@overdeck/contracts 0.63.0 → 0.65.0

package/dist/index.cjs

@@ -107,7 +107,8 @@ const IssueState = effect.Schema.Literals([
 const IssueAttention = effect.Schema.Literals([
 	"needs-you",
 	"stuck",
-	"api-error"
+	"api-error",
+	"work-not-started"
 ]);
 /** Latest review decision on the PR, as the forge reports it. */
 const PrReviewState = effect.Schema.Literals([
@@ -140,6 +141,16 @@ const DerivedBranchState = effect.Schema.Struct({
 	aheadOfMain: effect.Schema.Number,
 	pushed: effect.Schema.Boolean
 });
+/** The workspace journal's read on a post-planning auto-start (PAN-4399). */
+const DerivedWorkStart = effect.Schema.Struct({
+	status: effect.Schema.Literals(["retrying", "not-started"]),
+	/** ISO time of the journal entry the status was read from. */
+	at: effect.Schema.String,
+	error: effect.Schema.optional(effect.Schema.String),
+	nextRetryAt: effect.Schema.optional(effect.Schema.String),
+	/** The retry is journaled but not actually running because the Deacon is frozen (PAN-4210). Present only when true. */
+	held: effect.Schema.optional(effect.Schema.Literal(true))
+});
 /** Everything the dashboard needs to render an issue's pipeline position. */
 const DerivedIssueState = effect.Schema.Struct({
 	issueId: effect.Schema.String,
@@ -152,7 +163,9 @@ const DerivedIssueState = effect.Schema.Struct({
 	* precedence — could not be ruled in or out. Present only in that case; an
 	* unresolved tracker read is never reported as an open issue.
 	*/
-	trackerUnknown: effect.Schema.optional(effect.Schema.Literal(true))
+	trackerUnknown: effect.Schema.optional(effect.Schema.Literal(true)),
+	/** A deferred or gave-up post-planning auto-start read from the workspace journal (PAN-4399). */
+	workStart: effect.Schema.optional(DerivedWorkStart)
 });
 const ISSUE_STATES = [
 	"backlog",
@@ -180,7 +193,8 @@ const ISSUE_STATE_PRECEDENCE = [
 const ISSUE_ATTENTIONS = [
 	"needs-you",
 	"stuck",
-	"api-error"
+	"api-error",
+	"work-not-started"
 ];
 function isIssueState(value) {
 	return typeof value === "string" && ISSUE_STATES.includes(value);
@@ -483,6 +497,13 @@ const ChannelPermissionRequestSnapshot = effect.Schema.Struct({
 	inputPreview: effect.Schema.String,
 	createdAt: effect.Schema.String
 });
+/** PAN-4371 — advisory Jev reading of why an idle agent ended its turn. kind is a string (append-only store). */
+const TurnEndAssessment = effect.Schema.Struct({
+	kind: effect.Schema.String,
+	confidence: effect.Schema.Number,
+	needsAnswer: effect.Schema.Boolean,
+	model: effect.Schema.String
+});
 const AgentSnapshot = effect.Schema.Struct({
 	id: AgentId,
 	issueId: IssueId,
@@ -545,6 +566,7 @@ const AgentSnapshot = effect.Schema.Struct({
 	})),
 	resolution: effect.Schema.optional(AgentResolution),
 	resolutionCount: effect.Schema.optional(effect.Schema.Number),
+	turnEndAssessment: effect.Schema.optional(TurnEndAssessment),
 	runtimeSnapshotSequence: effect.Schema.optional(SequenceNumber)
 });
 /** PAN-3151: A recorded cycle in the review convergence tracking series */
@@ -1802,7 +1824,8 @@ const AgentEnrichmentChangedEvent = effect.Schema.Struct({
 			plan: effect.Schema.String
 		})),
 		resolution: effect.Schema.optional(AgentResolution),
-		resolutionCount: effect.Schema.optional(effect.Schema.Number)
+		resolutionCount: effect.Schema.optional(effect.Schema.Number),
+		turnEndAssessment: effect.Schema.optional(TurnEndAssessment)
 	})
 });
 /** New — agent created in database */
@@ -3197,6 +3220,30 @@ const OpenInEditorInput = effect.Schema.Struct({
 	editor: EditorIdSchema
 });
 //#endregion
+//#region src/effort.ts
+/**
+* Canonical reasoning-effort levels, end to end. `xhigh` was added in Opus 4.7
+* (between `high` and `max`); `max` predates it (Opus 4.6+/Sonnet 4.6). This is
+* the single source of truth for the enum — every other copy in the codebase
+* derives from it.
+*/
+const EFFORT_LEVELS = [
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+const DEFAULT_EFFORT = "high";
+const EffortLevelSchema = effect.Schema.Literals(EFFORT_LEVELS);
+function isEffortLevel(value) {
+	return typeof value === "string" && EFFORT_LEVELS.includes(value);
+}
+/** Compares two effort levels by rank; negative when `a` is lower than `b`. */
+function compareEffort(a, b) {
+	return EFFORT_LEVELS.indexOf(a) - EFFORT_LEVELS.indexOf(b);
+}
+//#endregion
 //#region src/rpc.ts
 const WS_METHODS = {
 	scanConversations: "pan.scanConversations",
@@ -3282,6 +3329,8 @@ const ContextUsage = effect.Schema.Struct({
 	maxObservedInputTokens: effect.Schema.optional(effect.Schema.Number),
 	/** Model the most recent assistant turn ran under (from JSONL). */
 	lastModel: effect.Schema.optional(effect.Schema.NullOr(effect.Schema.String)),
+	/** PAN-4255: effort observed in the transcript (assistant `effort` or an /effort confirmation). Claude Code only. */
+	lastEffort: effect.Schema.optional(effect.Schema.NullOr(effect.Schema.String)),
 	/** ISO timestamp of the most recent assistant turn. */
 	lastTurnAt: effect.Schema.optional(effect.Schema.NullOr(effect.Schema.String))
 });
@@ -3352,7 +3401,14 @@ const ConversationResponse = effect.Schema.Struct({
 	proposedPlan: effect.Schema.optional(ProposedPlan),
 	compactBoundaries: effect.Schema.optional(effect.Schema.Array(CompactBoundary)),
 	contextUsage: effect.Schema.optional(effect.Schema.NullOr(ContextUsage)),
-	subagents: effect.Schema.optional(effect.Schema.Array(SubagentSummary))
+	subagents: effect.Schema.optional(effect.Schema.Array(SubagentSummary)),
+	/** PAN-4255: effort read from the agent's transcript (claude-code only). */
+	observedEffort: effect.Schema.optional(effect.Schema.NullOr(EffortLevelSchema)),
+	/** PAN-4255: the effort the agent was launched/pinned with and its EffortSource layer. */
+	effortResolution: effect.Schema.optional(effect.Schema.NullOr(effect.Schema.Struct({
+		effort: EffortLevelSchema,
+		source: effect.Schema.String
+	})))
 });
 const ConversationEvent = effect.Schema.Union([
 	effect.Schema.Struct({
@@ -3793,6 +3849,39 @@ const GetConversationStatsRpc = effect_unstable_rpc_Rpc.make(WS_METHODS.getConve
 /** All Overdeck WebSocket RPC methods */
 const PanRpcGroup = effect_unstable_rpc_RpcGroup.make(SubscribeDomainEventsRpc, SubscribeIssueEventsRpc, SubscribeTerminalRpc, SubscribeAgentOutputRpc, GetSnapshotRpc, ReplayEventsRpc, ReadWorkspaceFileRpc, ReadFileAtPathRpc, WriteFileAtPathRpc, ResolveFilePathExistsRpc, TerminalOpenRpc, TerminalWriteRpc, TerminalResizeRpc, TerminalCloseRpc, StartPlanningRpc, StartAgentRpc, DeepWipeRpc, SendTerminalInputRpc, ResizeTerminalRpc, SubscribeConversationMessagesRpc, SubscribeProjectSessionTreeRpc, ShellOpenInEditorRpc, GetAvailableEditorsRpc, ScanConversationsRpc, SearchConversationsRpc, ListDiscoveredSessionsRpc, ListSessionsFeedRpc, GetSessionsFeedFacetsRpc, GetDiscoveredSessionRpc, EnrichSessionsRpc, EmbedSessionsRpc, GetConversationCostRpc, GetConversationCostByWorkspaceRpc, GetConversationStatsRpc);
 //#endregion
+//#region src/agent-runtime-merge.ts
+function defaultRuntimeSnapshot(agentId, timestamp, sequence) {
+	return {
+		id: agentId,
+		activity: "idle",
+		lastActivity: timestamp,
+		updatedAtSequence: sequence
+	};
+}
+/**
+* Merge a snapshot's runtime map into the client's, per agent. A freshly booted
+* server may serve an older or missing entry; a client entry with a strictly
+* newer `lastActivity` (or an equal stamp with a higher `updatedAtSequence`)
+* survives, and an agent the snapshot omits keeps its entry.
+*/
+function mergeSnapshotRuntimeById(current, incoming) {
+	if (!incoming) return { ...current };
+	const merged = { ...current };
+	for (const [agentId, next] of Object.entries(incoming)) {
+		const held = current[agentId];
+		merged[agentId] = held && heldIsNewer(held, next) ? held : next;
+	}
+	return merged;
+}
+/** Newer `lastActivity` wins; equal stamps fall to the higher `updatedAtSequence`. */
+function heldIsNewer(held, next) {
+	const heldAt = Date.parse(held.lastActivity);
+	const nextAt = Date.parse(next.lastActivity);
+	if (heldAt > nextAt) return true;
+	if (heldAt !== nextAt) return false;
+	return Number.isFinite(held.updatedAtSequence) && Number.isFinite(next.updatedAtSequence) && held.updatedAtSequence > next.updatedAtSequence;
+}
+//#endregion
 //#region src/issue-delta.ts
 function createIssueDelta(previous, next) {
 	const changes = [];
@@ -3908,14 +3997,6 @@ function removeAgentFromSessionIndex(agentIdBySessionId, agentId) {
 	for (const [sessionId, id] of Object.entries(agentIdBySessionId ?? {})) if (id !== agentId) next[sessionId] = id;
 	return next;
 }
-function defaultRuntimeSnapshot(agentId, timestamp, sequence) {
-	return {
-		id: agentId,
-		activity: "idle",
-		lastActivity: timestamp,
-		updatedAtSequence: sequence
-	};
-}
 /**
 * Bump runtimeSnapshotSequence on the corresponding AgentSnapshot (if present)
 * so low-frequency subscribers can cheaply detect a runtime change. No-op if
@@ -3948,16 +4029,17 @@ function syncSnapshot(state, snapshot) {
 		channelPermissionRequestIdsByAgentId[request.agentId] = [...existing, request.requestId];
 	}
 	const memory = snapshot.memory;
+	const agentRuntimeById = mergeSnapshotRuntimeById(state.agentRuntimeById, snapshot.agentRuntimeById);
 	const agentIdBySessionId = {};
 	for (const agent of snapshot.agents) if (agent.sessionId) agentIdBySessionId[agent.sessionId] = agent.id;
-	for (const [agentId, runtime] of Object.entries(snapshot.agentRuntimeById ?? {})) if (runtime.claudeSessionId) agentIdBySessionId[runtime.claudeSessionId] = agentId;
+	for (const [agentId, runtime] of Object.entries(agentRuntimeById)) if (runtime.claudeSessionId) agentIdBySessionId[runtime.claudeSessionId] = agentId;
 	return {
 		...state,
 		sequence: snapshot.sequence,
 		agentsById,
 		derivedIssueStateByIssueId,
 		backendPanesById,
-		agentRuntimeById: snapshot.agentRuntimeById ?? state.agentRuntimeById,
+		agentRuntimeById,
 		channelPermissionRequestsById,
 		channelPermissionRequestIdsByAgentId,
 		resolvedChannelPermissionDecisionsById: {},
@@ -4056,7 +4138,8 @@ function applyEvent(state, event) {
 						pendingAskUserQuestion: event.payload.pendingAskUserQuestion,
 						pendingProposedPlan: event.payload.pendingProposedPlan,
 						resolution: event.payload.resolution,
-						resolutionCount: event.payload.resolutionCount
+						resolutionCount: event.payload.resolutionCount,
+						turnEndAssessment: event.payload.turnEndAssessment
 					}
 				}
 			};
@@ -4194,6 +4277,7 @@ function applyEvent(state, event) {
 					delete base["pendingInputKinds"];
 					delete base["pendingAskUserQuestion"];
 					delete base["pendingProposedPlan"];
+					delete base["turnEndAssessment"];
 				}
 				return base;
 			})();
@@ -5287,30 +5371,6 @@ function deriveProjectCi(record) {
 	};
 }
 //#endregion
-//#region src/effort.ts
-/**
-* Canonical reasoning-effort levels, end to end. `xhigh` was added in Opus 4.7
-* (between `high` and `max`); `max` predates it (Opus 4.6+/Sonnet 4.6). This is
-* the single source of truth for the enum — every other copy in the codebase
-* derives from it.
-*/
-const EFFORT_LEVELS = [
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max"
-];
-const DEFAULT_EFFORT = "high";
-const EffortLevelSchema = effect.Schema.Literals(EFFORT_LEVELS);
-function isEffortLevel(value) {
-	return typeof value === "string" && EFFORT_LEVELS.includes(value);
-}
-/** Compares two effort levels by rank; negative when `a` is lower than `b`. */
-function compareEffort(a, b) {
-	return EFFORT_LEVELS.indexOf(a) - EFFORT_LEVELS.indexOf(b);
-}
-//#endregion
 //#region src/flywheel.ts
 const FlywheelRunId = effect.Schema.String.check(effect.Schema.isPattern(/^RUN-\d+$/));
 const FlywheelHttpUrl = effect.Schema.String.check(effect.Schema.isPattern(/^https?:\/\/\S+$/i));
@@ -6911,196 +6971,649 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"id": "pan-skills-set",
 		"path": ["skills", "set"],
 		"display": "/pan skills set",
-		"description": "Set a skill on, off, or inherit (global unless --project/--issue)",
+		"description": "Set a skill (<skill> <state>) or a pack (--pack <id> <state>) on, off, or inherit",
 		"args": [{
-			"name": "skill",
-			"required": true,
-			"variadic": false
-		}, {
-			"name": "state",
-			"required": true,
-			"variadic": false
-		}],
-		"options": [{
-			"flags": "--project <key>",
-			"description": "Project override",
+			"name": "args",
 			"required": true,
-			"valueHint": "key"
-		}, {
-			"flags": "--issue <id>",
-			"description": "Issue override",
-			"required": true,
-			"valueHint": "id"
+			"variadic": true
 		}],
-		"aliases": [],
-		"category": "Core"
-	},
-	{
-		"id": "pan-issues",
-		"path": ["issues"],
-		"display": "/pan issues",
-		"description": "List and triage work across configured trackers",
-		"args": [],
 		"options": [
 			{
-				"flags": "--all",
-				"description": "Include closed issues",
-				"required": false,
-				"valueHint": null
-			},
-			{
-				"flags": "--mine",
-				"description": "Show only my assigned issues",
-				"required": false,
-				"valueHint": null
-			},
-			{
-				"flags": "--json",
-				"description": "Output as JSON",
-				"required": false,
-				"valueHint": null
-			},
-			{
-				"flags": "--tracker <type>",
-				"description": "Query specific tracker (linear/github/gitlab)",
+				"flags": "--project <key>",
+				"description": "Project override",
 				"required": true,
-				"valueHint": "type"
+				"valueHint": "key"
 			},
 			{
-				"flags": "--all-trackers",
-				"description": "Query all configured trackers",
-				"required": false,
-				"valueHint": null
+				"flags": "--issue <id>",
+				"description": "Issue override",
+				"required": true,
+				"valueHint": "id"
 			},
 			{
-				"flags": "--triage",
-				"description": "Show triage queue",
-				"required": false,
-				"valueHint": null
+				"flags": "--pack <id>",
+				"description": "Set a whole skill pack instead of one skill",
+				"required": true,
+				"valueHint": "id"
 			}
 		],
 		"aliases": [],
-		"category": "Lifecycle"
+		"category": "Core"
 	},
 	{
-		"id": "pan-show",
-		"path": ["show"],
-		"display": "/pan show",
-		"description": "Unified lens: derived issue state, CV, context, health for one issue",
+		"id": "pan-skills-pack",
+		"path": ["skills", "pack"],
+		"display": "/pan skills pack",
+		"description": "Register, update, and cache external skill packs pinned to a commit",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-pack-add",
+		"path": [
+			"skills",
+			"pack",
+			"add"
+		],
+		"display": "/pan skills pack add",
+		"description": "Register a git skill pack at the commit a ref resolves to (enables nothing)",
 		"args": [{
 			"name": "id",
 			"required": true,
 			"variadic": false
+		}, {
+			"name": "url",
+			"required": true,
+			"variadic": false
 		}],
 		"options": [
 			{
-				"flags": "--cv",
-				"description": "Agent work history only",
-				"required": false,
-				"valueHint": null
-			},
-			{
-				"flags": "--context",
-				"description": "Context engineering state only",
-				"required": false,
-				"valueHint": null
+				"flags": "--ref <ref>",
+				"description": "Tag or branch to pin",
+				"required": true,
+				"valueHint": "ref"
 			},
 			{
-				"flags": "--health",
-				"description": "Health + heartbeat only",
-				"required": false,
-				"valueHint": null
+				"flags": "--adapter <adapter>",
+				"description": "plain, claude-plugin, or deft-readonly",
+				"required": true,
+				"valueHint": "adapter"
 			},
 			{
-				"flags": "--json",
-				"description": "Output as JSON",
+				"flags": "--yes",
+				"description": "Trust the resolved commit without asking",
 				"required": false,
 				"valueHint": null
 			}
 		],
 		"aliases": [],
-		"category": "Observation"
+		"category": "Core"
 	},
 	{
-		"id": "pan-open",
-		"path": ["open"],
-		"display": "/pan open",
-		"description": "Open an issue workspace in your preferred editor",
+		"id": "pan-skills-pack-update",
+		"path": [
+			"skills",
+			"pack",
+			"update"
+		],
+		"display": "/pan skills pack update",
+		"description": "Move a pack to the commit its ref (or --ref) now resolves to",
 		"args": [{
 			"name": "id",
 			"required": true,
 			"variadic": false
 		}],
 		"options": [{
-			"flags": "-e, --editor <editor>",
-			"description": "Editor to use (cursor, windsurf, vscode, zed, etc.)",
+			"flags": "--ref <ref>",
+			"description": "Switch to a different tag or branch",
 			"required": true,
-			"valueHint": "editor"
+			"valueHint": "ref"
+		}, {
+			"flags": "--yes",
+			"description": "Trust the new commit without asking",
+			"required": false,
+			"valueHint": null
 		}],
 		"aliases": [],
-		"category": "Observation"
+		"category": "Core"
 	},
 	{
-		"id": "pan-review",
-		"path": ["review"],
-		"display": "/pan review",
-		"description": "Review-loop management: request re-review, abort reviewers, restart a round",
+		"id": "pan-skills-pack-list",
+		"path": [
+			"skills",
+			"pack",
+			"list"
+		],
+		"display": "/pan skills pack list",
+		"description": "List registered skill packs",
 		"args": [],
-		"options": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Output as JSON",
+			"required": false,
+			"valueHint": null
+		}, {
+			"flags": "--offline",
+			"description": "Skip the update check (no network)",
+			"required": false,
+			"valueHint": null
+		}],
 		"aliases": [],
-		"category": "Review"
+		"category": "Core"
 	},
 	{
-		"id": "pan-review-request",
-		"path": ["review", "request"],
-		"display": "/pan review request",
-		"description": "Request re-review after fixing feedback",
+		"id": "pan-skills-pack-remove",
+		"path": [
+			"skills",
+			"pack",
+			"remove"
+		],
+		"display": "/pan skills pack remove",
+		"description": "Unregister a pack, clear its global toggles, and delete its cache",
 		"args": [{
 			"name": "id",
 			"required": true,
 			"variadic": false
 		}],
-		"options": [{
-			"flags": "-m, --message <text>",
-			"description": "Message describing the fixes applied",
-			"required": true,
-			"valueHint": "text"
-		}],
+		"options": [],
 		"aliases": [],
-		"category": "Review"
+		"category": "Core"
 	},
 	{
-		"id": "pan-review-abort",
-		"path": ["review", "abort"],
-		"display": "/pan review abort",
-		"description": "Kill all running reviewer sessions and leave the worker idle",
+		"id": "pan-skills-pack-sync",
+		"path": [
+			"skills",
+			"pack",
+			"sync"
+		],
+		"display": "/pan skills pack sync",
+		"description": "Re-fetch packs and extract their trusted commits (all packs when omitted)",
 		"args": [{
 			"name": "id",
-			"required": true,
+			"required": false,
 			"variadic": false
 		}],
 		"options": [],
 		"aliases": [],
-		"category": "Review"
+		"category": "Core"
 	},
 	{
-		"id": "pan-review-restart",
-		"path": ["review", "restart"],
-		"display": "/pan review restart",
-		"description": "Resume review and re-dispatch reviewers missing a report",
-		"args": [{
-			"name": "id",
-			"required": true,
-			"variadic": false
-		}],
+		"id": "pan-skills-pack-gc",
+		"path": [
+			"skills",
+			"pack",
+			"gc"
+		],
+		"display": "/pan skills pack gc",
+		"description": "Remove unused skill pack mounts and dangling launch links",
+		"args": [],
 		"options": [{
-			"flags": "--model <model>",
-			"description": "Override model for all reviewers (e.g. gpt-5.4, claude-sonnet-5)",
+			"flags": "--max-age-days <n>",
+			"description": "Keep unused mounts younger than this",
 			"required": true,
-			"valueHint": "model"
-		}, {
-			"flags": "--role <role>",
-			"description": "Restart only a specific reviewer role (correctness/security/performance/requirements)",
+			"valueHint": "n"
+		}],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-pack-sageox",
+		"path": [
+			"skills",
+			"pack",
+			"sageox"
+		],
+		"display": "/pan skills pack sageox",
+		"description": "SageOx pack state and per-project upload opt-in (PAN-2444)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-pack-sageox-status",
+		"path": [
+			"skills",
+			"pack",
+			"sageox",
+			"status"
+		],
+		"display": "/pan skills pack sageox status",
+		"description": "Show, per project, the sageox pack state and the upload state",
+		"args": [],
+		"options": [{
+			"flags": "--project <key>",
+			"description": "Only this project",
+			"required": true,
+			"valueHint": "key"
+		}, {
+			"flags": "--json",
+			"description": "Output as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-pack-sageox-upload",
+		"path": [
+			"skills",
+			"pack",
+			"sageox",
+			"upload"
+		],
+		"display": "/pan skills pack sageox upload",
+		"description": "Turn SageOx uploads on or off for a project (off by default)",
+		"args": [{
+			"name": "state",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--project <key>",
+			"description": "Project key",
+			"required": true,
+			"valueHint": "key"
+		}],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-deft",
+		"path": ["skills", "deft"],
+		"display": "/pan skills deft",
+		"description": "Deft Directive detection, ownership report, and managed mode",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-deft-status",
+		"path": [
+			"skills",
+			"deft",
+			"status"
+		],
+		"display": "/pan skills deft status",
+		"description": "Show Directive detection, the deft pack, the skill map, managed mode, and the ownership report",
+		"args": [],
+		"options": [{
+			"flags": "--project <key>",
+			"description": "Registered project (default: the current repo)",
+			"required": true,
+			"valueHint": "key"
+		}, {
+			"flags": "--json",
+			"description": "Output as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-deft-enable",
+		"path": [
+			"skills",
+			"deft",
+			"enable"
+		],
+		"display": "/pan skills deft enable",
+		"description": "Enable Deft managed mode for a Directive project after showing the ownership plan",
+		"args": [],
+		"options": [{
+			"flags": "--project <key>",
+			"description": "Registered project",
+			"required": true,
+			"valueHint": "key"
+		}, {
+			"flags": "--yes",
+			"description": "Accept the printed plan without asking",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-deft-disable",
+		"path": [
+			"skills",
+			"deft",
+			"disable"
+		],
+		"display": "/pan skills deft disable",
+		"description": "Disable Deft managed mode; project files are untouched",
+		"args": [],
+		"options": [{
+			"flags": "--project <key>",
+			"description": "Registered project",
+			"required": true,
+			"valueHint": "key"
+		}],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-pair",
+		"path": ["pair"],
+		"display": "/pan pair",
+		"description": "Print a one-time URL that pairs another device with this dashboard (see configuration/remote-access.mdx)",
+		"args": [],
+		"options": [
+			{
+				"flags": "--label <name>",
+				"description": "Name to record for the pairing in the activity log",
+				"required": true,
+				"valueHint": "name"
+			},
+			{
+				"flags": "--url <base>",
+				"description": "Base URL the other device can reach (default: this dashboard's API URL)",
+				"required": true,
+				"valueHint": "base"
+			},
+			{
+				"flags": "--json",
+				"description": "Print { url, credential, expiresAt } as JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-devices",
+		"path": ["devices"],
+		"display": "/pan devices",
+		"description": "List or revoke paired devices (see configuration/remote-access.mdx)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-devices-list",
+		"path": ["devices", "list"],
+		"display": "/pan devices list",
+		"description": "List paired devices with created, last-used and revoked times",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Print the devices as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-devices-revoke",
+		"path": ["devices", "revoke"],
+		"display": "/pan devices revoke",
+		"description": "Revoke a paired device and close its live connections",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-token",
+		"path": ["token"],
+		"display": "/pan token",
+		"description": "Create, list or revoke scoped access tokens (see configuration/remote-access.mdx)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-token-create",
+		"path": ["token", "create"],
+		"display": "/pan token create",
+		"description": "Create a scoped access token and print it once",
+		"args": [{
+			"name": "name",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--scopes <list>",
+			"description": "Comma-separated scopes: read:events, read:state, read:conversations, tell, operate, admin",
+			"required": true,
+			"valueHint": "list"
+		}, {
+			"flags": "--json",
+			"description": "Print { id, name, scopes, token } as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-token-list",
+		"path": ["token", "list"],
+		"display": "/pan token list",
+		"description": "List access tokens with scopes and created, last-used and revoked times",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Print the tokens as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-token-revoke",
+		"path": ["token", "revoke"],
+		"display": "/pan token revoke",
+		"description": "Revoke an access token and close its live connections",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-issues",
+		"path": ["issues"],
+		"display": "/pan issues",
+		"description": "List and triage work across configured trackers",
+		"args": [],
+		"options": [
+			{
+				"flags": "--all",
+				"description": "Include closed issues",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--mine",
+				"description": "Show only my assigned issues",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--json",
+				"description": "Output as JSON",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--tracker <type>",
+				"description": "Query specific tracker (linear/github/gitlab)",
+				"required": true,
+				"valueHint": "type"
+			},
+			{
+				"flags": "--all-trackers",
+				"description": "Query all configured trackers",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--triage",
+				"description": "Show triage queue",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "Lifecycle"
+	},
+	{
+		"id": "pan-show",
+		"path": ["show"],
+		"display": "/pan show",
+		"description": "Unified lens: derived issue state, CV, context, health for one issue",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [
+			{
+				"flags": "--cv",
+				"description": "Agent work history only",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--context",
+				"description": "Context engineering state only",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--health",
+				"description": "Health + heartbeat only",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--json",
+				"description": "Output as JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "Observation"
+	},
+	{
+		"id": "pan-open",
+		"path": ["open"],
+		"display": "/pan open",
+		"description": "Open an issue workspace in your preferred editor",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "-e, --editor <editor>",
+			"description": "Editor to use (cursor, windsurf, vscode, zed, etc.)",
+			"required": true,
+			"valueHint": "editor"
+		}],
+		"aliases": [],
+		"category": "Observation"
+	},
+	{
+		"id": "pan-review",
+		"path": ["review"],
+		"display": "/pan review",
+		"description": "Review-loop management: request re-review, abort reviewers, restart a round",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "Review"
+	},
+	{
+		"id": "pan-review-request",
+		"path": ["review", "request"],
+		"display": "/pan review request",
+		"description": "Request re-review after fixing feedback",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "-m, --message <text>",
+			"description": "Message describing the fixes applied",
+			"required": true,
+			"valueHint": "text"
+		}],
+		"aliases": [],
+		"category": "Review"
+	},
+	{
+		"id": "pan-review-waive-test-removal",
+		"path": ["review", "waive-test-removal"],
+		"display": "/pan review waive-test-removal",
+		"description": "Operator-only: let a net test removal past the test-skip gate at the current head",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--reason <text>",
+			"description": "Why the removed tests are gone and nothing replaces them",
+			"required": true,
+			"valueHint": "text"
+		}],
+		"aliases": [],
+		"category": "Review"
+	},
+	{
+		"id": "pan-review-abort",
+		"path": ["review", "abort"],
+		"display": "/pan review abort",
+		"description": "Kill all running reviewer sessions and leave the worker idle",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Review"
+	},
+	{
+		"id": "pan-review-restart",
+		"path": ["review", "restart"],
+		"display": "/pan review restart",
+		"description": "Resume review and re-dispatch reviewers missing a report",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--model <model>",
+			"description": "Override model for all reviewers (e.g. gpt-5.4, claude-sonnet-5)",
+			"required": true,
+			"valueHint": "model"
+		}, {
+			"flags": "--role <role>",
+			"description": "Restart only a specific reviewer role (correctness/security/performance/requirements)",
 			"required": true,
 			"valueHint": "role"
 		}],
@@ -7193,7 +7706,7 @@ const COMPOSER_COMMAND_MANIFEST = [
 			},
 			{
 				"flags": "--effort <level>",
-				"description": "Planning effort: low | medium | high",
+				"description": "Planning effort: low | medium | high | xhigh | max",
 				"required": true,
 				"valueHint": "level"
 			},
@@ -7249,6 +7762,12 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"description": "Bypass the PRD-first gate for a genuinely trivial issue (loud; prefer writing the PRD)",
 				"required": false,
 				"valueHint": null
+			},
+			{
+				"flags": "--critic",
+				"description": "Require an independent different-family plan critique before promotion (automatic for architecture, substrate-improvement and security labels)",
+				"required": false,
+				"valueHint": null
 			}
 		],
 		"aliases": [],
@@ -7301,6 +7820,43 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"aliases": [],
 		"category": "Lifecycle"
 	},
+	{
+		"id": "pan-ask",
+		"path": ["ask"],
+		"display": "/pan ask",
+		"description": "Ask the operator a blocking decision; it appears in the dashboard Needs-you",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}, {
+			"name": "question",
+			"required": false,
+			"variadic": false
+		}],
+		"options": [
+			{
+				"flags": "--option <label>",
+				"description": "A choice the operator can pick (repeat 2-4 times)",
+				"required": true,
+				"valueHint": "label"
+			},
+			{
+				"flags": "--context <text>",
+				"description": "What you already tried or know, shown with the question",
+				"required": true,
+				"valueHint": "text"
+			},
+			{
+				"flags": "--withdraw",
+				"description": "Close your open decision request (answered another way, or no longer needed)",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
 	{
 		"id": "pan-answer",
 		"path": ["answer"],
@@ -7449,12 +8005,24 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"required": true,
 				"valueHint": "model"
 			},
+			{
+				"flags": "--effort <level>",
+				"description": "Reasoning effort for the new conversation: low, medium, high, xhigh or max; defaults to the source conversation's effort",
+				"required": true,
+				"valueHint": "level"
+			},
 			{
 				"flags": "--cwd <path>",
 				"description": "Working directory for the summary-forked session",
 				"required": true,
 				"valueHint": "path"
 			},
+			{
+				"flags": "--allow-primary",
+				"description": "Operator only: allow --cwd to be a project's primary checkout (refused for agent sessions)",
+				"required": false,
+				"valueHint": null
+			},
 			{
 				"flags": "--project <key>",
 				"description": "Project (yaml key or display name) for the new conversation; defaults to inheriting the source conversation's project",
@@ -7492,6 +8060,12 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"required": true,
 				"valueHint": "model"
 			},
+			{
+				"flags": "--effort <level>",
+				"description": "Reasoning effort for the new conversation: low, medium, high, xhigh or max; defaults to the source conversation's effort",
+				"required": true,
+				"valueHint": "level"
+			},
 			{
 				"flags": "--harness <harness>",
 				"description": "Ignored: harness is provider-default-only (PAN-1984)",
@@ -7504,6 +8078,12 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"required": true,
 				"valueHint": "path"
 			},
+			{
+				"flags": "--allow-primary",
+				"description": "Operator only: allow --cwd to be a project's primary checkout (refused for agent sessions)",
+				"required": false,
+				"valueHint": null
+			},
 			{
 				"flags": "--project <key>",
 				"description": "Project (yaml key or display name) for the new conversation; defaults to inheriting the source conversation's project",
@@ -7545,6 +8125,24 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"description": "Ignored: author harness is provider-default-only (PAN-1984)",
 				"required": true,
 				"valueHint": "harness"
+			},
+			{
+				"flags": "--skill <name>",
+				"description": "Turn this skill on for the new conversation only (repeatable); a pack skill is <pack>/<skill>",
+				"required": true,
+				"valueHint": "name"
+			},
+			{
+				"flags": "--pack <id>",
+				"description": "Turn every skill of this cached skill pack on for the new conversation only (repeatable)",
+				"required": true,
+				"valueHint": "id"
+			},
+			{
+				"flags": "--hold",
+				"description": "Create and launch the new conversation without sending the kickoff; start it with Send in the dashboard or pan handoff start <conv>",
+				"required": false,
+				"valueHint": null
 			}
 		],
 		"aliases": [],
@@ -8334,6 +8932,11 @@ const COMPOSER_COMMAND_MANIFEST = [
 			"description": "Print JSON",
 			"required": false,
 			"valueHint": null
+		}, {
+			"flags": "--steal",
+			"description": "Claim even when a running agent holds this item or an overlapping one (foreman/operator override)",
+			"required": false,
+			"valueHint": null
 		}],
 		"aliases": [],
 		"category": "Lifecycle"
@@ -8380,6 +8983,11 @@ const COMPOSER_COMMAND_MANIFEST = [
 			"description": "Print JSON",
 			"required": false,
 			"valueHint": null
+		}, {
+			"flags": "--on <refs...>",
+			"description": "Issues or PRs this item waits on (PAN-123, #45, owner/repo#45, PR URL); Overdeck wakes the agent when all have merged",
+			"required": true,
+			"valueHint": "refs..."
 		}],
 		"aliases": [],
 		"category": "Lifecycle"
@@ -8486,12 +9094,187 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"required": false,
 				"valueHint": null
 			},
-			{
-				"flags": "--labels <labels>",
-				"description": "Comma-separated labels for routing (e.g., docs,marketing)",
-				"required": true,
-				"valueHint": "labels"
-			},
+			{
+				"flags": "--labels <labels>",
+				"description": "Comma-separated labels for routing (e.g., docs,marketing)",
+				"required": true,
+				"valueHint": "labels"
+			},
+			{
+				"flags": "--project <path>",
+				"description": "Explicit project path (overrides registry)",
+				"required": true,
+				"valueHint": "path"
+			},
+			{
+				"flags": "--docker",
+				"description": "Start Docker containers after workspace creation",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--remote",
+				"description": "Create workspace on remote VM (Fly.io)",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--local",
+				"description": "Create workspace locally (explicit override)",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-migrate",
+		"path": ["workspace", "migrate"],
+		"display": "/pan workspace migrate",
+		"description": "Migrate workspace between local and remote (stops+pauses the local agent, commits and pushes all work first)",
+		"args": [{
+			"name": "issueId",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [
+			{
+				"flags": "--to <location>",
+				"description": "Target location: \"remote\" or \"local\" (default: auto-detect from current location)",
+				"required": true,
+				"valueHint": "location"
+			},
+			{
+				"flags": "--keep",
+				"description": "Keep the source workspace after migration",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--force",
+				"description": "Overwrite an existing destination workspace / ignore branch-drift guard",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-ssh",
+		"path": ["workspace", "ssh"],
+		"display": "/pan workspace ssh",
+		"description": "SSH into remote workspace VM",
+		"args": [{
+			"name": "issueId",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-sync-auth",
+		"path": ["workspace", "sync-auth"],
+		"display": "/pan workspace sync-auth",
+		"description": "Sync Claude Code credentials to remote workspace",
+		"args": [{
+			"name": "issueId",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-start",
+		"path": ["workspace", "start"],
+		"display": "/pan workspace start",
+		"description": "Start a stopped remote workspace",
+		"args": [{
+			"name": "issueId",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-stop",
+		"path": ["workspace", "stop"],
+		"display": "/pan workspace stop",
+		"description": "Stop (hibernate) a remote workspace",
+		"args": [{
+			"name": "issueId",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-list",
+		"path": ["workspace", "list"],
+		"display": "/pan workspace list",
+		"description": "List all workspaces",
+		"args": [],
+		"options": [
+			{
+				"flags": "--json",
+				"description": "Output as JSON",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--all",
+				"description": "List workspaces across all registered projects",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--kind <kind>",
+				"description": "Filter by workspace kind (main|issue|scratch), reading through the resolver",
+				"required": true,
+				"valueHint": "kind"
+			},
+			{
+				"flags": "--archived",
+				"description": "Include archived workspaces (only applies with --kind)",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--stale",
+				"description": "Show reclaim candidates: merged branches still on disk, with sizes",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-destroy",
+		"path": ["workspace", "destroy"],
+		"display": "/pan workspace destroy",
+		"description": "Destroy workspace (all shapes by default: base, strike, and slot worktrees)",
+		"args": [{
+			"name": "issueId",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [
+			{
+				"flags": "--force",
+				"description": "Force removal even with uncommitted changes",
+				"required": false,
+				"valueHint": null
+			},
 			{
 				"flags": "--project <path>",
 				"description": "Explicit project path (overrides registry)",
@@ -8499,20 +9282,14 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"valueHint": "path"
 			},
 			{
-				"flags": "--docker",
-				"description": "Start Docker containers after workspace creation",
-				"required": false,
-				"valueHint": null
-			},
-			{
-				"flags": "--remote",
-				"description": "Create workspace on remote VM (Fly.io)",
-				"required": false,
-				"valueHint": null
+				"flags": "--shape <shape>",
+				"description": "Limit to one shape: base|strike|slot|all (default: all)",
+				"required": true,
+				"valueHint": "shape"
 			},
 			{
-				"flags": "--local",
-				"description": "Create workspace locally (explicit override)",
+				"flags": "--purge-memory",
+				"description": "Also permanently delete the workspace's memory home (irreversible)",
 				"required": false,
 				"valueHint": null
 			}
@@ -8521,31 +9298,43 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"category": "Workspace"
 	},
 	{
-		"id": "pan-workspace-migrate",
-		"path": ["workspace", "migrate"],
-		"display": "/pan workspace migrate",
-		"description": "Migrate workspace between local and remote (stops+pauses the local agent, commits and pushes all work first)",
+		"id": "pan-workspace-new",
+		"path": ["workspace", "new"],
+		"display": "/pan workspace new",
+		"description": "Create a scratch workspace (shared dir by default; --isolated for a git worktree)",
 		"args": [{
-			"name": "issueId",
+			"name": "name",
 			"required": true,
 			"variadic": false
 		}],
 		"options": [
 			{
-				"flags": "--to <location>",
-				"description": "Target location: \"remote\" or \"local\" (default: auto-detect from current location)",
+				"flags": "--project <key>",
+				"description": "Registered project key (defaults to the sole project, or the one resolved from cwd)",
 				"required": true,
-				"valueHint": "location"
+				"valueHint": "key"
 			},
 			{
-				"flags": "--keep",
-				"description": "Keep the source workspace after migration",
+				"flags": "--isolated",
+				"description": "Create an isolated git worktree instead of sharing the project directory",
 				"required": false,
 				"valueHint": null
 			},
 			{
-				"flags": "--force",
-				"description": "Overwrite an existing destination workspace / ignore branch-drift guard",
+				"flags": "--parent-branch <branch>",
+				"description": "Parent branch for the isolated worktree (default: inferred from the project's current branch)",
+				"required": true,
+				"valueHint": "branch"
+			},
+			{
+				"flags": "--target-path <dir>",
+				"description": "Target an existing directory as the workspace path (rejects --isolated)",
+				"required": true,
+				"valueHint": "dir"
+			},
+			{
+				"flags": "--dry-run",
+				"description": "Print the resolved intent as JSON and create nothing",
 				"required": false,
 				"valueHint": null
 			}
@@ -8554,12 +9343,27 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"category": "Workspace"
 	},
 	{
-		"id": "pan-workspace-ssh",
-		"path": ["workspace", "ssh"],
-		"display": "/pan workspace ssh",
-		"description": "SSH into remote workspace VM",
+		"id": "pan-workspace-main",
+		"path": ["workspace", "main"],
+		"display": "/pan workspace main",
+		"description": "Resolve or create the project's singleton main workspace",
+		"args": [],
+		"options": [{
+			"flags": "--project <key>",
+			"description": "Registered project key (defaults to the sole project, or the one resolved from cwd)",
+			"required": true,
+			"valueHint": "key"
+		}],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-get",
+		"path": ["workspace", "get"],
+		"display": "/pan workspace get",
+		"description": "Show a workspace row by id",
 		"args": [{
-			"name": "issueId",
+			"name": "ws",
 			"required": true,
 			"variadic": false
 		}],
@@ -8568,12 +9372,12 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"category": "Workspace"
 	},
 	{
-		"id": "pan-workspace-sync-auth",
-		"path": ["workspace", "sync-auth"],
-		"display": "/pan workspace sync-auth",
-		"description": "Sync Claude Code credentials to remote workspace",
+		"id": "pan-workspace-activate",
+		"path": ["workspace", "activate"],
+		"display": "/pan workspace activate",
+		"description": "Touch a workspace's last-accessed time and print its layout hint",
 		"args": [{
-			"name": "issueId",
+			"name": "ws",
 			"required": true,
 			"variadic": false
 		}],
@@ -8582,12 +9386,12 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"category": "Workspace"
 	},
 	{
-		"id": "pan-workspace-start",
-		"path": ["workspace", "start"],
-		"display": "/pan workspace start",
-		"description": "Start a stopped remote workspace",
+		"id": "pan-workspace-archive",
+		"path": ["workspace", "archive"],
+		"display": "/pan workspace archive",
+		"description": "Archive a workspace (reversible; refuses kind=main)",
 		"args": [{
-			"name": "issueId",
+			"name": "ws",
 			"required": true,
 			"variadic": false
 		}],
@@ -8596,53 +9400,117 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"category": "Workspace"
 	},
 	{
-		"id": "pan-workspace-stop",
-		"path": ["workspace", "stop"],
-		"display": "/pan workspace stop",
-		"description": "Stop (hibernate) a remote workspace",
+		"id": "pan-workspace-relocate",
+		"path": ["workspace", "relocate"],
+		"display": "/pan workspace relocate",
+		"description": "Point a workspace at a new path (refuses kind=issue; kind=main requires --force)",
 		"args": [{
-			"name": "issueId",
+			"name": "ws",
 			"required": true,
 			"variadic": false
 		}],
-		"options": [],
+		"options": [{
+			"flags": "--path <dir>",
+			"description": "New path (must be an existing directory)",
+			"required": true,
+			"valueHint": "dir"
+		}, {
+			"flags": "--force",
+			"description": "Allow relocating the main workspace, diverging it from projects.yaml",
+			"required": false,
+			"valueHint": null
+		}],
 		"aliases": [],
 		"category": "Workspace"
 	},
 	{
-		"id": "pan-workspace-list",
-		"path": ["workspace", "list"],
-		"display": "/pan workspace list",
-		"description": "List all workspaces",
-		"args": [],
+		"id": "pan-workspace-render-devcontainer",
+		"path": ["workspace", "render-devcontainer"],
+		"display": "/pan workspace render-devcontainer",
+		"description": "Re-render <workspace>/.devcontainer/ from the project compose template",
+		"args": [{
+			"name": "featureName",
+			"required": true,
+			"variadic": false
+		}],
 		"options": [
 			{
-				"flags": "--json",
-				"description": "Output as JSON",
-				"required": false,
-				"valueHint": null
+				"flags": "--project <key>",
+				"description": "Project key in projects.yaml (e.g. mind-your-now)",
+				"required": true,
+				"valueHint": "key"
 			},
 			{
-				"flags": "--all",
-				"description": "List workspaces across all registered projects",
+				"flags": "--workspace <path>",
+				"description": "Override the inferred workspace path",
+				"required": true,
+				"valueHint": "path"
+			},
+			{
+				"flags": "--json",
+				"description": "Emit JSON instead of human-readable output",
 				"required": false,
 				"valueHint": null
-			},
+			}
+		],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-deep-clean",
+		"path": ["workspace", "deep-clean"],
+		"display": "/pan workspace deep-clean",
+		"description": "Interactive: git clean -fd against a workspace (preserves protected paths)",
+		"args": [{
+			"name": "issueId",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--yes",
+			"description": "Skip confirmation prompt (still requires a TTY)",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-rebuild",
+		"path": ["workspace", "rebuild"],
+		"display": "/pan workspace rebuild",
+		"description": "Tear down, re-render, and restart a single workspace Docker stack",
+		"args": [{
+			"name": "issueId",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-reap",
+		"path": ["workspace", "reap"],
+		"display": "/pan workspace reap",
+		"description": "List or remove orphaned unhealthy workspace Docker stacks and orphaned workspace networks",
+		"args": [],
+		"options": [
 			{
-				"flags": "--kind <kind>",
-				"description": "Filter by workspace kind (main|issue|scratch), reading through the resolver",
+				"flags": "--days <days>",
+				"description": "Minimum age in days",
 				"required": true,
-				"valueHint": "kind"
+				"valueHint": "days"
 			},
 			{
-				"flags": "--archived",
-				"description": "Include archived workspaces (only applies with --kind)",
+				"flags": "--apply",
+				"description": "Run docker compose down -v --remove-orphans for stack candidates and remove orphaned workspace networks",
 				"required": false,
 				"valueHint": null
 			},
 			{
-				"flags": "--stale",
-				"description": "Show reclaim candidates: merged branches still on disk, with sizes",
+				"flags": "--yes",
+				"description": "Skip confirmation when using --apply",
 				"required": false,
 				"valueHint": null
 			}
@@ -8651,345 +9519,515 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"category": "Workspace"
 	},
 	{
-		"id": "pan-workspace-destroy",
-		"path": ["workspace", "destroy"],
-		"display": "/pan workspace destroy",
-		"description": "Destroy workspace (all shapes by default: base, strike, and slot worktrees)",
+		"id": "pan-workspace-update",
+		"path": ["workspace", "update"],
+		"display": "/pan workspace update",
+		"description": "Update skills/agents/rules in an existing workspace",
+		"args": [{
+			"name": "issueId",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--force",
+			"description": "Overwrite user-modified files",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-use-config",
+		"path": ["workspace", "use-config"],
+		"display": "/pan workspace use-config",
+		"description": "Copy installed Overdeck config into workspace (makes it user settings)",
+		"args": [{
+			"name": "issueId",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--project <path>",
+			"description": "Explicit project path (overrides registry)",
+			"required": true,
+			"valueHint": "path"
+		}],
+		"aliases": [],
+		"category": "Workspace"
+	},
+	{
+		"id": "pan-workspace-add-repo",
+		"path": ["workspace", "add-repo"],
+		"display": "/pan workspace add-repo",
+		"description": "Add configured repositories or register a new repository in a polyrepo workspace",
 		"args": [{
-			"name": "issueId",
+			"name": "workspaceId",
 			"required": true,
 			"variadic": false
+		}, {
+			"name": "repoNames",
+			"required": false,
+			"variadic": true
 		}],
 		"options": [
 			{
-				"flags": "--force",
-				"description": "Force removal even with uncommitted changes",
+				"flags": "--dry-run",
+				"description": "Show what would be added",
 				"required": false,
 				"valueHint": null
 			},
 			{
-				"flags": "--project <path>",
-				"description": "Explicit project path (overrides registry)",
+				"flags": "--group <groupName>",
+				"description": "Add all repos from a named group (from groups_file)",
 				"required": true,
-				"valueHint": "path"
+				"valueHint": "groupName"
 			},
 			{
-				"flags": "--shape <shape>",
-				"description": "Limit to one shape: base|strike|slot|all (default: all)",
+				"flags": "--new <gitUrl>",
+				"description": "Register a repository that was created during this issue",
 				"required": true,
-				"valueHint": "shape"
+				"valueHint": "gitUrl"
 			},
 			{
-				"flags": "--purge-memory",
-				"description": "Also permanently delete the workspace's memory home (irreversible)",
-				"required": false,
-				"valueHint": null
+				"flags": "--project <key>",
+				"description": "Explicit project key from projects.yaml (overrides registry)",
+				"required": true,
+				"valueHint": "key"
 			}
 		],
 		"aliases": [],
 		"category": "Workspace"
 	},
 	{
-		"id": "pan-workspace-new",
-		"path": ["workspace", "new"],
-		"display": "/pan workspace new",
-		"description": "Create a scratch workspace (shared dir by default; --isolated for a git worktree)",
+		"id": "pan-vault",
+		"path": ["vault"],
+		"display": "/pan vault",
+		"description": "Session Vault: encrypted off-machine storage and cross-machine resume for agent conversations",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-vault-setup",
+		"path": ["vault", "setup"],
+		"display": "/pan vault setup",
+		"description": "Enable the vault against your own git remote and print the recovery phrase once",
 		"args": [{
-			"name": "name",
+			"name": "git-url",
 			"required": true,
 			"variadic": false
 		}],
 		"options": [
 			{
-				"flags": "--project <key>",
-				"description": "Registered project key (defaults to the sole project, or the one resolved from cwd)",
-				"required": true,
-				"valueHint": "key"
-			},
-			{
-				"flags": "--isolated",
-				"description": "Create an isolated git worktree instead of sharing the project directory",
+				"flags": "--hooks",
+				"description": "Also register the Claude Code Stop hook that saves after each turn",
 				"required": false,
 				"valueHint": null
 			},
 			{
-				"flags": "--parent-branch <branch>",
-				"description": "Parent branch for the isolated worktree (default: inferred from the project's current branch)",
+				"flags": "--passphrase-file <path>",
+				"description": "Also enable passphrase unlock with the passphrase in this file",
 				"required": true,
-				"valueHint": "branch"
+				"valueHint": "path"
 			},
 			{
-				"flags": "--target-path <dir>",
-				"description": "Target an existing directory as the workspace path (rejects --isolated)",
-				"required": true,
-				"valueHint": "dir"
+				"flags": "--generate-passphrase",
+				"description": "Also enable passphrase unlock with a generated 6-word passphrase, printed once",
+				"required": false,
+				"valueHint": null
 			},
 			{
-				"flags": "--dry-run",
-				"description": "Print the resolved intent as JSON and create nothing",
+				"flags": "--no-passphrase",
+				"description": "Do not offer passphrase unlock",
 				"required": false,
 				"valueHint": null
 			}
 		],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-main",
-		"path": ["workspace", "main"],
-		"display": "/pan workspace main",
-		"description": "Resolve or create the project's singleton main workspace",
-		"args": [],
+		"id": "pan-vault-join",
+		"path": ["vault", "join"],
+		"display": "/pan vault join",
+		"description": "Join an existing vault from another machine with the vault passphrase or the recovery phrase",
+		"args": [{
+			"name": "git-url",
+			"required": true,
+			"variadic": false
+		}],
 		"options": [{
-			"flags": "--project <key>",
-			"description": "Registered project key (defaults to the sole project, or the one resolved from cwd)",
+			"flags": "--phrase-file <path>",
+			"description": "Read the 24-word recovery phrase from a file instead of prompting",
 			"required": true,
-			"valueHint": "key"
+			"valueHint": "path"
+		}, {
+			"flags": "--passphrase-file <path>",
+			"description": "Read the vault passphrase from a file instead of prompting",
+			"required": true,
+			"valueHint": "path"
 		}],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-get",
-		"path": ["workspace", "get"],
-		"display": "/pan workspace get",
-		"description": "Show a workspace row by id",
-		"args": [{
-			"name": "ws",
-			"required": true,
-			"variadic": false
-		}],
+		"id": "pan-vault-passphrase",
+		"path": ["vault", "passphrase"],
+		"display": "/pan vault passphrase",
+		"description": "Turn passphrase unlock for new machines on (set) or off (remove); the vault key stays the same",
+		"args": [],
 		"options": [],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-activate",
-		"path": ["workspace", "activate"],
-		"display": "/pan workspace activate",
-		"description": "Touch a workspace's last-accessed time and print its layout hint",
-		"args": [{
-			"name": "ws",
+		"id": "pan-vault-passphrase-set",
+		"path": [
+			"vault",
+			"passphrase",
+			"set"
+		],
+		"display": "/pan vault passphrase set",
+		"description": "Wrap the vault key under a passphrase so a new machine can join without the recovery phrase",
+		"args": [],
+		"options": [{
+			"flags": "--passphrase-file <path>",
+			"description": "Read the passphrase from a file instead of prompting",
 			"required": true,
-			"variadic": false
+			"valueHint": "path"
+		}, {
+			"flags": "--generate",
+			"description": "Generate a 6-word passphrase and print it once",
+			"required": false,
+			"valueHint": null
 		}],
-		"options": [],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-archive",
-		"path": ["workspace", "archive"],
-		"display": "/pan workspace archive",
-		"description": "Archive a workspace (reversible; refuses kind=main)",
-		"args": [{
-			"name": "ws",
-			"required": true,
-			"variadic": false
-		}],
+		"id": "pan-vault-passphrase-remove",
+		"path": [
+			"vault",
+			"passphrase",
+			"remove"
+		],
+		"display": "/pan vault passphrase remove",
+		"description": "Delete the passphrase unlock object; joining then needs the recovery phrase",
+		"args": [],
 		"options": [],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-relocate",
-		"path": ["workspace", "relocate"],
-		"display": "/pan workspace relocate",
-		"description": "Point a workspace at a new path (refuses kind=issue; kind=main requires --force)",
-		"args": [{
-			"name": "ws",
-			"required": true,
-			"variadic": false
-		}],
+		"id": "pan-vault-rotate-key",
+		"path": ["vault", "rotate-key"],
+		"display": "/pan vault rotate-key",
+		"description": "Replace the vault key after losing a device: re-encrypt refs under a new key, keep old chunks readable, print a new recovery phrase",
+		"args": [],
+		"options": [
+			{
+				"flags": "--yes",
+				"description": "Rotate without the confirmation prompt",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--passphrase-file <path>",
+				"description": "Re-wrap passphrase unlock under the new key with the passphrase in this file",
+				"required": true,
+				"valueHint": "path"
+			},
+			{
+				"flags": "--generate-passphrase",
+				"description": "Re-wrap passphrase unlock under the new key with a generated 6-word passphrase, printed once",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--no-passphrase",
+				"description": "Turn passphrase unlock off",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-vault-status",
+		"path": ["vault", "status"],
+		"display": "/pan vault status",
+		"description": "Show backend, this machine, owned records, last sync and the machine list",
+		"args": [],
 		"options": [{
-			"flags": "--path <dir>",
-			"description": "New path (must be an existing directory)",
-			"required": true,
-			"valueHint": "dir"
-		}, {
-			"flags": "--force",
-			"description": "Allow relocating the main workspace, diverging it from projects.yaml",
+			"flags": "--json",
+			"description": "Output in JSON format",
 			"required": false,
 			"valueHint": null
 		}],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-render-devcontainer",
-		"path": ["workspace", "render-devcontainer"],
-		"display": "/pan workspace render-devcontainer",
-		"description": "Re-render <workspace>/.devcontainer/ from the project compose template",
+		"id": "pan-vault-save",
+		"path": ["vault", "save"],
+		"display": "/pan vault save",
+		"description": "Settle one transcript (by session id or path) or many into the vault",
 		"args": [{
-			"name": "featureName",
-			"required": true,
+			"name": "session-id-or-path",
+			"required": false,
 			"variadic": false
 		}],
 		"options": [
 			{
-				"flags": "--project <key>",
-				"description": "Project key in projects.yaml (e.g. mind-your-now)",
+				"flags": "--all",
+				"description": "Settle every discovered transcript",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--since <date>",
+				"description": "With --all: only transcripts modified on or after this date",
 				"required": true,
-				"valueHint": "key"
+				"valueHint": "date"
 			},
 			{
-				"flags": "--workspace <path>",
-				"description": "Override the inferred workspace path",
+				"flags": "--harness <harness>",
+				"description": "With --all: only this harness (claude-code, codex, ...)",
 				"required": true,
-				"valueHint": "path"
+				"valueHint": "harness"
 			},
 			{
-				"flags": "--json",
-				"description": "Emit JSON instead of human-readable output",
+				"flags": "--hook",
+				"description": "Claude Code Stop-hook mode: read {session_id, transcript_path} JSON from stdin, print nothing, exit 0",
 				"required": false,
 				"valueHint": null
 			}
 		],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-deep-clean",
-		"path": ["workspace", "deep-clean"],
-		"display": "/pan workspace deep-clean",
-		"description": "Interactive: git clean -fd against a workspace (preserves protected paths)",
+		"id": "pan-vault-sync",
+		"path": ["vault", "sync"],
+		"display": "/pan vault sync",
+		"description": "Settle owned transcripts that grew, register this machine and refresh the list",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-vault-list",
+		"path": ["vault", "list"],
+		"display": "/pan vault list",
+		"description": "List saved conversations from the local cache (never contacts the backend)",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Output in JSON format",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-vault-show",
+		"path": ["vault", "show"],
+		"display": "/pan vault show",
+		"description": "Print a saved conversation read-only with its versions",
 		"args": [{
-			"name": "issueId",
+			"name": "id",
 			"required": true,
 			"variadic": false
 		}],
 		"options": [{
-			"flags": "--yes",
-			"description": "Skip confirmation prompt (still requires a TTY)",
+			"flags": "--json",
+			"description": "Output in JSON format",
 			"required": false,
 			"valueHint": null
 		}],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-rebuild",
-		"path": ["workspace", "rebuild"],
-		"display": "/pan workspace rebuild",
-		"description": "Tear down, re-render, and restart a single workspace Docker stack",
+		"id": "pan-vault-resume",
+		"path": ["vault", "resume"],
+		"display": "/pan vault resume",
+		"description": "Continue a saved conversation here: <id> or <id>@<version>; adopts it and launches the harness",
 		"args": [{
-			"name": "issueId",
+			"name": "id",
 			"required": true,
 			"variadic": false
 		}],
-		"options": [],
-		"aliases": [],
-		"category": "Workspace"
-	},
-	{
-		"id": "pan-workspace-reap",
-		"path": ["workspace", "reap"],
-		"display": "/pan workspace reap",
-		"description": "List or remove orphaned unhealthy workspace Docker stacks and orphaned workspace networks",
-		"args": [],
 		"options": [
 			{
-				"flags": "--days <days>",
-				"description": "Minimum age in days",
+				"flags": "--cwd <dir>",
+				"description": "Working directory to resume in (default: the saved cwd)",
 				"required": true,
-				"valueHint": "days"
+				"valueHint": "dir"
 			},
 			{
-				"flags": "--apply",
-				"description": "Run docker compose down -v --remove-orphans for stack candidates and remove orphaned workspace networks",
+				"flags": "--no-launch",
+				"description": "Print the launch command instead of running it",
 				"required": false,
 				"valueHint": null
 			},
 			{
-				"flags": "--yes",
-				"description": "Skip confirmation when using --apply",
+				"flags": "--on-drift <choice>",
+				"description": "When the cwd state differs from the saved state: continue | note | cancel",
+				"required": true,
+				"valueHint": "choice"
+			},
+			{
+				"flags": "--no-code",
+				"description": "Do not apply the saved code snapshot; only continue the conversation",
 				"required": false,
 				"valueHint": null
+			},
+			{
+				"flags": "--worktree <dir>",
+				"description": "Apply the code snapshot into a new git worktree at <dir> instead of the target checkout",
+				"required": true,
+				"valueHint": "dir"
 			}
 		],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-update",
-		"path": ["workspace", "update"],
-		"display": "/pan workspace update",
-		"description": "Update skills/agents/rules in an existing workspace",
+		"id": "pan-vault-exclude",
+		"path": ["vault", "exclude"],
+		"display": "/pan vault exclude",
+		"description": "Exclude conversations by cwd path, git origin or session id; an excluded saved record becomes a tombstone",
 		"args": [{
-			"name": "issueId",
-			"required": true,
+			"name": "path",
+			"required": false,
 			"variadic": false
 		}],
 		"options": [{
-			"flags": "--force",
-			"description": "Overwrite user-modified files",
-			"required": false,
-			"valueHint": null
+			"flags": "--origin <url>",
+			"description": "Exclude conversations whose git origin is this URL",
+			"required": true,
+			"valueHint": "url"
+		}, {
+			"flags": "--session <id>",
+			"description": "Exclude one session by native session id or vault id",
+			"required": true,
+			"valueHint": "id"
 		}],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-use-config",
-		"path": ["workspace", "use-config"],
-		"display": "/pan workspace use-config",
-		"description": "Copy installed Overdeck config into workspace (makes it user settings)",
+		"id": "pan-vault-include",
+		"path": ["vault", "include"],
+		"display": "/pan vault include",
+		"description": "Remove an exclusion added with pan vault exclude",
 		"args": [{
-			"name": "issueId",
-			"required": true,
+			"name": "path",
+			"required": false,
 			"variadic": false
 		}],
 		"options": [{
-			"flags": "--project <path>",
-			"description": "Explicit project path (overrides registry)",
+			"flags": "--origin <url>",
+			"description": "Include conversations whose git origin is this URL again",
 			"required": true,
-			"valueHint": "path"
+			"valueHint": "url"
+		}, {
+			"flags": "--session <id>",
+			"description": "Include one session again",
+			"required": true,
+			"valueHint": "id"
 		}],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-workspace-add-repo",
-		"path": ["workspace", "add-repo"],
-		"display": "/pan workspace add-repo",
-		"description": "Add configured repositories or register a new repository in a polyrepo workspace",
+		"id": "pan-vault-allow-secret",
+		"path": ["vault", "allow-secret"],
+		"display": "/pan vault allow-secret",
+		"description": "Allow one blocked transcript line, or the blocked code lines of one file, for that record only",
 		"args": [{
-			"name": "workspaceId",
+			"name": "id-or-path",
 			"required": true,
 			"variadic": false
 		}, {
-			"name": "repoNames",
+			"name": "line",
 			"required": false,
-			"variadic": true
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--file <path>",
+			"description": "Allow the blocked lines of this file in the code snapshot (path relative to the repository root)",
+			"required": true,
+			"valueHint": "path"
 		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-vault-evict",
+		"path": ["vault", "evict"],
+		"display": "/pan vault evict",
+		"description": "Review the pending-deletion batch (default) or act on it; nothing is deleted without --confirm",
+		"args": [],
 		"options": [
 			{
-				"flags": "--dry-run",
-				"description": "Show what would be added",
+				"flags": "--review",
+				"description": "Scan and print the batch with its fingerprint (default)",
 				"required": false,
 				"valueHint": null
 			},
 			{
-				"flags": "--group <groupName>",
-				"description": "Add all repos from a named group (from groups_file)",
+				"flags": "--confirm <fingerprint>",
+				"description": "Delete the reviewed files if the batch still matches this fingerprint",
 				"required": true,
-				"valueHint": "groupName"
+				"valueHint": "fingerprint"
 			},
 			{
-				"flags": "--new <gitUrl>",
-				"description": "Register a repository that was created during this issue",
+				"flags": "--decline <vaultId>",
+				"description": "Remove an entry from the batch and do not offer it again",
 				"required": true,
-				"valueHint": "gitUrl"
+				"valueHint": "vaultId"
 			},
 			{
-				"flags": "--project <key>",
-				"description": "Explicit project key from projects.yaml (overrides registry)",
+				"flags": "--reoffer <vaultId>",
+				"description": "Allow a declined entry to be offered again",
 				"required": true,
-				"valueHint": "key"
+				"valueHint": "vaultId"
+			},
+			{
+				"flags": "--clear",
+				"description": "Empty the batch without deleting or declining anything",
+				"required": false,
+				"valueHint": null
 			}
 		],
 		"aliases": [],
-		"category": "Workspace"
+		"category": "CLI"
+	},
+	{
+		"id": "pan-vault-restore",
+		"path": ["vault", "restore"],
+		"display": "/pan vault restore",
+		"description": "Rebuild an evicted transcript byte for byte at its original path",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--to <path>",
+			"description": "Write the rebuilt file here instead of the recorded path",
+			"required": true,
+			"valueHint": "path"
+		}],
+		"aliases": [],
+		"category": "CLI"
 	},
 	{
 		"id": "pan-test",
@@ -10266,6 +11304,124 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"aliases": [],
 		"category": "Flywheel"
 	},
+	{
+		"id": "pan-models",
+		"path": ["models"],
+		"display": "/pan models",
+		"description": "Model settings: provider presets",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-models-preset",
+		"path": ["models", "preset"],
+		"display": "/pan models preset",
+		"description": "Apply eval-backed provider model presets (writes explicit values once; never auto-applies)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-models-preset-list",
+		"path": [
+			"models",
+			"preset",
+			"list"
+		],
+		"display": "/pan models preset list",
+		"description": "List presets, their versions and what was last applied",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Print JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-models-preset-show",
+		"path": [
+			"models",
+			"preset",
+			"show"
+		],
+		"display": "/pan models preset show",
+		"description": "Show the per-setting diff a preset would make to config.yaml",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--json",
+			"description": "Print the plan JSON (same body as GET /api/model-presets/:id/plan)",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-models-preset-apply",
+		"path": [
+			"models",
+			"preset",
+			"apply"
+		],
+		"display": "/pan models preset apply",
+		"description": "Apply a preset: print the diff, confirm, then write only the changed settings",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [
+			{
+				"flags": "--dry-run",
+				"description": "Print the diff and write nothing",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--yes",
+				"description": "Apply without the confirmation prompt",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--json",
+				"description": "Print JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-models-preset-undo",
+		"path": [
+			"models",
+			"preset",
+			"undo"
+		],
+		"display": "/pan models preset undo",
+		"description": "Restore the values the last preset apply replaced",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Print JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
 	{
 		"id": "pan-parked",
 		"path": ["parked"],
@@ -11140,29 +12296,6 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"aliases": [],
 		"category": "Admin"
 	},
-	{
-		"id": "pan-admin-tldr",
-		"path": ["admin", "tldr"],
-		"display": "/pan admin tldr",
-		"description": "TLDR daemon: status, start, stop, warm",
-		"args": [{
-			"name": "action",
-			"required": false,
-			"variadic": false
-		}, {
-			"name": "workspace",
-			"required": false,
-			"variadic": false
-		}],
-		"options": [{
-			"flags": "--json",
-			"description": "Output as JSON",
-			"required": false,
-			"valueHint": null
-		}],
-		"aliases": [],
-		"category": "Admin"
-	},
 	{
 		"id": "pan-admin-fpp",
 		"path": ["admin", "fpp"],
@@ -12133,7 +13266,7 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"id": "pan-spawn",
 		"path": ["spawn"],
 		"display": "/pan spawn",
-		"description": "Create a worker pane for one xBRIEF item in the issue workspace",
+		"description": "Create a worker pane for one xBRIEF item in its own item worktree",
 		"args": [],
 		"options": [
 			{
@@ -12159,6 +13292,18 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"description": "Coding-agent harness (default: claude-code)",
 				"required": true,
 				"valueHint": "harness"
+			},
+			{
+				"flags": "--effort <level>",
+				"description": "Reasoning effort: low | medium | high | xhigh | max (defaults to the item/plan metadata, then roles.worker.effort)",
+				"required": true,
+				"valueHint": "level"
+			},
+			{
+				"flags": "--shared",
+				"description": "Run the worker in the issue workspace instead of an item worktree (foreman/operator only; serial use)",
+				"required": false,
+				"valueHint": null
 			}
 		],
 		"aliases": [],
@@ -12211,6 +13356,12 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"required": true,
 				"valueHint": "harness"
 			},
+			{
+				"flags": "--effort <level>",
+				"description": "Reasoning effort: low | medium | high | xhigh | max (defaults to roles.worker.effort)",
+				"required": true,
+				"valueHint": "level"
+			},
 			{
 				"flags": "--read-only",
 				"description": "Run in the issue workspace with git writes blocked",
@@ -12545,6 +13696,12 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"required": false,
 				"valueHint": null
 			},
+			{
+				"flags": "--force",
+				"description": "Launch even while the host is CPU-saturated",
+				"required": false,
+				"valueHint": null
+			},
 			{
 				"flags": "--no-wait",
 				"description": "Return without waiting for the lane to start",
@@ -13182,26 +14339,17 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"display": "/pan status",
 		"description": "Show running agents",
 		"args": [],
-		"options": [
-			{
-				"flags": "--json",
-				"description": "Output as JSON",
-				"required": false,
-				"valueHint": null
-			},
-			{
-				"flags": "--tldr",
-				"description": "Show TLDR index health across all workspaces",
-				"required": false,
-				"valueHint": null
-			},
-			{
-				"flags": "--context",
-				"description": "Show context window usage % for each agent",
-				"required": false,
-				"valueHint": null
-			}
-		],
+		"options": [{
+			"flags": "--json",
+			"description": "Output as JSON",
+			"required": false,
+			"valueHint": null
+		}, {
+			"flags": "--context",
+			"description": "Show context window usage % for each agent",
+			"required": false,
+			"valueHint": null
+		}],
 		"aliases": [],
 		"category": "Core"
 	},
@@ -13365,7 +14513,7 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"id": "pan-restart",
 		"path": ["restart"],
 		"display": "/pan restart",
-		"description": "Restart a platform component (default: dashboard only — leaves CLIProxy, Traefik, TLDR running)",
+		"description": "Restart a platform component (default: dashboard only — leaves CLIProxy and Traefik running)",
 		"args": [],
 		"options": [
 			{
@@ -14070,6 +15218,26 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"aliases": [],
 		"category": "Data"
 	},
+	{
+		"id": "pan-cost-effort",
+		"path": ["cost", "effort"],
+		"display": "/pan cost effort",
+		"description": "Show costs grouped by reasoning effort",
+		"args": [],
+		"options": [{
+			"flags": "-i, --issue <issueId>",
+			"description": "Limit to one issue",
+			"required": true,
+			"valueHint": "issueId"
+		}, {
+			"flags": "--json",
+			"description": "Print JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Data"
+	},
 	{
 		"id": "pan-cost-budget",
 		"path": ["cost", "budget"],
@@ -14475,6 +15643,10 @@ const DirectoryEntry = effect.Schema.Struct({
 	harness: effect.Schema.String,
 	/** `unknown` when not known. */
 	model: effect.Schema.String,
+	/** The launch effort from state.json, native agents only (PAN-4259). */
+	effort: effect.Schema.optional(EffortLevelSchema),
+	/** Where `effort` came from (an EffortSource), native agents only. */
+	effortSource: effect.Schema.optional(effect.Schema.String),
 	state: DirectoryEntryState,
 	startedAt: effect.Schema.NullOr(effect.Schema.String),
 	lastActivityAt: effect.Schema.NullOr(effect.Schema.String),
@@ -14627,6 +15799,47 @@ function laneActivityOf(row, now) {
 	return "stopped";
 }
 //#endregion
+//#region src/environment.ts
+/** Wire protocol version a client and server must agree on. */
+const ENVIRONMENT_PROTOCOL_VERSION = 1;
+const EnvironmentId = effect.Schema.String.pipe(effect.Schema.brand("EnvironmentId"));
+const EnvironmentCapabilities = effect.Schema.Struct({
+	/** `POST /api/pairing/*` is available. */
+	pairing: effect.Schema.Boolean,
+	/** `GET/DELETE /api/devices` is available. */
+	deviceSessions: effect.Schema.Boolean,
+	/** `/ws/*` upgrades require a credential (PAN-1166). */
+	terminalAuth: effect.Schema.Boolean
+});
+const EnvironmentDescriptor = effect.Schema.Struct({
+	descriptorVersion: effect.Schema.Literal(1),
+	environmentId: EnvironmentId,
+	label: effect.Schema.String,
+	platform: effect.Schema.Struct({
+		os: effect.Schema.String,
+		arch: effect.Schema.String
+	}),
+	/** Exact package version of the serving Overdeck. */
+	serverVersion: effect.Schema.String,
+	/** The server's `ENVIRONMENT_PROTOCOL_VERSION`. */
+	protocolVersion: effect.Schema.Number,
+	capabilities: EnvironmentCapabilities
+});
+/** A server-local id qualified by the environment that owns it. */
+const ScopedRef = (localId) => effect.Schema.Struct({
+	environmentId: EnvironmentId,
+	localId
+});
+const ScopedProjectRef = ScopedRef(effect.Schema.String);
+const ScopedIssueRef = ScopedRef(effect.Schema.String);
+const ScopedAgentRef = ScopedRef(effect.Schema.String);
+const ScopedConversationRef = ScopedRef(effect.Schema.String);
+const ScopedTerminalRef = ScopedRef(effect.Schema.String);
+/** True only when the server speaks exactly the client's protocol version. */
+function isProtocolCompatible(descriptor, clientProtocolVersion) {
+	return descriptor.protocolVersion === clientProtocolVersion;
+}
+//#endregion
 exports.ACP_BEHAVIOR = ACP_BEHAVIOR;
 exports.AGENT_ROLES = AGENT_ROLES;
 exports.Activity = Activity;
@@ -14750,6 +15963,7 @@ exports.DeployStalenessSnapshot = DeployStalenessSnapshot;
 exports.DerivedBranchState = DerivedBranchState;
 exports.DerivedIssueState = DerivedIssueState;
 exports.DerivedPrState = DerivedPrState;
+exports.DerivedWorkStart = DerivedWorkStart;
 exports.DirectoryEntry = DirectoryEntry;
 exports.DirectoryEntryKind = DirectoryEntryKind;
 exports.DirectoryEntryLocation = DirectoryEntryLocation;
@@ -14764,6 +15978,7 @@ exports.DiscoveredSessionSnapshot = DiscoveredSessionSnapshot;
 exports.DomainEvent = DomainEvent;
 exports.EDITORS = EDITORS;
 exports.EFFORT_LEVELS = EFFORT_LEVELS;
+exports.ENVIRONMENT_PROTOCOL_VERSION = ENVIRONMENT_PROTOCOL_VERSION;
 exports.EditorIdSchema = EditorIdSchema;
 exports.EffortLevelSchema = EffortLevelSchema;
 exports.EmbedProgressEvent = EmbedProgressEvent;
@@ -14774,6 +15989,9 @@ exports.EnrichProgressEvent = EnrichProgressEvent;
 exports.EnrichProgressSnapshot = EnrichProgressSnapshot;
 exports.EnrichSessionsRpc = EnrichSessionsRpc;
 exports.EnrichStatsSnapshot = EnrichStatsSnapshot;
+exports.EnvironmentCapabilities = EnvironmentCapabilities;
+exports.EnvironmentDescriptor = EnvironmentDescriptor;
+exports.EnvironmentId = EnvironmentId;
 exports.ExtractionProviderConfig = ExtractionProviderConfig;
 exports.ExtractionProviderTarget = ExtractionProviderTarget;
 exports.FeatureNode = FeatureNode;
@@ -14984,6 +16202,12 @@ exports.ScanProgressEvent = ScanProgressEvent;
 exports.ScanProgressSnapshot = ScanProgressSnapshot;
 exports.ScanResult = ScanResult;
 exports.ScanStartedEvent = ScanStartedEvent;
+exports.ScopedAgentRef = ScopedAgentRef;
+exports.ScopedConversationRef = ScopedConversationRef;
+exports.ScopedIssueRef = ScopedIssueRef;
+exports.ScopedProjectRef = ScopedProjectRef;
+exports.ScopedRef = ScopedRef;
+exports.ScopedTerminalRef = ScopedTerminalRef;
 exports.SearchConversationsRpc = SearchConversationsRpc;
 exports.SendTerminalInputRpc = SendTerminalInputRpc;
 exports.SequenceNumber = SequenceNumber;
@@ -15036,6 +16260,7 @@ exports.TickMarker = TickMarker;
 exports.TickMarkerPhase = TickMarkerPhase;
 exports.TurnDiffFileChange = TurnDiffFileChange;
 exports.TurnDiffSummary = TurnDiffSummary;
+exports.TurnEndAssessment = TurnEndAssessment;
 exports.WIRED_HOOK_INVENTORY = WIRED_HOOK_INVENTORY;
 exports.WIRED_HOOK_NAMES = WIRED_HOOK_NAMES;
 exports.WS_METHODS = WS_METHODS;
@@ -15081,6 +16306,7 @@ exports.isConfiguredPullRequestRepo = isConfiguredPullRequestRepo;
 exports.isEffortLevel = isEffortLevel;
 exports.isIssueAttention = isIssueAttention;
 exports.isIssueState = isIssueState;
+exports.isProtocolCompatible = isProtocolCompatible;
 exports.isSingletonConversation = isSingletonConversation;
 exports.isTerminalBackendName = isTerminalBackendName;
 exports.isTerminalTurnDiffSummaryStatus = isTerminalTurnDiffSummaryStatus;