@openrig/cli 0.6.10 → 0.6.11

package/daemon/docs/reference/agent-startup-guide.md

@@ -236,6 +236,25 @@ post-launch files. If it needs them, first look at what that occupant has done;
 `rig seat launch <seat> --fresh --reason <text>` starts a blank conversation for the seat. If the occupant is still
 live, the command refuses with `session_live` unless you also pass `--stop`, which replaces that occupant deliberately.
 
+**Preview before replacing a seat.** `rig seat launch <seat> --fresh --plan` inspects the selected
+seat without starting tmux, stopping or launching a process, projecting startup files, or changing
+lifecycle/queue records. Add `--json` for structured output. `--fresh` is still required;
+`--reason` is optional for the preview and required when executing. Pass `--stop` to preview the
+intended replacement of a live managed occupant. Adopted and unmanaged occupants remain blocked.
+
+The plan identifies the target, current occupant, stop requirements, blockers, startup counts,
+and each sibling seat's unchanged effect. Siblings stay attached and untouched. Launch composes
+a new command through the runtime adapter using current settings; it does not replay a stored
+wrapper command. The seat's launch environment and managed executable selection still apply.
+The plan does not construct or display the launch command.
+
+A preview is a snapshot, not a reservation or a native-readiness check. Unreadable tmux produces
+`complete: false` and `launchable: null` (unknown), unless a known blocker already proves
+`launchable: false`. A successful preview exits 0, including blocked or incomplete plans; scripts
+must inspect `launchable === true` before deciding to execute. Request failures still exit nonzero.
+Execution always resolves and checks the current state again. An older daemon without the preview
+endpoint refuses the request; the CLI never falls back to executing a launch.
+
 ### The `applies_on` Field
 
 Each startup file and action specifies when it applies:

package/daemon/docs/reference/keeping-a-watch.md

@@ -0,0 +1,156 @@
+# Keeping a Watch for a Person
+
+**How an operator turns "remind me in 20 minutes" or "tell me when X happens, check every hour" into a watch it
+keeps, using today's queue commands.** The person speaks in sentences. They never see YAML, a job ID or a policy name
+unless they ask.
+
+> **Status (0.7.0, not on by default).** No agent's guidance points here yet, and no profile loads it. It's switched
+> on by adding one line to the kernel operator's role guidance, after a native run on a real install shows the
+> pattern holds. Until then, hand this page to an operator by hand (`docs/reference/keeping-a-watch.md`) to try it.
+
+## The shape
+
+A watch is a **queue task the operator owns**, set aside with a **one-shot timer**:
+
+1. The person asks. The operator creates one task for itself and sets it aside with `--wake-after`.
+2. The timer fires once and wakes the operator. The operator reads the task and checks the condition.
+3. Then it tells the person, re-arms the timer, or both. **A timer fires once: a watch that isn't re-armed goes
+   quiet.**
+
+OpenRig keeps the record and the timer. The operator does the judgment: what to check, and whether it's worth telling
+the person.
+
+## Before you set one: can you reach the person?
+
+Run `rig gateway human list --json`. A watch tells the person through the registered human channel (Slack today,
+also shown in the TUI Feed), at `<entityId>@external`. **A terminal is never a person's address.** If no human is
+registered, say so now, before setting anything up: a watch that can't reach them is a watch they'll never hear from.
+
+## Setting a watch
+
+**1. Write the task body for a successor.** You may be restarted, compacted or replaced before the watch ends. A new
+operator must be able to act from the task alone. Put these in the body:
+
+```markdown
+Person's words: "Tell me when the release PR merges; check every hour."
+Check: `gh pr view <n> --json state` — met when state is MERGED.
+Interval: 1h.
+Tell them: <entityId>@external (human channel), once, when met.
+Stop: after telling them once, or when they say stop.
+Unknown: not said yet.
+```
+
+**2. Create it for yourself,** with a `watch` tag so it can be listed later (tags can't be changed after creation).
+`<your session>` is your session name from `rig whoami --json`:
+
+```bash
+rig queue create --destination <your session> --tags watch \
+  --summary "Watch: tell <person> when the release PR merges (hourly)" --body-file <file>
+```
+
+**3. Set it aside with the timer.** A new pending task can be set aside directly; no claim is needed:
+
+```bash
+rig queue block <task> --on external:<what you check> --wake-after 1h \
+  --continuation "check <what>; tell <person> if met, else re-arm 1h"
+```
+
+`--on` is always required; `external:<what>` names the outside thing you're waiting on. The timer first fires after
+the interval, not now.
+
+**4. Say back what you set, in one or two plain lines:** what you'll check, how often, how they'll be told, and when
+it stops. For example: "I'll check the release PR every hour and message you here once it merges. Then I'll stop."
+
+A plain reminder ("remind me in 20 minutes to look at the release notes") is the same with no condition. Set it aside
+with `--wake-after 20m`, and when it fires, tell them and close it.
+
+## Every time the timer fires: read the record first
+
+When the timer's message arrives, **run `rig queue show <task> --full --json` before doing anything.** A message already
+on its way can still arrive after the watch was stopped or changed. If the task is no longer set aside (done, canceled, or replaced),
+do nothing.
+
+Otherwise, check the condition, then do exactly one of these:
+
+| What you found | Do |
+|---|---|
+| **Met, and the watch was "once"** | Tell the person (below), then close: `rig queue update <task> --state done --closure-reason no-follow-on --note "<what you saw>"` |
+| **Met, and it's "every time"** | Tell the person, then re-arm |
+| **Not met** | Re-arm. Say nothing to the person: never send "nothing yet" |
+| **Can't tell** (no fresh reading) | The first time, tell them once that you can't tell, and why. Record that in a note (`Unknown: said <time>`), then re-arm. **Never say "all fine" for an unknown.** Stay quiet on later unknowns until the reading returns or changes |
+
+**Re-arm** by setting it aside again with a fresh timer:
+
+```bash
+rig queue block <task> --on external:<what> --wake-after 1h --note "checked <time>: not met"
+```
+
+A new set-aside replaces the old one and retires any earlier timer, so a task never carries two live timers.
+
+**Put what changed in `--note` or `--continuation`, not both.** When `rig queue block` gets `--continuation`, that is
+the note it records, and `--note` is dropped.
+
+Each check costs one of your turns on the person's subscription. **Use the longest interval that serves the ask.**
+
+## Telling the person
+
+```bash
+rig queue create --destination <entityId>@external --human-intent update \
+  --summary "<subject>" --body-file <brief> --evidence-ref <watch task id> --verify --json
+```
+
+- Always pass `--evidence-ref`; the watch task's ID is a durable pointer the person can open.
+- Later messages about the same watch can thread with `--reply-to <earlier message's id>`.
+- **`posted` means the connector posted it, not that they read it.** Don't say they saw it.
+- **If delivery fails or is indeterminate,** inspect that task before anything else. Never resend blindly.
+
+## "What are you watching for me?"
+
+List **every active state**, not just set-aside ones. A watch being checked can be in progress, and a new one can be
+pending:
+
+```bash
+rig queue list --owned --state pending,in-progress,blocked --full --limit 200 -o json
+```
+
+Then keep the tasks tagged `watch`. Two rules:
+
+- **Check that the number of tasks returned is below the limit.** The limit applies before you filter by tag. If you got
+  exactly the limit, raise it and list again. **Never report "no watch" from a page that was cut off.**
+- **Use `--full`.** Compact output leaves out the body and the waiting view.
+
+For each watch, say what it checks, how often, how they'll be told, and the next check. The next check is
+`waiting.nextBackstop.dueAt` when `waiting.nextBackstop.mechanism` starts with `watchdog:`. If a set-aside watch shows
+no timed backstop instead, its timer has fired and wasn't re-armed. Check it now and re-arm it.
+
+Answer from the records, so a second reader would give the same list.
+
+## Changing or stopping a watch
+
+| The person says | Do |
+|---|---|
+| **"Check every 2 hours instead"** | Re-arm with the new interval and a note saying what changed: `rig queue block <task> --on external:<what> --wake-after 2h --note "<person's words>"` |
+| **"Watch Y instead"** (what's checked changes) | A task's body can't be edited. Create the new watch, then retire the old one: `rig queue update <old> --state canceled --closure-reason superseded --closure-target <new> --note "<person's words>"` |
+| **"Stop watching that"** | `rig queue update <task> --state canceled --note "<person's words>"`. Leaving the set-aside state retires its timer. A plain cancel takes no other closure fields |
+
+Tell the person in one line what changed. After a stop, take no further action for that watch.
+
+## Across a restart or handover
+
+A set-aside watch's current timer is **kept** when the operator is restarted or replaced, and it fires at whoever is
+the operator next. That's why the body must stand alone.
+
+**One gap:** a timer fires once. If the operator is replaced **after a fire and before the re-arm**, the successor
+inherits a set-aside watch with no live timer. OpenRig's idle-owner check may remind the new operator once, but only
+under some conditions, with no delay guarantee. So:
+
+- **Re-arm promptly** after every fire.
+- **After a restart or handover, list your watches** (above) and re-arm any that show no timed backstop.
+
+## What not to use
+
+- **`rig watchdog register --policy periodic-reminder` for a person's watch.** It repeats every interval until it's
+  stopped (the first fire comes one interval after you register it), and it stops when the agent that registered it
+  is replaced. It's fine for agent-to-agent reminders.
+- **Transcript bytes as "usage".** `context-usage-threshold` measures an agent's transcript, not an account's
+  allowance.

package/daemon/docs/reference/rig-spec.md

@@ -397,7 +397,7 @@ directory's `CLAUDE.md`, including blocks written by other rigs.
 | `profile` | string | yes | — | Profile name from the referenced AgentSpec. Use `default` for the default profile. Exception: `none` for terminal nodes. |
 | `codex_config_profile` | string | no | — | Codex-only native profile passed as `-p <name>`; letters, numbers, `_`, `.`, `-`. Separate from the AgentSpec `profile`. With the normal launch mode, this replaces OpenRig's explicit workspace-write sandbox flag. A full-bypass policy instead emits danger-full-access and omits this profile argument. |
 | `runtime` | string | yes | — | Agent runtime. Current supported values: `claude-code`, `codex`, `pi`, `omp`, `terminal`, `stub`. `stub` is a deterministic test harness, not an agent: a Node runner in the seat's tmux pane goes through the normal launch, skill projection, startup-file and readiness path, follows `<cwd>/.openrig/stub/script.json` when present, and calls no model. See "What a stub can and cannot prove" in `docs/as-built/test-layers.md`. |
-| `cwd` | string | yes | — | Working directory for the agent. A relative path resolves against the rig root (the directory containing the rig spec); an absolute path is used as is. Use `"."` for the rig root itself. Can be overridden at launch time with `rig up --cwd`. A cwd inside the OpenRig installation fails preflight unless `--cwd` is given. |
+| `cwd` | string | yes | — | Working directory for the agent. A relative path resolves against the rig root (the directory containing the rig spec). If that path exists as written, it is used. Otherwise a leading `~` or `~/` expands to the home directory (`~user` does not) and `$VAR` / `${VAR}` expand from the daemon host's environment; a relative result still resolves against the rig root. A reference to an unset variable stays as written, so the cwd is that literal path and works only if it exists. Use `"."` for the rig root itself. Can be overridden at launch time with `rig up --cwd`. A cwd inside the OpenRig installation fails preflight unless `--cwd` is given. |
 | `label` | string | no | — | Human-readable member name. Shown in UI when present. |
 | `model` | string | no | — | Model override. Runtime-specific (e.g., `claude-opus-4-6` for Claude Code). |
 | `effort` | string | no | — | Reasoning effort override, trimmed. A non-string value is ignored with an advisory. |
@@ -406,7 +406,7 @@ directory's `CLAUDE.md`, including blocks written by other rigs.
 | `restore_policy` | string | no | the AgentSpec's | Restore behavior. One of: `resume_if_possible`, `relaunch_fresh`, `checkpoint_only`. The default comes from the AgentSpec's `defaults.lifecycle` (else `resume_if_possible`) as narrowed by its profile; a member value may only narrow it further, in that order. |
 | `compaction_strategy` | string | no | — | `default-compaction`, `managed-compaction`, `handover` or `apprentice-handover`; `harness_native` and `pod_continuity` are accepted as deprecated aliases, and `custom_prompt` is refused. |
 | `mechanic` | string | no | — | A canonical `seat@rig` session address, for `apprentice-handover`. |
-| `session_source` | object | no | — | Start the seat from an existing session: `fork` with `native_id`, `rebuild` with `artifact_set`, or `agent_image` with `image_name`. Not valid on terminal members. |
+| `session_source` | object | no | — | Start the seat from an existing session: `fork` with `native_id`, `rebuild` with `artifact_set`, or `agent_image` with `image_name`. A Claude Code `fork` needs Claude Code 2.0.73 or later. Not valid on terminal members. |
 | `starter_ref` | object | no | — | `{ name }` of an agent starter (`^[a-zA-Z0-9][a-zA-Z0-9_-]*$`) whose files lead the seat's startup. Not valid on terminal members or with a fork. |
 | `startup` | StartupBlock | no | — | Member-level startup files and actions. Applied only to this member. |
 

package/daemon/docs/reference/sdlc-conventions.md

@@ -121,7 +121,17 @@ When the owning scope selects `proofPolicy.judges`, use `rig proof judge` to
 record an attributed accept, reject or withdraw decision on a contract item,
 and `rig proof show` to read derived readiness up through slice, mission and
 project. The nearest slice, mission or project policy selects authorized judges;
-`rig proof --help` describes setup, selectors and evidence requirements. A
+`rig proof --help` describes setup, selectors and evidence requirements. In a
+multi-project workspace catalog, name the project with `--project <id>` or a
+`<id>:` scope prefix (`alpha:m0/slices/01-t001`); unqualified scopes use the
+daemon's selected workspace. The prefix counts only when it names a catalogued
+project and no scope exists at that literal path, so a mission folder with a
+colon (`alpha:trial/slices/01-t001`) still resolves as written. The scopes views
+read a catalog project's readiness against the same project root, so they agree
+with `rig proof show`. A catalog-project read names the project
+(`project: { id, root }`) and reports its source watcher as unavailable; a
+judgment carries that root and is refused (409 `project_changed`) if the
+catalog has since moved the project. A
 correction preserves history and unrelated judgments without editing ancestor
 status checklists. An artifact can identify non-code work without a fabricated
 commit. Evidence capture (`proof add`), policy acceptance, higher outcome

package/daemon/docs/reference/slack-app-setup.md

@@ -178,8 +178,9 @@ are not supported targets.
 
 ## Reconnect recovery and status
 
-The daemon scans available top-level messages in the configured channel after a
-Socket Mode connection and on its existing five-minute retry cadence. Recovered
+The daemon scans available top-level messages and replies broadcast with **Also send to
+channel** in the configured default channel after a Socket Mode connection and on its
+existing five-minute retry cadence. Broadcast replies keep their thread's routing. Recovered
 tasks say **Recovered after a gap** and show the original Slack posting time.
 They use the same sender admission, routing, attachment handling, fixed identity
 and dead-letter path as live messages. A durable dead letter is custody of a
@@ -204,8 +205,9 @@ When Slack reports a plan history limit, recovery still lands the available page
 and advances normally, retaining an older-history limitation in status across restarts.
 Missing bot credentials, history scope, membership, retention limits and API
 failures appear as recovery limitations. No additional scope is required to keep
-live delivery working. Thread-reply catch-up and dead-connection detection remain
-outside this recovery scope; global chronological order is not promised.
+live delivery working. Non-broadcast thread replies and other channels remain outside
+this recovery scope; global chronological order is not promised. This change does not
+replay intervals already checkpointed before broadcast-reply recovery was added.
 
 `rig slack status` retains local configuration checks and adds a bounded daemon
 snapshot: socket state/generation, last event, recovery interval/state/reason,

package/daemon/docs/reference/whats-new.md

@@ -1,7 +1,7 @@
-# What changed in OpenRig 0.6.10
+# What changed in OpenRig 0.6.11
 
-This note is for an agent on an install that was just upgraded to 0.6.10. It lists only what behaves differently from
-0.6.9 and what to do about it. For everything OpenRig can do, read the capability map:
+This note is for an agent on an install that was just upgraded to 0.6.11. It lists only what behaves differently from
+0.6.10 and what to do about it. For everything OpenRig can do, read the capability map:
 `rig context get onboarding-width/public-what-you-can-do.md`. Each release replaces this file, so
 `rig context get reference/whats-new.md` describes the installed version once the upgraded daemon is running. Without
 a running daemon, read `$OPENRIG_HOME/reference/whats-new.md`. The daemon refreshes that copy when it starts, so right
@@ -9,158 +9,159 @@ after an upgrade it can still hold the previous version's note.
 
 ## After the upgrade
 
-- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Two migrations run on the first start: `099`
-  adds one partial index to the queue table, and `101` adds four empty columns to `sessions`. Neither changes existing
-  data. There is no migration `100`. The bundled openrig-core plugin goes from 0.1.8 to 0.1.9.
+- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). One migration runs on the first start: `103`
+  adds one column to `sessions`, `intentionally_stopped`, which is 0 for every existing row. There are no migrations
+  `100` or `102`. The bundled openrig-core plugin stays at 0.1.9; two of its files changed.
+- **Two new switches, both off by default:**
+  - `output.compact` (or `OPENRIG_OUTPUT_COMPACT`): the seven queue write commands (`rig queue create`, `claim`,
+    `unclaim`, `update`, `block`, `handoff` and `handoff-and-complete`) print a short receipt instead of the whole
+    row, and `--full` prints the whole row. While it's off their output is unchanged, `--full` is accepted, and
+    `rig config` lists the key.
+  - `provider.usage_windows` (or `OPENRIG_PROVIDER_USAGE_WINDOWS` in the daemon's environment): `rig provider status
+    --refresh` reads a Codex login's usage windows once. While it's off, `--refresh` says how to turn it on and exits 1.
 
 ## Output that changed shape
 
-- **`rig capture --lines N` is the last N lines,** after blank rows at the bottom are dropped. When earlier lines are
-  cut, stderr says `[rig capture: <session>: N earlier lines not shown; last M shown]`. In `--json`, `lines` is then
-  the count returned, and `requestedLines` and `omittedLines` are new (per seat under `--rig` or `--pod`). For the old
-  output, N history lines plus the whole pane, add `--history-plus-pane`; it keeps the old JSON too, without
-  `requestedLines` or `omittedLines`. Without `--lines`, or with a non-numeric or zero `--lines`, nothing changed. A
-  short capture doesn't prove a seat is idle.
-- **Compact `rig queue list` rows carry `summary`,** and so do `overdue` and `undelivered`. The fields they leave out
-  (`body`, `evidenceRef`, `humanDetail`, `waiting`, `chainOfRecord`, `replyTo`, `humanQuestions`, `humanAnswers`) are
-  now absent, not `null` or `""`, and `fieldsElided` names them. A filter that tested those fields for null must test
-  for presence. Read a full row with `rig queue show <id> --full --json`.
-- **`lastNudgeResult` reads `claimed`** on a claimed row whose wake was recorded as `delivered-ack-pending` or
-  `indeterminate:…`. The recorded value is unchanged and shows in the new `lastNudgeWireResult`; unclaiming brings it
-  back. `claimed` is never promoted to `verified`.
-- **`rig chatroom history` returns the newest messages** when you give neither `--after` nor `--since`, still listed
-  oldest first. Before, a room longer than the limit returned its oldest messages. `--after` and `--since` still page
-  forward from that point, and `rig chatroom wait` is unchanged.
+- **`rig queue create --verify` reports `outcome: "claimed"`** for a claimed row whose wake wasn't confirmed, instead
+  of `indeterminate`. A claim is pickup, not proof the body was read.
+- **`rig queue create --verify` to a registered person who is also a seat with a pane reports the Slack side too.**
+  Beside the terminal wake it adds a `gateway` object: `posted` (`connectorAccepted: true`), `transport-failed` or
+  `never-posted` (`connectorAccepted: false`, with the detail), or `still-pending` (`connectorAccepted: null`). The
+  wait is still bounded by the existing 30-second default, and it can use all of it even when Slack isn't set up or the
+  row won't be posted; the Slack side then reads `still-pending`. Posted isn't read, and "This is not a failed handoff"
+  isn't shown when Slack reports a failed delivery. `GET /api/queue/:qitemId` returns `ownerNotificationLevel`, or
+  `null`.
+- **`rig queue whoami --work-candidates` returns up to 50 held and 50 next rows,** with `heldTruncated` and
+  `nextTruncated`. `heldAndNextTruncated` now means either list was cut. With `OPENRIG_REFOCUS_WORK_PACKET` on (off by
+  default, as in 0.6.10), the refocus work packet lists held and next work separately, up to 50 each.
+- **`rig ps --nodes --json` carries `intentionallyStopped`,** and `rig ps --nodes` shows `usage_limit` under REASON for a
+  Codex seat at its usage limit.
 
 ## Seats and restore
 
-- **`rig launch <rigId> <seat>` no longer calls an exited agent running.** When a seat's kept pane is at an idle shell,
-  the launch returns `attention_required` (HTTP 409, exit 1) with `Session alive, agent not running for '<seat>'` and
-  the ways back: resume it with `--snapshot-id <id>` when a snapshot can, `rig seat launch <session> --fresh --stop`, or
-  restart the agent in the pane. The pane and its history are kept. This covers Claude Code, Codex, Pi and OMP seats.
-- **`rig up <rig> --existing` puts back the guidance `rig down` removed.** Before a resumed seat starts, the missing
-  OpenRig managed blocks go back into the rig's Claude file (`CLAUDE.md`, or `CLAUDE.local.md`) or `AGENTS.md` for
-  Codex. Existing blocks and the person's own text are untouched, and nothing is sent to the conversation. The
-  warnings say `Restore guidance: <seat>: put back missing blocks …`. A seat still missing a block keeps running, its
-  node lists `guidanceGaps`, the rig reads `partially_restored` instead of `fully_restored`, and `rig up` exits 1.
-- **A resumed Claude seat whose session ID changed can prove.** When Claude continues `--resume T1` under a new ID T2,
-  and the first SessionStart hook from the process OpenRig launched reports `source: "resume"`, OpenRig records T2. The
-  seat restores as `resumed`, `rig seat clear-attention` can clear it, and sends stop warning that the launch identity
-  differs. Resume commands now start with `OPENRIG_RESUME_LAUNCH='<T1>'`. It needs openrig-core 0.1.9; `/clear`, an
-  in-process `/resume`, or a hand-started process still keep the refusal.
-- **A restore no longer proves a seat from a launcher's token** when the launcher isn't Claude and the Claude it
-  started names a different conversation. That seat reads `mismatch` and the restore returns `attention_required`.
-- **A seat whose tmux session is confirmed gone reads `detached`,** with activity `unknown` and reason
-  `session_missing`. `rig ps --nodes` shows `tmux session missing; restore or relaunch the seat`, `rig seat status`
-  prints a `Reason:` line, and `--full --json` adds `storedSessionStatus`. The stored status isn't rewritten.
-- **A Codex seat at its usage limit reads `unknown` with reason `usage_limit`,** not idle, when its screen ends with
-  the `■ You've hit your usage limit` banner. For a seat bound to a known Codex account, `rig provider signals` can show
-  a provider-event signal for that account that allows a switch decision.
-- **`rig add <rig> …` takes the rig's name as well as its ID.** A name two active rigs share is refused with
-  `rig_ambiguous` and the candidates. `rig launch` still takes an ID only.
-- **`rig start` says why it skipped an existing kernel:** `Kernel auto-boot skipped (kernel rig already managed).` and,
-  if its seats aren't running, `rig up kernel --existing`.
+- **A restore no longer starts a seat fresh when an earlier occupant left a resume token.** If a seat wasn't running
+  when the snapshot was taken, but an earlier session recorded a resume token, `rig up --existing` and `rig launch`
+  stop that seat at `awaiting-decision` and start nothing, because the token doesn't prove that conversation can still
+  resume. `rig launch` of such a seat exits 1 where it used to start it fresh. The message names the command that
+  starts it fresh on purpose. See the known gap below for how this shows in the rig status API.
+- **In a restore of a rig whose seats are in pods, a seat is rolled back as unresumable only when its runtime reports
+  the conversation missing.** When Claude, Codex or Pi reports that, the seat goes back to `awaiting-decision` and
+  nothing starts, instead of a failed launch that left the new pane behind. A rig where every seat ends this way reads
+  `partially_restored` instead of `failed`; the exit code is 1 either way. A Claude that exits to its shell for another
+  reason keeps 0.6.10's result: the seat is reported failed and its pane is kept, so you can read what happened. Restores
+  of rigs without pods keep their earlier handling.
+- **`rig seat launch --fresh --stop` checks before it stops anything.** A seat with a still-live older session is
+  refused before the current agent is stopped; 0.6.10 stopped it first. `--plan` previews a fresh launch without
+  changing anything and exits 0 even when it would be blocked. `--reason` is required only to execute; leaving it out
+  reports `missing_reason`.
+- **A seat you stop on purpose no longer makes its rig read `degraded`.** `rig seat stop` records the stop, and `rig ps`
+  and the TUI leave that seat out of the rig's state; running counts still exclude it. A rig whose seats were all
+  stopped this way reads `stopped`.
+- **Restart one Codex seat in place, on Linux:** `rig seat restart <seat> --keep-conversation --reason "<why>"`
+  restarts it in its own pane on the same conversation, so it starts again on whatever account its Codex home now
+  holds. It doesn't switch accounts itself. Before it stops anything, it checks that the seat is a Codex seat OpenRig
+  launched, in a single pane, with a conversation it can prove, and that relaunching wouldn't change the running
+  settings; any doubt refuses with nothing stopped. `--plan` runs every check and stops nothing.
+  `--verify --expect-account <account>` reports `moved` only when a tool turn has completed in the same conversation
+  since the restart and Codex's status names that account.
+  On macOS, a request that gets as far as reading the running process refuses before stopping the seat, because that
+  reading depends on `/proc`.
+- **A forked Claude seat launches with its own session ID** (`rig fork`, or `session_source: fork`), so strict restore
+  and clear-attention can verify it as its own conversation. Forking a Claude seat needs Claude Code 2.0.73 or later,
+  which OpenRig doesn't check. Forks launched before this keep reading `mismatch` until they're relaunched.
+- **Seats no longer inherit the launching Claude Code or Herdr session's identity variables,** such as `CLAUDECODE`.
+  If removing them fails, the launch goes ahead with a warning.
+- **A member's `cwd` in a rig spec can be `~`, start with `~/`, or use `$VAR` or `${VAR}`,** expanded from the daemon's
+  environment, when the path as written doesn't exist. `rig up` warns on stderr when it chose `/` as the launch folder
+  itself.
+- **A late readiness result no longer overwrites a newer launch attempt.**
 
 ## Sends and wakes
 
-- **Codex seats behind a launcher receive sends.** When a seat's `codex` is a launcher that starts Codex as a child,
-  `rig send` and queue wakes used to refuse with "reports sh as the foreground command". The deepest `codex` on one
-  process chain now counts as the seat. Codex processes on separate branches, or naming different conversations, are
-  still refused.
-- **Claude's faint suggested prompt isn't a person's draft.** A send to an idle Claude seat whose empty input box shows
-  only that suggestion is no longer refused as `prompt_draft`. OpenRig takes one styled capture to tell; real typed or
-  pasted text is still refused, and a suggestion that wraps onto a second row still reads as a draft.
-- **`rig queue create --verify` reports a seat's wake and claim.** For an agent destination it returns as soon as a
-  wake result or a claim is recorded, bounded at 30 seconds, with `receiptSource: "terminal"`, `outcome`, `wakeResult`
-  and `claim {observed, claimedAt, pickup}`. An unconfirmed receipt is not a failed handoff. See the known gap below
-  for a row the seat already claimed.
-- **Keep agent-to-agent escalations off the person's Slack (off by default).** `rig config set queue.wake_human_rung
-  explicit-only` (or `OPENRIG_QUEUE_WAKE_HUMAN_RUNG`) stops the wake ladder's last step at `rig view show escalations`
-  unless the row is addressed to a person: an `@external` address or a registered human. A seat stuck at a prompt only
-  a person can clear still reaches one, and an unreadable human registry posts everything. The default, `always`,
-  changes nothing.
-
-## Slack
-
-- **A decision click that isn't recorded gets one reply in the thread** saying why: the clicker isn't registered, the
-  decision was sent to someone else or is no longer waiting, the button no longer matches, or OpenRig can't find the
-  decision. Where it helps, the reply asks for an answer in words. A recorded click still gets its usual reply, and a
-  redelivered click gets no second one. It's best effort and needs the bot token. A successful press doesn't exercise
-  these replies.
-
-## Terminals and attach
-
-- **Attach commands name the daemon's tmux server.** When the daemon was started inside tmux on a non-default socket,
-  every attach command OpenRig prints carries `-L <name>` or `-S <path>`, including `tmuxAttachCommand` in `rig ps
-  --json`. From inside tmux, run it as `env -u TMUX <tmuxAttachCommand>`. On the default server nothing changed.
-- **When a caller of the daemon's terminal API names no provider, the daemon uses cmux if Herdr isn't available** and
-  cmux is, and says so. A named `--provider` is used as named. `rig terminal open` without `--provider`, and the TUI's
-  "Open terminals", open Herdr, or plain tmux when Herdr is missing, never cmux. The TUI's preview now asks for the
-  same provider as the window it opens, so it isn't refused when cmux is running.
-- **A tmux started inside a Herdr pane is recognised** by Herdr's markers (`HERDR_ENV`, `HERDR_PANE_ID`,
-  `HERDR_SOCKET_PATH`), so `rig terminal open --window` opens in that Herdr.
-
-## Setup
-
-- **`rig setup --providers claude|codex|both`** (or a comma list) sets which harnesses it installs and checks. One not
-  chosen reads `skipped` with `Not selected: …`, never failed. Without the flag, setup is unchanged. `rig doctor` still
-  checks both.
-- **A first `rig daemon start` after a timed-out probe goes ahead when the port is free,** as on WSL2. A port that's
-  really held is refused with `Address already in use (EADDRINUSE)` and the `--port` advice.
-
-## Teams
-
-- **Starter and factory teams run their own first steps and checks without stopping for approval** where they can:
-  plain `rig` commands, the file tool instead of a heredoc, the project's test command first. Their leads read the goal
-  from `rig queue show <id> --full`.
-- **The operator says what a team launch changes in the person's folder before asking** (`CLAUDE.md`, skills,
-  `.mcp.json`, `.openrig/`, and an accept-edits `.claude/settings.local.json`), and offers a separate copy such as a git
-  worktree. When a seat shows `needs_input`, the operator or lead tells the person which seat, what it asks, and its
-  attach command.
+- **`rig send --wait-for-idle N` waits before it takes the seat's delivery lease,** so other sends and queue wakes to
+  that seat aren't held behind a long wait. N is now a deadline from the start of the wait, including any time spent
+  waiting for the lease. A timeout names the wait you asked for.
+- **A parked seat whose occupant is known isn't woken again for the same rows after a wake was delivered,** until it
+  updates one of them or one changes state. A failed, refused or unrecorded wake still repeats at the next park, and a
+  new occupant gets its first wake. "Delivered" means the wake was typed into the seat's terminal, not that the agent
+  read it.
+- **`rig send --verify` confirms enveloped multi-line messages that the agent's screen indents,** and queue wakes use
+  the same check.
+- **A Claude footer in auto, bypass or plan mode on the last line reads idle** when no activity hook is reporting.
+- **A failed Pi or OMP turn shows the provider's own reason** when it gives one.
+- **A `handed-off` closure with no visible successor** gets the same custody advisory and stuck-sweep finding as a
+  `done` closure.
+
+## Status
+
+- **A Codex seat at its usage limit stays `unknown` with reason `usage_limit`** while its screen redraws, instead of
+  reading `running`. It clears when a readable screen shows no banner, or when Codex shows it's working again. See the
+  known gap below.
+- **`rig ps` takes a rig's running count and status from the same set of sessions as `rig ps --nodes`.**
+- **`rig whoami --full --json` shows a Codex seat's `runtimeContext.threadId`** when its stored conversation ID was
+  verified resumable.
+- **The TUI says when a queue sample hit its cap or failed to load:** counts read `N+`, a seat missing from the sample
+  shows `?`, and Pulse no longer lists a NEEDS YOU item a second time. The caps count the whole host, so a quiet rig can
+  read `?` while another rig is busy.
+- **The TUI Topology table's Q, WORK and NOW columns fill again** on drilled views and on a seat's page.
 
 ## Smaller fixes
 
-- `_` and `%` in a `rig view show <lens> --rig <name>` rig name are no longer wildcards, in all seven lenses that
-  filter by rig.
-- `rig ask` matches chat keywords such as `config.json` or `C++` literally.
-- `rig heartbeat` reads CRLF queue files and reads a zone-less proof timestamp as UTC when picking the latest.
-- `rig usage top` reads every sample in its window; `rig usage top|series --json` prints the daemon's error as JSON.
-- A `?limit=` that isn't a number returns 400, not 500.
-- `rig workflow instantiate` and `project` print the instance and packet the daemon returned.
-- `rig transcript --tail` keeps a line ending in `%` and drops a repeated prompt.
-- `--json` after `--` no longer turns an error into JSON; `rig env` prints the daemon's error.
-- A file read over 1 MiB ends at a whole UTF-8 character, and `truncatedAtBytes` says where.
-- The TUI counts CR+LF as one Enter, keeps an emoji whole at a wrap, pages Local reading directories by 10, and skips
-  fenced examples when opening a file at a heading.
-- Scope progress rows go only under a matching `##` heading, frontmatter updates stay inside the exact `---`
-  delimiters, a capability delta expires only with a readable successor file, and fenced examples no longer count as
-  slice sections or progress tasks.
-- `rig package install` looks for a guidance block's closing marker only after its opening one.
-- A Codex seat keeps its last context reading across quota-only usage records, and a fresh Codex launch keeps git
-  metadata paths that end in whitespace.
+- A Slack reply sent with "Also send to channel" in the default channel is recovered after a connection gap.
+- `rig config set daemon.port` refuses a port outside 0–65535, and a port like that from the environment or
+  `config.json` falls back to the file or default with a warning. `rig daemon start --port` refuses one too, with exit 1.
+- Parallel `rig scope slice create` calls get different slice numbers. A number is never reused, and each create leaves
+  a hidden `slices/.nn-NN` claim file.
+- `rig proof show` and `rig proof judge` take `--project <id>` or a `<project>:` scope prefix. Scope readiness for a
+  project selected in the TUI uses that project's own root.
+- The chat send and topic routes return 400 before storing anything for payloads that used to fail with 500;
+  `/api/wake-resolve` answers a fractional or non-numeric generation with its usual "does not exist" reply; watchdog
+  registration refuses a `scan_interval_seconds` that can't be turned into a number (non-numeric text, a boolean, an
+  empty array); and unmanaged-pane discovery matches agent
+  process names exactly, plus `claude.exe` and names cut to 15 or 16 characters.
+- The `rigs` and `openrig-skills` skill descriptions split by who is asking: a person in their own session, or an agent
+  inside a rig.
+- A new reference page covers keeping a watch for a person with today's queue commands, installed at
+  `$OPENRIG_HOME/reference/keeping-a-watch.md`. See the known gap below.
 
 ## What to stop doing
 
-- **Stop reading "already running" from `rig launch` as healthy** for a seat whose agent may have exited; 0.6.10 says
-  `attention_required`.
-- **Stop reading `rig capture --lines N` as N history lines plus the pane.** Add `--history-plus-pane` for that.
-- **Stop testing compact queue rows for null fields.** They're absent; check `fieldsElided`.
-- **Stop attaching to the default tmux server** when the printed command names `-L` or `-S`.
-
-## Known gaps in 0.6.10
-
-- **`rig queue create --verify` can report `outcome: "indeterminate"` for a row the seat already claimed,** with
-  "Terminal receipt unconfirmed (claimed)." Read `claim` for pickup: neither the claim nor this outcome shows the
-  message was displayed or read. It isn't a failed handoff, so don't re-run the create.
-- **The latest first-install check used 0.6.9 on Linux only.** macOS was last checked with 0.6.8, and native Windows
-  hasn't been checked.
+- **Stop expecting a restore to start a seat fresh** when an earlier session left a resume token; decide at
+  `awaiting-decision`, or use the command the message names.
+- **Stop reading `indeterminate` as the answer for a claimed row** from `rig queue create --verify`; 0.6.11 says
+  `claimed`.
+- **Stop treating `degraded` as a stopped seat's doing** after `rig seat stop`; the rig leaves that seat out.
+- **Stop counting a long `--wait-for-idle` as extra time after the lease;** N is a deadline from the start of the wait.
+
+## Known gaps in 0.6.11
+
+- **`rig seat restart --keep-conversation` supports Linux only.** Its automated tests are hermetic: they don't restart a
+  real Codex seat.
+- **The rig status API can call a running rig `blocked` because of one seat that isn't running.** It happens when the
+  latest snapshot recorded no occupant for that seat, an earlier session of the seat left a resume token, and its newest
+  session's restore policy is `resume_if_possible`. A restore from that snapshot would stop at the seat for a decision,
+  and `GET /api/rigs/:id/status` folds that forecast into the rig's status, so it mixes current status with restore
+  readiness: no seat is halted. `rig status` and the TUI's rig list don't show it for a running rig.
+- **A Codex seat can keep reading as at its usage limit** when an old usage-limit banner is followed by a submitted
+  prompt and the agent's reply, with no Codex working line and no input line below. It's recorded again every five
+  minutes, where 0.6.10 let it age out. The case was constructed from the source and hasn't been seen in a real
+  session.
+- **The keeping-a-watch page says a timer fires once; a held-back wake uses up that fire.** When the typing guard holds
+  a one-shot `--wake-after` wake back (it shows as `retained`), that held-back attempt is recorded as the timer's one
+  fire and later wakes aren't, so the timer isn't retired: it can wake the owner again at each interval while the row
+  stays set aside. A row sharing the timer through `--wake-watchdog`, after the original row was handed off or stopped,
+  loses its one wake if that wake is held back. Read the row's transitions after each wake.
+- **After `rig scope slice create` says it couldn't verify membership, the slice was kept.** Check `mission.yaml` before
+  creating it again: creating it again makes a second slice with the same name.
+- **The latest first-install check before this release used 0.6.10 on Linux only.** macOS was last checked with 0.6.8,
+  and native Windows hasn't been checked.
 - **Only one selected lifecycle-help command has been checked in a live Claude session;** source and parser coverage
   is broader. If a help command still asks, report it.
 - **Codex team seats aren't asked before lifecycle commands yet.**
 - **The send gate trusts the most recently recorded hook.** If hooks are recorded out of order, it can hold a send for
   a question that's already answered, or miss one that's waiting. `rig capture` shows the real screen.
 - **A Codex seat whose permission request was approved automatically can still read "needs input".**
-- **A launched team still writes into its working folder;** the operator now says what changes before you agree.
+- **A launched team still writes into its working folder;** the operator says what changes before you agree.
 - **After a restart, `rig status` shows `Kernel: skipped` whatever the kernel seats' state.** Read them with
   `rig ps --nodes --rig kernel --full`.
 - **`rig tui --shared` still attaches on the default tmux server,** so it can't find the dashboard when the daemon runs

package/daemon/specs/agents/shared/skills/core/openrig-skills/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: openrig-skills
-description: "Use when you're operating OpenRig and need the right skill or context for fleet recovery, seat handover, new-seat orientation, a watchdog wake, cross-host reach to an agent on another machine, rig packaging, an OpenRig upgrade, systematic debugging, queue triage, or implementation planning; also use when you don't know what applies or nothing is projected on cold boot."
+description: "Use when an agent running inside OpenRig needs the right skill or context for fleet recovery, seat handover, new-seat orientation, a watchdog wake, cross-host reach to an agent on another machine, rig packaging, an OpenRig upgrade, systematic debugging, queue triage, or implementation planning; also when the agent doesn't know what applies or nothing is projected on cold boot. Installing, starting or updating OpenRig, getting back to a team or bringing a stopped one back from a person's own session is the rigs skill."
 allowed-tools: Bash(rig:*)
 metadata:
   openrig: