@nanonets/graft 0.24.0 → 0.25.0

package/dist/cli.js

@@ -11,8 +11,8 @@
 import { spawnSync } from "node:child_process";
 import "dotenv/config";
 import { Command } from "commander";
-import { statSync } from "node:fs";
-import { basename, dirname, join, relative, resolve } from "node:path";
+import { readFileSync, statSync } from "node:fs";
+import { basename, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Graft } from "./engine.js";
 import { resolveConfig } from "./ai/providers.js";
@@ -21,12 +21,13 @@ import { formatGraphCheckReport } from "./graph/check.js";
 import { buildGraphIfMissing, runInit } from "./claude/init.js";
 import { statuslineWanted } from "./claude/settings-merge.js";
 import { runHostsInit } from "./hosts/init.js";
+import { codexStatusLines, codexTrustLine } from "./hosts/codex-trust.js";
 import { hostIds } from "./hosts/registry.js";
-import { checkoutRoot, ensureRepoHome, keepsNotes, rememberRepo, repoName, repoPlace, shownPath } from "./notes/home.js";
+import { checkoutRoot, ensureRepoHome, keepsNotes, rememberRepo, repoName, repoPlace } from "./notes/home.js";
 import { brand, cmd, graftNotice, strandedRepoNotice, tag } from "./brand.js";
 import { branchDiff } from "./cloud/diff.js";
 import { openBrowser } from "./util/browser.js";
-import { learningsAtBase, teammateEdits, withBaseLearnings } from "./check/learning-edits.js";
+import { committedAtBase, learningsAtBase, teammateEdits, withBaseLearnings } from "./check/learning-edits.js";
 import { contextDirFor } from "./context/node-file.js";
 import { loadGraphCached } from "./graph/load.js";
 import { ensureFreshChildren, ensureFreshGraph, refreshNote } from "./graph/refresh.js";
@@ -39,8 +40,9 @@ import { runWorkspaceAsk, runWorkspaceBuild, runWorkspaceCallers, runWorkspaceCh
 import { formatInitEpilogue } from "./cli-epilogue.js";
 import { planInit, selectedWrites } from "./hosts/plan.js";
 import { planRetract, runRetract, changed } from "./hosts/retract.js";
-import { compactWrites, formatNonInteractiveHelp, formatPlan, pickLearnings, runPicker } from "./cli-picker.js";
+import { compactWrites, formatNonInteractiveHelp, formatPlan, runPicker } from "./cli-picker.js";
 import { buildGraphWithProgress } from "./claude/build-progress.js";
+import { installBrainsServer, removeBrainsServer } from "./hosts/claude-global.js";
 import { homedir } from "node:os";
 import { formatUpgradeReport, formatVersionReport, getNpmViewVersion, readCurrentVersion, readPackageName, runUpgrade } from "./cli-meta.js";
 import { nativeFallbackNotice } from "./graph/native.js";
@@ -48,25 +50,31 @@ import { patchBuildConfig } from "./util/state.js";
 import { normalizePathPrefix } from "./util/paths.js";
 import { latestSession, formatSessionStats, sessionInputRate } from "./claude/session-metrics.js";
 import { listSessionIds, readSession, sessionDir } from "./claude/state.js";
-import { costLabel, listNotes, noteName, notePlace, noteTargets, readingTokens, savedByNote, commitLines, PERSONAL_SAVED_LINE, PR_SPEEDUP, SECTIONS, tokensWorthSaying, sectionLead, shortDate, tokensLabel, writeNote, mentionedFiles } from "./notes/notes.js";
-import { findLearning, liveLearnings } from "./notes/learning-fields.js";
+import { costLabel, listNotes, noteName, notePlace, noteTargets, readingTokens, commitLines, PERSONAL_SAVED_LINE, PR_SPEEDUP, SECTIONS, tokensWorthSaying, sectionLead, shortDate, tokensLabel, writeNote, mentionedFiles } from "./notes/notes.js";
 import { aboutTerms, currentSessionCost } from "./notes/session-cost.js";
-import { beginPastRead, finishPastRead } from "./notes/cold-start.js";
-import { anchoredReviews, beginReviewRead, finishReviewRead } from "./notes/pr-reviews.js";
-import { finishMemoryRead, memoryCandidates, offeredBefore } from "./notes/memory-notes.js";
+import { flatLine, unmarkedWords } from "./notes/flatten.js";
+import { beginLookBack, finishLookBack } from "./init/run.js";
+import { keepCommand } from "./init/keep.js";
+import { recordInit, snapInit } from "./init/install-paths.js";
+import { finishPair, PairRun, validPairCode } from "./cloud/pair.js";
 import { currentBranch, noteAuthor, teammatesOn } from "./notes/git-facts.js";
+import { listSkills } from "./skills/skills.js";
+import { registerSkillCommands } from "./skills/cli-skills.js";
 import { gateNote, namesRepoSymbol, symbolCandidates, trackedFiles } from "./notes/note-gate.js";
-import { confirm, fold, getSkill, learn, listSkills, publish, skillForAgent, skillName, skillStatus } from "./skills/skills.js";
+import { recordLookup } from "./cloud/lookup-activity.js";
 import { clearPending, cloudLines, loginLink, sessionKey, waitForConnect } from "./cloud/nudge.js";
-import { addRepo, clearCloud, cloudEnabled, fetchMe, fetchTeam, isError, readCloud, writeCloud } from "./cloud/workspace.js";
-import { inWorkspace, maybeSyncInBackground, recordActivity, runSyncChild, syncRepo } from "./cloud/workspace-sync.js";
+import { addRepo, clearCloud, cloudEnabled, fetchMe, fetchTeam, isError, readCloud, serverUrl, trailUrl, useServer, writeCloud } from "./cloud/workspace.js";
+import { claimConnectCode, connectAgain, offlineLine, learningsSummary, machineName, normalizeCode, OnboardingReporter, repoRef, teammatesChecked, teammatesFromGit, tokensOnOneLookup, } from "./cloud/onboarding.js";
+import { inWorkspace, maybeSyncInBackground, recordActivity, runSyncChild, syncRepo, workspaceLearnings } from "./cloud/workspace-sync.js";
 import { checkLocally } from "./check/local-check.js";
+import { findLearning, learningFileName, liveLearnings } from "./notes/learning-fields.js";
+import { savedIdLine } from "./notes/replace.js";
 import { formatOverlap, maybeRefreshBranches, overlapsWith, pushedWhen, readBranchCache, refreshBranches } from "./notes/branches.js";
 import { ensureRepoTrail, LEARNINGS_DIR } from "./notes/repo-trail.js";
 import { setInputRate } from "./context/savings.js";
 import { formatUpdateNudge, maybeRefreshInBackground, readStamp, readUpdateCache, refreshUpdateCache, wiredHostIds, wiringOpts, writeStamp } from "./upkeep.js";
 import { shouldMoveToTrail } from "./upkeep-run.js";
-import { countBucket, savedTokensBucket, errorCode, filesBucket, durationBucket, formatDebug, formatStatus, firstRunNotice, isTrackedCommand, langsValue, offReason, maybeFlushInBackground, patchState, runFlush, track, trackFirstRunIfNew, } from "./telemetry/index.js";
+import { countBucket, errorCode, filesBucket, durationBucket, formatDebug, formatStatus, firstRunNotice, isTrackedCommand, langsValue, offReason, maybeFlushInBackground, patchState, runFlush, track, trackFirstRunIfNew, } from "./telemetry/index.js";
 const program = new Command();
 const currentVersion = readCurrentVersion(import.meta.url);
 /**
@@ -80,7 +88,7 @@ const TRAIL = brand() === "trail";
 /** Help-screen groups under trail; graft keeps its one flat list. */
 const GROUP = {
     find: "Find code · your agent runs these:",
-    memory: "Team memory:",
+    memory: "Learnings:",
     setup: "Setup:",
     cloud: "Workspace · your team's view, across repos:",
     ci: "CI:",
@@ -118,8 +126,8 @@ function noteHit(found) {
 program
     .name(brand())
     .description(TRAIL
-    ? "Memory for your coding agents: a code map, and the learnings each session\n" +
-        "leaves in your repo's .trail/, so your whole team's Claude starts from them."
+    ? "A code map for your coding agents, and the learnings each session leaves\n" +
+        "in your repo's .trail/, so everyone's Claude in the repo starts from them."
     : "Build a repo's context graph as linked markdown, and keep it in sync with the code.")
     .version(currentVersion, "-v, --version")
     .option("--dir <path>", "context graph directory (default: <repo>/graft)")
@@ -152,7 +160,7 @@ function warnUnsupportedExtensions(exts) {
         return;
     for (const e of bad) {
         const shown = e.trim().startsWith(".") ? e.trim() : `.${e.trim()}`;
-        console.error(`⚠ -e "${shown}": no parser registered for this extension — ignoring it.`);
+        console.error(`⚠ -e "${shown}": no parser registered for this extension, so it is ignored.`);
     }
     console.error(`  supported: ${supportedExtensions().join(" ")}`);
 }
@@ -169,7 +177,7 @@ function queryRoot(dir) {
         return resolve(dir);
     const { root, levels } = nearestGraftRoot(process.cwd(), program.opts().dir);
     if (levels > 0)
-        console.error(`${tag()} no code map here — answering from ${contextDirFor(root, program.opts().dir)}`);
+        console.error(`${tag()} no code map here: answering from ${contextDirFor(root, program.opts().dir)}`);
     return root;
 }
 /**
@@ -192,7 +200,7 @@ async function refreshBefore(dir, opts) {
 }
 /** Attached to every query command: `--no-refresh` answers from the graph exactly
  * as it is on disk, no rebuild. */
-const NO_REFRESH_FLAG = ["--no-refresh", "skip the freshness check — answer from the graph as-is"];
+const NO_REFRESH_FLAG = ["--no-refresh", "skip the freshness check: answer from the graph as-is"];
 const VIZ_TABS = ["context", "code", "outline"];
 /**
  * `--tabs context,code` → the tabs to write into an exported page.
@@ -208,7 +216,7 @@ function parseTabs(raw) {
     const want = raw.split(",").map((t) => t.trim()).filter(Boolean);
     const bad = want.filter((t) => !VIZ_TABS.includes(t));
     if (bad.length > 0 || want.length === 0) {
-        console.error(`✗ --tabs takes a comma-separated subset of ${VIZ_TABS.join(", ")}${bad.length ? ` — got "${bad.join('", "')}"` : ""}`);
+        console.error(`✗ --tabs takes a comma-separated subset of ${VIZ_TABS.join(", ")}${bad.length ? `, not "${bad.join('", "')}"` : ""}`);
         process.exit(1);
     }
     return want;
@@ -218,7 +226,7 @@ function parseTabs(raw) {
  * not editorialize on stderr at startup (`mcp` runs its own upkeep at boot, and
  * `_update-check` IS the fetch).
  */
-const UPKEEP_SKIP = new Set(["version", "upgrade", "_update-check", "_trail-past-read", "mcp"]);
+const UPKEEP_SKIP = new Set(["version", "upgrade", "_update-check", "mcp"]);
 /**
  * Every other command: top up the cached registry answer in the background and,
  * if a newer graft is out, say so once on stderr. This is what makes the CLI the
@@ -272,20 +280,6 @@ function spelling(action) {
 }
 // Hidden: spawned detached by maybeSyncInBackground when a workspace repo's
 // learnings changed, or uses are waiting to go. Running it by hand syncs now.
-// A repo that moved from graft to trail at session start reads its past
-// sessions and PR reviews here, detached, so the session doesn't wait on it.
-program
-    .command("_trail-past-read", { hidden: true })
-    .argument("<dir>")
-    .action(async (dir) => {
-    const repo = resolve(dir);
-    const read = beginPastRead(repo);
-    const reviews = beginReviewRead(repo);
-    if (read)
-        await finishPastRead(repo, read);
-    if (reviews)
-        await finishReviewRead(repo, reviews);
-});
 program
     .command("_trail-sync", { hidden: true })
     .description("internal: send this repo's learnings and the waiting uses to the Trail workspace")
@@ -307,6 +301,18 @@ program
     .action(async () => {
     await waitForConnect();
 });
+program
+    .command("_trail-pair", { hidden: true })
+    .description("internal: after `init --pair`, wait for the connect and the review in the browser, then upload the repo's learnings")
+    .argument("<state>")
+    .argument("<dir>")
+    .argument("[server]", "the Trail the run reported to (init's --server)")
+    .action(async (state, dir, server) => {
+    const base = serverUrl(server);
+    if (base)
+        useServer(base);
+    await finishPair(state, resolve(dir));
+});
 program
     .command("_update-check", { hidden: true })
     .description("internal: refresh the cached latest-version answer")
@@ -331,7 +337,7 @@ grouped(program.command("telemetry"), GROUP.setup)
             return;
         case "enable":
             patchState({ enabled: true });
-            console.log(`telemetry: on — anonymous, aggregate-only. \`${cmd("graft telemetry status")}\` for details.`);
+            console.log(`telemetry: on, anonymous and aggregate-only. \`${cmd("graft telemetry status")}\` for details.`);
             return;
         case "disable":
             // Also stamp the notice as shown: someone who has just opted out should
@@ -343,7 +349,7 @@ grouped(program.command("telemetry"), GROUP.setup)
             console.log(formatDebug());
             return;
         default:
-            console.error(`✗ unknown action "${action}" — expected status, enable, disable, or debug`);
+            console.error(`✗ unknown action "${action}": expected status, enable, disable, or debug`);
             process.exit(1);
     }
 });
@@ -385,7 +391,7 @@ function moveHereToTrail(dir) {
 grouped(program.command("build"), GROUP.setup)
     .description(TRAIL
     ? "Rebuild the code map in .trail/cache/ ($0, no key). --check fails if it's stale; --deep adds LLM summaries."
-    : "Build graft/ from your code — wiring graph + per-file cards ($0, no key). " +
+    : "Build graft/ from your code: wiring graph + per-file cards ($0, no key). " +
         "Add --deep for the LLM concept map + per-symbol summaries/crux.")
     .argument("[dir]", "repository root", ".")
     .option("--check", "build nothing: fail if graft/ is stale relative to the code (for CI)")
@@ -403,9 +409,9 @@ grouped(program.command("build"), GROUP.setup)
     .option("--follow-nested-repos", "include nested Git clones the index does not track (a multi-repo manifest checkout, or any repo cloned into the tree) " +
     "as ONE graph, so imports across them resolve; persisted for later builds and automatic refreshes")
     .option("--no-follow-nested-repos", "exclude untracked nested Git clones; persisted for later builds and automatic refreshes (default)")
-    .option("--include-dir <name>", "override SKIP_DIRS for this repo's walks — repeatable (e.g. --include-dir build --include-dir tools); " +
+    .option("--include-dir <name>", "override SKIP_DIRS for this repo's walks, repeatable (e.g. --include-dir build --include-dir tools); " +
     "persisted, so a later build (and the hooks/refresh path) include it without the flag; dot-dirs are never overridable", (val, prev) => [...prev, val], [])
-    .option("--only-dir <path>", "only index files under this repo-relative path — repeatable; the wiring walk and the --deep " +
+    .option("--only-dir <path>", "only index files under this repo-relative path, repeatable; the wiring walk and the --deep " +
     "concept pass both honor it. Recorded in the graph fingerprint so a later build " +
     "(and the hooks/refresh path) walks the same set; everything outside the list is skipped", (val, prev) => [...prev, val], [])
     .option("--no-gitignore", "skip writing graft/ into .gitignore (same as GRAFT_NO_GITIGNORE=1)")
@@ -494,12 +500,12 @@ grouped(program.command("build"), GROUP.setup)
     const resolved = resolveConfig(cliConfig());
     if (deep && !resolved.apiKey) {
         deep = false;
-        console.error("⚠ no API key set — falling back to the structural build (no LLM summaries).\n" +
+        console.error("⚠ no API key set, so falling back to the structural build (no LLM summaries).\n" +
             "  Set GRAFT_API_KEY (and GRAFT_PROVIDER / GRAFT_BASE_URL / GRAFT_MODEL for your\n" +
             `  provider) and re-run \`${cmd("graft build --deep")}\` to add concept nodes and summaries.`);
     }
     if (deep && resolved.usedLegacyEnv) {
-        console.error("⚠ using OPENROUTER_API_KEY (deprecated) — prefer GRAFT_API_KEY + GRAFT_BASE_URL.");
+        console.error("⚠ using OPENROUTER_API_KEY (deprecated): prefer GRAFT_API_KEY + GRAFT_BASE_URL.");
     }
     // Workspace parent: build each child into its OWN graft/ + a workspace index.
     const buildRoot = resolve(dir);
@@ -585,10 +591,10 @@ grouped(program.command("build"), GROUP.setup)
         console.error(fallbackNotice);
     const rel = relative(process.cwd(), g.contextDir) || "graft";
     if (process.env.GRAFT_NO_GITIGNORE) {
-        console.log(`  ${rel}/ is a local cache — add it to your gitignore if you want it untracked.`);
+        console.log(`  ${rel}/ is a local cache: add it to your gitignore if you want it untracked.`);
     }
     else {
-        console.log(`  ${rel}/ is git-ignored (added automatically) — a local cache; teammates run \`${cmd("graft build")}\` to get their own.`);
+        console.log(`  ${rel}/ is git-ignored (added automatically), a local cache; teammates run \`${cmd("graft build")}\` to get their own.`);
     }
     // #127: a --deep run whose LLM calls failed used to print the same success
     // footer and exit 0, so a quota-exhausted build looked identical to a clean
@@ -603,7 +609,7 @@ grouped(program.command("build"), GROUP.setup)
             const total = ready + m.stale + m.pending;
             const pct = total > 0 ? Math.round((ready / total) * 100) : 0;
             console.error("");
-            console.error(`✗ the deep pass did not complete — the meaning tier is incomplete.`);
+            console.error(`✗ the deep pass did not complete, so the meaning tier is incomplete.`);
             if (conceptFatal)
                 console.error(`  concepts: ${conceptFatal}`);
             if (m.fatal)
@@ -622,56 +628,45 @@ grouped(program.command("build"), GROUP.setup)
         }
     }
 });
-/** The file part of a hit's `file:Lx-Ly` pointer. */
-function pointerFile(pointer) {
-    return pointer.replace(/:L\d+(-L?\d+)?$/, "");
-}
 /**
  * After `ask`, under trail: which shown learnings are a teammate's, and the
- * shown learnings recorded as a use, which is what the team page counts as
- * reuse. Then the background upkeep that keeps branches and the workspace
- * current. Spawns no git itself. Teammates' branches come up after an edit
+ * lookup recorded (the learnings shown are a use, which is what the team page
+ * counts as reuse; the tokens saved ride along). Then the background upkeep
+ * that keeps branches and the workspace current. Spawns no git itself. Teammates' branches come up after an edit
  * instead, once there's a function to compare (notes/edit-overlap.ts).
  */
 function afterAsk(r, repo) {
+    // Every lookup is reported, not only ones that showed a learning: the tokens
+    // the map saved are what the team page's running total counts. A no-op unless
+    // this machine is connected and the repo is the workspace's.
+    recordLookup(r, repo);
     if (!r.notesChecked)
         return;
     rememberRepo(repo);
     maybeRefreshBranches(repo);
     const me = noteAuthor(repo);
-    const files = [...new Set(r.hits.map((h) => pointerFile(h.pointer)))];
     const shown = r.notes ?? [];
     if (shown.length) {
         for (const h of shown)
             h.note.teammate = !!h.note.author && !!me && h.note.author !== me;
-        recordActivity({
-            repo: repoPlace(repo).key,
-            kind: "search",
-            asker: me,
-            session: sessionKey(repo) ?? `${me}-${new Date().toISOString().slice(0, 10)}`,
-            query: r.query,
-            files,
-            shown_paths: shown.map((h) => noteName(h.note)),
-            shown_authors: shown.map((h) => h.note.author),
-            at: new Date().toISOString(),
-        });
-        const saved = shown.reduce((sum, h) => sum + savedByNote(h.note), 0);
-        track("learning_reused", { teammate: String(shown.some((h) => h.note.teammate)), saved_tokens_bucket: savedTokensBucket(saved) }, { repo });
     }
     maybeSyncInBackground(repo);
 }
 grouped(program.command("ask"), GROUP.find)
-    .description("Query the graft/ graph — returns ranked nodes + exact file:line, routed to prose or wiring ($0, no key)")
-    .argument("<query>", "what you want to understand, in plain words")
+    .description("Query the graft/ graph: returns ranked nodes + exact file:line, routed to prose or wiring ($0, no key)")
+    .argument("<query>", "what you want to understand, in plain words (- reads it from stdin)")
     .argument(...DIR_ARG)
     .option("-n, --limit <n>", "max results", "8")
-    .option("--source", "inline the source at each file:line hit (retriever mode — the pack IS the answer, no need to re-open files)")
+    .option("--source", "inline the source at each file:line hit (retriever mode: the pack IS the answer, no need to re-open files)")
     .option("--full", "with --source: inline whole definition spans instead of the default ≤8-line crux excerpts")
     .option("--in <path>", "narrow to nodes under this path prefix, filtered before scoring (segment-aware, like scopeOf)")
     .option("--json", "output the result as JSON")
     .option("--no-graph-rank", "rank by lexical relevance only, without the graph-connectivity re-rank (ablation/eval)")
     .option(...NO_REFRESH_FLAG)
     .action(async (query, dirArg, opts) => {
+    // The prompt hook passes what the person typed on stdin, out of sight of `ps`.
+    if (query === "-")
+        query = readFileSync(0, "utf8").trim();
     const dir = noteQuery(queryRoot(dirArg));
     await refreshBefore(dir, opts);
     const askGlobalDir = program.opts().dir;
@@ -708,7 +703,7 @@ grouped(program.command("ask"), GROUP.find)
     }
 });
 grouped(program.command("skeleton"), GROUP.find)
-    .description("Signatures-only view of one file from the wiring graph — the cheapest way to see a file's API surface")
+    .description("Signatures-only view of one file from the wiring graph: the cheapest way to see a file's API surface")
     .argument("<file>", "repo-relative path (or unique basename) of the file")
     .argument(...DIR_ARG)
     .option("--json", "output the result as JSON")
@@ -765,7 +760,7 @@ async function runCheckCommand(dirArg, opts, label) {
     }
     else {
         if (r.missing) {
-            console.log(`deep layer: not built (run \`${cmd("graft build --deep")}\` for concept nodes) — wiring graph is the source of truth`);
+            console.log(`deep layer: not built (run \`${cmd("graft build --deep")}\` for concept nodes); the wiring graph is the source of truth`);
         }
         else {
             console.log(formatCheckReport(r, label));
@@ -819,7 +814,7 @@ program
     const globalOpts = program.opts();
     const contextDir = contextDirFor(root, globalOpts.dir);
     if (!existsSync(contextDir)) {
-        console.error(`✗ no context graph at ${contextDir} — run \`${cmd("graft build --deep")}\` first`);
+        console.error(`✗ no context graph at ${contextDir}: run \`${cmd("graft build --deep")}\` first`);
         process.exit(1);
     }
     const viewerDir = fileURLToPath(new URL("./viewer/", import.meta.url)); // prebuilt
@@ -851,11 +846,16 @@ program
 });
 program
     .command("mcp", { hidden: TRAIL })
-    .description("Serve the graph over MCP (stdio) — exposes graft_find_code, graft_trace_calls, graft_find_all, graft_file_api, graft_repo_map and graft_check_freshness as tools")
+    .description("Serve the graph over MCP (stdio): exposes graft_find_code, graft_trace_calls, graft_find_all, graft_file_api, graft_repo_map and graft_check_freshness as tools")
     .argument(...DIR_ARG)
-    .action(async (dirArg) => {
-    const dir = noteQuery(queryRoot(dirArg));
+    .option("--brains", "serve only the connected Trail workspace's brain tools (what Claude Code gets after init --connect)")
+    .action(async (dirArg, opts) => {
     const { startMcpServer } = await import("./mcp/server.js");
+    if (opts.brains) {
+        startMcpServer(process.cwd(), undefined, currentVersion, { brainsOnly: true });
+        return;
+    }
+    const dir = noteQuery(queryRoot(dirArg));
     const globalOpts = program.opts();
     startMcpServer(dir, globalOpts.dir, currentVersion);
 });
@@ -893,13 +893,13 @@ grouped(program.command("callers"), GROUP.find)
 });
 grouped(program.command("blast"), GROUP.ci)
     .description("Blast radius of a diff: what depends on the lines this change touched ($0, no LLM). " +
-    "Built for CI — `--format markdown` is a PR comment with a Mermaid diagram.")
+    "Built for CI: `--format markdown` is a PR comment with a Mermaid diagram.")
     .argument(...DIR_ARG)
     .option("--base <ref>", "diff against this ref's merge base with HEAD (e.g. origin/main); default: the working tree vs HEAD")
     .option("-d, --depth <n>", 'hops to walk over incoming edges, or "all" for the full closure (default 2)')
     .option("--format <fmt>", "text (default) | markdown | mermaid | json")
     .option("--name", "name the affected areas with one cached LLM call (needs GRAFT_API_KEY); without it, areas are named after their hub symbol")
-    .option("--export-viz <dir>", "also write the interactive page for this radius (one self-contained index.html — for CI, GitHub Pages, or an artifact)")
+    .option("--export-viz <dir>", "also write the interactive page for this radius (one self-contained index.html, for CI, GitHub Pages, or an artifact)")
     .option("--title <text>", "subtitle beside the repo name on the exported page (e.g. \"PR #171\")")
     .option("--no-owners", "do not suggest who to tag (by default, git history names the people behind each affected area)")
     .option("--pr-author <who...>", "GitHub login, git name or email of the PR author, so they are left out of their own suggestions")
@@ -949,7 +949,7 @@ grouped(program.command("grep"), GROUP.find)
     });
 });
 grouped(program.command("map"), GROUP.find)
-    .description("Token-budgeted repo orientation — directory clusters, per-directory hubs, and global hotspots from the wiring graph ($0, no LLM)")
+    .description("Token-budgeted repo orientation: directory clusters, per-directory hubs, and global hotspots from the wiring graph ($0, no LLM)")
     .argument(...DIR_ARG)
     .option("--max-dirs <n>", "max directory entries shown, rest counted into dropped (default 16)")
     .option("--json", "output as JSON")
@@ -977,7 +977,7 @@ grouped(program.command("map"), GROUP.find)
     const contextDir = contextDirFor(root, globalOpts.dir);
     const graph = loadGraphCached(contextDir);
     if (!graph) {
-        console.error(`✗ no graph — run ${cmd("graft build")} first`);
+        console.error(`✗ no graph: run ${cmd("graft build")} first`);
         process.exit(1);
         return;
     }
@@ -1007,154 +1007,12 @@ grouped(program.command("note", { hidden: !TRAIL }), GROUP.memory)
     .action(async (dir, opts) => {
     await runNoteCommand(resolve(dir), opts);
 });
-// `trail learn` and `trail skills`: corrections become takeaways on a skill,
-// kept on this machine, and takeaways fold into its SKILL.md. Unlisted under
-// graft, like `note`, but they run.
-// Still runs; unlisted while learnings are the one thing trail keeps.
-grouped(program.command("learn", { hidden: true }), GROUP.memory)
-    .description("Turn a correction into a takeaway on a skill, kept in ~/.trail (the takeaway on stdin)")
-    .argument("<skill>", "the skill it belongs to, e.g. pdf-coords; a new name makes a new skill")
-    .argument("[dir]", "repository root", ".")
-    .option("-m, --text <text>", "the takeaway itself, instead of stdin")
-    .option("--description <text>", "for a new skill: what it covers")
-    .option("--section <heading>", "the SKILL.md heading it belongs under when folded")
-    .option("--author <name>", "who taught it (default: the first word of git config user.name)")
-    .action(async (skill, dir, opts) => {
-    const repo = resolve(dir);
-    const text = (opts.text ?? (await readStdin())).trim();
-    if (!text) {
-        console.error(`✗ a takeaway needs its text, on stdin or with -m:`);
-        console.error(`  ${cmd("graft learn")} ${skill} <<'EOF'\n  Read rotation with page.Rotation(), never pdfcpu: it drops /Rotate on linearized files.\n  EOF`);
-        process.exitCode = 1;
-        return;
-    }
-    const author = opts.author?.trim() || noteAuthor(repo);
-    let r;
-    try {
-        r = learn(repo, { skill, text, author, date: new Date().toISOString().slice(0, 10), description: opts.description, section: opts.section });
-    }
-    catch (err) {
-        console.error(`✗ ${err instanceof Error ? err.message : String(err)}`);
-        process.exitCode = 1;
-        return;
-    }
-    track("takeaway_saved", { new_skill: String(r.created) }, { repo });
-    const kind = r.created ? "new skill" : r.skill.where === "repo" ? "the repo's skill" : "skill";
-    console.log(`✓ takeaway saved to ${kind} ${r.skill.name}${author ? ` · taught by ${author}` : ""}`);
-    console.log(`· your agent follows it from now on · kept on this machine, in ${shownPath(dirname(dirname(r.takeaway.path)))}`);
-    console.log(`· ${cmd("graft skills")} fold ${r.skill.name} writes it into SKILL.md`);
-});
-const skillsCmd = grouped(program.command("skills", { hidden: true }), GROUP.memory)
-    .description("List this repo's skills, and the takeaways waiting to fold into each")
-    .argument("[dir]", "repository root", ".")
-    .option("--json", "output as JSON")
-    .action((dir, opts) => {
-    const repo = resolve(dir);
-    const all = listSkills(repo);
-    if (opts.json) {
-        console.log(JSON.stringify(all, null, 2));
-        return;
-    }
-    if (all.length === 0) {
-        console.log(`no skills yet · ${cmd("graft learn")} <skill> saves the first takeaway and makes the skill`);
-        return;
-    }
-    const width = Math.max(...all.map((s) => s.name.length)) + 2;
-    for (const s of all)
-        console.log(`${s.name.padEnd(width)}${skillStatus(s)}`);
-});
-/** `✗ no skill called x` and the exit code, for a name that isn't one. */
-function noSuchSkill(name) {
-    console.error(`✗ no skill called ${skillName(name)} · ${cmd("graft skills")} lists them`);
-    process.exitCode = 1;
-}
-skillsCmd
-    .command("show")
-    .description("Print a skill with every takeaway not yet folded in: what an agent reads before working in its area")
-    .argument("<skill>", "the skill")
-    .option("-C, --dir <path>", "repository root", ".")
-    .action((skill, opts) => {
-    const s = getSkill(resolve(opts.dir), skill);
-    if (!s)
-        return noSuchSkill(skill);
-    process.stdout.write(skillForAgent(s));
-});
-skillsCmd
-    .command("fold")
-    .description("Write a skill's waiting takeaways into its SKILL.md and bump its version")
-    .argument("[skill]", "one skill; leave out to fold every skill with takeaways waiting")
-    .option("--confirmed", "only the takeaways someone other than their teacher confirmed")
-    .option("-C, --dir <path>", "repository root", ".")
-    .action((skill, opts) => {
-    const repo = resolve(opts.dir);
-    if (skill && !getSkill(repo, skill))
-        return noSuchSkill(skill);
-    const names = skill ? [skill] : listSkills(repo).map((s) => s.name);
-    let inRepo = false;
-    let any = false;
-    for (const n of names) {
-        const r = fold(repo, n, { confirmed: opts.confirmed });
-        if (!r)
-            continue;
-        if (r.folded.length === 0) {
-            if (skill)
-                console.log(`· ${r.skill} v${r.from} · nothing to fold${r.stillWaiting ? `, ${r.stillWaiting} waiting for a second person` : ""}`);
-            continue;
-        }
-        any = true;
-        inRepo ||= r.where === "repo";
-        track("skills_folded", { takeaways_bucket: countBucket(r.folded.length) }, { repo });
-        console.log(`✓ ${r.skill} v${r.from} → v${r.to} · folded ${r.folded.length} takeaway${r.folded.length === 1 ? "" : "s"}${r.stillWaiting ? `, ${r.stillWaiting} still waiting` : ""}`);
-        console.log(`  M ${r.where === "repo" ? shown(repo, r.file) : shownPath(r.file)}   ${r.sections.map((h) => `+ ${h}`).join(" ")}`);
-    }
-    if (!any) {
-        if (!skill)
-            console.log("· nothing to fold");
-        return;
-    }
-    if (inRepo)
-        console.log("· review with git diff, then commit");
-    else
-        console.log(`· ${cmd("graft skills")} publish <skill> moves a skill into the repo's .claude/skills/, to commit for your team`);
-});
-skillsCmd
-    .command("publish")
-    .description("Move a skill kept on this machine into the repo's .claude/skills/, ready to commit")
-    .argument("<skill>", "the skill")
-    .option("-C, --dir <path>", "repository root", ".")
-    .action((skill, opts) => {
-    const repo = resolve(opts.dir);
-    const r = publish(repo, skill);
-    if (!r.ok) {
-        if (r.reason === "unknown")
-            return noSuchSkill(skill);
-        console.log(`· ${skillName(skill)} is already in the repo, in .claude/skills/${skillName(skill)}/`);
-        return;
-    }
-    console.log(`✓ ${skillName(skill)} → ${shown(repo, r.file)}`);
-    console.log("· commit it to share it: Claude Code loads it for everyone who pulls. its takeaways stay on this machine");
-});
-skillsCmd
-    .command("confirm")
-    .description("Say a teammate's takeaway is right, so `fold --confirmed` takes it")
-    .argument("<skill>", "the skill")
-    .argument("[takeaway]", "one takeaway file (default: every one waiting that someone else taught)")
-    .option("--author <name>", "who is confirming (default: the first word of git config user.name)")
-    .option("-C, --dir <path>", "repository root", ".")
-    .action((skill, takeaway, opts) => {
-    const repo = resolve(opts.dir);
-    if (!getSkill(repo, skill))
-        return noSuchSkill(skill);
-    const who = opts.author?.trim() || noteAuthor(repo);
-    const done = confirm(repo, skill, who, takeaway);
-    if (done.length === 0) {
-        console.log(`· nothing to confirm on ${skillName(skill)} — a takeaway needs someone other than its teacher`);
-        return;
-    }
-    for (const t of done)
-        console.log(`✓ confirmed ${t.taughtBy || "a"}'s takeaway from ${shortDate(t.date)} · ${shownPath(t.path)}`);
-    console.log(`· ${cmd("graft skills")} fold ${skillName(skill)} writes it into SKILL.md`);
-});
+// `trail skills` (design 1.7): the skills Trail kept for you, held ones to keep, offers and the switch; and
+// `trail forget <name>`, the undo every save line names. The person-only ones refuse an agent (cli-skills.ts).
+registerSkillCommands(program);
+for (const c of program.commands)
+    if (c.name() === "skills")
+        grouped(c, GROUP.memory);
 grouped(program.command("init"), GROUP.setup)
     .description(TRAIL
     ? "Wire trail into your agents: instruction files and MCP for each, plus hooks and a statusline for Claude Code"
@@ -1172,8 +1030,36 @@ grouped(program.command("init"), GROUP.setup)
     .option("-y, --yes", "skip the picker and wire every detected agent (the pre-0.8 default)")
     .option("--no-global", "skip writes outside this repo (the ~/.codex/ config + hooks)")
     .option("--verbose", "print every file written, the graph build's own output and the closing banner")
+    .option("--connect <code>", "connect this machine to your Trail workspace with the one-time code from team.trailhq.com, and send it a summary of this repo (titles, counts and names; never code)")
+    .option("--pair <code>", "the pair code from Trail's onboarding page: that page shows this run live, then you review what it found")
+    .option("--server <url>", "the Trail that gave the code (default: Trail cloud, https://team.trailhq.com)")
+    .option("--plain", "look back without asking Claude to name what it finds")
+    .option("--look-back", "look back at your past sessions again, for what isn't kept or closed yet")
     .action(async (dir, opts) => {
-    await runInitCommand(dir, opts);
+    if (opts.connect !== undefined && opts.pair !== undefined) {
+        console.error("✗ --connect and --pair are two ways in: use the one your Trail page gave you");
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.connect !== undefined)
+        await runConnectInit(dir, opts);
+    else
+        await runInitCommand(dir, opts);
+});
+// `trail init` prints this when there was no terminal to ask on (an agent ran
+// it) or with --yes: the person picks what to keep from what the look-back
+// found. An agent may run it only after the person answered (pre-bash checks).
+program
+    .command("keep", { hidden: true })
+    .description("keep learnings `trail init` found: trail keep 1 3, or trail keep none")
+    .argument("<numbers...>", "the numbers from the list init printed, or none")
+    .action((numbers) => {
+    // The CLI half of the keep check (src/init/keep.ts): it needs the receipt the PreToolUse half wrote.
+    const r = keepCommand(numbers, process.env);
+    for (const line of r.lines)
+        console.error(line);
+    if (r.code)
+        process.exitCode = r.code;
 });
 /** Everything on stdin, or "" when nothing is piped in. */
 async function readStdin() {
@@ -1266,11 +1152,12 @@ async function runNoteCommand(repo, opts) {
     }
     const author = opts.author?.trim() || noteAuthor(repo);
     const date = new Date().toISOString().slice(0, 10);
+    // Saved by `trail note`, which is how an agent saves: src says so, and no flag changes it.
     const earlier = [];
     const saved = [];
     for (const t of targets) {
         earlier.push(...listNotes(t.dir));
-        saved.push(writeNote(t.dir, { title: opts.title, body, author, date, branch: currentBranch(t.dir), cost, touches: t.touches, replaces }, scope));
+        saved.push(writeNote(t.dir, { title: opts.title, body, author, date, branch: currentBranch(t.dir), cost, touches: t.touches, replaces, src: "agent" }, scope));
     }
     const touches = targets.flatMap((t) => t.touches);
     track("note_saved", { has_cost: String(cost?.tokens !== undefined || cost?.minutes !== undefined), touches_bucket: countBucket(touches.length), scope: saved[0]?.scope ?? scope }, { repo });
@@ -1279,7 +1166,8 @@ async function runNoteCommand(repo, opts) {
         return;
     }
     for (const n of saved)
-        console.log(`✓ ${n.scope === "personal" ? "saved just for you" : "saved for your team"} · ${notePlace(n)}`);
+        console.log(`✓ ${n.scope === "personal" ? "saved just for you" : "added to this repo"} · ${notePlace(n)}`);
+    console.log(savedIdLine(saved));
     const note = saved[0];
     // Name a code file if the note touches one; docs are rarely what it's about.
     const about = touches.find((t) => !/\.(md|mdx|txt)$/i.test(t.split("#")[0])) ?? touches[0];
@@ -1294,7 +1182,7 @@ async function runNoteCommand(repo, opts) {
     }
     // Learnings about the same files, from someone else: this one builds on theirs.
     const files = new Set(touches.map((t) => t.split("#")[0]));
-    const prior = earlier.find((n) => n.author !== note.author && n.touches.some((t) => files.has(t.split("#")[0])));
+    const prior = liveLearnings(earlier).find((n) => n !== old && n.author !== note.author && n.touches.some((t) => files.has(t.split("#")[0])));
     if (prior)
         console.log(`· builds on ${prior.author ? `${prior.author}'s` : "a"} learning from ${shortDate(prior.date)}`);
     if (!SECTIONS.some((s) => sectionLead(body, s.heading) !== null))
@@ -1334,19 +1222,56 @@ function printLines(lines) {
     if (lines.length)
         console.log(`\n${lines.join("\n")}`);
 }
+/**
+ * `--server <url>` on `init --connect` and `--pair`: the Trail that gave the
+ * code, for the rest of this run (`useServer`, never the environment). False,
+ * after saying why, when it isn't a URL.
+ */
+function useServerOption(raw) {
+    if (raw === undefined || !raw.trim())
+        return true;
+    const server = serverUrl(raw);
+    if (!server) {
+        console.error("✗ --server takes a URL, like https://dev.trailhq.com");
+        process.exitCode = 1;
+        return false;
+    }
+    useServer(server);
+    return true;
+}
+/**
+ * What `init --pair` hears from init, as the onboarding page's steps: the map
+ * is done when `mapped` fires, the past sessions when `learned` does. Nothing
+ * to say for a run that read no sessions (that step is already marked).
+ */
+function pairProgress(pair) {
+    return {
+        mapped: (m) => pair.phase("files", "done", m.files ? `${m.files.toLocaleString("en-US")} files` : "", m.files ? `Mapped ${m.files.toLocaleString("en-US")} files` : "Mapped the code"),
+        learned: (l) => {
+            if (l.sessions <= 0)
+                return;
+            pair.phase("decisions", "done", `${l.sessions} sessions`, `Read ${l.sessions} past Claude sessions`);
+        },
+    };
+}
 /** Repo-relative with forward slashes, for printing. */
 function shown(repo, path) {
     return relative(repo, path).split("\\").join("/");
 }
+/** Agents init knows by another id: both read AGENTS.md. */
+const AGENT_ALIASES = { codex: "agents", opencode: "agents" };
 /** `graft init`. */
-async function runInitCommand(dir, opts) {
+async function runInitCommand(dir, opts, progress) {
     if (opts.listAgents) {
         for (const id of [...hostIds(), "claude"])
             console.log(id);
         return null;
     }
     const repo = resolve(dir);
-    const explicit = Array.isArray(opts.agents) ? opts.agents : undefined;
+    // Codex and OpenCode read AGENTS.md: `--agents codex` means that wiring.
+    // The name as given is kept for Trail's onboarding page.
+    const asked = Array.isArray(opts.agents) ? opts.agents : undefined;
+    const explicit = asked ? [...new Set(asked.map((id) => AGENT_ALIASES[id] ?? id))] : undefined;
     // Checked before anything is written: run from the home folder, init wired
     // it, mapped every code file under it, then said to commit.
     const refusal = homeFolderRefusal(repo);
@@ -1359,7 +1284,7 @@ async function runInitCommand(dir, opts) {
         const validIds = [...hostIds(), "claude"];
         const unknown = explicit.filter((id) => !validIds.includes(id));
         if (unknown.length) {
-            console.error(`✗ unknown agent id(s): ${unknown.join(", ")} — valid: ${validIds.join(", ")}`);
+            console.error(`✗ unknown agent id(s): ${unknown.join(", ")}; valid: ${validIds.join(", ")}`);
             process.exit(1);
         }
     }
@@ -1391,7 +1316,7 @@ async function runInitCommand(dir, opts) {
             offerTelemetry: reason === null || reason === "disabled",
         });
         if (picked === null) {
-            console.error("· cancelled — nothing written");
+            console.error("· cancelled, nothing written");
             return null;
         }
         ids = picked.hosts;
@@ -1419,20 +1344,42 @@ async function runInitCommand(dir, opts) {
     if (opts.dryRun) {
         console.error(formatPlan(plan, ids, repo, home));
         for (const child of children)
-            console.error(`\n— ${child}/ (workspace child)\n` + formatPlan(planInit(join(repo, child), { home }), ids, join(repo, child), home));
+            console.error(`\n· ${child}/ (workspace child)\n` + formatPlan(planInit(join(repo, child), { home }), ids, join(repo, child), home));
         return null;
     }
     if (ids.length === 0) {
-        console.error("· no agents selected — nothing written");
+        console.error("· no agents selected, nothing written");
         return null;
     }
+    // With --pair, Trail's onboarding page is waiting on this run: tell it
+    // first, so the person can sign up while the rest of init runs.
+    let pair = null;
+    if (opts.pair !== undefined) {
+        if (!useServerOption(opts.server))
+            return null;
+        if (!validPairCode(opts.pair)) {
+            console.error(`✗ --pair takes the code from Trail's onboarding page, got "${opts.pair}"`);
+            process.exitCode = 1;
+            return null;
+        }
+        const started = await PairRun.start(repo, opts.pair, { agent: asked?.[0] ?? ids[0], version: currentVersion });
+        if ("error" in started) {
+            console.error(`⚠ couldn't tell Trail about this run (${started.error}); setting up here anyway`);
+        }
+        else {
+            pair = started;
+            console.error(`· Trail's page is following along · ${started.url}`);
+        }
+    }
     const wantClaude = ids.includes("claude");
     const cliPath = fileURLToPath(import.meta.url);
+    // D120 (2): what each checkout holds before init writes, so its install record names only init's own changes.
+    const installSnaps = TRAIL ? snapInit(targets, home) : [];
     // Under trail, each repo gets its `.trail/learnings/`, committed with the
     // code, and its folder in ~/.trail for personal learnings and corrections.
-    // First, before the reads below send their first event: that makes the
-    // repo one on trail, so the event's repo id lands in `.trail/cache/` and
-    // not in a `graft/` that nothing ignores.
+    // Before the look-back below sends its first event: that makes the repo one
+    // on trail, so the event's repo id lands in `.trail/cache/` and not in a
+    // `graft/` that nothing ignores.
     const notesHome = new Map();
     if (TRAIL)
         for (const target of targets) {
@@ -1442,31 +1389,39 @@ async function runInitCommand(dir, opts) {
             if (place.git)
                 maybeRefreshBranches(place.checkout);
         }
-    // Under trail, with Claude Code picked: what the person kept telling Claude
-    // in this repo's past sessions, and what reviewers kept flagging on its
-    // merged PRs, read while the rest of init runs and saved as learnings at
-    // the end. Once per repo, and never asked about first.
-    const pastRead = TRAIL && wantClaude ? beginPastRead(repo) : null;
-    if (pastRead)
-        console.error(`· reading your ${pastRead.sessions} past Claude sessions here for what you keep telling Claude`);
-    const reviewRead = TRAIL && wantClaude ? beginReviewRead(repo) : null;
-    if (reviewRead)
-        console.error("· reading review comments on this repo's merged PRs for what reviewers keep flagging");
+    // Under trail, with Claude Code picked: look back at this repo's past
+    // sessions and PR reviews while the rest of init runs, and offer what came
+    // up at the end. Nothing is kept without a tick (see src/init/review.ts).
+    const tty = Boolean(process.stdin.isTTY && process.stderr.isTTY);
+    const lookBack = TRAIL && wantClaude ? beginLookBack(repo, { plain: opts.plain === true, again: opts.lookBack === true }) : null;
+    for (const line of lookBack?.lines ?? [])
+        console.error(line);
+    if (pair) {
+        if (lookBack?.reads.lb)
+            pair.phase("decisions", "running", "", "Reading past Claude sessions");
+        else
+            pair.phase("decisions", "done", "none here");
+        if (lookBack?.reads.reviews)
+            pair.phase("prs", "running", "", "Reading review comments on merged PRs");
+        else
+            pair.phase("prs", "done", "none here");
+    }
     if (children.length)
-        console.error(`· workspace: wiring ${repo} and ${children.length} child repo(s) — ${children.join(", ")}`);
+        console.error(`· workspace: wiring ${repo} and ${children.length} child repo(s): ${children.join(", ")}`);
     // Today's output, file by file, behind --verbose. Everything else gets one
     // line per step: the graph, then one per agent.
     const verbose = opts.verbose === true;
     const reports = [];
     for (const target of targets) {
         if (verbose && target !== repo)
-            console.error(`\n— ${relative(repo, target)}/`);
+            console.error(`\n· ${relative(repo, target)}/`);
         reports.push(wireTarget(target, ids, { home, cliPath, plan, opts, wantClaude, quiet: !verbose }));
     }
     // The graph, built once after the wiring: a workspace parent's build is
     // the workspace build, so it covers every child.
     let graphLine = null;
     if (!verbose) {
+        pair?.phase("files", "running", "", "Mapping the code");
         const res = await buildGraphWithProgress(repo, { build: opts.build, cliPath });
         for (const m of res.messages)
             console.error(m);
@@ -1479,7 +1434,7 @@ async function runInitCommand(dir, opts) {
             graphLine = "✓ graph built";
         }
         else if (res.failed) {
-            graphLine = `⚠ the graph build failed — run ${cmd("graft build")} to see why`;
+            graphLine = `⚠ the graph build failed: run ${cmd("graft build")} to see why`;
         }
         else if (existing) {
             graphLine = `✓ graph ready · ${fmt(existing.meta.nodeCount)} nodes, ${fmt(existing.meta.edgeCount)} edges`;
@@ -1488,14 +1443,36 @@ async function runInitCommand(dir, opts) {
             graphLine = "✓ graph ready";
         }
         else {
-            graphLine = `· skipped the graph build — run ${cmd("graft build")}`;
+            graphLine = `· skipped the graph build: run ${cmd("graft build")}`;
         }
     }
+    // After the graph build too: it adds the map's ignore lines (`.trail/.gitignore` under trail, `.gitignore` and `.ignore`
+    // under graft), and those are init's writes.
+    recordInit(installSnaps);
+    // --pair hears the same stages --connect does; only the ones InitProgress
+    // has no slot for (a read starting, the PR read, nothing to read) stay inline.
+    const report = pair ? pairProgress(pair) : progress;
+    if (report?.mapped) {
+        const g = loadGraphCached(contextDirFor(repo, children.length ? undefined : program.opts().dir));
+        report.mapped({
+            nodes: g?.meta.nodeCount ?? 0,
+            edges: g?.meta.edgeCount ?? 0,
+            files: g ? g.nodes.filter((n) => n.kind === "file").length : 0,
+        });
+    }
+    // With --pair, one lookup measured against reading the files whole: the
+    // page's token step. It needs the map, so it follows the build.
+    let tokens = null;
+    if (pair) {
+        pair.phase("tokens", "running", "", "Measuring one lookup against reading the files");
+        tokens = tokensOnOneLookup(repo, { contextDir: program.opts().dir });
+        pair.tokensDone(tokens);
+    }
     if (!verbose) {
         // Warnings and removals in full, whatever else is folded.
         const removed = [...new Set(reports.flatMap((r) => r.retracted))];
         for (const id of removed)
-            console.error(`- removed ${id} — agent not selected`);
+            console.error(`- removed ${id} (agent not selected)`);
         for (const w of reports.flatMap((r) => r.warnings))
             console.error(w);
         const writesFor = (id) => (plan.find((p) => p.id === id)?.writes ?? []).filter((w) => opts.global !== false || w.scope !== "global");
@@ -1507,107 +1484,58 @@ async function runInitCommand(dir, opts) {
             console.error(`✓ ${id.padEnd(width)}   ${summary}`.trimEnd());
         }
     }
-    // Under trail: what init learned, where this repo's learnings are, and how
-    // many there already are. The team's come from what is tied to the code:
-    // what reviewers kept flagging on merged PRs, and Claude Code's notes about
-    // the repo on this machine. What the person kept telling Claude is theirs.
+    // Under trail: what the look-back found, and #662's team rows (what
+    // reviewers kept flagging on merged PRs, and Claude Code's notes about the
+    // repo on this machine), what the person kept, where this repo's learnings
+    // are, and how many there already are.
     let learnedNow = false;
     let teamSaved = 0;
-    const memory = TRAIL && wantClaude ? memoryCandidates(repo, { offered: offeredBefore(repo) }) : [];
-    if (TRAIL && (pastRead || reviewRead || memory.length)) {
-        if (pastRead && !pastRead.done)
-            console.error("· still reading your past sessions…");
-        const fromSessions = pastRead ? (await pastRead.result).findings : [];
-        if (reviewRead && !reviewRead.done)
-            console.error("· still reading PR reviews…");
-        const fromReviews = reviewRead ? anchoredReviews(repo, (await reviewRead.result).findings) : [];
-        // On a terminal, the person ticks which to keep in one list, the team's
-        // first and ticked, their own unticked. A scripted run, or one with
-        // --yes, keeps the team's and what they told Claude. Cancelling saves
-        // none, and the next init asks again.
-        const picked = process.stdin.isTTY && process.stderr.isTTY && !opts.yes && fromReviews.length + memory.length + fromSessions.length
-            ? await pickLearnings([
-                ...fromReviews.map((f) => ({ title: f.title, forTeam: true, prs: f.prs })),
-                ...memory.map((c) => ({ title: c.title, forTeam: c.forTeam, memory: true })),
-                ...fromSessions.map((f) => ({ title: f.title, forTeam: false, sessions: f.sessions.length })),
-            ])
-            : undefined;
-        // The picked rows that are `found`'s, which start at `from` in the list.
-        const keepFrom = (from) => picked === undefined
-            ? undefined
-            : async (found) => picked && picked.filter((i) => i >= from && i < from + found.length).map((i) => found[i - from]);
-        const learned = [];
-        // Reviews first: which of them are offered depends on the learnings already saved.
-        if (reviewRead) {
-            const { result, saved, kept, cancelled } = await finishReviewRead(repo, reviewRead, keepFrom(0));
-            const offered = fromReviews.length;
-            if (saved.length) {
-                const n = saved.length;
-                const what = n < offered ? `kept ${n} of the ${offered} things` : `learned ${n} thing${n === 1 ? "" : "s"}`;
-                console.error(`✓ ${what} reviewers made authors change, from the last ${result.prs} merged PRs here`);
-                // saveReviewFindings keeps the findings' order.
-                saved.forEach((note, i) => console.error(`    for your team · from review on ${(kept[i]?.prs ?? []).map((n) => `#${n}`).join(", ")}: ${note.title}`));
-            }
-            else if (cancelled) {
-                console.error(`· saved none of the ${offered} things reviewers made authors change; ${cmd("graft init")} again asks again`);
-            }
-            else if (offered) {
-                console.error(`· kept none of the ${offered} things reviewers made authors change`);
-            }
-            else if (result.reason === "failed") {
-                console.error(`· couldn't read PR reviews this time; ${cmd("graft init")} again tries again`);
-            }
-            learned.push(...saved);
+    // What the look-back read, for the --pair and --connect pages, and the skills it found (--pair names them).
+    let sessionsRead = 0;
+    let skillsFound = [];
+    if (lookBack) {
+        // With --pair the person reviews what was found on Trail's page, so no screen here, as with no terminal.
+        const screen = tty && !pair;
+        const learned = await finishLookBack(repo, lookBack.reads, { yes: opts.yes === true, verbose: opts.verbose === true, say: (l) => console.error(l), ...(screen ? { io: { stdin: process.stdin, stdout: process.stderr } } : {}) });
+        // #662's lines for the team rows it kept with no screen, in its words.
+        const { fromReviews, fromMemory } = learned.teamKept ?? { fromReviews: null, fromMemory: null };
+        if (fromReviews?.saved.length) {
+            const n = fromReviews.saved.length;
+            const what = n < fromReviews.offered ? `kept ${n} of the ${fromReviews.offered} things` : `learned ${n} thing${n === 1 ? "" : "s"}`;
+            console.error(`✓ ${what} reviewers made authors change, from the last ${fromReviews.result.prs} merged PRs here`);
+            // saveReviewFindings keeps the findings' order.
+            fromReviews.saved.forEach((note, i) => console.error(`    for your team · from review on ${(fromReviews.kept[i]?.prs ?? []).map((n) => `#${n}`).join(", ")}: ${note.title}`));
         }
-        if (memory.length) {
-            const { saved, cancelled } = await finishMemoryRead(repo, memory, keepFrom(fromReviews.length));
-            if (saved.length) {
-                console.error(`✓ kept ${saved.length} of the ${memory.length} notes your Claude keeps about this repo`);
-                for (const note of saved)
-                    console.error(`    ${note.scope === "personal" ? "just for you " : "for your team"} · ${note.title}`);
-            }
-            else if (cancelled) {
-                console.error(`· saved none of the ${memory.length} notes your Claude keeps about this repo; ${cmd("graft init")} again asks again`);
-            }
-            learned.push(...saved);
+        if (fromMemory?.saved.length) {
+            console.error(`✓ kept ${fromMemory.saved.length} of the ${fromMemory.offered} notes your Claude keeps about this repo`);
+            for (const note of fromMemory.saved)
+                console.error(`    ${note.scope === "personal" ? "just for you " : "for your team"} · ${note.title}`);
         }
-        if (pastRead) {
-            const { result, saved, kept, cancelled } = await finishPastRead(repo, pastRead, keepFrom(fromReviews.length + memory.length));
-            const offered = result.findings.length;
-            if (saved.length) {
-                const n = saved.length;
-                const what = n < offered ? `kept ${n} of the ${offered} things` : `learned ${n} thing${n === 1 ? "" : "s"}`;
-                console.error(`✓ ${what} you told Claude more than once, from your last ${result.read} sessions here, just for you`);
-                // Each with how many sessions it was said in: saveFindings keeps the findings' order.
-                saved.forEach((note, i) => {
-                    const said = kept[i]?.sessions.length ?? 0;
-                    const count = said > 1 ? `told Claude in ${said} sessions: ` : "";
-                    console.error(`    just for you  · ${count}${note.title}`);
-                });
-            }
-            else if (cancelled) {
-                console.error(`· saved none of the ${offered} things you told Claude more than once; ${cmd("graft init")} again asks again`);
-            }
-            else if (offered) {
-                console.error(`· kept none of the ${offered} things you told Claude more than once`);
-            }
-            else if (result.reason === "failed") {
-                console.error(`· couldn't read your past sessions this time; ${cmd("graft init")} again tries again`);
-            }
-            learned.push(...saved);
+        sessionsRead = learned.read?.sessions ?? 0;
+        skillsFound = learned.skills ?? [];
+        const prs = learned.read?.prs;
+        if (pair && prs !== undefined && prs !== null) {
+            const n = fromReviews?.saved.length ?? 0;
+            pair.phase("prs", "done", `${prs} PRs`, `Read ${prs} merged PRs: ${n} thing${n === 1 ? "" : "s"} reviewers made authors change`);
         }
-        learnedNow = learned.length > 0;
-        teamSaved = learned.filter((s) => s.scope === "repo").length;
+        // The team learnings kept with no screen, said in no past session; after a screen the page lists the repo's own.
+        const notes = [...(fromReviews?.saved ?? []), ...(fromMemory?.saved ?? [])].map((note) => ({ note, sessions: 0 }));
+        report?.learned?.({ notes, sessions: sessionsRead });
+        learnedNow = learned.kept > 0;
+        teamSaved = learned.team;
         if (learnedNow) {
             console.error("· Claude follows them from your next session");
-            if (teamSaved)
+            if (learned.inRepo)
                 console.error(commitLines({}, teammatesOn(repo), "repo").uncommitted);
         }
     }
+    // Not looked back (not trail, or not Claude Code): the page still gets its stage.
+    if (!lookBack)
+        report?.learned?.({ notes: [], sessions: 0 });
     if (TRAIL && !learnedNow) {
         const home = notesHome.get(repo);
         if (home) {
-            const learnings = listNotes(repo, { branches: false }).filter((n) => n.scope === "repo");
+            const learnings = liveLearnings(listNotes(repo, { branches: false })).filter((n) => n.scope === "repo");
             if (learnings.length === 0)
                 console.error(`✓ learnings  ${LEARNINGS_DIR}/ · a session that fixes a bug, takes a correction or opens a PR leaves one there, for your whole team`);
             else
@@ -1644,8 +1572,8 @@ async function runInitCommand(dir, opts) {
             console.error(NOT_GIT_LINE);
         else if (tops.length)
             console.error(TRAIL
-                ? `· commit ${tops.slice(0, 5).join(" and ")}${tops.length > 5 ? ` +${tops.length - 5} more` : ""} once — after that, teammates' Claude reads your learnings even before they install trail`
-                : `· commit ${tops.slice(0, 5).join(" ")}${tops.length > 5 ? ` +${tops.length - 5} more` : ""} to share it — graft/ stays local and git-ignored`);
+                ? `· commit ${tops.slice(0, 5).join(" and ")}${tops.length > 5 ? ` +${tops.length - 5} more` : ""} once: after that, teammates' Claude reads your learnings even before they install trail`
+                : `· commit ${tops.slice(0, 5).join(" ")}${tops.length > 5 ? ` +${tops.length - 5} more` : ""} to share it: graft/ stays local and git-ignored`);
     }
     // One epilogue for the whole run. A workspace parent holds no nodes of its
     // own, so the totals come from the children — the graph the user actually got.
@@ -1660,14 +1588,130 @@ async function runInitCommand(dir, opts) {
                 nodes: graphs.reduce((n, g) => n + g.meta.nodeCount, 0),
                 edges: graphs.reduce((n, g) => n + g.meta.edgeCount, 0),
             }));
+    // Hand what was found to the review page, and leave a child waiting for
+    // the person to connect and review there.
+    if (pair) {
+        // Teammates' branches on this person's files, checked against the
+        // learnings just saved and the repo's own: synchronous, so the finding
+        // exists before the page is told the read is done.
+        pair.phase("team", "running", "", "Checking your team's branches");
+        const teamNotes = listNotes(repo, { branches: false }).filter((n) => n.scope === "repo" && !n.ref);
+        // No remote (or no default branch) means nothing was checked: `teammates`
+        // is left out, since an empty list would say "checked, none".
+        const teammates = teammatesChecked(repo, { learnings: teamNotes });
+        pair.teamDone(teammates);
+        pair.findings({ tokens, sessions: lookBack?.reads.lb ? sessionsRead : undefined, teammates });
+        await pair.finish(repo, skillsFound);
+        pair.handOff(repo);
+        console.error(`✓ Trail has what it found · review it in the browser: ${pair.url}`);
+        if (!process.stdout.isTTY)
+            console.error(`[trail] Tell the user, in one line: their Trail page has moved on; review what Trail found there. If it isn't open, the link is ${pair.url}`);
+    }
     // Run by an agent, not a person: the last line tells it to ask about the
     // commit, since the person never saw the picker and Claude Code folds the rest.
-    if (teamSaved && !process.stderr.isTTY)
+    // With --pair the person reviews them on the Trail page first, so no ask here.
+    if (teamSaved && !pair && !process.stderr.isTTY)
         console.error(`→ ${teamSaved} team learning${teamSaved === 1 ? "" : "s"} in ${LEARNINGS_DIR}/ ${teamSaved === 1 ? "isn't" : "aren't"} committed yet. Ask the user: "Commit ${teamSaved === 1 ? "it" : `the ${teamSaved}`} so your teammates' Claude starts from ${teamSaved === 1 ? "it" : "them"}? (yes / no)"`);
     // Sorted so `claude,cursor` and `cursor,claude` aggregate as one value.
     track("init_completed", { agents: [...ids].sort().join(","), consent: consent === undefined ? "unasked" : String(consent) }, { repo });
     return { ids };
 }
+/**
+ * `trail init --connect <CODE>`: the onboarding on team.trailhq.com. Claims the
+ * one-time code (a wrong or spent one stops here, before anything is written),
+ * saves the workspace token where `trail login` keeps it, then runs init as
+ * usual while the page ticks off connected, mapped and learned. At the end,
+ * one summary of the repo goes up (a lookup's tokens saved, the learnings'
+ * titles, teammates' branches from git: never code, diffs or session text),
+ * then `done`. Offline, init still sets the repo up and says how to connect.
+ */
+async function runConnectInit(dir, opts) {
+    if (opts.listAgents || opts.dryRun) {
+        if (opts.dryRun)
+            console.error("· --dry-run: not connecting");
+        await runInitCommand(dir, opts);
+        return;
+    }
+    const repo = resolve(dir);
+    if (!useServerOption(opts.server))
+        return;
+    const base = trailUrl();
+    const code = normalizeCode(opts.connect ?? "");
+    if (!code) {
+        console.error(`✗ "${opts.connect ?? ""}" isn't a Trail code · it looks like TRL-7F2A-K9QD, from ${base}/welcome/code`);
+        process.exitCode = 1;
+        return;
+    }
+    const ref = repoRef(repo);
+    const machine = machineName();
+    const got = await claimConnectCode(base, code, { machine, repo: ref });
+    const cloud = "cloud" in got ? got.cloud : null;
+    if ("cloud" in got) {
+        const cloud = got.cloud;
+        writeCloud(cloud);
+        // A sign-in link out from before is moot now.
+        clearPending();
+        console.error(`✓ connected to workspace ${cloud.workspace.name}`);
+        track("brain_signup_settled", { outcome: "linked", mode: "connect", duration_bucket: durationBucket(0) }, { repo });
+    }
+    else if (got.reason === "invalid") {
+        console.error(`✗ ${got.error} · get a new code at ${base}/welcome/code`);
+        process.exitCode = 1;
+        return;
+    }
+    else {
+        console.error(offlineLine(got.error, base, code, cmd("graft init")));
+    }
+    const reporter = cloud ? new OnboardingReporter(cloud, ref, { machine }) : null;
+    void reporter?.stage("connected");
+    // What init learned this run, kept for the summary.
+    const heard = { notes: [], sessions: 0 };
+    const progress = reporter
+        ? {
+            mapped: (m) => void reporter.stage("mapped", m),
+            learned: (l) => {
+                Object.assign(heard, l);
+                const team = learningsSummary(repo, l.notes);
+                void reporter.stage("learned", { learnings: team.length, sessions: l.sessions || Math.max(0, ...team.map((t) => t.sessions)) });
+            },
+        }
+        : undefined;
+    // The page's command is pasted into a terminal, but an agent may run it for
+    // them: with no terminal to pick in, wire the agents this machine has.
+    const interactive = process.stdin.isTTY && process.stderr.isTTY;
+    const res = await runInitCommand(dir, interactive ? opts : { ...opts, yes: true }, progress);
+    if (!reporter || !cloud)
+        return;
+    if (!res) {
+        await reporter.flush();
+        return;
+    }
+    // What Trail found, for the page: route B, summaries only.
+    const learnings = learningsSummary(repo, heard.notes);
+    const sessions = heard.sessions || Math.max(0, ...learnings.map((l) => l.sessions));
+    const tokens = tokensOnOneLookup(repo, { contextDir: program.opts().dir });
+    const teamNotes = listNotes(repo, { branches: false }).filter((n) => n.scope === "repo" && !n.ref);
+    const teammates = teammatesFromGit(repo, { learnings: teamNotes });
+    const sent = await reporter.summary({ tokens, ...(sessions ? { sessions } : {}), learnings, teammates });
+    await reporter.stage("done");
+    await reporter.flush();
+    // Claude Code gets the workspace's brains through one user-level `trail` entry.
+    const brainsEntry = res.ids.includes("claude") && opts.global !== false ? installBrainsServer(homedir()) : null;
+    if (sent) {
+        const parts = [
+            tokens ? `one lookup saved ${tokens.pct}% of the tokens` : null,
+            `${learnings.length} learning${learnings.length === 1 ? "" : "s"}`,
+            `${teammates.length} teammate branch${teammates.length === 1 ? "" : "es"} on your files`,
+        ].filter(Boolean);
+        console.error(`✓ sent ${cloud.workspace.name} a summary: ${parts.join(", ")} · titles, counts and names only, no code`);
+        console.error(`· see what Trail found: ${base}/welcome/code/found`);
+    }
+    else {
+        console.error(`· couldn't send the summary to Trail this time · with a new code from ${base}/welcome/code, ${connectAgain(cmd("graft init"), "<code>", base)} sends it again`);
+    }
+    if (brainsEntry?.action === "created" || brainsEntry?.action === "updated")
+        console.error(`✓ Claude Code gets your workspace's brains in every project · restart it to pick them up`);
+}
 /** One repo's worth of `init` writes — the parent, then each workspace child. */
 function wireTarget(repo, ids, ctx) {
     const { home, cliPath, plan, wantClaude } = ctx;
@@ -1690,7 +1734,7 @@ function wireTarget(repo, ids, ctx) {
     // be rewritten, and the graph cache is kept (init is one step from using it).
     const retracted = changed(runRetract(repo, { home, apply: true, global: opts.global, cache: false, exclude: ids })).filter((r) => r.action !== "skipped-unparseable");
     for (const r of retracted)
-        say(`- removed ${r.path} (${r.what}) — agent not selected`);
+        say(`- removed ${r.path} (${r.what}): agent not selected`);
     report.retracted = [...new Set(retracted.map((r) => r.hostId))];
     if (wantClaude) {
         // `global`/`home` are threaded through alongside `statusline`: the claude layer
@@ -1706,11 +1750,11 @@ function wireTarget(repo, ids, ctx) {
             // trail registers no server for Claude Code: the hooks and the `trail` command cover it.
         }
         else if (res.mcp.action === "skipped-unparseable")
-            say(`⚠ .mcp.json: ${res.mcp.path} left unchanged (not valid JSON) — add the graft server manually`);
+            say(`⚠ .mcp.json: ${res.mcp.path} left unchanged (not valid JSON); add the graft server manually`);
         else if (res.mcp.action === "unchanged")
             say(`· mcp claude: ${res.mcp.path} (already registered)`);
         else
-            say(`✓ mcp claude: ${res.mcp.path} (${res.mcp.action}) — restart Claude Code to load the graft MCP server`);
+            say(`✓ mcp claude: ${res.mcp.path} (${res.mcp.action}); restart Claude Code to load the graft MCP server`);
         say(res.built ? `✓ built the graph (${cmd("graft build")})` : "· skipped graph build");
         if (!wantStatusline)
             say("· skipped Claude Code statusLine (--no-statusline)");
@@ -1735,6 +1779,13 @@ function wireTarget(repo, ids, ctx) {
             say(`✓ mcp ${m.id}: ${m.path} (${m.action})`);
         for (const h of r.hooks)
             say(`✓ hook ${h.id}: ${h.path} (${h.action})`);
+        // Phase 2 (4.17, Q3): Codex runs Trail's hooks only once the person trusts them in /hooks.
+        if (r.hooks.some((h) => h.id === "codex-hooks")) {
+            const trust = codexTrustLine({ ...process.env, HOME: home, CODEX_HOME: process.env.CODEX_HOME || join(home, ".codex") });
+            // A ⚠ line, so the short output keeps it too: until then Trail does nothing in Codex.
+            if (trust)
+                say(`⚠ ${trust}`);
+        }
         // Only worth saying when there was actually something out-of-repo to skip.
         if (opts.global === false && selectedWrites(plan, ids).some((w) => w.scope === "global"))
             say("· skipped out-of-repo writes (--no-global)");
@@ -1764,7 +1815,7 @@ function wireTarget(repo, ids, ctx) {
 function formatRetractions(rs, apply) {
     const hit = changed(rs);
     if (hit.length === 0)
-        return "· nothing to remove — no graft wiring found here";
+        return "· nothing to remove: no graft wiring found here";
     const verb = apply ? "removed" : "would remove";
     const lines = [];
     const byHost = new Map();
@@ -1782,9 +1833,9 @@ function formatRetractions(rs, apply) {
                     ? "-"
                     : "~";
             const note = r.action === "skipped-unparseable"
-                ? " — not valid JSON, left untouched (remove the graft entry by hand)"
+                ? ": not valid JSON, left untouched (remove the graft entry by hand)"
                 : r.action === "deleted"
-                    ? ` (${r.what} — deleted)`
+                    ? ` (${r.what}, deleted)`
                     : ` (${r.what})`;
             const scope = r.scope === "global" ? " [machine-wide]" : "";
             lines.push(`  ${mark} ${verb}: ${r.path}${scope}${note}`);
@@ -1796,7 +1847,7 @@ grouped(program.command("uninstall"), GROUP.setup)
     .description(`Remove every file and config entry ${TRAIL ? "trail or graft" : "graft"} has written to this repo (the inverse of init)`)
     .argument("[dir]", "target repo directory", ".")
     .option("-y, --yes", "actually remove (without this, prints what it would remove and exits)")
-    .option("--keep-cache", "keep graft/ and the .gitignore entries — wiring only")
+    .option("--keep-cache", "keep graft/ and the .gitignore entries: wiring only")
     .option("--no-global", "leave out-of-repo files alone (~/.codex, ~/.gemini)")
     .action((dir, opts) => {
     const repo = resolve(dir);
@@ -1804,7 +1855,7 @@ grouped(program.command("uninstall"), GROUP.setup)
     const common = { home, global: opts.global, cache: opts.keepCache ? false : true };
     if (!opts.yes) {
         console.error(formatRetractions(planRetract(repo, common), false));
-        console.error("\nDry run — nothing was touched. Re-run with -y to remove.");
+        console.error("\nDry run: nothing was touched. Re-run with -y to remove.");
         if (opts.global !== false)
             console.error("Entries marked [machine-wide] affect every project; --no-global skips them.");
         return;
@@ -1813,7 +1864,7 @@ grouped(program.command("uninstall"), GROUP.setup)
     console.error(formatRetractions(done, true));
     const bad = changed(done).filter((r) => r.action === "skipped-unparseable");
     console.error(bad.length
-        ? `\n⚠ ${bad.length} file(s) could not be parsed and were left as-is — see above.`
+        ? `\n⚠ ${bad.length} file(s) could not be parsed and were left as-is: see above.`
         : `\n✓ ${brand()} fully removed. \`${cmd("graft init")}\` re-wires from scratch.`);
 });
 /* -------------------------------------------------------------------------- */
@@ -1823,23 +1874,22 @@ grouped(program.command("uninstall"), GROUP.setup)
  * `trail login`: connect this machine to a Trail workspace by hand. Normally
  * nobody runs it: Claude offers the same link once there's a learning to
  * share. Prints the link, opens it, and waits for the person to sign in and
- * pick repos, then uploads those repos' learnings.
+ * add the repo they're in, then uploads its committed learnings. Other repos
+ * are added one at a time afterwards (`trail workspace add`).
  */
 function loginCommand(name = "login") {
     return new Command(name)
-        .description("Connect this machine to a Trail workspace: sign in, pick the repos it gets, invite your team")
-        .argument("[dir]", "the repo you're in, ticked first in the picker", ".")
-        .option("--server <url>", "a self-hosted Trail, e.g. https://trail.acme.internal (default: Trail cloud)")
+        .description("Connect this machine to a Trail workspace: sign in, add this repo, invite your team")
+        .argument("[dir]", "the repo to add", ".")
+        .option("--server <url>", "a self-hosted Trail, e.g. https://trail.acme.internal (default: Trail cloud, https://team.trailhq.com)")
         .action(async (dir, opts) => {
         const repo = resolve(dir);
-        const server = opts.server?.trim().replace(/\/+$/, "");
-        if (server) {
-            if (!/^https?:\/\//.test(server)) {
-                console.error(`✗ --server takes a URL, like https://trail.acme.internal`);
-                process.exitCode = 1;
-                return;
-            }
-            process.env.TRAIL_URL = server;
+        // Saved on the link, so its sign-in and every upload after go there; nothing in the environment.
+        const server = opts.server === undefined ? undefined : serverUrl(opts.server);
+        if (server === null) {
+            console.error(`✗ --server takes a URL, like https://trail.acme.internal`);
+            process.exitCode = 1;
+            return;
         }
         const cloud = readCloud();
         if (cloud) {
@@ -1847,8 +1897,8 @@ function loginCommand(name = "login") {
             return;
         }
         rememberRepo(repo);
-        const url = loginLink(repo);
-        console.error(`· sign in and pick the repos your workspace gets:\n  ${url}`);
+        const url = loginLink(repo, process.env, Date.now(), server);
+        console.error(`· sign in and add this repo to your workspace:\n  ${url}`);
         if (process.stdout.isTTY)
             openBrowser(url);
         console.error("· waiting for you to finish in the browser (ctrl-c stops; Claude picks it up later too)");
@@ -1869,6 +1919,7 @@ function logoutCommand(name = "logout") {
         .action(() => {
         const cloud = readCloud();
         clearPending();
+        removeBrainsServer(homedir());
         if (!clearCloud()) {
             console.error("· not connected to a workspace");
             return;
@@ -1918,6 +1969,8 @@ function workspaceCommand(name = "workspace") {
         if (here.git && !me.repos.some((r) => r.key === here.key)) {
             console.log(`  · ${here.name.padEnd(width)}not in the workspace · ${cmd("graft workspace add")} shares its learnings`);
         }
+        else if (here.git)
+            printLines(leftOutLines(here.checkout));
     });
     ws.command("add")
         .description("Add this repo to your workspace and share its learnings")
@@ -1951,18 +2004,33 @@ function workspaceCommand(name = "workspace") {
             return;
         }
         console.error(`✓ added ${here.name} to ${cloud.workspace.name} · shared ${res.learnings} learning${res.learnings === 1 ? "" : "s"}`);
+        for (const l of leftOutLines(here.checkout))
+            console.error(l);
         console.error(`· ${cloud.workspace.url}`);
     });
     return ws;
 }
+/**
+ * One line per learning of this repo's that the workspace doesn't get because
+ * it looks like it holds a secret: named, with what was seen, never the
+ * secret. Nothing when there are none or git can't read the repo.
+ */
+function leftOutLines(checkout) {
+    const out = workspaceLearnings(checkout)?.leftOut ?? [];
+    return out.map((l) => `  · left out: ${flatLine(l.name, 200)}${l.ref ? ` (on ${flatLine(l.ref, 120)})` : ""}: looks like it holds a secret (${l.why}). Take the secret out and commit, and it goes up with the next sync`);
+}
 /* -------------------------------------------------------------------------- */
 /* trail team · trail check                                                   */
 /* -------------------------------------------------------------------------- */
-/** Fold a long line at `width`, indenting what wraps. */
+/**
+ * Fold a long line at `width`, indenting what wraps. The text holds a
+ * learning's or a teammate's words, and any word can start a line, so it's
+ * one line first and no word starts with a `[trail]`-style marker (flatten.ts).
+ */
 function wrap(text, width, indent) {
     const out = [];
     let line = "";
-    for (const word of text.split(/\s+/)) {
+    for (const word of unmarkedWords(text)) {
         if (line && line.length + 1 + word.length > width) {
             out.push(line);
             line = indent + word;
@@ -2085,7 +2153,7 @@ function localTeam(repo, days, json) {
 }
 function teamCheckCommand(name = "check") {
     return new Command(name)
-        .description("Check your branch's diff against everything the team has learned: the repo's learnings, yours and your skills")
+        .description("Check your branch's diff against the learnings that bear on it: this repo's, yours, and the skills")
         .argument("[dir]", "repository root", ".")
         .option("--base <ref>", "compare against where the branch left this ref (default: origin's default branch)")
         .option("--json", "output as JSON")
@@ -2105,7 +2173,10 @@ function withoutTrailFiles(diff) {
  * the repo's `.trail/` (teammates' pushed branches included), this person's
  * own, and the repo's skills. No sign-in, no server. Exits 1 on a conflict.
  */
-async function runTeamCheck(repo, opts) {
+async function runTeamCheck(dir, opts) {
+    // From the top of the checkout: git names changed files from there, and a learning's touches have to
+    // line up with them exactly to fail the check. From a folder inside, none ever would.
+    const repo = checkoutRoot(dir) ?? dir;
     const d = branchDiff(repo, opts.base);
     if (!d) {
         console.error("✗ not a git repository");
@@ -2125,17 +2196,20 @@ async function runTeamCheck(repo, opts) {
     maybeRefreshBranches(repo);
     if (d.truncated)
         console.error("⚠ the diff is over 400 KB; only the first 400 KB is checked");
-    const r = checkLocally({ diff: withoutTrailFiles(d.diff), files, notes: withBaseLearnings(listNotes(repo), atBase), skills: listSkills(repo), asker: me });
+    // Replaced and retired learnings are left out after the swap, so a branch can't retire a learning by editing it.
+    const notes = withBaseLearnings(listNotes(repo), atBase);
+    const r = checkLocally({ diff: withoutTrailFiles(d.diff), files, notes, skills: listSkills(repo), asker: me, committed: committedAtBase(repo, d.from) });
     r.findings.unshift(...edits);
-    const sources = r.findings.map((f) => f.source).filter((s) => s.path);
+    // Only learnings the workspace gets: a personal one's file name carries its title.
+    const personal = new Set(notes.filter((n) => n.scope === "personal").map((n) => n.path));
+    const sources = r.findings.map((f) => f.source).filter((s) => s.path && !personal.has(s.path));
     recordActivity({
         repo: repoPlace(repo).key,
         kind: "check",
         asker: me,
         session: sessionKey(repo) ?? `${me}-${new Date().toISOString().slice(0, 10)}`,
-        query: "",
-        files,
-        shown_paths: [...new Set(sources.map((s) => s.path.slice(s.path.lastIndexOf("/") + 1)))],
+        file_count: files.length,
+        shown_paths: [...new Set(sources.map((s) => learningFileName(s.path)))],
         shown_authors: [...new Set(sources.map((s) => s.author ?? ""))],
         at: new Date().toISOString(),
     });
@@ -2156,23 +2230,28 @@ async function runTeamCheck(repo, opts) {
 function printCheck(r) {
     console.log(`checking ${r.files} changed file${r.files === 1 ? "" : "s"} against ${r.notes} learning${r.notes === 1 ? "" : "s"} and ${r.skills} skill${r.skills === 1 ? "" : "s"}\n`);
     const conflicts = r.findings.filter((f) => f.verdict === "conflict");
-    for (const f of [...conflicts, ...r.findings.filter((x) => x.verdict !== "conflict")]) {
-        const mark = f.verdict === "conflict" ? "✗" : "✓";
+    const leads = r.findings.filter((f) => f.verdict === "lead");
+    for (const f of [...conflicts, ...leads, ...r.findings.filter((x) => x.verdict === "follows")]) {
+        const mark = f.verdict === "conflict" ? "✗" : f.verdict === "lead" ? "●" : "✓";
         console.log(`${mark} ${f.file}${f.line ? `:${f.line}` : ""}`);
         console.log(`  ${f.summary}`);
+        if (f.why)
+            console.log(`  worth a look, can't fail the check: ${f.why}`);
+        if (f.replacedBy)
+            console.log(`  this branch replaces it with ${f.replacedBy.id} ("${f.replacedBy.title}"), which counts once it's on the base branch: until then, say why in the PR`);
         const s = f.source;
-        if (f.verdict === "conflict" && s.quote) {
+        if (f.verdict !== "follows" && s.quote) {
             const who = [s.author, s.date ? shortDate(s.date) : ""].filter(Boolean).join(" · ");
             for (const l of wrap(`${who ? `${who}: ` : ""}${s.quote}`, 70, "  "))
                 console.log(`  ${l.trimStart()}`);
         }
     }
     if (r.findings.length === 0)
-        console.log("✓ nothing the team has learned bears on this change");
+        console.log("✓ no learning bears on this change");
     console.log("");
     console.log(conflicts.length
         ? `· ${conflicts.length} conflict${conflicts.length === 1 ? "" : "s"} · fix ${conflicts.length === 1 ? "it" : "them"}, or say why in the commit message or PR description`
-        : "· no conflicts");
+        : `· no conflicts${leads.length ? ` · ${leads.length} worth a look` : ""}`);
 }
 /** Tokens saved by this repo's agent sessions touched in the last 7 days. */
 function savedThisWeek(repo, now = Date.now()) {
@@ -2214,7 +2293,8 @@ function statusCommand(name = "status") {
         const g = graph ? await engineFrom().checkGraph(repo) : null;
         const fresh = g && !g.missing ? g.ok : null;
         const kept = keepsNotes(repo);
-        const all = kept ? listNotes(repo) : [];
+        // Only what still holds: a retired, held or replaced learning reaches no agent.
+        const all = kept ? liveLearnings(listNotes(repo)) : [];
         const inRepo = all.filter((n) => n.scope === "repo" && !n.ref).length;
         const onBranches = all.filter((n) => n.ref).length;
         const personal = all.filter((n) => n.scope === "personal").length;
@@ -2239,7 +2319,7 @@ function statusCommand(name = "status") {
         else
             row("code map", `✓ ${fmt(graph.meta.nodeCount)} nodes · in sync with the code`);
         if (kept) {
-            const parts = [`${inRepo} for the team in ${LEARNINGS_DIR}/`];
+            const parts = [`${inRepo} added to this repo, in ${LEARNINGS_DIR}/`];
             if (onBranches)
                 parts.push(`${onBranches} on teammates' branches`);
             if (personal)
@@ -2250,9 +2330,15 @@ function statusCommand(name = "status") {
             if (cloudEnabled())
                 row("workspace", "not connected · Claude offers a link once there are learnings to share");
         }
+        else if (cloud.via === "connect") {
+            row("workspace", `${cloud.workspace.name} · gets a summary of the repos you run ${cmd("graft init")} --connect in · ${cloud.workspace.url}`);
+        }
         else
             row("workspace", `${cloud.workspace.name} · ${cloud.repos.length} repo${cloud.repos.length === 1 ? "" : "s"}${shared ? ", this one included" : `, not this one (${cmd("graft workspace add")})`} · ${cloud.workspace.url}`);
         row("this week", saved > 0 ? `~${shortCount(saved)} tokens saved` : "nothing saved yet");
+        // Phase 2 (4.17, D137): Codex's trust of Trail's hooks, and why it keeps nothing new there yet.
+        for (const l of codexStatusLines())
+            row("codex", l);
     });
 }
 if (TRAIL) {
@@ -2263,7 +2349,7 @@ if (TRAIL) {
         program.addCommand(c.helpGroup(GROUP.cloud), { hidden: !cloudEnabled() });
     program.addCommand(statusCommand().helpGroup(GROUP.setup));
     // Help lists the groups in this order, and the commands within each.
-    const order = ["ask", "grep", "skeleton", "callers", "map", "note", "check", "team", "learn", "skills", "init", "build", "status", "upgrade", "uninstall", "telemetry", "workspace", "login", "logout", "blast"];
+    const order = ["ask", "grep", "skeleton", "callers", "map", "note", "check", "team", "skills", "init", "build", "status", "upgrade", "uninstall", "telemetry", "workspace", "login", "logout", "blast"];
     const rank = (c) => {
         const i = order.indexOf(c.name());
         return i === -1 ? order.length : i;
@@ -2277,15 +2363,14 @@ if (TRAIL) {
         callers: "who calls it, or what it calls with --direction out",
         map: "directory clusters, hubs and hotspots",
         note: "save what this session worked out, as a learning in .trail/",
-        learn: "turn a correction into a takeaway on a skill",
-        skills: "list skills, show one, fold takeaways in, publish to the repo",
+        skills: "the steps that worked, kept as skills when you say so · on, off, show, forget",
         init: "wire trail into your agents",
         build: "rebuild the code map · --check fails if it's stale",
         status: "code map, learnings and tokens saved",
         upgrade: "install the latest trail",
         uninstall: "remove everything trail or graft wrote to this repo",
         telemetry: "show or turn off the anonymous usage stats",
-        check: "check your diff against everything the team has learned",
+        check: "check your diff against this repo's learnings and yours",
         team: "what the team learned this week, and where work overlaps",
         workspace: "your workspace's repos, team page and invite link",
         login: "connect a Trail workspace (Claude offers you the link)",