@agentshouse/skills 0.1.0-c7cb7e6f4dffa → 0.1.0-c7dbb0a4b158c

package/README.md

@@ -14,7 +14,8 @@ The Skills agents.house serves its agents, and the texts its agents read.
   `agent-functions/` holds the Agent functions agents.house writes into every Private Room, frontmatter and
   all. `owner-rules` is the Owner rules' text, and `owner-rules-earlier.json` the SHA-256 of every
   earlier text.
-- `agent-instructions.json` is the lines that open an agent's first prompt.
+- `agent-instructions.json` is the lines that open an agent's first prompt; its `routing` lines are
+  the ones agents.house's MCP server instructions carry too.
 
 ```ts
 import { OWNER_RULES, listSkills, readSkill } from '@agentshouse/skills';
@@ -23,7 +24,8 @@ for (const { name } of listSkills()) console.log(name, readSkill(name).length);
 console.log(OWNER_RULES);
 ```
 
-`agentInstructions(houseRef, copies)` returns the first prompt's lines, which name no Local copy,
+`agentInstructions()` returns the first prompt's lines, which name no Local copy, `ROUTING_INSTRUCTIONS`
+its routing lines,
 `GUIDE` every Guide page with its path, title, first line and text and
 `EARLIER_OWNER_RULES_SHA256` the earlier texts' digests.
 

package/agent-instructions.json

@@ -1,9 +1,16 @@
 {
-  "lines": [
+  "opening": [
     "From House:",
-    "Work with House through the `house` CLI: run `house --help`, and `house run_command '{\"command\":\"guide/open\"}'` opens `index`, the root page of House's guides and formats.",
-    "To give the User a file, upload it with `house upload` and link it; for an App, a Site or a website, follow the Guide from `index` with `guide/open`. Never start a server.",
-    "Optional per-Room instructions: `/rooms/private/rooms/<handle>/AGENTS.md`.",
-    "For another Agent's help, `agent-functions/send` naming one of the Room's Agent function cards under `house/agent-functions/`, or the Agent and what you ask, as its Trust level there allows; its mail comes back into this conversation."
+    "Work with House through the `house` CLI, `house <tool> '<arguments as JSON>'`: `house --help` lists the Tools and `house help <tool>` names a Tool's arguments."
+  ],
+  "routing": [
+    "Read with `shell` and `inspect`. Write with `files_batch` and `records_append`.",
+    "For anything else, `find_command`, then `run_command`.",
+    "Optional per-Room instructions: `/rooms/private/rooms/<handle>/AGENTS.md`."
+  ],
+  "closing": [
+    "`house run_command '{\"command\":\"guide/open\"}'` opens `index`, the root page of House's guides and formats.",
+    "A file reaches the User as a Room Path written with `house upload` and linked in the answer. House serves an App, a Site or a website built by the Guide from `index` (`guide/open`), with no server of your own.",
+    "For another Agent's help, `agent-functions/send` naming one of the Room's Agent function cards under `house/agent-functions/`, or the Agent and what you ask, as its Standing answers there allow; its mail comes back into this conversation."
   ]
 }

package/dist/index.d.ts

@@ -16,6 +16,7 @@ export declare const GUIDE_ROOT = "index";
 export declare const GUIDE: readonly GuidePage[];
 export declare const OWNER_RULES: string;
 export declare const EARLIER_OWNER_RULES_SHA256: readonly string[];
-export declare function agentInstructions(_houseRef: string, _copies: readonly string[]): string[];
+export declare const ROUTING_INSTRUCTIONS: readonly string[];
+export declare function agentInstructions(): string[];
 export declare function listSkills(): readonly Skill[];
 export declare function readSkill(name: string): readonly SkillFile[];

package/dist/index.js

@@ -8,6 +8,7 @@ const TREE = join(PACKAGE, 'guide');
 const PAGE = '.md';
 const FRONTMATTER = /^---\n[\s\S]*?\n---\n\n?/u;
 const HEADING = /^# /u;
+const LIST_ITEM = /^\s*[-*+] /u;
 export const GUIDE_ROOT = 'index';
 const OWNER_RULES_PAGE = 'owner-rules';
 function packaged(name) {
@@ -15,7 +16,8 @@ function packaged(name) {
 }
 function guidePage(file) {
     const text = readFileSync(join(TREE, file), 'utf8');
-    const [heading = '', , line = ''] = text.replace(FRONTMATTER, '').split('\n');
+    const [heading = '', , ...rest] = text.replace(FRONTMATTER, '').split('\n');
+    const line = rest.find((held) => held !== '' && !LIST_ITEM.test(held)) ?? '';
     return {
         path: file.slice(0, -PAGE.length).split(sep).join('/'),
         title: heading.replace(HEADING, ''),
@@ -33,8 +35,9 @@ export const GUIDE = readdirSync(TREE, {
 export const OWNER_RULES = GUIDE.find((page) => page.path === OWNER_RULES_PAGE).text;
 export const EARLIER_OWNER_RULES_SHA256 = JSON.parse(packaged('owner-rules-earlier.json'));
 const INSTRUCTIONS = JSON.parse(packaged('agent-instructions.json'));
-export function agentInstructions(_houseRef, _copies) {
-    return [...INSTRUCTIONS.lines];
+export const ROUTING_INSTRUCTIONS = INSTRUCTIONS.routing;
+export function agentInstructions() {
+    return [...INSTRUCTIONS.opening, ...INSTRUCTIONS.routing, ...INSTRUCTIONS.closing];
 }
 export function listSkills() {
     return readdirSync(SET, { withFileTypes: true })

package/guide/agent-functions/work-on-ticket.md

@@ -1,15 +1,13 @@
----
-description: Work the Wayfinding ticket this request names, from its Question to its Answer.
-input: The ticket to work on.
----
-
 # Work on ticket
 
+- **Description**: Work the Wayfinding ticket this request names, from its Question to its Answer.
+- **Input**: The ticket to work on.
+
 The Agent function an Agent runs when a person sets a Wayfinding ticket in progress with that Agent as its assignee.
 
 Work the one ticket this request names, then stop:
 
-1. Open the `wayfinding-ticket` the request names and set its `conversation` to the id of this conversation, which House's first message names.
+1. Open the `wayfinding-ticket` the request names and set its `conversation` to the id of this conversation, the one `conversations/active/list` marks `this`.
 2. Work it by its `kind`: for `research`, find out and say where you found it; for `prototype`, build the smallest thing that answers its Question; for `grilling`, ask your User until its Question is settled; for `task`, do what it asks.
-3. Write what you found or made in its Answer section and set its `status` to `done`.
+3. Write what you found or made as its Answer and set its `status` to `done`.
 4. Start no other ticket, not even one this ticket unblocks.

package/guide/apps/chat.md

@@ -8,16 +8,43 @@ no dependency. `const chat = await houseBridge.chat.mount(element, options)`, on
 object House hands the page as `window.houseBridge`, which `houseBridge()` of
 `@agentshouse/app-bridge` returns, draws it in `element` over the App's own client and
 resolves to a handle: `chat.update(options)` replaces its options and `chat.unmount()`
-removes it. `conversation` opens one, `null` for a
-new chat, `agent` is the Agent a new chat goes to, `showChats` adds its conversation list,
-`width` is `full` (the element), or `3/4`, `1/2` or `1/3` of the window docked at its right
-edge, whole on a narrow window, `onOpen` hears each conversation it opens as `{
-conversation, agent }`, and `onLink` takes a link without a scheme in place of the browser.
+removes it. It fills the element and lays itself out by the width it gives: the list of the
+User's Agents and their chats or one chat on a narrow element, the list beside the chat on a
+wider one once the User shows it or the element passes 1000 px, and the chat's details beside
+both on a wide one. With no chat open it shows what
+asks the User and what works now. `conversation` opens one chat, and with it `null` the Chat
+opens a new chat with `agent`, the Agent it goes to, or the list with neither. `onOpen` hears
+each chat it opens as `{ conversation, agent }`, and both `null` when the User goes back to the
+list, and `onLink` takes a link without a scheme in place of the browser.
+Or mount it as the Chat button, which takes no element:
+`const button = await houseBridge.chat.mountButton(options)` draws House's dot at the
+window's bottom-right corner, which counts what asks the User or, while nothing does, the chats
+that replied since the User opened them, and breathes while a turn runs; pressing it opens the
+Chat in a sheet above the page, and pressing it again hides it. With `agent` among the options
+the dot's first press opens it on a new chat with that Agent instead of a chat kept from an
+earlier visit, and later presses reopen the chat it last showed; the sheet stays hidden until
+the first press. The dot stays in view over the
+sheet, which the User moves, resizes up to the window's edges and lets fill the window, and the
+page under it never changes, so leave nothing of the page to make room for it.
+`button.open(target)` opens the sheet, on `{ conversation }` or on a new chat with
+`{ agent }`, or as it was with no target, and with `docked: true` docked at full height along
+the window's right edge; `button.hide()` hides it, keeping its chat, scroll and typed text;
+`button.update(options)` and `button.unmount()` work as for a page, with `onOpen` and
+`onLink`. To open on text written in, write it as the chat's draft through the runtime's
+`chatDraft` first, keyed `new:<agent>` for a new chat. In the sheet the input's + holds This
+page, which attaches the page's Page metadata to one message: a new chat's first message starts
+with it ticked. Mount one button per page.
+In either form the Chat draws inside its own shadow root, so no rule of the App's stylesheet
+reaches it. `chat.mount` needs an element that can hold a shadow root, such as a `div` or a
+`section`, and rejects on a `li`, a `td` or a `form`.
 Theme its own styles with CSS custom properties on the element or an ancestor:
 `--chat-background`, `--chat-surface`, `--chat-text`, `--chat-text-muted`,
 `--chat-accent`, `--chat-line`, `--chat-attention`, `--chat-danger`, `--chat-font`,
 `--chat-font-mono`, `--chat-font-size`, `--chat-radius` and `--chat-density` (a factor for
-spacing); an unset one keeps House's light or dark look. It shows conversations only where
-the release declares them; otherwise it lists no conversation and no Agent. A secret
+spacing); an unset one keeps House's light or dark look. For the Chat button, which takes no
+element, set them on the document's root element. Its dot is House's and takes none of them.
+It shows conversations only where the release declares them;
+otherwise it lists no conversation and no Agent. A secret
 question is never answered here; typed answers live in the Presentation State members named
-`typed:…`: leave them.
+`typed:…`, whether the list shows in `chat:page-list`, and the sheet's size, place, list and
+open chat in `chat:sheet`: leave them.

package/guide/apps/client.md

@@ -18,4 +18,4 @@ and returns `{ state: 'loading' }` until the topic's first value arrives, then `
 parts)`, which saves through `saveParts` and rejects with a recorded failure.
 `saveWritten(room, roomDrafts)` saves Room Drafts the App wrote, each named with the
 revision its last write returned: one another tab wrote since is refused as `stale`, and
-nothing is saved. React-admin and Refine Apps use `@agentshouse/mdruntime-families`.
+nothing is saved.

package/guide/apps/content-safety.md

@@ -10,8 +10,9 @@ images and other resources only from origins the Provider's policy allows. An ag
 never read the authorization, load code from a Room, call the Provider directly, or rebase
 a refused Change Batch.
 
-MD UI uses semantic HTML, is fully operable from a keyboard with labelled controls and
-the browser's own focus mark, and lays out from a 360 pixel wide viewport to a desktop.
+MD UI uses semantic HTML, is fully operable from a keyboard with labelled controls, styles
+no focus, removes the browser's own focus ring and takes no focus by itself, and lays out
+from a 360 pixel wide viewport to a desktop.
 Its strings are English only, dates and numbers follow the browser locale, and content is
 never translated. Light and dark themes come from CSS custom properties, defaulting to the
 browser's preference and respecting an App's override. What an agent adds carries none of

package/guide/apps/data.md

@@ -2,8 +2,8 @@
 
 How an App keeps what it shows as typed documents in the Rooms bound to it.
 
-- Design the Room schema first. Each thing the App shows is one Markdown document in a Room: its frontmatter `type` names its MD type, the rest of its frontmatter holds the fields, and long text goes in `##` sections. `schema.yaml` declares the types ([Schema](reference/schema)).
-- Keep each type in its own folder, such as `tasks/`, and read it by `pathPrefix`: a query naming `types` fails with `unknown-type` while no bound Room declares them.
+- Design the Room schema first. Each thing the App shows is one Markdown document in a Room: its frontmatter `type` names its MD type and its body writes the values: its `name` as the `#` line, each short value as a `- **Label**: value` line and long text under its own heading ([Schema](reference/schema)). `schema.yaml` declares the types ([Schema](reference/schema)).
+- Keep each type in its own folder, such as `tasks/`, and read it by `pathPrefix`. A query naming `types` fails with `unknown-type` over bound Rooms none of which declares them, and answers `{ pending }` instead while the App reaches no bound Room yet; an observed query that has already answered answers `{ pending }` while its bound Rooms refuse it, and answers again once they declare what it names.
 - Link types with `reference` fields instead of copying values; a query follows them with `hop` and `backlinks`.
 - `app.json` `room_slots` names the Rooms the App needs, each with `access` `read` or `write` and the `types` it uses ([App manifest](reference/app-manifest)). Bind Rooms with `apps/bindings/set`; App code cannot bind and reaches only bound Rooms, so it opens `bridge.ceremony('/bind/<app_ref>?slot=<name>')`, the House page where your User binds Rooms, which returns to the App.
 - A bound Room must hold each slot type identically in its own `settings/schema.yaml`, beside any other types, or its binding warns the User who bound it, and `apps/bindings/list` names that release and slot in its `mismatch` line, to the App's owner too. Write it with `files_batch` before binding; `rooms/create` makes a new Room.

package/guide/apps/example-function.md

@@ -2,7 +2,7 @@
 
 How a function hands each new lead to the manager on shift with the fewest leads since their shift began, records its decision and calls the CRM.
 
-A CRM posts each new lead to the Room's push address (`capture/push-addresses/create`) as `{"event": "lead.created", "card": {"id": 101}}`. The Room holds three types: `staff/<key>.md` with `manager_id`, the manager's id at the CRM; `shifts/<key>.md` with `staff`, the key, and `starts` and `ends` as ISO instants; and `decisions/<card>.md` with `card`, `staff` and `decided_at`. The App's `external_origins` lists the CRM's origin, the Room holds a Service key for it, and a Trigger runs the function for each lead:
+A CRM posts each new lead to the Room's push address (`capture/push-addresses/create`) as `{"event": "lead.created", "card": {"id": 101}}`. Name where the CRM puts its event id as the address's `event_id`, when you create it or later with `capture/push-addresses/edit`, so a lead it sends again writes nothing; an address naming none takes a `webhook-id` header as the id. The Room holds three types: `staff/<key>.md` with `manager_id`, the manager's id at the CRM; `shifts/<key>.md` with `staff`, the key, and `starts` and `ends` as ISO instants; and `decisions/<card>.md` with `card`, `staff` and `decided_at`. The App's `external_origins` lists the CRM's origin, the Room holds a Service key for it, and a Trigger runs the function for each lead:
 
 ```json
 {

package/guide/apps/function-times.md

@@ -0,0 +1,10 @@
+# Times in an App function
+
+How a function reads its Room's local time and turns a date and time there into a moment and back, with no time-zone library.
+
+- **The event.** Beside `moment`, the UTC instant `Date` reads, the event carries the Room's `time_zone`, such as `Europe/Kyiv`, and the moment's `date` (`YYYY-MM-DD`) and `time` (`HH:MM:SS`) there, so the same day is the Room's day: `order.fields.delivery === event.date`.
+- **To a moment.** `await house.toMoment({ date: '2026-11-10', time: '13:00' })` answers the ISO instant of a date and an `HH:MM` or `HH:MM:SS` time in the Room's zone, `'2026-11-10T11:00:00.000Z'` in Kyiv. At daylight saving, a time the clocks skip takes the moment just after the gap, `04:00` for `03:30` on the day Kyiv's clocks jump from `03:00` to `04:00`, and a time they repeat takes its earlier moment.
+- **To the Room's time.** `await house.toLocal({ moment: event.moment })` answers the `time_zone`, `date` and `time` in the Room's zone of a date-time with its offset, written as a document's `date-time` field takes it.
+- **Each is a call to House** that counts as no external call and rejects what it refuses with its `code`: `invalid-time` for what is no date and time, or no date-time with its offset, and `unknown-room` for a `room_ref` naming any Room but the run's own.
+
+Next: [App functions](apps/functions)

package/guide/apps/functions.md

@@ -2,12 +2,12 @@
 
 How an App declares a function that House runs on its servers when a Trigger fires, with no page open and no model.
 
-- **Declare.** `app.json` lists `functions`, each `{"name": "assign lead", "entry": "functions/assign.js"}` ([App manifest](reference/app-manifest)). The entry is one ES module whose default export is the function and which imports nothing, so your build bundles each function, with all it imports, into `dist/`, such as `esbuild src/assign.ts --bundle --format=esm --outfile=dist/functions/assign.js`. A publish is refused whole for an entry that is missing, imports, has no default export or is over <function-size>, for a name used twice, and for more than <release-functions> functions.
-- **Run.** A Trigger's `function` action names the App and one of its functions ([Triggers](reference/triggers)). House runs the App's latest release when the Event's turn comes, one Event of a Trigger after another, so a run reads what the run before it wrote. Runs share a fixed number of slots on House's servers, and a run waits, its action `waiting`, until one is free.
-- **The event.** `export default async (event, house) => {}` receives `kind`, the condition's `on`, with `room`, `trigger`, `id`, `moment` and what matched: `path` and `reference`, a document change's `transition`, an arriving item's `item` with its `headers` and raw `body` text, a dated document's `document`, a delivered notification's `notification`, the facts of its web document, or a message's `message`, its `sender` and its request's `agent_function`, never its words, with the document that request was started for as `path` and `reference`. `Date` reads `moment`. The return value is ignored, so write what you keep into the Room.
-- **The App API.** `house` is the page's App API over the Trigger's Room alone: `query(q)` ([Local Query](apps/local-query)), which reads only the documents of the `types`, folders (`folder`, `pathPrefix`) and `paths` it names and answers over them alone, so the rest of a large Room is never read: name the `types` or `pathPrefix` of its `hop` and `backlinks` too, and select its parts, since a query or `hop` or `backlinks` naming none, or selecting `backlinks` or `'all'`, is refused `invalid-query`, `saveParts(room, parts)`, `call(name, input)` for the Room acts, each by its House act name, such as `records/list` and `rooms/members/list`, and `callExternal(request)`. `query` and `callExternal` reject a refusal with its `code` for the function to catch, while `call` answers it as a result whose `kind` is `rejected` and `saveParts` as `outcome: 'refused'`, as on the page, so check what they answer. Its writes are the App's, by `App <App> (function <function>)`, fire Triggers, its own included, and count against the Room owner's Write limit.
-- **Reach.** A run holds no `fetch`, timer, file, `console` or `Intl`: keep times as ISO instants, or convert a local time by its UTC offset yourself. `callExternal` takes the request `bridge.callExternal` takes and is the one way out, to an origin the release's `external_origins` lists; naming its Room, `room_ref: event.room`, carries that Room's Service key, which the function never sees, or is refused `service_key_not_found` naming the `origin`. Its calls count against the Room owner's `external_calls` limit.
-- **Never repeated.** A run that started is never run again, even when it failed after a call reached the service. Send `event.id` as the service's idempotency key where it takes one, and name what you write by what the event carries, so a second delivery of the same thing finds it.
-- **Failure and limits.** A throw settles the run `failed` with `function_failed` and its text, which `triggers/fired/list` shows and the panel shows the Room's owner, with no notification; the next Event still runs. A run ends `failed` at <function-time>, at <function-memory> or past <function-calls> external calls: `time_cap_reached`, `memory_cap_reached` or `external_call_cap_reached`.
+- **Declare.** `app.json` lists `functions`, each `{"name": "assign lead", "entry": "functions/assign.js"}` ([App manifest](reference/app-manifest)). The entry is one ES module that imports nothing and default-exports the function, so your build bundles each function with its imports into `dist/`, such as `esbuild src/assign.ts --bundle --format=esm --outfile=dist/functions/assign.js`. A publish is refused whole for an entry that is missing, imports, has no default export or is over <function-size>, for a name used twice, and for more than <release-functions> functions.
+- **Run.** A Trigger's `function` action names the App and one of its functions ([Triggers](reference/triggers)). House runs the App's latest release when the Event's turn comes, one Event of a Trigger at a time, so a run reads what the one before wrote. Runs share a fixed number of slots on each server, one Room owner's at most <function-owner-slots>, and a run waits, its action `waiting`, until it may take one.
+- **The event.** `export default async (event, house) => {}` receives `kind`, the condition's `on`, with `room`, `trigger`, `id`, `moment`, the Room's `time_zone`, `date` and `time` ([Times](apps/function-times)) and what matched: `path` and `reference`, a document change's `transition`, an arriving item's `item` with its `headers` and raw `body` text, a dated document's `document`, a delivered notification's `notification`, the facts of its web document, or a message's `message`, its `sender` and its request's `agent_function`, never its words, with the document that request was started for as `path` and `reference`. `Date` reads `moment`. The return value is ignored: write what you keep into the Room.
+- **The App API.** `house` is the page's App API over the Trigger's Room alone: `query(q)` ([Local Query](apps/local-query)), which reads only the documents of the `types`, folders (`folder`, `pathPrefix`) and `paths` it names: name the `types` or `pathPrefix` of its `hop` and `backlinks` too and select its parts, since naming none, or selecting `backlinks` or `'all'`, is refused `invalid-query`, `saveParts(room, parts)`, `call(name, input)` for the Room acts by House act name and `callExternal(request)`. `call` answers a refusal as `kind: 'rejected'` and `saveParts` as `outcome: 'refused'`, as on the page; the others reject with its `code`. Its writes are the App's, by `App <App> (function <function>)`, fire Triggers, its own included, and count against the Room owner's Write limit.
+- **Reach.** A run holds no `fetch`, timer, file, `console` or `Intl`: convert times by `house.toMoment` and `house.toLocal`, which a page lacks. `callExternal` takes the request `bridge.callExternal` takes and is the one way out; naming its Room, `room_ref: event.room`, carries that Room's Service key, which the function never sees; calls count against the Room owner's `external_calls` limit. Its webhook signing secret goes nowhere: `call('service-keys/signatures/check', { room_ref, origin, text, signature })` answers `matched`, whether `signature` is `text`'s HMAC-SHA256 under it, lowercase hex or base64. Both take only an origin the release's `external_origins` lists and are refused `not_found` naming the `origin` where the Room holds none.
+- **Never repeated.** A run that started is never run again, even when it failed after a call reached the service. Send `event.id` as the service's idempotency key where it takes one, and name what you write by what the event carries, so a second delivery finds it.
+- **Failure and limits.** A throw settles the run `failed` with `function_failed` and its text, which `triggers/fired/list` and the Room owner's panel show, with no notification; the next Event still runs. A run ends `failed` at <function-time>, at <function-memory> or past <function-calls> external calls: `time_cap_reached`, `memory_cap_reached` or `external_call_cap_reached`.
 
 Next: [Example: assign a lead](apps/example-function)

package/guide/apps/local-first.md

@@ -5,13 +5,13 @@ How an App reads and writes its Rooms on the device, offline too.
 - The runtime holds every bound Room on the device and streams in every change from any device, App or agent. `query` and `observe` answer from the device and never wait on the network; `search` asks House ([Search rules](apps/search)).
 - Draw from `observe` at once, with no request of your own; an observation hears each later change by itself, so never poll, refetch or subscribe. An answer is `{ pending }` while a Room it reads has not reached this device or been prepared on it: draw the page without those documents; keep the empty state for a complete answer. `rooms` answers once the runtime knows the Rooms the page reaches. Offer binding a Room when it is empty while the sync status's `providerUnreachable` is false and `observe('connection-refusal')` answers `null`; any other empty list says only that nothing can be listed yet.
 - Show no loading state: draw the last state the device holds. A wait shows only after an act the User pressed whose answer comes from outside the stream, such as `bridge.callExternal`, until it arrives.
-- Write optimistically: write a Room Draft, then `save`. The change shows in every query at once as a Pending Change and reaches House when it can. `save` refuses at once, with its `code`, a change that is `stale`, `changed-underneath` or against the schema: say so and keep the form.
+- Write optimistically: write a Room Draft, then `save`. The change shows in every query at once as a Pending Change and reaches House when it can. `save` refuses at once, with its `code`, a change that is `stale`, `changed-underneath` or against the schema: say so and keep the form. After `changed-underneath`, draw the joined Room Draft and its `marks` ([Room Drafts](apps/room-drafts)).
 - Show what the runtime reports: `observe('queue', room)` lists changes House has not confirmed yet, and `observe('sync-status')`'s `attentionRequired` lists each change House refused, returned as a Room Draft with why, to save again or discard.
 - Keep what the User types in the Room Draft (`roomDraft.write`) as they type; it survives a new release replacing the page, a reload and another tab. Draw a form again only when its page changes, never on a streamed change.
 - A document has one Room Draft, shared by every tab and App, and `save` takes all of it. A write replaces every part and names the revision it read, so write onto the parts it holds; one from an older revision answers `stale` with the current Room Draft: show that one. A field part names as its `base` the value the page showed, `{ value }`, or `null` when the document has no such field.
 - Save a change the User does not type, such as a checkbox, with `saveParts(room, [{ path, parts }])`: it writes no Room Draft, so the one another tab holds stays.
 - Offline, all of this works and saves wait; `bridge.onStatus` reports `offline`: say so quietly.
 - A Room your User holds at the Open level locks once the browser has been offline 2 minutes, and from the moment it opens until House confirms the access. While it is locked, `rooms` lists it `locked: true`, a query that does not name it leaves it out, one naming it answers `{ pending }` with `awaits: 'unlock'`, and every other read and write naming it, `save` included, answers the code `room-locked` and keeps nothing. Draw it locked until it unlocks and keep what the User types in the page; what was saved before stays and is sent then.
-- An outside service is reached only at the origins `app.json` lists in `external_origins`, directly or through `bridge.callExternal`, sent by House's server. A call that names a Room bound to the App in a `write` slot with `room_ref` carries that Room's Service key for the origin, which the page never sees; any other call carries no key. A call through a Room that holds no key for the origin is refused `service_key_not_found` naming the `origin`: tell the person that the Room's owner or a manager enters the key under Service keys in the Room's Info, since no App opens that page.
-- The page's own storage is a disposable cache, the Room the only durable home of the App's data; handle any code or value you do not know through `code` and `retryable`, which every refusal and failure carries.
-- React: `useObserve` and `useSave` from `@agentshouse/mdruntime/react`. react-admin and Refine: the data providers of `@agentshouse/mdruntime-families`. The whole client: [The App runtime](apps/runtime).
+- An outside service is reached only at the origins `app.json` lists in `external_origins`, directly or through `bridge.callExternal`, sent by House's server. A call that names a Room bound to the App in a `write` slot with `room_ref` carries that Room's Service key for the origin, which the page never sees; any other call carries no key. A call through a Room that holds no key for the origin is refused `not_found` naming the `origin`: tell the person that the Room's owner or a manager enters the key under Connected on the Room's Settings page, since no App opens that page.
+- The page's own storage is a disposable cache, the Room the only durable home of the App's data; handle any code or value you do not know by its `code` ([Refusals](apps/runtime-refusals)).
+- React: `useObserve` and `useSave` from `@agentshouse/mdruntime/react`. The whole client: [The App runtime](apps/runtime).

package/guide/apps/local-query.md

@@ -18,7 +18,7 @@ draw it as loading and observe the query to hear the complete answer. A query is
   the device alone: an App function refuses it.
   `text` keeps the Documents whose text contains that phrase, ignoring case, ranking
   nothing.
-- **Fields.** Every frontmatter value is named by JSON Pointer: `/status`,
+- **Fields.** Every value of a typed Document is named by JSON Pointer: `/status`,
   `/shipping/city`, `~1` for a `/` and `~0` for a `~` in a key. A segment that meets a
   list applies to every item and a number names one item. `where` names pointers, ANDs
   them, and nests `$and` and `$or`; a pointer through a list holds if any item satisfies
@@ -30,7 +30,7 @@ draw it as loading and observe the query to hear the complete answer. A query is
   missing value is false and `$ne`, `$nin` and `$exists: false` true. A date
   compares in calendar order and never with a date-time. A date-time compares as an instant,
   whatever offset it is written in. A reference compares by the
-  Room Path it resolves to. Untyped frontmatter, and a value under `oneOf` or a
+  Room Path it resolves to. An untyped Document's frontmatter, and a value under `oneOf` or a
   conditional, is plain values. There is no regular expression.
 - **Relations.** Within one Room, `hop: { field, types, where, pathPrefix }` keeps Documents
   whose reference at pointer `field`, at any depth, points to a matching Document, and
@@ -40,8 +40,8 @@ draw it as loading and observe the query to hear the complete answer. A query is
   `revision`, or `unreadable` where the App does not bind it or it is locked.
 - **Parts.** A Document query must `select`: `'all'`, or `fields`, `sections`,
   `preamble`, `markdown`, `backlinks`, `change`, `fileId`, `revision`, `size` and `created`, where `fields` is `'all'`
-  or a list of pointers and `sections` `'all'` or a list of names. Selected pointers
-  return the frontmatter holding only them, nested as written. A backlink names the
+  or a list of pointers and `sections` `'all'` or a list of names of sections whose heading
+  names no field. Selected pointers return the values holding only them, nested as written. A backlink names the
   referring Path, MD Type and the pointer it came from as `field`. Room and Path always
   return; a Markdown Document also returns its MD Type, and at most its first 1,000
   backlinks: a query on the referring field reads the rest. A non-Markdown Document

package/guide/apps/page.md

@@ -3,12 +3,12 @@
 What an App's page draws and how it behaves in the browser.
 
 - The App draws everything; House draws nothing around it. Set the tab's title with `bridge.setTab({ title })`.
-- The address bar is the shell's, not your page's: read your place from `bridge.address()` and `bridge.onAddress`, and move with `bridge.push` or `bridge.replace`, so Back, Forward, reload and a shared link keep it; a push to the address already shown replaces it, so a double click adds no history entry. After an act that ends what the page shows, and when a dialog closes, `bridge.replace` the next address; a replace with the address this page was opened from goes back to it, so Back returns to where the person came from. Keep the open item, tab, filter and search in the address. Addresses under `/render` and `/info` are House's.
+- The address bar is the shell's, not your page's: read your place from `bridge.address()` and `bridge.onAddress`, and move with `bridge.push` or `bridge.replace`, so Back, Forward, reload and a shared link keep it; a push to the address already shown replaces it, so a double click adds no history entry. After an act that ends what the page shows, and when a dialog closes, `bridge.replace` the next address; a replace with the address this page was opened from goes back to it, so Back returns to where the person came from. Keep the open item, tab, filter and search in the address. Addresses under `/render`, `/info` and `/home-screen` are House's.
 - Files: take one in with `binaryFile.attach` the moment it is chosen and keep the Path it answers, hand one out with `binaryFile.download`, and show an image or video in `<room-media>` naming its width and height, so nothing waits for media and nothing moves when it arrives; never read a file whole to show or download it ([files](apps/runtime-files)).
 - Mobile first: lay out from 360 pixels wide up, with no action behind hover alone.
-- Every control works from the keyboard and has a label; give it no focus style of your own and never remove the browser's focus mark.
+- Every control works from the keyboard and has a label. Draw no focus mark: give nothing a focus style, and remove the browser's own ring with `* { outline: none; }`, the reset House's base carries, since that base does not reach your page. Nothing takes focus by itself: no `autofocus`, and no `focus()` that runs because a page or dialog opened.
 - An empty list says what it will hold and invites the first document.
 - Long names truncate with an ellipsis and show in full on hover.
 - The element is the link: a row, card or name opens its item; no "Open" buttons.
-- Offer installation yourself: `bridge.install()` from a click shows the browser's prompt, or answers `manual` where you show how.
+- Offer installation yourself: `bridge.install()` from a click starts the install or shows the browser's prompt, or answers `manual` where you show how.
 - Offer a way out where your User expects one: `bridge.ceremony('/sign-out')` signs them out of House and opens sign-in.

package/guide/apps/room-drafts.md

@@ -5,7 +5,8 @@ How App code writes a Room Draft, saves it and learns what became of each change
 The MD Runtime owns one durable Room Draft per Room and Path, shared by every App and tab
 across reloads; a Room the Provider reports lost takes its Room Drafts and queue with it.
 Write one with `roomDraft.write(room, path, revision, parts)`, naming the revision you read
-or `null`, and every part it now changes: fields, sections and the preamble, or the whole
+or `null`, and every part it now changes: fields, long text and lists included, sections
+whose heading names no field and the preamble, or the whole
 Markdown, a creation, a move, into another Room when it names `room`, or a removal. A new
 part names its base, the value you showed when it was opened, a field's as `{ value }` or
 `null` for no such field, and keeps its first base; a binary Path entry's move or removal
@@ -14,21 +15,27 @@ current Room Draft.
 
 Save takes one Room and the Room Drafts of it to save, each with its revision, validates
 locally, and on success appends one Change Batch to that Room's queue and removes those Room
-Drafts. Refused as `stale`, `changed-underneath` naming each part whose base no longer
-matches the visible state, or a local validation rule, it creates nothing and leaves every
-Room Draft. A directory move or removal is that part on each Document and binary Path entry
-beneath it, saved together; moves into another Room, saved alone, are one Change Batch in
-both Rooms' queues. `saveParts(room, [{ path, parts }])` saves parts, each Path once and
-each new part with its base, the same way but writes no Room Draft: one held at a saved Path
-stays, one at a moved Path moves with it to a destination that holds none. Never save by
-writing back a Room Draft read before.
+Drafts. Refused as `stale`, `changed-underneath` naming each part changed underneath, or a
+local validation rule, it creates nothing and removes no Room Draft. On `changed-underneath`
+it first joins each one over the current Document under a new revision: show that one. A
+field, a move, a removal and a replaced file keep yours; a section, the preamble, and a
+whole Markdown whose sections do not match hold the current text, then yours; a whole
+Markdown otherwise joins section by section. `marks`, keyed like `parts`,
+names each part holding both sides with the `change`, `{ author, time }` or `null`, that
+saved the current side, and a field's or file's `current`. Offer only Save and Discard; a
+write keeps the marks of the parts it still names. A directory move or removal is that part
+on each Document and binary Path entry beneath it, saved together; moves into another Room,
+saved alone, are one Change Batch in both Rooms' queues. `saveParts(room, [{ path, parts
+}])` saves parts, each Path once and each new part with its base, the same way but writes no
+Room Draft: one held at a saved Path stays, one at a moved Path moves with it to a
+destination that holds none. Never save by writing back a Room Draft read before.
 
 Outcomes follow the Provider's answer. An Accepted Change Batch stays in the queue, drawn
 over the confirmed layer, until that layer reaches the Room Version it was accepted at.
 Conflicted and Rejected, and a change that no longer applies, each
-leave the queue and return as Room Drafts on their Documents, marked with why: the
-Provider's structured refusal code and fields as returned, not known to have applied, or
-withdrawn locally. The rest of the queue keeps synchronizing, and Sync Status requires
+leave the queue and return as Room Drafts on their Documents, joined as above and marked
+with why: the Provider's structured refusal code and fields as returned, not known to have
+applied, or withdrawn locally. The rest of the queue keeps synchronizing, and Sync Status requires
 attention until each returned Room Draft is saved or discarded. `observe('queue', room)`
 shows each Pending Change Batch, which keeps no outcome once it leaves. Transport failure,
 Provider unavailability and a refusal marked retryable, until the reset it names, keep

package/guide/apps/runtime-api.md

@@ -4,7 +4,7 @@ What App code reaches through the runtime's client: its surfaces, its reach, obs
 
 App code reaches the MD Runtime through the remote client. The surfaces are Rooms, Query,
 Search, Observe, Types, Room Draft, Save, History, Resolve, binary files, Call,
-Reached, Log, the reported persistence answer, reauthorization, conversation, the chat
+Reached, the reported persistence answer, reauthorization, conversation, the chat
 draft, and Presentation State. Sync Status, readiness, the Service Mode, the storage-loss
 statement, the deployment facts, the signed-in member and the count of authority changes
 are observations only.
@@ -22,7 +22,8 @@ pending call and observation; a reconnected client observes again.
 
 `observe('agents')` answers every Agent a new conversation can go to, each `{ identity,
 name }`, a retired one left out: online every Agent of the User, with a conversation yet or
-not, offline every Agent a conversation names. Each conversation the Provider lists is held
+not, each with its `cli` and `environment` `{ identity, name, state }`, `state` `online` or
+`offline`; offline every Agent a conversation names. Each conversation the Provider lists is held
 complete in the browser. `conversation.list()` and `observe('conversations')` answer each
 with its Agent's identity and name, its name, created and finished times, last outcome,
 live `state` (`asking` while a question waits, `working` while a turn runs, else `idle`)
@@ -31,14 +32,18 @@ limit, total: true })` holds its latest `limit` messages, at most 1,000, oldest
 `total` their count, and `next` while older ones exist, which `after` takes, there or in
 `conversation.read(id, { limit, after })`, for the window before; its chat draft; and,
 only in memory, what the Provider streams whether or not anything views it: the running
-`turn` with its parts and its context in use and window, which the message accepted under
-the turn's id replaces, the open questions, the process state, and the CLI's commands and
-options, none stored or searchable. `chatDraft.write` and `chatDraft.discard` keep what
-the App Creator composes, and `chatDraft.prepend(conversation, draft)` puts a returned
-message ahead of it as it stands. Sending it is a Provider Action that needs the Provider
-reachable and is never queued. A new conversation's chat draft is keyed `new:<Agent
+`turn` with its Session content parts, which the message accepted under the turn's id
+replaces, the session's `state` with its context, limits, cost and what still runs, the open
+questions, the process state, the CLI's commands and options, and `deliveryWaiting`, the
+messages that wait in the Agent's queue, none stored or searchable. A saved message's
+`content` holds its turn's parts, tokens and state, and one its owner took out of the queue
+carries `removed: true`. `chatDraft.write` and `chatDraft.discard` keep what
+the App Creator composes, `chatDraft.prepend(conversation, draft)` puts a returned
+message ahead of it as it stands and `chatDraft.append(conversation, draft)` a text after it.
+Sending it is a Provider Action that needs the Provider reachable and is never queued.
+A new conversation's chat draft is keyed `new:<Agent
 identity>`: no conversation list removes it, a retired Agent's goes, and the first answer
 to `conversation.create({ agent_id, operation_id })` moves it to the created conversation,
 where `conversation.send(conversation)` sends it; a replay of that create moves nothing.
 
-Next: [Presentation State, binary files and the network](apps/runtime-files)
+Next: [Conversation acts and the Chat's device state](apps/runtime-conversations)

package/guide/apps/runtime-conversations.md

@@ -0,0 +1,38 @@
+# Conversation acts and the Chat's device state
+
+The conversation acts beyond sending, and what the browser keeps for the Chat.
+
+Each act takes the operation id its caller makes once and hands again on a retry, so
+House runs it once. `conversation.takeOut(conversation, message, operation)` takes a
+message that waits in the Agent's queue out. `conversation.decide(request, 'approve' |
+'decline', operation)` decides a waiting request, its `{ request, room, message? }` as the
+conversation shows it. `conversation.rename(conversation, name, operation)` renames a
+conversation, `conversation.option(conversation, option, value, operation)` sets a session
+option and `conversation.retry(conversation, message, operation)` sends a refused message
+again. A release that declares no conversations is refused each with `action-undeclared`
+naming its act.
+
+`conversation.attach(file)` attaches a `File` to a message, whatever Rooms the App reaches:
+House writes it into the User's Private Room at `attachments/<YYYY-MM-DD>/<name>` and it
+answers `{ kind: 'attached', link }`, the file's link with its key, which opens that one
+file to whoever holds the link, so write it into the chat draft or the text you send; or
+`{ kind: 'offline' }`, writing nothing, or a refusal or failure.
+`conversation.attachment(link)` answers such a link's file as `{ kind: 'link', url, name,
+mediaType }`, its short-lived address, `rejected` `not_found` for a key that opens nothing,
+or a failure. Without conversations the attach is refused `action-undeclared` and the read
+answers `absent`.
+
+`conversation.pin(figures)` keeps the Chat's pinned figures, which every conversation's
+`pins` shows, `conversation.openTurn(conversation, turn)` each chat's last opened turn,
+which its row's `opened` shows beside `answered`, the turn its Agent answered last, and
+`conversation.dismissSuggestion(conversation, suggestion)` each chat's suggested next
+prompt the User dismissed, which that conversation's `dismissedSuggestion` shows, on this
+browser for House and every App alike; none of it is sent to House. Without conversations
+they read none and keep nothing.
+
+`conversation.pageMetadata(appName, address)` answers the Page metadata block a message
+carries after the User's text: the App's name, the page's address and, while the page
+holds at most ten Local Queries open, each one's definition on its own line, never its
+results.
+
+Next: [Presentation State, binary files and the network](apps/runtime-files)

package/guide/apps/runtime-files.md

@@ -29,9 +29,11 @@ or remove one as a Document, its bytes following.
 - `<room-media room path width height alt>` draws an image, video or audio file of the
   Room. It reserves the box `width` and `height` set, in the file's own pixels, or a 16:9
   one, before any byte; asks for the file only as it nears the view; draws a file the
-  browser keeps from its bytes, offline too, and reads and keeps an image; plays a video
-  or audio file from the Provider's address loading only its metadata; asks again when a
-  shown file's address lapses; asks again while the file cannot be shown yet, such as
+  browser keeps from its bytes, offline too, and reads and keeps an image; shows a video's
+  first frame with a play mark and plays it only in House's full-screen viewer, which a
+  press on it opens, and plays an audio file, loading only either's metadata from the
+  Provider's address; asks again when a shown file's address lapses; asks again while the
+  file cannot be shown yet, such as
   while the Room does not hold it or House did not answer, until House refuses it for
   good; and shows its children where the file cannot be read.
 - `binaryFile.read(room, path, revision?)` answers `{ kind: 'binary', stream, byteLength,

package/guide/apps/runtime-refusals.md

@@ -1,12 +1,13 @@
 # Refusals, deployment facts and the member
 
-How the MD Runtime API refuses and fails, and how App code reads the deployment facts and who uses it.
+How the MD Runtime API refuses and fails, and how App code reads the deployment facts, who uses it and their time zone.
 
-Every refusal and failure carries `code` and `retryable`: each Call and History answer
-other than its result, a refused Save or Room Draft write, a returned Room Draft's reason,
-a Room's refusal, the Connection Refusal and every error a member rejects with, beside its
-message, a Provider refusal with the Provider's own `retryable`. Every code and value is
-open: handle one you do not know by its `code` and `retryable`. Only a tag telling which
+A refusal or failure carries `code` and `retryable`: each Call and History answer other
+than its result, a refused Save, a returned Room Draft's reason, a Room's refusal and every
+error a member rejects with, beside its message, a Provider refusal with the Provider's own
+`retryable`. The Connection Refusal carries a `code` and no `retryable`, and a Room Draft
+write from an older revision answers `{ outcome: 'stale', current }`. Every code and value
+is open: handle one you do not know by its `code`. Only a tag telling which
 fields a value carries, such as `kind`, is closed: keep a branch for one you do not know.
 A model with no usable types answers `types: null`.
 
@@ -20,4 +21,6 @@ named; signing out answers `null`, then ends the observation with the authorizat
 `observe('authority-changes')` answers how many times House told the runtime that what its
 User may see changed, a Room's members, a Share or an offer among them, and hears each next
 one, never a reconnection, so a view that read such a fact through Call reads it again when
-the count moves.
+the count moves. `observe('time-zone')` answers that User's IANA time zone, `null` until the
+Provider names one and where they hold none, kept and heard like the member; the Chat shows its
+times in it, and a page may too.

package/guide/apps/search.md

@@ -2,7 +2,7 @@
 
 How `search` finds Documents by words through House, and how a page finds them offline.
 
-`search({ text, rooms })` asks House's search, the one Agents use, once and online: there
+`search({ text, rooms })` asks House's search once and online: there
 is no observed search and the device keeps no full-text index. `rooms` names Room locators
 and defaults to every Room the page binds; the search never leaves those Rooms, and finds
 words in every Document there.

package/guide/apps/start.md

@@ -8,5 +8,6 @@ How to get an App's repository, build it and publish every change.
 - Only when no App exists yet, clone `<origin>/app/new.git` the same way: it gives mdui, a minimal App in plain TypeScript with its test and `npm run publish`. Run `npm ci --ignore-scripts`, then `npm run publish -- --name "<display name>"`, which creates the App and prints its address and its `.git` address. Then `git remote set-url origin <that .git address>`; every later `npm run publish` goes there, without `--name`.
 - Use any framework and build tool. `npm run build` leaves the whole release in `dist/`: the entry HTML, every file it loads, `app.json` and `schema.yaml`. The entry names files by relative paths (Vite: `base: './'`), carries no inline script and loads nothing from outside the release, so bundle fonts and libraries. A release holds at most <release-files> files and <release-size>.
 - Your User sees a change only once it is published, so an ask to change an App is an ask to publish it: end every change with a commit and `npm run publish`, which builds, pushes `main` and the build, and prints `published` or the reason House refused. A `git push` of `main` alone publishes nothing and says so. A refused push changes nothing and the previous release keeps running.
+- When a House update removes or narrows something your App's code uses, House commits a fix to its `main`, as `House`, and publishes it. A push refused with `fetch first` means someone committed after your clone: `git pull`, then publish again.
 - Without Git, zip the project folder after the build, without `node_modules` and `.env`, `upload` the ZIP to a Room and publish it with `apps/publish-zip`.
 - A page whose first draw is not yet the place it opened on, as one that draws its Room's documents once `observe` answers, registers `bridge.cooperate({ placed })` in its entry script before its first draw, where `placed` resolves once that place shows what it holds, as [the example](apps/example-tasks) does: House keeps its preparation surface over the page until then, and shows a page that registers none at its first draw. An open page keeps the release it loaded and runs the next one at its next load, so it needs no update code; `node_modules/@agentshouse/app-bridge/docs/families.md` describes each bridge member.

package/guide/index.md

@@ -1,11 +1,9 @@
 # House
 
-Where House's guides and formats start: `guide/open` opens a page by its `path` or finds pages by `words`.
+Where House's guides and formats start: `guide/open` opens a page by its `path` or finds pages by a `query`.
 
 House keeps Markdown files in Rooms, which your User shares with other people and their agents.
 
-While your User owns no Room but the Private Room, as `rooms_list` shows, open [House Onboarding](skills/house-onboarding) first.
-
 - `apps/`, building an App over your User's Rooms: [Build an App](apps/build), and the functions House runs for it when a Trigger fires: [App functions](apps/functions).
 - `reference/`, the formats House reads: [Access level](reference/access-level), [App manifest](reference/app-manifest), [Schema](reference/schema) and [Triggers](reference/triggers).
 - `agent-functions/`, the Agent function an Agent takes a plan's tickets by, written for the plan's Room and naming that Agent as [Agent function](reference/agent-function) says: [Work on ticket](agent-functions/work-on-ticket).

package/guide/owner-rules.md

@@ -26,11 +26,9 @@ The skills are already set up; never run `setup-matt-pocock-skills`.
   with `type: wayfinding-map` in its frontmatter, and its tickets,
   `wayfinding-ticket` documents in order as `projects/<name>/map/NN-<slug>.md`
   with `type: wayfinding-ticket`, since House knows a map or a ticket only by
-  its `type`: a ticket carries its `title`, its
-  `map` (the map's path), its `kind` (its type) and `blocked_by` (its
-  blockers); a claim sets `status: in-progress` and the
-  `assignee`, and a resolution writes the Answer and sets `done`, or
-  `out-of-scope`
+  its `type`, whose fields the Guide's `reference/wayfinding-types` lists; a
+  claim sets its `status` to `in-progress` and its `assignee`, and a
+  resolution writes its Answer and sets `done`, or `out-of-scope`
 - Research: `research/<slug>.md`
 - Architecture reports (improve-codebase-architecture): `architecture/<slug>.html`
 - Handoffs: `handoffs/<slug>.md`

package/guide/reference/access-level.md

@@ -2,7 +2,7 @@
 
 How much of a Room a grant or a Share lets its holder do with its text, and where.
 
-Access level, `level` on a Room grant or a Share’s Room item, each level including the one before it: `search`, the Search level, reaches the Room through `search`, `shell` and `inspect` alone, each reply at most <mcp-read-size> of the Room’s text, with no copy anywhere; `open`, the Open level, also opens the Room in browser Apps while the browser is online, and acts as `search` everywhere else; `keep`, the Keep level, also copies the Room to the devices that keep it, offline included, and is the one `export` needs. Apps need `open` or `keep`.
+Access level, `level` on a Room grant or a Share’s Room item, each level including the one before it: `search`, the Search level, reaches the Room through `shell` and `inspect` alone, each reply at most <mcp-read-size> of the Room’s text, with no copy anywhere; `open`, the Open level, also opens the Room in browser Apps while the browser is online, and acts as `search` everywhere else; `keep`, the Keep level, also copies the Room to the devices that keep it, offline included, and is the one `export` needs. Apps need `open` or `keep`.
 
 ```json
 { "room_ref": "r_ab12.1", "level": "open", "operations": ["write"] }

package/guide/reference/agent-function.md

@@ -2,16 +2,14 @@
 
 How an Agent function document in the Private Room is written, one for each Room it serves.
 
-Agent function, `/rooms/private/rooms/<room-handle>/agent-functions/<name>.md`, serving the Room `<room-handle>` names: `description`; `input`, a text saying what to send, empty if nothing; `agent`, the identifier of the one of your User's current Agents it starts; and `afk`, `true` for a run nobody watches, off when absent, under which Kit answers every question and permission prompt of the conversation a request starts by itself, for that conversation's life. The body is the instruction, which never leaves the Private Room. Writing it needs your User's write in that Room. House writes its card, the description, input and Agent, at `/rooms/<room-handle>/house/agent-functions/<name>.md`, where every member reads it, and refuses a name a card there already holds as `agent_function_name_taken`. An Agent function a second Room needs is a copy under that Room's handle. Anyone who writes that Room asks it with `agent-functions/send` naming the card, or names the `agent` with their own words, as the Agent's Trust level in that Room allows: under Any request, the default, either starts at once; under Agent functions only the card starts at once and own words are refused `own_text_not_admitted`; under Approve each either waits for the Agent's owner to approve it. Its owner sets the level on the Agent's House page; the owner, their own agents and their Private Room's Triggers start it at once at every level, a Trigger of any other Room asks as that Room's writers do, and `inspect` on a Room root names the Agents you may ask there with their levels. An Agent function request's input is text the Agent reads, and House checks no shape. Mail your conversation sends with `agent-functions/mail/send` and a request it sent reaches the conversation that request started at once under Any request; below it, `agent-functions/mail/send` answers `waiting: true` and the mail waits for that Agent's owner, and a declined one comes back to you as House's message saying so. That conversation's mail always comes back to yours. A request's run is the first turn of the conversation it starts: during that turn the Agent names the document it wrote in the request's Room as the request's result with `agent-functions/result/set`, and the turn's end finishes the request. The conversation stays active until it is Done, which `conversations/mark-done` sets at the end of a turn and which nothing undoes, so mail reaches it after its run.
+Agent function, `/rooms/private/rooms/<room-handle>/agent-functions/<name>.md`, serving the Room `<room-handle>` names: `description`; `input`, a text saying what to send, empty if nothing; `agent`, the identifier of the one of your User's current Agents it starts; and `afk`, `true` for a run nobody watches, off when absent, under which Kit answers every question and permission prompt of the conversation a request starts by itself, for that conversation's life. The body is the instruction, which never leaves the Private Room. Writing it needs your User's write in that Room. House writes its card, the description, input, Agent and `answer`, at `/rooms/<room-handle>/house/agent-functions/<name>.md`, where every member reads it, and refuses a name a card there already holds as `name_taken`. An Agent function a second Room needs is a copy under that Room's handle. While its document is not written in this form, every request for it is refused `agent_function_unreadable`. Anyone who writes that Room asks it with `agent-functions/send` naming the card, or names the `agent` with their own words, as the Standing answer there allows: the card's `answer`, or the Agent's for own words. `at_once`, the default, starts it; `ask_me` waits for the owner's approval; `off` refuses it, `agent_function_not_admitted` or `own_text_not_admitted`. Only the owner sets an answer, on the Room's House page; no field of this document holds one. The owner, their agents and their Private Room's Triggers start at once under every answer, a Trigger of another Room asks as its writers do, and `inspect` on a Room root names the Agents you may ask there with their answers. An Agent function request's input is text the Agent reads, and House checks no shape. Mail your conversation sends with `agent-functions/mail/send` and a request it sent reaches the conversation that request started at once where that Agent's own-words answer there is `at_once`; otherwise `agent-functions/mail/send` answers `waiting: true` and the mail waits for that Agent's owner, and a declined one comes back to you as House's message saying so. That conversation's mail always comes back to yours. A request's run is the first turn of the conversation it starts: during that turn the Agent names the document it wrote in the request's Room as the request's result with `agent-functions/result/set`, and the turn's end finishes the request. The conversation stays active until it is Done, which `conversations/mark-done` sets at the end of a turn and which nothing undoes, so mail reaches it after its run.
 
 A Trigger's `message` action puts its `text`, a link to what matched and its files into the active conversation, one not Done, its Agent function started from that Room for what the Event is about: the chat of a customer's `chat-message`, the matched document or item, or the Trigger for a `cron` clock. Its Event shows `continued` with that `request`; with none, it starts the Agent function as a `agent_function` action does, `requested`. A conversation waiting for approval refuses it, `refused` with `conversation_waiting`. The Agent reads a customer's message as a customer's words, one from a Trigger of its owner's Private Room as the owner's instruction, and any other as what matched, never an instruction. A `agent_function` action starts a new request on every Event. A `done` action marks Done every active conversation a request of its Trigger's Room started for the Event's document, whoever owns its Agent, but one waiting for approval, which stays for its owner to approve or decline; its Event shows `marked` with their number, `conversations`, 0 when there are none, as on a `cron` clock, whose Event names no document.
 
 ```markdown
----
-description: Summarize a thread in five bullets.
-input: The thread to summarize, as a ref or pasted text.
-agent: 019a0000-0000-7000-8000-000000000001
----
+- **Description**: Summarize a thread in five bullets.
+- **Input**: The thread to summarize, as a ref or pasted text.
+- **Agent**: 019a0000-0000-7000-8000-000000000001
 
 Read the thread and write five bullets under summaries/.
 ```

package/guide/reference/app-manifest.md

@@ -2,7 +2,9 @@
 
 What an App's `app.json` declares.
 
-App manifest, `app.json` at an App’s root: `entry`, its HTML page, and `room_slots`, each with a `name`, `access` `read` or `write`, and `types` from the `schema.yaml` beside it, written like a Room schema; `apps/bindings/set` fills a slot with Rooms. Where needed it adds `external_origins`, the https origins its page may reach; `conversations: true` to read your User’s conversations; `inboxes: true` to show customer chats, naming `chat` and `chat-message` in `room_slots`, and answer them through `chats/reply`, since only House writes a chat's documents; `house_acts`, the House acts it calls by their act names, such as `rooms/list` for your User’s Rooms or `rooms/rename`, never one only a person takes or one that changes what an App reaches, except that a Self-hosted Building's App may declare its administrators' acts, `building/people/list`, `building/people/add`, `building/people/remove`, `building/administrators/name`, `building/administrators/take`, `building/factor/require`, `building/factor/stop-requiring` and `building/factor/reset`, which its page calls in an administrator's browser once it has asked them to confirm each; `functions`, each a `name` and the `entry` file a Trigger runs on House's servers ([App functions](apps/functions)); and `theme_colour`, `#rrggbb`. A User who does not own the App is asked nothing when it opens and once to allow each House act it declares, at the App’s first call of that act, which waits on the answer; a declined one is refused. Nobody is asked about an act they have no right to use, and it is refused them unasked, the App's owner included: the administrators' acts `not_building_administrator` to anyone who is no administrator, and `rooms/create`, the acts that change another member's access, `rooms/access/entries/set`, `rooms/access/schema-roles/set` and `rooms/access/revoke`, and the owner acts the Private Room never admits, `rooms/archive`, `rooms/unarchive`, `rooms/public/set`, `rooms/rename`, `rooms/space/set`, `rooms/delete` and `rooms/ownership/cancel`, `operation_denied` to anyone who manages no Room but their Private Room. [Build an App](apps/build) shows how its page works.
+App manifest, `app.json` at an App’s root: `entry`, its HTML page, and `room_slots`, each with a `name`, `access` `read` or `write`, and `types` from the `schema.yaml` beside it, written like a Room schema; `apps/bindings/set` fills a slot with Rooms. Where needed it adds `external_origins`, the https origins its page may reach; `conversations: true` to read your User’s conversations; `inboxes: true` to show customer chats, naming `chat` and `chat-message` in `room_slots`, and answer them through `chats/reply`, since only House writes a chat's documents; `house_acts`, the House acts it calls by their act names, such as `rooms/list` for your User’s Rooms or `rooms/rename`, never one only a person takes or one that changes what an App reaches, except that a Self-hosted Building's App may declare its administrators' acts, `building/people/list`, `building/people/add`, `building/people/remove`, `building/administrators/name`, `building/administrators/take`, `building/factor/require`, `building/factor/stop-requiring` and `building/factor/reset`, which its page calls in an administrator's browser once it has asked them to confirm each; `functions`, each a `name` and the `entry` file a Trigger runs on House's servers ([App functions](apps/functions)); and `theme_colour`, `#rrggbb`: declare the colour of your page's top, which the installed App's title bar and a phone's top strip take, with `theme_colour_dark` where your dark mode's top differs. A User who does not own the App is asked nothing when it opens and once to allow each House act it declares, at the App’s first call of that act, which waits on the answer; a declined one is refused. Nobody is asked about an act they have no right to use, and it is refused them unasked, the App's owner included: the administrators' acts `not_building_administrator` to anyone who is no administrator, and `rooms/create`, the acts that change another member's access, `rooms/access/entries/set`, `rooms/access/schema-roles/set` and `rooms/access/revoke`, and the owner acts the Private Room never admits, `rooms/archive`, `rooms/unarchive`, `rooms/public/set`, `rooms/rename`, `rooms/space/set`, `rooms/delete` and `rooms/ownership/cancel`, `operation_denied` to anyone who manages no Room but their Private Room. [Build an App](apps/build) shows how its page works.
+
+Where the Building runs its own bot, the administrators' acts include a person's [one-time link](reference/telegram-link).
 
 ```json
 {

package/guide/reference/group-post.md

@@ -0,0 +1,7 @@
+# Group post
+
+How a Trigger's `notify` action posts in its Room's Telegram group, the one `rooms/telegram/attach` attaches, in place of each User's own notices.
+
+With `in_group: true`, e.g. `{kind: "notify", title: "Booking today", text: "A same-day booking came in.", to: {roles: ["admin"]}, in_group: true}`, the action posts once in the group's General topic: its title and text, an Open in House button to what matched, and each User it names who reads the Room, as many as one message holds, mentioned through Telegram, or by display name where they have not linked it. Nobody needs to agree to it, nobody is told on their own channels, and the post is not kept in the Room, so no Trigger fires on it.
+
+`triggers/fired/list` shows it `posted` with how many it `mentioned`; `no_target` with `no_group` while the Room has no group or its group is paused, at the firing or the send, and with `no_recipient` when it names no reader; or `failed` with `post_not_confirmed` when Telegram refused it, after one try more past a wait it named, or gave no answer. That post is never sent again, and the Room's owner and the Trigger's creator hear that it needs fixing.

package/guide/reference/inbox-types.md

@@ -0,0 +1,7 @@
+# Inbox types
+
+The `chat` and `chat-message` types every Room knows without declaring them, as House declares them: an Inbox chat's card and its messages, which only House writes. Each value is written in the document's body as [Schema](reference/schema) says.
+
+```yaml
+<inbox-types>
+```

package/guide/reference/schema.md

@@ -2,29 +2,38 @@
 
 How a Room's `settings/schema.yaml` declares its document types.
 
-Schema, `/rooms/<room>/settings/schema.yaml`: one JSON Schema in YAML. Each top-level key is an MD type holding the schema of its frontmatter; `$defs` holds shapes reused through `$ref: '#/$defs/<name>'`. An object setting neither `additionalProperties` nor `unevaluatedProperties` refuses other keys. House adds `reference` on a string at any depth, naming the types, or `attachment`, its value links to, and `cross_room: true` beside it, letting that be another Room's document of those types; a link or reference written as its `/rooms/<room>/` path is stored relative to the document; `sections`, a type's `##` headings, each `{ kind: text }` or `{ kind: list, items }`; and `member_document: true` on one type, whose documents name their member with `member`, a User Identifier from `rooms/members/list`. On a type, `create_roles` lists the Schema Roles that may create its documents and `delete_roles` those that may delete them, and changing a document's `type` needs both; on a field of a type's own `properties`, `change_roles` lists those that may change it, `initial_roles` those that may set it on a new document, and `transitions` the `{from, to, roles}` changes it may make, `null` standing for absent; `owner` and `member` are built in, `[]` allows nobody, and only someone who manages the Room's access changes them. `files_batch` creates or replaces the whole text, and may rewrite the documents a change breaks in the same call.
+Schema, `/rooms/<room>/settings/schema.yaml`: one JSON Schema in YAML. Each top-level key is an MD type holding the schema of its documents' values; `$defs` holds shapes reused through `$ref: '#/$defs/<name>'`. An object setting neither `additionalProperties` nor `unevaluatedProperties` refuses other keys. House adds `reference` on a string at any depth, naming the types, or `attachment`, its value links to, and `cross_room: true` beside it, letting that be another Room's document of those types; a link or reference written as its `/rooms/<room>/` path is stored relative to the document; `title` on a field, the label a document shows for it, its key when it has none; `contentMediaType: text/markdown` on a string, Markdown text under its own heading; and `member_document: true` on one type, whose documents name their member with `member`, a User Identifier from `rooms/members/list`. On a type, `create_roles` lists the Schema Roles that may create its documents and `delete_roles` those that may delete them, and changing a document's `type` needs both; on a field of a type's own `properties`, `change_roles` lists those that may change it, `initial_roles` those that may set it on a new document, and `transitions` the `{from, to, roles}` changes it may make, `null` standing for absent; `owner` and `member` are built in, `[]` allows nobody, and only someone who manages the Room's access changes them. `files_batch` creates or replaces the whole text, and may rewrite the documents a change breaks in the same call.
 
-A Room in a Space shows its Space's schema at that path and keeps none of its own: its owner and a member who can write in the Space change it there, a rule keyword only someone who manages the Space, in an edit holding that change alone, checked against every document of every Room of the Space; a change that would break any document is refused naming it, so change that document in its own edit first. A Room taken out of its Space keeps the last version as its own.
+A Room in a Space shows its Space's schema at that path and keeps none of its own: its owner and a member who can write in the Space change it there, a rule keyword only someone who manages the Space, in an edit holding that change alone, checked against every document of every Room of the Space; a change that would break any document is refused naming it, so change that document in its own edit first. A Room taken out of its Space keeps the last version as its own. Every Room also knows the [Inbox types](reference/inbox-types) and the [Wayfinding types](reference/wayfinding-types) without declaring them.
+
+A typed document keeps only `type`, `member`, `submitted` and House's other keys in its frontmatter and writes its values in its body: `name` as its `#` line; under it each short value as one `- **Label**: value` line, yes or no as `- [x] Label` or `- [ ] Label`, a reference as a link, a group of short values as an indented list under its label and a list of plain values as indented bullets; a Markdown text, or a value holding a line break, under its own `##` heading, one level deeper per level of nesting; rows of short values as a table whose column headings are labels; any other list as one heading per item, named by the item's `name`; and a value of no single JSON type as one fenced `json` block under its heading. Values come in any order and in any spelling GitHub Markdown reads alike. The list directly under the `#` line is the value list; a heading naming no field, the text around the values and everything after a `---` line is free text. A refusal names the line: `repeated-value` for a value written twice, `unknown-label` for a value line naming no field, `malformed-value` for a value its type's form does not read. Changing a `title` relabels every document of the type.
 
 ```yaml
 person:
   member_document: true
   properties:
-    role: { type: string }
+    name: { type: string }
+    role: { type: string, title: Role }
 task:
   properties:
-    title: { type: string }
-    status: { enum: [open, done] }
-    owner: { type: string, reference: person }
-  required: [title]
-  sections:
-    Notes: { kind: text }
+    name: { type: string }
+    status: { enum: [open, done], title: Status }
+    owner: { type: string, reference: person, title: Owner }
+    notes: { type: string, contentMediaType: text/markdown, title: Notes }
+  required: [name]
 ```
 
 ```markdown
 ---
-type: person
-member: <User Identifier from rooms/members/list>
-role: Designer
+type: task
 ---
+
+# Ship the release
+
+- **Status**: open
+- **Owner**: [Ada](../people/ada.md)
+
+## Notes
+
+What is left before Friday.
 ```

package/guide/reference/telegram-link.md

@@ -0,0 +1,11 @@
+# One-time link
+
+How a Self-hosted Building's App gives a person a one-time link to the Building's own bot, and undoes one taken wrongly.
+
+An App of a Self-hosted Building that runs its own bot may declare `building/people/telegram-link` and `building/people/telegram-link/undo` beside its administrators' other acts, which its page calls in an administrator's browser once it has asked them to confirm each, and which anyone who is no administrator is refused unasked, `not_building_administrator`.
+
+`building/people/telegram-link` takes `{person}`, the id `building/people/list` answers, and answers `{link}`, the bot's start address with a code bound to that person, which the administrator sends them in Telegram. It is given a person added by name who has not registered, whose account its first Join registers with that Telegram account, no email and the name they were added under, or a person who holds an account and an email, to whom it adds that Telegram account; anyone else is refused `telegram_link_refused`. The link works once, lapses after a day, and a fresh copy replaces the one before. A Telegram account another person holds is refused in the bot.
+
+`building/people/list` answers beside each person their link's `telegram_link`, `waiting`, `lapsed` or `taken`, and `telegram_name`, the name of the Telegram account that took it.
+
+`building/people/telegram-link/undo` takes `{person}`. Where the link registered the account, it removes that account as `building/people/remove` does, the administrator who undoes it as successor, and the person is listed again as added, under their id, so a fresh link can be copied and that Telegram account may take it. Where it added Telegram to an account the person held, it unlinks that Telegram account alone.

package/guide/reference/triggers.md

@@ -2,14 +2,16 @@
 
 How a Trigger's `condition` and `actions` are written for `triggers/create` and `triggers/edit`; House writes a Room's Triggers as read-only `house-trigger` documents at `house/triggers/<trigger>.md`.
 
-`condition`: When it fires: `on`, a `query` in the [Local Query](apps/local-query) language, at most one of `types`, `pathPrefix` or `paths` (one document, followed when it moves) and a `where`, naming a member by their member document's path, then the change tests. A task becoming ready: `{on: "documents", query: {types: ["task"], where: {"/status": "review"}}}`, firing as it starts to match, a new one only with `new_documents: true`. A field moving: `changes: {field: "/status", from: ["open"], to: ["done"]}`, or `from: "new"`, `to: "deleted"`; a section `{section: "Notes"}`; any edit `"text"`. `by: {"/door": "browser", "/user": "<User id>"}` tests who changed it and how; `moved_between_rooms: true` only a move between Rooms. Items: `{on: "items", query: {where: {"/address": "<address>", "/json/ref": "refs/heads/main"}}}`, also `/source`, `/delivery`, `/headers/<name>`. A clock is `{on: "clock", cron: "0 9 * * 1", time_zone: "Europe/Berlin"}`, or a day before each task is due: `{on: "clock", query: {types: ["task"], where: …}, date: "/due", days: -1, at: "09:00", time_zone: "Europe/Berlin"}`. In your Private Room alone, a notification to you: `{on: "notifications", query: {where: {"/kind": "share-offer"}}}` over its `house-notification` document; such a Trigger holds no `notify` action. A refusal names the test and what it takes.
+`condition`: When it fires: `on`, a `query` in the [Local Query](apps/local-query) language, at most one of `types`, `pathPrefix` or `paths` (one document, followed when it moves) and a `where`, naming a member by their member document's path, then the change tests. A task becoming ready: `{on: "documents", query: {types: ["task"], where: {"/status": "review"}}}`, firing as it starts to match, a new one only with `new_documents: true`. A field moving: `changes: {field: "/status", from: ["open"], to: ["done"]}`, or `from: "new"`, `to: "deleted"`; any edit `"text"`. `by: {"/door": "browser", "/user": "<User id>"}` tests who changed it and how; `moved_between_rooms: true` only a move between Rooms. Items: `{on: "items", query: {where: {"/address": "<address>", "/json/ref": "refs/heads/main"}}}`, also `/source`, `/delivery`, `/headers/<name>`. A clock is `{on: "clock", cron: "0 9 * * 1"}`, or a day before each task is due: `{on: "clock", query: {types: ["task"]}, date: "/due", days: -1, at: "09:00"}`, in the Room's time zone unless `time_zone: "UTC"` names another. In your Private Room alone, a notification to you: `{on: "notifications", query: {where: {"/kind": "share-offer"}}}` over its `house-notification` document; such a Trigger holds no `notify` action. A refusal names the test and what it takes.
 
 A message into a conversation the Room's [Agent function request](reference/agent-function) started: `{on: "messages", query: {where: {"/sender": "requester"}}}`, testing `/sender`, `/agent_function` and `/path`, the request's document, never its words.
 
-`actions`: a `notify` action names whom it reaches, e.g. `{kind: "notify", title: "Ready", text: "A task waits.", to: {users: ["<User id>"], fields: ["/members/assignee"], roles: ["owner"]}}`, Users by id, the member a field of the matched document names, and every holder of a Schema Role; a `function` action names an App and one function its latest release declares, e.g. `{kind: "function", app: "a_…", function: "assign lead"}`, which you may add only for an App you hold with this Room in a write slot of your bindings; [App functions](apps/functions) says how House runs it. `triggers/fired/list` shows each run `ran` with its `release`, or `failed` (`function_failed`, its `error`), never run again, or `function_not_started` while House tries, `final` after its last try.
+`actions`: a `notify` action names whom it reaches, e.g. `{kind: "notify", title: "Ready", text: "A task waits.", to: {users: ["<User id>"], fields: ["/members/assignee"], roles: ["owner"]}}`: Users by id, the member a matched document's field names and each Schema Role holder; a `function` action names an App and a function its latest release declares, e.g. `{kind: "function", app: "a_…", function: "assign lead"}`, only for an App you hold with this Room in a write slot of your bindings and run as [App functions](apps/functions) says; `triggers/fired/list` shows each run `ran` with its `release`, or `failed` (`function_failed`, its `error`), never run again, or `function_not_started` while House tries, `final` after its last try.
 
-In your Private Room alone, a `function` action naming no `app` runs one of your Environment functions ([wizard](skills/wizard)), e.g. `{kind: "function", function: "nightly backup"}`; elsewhere, or for one you do not hold, it is refused `environment_function_not_found`. Kit runs its script with no terminal, the Event as JSON in the file `HOUSE_INPUT` names, one Event at a time. `triggers/fired/list` shows each run `ran` or `failed` (`function_failed`, its `error`), never run again, with its `run`, `exit_code` and `output`; a Kit not connected at its turn reads `no_target` with `environment_offline`, never run later.
+A `notify` action with `in_group` is a [Group post](reference/group-post).
 
-A Trigger acts on at most <trigger-events-per-hour> Events in each UTC hour, across its versions, skipped and failed ones not counted; `triggers/fired/list` shows the first past the number `missed: "skipped"` with `code: "cap_reached"`, which starts nothing, and none later that hour; the Trigger shows as failing. A Trigger whose own actions make what it fires on stops there, so narrow its condition.
+In your Private Room alone, a `function` action naming no `app` runs one of your Environment functions ([wizard](skills/wizard)), e.g. `{kind: "function", function: "nightly backup"}`; elsewhere, or for one you do not hold, it is refused `not_found`. Kit runs its script with no terminal, the Event as JSON in the file `HOUSE_INPUT` names, one Event at a time. `triggers/fired/list` shows each run `ran` or `failed` (`function_failed`, its `error`), never run again, with its `run`, `exit_code` and `output`; a Kit not connected at its turn reads `no_target` with `environment_offline`, never run later.
 
-`{kind: "agent_function", card: "<name>", payload: "<input>"}` starts an [Agent function](reference/agent-function) and `{kind: "message", card: "<name>", text: "<text>"}` messages it; no such card is refused `agent_function_not_found`, a retired one `agent_function_retired`. `{kind: "done"}` marks Done each active conversation the Room's Agent function requests started for the Event's document, `marked` with their number.
+A Trigger acts on at most <trigger-events-per-hour> Events in each UTC hour, across its versions, skipped ones not counted; `triggers/fired/list` shows the first past the number `missed: "skipped"` with `code: "cap_reached"`, which starts nothing, and none later that hour; the Trigger shows as failing; narrow the condition of one whose own actions make what it fires on.
+
+`{kind: "agent_function", card: "<name>", payload: "<input>"}` starts an [Agent function](reference/agent-function) and `{kind: "message", card: "<name>", text: "<text>"}` messages it; no such card is refused `not_found`, a retired one `agent_function_retired`, and one whose document misses its type's form fails `agent_function_unreadable` for good. `{kind: "done"}` marks Done each active conversation the Room's Agent function requests started for the Event's document, `marked` with their number.

package/guide/reference/wayfinding-types.md

@@ -0,0 +1,7 @@
+# Wayfinding types
+
+The `wayfinding-map` and `wayfinding-ticket` types every Room knows without declaring them, as House declares them: a Wayfinding map and its tickets. Each value is written in the document's body as [Schema](reference/schema) says.
+
+```yaml
+<wayfinding-types>
+```

package/guide/sites/build.md

@@ -11,7 +11,7 @@ Build it as [Build an App](apps/build) says, with what follows. Anything private
 - A Site is public: anyone opens it, nobody signs in, and every visitor reads its bound Rooms, which must be your User's own and never the Private Room.
 - Everything it shows lives as documents in its Room; put its demo data there, never in code.
 - A visitor's edits stay in their browser and never reach House: write them with `save` as an App does.
-- To receive messages from visitors, name an Intake Room with `sites/intake-room/set` and send each with `runtime.call('sites/submissions/create', { content })`, online only. `content` is one Markdown document the Intake Room's `settings/schema.yaml` accepts, and House adds its `site` and `received` fields. The call answers `{ kind: 'action', result: { submitted: true } }` once House stored it. Anything else stored nothing: `{ kind: 'rejected', code }` says why, such as `bot_check_failed` for a browser that failed the bot check, as automated test browsers do, `site_intake_room_absent`, `invalid_documents` with the `path`, `rule` and `field` it broke, `submission_reserved_key`, `submission_too_large`, `limit_reached` or `cap_reached`. So thank the visitor only for `submitted`, and otherwise show that nothing was sent.
+- To receive messages from visitors, name an Intake Room with `sites/intake-room/set` and send each with `runtime.call('sites/submissions/create', { content })`, online only. `content` is one Markdown document the Intake Room's `settings/schema.yaml` accepts, and House adds its `site` and `submitted` fields. The call answers `{ kind: 'action', result: { submitted: true } }` once House stored it. Anything else stored nothing: `{ kind: 'rejected', code }` says why, such as `bot_check_failed` for a browser that failed the bot check, as automated test browsers do, `site_intake_room_absent`, `invalid_documents` with the `path`, `rule` and `field` it broke, `submission_reserved_key`, `submission_too_large`, `limit_reached` or `cap_reached`. So thank the visitor only for `submitted`, and otherwise show that nothing was sent.
 - `sites/describe` sets the title and description search engines show.
 - With `google_analytics_id` set by `sites/describe`, House measures a visitor only after they accept. While `bridge.onStatus` reports `analytics.measures`, ask them on the Site unless `analytics.choice` holds their answer, report it with `bridge.analyticsConsent('accept')` or `bridge.analyticsConsent('decline')`, and keep a way on every page to decline later, which reloads the page unmeasured.
 - See it yourself: open its url, which needs no sign-in.

package/guide/skills/house-onboarding.md

@@ -1,6 +1,6 @@
 ---
 name: house-onboarding
-description: Find out what a new User wants from House and keep their plan as a Wayfinding map and tickets in a Room you make for it; run it while your User owns no Room but the Private Room.
+description: Find out what a new User wants from House and keep their plan as a Wayfinding map and tickets in a Room you make for it.
 ---
 
 # House Onboarding
@@ -21,5 +21,5 @@ Run `wayfinder` to chart the map; this page adds only what is House's. `wayfinde
 - Keep decisions about the account, billing, runtime or credentials in the Private Room, `/rooms/private`.
 - Make the App for your User's goal a ticket.
 - Write the pair that starts an Agent on a ticket a person sets `status: in-progress` with it as its assignee: for yourself when you run as one of your User's Agents, and for another of them when your User asks, each named by the id `agents/list` answers for it.
-- The pair's Agent function is the text of [Work on ticket](agent-functions/work-on-ticket) with `agent: "<agent id>"` added to its frontmatter, written to `/rooms/private/rooms/<room-handle>/agent-functions/work-on-ticket.md` for the plan's Room, or to `work-on-ticket-<n>.md`, `<n>` the next free number from 2, when that name is taken.
+- The pair's Agent function is the text of [Work on ticket](agent-functions/work-on-ticket) with a `- **Agent**: <agent id>` line added to its values, written to `/rooms/private/rooms/<room-handle>/agent-functions/work-on-ticket.md` for the plan's Room, or to `work-on-ticket-<n>.md`, `<n>` the next free number from 2, when that name is taken.
 - Its Trigger is made by `triggers/create` in the plan's Room, described "Start <agent name> on a ticket a person sets in progress for it", with the one action `{"kind": "agent_function", "card": "<that file's name without .md>"}` and the condition `{"on": "documents", "query": {"types": ["wayfinding-ticket"], "where": {"/assignee/agent": "<agent id>"}}, "changes": {"field": "/status", "to": ["in-progress"]}, "by": {"/door": "browser"}}`, the id `agents/list` answers for that Agent.

package/owner-rules-earlier.json

@@ -8,5 +8,7 @@
   "d14166e300ce35455ca51ec4959c2bc77668e5cb7f890d2b89c4d2c1e02af6b5",
   "e612bbaa90e41d60b9bcd0367a074b9735b9239c287e56fa1becc8364562a422",
   "1148f2eec3f500c66c4678a8ce9ab215c095692f505af1934574da6072f4f1a4",
-  "42b31e675bfb35457a6cc94a54a58b180e4e646a83cb480701ee2e6259a84ee7"
+  "42b31e675bfb35457a6cc94a54a58b180e4e646a83cb480701ee2e6259a84ee7",
+  "ca9cf3104780486a72aac353a27ddc0f4479145de197c6ce28e4d0b5672de11b",
+  "2dec7ab02503f62a30605f0f976c36a8f4ed5da1b5de4750ac6550c511cddafe"
 ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentshouse/skills",
-  "version": "0.1.0-c7cb7e6f4dffa",
+  "version": "0.1.0-c7dbb0a4b158c",
   "description": "The upstream Skills agents.house serves its agents, verbatim, and the texts it writes for them: the Guide, its own Skills among the pages, and the Agent instructions",
   "license": "MIT",
   "type": "module",

package/upstream.json

@@ -1,7 +1,7 @@
 {
   "repository": "https://github.com/mattpocock/skills",
-  "commit": "4ae2317ddb22b046e26455e4f9c9b3aaaf62212d",
-  "date": "2026-10-31",
+  "commit": "5863806dd4e15c63174bee4e7515a4256792ecfa",
+  "date": "2026-11-12",
   "skills": [
     "ask-matt",
     "code-review",