@oxagen/cli 3.0.0 → 3.0.1-27

package/oxagen.mjs

@@ -4582,7 +4582,7 @@ function member(kind) {
 function parseTachoEvent(value) {
   return tachoEventSchema.parse(value);
 }
-var TACHO_ENVELOPE_VERSION, digest, str, short, u8, u16, u32, u64, bool, ts, json, TACHO_RUNTIMES, TACHO_FIDELITIES, TACHO_SOURCES, ENFORCEMENT_TIERS, TOOL_STATUSES, POLICY_DECISIONS, POLICY_SOURCES, EFFECT_KINDS, GAP_CAUSES, INCIDENT_KINDS, TOKEN_SOURCE_BASES, SYSTEM_CONTEXT_PART_KINDS, SYSTEM_CONTEXT_PARTS_MAX, systemContextPartSchema, toolFacts, modelFacts, TOKEN_SOURCE_COUNTS, promptFacts, policyFacts, subagentFacts, SUBAGENT_CHAINLESS_ATTR, healthFacts, lifecycleFacts, integrityFacts, MAX_OBSERVED_CHANGES, observedChangeSchema, MAX_SESSION_COMMIT_ITEMS, MAX_COMMIT_FILES, MAX_COMMIT_PARENTS, MAX_COMMIT_SUBJECT, commitName, sessionCommitFileSchema, sessionCommitSchema, observationFacts, inventoryFacts, totalsFacts, allFacts, BODY_MEMBER_NAMES, BODY_FACTS_SHAPE, pick, toolKeys, modelKeys, promptKeys, policyKeys, subagentKeys, healthKeys, lifecycleKeys, integrityKeys, inventoryKeys, totalsKeys, observationKeys, KIND_BODIES, TACHO_KINDS, agentIdentitySchema, subagentIdentitySchema, turnRefSchema, contextSchema, hostSchema, anthropicSchema, ADDRESS_MEMBERS, spanSchema, MAX_CONTENT_REDACTIONS, contentSchema, envelopeBase, members, TOKEN_SOURCE_KINDS, tachoRecordedEventSchema, tachoEventSchema;
+var TACHO_ENVELOPE_VERSION, digest, str, short, u8, u16, u32, u64, i32, bool, ts, json, TACHO_RUNTIMES, TACHO_FIDELITIES, TACHO_SOURCES, ENFORCEMENT_TIERS, TOOL_STATUSES, POLICY_DECISIONS, POLICY_SOURCES, EFFECT_KINDS, GAP_CAUSES, INCIDENT_KINDS, TOKEN_SOURCE_BASES, SYSTEM_CONTEXT_PART_KINDS, SYSTEM_CONTEXT_PARTS_MAX, systemContextPartSchema, toolFacts, modelFacts, TOKEN_SOURCE_COUNTS, promptFacts, policyFacts, subagentFacts, SUBAGENT_CHAINLESS_ATTR, healthFacts, lifecycleFacts, integrityFacts, MAX_OBSERVED_CHANGES, observedChangeSchema, MAX_SESSION_COMMIT_ITEMS, MAX_COMMIT_FILES, MAX_COMMIT_PARENTS, MAX_COMMIT_SUBJECT, commitName, sessionCommitFileSchema, sessionCommitSchema, observationFacts, inventoryFacts, totalsFacts, allFacts, BODY_MEMBER_NAMES, BODY_FACTS_SHAPE, pick, toolKeys, modelKeys, promptKeys, policyKeys, subagentKeys, healthKeys, lifecycleKeys, integrityKeys, inventoryKeys, totalsKeys, observationKeys, KIND_BODIES, TACHO_KINDS, agentIdentitySchema, subagentIdentitySchema, turnRefSchema, contextSchema, hostSchema, anthropicSchema, ADDRESS_MEMBERS, spanSchema, MAX_CONTENT_REDACTIONS, contentSchema, envelopeBase, members, TOKEN_SOURCE_KINDS, tachoRecordedEventSchema, tachoEventSchema;
 var init_envelope = __esm({
   "../../packages/tacho/src/envelope.ts"() {
     "use strict";
@@ -4597,6 +4597,7 @@ var init_envelope = __esm({
     u16 = external_exports.number().int().min(0).max(65535);
     u32 = external_exports.number().int().min(0).max(4294967295);
     u64 = external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+    i32 = external_exports.number().int().min(-2147483648).max(2147483647);
     bool = external_exports.boolean();
     ts = external_exports.string().refine(isProtocolTimestamp, "protocol timestamp");
     json = external_exports.unknown();
@@ -4704,6 +4705,15 @@ var init_envelope = __esm({
       tool_status: external_exports.enum(TOOL_STATUSES).optional(),
       tool_error_class: short.optional(),
       tool_error_message_digest: digest.optional(),
+      /**
+       * The exit code a shell command ended with, as the harness reported it
+       * (#7158). Claude Code writes it at the start of a failed call's error
+       * text ("Exit code 1"), Codex in its `exec_command_end` record, and Cursor
+       * in `afterShellExecution`. Signed, because a process killed by a signal
+       * can report a negative code. Absent when the harness did not say, which
+       * is not the same as zero.
+       */
+      tool_exit_code: i32.optional(),
       tool_duration_ms: u32.optional(),
       tool_blocked_on_user_ms: u32.optional(),
       tool_is_mutating: bool.optional(),
@@ -8242,7 +8252,7 @@ function verifyBundle(bundle2, publicKeyPem, expectedHostEnrollmentId) {
       createPublicKey(publicKeyPem),
       Buffer.from(signature.sig, "base64")
     );
-    if (!ok) return { ok, reason: "signature does not verify" };
+    if (!ok) return { ok, reason: "the lock does not verify" };
     if (expectedHostEnrollmentId !== void 0 && bundle2.host_enrollment_id !== expectedHostEnrollmentId) {
       return {
         ok: false,
@@ -10398,6 +10408,7 @@ var init_paths = __esm({
       backfillCursor: "backfill-cursor.json",
       memoryCounts: "memory-counts.json",
       stellaMemoryCursors: "stella-memory-cursors.json",
+      memorySent: "memory-sent.json",
       preSessionCopies: "pre-session",
       stellaIdentity: "stella-identity",
       workOrders: "work-orders"
@@ -10704,7 +10715,7 @@ function verifyBytes(pinned, bytes, signature) {
     return ok ? { ok } : {
       ok,
       reason: "signature_invalid",
-      detail: "signature does not verify"
+      detail: "the lock does not verify"
     };
   } catch (error) {
     return {
@@ -10793,7 +10804,7 @@ function verifyKeySet(set, pinned) {
   let last = {
     ok: false,
     reason: "unknown_kid",
-    detail: "no signature on the key set is by a pinned key"
+    detail: "no lock on the key set is by a pinned key"
   };
   for (const signature of signatures) {
     if (!pinned.has(signature.kid)) continue;
@@ -14616,6 +14627,9 @@ var init_llm_call_dedupe = __esm({
 });
 
 // ../../packages/tacho/src/claude-code/backfill.ts
+function isMidTurnMessage(record) {
+  return record["type"] === "attachment" && nonEmptyString(asRecord(record["attachment"])?.["type"]) === "queued_command";
+}
 function emptyTally() {
   return {
     lines: 0,
@@ -14781,7 +14795,7 @@ var init_backfill = __esm({
     init_record_basis();
     init_context();
     init_llm_call_dedupe();
-    BACKFILL_NORMALIZER_VERSION = "1";
+    BACKFILL_NORMALIZER_VERSION = "2";
     TESTED_CLAUDE_CODE_VERSIONS = {
       lowest: "2.1.263",
       highest: "2.1.281"
@@ -15103,11 +15117,12 @@ var init_backfill = __esm({
           count2(this.tally.drift.unknownTypes, "(none)");
           return void 0;
         }
-        if (IGNORED_TYPES.has(type) || type.startsWith("artifact-")) {
+        const mapped = MAPPED_TYPES.has(type) || isMidTurnMessage(value);
+        if (!mapped && (IGNORED_TYPES.has(type) || type.startsWith("artifact-"))) {
           count2(this.tally.recordsIgnored, type);
           return void 0;
         }
-        if (!MAPPED_TYPES.has(type)) {
+        if (!mapped) {
           count2(this.tally.drift.unknownTypes, type);
           return void 0;
         }
@@ -17516,6 +17531,15 @@ var init_result = __esm({
 });
 
 // ../../packages/tacho/src/claude-code/transcript.ts
+function queuedText(value) {
+  if (typeof value === "string") return value.length > 0 ? value : void 0;
+  if (!Array.isArray(value)) return void 0;
+  const text5 = value.map((block) => {
+    const item = rec3(block);
+    return s(item?.["type"]) === "text" ? s(item?.["text"]) : void 0;
+  }).filter((t) => t !== void 0 && t.length > 0).join("\n");
+  return text5.length > 0 ? text5 : void 0;
+}
 function rec3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
@@ -17830,6 +17854,34 @@ function normalizeTranscriptLine(line, fallbackTs) {
         ],
         totals: {}
       };
+    case "attachment": {
+      const attachment = rec3(record["attachment"]);
+      if (s(attachment?.["type"]) !== QUEUED_COMMAND)
+        return { drafts: [], totals: {} };
+      const prompt = queuedText(attachment?.["prompt"]);
+      if (prompt === void 0) return { drafts: [], totals: {} };
+      const origin = promptOriginOf(attachment?.["origin"]);
+      return {
+        drafts: [
+          {
+            ...draft(
+              "oxagen:message",
+              {
+                prompt_digest: digestText(prompt),
+                prompt_length: prompt.length,
+                ...defined({
+                  prompt_origin: origin,
+                  message_uuid: s(record["uuid"])
+                })
+              },
+              { [PROMPT_DELIVERY_ATTR]: MID_TURN_DELIVERY }
+            ),
+            content: textContent(prompt)
+          }
+        ],
+        totals: {}
+      };
+    }
     case "queue-operation": {
       const queued = s(record["content"]);
       return {
@@ -17898,7 +17950,7 @@ function normalizeTranscriptLine(line, fallbackTs) {
       return { drafts: [], totals: {} };
   }
 }
-var SESSION_TITLE_MAX, INTERRUPT_MARKER2;
+var PROMPT_DELIVERY_ATTR, MID_TURN_DELIVERY, QUEUED_COMMAND, SESSION_TITLE_MAX, INTERRUPT_MARKER2;
 var init_transcript = __esm({
   "../../packages/tacho/src/claude-code/transcript.ts"() {
     "use strict";
@@ -17908,6 +17960,9 @@ var init_transcript = __esm({
     init_context();
     init_payload_members();
     init_tools();
+    PROMPT_DELIVERY_ATTR = "oxagen.prompt_delivery";
+    MID_TURN_DELIVERY = "mid_turn";
+    QUEUED_COMMAND = "queued_command";
     SESSION_TITLE_MAX = 512;
     INTERRUPT_MARKER2 = "[Request interrupted by user";
   }
@@ -22704,7 +22759,7 @@ function progressLine(report) {
 function reportLines(report) {
   const lines = [];
   lines.push(
-    report.dry_run ? `Dry run with normalizer ${report.normalizer_version}. Nothing was sealed or sent.` : `Backfill with normalizer ${report.normalizer_version}.`
+    report.dry_run ? `Dry run with normalizer ${report.normalizer_version}. Nothing was locked or sent.` : `Backfill with normalizer ${report.normalizer_version}.`
   );
   lines.push("", "Projects");
   for (const project2 of report.projects) {
@@ -22783,7 +22838,7 @@ function reportLines(report) {
   }
   lines.push(
     "",
-    `Bodies: the workspace keeps ${report.bodies.mode === "content_exact" ? "content" : "digests only"}, and ${number(report.bodies.shipped)} bodies ${report.dry_run ? "would be sent" : "were queued to send"}.`
+    `Bodies: the workspace keeps ${report.bodies.mode === "content_exact" ? "content" : "hashes only"}, and ${number(report.bodies.shipped)} bodies ${report.dry_run ? "would be sent" : "were queued to send"}.`
   );
   return lines;
 }
@@ -26331,7 +26386,7 @@ async function restoreCredentials(host, deps, mode = "unenroll", only) {
           continue;
         }
         warnings.push(
-          `the ${provider} credential in custody cannot be read (${unreadable}). ${label2}'s run token was taken out anyway, since the gateway it worked at is being removed; set the ${provider} key in ${label2} by hand. The sealed store is left at ${deps.paths.credentials} in case the key file can be repaired`
+          `the ${provider} credential in custody cannot be read (${unreadable}). ${label2}'s run token was taken out anyway, since the gateway it worked at is being removed; set the ${provider} key in ${label2} by hand. The encrypted store is left at ${deps.paths.credentials} in case the key file can be repaired`
         );
       }
       const state = await contract.restore(
@@ -26393,7 +26448,10 @@ async function acquireSubscriptionToken(options, deps) {
   const run3 = await io.runSetupToken(
     claude,
     (chunk2) => process.stdout.write(
-      chunk2.replace(/sk-ant-oat[A-Za-z0-9_-]*/g, "sk-ant-oat\u2026 (sent to Oxagen)")
+      chunk2.replace(
+        /sk-ant-oat[A-Za-z0-9_-]*/g,
+        "sk-ant-oat\u2026 (sent to Oxagen)"
+      )
     )
   );
   if (run3.token !== void 0)
@@ -26490,9 +26548,7 @@ async function ensureCodexLogin(deps) {
 }
 async function codexLogin(deps) {
   const store = deps.credentialStore;
-  const held = store?.status().some(
-    (c) => c.provider === "openai" && c.kind === "chatgpt"
-  );
+  const held = store?.status().some((c) => c.provider === "openai" && c.kind === "chatgpt");
   if (held !== true) {
     const why = await ensureCodexLogin(deps);
     if (why !== void 0)
@@ -26569,10 +26625,7 @@ var init_credential = __esm({
     MODEL_CREDENTIAL_HARNESSES = [
       ...BROKERABLE_HARNESSES
     ];
-    CREDENTIAL_MODES = [
-      "brokered",
-      "passthrough"
-    ];
+    CREDENTIAL_MODES = ["brokered", "passthrough"];
     STELLA_ANTHROPIC_KEY_ENV = "ANTHROPIC_API_KEY";
     CLAUDE_OAUTH_TOKEN_ENV = "CLAUDE_CODE_OAUTH_TOKEN";
   }
@@ -27344,7 +27397,7 @@ import { readFileSync as readFileSync10 } from "node:fs";
 import { dirname as dirname9, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "3.0.0";
+  if (true) return "3.0.1-27";
   try {
     const here = dirname9(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -32786,7 +32839,7 @@ function printStatus(report, deps) {
       );
     if (claudeDesktop.otherServers > 0)
       deps.out(
-        `            ${claudeDesktop.otherServers} other MCP server(s): ${claudeDesktop.otherServerNames.join(", ")} \u2014 Oxagen does not see what they serve`
+        `            ${claudeDesktop.otherServers} other MCP server(s): ${claudeDesktop.otherServerNames.join(", ")}. Oxagen does not see what they serve`
       );
   }
   if (codexHooks !== void 0) {
@@ -33423,6 +33476,7 @@ async function unenrollLocked(options, deps) {
     deps.paths.backfillCursor,
     deps.paths.memoryCounts,
     deps.paths.stellaMemoryCursors,
+    deps.paths.memorySent,
     deps.paths.pid,
     deps.paths.daemonLauncher
   ])
@@ -34444,7 +34498,7 @@ ${problems.map((problem) => `  ${problem}`).join("\n")}`
       if (merged.changed) {
         deps.writeStellaHooks(merged.file);
         deps.out(
-          `      hooks written for ${stellaHookPresence(merged.file, host.host_enrollment_id).present.length} events (${file.format === "toml" ? "a managed block at the end of stella.toml; the rest of the file is untouched" : "command hooks in settings.json"}; Stella has no SessionEnd, so tachod seals a session when the stella process exits)`
+          `      hooks written for ${stellaHookPresence(merged.file, host.host_enrollment_id).present.length} events (${file.format === "toml" ? "a managed block at the end of stella.toml; the rest of the file is untouched" : "command hooks in settings.json"}; Stella has no SessionEnd, so tachod locks a session's record when the stella process exits)`
         );
       } else {
         deps.out("      already present; nothing to change");
@@ -34787,7 +34841,7 @@ ${problems.map((problem) => `  ${problem}`).join("\n")}`
   }
   if (!existsSync16(deps.paths.deviceKey))
     warnings.push(
-      `the device key is missing from ${deps.paths.deviceKey} after enrollment, so the daemon cannot sign for this machine; run \`oxagen agent enroll --force\` to enroll it again`
+      `the device key is missing from ${deps.paths.deviceKey} after enrollment, so the daemon cannot lock what this machine sends; run \`oxagen agent enroll --force\` to enroll it again`
     );
   for (const warning of warnings) deps.err(`warning: ${warning}`);
   const hooked = harnesses.filter((harness) => !unhooked.includes(harness));
@@ -35430,7 +35484,7 @@ async function exportCommand(options, deps) {
         const events = wal.read(uuid);
         const first = events[0];
         const last = events[events.length - 1];
-        return `${uuid}  ${first?.session_id ?? "?"}  ${events.length} events  ${first?.ts ?? ""} .. ${last?.ts ?? ""}${last?.kind === "agent_stop" ? "  sealed" : ""}`;
+        return `${uuid}  ${first?.session_id ?? "?"}  ${events.length} events  ${first?.ts ?? ""} .. ${last?.ts ?? ""}${last?.kind === "agent_stop" ? "  locked" : ""}`;
       })
     );
     deps.out(
@@ -36426,7 +36480,7 @@ async function verify4(options, rootDeps) {
     };
   }
   deps.err(
-    `Session ${found.session_id} chained as ${found.session_uuid}: ${found.seq} events, sealed.`
+    `Session ${found.session_id} chained as ${found.session_uuid}: ${found.seq} events, locked.`
   );
   return {
     ok: true,
@@ -36454,12 +36508,12 @@ var init_verify = __esm({
       stella: 45e3
     };
     ENDING_GRACE_MS = 3e4;
-    ENDING_DETAIL = "SessionEnd arrived, but the Oxagen collector had not finished the session's final worktree read. The chain seals once that read lands. Run `oxagen agent verify` again in a minute";
+    ENDING_DETAIL = "SessionEnd arrived, but the Oxagen collector had not finished the session's final worktree read. The collector locks the session's record once that read lands. Run `oxagen agent verify` again in a minute";
     UNSEALED_DETAIL = {
       "claude-code": "session started but SessionEnd never arrived within the timeout",
-      codex: "session started but its final chain seal never arrived; check Codex Stop and SessionEnd hook delivery with `oxagen agent status`",
-      cursor: "session started but its final chain seal never arrived; check Cursor stop and sessionEnd hook delivery with `oxagen agent status`",
-      stella: "session started but was not sealed within the timeout; Stella sends no SessionEnd, so the Oxagen collector seals the chain once the stella process has exited and its sweep has run"
+      codex: "session started but the final lock on its record never arrived; check Codex Stop and SessionEnd hook delivery with `oxagen agent status`",
+      cursor: "session started but the final lock on its record never arrived; check Cursor stop and sessionEnd hook delivery with `oxagen agent status`",
+      stella: "session started but its record was not locked within the timeout; Stella sends no SessionEnd, so the Oxagen collector locks the session's record once the stella process has exited and its sweep has run"
     };
   }
 });
@@ -36709,7 +36763,7 @@ function sandboxMeasurement(placement, guest) {
   ];
   if (!HOST_ID.test(placement.hostId) || !VM_ID.test(placement.vmId) || digests.some((digest6) => !DIGEST.test(digest6)))
     throw new Error(
-      "The sandbox placement or a measured digest is malformed; the agent was not started"
+      "The sandbox placement or a measured hash is malformed; the agent was not started"
     );
   return {
     profile: SANDBOX_PROFILE,
@@ -36731,7 +36785,7 @@ function modalSandboxMeasurement(placement, guest) {
   ];
   if (placement.profile !== MODAL_SANDBOX_PROFILE || !MODAL_ENVIRONMENT.test(placement.modalEnvironment) || !MODAL_ID.test(placement.modalSandboxId) || !MODAL_ID.test(placement.imageId) || digests.some((digest6) => !DIGEST.test(digest6)))
     throw new Error(
-      "The Modal placement or a measured digest is malformed; the agent was not started"
+      "The Modal placement or a measured hash is malformed; the agent was not started"
     );
   return {
     profile: MODAL_SANDBOX_PROFILE,
@@ -38671,7 +38725,7 @@ function containerArguments(spec) {
   if (!/^oxagen-contained-[a-f0-9]{32}$/.test(spec.name))
     throw new Error("Invalid contained container name");
   if (!/^sha256:[a-f0-9]{64}$/.test(spec.image))
-    throw new Error("Contained execution requires a resolved image digest");
+    throw new Error("Contained execution requires a resolved image hash");
   if (!Number.isSafeInteger(spec.uid) || spec.uid <= 0 || !Number.isSafeInteger(spec.gid) || spec.gid < 0)
     throw new Error("Contained execution requires an unprivileged Linux user");
   if (!CONTAINED_HARNESSES.includes(spec.harness))
@@ -39204,12 +39258,12 @@ function readBaseLayerDigest(system) {
   const found = system.stat(BASE_LAYER_DIGEST_FILE);
   if (found === void 0 || !found.isFile || found.uid !== 0 || (found.mode & 18) !== 0)
     throw new Error(
-      "The sandbox has no root-owned base layer digest; the agent was not started"
+      "The sandbox has no root-owned base layer hash; the agent was not started"
     );
   const digest6 = system.readFile(BASE_LAYER_DIGEST_FILE).toString("utf8").trim();
   if (!/^sha256:[a-f0-9]{64}$/.test(digest6))
     throw new Error(
-      "The sandbox's base layer digest is malformed; the agent was not started"
+      "The sandbox's base layer hash is malformed; the agent was not started"
     );
   return digest6;
 }
@@ -46448,7 +46502,7 @@ function createGithubProxy(deps) {
       verdict = evaluate();
     }
     if (!deps.policy().verified) {
-      reply(res, 403, "The signed mandate did not verify");
+      reply(res, 403, "The mandate's lock did not verify");
       return;
     }
     if (verdict.decision !== "allow" || !live(lease)) {
@@ -46813,6 +46867,163 @@ var init_hook_queues = __esm({
   }
 });
 
+// ../../packages/tacho/src/collector/memory-capture/memory-counts.ts
+function countsOf(state) {
+  const counts2 = /* @__PURE__ */ new Map();
+  if (typeof state !== "object" || state === null) return counts2;
+  const record = state;
+  if (record.schema !== MEMORY_COUNTS_STATE_SCHEMA) return counts2;
+  if (typeof record.counts !== "object" || record.counts === null)
+    return counts2;
+  for (const [harness, paths] of Object.entries(
+    record.counts
+  )) {
+    if (typeof paths !== "object" || paths === null) continue;
+    for (const [path2, count12] of Object.entries(
+      paths
+    ))
+      if (Number.isSafeInteger(count12) && count12 > 0)
+        counts2.set(keyOf(harness, path2), count12);
+  }
+  return counts2;
+}
+function stateOf2(counts2) {
+  const byHarness = {};
+  for (const [key, count12] of counts2) {
+    const split = key.indexOf("\n");
+    const harness = key.slice(0, split);
+    const path2 = key.slice(split + 1);
+    (byHarness[harness] ??= {})[path2] = count12;
+  }
+  return JSON.stringify({
+    schema: MEMORY_COUNTS_STATE_SCHEMA,
+    counts: byHarness
+  });
+}
+function fileStateStorage(path2, unparsed) {
+  return {
+    load: () => readJsonStateFile(path2, unparsed),
+    save: (json2) => writeSensitiveFileAtomic(path2, json2)
+  };
+}
+function stateSaver(storage, failed3) {
+  let lastFailure;
+  return (json2) => {
+    try {
+      storage.save(json2);
+      lastFailure = void 0;
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      if (detail === lastFailure) return;
+      lastFailure = detail;
+      failed3(detail);
+    }
+  };
+}
+function fileUseCountStorage(path2, log) {
+  return fileStateStorage(
+    path2,
+    (movedTo) => log(
+      movedTo === void 0 ? "memory counts: the saved counts did not parse and could not be moved aside; every count is reported from zero" : `memory counts: the saved counts did not parse; moved them to ${movedTo}, and every count is reported from zero`
+    )
+  );
+}
+function createUseCountLedger(deps) {
+  let counts2 = /* @__PURE__ */ new Map();
+  let blind = false;
+  try {
+    counts2 = countsOf(deps.storage.load());
+  } catch (error) {
+    blind = true;
+    deps.log(
+      `memory counts: the saved counts could not be read (${error instanceof Error ? error.message : String(error)}); no harness count is reported until the daemon restarts`
+    );
+  }
+  const saveState = stateSaver(
+    deps.storage,
+    (detail) => deps.log(
+      `memory counts: the counts could not be saved (${detail}); a restart reports the rises since the last save again`
+    )
+  );
+  const save = () => saveState(stateOf2(counts2));
+  return {
+    rises: (reads) => {
+      if (blind) return [];
+      const rises = [];
+      let changed = false;
+      for (const read2 of reads) {
+        const present = /* @__PURE__ */ new Set();
+        for (const { path: path2, count: count12, lastUsedAt } of read2.counts) {
+          if (!Number.isSafeInteger(count12) || count12 < 0) continue;
+          const key = keyOf(read2.harness, path2);
+          present.add(key);
+          const base2 = counts2.get(key) ?? 0;
+          if (count12 < base2) {
+            if (count12 === 0) counts2.delete(key);
+            else counts2.set(key, count12);
+            changed = true;
+            continue;
+          }
+          if (count12 === base2) continue;
+          const rise = Math.min(count12 - base2, RISE_MAX);
+          rises.push({
+            harness: read2.harness,
+            path: path2,
+            count: rise,
+            usedAt: lastUsedAt ?? new Date(deps.now()).toISOString(),
+            through: base2 + rise
+          });
+        }
+        const prefix = keyOf(read2.harness, read2.root);
+        for (const key of [...counts2.keys()])
+          if (key.startsWith(prefix) && !present.has(key)) {
+            counts2.delete(key);
+            changed = true;
+          }
+      }
+      if (changed) save();
+      return rises;
+    },
+    settle: (rises) => {
+      if (rises.length === 0) return;
+      for (const rise of rises)
+        counts2.set(keyOf(rise.harness, rise.path), rise.through);
+      save();
+    }
+  };
+}
+var MEMORY_COUNTS_STATE_SCHEMA, RISE_MAX, keyOf;
+var init_memory_counts = __esm({
+  "../../packages/tacho/src/collector/memory-capture/memory-counts.ts"() {
+    "use strict";
+    init_fs();
+    MEMORY_COUNTS_STATE_SCHEMA = "tacho.memory-counts.v1";
+    RISE_MAX = 1e4;
+    keyOf = (harness, path2) => `${harness}
+${path2}`;
+  }
+});
+
+// ../../packages/tacho/src/collector/memory-capture/memory-send.ts
+function stillHeld(held, digest6, now) {
+  return held !== void 0 && held.digest === digest6 && now - held.at < MEMORY_REFUSED_RETRY_MS;
+}
+var MemoryRateLimited, MEMORY_REFUSED_RETRY_MS;
+var init_memory_send = __esm({
+  "../../packages/tacho/src/collector/memory-capture/memory-send.ts"() {
+    "use strict";
+    MemoryRateLimited = class extends Error {
+      constructor(retryAfterMs2) {
+        super("memory upload: the control plane answered 429");
+        this.retryAfterMs = retryAfterMs2;
+        this.name = "MemoryRateLimited";
+      }
+      retryAfterMs;
+    };
+    MEMORY_REFUSED_RETRY_MS = 60 * 6e4;
+  }
+});
+
 // ../../packages/tacho/src/collector/memory-capture/memory-reader.ts
 import { createRequire as createRequire2 } from "node:module";
 import { isAbsolute as isAbsolute10, join as join40, sep as sep7 } from "node:path";
@@ -46932,9 +47143,9 @@ function memoryTextOf(text5) {
 function sentDigest(entry2) {
   return digestBytes(
     JSON.stringify([
-      entry2.statement,
-      entry2.label ?? null,
-      entry2.summary ?? null,
+      redactText(entry2.statement),
+      entry2.label === void 0 ? null : redactText(entry2.label),
+      entry2.summary === void 0 ? null : redactText(entry2.summary),
       entry2.memoryType ?? null,
       entry2.personal ?? null,
       entry2.repositoryDigests ?? null
@@ -46963,10 +47174,60 @@ function storedTextOf(memory) {
     ...memoryType !== void 0 ? { memoryType } : {}
   };
 }
+function timerWait(ms) {
+  return new Promise((resolve28) => {
+    setTimeout(() => resolve28(true), ms).unref?.();
+  });
+}
+function sentMarksOf(saved) {
+  const marks = /* @__PURE__ */ new Map();
+  if (typeof saved !== "object" || saved === null) return marks;
+  const state = saved;
+  if (state.schema !== MEMORY_SENT_STATE_SCHEMA || !Array.isArray(state.sent))
+    return marks;
+  for (const pair2 of state.sent) {
+    if (!Array.isArray(pair2) || pair2.length !== 2) continue;
+    const [key, digest6] = pair2;
+    if (typeof key !== "string" || typeof digest6 !== "string") continue;
+    if (!digest6.startsWith("sha256:")) continue;
+    marks.set(key, digest6);
+  }
+  return marks;
+}
 function createMemoryReader(deps) {
   const harnesses = deps.harnesses ?? HARNESS_MEMORY_LOCATIONS;
   const stores = deps.stores ?? [];
-  const sent = /* @__PURE__ */ new Map();
+  const log = deps.log ?? (() => void 0);
+  const now = deps.now ?? Date.now;
+  const wait = deps.wait ?? timerWait;
+  let sent = /* @__PURE__ */ new Map();
+  if (deps.storage !== void 0) {
+    try {
+      sent = sentMarksOf(deps.storage.load());
+    } catch (error) {
+      log(
+        `memory reader: the sent record could not be read (${error instanceof Error ? error.message : String(error)}); every memory is sent again`
+      );
+    }
+  }
+  let dirty = false;
+  const saveState = deps.storage === void 0 ? void 0 : stateSaver(
+    deps.storage,
+    (detail) => log(
+      `memory reader: the sent record could not be saved (${detail}); a restart sends the memories since the last save again`
+    )
+  );
+  function persist() {
+    if (!dirty || saveState === void 0) return;
+    dirty = false;
+    saveState(
+      JSON.stringify({
+        schema: MEMORY_SENT_STATE_SCHEMA,
+        sent: [...sent].slice(0, MEMORY_SENT_SAVED_MAX)
+      })
+    );
+  }
+  const refused2 = /* @__PURE__ */ new Map();
   const uploading = /* @__PURE__ */ new Set();
   let running;
   async function list2(dir) {
@@ -47014,16 +47275,39 @@ function createMemoryReader(deps) {
     const whole = [];
     const read2 = /* @__PURE__ */ new Set();
     const seen = /* @__PURE__ */ new Set();
+    let waited = 0;
     async function offer(entry2) {
-      const key = keyOf(entry2.harness, entry2.path);
+      const key = keyOf2(entry2.harness, entry2.path);
       const digest6 = sentDigest(entry2);
       if (sent.get(key) === digest6) return true;
-      try {
-        await deps.send(entry2);
-      } catch {
-        return false;
+      if (stillHeld(refused2.get(key), digest6, now())) return true;
+      for (; ; ) {
+        let outcome;
+        try {
+          outcome = await deps.send(entry2);
+        } catch (error) {
+          if (!(error instanceof MemoryRateLimited)) return false;
+          const ms = Math.max(
+            MEMORY_RATE_WAIT_MIN_MS,
+            Math.min(
+              error.retryAfterMs ?? MEMORY_RATE_WAIT_MAX_MS,
+              MEMORY_RATE_WAIT_MAX_MS
+            )
+          );
+          if (waited + ms > MEMORY_SCAN_WAIT_MAX_MS) return false;
+          waited += ms;
+          if (!await wait(ms)) return false;
+          continue;
+        }
+        if (outcome === "refused") {
+          refused2.set(key, { digest: digest6, at: now() });
+          return true;
+        }
+        break;
       }
+      refused2.delete(key);
       sent.set(key, digest6);
+      dirty = true;
       count12 += 1;
       return true;
     }
@@ -47035,7 +47319,7 @@ function createMemoryReader(deps) {
         const file = await readAt2(location.harness, path2);
         if (file.kind === "absent" || file.kind === "empty") continue;
         paths.push(path2);
-        seen.add(keyOf(location.harness, path2));
+        seen.add(keyOf2(location.harness, path2));
         if (file.kind !== "entry") continue;
         if (!await offer({ ...file.entry, ...placedFields(where) }))
           return false;
@@ -47052,7 +47336,7 @@ function createMemoryReader(deps) {
     for (const location of locations) {
       const top = location.projectsDir(deps.home);
       const root = withSep(top);
-      const prefix = keyOf(location.harness, root);
+      const prefix = keyOf2(location.harness, root);
       if (read2.has(prefix)) continue;
       read2.add(prefix);
       if (scoper === void 0) continue;
@@ -47069,7 +47353,7 @@ function createMemoryReader(deps) {
           const paths2 = [];
           if (!await readFolder(location, dir, files2.names, where2, paths2))
             return { sent: count12 };
-          whole.push(keyOf(location.harness, folder));
+          whole.push(keyOf2(location.harness, folder));
           scans.push({
             harness: location.harness,
             root: folder,
@@ -47097,7 +47381,7 @@ function createMemoryReader(deps) {
         scans.push({ harness: location.harness, root, paths: paths.sort() });
     }
     for (const store of typeof stores === "function" ? stores() : stores) {
-      const prefix = keyOf(store.harness, store.root);
+      const prefix = keyOf2(store.harness, store.root);
       if (read2.has(prefix)) continue;
       read2.add(prefix);
       const found = await store.read();
@@ -47109,7 +47393,7 @@ function createMemoryReader(deps) {
       for (const memory of found.memories) {
         if (!memory.path.startsWith(store.root) || memory.path.length === store.root.length)
           continue;
-        const key = keyOf(store.harness, memory.path);
+        const key = keyOf2(store.harness, memory.path);
         if (seen.has(key)) continue;
         const text5 = storedTextOf(memory);
         if (text5.statement.length === 0) continue;
@@ -47141,31 +47425,50 @@ function createMemoryReader(deps) {
         counts: useCounts
       });
     }
+    const gone = (key) => !seen.has(key) && whole.some((prefix) => key.startsWith(prefix));
     for (const key of [...sent.keys()])
-      if (!seen.has(key) && whole.some((prefix) => key.startsWith(prefix)))
+      if (gone(key)) {
         sent.delete(key);
+        dirty = true;
+      }
+    for (const key of [...refused2.keys()]) if (gone(key)) refused2.delete(key);
     return { sent: count12, scans, counts: counts2 };
   }
   return {
     // A scan that overlaps one still running joins it, so no entry is sent
-    // twice at once.
+    // twice at once. Every scan saves what it sent, whether it finished or
+    // stopped on a failure.
     scan: () => {
       running ??= scanOnce().finally(() => {
         running = void 0;
+        persist();
       });
       return running;
     },
     uploads: (path2) => {
       for (const root of uploading) if (path2.startsWith(root)) return true;
       return false;
+    },
+    resend: (memories) => {
+      for (const memory of memories)
+        if (sent.delete(keyOf2(memory.harness, memory.path))) dirty = true;
+      persist();
     }
   };
 }
-var MEMORY_STATEMENT_MAX_CHARS, MEMORY_LABEL_MAX_CHARS, MEMORY_SUMMARY_MAX_CHARS, MEMORY_TYPE_PATTERN, MEMORY_PROJECT_DIRS_MAX, HARNESS_MEMORY_LOCATIONS, FRONTMATTER, sqliteModule, FRONTMATTER_LINE, sends, keyOf, withSep;
+var MEMORY_SENT_STATE_SCHEMA, MEMORY_SENT_SAVED_MAX, MEMORY_RATE_WAIT_MAX_MS, MEMORY_RATE_WAIT_MIN_MS, MEMORY_SCAN_WAIT_MAX_MS, MEMORY_STATEMENT_MAX_CHARS, MEMORY_LABEL_MAX_CHARS, MEMORY_SUMMARY_MAX_CHARS, MEMORY_TYPE_PATTERN, MEMORY_PROJECT_DIRS_MAX, HARNESS_MEMORY_LOCATIONS, FRONTMATTER, sqliteModule, FRONTMATTER_LINE, sends, keyOf2, withSep;
 var init_memory_reader = __esm({
   "../../packages/tacho/src/collector/memory-capture/memory-reader.ts"() {
     "use strict";
     init_digest();
+    init_redaction();
+    init_memory_counts();
+    init_memory_send();
+    MEMORY_SENT_STATE_SCHEMA = "tacho.memory-sent.v1";
+    MEMORY_SENT_SAVED_MAX = 5e4;
+    MEMORY_RATE_WAIT_MAX_MS = 6e4;
+    MEMORY_RATE_WAIT_MIN_MS = 1e3;
+    MEMORY_SCAN_WAIT_MAX_MS = 30 * 6e4;
     MEMORY_STATEMENT_MAX_CHARS = 2e3;
     MEMORY_LABEL_MAX_CHARS = 200;
     MEMORY_SUMMARY_MAX_CHARS = 1e3;
@@ -47182,7 +47485,7 @@ var init_memory_reader = __esm({
     FRONTMATTER = /^---[ \t]*\r?\n(?:([\s\S]*?)\r?\n)?---[ \t]*(?:\r?\n|$)/;
     FRONTMATTER_LINE = /^([ \t]*)([A-Za-z_][\w-]*)[ \t]*:[ \t]*(.*)$/;
     sends = (where) => where.kind === "personal" || where.kind === "repository";
-    keyOf = (harness, path2) => `${harness}
+    keyOf2 = (harness, path2) => `${harness}
 ${path2}`;
     withSep = (dir) => dir.endsWith(sep7) ? dir : `${dir}${sep7}`;
   }
@@ -47290,144 +47593,21 @@ var init_codex_store = __esm({
   }
 });
 
-// ../../packages/tacho/src/collector/memory-capture/memory-counts.ts
-function countsOf(state) {
-  const counts2 = /* @__PURE__ */ new Map();
-  if (typeof state !== "object" || state === null) return counts2;
-  const record = state;
-  if (record.schema !== MEMORY_COUNTS_STATE_SCHEMA) return counts2;
-  if (typeof record.counts !== "object" || record.counts === null)
-    return counts2;
-  for (const [harness, paths] of Object.entries(
-    record.counts
-  )) {
-    if (typeof paths !== "object" || paths === null) continue;
-    for (const [path2, count12] of Object.entries(
-      paths
-    ))
-      if (Number.isSafeInteger(count12) && count12 > 0)
-        counts2.set(keyOf2(harness, path2), count12);
-  }
-  return counts2;
-}
-function stateOf2(counts2) {
-  const byHarness = {};
-  for (const [key, count12] of counts2) {
-    const split = key.indexOf("\n");
-    const harness = key.slice(0, split);
-    const path2 = key.slice(split + 1);
-    (byHarness[harness] ??= {})[path2] = count12;
-  }
-  return JSON.stringify({
-    schema: MEMORY_COUNTS_STATE_SCHEMA,
-    counts: byHarness
-  });
-}
-function fileStateStorage(path2, unparsed) {
-  return {
-    load: () => readJsonStateFile(path2, unparsed),
-    save: (json2) => writeSensitiveFileAtomic(path2, json2)
-  };
-}
-function stateSaver(storage, failed3) {
-  let lastFailure;
-  return (json2) => {
-    try {
-      storage.save(json2);
-      lastFailure = void 0;
-    } catch (error) {
-      const detail = error instanceof Error ? error.message : String(error);
-      if (detail === lastFailure) return;
-      lastFailure = detail;
-      failed3(detail);
-    }
-  };
-}
-function fileUseCountStorage(path2, log) {
-  return fileStateStorage(
-    path2,
-    (movedTo) => log(
-      movedTo === void 0 ? "memory counts: the saved counts did not parse and could not be moved aside; every count is reported from zero" : `memory counts: the saved counts did not parse; moved them to ${movedTo}, and every count is reported from zero`
-    )
-  );
-}
-function createUseCountLedger(deps) {
-  let counts2 = /* @__PURE__ */ new Map();
-  let blind = false;
+// ../../packages/tacho/src/collector/memory-capture/memory-upload.ts
+function answerReason(text5) {
+  let reason3 = text5;
   try {
-    counts2 = countsOf(deps.storage.load());
-  } catch (error) {
-    blind = true;
-    deps.log(
-      `memory counts: the saved counts could not be read (${error instanceof Error ? error.message : String(error)}); no harness count is reported until the daemon restarts`
-    );
-  }
-  const saveState = stateSaver(
-    deps.storage,
-    (detail) => deps.log(
-      `memory counts: the counts could not be saved (${detail}); a restart reports the rises since the last save again`
-    )
-  );
-  const save = () => saveState(stateOf2(counts2));
-  return {
-    rises: (reads) => {
-      if (blind) return [];
-      const rises = [];
-      let changed = false;
-      for (const read2 of reads) {
-        const present = /* @__PURE__ */ new Set();
-        for (const { path: path2, count: count12, lastUsedAt } of read2.counts) {
-          if (!Number.isSafeInteger(count12) || count12 < 0) continue;
-          const key = keyOf2(read2.harness, path2);
-          present.add(key);
-          const base2 = counts2.get(key) ?? 0;
-          if (count12 < base2) {
-            if (count12 === 0) counts2.delete(key);
-            else counts2.set(key, count12);
-            changed = true;
-            continue;
-          }
-          if (count12 === base2) continue;
-          const rise = Math.min(count12 - base2, RISE_MAX);
-          rises.push({
-            harness: read2.harness,
-            path: path2,
-            count: rise,
-            usedAt: lastUsedAt ?? new Date(deps.now()).toISOString(),
-            through: base2 + rise
-          });
-        }
-        const prefix = keyOf2(read2.harness, read2.root);
-        for (const key of [...counts2.keys()])
-          if (key.startsWith(prefix) && !present.has(key)) {
-            counts2.delete(key);
-            changed = true;
-          }
-      }
-      if (changed) save();
-      return rises;
-    },
-    settle: (rises) => {
-      if (rises.length === 0) return;
-      for (const rise of rises)
-        counts2.set(keyOf2(rise.harness, rise.path), rise.through);
-      save();
+    const parsed2 = JSON.parse(text5);
+    if (typeof parsed2 === "object" && parsed2 !== null) {
+      const body2 = parsed2;
+      const message = typeof body2.message === "string" ? body2.message : typeof body2.error === "object" && body2.error !== null && typeof body2.error.message === "string" ? body2.error.message : void 0;
+      reason3 = message ?? "";
     }
-  };
-}
-var MEMORY_COUNTS_STATE_SCHEMA, RISE_MAX, keyOf2;
-var init_memory_counts = __esm({
-  "../../packages/tacho/src/collector/memory-capture/memory-counts.ts"() {
-    "use strict";
-    init_fs();
-    MEMORY_COUNTS_STATE_SCHEMA = "tacho.memory-counts.v1";
-    RISE_MAX = 1e4;
-    keyOf2 = (harness, path2) => `${harness}
-${path2}`;
+  } catch {
   }
-});
-
-// ../../packages/tacho/src/collector/memory-capture/memory-upload.ts
+  const line = reason3.replace(/\s+/g, " ").trim();
+  return line.length === 0 ? void 0 : clip2(line, REFUSAL_REASON_MAX_CHARS);
+}
 async function postToControlPlane(fetch2, host, path2, body2, signal) {
   const url = `${host.api_url.replace(/\/$/, "")}${path2}`;
   const payload = JSON.stringify({
@@ -47444,10 +47624,15 @@ async function postToControlPlane(fetch2, host, path2, body2, signal) {
     body: payload,
     signal
   });
+  const retryAfterMs2 = parseRetryAfter(
+    response.headers?.get("retry-after") ?? null,
+    Date.now()
+  );
   return {
     ok: response.ok,
     status: response.status,
-    text: await response.text()
+    text: await response.text(),
+    ...retryAfterMs2 !== void 0 ? { retryAfterMs: retryAfterMs2 } : {}
   };
 }
 function changedFailureLog(write) {
@@ -47503,7 +47688,7 @@ function createMemoryUpload(deps) {
     const status2 = answer.status;
     if (answer.ok) {
       failures.clear();
-      return;
+      return "stored";
     }
     if (status2 === 404) {
       if (!routeMissingLogged) {
@@ -47515,24 +47700,32 @@ function createMemoryUpload(deps) {
       throw new Error("memory upload: the control plane answered 404");
     }
     if (ENTRY_REFUSED.has(status2)) {
+      const reason3 = answerReason(answer.text);
       deps.log(
-        `memory upload: the control plane refused ${entry2.path} (${status2}); it is sent again when the file changes`
+        `memory upload: the control plane refused ${entry2.path} (${status2}${reason3 === void 0 ? "" : `: ${reason3}`}); it is held and sent again later`
       );
-      return;
+      return "refused";
+    }
+    if (status2 === 429) {
+      failure4(`the control plane answered ${status2}`);
+      throw new MemoryRateLimited(answer.retryAfterMs);
     }
     throw failure4(`the control plane answered ${status2}`);
   };
 }
-var MEMORY_UPLOAD_PATH, MEMORY_UPLOAD_TIMEOUT_MS, ENTRY_REFUSED;
+var MEMORY_UPLOAD_PATH, MEMORY_UPLOAD_TIMEOUT_MS, ENTRY_REFUSED, REFUSAL_REASON_MAX_CHARS;
 var init_memory_upload = __esm({
   "../../packages/tacho/src/collector/memory-capture/memory-upload.ts"() {
     "use strict";
     init_redaction();
+    init_control_client();
     init_request_signature();
     init_memory_reader();
+    init_memory_send();
     MEMORY_UPLOAD_PATH = "/v1/tacho/memories";
     MEMORY_UPLOAD_TIMEOUT_MS = 15e3;
     ENTRY_REFUSED = /* @__PURE__ */ new Set([400, 413, 422]);
+    REFUSAL_REASON_MAX_CHARS = 300;
   }
 });
 
@@ -47907,6 +48100,26 @@ function pendingOf(text5, sentCount) {
     (index) => Number.isInteger(index) && index >= 0 && index < sentCount
   );
 }
+function missingOf(text5, listed) {
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(text5);
+  } catch {
+    return [];
+  }
+  const missing = typeof parsed2 === "object" && parsed2 !== null ? parsed2.missing : void 0;
+  if (!Array.isArray(missing)) return [];
+  const found = [];
+  for (const item of missing) {
+    if (typeof item !== "object" || item === null) continue;
+    const { harness, path: path2 } = item;
+    if (typeof harness !== "string" || typeof path2 !== "string") continue;
+    if (!listed.has(`${harness}
+${path2}`)) continue;
+    found.push({ harness, path: path2 });
+  }
+  return found;
+}
 function createMemoryUses(deps) {
   const queue = /* @__PURE__ */ new Map();
   let indexQueued = 0;
@@ -47936,7 +48149,7 @@ function createMemoryUses(deps) {
     }
     enqueue(key, { ...use });
   }
-  async function call2(body2, uses) {
+  async function call2(body2, uses, listed = /* @__PURE__ */ new Set()) {
     let response;
     try {
       response = await postToControlPlane(
@@ -47954,7 +48167,11 @@ function createMemoryUses(deps) {
     }
     if (response.ok) {
       failures.clear();
-      return { kind: "taken", pending: pendingOf(response.text, uses) };
+      return {
+        kind: "taken",
+        pending: pendingOf(response.text, uses),
+        missing: missingOf(response.text, listed)
+      };
     }
     if (response.status === 404) {
       if (!routeMissingLogged) {
@@ -47971,6 +48188,7 @@ function createMemoryUses(deps) {
     return { kind: "kept" };
   }
   async function reportOnce(scans, counts2) {
+    const missing = [];
     if (overflowed > 0) {
       deps.log(
         `memory uses: the queue was full, so ${overflowed} memory uses were not counted`
@@ -48009,7 +48227,7 @@ function createMemoryUses(deps) {
       if (result2.kind === "kept") {
         for (const rest of batches.slice(position))
           for (const use of rest) requeue(use);
-        return;
+        return { missing };
       }
       if (result2.kind === "refused") {
         deps.log(
@@ -48037,7 +48255,7 @@ function createMemoryUses(deps) {
         },
         0
       );
-      if (result2.kind === "kept") return;
+      if (result2.kind === "kept") return { missing };
       if (result2.kind === "refused")
         deps.log(
           `memory uses: the control plane refused ${batch.length} harness counts (${result2.status}); they are dropped`
@@ -48054,16 +48272,22 @@ function createMemoryUses(deps) {
       );
     }
     for (let start = 0; start < lists.length; start += MEMORY_SCANS_PER_REPORT) {
-      const result2 = await call2(
-        { scans: lists.slice(start, start + MEMORY_SCANS_PER_REPORT) },
-        0
+      const chunk2 = lists.slice(start, start + MEMORY_SCANS_PER_REPORT);
+      const listed = new Set(
+        chunk2.flatMap(
+          (scan) => scan.paths.map((path2) => `${scan.harness}
+${path2}`)
+        )
       );
-      if (result2.kind === "kept") return;
+      const result2 = await call2({ scans: chunk2 }, 0, listed);
+      if (result2.kind === "kept") return { missing };
       if (result2.kind === "refused")
         deps.log(
           `memory uses: the control plane refused a scan's file list (${result2.status})`
         );
+      else missing.push(...result2.missing);
     }
+    return { missing };
   }
   return {
     note: (read2) => {
@@ -48094,6 +48318,7 @@ function createMemoryUses(deps) {
         deps.log(
           `memory uses: the report failed (${error instanceof Error ? error.message : String(error)})`
         );
+        return { missing: [] };
       }).finally(() => {
         running = void 0;
       });
@@ -48344,6 +48569,7 @@ function createStellaMemories(deps) {
   }
   const gone = /* @__PURE__ */ new Set();
   const sent = /* @__PURE__ */ new Map();
+  const refused2 = /* @__PURE__ */ new Map();
   const failures = /* @__PURE__ */ new Map();
   const viewsMissingLogged = /* @__PURE__ */ new Set();
   let running;
@@ -48443,12 +48669,19 @@ ${lineage}`;
         const key = sentKey(store, memory.lineage);
         const digest6 = sentDigest2(memory);
         if (sent.get(key) === digest6) continue;
+        if (stillHeld(refused2.get(key), digest6, deps.now())) continue;
+        let outcome;
         try {
-          await deps.send(entryOf2(memory, store));
+          outcome = await deps.send(entryOf2(memory, store));
         } catch {
           sending = false;
           break;
         }
+        if (outcome === "refused") {
+          refused2.set(key, { digest: digest6, at: deps.now() });
+          continue;
+        }
+        refused2.delete(key);
         sent.set(key, digest6);
         result2.sent += 1;
       }
@@ -48504,6 +48737,11 @@ ${lineage}`;
         running = void 0;
       });
       return running;
+    },
+    resend: (lineages) => {
+      const wanted = new Set(lineages);
+      for (const key of [...sent.keys()])
+        if (wanted.has(key.slice(key.indexOf("\n") + 1))) sent.delete(key);
     }
   };
 }
@@ -48513,6 +48751,7 @@ var init_stella_memories = __esm({
     "use strict";
     init_digest();
     init_memory_counts();
+    init_memory_send();
     init_memory_uses();
     init_stella_store();
     STELLA_CURSORS_STATE_SCHEMA = "tacho.stella-memory-cursors.v1";
@@ -48523,7 +48762,7 @@ var init_stella_memories = __esm({
 function digestMismatch() {
   return {
     code: "digest_mismatch",
-    message: "The package digest does not match the lock.",
+    message: "The package hash does not match the lock.",
     fix: "Reinstall the locked version, or run the sync if the package changed on purpose."
   };
 }
@@ -48566,7 +48805,7 @@ function envelopeInvalid(reason3, subject = "call") {
   return {
     code: "envelope_invalid",
     message: `The ${subject}'s envelope does not verify: ${reason3}.`,
-    fix: "Enroll this machine again if Oxagen rotated its signing key, then retry."
+    fix: "Enroll this machine again if Oxagen changed the key it locks envelopes with, then retry."
   };
 }
 function envelopeExpired(expiresAt, subject = "call") {
@@ -48580,7 +48819,7 @@ function envelopeReplayed(subject = "call") {
   return {
     code: "envelope_replayed",
     message: `The local gateway already ran a ${subject} with this envelope's nonce.`,
-    fix: `Retry the ${subject}. The cloud gateway signs each ${subject} with a new nonce.`
+    fix: `Retry the ${subject}. The cloud gateway gives each ${subject} a new nonce.`
   };
 }
 function wrongMachine(machine, subject = "call") {
@@ -48594,7 +48833,7 @@ function argumentsMismatch() {
   return {
     code: "arguments_mismatch",
     message: "The call's arguments do not hash to the envelope's arguments_hash.",
-    fix: "Retry the call. The local gateway runs only the arguments the cloud gateway signed."
+    fix: "Retry the call. The local gateway runs only the arguments the cloud gateway locked into the envelope."
   };
 }
 function launchMismatch(reason3) {
@@ -48705,7 +48944,7 @@ var init_wire2 = __esm({
     LOCAL_DISCOVERY_ENVELOPE_SCHEMA = "local-discovery-envelope/v1";
     ENVELOPE_TTL_MAX_MS = 3e4;
     DEFAULT_DEADLINE_MS = 3e4;
-    sha256Schema = external_exports.string().regex(SHA256_DIGEST_PATTERN, "not a sha256:<hex> digest");
+    sha256Schema = external_exports.string().regex(SHA256_DIGEST_PATTERN, "not a sha256:<hex> hash");
     machineIdSchema = external_exports.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "not a machine id");
     nonceSchema = external_exports.string().regex(/^[A-Za-z0-9_-]{22,64}$/, "a nonce is 22 to 64 base64url characters");
     envVarNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,127}$/, "not an environment variable name");
@@ -48719,7 +48958,7 @@ var init_wire2 = __esm({
       alg: external_exports.literal("ed25519"),
       sig: external_exports.string().regex(
         /^[A-Za-z0-9+/]{86}==$/,
-        "an Ed25519 signature is 64 bytes in padded base64"
+        "an Ed25519 lock is 64 bytes in padded base64"
       )
     }).strict();
     localCallEnvelopeSchema = external_exports.object({
@@ -49085,7 +49324,7 @@ function createPackageDigester(deps) {
     const pinned = args.find((arg) => arg.startsWith(prefix))?.slice(prefix.length);
     if (pinned === void 0 || !SHA256_DIGEST_PATTERN.test(pinned)) {
       throw new DigestProblem(
-        `the launch does not pull ${pkg.name} by a sha256 digest`
+        `the launch does not pull ${pkg.name} by a sha256 hash`
       );
     }
     return pinned;
@@ -49220,7 +49459,7 @@ function checkSignedEnvelope(envelope2, launch, options, subject) {
   if (signature.alg !== "ed25519") {
     return refuse(
       envelopeInvalid(
-        `it is signed with ${String(signature.alg)}, and this machine accepts only ed25519`,
+        `it is locked with ${String(signature.alg)}, and this machine accepts only ed25519`,
         subject
       )
     );
@@ -49229,14 +49468,14 @@ function checkSignedEnvelope(envelope2, launch, options, subject) {
   if (signature.key_id !== trusted) {
     return refuse(
       envelopeInvalid(
-        `it names signing key ${signature.key_id}, and this machine trusts key ${trusted}`,
+        `it was locked with key ${signature.key_id}, and this machine trusts key ${trusted}`,
         subject
       )
     );
   }
   if (!signatureVerifies(envelope2, options.publicKeyPem)) {
     return refuse(
-      envelopeInvalid("the signature does not match its contents", subject)
+      envelopeInvalid("its lock does not match its contents", subject)
     );
   }
   if (envelope2.machine !== options.machine)
@@ -49266,7 +49505,7 @@ function checkSignedEnvelope(envelope2, launch, options, subject) {
   if (launch.package.digest !== envelope2.package_digest) {
     return refuse(
       launchMismatch(
-        `the launch pins package digest ${launch.package.digest}, and the envelope signs ${envelope2.package_digest}`
+        `the launch pins package hash ${launch.package.digest}, and the envelope locks ${envelope2.package_digest}`
       )
     );
   }
@@ -49274,7 +49513,7 @@ function checkSignedEnvelope(envelope2, launch, options, subject) {
   if (launchDigest !== envelope2.launch_digest) {
     return refuse(
       launchMismatch(
-        `the launch's command, args, and env names hash to ${launchDigest}, and the envelope signs ${envelope2.launch_digest}`
+        `the launch's command, args, and env names hash to ${launchDigest}, and the envelope locks ${envelope2.launch_digest}`
       )
     );
   }
@@ -50441,7 +50680,7 @@ async function fetchOne(input, url) {
       Buffer.from(await sum3.arrayBuffer()).toString("utf8")
     );
     if (want === void 0)
-      return { ok: false, message: `${url}.sha256 names no SHA-256 digest` };
+      return { ok: false, message: `${url}.sha256 names no SHA-256 hash` };
     const file = await input.fetch(url, {
       signal: AbortSignal.timeout(timeoutMs)
     });
@@ -53440,7 +53679,7 @@ function createModelProxy(deps) {
     let session;
     const lost = (error) => {
       deps.log(
-        `model proxy: sealing the frame of a call it did not forward (${reason3}) failed: ${error instanceof Error ? error.message : String(error)} session=${session ?? "unattributed"}`
+        `model proxy: locking the frame of a call it did not forward (${reason3}) failed: ${error instanceof Error ? error.message : String(error)} session=${session ?? "unattributed"}`
       );
     };
     try {
@@ -53856,7 +54095,7 @@ function createModelProxy(deps) {
     void onSessionQueue(deps.exclusive, record, land).catch(
       (error) => {
         deps.log(
-          `model proxy: sealing a cache keep-alive's frame failed: ${error instanceof Error ? error.message : String(error)} session=${sessionKey}`
+          `model proxy: locking a cache keep-alive's frame failed: ${error instanceof Error ? error.message : String(error)} session=${sessionKey}`
         );
       }
     );
@@ -54229,7 +54468,7 @@ function createModelProxy(deps) {
     };
     const logLostFrame = (error) => {
       deps.log(
-        `model proxy: sealing the call's frame failed, the response the caller already has is unaffected: ${error instanceof Error ? error.message : String(error)} session=${sessionKey}`
+        `model proxy: locking the call's frame failed, the response the caller already has is unaffected: ${error instanceof Error ? error.message : String(error)} session=${sessionKey}`
       );
     };
     const afterLanding = (landed, errorClass2) => {
@@ -56397,7 +56636,7 @@ function createSessionHeads(deps) {
       text5 = await response.text();
     } catch (error) {
       deps.log(
-        `backfill pre-flight: the control plane did not answer (${error instanceof Error ? error.message : String(error)}); the pass seals nothing it cannot check`
+        `backfill pre-flight: the control plane did not answer (${error instanceof Error ? error.message : String(error)}); the pass locks nothing it cannot check`
       );
       return void 0;
     } finally {
@@ -56405,7 +56644,7 @@ function createSessionHeads(deps) {
     }
     if (status2 < 200 || status2 >= 300) {
       deps.log(
-        `backfill pre-flight: the control plane answered ${status2}; the pass seals nothing it cannot check`
+        `backfill pre-flight: the control plane answered ${status2}; the pass locks nothing it cannot check`
       );
       return void 0;
     }
@@ -56414,7 +56653,7 @@ function createSessionHeads(deps) {
       parsed2 = answerSchema.parse(JSON.parse(text5));
     } catch {
       deps.log(
-        "backfill pre-flight: the control plane's answer did not parse; the pass seals nothing it cannot check"
+        "backfill pre-flight: the control plane's answer did not parse; the pass locks nothing it cannot check"
       );
       return void 0;
     }
@@ -56871,7 +57110,7 @@ async function initializeDaemon(options, server, port, ready, clock2) {
   const sealedState = parseSealedState(
     readJsonStateFile(
       paths.daemonSealedState,
-      (movedTo) => logSetAside("daemon sealed state", movedTo)
+      (movedTo) => logSetAside("daemon state of locked sessions", movedTo)
     )
   );
   let reconcileMs = 0;
@@ -58087,7 +58326,7 @@ async function initializeDaemon(options, server, port, ready, clock2) {
     }
   } catch (error) {
     log(
-      `pending session ends unavailable: ${error instanceof Error ? error.message : String(error)}; those sessions are not sealed at this start. Check ${pendingEndsPath}`
+      `pending session ends unavailable: ${error instanceof Error ? error.message : String(error)}; those sessions are not locked at this start. Check ${pendingEndsPath}`
     );
   }
   const persistPendingEnds = () => writeSensitiveFileAtomic(
@@ -58428,7 +58667,7 @@ async function initializeDaemon(options, server, port, ready, clock2) {
       if (key !== void 0) forgetHookId(session, key);
     }
     log(
-      `session end for ${uuid} conflicts with the WAL at ${conflict.sessionUuid}:${conflict.seq}; its sealed terminal is in quarantine/${name}, and the end is sealed again on the chain the WAL holds`
+      `session end for ${uuid} conflicts with the WAL at ${conflict.sessionUuid}:${conflict.seq}; its locked end event is in quarantine/${name}, and the end is locked again on the chain the WAL holds`
     );
   }
   async function warmTerminalIndexes(sessionUuid2) {
@@ -59157,7 +59396,9 @@ async function initializeDaemon(options, server, port, ready, clock2) {
       return;
     }
     for (const refusal of session.recorder.takeOtelRefusals())
-      log(`OTel record not sealed for session ${sessionId}: ${refusal}`);
+      log(
+        `OTel record not locked into the chain for session ${sessionId}: ${refusal}`
+      );
   }
   const api = {
     runContained: contained.run,
@@ -59598,7 +59839,7 @@ async function initializeDaemon(options, server, port, ready, clock2) {
     for (const session of registry2.list()) {
       for (const repair of session.recorder.takeSealRepairs()) {
         log(
-          `recorder sealed an event no path returned; written anyway: ${repair}`
+          `recorder locked an event no path returned; written anyway: ${repair}`
         );
       }
     }
@@ -59872,6 +60113,28 @@ async function initializeDaemon(options, server, port, ready, clock2) {
         fetch: options.fetch ?? globalThis.fetch,
         log
       }),
+      // What the API stored survives a restart, so a restart sends only new
+      // and changed memories rather than every one on the machine (#7159).
+      storage: fileStateStorage(
+        paths.memorySent,
+        (movedTo) => log(
+          movedTo === void 0 ? "memory reader: the sent record did not parse and could not be moved aside; every memory is sent again" : `memory reader: the sent record did not parse; moved it to ${movedTo}, and every memory is sent again`
+        )
+      ),
+      log,
+      // A 429 is waited out within the scan. A stop ends the wait at once.
+      wait: (ms) => new Promise((resolve28) => {
+        if (stopping.signal.aborted) return resolve28(false);
+        const done = (passed) => {
+          clearTimeout(timer2);
+          stopping.signal.removeEventListener("abort", onAbort);
+          resolve28(passed);
+        };
+        const onAbort = () => done(false);
+        const timer2 = setTimeout(() => done(true), ms);
+        timer2.unref();
+        stopping.signal.addEventListener("abort", onAbort, { once: true });
+      }),
       harnesses: memoryLocations,
       scope: () => memoryScope.forScan(),
       // Codex's store follows `CODEX_HOME`. Only the agent that enrolls
@@ -59908,9 +60171,20 @@ async function initializeDaemon(options, server, port, ready, clock2) {
         const stella = stopped2 ? void 0 : await stellaMemories?.scan();
         const scans = [...result2.scans ?? [], ...stella?.scans ?? []];
         return { scans, counts: result2.counts };
-      }).then(
-        (result2) => stopped2 ? void 0 : memoryUses?.report(result2.scans, result2.counts)
-      ).catch((error) => {
+      }).then(async (result2) => {
+        if (stopped2 || memoryUses === void 0) return;
+        const report = await memoryUses.report(result2.scans, result2.counts);
+        if (report.missing.length === 0) return;
+        log(
+          `memory scan: the control plane holds no memory for ${report.missing.length} scanned files; they are sent again at the next scan`
+        );
+        memoryReader.resend(
+          report.missing.filter((memory) => memory.harness !== "stella")
+        );
+        stellaMemories?.resend(
+          report.missing.filter((memory) => memory.harness === "stella").map((memory) => memory.path)
+        );
+      }).catch((error) => {
         log(
           `memory scan failed: ${error instanceof Error ? error.message : String(error)}`
         );
@@ -59995,7 +60269,7 @@ async function initializeDaemon(options, server, port, ready, clock2) {
       });
       if (!await settleWithin(sealed, timers.stopQueueMs))
         log(
-          `stop: a task held the queue for ${timers.stopQueueMs} ms; the host chain seals when it finishes`
+          `stop: a task held the queue for ${timers.stopQueueMs} ms; the host chain locks when it finishes`
         );
       if (!await settleWithin(shipper.drain(), timers.stopDrainMs))
         log(
@@ -64384,7 +64658,8 @@ var init_esm = __esm({
 });
 
 // ../../packages/tacho/src/collector/run.ts
-import { readFileSync as readFileSync25, unlinkSync as unlinkSync15 } from "node:fs";
+import { readFileSync as readFileSync25, realpathSync as realpathSync7, statSync as statSync17, unlinkSync as unlinkSync15 } from "node:fs";
+import { dirname as dirname29, join as join53 } from "node:path";
 function stopWithin(stop, graceMs, exit, log) {
   const timer = setTimeout(() => {
     log(`tachod: stop did not finish within ${graceMs} ms, exiting
@@ -64446,6 +64721,87 @@ function writeDaemonPid(path2, now = /* @__PURE__ */ new Date(), execPath = proc
     420
   );
 }
+function installedCliVersion(entry2 = process.argv[1], read2 = (path2) => readFileSync25(path2, "utf8"), realpath3 = realpathSync7) {
+  if (entry2 === void 0) return void 0;
+  let dir;
+  try {
+    dir = dirname29(realpath3(entry2));
+  } catch {
+    return void 0;
+  }
+  for (let depth = 0; depth < CLI_PACKAGE_DEPTH_MAX; depth += 1) {
+    try {
+      const pkg = JSON.parse(read2(join53(dir, "package.json")));
+      if (pkg.name === "@oxagen/cli")
+        return typeof pkg.version === "string" ? pkg.version : void 0;
+    } catch {
+    }
+    const parent = dirname29(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+  return void 0;
+}
+function processProbe() {
+  return {
+    entry: process.argv[1],
+    native: isNativeBuild(),
+    execPath: process.execPath,
+    platform: process.platform,
+    read: (path2) => readFileSync25(path2, "utf8"),
+    realpath: realpathSync7,
+    stat: statSync17,
+    exists: (path2) => {
+      try {
+        statSync17(path2);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function installedIdentity(probe = processProbe()) {
+  if (!probe.native)
+    return installedCliVersion(probe.entry, probe.read, probe.realpath);
+  try {
+    const real = probe.realpath(
+      stableExecutablePath(probe.execPath, probe.platform, probe.exists)
+    );
+    const info = probe.stat(real);
+    return `${real} (${info.size} bytes, changed ${new Date(info.mtimeMs).toISOString()})`;
+  } catch {
+    return void 0;
+  }
+}
+function watchInstalledVersion(options) {
+  const atStart = options.installed();
+  let seen;
+  let done = false;
+  const set = options.setInterval ?? setInterval;
+  const clear = options.clearInterval ?? ((handle2) => clearInterval(handle2));
+  const handle = set(() => {
+    if (done) return;
+    const now = options.installed();
+    const changed = now !== void 0 && now !== options.running && now !== atStart;
+    if (!changed) {
+      seen = void 0;
+      return;
+    }
+    if (seen !== now) {
+      seen = now;
+      return;
+    }
+    done = true;
+    clear(handle);
+    options.restart(now);
+  }, options.everyMs ?? VERSION_CHECK_MS);
+  handle.unref?.();
+  return () => {
+    done = true;
+    clear(handle);
+  };
+}
 function ownProcStart() {
   if (process.platform !== "linux") return void 0;
   return readProcessStarts([process.pid], void 0, "linux")?.get(process.pid);
@@ -64567,6 +64923,17 @@ async function runDaemonProcess(options = {}) {
     releaseDaemonPid(paths.pid, previousPid);
     throw error;
   }
+  watchInstalledVersion({
+    running: TACHO_VERSION,
+    installed: () => installedIdentity(),
+    restart: (installed) => {
+      log(
+        `tachod: this daemon runs ${TACHO_VERSION} and the CLI installed under it is now ${installed}; restarting so the service manager starts the new one
+`
+      );
+      stop("CLI update");
+    }
+  });
   if (options.started !== void 0) {
     try {
       await options.started(
@@ -64583,7 +64950,7 @@ async function runDaemonProcess(options = {}) {
   }
   await new Promise(() => void 0);
 }
-var STOP_GRACE_MS2;
+var STOP_GRACE_MS2, VERSION_CHECK_MS, CLI_PACKAGE_DEPTH_MAX;
 var init_run2 = __esm({
   "../../packages/tacho/src/collector/run.ts"() {
     "use strict";
@@ -64591,8 +64958,12 @@ var init_run2 = __esm({
     init_fs();
     init_paths();
     init_process_scan();
+    init_deps();
+    init_version();
     init_daemon();
     STOP_GRACE_MS2 = 5e3;
+    VERSION_CHECK_MS = 10 * 6e4;
+    CLI_PACKAGE_DEPTH_MAX = 6;
   }
 });
 
@@ -64605,21 +64976,21 @@ import {
   mkdirSync as mkdirSync9,
   openSync as openSync9,
   readSync as readSync5,
-  realpathSync as realpathSync7,
+  realpathSync as realpathSync8,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname29, join as join53, resolve as resolve20 } from "node:path";
+import { dirname as dirname30, join as join54, resolve as resolve20 } from "node:path";
 function bundlePath(root, relative12, create2 = false) {
   const absolute = resolve20(root);
   if (create2) mkdirSync9(absolute, { recursive: true, mode: 448 });
   if (lstatSync10(absolute).isSymbolicLink() || !lstatSync10(absolute).isDirectory()) {
     arpFail(`The bundle root ${absolute} must be a directory, not a symlink.`);
   }
-  const base2 = realpathSync7(absolute);
+  const base2 = realpathSync8(absolute);
   let current = base2;
   const parts = relative12.split("/");
   for (let i2 = 0; i2 < parts.length; i2++) {
-    current = join53(current, parts[i2]);
+    current = join54(current, parts[i2]);
     try {
       const stat7 = lstatSync10(current);
       if (stat7.isSymbolicLink() || i2 < parts.length - 1 && !stat7.isDirectory()) {
@@ -64633,7 +65004,7 @@ function bundlePath(root, relative12, create2 = false) {
       else if (i2 < parts.length - 1) throw error;
     }
   }
-  if (realpathSync7(dirname29(current)) !== dirname29(current)) {
+  if (realpathSync8(dirname30(current)) !== dirname30(current)) {
     arpFail(`The bundle directory changed while ${relative12} was read.`);
   }
   return current;
@@ -64651,7 +65022,8 @@ function readBounded(root, relative12, limit = ARP_MAX_BLOB_BYTES) {
     let offset = 0;
     while (offset < bytes.length) {
       const count12 = readSync5(fd2, bytes, offset, bytes.length - offset, offset);
-      if (!count12) arpFail(`The bundle file ${relative12} changed while it was read.`);
+      if (!count12)
+        arpFail(`The bundle file ${relative12} changed while it was read.`);
       offset += count12;
     }
     if (readSync5(fd2, Buffer.alloc(1), 0, 1, offset) !== 0)
@@ -64696,7 +65068,7 @@ function readBlob(root, ref) {
   const bytes = readBounded(root, blobPath(ref), ref.bytes);
   if (bytes.length !== ref.bytes || digestBytes(bytes) !== ref.digest) {
     arpFail(
-      `Blob ${ref.digest} failed its integrity check: its bytes do not match its digest and size (${ref.bytes} bytes).`
+      `Blob ${ref.digest} failed its integrity check: its bytes do not match its hash and size (${ref.bytes} bytes).`
     );
   }
   return bytes;
@@ -64704,12 +65076,14 @@ function readBlob(root, ref) {
 function controlJson(bytes, name) {
   const value = JSON.parse(bytes.toString("utf8"));
   if (!Buffer.from(jcs(value)).equals(bytes))
-    arpFail(`The ${name} must use canonical JSON.`);
+    arpFail(`The ${name} must use JSON in one standard form.`);
   function check2(item, depth) {
     if (depth > MAX_CONTROL_DEPTH)
       arpFail(`The ${name} nests deeper than ${MAX_CONTROL_DEPTH} levels.`);
     if (typeof item === "number" && !Number.isSafeInteger(item))
-      arpFail(`The ${name} holds ${item}, and its numbers must be safe integers.`);
+      arpFail(
+        `The ${name} holds ${item}, and its numbers must be safe integers.`
+      );
     if (typeof item === "string" && /[\ud800-\udfff]/u.test(item))
       arpFail(`The ${name} contains an invalid Unicode string.`);
     if (item && typeof item === "object") {
@@ -64732,7 +65106,7 @@ function parseControl(schema, bytes, name) {
 function writeCheckpoint(root, checkpoint, key) {
   const parsed2 = arpCheckpointSchema.parse(checkpoint);
   const bytes = Buffer.from(jcs(parsed2));
-  controlJson(bytes, "checkpoint");
+  controlJson(bytes, "save point");
   const subjectDigest = digestBytes(bytes);
   const attestation = {
     schema: "arp.attestation/0.1",
@@ -64858,16 +65232,16 @@ function verifyBundle2(root, trustedPublicKey) {
   const checkpoint = parseControl(
     arpCheckpointSchema,
     checkpointBytes,
-    "checkpoint"
+    "save point"
   );
   if (checkpoint.gaps.some((gap) => gap.required) || checkpoint.effects.some((effect) => effect.status === "unknown")) {
-    arpFail("The checkpoint has required gaps or unresolved effects.");
+    arpFail("The save point has required gaps or unresolved effects.");
   }
   const checkpointDigest = digestBytes(checkpointBytes);
   const attestation = parseControl(
     attestationSchema,
     readBounded(root, "checkpoint.attestation.json", 4096),
-    "checkpoint attestation"
+    "save point lock"
   );
   if (checkpoint.issuer !== deviceKeyFingerprint(trustedPublicKey) || attestation.subject_digest !== checkpointDigest || attestation.key_id !== deviceKeyFingerprint(trustedPublicKey) || !verifyDeviceSignature(
     trustedPublicKey,
@@ -64875,7 +65249,7 @@ function verifyBundle2(root, trustedPublicKey) {
 ${checkpointDigest}`,
     attestation.signature
   )) {
-    arpFail("The checkpoint signature does not match the trusted key.");
+    arpFail("The save point's lock does not match the trusted key.");
   }
   let total2 = 0;
   const seen = /* @__PURE__ */ new Map();
@@ -64961,7 +65335,7 @@ ${checkpointDigest}`,
   const evidence = JSON.parse(evidenceBytes.toString("utf8"));
   if (!Buffer.from(jcs(evidence)).equals(evidenceBytes)) {
     arpFail(
-      "The evidence array must use canonical JSON without changing native events."
+      "The evidence array must use JSON in one standard form without changing native events."
     );
   }
   if (!Array.isArray(evidence) || evidence.length > MAX_EVIDENCE_EVENTS)
@@ -65056,7 +65430,7 @@ function readHandoffFrames(bytes) {
     }
     if (frame2.content_digest !== digestBytes(frame2.content) || frame2.token_cost !== budgetTokens(frame2.content)) {
       arpFail(
-        `Context frame ${frame2.id} has an invalid CGP content digest or token cost.`
+        `Context frame ${frame2.id} has an invalid CGP content hash or token cost.`
       );
     }
   }
@@ -65464,20 +65838,20 @@ function checkDeterministicComposition(journal) {
       });
     } else if (first.digest !== event.composition_digest) {
       violations.push(
-        `the frame set rendered at seq ${event.seq} is identical to seq ${first.seq} but composed to a different digest: an unchanged set must render byte-identically (section 1)`
+        `the frame set rendered at seq ${event.seq} is identical to seq ${first.seq} but composed to a different hash: an unchanged set must render byte-identically (section 1)`
       );
     }
   }
   if (digested === 0) {
     return skip(
       CHECK_COMPOSITION,
-      "no composition digests recorded: prefix stability not exercised by this journal"
+      "no composition hashes recorded: prefix stability not exercised by this journal"
     );
   }
   return fromViolations(
     CHECK_COMPOSITION,
     violations,
-    `${digested} digest-carrying prompt(s); identical frame sets composed identically`
+    `${digested} hash-carrying prompt(s); identical frame sets composed identically`
   );
 }
 function checkEffectExactlyOnce(journal) {
@@ -65576,11 +65950,11 @@ import {
   mkdirSync as mkdirSync10,
   openSync as openSync10,
   readSync as readSync6,
-  realpathSync as realpathSync8,
+  realpathSync as realpathSync9,
   rmSync as rmSync12,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname30, isAbsolute as isAbsolute15, join as join54, relative as relative6, resolve as resolve21, sep as sep8 } from "node:path";
+import { dirname as dirname31, isAbsolute as isAbsolute15, join as join55, relative as relative6, resolve as resolve21, sep as sep8 } from "node:path";
 function outsideProfile(path2) {
   return HARNESS_CONFIG_PATH.test(path2) || CREDENTIAL_PATH.test(path2);
 }
@@ -65595,9 +65969,7 @@ function readRegular(label2, path2, limit) {
   try {
     const before = fstatSync3(fd2);
     if (!before.isFile() || before.size > limit)
-      arpFail(
-        `${label2} ${path2} is not a regular file of at most ${limit} bytes.`
-      );
+      arpFail(`${label2} ${path2} is not a regular file of at most ${limit} bytes.`);
     const bytes = Buffer.alloc(before.size);
     let offset = 0;
     while (offset < bytes.length) {
@@ -65636,9 +66008,9 @@ function within2(root, path2) {
 }
 function newPath(path2) {
   const full = resolve21(path2);
-  return join54(
-    realpathSync8(dirname30(full)),
-    full.slice(dirname30(full).length + 1)
+  return join55(
+    realpathSync9(dirname31(full)),
+    full.slice(dirname31(full).length + 1)
   );
 }
 function sourcePath(root, path2) {
@@ -65650,7 +66022,7 @@ function sourcePath(root, path2) {
   }
   let current = root;
   for (const part2 of path2.split("/")) {
-    current = join54(current, part2);
+    current = join55(current, part2);
     if (lstatSync11(current).isSymbolicLink())
       arpFail(
         `${path2} is a symlink or passes through one. Symlinks require a resource adapter.`
@@ -65701,15 +66073,15 @@ function readBrief(path2) {
 function captureCheckpoint(options) {
   if (!options.attestBoundary)
     arpFail(
-      "Pass --attest-boundary to attest that the stopped workspace matches the brief's evidence boundary."
+      "Pass --attest-boundary to confirm that the stopped workspace matches the brief's evidence boundary."
     );
-  const root = realpathSync8(options.workspace);
+  const root = realpathSync9(options.workspace);
   if (!lstatSync11(root).isDirectory())
     arpFail(`The workspace ${root} is not a directory.`);
   const out = newPath(options.out);
   if (within2(root, out))
     arpFail(
-      `Write the checkpoint outside its source workspace; ${out} is inside ${root}.`
+      `Write the save point outside its source workspace; ${out} is inside ${root}.`
     );
   const brief = readBrief(options.briefFile);
   const evidenceBytes = readRegular(
@@ -65865,7 +66237,7 @@ function captureCheckpoint(options) {
 function prepareCheckpoint(options) {
   const harness = external_exports.enum(["codex", "claude-code", "cursor", "stella"]).parse(options.harness);
   const verified = verifyBundle2(options.bundle, options.publicKey);
-  const bundle2 = realpathSync8(options.bundle);
+  const bundle2 = realpathSync9(options.bundle);
   const { checkpoint, workspace, checkpointDigest, events } = verified;
   const blob = (ref) => verified.blobs.get(ref.digest) ?? arpFail(`Blob ${ref.digest} was not read during verification.`);
   const traceReport = runOracles(projectToTrace(events));
@@ -65878,15 +66250,15 @@ function prepareCheckpoint(options) {
     );
   const taskBytes = blob(checkpoint.task);
   const contextBytes = blob(checkpoint.context);
-  rejectSecrets("The checkpoint's task", taskBytes);
-  rejectSecrets("The checkpoint's context", contextBytes);
+  rejectSecrets("The save point's task", taskBytes);
+  rejectSecrets("The save point's context", contextBytes);
   const task = external_exports.object({ request: external_exports.string().min(1).max(64e3) }).strict().safeParse(JSON.parse(taskBytes.toString("utf8")));
   if (!task.success)
-    arpFail(`The checkpoint's task is not valid: ${zodIssues(task.error)}.`);
+    arpFail(`The save point's task is not valid: ${zodIssues(task.error)}.`);
   const frames = readHandoffFrames(contextBytes);
   if (!sameJson(blob(checkpoint.environment), CAPTURED_ENVIRONMENT) || !sameJson(blob(checkpoint.authority), CAPTURED_AUTHORITY) || !sameJson(blob(checkpoint.tools), CAPTURED_TOOLS)) {
     arpFail(
-      "The checkpoint needs an environment, tool, or authority adapter not supported here."
+      "The save point needs an environment, tool, or authority adapter not supported here."
     );
   }
   const unsupported = checkpoint.gaps.filter(
@@ -65894,7 +66266,7 @@ function prepareCheckpoint(options) {
   );
   if (workspace.repositories.length > 0 || unsupported.length > 0) {
     arpFail(
-      `The checkpoint requires a repository or gap adapter not supported here${unsupported.length > 0 ? ` (gaps: ${unsupported.map((gap) => gap.code).join(", ")})` : ""}.`
+      `The save point requires a repository or gap adapter not supported here${unsupported.length > 0 ? ` (gaps: ${unsupported.map((gap) => gap.code).join(", ")})` : ""}.`
     );
   }
   const restore = workspace.entries.map((entry2) => {
@@ -65917,23 +66289,23 @@ function prepareCheckpoint(options) {
   });
   mkdirSync10(destination, { mode: 448 });
   try {
-    const restored = join54(destination, "workspace");
+    const restored = join55(destination, "workspace");
     mkdirSync10(restored, { mode: 448 });
     for (const item of restore) {
-      const path2 = join54(restored, item.path);
+      const path2 = join55(restored, item.path);
       if (item.kind === "directory")
         mkdirSync10(path2, { recursive: true, mode: 448 });
       else {
-        mkdirSync10(dirname30(path2), { recursive: true, mode: 448 });
+        mkdirSync10(dirname31(path2), { recursive: true, mode: 448 });
         writeFileSync7(path2, item.bytes, {
           flag: "wx",
           mode: item.executable ? 448 : 384
         });
       }
     }
-    const promptDir = join54(restored, ".arp");
+    const promptDir = join55(restored, ".arp");
     mkdirSync10(promptDir, { mode: 448 });
-    const promptFile = join54(promptDir, "handoff.json");
+    const promptFile = join55(promptDir, "handoff.json");
     const prompt = {
       checkpoint_digest: checkpointDigest,
       task: task.data.request,
@@ -65950,7 +66322,7 @@ function prepareCheckpoint(options) {
       flag: "wx",
       mode: 384
     });
-    const reportPath = join54(destination, "report.json");
+    const reportPath = join55(destination, "report.json");
     writeFileSync7(
       reportPath,
       jcs(
@@ -66065,7 +66437,7 @@ var init_transfer = __esm({
 
 // ../../packages/tacho/src/cli/arp.ts
 function addArpCommands(program2, deps = defaultCliDeps()) {
-  const arp = program2.command("arp").description("Capture and prepare local Agent Run Protocol checkpoints");
+  const arp = program2.command("arp").description("Capture and prepare local Agent Run Protocol save points");
   async function report(operation, next) {
     try {
       deps.out(JSON.stringify(await operation()));
@@ -66075,12 +66447,12 @@ function addArpCommands(program2, deps = defaultCliDeps()) {
       process.exitCode = 1;
     }
   }
-  arp.command("capture").description("Sign selected files and a brief at a stopped turn boundary").requiredOption("--workspace <directory>", "Stopped source workspace").requiredOption("--evidence <file>", "Tacho export ending at turn_end").requiredOption(
+  arp.command("capture").description("Lock selected files and a brief at a stopped turn boundary").requiredOption("--workspace <directory>", "Stopped source workspace").requiredOption("--evidence <file>", "Tacho export ending at turn_end").requiredOption(
     "--brief <file>",
     "Transfer brief and explicit file selection"
-  ).requiredOption("--out <directory>", "New checkpoint directory").requiredOption("--key <file>", "Checkpoint signing key file").requiredOption(
+  ).requiredOption("--out <directory>", "New save point directory").requiredOption("--key <file>", "Key file that locks the save point").requiredOption(
     "--attest-boundary",
-    "Attest that the stopped workspace matches the evidence boundary"
+    "Confirm that the stopped workspace matches the evidence boundary"
   ).action(
     async (opts) => {
       await report(
@@ -66096,22 +66468,27 @@ function addArpCommands(program2, deps = defaultCliDeps()) {
       );
     }
   );
-  arp.command("verify").description("Check checkpoint integrity against a pinned public key").requiredOption("--bundle <directory>", "Checkpoint directory").requiredOption("--public-key <key>", "Trusted checkpoint public key").action(async (opts) => {
-    await report(
-      async () => {
-        const verified = await verifyBundle2(opts.bundle, opts.publicKey);
-        return { checkpointDigest: verified.checkpointDigest };
-      },
-      "Check that --bundle names a checkpoint directory and that --public-key is the key the checkpoint was signed with. Run `oxagen arp verify --help` for each option."
-    );
+  arp.command("verify").description(
+    "Check that a save point is unchanged, using a pinned public key"
+  ).requiredOption("--bundle <directory>", "Save point directory").requiredOption(
+    "--public-key <key>",
+    "Trusted public key for the save point"
+  ).action(async (opts) => {
+    await report(async () => {
+      const verified = await verifyBundle2(opts.bundle, opts.publicKey);
+      return { checkpointDigest: verified.checkpointDigest };
+    }, "Check that --bundle names a save point directory and that --public-key matches the key that locked the save point. Run `oxagen arp verify --help` for each option.");
   });
-  arp.command("prepare").description("Restore selected files and write a prompt for a fresh run").requiredOption("--bundle <directory>", "Checkpoint directory").requiredOption("--destination <directory>", "New preparation directory").requiredOption("--public-key <key>", "Trusted checkpoint public key").addOption(
+  arp.command("prepare").description("Restore selected files and write a prompt for a fresh run").requiredOption("--bundle <directory>", "Save point directory").requiredOption("--destination <directory>", "New preparation directory").requiredOption(
+    "--public-key <key>",
+    "Trusted public key for the save point"
+  ).addOption(
     new Option("--harness <name>", "Destination harness").choices(["claude-code", "codex", "cursor", "stella"]).makeOptionMandatory()
   ).action(
     async (opts) => {
       await report(
         () => prepareCheckpoint(opts),
-        "Check that --bundle names a checkpoint directory, that --public-key is the key the checkpoint was signed with, and that --destination names a directory that does not exist yet. Run `oxagen arp prepare --help` for each option."
+        "Check that --bundle names a save point directory, that --public-key matches the key that locked the save point, and that --destination names a directory that does not exist yet. Run `oxagen arp prepare --help` for each option."
       );
     }
   );
@@ -66642,8 +67019,8 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "3.0.0",
-      description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
+      version: "3.0.1-27",
+      description: "Oxagen governance CLI: spend, source tracking, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",
       bin: {
@@ -66709,10 +67086,10 @@ var init_package = __esm({
 
 // src/lib/atomic-write.ts
 import { writeFileSync as writeFileSync8, renameSync as renameSync7, unlinkSync as unlinkSync16, existsSync as existsSync26 } from "node:fs";
-import { dirname as dirname31, join as join55 } from "node:path";
+import { dirname as dirname32, join as join56 } from "node:path";
 function atomicWriteFileSync(path2, data, mode) {
-  const dir = dirname31(path2);
-  const tmp = join55(
+  const dir = dirname32(path2);
+  const tmp = join56(
     dir,
     `.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`
   );
@@ -66737,8 +67114,8 @@ var init_atomic_write = __esm({
 
 // src/lib/config.ts
 import { homedir as homedir9 } from "os";
-import { join as join56 } from "path";
-import { readFileSync as readFileSync27, mkdirSync as mkdirSync11, existsSync as existsSync27, statSync as statSync17 } from "fs";
+import { join as join57 } from "path";
+import { readFileSync as readFileSync27, mkdirSync as mkdirSync11, existsSync as existsSync27, statSync as statSync18 } from "fs";
 function getConfigDir() {
   return CONFIG_DIR;
 }
@@ -66768,7 +67145,7 @@ function parseConfig(raw) {
 function readConfig() {
   let identity;
   try {
-    const info = statSync17(CONFIG_FILE);
+    const info = statSync18(CONFIG_FILE);
     identity = `${info.ino}:${info.size}:${info.mtimeMs}`;
   } catch {
     cached2 = void 0;
@@ -66824,8 +67201,8 @@ var CONFIG_DIR, CONFIG_FILE, STRING_FIELDS, TELEMETRY_FIELDS, cached2;
 var init_config = __esm({
   "src/lib/config.ts"() {
     init_atomic_write();
-    CONFIG_DIR = join56(homedir9(), ".config", "oxagen");
-    CONFIG_FILE = join56(CONFIG_DIR, "config.json");
+    CONFIG_DIR = join57(homedir9(), ".config", "oxagen");
+    CONFIG_FILE = join57(CONFIG_DIR, "config.json");
     STRING_FIELDS = [
       "token",
       "orgSlug",
@@ -66870,16 +67247,16 @@ import {
   writeFile as writeFile2
 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { join as join57 } from "node:path";
+import { join as join58 } from "node:path";
 function isDebugEnabled() {
   const v = process.env[DEBUG_ENV];
   return v === "1" || v === "true";
 }
 function logsDir() {
-  return join57(homedir10(), ".oxagen", "logs");
+  return join58(homedir10(), ".oxagen", "logs");
 }
 function debugLogFile() {
-  return join57(logsDir(), "cli.output");
+  return join58(logsDir(), "cli.output");
 }
 function sanitize(value, depth = 0) {
   if (value === null || value === void 0) return value;
@@ -67101,12 +67478,12 @@ function diagnosticHeaders(res) {
 }
 function httpErrorHint(status2, traceId) {
   if (status2 >= 500) {
-    return "Server-side error \u2014 the stack lives in the API's runtime logs, not here. " + (traceId ? `Look up request id "${traceId}" (its region prefix names the deployment): \`vercel logs <deployment-url>\` or the Vercel dashboard \u2192 Logs.` : "Check the API deployment's runtime logs.");
+    return "Server-side error. The stack lives in the API's runtime logs, not here. " + (traceId ? `Look up request id "${traceId}" (its region prefix names the deployment): \`vercel logs <deployment-url>\` or the Vercel dashboard \u2192 Logs.` : "Check the API deployment's runtime logs.");
   }
   if (status2 === 401 || status2 === 403) {
     return "Auth/scope rejected. Re-check `oxagen login` or OXAGEN_API_TOKEN / OXAGEN_ORG_ID / OXAGEN_WORKSPACE_ID.";
   }
-  if (status2 === 429) return "Rate limited \u2014 honor the retry-after header.";
+  if (status2 === 429) return "Rate limited. Honor the retry-after header.";
   return void 0;
 }
 async function buildHttpError(event, method, url, path2, res, startedAt, secret) {
@@ -68366,7 +68743,7 @@ function printProjection(opts, writer) {
     const factor = cheap.totalUsd > 0 ? (dear.totalUsd / cheap.totalUsd).toFixed(1) : "\u221E";
     out("");
     out(
-      `  cheapest: ${cheap.label} (${formatUsd(cheap.totalUsd)}) \u2014 ${factor}\xD7 cheaper than ${dear.label}.`
+      `  cheapest: ${cheap.label} (${formatUsd(cheap.totalUsd)}), ${factor}\xD7 cheaper than ${dear.label}.`
     );
   }
   if (rows.some((r) => r.fallback))
@@ -69586,8 +69963,8 @@ function checkLine(check2) {
 async function contextRevert(proposalId, opts, writer = stdoutWriter) {
   const out = createOutput({ json: opts.json }, writer);
   if (!proposalId || !PROPOSAL_ID.test(proposalId)) {
-    writer.writeErr("error: name the merged proposal, such as prp_01k5ru4a");
-    writer.writeErr("usage: oxagen context revert <proposalId> [--json]");
+    writer.writeErr("error: name the merged suggestion, such as prp_01k5ru4a");
+    writer.writeErr("usage: oxagen context revert <suggestionId> [--json]");
     process.exitCode = 2;
     return;
   }
@@ -69723,7 +70100,7 @@ async function steeringFindings(opts = {}, writer = stdoutWriter) {
     if (index > 0) writer.write("");
     writer.write(`${repository.full_name} (${repository.provider})`);
     printTable(
-      ["FINDING", "KIND", "FILE", "RECORD", "PULL REQUEST", "PROPOSAL"],
+      ["FINDING", "KIND", "FILE", "RECORD", "PULL REQUEST", "SUGGESTION"],
       repository.findings.map(findingRow),
       writer
     );
@@ -69738,7 +70115,7 @@ async function steeringFindings(opts = {}, writer = stdoutWriter) {
   );
   if (promotable) {
     writer.write(
-      "Promote a contradiction to a proposal with `oxagen steering promote <finding-id>`."
+      "Promote a contradiction to a suggestion with `oxagen steering promote <finding-id>`."
     );
   }
 }
@@ -70556,9 +70933,9 @@ var init_git = __esm({
 
 // ../../packages/steering-freshness/src/cache.ts
 import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname32, join as join58 } from "node:path";
+import { dirname as dirname33, join as join59 } from "node:path";
 function stampPath(gitCommonDir) {
-  return join58(gitCommonDir, "oxagen", "steering-freshness.json");
+  return join59(gitCommonDir, "oxagen", "steering-freshness.json");
 }
 async function readFetchStamp(gitCommonDir, io = defaultIo) {
   try {
@@ -70579,7 +70956,7 @@ async function readFetchStamp(gitCommonDir, io = defaultIo) {
 async function writeFetchStamp(gitCommonDir, stamp, io = defaultIo) {
   const path2 = stampPath(gitCommonDir);
   try {
-    await io.mkdirp(dirname32(path2));
+    await io.mkdirp(dirname33(path2));
     await io.write(path2, `${JSON.stringify(stamp)}
 `, "utf8");
   } catch {
@@ -70610,24 +70987,24 @@ var init_cache = __esm({
 // ../../packages/steering-freshness/src/hooks.ts
 import { mkdir as mkdir5, readFile as readFile7, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
-import { dirname as dirname33, join as join59 } from "node:path";
+import { dirname as dirname34, join as join60 } from "node:path";
 function hookCommand(harness) {
   return `oxagen steering gate --harness ${harness}`;
 }
 function hookConfigPath(projectRoot, harness, env = process.env, home = homedir11()) {
   switch (harness) {
     case "claude-code":
-      return join59(projectRoot, ".claude", "settings.json");
+      return join60(projectRoot, ".claude", "settings.json");
     case "codex":
-      return join59(env["CODEX_HOME"] ?? join59(home, ".codex"), "hooks.json");
+      return join60(env["CODEX_HOME"] ?? join60(home, ".codex"), "hooks.json");
     case "cursor":
-      return join59(home, ".cursor", "hooks.json");
+      return join60(home, ".cursor", "hooks.json");
     case "stella":
-      return join59(env["STELLA_HOME"] ?? join59(home, ".stella"), "stella.toml");
+      return join60(env["STELLA_HOME"] ?? join60(home, ".stella"), "stella.toml");
   }
 }
 function stellaJsonPath(env, home) {
-  return join59(env["STELLA_HOME"] ?? join59(home, ".stella"), "settings.json");
+  return join60(env["STELLA_HOME"] ?? join60(home, ".stella"), "settings.json");
 }
 function isRecord8(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
@@ -70714,7 +71091,7 @@ async function installJsonGroupHook(path2, harness, entry2, io) {
     };
   }
   const had = hasGroupHook(loaded.config);
-  await io.mkdirp(dirname33(path2));
+  await io.mkdirp(dirname34(path2));
   await io.write(
     path2,
     `${JSON.stringify(withGroupHook(loaded.config, entry2), null, 2)}
@@ -70816,7 +71193,7 @@ async function installCursorHook(path2, io) {
   ];
   const next = { ...config, hooks };
   if (next.version === void 0) next.version = 1;
-  await io.mkdirp(dirname33(path2));
+  await io.mkdirp(dirname34(path2));
   await io.write(path2, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   return {
@@ -70999,7 +71376,7 @@ async function installStellaHook(projectRoot, io, env, home) {
   }
   const separator = base2.length === 0 ? "" : eol;
   const next = `${base2}${separator}${renderStellaBlock(eol)}`;
-  await io.mkdirp(dirname33(path2));
+  await io.mkdirp(dirname34(path2));
   await io.write(path2, next, "utf8");
   return {
     harness: "stella",
@@ -71287,7 +71664,7 @@ var init_policy = __esm({
 // ../../packages/steering-freshness/src/settings.ts
 import { readFile as readFile8 } from "node:fs/promises";
 import { homedir as homedir12 } from "node:os";
-import { join as join60 } from "node:path";
+import { join as join61 } from "node:path";
 async function readLayer(scope, path2, read2) {
   let text5;
   try {
@@ -71339,14 +71716,14 @@ function parseLayer(scope, path2, text5) {
 }
 async function loadSteeringSettings({
   projectRoot,
-  userSettingsPath = join60(homedir12(), USER_SETTINGS_RELATIVE),
+  userSettingsPath = join61(homedir12(), USER_SETTINGS_RELATIVE),
   read: read2 = readFile8,
   workspacePolicy = null
 }) {
   const targets = [
     ["user", userSettingsPath],
-    ["project", join60(projectRoot, PROJECT_DIR_NAME, PROJECT_SETTINGS_FILE)],
-    ["local", join60(projectRoot, PROJECT_DIR_NAME, LOCAL_SETTINGS_FILE)]
+    ["project", join61(projectRoot, PROJECT_DIR_NAME, PROJECT_SETTINGS_FILE)],
+    ["local", join61(projectRoot, PROJECT_DIR_NAME, LOCAL_SETTINGS_FILE)]
   ];
   const layers = [];
   const warnings = [];
@@ -71409,7 +71786,7 @@ var init_settings = __esm({
     "use strict";
     init_git();
     init_policy();
-    USER_SETTINGS_RELATIVE = join60(
+    USER_SETTINGS_RELATIVE = join61(
       ".config",
       "oxagen",
       "settings.json"
@@ -71422,7 +71799,7 @@ var init_settings = __esm({
 
 // ../../packages/steering-freshness/src/check.ts
 import { lstat as lstat4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute16, join as join61, resolve as resolve22 } from "node:path";
+import { isAbsolute as isAbsolute16, join as join62, resolve as resolve22 } from "node:path";
 function publishedCommits(platform) {
   if (platform.headCommits && platform.headCommits.length > 0)
     return platform.headCommits;
@@ -71759,7 +72136,7 @@ async function absentFromDisk(root, paths) {
   const flags = await Promise.all(
     paths.map(async (path2) => {
       try {
-        await lstat4(join61(root, path2));
+        await lstat4(join62(root, path2));
         return false;
       } catch {
         return true;
@@ -71818,7 +72195,7 @@ var init_check = __esm({
 // ../../packages/steering-freshness/src/sync.ts
 import { mkdtemp, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join62 } from "node:path";
+import { join as join63 } from "node:path";
 function refuse3(refusal, message) {
   return {
     applied: false,
@@ -71999,9 +72376,9 @@ async function syncSteering(opts) {
   };
 }
 async function commitPaths(ctx, message, paths) {
-  const dir = await mkdtemp(join62(tmpdir2(), "oxagen-steering-sync-"));
+  const dir = await mkdtemp(join63(tmpdir2(), "oxagen-steering-sync-"));
   try {
-    const list2 = join62(dir, "pathspec");
+    const list2 = join63(dir, "pathspec");
     await writeFile6(list2, `${paths.join("\0")}\0`, "utf8");
     await git3(
       ctx,
@@ -72432,6 +72809,8 @@ function parseLedgerFileName(name) {
 }
 function classifySteering(parts) {
   const name = parts[parts.length - 1];
+  if (parts[1] === PEOPLE_DIR && PERSON_FOLDER.test(parts[2] ?? ""))
+    return parts.length >= 5 && name.endsWith(".md") ? "person-record" : "unknown";
   if (parts[1] === "promotions") {
     return parts.length === 3 && parseLedgerFileName(name) ? "ledger" : "unknown";
   }
@@ -72486,11 +72865,11 @@ function recordLineageFromPath(path2) {
   const kind = classifySteeringRepoPath(path2);
   const parts = path2.split("/");
   if (kind === "skill-record") return parts[2];
-  if (kind === "record")
+  if (kind === "record" || kind === "person-record")
     return parts[parts.length - 1].slice(0, -3);
   return null;
 }
-var AGENTS_MD_PATH, CLAUDE_MD_PATH, README_PATH, GITATTRIBUTES_PATH, WORKSPACE_TOML_PATH, AGENTS_DIR, STEERING_DIR, GOVERNANCE_TOML_PATH, SKILLS_DIR, TOOLS_DIR, TOOL_SERVERS_DIR, POLICY_DIR, CEDAR_SCHEMA_PATH, CODEGRAPH_SETTINGS_DIR, SANDBOX_TEMPLATE_DIR, SKILL_FILE_NAME, SERVER_TOML_NAME, TOOLS_TOML_NAME, TOOLS_LOCK_NAME, LEDGER_ROTATIONS, LEDGER_FILE, ROOT_FILES, SERVER_FILES, SANDBOX_SERVICE_NAME, WORKSPACE_LINK_PATH;
+var AGENTS_MD_PATH, CLAUDE_MD_PATH, README_PATH, GITATTRIBUTES_PATH, WORKSPACE_TOML_PATH, AGENTS_DIR, STEERING_DIR, PEOPLE_DIR, PERSON_FOLDER, GOVERNANCE_TOML_PATH, SKILLS_DIR, TOOLS_DIR, TOOL_SERVERS_DIR, POLICY_DIR, CEDAR_SCHEMA_PATH, CODEGRAPH_SETTINGS_DIR, SANDBOX_TEMPLATE_DIR, SKILL_FILE_NAME, SERVER_TOML_NAME, TOOLS_TOML_NAME, TOOLS_LOCK_NAME, LEDGER_ROTATIONS, LEDGER_FILE, ROOT_FILES, SERVER_FILES, SANDBOX_SERVICE_NAME, WORKSPACE_LINK_PATH;
 var init_paths2 = __esm({
   "../../packages/oxagen/src/steering-repo/paths.ts"() {
     "use strict";
@@ -72501,6 +72880,8 @@ var init_paths2 = __esm({
     WORKSPACE_TOML_PATH = "workspace.toml";
     AGENTS_DIR = "agents";
     STEERING_DIR = "steering";
+    PEOPLE_DIR = "people";
+    PERSON_FOLDER = /^usr_[0-9a-z]+$/i;
     GOVERNANCE_TOML_PATH = "steering/governance.toml";
     SKILLS_DIR = "steering/skills";
     TOOLS_DIR = "tools";
@@ -72546,9 +72927,9 @@ var init_paths2 = __esm({
 
 // src/commands/workspace-link.ts
 import { existsSync as existsSync28, mkdirSync as mkdirSync12, readFileSync as readFileSync28 } from "node:fs";
-import { dirname as dirname34, join as join63 } from "node:path";
+import { dirname as dirname35, join as join64 } from "node:path";
 function workspaceLinkPath(cwd) {
-  return join63(cwd, WORKSPACE_LINK_PATH);
+  return join64(cwd, WORKSPACE_LINK_PATH);
 }
 function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -72602,7 +72983,7 @@ function readWorkspaceLink(cwd) {
 }
 function writeWorkspaceLink(cwd, link) {
   const filePath = workspaceLinkPath(cwd);
-  mkdirSync12(dirname34(filePath), { recursive: true });
+  mkdirSync12(dirname35(filePath), { recursive: true });
   atomicWriteFileSync(filePath, JSON.stringify(link, null, 2));
 }
 var LINK_STRING_FIELDS;
@@ -72637,8 +73018,8 @@ __export(steering_exports, {
   toSignal: () => toSignal
 });
 import { execFileSync } from "node:child_process";
-import { existsSync as existsSync29, realpathSync as realpathSync9 } from "node:fs";
-import { dirname as dirname35, join as join64, normalize as normalize2, parse as parsePath } from "node:path";
+import { existsSync as existsSync29, realpathSync as realpathSync10 } from "node:fs";
+import { dirname as dirname36, join as join65, normalize as normalize2, parse as parsePath } from "node:path";
 function findProjectRoot(start) {
   const { root } = parsePath(start);
   const rawGitRoot = gitRootOr(start);
@@ -72647,16 +73028,16 @@ function findProjectRoot(start) {
   if (gitRoot !== null) return gitRoot;
   let dir = from;
   for (; ; ) {
-    if (existsSync29(join64(dir, PROJECT_DIR_NAME))) return dir;
+    if (existsSync29(join65(dir, PROJECT_DIR_NAME))) return dir;
     if (dir === root) return from;
-    const parent = dirname35(dir);
+    const parent = dirname36(dir);
     if (parent === dir) return from;
     dir = parent;
   }
 }
 function realpathOr(path2) {
   try {
-    return realpathSync9(path2);
+    return realpathSync10(path2);
   } catch {
     return normalize2(path2);
   }
@@ -72876,7 +73257,7 @@ async function resolveContext(cwd, {
     if (boundRemote === null) {
       belongsHere = false;
       mismatch.push(
-        budget.expired() ? `the check ran out of time before it could tell whether a remote of this checkout points at ${fromPlatform.repository}, so Oxagen's answer was ignored` : scope ? `Oxagen's answer is about ${fromPlatform.repository}, the linked workspace's steering repository. No remote of this checkout points at it, so the workspace's steering gates do not apply here` : `Oxagen's answer is about ${fromPlatform.repository}, which no remote of this checkout points at, so it was ignored \u2014 run \`oxagen init\` in this repository to link it to its workspace`
+        budget.expired() ? `the check ran out of time before it could tell whether a remote of this checkout points at ${fromPlatform.repository}, so Oxagen's answer was ignored` : scope ? `Oxagen's answer is about ${fromPlatform.repository}, the linked workspace's steering repository. No remote of this checkout points at it, so the workspace's steering gates do not apply here` : `Oxagen's answer is about ${fromPlatform.repository}, which no remote of this checkout points at, so it was ignored. Run \`oxagen init\` in this repository to link it to its workspace`
       );
     }
   }
@@ -73462,7 +73843,7 @@ var init_common = __esm({
     init_names();
     lineageSchema = external_exports.string().regex(
       STEERING_RECORD_LINEAGE,
-      "a lineage is lowercase letters, digits, dots, and hyphens, and starts and ends with a letter or digit"
+      "a record ID is lowercase letters, digits, dots, and hyphens, and starts and ends with a letter or digit"
     );
     repoRefSchema = external_exports.string().regex(
       REPO_REF_PATTERN,
@@ -73486,7 +73867,7 @@ var init_common = __esm({
     );
     recordIdSchema = external_exports.string().regex(
       /^rec_[a-z0-9_]+_[0-9a-f]{12}$/,
-      "an id is rec_<lineage slug>_<12 hex characters>, which Oxagen writes on merge. Remove the line and let Oxagen write it."
+      "an id is rec_<record ID slug>_<12 hex characters>, which Oxagen writes on merge. Remove the line and let Oxagen write it."
     );
     sha256Schema2 = external_exports.string().regex(/^sha256:[0-9a-f]{64}$/);
     gitObjectIdSchema = external_exports.string().regex(/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/);
@@ -74044,15 +74425,15 @@ var init_context_steering_shared = __esm({
     );
     lineageIdSchema = external_exports.string().min(1).max(200).regex(
       RECORD_LINEAGE_ID,
-      `a lineage id is lowercase letters, digits, dots and hyphens (e.g. ctx.release.notes-format). The id ${GOVERNANCE_LINEAGE} is reserved for governance changes`
+      `a record ID is lowercase letters, digits, dots and hyphens (e.g. ctx.release.notes-format). The id ${GOVERNANCE_LINEAGE} is reserved for governance changes`
     );
     proposedRecordSchema = external_exports.object({
       lineageId: lineageIdSchema.describe(
-        "The lineage this proposal is about; the file stem under .oxagen/rules/"
+        "The record ID this suggestion is about; the file stem under .oxagen/rules/"
       ),
       title: external_exports.string().trim().min(1).max(200).optional(),
       label: external_exports.string().trim().min(1).max(STEERING_RECORD_LABEL_MAX).optional().describe(
-        "The record's name, at most 36 characters. Omit it to keep the current label. A rename never creates a version and never changes the lineage."
+        "The record's name, at most 36 characters. Omit it to keep the current label. A rename never creates a version and never changes the record ID."
       ),
       kind: recordKindSchema2,
       force: recordForceSchema2,
@@ -74090,7 +74471,7 @@ var init_context_steering_shared = __esm({
     }).strict();
     proposalIdSchema = external_exports.string().regex(
       /^prp_[0-9A-Za-z]+$/,
-      "a proposal id is prp_ followed by letters and digits"
+      "a suggestion id is prp_ followed by letters and digits"
     );
     proposalViewSchema = external_exports.object({
       id: proposalIdSchema,
@@ -74304,7 +74685,7 @@ var init_steering_markdown_import_shared = __esm({
       origin: markdownImportOriginSchema.describe(
         "frontmatter for a file that is one steering record already, split for a statement the model split out"
       ),
-      lineage: lineageSchema.max(200).describe("The record's lineage, and its file name in the steering repo"),
+      lineage: lineageSchema.max(200).describe("The record's ID, and its file name in the steering repo"),
       label: external_exports.string().trim().min(1).max(STEERING_RECORD_LABEL_MAX).describe("The record's name, at most 36 characters"),
       statement: external_exports.string().trim().min(1).max(MARKDOWN_IMPORT_FILE_CHARS_MAX).describe("What the record tells an agent: the record's body"),
       kind: recordKindSchema,
@@ -74409,7 +74790,7 @@ var init_steering_markdown_import_shared = __esm({
       memory: external_exports.string().nullable().describe(
         "The waiting memory's id (mem_...), or null for any other reason"
       ),
-      lineage: external_exports.string().nullable().describe("The published record's lineage, or null for any other reason"),
+      lineage: external_exports.string().nullable().describe("The published record's ID, or null for any other reason"),
       file: external_exports.string().nullable().describe("The file of the earlier row of this import, or null"),
       line: external_exports.number().int().min(1).nullable().describe("The line of the earlier row of this import, or null")
     }).strict();
@@ -83793,7 +84174,7 @@ var init_columns = __esm({
 import { createHash as createHash18 } from "node:crypto";
 function digestToBytes(digest6) {
   if (!SHA256_DIGEST_PATTERN.test(digest6)) {
-    throw new TypeError(`not a sha256 digest: ${digest6}`);
+    throw new TypeError(`not a sha256 hash: ${digest6}`);
   }
   return Buffer.from(digest6.slice("sha256:".length), "hex");
 }
@@ -84122,17 +84503,17 @@ function manifestProblem(manifest) {
   return void 0;
 }
 function attestationFileProblem(file) {
-  if (file === null) return "attestation is not a JSON object";
+  if (file === null) return "attestation.json is not a JSON object";
   const attestations = file["attestations"];
   if (attestations === void 0) return void 0;
   if (!Array.isArray(attestations))
-    return "attestation attestations is not a list";
+    return "the `attestations` member of attestation.json is not a list";
   const walkable = attestations.every((attestation) => {
     const payload = asRecord2(asRecord2(attestation)?.["payload"]);
     return payload !== null && isCount2(payload["frame_count"]);
   });
   if (!walkable)
-    return "an attestation lacks a payload with a whole frame_count";
+    return "a lock in attestation.json lacks a payload with a whole frame_count";
   return void 0;
 }
 function manifestOf(value, checks) {
@@ -84148,7 +84529,11 @@ function attestationFileOf(value, checks) {
   const file = asRecord2(value);
   const problem = attestationFileProblem(file);
   if (problem !== void 0) {
-    checks.push({ name: "attestation", status: "broken", detail: problem });
+    checks.push({
+      name: "attestation.json",
+      status: "broken",
+      detail: problem
+    });
     return null;
   }
   return file;
@@ -84166,7 +84551,7 @@ function verifyRunExport(files2) {
   const manifestJson = parseJson2(files2["manifest.json"], "manifest", checks);
   const attestationJson = parseJson2(
     files2["attestation.json"],
-    "attestation",
+    "attestation.json",
     checks
   );
   const manifest = manifestOf(manifestJson, checks);
@@ -84276,7 +84661,7 @@ function verifyRunExport(files2) {
       }
       if (digestOf3(frame2) === null) {
         digest6 = "broken";
-        reasons.push("frame carries no sha256 digest");
+        reasons.push("frame carries no sha256 hash");
       }
       verdicts.push({
         line,
@@ -84292,8 +84677,8 @@ function verifyRunExport(files2) {
       hold(
         `stream ${attempt.attempt_id}`,
         stream === attempt.event_stream_digest,
-        "the frames fold to the sealed event_stream_digest",
-        `the frames fold to ${stream}, the seal recorded ${attempt.event_stream_digest}`
+        "the frames fold to the locked event_stream_digest",
+        `the frames fold to ${stream}, the lock recorded ${attempt.event_stream_digest}`
       );
     }
     offset += attempt.frame_count;
@@ -84307,7 +84692,7 @@ function verifyRunExport(files2) {
       status: "broken",
       digest: "broken",
       link: "broken",
-      reasons: ["frame lies outside every attested attempt"]
+      reasons: ["frame lies outside every locked attempt"]
     });
   }
   verdicts.sort((a, b3) => a.line - b3.line);
@@ -84334,7 +84719,7 @@ function verifyRunExport(files2) {
     keyId = null;
   }
   hold(
-    "attester key",
+    "lock key",
     keyId !== null && keyId === attestationFile.key_id && keyId === manifest.attester_key_id,
     `key ${String(keyId)}`,
     "the bundled public key does not match the recorded key id"
@@ -84344,10 +84729,10 @@ function verifyRunExport(files2) {
   attestations.forEach((a, i2) => {
     const attemptId = a.payload?.attempt_id ?? `#${i2 + 1}`;
     hold(
-      `signature ${attemptId}`,
+      `lock ${attemptId}`,
       keyId !== null && verifyAttestation(a, pem),
-      "Ed25519 signature verifies",
-      "the attestation signature does not verify"
+      "the Ed25519 lock verifies",
+      "the lock does not verify"
     );
     const slice = digests.slice(
       covered,
@@ -84360,30 +84745,30 @@ function verifyRunExport(files2) {
       hold(
         `exported content ${attemptId}`,
         exportedDigest === a.payload?.archive_segment_digest,
-        "the exported frame bytes match the signed segment digest",
-        "the exported frame bytes do not match the signed segment digest"
+        "the exported frame bytes match the locked segment hash",
+        "the exported frame bytes do not match the locked segment hash"
       );
     }
     hold(
       `run identity ${attemptId}`,
       a.payload?.run_id === manifest.run_id,
-      "the attestation names this run",
-      "the manifest run differs from the signed run"
+      "the lock names this run",
+      "the manifest run differs from the locked run"
     );
     covered += a.payload?.frame_count ?? 0;
     const attemptRoot = slice.every((d) => d !== null) ? merkleRoot(slice) : null;
     hold(
-      `attested root ${attemptId}`,
+      `locked root ${attemptId}`,
       attemptRoot === a.payload?.merkle_root,
-      "the attempt's frames hash to the signed root",
-      `the attempt's frames hash to ${attemptRoot ?? "nothing"}, the attestation signed ${String(a.payload?.merkle_root)}`
+      "the attempt's frames hash to the locked root",
+      `the attempt's frames hash to ${attemptRoot ?? "nothing"}, the lock holds ${String(a.payload?.merkle_root)}`
     );
   });
   hold(
     "coverage",
     covered === frames.length && attestations.length > 0,
-    "the attestations cover every frame",
-    `the attestations cover ${covered} of ${frames.length} frames`
+    "the locks cover every frame",
+    `the locks cover ${covered} of ${frames.length} frames`
   );
   let redactions = null;
   const redactionsText = files2["redactions.json"];
@@ -84977,7 +85362,7 @@ var init_record = __esm({
         "Tool names, or <server>__* prefixes. The record reaches a request only when the run's toolbelt holds a match."
       ),
       skills: uniqueArray(lineageSchema, "skills", 1).optional().describe(
-        "Skill lineages. The record reaches a request only when the request's context.skill is on the list. A record cannot target a named agent."
+        "Skill record IDs. The record reaches a request only when the request's context.skill is on the list. A record cannot target a named agent."
       ),
       toolbelt: external_exports.string().min(1).optional().describe(
         "A named toolbelt in tools/toolbelts/. The steering repo spec defers what it does to a later version."
@@ -85345,7 +85730,7 @@ var init_codegraph_settings = __esm({
       ),
       key_hint: external_exports.string().regex(/^.{4}$/u, "a key hint is the key's last 4 characters").optional().describe("The last 4 characters of the organization's key."),
       linker_model: modelId().optional().describe(
-        "The model that judges candidate links. Unset: GLM 5.3 Flash, or GLM 5.2 where 5.3 Flash has no batch option."
+        "The model that judges suggested links. Unset: GLM 5.3 Flash, or GLM 5.2 where 5.3 Flash has no batch option."
       ),
       stronger_model: modelId().optional().describe(
         "The model for cross-repo pairs the linker model could not settle. Unset: GLM 5.3."
@@ -85645,7 +86030,7 @@ var init_codegraph_settings = __esm({
         7
       ),
       stale_proposal_days: setting(
-        external_exports.number().int().min(1).describe("A proposal untouched this many days is stale."),
+        external_exports.number().int().min(1).describe("A suggestion untouched this many days is stale."),
         30
       ),
       package_categories: uniqueArray(
@@ -85834,7 +86219,7 @@ var init_codegraph_settings = __esm({
         group: "decisions",
         id: "codegraph-decisions/v1",
         title: "Code graph decision records",
-        description: "codegraph/decisions.toml: the importance threshold, grouping window, stale-proposal age, and package categories.",
+        description: "codegraph/decisions.toml: the importance threshold, grouping window, stale-suggestion age, and package categories.",
         schema: codegraphDecisionsSchema,
         defaults: CODEGRAPH_DECISIONS_DEFAULTS,
         timing: "next_build"
@@ -86002,7 +86387,7 @@ var init_promotion = __esm({
         "The hash of the line before, or null on the first line of the chain."
       ),
       hash: sha256Schema2.describe(
-        "sha256 over the RFC 8785 canonical JSON of this line without hash."
+        "sha256 of this line without hash, as JSON in one standard form (RFC 8785)."
       )
     }).strict();
   }
@@ -86083,7 +86468,7 @@ var init_digest_shared = __esm({
   "../../packages/oxagen/src/contracts/digest.shared.ts"() {
     "use strict";
     init_zod();
-    sha256DigestSchema = external_exports.string().regex(/^sha256:[0-9a-f]{64}$/, "a sha256 digest (sha256:<64 hex>)");
+    sha256DigestSchema = external_exports.string().regex(/^sha256:[0-9a-f]{64}$/, "a sha256 hash (sha256:<64 hex>)");
   }
 });
 
@@ -86978,7 +87363,7 @@ var init_workspace2 = __esm({
         "Identical calls in a row that stop a run counting as progress. 2 or more."
       ),
       mode: noProgressModeSchema.describe(
-        "observe records each run that reaches the limit, and runs keep going. enforced also pauses the run at its next checkpoint."
+        "observe records each run that reaches the limit, and runs keep going. enforced also pauses the run before its next step."
       )
     }).strict();
     workspaceSchema = external_exports.object({
@@ -87079,7 +87464,7 @@ var init_steering_tools = __esm({
     STEERING_SEARCH_SNIPPET_MAX = 160;
     steeringSearchInputSchema = external_exports.object({
       query: external_exports.string().max(500).optional().describe(
-        "Words to look for in each record's label, description, lineage, and body. A label match ranks above a description match, and a description match above a body match."
+        "Words to look for in each record's label, description, record ID, and body. A label match ranks above a description match, and a description match above a body match."
       ),
       kind: recordKindSchema.optional().describe("Only records of this kind, such as skill."),
       kinds: external_exports.array(recordKindSchema).min(1).max(20).optional().describe(
@@ -87261,9 +87646,12 @@ function isRecordKind(kind) {
 function isRecordPath(path2) {
   return isRecordKind(classifySteeringRepoPath(path2));
 }
+function isReadRecordKind(kind) {
+  return isRecordKind(kind) || kind === "person-record";
+}
 function readRecordFile(path2, text5) {
   const kind = classifySteeringRepoPath(path2);
-  if (!isRecordKind(kind)) return null;
+  if (!isReadRecordKind(kind)) return null;
   const split = splitRecordFile(text5);
   if (!split.ok) return null;
   const parsed2 = parseFrontmatter(split.parts.frontmatter);
@@ -87650,6 +88038,9 @@ function sameBudget(a, b3) {
 function entryText(entry2) {
   return `${entry2.lineage} (${formatCount(entry2.tokens)} tokens)`;
 }
+function workspaceRecords(env) {
+  return env.records.filter((file) => file.kind !== "person-record");
+}
 function changedRecordTokens(env) {
   const lines = [];
   for (const file of env.records) {
@@ -87685,7 +88076,10 @@ function alwaysOnPart(env) {
   const budgetMoved = env.base !== null && !sameBudget(budget, alwaysOnBudget(env.base));
   const before = /* @__PURE__ */ new Map();
   if (env.base !== null && env.baseRecords !== null)
-    for (const block of alwaysOnBlocks(env.base, env.baseRecords))
+    for (const block of alwaysOnBlocks(
+      env.base,
+      env.baseRecords.filter((file) => file.kind !== "person-record")
+    ))
       before.set(block.repository, block);
   const governance = env.head.get(GOVERNANCE_TOML_PATH);
   const line = governance === void 0 ? null : tomlLine(governance, "steering.always_on_tokens");
@@ -87693,7 +88087,7 @@ function alwaysOnPart(env) {
   const notes = [];
   const ceiling = budgetCeiling(budget, line);
   if (ceiling !== null) findings.push(ceiling);
-  for (const block of alwaysOnBlocks(env.head, env.records)) {
+  for (const block of alwaysOnBlocks(env.head, workspaceRecords(env))) {
     const prior = before.get(block.repository);
     if (!budgetMoved && prior?.text === block.text) continue;
     const priorTokens = prior?.tokens ?? 0;
@@ -88085,7 +88479,7 @@ function flips(env) {
         ...place(file, "effect"),
         message: `The published constraint ${record.lineage} is a ${before}, and this change makes it a ${record.effect}.`,
         expected: `effect: ${before}, as published.`,
-        fix: "Archive this record, and open a new record with its own lineage for the opposite effect."
+        fix: "Archive this record, and open a new record with its own record ID for the opposite effect."
       })
     );
   }
@@ -88179,9 +88573,9 @@ var init_lineage = __esm({
               path: file.path,
               line: recordFieldLine(file, "lineage"),
               field: "lineage",
-              message: `The lineage ${lineage} is also declared in ${others.join(", ")}.`,
-              expected: "One file for each lineage.",
-              fix: "Give each record its own lineage, or delete the copy."
+              message: `The record ID ${lineage} is also declared in ${others.join(", ")}.`,
+              expected: "One file for each record ID.",
+              fix: "Give each record its own record ID, or delete the copy."
             })
           );
         }
@@ -88440,12 +88834,12 @@ function recordFieldFindings(file, known) {
         line: at2(`skills.${n2}`),
         field: `skills.${n2}`,
         ...withHint(
-          `The record names the skill ${skill}, and no active skill has that lineage.`,
+          `The record names the skill ${skill}, and no active skill has that record ID.`,
           skill,
           skillList
         ),
-        expected: "The lineage of an active skill under steering/skills/.",
-        fix: `Correct the lineage, or add the skill at steering/skills/${skill}/SKILL.md.`
+        expected: "The record ID of an active skill under steering/skills/.",
+        fix: `Correct the record ID, or add the skill at steering/skills/${skill}/SKILL.md.`
       })
     );
   });
@@ -88681,13 +89075,13 @@ var init_references = __esm({
     init_repo2();
     find8 = finder("references");
     MENTION_TEXT = {
-      record: "the lineage of an active record",
-      skill: "the lineage of an active skill",
+      record: "the record ID of an active record",
+      skill: "the record ID of an active skill",
       tool: "a tool the workspace imports"
     };
     MENTION_MISS = {
-      record: "no active record has that lineage",
-      skill: "no active skill has that lineage",
+      record: "no active record has that record ID",
+      skill: "no active skill has that record ID",
       tool: "no server in the workspace imports that tool"
     };
     FILE_MENTION = /(^|[\s(`'"])@([A-Za-z0-9_][A-Za-z0-9_./-]*\.[A-Za-z0-9]+)/g;
@@ -88909,16 +89303,16 @@ function recordShape2(file) {
   const lineage = file.raw.lineage;
   if (!isString(lineage)) return findings;
   const parts = file.path.split("/");
-  if (file.kind === "record" && fileStem(file.path) !== lineage) {
+  if (file.kind !== "skill-record" && fileStem(file.path) !== lineage) {
     findings.push(
       find9({
         rule: "file-named-for-lineage",
         path: file.path,
         line: recordFieldLine(file, "lineage"),
         field: "lineage",
-        message: `The file is named ${fileStem(file.path)}.md, but its lineage is ${lineage}.`,
-        expected: "A record file named <lineage>.md.",
-        fix: `Rename the file to ${lineage}.md, or correct the lineage.`
+        message: `The file is named ${fileStem(file.path)}.md, but its record ID is ${lineage}.`,
+        expected: "A record file named <record ID>.md.",
+        fix: `Rename the file to ${lineage}.md, or correct the record ID.`
       })
     );
   }
@@ -88929,9 +89323,9 @@ function recordShape2(file) {
         path: file.path,
         line: recordFieldLine(file, "lineage"),
         field: "lineage",
-        message: `The skill's folder is named ${parts[2]}, but its lineage is ${lineage}.`,
-        expected: `A skill at ${SKILLS_DIR}/<lineage>/${SKILL_FILE_NAME}.`,
-        fix: `Rename the folder to ${lineage}, or correct the lineage.`
+        message: `The skill's folder is named ${parts[2]}, but its record ID is ${lineage}.`,
+        expected: `A skill at ${SKILLS_DIR}/<record ID>/${SKILL_FILE_NAME}.`,
+        fix: `Rename the folder to ${lineage}, or correct the record ID.`
       })
     );
   }
@@ -88944,7 +89338,7 @@ function recordShape2(file) {
         line: recordFieldLine(file, "kind"),
         field: "kind",
         message: `A skill must live in its own folder under ${SKILLS_DIR}.`,
-        expected: `A skill at ${SKILLS_DIR}/<lineage>/${SKILL_FILE_NAME}.`,
+        expected: `A skill at ${SKILLS_DIR}/<record ID>/${SKILL_FILE_NAME}.`,
         fix: `Move the file to ${SKILLS_DIR}/${lineage}/${SKILL_FILE_NAME}, or change the kind.`
       })
     );
@@ -89168,6 +89562,7 @@ var init_schema2 = __esm({
         const kind = classifySteeringRepoPath(path2);
         switch (kind) {
           case "record":
+          case "person-record":
           case "skill-record":
             findings.push(...readRecord(path2, text5, records.get(path2) ?? null));
             findings.push(...scopeFitsRepo(records.get(path2) ?? null, env.repo));
@@ -89961,7 +90356,7 @@ var init_memory_client = __esm({
 import { readFile as readFile9 } from "node:fs/promises";
 import {
   basename as basename7,
-  dirname as dirname36,
+  dirname as dirname37,
   isAbsolute as isAbsolute17,
   relative as relative7,
   resolve as resolve23,
@@ -89973,7 +90368,7 @@ function inside(rel) {
 function importFilename(path2, folder) {
   let rel = relative7(process.cwd(), path2);
   if (!inside(rel) && folder !== void 0) {
-    rel = relative7(dirname36(resolve23(folder)), resolve23(path2));
+    rel = relative7(dirname37(resolve23(folder)), resolve23(path2));
   }
   const name = inside(rel) ? rel.split(sep9).join("/") : basename7(path2);
   return name.length > 256 ? basename7(path2).slice(-256) : name;
@@ -90268,7 +90663,7 @@ __export(steering_import_exports, {
 });
 import { readdir as readdir4, realpath as realpath2, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir13 } from "node:os";
-import { basename as basename8, extname, join as join65, relative as relative8, sep as sep10 } from "node:path";
+import { basename as basename8, extname, join as join66, relative as relative8, sep as sep10 } from "node:path";
 function envDir2(env, key) {
   const value = env[key];
   return value === void 0 || value.trim() === "" ? null : value;
@@ -90276,34 +90671,34 @@ function envDir2(env, key) {
 function harnessHome(harness, env = process.env, home = homedir13()) {
   switch (harness) {
     case "claude-code": {
-      const config = envDir2(env, "CLAUDE_CONFIG_DIR") ?? join65(home, ".claude");
+      const config = envDir2(env, "CLAUDE_CONFIG_DIR") ?? join66(home, ".claude");
       return {
         harness,
         folders: [
           {
-            dir: skillsRoot("claude-code", env, home) ?? join65(config, "skills"),
+            dir: skillsRoot("claude-code", env, home) ?? join66(config, "skills"),
             mount: ".claude/skills"
           },
-          { dir: join65(config, "commands"), mount: ".claude/commands" },
-          { dir: join65(config, "agents"), mount: ".claude/agents" }
+          { dir: join66(config, "commands"), mount: ".claude/commands" },
+          { dir: join66(config, "agents"), mount: ".claude/agents" }
         ],
         instructions: [
-          { file: join65(config, "CLAUDE.md"), filename: ".claude/CLAUDE.md" }
+          { file: join66(config, "CLAUDE.md"), filename: ".claude/CLAUDE.md" }
         ]
       };
     }
     case "codex": {
-      const codexHome = envDir2(env, "CODEX_HOME") ?? join65(home, ".codex");
+      const codexHome = envDir2(env, "CODEX_HOME") ?? join66(home, ".codex");
       return {
         harness,
         folders: [
           {
-            dir: skillsRoot("codex", env, home) ?? join65(home, ".agents", "skills"),
+            dir: skillsRoot("codex", env, home) ?? join66(home, ".agents", "skills"),
             mount: ".agents/skills"
           }
         ],
         instructions: ["AGENTS.override.md", "AGENTS.md"].map((name) => ({
-          file: join65(codexHome, name),
+          file: join66(codexHome, name),
           filename: `.codex/${name}`
         }))
       };
@@ -90312,8 +90707,8 @@ function harnessHome(harness, env = process.env, home = homedir13()) {
       return {
         harness,
         folders: [
-          { dir: join65(home, ".cursor", "skills"), mount: ".cursor/skills" },
-          { dir: join65(home, ".cursor", "commands"), mount: ".cursor/commands" }
+          { dir: join66(home, ".cursor", "skills"), mount: ".cursor/skills" },
+          { dir: join66(home, ".cursor", "commands"), mount: ".cursor/commands" }
         ],
         instructions: []
       };
@@ -90359,7 +90754,7 @@ async function findMarkdownFiles(paths, harness) {
     }
     const found = [];
     for (const entry2 of entries2.sort(byName)) {
-      const path2 = join65(dir, entry2.name);
+      const path2 = join66(dir, entry2.name);
       if (entry2.isDirectory()) {
         if (!entry2.name.startsWith(".") && entry2.name !== "node_modules")
           found.push(...await filesUnder(path2, from));
@@ -90381,7 +90776,7 @@ async function findMarkdownFiles(paths, harness) {
     const { folder } = frame2;
     const named = (rel) => frame2.fixedNames ? { filename: rel } : {};
     for (const entry2 of entries2) {
-      const path2 = join65(dir, entry2.name);
+      const path2 = join66(dir, entry2.name);
       const rel = frame2.relOf(path2);
       if (entry2.isDirectory()) {
         if (entry2.name === "node_modules") continue;
@@ -90440,7 +90835,7 @@ async function findMarkdownFiles(paths, harness) {
     }
     if (folderGiven) {
       const catalogue = CATALOGUE_FOLDERS.has(basename8(path2));
-      const root = catalogue ? join65(path2, "..") : path2;
+      const root = catalogue ? join66(path2, "..") : path2;
       await walk2(path2, {
         relOf: (p) => under(root, p),
         folder: path2,
@@ -90604,7 +90999,7 @@ async function steeringPromote(findingId, opts = {}, writer = stdoutWriter) {
     return;
   }
   writer.write(
-    `Opened proposal ${result2.proposal_id} for record ${result2.lineage}.`
+    `Opened suggestion ${result2.proposal_id} for record ${result2.lineage}.`
   );
   const pr = result2.pull_request;
   writer.write(
@@ -90627,7 +91022,7 @@ var init_steering_promote = __esm({
     USAGE2 = "oxagen steering promote <finding-id> [--json]";
     NEXT_STEPS2 = {
       finding_resolved: "Run `oxagen steering findings` to see the statements that still match a record.",
-      already_proposed: "Run `oxagen steering findings` to see the open proposal and its steering PR.",
+      already_proposed: "Run `oxagen steering findings` to see the open suggestion and its steering PR.",
       lineage_pr_open: "Merge or close the PR that is open on the record, then promote the finding again."
     };
   }
@@ -90650,7 +91045,7 @@ async function steeringRestoreBlock(proposalId, path2, opts = {}, writer = stdou
   if (!PROPOSAL_ID2.test(id2)) {
     usageError(
       writer,
-      `expected a proposal id that starts with prp_, got ${JSON.stringify(proposalId)}`,
+      `expected a suggestion id that starts with prp_, got ${JSON.stringify(proposalId)}`,
       USAGE3
     );
     return;
@@ -90704,9 +91099,9 @@ var init_steering_restore_block = __esm({
     NEXT_STEPS3 = {
       no_managed_block: "Remove the marker lines and the text between them from the file on the PR's branch by hand.",
       no_managed_blocks: "The repository keeps its steering under .oxagen/. Edit the file on the PR's branch directly.",
-      pr_not_open: "Run `oxagen steering findings` to see the proposal's current steering PR."
+      pr_not_open: "Run `oxagen steering findings` to see the suggestion's current steering PR."
     };
-    USAGE3 = "oxagen steering restore-block <proposal-id> <AGENTS.md|CLAUDE.md|README.md> [--json]";
+    USAGE3 = "oxagen steering restore-block <suggestion-id> <AGENTS.md|CLAUDE.md|README.md> [--json]";
   }
 });
 
@@ -90934,7 +91329,7 @@ async function terminalSession(relay, mode, runName, io, writer) {
   if (detaching) {
     writer.writeErr(
       `
-Detached. The run keeps going. Open its terminal again with \`oxagen sandbox attach ${runName}\`.`
+You left the terminal. The run keeps going. Open its terminal again with \`oxagen sandbox attach ${runName}\`.`
     );
   } else if (result2?.message) {
     writer.writeErr(`
@@ -91269,7 +91664,7 @@ async function runExport(runId, opts = {}, writer = stdoutWriter) {
   }
   writer.write(`Export ${result2.exportId} queued for ${runId}.`);
   writer.write(
-    `The bundle holds the frames as NDJSON, the Merkle root, the attestation, the verifying key, and a verifier script. Check on it with \`oxagen run export-status ${result2.exportId}\`.`
+    `The bundle holds the frames as NDJSON, the Merkle root, Oxagen's lock, the key that checks the lock, and a verifier script. Check on it with \`oxagen run export-status ${result2.exportId}\`.`
   );
 }
 function resolveDownloadUrl(url, apiUrl) {
@@ -91312,7 +91707,7 @@ async function runExportStatus(exportId, opts = {}, writer = stdoutWriter) {
     return;
   }
   writer.write(`Size: ${formatBytes2(result2.bundleBytes)}`);
-  writer.write(`Digest: ${result2.bundleDigest ?? "not recorded"}`);
+  writer.write(`Hash: ${result2.bundleDigest ?? "not recorded"}`);
   writer.write(`Frames: ${result2.frameCount ?? "not recorded"}`);
   writer.write(`Merkle root: ${result2.merkleRoot ?? "not recorded"}`);
   if (result2.download) {
@@ -91343,7 +91738,7 @@ async function runDownload(exportId, opts = {}, writer = stdoutWriter) {
   }
   if (!status2.download || !status2.bundleDigest) {
     out.error(
-      `Export ${exportId} is ready but the platform sent no download link or digest.`,
+      `Export ${exportId} is ready but the platform sent no download link or hash.`,
       "not_ready"
     );
     return;
@@ -91426,7 +91821,7 @@ async function runDownload(exportId, opts = {}, writer = stdoutWriter) {
     return;
   }
   writer.write(`Wrote ${path2} (${formatBytes2(size)}).`);
-  writer.write(`Digest ${actual} matches the recorded bundle digest.`);
+  writer.write(`Hash ${actual} matches the recorded bundle hash.`);
   writer.write(`Check every frame offline with \`oxagen verify ${path2}\`.`);
 }
 function attestationLine(attestation) {
@@ -91453,7 +91848,7 @@ async function runChain(runId, opts = {}, writer = stdoutWriter) {
   const many = result2.seals.length > 1;
   result2.seals.forEach((seal2, i2) => {
     writer.write(
-      `${many ? `Attempt ${i2 + 1} attestation` : "Attestation"}: ${attestationLine(seal2.attestation)}`
+      `${many ? `Attempt ${i2 + 1} lock` : "Lock"}: ${attestationLine(seal2.attestation)}`
     );
   });
   writer.write(
@@ -91477,7 +91872,9 @@ async function runChain(runId, opts = {}, writer = stdoutWriter) {
     }
   }
   if (result2.checkpoints.length > 0) {
-    writer.write(`${result2.checkpoints.length} signed checkpoint(s).`);
+    writer.write(
+      `The agent's computer locked the record at ${result2.checkpoints.length} point(s) along the way.`
+    );
   }
   const chains = result2.chains ?? [];
   if (chains.length > 0) {
@@ -91486,7 +91883,7 @@ async function runChain(runId, opts = {}, writer = stdoutWriter) {
     for (const chain of chains) {
       const name = chain.subagentType ?? chain.subagentId ?? chain.sessionUuid;
       writer.write(
-        `  ${name} (${chain.sessionUuid}): ${chain.frameCount} frames, ${chain.gaps.missingFrameCount} missing frames, ${chain.gaps.missingBodies} missing bodies${chain.sealedAt === null ? ", unsealed" : ""}${chain.complete ? "" : ", cut short"}`
+        `  ${name} (${chain.sessionUuid}): ${chain.frameCount} frames, ${chain.gaps.missingFrameCount} missing frames, ${chain.gaps.missingBodies} missing bodies${chain.sealedAt === null ? ", not locked" : ""}${chain.complete ? "" : ", cut short"}`
       );
     }
   }
@@ -91774,7 +92171,7 @@ async function runShow(runId, opts = {}, writer = stdoutWriter) {
   writer.write(`Steering: ${steeringOf(run3)}`);
   writer.write(`Replay grade: ${run3.replayGrade ?? NOT_RECORDED}`);
   writer.write(`Started: ${run3.startedAt}`);
-  writer.write(`Sealed: ${run3.sealedAt ?? "not sealed"}`);
+  writer.write(`Locked: ${run3.sealedAt ?? "not locked"}`);
   writer.write(`Turns: ${run3.turns ?? NOT_RECORDED}`);
   writer.write(`Steps: ${run3.steps}`);
   writer.write(`Frames: ${run3.frames}`);
@@ -92765,7 +93162,7 @@ function unzipSync(data, opts) {
   }
   return files2;
 }
-var require2, _a, Worker, isMarkedAsUntransferable, u82, u162, i32, fleb, fdeb, clim, freb, _a, fl, revfl, _b, fd, revfd, rev, x, i, hMap, flt, i, i, i, i, fdt, i, flrm, fdrm, max, bits, bits16, shft, slc, ec, err, inflt, et, b2, b4, b8, td, tds, dutf8, slzh, zh, z64hs;
+var require2, _a, Worker, isMarkedAsUntransferable, u82, u162, i322, fleb, fdeb, clim, freb, _a, fl, revfl, _b, fd, revfd, rev, x, i, hMap, flt, i, i, i, i, fdt, i, flrm, fdrm, max, bits, bits16, shft, slc, ec, err, inflt, et, b2, b4, b8, td, tds, dutf8, slzh, zh, z64hs;
 var init_esm2 = __esm({
   "../../node_modules/.pnpm/fflate@0.8.3/node_modules/fflate/esm/index.mjs"() {
     require2 = createRequire3("/");
@@ -92775,7 +93172,7 @@ var init_esm2 = __esm({
     }
     u82 = Uint8Array;
     u162 = Uint16Array;
-    i32 = Int32Array;
+    i322 = Int32Array;
     fleb = new u82([
       0,
       0,
@@ -92853,7 +93250,7 @@ var init_esm2 = __esm({
       for (var i2 = 0; i2 < 31; ++i2) {
         b3[i2] = start += 1 << eb[i2 - 1];
       }
-      var r = new i32(b3[30]);
+      var r = new i322(b3[30]);
       for (var i2 = 1; i2 < 30; ++i2) {
         for (var j = b3[i2]; j < b3[i2 + 1]; ++j) {
           r[j] = j - b3[i2] << 5 | i2;
@@ -93190,11 +93587,11 @@ __export(verify_exports, {
   readBundle: () => readBundle,
   verifyBundle: () => verifyBundle3
 });
-import { existsSync as existsSync30, readFileSync as readFileSync30, statSync as statSync18 } from "node:fs";
-import { join as join66 } from "node:path";
+import { existsSync as existsSync30, readFileSync as readFileSync30, statSync as statSync19 } from "node:fs";
+import { join as join67 } from "node:path";
 function readDirectory(dir) {
   const read2 = (name) => {
-    const path2 = join66(dir, name);
+    const path2 = join67(dir, name);
     return existsSync30(path2) ? readFileSync30(path2, "utf8") : void 0;
   };
   return assemble(read2, dir);
@@ -93241,7 +93638,7 @@ function readBundle(path2) {
   if (!existsSync30(path2)) {
     throw new BundleReadError(`${path2} does not exist.`);
   }
-  return statSync18(path2).isDirectory() ? readDirectory(path2) : readZip(path2);
+  return statSync19(path2).isDirectory() ? readDirectory(path2) : readZip(path2);
 }
 function plural3(count12, one, many) {
   return `${count12} ${count12 === 1 ? one : many}`;
@@ -93255,7 +93652,7 @@ function formatFrame(frame2) {
     `frame ${frame2.line}`,
     where,
     frame2.status,
-    `digest ${digestLabel(frame2.digest)}`,
+    `hash ${digestLabel(frame2.digest)}`,
     `link ${frame2.link}`
   ];
   if (frame2.reasons.length > 0) parts.push(frame2.reasons.join("; "));
@@ -93277,7 +93674,7 @@ function formatVerification(result2) {
   ).length;
   if (notCarried > 0) {
     lines.push(
-      `  Digest not carried on ${plural3(notCarried, "wrapped (tse_) frame", "wrapped (tse_) frames")}. A wrapped frame is hashed over its full event, and the bundle does not hold that event for these frames: an export before format 3 never did, and a format-3 export leaves it out when the stored row cannot be proven to rebuild it. For these frames, only the links and the Merkle root can be checked.`
+      `  Hash not carried on ${plural3(notCarried, "wrapped (tse_) frame", "wrapped (tse_) frames")}. A wrapped frame is hashed over its full event, and the bundle does not hold that event for these frames: an export before format 3 never did, and a format-3 export leaves it out when the stored row cannot be proven to rebuild it. For these frames, only the links and the Merkle root can be checked.`
     );
   }
   lines.push("");
@@ -94439,7 +94836,7 @@ async function resolveOrg(opts) {
   return promptChoice(
     "Select an organization:",
     organizations,
-    (o) => `${o.name}  (${o.slug})  \u2014 ${o.role}`,
+    (o) => `${o.name}  (${o.slug}), ${o.role}`,
     opts.isTTY
   );
 }
@@ -94472,7 +94869,7 @@ async function resolveWorkspace(opts) {
   const ws = await promptChoice(
     `Select a workspace in ${opts.orgSlug}:`,
     workspaces,
-    (w) => `${w.name}  (${w.slug})${w.role ? `  \u2014 ${w.role}` : ""}`,
+    (w) => `${w.name}  (${w.slug})${w.role ? `, ${w.role}` : ""}`,
     opts.isTTY
   );
   return { org: organization, workspace: ws };
@@ -94510,11 +94907,11 @@ import {
   mkdirSync as mkdirSync13,
   readFileSync as readFileSync31,
   readdirSync as readdirSync15,
-  realpathSync as realpathSync10,
+  realpathSync as realpathSync11,
   writeFileSync as writeFileSync9
 } from "node:fs";
 import { homedir as homedir14, hostname as osHostname3 } from "node:os";
-import { join as join67, relative as relative9, resolve as resolve25, sep as sep11 } from "node:path";
+import { join as join68, relative as relative9, resolve as resolve25, sep as sep11 } from "node:path";
 function git4(cwd, args) {
   return new Promise((done) => {
     try {
@@ -94561,7 +94958,7 @@ function parseRemoteRepository(url) {
 }
 function oxagenPresent(root) {
   try {
-    return readdirSync15(join67(root, ".oxagen")).some(
+    return readdirSync15(join68(root, ".oxagen")).some(
       (name) => name !== "workspace.json"
     );
   } catch {
@@ -94570,21 +94967,21 @@ function oxagenPresent(root) {
 }
 function symlinkState(root) {
   try {
-    if (!lstatSync12(join67(root, ".stella")).isDirectory()) return "none";
+    if (!lstatSync12(join68(root, ".stella")).isDirectory()) return "none";
   } catch {
     return "none";
   }
   let oxagenReal;
   try {
-    oxagenReal = realpathSync10(join67(root, ".oxagen"));
+    oxagenReal = realpathSync11(join68(root, ".oxagen"));
   } catch {
     return "missing";
   }
   for (const link of STELLA_LINKS) {
-    const at2 = join67(root, link);
+    const at2 = join68(root, link);
     try {
       if (!lstatSync12(at2).isSymbolicLink()) return "missing";
-      const target2 = realpathSync10(at2);
+      const target2 = realpathSync11(at2);
       if (target2 !== oxagenReal && !target2.startsWith(oxagenReal + sep11)) {
         return "missing";
       }
@@ -94595,7 +94992,7 @@ function symlinkState(root) {
   return "linked";
 }
 function machineId(configDir = getConfigDir()) {
-  const file = join67(configDir, MACHINE_ID_FILE);
+  const file = join68(configDir, MACHINE_ID_FILE);
   let secret = null;
   try {
     if (existsSync31(file)) {
@@ -94666,7 +95063,7 @@ async function reportWorkingCopy(opts) {
 }
 function realpathOr2(path2) {
   try {
-    return realpathSync10(path2);
+    return realpathSync11(path2);
   } catch {
     return resolve25(path2);
   }
@@ -94677,12 +95074,12 @@ async function ensureWorkspaceLinkIgnored(root) {
   const topDir = resolve25(top);
   const entry2 = relative9(
     topDir,
-    join67(realpathOr2(root), ".oxagen", "workspace.json")
+    join68(realpathOr2(root), ".oxagen", "workspace.json")
   ).split(sep11).join("/");
   if (entry2.startsWith("../")) return null;
   const rule = await git4(topDir, ["check-ignore", "--no-index", "-v", entry2]);
   if (rule !== null) return null;
-  const gitignore = join67(resolve25(top), ".gitignore");
+  const gitignore = join68(resolve25(top), ".gitignore");
   let existing = "";
   try {
     existing = readFileSync31(gitignore, "utf8");
@@ -94841,7 +95238,7 @@ Waiting for GitHub authorization (timeout: ${Math.round(poll.timeoutMs / 6e4)} m
     return null;
   }
   process.stdout.write(`
-GitHub connected! Fetching repositories...
+GitHub connected. Fetching repositories...
 `);
   let installations;
   try {
@@ -95200,14 +95597,14 @@ import {
   mkdirSync as mkdirSync14,
   readFileSync as readFileSync32,
   readdirSync as readdirSync16,
-  realpathSync as realpathSync11,
+  realpathSync as realpathSync12,
   rmSync as rmSync14,
   rmdirSync as rmdirSync7
 } from "node:fs";
 import {
-  dirname as dirname37,
+  dirname as dirname38,
   isAbsolute as isAbsolute18,
-  join as join68,
+  join as join69,
   parse as parsePath2,
   posix as posix5,
   sep as sep12
@@ -95232,7 +95629,7 @@ function checkSteeringPath(path2) {
   }
   const normalized = posix5.normalize(path2);
   if (normalized !== path2 || normalized.split("/").some((s2) => s2 === ".." || s2 === ".")) {
-    return { ok: false, reason: "not a canonical path" };
+    return { ok: false, reason: "has a . or .. part or a double slash" };
   }
   if (!normalized.startsWith(`${OXAGEN_DIR}/`)) {
     return { ok: false, reason: "outside .oxagen/" };
@@ -95320,14 +95717,14 @@ function findLinkedRoot(start) {
     } catch {
     }
     if (dir === root) return null;
-    const parent = dirname37(dir);
+    const parent = dirname38(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function fsReader(root) {
   return (path2) => {
-    const abs = join68(root, ...path2.split("/"));
+    const abs = join69(root, ...path2.split("/"));
     try {
       const st = lstatSync13(abs);
       if (!st.isFile()) return Buffer.from(`\0not-a-file:${abs}`);
@@ -95338,14 +95735,14 @@ function fsReader(root) {
   };
 }
 function assertInsideOxagen(root, path2) {
-  const oxagenAbs = join68(root, OXAGEN_DIR);
+  const oxagenAbs = join69(root, OXAGEN_DIR);
   let oxagenReal;
   try {
-    oxagenReal = realpathSync11(oxagenAbs);
+    oxagenReal = realpathSync12(oxagenAbs);
   } catch {
     return;
   }
-  const abs = join68(root, ...path2.split("/"));
+  const abs = join69(root, ...path2.split("/"));
   try {
     if (lstatSync13(abs).isSymbolicLink()) {
       throw new Error(
@@ -95355,11 +95752,11 @@ function assertInsideOxagen(root, path2) {
   } catch (err2) {
     if (err2.code !== "ENOENT") throw err2;
   }
-  let dir = dirname37(abs);
+  let dir = dirname38(abs);
   for (; ; ) {
     let real = null;
     try {
-      real = realpathSync11(dir);
+      real = realpathSync12(dir);
     } catch {
       real = null;
     }
@@ -95369,14 +95766,14 @@ function assertInsideOxagen(root, path2) {
       }
       return;
     }
-    const parent = dirname37(dir);
+    const parent = dirname38(dir);
     if (parent === dir) return;
     dir = parent;
   }
 }
 function pruneEmptyDirs(root, path2) {
-  const stop = join68(root, OXAGEN_DIR);
-  let dir = dirname37(join68(root, ...path2.split("/")));
+  const stop = join69(root, OXAGEN_DIR);
+  let dir = dirname38(join69(root, ...path2.split("/")));
   while (dir.startsWith(stop + sep12)) {
     try {
       if (readdirSync16(dir).length > 0) return;
@@ -95384,19 +95781,19 @@ function pruneEmptyDirs(root, path2) {
     } catch {
       return;
     }
-    dir = dirname37(dir);
+    dir = dirname38(dir);
   }
 }
 function applyPlan(root, plan) {
   for (const w of plan.writes) assertInsideOxagen(root, w.path);
   for (const d of plan.deletes) assertInsideOxagen(root, d);
   for (const w of plan.writes) {
-    const abs = join68(root, ...w.path.split("/"));
-    mkdirSync14(dirname37(abs), { recursive: true });
+    const abs = join69(root, ...w.path.split("/"));
+    mkdirSync14(dirname38(abs), { recursive: true });
     atomicWriteFileSync(abs, w.content);
   }
   for (const d of plan.deletes) {
-    rmSync14(join68(root, ...d.split("/")), { force: true });
+    rmSync14(join69(root, ...d.split("/")), { force: true });
     pruneEmptyDirs(root, d);
   }
 }
@@ -97282,7 +97679,7 @@ var init_lock = __esm({
           "source.registry_type: npm, pypi, oci, or nuget."
         ),
         digest: sha256Schema2.describe(
-          "For oci, the image's manifest digest. For pypi, the SHA-256 of file. For the others, the SHA-256 of the package archive."
+          "For oci, the SHA-256 of the image's manifest. For pypi, the SHA-256 of file. For the others, the SHA-256 of the package archive."
         ),
         file: pypiLockFileSchema.optional().describe("For pypi: the one file of the release the launch installs.")
       }),
@@ -97610,20 +98007,20 @@ var init_envelope3 = __esm({
     );
     envelopeSignatureSchema2 = external_exports.object({
       key_id: external_exports.string().regex(/^[0-9a-f]{16}$/, "a key id is 16 lowercase hex characters").describe(
-        "The first 8 bytes of the SHA-256 of the signing public key, in hex."
+        "The first 8 bytes of the SHA-256 of the public key that locks the envelope, in hex."
       ),
       alg: external_exports.literal("ed25519"),
       sig: external_exports.string().regex(
         /^[A-Za-z0-9+/]{86}==$/,
-        "an Ed25519 signature is 64 bytes in padded base64"
+        "an Ed25519 lock is 64 bytes in padded base64"
       ).describe(
-        "The signature over the envelope's RFC 8785 bytes without its signature field."
+        "The lock over the envelope's RFC 8785 bytes without its `signature` field."
       )
-    }).strict().describe("The cloud gateway's signature.");
+    }).strict().describe("The cloud gateway's lock on the envelope.");
     envelopeDeadlineSchema = external_exports.number().int().min(1).max(3e5).optional();
     machineIdSchema2 = external_exports.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "not a machine id");
     issuedAtSchema = instantSchema2.describe(
-      "When the cloud gateway signed the envelope."
+      "When the cloud gateway locked the envelope."
     );
     expiresAtSchema = instantSchema2.describe(
       `When the envelope stops being valid: after issued_at, and at most ${ENVELOPE_TTL_MAX_MS2 / 1e3} seconds after it.`
@@ -97770,7 +98167,7 @@ var init_relay_envelope = __esm({
         ),
         credential: relayCredentialSchema.optional(),
         signature: envelopeSignatureSchema2
-      }).strict().describe("One request the cloud gateway decided and signed for a relay."),
+      }).strict().describe("One request the cloud gateway decided and locked for a relay."),
       [expiryCheck, mutualTlsCheck]
     );
   }
@@ -97801,7 +98198,7 @@ var init_local_call_envelope = __esm({
           "The tool's definition hash in the lock."
         ),
         package_digest: sha256Schema2.describe(
-          "The lock's digest of the package or binary. The local gateway refuses a command that does not match."
+          "The lock's hash of the package or binary. The local gateway refuses a command that does not match."
         ),
         arguments_hash: sha256Schema2.describe(
           "SHA-256 over the RFC 8785 form of the upstream arguments, after the input was shaped."
@@ -97820,7 +98217,7 @@ var init_local_call_envelope = __esm({
         expires_at: expiresAtSchema,
         signature: envelopeSignatureSchema2
       }).strict().describe(
-        "One call to a local server that the cloud gateway decided and signed."
+        "One call to a local server that the cloud gateway decided and locked."
       ),
       [expiryCheck]
     );
@@ -97840,7 +98237,7 @@ var init_local_discovery_envelope = __esm({
       external_exports.object({
         schema: external_exports.literal("local-discovery-envelope/v1"),
         package_digest: sha256Schema2.describe(
-          "The lock's digest of the package or binary. The local gateway refuses a command that does not match."
+          "The lock's hash of the package or binary. The local gateway refuses a command that does not match."
         ),
         launch_digest: sha256Schema2.describe(
           "SHA-256 over the RFC 8785 form of the launch's command, args with each ${NAME} unfilled, and env names. The local gateway refuses a launch that does not match."
@@ -97856,7 +98253,7 @@ var init_local_discovery_envelope = __esm({
         expires_at: expiresAtSchema,
         signature: envelopeSignatureSchema2
       }).strict().describe(
-        "One discovery of a local server's tools that the cloud gateway decided and signed."
+        "One discovery of a local server's tools that the cloud gateway decided and locked."
       ),
       [expiryCheck]
     );
@@ -139514,9 +139911,9 @@ import {
   mkdirSync as mkdirSync15,
   readFileSync as readFileSync33,
   readlinkSync as readlinkSync4,
-  statSync as statSync19
+  statSync as statSync20
 } from "node:fs";
-import { dirname as dirname38, isAbsolute as isAbsolute19, join as join69, relative as relative10, resolve as resolve27, sep as sep13 } from "node:path";
+import { dirname as dirname39, isAbsolute as isAbsolute19, join as join70, relative as relative10, resolve as resolve27, sep as sep13 } from "node:path";
 function cloneRepoKind(root) {
   const out = git5(root, ["remote", "get-url", "origin"]);
   const url = out?.toString("utf8").trim() ?? "";
@@ -139556,7 +139953,7 @@ function commitOf2(root, ref) {
   return sha2.length > 0 ? sha2 : null;
 }
 function readWorkingFile(root, path2) {
-  const abs = join69(root, ...path2.split("/"));
+  const abs = join70(root, ...path2.split("/"));
   try {
     const stat7 = lstatSync14(abs);
     if (stat7.isSymbolicLink()) return readlinkSync4(abs, "utf8");
@@ -139635,14 +140032,14 @@ function chooseBase(root, ref) {
 }
 function isFile(path2) {
   try {
-    return statSync19(path2).isFile();
+    return statSync20(path2).isFile();
   } catch {
     return false;
   }
 }
 function isDir(path2) {
   try {
-    return statSync19(path2).isDirectory();
+    return statSync20(path2).isDirectory();
   } catch {
     return false;
   }
@@ -139650,10 +140047,10 @@ function isDir(path2) {
 function findSteeringRoot(start) {
   let dir = resolve27(start);
   for (; ; ) {
-    if (isFile(join69(dir, WORKSPACE_TOML_PATH)) || isFile(join69(dir, AGENTS_MD_PATH)) && isDir(join69(dir, STEERING_DIR))) {
+    if (isFile(join70(dir, WORKSPACE_TOML_PATH)) || isFile(join70(dir, AGENTS_MD_PATH)) && isDir(join70(dir, STEERING_DIR))) {
       return dir;
     }
-    const parent = dirname38(dir);
+    const parent = dirname39(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -139730,7 +140127,7 @@ function cacheFile(cacheDir, root) {
     key: token === void 0 ? null : createHash23("sha256").update(token).digest("hex").slice(0, 16)
   };
   const key = createHash23("sha256").update(JSON.stringify([root, identity])).digest("hex").slice(0, 32);
-  return join69(cacheDir, `${key}.json`);
+  return join70(cacheDir, `${key}.json`);
 }
 function readCache(file, now) {
   let entry2;
@@ -139758,7 +140155,7 @@ async function publishedInputs(root, deps, refresh, out) {
   }
   if (file !== null) {
     try {
-      mkdirSync15(dirname38(file), { recursive: true });
+      mkdirSync15(dirname39(file), { recursive: true });
       atomicWriteFileSync(
         file,
         JSON.stringify({
@@ -139844,7 +140241,7 @@ function defaultDeps2() {
   return {
     fetchPublished: fetchSteeringIndex,
     cedar: cedarHooks,
-    cacheDir: join69(getConfigDir(), "cache", "steering-check"),
+    cacheDir: join70(getConfigDir(), "cache", "steering-check"),
     now: () => Date.now()
   };
 }
@@ -144196,7 +144593,7 @@ var init_src9 = __esm({
 
 // src/commands/codegraph-upload/files.ts
 import { readdir as readdir5, stat as stat5 } from "node:fs/promises";
-import { join as join70, relative as relative11, sep as sep14 } from "node:path";
+import { join as join71, relative as relative11, sep as sep14 } from "node:path";
 function hasGlobChars(pattern) {
   return /[*?[\]{}]/.test(pattern);
 }
@@ -144208,7 +144605,7 @@ async function walk(root, dir, out) {
   const entries2 = await readdir5(dir, { withFileTypes: true });
   for (const entry2 of entries2) {
     if (entry2.isSymbolicLink()) continue;
-    const full = join70(dir, entry2.name);
+    const full = join71(dir, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIP_DIRS.has(entry2.name)) await walk(root, full, out);
     } else if (entry2.isFile()) {
@@ -144220,7 +144617,7 @@ async function expandPattern(root, pattern) {
   const wanted = normalize3(pattern.trim());
   if (!hasGlobChars(wanted)) {
     try {
-      const info = await stat5(join70(root, wanted));
+      const info = await stat5(join71(root, wanted));
       return info.isFile() ? [wanted] : [];
     } catch {
       return [];
@@ -144371,7 +144768,7 @@ var init_token = __esm({
 });
 
 // src/commands/codegraph-upload/run.ts
-import { join as join71 } from "node:path";
+import { join as join72 } from "node:path";
 function addDropped(into, more) {
   into.sensitiveValues += more.sensitiveValues;
   into.secretData += more.secretData;
@@ -144389,7 +144786,7 @@ async function uploadOne(deps, config, token, group, path2, totals2) {
   const label2 = `${group.kind}/${group.source} ${path2}`;
   let bytes;
   try {
-    bytes = await deps.readFile(join71(deps.cwd, path2));
+    bytes = await deps.readFile(join72(deps.cwd, path2));
   } catch (error) {
     totals2.failed += 1;
     deps.log(`error: ${label2}: cannot read the file: ${error.message}`);
@@ -144847,7 +145244,7 @@ var init_usage = __esm({
       "Oxagen CLI collects anonymous usage telemetry (command names, durations,",
       "coarse success/error categories, OS/arch) to improve the product. It never",
       "collects code, prompts, file contents, file paths, model slugs, or",
-      "personal data \u2014 see TELEMETRY.md for the exact field list.",
+      "personal data. See TELEMETRY.md for the exact field list.",
       "",
       "Opt out anytime: `oxagen telemetry off`, or set OXAGEN_TELEMETRY=0 /",
       "DO_NOT_TRACK=1. This notice only prints once.",
@@ -144878,7 +145275,7 @@ function telemetryStatus(writer = stdoutWriter) {
     status2,
     () => [
       `Telemetry: ${enabled ? "enabled" : "disabled"}`,
-      `Install id: ${installId ?? "(not yet generated \u2014 created on first command)"}`,
+      `Install id: ${installId ?? "(not yet generated; created on first command)"}`,
       `Ingest endpoint: ${ingestEndpoint}`,
       "See TELEMETRY.md for the full disclosure."
     ].join("\n")
@@ -144893,7 +145290,7 @@ function telemetryOff(writer = stdoutWriter) {
   const config = readConfig();
   writeConfig({ telemetry: { ...config.telemetry, enabled: false } });
   createOutput({}, writer).info(
-    "\u2713 Telemetry disabled \u2014 no usage data will be sent."
+    "\u2713 Telemetry disabled. No usage data will be sent."
   );
 }
 function isSubcommand(value) {
@@ -144983,7 +145380,7 @@ function makeErrorHtml(message) {
 <html lang="en">
 <head>
   <meta charset="utf-8">
-  <title>Oxagen \u2014 Login failed</title>
+  <title>Oxagen: Login failed</title>
   <style>
     body { font-family: system-ui, sans-serif; display: flex; justify-content: center;
            align-items: center; min-height: 100vh; margin: 0; background: #f4f4f5; }
@@ -145680,7 +146077,7 @@ async function agentStatus2(agent, opts = {}, writer = stdoutWriter) {
     return;
   }
   const { identity } = result2;
-  writer.write(`${identity.name} (${identity.slug}) \u2014 ${identity.status}`);
+  writer.write(`${identity.name} (${identity.slug}): ${identity.status}`);
   writer.write(`  id          ${identity.id}`);
   writer.write(`  agent key   ${identity.agentKey ?? "\u2014"}`);
   writer.write(`  harness     ${identity.harness}`);
@@ -146126,7 +146523,7 @@ async function routerPreview(prompt, opts = {}, writer = stdoutWriter) {
   writer.write("");
   if (result2.candidates.length === 0) {
     writer.write(
-      "No observed candidates for this class \u2014 deterministic fallback used."
+      "No observed models for this class. Deterministic fallback used."
     );
     return;
   }
@@ -146383,7 +146780,7 @@ async function handleSecretImport(opts, writer = stdoutWriter) {
     const { rows, committed } = await apiPostOrThrow("secret/import-env", { text: text5, environmentId, commit: !!opts.yes });
     const newCount = rows.filter((r) => r.isNewKey).length;
     writer.write(
-      `${committed ? "imported" : "preview"} \u2014 ${rows.length} parsed (${newCount} new, ${rows.length - newCount} existing):`
+      `${committed ? "imported" : "preview"}: ${rows.length} parsed (${newCount} new, ${rows.length - newCount} existing):`
     );
     printTable(
       ["", "KEY", "TARGET", "SENS", "STATE"],
@@ -146616,7 +147013,7 @@ function addHostWrapCommands(parent) {
 function buildProgram() {
   const program2 = new Command();
   program2.name("oxagen").description(
-    "Oxagen governance CLI \u2014 spend, traces, grounding, credentials, and audit"
+    "Oxagen governance CLI: spend, traces, grounding, credentials, and audit"
   ).version(version).option(
     "-m, --model <slug>",
     "Model slug for subcommands that price or filter by model (e.g. cost)"
@@ -146641,7 +147038,7 @@ function buildProgram() {
       "github",
       "Route repository Git requests through the host's credential custody"
     ],
-    ["arp", "Capture and prepare local Agent Run Protocol checkpoints"]
+    ["arp", "Capture and prepare local Agent Run Protocol save points"]
   ];
   for (const [name, description] of recorderCommands) {
     program2.command(name, { hidden: true }).description(description).helpOption(false).allowUnknownOption().allowExcessArguments().action(async () => {
@@ -146657,17 +147054,17 @@ function buildProgram() {
     handleCost2(merged);
   });
   const budgetCmd = program2.command("budget").description(
-    "Hard period-to-date spend ceilings that gate agent runs \u2014 org + workspace"
+    "Hard period-to-date spend ceilings that gate agent runs (org + workspace)"
   );
   budgetCmd.command("show").description("Show configured spend ceilings with their live burn").option("--json", "Output JSON").action(async (opts) => {
     const { budgetShow: budgetShow2 } = await Promise.resolve().then(() => (init_budget2(), budget_exports));
     await budgetShow2(opts);
   });
   budgetCmd.command("set").description(
-    "Set (create or replace) a spend ceiling \u2014 Owner/Admin/Billing only"
+    "Set (create or replace) a spend ceiling (Owner/Admin/Billing only)"
   ).requiredOption("--scope <scope>", "org | workspace").requiredOption("--period <period>", "monthly | rolling").requiredOption("--limit <usd>", "Hard USD ceiling (> 0)").option(
     "--window-days <n>",
-    "Trailing window in days \u2014 required for --period rolling, omit for monthly"
+    "Trailing window in days: required for --period rolling, omit for monthly"
   ).option(
     "--enabled <bool>",
     "Whether the ceiling is enforced (true/false)",
@@ -146699,7 +147096,7 @@ function buildProgram() {
     }
   );
   const priceCmd = program2.command("price").description(
-    "The organization's negotiated rates in the price book \u2014 what runs are billed at"
+    "The organization's negotiated rates in the price book: what runs are billed at"
   );
   priceCmd.command("list").description(
     "Read current prices and optionally scheduled negotiated rates"
@@ -146713,7 +147110,7 @@ function buildProgram() {
     }
   );
   priceCmd.command("set").description(
-    "Set a negotiated rate for one model and token class \u2014 Owner/Admin/Billing only"
+    "Set a negotiated rate for one model and token class (Owner/Admin/Billing only)"
   ).requiredOption("--provider <provider>", "Provider, e.g. anthropic").requiredOption("--model <model>", "Model id, e.g. claude-sonnet-5").requiredOption(
     "--token-class <class>",
     "input_uncached | cache_read | cache_write_5m | cache_write_1h | output | reasoning | server_tool_request | embedding_input | rerank | image | video_second"
@@ -146737,7 +147134,7 @@ function buildProgram() {
     await priceSet2(opts);
   });
   priceCmd.command("remove").description(
-    "End a negotiated rate so the model returns to the list price \u2014 Owner/Admin/Billing only"
+    "End a negotiated rate so the model returns to the list price (Owner/Admin/Billing only)"
   ).requiredOption("--provider <provider>", "Provider, e.g. anthropic").requiredOption("--model <model>", "Model id, e.g. claude-sonnet-5").requiredOption("--token-class <class>", "The token class to end").option("--region <region>", "Region the rate applies to; omit for any").option(
     "--at <instant>",
     "RFC 3339 instant the rate stops applying; omit for now"
@@ -146820,23 +147217,23 @@ function buildProgram() {
     }
   );
   const contextCmd = program2.command("context").description(
-    "Steering: record a proposal on a lineage, or revert a merged one"
+    "Steering: record a suggestion for a steering record, or revert a merged one"
   );
   contextCmd.command("propose").description(
-    "Record a proposal (the record it should become, why); its steering PR is opened and merged in Oxagen"
+    "Record a suggestion (the record it should become, why); its steering PR is opened and merged in Oxagen"
   ).requiredOption(
     "--lineage <id>",
-    "The lineage id (the file stem under .oxagen/rules/)"
+    "The record ID (the file stem under .oxagen/rules/)"
   ).requiredOption(
     "--kind <kind>",
     "rule | constraint | procedure | fact | memory | preference"
-  ).requiredOption("--force <force>", "must | should | may | info").requiredOption("--scope <scope>", "workspace | repository").requiredOption("--statement <text>", "The single-sentence claim").requiredOption("--rationale <text>", "Why the record should be published").option("--effect <effect>", "require | forbid \u2014 a constraint only").option("--json", "Output JSON").action(
+  ).requiredOption("--force <force>", "must | should | may | info").requiredOption("--scope <scope>", "workspace | repository").requiredOption("--statement <text>", "The single-sentence claim").requiredOption("--rationale <text>", "Why the record should be published").option("--effect <effect>", "require | forbid (a constraint only)").option("--json", "Output JSON").action(
     async (opts) => {
       const { contextPropose: contextPropose2 } = await Promise.resolve().then(() => (init_context4(), context_exports));
       await contextPropose2(opts);
     }
   );
-  contextCmd.command("revert <proposalId>").description(
+  contextCmd.command("revert <suggestionId>").description(
     "Open a steering PR that undoes a merged one (revert_steering_pr); it merges after its own review"
   ).option("--json", "Output JSON").action(async (proposalId, opts) => {
     const { contextRevert: contextRevert2 } = await Promise.resolve().then(() => (init_context4(), context_exports));
@@ -146984,8 +147381,8 @@ function buildProgram() {
     await steeringPromote2(findingId, opts);
   });
   steeringCmd.command("restore-block").argument(
-    "<proposal-id>",
-    "The prp_\u2026 proposal whose steering PR holds the file"
+    "<suggestion-id>",
+    "The prp_\u2026 suggestion whose steering PR holds the file"
   ).argument("<path>", "AGENTS.md, CLAUDE.md, or README.md").description(
     "Restore Oxagen's managed block in one file of an open steering PR, as one commit from the production branch"
   ).option("--json", "Output JSON").action(
@@ -147002,7 +147399,7 @@ function buildProgram() {
     await toolsMigrate2(opts);
   });
   const runCmd = program2.command("run").description(
-    "Start an agent under the contained launcher (`oxagen run -- claude -p <task>`), start a run in its own sandbox (`oxagen run --harness claude --workspace-slug <slug> --repo <owner/name>`), or read a recorded run: its chain and seal, and its signed evidence bundle"
+    "Start an agent under the contained launcher (`oxagen run -- claude -p <task>`), start a run in its own sandbox (`oxagen run --harness claude --workspace-slug <slug> --repo <owner/name>`), or read a recorded run: its chain, Oxagen's lock on it, and its locked evidence bundle"
   ).option("--image <ref>", "The contained image (or OXAGEN_CONTAINED_IMAGE)").option(
     "--workspace <dir>",
     "The repository root to mount at /workspace (default: the current directory). A sandbox run names its workspace with --workspace-slug"
@@ -147072,7 +147469,7 @@ function buildProgram() {
     }
   );
   runCmd.command("chain").description(
-    "Show what makes a run's record tamper-evident: the hash rule, the root, the checkpoints, the gaps, and the replay ladder"
+    "Show what makes a run's record tamper-evident: the hash rule, the root, the locks taken along the way, the gaps, and the replay ladder"
   ).argument("<run-id>", "The run's public id (arun_\u2026 or tse_\u2026)").option("--json", "Output JSON").action(async (runId, opts) => {
     const { runChain: runChain2 } = await Promise.resolve().then(() => (init_run4(), run_exports));
     await runChain2(runId, opts);
@@ -147087,7 +147484,7 @@ function buildProgram() {
     "Read one page of a run's transcript: its entries, the count per chip over the whole run, and a search of the kept bodies"
   ).argument("<run-id>", "The run's public id (arun_\u2026 or tse_\u2026)").option("--zoom <zoom>", "turns, steps, or everything", "steps").option(
     "--kinds <kinds>",
-    "The chips to keep, comma-separated (thinking,seal)"
+    "The chips to keep, comma-separated (thinking,tools)"
   ).option("--query <words>", "Words to search the entries for, ignoring case").option("--after <cursor>", "The cursor the previous page printed").option("--limit <n>", "Page size, 1 to 500", wholeNumber2(1, 500)).option("--text <text>", "How much of each body to carry: excerpt or full").option("--json", "Output the raw contract payload as JSON").action(
     async (runId, opts) => {
       const { runTranscript: runTranscript2 } = await Promise.resolve().then(() => (init_run4(), run_exports));
@@ -147101,7 +147498,7 @@ function buildProgram() {
     await runContext2(runId, opts);
   });
   runCmd.command("export").description(
-    "Queue the signed, offline-verifiable evidence bundle for a sealed run \u2014 Owner/Admin only"
+    "Queue the evidence bundle for a locked run. Oxagen locks the bundle so anyone can check it offline (Owner/Admin only)"
   ).argument("<run-id>", "The run's public id (arun_\u2026 or tse_\u2026)").option("--json", "Output JSON").action(async (runId, opts) => {
     const { runExport: runExport2 } = await Promise.resolve().then(() => (init_run4(), run_exports));
     await runExport2(runId, opts);
@@ -147116,7 +147513,7 @@ function buildProgram() {
     await runExportStatus2(exportId, opts);
   });
   runCmd.command("download").description(
-    "Download a ready run export and check its sha256 against the recorded digest"
+    "Download a ready run export and check its sha256 against the recorded hash"
   ).argument(
     "<export-id>",
     "The export id `oxagen run export` printed (rexp_\u2026)"
@@ -147281,13 +147678,13 @@ function buildProgram() {
     )
   );
   program2.command("verify").description(
-    "Check a run export bundle offline: each frame's digest and link, the Merkle root, and each signature"
+    "Check a run export bundle offline: each frame's hash and link, the Merkle root, and each lock"
   ).argument("<bundle>", "The bundle's .zip file or its extracted directory").option("--json", "Output the verification as JSON").action(async (bundle2, opts) => {
     const { verifyBundle: verifyBundle4 } = await Promise.resolve().then(() => (init_verify2(), verify_exports));
     await verifyBundle4(bundle2, opts);
   });
   program2.command("attention").description(
-    "List what waits on you in this workspace: approvals and questions on your runs, work orders in review, ready work items assigned to you, and steering proposals"
+    "List what waits on you in this workspace: approvals and questions on your runs, work orders in review, ready work items assigned to you, and steering suggestions"
   ).option(
     "--state <state>",
     "open lists what waits; resolved lists what was answered",
@@ -147373,7 +147770,7 @@ function buildProgram() {
   ).option(
     "--harness <harness>",
     "Only memories this harness keeps: claude-code, codex, cursor, stella, or claude-desktop"
-  ).option("--agent <lineage>", "Only memories this agent wrote").option(
+  ).option("--agent <record-id>", "Only memories this agent wrote").option(
     "--repository <repo>",
     "Only memories scoped to this repository, such as github.com/acme/api"
   ).option(
@@ -147598,16 +147995,16 @@ function buildProgram() {
     }
   );
   program2.command("telemetry").description(
-    "Inspect or control anonymous CLI usage telemetry (on by default \u2014 see TELEMETRY.md)"
+    "Inspect or control anonymous CLI usage telemetry (on by default; see TELEMETRY.md)"
   ).argument("[subcommand]", "on | off | status (default: status)").action(async (subcommand) => {
     const { handleTelemetry: handleTelemetry2 } = await Promise.resolve().then(() => (init_telemetry(), telemetry_exports));
     handleTelemetry2(subcommand);
   });
   program2.command("login").description(
-    "Authenticate the CLI \u2014 opens a browser by default (interactive). Use --token for CI/headless."
+    "Authenticate the CLI. Opens a browser by default (interactive). Use --token for CI/headless."
   ).option(
     "--token <token>",
-    "Platform API token \u2014 skips browser login (CI/headless)"
+    "Platform API token: skips browser login (CI/headless)"
   ).option(
     "--org <slug>",
     "Organization slug; with a saved session and no --token, rescopes the default without a browser"
@@ -147670,7 +148067,7 @@ function buildProgram() {
     "[agent]",
     "An agent id or slug. Omit it to unenroll this machine instead"
   ).description(
-    "With an agent: revoke its live host enrollments, or one host with --host \u2014 Owner/Admin only. Without one: remove this machine's hooks and service, revoke its enrollment, delete its host key"
+    "With an agent: revoke its live host enrollments, or one host with --host (Owner/Admin only). Without one: remove this machine's hooks and service, revoke its enrollment, delete its host key"
   ).option("--host <tch_id>", "With an agent: only this host").option("--reason <text>", "Recorded on the host and in the revoke command").option("--json", "With an agent: output JSON").option(
     "--yes",
     "With an agent and no --host: revoke every live host without asking"
@@ -147893,7 +148290,7 @@ function buildProgram() {
     await handleEnvSetDefault2(idOrSlug);
   });
   const routerCmd = program2.command("router").description(
-    "Verified-Outcome Market Router \u2014 learned, economic model routing"
+    "Verified-Outcome Market Router: learned, economic model routing"
   );
   routerCmd.command("preview <prompt>").description("Dry-run the routing decision for a prompt (changes nothing)").option("--files <n>", "Expected number of files touched", wholeNumber2(0)).option("--cross-package", "The task crosses package boundaries").option("--task-class <class>", "Override the derived task class").option("--json", "Output JSON").action(
     async (prompt, opts) => {
@@ -147906,7 +148303,7 @@ function buildProgram() {
     const { routerPolicyGet: routerPolicyGet2 } = await Promise.resolve().then(() => (init_router(), router_exports));
     await routerPolicyGet2(opts);
   });
-  routerPolicyCmd.command("set").description("Update the policy (org Owner) \u2014 changes spend behavior").option(
+  routerPolicyCmd.command("set").description("Update the policy, which changes spend behavior (org Owner)").option(
     "--scope <scope>",
     "org | workspace (default workspace)",
     oneOf2(["org", "workspace"])