription
+  every-ask|urgent-only|unset`. Every ask is on the TUI's Feed either way. Under `urgent-only`, only an ask
+  created or handed off with `--alert` posts. An ask marked `--alert` stands out in Slack (an interrupt with a mention)
+  under either setting, so use it only for something only they can do, or an approval whose wait costs now.
+- **Give one Claude member its own setup** in the rig spec: `agent_file`, `append_system_prompt_file`, `plugin_dirs` and
+  `advisor` (an Advisor model). They're copied into that seat's storage, never the project.
+- **See a seat's own skills:** `rig skill loadout --seat <session|self>`.
+- **Reach the team from an assistant without a shell:** the MCP server has 34 tools, including `rig_whoami`,
+  `rig_restore_status`, `rig_team`, `rig_telemetry_events`, following a handoff, reading a finished item's artifact and
+  deciding inside a person's decision room. `rig mcp serve --http` serves them over HTTP; `rig mcp token add <name>
+  --seat <session>` gives each caller its own seat.
+- **Hand a row's task to an outside agent:** `rig acp run <row>` for an ACP agent (Hermes, OpenClaw).
+  `docs/reference/a2a-agents.md` covers A2A agents.
+- **Run a community harness that names, reports or reopens its conversations:** preset fields `launch_result`, `resume`,
+  `names_conversation` and `startup_assisted`, with examples for Cursor, Hermes and OpenClaw under
+  `docs/reference/community-harness-examples/`.
+- **Change one edge on a running rig:** `rig edge add <rig> <from> <to> --kind <kind>` and `rig edge remove <rig>
+  <edge-id>` (`--plan`, `--json`). A `delegates_to` change says when it moves who work routes to.
+- **Run one spec as several rigs:** `rig up <spec> --name <rig>`.
+- **Retune a watchdog in place:** `rig watchdog update <jobId> [--interval-seconds n] [--message text] [--spec path]`
+  keeps its id and attachments. The context watch takes `--threshold-tokens` or `--threshold-percent`.
+- **Put restore maps where seats may write:** `rig config set policies.claude_compaction.preparation_root <abs path>`.
+- **Pick a Herdr session:** `rig terminal open <view> --provider herdr --session <name>`.
+- **Close a row with its artifact:** `rig queue update <id> --state done --evidence-ref <path>`.
+- **File and read subscription move reports:** `rig provider moves report` and `rig provider moves`. `--host <id>` and
+  `--codex-home <dir>` on `rig auth status|list|switch` and `rig seat restart` act on another machine's Codex home.
+- **Route stream observations with typed decisions (opt-in, off by default):** once `decisions.enabled` is true,
+  `decisions.consumers` includes `stream` and the intake seat has `OPENROUTER_API_KEY`, `rig project wake --decide`
+  gives each eligible stream observation one bounded typed decision during that seat's wake: create a row for a supplied
+  owner, join supplied work, or record a duplicate or no action. Anything uncertain, refused or failed goes to the
+  intake seat as its own disposition, and the model isn't asked again. `rig project decisions status` shows the state
+  without making a call. Without `--decide`, or with decisions off, nothing changes; turning decisions off no longer
+  strands an accepted create or join whose effect hadn't landed.
+- **Read the stream as a subscriber:** `rig stream subscribe <seat>` (`--tags`, `--type`; re-subscribing keeps the
+  place), then `rig stream read` returns the next bounded page for the calling seat (at most 20 items and 64 KiB, with
+  `more`, `unread` and any `gap`). `rig stream subscriptions` lists readers; `rig stream unsubscribe <seat>` stops one.
+  `rig stream show <id>` says what became of an observation.
+- **Keep the kernel to the harnesses you chose:** `rig setup --providers <list>` is now saved as `provider.selected`, and
+  the kernel starts seats only for those.
+- **Stop a second daemon on a live database:** `rig config set daemon.db_conflict stop` refuses a start whose database a
+  matching live daemon already holds (the default `warn` only warns). `rig daemon start --allow-db-conflict` allows one
+  deliberate start.
 
-## Compaction, restore and handover
+## Behaviour that changed
 
-- **A prepared managed compaction is held, not re-requested.** When the map is
-  complete but `/compact` couldn't go in, the attempt stays `waiting`, marked
-  `prepared`, and sends `/compact` at the next idle moment with an empty box.
-  `rig compact <seat> --state` shows it; a manual `rig compact` reads
-  `already_in_progress`; `--cancel` disarms it. It ends on a context dip, a
-  conversation change, a stale map (`prepared_map_stale`: 15 points of growth or
-  2 hours) or a map that stops reading ready.
-- **The final `/compact` waits out the preparation's own fresh activity** (up
-  to about 23 s, against 9 s), so an idle seat that ran out of context compacts
-  instead of being refused; a busy seat can wait up to about 14 s longer.
-- **A queue wake refused at a prompt** no longer goes in right after
-  "Compacted" while the compaction still owes its turn boundary and restore
-  request; it goes in at the next idle moment after that step clears.
-- **A full restore stopped at a prompt clears itself** once the seat runs the
-  conversation it was restoring. If a seat still reads `attention_required`, run
-  `rig seat clear-attention <seat>`, with `--reason` after a partial restore or
-  a community harness's assisted startup. `proof_superseded` means the restore
-  changed mid-check.
-- **A Codex helper inside a Claude seat** no longer takes the seat's resume
-  token (`transcript_not_this_session`).
-- **A Claude rebuild handover may report its priming packet unconfirmed.**
-  Submit the existing packet once, only if it's still staged. Never resend it
-  blindly or rerun the handover.
-- **`on_restore: follow_source`** on a spec's `resources.skills[]` entry
-  refreshes that skill from its source on restore; `keep_saved` is the default.
-
-## Working with the team from outside
-
-- **The `openrig` plugin** lets a person use their own Claude Code or Codex
-  with their local team: hand it work, follow it, answer the team's questions
-  in their own words, and read the result. Install it from the package
-  (`claude plugin marketplace add "$(npm root -g)/@openrig/cli/daemon/assets/plugins/openrig"`,
-  then `claude plugin install openrig@openrig-app`) or from this repository on
-  GitHub. Everyone using the app on a machine acts as the seat it names.
-- **VS Code, Copilot CLI and Cursor** start its server with no seat: add your
-  own `rig mcp serve --front-door` server with `OPENRIG_SESSION_NAME` set and
-  turn the plugin's off. A seatless app can create tasks, send and post as
-  `unknown-mcp-<8 hex>`, but can't claim, update, hand off or answer.
-- **ACP apps:** `rig acp serve --to <member@rig>` (or the `acp.to` setting)
-  makes the team an agent in an app that launches a custom ACP agent, such as
-  Zed or T3 Code. Nothing runs until an app starts it, and it uses the daemon
-  `rig` uses. A question left unanswered in the app stays open in the TUI and
-  Slack. The `@openrig/acp` launcher is packed beside the CLI at the same
-  version. See `docs/reference/acp-agents.md`.
-- **Assistants through a grant service** are experimental, unsupported and off
-  by default: they need your own internet-reachable `rig mcp serve --http
-  --grant-service <url>` and an outside grant service. A registered person can
-  answer the team's questions from one, and `--task-destination <member@rig>`
-  names where its tasks go (`docs/reference/hosted-members.md`).
-- **The `relay` gateway connector** is off unless you add a relay binding. It
-  hands questions and updates to a bridge the operator runs on loopback;
-  "Accepted by bridge" isn't delivery (`docs/reference/gateway-relay.md`).
-
-## OpenShell workers
-
-On OpenShell 0.1.6 the maintained cleanup (`delete-owned`) now works for a
-custom image, and recreate and an exact resume passed in our native run. A
-restored guest still receives its startup text again, so strict recall after a
-restore isn't met, and the worker isn't end to end. The CA fix holds on 0.1.6.
-"Never grant the guest access to the daemon's main API
-port (normally 7433)."
-
-## Other changes to act on
-
-- Denying or dropping a host pairing request in Steering now gives the requesting machine no access; in 0.7.9 and 0.7.10, that action could return the daemon access token. ([#2884](https://github.com/mvschwarz/openrig/pull/2884))
-- **Pairing answers now reach the target's kernel operator.** On a 0.7.11 target with a receiving kernel operator, typed words and Approve or Deny choices in the TUI, Steering or Slack are replies for that agent to read. Receiving a reply neither grants nor denies access. The operator acts on clear intent with `rig host approve <code>` or `rig host deny <code>` and asks back when the answer is unclear. The commands also work from a plain terminal on the target; they use its operator bearer (`OPENRIG_AUTH_BEARER_TOKEN`, or `--bearer <token>`). ([#2900](https://github.com/mvschwarz/openrig/pull/2900))
-- **An Approve click on an operator-owned request waits for the operator to act.** A stopped operator keeps ownership; the answer waits in its queue. A stopped or unknown running state is named with the terminal route, without claiming the answer was read. If there is no operator, it cannot receive answers, or OpenRig cannot determine one, the request names that case and uses the agent-free path: Approve and Deny decide directly, and replies lead to another ask rather than denial. File-only replies and the literal `[file reply]` have no words stored on the agent-free ask; they still do not deny it.
-- **TUI answers use the daemon's operator bearer when configured.** Ordinary terminal calls keep their separate terminal credential. A missing or wrong action credential leaves the answer unrecorded and shows what to set; this does not weaken the daemon's authentication.
-- **Receipt, clarification and outcome are separate steps.** Receipts, agent-free re-asks and outcomes inferred from clicks or closes need the requesting machine to keep polling. An explicit `rig host approve` or `rig host deny` attempts its outcome update directly. An expiry timer closes the ask even if polling stopped; an unanswered expired ask gets no further update. Requests and decisions live in daemon memory, so a restart drops an open request. Approval still must be collected before expiry. This target-side change does not change older targets.
-
-- **Rows on another host:** `rig queue show`, `list`, `transitions`, `update`
-  and `block` take `--host <id>`; `claim` doesn't, since only the destination
-  seat on its own host claims. `--host` never follows `rig host select`.
-- **A seat's unclaimed backlog:** a seat with no escalation route or delegation
-  parent gets one `unclaimed-backlog` notice. To route its findings to a
-  watching seat:
-  `rig edge add <rig> <root seat's logical id> <watching seat> --kind escalates_to`.
-- **Claims read `working`** for up to 60 minutes while a Claude owner has a
-  live background shell, and 20 while a managed restore is owed.
-- **A cross-host handoff that overrides your claim** wakes you with the
-  successor's id: stop and coordinate with that seat.
-- **Code results:** set an `openrig.code-result/v1` manifest as `evidenceRef`;
-  `rig queue artifact <qitemId>` and `rig_artifact_read` return the commit pair.
-- **Workflows:** runs keep their own spec; `rig workflow unregister
-  <name>[@<version>]` (or `--prune-missing`) removes registered versions;
-  `rig workflow trace <id> --full` returns the whole trail; `show`, `trace` and
-  `status` print `objective:`.
-- **`rig stream emit` timeouts:** repeat with the same `--id`, or check with
-  `rig stream list` before emitting again.
-- **Launch and setup:** `launch_wrapper` works for local Claude Code, Pi and
-  Codex seats; `rig provider switch --seat <pi seat> --to-account <name>
-  --account-home <dir> --reason "<why>"` switches a Pi seat's account (`--dry-run`
-  first), and a Pi seat with a declared account home starts again; `rig config set` says when
-  an environment variable masks the saved value.
-- **Linux seats:** when the daemon runs as a systemd user service, the seats'
-  tmux server starts in its own user scope (`openrig-tmux-<id>.scope`), so the
-  daemon's unit can stop or restart without ending them. Otherwise the server
-  starts as before, with one log line giving the reason.
-- **Writable terminal tiles** attach as in 0.7.10: the screen in use sizes the
-  seat and text reflows on resize. Read-only tiles keep showing without attaching
-  or resizing the seat. Web fixed geometry is opt-in through
-  `terminal.fixed_geometry` (off by default). As in 0.7.10, Enter or Ctrl-C while
-  the first attach is in flight can close that viewer; the agent keeps running,
-  so reopen the view. Kept writable tiles from 0.7.8, 0.7.9 or pre-reflow 0.7.11
-  need a manual refresh: close only the owned viewer and reopen with
-  `rig terminal open`; for `--follow`, use `--no-follow` first, then open a fresh
-  view. The agent and conversation are preserved; no automatic migration runs.
-  ([#2868](https://github.com/mvschwarz/openrig/pull/2868), [#2757](https://github.com/mvschwarz/openrig/pull/2757), [#2821](https://github.com/mvschwarz/openrig/pull/2821))
-- **A Claude seat launched with `--settings` JSON written with spaces** can be
-  verified again.
-- **`view.changed` is no longer stored,** and `/api/events` no longer sends it.
 - **Old history-only events can be pruned, if you choose to.** `retention.events_days` (default `0`, which keeps every
   event) turns on a pass in the retention sweep (at daemon start and daily) that deletes `view.changed`,
   `snapshot.created`, `watchdog.evaluation_fired` and the `queue.created`, `queue.updated`, `queue.claimed`,
@@ -207,530 +107,105 @@ port (normally 7433)."
 - **With pruning on, `rig telemetry events` reports the pruned ranges.** A page that spans pruned events inside the
   retained window has a `retained_sequence_gap` for each missing seq range and `coverage.status` `partial` (it used to be
   `retained_window`); events pruned from the start of the log show up as `before_retained_floor`.
-- **Large fleets:** `daemon.seat_poll_interval_ms` (up to 2000) lowers CPU at
-  the cost of activity freshness; keep 1000 if tmux is slow.
-- **Terminals:** Herdr follow views work on macOS (protocol 22) and open a
-  snapshot (`follow_unsupported`) where live following isn't supported.
 
-## Limits to keep in view
+- **Team skills live in each seat's own storage** (`$OPENRIG_HOME/state/seats/<rig id>/<logical seat>/<runtime>/`), not
+  in the project's `.claude/skills` or `.agents/skills`. Claude seats get them as a generated plugin (`openrig:<id>`),
+  Codex seats as their own catalog. If a link sits in that path, the seat starts without them and the result names
+  what wasn't delivered.
+- **Urgent wakes are labelled:** an urgent or critical row's wake starts with `Urgent (marked by …):` at every seat. A
+  seat on `hold` gets one held notice per wake instead of re-nudges, and lifecycle work is refused at the middle levels as
+  at `hold`.
+- **A daemon restart picks up a managed compaction where it stopped.** An owed restore step resumes, a `/compact` that
+  may have been sent is never sent again, and `rig compact --state` shows anything stranded or owed.
+- **A Claude seat whose startup turn is refused** (an expired login, say) holds the rest of its startup context as owed.
+  A startup input sent before the refusal is noticed can still be submitted (see Known issues in the
+  [0.7.1 release notes](https://github.com/mvschwarz/openrig/releases/tag/v0.7.1)).
+- **`rig send` refuses with `target_needs_input`** when a Claude seat's hook has just reported it running and its screen
+  shows an MCP enablement menu, a question or a permission prompt.
+- **`rig down` asks before stopping the caller's own rig.** Without a terminal it exits 1, stops nothing and prints the
+  `--yes` command.
+- **`rig up --plan` doesn't start a stopped daemon:** it exits 1 with `daemon_not_running` and names `rig daemon start`
+  and `--no-kernel`.
+- **`rig daemon start`** waits up to 20 seconds for a slow daemon, and starts with a warning when only a secondary
+  listener, such as Tailscale's, can't be verified.
+- **A seat joined with `rig attach` as an outside app** (Claude Desktop) stays attached through `rig down` and restore
+  (`left_attached`). To replace it, `rig unclaim <name>`, then launch.
+- **New seats get the daemon's `OPENRIG_DB` and `TMUX_TMPDIR`.**
+- **A rebuilt Codex seat keeps its observed permissions,** and a read-only Codex profile launches without OpenRig's
+  writable roots.
+- **A seat's own role** goes only to that seat, never into a shared `CLAUDE.md` or `AGENTS.md`, and `rig down` returns
+  guidance files byte for byte.
+- **Workflow actions** (`project`, `route`, `resume`, `abort`) record the calling agent; a request with neither identity
+  nor actor gets the shared `actor_required` error.
+- **`rig provider moves` is back** for subscription move reports. It switches nothing.
+- **`--dangerously-interact` into a seat's input box stops first** when the box already holds typed or pasted text: it
+  shows that text (apart from suggestions) and types nothing. Clear the box and retry, or pass `--type-without-checking`,
+  which clears nothing. Keys for a recognized native menu are sent as before.
+- **A terminal seat gets exactly the text sent to it,** without the From/To lines (the result says `envelopeOmitted`).
+  A queue wake to a terminal seat types nothing and fails `failed:terminal-seat`; the row stays queued.
+- **A daemon restart that can't see the seats' tmux server** no longer detaches seats whose recorded process still
+  runs, so it doesn't relaunch them beside themselves.
+- **Provider credentials and the activity-hook token stay off tmux, shell and `env` command lines** at launch and
+  handover. A launch whose staging fails stops instead of falling back.
+- **An answer retried from Slack or Steering** after an interrupted close reuses the first reply and finishes the
+  request once.
+- **One bad row no longer stops the stuck sweep** from flagging the others; **a malformed unrelated diagnosis row** no
+  longer stops health diagnoses from listing.
 
-- **OpenShell:** a restored guest gets its startup text again, strict recall
-  isn't met, and the worker isn't end to end (above).
-- **Drafts:** detection isn't complete. Under `refuse`, an unreadable input box
-  lets the send go ahead; under `deliver`, a result may not mention a draft.
-- **A post-compaction step can still hold** when the box reads as typed, under
-  draft-aware delivery or the typing guard, or after a lost `/compact`. Run
-  `rig compact <seat> --cancel`, then send a restore request naming the newest
-  restore map, marker and packet. A refused queue wake now waits for that step,
-  but recovery at daemon start and a new handoff's wake don't check yet.
-- **`keep_saved` skills:** a skill whose source changes between `rig down` and
-  the restore comes back missing, named in the restore's warnings; an edited seat
-  copy is kept.
-- **Terminal tiles** each run one tmux command a second while showing (8 tiles
-  used about 6–8% of one core on an Apple Silicon Mac mini).
-- **A message held as `draft_input_unknown`** isn't retried, and whether
-  managed compaction gets past the update banner wasn't retested.
-- **Claude provider switch:** the "probe pane returned to a shell" failure in
-  [#2341](https://github.com/mvschwarz/openrig/issues/2341) isn't shown fixed;
-  the launcher-script rebuild timeout and `--no-chrome` are fixed.
-- **ACP apps** were checked in T3 Code (Beta) 0.1.7 and with a scripted client;
-  the unanswered-question notice hasn't run in a live app. A cancel stops
-  waiting; the team's work carries on.
-- **The `openrig` plugin** hasn't run in Claude Desktop, the Codex app or
-  Copilot CLI. **Grant-service assistants** still aren't woken.
-- **Claude `launch_wrapper`** hasn't run with zsh, on macOS arm64 or with a real
-  installed Claude; an alias or shell function named `claude` fails closed.
-- **Going back to 0.7.10** isn't established; an older permission hook also
-  gives named-policy Claude sessions no decision until they're relaunched.
-- **The other 0.7.10 limits below still apply:** `rig exec` cancels,
-  permission requests in seat status, Codex hooks (including
-  `rig seat restart --keep-conversation` refusing a Codex seat launched with
-  developer instructions), smol-toml 1.9.x, Slack, Claude Code 2.1.319's auto
-  mode, Codex snapshot restores and `AGENTS.md`, unretried reminders, SSH host
-  status, advisories on a native resume, seats handed over before 0.7.9, `rig`
-  in the TUI's shell after a project-local install, the "Startup prompt still
-  staged" message, and a partial install from two npm installs at once.
-  0.7.10's bare-banner and launcher-script limits are fixed, and its OpenShell
-  limit is replaced by the one above.
+## Output that changed shape
 
----
+- **`rig ps --nodes`** separates every cell with one space (the default row is 5 columns wider), adds an `ATTN` column
+  (`yes`, `no` or `?`) before `REASON`, and marks a `running` seat whose tmux couldn't be reached as unconfirmed.
+- **`rig queue show --json`** no longer has `lastNudgeInputBox`, and send results no longer describe the input box.
+- **`rig queue show` and `rig queue whoami`** print their human notices on stderr, so stdout is the JSON.
+- **A claimed row whose owner waits on a person** reads pickup `needs-input`, with the reason.
+- **`rig down --json`** adds `leftRunning`; `rig reconcile-session` says whether resume metadata was recorded.
+- **`rig compact-plan`** labels its thresholds as its own and says whether automatic compaction is on.
+- **A send held for a draft** in the seat's input box reports `inputPhase: "not_reached"`: it was never typed.
+- **A stream body over 16 KiB** is stored truncated, ending `[truncated by OpenRig: kept N of M bytes]`, and reads mark it
+  `bodyTruncated`. `rig stream list --after <sortKey>` from a pruned item returns 410 `stream_cursor_expired`, naming
+  `--since` to resume, instead of an empty list.
 
-## What changed in OpenRig 0.7.10
+## What to stop doing
 
-The changes from 0.7.9 to 0.7.10, published on 2026-11-08, for an install
-upgrading from 0.7.9 or earlier. 0.7.10 added `rig exec` for finite runs on
-Claude Code or Codex, sent a held post-compaction step after two idle polls that
-can't read the input box, left every tmux mode before a delivery, and showed
-agent spec advisories at launch. Its OpenShell line below is corrected.
+- **Don't read `lastNudgeInputBox`.** It's gone.
+- **Don't parse `rig ps --nodes` by column position.** Use `--json`, with `--fields` to pick fields.
+- **Don't look for a team seat's skills in the project folders.** Use `rig skill loadout --seat`.
+- **Don't stop and re-register a watchdog to change it.** Use `rig watchdog update`.
+- **Don't take a rig down to fix one edge.** Use `rig edge add` or `remove`.
+- **Don't print `OPENRIG_ACTIVITY_*` values** while looking for identity. Use `rig whoami`.
+- **Don't use `--dangerously-interact` to type over a half-written input box.** It stops and shows the text; choose
+  explicitly, or use `rig send --urgent` where the seat's interruption level allows it.
 
-### After the upgrade
+## Known gaps in 0.7.1
 
-- **Restart the daemon** to load the new code: `rig daemon stop`, then
-  `rig daemon start`. This release adds no migrations.
-- **The bundled openrig-core plugin goes from 0.1.25 to 0.1.26.** Its Claude
-  hooks add a `PermissionRequest` hook that reports permission requests to seat
-  status, and its refocus hook and the refocusing skill's trace script changed.
-  Managed refresh preserves replaced files under
-  `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits you still
-  need from the preserved copy.
-- **Check agent specs before relaunching seats:** run `rig agent validate <path>`
-  and read any `agent spec advisory` line. A profile's `uses.<category>` written
-  as a single value now selects that resource; if the resource pool doesn't hold
-  it, a member using that profile fails to resolve with "not found in resource
-  pool". Ask the person before you change their spec.
-- **Codex hooks:** a Codex seat kept running across the upgrade can show "Hook
-  failed — plugin contents changed; hook approval required" until relaunched; in
-  0.7.9's upgrade test, one seat restarted with OpenRig's managed restart showed
-  no review afterwards.
-- **OpenShell:** rebuild a guest image with this release's `guest.py` before
-  using it; the CA repair is in that file, which the image carries.
-- **Codex tool commands use a non-login shell:** managed Codex seats now pass
-  Codex `-c allow_login_shell=false`, so plain `rig` works however OpenRig was
-  installed, with a Codex that supports `allow_login_shell` (checked in Codex's
-  source at 0.162.1 and 0.166); not yet run with a live Codex seat. Setup that lives only in login or rc files, and shell functions and
-  aliases, may be missing from tool commands, and a model request for
-  `login: true` gets Codex's refusal, "login shell is disabled by config". To
-  defer to Codex's own setting, run `rig config set launch.codex_login_shell
-  true`; a login file that sets `PATH` outright can then hide `rig`. It applies
-  at each seat's next launch, and a restart in place keeps the running choice.
-  ([#2613](https://github.com/mvschwarz/openrig/pull/2613))
-
-### Finite runs: `rig exec`
-
-`docs/reference/acp-agents.md` is the rule. Read it before handing a row to
-Claude Code or Codex.
-- **Install the adapters first:** `@agentclientprotocol/claude-agent-acp`
-  0.101.0 and `@agentclientprotocol/codex-acp` 2.5.0, as that page shows.
-  `rig exec harnesses` reports the adapter and native versions it finds.
-- **Run:** `rig exec run <row> --harness claude` (or `codex`). `--plan` shows
-  what would run and starts nothing; `--wait` waits for the outcome. A connector
-  owns the run, so leaving `--wait` or closing the terminal doesn't stop it.
-  Running it again returns the row's run instead of sending the task twice;
-  `--again` starts another turn once that run has ended.
-- **Read the outcome** with `rig exec status <runId|row>`. `interrupted` means
-  the connector died without recording an outcome, so the outcome is unknown. A
-  `completed` turn is the agent's report, not finished work: check the work
-  before you close the row. `--wait` exits 0 for `completed`, 2 for any other
-  outcome and 3 when you stop waiting.
-- **Cancel** with `rig exec cancel <runId>`, not `rig acp cancel`. An
-  acknowledgement isn't a settled shutdown, and it says nothing about further
-  spend.
-- **Usage and cost** the agent reported are on the row's outcome note, for
-  `rig acp run` too, each with its source; what it didn't report reads unknown.
-
-### Compaction and delivery
-
-- **A held post-compaction step goes in.** After two idle polls in a row that
-  can't read a seat's input box, the next poll sends the step (the turn
-  boundary, the restore request or the audit). `rig compact <seat> --state` and
-  `rig seat status` say it went in over a box OpenRig couldn't read; they never
-  call that box empty. A draft OpenRig can't recognise in that box may receive
-  the restore text.
-- **Still held:** a box that reads as typed, with or without a suggestion; a
-  seat whose draft-aware delivery or typing guard holds OpenRig's input; and the
-  step after a `/compact` whose result was lost. To take over a held restore by
-  hand, run `rig compact <seat> --cancel`, then send the seat a restore request
-  naming its newest restore map, its restore marker and its packet. A step
-  already being pasted can still land.
-- **tmux modes:** a send or wake now leaves every tmux mode in a seat's pane,
-  including a chooser, customize or clock mode a person has open. If a send is
-  still refused for a tmux mode, the refusal names why leaving failed.
-- **A scrolled pane with a stale record:** leaving the mode now goes through the
-  seat's address, so a stale binding naming the same reused tmux pane, from
-  another rig for example, no longer makes the send fail with nothing sent.
-- **Herdr views kept across an upgrade keep working,** on Linux Herdr 0.9.5 /
-  protocol 22. A viewer or follow view kept from 0.7.5 through 0.7.9 now counts
-  as the same attachment when only OpenRig's tile script changed, and moves to
-  the current command, so the viewer stays confirmed and the follow view goes on
-  adding and closing tiles. A kept viewer that's already running keeps its
-  earlier sizing for as long as it runs, its own re-attaches included; writable
-  viewers opened after the upgrade size their pane. A different session, tmux,
-  server or read-only setting still holds the view, as before. Checked against
-  the scripts those releases used, not yet with a live Herdr. It follows
-  @natefaerber's approach in
-  [#2467](https://github.com/mvschwarz/openrig/pull/2467). ([#2634](https://github.com/mvschwarz/openrig/pull/2634))
-
-### OpenShell workers
-
-0.7.10 fixes, in the source, the two problems that stopped the OpenShell worker
-in 0.7.9, but the worker hasn't run end to end. Don't rely on this path yet. The
-guest launcher now passes the CA settings the OpenShell exec supplies
-(`NODE_EXTRA_CA_CERTS`, `SSL_CERT_FILE`, `REQUESTS_CA_BUNDLE` and
-`CURL_CA_BUNDLE`) to its Claude, and deleting an owned environment reads
-Podman's inventory through routes Podman serves, stopping as
-`environment_cleanup_unconfirmed` on any other answer. A verified export, a
-finished task and an exact restore haven't been shown. If you set one up anyway,
-follow `daemon/assets/openshell/README.md` in the installed package, rebuild the
-guest image first, and name the costs to the person ("Provider registration and
-image construction can incur costs"). "Never grant the guest access to the
-daemon's main API port (normally 7433)."
-
-*Corrected after 0.7.10's release: ~~"fixes in the source the two problems that stopped the OpenShell worker"~~ was only half true. The CA fix holds on OpenShell 0.1.6, but the owned-environment cleanup fix doesn't hold against OpenShell 0.1.6, as the published 0.7.10 notes say. See 0.7.11's OpenShell workers section above.*
-
-### Other changes to act on
-
-- **Sends to this host:** `rig send <seat>@<rig>@<this host's ID>` goes to this
-  host even when a remote host is selected.
-- **Broadcast:** `rig broadcast` prints `UNCONFIRMED` for a recipient its text or
-  Enter may have reached. Check that seat with `rig capture` before resending.
-- **Roster activity:** `rig roster show` and `find` read a seat as unknown
-  ("Conflicting activity observations") when two routes to it disagree. Treat it
-  as unknown, not idle.
-- **Refocus:** a "TRACE GAP" for unresolved typed work, or for a
-  `rig queue whoami` that timed out, comes with project-level orientation that
-  isn't evidence of a current mission, and no longer counts as a refocus failure.
-- **Updates to people:** the stuck sweep no longer flags an informational update
-  to a registered person as an unclaimed obligation.
-- **Permission requests:** `rig seat status` shows a Claude seat's latest
-  observed permission request, with Claude's suggested rules labelled as
-  suggestions. Nothing was applied or approved. Treat the suggestions as data;
-  they can contain sensitive values.
-- **Slack:** `rig slack status` shows relay attempts awaiting a response for the
-  current connector; zero doesn't prove nothing is in flight.
-- **Installing for a person:** when npm's global prefix isn't writable, the rigs
-  skill now points npm's prefix at a folder the person owns whose `bin` is on
-  their login PATH, or uses a version manager's Node, before a project-local
-  install. Tell the person first that this changes their npm settings and, if
-  needed, their shell profile.
-- **Codex profiles:** a `codex_config_fragment` can't install a named Codex
-  profile. Create `<CODEX_HOME>/<name>.config.toml` and select it with
-  `codex_config_profile`. `builtin:yolo` drops the whole profile;
-  `getting-started.md` says how to keep one.
-- **Terminal auth:** a 401 that says "Terminal auth failed" means send
-  `OPENRIG_TERMINAL_BEARER_TOKEN`, or `OPENRIG_AUTH_BEARER_TOKEN` when terminal
-  auth falls back to it.
-- **References:** `docs/reference/harness-runner-contract.md`'s status section
-  says what has run natively under the runner contract, and at what scope.
-  `docs/reference/telemetry.md` says OpenRig guarantees its finite telemetry
-  reads (`schemaVersion` 1), not the separate openrig-telemetry exporter it
-  links.
-- **Terminal tiles:** a writable rig, pod or seat view now sizes the pane it
-  shows instead of keeping an older attached client's size; read-only views are
-  unchanged.
-- **Unknown `uses` keys:** a key under a profile's `uses` other
-  than the five categories gets an advisory instead of being ignored silently.
-
-### Limits to keep in view
-
-- **OpenShell** hasn't run end to end on 0.7.10 (above). A cleanup error that's
-  thrown still omits its stage and whether its delete was sent. A
-  same-generation reconciled launch opens no viewer, so run
-  `rig environment connect` yourself; non-text startup actions aren't supported
-  on environment seats.
-- **`rig exec`:** no real adapter has run under it yet; one run per row,
-  detached ownership and reconciling were checked against a stand-in agent.
-  Concurrent runs, long or background tasks, recovery across a reboot, MCP
-  servers and Windows aren't covered. A Ctrl-C just before the connector is
-  launched isn't caught by `--wait`.
-- **Draft-aware delivery to Claude:** a narrow Claude pane showing
-  `✔ Update installed · Restart to update` on its own line can still hold
-  deliveries at an empty prompt, queue wakes included; 0.7.10 doesn't recognize
-  that bare banner. A held message isn't replayed automatically by that path.
-- **Seats handed over before 0.7.9** keep their adopted origin until a later
-  launched handover or managed launch records a new session. Until then
-  `rig seat stop`, `clean` and in-place restart refuse them, and now say why.
-  Don't use `rig unclaim` to get around it: that ends OpenRig's management of
-  the seat.
-- **Permission requests in seat status** show only the latest one, held in
-  memory for five minutes and lost on a daemon restart.
-- **Agent spec advisories** don't show for a native resume that continues a
-  saved conversation.
-- **The other 0.7.9 limits below still apply:** open updates for a person, Slack,
-  SSH host status, shared asks, permit records, existing seats, Codex hooks, and
-  grant-service assistants not being woken. 0.7.9's limits on a restore request
-  held after compaction, `rig broadcast`'s `FAILED`, what has run under the
-  runner contract, and Codex seats' `rig: command not found` are fixed or
-  changed. The 0.7.8 limits below that 0.7.9
-  didn't fix or change, and the
-  [0.7.7](https://github.com/mvschwarz/openrig/releases/tag/v0.7.7) and
-  [0.7.6](https://github.com/mvschwarz/openrig/releases/tag/v0.7.6) limits, still
-  apply.
-
----
-
-## What changed in OpenRig 0.7.9
-
-The changes from 0.7.8 to 0.7.9, published on 2026-11-06, for an install
-upgrading from 0.7.8 or earlier.
-
-### After the upgrade
-
-- **Restart the daemon** to load the new code: `rig daemon stop`, then
-  `rig daemon start`.
-  - **Migrations 146 to 149** record a Pi seat's guidance file, what OpenRig last
-    wrote in each managed guidance block, an index for reading a rig's outbox,
-    and the stream intake position.
-- **Tell the person that stream intake is on.** Each `rig stream emit` now opens
-  an intake row for the kernel queue worker (`queue.worker`), or adds a note to
-  the one still unclaimed, and the row wakes the queue worker like any queue row.
-  Earlier stream history isn't replayed. If they want 0.7.8's behaviour, with no
-  intake rows, run `rig config set stream.intake off`.
-- **The bundled openrig-core plugin goes from 0.1.24 to 0.1.25.** Its
-  seat-continuity-and-handover skill changed. Managed refresh preserves replaced
-  files under `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits
-  you still need from the preserved copy.
-- **Where seat guidance goes now:**
-  - a fresh Pi seat gets OpenRig's guidance in its own agent folder's
-    `AGENTS.md`, unless that file or folder is a link;
-  - a fresh Codex seat on Codex 0.164.0 or later gets it as launch developer
-    instructions, not in the repository `AGENTS.md`, when no config layer
-    OpenRig reads sets `developer_instructions`;
-  - a Codex resume, fork, restore or handover successor, an older or unknown
-    Codex, and a config layer that sets `developer_instructions` or can't be read
-    still use the repository `AGENTS.md`;
-  - if only the person's shell startup sets `CODEX_HOME`, OpenRig reads
-    `~/.codex`, so a `developer_instructions` set in their home is replaced for
-    that session. Declare the same absolute path as `CODEX_HOME` in the member's
-    or rig's `env:` to have it checked. `docs/reference/agent-startup-guide.md`
-    ("Codex guidance at launch") is the rule;
-  - a managed block a person edited by hand is kept and named
-    (`guidance_block_edited`), not replaced. Read the warning before you change
-    the block.
-- **Slack:** on the first start after upgrading, the connector edits the asks
-  that ended earlier to show they were handled, at Slack's edit rate: about an
-  hour for 450 asks. `rig slack status` shows pending edits.
-- **OpenShell:** rebuild a guest image built for 0.7.8 with this release's
-  helper; an older helper rejects the new startup step, and the error names the
-  rebuild.
-
-### Runner seats
-
-Section 7 of `docs/reference/harness-runner-contract.md` is the rule for
-permissions, and section 4 for activity. Read them before writing or changing a
-runner.
-- **Typed words:** a reply of just yes or no counts as the agent's allow or
-  reject. Any other words choose nothing: OpenRig's default permits the request
-  when the agent offered an allow option, and the read result carries the words
-  whole as `said`. A runner may queue them for the agent as an ordinary prompt
-  after the current turn, never as the answer; one that drops them still keeps
-  the contract. The ask now tells the person this.
-- **Permit records:** each permit OpenRig decides by default (no one to ask, or
-  an ask closed without a choice, including a row passed to an agent seat) is
-  recorded once, as a stream item from the seat, naming the tool call, why no
-  person answered and the option given. Read them with
-  `rig stream list --tag runner-permission-permit` or `--source <seat>`. A record
-  has no destination and never changes the permit. Stream intake reads past it, so
-  it opens no intake row and wakes no one.
-- **The working beat:** while a prompt is outstanding and the agent is alive, a
-  runner may post `active` / `liveness` so a long call keeps reading working.
-  After delivering an answer or permit, it posts `active` /
-  `permission_resolved`. A runner that sends no beats behaves as before. The Pi
-  runner and the dsh example post it.
-- **Check a runner** with
-  `node daemon/docs/reference/runner-conformance/check-runner.mjs --runner '<command with {agent}>' --name <harness>`.
-  It now covers the beat, and no longer falsely fails a correct runner on a busy
-  machine.
-- **The dsh example** reads `DSH_SEAT_BIN` and `DSH_SEAT_HOME` from the member's
-  `env:`, and section 8 names ACP's `session/resume`.
-
-### OpenShell workers
-
-0.7.9 includes a repair for the OpenShell worker that wasn't usable in 0.7.8,
-but the worker still doesn't work in 0.7.9. Don't rely on this path in 0.7.9.
-Startup reaches the guest through a hash-checked first-input file, and nothing
-is typed through the host viewer. Readiness checks the guest's own execution,
-and a failed owned delete reports the stage that failed. Release testing on
-0.7.9 then found two more problems: the guest's Claude couldn't reach its model
-(`SELF_SIGNED_CERT_IN_CHAIN`), because the guest launcher left out the CA
-settings the OpenShell exec supplies, and deleting an owned environment never
-sent the delete, because its inventory step misread a "Not Found" reply. 0.7.10's
-fixes for both are described above. "Never grant the guest access to the
-daemon's main API port (normally 7433)."
-
-### Assistants connected through a grant service (experimental)
-
-Experimental, unsupported, off by default, and at the person's own risk. With
-`rig mcp serve --http --grant-service <url>` and a grant service the person
-supplies and runs, a connected assistant can claim, update and park the rows
-addressed to its own seat, and see its team with `rig_team`, within the scope its
-existing tools have. Nothing wakes it: an item stays queued until its receiver
-claims it. Name the outside service, and the exposure of serving MCP over HTTP,
-to the person before you set this up. `docs/reference/hosted-members.md` is the
-rule.
-
-### Other changes to act on
-
-- **Held messages:** a seat that starts, or takes over a seat, with held
-  messages is told how many there are. Read them with
-  `rig seat held-messages <seat>`.
-- **Unconfirmed sends:** `rig send --verify` now reports unconfirmed and exits 1
-  when it can't see what its Enter did, and `rig walk` reports unconfirmed
-  instead of lost. Inspect the recipient before any resend.
-- **Deadlines:** to accept a re-estimate without unclaiming the work, run
-  `rig queue update <id> --closure-required-at <ISO>`.
-- **Shared workspaces:** any registered person can settle another's ask as
-  themselves, and the first committed answer wins; a later answer gets 409
-  `qitem_already_terminal` and records nothing. A person registered with no
-  connector binding is asked on Steering and in the Feed only.
-- **Handover:** a fresh or rebuild successor's first turn lists its startup
-  files, role first. A successor that started without a required startup file is
-  marked in the seat list.
-- **Ambiguous rig names:** when an active rig name matches more than one rig,
-  `rig env down`, `status` and `logs` list the matching rig IDs and stop, and
-  `rig doctor --spec` reports conformance as unknown. Use the rig ID.
-- **Seat activity:** window samples older than their bound no longer decide a
-  seat's activity, so a seat whose pane can't be read reads unknown rather than
-  its last verdict. Treat unknown as unknown, not idle.
-- **Launch options:** `specs.builtins_visible: false` hides built-in specs
-  (`rig specs ls --include-builtins` still lists them); `plugin_channels` gives
-  one Claude member its own `--channels`, untested with a real channel plugin.
-- **Files:** `rig down` removes OpenRig's own additions from a working folder
-  once no live seat uses them. `rig export` with no `-o` writes
-  `rig-export.yaml` beside an existing `rig.yaml`. `rig workspace validate` exits
-  1 for malformed optional frontmatter.
-- **Kernels:** a new default kernel starts in `<workspace.root>/kernel`.
-  Existing kernels stay where they are. `docs/reference/agent-startup-guide.md`
-  explains the optional move; a fresh launch there starts a new native
-  conversation, so ask the person before moving.
-- **PATH:** if preflight warns that a Codex seat's login shell can't find `rig`,
-  follow its fix. `getting-started.md` explains the `~/.profile` line and how to
-  check it with `bash -lc 'command -v node rig'`.
-
-### Limits to keep in view
-
-- **OpenShell:** the worker doesn't work in 0.7.9 (above). A same-generation
-  reconciled launch opens no viewer, so run `rig environment connect` yourself;
-  non-text startup actions aren't supported on environment seats.
-- **Open updates for a person** read a 1,001-row window, so a page can come back
-  short, marked `truncated`.
-- **Slack:** a private channel needs the documented route, which isn't tested,
-  and direct messages aren't supported. The channel and people reads haven't
-  been run against a live Slack workspace. Redaction of the bot token from a
-  transport error can still leave a malformed token fragment shorter than six
-  characters, so review an error before sharing it.
-- **SSH host status** reads `unknown` behind a ProxyJump or ProxyCommand; that
-  isn't proof the connection is broken. `rig host ls` reads the ssh config with
-  `ssh -G`, which runs any `Match exec` command in it.
-- **Shared asks:** a click's option written before its answer row can stand
-  beside or inside the closer's answer without the first clicker's authorship.
-- **Permit records** last as long as stream retention keeps them. A permit a
-  runner makes on its own, when it can't reach OpenRig, is in its pane only. For
-  an ask opened before 0.7.9, a record may omit the option's kind.
-- **Existing seats** pick up Codex launch instructions and the single
-  openrig-core skill load at their next fresh launch. A `CLAUDE.md` or
-  `AGENTS.md` that already grew a line per launch isn't trimmed.
-- **Codex hooks after an upgrade:** Codex sessions kept running across the
-  upgrade show "Hook failed — plugin contents changed; hook approval required"
-  until relaunched.
-- **0.7.8's limits** on the dsh `env:` names, conformance false failures, typed
-  words, the README's operator address, a symlinked rebuild, the rebuild receipt,
-  a re-parked click and unrecorded default permits are fixed or changed. The
-  other 0.7.8 limits below, and the
-  [0.7.7](https://github.com/mvschwarz/openrig/releases/tag/v0.7.7) and
-  [0.7.6](https://github.com/mvschwarz/openrig/releases/tag/v0.7.6) limits, still
-  apply.
-
----
-
-## What changed in OpenRig 0.7.8
-
-The changes from 0.7.7 to 0.7.8, published on 2026-11-05, for an install
-upgrading from 0.7.7 or earlier.
-
-### After the upgrade
-
-- **Restart the daemon** to load the new code: `rig daemon stop`, then
-  `rig daemon start`.
-  - **Migrations 142 to 145** store a Claude seat's MCP opt-out, seat activity
-    grants, OpenShell environment bindings and a seat's chosen permission person.
-- **The bundled openrig-core plugin goes from 0.1.23 to 0.1.24.** One skill line
-  changed. Managed refresh preserves replaced files under
-  `$OPENRIG_HOME/backups/managed-refresh/<id>/`; reapply local edits you still
-  need from the preserved copy.
-
-### Runner seats: a person answers permission requests
-
-Section 7 of `docs/reference/harness-runner-contract.md` is the rule. Read it
-before writing or changing a runner.
-- **Who is asked:**
-  - **the default person** (`rig gateway default`, or the only registered
-    person) gets an ordinary ask in the Feed and on Slack;
-  - **a chosen person,** after
-    `rig seat set-permissions-to <seat> --to <person> --reason "…"`. `--clear`
-    returns to the default;
-  - **no one:** when no one can be asked, the request is "Permitted at once,
-    with the agent's own allow option";
-  - **refusal** is opt-in, with `--deny`. `rig seat status` shows the choice.
-- **What a person's answer does:** a click gives that option, a plain yes gives
-  the allow, and a plain no gives the reject. "A person's no is never a grant."
-  An unanswered request stays pending until the agent's turn ends.
-- **The runner's protocol:**
-  - `POST /api/activity/permission-requests` submits the request;
-  - `GET …/<askId>?waitSeconds=25` reads the answer (25 at most);
-  - `POST …/<askId>/withdraw` withdraws it at the turn's end.
-
-  Deliver an answer once, only to the live request.
-- **Check a runner** with
-  `node daemon/docs/reference/runner-conformance/check-runner.mjs --runner '<command with {agent}>' --name <harness>`
-  from the installed package. It needs Node and tmux, and no daemon, model or
-  network.
-- **The worked example** is the dsh runner under
-  `daemon/docs/reference/community-harness-examples/dsh/`.
-- **A seat activity grant** lets a runner outside the host's hook setup report
-  activity for one seat and launch, without the install-wide hook token.
-
-### OpenShell workers
-
-0.7.8 includes `rig environment` (`setup`, `create`, `attach`) and a reference
-for binding a seat to an NVIDIA OpenShell sandbox (`daemon/assets/openshell/README.md`).
-**In our release testing the worker never became usable:** after the sandbox was
-created and the native process started, `rig environment connect` failed when its
-check timed out after 5 seconds, so no team work ran. Don't rely on this path in
-0.7.8; the later repairs are described above.
-
-**What it needs:**
-- NVIDIA OpenShell 0.1.6;
-- a Linux image;
-- an API-backed provider using `ANTHROPIC_API_KEY`. Subscription or OAuth
-  credentials aren't supported.
-
-"Provider registration and image construction can incur costs", so name them to
-the person before you start. "Never grant the guest access to the daemon's main
-API port (normally 7433)."
-
-### Other changes to act on
-
-- **Mission following:** `rig terminal open mission:<id> --follow --provider herdr`
-  follows a mission's current owners, with the same Herdr path as slices.
-- **Launch choices:**
-  - `claude_mcp: none` on a Claude member launches it without MCP servers;
-  - `rig config set terminal.tmux_server isolated` gives this OpenRig home its
-    own persistent tmux server.
-- **Hosts:** `rig host edit` and `rig host remove` correct or retire a host
-  entry. Use them instead of editing `hosts.yaml` by hand.
-- **Another user's daemon:** when `rig doctor` warns that the port is held by
-  another OS user's daemon, follow its fix (`rig config set daemon.port <free-port>`),
-  or set `OPENRIG_URL` to share that daemon on purpose.
-- **tmux control mode:** with `OPENRIG_TMUX_CONTROL=1`, OpenRig starts a control
-  client only on tmux 3.7c or newer, and uses spawned clients otherwise.
-- **Read-only tmux clients:** a submit key refused because of one goes through
-  the paste route.
-- **Slack:** a typed reply to a decision parked on its person is recorded as the
-  answer. Read the person's words; don't treat the close as approval.
-- **The TUI:** agent pages now show health findings and recently finished items,
-  and an agent spec's "not loaded in this view" means it wasn't read, not that
-  nothing runs it.
-
-### Limits to keep in view
-
-- ~~**No harness has run end to end under the runner contract yet.** The dsh
-  example and the conformance check were checked against stand-ins.~~ *Corrected
-  after release:* 0.7.8's release testing ran a real dsh 0.2.1-rc.2 through the
-  shipped dsh example runner for a person's allow-once and reject-once, and
-  through an outside runner, dsh-seat 0.3.0, for launch, queue work, multiline
-  input, activity, cancel and exact resume. The conformance check itself runs
-  against a stand-in agent.
-- **The answer owner is a registered person,** and a colleague's answer is
-  followed on this host only. A request handed to another host waits as needs
-  input until the turn ends.
-- **Permits and answers aren't recorded** beyond the runner's pane and the ask.
-  If the agent offers only `allow_always`, a permit makes its harness remember a
-  permission nobody chose.
-- **Coming as follow-ups:** recording permits made when no one can be asked, and
-  passing typed words that aren't a plain yes or no to the agent.
-- **The dsh example keeps one hold per seat:** two asks in one turn can leave one
-  waiting after the hold is released.
-- **An OpenShell worker's activity reads unknown,** sampled from the pane, never
-  idle.
-- **The [0.7.7](https://github.com/mvschwarz/openrig/releases/tag/v0.7.7) and
-  [0.7.6](https://github.com/mvschwarz/openrig/releases/tag/v0.7.6) limits still apply.**
+- **A new Claude seat's startup text can stay in its input box unsent.** If a fresh Claude seat sits idle with text at
+  its prompt, press Enter in its pane, or ask the person to.
+- **Claude seats on a macOS native install can read as needing attention after a restore.** Check the pane before
+  acting on it.
+- **A Slack channel-mapping change needs a daemon restart.** Don't use `rig slack disable` then `enable` for it: enabling
+  marks any alerts waiting to post to Slack as already seen.
+- **Ubuntu 22.04's tmux 3.2a:** the query known to crash its server is gone, but a narrower race remains. Avoid 3.2a
+  (`tmux -V`).
+- **`rig daemon start` can take 20 to 40 seconds** before its listener warning, longer than the TUI's 30-second "restore
+  everything" wait. On a slow host, start the daemon yourself first.
+- **A launch that warns "Scoped tmux environment unavailable; retaining the previous environment"** didn't give that seat
+  the clean environment. Check `env` in the seat before relying on OpenRig's variables.
+- **Going back to 0.7.0 with a Slack subscription set:** 0.7.0 can't read a person file that holds one, and its people
+  registry stops loading. Save the choice first (`rig gateway human show <id> --json > <id>.json`), then run
+  `rig gateway human set <id> slack-subscription unset` (`urgent-only` becomes every-ask, as on 0.7.0); set it again after
+  returning to 0.7.1. A person file still holding a `subscriptions:` entry fails on 0.7.0 too. Don't restore an older
+  gateway folder or database instead: that can lose newer people, bindings and delivery records.
+- **A Herdr tile over SSH** doesn't come back by itself after a Herdr restart. Reopen it with `rig terminal open <view>
+  --provider herdr`.
+- **Delegated decisions:** the ask is created before the decision, so without quiet hours it can post to the person
+  first. Pair a decision room with quiet hours, or decide before asking.
+- **`restore-check` still treats a missing startup file as rig-wide.** Trust `rig up --existing`'s per-seat result.
+- **Managed Claude launch requires `/usr/bin/env` support for `-0` and `-u`** (option support checked on GNU coreutils
+  and macOS 15; BusyBox and older macOS unverified). Without the required option support, launch stops instead of
+  falling back to credential-bearing command-line arguments.
+- **In draft-aware mode, an agent's multi-line message to a Claude seat can remain unsubmitted when the paste changes
+  Claude's footer hint.** OpenRig withholds Enter, leaving the text in the composer and later sends waiting. Observed on
+  Claude 2.1.309 with both 0.7.0 and the 0.7.1 pre-cut build; #14 remains open.
+- **A Claude seat signed in with a long-lived token (`claude setup-token`) gets no usage reading.** The reader accepts
+  only claude.ai subscription logins and reports `not_subscription_login`.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "openrig",
-  "version": "0.7.11",
+  "version": "0.7.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "openrig",
-      "version": "0.7.11",
+      "version": "0.7.1",
       "license": "Apache-2.0",
       "workspaces": [
         "packages/daemon",
@@ -7298,7 +7298,7 @@
     },
     "packages/cli": {
       "name": "@openrig/cli",
-      "version": "0.7.11",
+      "version": "0.7.1",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -7336,7 +7336,7 @@
     },
     "packages/daemon": {
       "name": "@openrig/daemon",
-      "version": "0.7.11",
+      "version": "0.7.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@hono/node-server": "^1.13.0",
@@ -7379,7 +7379,7 @@
     },
     "packages/ui": {
       "name": "@openrig/ui",
-      "version": "0.7.11",
+      "version": "0.7.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@fontsource-variable/jetbrains-mono": "^5.2.8",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openrig",
-  "version": "0.7.11",
+  "version": "0.7.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

packages/acp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/acp",
-  "version": "0.7.11",
+  "version": "0.7.1",
   "description": "OpenRig as an agent in ACP apps: starts rig acp serve from the @openrig/cli it pins.",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@openrig/cli": "0.7.11"
+    "@openrig/cli": "0.7.1"
   },
   "license": "Apache-2.0",
   "author": {

packages/acp/registry/agent.json

@@ -1,7 +1,7 @@
 {
   "id": "openrig",
   "name": "OpenRig",
-  "version": "0.7.11",
+  "version": "0.7.1",
   "description": "Send work to your OpenRig team of agents and follow it through to the result",
   "repository": "https://github.com/mvschwarz/openrig",
   "website": "https://openrig.dev",
@@ -12,7 +12,7 @@
   "license_url": "https://github.com/mvschwarz/openrig/blob/main/LICENSE",
   "distribution": {
     "npx": {
-      "package": "@openrig/[email protected]1"
+      "package": "@openrig/[email protected]"
     }
   }
 }

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/cli",
-  "version": "0.7.11",
+  "version": "0.7.1",
   "type": "module",
   "description": "Build your own network of agents from Claude Code, Codex and Pi: persistent teams with roles, shared context and owned work.",
   "keywords": [

packages/cli/src/client.ts

@@ -437,9 +437,9 @@ export class DaemonClient {
     // DaemonResponseError carrying the status + a bounded snippet, instead of a
     // raw SyntaxError bubbling to a cryptic (json) or silent (human) CLI exit.
     // A well-formed non-2xx body still parses and returns {status,data}; 204 has none.
-    if (res.status === 204) return { status: res.status, data: undefined as T };
+    if (res.status === 204) return { status: res.status, data: undefined as T, headers: res.headers };
     try {
-      return { status: res.status, data: JSON.parse(text) as T };
+      return { status: res.status, data: JSON.parse(text) as T, headers: res.headers };
     } catch {
       throw new DaemonResponseError(res.status, text);
     }

packages/cli/src/commands/config.ts

@@ -107,6 +107,14 @@ Keys:
                          than N days; 0 keeps them (default). Removed events no longer replay from /api/events, leave
                          the telemetry export, the log and the feed, and can't be brought back. Read at the next sweep
                          (daily and at daemon start)
+  retention.closed_content_days  remove the content of closed queue work (done, canceled, denied, handed-off) N
+                         days after it closed; the row stays, without content. 0 keeps it (default). Can't be undone
+  retention.closed_metadata_days  delete closed queue rows N days after they closed, keeping only their ids so a retry
+                         can't recreate them. 0 keeps them (default). Both read at the next sweep; "rig queue erase
+                         --routine --apply" runs them now
+  retention.erasure_ledger  an absolute file where queue erasure appends each erased id and its action, one JSON
+                         line each, before it commits them; keep it outside backups and replay it with "rig queue
+                         erase --ids <file> --apply" after a restore. Empty keeps no ledger (default)
   launch.non_interruptive  accept harness first-launch warnings at full bypass for new rigs (default off)
   launch.codex_login_shell  defer to Codex's own login-shell setting in managed Codex seats (default off)
                          Off adds allow_login_shell=false: tool commands inherit the seat's environment, so plain rig

packages/cli/src/commands/context.ts

@@ -42,6 +42,8 @@ import {
 import { realDeps } from "./daemon.js";
 import { prepareDaemonAutoStart } from "../daemon-auto-start.js";
 import { readOpenRigEnv } from "../openrig-compat.js";
+import { resolveRecapSeat, type RigSeat } from "../recap-seat.js";
+import { parseSessionName } from "../session-name.js";
 import type { StatusDeps } from "./status.js";
 import { reconstructionCommand } from "./context-reconstruction.js";
 
@@ -424,6 +426,28 @@ Examples:
     return deps.clientFactory(getDaemonUrl(status));
   }
 
+  /** A rig's seats as the daemon records them, for mapping a recap's --seat by identity. Never starts the daemon. */
+  async function rigSeats(rig: string): Promise<RigSeat[] | { unavailable: string }> {
+    try {
+      const client = await getClient();
+      const rigs = await client.get<Array<{ rigId: string; name: string }>>("/api/ps");
+      if (rigs.status !== 200 || !Array.isArray(rigs.data)) return { unavailable: `the daemon's rig list returned HTTP ${rigs.status}` };
+      const ids = rigs.data.filter((entry) => entry.name === rig).map((entry) => entry.rigId);
+      if (ids.length !== 1) return { unavailable: ids.length ? `${ids.length} rigs are named ${rig}` : `the daemon has no rig named ${rig}` };
+      const nodes = await client.get<Array<{ logicalId: string; podNamespace?: string | null; canonicalSessionName: string | null }>>(
+        `/api/rigs/${encodeURIComponent(ids[0]!)}/nodes`);
+      if (nodes.status !== 200 || !Array.isArray(nodes.data)) return { unavailable: `the daemon's seat list returned HTTP ${nodes.status}` };
+      return nodes.data.flatMap((node) => {
+        const session = node.canonicalSessionName ? parseSessionName(node.canonicalSessionName) : undefined;
+        if (session?.kind !== "canonical") return [];
+        const pod = node.podNamespace;
+        return [{ logicalId: node.logicalId, member: pod && node.logicalId.startsWith(`${pod}.`) ? node.logicalId.slice(pod.length + 1) : node.logicalId, folder: session.member }];
+      });
+    } catch (err) {
+      return { unavailable: (err as Error).message };
+    }
+  }
+
   // OPR.0.5.3.6 — the productized chain-file trace. Daemon-independent by
   // design: the walk is a config read + filesystem reads, so it works on a
   // box whose daemon is down (orientation is exactly when that happens).
@@ -786,14 +810,21 @@ Examples:
   // tree (a sandboxed seat) hands the same recap to the daemon, which owns it.
   cmd.command("recap-write")
     .description("Write this seat's authored RECAP (decisions-with-rationale) at the handover boundary; supersedes the previous recap into the seat's chain")
-    .requiredOption("--rig <rig>", "Rig name (the rigs/<rig> altitude)")
-    .requiredOption("--seat <seat>", "Seat id (the seats/<seat> altitude)")
+    .option("--rig <rig>", "Rig name (the rigs/<rig> altitude; default: this seat's rig, from OPENRIG_SESSION_NAME)")
+    .option("--seat <seat>", "The seat's folder: the part of its session name before @, e.g. dev-qa (default: this seat). A seat's recorded logical id or member id maps to its folder when the daemon can check it")
     .requiredOption("--file <path>", "Markdown file containing the recap content")
-    .action(async (opts: { rig: string; seat: string; file: string }) => {
+    .action(async (opts: { rig?: string; seat?: string; file: string }) => {
       try {
         const { writeSeatRecapAt, validateRecapContract } = await import("@openrig/daemon/seat-recap-store");
         const content = readFileSync(opts.file, "utf-8");
         const topologyRoot = String(new ConfigStore().resolveWithSource("topology.root").value);
+        const sessionName = readOpenRigEnv("OPENRIG_SESSION_NAME", "RIGGED_SESSION_NAME")?.trim();
+        const own = sessionName ? parseSessionName(sessionName) : undefined;
+        const rigName = opts.rig ?? (own?.kind === "canonical" ? own.rig : undefined);
+        // A named seat is checked against the rig's recorded seats when the daemon answers; a failed check doesn't stop the write.
+        const seats = opts.seat !== undefined && rigName ? await rigSeats(rigName) : undefined;
+        const target = resolveRecapSeat({ rig: opts.rig, seat: opts.seat, topologyRoot, sessionName, seats });
+        if ("error" in target) { console.error(target.error); process.exitCode = 1; return; }
         for (const f of validateRecapContract(content)) {
           console.error(f.kind === "no-decisions-section"
             ? "ADVISORY no-decisions-section: the authoring contract asks for decisions WITH rationale — conclusions alone are the lossy handoff shape."
@@ -801,7 +832,7 @@ Examples:
         }
         let written: { path: string; superseded: number; daemonUrl?: string };
         try {
-          written = writeSeatRecapAt({ topologyRoot, rig: opts.rig, seat: opts.seat, content });
+          written = writeSeatRecapAt({ topologyRoot, rig: target.rig, seat: target.seat, content });
         } catch (err) {
           if (!WRITE_REFUSED_CODES.has((err as NodeJS.ErrnoException).code ?? "")) throw err;
           // The daemon owns the topology tree (it primes RECAP.md at the next rebuild): it writes the same recap through
@@ -809,12 +840,13 @@ Examples:
           // that can't be reached is reported with its reason.
           console.error(`Note: this process can't write the topology tree (${(err as Error).message}), so the daemon writes the recap instead.`);
           const client = await getClient();
-          const res = await client.post<{ path?: string; superseded?: number; message?: string }>("/api/context-packs/seat-recap", { rig: opts.rig, seat: opts.seat, content });
+          const res = await client.post<{ path?: string; superseded?: number; message?: string }>("/api/context-packs/seat-recap", { rig: target.rig, seat: target.seat, content });
           if (res.status !== 200 || typeof res.data.path !== "string") throw new Error(res.data.message ?? `Daemon returned HTTP ${res.status}`);
           written = { path: res.data.path, superseded: res.data.superseded ?? 0, daemonUrl: client.baseUrl };
         }
         console.log(`Recap written: ${written.path}${written.superseded > 0 ? ` (${written.superseded} superseded predecessor${written.superseded === 1 ? "" : "s"} retained)` : ""}`
           + (written.daemonUrl ? `, by the daemon at ${written.daemonUrl}` : ""));
+        for (const note of target.notes) console.error(`Note: ${note}`);
       } catch (err) {
         // A daemon write that timed out says its outcome is unknown, so it's checked before a retry supersedes it again.
         if (!renderCaughtTransportError(err)) console.error((err as Error).message);

packages/cli/src/commands/daemon.ts

@@ -2,7 +2,7 @@ import { Command } from "commander";
 import fs from "node:fs";
 import { createServer } from "node:net";
 import { randomUUID } from "node:crypto";
-import { acquireDaemonStartLock } from "../daemon-start-lock.js";
+import { acquireDaemonStartLock, bootedAtMs, currentBootId } from "../daemon-start-lock.js";
 import { formatDaemonHostForUrl } from "../client.js";
 import { execFileSync, spawn } from "node:child_process";
 import { fetchWithTimeout } from "../fetch-with-timeout.js";
@@ -94,7 +94,11 @@ export function realDeps(): LifecycleDeps {
 
   return {
     processLiveness,
-    acquireStartLock: () => acquireDaemonStartLock(OPENRIG_DIR),
+    acquireStartLock: () => {
+      const lock = acquireDaemonStartLock(OPENRIG_DIR, { bootId: currentBootId(), bootedAtMs: bootedAtMs(), processLiveness });
+      if (lock.archived) console.error(`A start reservation from before this boot was left behind; archived it as ${lock.archived}`);
+      return lock;
+    },
     spawn: (cmd, args, opts) => spawn(cmd, args, opts as Parameters<typeof spawn>[2]),
     fetch: async (url) => {
       const res = await fetchWithTimeout(globalThis.fetch, url, {}, {
@@ -165,7 +169,7 @@ export function daemonCommand(depsOverride?: LifecycleDeps): Command {
   cmd
     .command("start")
     .description("Start the daemon")
-    .addHelpText("after", "\nStartup reserves this local instance before initialization and verifies the spawned child PID on every required listener.\nMissing/mismatched identity or child exit fails startup; failed publication withdraws only this launch's matching state. Use a matching CLI/daemon installation.\nA concurrent start fails without spawning another child. Inspect daemon-start.lock for launcher/child PIDs after an interrupted start;\nonly archive an abandoned reservation after proving both processes absent. A failed cleanup retains it and reports the child PID.\n")
+    .addHelpText("after", "\nStartup reserves this local instance before initialization and verifies the spawned child PID on every required listener.\nMissing/mismatched identity or child exit fails startup; failed publication withdraws only this launch's matching state. Use a matching CLI/daemon installation.\nA concurrent start fails without spawning another child. Inspect daemon-start.lock for launcher/child PIDs after an interrupted start;\nonly archive an abandoned reservation after proving both processes absent. A failed cleanup retains it and reports the child PID.\nA reservation from an earlier boot is archived as daemon-start.lock.abandoned-<time> and the start goes on.\n")
     .option("--port <port>", "Port to listen on")
     .option("--host <host>", "Host to bind on")
     .option("--db <path>", "Database path")
@@ -267,13 +271,19 @@ export function daemonCommand(depsOverride?: LifecycleDeps): Command {
         // need a kernel-ready signal opt in here.
         if (opts.waitForKernel) {
           const { waitForKernelReady, skippedKernelMessage } = await import("../daemon-lifecycle.js");
+          const { attentionLines, checkKernelAttention } = await import("../seat-attention.js");
+          const { DaemonClient } = await import("../client.js");
           const timeoutMs = opts.waitForKernelMs && /^\d+$/.test(opts.waitForKernelMs)
             ? parseInt(opts.waitForKernelMs, 10)
             : 60_000;
           const baseUrl = `http://${formatDaemonHostForUrl(state.host ?? "127.0.0.1")}:${state.port}`;
           const result = await waitForKernelReady(baseUrl, timeoutMs);
+          // A kernel seat held at a startup prompt or sign-in keeps the kernel short of ready: name it and why.
+          const heldLines = result.kernelState !== "ready" && result.kernelState !== "skipped"
+            ? attentionLines(await checkKernelAttention(new DaemonClient(baseUrl)), "pane").map(line => `  ${line}`) : [];
           if (result.ok) {
             console.log(`Kernel ${result.kernelState}; variant=${result.variant ?? "(none)"}`);
+            for (const line of heldLines) console.log(line);
           } else if (result.kernelState === "skipped") {
             // Skipped on purpose, so neither a timeout nor an auth problem: say why, and the way back.
             console.error(skippedKernelMessage(result.detail));
@@ -287,6 +297,7 @@ export function daemonCommand(depsOverride?: LifecycleDeps): Command {
                 "\n" +
                 "Fix: inspect `rig ps --rig kernel` for stalled agents, or run `claude auth status` / `codex login status` to confirm runtime auth.",
             );
+            for (const line of heldLines) console.error(line);
             process.exitCode = 1;
           }
         }

packages/cli/src/commands/gateway.ts

@@ -281,7 +281,7 @@ Examples:
     .description("List the registered people, with delivery readiness and quiet hours (rig gateway participants adds organizations, groups, policy and shared channels)")
     .option("--json", "Complete record(s) as JSON")
     .action(async (opts: { json?: boolean }) => {
-      const { listHumans } = await import("@openrig/daemon/gateway-human-registry");
+      const { listHumans, NO_HUMAN_CONFIGURED } = await import("@openrig/daemon/gateway-human-registry");
       const res = listHumans();
       if (!res.ok) { console.error(`refused: ${res.error}`); process.exitCode = 1; return; }
       const humans = await Promise.all(res.humans.map(async (record) => {
@@ -290,7 +290,7 @@ Examples:
           quiet: quiet.ok ? quiet.quiet : { unknown: `quiet hours could not be read from the daemon: ${quiet.reason}` } };
       }));
       if (opts.json) { console.log(JSON.stringify({ ok: true, humans })); return; }
-      if (res.humans.length === 0) { console.log("no human configured yet — register one: rig gateway human add <entityId> --display-name … --binding … --delivery-class …"); return; }
+      if (res.humans.length === 0) { console.log(NO_HUMAN_CONFIGURED); return; }
       for (const h of humans) {
         const inbound = h.bindings.inboundResolvable || !h.bindings.primary ? "" : "  [outbound-only]";
         const primary = h.bindings.primary ? `primary ${h.bindings.primary.kind}:${h.bindings.primary.connectorRef}` : "no connector: Feed and Steering only";
@@ -567,9 +567,14 @@ Examples:
 
   human
     .command("set <entityId> <field> <value>")
-    .description("Edit one field through the verb (same validation as add; re-projection immediate). Fields: display-name, delivery-class, away, availability (available|focus|away|off, or unset), slack-subscription (the person's Slack subscription: every-ask, the default, posts every ask to Slack too; urgent-only posts only asks created with --alert, the rest wait on Steering and the TUI; or unset), binding.<n>; and, kept in the participant side file: organization (an id, or unset), groups (comma-separated ids, or unset), policy (text, @<path> to read a file, or unset)")
+    .description("Edit one field through the verb (same validation as add; re-projection immediate). Fields: display-name, delivery-class, away, availability (available|focus|away|off, or unset), slack-subscription (the person's Slack subscription: every-ask, the default, posts every ask to Slack too; urgent-only posts only asks created with --alert, the rest wait on Steering and the TUI; or unset), binding.<n> (a full kind:connectorRef:secretsRef:role[:handle=<id>] spec, or unset to remove that binding); and, kept in the participant side file: organization (an id, or unset), groups (comma-separated ids, or unset), policy (text, @<path> to read a file, or unset)")
     .option("--reason <reason>", "Reason recorded with connector binding changes", "update human binding")
     .option("--actor <actor>", "Named operator when outside a managed seat")
+    .addHelpText("after", `
+Removing a connector binding (binding.<n> unset):
+  - The one-primary rule stays: no replacement primary is chosen silently. If removing a primary binding would leave other bindings, the command refuses. To replace the primary in place, set its slot to the new primary spec; to promote an existing secondary binding, first save that binding's full spec (kind:connectorRef:secretsRef:role[:handle=<id>]) from rig gateway human show <entityId> --json, then unset that secondary slot, then find the primary's current slot in remainingBindings (or rig gateway human show <entityId> --json, since the primary's slot shifts down when a lower-index secondary is removed) and set it to the saved spec with role primary (promotion replaces the former primary binding; its connector reference and inbound handle are not retained as a secondary); to remove every binding, unset the secondary bindings first using their current slot indexes from remainingBindings or rig gateway human show <entityId>, then finish at binding.0 (once all secondaries are gone, the primary is at binding.0).
+  - Remaining bindings are printed with their shifted binding.<n> slot indexes (the primary's slot shifts down too when a lower-index secondary is removed). Because indexes shift after removal, do not blindly retry 'binding.0 unset'; check remainingBindings, the receipt, or 'rig gateway human show <entityId>' before retrying.
+  - Removing a binding keeps the person, their preferences, their other bindings and their open questions. Removing the last binding makes the current delivery episode inactive, so new missing-post findings stop (an already-open recovery item for an undelivered notice may remain); the current delivery-outcome display may disappear too, while historical receipt notes remain. It does not answer, close or cancel open questions, cancel or reroute already-prepared deliveries, or retract anything a bridge has already accepted.`)
     .action(async (entityId: string, field: string, value: string, opts: { reason: string; actor?: string }) => {
       const registry = await import("@openrig/daemon/gateway-human-registry");
       if (field === "organization" || field === "groups" || field === "policy") {
@@ -602,7 +607,19 @@ Examples:
               return { value: res, after: { digest }, effect: digest === prior ? "no-op" : "applied" };
             },
           });
-          console.log(JSON.stringify({ ok: true, entityId, field, path: result.value.path, receipt: result.receipt }));
+          console.log(JSON.stringify({
+            ok: true,
+            entityId,
+            field,
+            path: result.value.path,
+            receipt: result.receipt,
+            ...(value === "unset"
+              ? {
+                  remainingBindings: result.value.remainingBindings ?? [],
+                  note: result.value.note,
+                }
+              : {}),
+          }));
         } catch (error) { console.error(`refused: ${(error as Error).message}`); process.exitCode = 1; }
         return;
       }

packages/cli/src/commands/launch.ts

@@ -35,7 +35,7 @@ type LaunchResponse = {
 // operator must act). These are NOT successful launches — never print "Launched" for
 // them; exit non-zero. Mirrors the daemon's NON_RUNNING_LAUNCH_STATUSES.
 const NON_RUNNING_LAUNCH_STATUSES = new Set(["awaiting-decision", "attention_required", "failed", "left_attached"]);
-function launchStatusRunning(status: string): boolean {
+export function launchStatusRunning(status: string): boolean {
   return !NON_RUNNING_LAUNCH_STATUSES.has(status);
 }
 

packages/cli/src/commands/proof.ts

@@ -143,6 +143,11 @@ export function proofCommand(): Command {
 The selected daemon owns show/judge. Scope addresses are mission/slices/slice#item.
 The project owner selects proofPolicy: { judges: [exact-seat-address] } in the
 owning slice.yaml, mission.yaml or project.yaml (nearest wins; no default gate roles).
+By default an item's latest judgment from any listed judge decides it. Add
+everyJudge: true to require every listed judge's own current accept: one judge's
+accept then can't hide another's reject, withdraw, missing judgment or stale
+evidence. Turning it on is a policy change, so earlier judgments must be recorded
+again. rig proof show lists each judge's own latest judgment either way.
 The contract is the authored ## Proof contract. A sole item needs no # selector.
 
 Example (existing evidence, no copied hashes or operation key):
@@ -163,9 +168,17 @@ checkboxes do not accept an item under the selected proof policy.
     if (cmd.opts().workspace) throw new Error("--workspace applies to proof add. Select the judgment daemon using OPENRIG_URL; proof show reports its scope basis.");
     return new DaemonClient();
   };
-  const response = async (r: { status: number; data: unknown }): Promise<Record<string, any>> => {
+  // A path_escape response names the supported routes to another workspace's tree.
+  const projectSelected = (project: unknown, scope: unknown) => Boolean(project) || /^[^/:]+:/.test(typeof scope === "string" ? scope : "");
+  const escapeHint = (project: boolean) => project
+    ? "\nThe scope is outside that project's missions root; name a mission/slice path inside it."
+    : "\nThe scope is outside the selected daemon workspace. For a catalog project, pass --project <id> or prefix the scope with <project>:."
+      + " To use another daemon's workspace, select that daemon with OPENRIG_URL.";
+  const response = async (r: { status: number; data: unknown }, project = false): Promise<Record<string, any>> => {
     const data = r.data as Record<string, any>;
-    if (r.status >= 400) throw new Error(`${data.error ?? r.status}: ${data.message ?? "Read the named source and retry"}`);
+    if (r.status >= 400) {
+      throw new Error(`${data.error ?? r.status}: ${data.message ?? "Read the named source and retry"}${data.error === "path_escape" ? escapeHint(project) : ""}`);
+    }
     return data;
   };
   const projectHelp = "Workspace-catalog project id; resolves the scope under that project's missions root (same as a <project>:<scope> prefix)";
@@ -175,7 +188,7 @@ checkboxes do not accept an item under the selected proof policy.
     .action(async (scope, opts) => {
       try {
         const query = new URLSearchParams({ ...(opts.project ? { project: opts.project } : {}), ...(scope ? { scope } : {}) }).toString();
-        const data = await response(await client().get(`/api/proof${query ? `?${query}` : ""}`));
+        const data = await response(await client().get(`/api/proof${query ? `?${query}` : ""}`), projectSelected(opts.project, scope));
         console.log(opts.json ? JSON.stringify(data) : JSON.stringify(data, null, 2));
       } catch (e) { console.error(e instanceof Error ? e.message : String(e)); process.exitCode = 1; }
     });
@@ -196,7 +209,7 @@ checkboxes do not accept an item under the selected proof policy.
         const refs = [...new Set<string>([...opts.evidence, ...(opts.comparison ? [opts.comparison] : [])])];
         const query = new URLSearchParams({ ...(opts.project ? { project: opts.project } : {}), scope });
         for (const ref of refs) query.append("evidence", ref);
-        const c = client(), view = await response(await c.get(`/api/proof?${query}`));
+        const c = client(), view = await response(await c.get(`/api/proof?${query}`), projectSelected(opts.project, scope));
         const items = view.items as Array<{ id: string; text: string; index: number; revision: string; judgment: { id: string } | null }> | undefined;
         const item = selector ? items?.find(i => i.id === selector || i.text === selector || String(i.index) === selector) : items?.length === 1 ? items[0] : undefined;
         if (!item) throw new Error("Select one current item with scope#item; rig proof show lists IDs, text and indices");
@@ -209,7 +222,7 @@ checkboxes do not accept an item under the selected proof policy.
           operationId: opts.operationId, replace: opts.replace === true, ...(opts.project ? { project: opts.project } : {}),
           // Pin the project root the prepared read resolved; the daemon refuses (409 project_changed) if it moved.
           ...((view.project as { root?: string } | undefined)?.root ? { projectRoot: (view.project as { root: string }).root } : {}) };
-        const result = await response(await c.post("/api/proof/judge", body));
+        const result = await response(await c.post("/api/proof/judge", body), projectSelected(opts.project, scope));
         console.log(opts.json ? JSON.stringify(result) : JSON.stringify(result, null, 2));
       } catch (e) { console.error(e instanceof Error ? e.message : String(e)); process.exitCode = 1; }
     });

packages/cli/src/commands/provider.ts

@@ -605,7 +605,7 @@ and native credential-store requirements are unchanged. No fresh account home or
 Do not combine --api-key-file with --account-home or --clear-account-home; select a home and switch credentials separately.
 Pi seats support --account-home with an existing readable auth.json, or --clear-account-home, through a fresh successor
 with a handover. Their current model and effort are retained unless overridden. Pi account changes work with or without
-a launch_wrapper; changing a seat between Pi and another runtime is not supported.
+a launch_wrapper. To change runtime, use rig seat set-runtime with --runtime pi, codex or claude-code.
 --clear-account-home returns to the configured member/rig/daemon/native home through a fresh successor with a handover.
 Use it without --to-account, --stored-login, --account-home or --token-file. It removes an account-home token reference
 only after confirmation; it does not restore historical login bytes. Anthropic active/default profiles live outside

packages/cli/src/commands/ps.ts

@@ -43,7 +43,7 @@ interface PsEntry {
   isArchived?: boolean;
 }
 
-interface NodeEntry {
+export interface NodeEntry {
   /** Served daemon attention, never re-derived here. Missing on an older daemon. */
   needsAttention?: boolean;
   arbitratedNeedsInput?: boolean | null;
@@ -716,6 +716,26 @@ function startedWithoutLine(files: string[]): string {
   return `missing required ${files.map((file) => file.split("/").pop()).join(", ")}`;
 }
 
+/** Why a seat that needs attention does, from what the daemon recorded: a missing session, a startup error, a held
+ *  message, a missing required file, or the served needs-input reason. Otherwise "reason unavailable". */
+export function attentionReason(n: NodeEntry): string {
+  return missingSessionGuidance(n) ?? n.latestError ?? (n.heldReason ? `held: ${n.heldReason}` : null)
+    ?? (n.startedWithoutRequired?.length ? startedWithoutLine(n.startedWithoutRequired) : null)
+    ?? questionReason(n) ?? "reason unavailable";
+}
+
+/** Whether the daemon serves a live question for the seat, with its own precedence: the arbitrated needs-input answer,
+ *  and the hook only when there's none. A served "no" beats a stale hook. */
+export function servesQuestion(n: NodeEntry): boolean {
+  return n.arbitratedNeedsInput ?? (n.agentActivity?.state === "needs_input");
+}
+
+/** The served question's reason, with the daemon's precedence: the arbitrated answer, and the hook only without one. */
+export function questionReason(n: NodeEntry): string | null {
+  return n.arbitratedNeedsInput === true ? n.activityState?.needsInput.reason ?? null
+    : n.arbitratedNeedsInput == null && n.agentActivity?.state === "needs_input" ? n.agentActivity.reason : null;
+}
+
 export function compactNodeProjection(nodes: NodeEntry[]): Array<Record<string, unknown>> {
   return nodes.map((n) => {
     const keepDiagnostics = n.needsAttention !== false;
@@ -1370,8 +1390,12 @@ async function handleNodes(
   if (useCompact) {
     console.log(padCompactNodeRow("RIG", "SESSION", "LIFECYCLE", "ACTIVITY", "WORK", "REASON", "ATTN"));
     for (const n of humanList as NodeEntry[]) {
+      // With the daemon's attention flag set, a live question shows its own reason rather than a recorded error. Without
+      // that flag (an older daemon), the order stays as it was, so a startup failure isn't hidden by a hook. The question's
+      // reason is shown whole, as the activity reason always was: it's what a person reads to know what to answer.
       const reason = missingSessionGuidance(n) ?? (n.needsAttention !== false || hasCurrentUsageLimit(n)
-        ? (n.latestError ? truncate(n.latestError, 40) : n.startedWithoutRequired?.length ? truncate(startedWithoutLine(n.startedWithoutRequired), 40)
+        ? (n.needsAttention === true && servesQuestion(n) ? questionReason(n) ?? "reason unavailable"
+          : n.latestError ? truncate(n.latestError, 40) : n.startedWithoutRequired?.length ? truncate(startedWithoutLine(n.startedWithoutRequired), 40)
           : n.agentActivity?.reason ?? "—")
         : livenessUnconfirmed(n) ? "liveness unconfirmed" : "—");
       console.log(padCompactNodeRow(

packages/cli/src/commands/queue.ts

@@ -4,7 +4,7 @@ import { Command, InvalidArgumentError } from "commander";
 import { DaemonClient, DaemonConnectionError, DaemonTimeoutError, DaemonResponseError, remoteDaemonClient, type DaemonResponse } from "../client.js";
 import { getDaemonStatus, getDaemonUrl , daemonStatusGuard, resolveOriginSelfHostId } from "../daemon-lifecycle.js";
 import { readOpenRigEnv } from "../openrig-compat.js";
-import { sessionRigOf, isHumanSeatSessionRef } from "../session-name.js";
+import { sessionRigOf, isHumanSeatSessionRef, parseSessionName } from "../session-name.js";
 import { realDeps } from "./daemon.js";
 import { enumArg, positiveIntArg } from "../cli-error.js";
 import type { StatusDeps } from "./status.js";
@@ -544,7 +544,11 @@ function notThisCreate(row: Record<string, unknown>, sent: SentCreate, storedSou
 /** Both reconciliation and --verify read the daemon that holds the row, with its own bearer. */
 async function queueReadTarget(deps: QueueDeps, client: DaemonClient, hostId: string | undefined) {
   let remote = remoteHostOf(hostId);
-  if (remote && await daemonSelfHostId(client) === remote) remote = undefined;
+  const requestedRemote = remote;
+  const selfHostId = requestedRemote ? await daemonSelfHostId(client) : undefined;
+  if (remote && selfHostId === remote) remote = undefined;
+  const remoteConfirmed = requestedRemote !== undefined && typeof selfHostId === "string"
+    && selfHostId.trim().length > 0 && selfHostId !== requestedRemote;
   let reader = client;
   let options: { timeoutMs: number; headers?: Record<string, string> } = { timeoutMs: CREATE_READ_BACK_TIMEOUT_MS };
   if (remote) {
@@ -559,7 +563,7 @@ async function queueReadTarget(deps: QueueDeps, client: DaemonClient, hostId: st
     reader = deps.clientFactory(match.host.url);
     if (bearer.token) options = { ...options, headers: { Authorization: `Bearer ${bearer.token}` } };
   }
-  return { reader, options };
+  return { reader, options, remote, remoteConfirmed };
 }
 
 /** Where a verb that names an existing row (show, transitions, list, claim, update, block) sends its request with
@@ -623,7 +627,7 @@ function createReceiptReader(deps: QueueDeps, client: DaemonClient, hostId: stri
 
 /** A create whose answer didn't arrive, or arrived unreadable, may still have committed. Read the row back once by the ID it
  *  was sent with, from the daemon that holds it. Only this create's row counts; it never sends the create again. */
-async function readBackCreate(deps: QueueDeps, client: DaemonClient, hostId: string | undefined, qitemId: string, sent: SentCreate): Promise<{ row: Record<string, unknown> | null; note: string }> {
+async function readBackCreate(deps: QueueDeps, client: DaemonClient, hostId: string | undefined, qitemId: string, sent: SentCreate): Promise<{ row: Record<string, unknown> | null; note: string; remoteConfirmed?: boolean }> {
   const remote = remoteHostOf(hostId);
   const where = remote ? ` on host '${remote}'` : "";
   const target = await queueReadTarget(deps, client, hostId);
@@ -638,7 +642,8 @@ async function readBackCreate(deps: QueueDeps, client: DaemonClient, hostId: str
       if (differs) {
         return { row: null, note: `Row ${qitemId}${where} exists but isn't this create (its ${differs} differs), so the outcome is still unknown. Don't reuse this ID for other work.` };
       }
-      return { row: res.data, note: `The create committed after all: row ${qitemId}${where} (read back by its ID).` };
+      return { row: res.data, note: `The create committed after all: row ${qitemId}${where} (read back by its ID).`,
+        remoteConfirmed: target.remoteConfirmed };
     }
     if (res.status === 404) return { row: null, note: `No row ${qitemId}${where} yet (read back once by its ID); it may still commit.` };
     return { row: null, note: `Reading row ${qitemId}${where} back answered ${res.status}, so the outcome is still unknown.` };
@@ -890,6 +895,54 @@ function requireSeatSession(ignoredFlag: string): string | undefined {
   return undefined;
 }
 
+/** The flags `rig queue update` takes that write more than a note. `--source` records a note only (#2866). */
+const UPDATE_STATE_WRITE_FLAGS = [
+  ["state", "--state"], ["reopen", "--reopen"], ["closureReason", "--closure-reason"], ["closureTarget", "--closure-target"],
+  ["closureRequiredAt", "--closure-required-at"], ["resolution", "--resolution"], ["blockedOn", "--blocked-on"],
+  ["wakeWatchdog", "--wake-watchdog"], ["wakeAfter", "--wake-after"], ["summary", "--summary"], ["evidenceRef", "--evidence-ref"],
+] as const;
+
+/**
+ * #2866: who appends a `rig queue update` note. Inside a managed seat it is the seat (the X-OpenRig-Session header the
+ * DaemonClient stamps), whatever --source says. Outside one, a routine can name itself with --source <name>@external:
+ * it rides the body as the declared actor, which the daemon records as claimed:v1 because no header names a seat, so
+ * the note is attributed to an external actor and never to a seat, and OPENRIG_SESSION_NAME is never forged. The
+ * external path records a note only, on the local daemon (the caller refuses a --host that resolves to another host).
+ * Returns the body actor to send (undefined = the header decides), or false after printing why nothing was sent.
+ */
+function resolveUpdateActor(source: string | undefined, opts: Record<string, unknown>): { actorSession?: string } | false {
+  const refuse = (message: string): false => { console.error(message); process.exitCode = 1; return false; };
+  // Trimmed like the DaemonClient's header (senderIdentityHeaders): a blank env is no seat, so the two never disagree.
+  const seat = readOpenRigEnv("OPENRIG_SESSION_NAME", "RIGGED_SESSION_NAME")?.trim() || undefined;
+  if (source !== undefined) {
+    const trimmed = source.trim();
+    if (parseSessionName(trimmed).kind !== "external") {
+      return refuse(`--source must be <name>@external (got '${source}'): it names a routine outside any seat, never a seat. Nothing was sent.`);
+    }
+    const writes = UPDATE_STATE_WRITE_FLAGS.filter(([key]) => opts[key] !== undefined).map(([, flag]) => flag);
+    if (opts.note === undefined || writes.length > 0) {
+      return refuse(`--source records a note only: pass --note and nothing else that writes${writes.length > 0 ? ` (got ${writes.join(", ")})` : ""}. ` +
+        "Changing a row needs a seat. Nothing was sent.");
+    }
+    if (seat) {
+      process.stderr.write(`warning: --source ${trimmed} is ignored: this runs in the seat ${seat}, which is the note's actor.\n`);
+      return {};
+    }
+    return { actorSession: trimmed };
+  }
+  if (seat) return {};
+  const noteOnly = opts.note !== undefined && UPDATE_STATE_WRITE_FLAGS.every(([key]) => opts[key] === undefined);
+  return refuse(noteOnly
+    ? "notes need a seat; an external routine can pass --source <name>@external. OPENRIG_SESSION_NAME is not set, so " +
+      "there's no seat to act as: run this from a managed seat, or add --source <name>@external to record the note as " +
+      "that external routine (claimed, never a seat). --actor is ignored: the actor is the seat's own identity."
+    : "OPENRIG_SESSION_NAME is not set, so there's no seat to act as. Run this from a managed seat, or set " +
+      "OPENRIG_SESSION_NAME to the seat's session name (for example dev-impl@my-rig). --actor is ignored: the actor is " +
+      "the seat's own identity. Changing a row needs a seat, and notes need a seat; an external routine can pass " +
+      "--source <name>@external for a note only. A person answering an ask addressed to them (a host pairing approval, " +
+      "say) does it in the TUI (rig tui, then attention) or in Steering, not with this command.");
+}
+
 function extractRigName(sessionName: string): string | undefined {
   // OPR.0.4.6.MH1 FR-8: the shared parse contract (greedy first-@ rig).
   return sessionRigOf(sessionName);
@@ -1182,8 +1235,51 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
         }, crossHostWriteOptions(hostResolved.hostId)).catch((error: unknown) => (error instanceof Error ? error : new Error(String(error))));
         const sent: SentCreate = { destinationSession: hostResolved.destination, claimedSource: managedSource === undefined ? source : undefined, body: resolvedBody,
           remoteHost: remoteHostOf(hostResolved.hostId) };
+        const emitScopeAdvisories = (created: Record<string, unknown>) => {
+          const advisories = Array.isArray(created?.advisories) ? created.advisories : [];
+          for (const value of advisories) {
+            if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+            const advisory = value as { code?: unknown; message?: unknown };
+            if (typeof advisory.message !== "string") continue;
+            switch (advisory.code) {
+              case "scope_check_skipped":
+                console.error(`Note: ${advisory.message}`);
+                break;
+              case "unresolved_scope":
+              case "ambiguous_scope":
+              case "empty_scope":
+              case "conflicting_scope":
+              case "scope_check_unavailable":
+                console.error(`Warning: ${advisory.message}`);
+                break;
+            }
+          }
+        };
+        const emitRecoveredScopeAdvisory = (recoveredRemote: boolean) => {
+          const recoveredTags: string[] = [];
+          for (const raw of tags ?? []) {
+            if (recoveredTags.length >= 8) break;
+            if (!raw.startsWith("mission:") && !raw.startsWith("slice:")) continue;
+            const prefix = raw.startsWith("mission:") ? "mission:" : "slice:";
+            const body = raw.slice(prefix.length).replace(/[\x00-\x1f\x7f]/g, "").trim().slice(0, 120);
+            const sanitized = body ? `${prefix}${body}` : prefix;
+            if (!recoveredTags.includes(sanitized)) recoveredTags.push(sanitized);
+          }
+          if (recoveredTags.length === 0) return;
+          // Only a confirmed different host ID justifies "forwarded";
+          // all other recovered outcomes remain neutral.
+          if (recoveredRemote) {
+            console.error(`Note: queue create scope check skipped for cross-host write (${recoveredTags.join(", ")}); row was forwarded.`);
+          } else {
+            console.error(`Warning: queue create scope check outcome unavailable after response recovery (${recoveredTags.join(", ")}): original scope check result was lost with the create response; row was created.`);
+          }
+        };
         // Every create that's answered with a row ends here: its warning, --verify's delivery, and the output.
-        const finish = async (created: Record<string, unknown>, status: number) => {
+        const finish = async (created: Record<string, unknown>, status: number, recovered?: "neutral" | "remote") => {
+          if (status < 400) {
+            if (recovered) emitRecoveredScopeAdvisory(recovered === "remote");
+            else emitScopeAdvisories(created);
+          }
           const createWarning = created?.createWarning as { code?: unknown; message?: unknown } | undefined;
           if (status < 400 && createWarning?.code === "qitem_body_not_saved" && typeof createWarning.message === "string") {
             console.error(`Warning: ${createWarning.message}`);
@@ -1213,7 +1309,7 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
             const late = await readBackCreate(deps, client, hostResolved.hostId, qitemId, sent);
             console.error(late.note);
             if (late.row) {
-              await finish(late.row, 200);
+              await finish(late.row, 200, late.remoteConfirmed ? "remote" : "neutral");
               return;
             }
           }
@@ -1230,7 +1326,7 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
           const late = await readBackCreate(deps, client, hostResolved.hostId, qitemId, sent);
           console.error(late.note);
           if (late.row) {
-            await finish(late.row, 200);
+            await finish(late.row, 200, late.remoteConfirmed ? "remote" : "neutral");
             return;
           }
           // Preserve that failure and expose the same recovery ID.
@@ -1299,11 +1395,13 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
     .option("--summary <text>", "Summary persisted onto the item (human-seat parks, or standalone summary update without --state)")
     .option("--evidence-ref <path>", "Pointer to the durable artifact, persisted onto the item on a human-seat park or a done close (--state done). For a code result, a JSON file of kind openrig.code-result/v1 (repo, base and revision as full commit ids, paths) lets a reader diff it exactly")
     .option("--note <text>", "Transition note for the audit log")
+    .option("--source <name@external>", "Outside a managed seat: the external routine that appends the --note, recorded as an external actor (claimed:v1), never a seat; note only, on this host's daemon (a --host that resolves to another host is refused). A managed seat stays the actor. Like any note, it resets the item's stall and notification timing (and its recovery and operator episodes) and advances a claimed item's last activity, but never resets how long an unclaimed item has waited")
     .option("--host <id>", QUEUE_HOST_ROW_OPTION_HELP)
     .option("--full", "Print the whole response row(s) as today, even when output.compact is on (the receipt's waiting keeps only blocker and nextBackstop)")
     .option("--json", "JSON output for agents")
     .action(async (qitemId: string, opts: {
       actor?: string;
+      source?: string;
       state?: string;
       reopen?: boolean;
       closureReason?: string;
@@ -1338,11 +1436,21 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
       // P21 I3 reconcile: the actor is DERIVED from the seat env (X-OpenRig-Session, stamped by
       // DaemonClient) — --actor is deprecated + ignored, no body actorSession. Verify the env (the
       // header source) or the daemon returns 400 actor_required (no seat identity to record; P18 retired the 401 refusal). Matches `resolve`.
-      if (!requireSeatSession("actor")) return;
+      // #2866: outside a seat, --source <name>@external names the routine appending a note (the declared body actor).
+      const actor = resolveUpdateActor(opts.source, opts);
+      if (!actor) return;
       const deps = getDeps();
       await withClient(deps, async (local) => {
         const target = await queueHostTarget(deps, local, opts.host, true);
         if ("error" in target) return emitHostResolutionError(target, opts.json ?? false);
+        if (actor.actorSession !== undefined && target.remote) {
+          // #2866: the other host would record the routine bare, indistinguishable from a routine of its own (a
+          // forwarded create stamps the origin; this path doesn't). A --host that resolves locally is fine.
+          console.error(`--source with --host ${target.remote} is not supported: that host would record ${actor.actorSession} ` +
+            "without the host it ran on. Run the routine on the host that holds the row. Nothing was sent.");
+          process.exitCode = 1;
+          return;
+        }
         const res = await target.client.post<unknown>(`/api/queue/${encodeURIComponent(qitemId)}/update`, {
           state: opts.state,
           reopen: opts.reopen,
@@ -1356,6 +1464,7 @@ export function queueCommand(depsOverride?: QueueDeps): Command {
           summary: opts.summary,
           evidenceRef: opts.evidenceRef,
           transitionNote: opts.note,
+          ...actor,
         }, target.options);
         await printQueueItemResult(target.client, qitemId, opts.json ?? false, res.data, res.status, writeReceipt(opts.full, { verb: "update" }), target.remote);
       }, remoteHostOf(opts.host) !== undefined, remoteHostOf(opts.host));
@@ -1999,6 +2108,100 @@ Examples:
       });
     });
 
+  cmd
+    .command("erase")
+    .description("Erase queue rows in one exact scope: an account's rows, a list of ids, or the closed-work retention windows; a dry run unless --apply")
+    .option("--members <file>", "Account deletion: the account's recorded session names (exact, departed seats included), one per line or a JSON array")
+    .option("--rig <id>", "With --members: the account rig's id. Also erases the rig's own records that outlive it (events, snapshots, node and seat records); refused unless every member is a session of it")
+    .option("--ids <file>", "These qitem ids, one per line or a JSON array; a report's qitems entries, or an erasure ledger's JSON lines, keep each one's action")
+    .option("--action <action>", "With --ids: delete (default) removes each row and keeps only its id; scrub removes its content and keeps the row", enumArg(["delete", "scrub"]))
+    .option("--routine", "Run this daemon's closed-work windows now (retention.closed_content_days, retention.closed_metadata_days)")
+    .option("--apply", "Erase. Without it the command reports what would be erased and changes nothing")
+    .option("--actor <session>", "Who is erasing, when OPENRIG_SESSION_NAME isn't set (recorded as a claimed identity)")
+    .option("--json", "JSON output for agents")
+    .addHelpText("after", [
+      "",
+      "Name exactly one scope. What each one erases:",
+      "  --members  every row whose source and destination are both members, in any state, deleted with its transitions,",
+      "             outbox and inbox copies, stream actions, events and audit rows; then member-to-member outbox and inbox",
+      "             entries no row owns, and the members' stream items. A row with one member endpoint is reported under",
+      "             mixed and left untouched. With --rig, also the rig's own events, snapshots and node and seat records.",
+      "  --ids      the listed rows, deleted or scrubbed (a report's qitems entries keep their action); a deleted id",
+      "             that's already gone keeps (or regains) its id marker.",
+      "  --routine  closed rows (done, canceled, denied, handed-off) past the windows, aged from when they closed.",
+      "A deleted row keeps only its id, and a create that reuses that id is refused (qitem_erased). A row a workflow still",
+      "references is reported under gaps and left. Output is JSON: clean (true only when nothing was left), complete,",
+      "qitems, mixed, gaps, alreadyAbsent, linked, unlinked and rig. Refusals: erase_scope_required, erase_scope_conflict,",
+      "erase_members_invalid, erase_rig_invalid, erase_rig_mismatch, erase_ids_invalid, erase_action_invalid,",
+      "erase_routine_off. A run that stops on an error returns what it committed, with error.stage, and exits 2.",
+      "Reference: docs/reference/queue-erasure.md",
+    ].join("\n"))
+    .action(async (opts: { members?: string; rig?: string; ids?: string; action?: string; routine?: boolean; apply?: boolean; actor?: string; json?: boolean }) => {
+      const list = (flag: string, path: string): unknown[] | undefined => {
+        let text: string;
+        try {
+          text = fs.readFileSync(path, "utf8");
+        } catch (err) {
+          console.error(`--${flag} ${path}: can't be read (${err instanceof Error ? err.message : String(err)}). Nothing was erased.`);
+          process.exitCode = 1;
+          return undefined;
+        }
+        if (text.trimStart().startsWith("[")) {
+          try {
+            const parsed: unknown = JSON.parse(text);
+            if (Array.isArray(parsed)) return parsed;
+          } catch { /* reported below */ }
+          console.error(`--${flag} ${path}: not a JSON array. Nothing was erased.`);
+          process.exitCode = 1;
+          return undefined;
+        }
+        // One entry per line: a plain id or session, or (an erasure ledger's line) a JSON object.
+        const entries: unknown[] = [];
+        for (const line of text.split(/\r?\n/).map((entry) => entry.trim()).filter((entry) => entry.length > 0 && !entry.startsWith("#"))) {
+          if (!line.startsWith("{")) {
+            entries.push(line);
+            continue;
+          }
+          try {
+            entries.push(JSON.parse(line));
+          } catch {
+            console.error(`--${flag} ${path}: a line isn't valid JSON (${line.slice(0, 60)}). Nothing was erased.`);
+            process.exitCode = 1;
+            return undefined;
+          }
+        }
+        return entries;
+      };
+      const body: Record<string, unknown> = { apply: opts.apply === true };
+      if (opts.members !== undefined) {
+        const members = list("members", opts.members);
+        if (!members) return;
+        body.members = members;
+      }
+      // Sent as given: the daemon refuses a rig without members (erase_rig_invalid), never drops it.
+      if (opts.rig !== undefined) body.rig = opts.rig;
+      if (opts.ids !== undefined) {
+        const ids = list("ids", opts.ids);
+        if (!ids) return;
+        body.ids = ids;
+        if (opts.action) body.action = opts.action;
+      }
+      if (opts.routine) body.routine = true;
+      if (!readOpenRigEnv("OPENRIG_SESSION_NAME", "RIGGED_SESSION_NAME")) {
+        if (!opts.actor) {
+          console.error("OPENRIG_SESSION_NAME is not set and --actor wasn't given, so there's no one to record as erasing. Nothing was erased.");
+          process.exitCode = 1;
+          return;
+        }
+        body.actorSession = opts.actor;
+      }
+      const deps = getDeps();
+      await withClient(deps, async (client) => {
+        const res = await client.post<unknown>("/api/queue/erase", body);
+        printResult(opts.json ?? false, res.data, res.status);
+      });
+    });
+
   // ---- Inbox subcommands ----
 
   cmd

packages/cli/src/commands/scope.ts

@@ -2186,6 +2186,17 @@ function sharedSliceNameFinding(missionsRoot: string, missionName: string, slice
   };
 }
 
+/** Show the inherited workspace route because Commander lists a parent option only in the parent's help. */
+export function scopeWorkspaceHelp(tier: "slice" | "mission", verb?: string): string {
+  return `
+Workspace: the parent option --workspace selects the missions root this command reads.
+  rig scope --workspace <project root> ${tier} ${verb ?? "<verb>"} ...
+A project root uses its project.yaml missions.root, else its missions/ folder; a
+folder named missions is used as is. Use it for a catalog project, for example
+$(rig config get workspace.projects_root)/<project>. Without --workspace,
+OPENRIG_WORK_ROOT applies, then the configured workspace.slices_root.`;
+}
+
 export function scopeCommand(): Command {
   const cmd = new Command("scope")
     .description("Scope tree primitive: missions, slices, sub-slices (per conventions/scope-and-versioning)")
@@ -2216,6 +2227,10 @@ export function scopeCommand(): Command {
   mission.addCommand(buildMissionVerifiedCommand());
   mission.addCommand(buildApproveCommand("mission"));
   cmd.addCommand(mission);
+  for (const [tier, group] of [["slice", slice], ["mission", mission]] as const) {
+    group.addHelpText("after", scopeWorkspaceHelp(tier));
+    for (const verb of group.commands) verb.addHelpText("after", scopeWorkspaceHelp(tier, verb.name()));
+  }
   cmd.addCommand(buildResolveNotesCommand());
   cmd.addCommand(buildAuditCommand());
 

packages/cli/src/commands/seat.ts

@@ -21,6 +21,8 @@ async function defaultReadStdin(): Promise<string> {
 }
 
 interface SeatStatusResponse {
+  /** What OpenRig's own refocus hook has recorded for this seat (Claude and Codex seats). */
+  refocus?: { lastRecordedAt: string | null; currentConversation: boolean | "unknown"; noIdentity?: true; detail: string };
   permission_stop?: { state: "unavailable"; command: "unavailable"; origin: "unknown" }
     | { state: "request_observed" | "completed"; command: string; origin: "harness";
         source: "PermissionRequest"; observed_at: string; actor: "main" | "subagent"; pending: "unknown" | false;
@@ -76,6 +78,9 @@ interface SeatStatusResponse {
     ignored?: { source: string; value: string };
   };
   claude_token?: { kind?: "api-key"; label: string; token_file: string; file: "readable" | "unusable"; problem?: string; notice?: string };
+  /** A running Claude or Codex seat: when OpenRig wrote each block in its guidance file, before or after a recorded session
+   *  moment (its startup finish, or when a claimed session was recorded). Chronology only, never what the agent read. */
+  guidance?: { file: string; detail: string; blocks: Array<{ id: string; writtenAt: string | null; written: "before" | "after" | "unknown"; reason?: string }> };
   session_reason?: string | null;
   startup_status: string | null;
   occupant_lifecycle: string;
@@ -140,6 +145,7 @@ interface SeatHandoverMutationResult {
   ok: true;
   dryRun: false;
   mutated: true;
+  /** Legacy compatibility field, always false. Read currentStatus.continuityOutcome and sourceOutcome instead. */
   continuityTransferred: false;
   seat: SeatHandoverPlan["seat"];
   source: {
@@ -168,7 +174,8 @@ interface SeatHandoverMutationResult {
   /** OPR.0.5.5.5 — per-source execution record (wire mirror of the daemon shape). */
   sourceOutcome?:
     | { mode: "fork"; forkedFrom: string; forkId?: "captured" | "pending"; limit?: string }
-    | { mode: "rebuild"; primedArtifacts: Array<{ address: string; label: string }>; gaps: string[]; emptyChainReason?: string; permissions?: { state: string; detail: string } };
+    | { mode: "rebuild"; primedArtifacts: Array<{ address: string; label: string }>; gaps: string[]; emptyChainReason?: string; permissions?: { state: string; detail: string };
+        model?: { requested: string | null; predecessorCompared: false } };
   /** The restore or rebuild priming packet was pasted and Enter pressed, but its submission couldn't be confirmed. */
   restorePacket?: { status: "unconfirmed"; reason: string };
   /** #2456: the required startup files the successor started without, where a start would have failed. */
@@ -243,6 +250,7 @@ function printHuman(status: SeatStatusResponse): void {
     console.log(`Claude ${t.kind === "api-key" ? "API key" : "subscription token"}: ${t.label}, read from ${t.token_file} at each launch (${t.file === "readable" ? "readable now" : "won't apply at the next launch"})`);
     if (t.notice) console.log(`  ${t.notice}`);
   }
+  if (status.guidance) console.log(`Guidance: ${status.guidance.detail}`);
   if (status.typingGuard) {
     const g = status.typingGuard;
     const mode = g.effectiveLevel ?? g.effectiveMode ?? (g.effective ? "on" : "off");
@@ -273,6 +281,7 @@ function printHuman(status: SeatStatusResponse): void {
     if (rules?.size_cut) console.log("  Suggested-rule evidence is incomplete because of size bounds.");
   }
   if (status.compaction) console.log(`Managed compaction (${status.compaction.stage}): ${status.compaction.detail}`);
+  if (status.refocus) console.log(`Refocus: ${status.refocus.detail}`);
   const reason = sessionReason(status.session_reason);
   if (reason) console.log(`Reason: ${reason}`);
   if (status.permissions?.account) {
@@ -384,7 +393,11 @@ function printHumanHandoverResult(result: SeatHandoverMutationResult): void {
     if (result.sourceOutcome.forkId === "pending") console.log(`Fork id: PENDING. ${result.sourceOutcome.limit ?? ""}`.trim());
   } else if (result.sourceOutcome?.mode === "rebuild") {
     const outcome = result.sourceOutcome;
+    console.log("Rebuild starts a new conversation; durable artifacts carry its context, not a native resume.");
     if (outcome.permissions) console.log(`Codex rebuild permissions: ${outcome.permissions.state}. ${outcome.permissions.detail}`);
+    if (outcome.model) {
+      console.log(`Codex rebuild model: ${outcome.model.requested ? `requested ${outcome.model.requested}` : "runtime configuration/default"}. The predecessor's in-pane model was not compared or carried.`);
+    }
     if (outcome.primedArtifacts.length > 0) {
       const heading = result.restorePacket?.status === "unconfirmed" ? "Rebuild packet includes" : "Rebuild primed from";
       console.log(`${heading} ${outcome.primedArtifacts.length} durable artifact${outcome.primedArtifacts.length === 1 ? "" : "s"}:`);
@@ -1035,13 +1048,13 @@ resume/successor launch reads it at call time. Examples:
   cmd
     .command("set-runtime")
     .argument("<seat>", "Canonical session name or logical seat ref")
-    .option("--runtime <runtime>", "codex or claude-code")
+    .option("--runtime <runtime>", "codex, claude-code or pi")
     .option("--reason <text>", "Why the seat moves; recorded with the switch")
     .option("--model <id>", "Target model; otherwise the seat's agent spec for the target, else the target's default")
     .option("--effort <level>", "Target effort, the target runtime's own level (not translated)")
     .option("--codex-config-profile <name>", "Codex configuration profile for a Codex successor")
     .option("--clear-account-home", "Return to member/rig/daemon/native login selection through a fresh successor")
-    .option("--account-home <path>", "Isolated target CODEX_HOME or CLAUDE_CONFIG_DIR; also permits a fresh successor on the same runtime")
+    .option("--account-home <path>", "Target Codex/Claude home or Pi account directory containing auth.json; also permits a same-runtime successor")
     .option("--token-file <path>", "With a Claude account home, its required subscription token reference")
     .option("--account-label <label>", "With --token-file, the selected account's label")
     .option("--permission-mode <mode>", "Target native permission choice; default: inherit the seat's member and rig policy")
@@ -1051,7 +1064,7 @@ resume/successor launch reads it at call time. Examples:
     .option("--note <text>", "With --confirm: what you'll do first")
     .option("--recover", "Finish an interrupted switch from its record")
     .option("--json", "JSON output for agents")
-    .description("Move a live Codex or Claude Code seat to the other runtime, successor first")
+    .description("Move a live Codex, Claude Code or Pi seat to another runtime, successor first")
     .addHelpText("after", `
 The seat keeps its address, connections, queue rows and claims. Its successor
 starts on the target runtime beside the current occupant, reads a handover, and
@@ -1065,7 +1078,7 @@ later converge reports a deferred change_runtime); the source runtime's model,
 effort, Codex profile and native permission choice are cleared, not mapped; two
 processes run until cutover; messages sent to the seat during the switch are
 held, not typed, and need sending again afterwards.
-Codex and Claude Code, single-pane seats only. --dry-run lists the details.
+Codex, Claude Code and Pi, single-pane seats only. --dry-run lists the details.
 A seat that has never started has no pane to switch: declare the other runtime for it in its rig spec and bring the team
 up again from that spec. That's a new generation of the seat, without this seat's edges, settings or queued work.
 --clear-account-home returns to configured member/rig/daemon/native selection; it does not restore historical credentials.
@@ -1437,12 +1450,16 @@ Examples:
     .option("--json", "JSON output for agents")
     .description("Stop exactly one LIVE managed seat (kills only that seat's tmux session; audited)")
     .addHelpText("after", `
-Siblings are untouched. A dead seat is refused (use rig seat clean); an adopted
-session is refused (use rig unclaim). A seat handed over (fresh, fork or rebuild)
-before OpenRig 0.7.9 still reads adopted and is refused too, until its next launched
-handover or managed launch; the refusal says so. Stopping ends that agent's session and any
-work in progress: check it first (rig capture <seat>) and stop only a seat you
-own or were asked to stop. rig seat launch <seat> --fresh --reason <text> starts
+Siblings are untouched. A dead seat is refused (use rig seat clean). An adopted
+session is refused: to end only it, run rig unclaim <session> (it releases the
+session and leaves its process running), then end that process in its own
+terminal. rig down <rig> ends every seat in its rig, so it is the route only
+for a one-seat rig.
+A seat handed over (fresh, fork or rebuild) before OpenRig 0.7.9 still reads
+adopted and is refused too, until its next launched handover or managed launch;
+the refusal says so. Stopping ends that agent's session and any work in progress:
+check it first (rig capture <seat>) and stop only a seat you own or were asked to
+stop. rig seat launch <seat> --fresh --reason <text> starts
 a fresh occupant there; it does not resume the stopped conversation.
 A community harness stop closes its managed pane; its native processes or compute
 may outlive it. Inspect their own lifecycle receipts.

packages/cli/src/commands/send.ts

@@ -61,6 +61,8 @@ export interface EnvelopeMeta {
   /** Twin of pane-envelope's field: the row a person's (@external) message delivers, named in the
    *  reply hint with --reply-to so the answer joins its Slack thread. ABSENT ⇒ the plain hint. */
   replyToQitem?: string;
+  /** Twin of pane-envelope's field (#2895 (a)): false ⇒ the reply line names no `rig send`. ABSENT or true ⇒ today's hint. */
+  senderReachable?: boolean;
 }
 
 /** The To-line projection + anti-storm scale (header-alone distinguishability). */
@@ -108,7 +110,9 @@ export function wrapSendBody(
     ? `↩ Reply if needed: rig queue create --destination ${senderLabel}${meta?.replyToQitem ? ` --human-intent update --reply-to ${meta.replyToQitem}` : ""} --summary "<one line>" --body "..." --verify`
     : isHumanSeatSessionRef(personAddress)
       ? `↩ Reply if needed: rig queue create --destination ${senderLabel} --human-intent update --summary "<one line>" --evidence-ref "<path>" --body "..." --verify`
-      : `↩ Reply: rig send ${senderLabel} "..."`;
+      : meta?.senderReachable === false
+        ? `↩ No reply by rig send: ${senderLabel} has no session.`
+        : `↩ Reply: rig send ${senderLabel} "..."`;
   return [...header, "---", body, "---", reply].join("\n");
 }
 
@@ -246,7 +250,7 @@ export function sendCommand(depsOverride?: SendDeps): Command {
     .option("--force", "Back-compat no-op: a mid-task/busy pane already sends-with-advisory by default; --force never bypasses the interactive-prompt/permission guard")
     .option("--wait-for-idle <seconds>", "Wait until the target is explicitly idle before sending. If it's still busy, or its activity is unknown, when the wait ends, nothing is sent (exit 1) and nothing is kept to send later; put separate work in a queue row (rig queue create)")
     .option("--raw", "Send exact text/keystrokes without the From/To messaging envelope (still guarded against interactive prompts)")
-    .option("--dangerously-interact", "DANGEROUS: type an answer as keystrokes into an interactive prompt (implies --raw; requires --reason). Letters can select menu shortcuts; CR/ESC act as keys. Enter is added only for the complete visibly staged answer.")
+    .option("--dangerously-interact", "DANGEROUS: type an answer as keystrokes into an interactive prompt (implies --raw; requires --reason). Letters can select menu shortcuts; CR/ESC act as keys. Enter is added for the complete visibly staged answer, or away from a recognized prompt when the input box can't be found or read.")
     .option("--type-without-checking", "With --dangerously-interact: type without reading or clearing existing input; may join or submit that text")
     .option("--reason <text>", "Why the prompt is being driven (required with --dangerously-interact; recorded in the audit log)")
     .option("--urgent", "Mark this message urgent: it types at seats whose interruption level holds other messages. Anyone may mark one; the recipient sees who did")
@@ -322,8 +326,10 @@ would run the envelope lines; the output says so. Use
 --dangerously-interact --reason "<why>" to DELIBERATELY drive a prompt (select an
 option or approve a permission) — the only override of the prompt guard; it
 implies --raw and is audit-logged. The answer is typed as keystrokes: letters may
-be menu shortcuts, and CR/ESC act as keys. An Enter is added only when the complete
-answer is visibly staged in a recognized text input. Combining --verify with
+be menu shortcuts, and CR/ESC act as keys. An Enter is added when the complete
+answer is visibly staged in a recognized text input, and, away from a recognized
+prompt or menu, when the input box can't be found or read (the result says so).
+Combining --verify with
 --dangerously-interact never adds an automatic submit retry, even when the daemon
 did not detect a prompt or did not report its disposition. Unknown consumption
 is not a send failure. On a managed seat with the delivery guard attached, a
@@ -332,7 +338,10 @@ pasted text stops the send and is shown only to you, separately from recognized
 dim suggestions. Collapsed paste contents and unrecognized inputs are not known.
 Inspect the native terminal, deliberately clear its prompt with native/tmux
 controls, then retry. Manual clearing runs outside OpenRig's lease and observation
-checks and is not recorded. --type-without-checking explicitly skips this read;
+checks and is not recorded. An input that can't be read doesn't stop the send:
+the answer is typed, nothing is cleared, the result says the input couldn't be
+read, and the answer may join or submit what is there.
+--type-without-checking explicitly skips this read;
 it does not clear anything and may join or submit existing text. Human typing
 can still race a capture and paste; the check is not atomic.
 
@@ -1134,9 +1143,11 @@ async function runFanOutSend(params: {
   }
 
   const data = res.data;
-  const results = (data["results"] as Array<{ sessionName: string; ok: boolean; error?: string; outcome?: string; envelopeOmitted?: boolean; managedCompaction?: { notice?: unknown }; existingInput?: unknown }>) ?? [];
-  // Context beside a recipient's own result: it was in a managed compaction or restore when the send ran.
+  const results = (data["results"] as Array<{ sessionName: string; ok: boolean; error?: string; outcome?: string; envelopeOmitted?: boolean; managedCompaction?: { notice?: unknown }; existingInput?: unknown; warning?: string }>) ?? [];
+  // Context beside a recipient's own result: its own advisory (such as unreadable input), and whether
+  // it was in a managed compaction or restore when the send ran.
   const printNotice = (r: (typeof results)[number]) => {
+    if (r.warning) console.log(`${r.sessionName}: Advisory: ${r.warning}`);
     if (typeof r.managedCompaction?.notice === "string") console.log(`Notice: ${r.managedCompaction.notice}`);
   };
   // Round-2 F1 (desk-binding): ONE verdict line per recipient. A

packages/cli/src/commands/setup.ts

@@ -193,7 +193,7 @@ const BASE_RUNTIME_CONFIG_DISCLOSURE: RuntimeConfigDisclosure[] = [
     scope: "project",
     runtime: "claude-code",
     path: "CLAUDE.md (or CLAUDE.local.md when the rig chooses it)",
-    purpose: "OpenRig managed blocks at each start: the rig's culture, the OpenRig Start identity pointer, the onboarding pages at a fresh start (onboarding.default_pack.enabled), and guidance files a team merges. The router line is added only on a yes. rig down removes the blocks unless a seat of another active rig, or a still-running seat of this one, uses the file.",
+    purpose: "OpenRig managed blocks at each start: the rig's culture, the OpenRig Start identity pointer, the context-entry pointer to skills, help and declared context, the onboarding pages at a fresh start (onboarding.default_pack.enabled), and guidance files a team merges. The router line is added only on a yes. rig down removes the blocks unless a seat of another active rig, or a still-running seat of this one, uses the file.",
   },
   {
     scope: "project",

packages/cli/src/commands/skill.ts

@@ -56,6 +56,9 @@ interface SeatInspection {
   bootstrapLine?: { state: "unasked" | "unknown" } | { state: "yes" | "no"; by: "saved" | "environment" } | null;
   /** OPR.0.7.0.9: what the seat's launch passes of its own additions; absent from an older daemon. */
   launchAdditions?: SeatLaunchAdditionsView | null;
+  /** #2895 (b): set for a seat on a runtime without seat skills; absent from an older daemon. */
+  unsupported?: true;
+  note?: string;
 }
 
 interface SeatApplyResponse {
@@ -185,6 +188,10 @@ export function skillCommand(depsOverride?: StatusDeps): Command {
       process.exitCode = 1;
       return;
     }
+    if (!opts.apply && data.unsupported) {
+      if (!opts.json) console.log(data.note);
+      return;
+    }
     const inspection = opts.apply ? data.inspection : data;
     if (!opts.json) printSeat(inspection);
     if (!opts.apply) {

packages/cli/src/commands/slack.ts

@@ -122,7 +122,7 @@ const CHANNEL_MAP_APPLY =
 const POST_OPEN_ASKS = "`rig slack post-open-asks`";
 
 type OpenAskOutcome = "posted" | "already-posted" | "queued" | "held" | "below-floor" | "no-longer-active" | "superseded"
-  | "recipient-changed" | "state-unavailable" | "transport-failed" | "uncertain";
+  | "recipient-changed" | "no-connector" | "state-unavailable" | "transport-failed" | "uncertain";
 interface OpenAsk { qitemId: string; recipient: string; summary: string | null; outcome: OpenAskOutcome; detail?: string }
 interface PostOpenAsksResponse { ok: boolean; asks: OpenAsk[] }
 
@@ -135,6 +135,7 @@ const OUTCOME_LABEL: Record<OpenAskOutcome, string> = {
   "no-longer-active": "no longer active",
   superseded: "superseded",
   "recipient-changed": "recipient changed",
+  "no-connector": "no connector (Steering and the Feed only)",
   "state-unavailable": "state unavailable",
   "transport-failed": "transport failed",
   uncertain: "uncertain",
@@ -180,7 +181,7 @@ export function slackCommand(deps: SlackDeps = {}): Command {
     .command("setup")
     .description("Configure the connector (first-class config; secrets stay in the env file, never here)")
     .option("--channel <id>", "Slack channel id the connector app must be a member of")
-    .option("--inbound-destination <session>", "where inbound human messages land (default operator-agent@kernel)")
+    .option("--inbound-destination <session>", "where a person's unrouted message lands: a seat's session, or default-receiver (the default) for the host's default receiving agent (agents.operator_session, else the kernel operator)")
     .option("--minimum-level-that-posts <level>", "minimum OWNER level posted to Slack: RECORD|NOTICE|ALERT")
     .option("--minimum-level-that-interrupts <level>", "minimum OWNER level that mentions/interrupts: RECORD|NOTICE|ALERT")
     .option("--source-label <label>", "label shown in the posted message footer (where the queue lives)")
@@ -250,7 +251,7 @@ export function slackCommand(deps: SlackDeps = {}): Command {
         for (const r of readiness) log(`  ${r.ok ? "✓" : "✗"} ${r.label}: ${r.detail}`);
         log(`Daemon: ${observation.state}${observation.reason ? ` (${observation.reason})` : ""}`);
         const connector = observation.connector as { configurationDigest?: string; inboundReady?: boolean; outboundReady?: boolean;
-          inboundRouting?: { fallback: string; destination: string };
+          inboundRouting?: { fallback: string; destination: string; destinationFrom?: string; destinationNote?: string };
           settlement?: { pending: number; lastFailure: string | null };
           deadLetterBacklog?: number | null; deadLetterBacklogState?: string; deadLetterBacklogReason?: string; relayAttemptsInFlight?: number;
           inbound?: InboundDeliveryStatus & { state?: string; generation?: number; lastEventAt?: string };
@@ -258,7 +259,7 @@ export function slackCommand(deps: SlackDeps = {}): Command {
             coverage?: { coverageStart: string; coveredThrough: string; pending?: { upper: string; nextLatest: string }; nextRetryAt?: number } | null;
             channels?: Array<{ channel?: string | null; state?: string; reason?: string; lastScanAt?: string;
               coverage?: { coverageStart: string; coveredThrough: string; nextRetryAt?: number } | null }>;
-            threads?: { state?: string; reason?: string; tracked?: number; scanned?: number; pending?: number; oldestPendingSeconds?: number | null;
+            threads?: { state?: string; reason?: string; tracked?: number; scanned?: number; pending?: number; settled?: number; settledRescanHours?: number; oldestPendingSeconds?: number | null;
               backoff?: Record<string, number>; incomplete?: Record<string, number> };
             limits?: string[] } } | undefined;
         if (connector) {
@@ -267,6 +268,7 @@ export function slackCommand(deps: SlackDeps = {}): Command {
             if (connector.settlement.lastFailure) log(`  Last ask-edit failure: ${connector.settlement.lastFailure}`);
           }
           if (connector.inboundRouting?.fallback === "local") log(`  Configured routing fallback: local to ${connector.inboundRouting.destination} (after forwarding, thread and channel routes)`);
+          if (connector.inboundRouting?.destinationNote) log(`  ${connector.inboundRouting.destinationFrom === "receiving-agent" ? "Default receiving agent" : "No receiving agent"}: ${connector.inboundRouting.destinationNote}`);
           log(`  Socket: ${connector.inbound?.state ?? "unknown"}; generation ${connector.inbound?.generation ?? "unknown"}; last event ${connector.inbound?.lastEventAt ?? "unknown"}`);
           for (const line of socketDeliveryLines(connector.inbound)) log(`  ${line}`);
           const recovery = connector.recovery;
@@ -288,6 +290,7 @@ export function slackCommand(deps: SlackDeps = {}): Command {
             const behind = threads.oldestPendingSeconds != null ? ` (oldest ${Math.round(threads.oldestPendingSeconds / 60)} min behind)` : "";
             log(`  Thread recovery: ${threads.state ?? "unknown"}${threads.reason ? ` (${threads.reason})` : ""}; ${threads.tracked ?? 0} tracked (open, or closed within seven days); `
               + `${threads.scanned ?? 0} scanned, ${threads.pending ?? 0} waiting their turn${behind}`
+              + `${threads.settled ? `, ${threads.settled} settled (nobody waiting; rescanned ${!threads.settledRescanHours || threads.settledRescanHours === 24 ? "daily" : `every ${threads.settledRescanHours} hours`})` : ""}`
               + `${reasons(threads.backoff) ? `; backing off: ${reasons(threads.backoff)}` : ""}${reasons(threads.incomplete) ? `; incomplete: ${reasons(threads.incomplete)}` : ""}`);
           }
           log(`  Recovery counts since connector start: accepted ${recovery?.acceptedThisProcess ?? "unknown"}; dead-lettered ${recovery?.deadLetteredThisProcess ?? "unknown"} (custody, not delivery)`);

packages/cli/src/commands/status.ts

@@ -11,6 +11,7 @@ import {
 import { readLifecycleDescription } from "../daemon-lifecycle-status.js";
 import { realDeps } from "./daemon.js";
 import { ConfigStore } from "../config-store.js";
+import { attentionLines, checkKernelAttention } from "../seat-attention.js";
 
 export interface StatusDeps {
   lifecycleDeps: LifecycleDeps;
@@ -136,8 +137,12 @@ export function statusCommand(depsOverride?: StatusDeps): Command {
       } catch {
         // config resolution unavailable - null rather than a guess.
       }
+      // A kernel short of ready: its seats that need attention, and any it couldn't check (never read as none).
+      const attention = kernelRes?.status === 200 && kernelRes.data?.kernel_state && kernelRes.data.kernel_state !== "ready"
+        ? await checkKernelAttention(client) : null;
       const kernel = kernelRes && kernelRes.status === 200 && kernelRes.data?.kernel_state
-        ? { state: kernelRes.data.kernel_state, lastBootFailure: kernelRes.data.last_boot_failure ?? null }
+        ? { state: kernelRes.data.kernel_state, lastBootFailure: kernelRes.data.last_boot_failure ?? null,
+          ...(attention && (attention.attention.length || attention.unknown.length) ? { attention } : {}) }
         : { state: kernelRes && kernelRes.status === 503 ? "not_tracked" : "unknown", lastBootFailure: null };
       const daemon = { state: "running", reachable: true, pid: status.pid, port: status.port, healthy: true };
       if (summaryRes.status !== 200) {
@@ -163,6 +168,10 @@ export function statusCommand(depsOverride?: StatusDeps): Command {
       if (failure) {
         console.log(`  Recovered from an earlier boot failure (${failure.state}${failure.at ? ` at ${failure.at}` : ""}): ${failure.detail ?? "no detail recorded"}`);
       }
+      // A kernel seat held at a startup prompt or sign-in keeps the kernel short of ready: name it and why.
+      if (kernelRes.data.kernel_state !== "ready") {
+        for (const line of attentionLines(await checkKernelAttention(client), "pane")) console.log(`  ${line}`);
+      }
     } else if (kernelRes && kernelRes.status === 503) {
       console.log("Kernel: not tracked (no kernel-boot tracker wired)");
     } else {

packages/cli/src/commands/terminal.ts

@@ -24,10 +24,40 @@ import { realDeps } from "./daemon.js";
 import type { StatusDeps } from "./status.js";
 import { openTerminalWindow, type WindowDeps } from "../terminal-window.js";
 import { assertLocalTmux, attachTmux, isLocalTmuxHost, readTmuxServerArgs, type TmuxAttachment } from "../tmux-attachment.js";
+import { attentionLines, checkSeatAttention } from "../seat-attention.js";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { homedir } from "node:os";
+
+/** herdr-app's home, resolved the way herdr-app resolves it (as the TUI does). */
+function herdrAppHome(env: NodeJS.ProcessEnv): string {
+  return env["HERDR_APP_HOME"] || join(env["XDG_CONFIG_HOME"] || join(env["HOME"] || homedir(), ".config"), "herdr-app");
+}
 
 export interface TerminalDeps extends StatusDeps {
   windowDeps?: WindowDeps;
   attachTmux?: (target: TmuxAttachment) => Promise<number>;
+  /** This process's environment (herdr-app context); injectable for tests. */
+  env?: NodeJS.ProcessEnv;
+  socketExists?: (path: string) => boolean;
+}
+
+/**
+ * The herdr-app client a command addresses, or null when it doesn't use herdr-app: `--provider herdr-app` opens the
+ * view in the herdr-app window you run it in. Inside a herdr-app terminal, plain `rig terminal open <view>` does the
+ * same when that window is answering (its socket file is a hint; the window is asked before it is chosen). `--window`
+ * always asks for a new desktop window.
+ */
+export function herdrAppClient(opts: { provider?: string; window?: boolean; appHome?: string }, deps: TerminalDeps):
+  { appHome: string; ambient: boolean } | null {
+  if (opts.window) return null;
+  const env = deps.env ?? process.env;
+  const named = opts.provider?.trim();
+  const exists = deps.socketExists ?? existsSync;
+  const ambient = !named
+    && !!env["HC_TERMINAL_ID"] && !!env["HC_TERMINAL_SOCKET"] && exists(join(herdrAppHome(env), "herdr-app.sock"));
+  if (named !== "herdr-app" && !ambient) return null;
+  return { appHome: opts.appHome ? resolve(opts.appHome) : herdrAppHome(env), ambient };
 }
 export interface FollowControls {
   enabled: boolean; maxTiles?: number; graceMs?: number; focusRetentionMs?: number;
@@ -44,6 +74,8 @@ export interface OpenViewResult {
   session?: string;
   ok: boolean;
   opened: string[];
+  /** Opened seats on another host, with that host: complete when sent, so its absence (an older daemon) means unknown. */
+  remote?: Array<{ seat: string; host: string }>;
   absent: { seat: string; host: string | null; reason: string }[];
   degraded: { seat: string; host: string; reason: string; code?: "pane_unconfirmed" }[];
   pages: number;
@@ -106,6 +138,23 @@ function humanOpen(r: OpenViewResult): string {
   return lines.join("\n");
 }
 
+/** Names the opened seats that need attention (a startup prompt, a sign-in, a failed start), so a held seat doesn't
+ *  read as an open that failed for no reason. Local seats are checked on this daemon; a seat on another host, or one
+ *  whose host the result doesn't say, is reported unchecked, never matched to a local seat of the same name. */
+async function withHeldSeats(client: DaemonClient, r: OpenViewResult): Promise<OpenViewResult> {
+  const seats = [...new Set([...r.opened, ...(r.following?.tiles.map(t => t.seat) ?? [])])];
+  if (!Array.isArray(r.remote)) {
+    // An older daemon names opened seats without saying which are remote: none can be checked locally by name.
+    const lines = seats.length ? attentionLines({ attention: [], unknown: seats.map(seat => ({ seat, why: "the daemon didn't say which host each tile is on" })) }, "tile") : [];
+    return lines.length ? { ...r, notes: [...(r.notes ?? []), ...lines] } : r;
+  }
+  const remote = new Map(r.remote.map(({ seat, host }) => [seat, host]));
+  const check = await checkSeatAttention(client, seats.filter(seat => !remote.has(seat)));
+  for (const [seat, host] of remote) check.unknown.push({ seat, why: `it's on host ${host}, which this daemon doesn't check` });
+  const lines = attentionLines(check, "tile");
+  return lines.length ? { ...r, notes: [...(r.notes ?? []), ...lines] } : r;
+}
+
 /** A successful existing-workspace selection also needs no new panes. */
 function printOpen(json: boolean, r: OpenViewResult, status: number): void {
   if (json) {
@@ -121,7 +170,7 @@ function printOpen(json: boolean, r: OpenViewResult, status: number): void {
 export function terminalCommand(depsOverride?: TerminalDeps): Command {
   const cmd = new Command("terminal").description(
     "Open the OpenRig view and agent conversations in terminal tiles",
-  ).addHelpText("after", "\nThe OpenRig TUI and operator (after install, and whenever the person wants their agents):\n  rig terminal open saved:kernel --window\n  Opens the window itself on the daemon's desktop; an agent can run it from its shell.\n  Inside Rex it opens a Rex session and shows it in the Rex app; otherwise it uses herdr when installed, else the same layout in plain tmux.\n  Herdr needs a terminal the person can see; TUI navigation does not open one.\n  Over headless SSH, give the exact connection/attach command for a new terminal/tab.\n  Only if the window cannot open: rig tui --shared is the dashboard-only fallback.\n  On a desktop, the agent opens the view; it does not finish by printing a command to copy.\n");
+  ).addHelpText("after", "\nThe OpenRig TUI and operator (after install, and whenever the person wants their agents):\n  rig terminal open saved:kernel --window\n  Opens the window itself on the daemon's desktop; an agent can run it from its shell.\n  Inside a herdr-app terminal, omit --window to open in that window.\n  Inside Rex it opens a Rex session and shows it in the Rex app; otherwise it uses herdr when installed, else the same layout in plain tmux.\n  Herdr needs a terminal the person can see; TUI navigation does not open one.\n  Over headless SSH, give the exact connection/attach command for a new terminal/tab.\n  Only if the window cannot open: rig tui --shared is the dashboard-only fallback.\n  On a desktop, the agent opens the view; it does not finish by printing a command to copy.\n");
 
   const getDeps = (): TerminalDeps =>
     depsOverride ?? {
@@ -133,9 +182,10 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
     .command("open")
     .argument("<view>", "a rig name, pod:<rig>/<pod>, seat:<rig>/<logical-id>, mission:<id>, slice:<id>, qitem:<id> (current local obligation owners), or a saved-view id")
     .description("Open a desktop terminal showing the view's live agents as interactive tiles")
-    .option("--provider <name>", "herdr, cmux or rex: open in the running provider without a desktop window; each open adds a new workspace (inside Herdr, --window reuses a matching one); tmux requires --window. Inside Rex, the default opens in Rex")
+    .option("--provider <name>", "herdr, herdr-app, cmux or rex: open in the running provider without a desktop window; each open adds a new workspace (inside Herdr, --window reuses a matching one), and herdr-app opens a Rig view in the herdr-app window this runs in, which must be answering; tmux requires --window. Inside Rex, the default opens in Rex")
     .option("--session <name>", "Herdr session on the daemon's host; --session default selects Herdr's default session")
-    .option("--window", "Open a new desktop terminal tab/window (the default when --provider is omitted)")
+    .option("--window", "Open a new desktop terminal tab/window (the default when --provider is omitted outside herdr-app); inside a herdr-app terminal --window still asks for a desktop window, and plain open reuses herdr-app")
+    .option("--app-home <dir>", "herdr-app: the client to open in (default: herdr-app's own home, from HERDR_APP_HOME or ~/.config/herdr-app)")
     .option("--expected-plan <id>", "Open only if the view still matches this preview")
     .option("--follow", "Keep one qitem:<id>, slice:<id-or-name> or mission:<id> workspace following current obligation owners (Linux/macOS Herdr protocol 22)")
     .option("--no-follow", "Stop following and keep the existing workspace and tiles as a fixed layout")
@@ -148,7 +198,7 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
     .option("--grace-ms <ms>", "Departure grace, default 4000, at most 60000", Number)
     .option("--focus-retention-ms <ms>", "Extra focused-reading retention, default 12000, at most 300000", Number)
     .option("--json", "JSON output for agents")
-    .action(async (view: string, opts: { provider?: string; session?: string; json?: boolean; window?: boolean; expectedPlan?: string;
+    .action(async (view: string, opts: { provider?: string; session?: string; json?: boolean; window?: boolean; expectedPlan?: string; appHome?: string;
       follow?: boolean; maxTiles?: number; pin?: string[]; unpin?: string[]; suppress?: string[]; unsuppress?: string[];
       suppressionMs?: number; graceMs?: number; focusRetentionMs?: number }) => {
       const deps = getDeps();
@@ -157,12 +207,51 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
       const hasControls = [maxTiles, pin, unpin, suppress, unsuppress, suppressionMs, graceMs, focusRetentionMs].some(v => v !== undefined);
       const following: FollowControls | undefined = opts.follow !== undefined || hasControls
         ? { enabled: opts.follow !== false, maxTiles, pin, unpin, suppress, unsuppress, suppressionMs, graceMs, focusRetentionMs } : undefined;
+      const herdrApp = herdrAppClient(opts, deps);
       await withClient(deps, async (client) => {
+        // An ambient herdr-app terminal does not claim --follow; only an explicit --provider herdr-app errors with follow_unsupported.
+        let selectedHerdrApp = herdrApp?.ambient && following ? null : herdrApp;
+        let ambientFallbackNote: string | undefined;
+        if (selectedHerdrApp?.ambient) {
+          const probe = await client.get<{
+            available?: boolean;
+            launch?: { socketPath?: string };
+            providers?: Array<{ status?: { available?: boolean; launch?: { socketPath?: string } } }>;
+          }>(
+            `/api/terminal/status?provider=herdr-app&appHome=${encodeURIComponent(selectedHerdrApp.appHome)}`,
+          );
+          const report = probe.data?.providers?.[0]?.status ?? probe.data;
+          if (probe.status >= 400 || typeof report?.available !== "boolean") {
+            const socketPath = report?.launch?.socketPath ?? join(selectedHerdrApp.appHome, "herdr-app.sock");
+            ambientFallbackNote = `herdr-app's socket exists at ${socketPath} but the daemon could not confirm whether it is answering (HTTP ${probe.status}); opening a desktop window instead. Use --provider herdr-app to require it.`;
+            console.error(ambientFallbackNote);
+            selectedHerdrApp = null;
+          } else if (!report.available) {
+            const socketPath = report.launch?.socketPath ?? join(selectedHerdrApp.appHome, "herdr-app.sock");
+            ambientFallbackNote = `herdr-app's socket exists at ${socketPath} but it isn't answering; opening a desktop window instead. Use --provider herdr-app to require it.`;
+            console.error(ambientFallbackNote);
+            selectedHerdrApp = null;
+          }
+        }
+        if (selectedHerdrApp) {
+          // herdr-app: a fresh Rig view in that client's own window, through the daemon. No desktop window.
+          if (following) { printResult(opts.json ?? false, { ok: false, provider: "herdr-app", code: "follow_unsupported", error: "Following isn't available in herdr-app yet; open the view without --follow." }, 400); return; }
+          const { appHome } = selectedHerdrApp;
+          const res = await client.post<OpenViewResult>("/api/terminal/open", { view, provider: "herdr-app",
+            herdrApp: { appHome },
+            ...(opts.expectedPlan !== undefined ? { expectedPlan: opts.expectedPlan } : {}) }, { timeoutMs: TERMINAL_OPEN_TIMEOUT_MS });
+          if (!Array.isArray(res.data?.opened)) { printResult(opts.json ?? false, res.data, res.status); return; }
+          printOpen(opts.json ?? false, await withHeldSeats(client, res.data), res.status);
+          return;
+        }
         // Herdr's control socket can answer with no desktop client attached.
         // The default requests a desktop; an explicit provider reuses its workspace.
+        // --window never selects herdr-app
         if (following?.enabled !== false && (opts.window || !opts.provider)) {
-          const result = await openTerminalWindow(client, view, opts.provider, deps.windowDeps, opts.expectedPlan, session, following);
-          printOpen(opts.json ?? false, result, 200);
+          const windowProvider = opts.provider?.trim() === "herdr-app" ? undefined : opts.provider;
+          const result = await openTerminalWindow(client, view, windowProvider, deps.windowDeps, opts.expectedPlan, session, following);
+          const out = ambientFallbackNote ? { ...result, notes: [...(result.notes ?? []), ambientFallbackNote] } : result;
+          printOpen(opts.json ?? false, await withHeldSeats(client, out), 200);
           return;
         }
         let expectedPlan = opts.expectedPlan;
@@ -187,7 +276,7 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
           printResult(opts.json ?? false, res.data, res.status);
           return;
         }
-        printOpen(opts.json ?? false, res.data, res.status);
+        printOpen(opts.json ?? false, await withHeldSeats(client, res.data), res.status);
       });
     });
 
@@ -203,18 +292,38 @@ export function terminalCommand(depsOverride?: TerminalDeps): Command {
       });
     });
 
+  cmd
+    .command("close <view>")
+    .description("Close a herdr-app Rig view (rv-…): its cells leave the layout, then only its own viewers end; seats keep running")
+    .option("--app-home <dir>", "herdr-app home the view is in (default: herdr-app's own)")
+    .option("--json", "JSON output for agents")
+    .action(async (view: string, opts: { appHome?: string; json?: boolean }) => {
+      const deps = getDeps();
+      const env = deps.env ?? process.env;
+      await withClient(deps, async (client) => {
+        const res = await client.post<OpenViewResult>("/api/terminal/close", { view, provider: "herdr-app",
+          herdrApp: { appHome: opts.appHome ? resolve(opts.appHome) : herdrAppHome(env) } }, { timeoutMs: TERMINAL_OPEN_TIMEOUT_MS });
+        if (opts.json) { printResult(true, res.data, res.status); return; }
+        console.log(res.data?.ok ? `Closed Rig view ${view}.` : `Not closed: ${res.data?.error ?? `HTTP ${res.status}`}`);
+        for (const note of res.data?.notes ?? []) console.log(`  ${note}`);
+        if (res.status >= 400) process.exitCode = 1;
+      });
+    });
+
   cmd
     .command("status")
     .description("Show terminal provider availability + liveness (doctor)")
-    .option("--provider <name>", "restrict to one provider (herdr / cmux / rex)")
+    .option("--provider <name>", "restrict to one provider (herdr / herdr-app / cmux / rex)")
     .option("--session <name>", "Inspect a named Herdr session on the daemon's host")
+    .option("--app-home <dir>", "herdr-app: the client to inspect (default: herdr-app's own home)")
     .option("--json", "JSON output for agents")
-    .action(async (opts: { provider?: string; session?: string; json?: boolean }) => {
+    .action(async (opts: { provider?: string; session?: string; appHome?: string; json?: boolean }) => {
       const deps = getDeps();
       await withClient(deps, async (client) => {
         let path = opts.provider
           ? `/api/terminal/status?provider=${encodeURIComponent(opts.provider)}`
           : "/api/terminal/status";
+        if (opts.provider === "herdr-app") path += `&appHome=${encodeURIComponent(opts.appHome ? resolve(opts.appHome) : herdrAppHome(deps.env ?? process.env))}`;
         const session = opts.session?.trim();
         if (session !== undefined) path += `${opts.provider ? "&" : "?"}session=${encodeURIComponent(session)}`;
         const res = await client.get<{ session?: string; error?: string }>(path);

packages/cli/src/commands/up.ts

@@ -11,6 +11,7 @@ import { getDaemonStatus, getDaemonUrl, startDaemon, type LifecycleDeps, daemonS
 import { shouldAutoStartDaemon } from "../daemon-reachability.js";
 import { prepareDaemonAutoStart } from "../daemon-auto-start.js";
 import { freshSeatCommand, launchFreshSeat } from "../fresh-seat-command.js";
+import { launchStatusRunning } from "./launch.js";
 import type { StartOptions } from "../daemon-lifecycle.js";
 import { realDeps } from "./daemon.js";
 import type { StatusDeps } from "./status.js";
@@ -120,6 +121,17 @@ snapshot, resuming seats where their harness allows; it refuses while any of its
 whose rig name already exists starts a new team in place of the stopped one, which
 is archived, and refuses if the old one may still be running. To bring a stopped
 team back with its conversations, run rig up <rig-name> --existing, not the spec.
+
+After a restore, rig up exits 0 only when the rig came back whole (rigResult
+fully_restored). It exits 1 when it didn't (partially_restored, failed or
+not_attempted), including when every seat is running but some started fresh
+without their conversation, or came back with a guidance or restore gap. With
+--json, read rigResult and each node's status, noConversation, guidanceGaps and
+restoreGaps to tell these apart: a seat with a gap keeps its own status, such as
+resumed, and a fresh seat marked noConversation (a terminal seat) lost nothing.
+A refused request exits 1 for a conflict (HTTP 409, such as a rig still running
+or a restore not attempted) and 2 for any other refusal (400, 404 or 500, such
+as no rig by that name or a failed boot).
 `);
   const getDepsF = () => depsOverride ?? { lifecycleDeps: realDeps(), clientFactory: (url: string) => new DaemonClient(url) };
 
@@ -706,7 +718,7 @@ team back with its conversations, run rig up <rig-name> --existing, not the spec
         }
         console.log(`Rig "${rigName ?? rigId}" restored (ID: ${rigId})`);
         if (rigResult) console.log(`Result: ${rigResult}`);
-        const nodes = (res.data["nodes"] as Array<{ logicalId: string; status: string; error?: string }>) ?? [];
+        const nodes = (res.data["nodes"] as Array<{ logicalId: string; status: string; error?: string; noConversation?: true; guidanceGaps?: string[]; restoreGaps?: string[] }>) ?? [];
         for (const n of nodes) {
           // OPR.0.3.4.2 — the five-term vocabulary renders distinctly; the
           // awaiting-decision reason is part of the line (not a dead end), and so is a failed seat's (such as a seat held
@@ -717,6 +729,16 @@ team back with its conversations, run rig up <rig-name> --existing, not the spec
             console.log(`  ${n.logicalId}: ${n.status}`);
           }
         }
+        // Every seat running still exits 1 when the restore isn't whole; say why, so nobody retries a start that worked.
+        if (rigResult === "partially_restored" && nodes.length > 0 && nodes.every((n) => launchStatusRunning(n.status))) {
+          const fresh = nodes.filter((n) => (n.status === "fresh" || n.status === "fresh-primed") && !n.noConversation).length;
+          const gapped = nodes.filter((n) => (n.guidanceGaps?.length ?? 0) > 0 || (n.restoreGaps?.length ?? 0) > 0).map((n) => n.logicalId);
+          const reasons = [
+            ...(fresh > 0 ? [`${fresh} started fresh without their conversation`] : []),
+            ...(gapped.length > 0 ? [`${gapped.join(", ")} came back with a gap named in a warning`] : []),
+          ];
+          console.log(`${nodes.length === 1 ? "The one seat is" : `All ${nodes.length} seats are`} running${reasons.length > 0 ? `; ${reasons.join("; ")}` : ""}. The restore isn't whole, so rig up exits 1.`);
+        }
         const warnings = (res.data["warnings"] as string[]) ?? [];
         for (const w of warnings) {
           console.error(`  warning: ${w}`);

packages/cli/src/commands/workflow-errors.ts

@@ -72,7 +72,7 @@ export function describeDaemonRejection(body: unknown, instanceHint?: string): T
       return {
         fact: "The failed step no longer exists in the cached workflow spec.",
         consequence: "The spec drifted after this instance failed; rebinding would route a step the workflow no longer declares.",
-        action: "Restore the step in the spec (re-validate to refresh the cache) or instantiate a fresh run.",
+        action: "Restore the step in the spec (then re-register it through the workflows-folder scan or an instantiate by path to refresh the cache) or instantiate a fresh run.",
       };
     case "instance_version_conflict":
       return {

packages/cli/src/commands/workflow.ts

@@ -172,7 +172,7 @@ export function workflowCommand(depsOverride?: WorkflowDeps): Command {
 
   cmd
     .command("validate <specPath>")
-    .description("Validate a workflow spec file (returns structured ok/error report)")
+    .description("Validate a workflow spec file in memory, without registering it (returns structured ok/error report)")
     .option("--json", "JSON output for agents")
     .addHelpText("after", `
 Examples:

packages/cli/src/config-store.ts

@@ -222,6 +222,9 @@ export interface RiggedConfig {
     streamDays: number;
     streamMaxItems: number;
     eventsDays: number;
+    closedContentDays: number;
+    closedMetadataDays: number;
+    erasureLedger: string;
     batchSize: number;
   };
   // S04 (OPR.0.5.5.4) — pickup-receipt stall threshold (twin of the daemon settings-store).
@@ -417,6 +420,9 @@ const DEFAULTS = {
     streamDays: 30,
     streamMaxItems: 20000,
     eventsDays: 0,
+    closedContentDays: 0,
+    closedMetadataDays: 0,
+    erasureLedger: "",
     batchSize: 500,
   },
   // S04 — pickup-receipt stall threshold default (twin of daemon getDefaultValue).
@@ -568,6 +574,12 @@ export const VALID_KEYS = [
   "retention.stream_max_items",
   // The history-only event types of `events` older than N days, 0 (default) keeps them; lockstep with the daemon twin.
   "retention.events_days",
+  // Closed queue work: content erased N days after it closed, then the row (only its id kept); 0 (default) keeps them;
+  // lockstep with the daemon twin.
+  "retention.closed_content_days",
+  "retention.closed_metadata_days",
+  // Queue erasure's ledger file (JSON lines of erased ids and actions); empty keeps none; lockstep with the daemon twin.
+  "retention.erasure_ledger",
   "stream.intake",
   "retention.batch_size",
   // S04 — pickup-receipt stall threshold; lockstep with the daemon settings-store twin.
@@ -691,6 +703,9 @@ export const ENV_MAP: Record<ValidKey, { primary: string; legacy?: string }> = {
   "retention.stream_days": { primary: "OPENRIG_RETENTION_STREAM_DAYS" },
   "retention.stream_max_items": { primary: "OPENRIG_RETENTION_STREAM_MAX_ITEMS" },
   "retention.events_days": { primary: "OPENRIG_RETENTION_EVENTS_DAYS" },
+  "retention.closed_content_days": { primary: "OPENRIG_RETENTION_CLOSED_CONTENT_DAYS" },
+  "retention.closed_metadata_days": { primary: "OPENRIG_RETENTION_CLOSED_METADATA_DAYS" },
+  "retention.erasure_ledger": { primary: "OPENRIG_RETENTION_ERASURE_LEDGER" },
   "stream.intake": { primary: "OPENRIG_STREAM_INTAKE" },
   "retention.batch_size": { primary: "OPENRIG_RETENTION_BATCH_SIZE" },
   "queue.pickup_stall_threshold_minutes": { primary: "OPENRIG_QUEUE_PICKUP_STALL_THRESHOLD_MINUTES" },
@@ -797,6 +812,9 @@ const KEY_TO_PATH: Record<ValidKey, string[]> = {
   "retention.stream_days": ["retention", "streamDays"],
   "retention.stream_max_items": ["retention", "streamMaxItems"],
   "retention.events_days": ["retention", "eventsDays"],
+  "retention.closed_content_days": ["retention", "closedContentDays"],
+  "retention.closed_metadata_days": ["retention", "closedMetadataDays"],
+  "retention.erasure_ledger": ["retention", "erasureLedger"],
   "stream.intake": ["stream", "intake"],
   "retention.batch_size": ["retention", "batchSize"],
   "queue.pickup_stall_threshold_minutes": ["queue", "pickupStallThresholdMinutes"],
@@ -1183,6 +1201,24 @@ const KEY_CONSTRAINTS: Partial<Record<ValidKey, (raw: string, coerced: string |
       throw new Error(`Invalid value for retention.events_days: must be an integer >= 0 (0 keeps the events), got "${raw}"`);
     }
   },
+  // 0 (the default) keeps closed work; a positive day count turns its erasure on (queue-erasure).
+  "retention.closed_content_days": (raw, coerced) => {
+    if (!/^-?\d+$/.test((raw ?? "").trim()) || typeof coerced !== "number" || !Number.isInteger(coerced) || coerced < 0) {
+      throw new Error(`Invalid value for retention.closed_content_days: must be an integer >= 0 (0 keeps the content), got "${raw}"`);
+    }
+  },
+  "retention.closed_metadata_days": (raw, coerced) => {
+    if (!/^-?\d+$/.test((raw ?? "").trim()) || typeof coerced !== "number" || !Number.isInteger(coerced) || coerced < 0) {
+      throw new Error(`Invalid value for retention.closed_metadata_days: must be an integer >= 0 (0 keeps the rows), got "${raw}"`);
+    }
+  },
+  // Empty (the default) keeps no erasure ledger; otherwise an absolute file path, kept outside the backed-up data.
+  "retention.erasure_ledger": (raw) => {
+    const value = (raw ?? "").trim();
+    if (value !== "" && !value.startsWith("/")) {
+      throw new Error(`Invalid value for retention.erasure_ledger: must be empty or an absolute file path, got "${raw}"`);
+    }
+  },
   "retention.batch_size": (raw, coerced) => {
     if (!/^-?\d+$/.test((raw ?? "").trim()) || typeof coerced !== "number" || !Number.isInteger(coerced) || coerced < 1) {
       throw new Error(`Invalid value for retention.batch_size: must be an integer >= 1, got "${raw}"`);
@@ -1455,6 +1491,9 @@ export class ConfigStore {
         streamDays: v("retention.stream_days") as number,
         streamMaxItems: v("retention.stream_max_items") as number,
         eventsDays: v("retention.events_days") as number,
+        closedContentDays: v("retention.closed_content_days") as number,
+        closedMetadataDays: v("retention.closed_metadata_days") as number,
+        erasureLedger: v("retention.erasure_ledger") as string,
         batchSize: v("retention.batch_size") as number,
       },
       queue: {

packages/cli/src/daemon-start-lock.ts

@@ -1,23 +1,53 @@
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 
 export interface DaemonStartLock {
   recordChild(pid: number): void;
   release(preserve?: boolean): void;
+  /** Where a reservation left from before this boot was archived, when this launch did so. */
+  archived?: string;
+}
+
+export interface StaleLockCheck {
+  /** This boot's identity (`currentBootId`), recorded in the reservation; undefined where the OS has none. */
+  bootId?: string;
+  /** When this machine booted, in ms since the epoch. */
+  bootedAtMs: number;
+  /** Three-state liveness (`createProcessLiveness`): only "dead" counts as gone. */
+  processLiveness: (pid: number) => "alive" | "dead" | "unknown";
+  /** Test seam: runs after the reservation was inspected and before it is claimed. */
+  afterInspect?: () => void;
 }
 
 /** One supported local launch owns pre-bind initialization through publication.
  * ponytail: no age-based takeover — a dead launcher can leave a live unbound child.
- * Hard-crash recovery inspects the recorded PIDs before archiving this file. */
-export function acquireDaemonStartLock(home: string): DaemonStartLock {
+ * The one exception is a reservation from an earlier boot: a reboot ends every process it could name.
+ * A reservation that records its boot ID is from an earlier boot when that ID differs from this one's;
+ * PIDs don't matter then, since after a reboot they may belong to unrelated processes.
+ * One without a boot ID (written by an older CLI) must have been written and last changed before
+ * this boot, with every recorded PID positively dead; the PID check covers a clock that jumped after
+ * boot, and a PID that can't be inspected keeps the refusal.
+ * Otherwise hard-crash recovery inspects the recorded PIDs before archiving this file. */
+export function acquireDaemonStartLock(home: string, stale?: StaleLockCheck): DaemonStartLock {
   fs.mkdirSync(home, { recursive: true });
   const file = path.join(home, "daemon-start.lock");
   let fd: number;
+  let archived: string | undefined;
   try {
     fd = fs.openSync(file, "wx", 0o600);
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
-    throw new Error(`Daemon startup is already reserved: ${file}. Inspect its launcher/child PIDs, daemon.json and daemon.log. If the launch was abandoned, prove both processes are absent before archiving the reservation and retrying; no child spawned.`);
+    archived = stale ? archiveIfBeforeBoot(file, stale) : undefined;
+    if (!archived) throw reserved(file);
+    try {
+      fd = fs.openSync(file, "wx", 0o600);
+    } catch (retry) {
+      // Another launch took the path after this one archived the old reservation: it owns startup.
+      if ((retry as NodeJS.ErrnoException).code === "EEXIST") throw reserved(file);
+      throw retry;
+    }
   }
   const identity = fs.fstatSync(fd);
   const release = (preserve = false): void => {
@@ -33,7 +63,8 @@ export function acquireDaemonStartLock(home: string): DaemonStartLock {
     }
   };
   try {
-    fs.writeSync(fd, JSON.stringify({ launcherPid: process.pid, startedAt: new Date().toISOString() }) + "\n");
+    const bootId = stale?.bootId ? { bootId: stale.bootId } : {};
+    fs.writeSync(fd, JSON.stringify({ launcherPid: process.pid, startedAt: new Date().toISOString(), ...bootId }) + "\n");
   } catch (error) {
     release();
     throw error;
@@ -41,5 +72,94 @@ export function acquireDaemonStartLock(home: string): DaemonStartLock {
   return {
     recordChild: (pid) => { fs.writeSync(fd, JSON.stringify({ childPid: pid }) + "\n"); },
     release,
+    ...(archived ? { archived } : {}),
   };
 }
+
+function reserved(file: string): Error {
+  return new Error(`Daemon startup is already reserved: ${file}. Inspect its launcher/child PIDs, daemon.json and daemon.log. If the launch was abandoned, prove both processes are absent before archiving the reservation and retrying; no child spawned.`);
+}
+
+/** This machine's boot time, in ms since the epoch. */
+export function bootedAtMs(): number {
+  return Date.now() - os.uptime() * 1000;
+}
+
+/** An ID that changes on every boot: Linux's boot_id, macOS's kern.bootsessionuuid; else undefined. */
+export function currentBootId(): string | undefined {
+  try {
+    const id = process.platform === "linux"
+      ? fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8")
+      : process.platform === "darwin"
+        ? execFileSync("/usr/sbin/sysctl", ["-n", "kern.bootsessionuuid"], { encoding: "utf8", timeout: 2_000 })
+        : "";
+    return id.trim() || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Archives a reservation from an earlier boot (see `acquireDaemonStartLock`) and returns the archive's path.
+ * Anything unreadable or from this boot stays where it is, and so does a legacy one naming a PID that isn't
+ * positively dead. One launch wins: the archive is a hard link named after the inspected file's inode, made
+ * with link(2), which never replaces an existing name. A launch that lost the race, or whose path now holds a
+ * different file, gets EEXIST or a mismatched inode and keeps the refusal. Only the winner removes the old
+ * name, and nothing else can replace it while it exists, so the winner never removes another launch's lock.
+ * A winner that dies between link and unlink leaves both names; later starts refuse, as before this change. */
+function archiveIfBeforeBoot(file: string, stale: StaleLockCheck): string | undefined {
+  let text: string;
+  let inspected: fs.Stats;
+  let fd: number;
+  try {
+    fd = fs.openSync(file, "r");
+  } catch {
+    return undefined;
+  }
+  try {
+    inspected = fs.fstatSync(fd);
+    text = fs.readFileSync(fd, "utf8");
+  } catch {
+    return undefined;
+  } finally {
+    fs.closeSync(fd);
+  }
+  const pids: number[] = [];
+  let startedAtMs = Number.NaN;
+  let lockBootId: string | undefined;
+  for (const line of text.split("\n")) {
+    if (!line.trim()) continue;
+    let record: { launcherPid?: unknown; childPid?: unknown; startedAt?: unknown; bootId?: unknown };
+    try {
+      record = JSON.parse(line);
+    } catch {
+      return undefined;
+    }
+    for (const pid of [record.launcherPid, record.childPid]) {
+      if (typeof pid === "number" && Number.isInteger(pid) && pid > 0) pids.push(pid);
+    }
+    if (typeof record.startedAt === "string") startedAtMs = Date.parse(record.startedAt);
+    if (typeof record.bootId === "string" && record.bootId) lockBootId = record.bootId;
+  }
+  if (!Number.isFinite(startedAtMs) || pids.length === 0) return undefined;
+  if (lockBootId && stale.bootId) {
+    if (lockBootId === stale.bootId) return undefined;
+  } else {
+    if (Math.max(startedAtMs, inspected.mtimeMs) >= stale.bootedAtMs) return undefined;
+    if (!pids.every((pid) => stale.processLiveness(pid) === "dead")) return undefined;
+  }
+  stale.afterInspect?.();
+  const stamp = new Date(startedAtMs).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+  const target = `${file}.abandoned-${stamp}-${inspected.ino}`;
+  try {
+    fs.linkSync(file, target);
+  } catch {
+    return undefined;
+  }
+  const linked = fs.statSync(target);
+  if (linked.dev !== inspected.dev || linked.ino !== inspected.ino) {
+    fs.unlinkSync(target);
+    return undefined;
+  }
+  fs.unlinkSync(file);
+  return target;
+}

packages/cli/src/lib/scope/logical-checkbox.ts

@@ -46,6 +46,7 @@ export function parseLogicalCheckboxes(block: string | null): LogicalCheckboxIte
   if (!block) return [];
   const lines = block.split(/\r?\n/);
   const out: LogicalCheckboxItem[] = [];
+  let fence: { marker: string; length: number } | null = null;
   let current: { checked: boolean; parts: string[]; indent: number; sourceLine: number } | null = null;
 
   const flush = () => {
@@ -56,6 +57,18 @@ export function parseLogicalCheckboxes(block: string | null): LogicalCheckboxIte
 
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i]!;
+    // Fenced examples do not declare proof items or shift evidence indexes.
+    const marker = line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
+    if (fence) {
+      if (marker && marker[1]![0] === fence.marker && marker[1]!.length >= fence.length
+        && /^[ \t]*$/.test(marker[2]!)) fence = null;
+      continue;
+    }
+    if (marker && (marker[1]![0] !== "`" || !marker[2]!.includes("`"))) {
+      flush();
+      fence = { marker: marker[1]![0]!, length: marker[1]!.length };
+      continue;
+    }
     const m = line.match(CHECKBOX_LINE);
     if (m) {
       flush();

packages/cli/src/lib/scope/scope-fs.ts

@@ -410,7 +410,8 @@ export function findMission(missionsRoot: string, identifier: string): MissionIn
   throw new ScopeCliError({
     fact: `Mission "${identifier}" not found under ${missionsRoot}.`,
     consequence: "Command did not run.",
-    action: "List available missions with: rig scope mission ls",
+    action: "List available missions with: rig scope mission ls. "
+      + "For a mission in another workspace, such as a catalog project, select its tree with the parent option: rig scope --workspace <project root> mission <verb> <mission>",
   });
 }
 
@@ -528,10 +529,15 @@ export function findSlice(
       // Walk up to find the owning mission.
       const owningMissionPath = findOwningMission(missionsRoot, candidate);
       if (!owningMissionPath) {
+        const workspace = workspaceHoldingSlice(missionsRoot, candidate);
         const error = new ScopeCliError({
           fact: `Slice path "${slicePath}" resolved to ${candidate} but no parent mission was found.`,
           consequence: "Cannot determine mission context for this slice.",
-          action: "Ensure the slice lives under <missionsRoot>/<mission>/{slices,closed}/.",
+          action: workspace
+            ? `The slice is in another workspace's missions tree (${workspace.missionsRoot}), not under ${missionsRoot}. `
+              + `Select that tree with the parent --workspace option, for example: rig scope --workspace ${quoteArg(workspace.option)} slice <verb> ${quoteArg(slicePath)}`
+            : "Ensure the slice lives under <missionsRoot>/<mission>/{slices,closed}/. "
+              + "For a slice in another workspace, such as a catalog project, select its tree with the parent option: rig scope --workspace <project root> slice <verb> <slice-path>",
         });
         if (!hintedName) throw error;
         firstContextError ??= error;
@@ -551,6 +557,33 @@ export function findSlice(
   });
 }
 
+/** POSIX single-quoting for a path shown in a command. */
+function quoteArg(value: string): string {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+
+/**
+ * For a slice directory the selected missions root does not hold, the --workspace value that
+ * selects the nearest missions tree that does: the project root when that resolves to the tree,
+ * else the missions folder itself. Each value is checked with resolveMissionsRoot, so the named
+ * option is one that works. Null when no ancestor is a readable missions tree.
+ */
+function workspaceHoldingSlice(selectedRoot: string, sliceDir: string): { option: string; missionsRoot: string } | null {
+  const selected = path.resolve(selectedRoot);
+  const target = path.resolve(sliceDir);
+  for (let root = path.dirname(target); root !== path.dirname(root); root = path.dirname(root)) {
+    if (root === selected || !walkToMission(root, target)) continue;
+    for (const option of [path.dirname(root), root]) {
+      try {
+        if (path.resolve(resolveMissionsRoot({ override: option, strictOverride: true })) === root) return { option, missionsRoot: root };
+      } catch {
+        // Not a workspace for this tree; try the next form.
+      }
+    }
+  }
+  return null;
+}
+
 function findOwningMission(missionsRoot: string, slicePath: string): string | null {
   // path.dirname never ends in a separator, so compare against the normalized root
   // (a configured or --workspace root may be written as `/w/missions/`); resolve the

packages/cli/src/mcp-server.ts

@@ -305,6 +305,18 @@ function projectForExternal<T>(row: T, view: ExternalView): T {
   return fields as T;
 }
 
+/** A handed-on item as a scoped caller receives it: without the daemon's own successor fields (successors,
+ *  successorsTruncated, successorNote), which name rows and remote ids regardless of this caller's scope. Its answer is
+ *  show's scope-checked successor (successorOf). */
+function withoutDaemonSuccessors<T>(row: T): T {
+  if (!row || typeof row !== "object" || Array.isArray(row)) return row;
+  const fields = { ...(row as Record<string, unknown>) };
+  delete fields.successors;
+  delete fields.successorsTruncated;
+  delete fields.successorNote;
+  return fields as T;
+}
+
 /** What an authenticated non-owner caller may reach: its own seat, its rigs' seats, the items they send or own (to read),
  *  the items they own (to change), and its shared roots. A person (<entityId>@external) is never in a non-owner's scope. */
 function scopeFor(access: McpAccess, seatOf: () => string | undefined): Scope {
@@ -391,6 +403,18 @@ function externalScope(access: McpAccess, seatOf: () => string | undefined): Sco
   };
 }
 
+/** The daemon's root_unknown names every shared root it has. A scoped caller learns only the ones it may read: the
+ *  daemon's roots its grant names, or none when that list can't be read. Every other answer passes as it is. */
+function scopedRootUnknown(res: DaemonResponse<unknown>, scope: Scope): DaemonResponse<unknown> {
+  const data = (res.data ?? {}) as Record<string, unknown>;
+  if (data.error !== "root_unknown") return res;
+  const roots = Array.isArray(data.configuredRoots)
+    ? data.configuredRoots.filter((name): name is string => typeof name === "string" && scope.root(name)) : [];
+  const named = typeof data.rootName === "string" ? ` '${data.rootName}'` : "";
+  return { status: res.status, data: { error: "root_unknown", ...(named ? { rootName: data.rootName } : {}), configuredRoots: roots,
+    message: `Shared root${named} is not configured on this daemon. Shared roots this connection may read: ${roots.join(", ") || "(none)"}.` } };
+}
+
 /** A target outside an authenticated caller's scope. It names the kind of target only, never the record. */
 function outOfScope(what: string, hint?: string): TextResult {
   const message = `${what} is outside what this connection may reach.${hint ? ` ${hint}` : ""}`;
@@ -609,8 +633,9 @@ const EXTERNAL_INBOX_INSTRUCTIONS = [...SHARED_INSTRUCTIONS,
 function instructionsFor(access: McpAccess | undefined, frontDoor = false): string {
   if (!access?.external) return frontDoor ? FRONT_DOOR_INSTRUCTIONS : INSTRUCTIONS;
   const tools = externalTools(access.external);
-  if (tools.has("rig_queue_claim") && tools.has("rig_queue_update")) return EXTERNAL_INBOX_INSTRUCTIONS;
-  return tools.has("rig_question_list") || tools.has("rig_question_answer") ? EXTERNAL_PERSON_INSTRUCTIONS : EXTERNAL_INSTRUCTIONS;
+  const instructions = tools.has("rig_queue_claim") && tools.has("rig_queue_update") ? EXTERNAL_INBOX_INSTRUCTIONS
+    : tools.has("rig_question_list") || tools.has("rig_question_answer") ? EXTERNAL_PERSON_INSTRUCTIONS : EXTERNAL_INSTRUCTIONS;
+  return tools.has("rig_team") ? `Discover the team this grant connects you to by calling rig_team without rigId. A sole granted rig is selected automatically; with several, it returns the granted names to choose from.\n${instructions}` : instructions;
 }
 
 /** A configured default must identify exactly one existing local node. No topology relationship, name convention
@@ -1420,9 +1445,10 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
         const view = externalView(scope);
         let successor = handedOn ? await successorOf(client, qitemId, row.closureTarget, view ? scope!.item : undefined) : undefined;
         if (scope && !view && successor && "destinationSession" in successor && !scope.successor(successor.destinationSession)) successor = { unknown: true, code: "out_of_scope" };
+        const shownItem = scope ? withoutDaemonSuccessors(item.data) : item.data;
         const data = view
-          ? { item: projectForExternal(item.data, view), transitions: Array.isArray(transitions.data) ? transitions.data.map((t) => projectForExternal(t, view)) : transitions.data }
-          : { item: item.data, transitions: transitions.data };
+          ? { item: projectForExternal(shownItem, view), transitions: Array.isArray(transitions.data) ? transitions.data.map((t) => projectForExternal(t, view)) : transitions.data }
+          : { item: shownItem, transitions: transitions.data };
         return mapResult({ status: 200, data: { ...data, ...(handedOn ? { successor } : {}) } }, undefined, { structured: true });
       } catch (err) {
         return caught(err);
@@ -1679,18 +1705,33 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
   if (offered("rig_team")) server.registerTool(
     "rig_team",
     {
-      description: "Show a rig's team: its lead, the rig's one delegates_to root (the seat that delegates to others and that nothing delegates to: the seat to delegate to), and each seat's pod, role, runtime, delegation (reportsTo, delegatesTo) and activity as the daemon reports it. Activity the daemon doesn't know reads unknown, never idle. hostedMembers are the rig's members that live outside a terminal (roster entries marked hosted): their authored capabilities and limits, with no pane and activity unknown.",
+      description: "Show a rig's team. For an external grant, omit rigId to use its sole rig or see its granted names to choose from. The answer includes its lead, the rig's one delegates_to root (the seat that delegates to others and that nothing delegates to: the seat to delegate to), and each seat's pod, role, runtime, delegation (reportsTo, delegatesTo) and activity as the daemon reports it. Activity the daemon doesn't know reads unknown, never idle. hostedMembers are the rig's members that live outside a terminal (roster entries marked hosted): their authored capabilities and limits, with no pane and activity unknown.",
       inputSchema: z.object({
-        rigId: z.string().describe("Rig name or identifier"),
+        rigId: z.string().optional().describe("Rig name or identifier; optional for an external grant to discover its team"),
       }),
       annotations: READ_ONLY,
     },
     async ({ rigId }) => {
       try {
+        const inferred = rigId === undefined && !!access?.external;
+        if (rigId === undefined) {
+          if (!access?.external) {
+            const message = "Pass a rig name or identifier as rigId.";
+            return errorResult(message, "rig_required", message);
+          }
+          const rigs = [...new Set(access.rigs)];
+          if (rigs.length !== 1) return mapResult({ status: 200, data: { rigs,
+            message: rigs.length ? "Choose one of this grant's rigs and pass its name as rigId." : "This grant names no rigs; ask the connection operator to check its scope." } }, undefined, { structured: true });
+          rigId = rigs[0]!;
+        }
         // An external caller names one of its grant's rigs, so a lookup never answers about another workspace's rig.
         if (access?.external && !scope?.rig(rigId)) return outOfScope(`Rig ${rigId}`);
         const rig = await rigIdFor(client, rigId);
         if ("content" in rig) return rig;
+        if (inferred && !rig.resolved) {
+          const message = `No rig could be resolved from this grant's scope: ${rigId}. Check the connection's scope with its operator.`;
+          return errorResult(message, "scoped_rig_unresolved", message, { rigs: [rigId] });
+        }
         const id = encodeURIComponent(rig.id);
         const detail = await client.get(`/api/rigs/${id}`);
         if (detail.status >= 400) return mapResult(detail);
@@ -1839,7 +1880,7 @@ export function createMcpServer(client: DaemonClient, options: { seat?: string;
       try {
         const read = async (source: string, rootName: string, inside: string): Promise<TextResult> => {
           const res = await client.get(`/api/files/read?${new URLSearchParams({ root: rootName, path: inside }).toString()}`);
-          if (res.status >= 400) return mapResult(res);
+          if (res.status >= 400) return mapResult(scope ? scopedRootUnknown(res, scope) : res);
           return mapResult({ status: 200, data: artifactView(source, (res.data ?? {}) as FileRead, offset ?? 0) }, undefined, { structured: true });
         };
         if (scope && root && !scope.root(root)) return outOfScope(`Root ${root}`);

packages/cli/src/recap-seat.ts

@@ -0,0 +1,42 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { parseSessionName } from "./session-name.js";
+
+/** One of the rig's seats as the daemon records it: its logical id, its member id within its pod, and its folder, the
+ *  part of its session name before `@`, which every recap reader uses. */
+export interface RigSeat { logicalId: string; member: string; folder: string }
+
+/** Where `rig context recap-write` writes a recap: `rigs/<rig>/seats/<seat>`. Without --rig or --seat it's the calling
+ *  seat's folder (OPENRIG_SESSION_NAME). A name that is a seat's folder, or the caller's own, is used as given. Another
+ *  name maps to a seat's folder only when it is exactly one seat's recorded logical id or member id in the rig's seats,
+ *  so neither a suffix nor a dot is taken as identity. When the seats can't be read, or nothing matches, the name is
+ *  written as given and a note says what was and wasn't checked. Nothing is refused. */
+export function resolveRecapSeat(opts: { rig?: string; seat?: string; sessionName?: string; topologyRoot: string;
+  seats?: RigSeat[] | { unavailable: string } }): { rig: string; seat: string; notes: string[] } | { error: string } {
+  const own = opts.sessionName ? parseSessionName(opts.sessionName) : undefined;
+  const ownRig = own?.kind === "canonical" ? own.rig : undefined;
+  const rig = opts.rig ?? ownRig;
+  if (!rig) return { error: "Name the rig with --rig: OPENRIG_SESSION_NAME isn't set, so there's no seat to default to." };
+  const self = own?.kind === "canonical" && rig === own.rig ? own.member : undefined;
+  if (opts.seat === undefined) {
+    if (!self) return { error: `Name the seat with --seat: the part of its session name before @ (dev-qa for dev-qa@${rig}).` };
+    return { rig, seat: self, notes: [] };
+  }
+  const given = opts.seat;
+  if (given === self) return { rig, seat: given, notes: [] };
+  const fresh = !existsSync(join(opts.topologyRoot, "rigs", rig, "seats", given));
+  const where = "OpenRig reads a seat's recap from the folder named by the part of its session name before @.";
+  if (!opts.seats || "unavailable" in opts.seats) {
+    const why = opts.seats && "unavailable" in opts.seats ? ` (${opts.seats.unavailable})` : "";
+    return { rig, seat: given, notes: [`${fresh ? `seats/${given} didn't exist in rig ${rig}, so this write created it, and the` : `The recap went to the existing seats/${given} as given, but the`} name couldn't be checked against the rig's seats${why}. ${where}`] };
+  }
+  if (opts.seats.some((seat) => seat.folder === given)) return { rig, seat: given, notes: [] };
+  const matches = opts.seats.filter((seat) => seat.logicalId === given || seat.member === given);
+  if (matches.length === 1) {
+    const [seat] = matches;
+    const kind = seat!.logicalId === given ? "logical id" : "member id";
+    return { rig, seat: seat!.folder, notes: [`--seat ${given} is the ${kind} of ${seat!.folder}@${rig}, so the recap goes to seats/${seat!.folder}, the folder OpenRig reads its recap from.`] };
+  }
+  const named = matches.length ? ` It's the logical or member id of ${matches.map((seat) => `seats/${seat.folder}`).join(" and ")}, so it wasn't mapped; name one of them.` : "";
+  return { rig, seat: given, notes: [`seats/${given} ${fresh ? `didn't exist in rig ${rig}, so this write created it` : `isn't one of rig ${rig}'s seat folders`}. ${where}${named}`] };
+}

packages/cli/src/seat-attention.ts

@@ -0,0 +1,110 @@
+// Seats that need attention, named where a command shows or reports them, so a held seat doesn't read as a view or
+// kernel that failed for no reason (D#52). This reads the daemon's own attention flag and recorded reason from the
+// node route `rig ps --nodes` uses; it detects nothing itself. A check that couldn't be made is reported as unknown,
+// never as "nothing needs attention".
+
+import type { DaemonClient } from "./client.js";
+import { attentionReason, questionReason, servesQuestion, type NodeEntry } from "./commands/ps.js";
+
+export interface SeatAttention {
+  seat: string;
+  reason: string;
+  /** The daemon serves a live question for this seat (needs-input), so a person can answer it there. Otherwise the
+   *  flag is broader: a failed or gated startup, a recorded error, a held message or a missing required file. */
+  waitingOnPerson: boolean;
+}
+
+export interface AttentionCheck {
+  attention: SeatAttention[];
+  /** Seats whose attention couldn't be read, and why. */
+  unknown: Array<{ seat: string; why: string }>;
+}
+
+function failure(res: { status: number; data?: unknown }): string {
+  const error = (res.data as { error?: unknown } | null | undefined)?.error;
+  return `HTTP ${res.status}${typeof error === "string" && error ? `: ${error}` : ""}`;
+}
+
+/** The given local seats (session names, `member@rig`) checked against the daemon's node inventory. A rig whose read
+ *  fails leaves its seats unknown and keeps the other rigs' answers. */
+export async function checkSeatAttention(client: DaemonClient, seats: readonly string[]): Promise<AttentionCheck> {
+  const check: AttentionCheck = { attention: [], unknown: [] };
+  const byRig = new Map<string, Set<string>>();
+  for (const seat of seats) {
+    const at = seat.lastIndexOf("@");
+    if (at <= 0 || at === seat.length - 1) { check.unknown.push({ seat, why: "not a seat@rig name" }); continue; }
+    const rig = seat.slice(at + 1);
+    if (!byRig.has(rig)) byRig.set(rig, new Set());
+    byRig.get(rig)!.add(seat);
+  }
+  if (byRig.size === 0) return check;
+  const unknownAll = (why: string) => { for (const wanted of byRig.values()) for (const seat of wanted) check.unknown.push({ seat, why }); };
+  let rigs: Array<{ rigId: string; rigName?: string; name?: string }>;
+  try {
+    const res = await client.get<Array<{ rigId: string; rigName?: string; name?: string }>>("/api/ps");
+    if (res.status >= 400 || !Array.isArray(res.data)) { unknownAll(`the rig list couldn't be read (${failure(res)})`); return check; }
+    rigs = res.data;
+  } catch (err) {
+    unknownAll(`the rig list couldn't be read (${err instanceof Error ? err.message : String(err)})`);
+    return check;
+  }
+  for (const [rigName, wanted] of byRig) {
+    const matches = rigs.filter(rig => (rig.rigName ?? rig.name) === rigName);
+    if (matches.length === 0) { for (const seat of wanted) check.unknown.push({ seat, why: `no rig named ${rigName} on this daemon` }); continue; }
+    const found = new Set<string>();
+    const failures: string[] = [];
+    for (const rig of matches) {
+      let nodes: NodeEntry[];
+      try {
+        const res = await client.get<NodeEntry[]>(`/api/rigs/${encodeURIComponent(rig.rigId)}/nodes`);
+        if (res.status >= 400 || !Array.isArray(res.data)) { failures.push(`${rigName}'s seats couldn't be read (${failure(res)})`); continue; }
+        nodes = res.data;
+      } catch (err) {
+        failures.push(`${rigName}'s seats couldn't be read (${err instanceof Error ? err.message : String(err)})`);
+        continue;
+      }
+      for (const node of nodes) {
+        const seat = node.canonicalSessionName;
+        if (!seat || !wanted.has(seat) || found.has(seat)) continue;
+        found.add(seat);
+        if (node.needsAttention === undefined) { check.unknown.push({ seat, why: "the daemon served no attention evidence for it" }); continue; }
+        if (!node.needsAttention) continue;
+        const question = servesQuestion(node);
+        // A live question names its own reason. An older recorded error would describe something else.
+        check.attention.push({ seat, reason: question ? questionReason(node) ?? "reason unavailable" : attentionReason(node), waitingOnPerson: question });
+      }
+    }
+    for (const seat of wanted) {
+      if (!found.has(seat)) check.unknown.push({ seat, why: failures[0] ?? `not in ${rigName}'s seats on this daemon` });
+    }
+  }
+  return check;
+}
+
+/** The kernel's seats that aren't ready, checked the same way. */
+export async function checkKernelAttention(client: DaemonClient): Promise<AttentionCheck> {
+  try {
+    const res = await client.get<{ agents?: Array<{ session_name?: string; startup_status?: string; down?: boolean }> }>("/api/kernel/status");
+    if (res.status >= 400) return { attention: [], unknown: [{ seat: "kernel", why: `the kernel status couldn't be read (${failure(res)})` }] };
+    const unready = (res.data?.agents ?? [])
+      .filter(agent => agent.startup_status !== "ready" || agent.down)
+      .flatMap(agent => agent.session_name ? [agent.session_name] : []);
+    return unready.length ? checkSeatAttention(client, unready) : { attention: [], unknown: [] };
+  } catch (err) {
+    return { attention: [], unknown: [{ seat: "kernel", why: `the kernel status couldn't be read (${err instanceof Error ? err.message : String(err)})` }] };
+  }
+}
+
+/** One line per seat that needs attention, then one line per reason a check couldn't be made. */
+export function attentionLines(check: AttentionCheck, where: "tile" | "pane"): string[] {
+  const lines = check.attention.map(({ seat, reason, waitingOnPerson }) => waitingOnPerson
+    ? `${seat} is waiting on a person: ${reason}. Answer it in its ${where === "tile" ? "tile" : "terminal"}, or read it with: rig capture ${seat}`
+    : `${seat} needs attention: ${reason}. Look at it ${where === "tile" ? "in its tile " : ""}with: rig capture ${seat}`);
+  const byWhy = new Map<string, string[]>();
+  for (const { seat, why } of check.unknown) byWhy.set(why, [...(byWhy.get(why) ?? []), seat]);
+  for (const [why, seats] of byWhy) {
+    const named = seats.length > 5 ? `${seats.slice(0, 5).join(", ")} and ${seats.length - 5} more` : seats.join(", ");
+    lines.push(`Couldn't check whether ${named} ${seats.length === 1 ? "needs" : "need"} attention: ${why}.`);
+  }
+  return lines;
+}

packages/cli/src/terminal-window.ts

@@ -19,6 +19,8 @@ interface Preview {
   tmux?: { mode: "inherit" | "isolated" };
   status: { launch?: { socketPath: string; session?: string } };
   composed: { id: string; localTmuxServer?: readonly string[]; opened: Pane[]; pages: Pane[][]; columns?: number; kernelLayout?: string; spaceLabel?: string; absent: OpenViewResult["absent"]; degraded: OpenViewResult["degraded"] };
+  /** The composed view's remote tiles, complete; an older daemon's preview omits it, so their hosts are unknown. */
+  remote?: Array<{ seat: string; host: string }>;
 }
 
 export interface WindowDeps {
@@ -300,7 +302,7 @@ export async function openTerminalWindow(client: DaemonClient, view: string, req
       return failed("The daemon did not confirm the requested Herdr session. Update the daemon before opening a named session.");
     }
     const launchTarget = preview.data.status.launch;
-    let { composed, planId } = preview.data;
+    let { composed, planId, remote } = preview.data;
     await assertLocalTmux(client, preview.data.tmux?.mode, "The window launcher must run on the daemon's own desktop; its instance identity could not be confirmed locally.");
     const tmuxServer = readTmuxServerArgs(composed.localTmuxServer);
     if (expectedPlan !== undefined && expectedPlan !== planId) {
@@ -320,7 +322,7 @@ export async function openTerminalWindow(client: DaemonClient, view: string, req
         if (JSON.stringify(readTmuxServerArgs(next.data.composed.localTmuxServer)) !== JSON.stringify(tmuxServer)) {
           throw new Error("The daemon's tmux server changed while opening the window; refresh the preview before retrying.");
         }
-        ({ composed, planId } = next.data);
+        ({ composed, planId, remote } = next.data);
         if (!composed.opened.length) throw new Error("No conversations are attachable after opening the terminal.");
       }
       if (composed.kernelLayout) windowNotes.push(viewportColumns === undefined
@@ -540,7 +542,7 @@ export async function openTerminalWindow(client: DaemonClient, view: string, req
       windowAttempted = true;
       window = await launchWindow(`env -u TMUX ${tmuxCommand} attach-session -t ${shellQuote(`=${viewer}`)}`);
     }
-    return { provider, ok: true, opened: composed.opened.map(pane => pane.seat), absent: composed.absent, degraded: composed.degraded, pages: composed.pages.length, window, notes: [`Viewing session: ${viewer}. Existing conversations were preserved.`, ...windowNotes, "Check the new terminal shows the intended view; window creation alone is not visual confirmation."] };
+    return { provider, ok: true, opened: composed.opened.map(pane => pane.seat), ...(Array.isArray(remote) ? { remote } : {}), absent: composed.absent, degraded: composed.degraded, pages: composed.pages.length, window, notes: [`Viewing session: ${viewer}. Existing conversations were preserved.`, ...windowNotes, "Check the new terminal shows the intended view; window creation alone is not visual confirmation."] };
   } catch (err) {
     if (windowAttempted && /-1743\b/.test(`${(err as Error).message} ${(err as { stderr?: string }).stderr ?? ""}`)) {
       windowNotes.push("macOS denied Automation access. In System Settings > Privacy & Security > Automation, allow the calling app to control the terminal app before trying again.");

packages/cli/test/client-body-timeout.test.ts

@@ -116,7 +116,9 @@ describe("DaemonClient response body deadline", () => {
   it("uses the per-request deadline through the complete body", async () => {
     const endpoint = await slowBodyServer(100);
     const client = new DaemonClient(endpoint.url, { timeoutMs: 20 });
-    await expect(client.get("/read", { timeoutMs: 1_000 })).resolves.toEqual({ status: 200, data: { ok: true } });
+    const response = await client.get("/read", { timeoutMs: 1_000 });
+    expect(response).toEqual({ status: 200, data: { ok: true }, headers: expect.any(Headers) });
+    expect(response.headers?.get("content-type")).toBe("application/json");
     expect(endpoint.requests()).toBe(1);
     expect(endpoint.closedBeforeEnd()).toBe(0);
   });

packages/cli/test/config-store-extended.test.ts

@@ -217,6 +217,9 @@ describe("ConfigStore — extended namespaces (User Settings v0)", () => {
       "retention.stream_days", // slice 22 outcome 9: stream retention
       "retention.stream_max_items",
       "retention.events_days", // the history-only event types of events
+      "retention.closed_content_days", // closed-work erasure: content
+      "retention.closed_metadata_days", // closed-work erasure: the row, keeping its id
+      "retention.erasure_ledger", // queue erasure's replay ledger file
       "stream.intake",
       "retention.batch_size",
       "queue.pickup_stall_threshold_minutes",

packages/cli/test/context-recap-write.test.ts

@@ -14,6 +14,7 @@ import { contextCommand } from "../src/commands/context.js";
 import { DaemonClient, DaemonConnectionError, DaemonTimeoutError } from "../src/client.js";
 import { STATE_FILE, type LifecycleDeps, type DaemonState } from "../src/daemon-lifecycle.js";
 import type { StatusDeps } from "../src/commands/status.js";
+import { resolveAuthoredRecapPointer } from "../../daemon/src/domain/context-packs/seat-recap-store.js";
 
 /** A running daemon on `port`, as the CLI's status check sees it. */
 function lifecycleDeps(port: number): LifecycleDeps {
@@ -34,6 +35,13 @@ function lifecycleDeps(port: number): LifecycleDeps {
 
 const daemonDeps = (port: number): StatusDeps => ({ lifecycleDeps: lifecycleDeps(port), clientFactory: (url) => new DaemonClient(url) });
 
+/** No daemon state file and nothing answering: the CLI reads the daemon as stopped. */
+const noDaemon: StatusDeps = {
+  lifecycleDeps: { ...lifecycleDeps(0), readFile: vi.fn(() => null), exists: vi.fn(() => false), isProcessAlive: vi.fn(() => false),
+    fetch: vi.fn(async () => { throw new Error("connect ECONNREFUSED"); }) },
+  clientFactory: () => { throw new Error("no daemon in this test"); },
+};
+
 async function runRecapWrite(argv: string[], deps?: StatusDeps): Promise<{ logs: string[]; errLogs: string[]; exitCode: number | undefined }> {
   const logs: string[] = [];
   const errLogs: string[] = [];
@@ -47,7 +55,8 @@ async function runRecapWrite(argv: string[], deps?: StatusDeps): Promise<{ logs:
   try {
     const program = new Command();
     program.exitOverride();
-    program.addCommand(contextCommand(deps));
+    // No test reaches a real daemon: without deps, the daemon reads as stopped.
+    program.addCommand(contextCommand(deps ?? noDaemon));
     await program.parseAsync(["node", "rig", "context", ...argv]);
   } catch { /* commander exitOverride */ } finally {
     exitCode = process.exitCode;
@@ -231,7 +240,9 @@ describe.skipIf(process.getuid?.() === 0)("rig context recap-write when this pro
       const res = await runRecapWrite(["recap-write", "--rig", "r1", "--seat", "s1", "--file", recap], daemonDeps(port));
 
       expect(res.exitCode ?? 0).toBe(0);
-      expect(received).toEqual([{ method: "POST", url: "/api/context-packs/seat-recap",
+      // The named seat is looked up first (reads only); the one write is the daemon's recap write.
+      expect(received.filter((request) => request.method !== "POST").every((request) => request.method === "GET")).toBe(true);
+      expect(received.filter((request) => request.method === "POST")).toEqual([{ method: "POST", url: "/api/context-packs/seat-recap",
         body: { rig: "r1", seat: "s1", content: "## Recent Decisions\nchose the daemon because the seat can't write here" } }]);
       expect(res.logs.join("\n")).toBe(`Recap written: /daemon/topology/rigs/r1/seats/s1/RECAP.md (1 superseded predecessor retained), by the daemon at http://127.0.0.1:${port}`);
       expect(res.errLogs.join("\n")).toMatch(/can't write the topology tree \(EACCES.*\), so the daemon writes the recap instead/);
@@ -298,3 +309,121 @@ describe.skipIf(process.getuid?.() === 0)("rig context recap-write when this pro
     }
   });
 });
+
+// Every recap reader uses seats/<the part of the session name before @>, so a recap written under a member id or a
+// logical id was left where nothing reads it (one seat had lead, editorial.lead and editorial-lead). A name maps only by
+// the rig's recorded seats, never by its spelling: a suffix or a dot isn't identity.
+describe("rig context recap-write — the seat folder every reader uses", () => {
+  /** The rig's seats as the daemon records them (pod.member logical ids; custom.name is a self-attached session). */
+  const recorded = [
+    { logicalId: "editorial.lead", podNamespace: "editorial", canonicalSessionName: "editorial-lead@web-studio" },
+    { logicalId: "ux.designer", podNamespace: "ux", canonicalSessionName: "ux-designer@web-studio" },
+    { logicalId: "research.dev-qa", podNamespace: "research", canonicalSessionName: "research-dev-qa@web-studio" },
+    { logicalId: "dev.qa", podNamespace: "dev", canonicalSessionName: "dev-qa@web-studio" },
+    { logicalId: "custom", podNamespace: null, canonicalSessionName: "custom.name@web-studio" },
+  ];
+  const withSeats: StatusDeps = { lifecycleDeps: lifecycleDeps(4242), clientFactory: (() => ({
+    get: async (path: string) => path === "/api/ps" ? { status: 200, data: [{ rigId: "rig-1", name: "web-studio" }] }
+      : path === "/api/rigs/rig-1/nodes" ? { status: 200, data: recorded } : { status: 404, data: {} },
+  })) as never };
+
+  async function inTopology(session: string | undefined, run: (tmp: string, seats: string, recap: string) => Promise<void>) {
+    const tmp = mkdtempSync(join(tmpdir(), "recap-seat-"));
+    const saved = { root: process.env["OPENRIG_TOPOLOGY_ROOT"], session: process.env["OPENRIG_SESSION_NAME"], legacy: process.env["RIGGED_SESSION_NAME"] };
+    try {
+      process.env["OPENRIG_TOPOLOGY_ROOT"] = join(tmp, "topology");
+      if (session === undefined) delete process.env["OPENRIG_SESSION_NAME"]; else process.env["OPENRIG_SESSION_NAME"] = session;
+      delete process.env["RIGGED_SESSION_NAME"];
+      const seats = join(tmp, "topology", "rigs", "web-studio", "seats");
+      for (const folder of ["editorial-lead", "ux-designer", "research-dev-qa", "dev-qa", "custom.name"]) mkdirSync(join(seats, folder), { recursive: true });
+      const recap = join(tmp, "recap.md");
+      writeFileSync(recap, "## Recent Decisions\nchose X because Y");
+      await run(tmp, seats, recap);
+    } finally {
+      for (const [key, value] of [["OPENRIG_TOPOLOGY_ROOT", saved.root], ["OPENRIG_SESSION_NAME", saved.session], ["RIGGED_SESSION_NAME", saved.legacy]] as const) {
+        if (value === undefined) delete process.env[key]; else process.env[key] = value;
+      }
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  }
+  const folders = (seats: string) => readdirSync(seats).sort();
+  const standard = ["custom.name", "dev-qa", "editorial-lead", "research-dev-qa", "ux-designer"];
+
+  it.each([
+    { name: "no --rig or --seat: this seat", args: [] as string[], note: undefined },
+    { name: "this seat's member id", args: ["--seat", "lead"], note: "--seat lead is the member id of editorial-lead@web-studio, so the recap goes to seats/editorial-lead" },
+    { name: "this seat's logical id", args: ["--seat", "editorial.lead"], note: "--seat editorial.lead is the logical id of editorial-lead@web-studio" },
+    { name: "the folder itself", args: ["--rig", "web-studio", "--seat", "editorial-lead"], note: undefined },
+  ])("a seat writing its own recap lands in seats/editorial-lead ($name)", async ({ args, note }) => {
+    await inTopology("editorial-lead@web-studio", async (tmp, seats, recap) => {
+      const res = await runRecapWrite(["recap-write", ...args, "--file", recap], withSeats);
+      expect(res.exitCode ?? 0).toBe(0);
+      expect(readFileSync(join(seats, "editorial-lead", "RECAP.md"), "utf-8")).toContain("chose X because Y");
+      // The handover's own reader finds it, from the session name alone.
+      expect(resolveAuthoredRecapPointer("editorial-lead@web-studio", join(tmp, "topology"))).toMatchObject({ address: "seat:RECAP.md" });
+      expect(folders(seats)).toEqual(standard);
+      if (note) expect(res.errLogs.join("\n")).toContain(note);
+      else expect(res.errLogs.join("\n")).not.toContain("Note:");
+    });
+  });
+
+  it("another seat's exact folder is never mistaken for the caller, even when the caller's folder ends with it", async () => {
+    await inTopology("research-dev-qa@web-studio", async (_tmp, seats, recap) => {
+      const res = await runRecapWrite(["recap-write", "--seat", "dev-qa", "--file", recap], withSeats);
+      expect(res.exitCode ?? 0).toBe(0);
+      expect(existsSync(join(seats, "dev-qa", "RECAP.md"))).toBe(true);
+      expect(existsSync(join(seats, "research-dev-qa", "RECAP.md"))).toBe(false);
+      expect(res.errLogs.join("\n")).not.toContain("Note:");
+    });
+  });
+
+  it.each(["custom.name@web-studio", "editorial-lead@web-studio"])("a dotted seat folder is used as given, not rewritten to a hyphen (caller %s)", async (session) => {
+    await inTopology(session, async (_tmp, seats, recap) => {
+      const res = await runRecapWrite(["recap-write", "--seat", "custom.name", "--file", recap], withSeats);
+      expect(res.exitCode ?? 0).toBe(0);
+      expect(existsSync(join(seats, "custom.name", "RECAP.md"))).toBe(true);
+      expect(folders(seats)).toEqual(standard);
+    });
+  });
+
+  it("another seat's recorded logical or member id maps to its folder; a name no seat has still writes, and says so", async () => {
+    await inTopology("editorial-lead@web-studio", async (_tmp, seats, recap) => {
+      const logical = await runRecapWrite(["recap-write", "--seat", "ux.designer", "--file", recap], withSeats);
+      expect(existsSync(join(seats, "ux-designer", "RECAP.md"))).toBe(true);
+      expect(logical.errLogs.join("\n")).toContain("--seat ux.designer is the logical id of ux-designer@web-studio");
+      const member = await runRecapWrite(["recap-write", "--seat", "designer", "--file", recap], withSeats);
+      expect(member.errLogs.join("\n")).toContain("--seat designer is the member id of ux-designer@web-studio");
+      expect(folders(seats)).toEqual(standard);
+
+      const unknown = await runRecapWrite(["recap-write", "--seat", "nobody", "--file", recap], withSeats);
+      expect(unknown.exitCode ?? 0).toBe(0);
+      expect(existsSync(join(seats, "nobody", "RECAP.md"))).toBe(true);
+      expect(unknown.errLogs.join("\n")).toContain("seats/nobody didn't exist in rig web-studio, so this write created it.");
+    });
+  });
+
+  it("when the daemon can't be asked, a name is written as given and the note says it wasn't checked", async () => {
+    await inTopology("editorial-lead@web-studio", async (_tmp, seats, recap) => {
+      const res = await runRecapWrite(["recap-write", "--seat", "lead", "--file", recap]);
+      expect(res.exitCode ?? 0).toBe(0);
+      expect(existsSync(join(seats, "lead", "RECAP.md"))).toBe(true);
+      expect(res.errLogs.join("\n")).toContain("the name couldn't be checked against the rig's seats");
+      // An existing folder, such as an old alias, is no proof of identity either, so the note is there too.
+      const existing = await runRecapWrite(["recap-write", "--seat", "lead", "--file", recap]);
+      expect(existing.exitCode ?? 0).toBe(0);
+      expect(existing.errLogs.join("\n")).toContain("The recap went to the existing seats/lead as given, but the name couldn't be checked against the rig's seats");
+    });
+  });
+
+  it("without OPENRIG_SESSION_NAME, --rig and --seat are named, not guessed", async () => {
+    await inTopology(undefined, async (_tmp, seats, recap) => {
+      const noRig = await runRecapWrite(["recap-write", "--file", recap]);
+      expect(noRig.exitCode).toBe(1);
+      expect(noRig.errLogs.join("\n")).toContain("Name the rig with --rig");
+      const noSeat = await runRecapWrite(["recap-write", "--rig", "web-studio", "--file", recap]);
+      expect(noSeat.exitCode).toBe(1);
+      expect(noSeat.errLogs.join("\n")).toContain("Name the seat with --seat");
+      expect(folders(seats)).toEqual(standard);
+    });
+  });
+});

packages/cli/test/daemon-start-identity.test.ts

@@ -5,7 +5,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { startDaemon, getDaemonStatus, STATE_FILE, type LifecycleDeps } from "../src/daemon-lifecycle.js";
-import { acquireDaemonStartLock } from "../src/daemon-start-lock.js";
+import { acquireDaemonStartLock, currentBootId } from "../src/daemon-start-lock.js";
+import { createProcessLiveness, readProcessState } from "../src/commands/daemon.js";
 
 afterEach(() => vi.useRealTimers());
 function fixture() {
@@ -287,6 +288,116 @@ describe("local startup reservation", () => {
       expect(fs.existsSync(file)).toBe(true); third.release();
     } finally { fs.rmSync(home, { recursive: true, force: true }); }
   });
+  describe("a reservation from before this boot", () => {
+    const startedAt = "2026-11-10T20:05:59.662Z", bootedAtMs = Date.parse("2026-11-10T20:46:15Z");
+    const dead = () => "dead" as const, alive = () => "alive" as const;
+    const leftover = (home: string, at = startedAt, bootId?: string) => {
+      const file = path.join(home, "daemon-start.lock");
+      fs.writeFileSync(file, JSON.stringify({ launcherPid: 35905, startedAt: at, ...(bootId ? { bootId } : {}) }) + "\n" + JSON.stringify({ childPid: 36449 }) + "\n");
+      const written = new Date(Date.parse(at) + 1000);
+      fs.utimesSync(file, written, written);
+      return file;
+    };
+    const archiveOf = (file: string, stamp: string) => `${file}.abandoned-${stamp}-${fs.statSync(file).ino}`;
+    const withHome = (body: (home: string) => void) => {
+      const home = fs.mkdtempSync(path.join(os.tmpdir(), "openrig-start-lock-"));
+      try { body(home); } finally { fs.rmSync(home, { recursive: true, force: true }); }
+    };
+    it("is archived and the launch goes on when every recorded PID is dead", () => withHome((home) => {
+      const file = leftover(home), archive = archiveOf(file, "20261110T200559Z"), liveness = vi.fn(dead);
+      const lock = acquireDaemonStartLock(home, { bootedAtMs, processLiveness: liveness });
+      expect(lock.archived).toBe(archive);
+      expect(fs.readFileSync(archive, "utf8")).toContain('"childPid":36449');
+      expect(liveness).toHaveBeenCalledWith(35905); expect(liveness).toHaveBeenCalledWith(36449);
+      expect(fs.readFileSync(file, "utf8")).toContain(`"launcherPid":${process.pid}`);
+      lock.release();
+      expect(fs.existsSync(file)).toBe(false);
+    }));
+    it("stays when a recorded PID is alive, in case the clock moved after boot", () => withHome((home) => {
+      const file = leftover(home);
+      expect(() => acquireDaemonStartLock(home, { bootedAtMs, processLiveness: (pid) => pid === 36449 ? "alive" : "dead" })).toThrow(/already reserved/);
+      expect(fs.readFileSync(file, "utf8")).toContain('"childPid":36449');
+    }));
+    it("stays when a recorded PID can't be inspected (EPERM)", () => withHome((home) => {
+      const file = leftover(home);
+      const processLiveness = createProcessLiveness({ signal: () => "not-permitted", readProcessState: () => "S" });
+      expect(() => acquireDaemonStartLock(home, { bootedAtMs, processLiveness })).toThrow(/already reserved/);
+      expect(fs.readdirSync(home)).toEqual(["daemon-start.lock"]);
+      expect(fs.readFileSync(file, "utf8")).toContain('"launcherPid":35905');
+    }));
+    it("stays when ps can't run for a recorded PID", () => withHome((home) => {
+      leftover(home);
+      const processLiveness = createProcessLiveness({
+        signal: () => "sent",
+        readProcessState: (pid) => readProcessState(pid, "darwin", () => { throw new Error("ps: not permitted"); }),
+      });
+      expect(() => acquireDaemonStartLock(home, { bootedAtMs, processLiveness })).toThrow(/already reserved/);
+      expect(fs.readdirSync(home)).toEqual(["daemon-start.lock"]);
+    }));
+    it("stays when it was written during this boot", () => withHome((home) => {
+      leftover(home, "2026-11-10T20:50:00.000Z");
+      expect(() => acquireDaemonStartLock(home, { bootedAtMs, processLiveness: dead })).toThrow(/already reserved/);
+    }));
+    it("stays when it was modified during this boot", () => withHome((home) => {
+      const file = leftover(home), later = new Date(bootedAtMs + 60_000);
+      fs.utimesSync(file, later, later);
+      expect(() => acquireDaemonStartLock(home, { bootedAtMs, processLiveness: dead })).toThrow(/already reserved/);
+    }));
+    it("stays when it can't be read as a reservation", () => withHome((home) => {
+      const file = path.join(home, "daemon-start.lock");
+      fs.writeFileSync(file, "not json\n");
+      fs.utimesSync(file, new Date(bootedAtMs - 60_000), new Date(bootedAtMs - 60_000));
+      expect(() => acquireDaemonStartLock(home, { bootedAtMs, processLiveness: dead })).toThrow(/already reserved/);
+      expect(fs.readFileSync(file, "utf8")).toBe("not json\n");
+    }));
+    it("is archived when it records an earlier boot's ID, even if a recorded PID is now someone else's", () => withHome((home) => {
+      const file = leftover(home, "2026-11-10T20:50:00.000Z", "boot-a"), archive = archiveOf(file, "20261110T205000Z");
+      const lock = acquireDaemonStartLock(home, { bootId: "boot-b", bootedAtMs, processLiveness: alive });
+      expect(lock.archived).toBe(archive);
+      expect(fs.readFileSync(file, "utf8")).toContain('"bootId":"boot-b"');
+      lock.release();
+    }));
+    it("stays when it records this boot's ID, whatever its times and PIDs", () => withHome((home) => {
+      leftover(home, startedAt, "boot-b");
+      expect(() => acquireDaemonStartLock(home, { bootId: "boot-b", bootedAtMs, processLiveness: dead })).toThrow(/already reserved/);
+    }));
+    it("without a boot ID of its own, falls back to the boot time and PID checks", () => withHome((home) => {
+      const file = leftover(home), archive = archiveOf(file, "20261110T200559Z");
+      expect(() => acquireDaemonStartLock(home, { bootId: "boot-b", bootedAtMs, processLiveness: () => "unknown" })).toThrow(/already reserved/);
+      const lock = acquireDaemonStartLock(home, { bootId: "boot-b", bootedAtMs, processLiveness: dead });
+      expect(lock.archived).toBe(archive);
+      lock.release();
+    }));
+    it("has one winner when another launch archives it and takes the lock between this one's inspection and its claim", () => withHome((home) => {
+      const file = leftover(home, startedAt, "boot-a"), archive = archiveOf(file, "20261110T200559Z");
+      let b: ReturnType<typeof acquireDaemonStartLock> | undefined;
+      const afterInspect = () => { b = acquireDaemonStartLock(home, { bootId: "boot-b", bootedAtMs, processLiveness: dead }); };
+      expect(() => acquireDaemonStartLock(home, { bootId: "boot-b", bootedAtMs, processLiveness: dead, afterInspect })).toThrow(/already reserved/);
+      expect(b?.archived).toBe(archive);
+      expect(fs.readFileSync(archive, "utf8")).toContain('"launcherPid":35905'); // the archive still holds the abandoned reservation
+      const current = fs.readFileSync(file, "utf8");
+      expect(current).toContain(`"launcherPid":${process.pid}`); // B's fresh lock is still in place, not moved by A
+      expect(fs.readdirSync(home).sort()).toEqual([path.basename(archive), "daemon-start.lock"].sort());
+      b!.release();
+      expect(fs.existsSync(file)).toBe(false); // B still owns its file
+    }));
+    it("is not moved when the path holds a different file than the one inspected", () => withHome((home) => {
+      const file = leftover(home, startedAt, "boot-a");
+      const afterInspect = () => { fs.renameSync(file, file + ".moved"); fs.writeFileSync(file, '{"launcherPid":1,"startedAt":"2026-11-10T21:00:00.000Z","bootId":"boot-b"}\n'); };
+      expect(() => acquireDaemonStartLock(home, { bootId: "boot-b", bootedAtMs, processLiveness: dead, afterInspect })).toThrow(/already reserved/);
+      expect(fs.readFileSync(file, "utf8")).toContain('"launcherPid":1');
+      expect(fs.readdirSync(home).sort()).toEqual(["daemon-start.lock", "daemon-start.lock.moved"]);
+    }));
+    it.runIf(process.platform === "darwin" || process.platform === "linux")("reads this boot's ID from the OS", () => {
+      const id = currentBootId();
+      expect(id).toMatch(/^[0-9a-f-]{32,36}$/i);
+      expect(currentBootId()).toBe(id);
+    });
+    it("stays without the boot check, as before", () => withHome((home) => {
+      leftover(home);
+      expect(() => acquireDaemonStartLock(home)).toThrow(/already reserved/);
+    }));
+  });
 });
 
 

packages/cli/test/daemon-start-wait-for-kernel.test.ts

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { waitForKernelReady, type KernelReadyResult } from "../src/daemon-lifecycle.js";
 import { daemonCommand } from "../src/commands/daemon.js";
+import { checkKernelAttention } from "../src/seat-attention.js";
 
 vi.mock("../src/daemon-lifecycle.js", async (original) => {
   const actual = await original<typeof import("../src/daemon-lifecycle.js")>();
@@ -14,14 +15,22 @@ vi.mock("../src/daemon-lifecycle.js", async (original) => {
     waitForKernelReady: vi.fn(),
   };
 });
+// The held-seat read goes to the daemon this start reports; never a real one from a test.
+vi.mock("../src/seat-attention.js", async (original) => ({
+  ...await original<typeof import("../src/seat-attention.js")>(),
+  checkKernelAttention: vi.fn(async () => ({ attention: [], unknown: [] })),
+}));
 vi.mock("../src/system-preflight.js", () => ({ SystemPreflight: class { run = async () => ({ ready: true, checks: [] }); }, quietPreflightExec: async () => "" }));
 let home: string;
 let errors: string[];
+let logs: string[];
 beforeEach(() => {
   home = mkdtempSync(join(tmpdir(), "daemon-start-wait-for-kernel-"));
   vi.stubEnv("OPENRIG_HOME", home);
   errors = [];
-  vi.spyOn(console, "log").mockImplementation(() => {});
+  logs = [];
+  vi.mocked(checkKernelAttention).mockResolvedValue({ attention: [], unknown: [] });
+  vi.spyOn(console, "log").mockImplementation((...args: unknown[]) => { logs.push(args.join(" ")); });
   vi.spyOn(console, "error").mockImplementation((...args: unknown[]) => { errors.push(args.join(" ")); });
 });
 afterEach(() => { vi.restoreAllMocks(); vi.unstubAllEnvs(); rmSync(home, { recursive: true, force: true }); process.exitCode = undefined; });
@@ -57,3 +66,19 @@ it("a kernel still booting at the deadline keeps the timeout and its fix", async
   expect(out).toContain("Fix: inspect `rig ps --rig kernel` for stalled agents");
   expect(process.exitCode).toBe(1);
 });
+
+it("a partial_ready kernel names the seat that needs attention and why, and any it couldn't check (D#52)", async () => {
+  vi.mocked(checkKernelAttention).mockResolvedValue({
+    attention: [{ seat: "advisor-lead@kernel", reason: "Startup requires attention: Login expired · Please run /login", waitingOnPerson: false }],
+    unknown: [{ seat: "queue-worker@kernel", why: "not in kernel's seats on this daemon" }] });
+  await startWaiting({ ok: true, kernelState: "partial_ready", variant: "claude-only" });
+  expect(logs).toContain("Kernel partial_ready; variant=claude-only");
+  expect(logs).toContain("  advisor-lead@kernel needs attention: Startup requires attention: Login expired · Please run /login. Look at it with: rig capture advisor-lead@kernel");
+  expect(logs).toContain("  Couldn't check whether queue-worker@kernel needs attention: not in kernel's seats on this daemon.");
+  expect(process.exitCode).toBeUndefined();
+});
+
+it("a ready kernel asks nothing more of the daemon", async () => {
+  await startWaiting({ ok: true, kernelState: "ready", variant: "claude-only" });
+  expect(checkKernelAttention).not.toHaveBeenCalled();
+});

packages/cli/test/gateway-human-lifecycle-verb.test.ts

@@ -221,6 +221,89 @@ describe("rig gateway human lifecycle verbs (S12)", () => {
     if (loaded.ok) expect(loaded.entities[0]!.prefs.deliveryClass).toBe("D");
   });
 
+  it("set binding.<n> unset refuses primary removal when secondary bindings exist, then unsets secondary and sole primary with remainingBindings + note", async () => {
+    const addRes = addHumanFragment(
+      {
+        entityId: "ana",
+        class: "human",
+        displayName: "Ana",
+        address: "ana@external",
+        connectorBindings: [
+          { kind: "slack", connectorRef: "main", secretsRef: "vault://slack/ana-secret", role: "primary", handle: "U0ANA" },
+          { kind: "slack", connectorRef: "backup", secretsRef: "vault://slack/ana-backup-secret", role: "secondary" },
+        ],
+        prefs: { deliveryClass: "A" },
+      },
+      home,
+    );
+    expect(addRes.ok).toBe(true);
+
+    // 1. Refuse unsetting primary binding.0 while binding.1 remains
+    errSpy.mockClear();
+    const p1 = program();
+    p1.exitOverride();
+    await p1.parseAsync(["node", "rig", "gateway", "human", "set", "ana", "binding.0", "unset", "--reason", "try remove primary"]);
+    expect(process.exitCode).toBe(1);
+    const refusal = errSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(refusal).toContain("no replacement is chosen silently");
+    expect(refusal).toContain('To replace the primary, set binding.0 to the new primary spec: rig gateway human set ana binding.0 "<kind:connectorRef:secretsRef:primary[:handle=<id>]>"');
+    expect(refusal).toContain("To promote one of the other bindings (binding.1), first save that binding's full spec (kind:connectorRef:secretsRef:role[:handle=<id>]) from rig gateway human show ana --json, then unset that secondary slot, then find the primary's current slot in remainingBindings (or rig gateway human show ana --json, since unsetting a lower slot shifts the primary down) and set it to the saved spec with role primary (promotion replaces the former primary binding; its connector reference and inbound handle are not retained as a secondary).");
+    expect(refusal).toContain("To remove every binding, unset the secondary bindings first using their current slot indexes from remainingBindings or rig gateway human show ana, then finish at binding.0 (once all secondaries are gone, the primary is at binding.0).");
+    expect(refusal).not.toContain("--replace");
+
+    // 2. Unset secondary binding.1 -> succeeds, prints remainingBindings[0] = binding.0 and note without secrets
+    process.exitCode = undefined;
+    logSpy.mockClear();
+    const p2 = program();
+    p2.exitOverride();
+    await p2.parseAsync(["node", "rig", "gateway", "human", "set", "ana", "binding.1", "unset", "--reason", "drop backup binding"]);
+    expect(process.exitCode).toBeUndefined();
+    const out1Raw = logSpy.mock.calls.at(-1)![0] as string;
+    expect(out1Raw).not.toContain("ana-secret");
+    const out1 = JSON.parse(out1Raw) as {
+      ok: boolean;
+      entityId: string;
+      field: string;
+      receipt: { effect: string };
+      remainingBindings: Array<Record<string, unknown>>;
+      note: string;
+    };
+    expect(out1.ok).toBe(true);
+    expect(out1.entityId).toBe("ana");
+    expect(out1.field).toBe("binding.1");
+    expect(out1.receipt.effect).toBe("applied");
+    expect(out1.remainingBindings).toEqual([
+      { slot: "binding.0", kind: "slack", connectorRef: "main", role: "primary", handle: "U0ANA", inboundResolvable: true },
+    ]);
+    expect(out1.note).toContain("Remaining binding(s): binding.0: slack:main role=primary handle=U0ANA");
+    expect(out1.note).toContain("Binding slot indexes shift after removal");
+
+    // 3. Unset sole remaining primary binding.0 -> succeeds, leaves connectorBindings: []
+    logSpy.mockClear();
+    const p3 = program();
+    p3.exitOverride();
+    await p3.parseAsync(["node", "rig", "gateway", "human", "set", "ana", "binding.0", "unset", "--reason", "remove last binding"]);
+    expect(process.exitCode).toBeUndefined();
+    const out2 = JSON.parse(logSpy.mock.calls.at(-1)![0] as string) as {
+      ok: boolean;
+      remainingBindings: unknown[];
+      note: string;
+    };
+    expect(out2.ok).toBe(true);
+    expect(out2.remainingBindings).toEqual([]);
+    expect(out2.note).toContain("Remaining bindings: none");
+    expect(out2.note).toContain("Removing the last binding makes the current delivery episode inactive, so new missing-post findings stop (an already-open recovery item for an undelivered notice may remain)");
+    expect(out2.note).toContain("It does not answer, close or cancel open questions, cancel or reroute already-prepared deliveries, or retract anything a bridge has already accepted");
+
+    const loaded = loadHumanRegistry(home);
+    expect(loaded.ok).toBe(true);
+    if (loaded.ok) {
+      const ana = loaded.entities.find((e) => e.entityId === "ana")!;
+      expect(ana.connectorBindings).toEqual([]);
+      expect(ana.prefs.deliveryClass).toBe("A");
+    }
+  });
+
   it("set with a bad enum exits 1 and names the allowed set", async () => {
     const p = program();
     p.exitOverride();

packages/cli/test/logical-checkbox-fences.test.ts

@@ -0,0 +1,43 @@
+import { describe, it, expect } from "vitest";
+import { parseLogicalCheckboxes } from "../src/lib/scope/logical-checkbox.js";
+
+import { parseProofContract } from "../src/commands/proof.js";
+
+describe("proof-contract fenced examples", () => {
+  it.each(["```", "~~~"])("excludes examples inside %s fences and keeps source lines", (marker) => {
+    const block = [
+      "- [ ] first promise",
+      "  continued",
+      `${marker}markdown`,
+      "- [x] example only",
+      marker,
+      "- [x] second promise",
+    ].join("\n");
+    expect(parseLogicalCheckboxes(block)).toEqual([
+      { checked: false, rawText: "first promise continued", sourceLine: 1 },
+      { checked: true, rawText: "second promise", sourceLine: 6 },
+    ]);
+  });
+
+  it("keeps shorter, mismatched and annotated closers inside the example", () => {
+    const block = ["````md", "```", "~~~", "```` text", "- [ ] example", "`````", "- [ ] real"].join("\n");
+    expect(parseLogicalCheckboxes(block)).toEqual([
+      { checked: false, rawText: "real", sourceLine: 7 },
+    ]);
+  });
+
+  it("does not treat inline backticks as an opener", () => {
+    expect(parseLogicalCheckboxes("```inline```\n- [ ] real")).toEqual([
+      { checked: false, rawText: "real", sourceLine: 2 },
+    ]);
+  });
+
+  it("keeps evidence positions stable through the proof-contract reader", () => {
+    const document = "## Proof contract\n- [ ] first\n```md\n- [x] example\n```\n- [ ] second\n";
+    expect(parseProofContract(document)).toEqual(["first", "second"]);
+  });
+
+  it("ignores the remainder of an unclosed example", () => {
+    expect(parseLogicalCheckboxes("~~~md\n- [ ] example")).toEqual([]);
+  });
+});

packages/cli/test/long-request-fetch.test.ts

@@ -55,7 +55,8 @@ describe("a request allowed 300 s or more", () => {
   it("carries the method, the seat and the body, and returns the daemon's answer as it came", async () => {
     const client = new DaemonClient(baseUrl, { sessionName: "dev-impl@my-rig" });
     const res = await client.post("/api/transport/send", { session: "qa@my-rig", waitForIdleMs: 400_000 }, { timeoutMs: 405_000 });
-    expect(res).toEqual({ status: 409, data: { ok: false, reason: "wait_for_idle_timeout", sent: false } });
+    expect(res).toEqual({ status: 409, data: { ok: false, reason: "wait_for_idle_timeout", sent: false }, headers: expect.any(Headers) });
+    expect(res.headers?.get("content-type")).toBe("application/json");
     expect(seen.at(-1)).toEqual({ method: "POST", path: "/api/transport/send", session: "dev-impl@my-rig",
       body: JSON.stringify({ session: "qa@my-rig", waitForIdleMs: 400_000 }) });
   });

packages/cli/test/mcp-http-daemon.test.ts

@@ -34,6 +34,7 @@ describe("rig mcp serve --http on the daemon's routes", () => {
   let db: Database.Database;
   let home: string;
   let shared: string;
+  let otherShared: string;
   let repo: QueueRepository;
   let bus: EventBus;
   /** Registered people a test sets; null reads the instance's registry, as the daemon does. */
@@ -52,6 +53,7 @@ describe("rig mcp serve --http on the daemon's routes", () => {
     migrate(db, ALL_MIGRATIONS);
     home = fs.mkdtempSync(path.join(os.tmpdir(), "mcp-http-"));
     shared = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "mcp-http-shared-")));
+    otherShared = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "mcp-http-acct-b-")));
     process.env.OPENRIG_HOME = home;
     // The env seat a local caller is declared as; an authenticated caller must never act as it.
     process.env.OPENRIG_SESSION_NAME = "env-seat@elsewhere";
@@ -68,7 +70,8 @@ describe("rig mcp serve --http on the daemon's routes", () => {
       appDeps: {
         sessionTransport: { resolveSessions: async (target: unknown) => { resolved.push(target); return { ok: false, code: "not_found", error: "inert fixture" }; }, send: inert, capture: inert, broadcast: inert } as never,
         queueRepo: repo,
-        filesAllowlist: [{ name: "proof", canonicalPath: shared }],
+        // Two shared roots, as one daemon serving two accounts has: proof, and another account's acct-b.
+        filesAllowlist: [{ name: "proof", canonicalPath: shared }, { name: "acct-b", canonicalPath: otherShared }],
       },
     });
     const { app } = setup;
@@ -84,6 +87,7 @@ describe("rig mcp serve --http on the daemon's routes", () => {
     db.close();
     fs.rmSync(home, { recursive: true, force: true });
     fs.rmSync(shared, { recursive: true, force: true });
+    fs.rmSync(otherShared, { recursive: true, force: true });
     if (saved.home === undefined) delete process.env.OPENRIG_HOME; else process.env.OPENRIG_HOME = saved.home;
     if (saved.session === undefined) delete process.env.OPENRIG_SESSION_NAME; else process.env.OPENRIG_SESSION_NAME = saved.session;
   });
@@ -242,7 +246,18 @@ describe("rig mcp serve --http on the daemon's routes", () => {
     const own = (await asCarol("rig_queue_create", { destination: "impl@team", body: "hand this on" })).structured.qitemId as string;
     const handoff = await fetch(`${daemonUrl}/api/queue/${own}/handoff`, { method: "POST", headers: { "Content-Type": "application/json", "X-OpenRig-Session": "impl@team" }, body: JSON.stringify({ toSession: "qa@other", nudge: false }) });
     expect(handoff.status).toBe(201);
+    const next = ((await handoff.json()) as { created: { qitemId: string } }).created.qitemId;
     expect((await asCarol("rig_queue_show", { qitemId: own })).structured.successor).toEqual({ unknown: true, code: "out_of_scope" });
+    // Nor do the daemon's own successor fields, which it fills without a caller's scope (here: 21 successors, so the list
+    // is cut too).
+    const more = db.prepare(`INSERT INTO queue_items (qitem_id, ts_created, ts_updated, source_session, destination_session, state, priority, body, handed_off_from)
+      VALUES (?, '2026-10-26T00:00:00.000Z', '2026-10-26T00:00:00.000Z', 'impl@team', 'qa@other', 'pending', 'routine', 'x', ?)`);
+    for (let n = 0; n < 20; n++) more.run(`qitem-more-${n}`, own);
+    expect(await (await fetch(`${daemonUrl}/api/queue/${own}`)).json()).toMatchObject({ successorsTruncated: true, successors: expect.arrayContaining([expect.objectContaining({ qitemId: next })]) });
+    const handedOn = await asCarol("rig_queue_show", { qitemId: own });
+    for (const derived of ["successors", "successorsTruncated", "successorNote"]) expect(handedOn.structured.item).not.toHaveProperty(derived);
+    expect(handedOn.text).not.toContain(next);
+    expect(handedOn.text).not.toContain("qitem-more-");
 
     // Artifacts: a root outside the grant is out of reach, directly or through an item.
     fs.writeFileSync(path.join(shared, "report.md"), "ARTIFACT body");
@@ -254,6 +269,30 @@ describe("rig mcp serve --http on the daemon's routes", () => {
     expect(viaItem.text).not.toContain("ARTIFACT body");
   });
 
+  it("a scoped grant's root_unknown names only the shared roots it may read, and an unscoped caller still sees them all", async () => {
+    // The grant names proof and a root this daemon no longer shares; acct-b is another account's.
+    const dana = await grant("dana", { roots: ["proof", "stale"] });
+    const owner = await grant("owner", { owner: true });
+    const served = await listen();
+    const asDana = await connect(served.url, dana);
+    const asOwner = await connect(served.url, owner);
+    const withRef = await repo.create({ sourceSession: "dana@team", destinationSession: "impl@team", body: "x", nudge: false } as never);
+    db.prepare("UPDATE queue_items SET evidence_ref = ? WHERE qitem_id = ?").run("report.md", withRef.qitemId);
+
+    for (const args of [{ root: "stale", path: "report.md" }, { qitemId: withRef.qitemId, root: "stale" }]) {
+      const scoped = await asDana("rig_artifact_read", args);
+      expect(scoped.structured).toMatchObject({ ok: false, code: "root_unknown",
+        message: "Shared root 'stale' is not configured on this daemon. Shared roots this connection may read: proof." });
+      expect(JSON.parse(scoped.text)).toEqual({ error: "root_unknown", rootName: "stale", configuredRoots: ["proof"],
+        message: "Shared root 'stale' is not configured on this daemon. Shared roots this connection may read: proof." });
+    }
+
+    const unscoped = await asOwner("rig_artifact_read", { root: "stale", path: "report.md" });
+    expect(unscoped.structured).toMatchObject({ code: "root_unknown" });
+    expect(JSON.parse(unscoped.text)).toMatchObject({ rootName: "stale", configuredRoots: ["proof", "acct-b"] });
+    expect(unscoped.text).toContain("acct-b");
+  });
+
   it("a hosted member works its own rows as its grant's seat, shows on the team with activity unknown, and keeps its record after revoke", async () => {
     // The team has a lead with a node. The hosted member (a tool outside any terminal) has a roster entry and a grant, no node.
     const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "mcp-http-workspace-"));

packages/cli/test/mcp-http-grant-service-daemon.test.ts

@@ -963,6 +963,7 @@ describe("rig mcp serve --http --grant-service on the daemon's routes", () => {
     expect(shown.structured.item).toMatchObject({ state: "handed-off", closureReason: "handed_off_to", handedOffTo: null, closureTarget: null,
       closingTransition: { closureReason: "handed_off_to", closureTarget: null, transitionNote: "handed on (out of scope)" } });
     expect(shown.structured.successor).toEqual({ unknown: true, code: "out_of_scope" });
+    for (const derived of ["successors", "successorsTruncated", "successorNote"]) expect(shown.structured.item).not.toHaveProperty(derived);
     expect(JSON.stringify((await asExternal("rig_queue_list", { all: true })).structured)).not.toContain("impl@team-a");
 
     // A cross-host successor's parties can't be checked here: its id and host stay hidden.
@@ -970,6 +971,7 @@ describe("rig mcp serve --http --grant-service on the daemon's routes", () => {
     db.prepare("UPDATE queue_items SET state = 'handed-off', closure_reason = 'handed_off_to', closure_target = 'qitem-far01@other-host', handed_off_to = 'impl@team-a@other-host' WHERE qitem_id = ?").run(remote);
     const far = await asExternal("rig_queue_show", { qitemId: remote });
     expect(far.structured.successor).toEqual({ unknown: true, code: "out_of_scope" });
+    expect(far.structured.item).not.toHaveProperty("successorNote");
     expect(far.text).not.toContain("other-host");
 
     // A successor addressed to the caller but sent by another caller-shaped seat isn't the team's; nor is a sibling the

packages/cli/test/mcp-http-grant-service-network.test.ts

@@ -132,10 +132,12 @@ describe("agent network increment A: OAuth-connected assistants work with each o
     const served = await listen();
     const a = await connect(served.url, A);
     const b = await connect(served.url, B);
-    const team = await a("rig_team", { rigId: RIG });
+    const team = await a("rig_team");
     expect(team.isError).toBe(false);
     expect(team.text).toContain(B.seat);
     expect(team.text).toContain(LEAD);
+    expect(team.structured.rig.name).toBe(RIG);
+    expect((await b("rig_team")).structured.rig.name).toBe(RIG);
 
     const sent = await a("rig_queue_create", { destination: B.seat, body: "Critique this plan.", tags: ["review"] });
     expect(sent.isError).toBe(false);

packages/cli/test/mcp-queue-daemon.test.ts

@@ -149,6 +149,8 @@ describe("MCP queue tools on the daemon's queue routes", () => {
 
     const shown = await desk("rig_queue_show", { qitemId });
     expect(shown.data.item).toMatchObject({ state: "handed-off" });
+    // An unscoped caller gets the daemon's successor fields as they are.
+    expect(shown.data.item.successors).toEqual([{ qitemId: next, destinationSession: "qa@team", state: "pending", via: "handedOffFrom" }]);
     expect(shown.structured).toMatchObject({ successor: { qitemId: next, destinationSession: "qa@team", state: "pending" } });
     expect(shown.data.successor).toEqual((shown.structured as { successor: unknown }).successor);
     const onward = await desk("rig_queue_list", { handedOffFrom: qitemId });

packages/cli/test/mcp-rig-names.test.ts

@@ -4,7 +4,7 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
-import { createMcpServer } from "../src/mcp-server.js";
+import { type McpAccess, createMcpServer } from "../src/mcp-server.js";
 import { DaemonClient, type DaemonResponse } from "../src/client.js";
 
 const RIG_ID = "01M5F0YZQXETQ4YVH3MJVQPQXQ";
@@ -14,7 +14,7 @@ const REMOVED_ID = "01M5F0REMOVEDRIGIDXXXXXXXX";
 let close: (() => Promise<void>) | undefined;
 afterEach(async () => { await close?.(); close = undefined; });
 
-async function connect(rigs: Array<{ id: string; name: string }>) {
+async function connect(rigs: Array<{ id: string; name: string }>, access?: McpAccess) {
   const requests: string[] = [];
   const snapshots: Record<string, unknown[]> = { [RIG_ID]: [{ id: "snap-1" }], [REMOVED_ID]: [{ id: "snap-old" }] };
   const known = new Set(rigs.map((r) => r.id));
@@ -24,6 +24,8 @@ async function connect(rigs: Array<{ id: string; name: string }>) {
     if (path.startsWith("/api/rigs/summary")) return { status: 200, data: rigs.map((r) => ({ ...r, archivedAt: null })) };
     const snaps = /^\/api\/rigs\/([^/]+)\/snapshots$/.exec(path);
     if (snaps) return { status: 200, data: snapshots[snaps[1]!] ?? [] };
+    const detail = /^\/api\/rigs\/([^/]+)$/.exec(path);
+    if (detail && known.has(detail[1]!)) return { status: 200, data: { rig: rigs.find(r => r.id === detail[1]), representative: null } };
     const nodes = /^\/api\/rigs\/([^/]+)\/nodes$/.exec(path);
     if (nodes && known.has(nodes[1]!)) return { status: 200, data: [{ logicalId: "work.worker" }] };
     return { status: 404, data: { error: "Rig not found" } };
@@ -35,7 +37,7 @@ async function connect(rigs: Array<{ id: string; name: string }>) {
     return { status: 404, data: { error: "Rig not found" } };
   }) as DaemonClient["post"];
 
-  const server = createMcpServer(client);
+  const server = createMcpServer(client, { access });
   const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
   const mcp = new Client({ name: "test", version: "1.0.0" });
   await server.connect(serverTransport);
@@ -45,7 +47,7 @@ async function connect(rigs: Array<{ id: string; name: string }>) {
     const result = await mcp.callTool({ name, arguments: args }) as { content: Array<{ text: string }>; isError?: boolean };
     return { text: result.content[0]!.text, isError: result.isError === true };
   };
-  return { call, requests };
+  return { call, requests, instructions: mcp.getInstructions(), tools: (await mcp.listTools()).tools };
 }
 
 describe("MCP rig tools accept a rig name", () => {
@@ -93,3 +95,59 @@ describe("MCP rig tools accept a rig name", () => {
     expect(requests).toContain(`GET /api/rigs/${RIG_ID}/nodes`);
   });
 });
+
+const external = (rigs: string[]): McpAccess => ({ principal: "fixture-caller@solo", owner: false, rigs, roots: [], workspace: false, external: { objects: { team: ["list"] } } });
+
+describe("external team discovery within the grant", () => {
+  it.each([["solo"], ["solo", "solo"]])("uses a sole granted rig without a name (scope %j)", async (...rigs) => {
+    const { call, instructions, tools } = await connect([{ id: RIG_ID, name: "solo" }, { id: OTHER_ID, name: "outside" }], external(rigs));
+    const result = await call("rig_team", {});
+    expect(result.isError).toBe(false);
+    expect(JSON.parse(result.text).rig).toEqual({ id: RIG_ID, name: "solo" });
+    expect(result.text).not.toContain("outside");
+    expect(instructions?.slice(0, 512)).toContain("rig_team without rigId");
+    expect(tools.map(t => t.name)).toEqual(["rig_team"]);
+  });
+
+  it("offers only the granted names when a choice is needed, without looking up other rigs", async () => {
+    const { call, requests } = await connect([{ id: RIG_ID, name: "solo" }, { id: OTHER_ID, name: "outside" }], external(["solo", "second"]));
+    const result = await call("rig_team", {});
+    expect(result.isError).toBe(false);
+    expect(JSON.parse(result.text).rigs).toEqual(["solo", "second"]);
+    expect(result.text).not.toContain("outside");
+    expect(requests).toEqual([]);
+  });
+
+  it("names an empty grant scope without guessing another rig", async () => {
+    const { call, requests } = await connect([{ id: RIG_ID, name: "outside" }], external([]));
+    const result = await call("rig_team", {});
+    expect(result.isError).toBe(false);
+    expect(JSON.parse(result.text)).toMatchObject({ rigs: [], message: expect.stringContaining("no rigs") });
+    expect(result.text).not.toContain("outside");
+    expect(requests).toEqual([]);
+  });
+
+  it("names an unresolved sole grant and does not read a different rig", async () => {
+    const { call, requests } = await connect([{ id: OTHER_ID, name: "outside" }], external(["missing"]));
+    const result = await call("rig_team", {});
+    expect(result.isError).toBe(true);
+    expect(result.text).toContain("missing");
+    expect(result.text).not.toContain("outside");
+    expect(requests).not.toContain(`GET /api/rigs/${OTHER_ID}`);
+  });
+
+  it("still asks an unscoped owner for a rig rather than guessing one", async () => {
+    const { call, requests } = await connect([{ id: RIG_ID, name: "solo" }]);
+    const result = await call("rig_team", {});
+    expect(result.isError).toBe(true);
+    expect(result.text).toContain("Pass a rig name or identifier");
+    expect(requests).toEqual([]);
+  });
+
+  it("keeps explicit granted reads and out-of-scope refusal unchanged", async () => {
+    const { call, requests } = await connect([{ id: RIG_ID, name: "solo" }, { id: OTHER_ID, name: "outside" }], external(["solo"]));
+    expect((await call("rig_team", { rigId: "solo" })).isError).toBe(false);
+    expect((await call("rig_team", { rigId: "outside" })).isError).toBe(true);
+    expect(requests).not.toContain(`GET /api/rigs/${OTHER_ID}`);
+  });
+});

packages/cli/test/mcp-server.test.ts

@@ -354,6 +354,29 @@ describe("MCP Server", () => {
     await cleanup();
   });
 
+  it("rig_artifact_read: an external grant's root_unknown names only its own shared roots, or none when the daemon's list can't be read", async () => {
+    let listed = true;
+    const getFn = vi.fn(async (p: string) => {
+      if (p === "/api/queue/q-ext") return { status: 200, data: { qitemId: "q-ext", sourceSession: "cus-a1-caller@team", destinationSession: "lead@team", evidenceRef: "report.md" } };
+      if (p === "/api/files/roots") return { status: 200, data: { roots: [{ name: "proof", path: "/shared/proof" }, { name: "acct-b", path: "/shared/acct-b" }] } };
+      if (p.startsWith("/api/files/read?root=stale&")) return { status: 400, data: { error: "root_unknown",
+        message: "allowlist root 'stale' is not configured. Allowlist configured roots: proof, acct-b.", rootName: "stale", ...(listed ? { configuredRoots: ["proof", "acct-b"] } : {}) } };
+      return { status: 404, data: {} };
+    });
+    await setup({ get: getFn }, { seat: "cus-a1-caller@team",
+      access: { principal: "cus_A1", owner: false, rigs: ["team"], roots: ["proof", "stale"], workspace: false, external: { objects: { artifact: ["read"] } } } });
+    const named = await mcpClient.callTool({ name: "rig_artifact_read", arguments: { qitemId: "q-ext", root: "stale" } });
+    expect(named.structuredContent).toMatchObject({ ok: false, code: "root_unknown",
+      message: "Shared root 'stale' is not configured on this daemon. Shared roots this connection may read: proof." });
+    expect(JSON.stringify(named.content)).not.toContain("acct-b");
+    listed = false;
+    const unlisted = await mcpClient.callTool({ name: "rig_artifact_read", arguments: { qitemId: "q-ext", root: "stale" } });
+    expect(unlisted.structuredContent).toMatchObject({ code: "root_unknown",
+      message: "Shared root 'stale' is not configured on this daemon. Shared roots this connection may read: (none)." });
+    expect(JSON.stringify(unlisted.content)).not.toContain("acct-b");
+    await cleanup();
+  });
+
   it("a front door gets front-door instructions, not the member workflow, and its declared seat with no session reads as itself", async () => {
     try {
       vi.stubEnv("OPENRIG_SESSION_NAME", "claude-app@my-rig");

packages/cli/test/proof-project-flag.test.ts

@@ -3,10 +3,12 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 
 const calls: Array<{ method: string; url: string; body?: Record<string, unknown> }> = [];
 let readExtra: Record<string, unknown> = {};
+let readFailure: { status: number; data: Record<string, unknown> } | null = null;
 vi.mock("../src/client.js", () => ({
   DaemonClient: class {
     async get(url: string) {
       calls.push({ method: "GET", url });
+      if (readFailure) return readFailure;
       return { status: 200, data: { items: [{ id: "i1", text: "Prove it.", index: 1, revision: "r1", judgment: null }], ...readExtra } };
     }
     async post(url: string, body: Record<string, unknown>) {
@@ -18,7 +20,7 @@ vi.mock("../src/client.js", () => ({
 const { proofCommand } = await import("../src/commands/proof.js");
 
 const run = (args: string[]) => proofCommand().parseAsync(["node", "proof", ...args]);
-beforeEach(() => { calls.length = 0; readExtra = {}; vi.spyOn(console, "log").mockImplementation(() => {}); });
+beforeEach(() => { calls.length = 0; readExtra = {}; readFailure = null; vi.spyOn(console, "log").mockImplementation(() => {}); });
 
 describe("rig proof --project (#132)", () => {
   it("show passes --project and the scope as query parameters", async () => {
@@ -51,3 +53,41 @@ describe("rig proof --project (#132)", () => {
     expect(calls[3]!.body).not.toHaveProperty("projectRoot");
   });
 });
+
+describe("O2: a path_escape scope names the routes to another workspace", () => {
+  const escape = { status: 400, data: { error: "path_escape", message: "Path escapes /w/missions; paths must stay within the selected workspace" } };
+  const shown = async (args: string[]): Promise<string> => {
+    const errors: string[] = [];
+    vi.spyOn(console, "error").mockImplementation((text: unknown) => { errors.push(String(text)); });
+    readFailure = escape;
+    await run(args);
+    process.exitCode = undefined;
+    return errors.join("\n");
+  };
+
+  it("without a project, names --project, the <project>: prefix and OPENRIG_URL, not rig scope", async () => {
+    const text = await shown(["show", "/other/projects/alpha/missions/m1/slices/01-x"]);
+    expect(text).toContain("path_escape: Path escapes /w/missions");
+    expect(text).toContain("For a catalog project, pass --project <id> or prefix the scope with <project>:.");
+    expect(text).toContain("To use another daemon's workspace, select that daemon with OPENRIG_URL.");
+    expect(text).not.toContain("rig scope");
+  });
+
+  it("with --project or a <project>: prefix, says the scope is outside that project's tree", async () => {
+    for (const args of [["show", "/x/slices/01-x", "--project", "alpha"], ["judge", "alpha:/x/slices/01-x#1", "--verdict", "accept", "--reason", "r"]]) {
+      const text = await shown(args);
+      expect(text).toContain("The scope is outside that project's missions root");
+      expect(text).not.toContain("pass --project");
+    }
+  });
+
+  it("another daemon error keeps its message without the hint", async () => {
+    readFailure = null;
+    const errors: string[] = [];
+    vi.spyOn(console, "error").mockImplementation((text: unknown) => { errors.push(String(text)); });
+    readFailure = { status: 404, data: { error: "scope_missing", message: "Select an existing mission or slice directory" } };
+    await run(["show", "m0/slices/01-t001"]);
+    process.exitCode = undefined;
+    expect(errors.join("\n")).toBe("scope_missing: Select an existing mission or slice directory");
+  });
+});

packages/cli/test/ps-compact.test.ts

@@ -401,6 +401,29 @@ describe("OPR.0.4.0.25 — rig ps token-safe defaults", () => {
     } finally { Object.assign(node, original); }
   });
 
+  it.each([
+    // A served question on a seat that also carries a recorded startup error: the question's reason.
+    { arbitrated: true, questionReason: "permission_prompt", expected: "permission_prompt" },
+    // A served question whose reason isn't served: never the recorded error.
+    { arbitrated: true, questionReason: null, expected: "reason unavailable" },
+    // A served "no" with a stale needs_input hook: no question, so the recorded error leads as before.
+    { arbitrated: false, questionReason: null, expected: "startup failure" },
+  ])("REASON names a live question's reason over a recorded error, with the daemon's precedence (arbitrated: $arbitrated)", async ({ arbitrated, questionReason, expected }) => {
+    const node = RIG_B_NODES[0]!;
+    const original = { ...node };
+    Object.assign(node, { needsAttention: true, arbitratedNeedsInput: arbitrated, startupStatus: "failed", latestError: "startup failure",
+      activityState: { activity: "needs_input", display: "needs input", needsInput: { count: arbitrated ? 1 : 0, reason: questionReason }, decidedBy: "hook" },
+      agentActivity: { ...node.agentActivity, state: "needs_input", reason: "approval_pending" } });
+    try {
+      const text = await captureLogs(() => makeCmd().parseAsync(["node", "rig", "ps", "--nodes", "--rig", "openrig-comms"]).then(() => {}));
+      expect(text.logs.find((line) => line.includes(node.canonicalSessionName))).toMatch(new RegExp(`yes\\s+${expected}\\s*$`));
+    } finally {
+      // Restore the shared fixture exactly, including dropping keys it didn't have (activityState).
+      for (const key of Object.keys(node)) if (!(key in original)) Reflect.deleteProperty(node, key);
+      Object.assign(node, original);
+    }
+  });
+
   it.each([[false, false], [true, false], [false, true]])("shows current limits without hiding startup failures (stale: %s, failed: %s)", async (stale, failed) => {
     const node = RIG_B_NODES[0]!;
     const original = { agentActivity: node.agentActivity, startupStatus: node.startupStatus, latestError: node.latestError, needsAttention: node.needsAttention };

packages/cli/test/queue-destination-advisory.test.ts

@@ -1,6 +1,15 @@
-import { describe, it, expect, vi } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { Hono } from "hono";
 import { createDaemon } from "../../daemon/src/startup.js";
+import { SettingsStore } from "../../daemon/src/domain/user-settings/settings-store.js";
+import { queueRoutes } from "../../daemon/src/routes/queue.js";
+import { getSelfHostId, setSelfHostId } from "../../daemon/src/domain/hosts/fanout-contract.js";
+import { deriveCurrentWork, resolveWorkNodeDirs } from "../../daemon/src/domain/current-work.js";
 import { queueCommand, type QueueDeps } from "../src/commands/queue.js";
+import { DaemonResponseError } from "../src/client.js";
 
 describe("queue destination advisory through CLI and route", () => {
   it("prints the accepted typo unchanged for create and both handoffs", async () => {
@@ -56,3 +65,884 @@ describe("queue destination advisory through CLI and route", () => {
     }
   }, 30_000);
 });
+
+describe("queue create scope advisories preserve admission and output", () => {
+  type Daemon = Awaited<ReturnType<typeof createDaemon>>;
+  type Fixture = { daemon: Daemon; app: Hono; root: string; missions: string; hostId: string | null };
+  let scratch: string;
+  let daemons: Daemon[];
+  let source: Fixture;
+  let stdout: string[];
+  let stderr: string[];
+  let responseHeaders: Headers[];
+  let createResponses: Array<{ status: number; data: Record<string, unknown> }>;
+  let savedHost: string | null;
+  let savedExit: typeof process.exitCode;
+
+  function spec(directory: string, id: string): void {
+    fs.mkdirSync(directory, { recursive: true });
+    fs.writeFileSync(path.join(directory, "SPEC.md"), `---\nid: ${id}\n---\n# Fixture\n`);
+  }
+
+  async function fixture(name: string): Promise<Fixture> {
+    const root = path.join(scratch, name);
+    const missions = path.join(root, "alpha", "missions");
+    spec(path.join(root, "alpha"), "alpha");
+    fs.writeFileSync(path.join(root, "workspace.yaml"), "projects:\n  - id: alpha\n    root: alpha\n");
+    fs.writeFileSync(path.join(root, "alpha", "project.yaml"), "id: alpha\nmissions:\n  root: missions\n");
+    spec(path.join(missions, "release"), "MISSION.ONE");
+    spec(path.join(missions, "release", "slices", "build"), "SLICE.ONE");
+    for (const dir of ["duplicate-a", "duplicate-b"]) {
+      spec(path.join(missions, dir), "DUP.MISSION");
+      spec(path.join(missions, "release", "slices", dir), "DUP.SLICE");
+    }
+    const fallback = path.join(root, "fallback");
+    spec(path.join(fallback, "release"), "FALLBACK.MISSION");
+    spec(path.join(fallback, "release", "slices", "build"), "FALLBACK.SLICE");
+    const config = path.join(root, "settings.json");
+    fs.writeFileSync(config, JSON.stringify({ workspace: {
+      root, slicesRoot: fallback, catalogPath: path.join(root, "workspace.yaml"),
+    } }));
+    const daemon = await createDaemon({ dbPath: ":memory:", tmuxExec: async () => "",
+      cmuxFactory: async () => { throw Object.assign(new Error("no fixture socket"), { code: "ENOENT" }); } });
+    daemons.push(daemon);
+    const rig = daemon.deps.rigRepo.createRig("scope");
+    for (const member of ["writer", "worker"]) daemon.deps.rigRepo.addNode(rig.id, member, { runtime: null });
+    const app = new Hono();
+    app.use("*", async (c, next) => {
+      const set = c.set.bind(c) as (key: string, value: unknown) => void;
+      for (const key of ["eventBus", "queueRepo", "inboxHandler", "outboxHandler", "rigRepo"] as const) {
+        set(key, daemon.deps[key]);
+      }
+      set("settingsStore", new SettingsStore(config));
+      await next();
+    });
+    app.route("/api/queue", queueRoutes());
+    return { daemon, app, root, missions, hostId: getSelfHostId() };
+  }
+
+  beforeEach(async () => {
+    savedExit = process.exitCode;
+    savedHost = getSelfHostId();
+    process.exitCode = undefined;
+    daemons = [];
+    scratch = fs.mkdtempSync(path.join(os.tmpdir(), "queue-scope-"));
+    vi.stubEnv("OPENRIG_NO_KERNEL", "1");
+    vi.stubEnv("OPENRIG_SESSION_NAME", "writer@scope");
+    vi.stubEnv("OPENRIG_OUTPUT_COMPACT", "0");
+    stdout = [];
+    stderr = [];
+    responseHeaders = [];
+    createResponses = [];
+    vi.spyOn(console, "log").mockImplementation((...args: unknown[]) => { stdout.push(args.join(" ")); });
+    vi.spyOn(console, "error").mockImplementation((...args: unknown[]) => { stderr.push(args.join(" ")); });
+    vi.spyOn(process.stderr, "write").mockImplementation((chunk: string | Uint8Array) => { stderr.push(String(chunk)); return true; });
+    source = await fixture("sender");
+  });
+
+  afterEach(() => {
+    for (const daemon of daemons) {
+      daemon.eventLoopMonitor.stop();
+      daemon.contextMonitor.stop();
+      daemon.deps.seatActivityService?.stop();
+      daemon.db.close();
+    }
+    setSelfHostId(savedHost);
+    vi.restoreAllMocks();
+    vi.unstubAllEnvs();
+    process.exitCode = savedExit;
+    fs.rmSync(scratch, { recursive: true, force: true });
+  });
+
+  async function create(app: Hono, args: string[], json: boolean, id = "qitem-create-contract", clientFactory?: QueueDeps["clientFactory"], destination = "worker@scope", jsonOnlyResponse = false): Promise<void> {
+    stdout.length = 0;
+    stderr.length = 0;
+    const deps: QueueDeps = {
+      lifecycleDeps: { readFile: () => null, exists: () => false,
+        fetch: async () => ({ ok: true }) } as QueueDeps["lifecycleDeps"],
+      clientFactory: clientFactory ?? (() => ({
+        post: async (url: string, body: unknown) => {
+          const response = await app.request(url, { method: "POST",
+            headers: { "Content-Type": "application/json", "X-OpenRig-Session": "writer@scope" },
+            body: JSON.stringify(body) });
+          responseHeaders.push(response.headers);
+          const data = await response.json() as Record<string, unknown>;
+          createResponses.push({ status: response.status, data });
+          return { status: response.status, data, ...(jsonOnlyResponse ? {} : { headers: response.headers }) };
+        },
+      }) as unknown as ReturnType<QueueDeps["clientFactory"]>),
+    };
+    await queueCommand(deps).parseAsync(["create", "--destination", destination,
+      "--body", "scope contract body", "--summary", "scope contract", "--id", id,
+      "--no-nudge", "--full", ...args, ...(json ? ["--json"] : [])], { from: "user" });
+  }
+
+  function committed(f: Fixture, id: string, tags: string[] | null): void {
+    const stored = f.daemon.deps.queueRepo.getById(id);
+    expect(stored).toMatchObject({ qitemId: id, destinationSession: "worker@scope",
+      body: "scope contract body", summary: "scope contract", state: "pending", priority: "routine", tags });
+    expect(f.daemon.db.prepare("SELECT COUNT(*) AS n FROM queue_items WHERE qitem_id = ?").get(id)).toEqual({ n: 1 });
+    expect(process.exitCode ?? 0).toBe(0);
+    expect(stdout).toHaveLength(1);
+    // The independent read pins the unchanged primary row; advisories are the additive response field.
+    const output = JSON.parse(stdout[0]!) as Record<string, unknown>;
+    const { advisories, ...primary } = output;
+    expect(primary).toEqual(JSON.parse(JSON.stringify(stored)));
+    expect(advisories === undefined || Array.isArray(advisories)).toBe(true);
+  }
+
+  const scopeLines = () => stderr.join("\n").split("\n")
+    .filter(line => /\bscope\b|mission:|slice:/i.test(line)).join("\n");
+
+  function assertJsonCreate(f: Fixture, destination: string, tags: string[]): Record<string, unknown> {
+    expect(createResponses).toHaveLength(1);
+    expect(createResponses[0]!.status).toBe(201);
+    const data = createResponses[0]!.data;
+    const stored = f.daemon.deps.queueRepo.getById("qitem-create-contract");
+    expect(stored).toMatchObject({ destinationSession: destination, body: "scope contract body", tags });
+    expect(f.daemon.db.prepare("SELECT COUNT(*) AS n FROM queue_items WHERE qitem_id = ?")
+      .get("qitem-create-contract")).toEqual({ n: 1 });
+    const { advisories: _advisories, ...primary } = data;
+    expect(primary).toEqual(JSON.parse(JSON.stringify(stored)));
+    expect(stdout).toHaveLength(1);
+    expect(JSON.parse(stdout[0]!)).toEqual(data);
+    expect(process.exitCode ?? 0).toBe(0);
+    return data;
+  }
+
+  it.each([
+    { mission: "MISSING.MISSION", code: "unresolved_scope", diagnostic: /unresolved|resolves to 0/i },
+    { mission: "DUP.MISSION", code: "ambiguous_scope", diagnostic: /ambiguous|resolves to 2/i },
+    { mission: "release", code: "scope_check_unavailable", diagnostic: /unavailable|could not.*check/i },
+  ])("carries $code in the real create JSON and renders it once without response headers", async row => {
+    if (row.code === "scope_check_unavailable") {
+      fs.writeFileSync(path.join(source.root, "workspace.yaml"), "projects: invalid\n");
+    }
+    const unchanged = preserveAuthored(source);
+    const tag = "mission:" + row.mission;
+    await create(source.app, ["--mission", row.mission, "--tags", "project:alpha"], true,
+      "qitem-create-contract", undefined, "worker@scope", true);
+    const data = assertJsonCreate(source, "worker@scope", [tag, "project:alpha"]);
+    unchanged();
+    expect.soft(data.advisories).toEqual([expect.objectContaining({ code: row.code,
+      message: expect.stringMatching(row.diagnostic) })]);
+    const advice = Array.isArray(data.advisories) ? data.advisories : [];
+    expect.soft(advice.map(item => item.message).join("\n")).toContain(tag);
+    expect.soft(responseHeaders[0]!.has("X-OpenRig-Scope-Advisory")).toBe(false);
+    const rendered = scopeLines().split("\n").filter(line => line.includes(tag) && row.diagnostic.test(line));
+    expect.soft(rendered).toHaveLength(1);
+  });
+
+  it("keeps the destination advisory before scope advice in the real JSON response", async () => {
+    const destination = "missing-worker@scope";
+    await create(source.app, ["--mission", "MISSING.MISSION", "--tags", "project:alpha"], true,
+      "qitem-create-contract", undefined, destination, true);
+    const data = assertJsonCreate(source, destination, ["mission:MISSING.MISSION", "project:alpha"]);
+    const advice = Array.isArray(data.advisories) ? data.advisories : [];
+    expect.soft(advice.map(item => item.code)).toEqual(["unmatched_destination_seat", "unresolved_scope"]);
+    expect.soft(advice[0]).toMatchObject({ destinationSession: destination,
+      availableDestinations: expect.arrayContaining(["worker@scope", "writer@scope"]) });
+    expect.soft(scopeLines().split("\n").filter(line => /mission:MISSING.MISSION.*unresolved|unresolved.*mission:MISSING.MISSION/i.test(line)))
+      .toHaveLength(1);
+  });
+
+  it("keeps long Unicode scope messages in JSON and stderr without a header-sized limit", async () => {
+    fs.writeFileSync(path.join(source.root, "workspace.yaml"), "projects: invalid\n");
+    const tags = ["project:alpha", ...Array.from({ length: 9 }, (_, i) =>
+      "mission:" + ("部署_" + i + "_").padEnd(150, "x") + "_末尾")];
+    await create(source.app, ["--tags", tags.join(",")], true,
+      "qitem-create-contract", undefined, "worker@scope", true);
+    const data = assertJsonCreate(source, "worker@scope", tags);
+    const advice = Array.isArray(data.advisories) ? data.advisories : [];
+    const messages = advice.map(item => item.message).join("\n");
+    expect.soft(advice).toEqual([expect.objectContaining({ code: "scope_check_unavailable", message: expect.any(String) })]);
+    expect.soft(messages.length).toBeGreaterThan(1024);
+    for (const tag of tags.slice(1)) {
+      expect.soft(messages).toContain(tag);
+      expect.soft(scopeLines()).toContain(tag);
+    }
+    expect.soft(scopeLines().split("\n").filter(line => /unavailable|could not.*check/i.test(line))).toHaveLength(1);
+    expect.soft(responseHeaders[0]!.has("X-OpenRig-Scope-Advisory")).toBe(false);
+  });
+
+  it("returns skipped scope advice for a forwarded create without sender scope reads", async () => {
+    const receiver = await fixture("json-receiver");
+    const { app, observation } = forwardingApp(receiver);
+    const senderReads = observeSenderScopeReads();
+    setSelfHostId(source.hostId);
+    await create(app, ["--host", "remote-fixture", "--mission", "MISSING.MISSION", "--tags", "project:alpha"], true,
+      "qitem-create-contract", undefined, "worker@scope", true);
+    const data = assertJsonCreate(receiver, "worker@scope", ["mission:MISSING.MISSION", "project:alpha", "cross-host", "from-host:" + os.hostname()]);
+    expect(observation.forwards).toBe(1);
+    expect(source.daemon.deps.queueRepo.getById("qitem-create-contract")).toBeNull();
+    expect(senderReads).toEqual([]);
+    const advice = Array.isArray(data.advisories) ? data.advisories : [];
+    expect.soft(advice).toEqual([expect.objectContaining({ code: expect.any(String), message: expect.stringMatching(/skipped.*cross-host|cross-host.*skipped/i) })]);
+    expect.soft(scopeLines()).toMatch(/skipped/i);
+    expect.soft(scopeLines()).not.toMatch(/unresolved|unavailable|resolves to 0/i);
+    expect.soft(responseHeaders[0]!.has("X-OpenRig-Scope-Advisory")).toBe(false);
+  });
+
+  it("keeps receiver destination advice before forwarded skipped scope advice", async () => {
+    const receiver = await fixture("advisory-receiver");
+    const { app, observation } = forwardingApp(receiver);
+    const senderReads = observeSenderScopeReads();
+    setSelfHostId(source.hostId);
+    const destination = "missing-worker@scope";
+    const tags = ["mission:release", "slice:SLICE.ONE", "project:alpha", "cross-host", "from-host:" + os.hostname()];
+
+    await create(app, ["--host", "remote-fixture", "--mission", "release", "--slice", "SLICE.ONE",
+      "--tags", "project:alpha"], true, "qitem-create-contract", undefined, destination);
+
+    const data = assertJsonCreate(receiver, destination, tags);
+    const advisories = Array.isArray(data.advisories)
+      ? data.advisories as Array<{ code?: unknown; message?: unknown }>
+      : [];
+    expect(advisories.map(advisory => advisory.code)).toEqual(["unmatched_destination_seat", "scope_check_skipped"]);
+    expect(advisories[0]).toMatchObject({ destinationSession: destination,
+      availableDestinations: expect.arrayContaining(["worker@scope", "writer@scope"]) });
+    expect(advisories[1]).toMatchObject({ message: expect.stringMatching(/skipped.*cross-host|cross-host.*skipped/i) });
+    expect(observation.forwards).toBe(1);
+    expect(observation.committedStatuses).toEqual([201]);
+    expect(source.daemon.deps.queueRepo.getById("qitem-create-contract")).toBeNull();
+    expect(receiver.daemon.deps.queueRepo.getById("qitem-create-contract")?.sourceSession)
+      .toBe("writer@scope@" + source.hostId);
+    expect(senderReads).toEqual([]);
+  });
+
+  it.each([
+    { label: "JSON null", reply: () => Response.json(null, { status: 202 }), expectedBody: "null" },
+    { label: "JSON array", reply: () => Response.json(["receiver-payload"], { status: 202 }), expectedBody: '["receiver-payload"]' },
+    { label: "non-JSON body", reply: () => new Response("receiver-payload", {
+      status: 202, headers: { "Content-Type": "text/plain" },
+    }), expectedBody: "" },
+  ])("passes through a forwarded $label response unchanged", async row => {
+    const receiver = await fixture("malformed-response-receiver");
+    const { app, observation } = forwardingApp(receiver, false, row.reply);
+    const senderReads = observeSenderScopeReads();
+    setSelfHostId(source.hostId);
+    const id = "qitem-create-contract";
+    const response = await app.request("/api/queue/create", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-OpenRig-Session": "writer@scope" },
+      body: JSON.stringify({ qitemId: id, destinationSession: "worker@scope", body: "scope contract body",
+        summary: "scope contract", nudge: false, hostId: "remote-fixture",
+        tags: ["mission:release", "slice:SLICE.ONE", "project:alpha"] }),
+    });
+    const responseBody = await response.text();
+
+    expect(response.status).toBe(202);
+    expect(responseBody).toBe(row.expectedBody);
+    expect(observation.forwards).toBe(1);
+    expect(observation.committedStatuses).toEqual([202]);
+    expect(source.daemon.deps.queueRepo.getById(id)).toBeNull();
+    expect(receiver.daemon.deps.queueRepo.getById(id)).toBeNull();
+    expect(senderReads).toEqual([]);
+  });
+
+  function preserveAuthored(f: Fixture): () => void {
+    const read = fs.readFileSync.bind(fs);
+    const stat = fs.statSync.bind(fs);
+    const list = fs.readdirSync.bind(fs);
+    const snapshot = (): Record<string, string> => {
+      const files: Record<string, string> = {};
+      const visit = (file: string): void => {
+        if (stat(file).isDirectory()) {
+          for (const child of list(file).sort()) visit(path.join(file, child));
+        } else files[path.relative(f.root, file)] = read(file, "utf8");
+      };
+      for (const file of ["workspace.yaml", "alpha/project.yaml", "alpha/missions"]) visit(path.join(f.root, file));
+      return files;
+    };
+    const before = snapshot();
+    return () => expect(snapshot()).toEqual(before);
+  }
+
+  function observeSenderScopeReads(): string[] {
+    const reads: string[] = [];
+    for (const method of ["readdirSync", "readFileSync", "statSync", "existsSync"] as const) {
+      const original = fs[method].bind(fs) as (...args: unknown[]) => unknown;
+      vi.spyOn(fs, method).mockImplementation(((...args: unknown[]) => {
+        if (String(args[0]) === path.join(source.root, "workspace.yaml")
+          || String(args[0]) === source.missions || String(args[0]).startsWith(source.missions + path.sep)) {
+          reads.push(method + ":" + String(args[0]));
+        }
+        return original(...args);
+      }) as never);
+    }
+    return reads;
+  }
+
+  function forwardingApp(receiver: Fixture, loseResponse = false, remoteResponse?: () => Response) {
+    const observation = { forwards: 0, committedStatuses: [] as number[] };
+    const app = new Hono();
+    app.use("*", async (c, next) => {
+      const set = c.set.bind(c) as (key: string, value: unknown) => void;
+      for (const key of ["eventBus", "queueRepo", "inboxHandler", "outboxHandler", "rigRepo"] as const) set(key, source.daemon.deps[key]);
+      set("settingsStore", new SettingsStore(path.join(source.root, "settings.json")));
+      set("hostRegistryLoader", () => ({ ok: true, registry: { hosts: [
+        { id: "remote-fixture", transport: "http", url: "http://remote-fixture.invalid:39001" },
+      ] } }));
+      set("remoteFetchImpl", async (_url: unknown, init: RequestInit) => {
+        observation.forwards++;
+        const body = JSON.parse(String(init.body));
+        const previous = getSelfHostId();
+        setSelfHostId(receiver.hostId);
+        try {
+          const response = remoteResponse
+            ? remoteResponse()
+            : await receiver.app.request("/api/queue/create", { ...init,
+              headers: { "Content-Type": "application/json", "X-OpenRig-Session": body.sourceSession } });
+          observation.committedStatuses.push(response.status);
+          if (loseResponse) {
+            await response.text();
+            return new Response(new ReadableStream({ start(controller) {
+              controller.error(new Error("fixture lost receiver body after commit"));
+            } }), { status: response.status, headers: response.headers });
+          }
+          return response;
+        } finally { setSelfHostId(previous); }
+      });
+      await next();
+    });
+    app.route("/api/queue", queueRoutes());
+    return { app, observation };
+  }
+
+  function recoveredClient(app: Hono, target: Fixture, typedLoss: boolean, readHealth?: (observation: number) => string | null) {
+    const calls = { posts: [] as string[], readbacks: [] as Array<{ base: string; url: string }>, postStatuses: [] as number[],
+      postBodies: [] as unknown[], committedBeforeLoss: [] as unknown[], healthReads: 0,
+      healthResults: [] as Array<string | null> };
+    const factory: QueueDeps["clientFactory"] = (base: string) => ({
+      senderIdentity: async () => ({ session: "writer@scope", originUnknown: false }),
+      post: async (url: string, body: unknown) => {
+        calls.posts.push(url);
+        calls.postBodies.push(body);
+        const response = await app.request(url, { method: "POST",
+          headers: { "Content-Type": "application/json", "X-OpenRig-Session": "writer@scope" },
+          body: JSON.stringify(body) });
+        calls.postStatuses.push(response.status);
+        if (typedLoss) {
+          await response.text();
+          calls.committedBeforeLoss.push(target.daemon.deps.queueRepo.getById((body as { qitemId: string }).qitemId));
+          throw new DaemonResponseError(response.status, "fixture lost committed response body");
+        }
+        return { status: response.status, data: await response.json(), headers: response.headers };
+      },
+      get: async (url: string) => {
+        if (url === "/healthz") {
+          calls.healthReads++;
+          try {
+            const selfHostId = readHealth ? readHealth(calls.healthReads) : source.hostId;
+            calls.healthResults.push(selfHostId);
+            return { status: 200, data: { selfHostId } };
+          } catch (error) {
+            calls.healthResults.push("unreadable");
+            throw error;
+          }
+        }
+        calls.readbacks.push({ base, url });
+        const row = target.daemon.deps.queueRepo.getById(decodeURIComponent(url.slice("/api/queue/".length)));
+        return row ? { status: 200, data: row } : { status: 404, data: { error: "not_found" } };
+      },
+    }) as unknown as ReturnType<QueueDeps["clientFactory"]>;
+    return { factory, calls };
+  }
+
+  it.each(["SLICE.ONE", "MISSING.SLICE"])("reports slice-only %s as unavailable without mission context", async slice => {
+    const unchanged = preserveAuthored(source);
+    await create(source.app, ["--slice", slice, "--tags", "project:alpha"], true);
+    committed(source, "qitem-create-contract", ["slice:" + slice, "project:alpha"]);
+    unchanged();
+    expect.soft(scopeLines()).toContain("slice:" + slice);
+    expect.soft(scopeLines()).toMatch(/\bunavailable\b/i);
+    expect.soft(scopeLines()).toMatch(/\bmission\b/i);
+    expect.soft(scopeLines()).toMatch(/absent|missing|need|requir|without|not supplied/i);
+    expect.soft(scopeLines()).not.toMatch(/resolves to 0|checked.*unresolved|not found/i);
+  });
+
+  it.each([
+    { label: "mission alone", tags: ["mission:"], empty: "mission:", valid: null },
+    { label: "slice alone", tags: ["slice:"], empty: "slice:", valid: null },
+    { label: "mission beside valid slice", tags: ["mission:", "slice:SLICE.ONE"], empty: "mission:", valid: "slice:SLICE.ONE" },
+    { label: "slice beside valid mission", tags: ["mission:release", "slice:"], empty: "slice:", valid: "mission:release" },
+  ])("identifies the empty value for $label without blaming the other tag", async row => {
+    const unchanged = preserveAuthored(source);
+    const tags = [...row.tags, "project:alpha"];
+    await create(source.app, ["--tags", tags.join(",")], true);
+    committed(source, "qitem-create-contract", tags);
+    unchanged();
+    expect.soft(scopeLines()).toContain(row.empty);
+    expect.soft(scopeLines()).toMatch(/\bempty\b/i);
+    expect.soft(scopeLines()).not.toMatch(/resolves to 0|checked.*unresolved/i);
+    if (row.valid) expect.soft(scopeLines()).not.toContain(row.valid + " is unresolved");
+  });
+
+  it.each(["mission:", "slice:"])("keeps remote empty-only %s SKIPPED without sender scope reads", async empty => {
+    const receiver = await fixture("receiver");
+    const sourceUnchanged = preserveAuthored(source);
+    const receiverUnchanged = preserveAuthored(receiver);
+    const { app, observation } = forwardingApp(receiver);
+    const senderReads = observeSenderScopeReads();
+    setSelfHostId(source.hostId);
+    await create(app, ["--host", "remote-fixture", "--tags", empty + ",project:alpha"], true);
+    const tags = [empty, "project:alpha", "cross-host", "from-host:" + os.hostname()];
+    committed(receiver, "qitem-create-contract", tags);
+    expect(source.daemon.deps.queueRepo.getById("qitem-create-contract")).toBeNull();
+    expect(receiver.daemon.deps.queueRepo.getById("qitem-create-contract")?.sourceSession).toBe("writer@scope@" + source.hostId);
+    expect(observation.forwards).toBe(1);
+    expect(observation.committedStatuses).toEqual([201]);
+    expect(senderReads).toEqual([]);
+    sourceUnchanged();
+    receiverUnchanged();
+    expect.soft(scopeLines()).toMatch(/\bskipped\b/i);
+    expect.soft(scopeLines()).toContain(empty);
+    expect.soft(scopeLines()).not.toMatch(/unresolved|unavailable|resolves to 0/i);
+  });
+
+  it.each(["mission", "slice"] as const)("checks an exact-name regular file at %s level as unresolved", async level => {
+    const parent = level === "mission" ? source.missions : path.join(source.missions, "release", "slices");
+    const wanted = level === "mission" ? "release" : "build";
+    const target = path.join(parent, wanted);
+    fs.rmSync(target, { recursive: true });
+    fs.writeFileSync(target, "a regular file is not a work directory");
+    expect(fs.statSync(target).isFile()).toBe(true);
+    // Historical current-work resolution stays permissive; this advisory has a stricter directory contract.
+    expect(resolveWorkNodeDirs(parent, wanted)).toEqual([{ dir: wanted, form: "directory name" }]);
+    const unchanged = preserveAuthored(source);
+    const args = level === "mission" ? ["--mission", wanted] : ["--mission", "release", "--slice", wanted];
+    const tags = level === "mission" ? ["mission:release", "project:alpha"] : ["mission:release", "slice:build", "project:alpha"];
+    await create(source.app, [...args, "--tags", "project:alpha"], true);
+    committed(source, "qitem-create-contract", tags);
+    unchanged();
+    expect.soft(scopeLines()).toContain(level + ":" + wanted);
+    expect.soft(scopeLines()).toMatch(/\bunresolved\b/i);
+    expect.soft(scopeLines()).not.toMatch(/unavailable|skipped/i);
+  });
+
+  it.each([true, false])("reconciles a real local commit once with scope-tagged=%s", async tagged => {
+    const unchanged = preserveAuthored(source);
+    const { factory, calls } = recoveredClient(source.app, source, true);
+    const args = tagged ? ["--mission", "missing-mission", "--tags", "project:alpha"] : [];
+    await create(source.app, args, true, "qitem-create-contract", factory);
+    committed(source, "qitem-create-contract", tagged ? ["mission:missing-mission", "project:alpha"] : null);
+    expect(calls.posts).toEqual(["/api/queue/create"]);
+    expect(calls.postStatuses).toEqual([201]);
+    expect(calls.readbacks.map(call => call.url)).toEqual(["/api/queue/qitem-create-contract"]);
+    expect(stderr.join("\n")).toContain("committed after all: row qitem-create-contract");
+    unchanged();
+    if (tagged) {
+      expect.soft(scopeLines()).toContain("mission:missing-mission");
+      expect.soft(scopeLines()).toMatch(/\bunavailable\b/i);
+      expect.soft(scopeLines()).toMatch(/\boutcome\b|\bresult\b/i);
+      expect.soft(scopeLines()).not.toMatch(/resolves to 0|checked.*unresolved/i);
+    } else expect(scopeLines()).toBe("");
+  });
+
+  async function recoverOwnHost(form: "--host" | "qualified destination", readHealth?: (observation: number) => string | null) {
+    expect(source.hostId).toEqual(expect.any(String));
+    expect(source.hostId).not.toBe("local");
+    expect(getSelfHostId()).toBe(source.hostId);
+    const health = await source.daemon.app.request("/healthz");
+    expect(health.status).toBe(200);
+    expect(await health.json()).toMatchObject({ selfHostId: source.hostId });
+    const unchanged = preserveAuthored(source);
+    const { factory, calls } = recoveredClient(source.app, source, true, readHealth);
+    const args = ["--mission", "missing-mission", "--tags", "project:alpha"];
+    if (form === "--host") args.push("--host", source.hostId!);
+    const destination = form === "qualified destination" ? "worker@scope@" + source.hostId : "worker@scope";
+    await create(source.app, args, true, "qitem-create-contract", factory, destination);
+    const tags = ["mission:missing-mission", "project:alpha"];
+    committed(source, "qitem-create-contract", tags);
+    const stored = source.daemon.deps.queueRepo.getById("qitem-create-contract");
+    expect(stored?.sourceSession).toBe("writer@scope");
+    expect(stored?.destinationSession).toBe("worker@scope");
+    expect(stored?.tags).toEqual(tags);
+    expect(source.daemon.db.prepare("SELECT COUNT(*) AS n FROM queue_items WHERE body = ?").get("scope contract body")).toEqual({ n: 1 });
+    expect(calls.posts).toEqual(["/api/queue/create"]);
+    expect(calls.postStatuses).toEqual([201]);
+    expect(calls.postBodies).toEqual([expect.objectContaining({ hostId: source.hostId,
+      destinationSession: "worker@scope", qitemId: "qitem-create-contract", tags })]);
+    expect(calls.committedBeforeLoss).toEqual([stored]);
+    expect(calls.healthReads).toBeGreaterThan(0);
+    expect(calls.readbacks.map(call => call.url)).toEqual(["/api/queue/qitem-create-contract"]);
+    expect(stderr.join("\n")).toContain("committed after all: row qitem-create-contract");
+    unchanged();
+    return calls;
+  }
+
+  it.each(["--host", "qualified destination"] as const)("keeps recovered own-host %s advice local after a committed response is lost", async form => {
+    await recoverOwnHost(form);
+    expect.soft(scopeLines()).toContain("mission:missing-mission");
+    expect.soft(scopeLines()).toMatch(/\bunavailable\b/i);
+    expect.soft(scopeLines()).toMatch(/\boutcome\b|\bresult\b/i);
+    expect.soft(scopeLines()).toMatch(/response recovery/i);
+    expect.soft(scopeLines()).not.toMatch(/\bskipped\b|cross-host|\bforwarded\b/i);
+  });
+
+  it.each(["--host", "qualified destination"] as const)(
+    "keeps own-host %s recovery advice unknown when the first identity read fails but the later match succeeds",
+    async form => {
+      const registryUrl = "http://own-host-recovery.invalid:39001";
+      const home = path.join(scratch, "cli-home-own-host-recovery");
+      fs.mkdirSync(home);
+      fs.writeFileSync(path.join(home, "hosts.yaml"), `hosts:\n  - id: ${source.hostId}\n    transport: http\n    url: ${registryUrl}\n`);
+      vi.stubEnv("OPENRIG_HOME", home);
+
+      const calls = await recoverOwnHost(form, observation => {
+        if (observation === 1) throw new Error("fixture first identity read is unavailable");
+        return source.hostId;
+      });
+
+      expect(calls.healthResults).toEqual(["unreadable", source.hostId]);
+      expect(calls.healthReads).toBe(2);
+      expect(calls.readbacks).toEqual([{
+        base: registryUrl,
+        url: "/api/queue/qitem-create-contract",
+      }]);
+      expect(scopeLines()).toContain("mission:missing-mission");
+      expect(scopeLines()).toMatch(/scope check outcome unavailable after response recovery/i);
+      expect(scopeLines()).not.toMatch(/\bskipped\b|cross-host|\bforwarded\b/i);
+    },
+  );
+
+  function healthAfterMatchedRecovery(later: "different" | "null" | "unreadable") {
+    return (observation: number): string | null => {
+      // The target and source checks see the real host. Only the later advice read changes.
+      if (observation <= 2) return source.hostId;
+      if (later === "unreadable") throw new Error("fixture health became unreadable after matching recovery");
+      return later === "null" ? null : "replacement-fixture";
+    };
+  }
+
+  it.each((["--host", "qualified destination"] as const).flatMap(form =>
+    (["different", "null", "unreadable"] as const).map(later => ({ form, later }))))(
+    "keeps matched own-host $form recovery local when later health is $later", async ({ form, later }) => {
+      const calls = await recoverOwnHost(form, healthAfterMatchedRecovery(later));
+      const evidence = "observed health sequence: " + JSON.stringify(calls.healthResults);
+      expect.soft(scopeLines(), evidence).toContain("mission:missing-mission");
+      expect.soft(scopeLines(), evidence).toMatch(/\bunavailable\b/i);
+      expect.soft(scopeLines(), evidence).toMatch(/\boutcome\b|\bresult\b/i);
+      expect.soft(scopeLines(), evidence).toMatch(/response recovery/i);
+      expect.soft(scopeLines(), evidence).not.toMatch(/\bskipped\b|cross-host|\bforwarded\b/i);
+    },
+  );
+
+  it.each(["--host", "qualified destination"] as const)(
+    "keeps own-host %s outcome unknown when health becomes unreadable before source matching", async form => {
+      expect(source.hostId).toEqual(expect.any(String));
+      expect(getSelfHostId()).toBe(source.hostId);
+      const unchanged = preserveAuthored(source);
+      const { factory, calls } = recoveredClient(source.app, source, true, observation => {
+        if (observation === 1) return source.hostId;
+        throw new Error("fixture health unreadable while matching the stored source");
+      });
+      const args = ["--mission", "missing-mission", "--tags", "project:alpha"];
+      if (form === "--host") args.push("--host", source.hostId!);
+      const destination = form === "qualified destination" ? "worker@scope@" + source.hostId : "worker@scope";
+      await expect(create(source.app, args, true, "qitem-create-contract", factory, destination))
+        .rejects.toMatchObject({ name: "DaemonResponseError", status: 201 });
+      const stored = source.daemon.deps.queueRepo.getById("qitem-create-contract");
+      expect(stored).toMatchObject({ qitemId: "qitem-create-contract", sourceSession: "writer@scope",
+        destinationSession: "worker@scope", body: "scope contract body", summary: "scope contract", state: "pending",
+        tags: ["mission:missing-mission", "project:alpha"] });
+      expect(source.daemon.db.prepare("SELECT COUNT(*) AS n FROM queue_items WHERE body = ?")
+        .get("scope contract body")).toEqual({ n: 1 });
+      expect(calls.committedBeforeLoss).toEqual([stored]);
+      expect(calls.posts).toEqual(["/api/queue/create"]);
+      expect(calls.postStatuses).toEqual([201]);
+      expect(calls.readbacks.map(call => call.url)).toEqual(["/api/queue/qitem-create-contract"]);
+      expect(stdout).toEqual([]);
+      expect(stderr.join("\n")).toContain("couldn't read this daemon's host id to tell whether its source is this create's");
+      expect(stderr.join("\n")).toContain("outcome is still unknown");
+      expect(stderr.join("\n")).not.toContain("committed after all");
+      expect(scopeLines()).not.toMatch(/scope check|\bforwarded\b/i);
+      unchanged();
+    },
+  );
+
+  async function recoverForwardedCommit(readHealth?: (observation: number) => string | null) {
+    const receiver = await fixture("receiver");
+    const sourceUnchanged = preserveAuthored(source);
+    const receiverUnchanged = preserveAuthored(receiver);
+    const { app, observation } = forwardingApp(receiver, true);
+    const { factory, calls } = recoveredClient(app, receiver, false, readHealth);
+    const home = path.join(scratch, "cli-home");
+    fs.mkdirSync(home);
+    fs.writeFileSync(path.join(home, "hosts.yaml"), "hosts:\n  - id: remote-fixture\n    transport: http\n    url: http://remote-fixture.invalid:39001\n");
+    vi.stubEnv("OPENRIG_HOME", home);
+    const senderReads = observeSenderScopeReads();
+    setSelfHostId(source.hostId);
+    await create(app, ["--host", "remote-fixture", "--mission", "release", "--slice", "SLICE.ONE", "--tags", "project:alpha"], true,
+      "qitem-create-contract", factory);
+    committed(receiver, "qitem-create-contract", ["mission:release", "slice:SLICE.ONE", "project:alpha", "cross-host", "from-host:" + os.hostname()]);
+    expect(source.daemon.deps.queueRepo.getById("qitem-create-contract")).toBeNull();
+    expect(receiver.daemon.deps.queueRepo.getById("qitem-create-contract")?.sourceSession).toBe("writer@scope@" + source.hostId);
+    expect(calls.posts).toEqual(["/api/queue/create"]);
+    expect(calls.postStatuses).toEqual([502]);
+    expect(observation.forwards).toBe(1);
+    expect(observation.committedStatuses).toEqual([201]);
+    expect(calls.readbacks).toEqual([{ base: "http://remote-fixture.invalid:39001", url: "/api/queue/qitem-create-contract" }]);
+    expect(stderr.join("\n")).toContain("committed after all: row qitem-create-contract on host 'remote-fixture'");
+    expect(senderReads).toEqual([]);
+    sourceUnchanged();
+    receiverUnchanged();
+    expect.soft(scopeLines()).toMatch(/\bskipped\b/i);
+    expect.soft(scopeLines()).toContain("mission:release");
+    expect.soft(scopeLines()).toContain("slice:SLICE.ONE");
+    expect.soft(scopeLines()).not.toMatch(/unavailable|unresolved|resolves to 0/i);
+  }
+
+  it("reconciles a forwarded indeterminate commit with SKIPPED and destination provenance", async () => {
+    await recoverForwardedCommit();
+  });
+
+  it.each(["null", "unreadable"] as const)(
+    "keeps confirmed remote recovery SKIPPED when later health is %s", async later => {
+      await recoverForwardedCommit(healthAfterMatchedRecovery(later));
+    },
+  );
+
+  it.each([
+    { level: "mission", tags: ["mission:release", "mission:MISSION.ONE", "slice:SLICE.ONE", "project:alpha"] },
+    { level: "slice", tags: ["mission:release", "slice:SLICE.ONE", "slice:build", "project:alpha"] },
+  ])("reports distinct $level inputs as a conflict, not a directory count", async row => {
+    const unchanged = preserveAuthored(source);
+    const old = deriveCurrentWork([{ qitemId: "input-conflict", state: "in-progress", tags: row.tags }], source.missions);
+    expect(old.currentWork).toBeNull();
+    expect(old.currentWorkBasis).toContain("conflicting typed tags:");
+    expect(old.currentWorkBasis).toContain("2 distinct " + row.level + " tags");
+    await create(source.app, ["--tags", row.tags.join(",")], true);
+    committed(source, "qitem-create-contract", row.tags);
+    unchanged();
+    expect.soft(scopeLines()).toMatch(/\bconflict(?:ing)?\b/i);
+    expect.soft(scopeLines()).toContain(row.level + ":");
+    expect.soft(scopeLines()).not.toMatch(/resolves to \d+ directories/i);
+  });
+
+  it.each(["mission", "slice"] as const)("retains a visible %s conflict when long values share a display prefix", async level => {
+    const common = ("ordinary_" + level + "_").padEnd(220, "x");
+    const first = level + ":" + common + "A";
+    const second = level + ":" + common + "B";
+    const tags = level === "mission"
+      ? [first, second, "project:alpha"] : ["mission:release", first, second, "project:alpha"];
+    const unchanged = preserveAuthored(source);
+    await create(source.app, ["--tags", tags.join(",")], true);
+    committed(source, "qitem-create-contract", tags);
+    unchanged();
+    const advisories = createResponses[0]?.data.advisories as Array<{ code?: unknown; message?: unknown }> | undefined;
+    expect(advisories).toHaveLength(1);
+    expect(advisories?.[0]).toMatchObject({ code: "conflicting_scope", message: expect.any(String) });
+    const message = advisories?.[0]?.message as string;
+    expect(message).toContain(first);
+    expect(message).toContain(second);
+    expect.soft(scopeLines()).toMatch(/\bconflict(?:ing)?\b/i);
+    expect.soft(scopeLines()).toContain(level + ":");
+    expect.soft(scopeLines()).toContain(first);
+    expect.soft(scopeLines()).toContain(second);
+    expect.soft(scopeLines()).not.toMatch(/resolves to \d+ directories/i);
+  });
+
+  it.each([
+    { level: "mission", code: "EACCES", wanted: "DUP.MISSION" },
+    { level: "slice", code: "EIO", wanted: "DUP.SLICE" },
+  ])("reports unavailable for two $level matches plus unreadable extra SPEC ($code)", async row => {
+    const lookup = row.level === "mission" ? source.missions : path.join(source.missions, "release", "slices");
+    for (const child of ["duplicate-a", "duplicate-b"]) {
+      expect(fs.statSync(path.join(lookup, child)).isDirectory()).toBe(true);
+      expect(fs.readFileSync(path.join(lookup, child, "SPEC.md"), "utf8")).toContain("id: " + row.wanted);
+    }
+    const extra = path.join(lookup, "unreadable-extra");
+    spec(extra, "EXTRA");
+    const file = path.join(extra, "SPEC.md");
+    expect(fs.statSync(file).isFile()).toBe(true);
+    const unchanged = preserveAuthored(source);
+    const read = fs.readFileSync.bind(fs);
+    let faults = 0;
+    vi.spyOn(fs, "readFileSync").mockImplementation(((...args: unknown[]) => {
+      if (String(args[0]) === file) {
+        faults++;
+        throw Object.assign(new Error("fixture extra SPEC read failed"), { code: row.code });
+      }
+      return (read as (...input: unknown[]) => unknown)(...args);
+    }) as typeof fs.readFileSync);
+    const args = row.level === "mission" ? ["--mission", row.wanted] : ["--mission", "release", "--slice", row.wanted];
+    const tags = row.level === "mission"
+      ? ["mission:DUP.MISSION", "project:alpha"] : ["mission:release", "slice:DUP.SLICE", "project:alpha"];
+    await create(source.app, [...args, "--tags", "project:alpha"], true);
+    committed(source, "qitem-create-contract", tags);
+    expect(faults).toBeGreaterThan(0);
+    unchanged();
+    expect.soft(scopeLines()).toContain(row.level + ":" + row.wanted);
+    expect.soft(scopeLines()).toMatch(/\bunavailable\b/i);
+    expect.soft(scopeLines()).not.toMatch(/resolves to \d+ directories/i);
+  });
+
+  it.each([false, true])("keeps valid project scope successful with unchanged JSON (json=%s)", async json => {
+    await create(source.app, ["--mission", "release", "--slice", "SLICE.ONE", "--tags", "project:alpha"], json);
+    committed(source, "qitem-create-contract", ["mission:release", "slice:SLICE.ONE", "project:alpha"]);
+    expect(scopeLines()).not.toMatch(/unresolved|ambiguous|unavailable|could not|skipped/i);
+  });
+
+  it.each([false, true])("keeps untagged create unchanged (json=%s)", async json => {
+    await create(source.app, [], json);
+    committed(source, "qitem-create-contract", null);
+    expect(scopeLines()).toBe("");
+  });
+
+  it.each([
+    { label: "missing mission", mission: "missing-mission", slice: "SLICE.ONE", tag: "mission:missing-mission", kind: /unresolved|not found|does not (?:exist|resolve)|resolves to 0|cannot.*uniquely/i },
+    { label: "ambiguous mission", mission: "DUP.MISSION", slice: "SLICE.ONE", tag: "mission:DUP.MISSION", kind: /ambiguous|more than one|resolves to 2|not.*uniquely|cannot.*uniquely/i },
+    { label: "missing slice", mission: "release", slice: "MISSING.SLICE", tag: "slice:MISSING.SLICE", kind: /unresolved|not found|does not (?:exist|resolve)|resolves to 0|cannot.*uniquely/i },
+    { label: "ambiguous slice", mission: "release", slice: "DUP.SLICE", tag: "slice:DUP.SLICE", kind: /ambiguous|more than one|resolves to 2|not.*uniquely|cannot.*uniquely/i },
+    { label: "completed empty-directory check", mission: "missing-mission", slice: "SLICE.ONE", tag: "mission:missing-mission", kind: /unresolved|not found|does not (?:exist|resolve)|resolves to 0|cannot.*uniquely/i },
+  ])("commits $label and reports checked nonunique scope only on stderr", async row => {
+    if (row.label === "completed empty-directory check") {
+      fs.rmSync(source.missions, { recursive: true });
+      fs.mkdirSync(source.missions);
+    }
+    await create(source.app, ["--mission", row.mission, "--slice", row.slice, "--tags", "project:alpha"], true);
+    committed(source, "qitem-create-contract", [`mission:${row.mission}`, `slice:${row.slice}`, "project:alpha"]);
+    expect(scopeLines()).toContain(row.tag);
+    expect(scopeLines()).toMatch(row.kind);
+    expect(scopeLines()).not.toMatch(/unavailable|could not (?:run|check)|skipped/i);
+  });
+
+  it.each(["non-directory missions root", "invalid catalogue"])(
+    "commits when the check cannot run: %s, without calling it checked unresolved", async cause => {
+      if (cause === "non-directory missions root") {
+        fs.rmSync(source.missions, { recursive: true });
+        fs.writeFileSync(source.missions, "not a directory");
+      } else {
+        fs.writeFileSync(path.join(source.root, "workspace.yaml"), "projects: invalid\n");
+      }
+      await create(source.app, ["--mission", "release", "--slice", "SLICE.ONE", "--tags", "project:alpha"], true);
+      committed(source, "qitem-create-contract", ["mission:release", "slice:SLICE.ONE", "project:alpha"]);
+      expect(scopeLines()).toMatch(/unavailable|could not (?:run|check)|unable to (?:run|check)/i);
+      expect(scopeLines()).not.toMatch(/resolves to 0|not found|checked.*unresolved/i);
+    },
+  );
+
+  const longScopeTags = () => [
+    ...Array.from({ length: 7 }, (_, i) => "mission:" + ("ordinary_mission_" + i + "_").padEnd(150, "x")),
+    ...Array.from({ length: 2 }, (_, i) => "slice:" + ("ordinary_slice_" + i + "_").padEnd(150, "x")),
+  ];
+
+  it.each([
+    { level: "mission", code: "EACCES", mission: "MISSION.ONE", slice: "SLICE.ONE" },
+    { level: "slice", code: "EIO", mission: "release", slice: "SLICE.ONE" },
+  ])("reports unavailable when existing $level SPEC lookup fails with $code", async row => {
+    const file = row.level === "mission"
+      ? path.join(source.missions, "release", "SPEC.md")
+      : path.join(source.missions, "release", "slices", "build", "SPEC.md");
+    expect(fs.statSync(file).isFile()).toBe(true);
+    const read = fs.readFileSync.bind(fs);
+    let faults = 0;
+    vi.spyOn(fs, "readFileSync").mockImplementation(((...args: unknown[]) => {
+      if (String(args[0]) === file) {
+        faults++;
+        throw Object.assign(new Error("fixture SPEC read failed"), { code: row.code });
+      }
+      return (read as (...input: unknown[]) => unknown)(...args);
+    }) as typeof fs.readFileSync);
+    await create(source.app, ["--mission", row.mission, "--slice", row.slice, "--tags", "project:alpha"], true);
+    committed(source, "qitem-create-contract", [`mission:${row.mission}`, `slice:${row.slice}`, "project:alpha"]);
+    expect(faults).toBeGreaterThan(0);
+    expect(scopeLines()).toMatch(/unavailable|could not (?:run|check)|unable to (?:run|check)/i);
+    expect(scopeLines()).not.toMatch(/resolves to 0|checked.*unresolved/i);
+  });
+
+  it("keeps absent unrelated metadata distinct from an unreadable existing SPEC", async () => {
+    fs.unlinkSync(path.join(source.missions, "duplicate-a", "SPEC.md"));
+    await create(source.app, ["--mission", "MISSION.ONE", "--slice", "SLICE.ONE", "--tags", "project:alpha"], true);
+    committed(source, "qitem-create-contract", ["mission:MISSION.ONE", "slice:SLICE.ONE", "project:alpha"]);
+    expect(scopeLines()).toBe("");
+  });
+
+  it("keeps the unavailable notice for ordinary long scope tags without changing the committed result", async () => {
+    fs.writeFileSync(path.join(source.root, "workspace.yaml"), "projects: invalid\n");
+    const tags = ["project:alpha", ...longScopeTags()];
+    await create(source.app, ["--tags", tags.join(",")], true);
+    committed(source, "qitem-create-contract", tags);
+    expect(JSON.stringify(tags).length).toBeGreaterThan(1024);
+    const advisories = createResponses[0]?.data.advisories as Array<{ code?: unknown; message?: unknown }> | undefined;
+    expect(advisories).toEqual([expect.objectContaining({ code: "scope_check_unavailable", message: expect.any(String) })]);
+    const message = advisories?.[0]?.message as string;
+    for (const tag of tags.slice(1)) expect(message).toContain(tag);
+    expect(scopeLines()).toMatch(/unavailable|could not (?:run|check)|unable to (?:run|check)/i);
+    expect(scopeLines()).not.toMatch(/resolves to 0|checked.*unresolved/i);
+  });
+
+  it.each(["valid", "missing", "long tags"])("remote create is SKIPPED even when sender scope is %s", async senderState => {
+    const receiver = await fixture("receiver");
+    fs.rmSync(receiver.missions, { recursive: true });
+    fs.mkdirSync(receiver.missions);
+    if (senderState === "missing") {
+      fs.rmSync(source.missions, { recursive: true });
+      fs.mkdirSync(source.missions);
+      spec(path.join(receiver.missions, "release"), "MISSION.ONE");
+      spec(path.join(receiver.missions, "release", "slices", "build"), "SLICE.ONE");
+    }
+    const senderReads: string[] = [];
+    for (const method of ["readdirSync", "readFileSync", "statSync", "existsSync"] as const) {
+      const original = fs[method].bind(fs) as (...args: unknown[]) => unknown;
+      vi.spyOn(fs, method).mockImplementation(((...args: unknown[]) => {
+        if (String(args[0]) === path.join(source.root, "workspace.yaml")
+          || String(args[0]) === source.missions || String(args[0]).startsWith(source.missions + path.sep)) {
+          senderReads.push(method + ":" + String(args[0]));
+        }
+        return original(...args);
+      }) as never);
+    }
+    let forwarded = 0;
+    const app = new Hono();
+    app.use("*", async (c, next) => {
+      const set = c.set.bind(c) as (key: string, value: unknown) => void;
+      for (const key of ["eventBus", "queueRepo", "inboxHandler", "outboxHandler", "rigRepo"] as const) set(key, source.daemon.deps[key]);
+      set("settingsStore", new SettingsStore(path.join(source.root, "settings.json")));
+      set("hostRegistryLoader", () => ({ ok: true, registry: { hosts: [
+        { id: "remote-fixture", transport: "http", url: "http://remote-fixture.invalid:39001" },
+      ] } }));
+      set("remoteFetchImpl", async (_url: unknown, init: RequestInit) => {
+        forwarded++;
+        const body = JSON.parse(String(init.body));
+        const previous = getSelfHostId();
+        setSelfHostId(receiver.hostId);
+        try {
+          return await receiver.app.request("/api/queue/create", { ...init,
+            headers: { "Content-Type": "application/json", "X-OpenRig-Session": body.sourceSession } });
+        } finally { setSelfHostId(previous); }
+      });
+      await next();
+    });
+    app.route("/api/queue", queueRoutes());
+    setSelfHostId(source.hostId);
+    const extraTags = senderState === "long tags" ? longScopeTags() : [];
+    await create(app, ["--host", "remote-fixture", "--mission", "release", "--slice", "SLICE.ONE", "--tags", ["project:alpha", ...extraTags].join(",")], true);
+    expect(forwarded).toBe(1);
+    expect(source.daemon.deps.queueRepo.getById("qitem-create-contract")).toBeNull();
+    const stored = receiver.daemon.deps.queueRepo.getById("qitem-create-contract");
+    expect(stored).toMatchObject({ destinationSession: "worker@scope", body: "scope contract body", state: "pending" });
+    expect(stored?.sourceSession).toBe(`writer@scope@${source.hostId}`);
+    expect(stored?.tags).toEqual(expect.arrayContaining(["mission:release", "slice:SLICE.ONE", "project:alpha"]));
+    expect(process.exitCode ?? 0).toBe(0);
+    expect(stdout).toHaveLength(1);
+    const output = JSON.parse(stdout[0]!) as Record<string, unknown>;
+    const { advisories: _advisories, ...primary } = output;
+    expect(primary).toEqual(JSON.parse(JSON.stringify(stored)));
+    expect(output).toEqual(createResponses[0]?.data);
+    expect(senderReads).toEqual([]);
+    if (senderState === "long tags") {
+      expect(stored?.tags).toEqual(["mission:release", "slice:SLICE.ONE", "project:alpha", ...extraTags, "cross-host", `from-host:${os.hostname()}`]);
+      expect(JSON.stringify(extraTags).length).toBeGreaterThan(1024);
+    }
+    const advisories = createResponses[0]?.data.advisories as Array<{ code?: unknown; message?: unknown }> | undefined;
+    expect(advisories).toEqual([expect.objectContaining({ code: "scope_check_skipped", message: expect.any(String) })]);
+    const message = advisories?.[0]?.message as string;
+    expect(message).toContain("mission:release");
+    expect(message).toContain("slice:SLICE.ONE");
+    if (senderState === "long tags") for (const tag of extraTags) expect(message).toContain(tag);
+    expect(scopeLines()).toMatch(/\bskipped\b/i);
+    expect(scopeLines()).not.toMatch(/unresolved|ambiguous|unavailable/i);
+  });
+});

packages/cli/test/queue-erase.test.ts

@@ -0,0 +1,116 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import type { QueueDeps } from "../src/commands/queue.js";
+import { createProgram } from "../src/index.js";
+
+// `rig queue erase`: the file it reads, the request it sends, and what it refuses before sending anything.
+vi.mock("../src/daemon-lifecycle.js", async () => {
+  const actual = await vi.importActual<Record<string, unknown>>("../src/daemon-lifecycle.js");
+  return {
+    ...actual,
+    getDaemonStatus: vi.fn(async () => ({ state: "running", healthy: true, pid: 1234, port: 7433 })),
+    getDaemonUrl: vi.fn(() => "http://localhost:7433"),
+  };
+});
+
+function makeDeps(response: { status: number; data: unknown } = { status: 200, data: { ok: true } }) {
+  const posts: Array<{ path: string; body: unknown }> = [];
+  const deps = {
+    lifecycleDeps: {} as QueueDeps["lifecycleDeps"],
+    clientFactory: () => ({
+      post: vi.fn(async (urlPath: string, body: unknown) => {
+        posts.push({ path: urlPath, body });
+        return response;
+      }),
+    }) as unknown as ReturnType<QueueDeps["clientFactory"]>,
+  } as QueueDeps;
+  return { deps, posts };
+}
+
+describe("rig queue erase", () => {
+  let dir: string;
+  let errors: string[];
+  beforeEach(() => {
+    vi.unstubAllEnvs();
+    vi.stubEnv("OPENRIG_SESSION_NAME", "ops-admin@n-ops");
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "queue-erase-"));
+    errors = [];
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    vi.spyOn(console, "error").mockImplementation((...args) => errors.push(args.join(" ")));
+    process.exitCode = undefined;
+  });
+  const run = (deps: QueueDeps, ...args: string[]) => createProgram({ queueDeps: deps }).parseAsync(["node", "rig", "queue", "erase", ...args]);
+
+  it("reads a members file (one per line, comments skipped) and sends a dry run unless --apply", async () => {
+    const file = path.join(dir, "members.txt");
+    fs.writeFileSync(file, "# account n-acct\na-one@n-acct\n\n  b-two@n-acct  \n");
+    const { deps, posts } = makeDeps();
+    await run(deps, "--members", file);
+    await run(deps, "--members", file, "--apply");
+    expect(posts).toEqual([
+      { path: "/api/queue/erase", body: { apply: false, members: ["a-one@n-acct", "b-two@n-acct"] } },
+      { path: "/api/queue/erase", body: { apply: true, members: ["a-one@n-acct", "b-two@n-acct"] } },
+    ]);
+  });
+
+  it("reads ids as a JSON array and passes the action", async () => {
+    const file = path.join(dir, "ids.json");
+    fs.writeFileSync(file, JSON.stringify(["qitem-1", "qitem-2"]));
+    const { deps, posts } = makeDeps();
+    await run(deps, "--ids", file, "--action", "scrub", "--apply");
+    expect(posts).toEqual([{ path: "/api/queue/erase", body: { apply: true, ids: ["qitem-1", "qitem-2"], action: "scrub" } }]);
+  });
+
+  it("passes the account rig with the members, and a ledger of report entries as given", async () => {
+    const members = path.join(dir, "members.json");
+    fs.writeFileSync(members, JSON.stringify(["a-one@n-acct"]));
+    const ledger = path.join(dir, "ledger.json");
+    const entries = [{ qitemId: "qitem-1", action: "scrub", state: "done" }, "qitem-2"];
+    fs.writeFileSync(ledger, JSON.stringify(entries));
+    const { deps, posts } = makeDeps();
+    await run(deps, "--members", members, "--rig", "rig-acct-id", "--apply");
+    await run(deps, "--ids", ledger, "--apply");
+    expect(posts).toEqual([
+      { path: "/api/queue/erase", body: { apply: true, members: ["a-one@n-acct"], rig: "rig-acct-id" } },
+      { path: "/api/queue/erase", body: { apply: true, ids: entries } },
+    ]);
+  });
+
+  it("reads an erasure ledger's JSON lines as given: entries that keep their action and batch, and commit lines", async () => {
+    const ledger = path.join(dir, "ledger.jsonl");
+    fs.writeFileSync(ledger, '{"qitemId":"qitem-1","action":"scrub","reason":"retention-content","erasedAt":"t","batch":"b1"}\n{"batch":"b1","committed":true,"at":"t"}\n# a comment\n{"qitemId":"qitem-2","action":"delete"}\n');
+    const { deps, posts } = makeDeps();
+    await run(deps, "--ids", ledger, "--apply");
+    expect(posts).toEqual([{ path: "/api/queue/erase", body: { apply: true, ids: [
+      { qitemId: "qitem-1", action: "scrub", reason: "retention-content", erasedAt: "t", batch: "b1" }, { batch: "b1", committed: true, at: "t" },
+      { qitemId: "qitem-2", action: "delete" },
+    ] } }]);
+    fs.writeFileSync(ledger, '{"qitemId": broken\n');
+    process.exitCode = undefined;
+    await run(deps, "--ids", ledger, "--apply");
+    expect(process.exitCode).toBe(1);
+    expect(posts).toHaveLength(1);
+  });
+
+  it("sends nothing when its file can't be read, or when there's no one to record as erasing", async () => {
+    const { deps, posts } = makeDeps();
+    await run(deps, "--members", path.join(dir, "missing.txt"));
+    expect(process.exitCode).toBe(1);
+    vi.stubEnv("OPENRIG_SESSION_NAME", "");
+    process.exitCode = undefined;
+    await run(deps, "--routine");
+    expect(process.exitCode).toBe(1);
+    expect(posts).toEqual([]);
+    expect(errors.join("\n")).toMatch(/Nothing was erased/);
+    await run(deps, "--routine", "--actor", "erase-runner@n-ops");
+    expect(posts).toEqual([{ path: "/api/queue/erase", body: { apply: false, routine: true, actorSession: "erase-runner@n-ops" } }]);
+  });
+
+  it("a daemon refusal exits nonzero", async () => {
+    const { deps } = makeDeps({ status: 400, data: { error: "erase_scope_required", message: "Name one scope" } });
+    await run(deps);
+    expect(process.exitCode).toBe(1);
+  });
+});

packages/cli/test/queue-update-external-source.test.ts

@@ -0,0 +1,215 @@
+// #2866 — `rig queue update --source <name>@external`: a routine running outside any managed seat can append a
+// NOTE as itself, recorded as an external actor (claimed:v1), never as a seat. A REAL `queueCommand` invocation
+// talks over LOOPBACK HTTP to the real queueRoutes + QueueRepository on a fully migrated test DB, so the recorded
+// transition (actor + provenance) is read back from the store, not from a stubbed response.
+import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach, vi } from "vitest";
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+import type Database from "better-sqlite3";
+import { createDb } from "../../daemon/src/db/connection.js";
+import { migrate } from "../../daemon/src/db/migrate.js";
+import { ALL_MIGRATIONS } from "../../daemon/src/db/all-migrations.js";
+import { EventBus } from "../../daemon/src/domain/event-bus.js";
+import { QueueRepository } from "../../daemon/src/domain/queue-repository.js";
+import { queueRoutes } from "../../daemon/src/routes/queue.js";
+import { DaemonClient } from "../src/client.js";
+import { queueCommand } from "../src/commands/queue.js";
+import { STATE_FILE } from "../src/daemon-lifecycle.js";
+
+let db: Database.Database;
+let repo: QueueRepository;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let server: any;
+let port = 0;
+const seenHeaders: Array<string | undefined> = [];
+const SELF_HOST_ID = "this-host";
+const REMOTE_URL = "http://127.0.0.1:9";
+const remoteCalls: string[] = [];
+
+// Same hermetic isolation as queue-update-metadata-reject-cli.test.ts: ambient OPENRIG_URL / RIGGED_URL /
+// OPENRIG_PORT win over the injected state file, so they are removed for the CLI-invocation window only.
+const AMBIENT_KEYS = ["OPENRIG_URL", "RIGGED_URL", "OPENRIG_PORT"] as const;
+const savedEnv: Record<string, string | undefined> = {};
+function neutralizeAmbient(): void { for (const k of AMBIENT_KEYS) { savedEnv[k] = process.env[k]; delete process.env[k]; } }
+function restoreAmbient(): void { for (const k of AMBIENT_KEYS) { if (savedEnv[k] === undefined) delete process.env[k]; else process.env[k] = savedEnv[k]; } }
+
+beforeAll(async () => {
+  db = createDb();
+  migrate(db, ALL_MIGRATIONS);
+  const bus = new EventBus(db);
+  repo = new QueueRepository(db, bus, { validateRig: () => true });
+  const app = new Hono();
+  app.use("*", async (c, next) => {
+    seenHeaders.push(c.req.header("x-openrig-session"));
+    c.set("eventBus" as never, bus); c.set("queueRepo" as never, repo); await next();
+  });
+  // The daemon's own host id, as /healthz reports it: a `--host` naming it resolves to this daemon (queueHostTarget).
+  app.get("/healthz", (c) => c.json({ ok: true, selfHostId: SELF_HOST_ID }));
+  app.route("/api/queue", queueRoutes());
+  await new Promise<void>((resolve) => { server = serve({ fetch: app.fetch, hostname: "127.0.0.1", port: 0 }, (info: { port: number }) => { port = info.port; resolve(); }); });
+});
+
+afterAll(async () => {
+  restoreAmbient();
+  if (server) await new Promise<void>((resolve) => server.close(() => resolve()));
+  db?.close();
+});
+
+function loopbackUrl(): string { return `http://127.0.0.1:${port}`; }
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function deps(): any {
+  return {
+    // One registered http host besides this daemon, so `--host other-host` resolves to a truly remote target.
+    hostRegistryLoader: () => ({ ok: true, registry: { hosts: [{ id: "other-host", transport: "http", url: REMOTE_URL }] } }),
+    lifecycleDeps: { spawn: () => ({ pid: 1, unref() {} }), fetch: async () => ({ ok: true }), kill: () => true, readFile: (p: string) => (p === STATE_FILE ? JSON.stringify({ pid: 1, port, host: "127.0.0.1", db: "x", startedAt: "x" }) : null), writeFile() {}, removeFile() {}, exists: (p: string) => p === STATE_FILE, mkdirp() {}, openForAppend: () => 3, isProcessAlive: () => true },
+    clientFactory: (url: string) => {
+      // The remote host's client is built but must never be called: every method records the call and fails.
+      if (url === REMOTE_URL) {
+        return new Proxy({}, { get: (_t, prop) => async () => { remoteCalls.push(String(prop)); throw new Error(`remote ${String(prop)} called`); } });
+      }
+      if (url !== loopbackUrl()) throw new Error(`test-isolation guard: clientFactory url '${url}' !== loopback '${loopbackUrl()}'`);
+      return new DaemonClient(url);
+    },
+  };
+}
+
+async function runCli(args: string[]): Promise<{ out: string; exit: number | undefined }> {
+  const out: string[] = [];
+  const ol = console.log, oe = console.error, ow = process.stderr.write;
+  console.log = (...a: unknown[]) => { out.push(a.join(" ")); };
+  console.error = (...a: unknown[]) => { out.push(a.join(" ")); };
+  process.stderr.write = ((chunk: string | Uint8Array) => { out.push(String(chunk)); return true; }) as typeof process.stderr.write;
+  process.exitCode = undefined;
+  neutralizeAmbient();
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  try { await queueCommand(deps() as any).parseAsync(["node", "rig", ...args]); }
+  finally { restoreAmbient(); console.log = ol; console.error = oe; process.stderr.write = ow; }
+  const exit = process.exitCode; process.exitCode = 0;
+  return { out: out.join("\n"), exit };
+}
+
+type TransitionRow = { actor_session: string; state: string; transition_note: string | null; identity_provenance: string | null };
+const transitions = (id: string) => db.prepare(
+  "SELECT actor_session, state, transition_note, identity_provenance FROM queue_transitions WHERE qitem_id = ? ORDER BY rowid",
+).all(id) as TransitionRow[];
+
+describe("#2866 rig queue update --source <name>@external (note only, external actor)", () => {
+  let id: string;
+  beforeEach(async () => {
+    // Outside any managed seat: neither seat env is set, so the CLI stamps no X-OpenRig-Session header.
+    vi.stubEnv("OPENRIG_SESSION_NAME", "");
+    vi.stubEnv("RIGGED_SESSION_NAME", "");
+    seenHeaders.length = 0;
+    remoteCalls.length = 0;
+    id = (await repo.create({ sourceSession: "orch@rig", destinationSession: "dev-x@rig", body: "work" })).qitemId;
+  });
+  afterEach(() => { vi.unstubAllEnvs(); });
+
+  it("records the note with the external routine as its actor (claimed:v1), never a seat, and leaves the state alone", async () => {
+    const before = repo.getByIdOrThrow(id);
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", "nudged the owner", "--json"]);
+    expect(exit, out).toBeFalsy();
+    const last = transitions(id).at(-1)!;
+    expect(last).toMatchObject({ actor_session: "routine-nightly@external", transition_note: "nudged the owner", identity_provenance: "claimed:v1" });
+    expect(last.state).toBe(before.state);
+    expect(repo.getByIdOrThrow(id).state).toBe(before.state);
+    // No seat identity was forged on the wire: the request carried no X-OpenRig-Session header.
+    expect(seenHeaders.length).toBeGreaterThan(0);
+    expect(seenHeaders.every((h) => h === undefined)).toBe(true);
+  });
+
+  it("without a seat and without --source, says notes need a seat and names --source; nothing is sent", async () => {
+    const beforeTxns = transitions(id).length;
+    const { out, exit } = await runCli(["update", id, "--note", "nudged the owner"]);
+    expect(exit).toBe(1);
+    expect(out.startsWith("notes need a seat; an external routine can pass --source <name>@external")).toBe(true);
+    expect(seenHeaders).toEqual([]);
+    expect(transitions(id).length).toBe(beforeTxns);
+  });
+
+  it("without a seat, a state change still needs one: refused before any request, and the error names --source for notes", async () => {
+    const before = repo.getByIdOrThrow(id);
+    const { out, exit } = await runCli(["update", id, "--state", "done", "--closure-reason", "no-follow-on"]);
+    expect(exit).toBe(1);
+    expect(out).toContain("OPENRIG_SESSION_NAME is not set, so there's no seat to act as");
+    expect(out).toContain("notes need a seat; an external routine can pass --source <name>@external");
+    // D#52: a person approving their own ask (a host pairing) is pointed at the TUI or Steering.
+    expect(out).toContain("A person answering an ask addressed to them (a host pairing approval, say) does it in the TUI (rig tui, then attention) or in Steering");
+    expect(seenHeaders).toEqual([]);
+    expect(repo.getByIdOrThrow(id)).toEqual(before);
+  });
+
+  it("a blank seat env is no seat: the --source note is recorded as the external routine, not dropped", async () => {
+    vi.stubEnv("OPENRIG_SESSION_NAME", "   ");
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", "blank env", "--json"]);
+    expect(exit, out).toBeFalsy();
+    expect(out).not.toContain("is ignored");
+    expect(transitions(id).at(-1)).toMatchObject({ actor_session: "routine-nightly@external", identity_provenance: "claimed:v1" });
+  });
+
+  it.each(["local", SELF_HOST_ID])("accepts --host %s, which resolves to this daemon: the note is recorded as the external routine", async (host) => {
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", `via --host ${host}`, "--host", host, "--json"]);
+    expect(exit, out).toBeFalsy();
+    expect(transitions(id).at(-1)).toMatchObject({ actor_session: "routine-nightly@external", transition_note: `via --host ${host}`, identity_provenance: "claimed:v1" });
+  });
+
+  it("refuses --source with a --host that resolves to another host (it would lose the routine's origin); nothing is written", async () => {
+    const beforeTxns = transitions(id).length;
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", "x", "--host", "other-host"]);
+    expect(exit).toBe(1);
+    expect(out).toContain("--source with --host other-host is not supported");
+    expect(out).toContain("Nothing was sent");
+    // Only the self-id probe reached this daemon; nothing was posted here or to the other host.
+    expect(remoteCalls).toEqual([]);
+    expect(transitions(id).length).toBe(beforeTxns);
+  });
+
+  it.each(["dev-x@rig", "routine-nightly", "routine@externalx", "human@kernel"])("refuses --source %s (not <name>@external); nothing is sent", async (source) => {
+    const beforeTxns = transitions(id).length;
+    const { out, exit } = await runCli(["update", id, "--source", source, "--note", "nudged the owner"]);
+    expect(exit).toBe(1);
+    expect(out).toContain("--source must be <name>@external");
+    expect(seenHeaders).toEqual([]);
+    expect(transitions(id).length).toBe(beforeTxns);
+  });
+
+  // Every flag of the update verb that writes more than a note, one case each (UPDATE_STATE_WRITE_FLAGS in queue.ts).
+  it.each([
+    ["--state", ["--state", "in-progress"]],
+    ["--reopen", ["--reopen"]],
+    ["--closure-reason", ["--closure-reason", "no-follow-on"]],
+    ["--closure-target", ["--closure-target", "next@rig"]],
+    ["--closure-required-at", ["--closure-required-at", "2030-01-01T00:00:00Z"]],
+    ["--resolution", ["--state", "done", "--closure-reason", "no-follow-on", "--resolution", "finished"]],
+    ["--blocked-on", ["--state", "blocked", "--blocked-on", "external:x"]],
+    ["--wake-watchdog", ["--wake-watchdog", "job-1"]],
+    ["--wake-after", ["--wake-after", "15m"]],
+    ["--summary", ["--summary", "new subject"]],
+    ["--evidence-ref", ["--evidence-ref", "/proof.md"]],
+  ] as const)("refuses --source with %s: it records a note only; nothing is sent", async (_label, extra) => {
+    const before = repo.getByIdOrThrow(id);
+    const beforeTxns = transitions(id).length;
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", "x", ...extra]);
+    expect(exit).toBe(1);
+    expect(out).toContain("--source records a note only");
+    expect(seenHeaders).toEqual([]);
+    expect(transitions(id).length).toBe(beforeTxns);
+    expect(repo.getByIdOrThrow(id)).toEqual(before);
+  });
+
+  it("refuses --source without --note; nothing is sent", async () => {
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external"]);
+    expect(exit).toBe(1);
+    expect(out).toContain("--source records a note only");
+    expect(seenHeaders).toEqual([]);
+  });
+
+  it("inside a managed seat the seat stays the actor (transport:v1); --source does not override it", async () => {
+    vi.stubEnv("OPENRIG_SESSION_NAME", "dev-x@rig");
+    const { out, exit } = await runCli(["update", id, "--source", "routine-nightly@external", "--note", "seat note", "--json"]);
+    expect(exit, out).toBeFalsy();
+    expect(transitions(id).at(-1)).toMatchObject({ actor_session: "dev-x@rig", transition_note: "seat note", identity_provenance: "transport:v1" });
+    expect(out).toContain("warning: --source routine-nightly@external is ignored: this runs in the seat dev-x@rig");
+  });
+});

packages/cli/test/scope-commands.test.ts

@@ -1367,6 +1367,29 @@ describe("--help is present on every command (HG-12)", () => {
   });
 });
 
+describe("slice and mission verb help names the parent --workspace option", () => {
+  const helpOf = (cmd: Command): string => {
+    let out = "";
+    cmd.configureOutput({ writeOut: (text) => { out += text; } });
+    cmd.outputHelp();
+    return out;
+  };
+
+  it("every slice and mission verb, and each tier, shows the rig scope --workspace route", () => {
+    const cmd = scopeCommand();
+    for (const tierName of ["slice", "mission"] as const) {
+      const tier = cmd.commands.find((c) => c.name() === tierName)!;
+      expect(helpOf(tier)).toContain(`rig scope --workspace <project root> ${tierName} <verb> ...`);
+      for (const verb of tier.commands) {
+        const help = helpOf(verb);
+        expect(help, `${tierName} ${verb.name()}`).toContain(`rig scope --workspace <project root> ${tierName} ${verb.name()} ...`);
+        expect(help, `${tierName} ${verb.name()}`).toContain("$(rig config get workspace.projects_root)/<project>");
+        expect(help, `${tierName} ${verb.name()}`).not.toContain("~/.openrig");
+      }
+    }
+  });
+});
+
 describe("rig scope audit ordinal naming", () => {
   let root: string;
   let mission: string;

packages/cli/test/scope-fs.test.ts

@@ -512,6 +512,36 @@ describe("findSlice + resolution variants", () => {
   it("3-part error when slice not found (HG-10)", () => {
     expect(() => findSlice(missionsRoot, "99-missing", "release-0.3.2")).toThrow(/not found/);
   });
+
+  it("O2: an absolute slice in another workspace's missions tree names the --workspace that selects it", () => {
+    const project = path.join(root, "projects", "alpha");
+    const slice = path.join(project, "missions", "m1", "slices", "01-x");
+    writeFile(path.join(project, "missions", "m1", "SPEC.md"), "---\nid: ALPHA.99.0.1\n---\nbody");
+    writeFile(path.join(slice, "SPEC.md"), "---\nid: ALPHA.99.0.1.1\n---\nbody");
+    let error: unknown;
+    try { findSlice(missionsRoot, slice); } catch (err) { error = err; }
+    expect(error).toBeInstanceOf(ScopeCliError);
+    expect((error as ScopeCliError).fact).toBe(`Slice path "${slice}" resolved to ${slice} but no parent mission was found.`);
+    expect((error as ScopeCliError).action).toBe(
+      `The slice is in another workspace's missions tree (${path.join(project, "missions")}), not under ${missionsRoot}. `
+      + `Select that tree with the parent --workspace option, for example: rig scope --workspace '${project}' slice <verb> '${slice}'`,
+    );
+    // The named option works: that workspace resolves the slice.
+    expect(findSlice(resolveMissionsRoot({ override: project, strictOverride: true }), slice).id).toBe("ALPHA.99.0.1.1");
+  });
+
+  it("O2: a slice outside any missions tree keeps the old advice and adds the --workspace route", () => {
+    const scratch = path.join(root, "07-target");
+    fs.mkdirSync(scratch);
+    expect(() => findSlice(missionsRoot, scratch)).toThrow(
+      "Ensure the slice lives under <missionsRoot>/<mission>/{slices,closed}/. For a slice in another workspace, such as a catalog project, "
+      + "select its tree with the parent option: rig scope --workspace <project root> slice <verb> <slice-path>",
+    );
+  });
+
+  it("O2: a mission not found names the --workspace route", () => {
+    expect(() => findMission(missionsRoot, "absent")).toThrow("rig scope --workspace <project root> mission <verb> <mission>");
+  });
 });
 
 describe("BC-2 BLOCK 2 — findMission rejects README-less directories", () => {

packages/cli/test/seat-attention.test.ts

@@ -0,0 +1,138 @@
+import { expect, it, vi } from "vitest";
+import { attentionLines, checkKernelAttention, checkSeatAttention } from "../src/seat-attention.js";
+
+type Reply = { status: number; data: unknown } | Error;
+function client(routes: Record<string, Reply>) {
+  const get = vi.fn(async (url: string) => {
+    const reply = routes[url];
+    if (reply instanceof Error) throw reply;
+    return reply ?? { status: 404, data: { error: "not found" } };
+  });
+  return { get, client: { get } as unknown as Parameters<typeof checkSeatAttention>[0] };
+}
+
+const LOGIN = "Startup requires attention: Login expired · Please run /login";
+const nodes = [
+  // A live question the daemon serves (needs-input), with its own reason.
+  { canonicalSessionName: "question@r", needsAttention: true, arbitratedNeedsInput: true, startupStatus: "ready", latestError: null,
+    activityState: { activity: "needs_input", display: "needs input", needsInput: { count: 1, reason: "selection_prompt" }, decidedBy: "pane" } },
+  // Broad attention that isn't a question: a ready seat started without required guidance.
+  { canonicalSessionName: "guidance@r", needsAttention: true, arbitratedNeedsInput: false, startupStatus: "ready", latestError: null,
+    startedWithoutRequired: ["/seat/AGENTS.md"] },
+  // A failed start: a readiness timeout, as a dialog the startup check doesn't recognise leaves it.
+  { canonicalSessionName: "failed@r", needsAttention: true, startupStatus: "failed",
+    latestError: "Readiness timeout after 30s — harness did not become interactive: unknown" },
+  // An expired sign-in at startup.
+  { canonicalSessionName: "login@r", needsAttention: true, startupStatus: "attention_required", latestError: LOGIN },
+  { canonicalSessionName: "fine@r", needsAttention: false, startupStatus: "ready", latestError: null },
+  // An older daemon that serves no attention evidence.
+  { canonicalSessionName: "old@r", startupStatus: "ready", latestError: null },
+];
+
+it("honours the daemon's needs-input precedence: a served 'no' beats a stale hook; the hook counts only without an answer", async () => {
+  const precedence = [
+    // Broad attention (missing guidance), the arbitrated answer is no question, and a stale needs_input hook remains.
+    { canonicalSessionName: "stale@r", needsAttention: true, arbitratedNeedsInput: false, startupStatus: "ready", latestError: null,
+      startedWithoutRequired: ["/seat/AGENTS.md"], agentActivity: { state: "needs_input", reason: "permission_prompt" } },
+    // The same stale hook as the only reason: its reason isn't revived either.
+    { canonicalSessionName: "staleonly@r", needsAttention: true, arbitratedNeedsInput: false, startupStatus: "ready", latestError: null,
+      agentActivity: { state: "needs_input", reason: "permission_prompt" } },
+    // No arbitrated answer: the hook decides, with its reason.
+    { canonicalSessionName: "hook@r", needsAttention: true, arbitratedNeedsInput: null, startupStatus: "ready", latestError: null,
+      agentActivity: { state: "needs_input", reason: "permission_prompt" } },
+  ];
+  const { client: c } = client({ "/api/ps": { status: 200, data: [{ rigId: "r1", rigName: "r" }] }, "/api/rigs/r1/nodes": { status: 200, data: [...nodes, ...precedence] } });
+  const check = await checkSeatAttention(c, ["stale@r", "staleonly@r", "hook@r", "question@r"]);
+  expect(check.attention).toEqual([
+    { seat: "question@r", reason: "selection_prompt", waitingOnPerson: true },
+    { seat: "stale@r", reason: "missing required AGENTS.md", waitingOnPerson: false },
+    { seat: "staleonly@r", reason: "reason unavailable", waitingOnPerson: false },
+    { seat: "hook@r", reason: "permission_prompt", waitingOnPerson: true },
+  ]);
+});
+
+it("labels only a served live question as waiting on a person; the broad flag reads 'needs attention' with its reason", async () => {
+  const { client: c } = client({ "/api/ps": { status: 200, data: [{ rigId: "r1", rigName: "r" }] }, "/api/rigs/r1/nodes": { status: 200, data: nodes } });
+  const check = await checkSeatAttention(c, ["question@r", "guidance@r", "failed@r", "login@r", "fine@r", "old@r"]);
+  expect(check.attention).toEqual([
+    { seat: "question@r", reason: "selection_prompt", waitingOnPerson: true },
+    { seat: "guidance@r", reason: "missing required AGENTS.md", waitingOnPerson: false },
+    { seat: "failed@r", reason: "Readiness timeout after 30s — harness did not become interactive: unknown", waitingOnPerson: false },
+    { seat: "login@r", reason: LOGIN, waitingOnPerson: false },
+  ]);
+  expect(check.unknown).toEqual([{ seat: "old@r", why: "the daemon served no attention evidence for it" }]);
+  expect(attentionLines(check, "tile")).toEqual([
+    "question@r is waiting on a person: selection_prompt. Answer it in its tile, or read it with: rig capture question@r",
+    "guidance@r needs attention: missing required AGENTS.md. Look at it in its tile with: rig capture guidance@r",
+    "failed@r needs attention: Readiness timeout after 30s — harness did not become interactive: unknown. Look at it in its tile with: rig capture failed@r",
+    `login@r needs attention: ${LOGIN}. Look at it in its tile with: rig capture login@r`,
+    "Couldn't check whether old@r needs attention: the daemon served no attention evidence for it.",
+  ]);
+});
+
+it("an unreadable rig list leaves every seat unknown, not unflagged", async () => {
+  const { client: c } = client({ "/api/ps": { status: 503, data: { error: "busy" } } });
+  const check = await checkSeatAttention(c, ["a@r", "b@r"]);
+  expect(check).toEqual({ attention: [], unknown: [
+    { seat: "a@r", why: "the rig list couldn't be read (HTTP 503: busy)" },
+    { seat: "b@r", why: "the rig list couldn't be read (HTTP 503: busy)" }] });
+  expect(attentionLines(check, "pane")).toEqual(["Couldn't check whether a@r, b@r need attention: the rig list couldn't be read (HTTP 503: busy)."]);
+});
+
+it("one rig's failed read keeps the other rig's answers and leaves only its own seats unknown", async () => {
+  const { client: c } = client({
+    "/api/ps": { status: 200, data: [{ rigId: "a1", rigName: "a" }, { rigId: "b1", rigName: "b" }] },
+    "/api/rigs/a1/nodes": { status: 200, data: [{ canonicalSessionName: "x@a", needsAttention: true, startupStatus: "attention_required", latestError: LOGIN }] },
+    "/api/rigs/b1/nodes": new Error("socket hang up"),
+  });
+  const check = await checkSeatAttention(c, ["x@a", "y@b"]);
+  expect(check.attention).toEqual([{ seat: "x@a", reason: LOGIN, waitingOnPerson: false }]);
+  expect(check.unknown).toEqual([{ seat: "y@b", why: "b's seats couldn't be read (socket hang up)" }]);
+});
+
+it("a seat that isn't in this daemon's inventory is unknown, never 'fine'", async () => {
+  const { client: c } = client({ "/api/ps": { status: 200, data: [{ rigId: "r1", rigName: "r" }] }, "/api/rigs/r1/nodes": { status: 200, data: [] } });
+  const check = await checkSeatAttention(c, ["gone@r", "x@elsewhere"]);
+  expect(check.unknown).toEqual([
+    { seat: "gone@r", why: "not in r's seats on this daemon" },
+    { seat: "x@elsewhere", why: "no rig named elsewhere on this daemon" }]);
+});
+
+it("an unreadable kernel status is reported, not read as no held seat", async () => {
+  const { client: c } = client({ "/api/kernel/status": { status: 503, data: { error: "kernel_boot_tracker_unavailable" } } });
+  expect(await checkKernelAttention(c)).toEqual({ attention: [],
+    unknown: [{ seat: "kernel", why: "the kernel status couldn't be read (HTTP 503: kernel_boot_tracker_unavailable)" }] });
+});
+
+it("keeps a long unknown list to one bounded line per reason", () => {
+  const unknown = ["a", "b", "c", "d", "e", "f", "g"].map(name => ({ seat: `${name}@r`, why: "down" }));
+  expect(attentionLines({ attention: [], unknown }, "pane"))
+    .toEqual(["Couldn't check whether a@r, b@r, c@r, d@r, e@r and 2 more need attention: down."]);
+});
+
+it("a seat waiting on a person names its question, not an older recorded error; the needs-attention order is unchanged", async () => {
+  const OLD = "Readiness timeout after 30s — harness did not become interactive: unknown";
+  const seats = [
+    // A live question, served by the arbitrated answer, on a seat that also carries an older startup error.
+    { canonicalSessionName: "asked@r", needsAttention: true, arbitratedNeedsInput: true, startupStatus: "failed", latestError: OLD,
+      activityState: { activity: "needs_input", display: "needs input", needsInput: { count: 1, reason: "permission_prompt" }, decidedBy: "hook" } },
+    // A live question from the hook alone (no arbitrated answer), with the same older error.
+    { canonicalSessionName: "hooked@r", needsAttention: true, arbitratedNeedsInput: null, startupStatus: "failed", latestError: OLD,
+      agentActivity: { state: "needs_input", reason: "elicitation_dialog" } },
+    // A live question whose reason isn't served: never the older error.
+    { canonicalSessionName: "unsaid@r", needsAttention: true, arbitratedNeedsInput: true, startupStatus: "failed", latestError: OLD,
+      activityState: { activity: "needs_input", display: "needs input", needsInput: { count: 1, reason: null }, decidedBy: "hook" } },
+    // No question: the recorded error still leads.
+    { canonicalSessionName: "broad@r", needsAttention: true, arbitratedNeedsInput: false, startupStatus: "failed", latestError: OLD,
+      agentActivity: { state: "needs_input", reason: "permission_prompt" } },
+  ];
+  const { client: c } = client({ "/api/ps": { status: 200, data: [{ rigId: "r1", rigName: "r" }] }, "/api/rigs/r1/nodes": { status: 200, data: seats } });
+  const check = await checkSeatAttention(c, ["asked@r", "hooked@r", "unsaid@r", "broad@r"]);
+  expect(check.attention).toEqual([
+    { seat: "asked@r", reason: "permission_prompt", waitingOnPerson: true },
+    { seat: "hooked@r", reason: "elicitation_dialog", waitingOnPerson: true },
+    { seat: "unsaid@r", reason: "reason unavailable", waitingOnPerson: true },
+    { seat: "broad@r", reason: OLD, waitingOnPerson: false },
+  ]);
+  expect(attentionLines(check, "tile")[0]).toBe("asked@r is waiting on a person: permission_prompt. Answer it in its tile, or read it with: rig capture asked@r");
+});

packages/cli/test/seat-set-runtime.test.ts

@@ -67,6 +67,13 @@ const plan = {
 describe("rig seat set-runtime", () => {
   afterEach(() => vi.restoreAllMocks());
 
+  it("passes a Pi target and its selected account through the existing dry-run workflow", async () => {
+    const { calls, exitCode } = await run({ status: 200, data: { ...plan, to: "pi", accountHome: "/accounts/pi" } },
+      ["dev.impl@my-rig", "--runtime", "pi", "--account-home", "/accounts/pi", "--reason", "Change runtime", "--dry-run"]);
+    expect(calls[0]!.body).toMatchObject({ runtime: "pi", accountHome: "/accounts/pi", reason: "Change runtime", dryRun: true });
+    expect(exitCode).toBeFalsy();
+  });
+
   it("an older daemon cannot silently ignore the chosen home and execute a switch", async () => {
     const { calls, exitCode } = await run({ status: 200, data: plan }, ["dev.impl@my-rig", "--runtime", "claude-code",
       "--account-home", "/accounts/claude-api", "--reason", "Plan limit", "--json"]);

packages/cli/test/seat.test.ts

@@ -788,6 +788,24 @@ describe("rig seat status", () => {
     else expect(logs.join("\n")).toContain(`Codex rebuild permissions: unverified. ${permissions.detail}`);
   });
 
+  it.each([[false, "chosen-model"], [false, null], [true, "chosen-model"], [true, null]] as const)(
+    "reports rebuild model selection without a native comparison (json=%s, model=%s)", async (json, requested) => {
+      const model = { requested, predecessorCompared: false };
+      const response = { ...HANDOVER_RESULT, source: { mode: "rebuild", raw: "rebuild" },
+        sourceOutcome: { mode: "rebuild", primedArtifacts: [], gaps: [], model } };
+      const { logs, exitCode } = await captureLogs(async () => {
+        await makeCommand(makeDeps({ status: 200, data: response }, [])).parseAsync(["node", "rig", "seat", "handover", "dev-impl@seat-rig",
+          "--source", "rebuild", "--reason", "context wall", ...(json ? ["--json"] : [])]);
+      });
+      expect(exitCode).toBeUndefined();
+      if (json) expect(JSON.parse(logs.join("\n")).sourceOutcome.model).toEqual(model);
+      else {
+        expect(logs.join("\n")).toContain("Rebuild starts a new conversation; durable artifacts carry its context, not a native resume.");
+        expect(logs.join("\n")).toContain(requested ? `Codex rebuild model: requested ${requested}` : "Codex rebuild model: runtime configuration/default");
+        expect(logs.join("\n")).toContain("The predecessor's in-pane model was not compared or carried.");
+      }
+    });
+
   it("handover non-dry-run human output avoids continuity claims (discovered, no context delivery)", async () => {
     const deps = makeDeps({ status: 200, data: HANDOVER_RESULT }, []);
 

packages/cli/test/send-header.test.ts

@@ -144,6 +144,22 @@ describe("wrapSendBody — pre-release CLI/daemon Item 2 (email-style envelope)"
     expect(out).toContain("Sent: 08-06 17:42Z · gen a1b2c3d4");
   });
 
+  // ── #2895 (a): a sender that `rig send` can't reach gets no `rig send` reply line ──
+  // MIRROR of packages/daemon/test/pane-envelope.test.ts against wrapPaneEnvelope (byte-identity contract).
+  it("#2895 (a): senderReachable false replaces the rig send line with a plain note; absent or true keeps it", () => {
+    const meta = { stampISO: "2026-08-06T17:42:09Z" };
+    expect(wrapSendBody("planner@global", "b@r", "hi", { ...meta, senderReachable: false }))
+      .toBe("From: planner@global\nTo: b@r\nSent: 08-06 17:42Z\n---\nhi\n---\n↩ No reply by rig send: planner@global has no session.");
+    expect(wrapSendBody("a@r", "b@r", "hi", { ...meta, senderReachable: true })).toBe(wrapSendBody("a@r", "b@r", "hi", meta));
+    expect(wrapSendBody("a@r", "b@r", "hi", meta).split("\n").at(-1)).toBe('↩ Reply: rig send a@r "..."');
+  });
+
+  it("#2895 (a): senderReachable false leaves the external reply line alone", () => {
+    for (const sender of ["alex@external"]) {
+      expect(wrapSendBody(sender, "b@r", "hi", { senderReachable: false })).toBe(wrapSendBody(sender, "b@r", "hi"));
+    }
+  });
+
   it("(g) byte-exact full envelope with gen (cross-package parity anchor)", () => {
     const out = wrapSendBody("a@r", "b@r", "hi", { stampISO: "2026-08-06T17:42:09Z", genUuid: GEN });
     expect(out).toBe('From: a@r\nTo: b@r\nSent: 08-06 17:42Z · gen a1b2c3d4\n---\nhi\n---\n↩ Reply: rig send a@r "..."');

packages/cli/test/send.test.ts

@@ -402,6 +402,31 @@ describe("Send CLI", () => {
     expect(logs.join("\n")).not.toContain("typed, never submitted");
   });
 
+  it("fan-out text output keeps each recipient's own advisory, such as unreadable input", async () => {
+    const unreadable = "Input could not be read and was not cleared; this send may join or submit existing text.";
+    const client = {
+      post: async (path: string) => {
+        if (path === "/api/transport/broadcast") return { status: 200, data: {
+          total: 2, sent: 2, failed: 0, results: [
+            { sessionName: "worker@test", ok: true, existingInput: { classification: "unreadable", fullContentsVisible: false }, warning: unreadable },
+            { sessionName: "sibling@test", ok: true, existingInput: { classification: "unreadable", fullContentsVisible: false }, warning: `${unreadable} No trailing Enter.` },
+          ],
+        } };
+        throw new Error("unexpected request");
+      },
+    } as unknown as DaemonClient;
+    const { logs } = await captureLogs(async () => {
+      await makeCmd({ ...runningDeps(port), clientFactory: () => client }).parseAsync([
+        "node", "rig", "send", "--to", "worker@test,sibling@test", "1", "--dangerously-interact", "--reason", "fixture",
+      ]);
+    });
+    const output = logs.join("\n");
+    expect(output).toContain(`worker@test: Advisory: ${unreadable}`);
+    expect(output).toContain(`sibling@test: Advisory: ${unreadable} No trailing Enter.`);
+    expect(output).toContain("worker@test: Existing input: unreadable");
+    expect(output).toContain("2/2 delivered");
+  });
+
   it("reports a fan-out refusal as unconfirmed alongside a successful recipient", async () => {
     let submits = 0;
     const client = {

packages/cli/test/setup.test.ts

@@ -1111,7 +1111,8 @@ describe("rig setup: the router-line question", () => {
     expect(routerStep(result)).toMatchObject({ status: "skipped", message: expect.stringContaining("it isn't a yes"), fixHint: "rig setup --router-line yes, or rig setup --router-line no" });
     expect(result.routerLine).toMatchObject({ answer: "unasked", files: expect.stringContaining("AGENTS.md"), limit: expect.stringContaining("doesn't remove a line already written") });
     expect(result.routerLine.line).toContain("rig skill loadout --seat self");
-    expect(result.routerLine.ifNo).toContain("Nothing is written into these files");
+    expect(result.routerLine.ifNo).toContain("This line isn't written");
+    expect(result.routerLine.ifNo).toContain("names the `openrig-skills` router");
     expect(set).not.toHaveBeenCalled();
     expect(store.resolveWithSource("skills.router_line.enabled").source).toBe("default");
   });

packages/cli/test/skill-loadout-seat.test.ts

@@ -88,6 +88,37 @@ describe("rig skill loadout --seat", () => {
     expect(logs.some((l) => l.startsWith("router") || l.startsWith("bootstrap") || l.startsWith("agent") || l.startsWith("prompt"))).toBe(false);
   });
 
+  it("#2895 (b): a seat on a runtime without seat skills prints the daemon's note and exits 0, in text and in --json", async () => {
+    process.env["OPENRIG_SESSION_NAME"] = "dev-impl@team";
+    const note = "dev-impl@team is a pi-tui seat; seat skills are kept for Claude Code and Codex seats";
+    const unsupported = { seat: { sessionName: "dev-impl@team", runtime: "pi-tui" }, unsupported: true, note,
+      storage: null, skills: [], catalogDigest: null, occupant: null, delivery: null };
+    const { deps } = makeDeps({ status: 200, data: unsupported });
+    await skillCommand(deps).parseAsync(["node", "rig", "loadout", "--seat", "self"]);
+    expect(logs).toEqual([note]);
+    expect(errors).toEqual([]);
+    expect(process.exitCode).toBeUndefined();
+    logs.length = 0;
+    await skillCommand(deps).parseAsync(["node", "rig", "loadout", "--seat", "self", "--json"]);
+    expect(JSON.parse(logs.join("\n"))).toEqual(unsupported);
+    expect(process.exitCode).toBeUndefined();
+  });
+
+  it("#2895 (b): an unknown session and --apply on a runtime without seat skills still exit 1 with the daemon's error", async () => {
+    process.env["OPENRIG_SESSION_NAME"] = "nobody@nowhere";
+    const unknown = makeDeps({ status: 404, data: { error: "no OpenRig seat has the session nobody@nowhere" } });
+    await skillCommand(unknown.deps).parseAsync(["node", "rig", "loadout", "--seat", "self"]);
+    expect(errors).toEqual(["no OpenRig seat has the session nobody@nowhere"]);
+    expect(process.exitCode).toBe(1);
+    errors.length = 0; process.exitCode = undefined;
+    process.env["OPENRIG_SESSION_NAME"] = "dev-impl@team";
+    const refused = "dev-impl@team is a pi-tui seat; seat skills are kept for Claude Code and Codex seats";
+    const apply = makeDeps({ status: 200, data: {} }, { status: 404, data: { error: refused } });
+    await skillCommand(apply.deps).parseAsync(["node", "rig", "loadout", "--seat", "self", "--apply"]);
+    expect(errors).toEqual([refused]);
+    expect(process.exitCode).toBe(1);
+  });
+
   it("says plainly that a shell without a seat identity is not an OpenRig seat, and shows no one else's skills", async () => {
     delete process.env["OPENRIG_SESSION_NAME"];
     const { deps, client } = makeDeps({ status: 200, data: inspection });

packages/cli/test/slack-post-open-asks-cli.test.ts

@@ -34,6 +34,21 @@ describe("rig slack post-open-asks", () => {
     expect(logs.join("\n")).toMatch(/Run `rig slack post-open-asks` again later .* reuses each ask's decision rather than offering it again/);
   });
 
+  it("prints an ask that may already be in Slack as uncertain, with the no-receipt line, never as a transport failure", async () => {
+    const { d, logs } = deps({ status: 200, data: { ok: true, asks: [
+      { qitemId: "q-7", recipient: "alex@external", summary: "Approve?", outcome: "uncertain",
+        detail: "may already be in Slack (its reply couldn't be read); the gateway checks Slack for its marker before any resend when it next starts" },
+      { qitemId: "q-8", recipient: "alex@external", summary: "Ship?", outcome: "uncertain",
+        detail: "may already be in Slack (its reply couldn't be read); no resend is pending" },
+    ] } });
+    await run(d, ["post-open-asks"]);
+    expect(logs[0]).toBe("2 open ask(s): 2 uncertain");
+    expect(logs[1]).toBe("  uncertain: q-7 for alex@external: Approve? (may already be in Slack (its reply couldn't be read); the gateway checks Slack for its marker before any resend when it next starts)");
+    expect(logs[2]).toBe("  uncertain: q-8 for alex@external: Ship? (may already be in Slack (its reply couldn't be read); no resend is pending)");
+    expect(logs.join("\n")).toMatch(/Queued or uncertain asks have no Slack receipt yet/);
+    expect(logs.join("\n")).not.toMatch(/transport fail/i);
+  });
+
   it("says the daemon's reason and exits 1 when Slack isn't posting, and when the daemon can't be reached", async () => {
     for (const response of [
       { status: 409, data: { error: "slack_not_posting", message: "Slack isn't enabled on this machine, so no ask was shown. Run rig slack enable first, then this." } },

packages/cli/test/status.test.ts

@@ -49,10 +49,17 @@ function createDaemonServer(
   summaryData: unknown[],
   cmuxStatus: unknown,
   kernelStatus?: { code: number; body: unknown },
+  more: Record<string, unknown> = {},
 ) {
   const server = http.createServer((req, res) => {
     const url = new URL(req.url!, "http://localhost");
 
+    if (url.pathname in more) {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(more[url.pathname]));
+      return;
+    }
+
     if (url.pathname === "/api/rigs/summary") {
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify(summaryData));
@@ -252,6 +259,47 @@ describe("rig status", () => {
       }
     });
 
+    it("names a kernel seat that needs attention, and why, under a partial_ready kernel (D#52)", async () => {
+      const held = createDaemonServer([], { available: false }, {
+        code: 200,
+        body: { kernel_state: "partial_ready", agents: [
+          { session_name: "advisor-lead@kernel", runtime: "claude-code", startup_status: "attention_required" },
+          { session_name: "operator-agent@kernel", runtime: "claude-code", startup_status: "ready" },
+        ] },
+      }, {
+        "/api/ps": [{ rigId: "k1", rigName: "kernel" }],
+        "/api/rigs/k1/nodes": [
+          { canonicalSessionName: "advisor-lead@kernel", needsAttention: true, startupStatus: "attention_required",
+            latestError: "Startup requires attention: Login expired · Please run /login" },
+          { canonicalSessionName: "operator-agent@kernel", needsAttention: false, startupStatus: "ready", latestError: null },
+        ],
+      });
+      const heldPort = await held.listen();
+      try {
+        const deps = () => ({
+          lifecycleDeps: mockLifecycleDeps({
+            exists: vi.fn((p: string) => p === STATE_FILE),
+            readFile: vi.fn((p: string) => (p === STATE_FILE ? JSON.stringify(runningState(heldPort)) : null)),
+            fetch: vi.fn(async () => ({ ok: true })),
+          }),
+          clientFactory: (baseUrl: string) => new DaemonClient(baseUrl),
+        });
+        const human = new Command();
+        human.addCommand(statusCommand(deps()));
+        const output = (await captureLogs(() => human.parseAsync(["node", "rig", "status"]))).join("\n");
+        expect(output).toContain("Kernel: partial_ready");
+        expect(output).toContain("  advisor-lead@kernel needs attention: Startup requires attention: Login expired · Please run /login. Look at it with: rig capture advisor-lead@kernel");
+        expect(output).not.toContain("operator-agent@kernel needs attention");
+        const json = new Command();
+        json.addCommand(statusCommand(deps()));
+        const parsed = JSON.parse((await captureLogs(() => json.parseAsync(["node", "rig", "status", "--json"]))).join("\n"));
+        expect(parsed.kernel.attention).toEqual({ unknown: [], attention: [
+          { seat: "advisor-lead@kernel", reason: "Startup requires attention: Login expired · Please run /login", waitingOnPerson: false }] });
+      } finally {
+        await held.close();
+      }
+    });
+
     it("marks the workspace root as an override when OPENRIG_WORKSPACE_ROOT is set", async () => {
       const prev = process.env.OPENRIG_WORKSPACE_ROOT;
       process.env.OPENRIG_WORKSPACE_ROOT = process.cwd(); // a real existing dir