@openrig/cli 0.6.10 → 0.6.11

package/daemon/assets/plugins/openrig-core/skills/openrig-skills/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: openrig-skills
-description: "Use when you're operating OpenRig and need the right skill or context for fleet recovery, seat handover, new-seat orientation, a watchdog wake, cross-host reach to an agent on another machine, rig packaging, an OpenRig upgrade, systematic debugging, queue triage, or implementation planning; also use when you don't know what applies or nothing is projected on cold boot."
+description: "Use when an agent running inside OpenRig needs the right skill or context for fleet recovery, seat handover, new-seat orientation, a watchdog wake, cross-host reach to an agent on another machine, rig packaging, an OpenRig upgrade, systematic debugging, queue triage, or implementation planning; also when the agent doesn't know what applies or nothing is projected on cold boot. Installing, starting or updating OpenRig, getting back to a team or bringing a stopped one back from a person's own session is the rigs skill."
 allowed-tools: Bash(rig:*)
 metadata:
   openrig:

package/daemon/assets/plugins/openrig-core/skills/refocusing/scripts/trace-to-root.py

@@ -351,7 +351,12 @@ def render_held_and_next(evidence):
             missions = ", ".join(row.get("missions") or [])
             output.append(f"- {row.get('qitemId') or 'a row'} — {row.get('summary') or 'no summary'}"
                           + (f" [mission: {missions}]" if missions else ""))
-    if evidence.get("heldAndNextTruncated"):
+    if "heldTruncated" in evidence or "nextTruncated" in evidence:
+        if evidence.get("heldTruncated"):
+            output.append("(the held list was cut; `rig queue list --owned --state blocked` has the rest)")
+        if evidence.get("nextTruncated"):
+            output.append("(the next list was cut; `rig queue list --owned --state pending` has the rest)")
+    elif evidence.get("heldAndNextTruncated"):
         output.append("(held and next lists were cut; `rig queue list` has the rest)")
     return "\n".join(output)
 

package/daemon/assets/skills/rigs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rigs
-description: Use when the user mentions OpenRig, rigs or the rig command, or wants a team of coding agents (Claude Code, Codex) on their project. That includes installing, setting up, starting or updating OpenRig, seeing or getting back to their OpenRig agents, TUI or operator, starting or sharing a team, and joining this session to one.
+description: Use when a person in their own Claude Code or Codex session mentions OpenRig, rigs or the rig command, or wants a team of coding agents (Claude Code, Codex) on their project. That includes installing, setting up, starting or updating OpenRig, seeing, getting back to or re-attaching to their OpenRig agents (including bringing a stopped team back), TUI or operator, starting or sharing a team, and joining this session to one. Operating a running rig from inside it (fleet recovery, seat handover, watchdog wakes, in-rig upgrades) is the openrig-skills skill.
 ---
 
 # rigs: your route into OpenRig

package/daemon/context-packs/help/manifest.yaml

@@ -1,6 +1,6 @@
 # Agent help: the single troubleshooting and escalation guide (docs/reference/help.md).
 name: help
-version: "0.6.10"
+version: "0.6.11"
 taxonomy: world
 purpose: "What an agent does when its user says OpenRig isn't working: diagnose, fix within permissions, verify, and escalate to OpenRig support."
 files:

package/daemon/context-packs/onboarding-width/manifest.yaml

@@ -1,6 +1,6 @@
 # Public capability and source-map width for the default onboarding walk.
 name: onboarding-width
-version: "0.6.10"
+version: "0.6.11"
 taxonomy: world
 purpose: "The public capability map and source map referenced by the default onboarding walk."
 files:

package/daemon/context-packs/onboarding-width/public-what-you-can-do.md

@@ -11,7 +11,7 @@ not know exists.** So the point of what follows is not skill. It is recognition:
 lands, something rhymes, and you go check instead of building.
 
 Eighty-seven top-level verbs ship (capability canon refreshed through
-`capability-delta-v0.6.10`). This marker describes the pack's teaching, not publication or live
+`capability-delta-v0.6.11`). This marker describes the pack's teaching, not publication or live
 adoption. Read this once for shape, and let it make you suspicious that a thing already exists.
 Model-divergence proclamations are live product (trust them; pins use canonical
 model IDs).
@@ -90,6 +90,8 @@ unseen — which makes messages the one delivery channel that never gets skipped
   confirm by effect, never relaunch on it. A send or wake to a seat whose latest hook is a
   question waiting for a person is refused with `target_needs_input`, even when its screen
   can't be read: read it with `rig capture` and get the question answered instead of retrying.
+  `--wait-for-idle N` waits before it takes the seat's delivery lease, so other sends and wakes to
+  that seat aren't held behind it; N is a deadline from the start of the wait.
   Over `--host` to an http-registered host, a send that may have reached the remote reads
   `remote-outcome-unknown` ("Delivery UNCONFIRMED"): check the target with `rig capture <session>
   --host <id>` before any resend. Only a host that was never reached reads as unreachable.
@@ -184,9 +186,11 @@ your context, your compaction and your replacement — and it is the only thing
   `handoff`'s, confirms the row was saved; the owner is woken after that. Before you say they were
   told, read the row's transitions, or use `--verify`. For a seat it reports the wake's terminal
   receipt and any claim separately: an unconfirmed receipt is not a failed handoff, and a claim is
-  pickup, not proof the body was read. For a row the seat already claimed, `outcome` can read
-  `indeterminate` while `claim` is accurate: read `claim`. It isn't a failed handoff, so don't
-  re-run the create.
+  pickup, not proof the body was read. For a claimed row whose wake wasn't confirmed, `outcome`
+  reads `claimed`; it isn't a failed handoff, so don't re-run the create. For a registered person
+  who is also a seat with a pane, it also waits for the Slack receipt and reports it on its own,
+  up to the 30-second default, even when Slack isn't set up or the row won't be posted. With `output.compact` on (off by default), the queue write commands print a short
+  receipt and `--full` prints the whole row.
 - **`rig queue show`** — what a row *actually says*. The header is not the body.
 - **`rig queue claim` / `unclaim`** — is this mine and running, or still pending where two agents
   might double-work it. Put it down honestly when it is not yours.
@@ -201,7 +205,11 @@ your context, your compaction and your replacement — and it is the only thing
   visible**, with a plain-language summary and a pointer to what a human must judge; `resolve`
   writes their decision onto the durable record and wakes the owner. **Closing it would be a lie
   and sitting on it silently is indistinguishable from a crash.** `--wake-after <duration>` arms
-  one wake for this park episode; a new park supersedes it and every exit route retires it.
+  one wake for this park episode; a new park supersedes it and every exit route retires it. In
+  this release a wake the typing guard holds back (`retained`) is recorded as that one fire and
+  later wakes aren't, so the timer isn't retired: it can wake the owner again at each interval
+  while the row stays parked. A row attached to a shared timer with `--wake-watchdog` loses its
+  one wake if that wake is held back.
 - **`rig queue overdue`** — what was claimed and never closed in time. **Defaults to the current
   rig**; ask for more if you mean more.
 - **`rig queue undelivered`** — pending create-path nudge failures only. For gateway or human
@@ -359,7 +367,11 @@ not have to tear one down to change it, and you rarely have to start from nothin
   is archived), so check `rig ps --nodes` first. Launch-created `AGENTS.md` or `CLAUDE` files now show in `git status`.
   `rig up <rig> --existing` puts back the OpenRig guidance blocks `rig down` removed before a
   resumed seat starts. A seat still missing one makes the rig `partially_restored` (its node lists
-  `guidanceGaps`) and `rig up` exits 1.
+  `guidanceGaps`) and `rig up` exits 1. A seat that wasn't running at the snapshot, but whose
+  earlier session left a resume token, stops at `awaiting-decision` instead of starting fresh, in
+  `rig up --existing` and in `rig launch` (exit 1); the message names the command that starts it
+  fresh on purpose. In a pod-aware rig, a seat is rolled back as unresumable only when its runtime
+  reports the conversation missing.
 - **`rig down`** — stop a rig's seats and take it out of the running set. It ends the agents'
   sessions and any work in progress; don't run it on a live team unless the person asked. In
   human mode it first prints one line with each agent's last known activity, or “unknown”: a
@@ -372,7 +384,16 @@ not have to tear one down to change it, and you rarely have to start from nothin
   `rig seat launch <session> --fresh --stop`.
 - **`rig seat launch <seat> --fresh --reason <why>`** — deliberately create a blank occupant for
   exactly one existing seat. It uses no resume, fork, rebuild, snapshot, or restore packet;
-  siblings and durable work stay put, and unmanaged ambiguity refuses.
+  siblings and durable work stay put, and unmanaged ambiguity refuses. With `--stop`, a seat with a
+  still-live older session is refused before anything is stopped; `--plan` previews it.
+- **`rig seat restart <seat> --keep-conversation --reason <why>`** — restart one Codex seat in its
+  own pane on the same conversation, so it starts again on whatever account its Codex home now
+  holds; it doesn't switch accounts itself. It refuses with nothing stopped unless the seat is a
+  Codex seat OpenRig launched, in a single pane, with a conversation it can prove and unchanged
+  running settings. `--plan` runs every check and stops nothing; `--verify --expect-account
+  <account>` reports `moved` only when a tool turn has completed in the same conversation since
+  the restart and Codex's status names that account. Linux only: on macOS a
+  request that reaches the running-process check refuses before stopping the seat.
 - **`rig add`** / **`rig expand`** — graft one more member, or a whole new pod, onto a rig that is
   already running. `rig add` takes the rig's name or ID; a name two active rigs share is refused
   with `rig_ambiguous` and the candidates. `rig grow --new-pod` and `rig expand` are one ingress; choose by input shape.
@@ -480,7 +501,8 @@ version, from checking the environment to a useful report to the OpenRig team.
   updating Codex is the operator's job.
 - **`rig seat set-model` / `stop` / `clean`** — persist the model for later managed resumes, stop
   exactly one live seat (ending its session and any work in progress), or clear a dead seat's
-  stale binding. When the topology is right and only
+  stale binding. A stop is recorded, so the rig doesn't read `degraded` for that seat, and a rig
+  whose seats were all stopped this way reads `stopped`. When the topology is right and only
   the occupant is wrong, use these seat lifecycle verbs or `rig handover`, not a rig down/up cycle.
   Effective-model detection follows the identity-verified current occupant, not a retained
   predecessor; a `<synthetic>` transcript record is skipped, so a PENDING model check is not a
@@ -568,7 +590,8 @@ scheme, and nothing downstream can see it.
   source actually bound. When someone later asks where the contract items came from, the drop's
   own echo is the answer — not a re-read of the files.
 - **`rig proof judge` / `rig proof show`** — record an attributed judgment on a contract item once,
-  then read derived proof, slice, mission and project readiness. The owning scope selects
+  then read derived proof, slice, mission and project readiness. Both take `--project <id>` or a
+  `<project>:` scope prefix. The owning scope selects
   `proofPolicy.judges` (nearest slice, mission or project policy wins); consult `rig proof --help`
   for that setup and the item/evidence selectors. Accept, reject or withdraw against readable
   evidence; corrections preserve history and unrelated judgments without ancestor status edits.
@@ -795,8 +818,10 @@ your circumstances is configuration, and the ones that are not, another agent ca
   accounts, what the usage signals say, and whether a seat can be moved without stranding the
   conversation it is in the middle of. **`provider signals` reports anomalies rather than a
   listing** — unbound seats, accounts shared across several seats. A Codex seat showing its
-  usage-limit banner reads activity `unknown` with reason `usage_limit`, and `provider signals` can
-  show a provider-event signal for that seat's account that allows a switch decision.
+  usage-limit banner reads activity `unknown` with reason `usage_limit`, and keeps it while its
+  screen redraws; `provider signals` can show a provider-event signal for that seat's account that
+  allows a switch decision. With `provider.usage_windows` on (off by default), `rig provider status
+  --refresh` reads a Codex login's usage windows once.
 - **Codex configuration fragments** — a `codex_config_fragment` must open with a table header and
   never overrides a user-declared table; see `docs/reference/agent-spec.md`.
 - **`rig env`** — the real services behind a rig: are they up, what are they saying, how do you

package/daemon/context-packs/reference/manifest.yaml

@@ -1,7 +1,7 @@
 # Reference guides the help pack links to, loaded one file or section at a time by address
 # (rig context get reference/<file>#<section>). Each file is a symlink to docs/reference/.
 name: reference
-version: "0.6.10"
+version: "0.6.11"
 taxonomy: world
 purpose: "Version-matched reference guides the help guide links to. Load a single file or section by address; don't load the whole pack."
 files:

package/daemon/context-packs/reference/rig-spec.md

@@ -397,7 +397,7 @@ directory's `CLAUDE.md`, including blocks written by other rigs.
 | `profile` | string | yes | — | Profile name from the referenced AgentSpec. Use `default` for the default profile. Exception: `none` for terminal nodes. |
 | `codex_config_profile` | string | no | — | Codex-only native profile passed as `-p <name>`; letters, numbers, `_`, `.`, `-`. Separate from the AgentSpec `profile`. With the normal launch mode, this replaces OpenRig's explicit workspace-write sandbox flag. A full-bypass policy instead emits danger-full-access and omits this profile argument. |
 | `runtime` | string | yes | — | Agent runtime. Current supported values: `claude-code`, `codex`, `pi`, `omp`, `terminal`, `stub`. `stub` is a deterministic test harness, not an agent: a Node runner in the seat's tmux pane goes through the normal launch, skill projection, startup-file and readiness path, follows `<cwd>/.openrig/stub/script.json` when present, and calls no model. See "What a stub can and cannot prove" in `docs/as-built/test-layers.md`. |
-| `cwd` | string | yes | — | Working directory for the agent. A relative path resolves against the rig root (the directory containing the rig spec); an absolute path is used as is. Use `"."` for the rig root itself. Can be overridden at launch time with `rig up --cwd`. A cwd inside the OpenRig installation fails preflight unless `--cwd` is given. |
+| `cwd` | string | yes | — | Working directory for the agent. A relative path resolves against the rig root (the directory containing the rig spec). If that path exists as written, it is used. Otherwise a leading `~` or `~/` expands to the home directory (`~user` does not) and `$VAR` / `${VAR}` expand from the daemon host's environment; a relative result still resolves against the rig root. A reference to an unset variable stays as written, so the cwd is that literal path and works only if it exists. Use `"."` for the rig root itself. Can be overridden at launch time with `rig up --cwd`. A cwd inside the OpenRig installation fails preflight unless `--cwd` is given. |
 | `label` | string | no | — | Human-readable member name. Shown in UI when present. |
 | `model` | string | no | — | Model override. Runtime-specific (e.g., `claude-opus-4-6` for Claude Code). |
 | `effort` | string | no | — | Reasoning effort override, trimmed. A non-string value is ignored with an advisory. |
@@ -406,7 +406,7 @@ directory's `CLAUDE.md`, including blocks written by other rigs.
 | `restore_policy` | string | no | the AgentSpec's | Restore behavior. One of: `resume_if_possible`, `relaunch_fresh`, `checkpoint_only`. The default comes from the AgentSpec's `defaults.lifecycle` (else `resume_if_possible`) as narrowed by its profile; a member value may only narrow it further, in that order. |
 | `compaction_strategy` | string | no | — | `default-compaction`, `managed-compaction`, `handover` or `apprentice-handover`; `harness_native` and `pod_continuity` are accepted as deprecated aliases, and `custom_prompt` is refused. |
 | `mechanic` | string | no | — | A canonical `seat@rig` session address, for `apprentice-handover`. |
-| `session_source` | object | no | — | Start the seat from an existing session: `fork` with `native_id`, `rebuild` with `artifact_set`, or `agent_image` with `image_name`. Not valid on terminal members. |
+| `session_source` | object | no | — | Start the seat from an existing session: `fork` with `native_id`, `rebuild` with `artifact_set`, or `agent_image` with `image_name`. A Claude Code `fork` needs Claude Code 2.0.73 or later. Not valid on terminal members. |
 | `starter_ref` | object | no | — | `{ name }` of an agent starter (`^[a-zA-Z0-9][a-zA-Z0-9_-]*$`) whose files lead the seat's startup. Not valid on terminal members or with a fork. |
 | `startup` | StartupBlock | no | — | Member-level startup files and actions. Applied only to this member. |
 

package/daemon/context-packs/reference/whats-new.md

@@ -1,7 +1,7 @@
-# What changed in OpenRig 0.6.10
+# What changed in OpenRig 0.6.11
 
-This note is for an agent on an install that was just upgraded to 0.6.10. It lists only what behaves differently from
-0.6.9 and what to do about it. For everything OpenRig can do, read the capability map:
+This note is for an agent on an install that was just upgraded to 0.6.11. It lists only what behaves differently from
+0.6.10 and what to do about it. For everything OpenRig can do, read the capability map:
 `rig context get onboarding-width/public-what-you-can-do.md`. Each release replaces this file, so
 `rig context get reference/whats-new.md` describes the installed version once the upgraded daemon is running. Without
 a running daemon, read `$OPENRIG_HOME/reference/whats-new.md`. The daemon refreshes that copy when it starts, so right
@@ -9,158 +9,159 @@ after an upgrade it can still hold the previous version's note.
 
 ## After the upgrade
 
-- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Two migrations run on the first start: `099`
-  adds one partial index to the queue table, and `101` adds four empty columns to `sessions`. Neither changes existing
-  data. There is no migration `100`. The bundled openrig-core plugin goes from 0.1.8 to 0.1.9.
+- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). One migration runs on the first start: `103`
+  adds one column to `sessions`, `intentionally_stopped`, which is 0 for every existing row. There are no migrations
+  `100` or `102`. The bundled openrig-core plugin stays at 0.1.9; two of its files changed.
+- **Two new switches, both off by default:**
+  - `output.compact` (or `OPENRIG_OUTPUT_COMPACT`): the seven queue write commands (`rig queue create`, `claim`,
+    `unclaim`, `update`, `block`, `handoff` and `handoff-and-complete`) print a short receipt instead of the whole
+    row, and `--full` prints the whole row. While it's off their output is unchanged, `--full` is accepted, and
+    `rig config` lists the key.
+  - `provider.usage_windows` (or `OPENRIG_PROVIDER_USAGE_WINDOWS` in the daemon's environment): `rig provider status
+    --refresh` reads a Codex login's usage windows once. While it's off, `--refresh` says how to turn it on and exits 1.
 
 ## Output that changed shape
 
-- **`rig capture --lines N` is the last N lines,** after blank rows at the bottom are dropped. When earlier lines are
-  cut, stderr says `[rig capture: <session>: N earlier lines not shown; last M shown]`. In `--json`, `lines` is then
-  the count returned, and `requestedLines` and `omittedLines` are new (per seat under `--rig` or `--pod`). For the old
-  output, N history lines plus the whole pane, add `--history-plus-pane`; it keeps the old JSON too, without
-  `requestedLines` or `omittedLines`. Without `--lines`, or with a non-numeric or zero `--lines`, nothing changed. A
-  short capture doesn't prove a seat is idle.
-- **Compact `rig queue list` rows carry `summary`,** and so do `overdue` and `undelivered`. The fields they leave out
-  (`body`, `evidenceRef`, `humanDetail`, `waiting`, `chainOfRecord`, `replyTo`, `humanQuestions`, `humanAnswers`) are
-  now absent, not `null` or `""`, and `fieldsElided` names them. A filter that tested those fields for null must test
-  for presence. Read a full row with `rig queue show <id> --full --json`.
-- **`lastNudgeResult` reads `claimed`** on a claimed row whose wake was recorded as `delivered-ack-pending` or
-  `indeterminate:…`. The recorded value is unchanged and shows in the new `lastNudgeWireResult`; unclaiming brings it
-  back. `claimed` is never promoted to `verified`.
-- **`rig chatroom history` returns the newest messages** when you give neither `--after` nor `--since`, still listed
-  oldest first. Before, a room longer than the limit returned its oldest messages. `--after` and `--since` still page
-  forward from that point, and `rig chatroom wait` is unchanged.
+- **`rig queue create --verify` reports `outcome: "claimed"`** for a claimed row whose wake wasn't confirmed, instead
+  of `indeterminate`. A claim is pickup, not proof the body was read.
+- **`rig queue create --verify` to a registered person who is also a seat with a pane reports the Slack side too.**
+  Beside the terminal wake it adds a `gateway` object: `posted` (`connectorAccepted: true`), `transport-failed` or
+  `never-posted` (`connectorAccepted: false`, with the detail), or `still-pending` (`connectorAccepted: null`). The
+  wait is still bounded by the existing 30-second default, and it can use all of it even when Slack isn't set up or the
+  row won't be posted; the Slack side then reads `still-pending`. Posted isn't read, and "This is not a failed handoff"
+  isn't shown when Slack reports a failed delivery. `GET /api/queue/:qitemId` returns `ownerNotificationLevel`, or
+  `null`.
+- **`rig queue whoami --work-candidates` returns up to 50 held and 50 next rows,** with `heldTruncated` and
+  `nextTruncated`. `heldAndNextTruncated` now means either list was cut. With `OPENRIG_REFOCUS_WORK_PACKET` on (off by
+  default, as in 0.6.10), the refocus work packet lists held and next work separately, up to 50 each.
+- **`rig ps --nodes --json` carries `intentionallyStopped`,** and `rig ps --nodes` shows `usage_limit` under REASON for a
+  Codex seat at its usage limit.
 
 ## Seats and restore
 
-- **`rig launch <rigId> <seat>` no longer calls an exited agent running.** When a seat's kept pane is at an idle shell,
-  the launch returns `attention_required` (HTTP 409, exit 1) with `Session alive, agent not running for '<seat>'` and
-  the ways back: resume it with `--snapshot-id <id>` when a snapshot can, `rig seat launch <session> --fresh --stop`, or
-  restart the agent in the pane. The pane and its history are kept. This covers Claude Code, Codex, Pi and OMP seats.
-- **`rig up <rig> --existing` puts back the guidance `rig down` removed.** Before a resumed seat starts, the missing
-  OpenRig managed blocks go back into the rig's Claude file (`CLAUDE.md`, or `CLAUDE.local.md`) or `AGENTS.md` for
-  Codex. Existing blocks and the person's own text are untouched, and nothing is sent to the conversation. The
-  warnings say `Restore guidance: <seat>: put back missing blocks …`. A seat still missing a block keeps running, its
-  node lists `guidanceGaps`, the rig reads `partially_restored` instead of `fully_restored`, and `rig up` exits 1.
-- **A resumed Claude seat whose session ID changed can prove.** When Claude continues `--resume T1` under a new ID T2,
-  and the first SessionStart hook from the process OpenRig launched reports `source: "resume"`, OpenRig records T2. The
-  seat restores as `resumed`, `rig seat clear-attention` can clear it, and sends stop warning that the launch identity
-  differs. Resume commands now start with `OPENRIG_RESUME_LAUNCH='<T1>'`. It needs openrig-core 0.1.9; `/clear`, an
-  in-process `/resume`, or a hand-started process still keep the refusal.
-- **A restore no longer proves a seat from a launcher's token** when the launcher isn't Claude and the Claude it
-  started names a different conversation. That seat reads `mismatch` and the restore returns `attention_required`.
-- **A seat whose tmux session is confirmed gone reads `detached`,** with activity `unknown` and reason
-  `session_missing`. `rig ps --nodes` shows `tmux session missing; restore or relaunch the seat`, `rig seat status`
-  prints a `Reason:` line, and `--full --json` adds `storedSessionStatus`. The stored status isn't rewritten.
-- **A Codex seat at its usage limit reads `unknown` with reason `usage_limit`,** not idle, when its screen ends with
-  the `■ You've hit your usage limit` banner. For a seat bound to a known Codex account, `rig provider signals` can show
-  a provider-event signal for that account that allows a switch decision.
-- **`rig add <rig> …` takes the rig's name as well as its ID.** A name two active rigs share is refused with
-  `rig_ambiguous` and the candidates. `rig launch` still takes an ID only.
-- **`rig start` says why it skipped an existing kernel:** `Kernel auto-boot skipped (kernel rig already managed).` and,
-  if its seats aren't running, `rig up kernel --existing`.
+- **A restore no longer starts a seat fresh when an earlier occupant left a resume token.** If a seat wasn't running
+  when the snapshot was taken, but an earlier session recorded a resume token, `rig up --existing` and `rig launch`
+  stop that seat at `awaiting-decision` and start nothing, because the token doesn't prove that conversation can still
+  resume. `rig launch` of such a seat exits 1 where it used to start it fresh. The message names the command that
+  starts it fresh on purpose. See the known gap below for how this shows in the rig status API.
+- **In a restore of a rig whose seats are in pods, a seat is rolled back as unresumable only when its runtime reports
+  the conversation missing.** When Claude, Codex or Pi reports that, the seat goes back to `awaiting-decision` and
+  nothing starts, instead of a failed launch that left the new pane behind. A rig where every seat ends this way reads
+  `partially_restored` instead of `failed`; the exit code is 1 either way. A Claude that exits to its shell for another
+  reason keeps 0.6.10's result: the seat is reported failed and its pane is kept, so you can read what happened. Restores
+  of rigs without pods keep their earlier handling.
+- **`rig seat launch --fresh --stop` checks before it stops anything.** A seat with a still-live older session is
+  refused before the current agent is stopped; 0.6.10 stopped it first. `--plan` previews a fresh launch without
+  changing anything and exits 0 even when it would be blocked. `--reason` is required only to execute; leaving it out
+  reports `missing_reason`.
+- **A seat you stop on purpose no longer makes its rig read `degraded`.** `rig seat stop` records the stop, and `rig ps`
+  and the TUI leave that seat out of the rig's state; running counts still exclude it. A rig whose seats were all
+  stopped this way reads `stopped`.
+- **Restart one Codex seat in place, on Linux:** `rig seat restart <seat> --keep-conversation --reason "<why>"`
+  restarts it in its own pane on the same conversation, so it starts again on whatever account its Codex home now
+  holds. It doesn't switch accounts itself. Before it stops anything, it checks that the seat is a Codex seat OpenRig
+  launched, in a single pane, with a conversation it can prove, and that relaunching wouldn't change the running
+  settings; any doubt refuses with nothing stopped. `--plan` runs every check and stops nothing.
+  `--verify --expect-account <account>` reports `moved` only when a tool turn has completed in the same conversation
+  since the restart and Codex's status names that account.
+  On macOS, a request that gets as far as reading the running process refuses before stopping the seat, because that
+  reading depends on `/proc`.
+- **A forked Claude seat launches with its own session ID** (`rig fork`, or `session_source: fork`), so strict restore
+  and clear-attention can verify it as its own conversation. Forking a Claude seat needs Claude Code 2.0.73 or later,
+  which OpenRig doesn't check. Forks launched before this keep reading `mismatch` until they're relaunched.
+- **Seats no longer inherit the launching Claude Code or Herdr session's identity variables,** such as `CLAUDECODE`.
+  If removing them fails, the launch goes ahead with a warning.
+- **A member's `cwd` in a rig spec can be `~`, start with `~/`, or use `$VAR` or `${VAR}`,** expanded from the daemon's
+  environment, when the path as written doesn't exist. `rig up` warns on stderr when it chose `/` as the launch folder
+  itself.
+- **A late readiness result no longer overwrites a newer launch attempt.**
 
 ## Sends and wakes
 
-- **Codex seats behind a launcher receive sends.** When a seat's `codex` is a launcher that starts Codex as a child,
-  `rig send` and queue wakes used to refuse with "reports sh as the foreground command". The deepest `codex` on one
-  process chain now counts as the seat. Codex processes on separate branches, or naming different conversations, are
-  still refused.
-- **Claude's faint suggested prompt isn't a person's draft.** A send to an idle Claude seat whose empty input box shows
-  only that suggestion is no longer refused as `prompt_draft`. OpenRig takes one styled capture to tell; real typed or
-  pasted text is still refused, and a suggestion that wraps onto a second row still reads as a draft.
-- **`rig queue create --verify` reports a seat's wake and claim.** For an agent destination it returns as soon as a
-  wake result or a claim is recorded, bounded at 30 seconds, with `receiptSource: "terminal"`, `outcome`, `wakeResult`
-  and `claim {observed, claimedAt, pickup}`. An unconfirmed receipt is not a failed handoff. See the known gap below
-  for a row the seat already claimed.
-- **Keep agent-to-agent escalations off the person's Slack (off by default).** `rig config set queue.wake_human_rung
-  explicit-only` (or `OPENRIG_QUEUE_WAKE_HUMAN_RUNG`) stops the wake ladder's last step at `rig view show escalations`
-  unless the row is addressed to a person: an `@external` address or a registered human. A seat stuck at a prompt only
-  a person can clear still reaches one, and an unreadable human registry posts everything. The default, `always`,
-  changes nothing.
-
-## Slack
-
-- **A decision click that isn't recorded gets one reply in the thread** saying why: the clicker isn't registered, the
-  decision was sent to someone else or is no longer waiting, the button no longer matches, or OpenRig can't find the
-  decision. Where it helps, the reply asks for an answer in words. A recorded click still gets its usual reply, and a
-  redelivered click gets no second one. It's best effort and needs the bot token. A successful press doesn't exercise
-  these replies.
-
-## Terminals and attach
-
-- **Attach commands name the daemon's tmux server.** When the daemon was started inside tmux on a non-default socket,
-  every attach command OpenRig prints carries `-L <name>` or `-S <path>`, including `tmuxAttachCommand` in `rig ps
-  --json`. From inside tmux, run it as `env -u TMUX <tmuxAttachCommand>`. On the default server nothing changed.
-- **When a caller of the daemon's terminal API names no provider, the daemon uses cmux if Herdr isn't available** and
-  cmux is, and says so. A named `--provider` is used as named. `rig terminal open` without `--provider`, and the TUI's
-  "Open terminals", open Herdr, or plain tmux when Herdr is missing, never cmux. The TUI's preview now asks for the
-  same provider as the window it opens, so it isn't refused when cmux is running.
-- **A tmux started inside a Herdr pane is recognised** by Herdr's markers (`HERDR_ENV`, `HERDR_PANE_ID`,
-  `HERDR_SOCKET_PATH`), so `rig terminal open --window` opens in that Herdr.
-
-## Setup
-
-- **`rig setup --providers claude|codex|both`** (or a comma list) sets which harnesses it installs and checks. One not
-  chosen reads `skipped` with `Not selected: …`, never failed. Without the flag, setup is unchanged. `rig doctor` still
-  checks both.
-- **A first `rig daemon start` after a timed-out probe goes ahead when the port is free,** as on WSL2. A port that's
-  really held is refused with `Address already in use (EADDRINUSE)` and the `--port` advice.
-
-## Teams
-
-- **Starter and factory teams run their own first steps and checks without stopping for approval** where they can:
-  plain `rig` commands, the file tool instead of a heredoc, the project's test command first. Their leads read the goal
-  from `rig queue show <id> --full`.
-- **The operator says what a team launch changes in the person's folder before asking** (`CLAUDE.md`, skills,
-  `.mcp.json`, `.openrig/`, and an accept-edits `.claude/settings.local.json`), and offers a separate copy such as a git
-  worktree. When a seat shows `needs_input`, the operator or lead tells the person which seat, what it asks, and its
-  attach command.
+- **`rig send --wait-for-idle N` waits before it takes the seat's delivery lease,** so other sends and queue wakes to
+  that seat aren't held behind a long wait. N is now a deadline from the start of the wait, including any time spent
+  waiting for the lease. A timeout names the wait you asked for.
+- **A parked seat whose occupant is known isn't woken again for the same rows after a wake was delivered,** until it
+  updates one of them or one changes state. A failed, refused or unrecorded wake still repeats at the next park, and a
+  new occupant gets its first wake. "Delivered" means the wake was typed into the seat's terminal, not that the agent
+  read it.
+- **`rig send --verify` confirms enveloped multi-line messages that the agent's screen indents,** and queue wakes use
+  the same check.
+- **A Claude footer in auto, bypass or plan mode on the last line reads idle** when no activity hook is reporting.
+- **A failed Pi or OMP turn shows the provider's own reason** when it gives one.
+- **A `handed-off` closure with no visible successor** gets the same custody advisory and stuck-sweep finding as a
+  `done` closure.
+
+## Status
+
+- **A Codex seat at its usage limit stays `unknown` with reason `usage_limit`** while its screen redraws, instead of
+  reading `running`. It clears when a readable screen shows no banner, or when Codex shows it's working again. See the
+  known gap below.
+- **`rig ps` takes a rig's running count and status from the same set of sessions as `rig ps --nodes`.**
+- **`rig whoami --full --json` shows a Codex seat's `runtimeContext.threadId`** when its stored conversation ID was
+  verified resumable.
+- **The TUI says when a queue sample hit its cap or failed to load:** counts read `N+`, a seat missing from the sample
+  shows `?`, and Pulse no longer lists a NEEDS YOU item a second time. The caps count the whole host, so a quiet rig can
+  read `?` while another rig is busy.
+- **The TUI Topology table's Q, WORK and NOW columns fill again** on drilled views and on a seat's page.
 
 ## Smaller fixes
 
-- `_` and `%` in a `rig view show <lens> --rig <name>` rig name are no longer wildcards, in all seven lenses that
-  filter by rig.
-- `rig ask` matches chat keywords such as `config.json` or `C++` literally.
-- `rig heartbeat` reads CRLF queue files and reads a zone-less proof timestamp as UTC when picking the latest.
-- `rig usage top` reads every sample in its window; `rig usage top|series --json` prints the daemon's error as JSON.
-- A `?limit=` that isn't a number returns 400, not 500.
-- `rig workflow instantiate` and `project` print the instance and packet the daemon returned.
-- `rig transcript --tail` keeps a line ending in `%` and drops a repeated prompt.
-- `--json` after `--` no longer turns an error into JSON; `rig env` prints the daemon's error.
-- A file read over 1 MiB ends at a whole UTF-8 character, and `truncatedAtBytes` says where.
-- The TUI counts CR+LF as one Enter, keeps an emoji whole at a wrap, pages Local reading directories by 10, and skips
-  fenced examples when opening a file at a heading.
-- Scope progress rows go only under a matching `##` heading, frontmatter updates stay inside the exact `---`
-  delimiters, a capability delta expires only with a readable successor file, and fenced examples no longer count as
-  slice sections or progress tasks.
-- `rig package install` looks for a guidance block's closing marker only after its opening one.
-- A Codex seat keeps its last context reading across quota-only usage records, and a fresh Codex launch keeps git
-  metadata paths that end in whitespace.
+- A Slack reply sent with "Also send to channel" in the default channel is recovered after a connection gap.
+- `rig config set daemon.port` refuses a port outside 0–65535, and a port like that from the environment or
+  `config.json` falls back to the file or default with a warning. `rig daemon start --port` refuses one too, with exit 1.
+- Parallel `rig scope slice create` calls get different slice numbers. A number is never reused, and each create leaves
+  a hidden `slices/.nn-NN` claim file.
+- `rig proof show` and `rig proof judge` take `--project <id>` or a `<project>:` scope prefix. Scope readiness for a
+  project selected in the TUI uses that project's own root.
+- The chat send and topic routes return 400 before storing anything for payloads that used to fail with 500;
+  `/api/wake-resolve` answers a fractional or non-numeric generation with its usual "does not exist" reply; watchdog
+  registration refuses a `scan_interval_seconds` that can't be turned into a number (non-numeric text, a boolean, an
+  empty array); and unmanaged-pane discovery matches agent
+  process names exactly, plus `claude.exe` and names cut to 15 or 16 characters.
+- The `rigs` and `openrig-skills` skill descriptions split by who is asking: a person in their own session, or an agent
+  inside a rig.
+- A new reference page covers keeping a watch for a person with today's queue commands, installed at
+  `$OPENRIG_HOME/reference/keeping-a-watch.md`. See the known gap below.
 
 ## What to stop doing
 
-- **Stop reading "already running" from `rig launch` as healthy** for a seat whose agent may have exited; 0.6.10 says
-  `attention_required`.
-- **Stop reading `rig capture --lines N` as N history lines plus the pane.** Add `--history-plus-pane` for that.
-- **Stop testing compact queue rows for null fields.** They're absent; check `fieldsElided`.
-- **Stop attaching to the default tmux server** when the printed command names `-L` or `-S`.
-
-## Known gaps in 0.6.10
-
-- **`rig queue create --verify` can report `outcome: "indeterminate"` for a row the seat already claimed,** with
-  "Terminal receipt unconfirmed (claimed)." Read `claim` for pickup: neither the claim nor this outcome shows the
-  message was displayed or read. It isn't a failed handoff, so don't re-run the create.
-- **The latest first-install check used 0.6.9 on Linux only.** macOS was last checked with 0.6.8, and native Windows
-  hasn't been checked.
+- **Stop expecting a restore to start a seat fresh** when an earlier session left a resume token; decide at
+  `awaiting-decision`, or use the command the message names.
+- **Stop reading `indeterminate` as the answer for a claimed row** from `rig queue create --verify`; 0.6.11 says
+  `claimed`.
+- **Stop treating `degraded` as a stopped seat's doing** after `rig seat stop`; the rig leaves that seat out.
+- **Stop counting a long `--wait-for-idle` as extra time after the lease;** N is a deadline from the start of the wait.
+
+## Known gaps in 0.6.11
+
+- **`rig seat restart --keep-conversation` supports Linux only.** Its automated tests are hermetic: they don't restart a
+  real Codex seat.
+- **The rig status API can call a running rig `blocked` because of one seat that isn't running.** It happens when the
+  latest snapshot recorded no occupant for that seat, an earlier session of the seat left a resume token, and its newest
+  session's restore policy is `resume_if_possible`. A restore from that snapshot would stop at the seat for a decision,
+  and `GET /api/rigs/:id/status` folds that forecast into the rig's status, so it mixes current status with restore
+  readiness: no seat is halted. `rig status` and the TUI's rig list don't show it for a running rig.
+- **A Codex seat can keep reading as at its usage limit** when an old usage-limit banner is followed by a submitted
+  prompt and the agent's reply, with no Codex working line and no input line below. It's recorded again every five
+  minutes, where 0.6.10 let it age out. The case was constructed from the source and hasn't been seen in a real
+  session.
+- **The keeping-a-watch page says a timer fires once; a held-back wake uses up that fire.** When the typing guard holds
+  a one-shot `--wake-after` wake back (it shows as `retained`), that held-back attempt is recorded as the timer's one
+  fire and later wakes aren't, so the timer isn't retired: it can wake the owner again at each interval while the row
+  stays set aside. A row sharing the timer through `--wake-watchdog`, after the original row was handed off or stopped,
+  loses its one wake if that wake is held back. Read the row's transitions after each wake.
+- **After `rig scope slice create` says it couldn't verify membership, the slice was kept.** Check `mission.yaml` before
+  creating it again: creating it again makes a second slice with the same name.
+- **The latest first-install check before this release used 0.6.10 on Linux only.** macOS was last checked with 0.6.8,
+  and native Windows hasn't been checked.
 - **Only one selected lifecycle-help command has been checked in a live Claude session;** source and parser coverage
   is broader. If a help command still asks, report it.
 - **Codex team seats aren't asked before lifecycle commands yet.**
 - **The send gate trusts the most recently recorded hook.** If hooks are recorded out of order, it can hold a send for
   a question that's already answered, or miss one that's waiting. `rig capture` shows the real screen.
 - **A Codex seat whose permission request was approved automatically can still read "needs input".**
-- **A launched team still writes into its working folder;** the operator now says what changes before you agree.
+- **A launched team still writes into its working folder;** the operator says what changes before you agree.
 - **After a restart, `rig status` shows `Kernel: skipped` whatever the kernel seats' state.** Read them with
   `rig ps --nodes --rig kernel --full`.
 - **`rig tui --shared` still attaches on the default tmux server,** so it can't find the dashboard when the daemon runs

package/daemon/context-packs/skills/agent-operated-software/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "agent-operated-software"
-version: "0.6.10"
+version: "0.6.11"
 taxonomy: "skills"
 purpose: "Use when designing, building, operating, or diagnosing an ongoing application whose live backend or control loop includes OpenRig agents, including applications with a Markdown, YAML, or JSON agent control plane or a thin surface over specialist agent roles."
 files:

package/daemon/context-packs/skills/agent-operated-workflows/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "agent-operated-workflows"
-version: "0.6.10"
+version: "0.6.11"
 taxonomy: "skills"
 purpose: "Use when a bounded real-world procedure has a deterministic happy path but brownfield, variable, or partially knowable state; when an operation must resume from verified evidence; or when deciding whether agent judgment or ordinary code should own a procedure's control loop."
 files:

package/daemon/context-packs/skills/applying-a-permission-policy/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "applying-a-permission-policy"
-version: "0.6.10"
+version: "0.6.11"
 taxonomy: "skills"
 purpose: "Use before launching a team during agent-guided setup, or when a user asks to configure OpenRig command permissions, reduce repeated native approval prompts, or apply a selected rig/seat permission policy."
 files:

package/daemon/context-packs/skills/claude-compaction-restore/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "claude-compaction-restore"
-version: "0.6.10"
+version: "0.6.11"
 taxonomy: "skills"
 purpose: "Use when a Claude Code session is about to compact, has just compacted, reached its context limit, resumed after /compact, or must rebuild its working picture of a long-running seat from its own restore map, its JSONL transcript and the files it touched."
 files:

package/daemon/context-packs/skills/core/agent-starters/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "agent-starters"
-version: "0.6.10"
+version: "0.6.11"
 taxonomy: "skills"
 purpose: "Use when creating, refreshing, packaging, inspecting, promoting, or deprecating a named per-seat starting point — Agent Starter manifest authoring, the 6-state lifecycle (captured → named → inspectable → used → promoted → deprecated), provenance honesty, and refusal rules. NOT a VM image; a managed starting point composed from agent role + startup context + optional native session source + provenance."
 files: