@paigy/harness 0.3.28 → 0.3.30

package/dist/cli.js

@@ -7585,8 +7585,8 @@ var require_webidl = __commonJS({
       return new TypeError(`${message.header}: ${message.message}`);
     };
     webidl.errors.conversionFailed = function(context) {
-      const plural2 = context.types.length === 1 ? "" : " one of";
-      const message = `${context.argument} could not be converted to${plural2}: ${context.types.join(", ")}.`;
+      const plural3 = context.types.length === 1 ? "" : " one of";
+      const message = `${context.argument} could not be converted to${plural3}: ${context.types.join(", ")}.`;
       return webidl.errors.exception({
         header: context.prefix,
         message
@@ -15050,9 +15050,9 @@ var require_pluralizer = __commonJS({
       this: "these"
     };
     module.exports = class Pluralizer {
-      constructor(singular, plural2) {
+      constructor(singular, plural3) {
         this.singular = singular;
-        this.plural = plural2;
+        this.plural = plural3;
       }
       pluralize(count) {
         const one = count === 1;
@@ -23743,7 +23743,7 @@ function updateSlot(agent2, patch) {
 }
 function slotIdentity(agent2) {
   const t = readTokenFile()[agent2];
-  return { name: t?.name ?? null, voice: t?.voice ?? null, tokenId: t?.token_id ?? null, workspace: t?.workspace ?? null };
+  return { name: t?.name ?? null, voice: t?.voice ?? null, tokenId: t?.token_id ?? null, workspace: t?.workspace ?? null, harness: t?.harness ?? null, sessionId: t?.session_id ?? null };
 }
 function readToken(agent2 = agentName()) {
   if (process.env.PAIGY_TOKEN) return process.env.PAIGY_TOKEN;
@@ -23783,9 +23783,14 @@ async function pollToken(deviceCode) {
   if (err === "access_denied") throw new Error("Access denied by user. Pairing cancelled.");
   throw new Error(`Unexpected error from /api/device/token: ${err}`);
 }
-function ensureAuthed(res) {
-  if (res.status === 401) throw new UnpairedError();
-  return res;
+async function ensureAuthed(res) {
+  if (res.status !== 401) return res;
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+  }
+  throw body?.error === "revoked" ? new RevokedError() : new UnpairedError();
 }
 function overrideToken(secret) {
   tokenOverride = secret;
@@ -23795,7 +23800,7 @@ async function fail(what, res) {
 }
 async function createGoal(input, opts = {}) {
   const token = authToken(opts.token) ?? "";
-  const res = ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/goals`, {
+  const res = await ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/goals`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${token}`, "x-paigy-model": "goal-entry-v1" },
     body: JSON.stringify(input)
@@ -23805,13 +23810,14 @@ async function createGoal(input, opts = {}) {
 }
 async function claimGoal(goalId, opts = {}) {
   const token = authToken(opts.token) ?? "";
-  const res = ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/goals/claim`, { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${token}`, "x-paigy-model": "goal-entry-v1" }, body: JSON.stringify(goalId ? { goalId } : {}) }));
+  const res = await ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/goals/claim`, { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${token}`, "x-paigy-model": "goal-entry-v1" }, body: JSON.stringify(goalId ? { goalId } : {}) }));
   if (!res.ok) await fail("claim_goal", res);
   return await res.json();
 }
 async function getGoal(goalId, opts = {}, read = {}) {
   const token = authToken(opts.token) ?? "";
-  const res = ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/goals/${encodeURIComponent(goalId)}${read.history ? "?history=1" : ""}`, {
+  const query = [read.history ? "history=1" : "", read.diagnose ? "diagnose=1" : ""].filter(Boolean).join("&");
+  const res = await ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/goals/${encodeURIComponent(goalId)}${query ? `?${query}` : ""}`, {
     method: "GET",
     headers: { authorization: `Bearer ${token}`, "x-paigy-model": "goal-entry-v1" }
   }));
@@ -23821,12 +23827,12 @@ async function getGoal(goalId, opts = {}, read = {}) {
 async function updateGoal(goalId, input, opts = {}) {
   const token = authToken(opts.token) ?? "";
   const operationId = input.operationId ?? randomUUID2();
-  const res = ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/goals/${encodeURIComponent(goalId)}`, { method: "PATCH", headers: { "content-type": "application/json", authorization: `Bearer ${token}`, "x-paigy-model": "goal-entry-v1" }, body: JSON.stringify({ ...input, operationId }) }));
+  const res = await ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/goals/${encodeURIComponent(goalId)}`, { method: "PATCH", headers: { "content-type": "application/json", authorization: `Bearer ${token}`, "x-paigy-model": "goal-entry-v1" }, body: JSON.stringify({ ...input, operationId }) }));
   if (!res.ok) await fail("update_goal", res);
   return await res.json();
 }
 async function hatch(name, voice = null) {
-  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/hatch`, {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/hatch`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${authToken()}` },
     body: JSON.stringify({ name, voice })
@@ -23845,19 +23851,27 @@ async function whoAmI(opts = {}) {
   }
 }
 async function claimSessions(opts = {}) {
-  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/sessions/claim`, {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/sessions/claim`, {
     headers: { authorization: `Bearer ${authToken(opts.token)}` }
     // the HOST's identity
   }));
   if (!res.ok) throw new Error(`claim_sessions failed: ${res.status}`);
   return (await res.json()).sessions;
 }
+async function recordDecision(decision, opts = {}) {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/host/decisions`, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token)}` },
+    body: JSON.stringify(decision)
+  }));
+  if (!res.ok) await fail("record_decision", res);
+}
 async function heartbeat(runtime, opts = {}) {
   const body = {
     ...runtime !== void 0 ? { runtime } : {},
     ...opts.activity !== void 0 ? { activity: opts.activity } : {}
   };
-  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/presence`, {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/presence`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token)}` },
     ...Object.keys(body).length > 0 ? { body: JSON.stringify(body) } : {}
@@ -23865,7 +23879,7 @@ async function heartbeat(runtime, opts = {}) {
   if (!res.ok) throw new Error(`heartbeat failed: ${res.status}`);
 }
 async function registerDelivery(mode, opts = {}) {
-  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/delivery`, {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/delivery`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token)}` },
     body: JSON.stringify({ mode })
@@ -23874,21 +23888,21 @@ async function registerDelivery(mode, opts = {}) {
   return await res.json();
 }
 async function listNotes(opts = {}) {
-  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/notes`, {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/notes`, {
     headers: { authorization: `Bearer ${authToken(opts.token)}` }
   }));
   if (!res.ok) throw new Error(`list_notes failed: ${res.status} ${await res.text()}`);
   return await res.json();
 }
 async function listConnections(opts = {}) {
-  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/tokens`, {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/tokens`, {
     headers: { authorization: `Bearer ${authToken(opts.token)}`, "x-paigy-model": "goal-entry-v1" }
   }));
   if (!res.ok) throw new Error(`list_connections failed: ${res.status} ${await res.text()}`);
   return await res.json();
 }
 async function submitTriage(run, opts = {}) {
-  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/triage`, {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/triage`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token)}` },
     body: JSON.stringify(run)
@@ -23897,7 +23911,7 @@ async function submitTriage(run, opts = {}) {
   return await res.json();
 }
 async function acceptTriage(proposalId, body, opts = {}) {
-  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/triage/${encodeURIComponent(proposalId)}/accept`, {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/triage/${encodeURIComponent(proposalId)}/accept`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token)}` },
     body: JSON.stringify(body)
@@ -23952,7 +23966,7 @@ async function contact(input, opts = {}) {
       ask: a.ask,
       options: a.options ?? []
     }));
-    const res = ensureAuthed(await send22(`${BACKEND_URL}/api/goals/contact`, {
+    const res = await ensureAuthed(await send22(`${BACKEND_URL}/api/goals/contact`, {
       method: "POST",
       headers,
       signal: opts.signal,
@@ -23974,15 +23988,17 @@ async function contact(input, opts = {}) {
   }
   const all = deliveries.filter((d) => !!d.deliveryId && !!d.goalId).map(({ id, deliveryId: deliveryId2, goalId }) => ({ ...id ? { id } : {}, deliveryId: deliveryId2, goalId }));
   const joinedCard = deliveries[0]?.joinedCard === true;
+  const joinedCall = deliveries[0]?.joinedCall === true;
   const read = async (signal2) => {
-    const res = ensureAuthed(await send22(`${BACKEND_URL}/api/deliveries/${encodeURIComponent(deliveryId)}`, { headers, signal: signal2 }));
+    const res = await ensureAuthed(await send22(`${BACKEND_URL}/api/deliveries/${encodeURIComponent(deliveryId)}`, { headers, signal: signal2 }));
     if (!res.ok) await fail("read_delivery", res);
     const one = await res.json();
     return {
       ...one,
       ...all.length > 1 ? { deliveries: all } : {},
       ...recorded.length ? { recorded, notSent: NOT_SENT } : {},
-      ...joinedCard ? { joinedCard: true } : {}
+      ...joinedCard ? { joinedCard: true } : {},
+      ...joinedCall ? { joinedCall: true } : {}
     };
   };
   const settled = (d) => d.kind === "notification" || d.state === "closed" || d.answers.length > 0 || d.entries.some((e) => e.kind === "contribution");
@@ -24004,7 +24020,7 @@ async function contact(input, opts = {}) {
   }
 }
 async function checkReplies(opts = {}) {
-  const res = ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/deliveries`, {
+  const res = await ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/deliveries`, {
     headers: { authorization: `Bearer ${authToken(opts.token) ?? ""}`, "x-paigy-model": "goal-entry-v1" }
   }));
   if (!res.ok) await fail("check_replies", res);
@@ -24170,7 +24186,7 @@ async function subscribeWake(onNudge, opts = {}) {
     }
   };
 }
-var import_undici, require2, BACKEND_URL, NETWORK_MSG, PROXY_ENV, agent, INSTANCE_ID, WORKSPACE_ID, envSession, lineage, ignoreOverride, defaultOptions, getDefaultOptions, getRefs, getRelativePath, parseCatchDef, integerDateParser, isJsonSchema7AllOfType, emojiRegex2, zodPatterns, ALPHA_NUMERIC, primitiveMappings, asAnyOf, parseOptionalDef, parsePipelineDef, parseReadonlyDef, selectParser, get$ref, addMeta, zodToJsonSchema, OPTIONS_MIN, OPTIONS_MAX, OptionSchema, OptionInputSchema, NIGHT, AskInputSchema, StartContactSchema, ContactSchema, CONTACT_SCHEMA, CONTACT_DESCRIPTION, CreateGoalSchema, CreateGoalToolSchema, CREATE_GOAL_DESCRIPTION, UpdateGoalSchema, UpdateGoalToolSchema, ClaimGoalSchema, GetGoalSchema, GET_GOAL_DESCRIPTION, UPDATE_GOAL_DESCRIPTION, CLAIM_GOAL_DESCRIPTION, CHECK_REPLIES_DESCRIPTION, CheckRepliesSchema, AGENT_TOOLS, AGENT_TOOL_NAMES, LIVE_MS, ContextSchema, ParticipantSchema, TransformSchema, VisualSchema, NotifyLevelSchema, SelectShapeSchema, ReceiptEventSchema, AttentionSchema, NotifyRequestFields, NotifyRequestSchema, NotifyStatusSchema, AgentStateSchema, TurnSchema, UserAnswerSchema, IntentSchema, RideAlongSchema, AwaitItemSchema, VoiceKeySchema, AgendaTurnSchema, CLAIM_STALE_MS, InboxItemSchema, APNS_TOKEN_RE, PushTokenSchema, MissedCallSchema, clock, QUIET, BrokerTuningSchema, UserSettingsSchema, HistoryItemSchema, ACTIVITY_LINES, ACTIVITY_LINE_MAX, AgentActivitySchema, ConnectionSummarySchema, LedgerItemSchema, AgentLedgerSchema, ReassignResultSchema, MoveRingSchema, MoveSchema, QueueQuestionSchema, QueueReplySchema, QueueItemSchema, COLD_AFTER_MS, NoteSourceSchema, NoteStatusSchema, NoteRepeatSchema, DecisionSchema, NoteSchema, TriageItemSchema, TriageAssignmentSchema, TriageStatusSchema, SubmitTriageSchema, TriageProposalSchema, AcceptTriageSchema, AcceptTriageResultSchema, DeliveryModeSchema, WAKE_EVENT, wakeChannel, RegisterDeliverySchema, OAuthStartSchema, DeliveryConfigSchema, WakeNudgeSchema, PairingStatusSchema, DeviceCodeSchema, DeviceInfoSchema, DeviceTokenSchema, SupportRequestSchema, NotificationFeedbackKindSchema, SlimOptionSchema, QuestionRowSchema, WorkStateSchema, WorkRowSchema, ComputerRowSchema, AgentRowSchema, SnapshotSchema, TOKEN_PATH, KEY_PATH, sleep, UnpairedError, ApiError, tokenOverride, authToken, AWAIT_WINDOW_MS, asked, NOT_SENT, HEARTBEAT_MS, RETRY_MS, JOIN, JOIN_TIMEOUT_MS, lines;
+var import_undici, require2, BACKEND_URL, NETWORK_MSG, PROXY_ENV, agent, INSTANCE_ID, WORKSPACE_ID, envSession, lineage, ignoreOverride, defaultOptions, getDefaultOptions, getRefs, getRelativePath, parseCatchDef, integerDateParser, isJsonSchema7AllOfType, emojiRegex2, zodPatterns, ALPHA_NUMERIC, primitiveMappings, asAnyOf, parseOptionalDef, parsePipelineDef, parseReadonlyDef, selectParser, get$ref, addMeta, zodToJsonSchema, OPTIONS_MIN, OPTIONS_MAX, OptionSchema, OptionInputSchema, NIGHT, AskInputSchema, StartContactSchema, ContactSchema, CONTACT_SCHEMA, CONTACT_DESCRIPTION, CreateGoalSchema, CreateGoalToolSchema, CREATE_GOAL_DESCRIPTION, UpdateGoalSchema, UpdateGoalToolSchema, ClaimGoalSchema, GetGoalSchema, GET_GOAL_DESCRIPTION, UPDATE_GOAL_DESCRIPTION, CLAIM_GOAL_DESCRIPTION, CHECK_REPLIES_DESCRIPTION, CheckRepliesSchema, AGENT_TOOLS, AGENT_TOOL_NAMES, LIVE_MS, WORKING_MS, ContextSchema, ParticipantSchema, TransformSchema, VisualSchema, NotifyLevelSchema, SelectShapeSchema, ReceiptEventSchema, AttentionSchema, NotifyRequestFields, NotifyRequestSchema, NotifyStatusSchema, AgentStateSchema, TurnSchema, UserAnswerSchema, IntentSchema, RideAlongSchema, AwaitItemSchema, VoiceKeySchema, AgendaTurnSchema, CLAIM_STALE_MS, InboxItemSchema, APNS_TOKEN_RE, PushTokenSchema, MissedCallSchema, clock, QUIET, BrokerTuningSchema, UserSettingsSchema, HistoryWorkSchema, HistoryEntrySchema, HistoryPageSchema, ACTIVITY_LINES, ACTIVITY_LINE_MAX, AgentActivitySchema, ConnectionSummarySchema, LedgerItemSchema, AgentLedgerSchema, ReassignResultSchema, MoveRingSchema, MoveSchema, QueueQuestionSchema, QueueReplySchema, QueueItemSchema, COLD_AFTER_MS, NoteSourceSchema, NoteStatusSchema, NoteRepeatSchema, DecisionSchema, NoteSchema, TriageItemSchema, TriageAssignmentSchema, TriageStatusSchema, SubmitTriageSchema, TriageProposalSchema, AcceptTriageSchema, AcceptTriageResultSchema, DeliveryModeSchema, WAKE_EVENT, wakeChannel, RegisterDeliverySchema, OAuthStartSchema, DeliveryConfigSchema, HostDecisionSchema, WakeNudgeSchema, PairingStatusSchema, DeviceCodeSchema, DeviceInfoSchema, DeviceTokenSchema, SupportRequestSchema, NotificationFeedbackKindSchema, SlimOptionSchema, QuestionRowSchema, WorkStateSchema, WorkRowSchema, ComputerRowSchema, AgentRowSchema, SnapshotSchema, CallRecapSchema, TOKEN_PATH, KEY_PATH, sleep, UnpairedError, RevokedError, ApiError, tokenOverride, authToken, AWAIT_WINDOW_MS, asked, NOT_SENT, HEARTBEAT_MS, RETRY_MS, JOIN, JOIN_TIMEOUT_MS, lines;
 var init_dist = __esm({
   "../../packages/sdk/dist/index.js"() {
     "use strict";
@@ -24583,18 +24599,18 @@ var init_dist = __esm({
       parentId: external_exports.string().uuid().optional().describe("The Goal this question is about \u2014 usually the one you are working on. The question goes onto that Goal and its answer comes back there. Omit it and Paigy places the question in the tree itself."),
       repo: external_exports.string().optional().describe("Optional repository context."),
       ask: external_exports.string().trim().min(1).max(1e4).describe(
-        "ONE question, and only what is needed to answer it. Several questions are several asks in the array, one each: an answer settles the one ask it was given in the shape that ask declares, so a person who answers the part of a bundled ask that interested them settles nothing and is asked again. Paigy reads every ask once and takes a bundled one apart into its own cards anyway \u2014 parts of one piece of work under one Goal, separate things as separate Goals \u2014 but the words it splits are its reading, not yours. News, progress and findings are their own contact; a call contact JOINS a call already happening, so several arrive as one call."
+        "ONE question, and only what is needed to answer it. Several questions are several asks in the array, one each: an answer settles the one ask it was given in the shape that ask declares, so a person who answers the part of a bundled ask that interested them settles nothing and is asked again. Paigy reads every ask once and takes a bundled one apart into its own cards anyway \u2014 each question a Question on the one Goal the ask lands on, never a Goal of its own \u2014 but the words it splits are its reading, not yours. News, progress and findings are their own contact; ANY contact for a person already on a call JOINS that call, whatever channel you asked for, so several arrive as one call."
       ),
-      options: external_exports.array(OptionInputSchema).min(2).max(6).optional()
+      options: external_exports.array(OptionInputSchema).min(1).max(6).optional()
     }).strict();
     StartContactSchema = external_exports.object({
       asks: external_exports.array(AskInputSchema).min(1).describe("The questions to pose, one per object. An ask with a parentId is filed on that Goal as it is; only an ask naming no Goal is placed in the tree by Paigy."),
-      waiting: external_exports.enum(["none", "hard"]).default("none"),
+      waiting: external_exports.enum(["none", "hard"]).default("none").describe("hard requests a call even when channel is notification; user permissions and ring cooldowns still apply."),
       channel: external_exports.enum(["notification", "call"]).default("notification")
     }).strict();
     ContactSchema = external_exports.union([StartContactSchema, external_exports.object({ deliveryId: external_exports.string().uuid() }).strict()]);
     CONTACT_SCHEMA = { type: "object", ...mcpInputSchema(ContactSchema) };
-    CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read \u2014 parts of one piece of work under one Goal, separate things as separate Goals. An ask with no options that is not blocking is a report: on a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so).";
+    CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read, every one on the Goal the ask lands on; separate pieces of work are separate asks. An ask with no options that is not blocking is a report, and a report is an UPDATE, never a claim on them: it reaches them and is listed apart from what waits on them, so no answer is owed and none should be awaited. On a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so). Send options (or waiting:'hard') when you actually need an answer. If the person is already on a call, your contact joins that call automatically \u2014 whatever channel you asked for, with no ring \u2014 and the Delivery it returns IS that call: reread it with contact({deliveryId}) to see everything answered on it so far, and contact again while it is live to add information or a further question to the same call.";
     CreateGoalSchema = external_exports.object({
       outcome: external_exports.string().trim().min(1).max(1e4),
       /** The work's NAME (#2115) — one to five words, how a person refers to it out loud ("the night
@@ -24632,7 +24648,11 @@ var init_dist = __esm({
         state: external_exports.enum(["active", "done", "cancelled"]).optional(),
         progress: external_exports.string().trim().min(1).max(1e4).optional(),
         reviewed: external_exports.literal(true).optional(),
-        dueAt: external_exports.string().datetime({ offset: true }).nullable().optional()
+        dueAt: external_exports.string().datetime({ offset: true }).nullable().optional(),
+        /** WITHDRAW YOUR OWN QUESTION (#2777, owner 2026-09-30). The question's id as every read shows it
+         *  (the conversation's `id`, eight characters, or the whole request Entry id), on THIS Goal, asked
+         *  by you and still open. It is cancelled, not answered: its cards close and nothing rings for it. */
+        withdraw: external_exports.array(external_exports.string().trim().regex(/^[0-9a-fA-F-]{8,36}$/)).min(1).max(10).optional()
       }).strict().refine((v) => Object.keys(v).length > 0),
       reason: external_exports.string().trim().min(1).max(2e3),
       operationId: external_exports.string().uuid().optional()
@@ -24643,10 +24663,14 @@ var init_dist = __esm({
       goalId: external_exports.string().uuid(),
       /** Every entry in full. Without it the read carries the person's words, open questions and your
        *  newest entry, and counts what it left out (`apps/api/src/goal/collapse.ts`). */
-      history: external_exports.boolean().optional()
+      history: external_exports.boolean().optional(),
+      /** WHEN A READ HAS CONFUSED YOU. Adds `diagnosis`: every reader that already answers a question
+       *  about this work, each answer attributed to the reader that gave it, and every disagreement
+       *  between two of them named. Off by default; `docs/model/goal/diagnose-design.md`. */
+      diagnose: external_exports.boolean().optional()
     }).strict();
-    GET_GOAL_DESCRIPTION = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.";
-    UPDATE_GOAL_DESCRIPTION = `Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
+    GET_GOAL_DESCRIPTION = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
+    UPDATE_GOAL_DESCRIPTION = `Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. withdraw: [questionId] takes back a question YOU asked on this Goal that is still open \u2014 because you acted on it yourself, it no longer matters, or you asked it wrongly (e.g. waiting: hard when nothing was blocked): it is cancelled, not answered, its card closes and it stops ringing; the id is the one the conversation shows. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. state: done while children are still open records your part as done: the Goal waits and closes by itself when its last open child closes. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
     CLAIM_GOAL_DESCRIPTION = "Claim the oldest runnable or review-pending Goal you own, or pass goalId to claim that Goal. Another agent's Goal that has gone quiet for 3 days (check_replies lists them as stalledOthers) is taken over when you claim it, and becomes yours to finish or cancel. Returns the Goal as get_goal reads it, and creates or renews the execution lease.";
     CHECK_REPLIES_DESCRIPTION = "What is waiting for you: your open Deliveries (a request the user started toward you, a handoff), one row each with its Goals, how many decisions are still open, and the newest words in brief; `assigned`, your Goals nobody has started yet, however they became yours (claim_goal({goalId}) starts one); and `review`, your Goals with something new on them \u2014 the user's answers and notes are Entries on the Goal, not Deliveries. A pure read with no arguments: nothing is consumed, acknowledged or claimed by reading it, so call it on startup, after a long wait, or whenever you want to know what is outstanding. To act on one, claim its Goal (claim_goal) or reread a Delivery in full with contact({deliveryId}). Once you have acted on what arrived, update_goal with reviewed: true clears the Goal from `review` and closes the Deliveries addressed to you on it.";
     CheckRepliesSchema = external_exports.object({}).strict();
@@ -24660,6 +24684,7 @@ var init_dist = __esm({
     ];
     AGENT_TOOL_NAMES = AGENT_TOOLS.map((t) => t.name);
     LIVE_MS = 3 * 6e4;
+    WORKING_MS = 30 * 6e4;
     ContextSchema = external_exports.object({
       title: external_exports.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
       description: external_exports.array(external_exports.string().min(1)).describe(
@@ -24730,7 +24755,7 @@ var init_dist = __esm({
       points: external_exports.array(external_exports.string()).nullable(),
       /** Whether the ask blocks the sender — what lets arbitration escalate it on silence. */
       blocking: external_exports.boolean(),
-      /** Reserved (MODEL.md lists it): a response deadline. No row column yet — a later Phase 2
+      /** Reserved (docs/model/model.md lists it): a response deadline. No row column yet — a later Phase 2
        *  slice wires it; optional so today's rows/callers project cleanly. */
       deadline: external_exports.string().datetime().nullable().optional()
     });
@@ -24781,7 +24806,7 @@ var init_dist = __esm({
        *  derive agent-side before sealing, so the server only ever shapes plaintext). */
       // 10k, not a sentence budget. What the human hears is bounded by the BROKER — it splits
       // the ask into topics and gives each one at most three sentences and one question
-      // (broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
+      // (docs/brain/broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
       // Owner, 2026-07-28: "our actual limitation on how long something is to the user should
       // come from the broker splitting and summarizing." The cap that remains is a size guard.
       ask: external_exports.string().min(1).max(1e4).optional().describe(
@@ -24858,7 +24883,7 @@ var init_dist = __esm({
       external_exports.object({ kind: external_exports.literal("clarify"), chunks: external_exports.array(external_exports.string()).min(1) }),
       external_exports.object({ kind: external_exports.literal("confirm"), approved: external_exports.boolean() }),
       external_exports.object({ kind: external_exports.literal("turns"), turns: external_exports.array(TurnSchema).min(1) }),
-      /** An auto-answer derived from the user's PAST decisions (broker/precedent-design.md §2):
+      /** An auto-answer derived from the user's PAST decisions (docs/brain/broker/precedent-design.md §2):
        *  delivered through the same settle/await path as a human answer, carrying the judge's
        *  derivation and the precedent ids it grew from. Always paired with a visible trail
        *  card the user can reply to — the broker never overrides the user. */
@@ -24907,7 +24932,7 @@ var init_dist = __esm({
          *  and now knows exactly which call to make. Absent when either half is missing —
          *  a sentence with a hole in it is worse than no sentence. */
         note: external_exports.string().optional(),
-        /** The call record rendered for THIS agent (`voice/record-design.md`): the words the
+        /** The call record rendered for THIS agent (`docs/brain/voice/record-design.md`): the words the
          *  shaped answer was mapped from, filtered to its own claims. There is no second list
          *  of labels beside it — the acts went 2026-09-04 and `intents` went with them (owner,
          *  2026-09-04): the agent reads the sentence and decides. */
@@ -25003,10 +25028,11 @@ var init_dist = __esm({
       agentId: external_exports.string().optional(),
       select: SelectShapeSchema.optional(),
       options: external_exports.array(OptionSchema.omit({ id: true })).optional(),
-      /** Pacing (#826, owner 2026-08-03: "how fast we move through them ... are parameters"):
-       *  seconds the floor stays open after this turn speaks. Absent = the bot's defaults
-       *  (the beat for context, the answer window for asks). Clamped bot-side. */
-      pace: external_exports.number().positive().optional(),
+      /* `pace` STOOD HERE (#826). A turn could carry seconds and the model chose them. The walk
+         paces itself now — a short beat between the sentences of a turn, the longer one at its end
+         (owner, 2026-09-30: "remove the bot deciding pace") — and it does that where the words are
+         spoken, not where the plan is written, so nothing between the brain and the walk decides
+         anything. A caller's own `beat_s` tuning is what it used to override. */
       /** Whether the walk WAITS for an answer before moving on. Absent = derived as today
        *  (a question blocks, context flows). blocking:false on a question = ask and move
        *  on, the claim stays pending; blocking:true on context = hold for a reply. */
@@ -25041,7 +25067,7 @@ var init_dist = __esm({
        *  instant the agent picks it up (#997). Absent = pre-trigger row; fall back to
        *  `createdAt`. */
       agentStateAt: external_exports.string().datetime().optional(),
-      /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (walk/design.md §11, owner
+      /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (docs/clients/app/walk/design.md §11, owner
        *  2026-09-22). One per DecisionNeed on the Call, in the Call's order, answered or open (a
        *  superseded or cancelled need is no longer a question anyone is asked). Present only on a
        *  Call's cards, and every card of that Call carries the same list: the call screen reads it
@@ -25102,7 +25128,7 @@ var init_dist = __esm({
        *  off the same open list the card came from, so it clears when the Call does. A card is the
        *  backup for a call not taken; while the call has it, the call is where it is answered. */
       onCall: external_exports.literal(true).optional(),
-      /** THE RING, ON THE ITEM (walk/design.md §12 §17, #2251): the last ring on this card was
+      /** THE RING, ON THE ITEM (docs/clients/app/walk/design.md §12 §17, #2251): the last ring on this card was
        *  declined, and what the ladder will do next — read off the cron's own row, never computed
        *  on the phone. Present only while a `declined` receipt stands on the card's last Call.
        *  The ladder is ACCOUNT-WIDE (#2259): `anchorAt` and `step` are the account's position;
@@ -25133,7 +25159,7 @@ var init_dist = __esm({
         "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
       ),
       /** Real downstream work is stuck behind this one — set by the agent, independent of
-       *  urgency (see the main README's "premier use case" + notify/states.md). Drives the
+       *  urgency (see the main README's "premier use case" + docs/delivery/notify/states.md). Drives the
        *  inbox's blocking badge and the extra confirm step before dismissing it. */
       blocking: external_exports.boolean().default(false),
       /** The user's locked-in answer; present only for replied items (GET /api/replied/:id). */
@@ -25207,9 +25233,16 @@ var init_dist = __esm({
         banner: external_exports.boolean(),
         push: external_exports.boolean()
       }),
+      /** LockedIn / Default / DateNight on screen; the stored words are unchanged on purpose —
+       *  they are an enum on a live column across every account, and the rename is a rename of
+       *  what people read (owner, 2026-09-30). */
       sessionMode: external_exports.enum(["default", "all_calls", "silent"]),
-      silentPush: external_exports.boolean(),
-      autoCallback: external_exports.boolean(),
+      /** DEAD, AND ACCEPTED ANYWAY (#2813). DateNight is inbox-only with no way back, so nothing
+       *  reads this. It stays OPTIONAL rather than deleted because a phone on the old bundle
+       *  PATCHes the whole settings object and would be refused for sending a key we stopped
+       *  wanting — the same trap `voiceMode` below already documents. #2813 drops the field and
+       *  its column once no installed build still sends it. */
+      silentPush: external_exports.boolean().optional(),
       /** Opt-in (default false) to using your content to improve Paigy and train models. */
       improveConsent: external_exports.boolean(),
       missedCall: MissedCallSchema.default("backoff_standard"),
@@ -25220,12 +25253,16 @@ var init_dist = __esm({
        *  must not silently reset this privacy choice. Absent = leave unchanged on
        *  write, 'hosted' on read (see store.ts). */
       voiceMode: external_exports.enum(["hosted", "on_device"]).optional(),
-      /** Talk — after you answer, the next step is read aloud (walk/design.md §6). ALWAYS ON until
+      /** Talk — after you answer, the next step is read aloud (docs/clients/app/walk/design.md §6). ALWAYS ON until
        *  turned off (owner, 2026-09-18, #2249): a setting, not a per-walk toggle. Optional, NOT
        *  defaulted, for the same reason `voiceMode` is: a stale client PATCHing the full settings
        *  object must not silently turn it back on. Absent = leave unchanged on write, true on
        *  read (see store.ts). */
       talk: external_exports.boolean().optional(),
+      /** CALL DIAGNOSTICS (owner, 2026-10-01): the call report carries each listen and the bot's own
+       *  load timings. SERVER-SET, no UI — on for every account that existed on 2026-10-01, off for
+       *  newer ones (migration 20261001132859). Read-only here: the settings PATCH never writes it. */
+      callDiagnostics: external_exports.boolean().optional(),
       /** Per-user ring budget (#603): calls per rolling day before further calls
        *  degrade to banner. Absent = the global default (25). A number, never a
        *  bypass — every account keeps a ceiling. No UI; set per user for testing. */
@@ -25234,9 +25271,6 @@ var init_dist = __esm({
        *  slower speaker). No API-side semantics; the bot resolves each key with its
        *  own defaults. Set per user (no UI yet); absent = bot defaults. */
       voiceTuning: external_exports.record(external_exports.string(), external_exports.union([external_exports.number(), external_exports.string()])).optional(),
-      /** Opt-in to real-phone (PSTN) calls when the app can't ring. Optional, not
-       *  defaulted — an older client PATCHing the full object must not clobber it. */
-      pstnCalls: external_exports.boolean().optional(),
       /** The user's IANA timezone (e.g. "America/Bogota"), recorded by the app — it is the
        *  only party that knows it. REMINDERS are why it exists: "remind me at ten" becomes
        *  an absolute `due_at` only if we know whose ten. Optional and never defaulted, for
@@ -25250,18 +25284,20 @@ var init_dist = __esm({
        *  clobber guard as voiceMode: absent = leave unchanged on write. */
       broker: BrokerTuningSchema.optional()
     });
-    HistoryItemSchema = external_exports.object({
+    HistoryWorkSchema = external_exports.object({
       id: external_exports.string(),
-      /** 'user' = a request you sent; 'agent' = a notification an agent sent you. */
-      initiator: external_exports.enum(["user", "agent"]),
       title: external_exports.string(),
-      /** The agent on the other end (its name). */
-      name: external_exports.string(),
-      createdAt: external_exports.string(),
-      /** When the agent fetched your request (user→agent only). */
-      agentAckedAt: external_exports.string().nullable(),
-      /** When you answered the agent's notification (agent→user only). */
-      humanAckedAt: external_exports.string().nullable()
+      state: external_exports.enum(["done", "cancelled"]),
+      /** Who held it (`agent:<tokenId>` or `human:<userId>`). */
+      assignee: external_exports.string()
+    });
+    HistoryEntrySchema = external_exports.union([
+      external_exports.object({ at: external_exports.string(), card: InboxItemSchema }),
+      external_exports.object({ at: external_exports.string(), work: HistoryWorkSchema })
+    ]);
+    HistoryPageSchema = external_exports.object({
+      entries: external_exports.array(HistoryEntrySchema),
+      next: external_exports.string().nullable()
     });
     ACTIVITY_LINES = 2;
     ACTIVITY_LINE_MAX = 80;
@@ -25278,7 +25314,7 @@ var init_dist = __esm({
       /** The credential kind: "device" = a paired machine (mint-only — it hosts and mints, it
        *  never talks); "agent" = an identity that sends. The roster and devices surfaces split
        *  on this. Optional/absent reads as "agent" (a row predating the kind column). See
-       *  apps/api/src/tokens/devices-vs-agents-design.md. */
+       *  docs/server/tokens/devices-vs-agents-design.md. */
       kind: external_exports.enum(["device", "agent"]).optional(),
       /** For an agent, the token id of the DEVICE that minted it — so agents group under their
        *  machine, and revoking a device cascades to them. Null on devices, and on unlinked
@@ -25296,7 +25332,7 @@ var init_dist = __esm({
        *  user on the agent's own page. null = no ceiling (today's behaviour for every
        *  connection). Android binds importance to a relationship rather than to each message,
        *  and that is the thing our roster could not say: "Marlow may always call me; Otto
-       *  never may" (navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
+       *  never may" (docs/clients/app/party/navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
        *  every surface at once and outranks even `sessionMode: all_calls` — a mode the user
        *  set once must not overrule a rule they set about one agent. */
       reach: NotifyLevelSchema.nullable().optional(),
@@ -25307,7 +25343,14 @@ var init_dist = __esm({
       /** Last presence heartbeat from a running agent process (POST /api/presence) — the
        *  desktop app while open. Null = never seen; stale = offline. */
       lastSeenAt: external_exports.string().datetime().nullable().optional(),
-      /** What a live desktop can run (companion.md §2.2), advertised on its heartbeat:
+      /** WORKING, NOT JUST CONNECTED (owner, 2026-09-30): the last time the agent itself acted on one of
+       *  its Goals — took its lease or recorded an operation (`tokens.last_worked_at`). Within
+       *  `WORKING_MS` it is working; otherwise it is connected but idle. Null = not seen working yet. */
+      lastWorkedAt: external_exports.string().datetime().nullable().optional(),
+      /** The oldest of its Goals that is `ready` for it — work handed to it that nobody has started.
+       *  With no work of its own for `WORKING_MS`, an agent sitting on this is not taking its work. */
+      oldestReadyAt: external_exports.string().datetime().nullable().optional(),
+      /** What a live desktop can run (docs/clients/desktop/companion.md §2.2), advertised on its heartbeat:
        *  harness availabilities + granted workspaces — the option set the phone's
        *  "new session" sheet offers. Absent for ordinary MCP agents. */
       runtime: external_exports.object({
@@ -25315,7 +25358,12 @@ var init_dist = __esm({
          *  shows its age here (`apps/desktop/src/update.ts`). */
         version: external_exports.string().optional(),
         harnesses: external_exports.array(external_exports.object({ name: external_exports.string(), label: external_exports.string(), status: external_exports.string() })).optional(),
-        workspaces: external_exports.array(external_exports.string()).optional()
+        workspaces: external_exports.array(external_exports.string()).optional(),
+        /** THE GIT REPOS IN THOSE FOLDERS (2026-10-01, Goal 26982211): each granted folder that is a
+         *  repo, and each repo directly inside one, with its `origin` remote. A session started for
+         *  work on `mauurda/paigy` opens in that repo rather than the folder above it, where the repo's
+         *  own AGENTS.md is never read (`workspaceForRepo`). Absent on hosts that predate it. */
+        repos: external_exports.array(external_exports.object({ path: external_exports.string(), remote: external_exports.string() })).optional()
       }).optional(),
       /** The tail of this agent's working log, when a harness is driving it — the agent page's
        *  live strip. Absent for anything the desktop harness isn't running (a hatched identity
@@ -25398,7 +25446,7 @@ var init_dist = __esm({
        *  for a settled question whose reply carried nothing readable. */
       answer: external_exports.string().nullable().default(null),
       /** The Goal this question belongs to — a step knows its Goal on its own, not only through
-       *  an `InboxItem`'s `communication.goalIds[0]` (walk/design.md §12 item 3).
+       *  an `InboxItem`'s `communication.goalIds[0]` (docs/clients/app/walk/design.md §12 item 3).
        *  READ BY `apps/client/src/walk/order.ts`, which stamps it onto every `WalkStep`: the walk's
        *  order, its route, home's trees and the list of steps all take a step's Goal from here, so
        *  this is the field they agree through rather than each re-deriving it from the row it
@@ -25445,6 +25493,9 @@ var init_dist = __esm({
       progressLine: external_exports.string().nullable().optional(),
       reviewPending: external_exports.boolean().default(false),
       dueAt: external_exports.string().nullable().default(null),
+      /** WHEN ITS OWNER SAID DONE WHILE CHILDREN WERE OPEN (#2704): its own work is finished and it closes
+       *  with its last open child. Null otherwise; optional, so hand-built queues need not spell it. */
+      finishedAt: external_exports.string().nullable().optional(),
       /** The Goal this one was opened under; null at the root. */
       parentGoalId: external_exports.string().nullable().default(null),
       /** Goals opened under this one — only those the same list holds. */
@@ -25453,8 +25504,17 @@ var init_dist = __esm({
       dependencyGoalIds: external_exports.array(external_exports.string()).default([]),
       /** True while any gate is on a Goal that is not done — the walk draws it dashed. */
       blocked: external_exports.boolean().default(false),
-      /** Every decision need on it, open or settled — the page decides which to show. */
+      /** Its questions: every OPEN one, and at most ten settled, newest settled first
+       *  (20260929133308) — the page decides which of them to show. NOT the whole set: `asked` and
+       *  `answered` are, and a settled one's words are a line (280 characters), its body read when the
+       *  question is opened. */
       questions: external_exports.array(QueueQuestionSchema).default([]),
+      /** HOW MANY QUESTIONS THIS WORK HAS ASKED, and how many are answered — the Goal's own totals,
+       *  bounded at 100 server-side. A tally counted off `questions` is a wrong number that looks
+       *  right once the cap bites (`walk/trees.ts` `tallyOf`). Optional, and defaulted from the array
+       *  by the projection, so hand-built queues (fixtures, the demo) need not spell them. */
+      asked: external_exports.number().optional(),
+      answered: external_exports.number().optional(),
       /** Every note on it the person replied to (`QueueReplySchema`) — the page decides which to show.
        *  Optional, not defaulted: absent is none, and every hand-built queue (fixtures, the demo) need
        *  not spell an empty list. */
@@ -25478,7 +25538,19 @@ var init_dist = __esm({
         said: external_exports.string(),
         at: external_exports.string(),
         entryId: external_exports.string()
-      }).nullable().optional()
+      }).nullable().optional(),
+      /** WHEN THIS PERSON LAST PUT A HAND ON IT THEMSELVES (owner, Paigy Goal 16d18f51, 2026-09-30):
+       *  the newest Entry on the Goal they wrote, of any kind — a line they added, a reply to a note, an
+       *  answer to a question, a voice note filed as work. Null when the only hands on it have been its
+       *  agent's; optional, so a hand-built queue (fixtures, the demo) and a door older than
+       *  20260930222356 need not spell it — `work/list.ts`'s `yoursAt` keeps its other sources, so the
+       *  Work tab orders as it did before the migration rather than throwing on the missing key.
+       *
+       *  It is a FACT, not a reconstruction: `latest` holds one Entry, so an agent's progress note a
+       *  minute after the person speaks erases their instant from it, and the durable traces the client
+       *  can see (`replies`, `questions[].answeredAt`) miss a spontaneous note entirely — a `request`
+       *  Entry with no `about_id` is in neither. */
+      lastPersonAt: external_exports.string().nullable().optional()
     });
     COLD_AFTER_MS = 3 * 24 * 60 * 60 * 1e3;
     NoteSourceSchema = external_exports.enum(["app", "call"]);
@@ -25508,7 +25580,7 @@ var init_dist = __esm({
       assignee: external_exports.string().nullable(),
       /** The request thread minted at assignment; null until assigned. */
       parentId: external_exports.string().nullable(),
-      /** REMINDERS (reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
+      /** REMINDERS (docs/model/notes/reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
        *  call — never a deadline. It only ever comes from the user's own words, so when it
        *  passes Paigy rings ONCE (#1293, owner 2026-08-26: a time said out loud is consent to
        *  a ring at that time); after that it rides like any other. Null = "the very next
@@ -25591,6 +25663,19 @@ var init_dist = __esm({
        *  carries credentials; only a `poll` registration can come back with null here. */
       realtime: external_exports.object({ url: external_exports.string(), anonKey: external_exports.string() }).nullable()
     });
+    HostDecisionSchema = external_exports.object({
+      /** The agent's token id: the row's `recipient`. */
+      agent: external_exports.string().uuid(),
+      decision: external_exports.enum(["stood_back", "took_over"]),
+      /** The work it was about: the Goal `claim_goal` would hand that agent next. */
+      goalId: external_exports.string().uuid().nullable().optional(),
+      /** When the server last heard from the agent, as the host read it: the presence it stood back for. */
+      seenAt: external_exports.string().datetime().nullable().optional(),
+      /** When that work last moved (`claimable.since` on `check_replies`), the fact the bound is judged on. */
+      since: external_exports.string().datetime().nullable().optional(),
+      /** What the host said, in its log's own words: why it stood back, or what the take-over did. */
+      said: external_exports.string().max(300).optional()
+    });
     WakeNudgeSchema = external_exports.object({
       kind: external_exports.enum(["reply", "request", "callback"]),
       notificationId: external_exports.string().optional(),
@@ -25635,6 +25720,9 @@ var init_dist = __esm({
        *  landed in the FIRST granted workspace and the agent rediscovered its own repo from
        *  the thread each time (host.ts, live catch 2026-08-06 — prompt-papered until now). */
       workspace: external_exports.string().nullable().optional(),
+      /** Local host recovery must preserve the launch's runtime and Paigy identity. */
+      harness: external_exports.enum(["claude", "codex", "agy"]).optional(),
+      session_id: external_exports.string().uuid().optional(),
       uik_pub: external_exports.string().nullable().optional()
     });
     SupportRequestSchema = external_exports.object({
@@ -25754,6 +25842,29 @@ var init_dist = __esm({
         computers: external_exports.array(ComputerRowSchema).nullable()
       }).nullable()
     });
+    CallRecapSchema = external_exports.object({
+      call: external_exports.object({
+        status: external_exports.string(),
+        startedAt: external_exports.string(),
+        durationMs: external_exports.number().nullable(),
+        agents: external_exports.array(external_exports.object({ id: external_exports.string(), name: external_exports.string().nullable() }))
+      }),
+      topics: external_exports.array(external_exports.object({
+        goalId: external_exports.string().uuid(),
+        title: external_exports.string(),
+        owner: external_exports.string(),
+        state: external_exports.string(),
+        questions: external_exports.array(external_exports.object({ id: external_exports.string().uuid(), state: external_exports.string(), title: external_exports.string() })),
+        /** `words` is always what they SAID, verbatim — the record, never replaced. `headline` is
+         *  their answer on one line when the call's read wrote one (owner, 2026-10-01: "render them
+         *  summarized like a pre-made option is"), so the row scans like a chosen option and their
+         *  own words stay under it. Absent on every line stored before the read wrote them, and on
+         *  anything that is not an answer. */
+        lines: external_exports.array(external_exports.object({ entryId: external_exports.string().uuid(), words: external_exports.string(), headline: external_exports.string().optional() }))
+      })),
+      unfiled: external_exports.array(external_exports.object({ lineId: external_exports.string().uuid(), words: external_exports.string(), atMs: external_exports.number() })),
+      more: external_exports.object({ lines: external_exports.number(), entries: external_exports.number(), topics: external_exports.number() })
+    });
     TOKEN_PATH = join22(homedir22(), ".paigy", "token.json");
     KEY_PATH = join22(homedir22(), ".paigy", "key.json");
     sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -25763,6 +25874,13 @@ var init_dist = __esm({
         this.name = "UnpairedError";
       }
     };
+    RevokedError = class extends UnpairedError {
+      constructor() {
+        super();
+        this.message = "This identity was revoked (the API answered 401 revoked): its credential is gone for good. Pairing again makes a new identity.";
+        this.name = "RevokedError";
+      }
+    };
     ApiError = class extends Error {
       status;
       body;
@@ -30358,132 +30476,6 @@ var require_lib = __commonJS({
   }
 });
 
-// src/triage/judge.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { homedir as homedir9 } from "os";
-import { delimiter as delimiter3 } from "path";
-function pickOllamaModel(tags) {
-  if (tags.length === 0) return null;
-  const score = (tag) => {
-    const i = PREFERRED.findIndex((p) => tag.toLowerCase().startsWith(p));
-    return i === -1 ? PREFERRED.length : i;
-  };
-  return [...tags].sort((a, b) => score(a) - score(b) || a.length - b.length)[0] ?? null;
-}
-function parseOllamaTags(body) {
-  const models = body?.models;
-  if (!Array.isArray(models)) return [];
-  return models.map((m) => m?.name ?? m?.model).filter((n) => typeof n === "string" && n.length > 0);
-}
-async function fetchTags(host) {
-  try {
-    const res = await fetch(`${host}/api/tags`, { signal: AbortSignal.timeout(2e3) });
-    if (!res.ok) return null;
-    return parseOllamaTags(await res.json());
-  } catch {
-    return null;
-  }
-}
-async function available(deps = {}) {
-  const tags = await (deps.tags ?? fetchTags)(OLLAMA_HOST);
-  const model = tags ? pickOllamaModel(tags) : null;
-  const ollama = tags === null ? { provider: "ollama", ready: false, model: null, hint: `no ollama at ${OLLAMA_HOST} \u2014 install it: https://ollama.com/download` } : model === null ? { provider: "ollama", ready: false, model: null, hint: "ollama is running but has no models \u2014 pull one: ollama pull llama3.2:3b" } : { provider: "ollama", ready: true, model };
-  const detected = (deps.detect ?? detectAll)();
-  const harnesses = CATALOG.map((entry) => {
-    const state = detected.find((d) => d.name === entry.name);
-    const usable = state?.status === "ready" || state?.status === "adapter-missing";
-    return usable ? { provider: entry.name, ready: true, model: null } : { provider: entry.name, ready: false, model: null, hint: state?.hint ?? `${entry.label} is not installed.` };
-  });
-  return [ollama, ...harnesses];
-}
-function refusal(options, asked2) {
-  const lines2 = [
-    asked2 ? `Can't judge with --via ${asked2}: ${options.find((o) => o.provider === asked2)?.hint ?? "it isn't available on this machine"}` : "No local judge available \u2014 triage refuses rather than sending your queue to a cloud model.",
-    "",
-    "Triage runs the model where your queue already lives (#1106). Your options:"
-  ];
-  for (const o of options) {
-    lines2.push(`  ${o.ready ? "\u2713" : "\u2717"} ${o.provider.padEnd(7)} ${PRIVACY[o.provider]}`);
-    if (!o.ready && o.hint) lines2.push(`      ${o.hint}`);
-  }
-  lines2.push("", "Then re-run:  paigy-harness triage [--via ollama|claude|codex|agy]");
-  return lines2.join("\n");
-}
-async function judgeFor(asked2, deps = {}) {
-  const options = await available(deps);
-  const chosen = asked2 ? options.find((o) => o.provider === asked2) : options.find((o) => o.ready);
-  if (!chosen?.ready) return { error: refusal(options, asked2) };
-  if (chosen.provider === "ollama") {
-    const model = chosen.model;
-    return {
-      provider: "ollama",
-      model,
-      run: async (prompt) => {
-        const res = await fetch(`${OLLAMA_HOST}/api/generate`, {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          // Non-streaming: we want the whole answer once, and the parser is the same
-          // either way. `temperature: 0` because this is a classification, not prose.
-          body: JSON.stringify({ model, prompt, stream: false, options: { temperature: 0 } }),
-          signal: AbortSignal.timeout(RUN_TIMEOUT_MS)
-        });
-        if (!res.ok) throw new Error(`ollama ${res.status}: ${await res.text()}`);
-        return (await res.json()).response ?? "";
-      }
-    };
-  }
-  const runner = RUNNERS[chosen.provider];
-  if (!runner) return { error: refusal(options, asked2) };
-  const bin = which(runner.cli);
-  if (!bin) return { error: refusal(options, asked2) };
-  return {
-    provider: chosen.provider,
-    model: null,
-    run: async (prompt) => {
-      const out = spawnSync2(bin, runner.argv(null), {
-        input: prompt,
-        encoding: "utf8",
-        cwd: homedir9(),
-        timeout: RUN_TIMEOUT_MS,
-        maxBuffer: 32 * 1024 * 1024,
-        env: { ...process.env, PATH: [process.env["PATH"], ...probeDirs()].filter(Boolean).join(delimiter3) }
-      });
-      if (out.error) throw new Error(`${runner.cli} failed to run: ${out.error.message}`);
-      if (out.status !== 0 && !out.stdout?.trim())
-        throw new Error(`${runner.cli} exited ${out.status ?? "?"}: ${(out.stderr ?? "").trim().slice(0, 500)}`);
-      return out.stdout ?? "";
-    }
-  };
-}
-var PRIVACY, OLLAMA_HOST, PREFERRED, RUNNERS, RUN_TIMEOUT_MS;
-var init_judge = __esm({
-  "src/triage/judge.ts"() {
-    "use strict";
-    init_catalog();
-    PRIVACY = {
-      ollama: "never leaves this machine",
-      claude: "this machine + your own Claude subscription; Paigy's servers never see it",
-      codex: "this machine + your own Codex subscription; Paigy's servers never see it",
-      agy: "this machine + your own Antigravity account; Paigy's servers never see it"
-    };
-    OLLAMA_HOST = process.env["OLLAMA_HOST"] ?? "http://localhost:11434";
-    PREFERRED = ["llama3.2", "qwen2.5", "phi", "gemma", "mistral", "llama3.1", "llama3"];
-    RUNNERS = {
-      // Ollama speaks HTTP, not a CLI — handled separately in `judgeFor`.
-      ollama: null,
-      // `claude -p` is print mode: one prompt, one answer, no session. Verified 2026-08-28.
-      claude: { cli: "claude", argv: () => ["-p"] },
-      // `codex exec` is Codex's documented non-interactive run; it reads the prompt from stdin
-      // when none is given as an argument. It prints its own preamble around the answer, which
-      // is exactly why the parser hunts for the JSON rather than trusting the whole of stdout.
-      codex: { cli: "codex", argv: () => ["exec", "--skip-git-repo-check", "-"] },
-      // `agy --print` (alias -p) is Antigravity's print mode, text output by default.
-      agy: { cli: "agy", argv: () => ["-p"] }
-    };
-    RUN_TIMEOUT_MS = 5 * 6e4;
-  }
-});
-
 // src/triage/evidence.ts
 function assigneeToken(note2) {
   const ref = note2.assignee ?? "";
@@ -30659,6 +30651,132 @@ var init_evidence = __esm({
   }
 });
 
+// src/triage/judge.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { homedir as homedir5 } from "os";
+import { delimiter as delimiter3 } from "path";
+function pickOllamaModel(tags) {
+  if (tags.length === 0) return null;
+  const score = (tag) => {
+    const i = PREFERRED.findIndex((p) => tag.toLowerCase().startsWith(p));
+    return i === -1 ? PREFERRED.length : i;
+  };
+  return [...tags].sort((a, b) => score(a) - score(b) || a.length - b.length)[0] ?? null;
+}
+function parseOllamaTags(body) {
+  const models = body?.models;
+  if (!Array.isArray(models)) return [];
+  return models.map((m) => m?.name ?? m?.model).filter((n) => typeof n === "string" && n.length > 0);
+}
+async function fetchTags(host) {
+  try {
+    const res = await fetch(`${host}/api/tags`, { signal: AbortSignal.timeout(2e3) });
+    if (!res.ok) return null;
+    return parseOllamaTags(await res.json());
+  } catch {
+    return null;
+  }
+}
+async function available(deps = {}) {
+  const tags = await (deps.tags ?? fetchTags)(OLLAMA_HOST);
+  const model = tags ? pickOllamaModel(tags) : null;
+  const ollama = tags === null ? { provider: "ollama", ready: false, model: null, hint: `no ollama at ${OLLAMA_HOST} \u2014 install it: https://ollama.com/download` } : model === null ? { provider: "ollama", ready: false, model: null, hint: "ollama is running but has no models \u2014 pull one: ollama pull llama3.2:3b" } : { provider: "ollama", ready: true, model };
+  const detected = (deps.detect ?? detectAll)();
+  const harnesses = CATALOG.map((entry) => {
+    const state = detected.find((d) => d.name === entry.name);
+    const usable = state?.status === "ready" || state?.status === "adapter-missing";
+    return usable ? { provider: entry.name, ready: true, model: null } : { provider: entry.name, ready: false, model: null, hint: state?.hint ?? `${entry.label} is not installed.` };
+  });
+  return [ollama, ...harnesses];
+}
+function refusal(options, asked2) {
+  const lines2 = [
+    asked2 ? `Can't judge with --via ${asked2}: ${options.find((o) => o.provider === asked2)?.hint ?? "it isn't available on this machine"}` : "No local judge available \u2014 triage refuses rather than sending your queue to a cloud model.",
+    "",
+    "Triage runs the model where your queue already lives (#1106). Your options:"
+  ];
+  for (const o of options) {
+    lines2.push(`  ${o.ready ? "\u2713" : "\u2717"} ${o.provider.padEnd(7)} ${PRIVACY[o.provider]}`);
+    if (!o.ready && o.hint) lines2.push(`      ${o.hint}`);
+  }
+  lines2.push("", "Then re-run:  paigy-harness triage [--via ollama|claude|codex|agy]");
+  return lines2.join("\n");
+}
+async function judgeFor(asked2, deps = {}) {
+  const options = await available(deps);
+  const chosen = asked2 ? options.find((o) => o.provider === asked2) : options.find((o) => o.ready);
+  if (!chosen?.ready) return { error: refusal(options, asked2) };
+  if (chosen.provider === "ollama") {
+    const model = chosen.model;
+    return {
+      provider: "ollama",
+      model,
+      run: async (prompt) => {
+        const res = await fetch(`${OLLAMA_HOST}/api/generate`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          // Non-streaming: we want the whole answer once, and the parser is the same
+          // either way. `temperature: 0` because this is a classification, not prose.
+          body: JSON.stringify({ model, prompt, stream: false, options: { temperature: 0 } }),
+          signal: AbortSignal.timeout(RUN_TIMEOUT_MS)
+        });
+        if (!res.ok) throw new Error(`ollama ${res.status}: ${await res.text()}`);
+        return (await res.json()).response ?? "";
+      }
+    };
+  }
+  const runner = RUNNERS[chosen.provider];
+  if (!runner) return { error: refusal(options, asked2) };
+  const bin = which(runner.cli);
+  if (!bin) return { error: refusal(options, asked2) };
+  return {
+    provider: chosen.provider,
+    model: null,
+    run: async (prompt) => {
+      const out = spawnSync2(bin, runner.argv(null), {
+        input: prompt,
+        encoding: "utf8",
+        cwd: homedir5(),
+        timeout: RUN_TIMEOUT_MS,
+        maxBuffer: 32 * 1024 * 1024,
+        env: { ...process.env, PATH: [process.env["PATH"], ...probeDirs()].filter(Boolean).join(delimiter3) }
+      });
+      if (out.error) throw new Error(`${runner.cli} failed to run: ${out.error.message}`);
+      if (out.status !== 0 && !out.stdout?.trim())
+        throw new Error(`${runner.cli} exited ${out.status ?? "?"}: ${(out.stderr ?? "").trim().slice(0, 500)}`);
+      return out.stdout ?? "";
+    }
+  };
+}
+var PRIVACY, OLLAMA_HOST, PREFERRED, RUNNERS, RUN_TIMEOUT_MS;
+var init_judge = __esm({
+  "src/triage/judge.ts"() {
+    "use strict";
+    init_catalog();
+    PRIVACY = {
+      ollama: "never leaves this machine",
+      claude: "this machine + your own Claude subscription; Paigy's servers never see it",
+      codex: "this machine + your own Codex subscription; Paigy's servers never see it",
+      agy: "this machine + your own Antigravity account; Paigy's servers never see it"
+    };
+    OLLAMA_HOST = process.env["OLLAMA_HOST"] ?? "http://localhost:11434";
+    PREFERRED = ["llama3.2", "qwen2.5", "phi", "gemma", "mistral", "llama3.1", "llama3"];
+    RUNNERS = {
+      // Ollama speaks HTTP, not a CLI — handled separately in `judgeFor`.
+      ollama: null,
+      // `claude -p` is print mode: one prompt, one answer, no session. Verified 2026-08-28.
+      claude: { cli: "claude", argv: () => ["-p"] },
+      // `codex exec` is Codex's documented non-interactive run; it reads the prompt from stdin
+      // when none is given as an argument. It prints its own preamble around the answer, which
+      // is exactly why the parser hunts for the JSON rather than trusting the whole of stdout.
+      codex: { cli: "codex", argv: () => ["exec", "--skip-git-repo-check", "-"] },
+      // `agy --print` (alias -p) is Antigravity's print mode, text output by default.
+      agy: { cli: "agy", argv: () => ["-p"] }
+    };
+    RUN_TIMEOUT_MS = 5 * 6e4;
+  }
+});
+
 // src/triage/verdict.ts
 function extractJson(raw) {
   const fenced = raw.match(/```(?:json)?\s*([\s\S]*?)```/i)?.[1];
@@ -32861,18 +32979,18 @@ var AskInputSchema2 = external_exports.object({
   parentId: external_exports.string().uuid().optional().describe("The Goal this question is about \u2014 usually the one you are working on. The question goes onto that Goal and its answer comes back there. Omit it and Paigy places the question in the tree itself."),
   repo: external_exports.string().optional().describe("Optional repository context."),
   ask: external_exports.string().trim().min(1).max(1e4).describe(
-    "ONE question, and only what is needed to answer it. Several questions are several asks in the array, one each: an answer settles the one ask it was given in the shape that ask declares, so a person who answers the part of a bundled ask that interested them settles nothing and is asked again. Paigy reads every ask once and takes a bundled one apart into its own cards anyway \u2014 parts of one piece of work under one Goal, separate things as separate Goals \u2014 but the words it splits are its reading, not yours. News, progress and findings are their own contact; a call contact JOINS a call already happening, so several arrive as one call."
+    "ONE question, and only what is needed to answer it. Several questions are several asks in the array, one each: an answer settles the one ask it was given in the shape that ask declares, so a person who answers the part of a bundled ask that interested them settles nothing and is asked again. Paigy reads every ask once and takes a bundled one apart into its own cards anyway \u2014 each question a Question on the one Goal the ask lands on, never a Goal of its own \u2014 but the words it splits are its reading, not yours. News, progress and findings are their own contact; ANY contact for a person already on a call JOINS that call, whatever channel you asked for, so several arrive as one call."
   ),
-  options: external_exports.array(OptionInputSchema2).min(2).max(6).optional()
+  options: external_exports.array(OptionInputSchema2).min(1).max(6).optional()
 }).strict();
 var StartContactSchema2 = external_exports.object({
   asks: external_exports.array(AskInputSchema2).min(1).describe("The questions to pose, one per object. An ask with a parentId is filed on that Goal as it is; only an ask naming no Goal is placed in the tree by Paigy."),
-  waiting: external_exports.enum(["none", "hard"]).default("none"),
+  waiting: external_exports.enum(["none", "hard"]).default("none").describe("hard requests a call even when channel is notification; user permissions and ring cooldowns still apply."),
   channel: external_exports.enum(["notification", "call"]).default("notification")
 }).strict();
 var ContactSchema2 = external_exports.union([StartContactSchema2, external_exports.object({ deliveryId: external_exports.string().uuid() }).strict()]);
 var CONTACT_SCHEMA2 = { type: "object", ...mcpInputSchema2(ContactSchema2) };
-var CONTACT_DESCRIPTION2 = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read \u2014 parts of one piece of work under one Goal, separate things as separate Goals. An ask with no options that is not blocking is a report: on a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so).";
+var CONTACT_DESCRIPTION2 = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read, every one on the Goal the ask lands on; separate pieces of work are separate asks. An ask with no options that is not blocking is a report, and a report is an UPDATE, never a claim on them: it reaches them and is listed apart from what waits on them, so no answer is owed and none should be awaited. On a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so). Send options (or waiting:'hard') when you actually need an answer. If the person is already on a call, your contact joins that call automatically \u2014 whatever channel you asked for, with no ring \u2014 and the Delivery it returns IS that call: reread it with contact({deliveryId}) to see everything answered on it so far, and contact again while it is live to add information or a further question to the same call.";
 var CreateGoalSchema2 = external_exports.object({
   outcome: external_exports.string().trim().min(1).max(1e4),
   /** The work's NAME (#2115) — one to five words, how a person refers to it out loud ("the night
@@ -32910,7 +33028,11 @@ var UpdateGoalSchema2 = external_exports.object({
     state: external_exports.enum(["active", "done", "cancelled"]).optional(),
     progress: external_exports.string().trim().min(1).max(1e4).optional(),
     reviewed: external_exports.literal(true).optional(),
-    dueAt: external_exports.string().datetime({ offset: true }).nullable().optional()
+    dueAt: external_exports.string().datetime({ offset: true }).nullable().optional(),
+    /** WITHDRAW YOUR OWN QUESTION (#2777, owner 2026-09-30). The question's id as every read shows it
+     *  (the conversation's `id`, eight characters, or the whole request Entry id), on THIS Goal, asked
+     *  by you and still open. It is cancelled, not answered: its cards close and nothing rings for it. */
+    withdraw: external_exports.array(external_exports.string().trim().regex(/^[0-9a-fA-F-]{8,36}$/)).min(1).max(10).optional()
   }).strict().refine((v) => Object.keys(v).length > 0),
   reason: external_exports.string().trim().min(1).max(2e3),
   operationId: external_exports.string().uuid().optional()
@@ -32921,10 +33043,14 @@ var GetGoalSchema2 = external_exports.object({
   goalId: external_exports.string().uuid(),
   /** Every entry in full. Without it the read carries the person's words, open questions and your
    *  newest entry, and counts what it left out (`apps/api/src/goal/collapse.ts`). */
-  history: external_exports.boolean().optional()
+  history: external_exports.boolean().optional(),
+  /** WHEN A READ HAS CONFUSED YOU. Adds `diagnosis`: every reader that already answers a question
+   *  about this work, each answer attributed to the reader that gave it, and every disagreement
+   *  between two of them named. Off by default; `docs/model/goal/diagnose-design.md`. */
+  diagnose: external_exports.boolean().optional()
 }).strict();
-var GET_GOAL_DESCRIPTION2 = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.";
-var UPDATE_GOAL_DESCRIPTION2 = `Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
+var GET_GOAL_DESCRIPTION2 = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
+var UPDATE_GOAL_DESCRIPTION2 = `Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. withdraw: [questionId] takes back a question YOU asked on this Goal that is still open \u2014 because you acted on it yourself, it no longer matters, or you asked it wrongly (e.g. waiting: hard when nothing was blocked): it is cancelled, not answered, its card closes and it stops ringing; the id is the one the conversation shows. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. state: done while children are still open records your part as done: the Goal waits and closes by itself when its last open child closes. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
 var CLAIM_GOAL_DESCRIPTION2 = "Claim the oldest runnable or review-pending Goal you own, or pass goalId to claim that Goal. Another agent's Goal that has gone quiet for 3 days (check_replies lists them as stalledOthers) is taken over when you claim it, and becomes yours to finish or cancel. Returns the Goal as get_goal reads it, and creates or renews the execution lease.";
 var CHECK_REPLIES_DESCRIPTION2 = "What is waiting for you: your open Deliveries (a request the user started toward you, a handoff), one row each with its Goals, how many decisions are still open, and the newest words in brief; `assigned`, your Goals nobody has started yet, however they became yours (claim_goal({goalId}) starts one); and `review`, your Goals with something new on them \u2014 the user's answers and notes are Entries on the Goal, not Deliveries. A pure read with no arguments: nothing is consumed, acknowledged or claimed by reading it, so call it on startup, after a long wait, or whenever you want to know what is outstanding. To act on one, claim its Goal (claim_goal) or reread a Delivery in full with contact({deliveryId}). Once you have acted on what arrived, update_goal with reviewed: true clears the Goal from `review` and closes the Deliveries addressed to you on it.";
 var CheckRepliesSchema2 = external_exports.object({}).strict();
@@ -32937,7 +33063,6 @@ var AGENT_TOOLS2 = [
   { name: "update_goal", description: UPDATE_GOAL_DESCRIPTION2, inputSchema: mcpInputSchema2(UpdateGoalToolSchema2) }
 ];
 var AGENT_TOOL_NAMES2 = AGENT_TOOLS2.map((t) => t.name);
-var DONE_MESSAGE = "When the work is done, send one message through contact saying what is done and anything the person needs to do or check.";
 function entryWords(entry) {
   const content = entry.content;
   if (content && "sealed" in content) return "";
@@ -32954,6 +33079,7 @@ function entryWords(entry) {
   return entry.sources.map((source) => source.text).join("\n");
 }
 var LIVE_MS2 = 3 * 6e4;
+var WORKING_MS2 = 30 * 6e4;
 var ContextSchema2 = external_exports.object({
   title: external_exports.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
   description: external_exports.array(external_exports.string().min(1)).describe(
@@ -33024,7 +33150,7 @@ var AttentionSchema2 = external_exports.object({
   points: external_exports.array(external_exports.string()).nullable(),
   /** Whether the ask blocks the sender — what lets arbitration escalate it on silence. */
   blocking: external_exports.boolean(),
-  /** Reserved (MODEL.md lists it): a response deadline. No row column yet — a later Phase 2
+  /** Reserved (docs/model/model.md lists it): a response deadline. No row column yet — a later Phase 2
    *  slice wires it; optional so today's rows/callers project cleanly. */
   deadline: external_exports.string().datetime().nullable().optional()
 });
@@ -33075,7 +33201,7 @@ var NotifyRequestFields2 = external_exports.object({
    *  derive agent-side before sealing, so the server only ever shapes plaintext). */
   // 10k, not a sentence budget. What the human hears is bounded by the BROKER — it splits
   // the ask into topics and gives each one at most three sentences and one question
-  // (broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
+  // (docs/brain/broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
   // Owner, 2026-07-28: "our actual limitation on how long something is to the user should
   // come from the broker splitting and summarizing." The cap that remains is a size guard.
   ask: external_exports.string().min(1).max(1e4).optional().describe(
@@ -33152,7 +33278,7 @@ var UserAnswerSchema2 = external_exports.discriminatedUnion("kind", [
   external_exports.object({ kind: external_exports.literal("clarify"), chunks: external_exports.array(external_exports.string()).min(1) }),
   external_exports.object({ kind: external_exports.literal("confirm"), approved: external_exports.boolean() }),
   external_exports.object({ kind: external_exports.literal("turns"), turns: external_exports.array(TurnSchema2).min(1) }),
-  /** An auto-answer derived from the user's PAST decisions (broker/precedent-design.md §2):
+  /** An auto-answer derived from the user's PAST decisions (docs/brain/broker/precedent-design.md §2):
    *  delivered through the same settle/await path as a human answer, carrying the judge's
    *  derivation and the precedent ids it grew from. Always paired with a visible trail
    *  card the user can reply to — the broker never overrides the user. */
@@ -33201,7 +33327,7 @@ var AwaitItemSchema2 = external_exports.discriminatedUnion("type", [
      *  and now knows exactly which call to make. Absent when either half is missing —
      *  a sentence with a hole in it is worse than no sentence. */
     note: external_exports.string().optional(),
-    /** The call record rendered for THIS agent (`voice/record-design.md`): the words the
+    /** The call record rendered for THIS agent (`docs/brain/voice/record-design.md`): the words the
      *  shaped answer was mapped from, filtered to its own claims. There is no second list
      *  of labels beside it — the acts went 2026-09-04 and `intents` went with them (owner,
      *  2026-09-04): the agent reads the sentence and decides. */
@@ -33297,10 +33423,11 @@ var AgendaTurnSchema2 = external_exports.object({
   agentId: external_exports.string().optional(),
   select: SelectShapeSchema2.optional(),
   options: external_exports.array(OptionSchema2.omit({ id: true })).optional(),
-  /** Pacing (#826, owner 2026-08-03: "how fast we move through them ... are parameters"):
-   *  seconds the floor stays open after this turn speaks. Absent = the bot's defaults
-   *  (the beat for context, the answer window for asks). Clamped bot-side. */
-  pace: external_exports.number().positive().optional(),
+  /* `pace` STOOD HERE (#826). A turn could carry seconds and the model chose them. The walk
+     paces itself now — a short beat between the sentences of a turn, the longer one at its end
+     (owner, 2026-09-30: "remove the bot deciding pace") — and it does that where the words are
+     spoken, not where the plan is written, so nothing between the brain and the walk decides
+     anything. A caller's own `beat_s` tuning is what it used to override. */
   /** Whether the walk WAITS for an answer before moving on. Absent = derived as today
    *  (a question blocks, context flows). blocking:false on a question = ask and move
    *  on, the claim stays pending; blocking:true on context = hold for a reply. */
@@ -33335,7 +33462,7 @@ var InboxItemSchema2 = external_exports.object({
    *  instant the agent picks it up (#997). Absent = pre-trigger row; fall back to
    *  `createdAt`. */
   agentStateAt: external_exports.string().datetime().optional(),
-  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (walk/design.md §11, owner
+  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (docs/clients/app/walk/design.md §11, owner
    *  2026-09-22). One per DecisionNeed on the Call, in the Call's order, answered or open (a
    *  superseded or cancelled need is no longer a question anyone is asked). Present only on a
    *  Call's cards, and every card of that Call carries the same list: the call screen reads it
@@ -33396,7 +33523,7 @@ var InboxItemSchema2 = external_exports.object({
    *  off the same open list the card came from, so it clears when the Call does. A card is the
    *  backup for a call not taken; while the call has it, the call is where it is answered. */
   onCall: external_exports.literal(true).optional(),
-  /** THE RING, ON THE ITEM (walk/design.md §12 §17, #2251): the last ring on this card was
+  /** THE RING, ON THE ITEM (docs/clients/app/walk/design.md §12 §17, #2251): the last ring on this card was
    *  declined, and what the ladder will do next — read off the cron's own row, never computed
    *  on the phone. Present only while a `declined` receipt stands on the card's last Call.
    *  The ladder is ACCOUNT-WIDE (#2259): `anchorAt` and `step` are the account's position;
@@ -33427,7 +33554,7 @@ var InboxItemSchema2 = external_exports.object({
     "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
   ),
   /** Real downstream work is stuck behind this one — set by the agent, independent of
-   *  urgency (see the main README's "premier use case" + notify/states.md). Drives the
+   *  urgency (see the main README's "premier use case" + docs/delivery/notify/states.md). Drives the
    *  inbox's blocking badge and the extra confirm step before dismissing it. */
   blocking: external_exports.boolean().default(false),
   /** The user's locked-in answer; present only for replied items (GET /api/replied/:id). */
@@ -33501,9 +33628,16 @@ var UserSettingsSchema2 = external_exports.object({
     banner: external_exports.boolean(),
     push: external_exports.boolean()
   }),
+  /** LockedIn / Default / DateNight on screen; the stored words are unchanged on purpose —
+   *  they are an enum on a live column across every account, and the rename is a rename of
+   *  what people read (owner, 2026-09-30). */
   sessionMode: external_exports.enum(["default", "all_calls", "silent"]),
-  silentPush: external_exports.boolean(),
-  autoCallback: external_exports.boolean(),
+  /** DEAD, AND ACCEPTED ANYWAY (#2813). DateNight is inbox-only with no way back, so nothing
+   *  reads this. It stays OPTIONAL rather than deleted because a phone on the old bundle
+   *  PATCHes the whole settings object and would be refused for sending a key we stopped
+   *  wanting — the same trap `voiceMode` below already documents. #2813 drops the field and
+   *  its column once no installed build still sends it. */
+  silentPush: external_exports.boolean().optional(),
   /** Opt-in (default false) to using your content to improve Paigy and train models. */
   improveConsent: external_exports.boolean(),
   missedCall: MissedCallSchema2.default("backoff_standard"),
@@ -33514,12 +33648,16 @@ var UserSettingsSchema2 = external_exports.object({
    *  must not silently reset this privacy choice. Absent = leave unchanged on
    *  write, 'hosted' on read (see store.ts). */
   voiceMode: external_exports.enum(["hosted", "on_device"]).optional(),
-  /** Talk — after you answer, the next step is read aloud (walk/design.md §6). ALWAYS ON until
+  /** Talk — after you answer, the next step is read aloud (docs/clients/app/walk/design.md §6). ALWAYS ON until
    *  turned off (owner, 2026-09-18, #2249): a setting, not a per-walk toggle. Optional, NOT
    *  defaulted, for the same reason `voiceMode` is: a stale client PATCHing the full settings
    *  object must not silently turn it back on. Absent = leave unchanged on write, true on
    *  read (see store.ts). */
   talk: external_exports.boolean().optional(),
+  /** CALL DIAGNOSTICS (owner, 2026-10-01): the call report carries each listen and the bot's own
+   *  load timings. SERVER-SET, no UI — on for every account that existed on 2026-10-01, off for
+   *  newer ones (migration 20261001132859). Read-only here: the settings PATCH never writes it. */
+  callDiagnostics: external_exports.boolean().optional(),
   /** Per-user ring budget (#603): calls per rolling day before further calls
    *  degrade to banner. Absent = the global default (25). A number, never a
    *  bypass — every account keeps a ceiling. No UI; set per user for testing. */
@@ -33528,9 +33666,6 @@ var UserSettingsSchema2 = external_exports.object({
    *  slower speaker). No API-side semantics; the bot resolves each key with its
    *  own defaults. Set per user (no UI yet); absent = bot defaults. */
   voiceTuning: external_exports.record(external_exports.string(), external_exports.union([external_exports.number(), external_exports.string()])).optional(),
-  /** Opt-in to real-phone (PSTN) calls when the app can't ring. Optional, not
-   *  defaulted — an older client PATCHing the full object must not clobber it. */
-  pstnCalls: external_exports.boolean().optional(),
   /** The user's IANA timezone (e.g. "America/Bogota"), recorded by the app — it is the
    *  only party that knows it. REMINDERS are why it exists: "remind me at ten" becomes
    *  an absolute `due_at` only if we know whose ten. Optional and never defaulted, for
@@ -33544,18 +33679,20 @@ var UserSettingsSchema2 = external_exports.object({
    *  clobber guard as voiceMode: absent = leave unchanged on write. */
   broker: BrokerTuningSchema2.optional()
 });
-var HistoryItemSchema2 = external_exports.object({
+var HistoryWorkSchema2 = external_exports.object({
   id: external_exports.string(),
-  /** 'user' = a request you sent; 'agent' = a notification an agent sent you. */
-  initiator: external_exports.enum(["user", "agent"]),
   title: external_exports.string(),
-  /** The agent on the other end (its name). */
-  name: external_exports.string(),
-  createdAt: external_exports.string(),
-  /** When the agent fetched your request (user→agent only). */
-  agentAckedAt: external_exports.string().nullable(),
-  /** When you answered the agent's notification (agent→user only). */
-  humanAckedAt: external_exports.string().nullable()
+  state: external_exports.enum(["done", "cancelled"]),
+  /** Who held it (`agent:<tokenId>` or `human:<userId>`). */
+  assignee: external_exports.string()
+});
+var HistoryEntrySchema2 = external_exports.union([
+  external_exports.object({ at: external_exports.string(), card: InboxItemSchema2 }),
+  external_exports.object({ at: external_exports.string(), work: HistoryWorkSchema2 })
+]);
+var HistoryPageSchema2 = external_exports.object({
+  entries: external_exports.array(HistoryEntrySchema2),
+  next: external_exports.string().nullable()
 });
 var ACTIVITY_LINES2 = 2;
 var ACTIVITY_LINE_MAX2 = 80;
@@ -33572,7 +33709,7 @@ var ConnectionSummarySchema2 = external_exports.object({
   /** The credential kind: "device" = a paired machine (mint-only — it hosts and mints, it
    *  never talks); "agent" = an identity that sends. The roster and devices surfaces split
    *  on this. Optional/absent reads as "agent" (a row predating the kind column). See
-   *  apps/api/src/tokens/devices-vs-agents-design.md. */
+   *  docs/server/tokens/devices-vs-agents-design.md. */
   kind: external_exports.enum(["device", "agent"]).optional(),
   /** For an agent, the token id of the DEVICE that minted it — so agents group under their
    *  machine, and revoking a device cascades to them. Null on devices, and on unlinked
@@ -33590,7 +33727,7 @@ var ConnectionSummarySchema2 = external_exports.object({
    *  user on the agent's own page. null = no ceiling (today's behaviour for every
    *  connection). Android binds importance to a relationship rather than to each message,
    *  and that is the thing our roster could not say: "Marlow may always call me; Otto
-   *  never may" (navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
+   *  never may" (docs/clients/app/party/navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
    *  every surface at once and outranks even `sessionMode: all_calls` — a mode the user
    *  set once must not overrule a rule they set about one agent. */
   reach: NotifyLevelSchema2.nullable().optional(),
@@ -33601,7 +33738,14 @@ var ConnectionSummarySchema2 = external_exports.object({
   /** Last presence heartbeat from a running agent process (POST /api/presence) — the
    *  desktop app while open. Null = never seen; stale = offline. */
   lastSeenAt: external_exports.string().datetime().nullable().optional(),
-  /** What a live desktop can run (companion.md §2.2), advertised on its heartbeat:
+  /** WORKING, NOT JUST CONNECTED (owner, 2026-09-30): the last time the agent itself acted on one of
+   *  its Goals — took its lease or recorded an operation (`tokens.last_worked_at`). Within
+   *  `WORKING_MS` it is working; otherwise it is connected but idle. Null = not seen working yet. */
+  lastWorkedAt: external_exports.string().datetime().nullable().optional(),
+  /** The oldest of its Goals that is `ready` for it — work handed to it that nobody has started.
+   *  With no work of its own for `WORKING_MS`, an agent sitting on this is not taking its work. */
+  oldestReadyAt: external_exports.string().datetime().nullable().optional(),
+  /** What a live desktop can run (docs/clients/desktop/companion.md §2.2), advertised on its heartbeat:
    *  harness availabilities + granted workspaces — the option set the phone's
    *  "new session" sheet offers. Absent for ordinary MCP agents. */
   runtime: external_exports.object({
@@ -33609,7 +33753,12 @@ var ConnectionSummarySchema2 = external_exports.object({
      *  shows its age here (`apps/desktop/src/update.ts`). */
     version: external_exports.string().optional(),
     harnesses: external_exports.array(external_exports.object({ name: external_exports.string(), label: external_exports.string(), status: external_exports.string() })).optional(),
-    workspaces: external_exports.array(external_exports.string()).optional()
+    workspaces: external_exports.array(external_exports.string()).optional(),
+    /** THE GIT REPOS IN THOSE FOLDERS (2026-10-01, Goal 26982211): each granted folder that is a
+     *  repo, and each repo directly inside one, with its `origin` remote. A session started for
+     *  work on `mauurda/paigy` opens in that repo rather than the folder above it, where the repo's
+     *  own AGENTS.md is never read (`workspaceForRepo`). Absent on hosts that predate it. */
+    repos: external_exports.array(external_exports.object({ path: external_exports.string(), remote: external_exports.string() })).optional()
   }).optional(),
   /** The tail of this agent's working log, when a harness is driving it — the agent page's
    *  live strip. Absent for anything the desktop harness isn't running (a hatched identity
@@ -33692,7 +33841,7 @@ var QueueQuestionSchema2 = external_exports.object({
    *  for a settled question whose reply carried nothing readable. */
   answer: external_exports.string().nullable().default(null),
   /** The Goal this question belongs to — a step knows its Goal on its own, not only through
-   *  an `InboxItem`'s `communication.goalIds[0]` (walk/design.md §12 item 3).
+   *  an `InboxItem`'s `communication.goalIds[0]` (docs/clients/app/walk/design.md §12 item 3).
    *  READ BY `apps/client/src/walk/order.ts`, which stamps it onto every `WalkStep`: the walk's
    *  order, its route, home's trees and the list of steps all take a step's Goal from here, so
    *  this is the field they agree through rather than each re-deriving it from the row it
@@ -33739,6 +33888,9 @@ var QueueItemSchema2 = external_exports.object({
   progressLine: external_exports.string().nullable().optional(),
   reviewPending: external_exports.boolean().default(false),
   dueAt: external_exports.string().nullable().default(null),
+  /** WHEN ITS OWNER SAID DONE WHILE CHILDREN WERE OPEN (#2704): its own work is finished and it closes
+   *  with its last open child. Null otherwise; optional, so hand-built queues need not spell it. */
+  finishedAt: external_exports.string().nullable().optional(),
   /** The Goal this one was opened under; null at the root. */
   parentGoalId: external_exports.string().nullable().default(null),
   /** Goals opened under this one — only those the same list holds. */
@@ -33747,8 +33899,17 @@ var QueueItemSchema2 = external_exports.object({
   dependencyGoalIds: external_exports.array(external_exports.string()).default([]),
   /** True while any gate is on a Goal that is not done — the walk draws it dashed. */
   blocked: external_exports.boolean().default(false),
-  /** Every decision need on it, open or settled — the page decides which to show. */
+  /** Its questions: every OPEN one, and at most ten settled, newest settled first
+   *  (20260929133308) — the page decides which of them to show. NOT the whole set: `asked` and
+   *  `answered` are, and a settled one's words are a line (280 characters), its body read when the
+   *  question is opened. */
   questions: external_exports.array(QueueQuestionSchema2).default([]),
+  /** HOW MANY QUESTIONS THIS WORK HAS ASKED, and how many are answered — the Goal's own totals,
+   *  bounded at 100 server-side. A tally counted off `questions` is a wrong number that looks
+   *  right once the cap bites (`walk/trees.ts` `tallyOf`). Optional, and defaulted from the array
+   *  by the projection, so hand-built queues (fixtures, the demo) need not spell them. */
+  asked: external_exports.number().optional(),
+  answered: external_exports.number().optional(),
   /** Every note on it the person replied to (`QueueReplySchema`) — the page decides which to show.
    *  Optional, not defaulted: absent is none, and every hand-built queue (fixtures, the demo) need
    *  not spell an empty list. */
@@ -33772,7 +33933,19 @@ var QueueItemSchema2 = external_exports.object({
     said: external_exports.string(),
     at: external_exports.string(),
     entryId: external_exports.string()
-  }).nullable().optional()
+  }).nullable().optional(),
+  /** WHEN THIS PERSON LAST PUT A HAND ON IT THEMSELVES (owner, Paigy Goal 16d18f51, 2026-09-30):
+   *  the newest Entry on the Goal they wrote, of any kind — a line they added, a reply to a note, an
+   *  answer to a question, a voice note filed as work. Null when the only hands on it have been its
+   *  agent's; optional, so a hand-built queue (fixtures, the demo) and a door older than
+   *  20260930222356 need not spell it — `work/list.ts`'s `yoursAt` keeps its other sources, so the
+   *  Work tab orders as it did before the migration rather than throwing on the missing key.
+   *
+   *  It is a FACT, not a reconstruction: `latest` holds one Entry, so an agent's progress note a
+   *  minute after the person speaks erases their instant from it, and the durable traces the client
+   *  can see (`replies`, `questions[].answeredAt`) miss a spontaneous note entirely — a `request`
+   *  Entry with no `about_id` is in neither. */
+  lastPersonAt: external_exports.string().nullable().optional()
 });
 var COLD_AFTER_MS2 = 3 * 24 * 60 * 60 * 1e3;
 var NoteSourceSchema2 = external_exports.enum(["app", "call"]);
@@ -33802,7 +33975,7 @@ var NoteSchema2 = external_exports.object({
   assignee: external_exports.string().nullable(),
   /** The request thread minted at assignment; null until assigned. */
   parentId: external_exports.string().nullable(),
-  /** REMINDERS (reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
+  /** REMINDERS (docs/model/notes/reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
    *  call — never a deadline. It only ever comes from the user's own words, so when it
    *  passes Paigy rings ONCE (#1293, owner 2026-08-26: a time said out loud is consent to
    *  a ring at that time); after that it rides like any other. Null = "the very next
@@ -33883,6 +34056,19 @@ var DeliveryConfigSchema2 = external_exports.object({
    *  carries credentials; only a `poll` registration can come back with null here. */
   realtime: external_exports.object({ url: external_exports.string(), anonKey: external_exports.string() }).nullable()
 });
+var HostDecisionSchema2 = external_exports.object({
+  /** The agent's token id: the row's `recipient`. */
+  agent: external_exports.string().uuid(),
+  decision: external_exports.enum(["stood_back", "took_over"]),
+  /** The work it was about: the Goal `claim_goal` would hand that agent next. */
+  goalId: external_exports.string().uuid().nullable().optional(),
+  /** When the server last heard from the agent, as the host read it: the presence it stood back for. */
+  seenAt: external_exports.string().datetime().nullable().optional(),
+  /** When that work last moved (`claimable.since` on `check_replies`), the fact the bound is judged on. */
+  since: external_exports.string().datetime().nullable().optional(),
+  /** What the host said, in its log's own words: why it stood back, or what the take-over did. */
+  said: external_exports.string().max(300).optional()
+});
 var WakeNudgeSchema2 = external_exports.object({
   kind: external_exports.enum(["reply", "request", "callback"]),
   notificationId: external_exports.string().optional(),
@@ -33927,6 +34113,9 @@ var DeviceTokenSchema2 = external_exports.object({
    *  landed in the FIRST granted workspace and the agent rediscovered its own repo from
    *  the thread each time (host.ts, live catch 2026-08-06 — prompt-papered until now). */
   workspace: external_exports.string().nullable().optional(),
+  /** Local host recovery must preserve the launch's runtime and Paigy identity. */
+  harness: external_exports.enum(["claude", "codex", "agy"]).optional(),
+  session_id: external_exports.string().uuid().optional(),
   uik_pub: external_exports.string().nullable().optional()
 });
 var SupportRequestSchema2 = external_exports.object({
@@ -34046,6 +34235,29 @@ var SnapshotSchema2 = external_exports.object({
     computers: external_exports.array(ComputerRowSchema2).nullable()
   }).nullable()
 });
+var CallRecapSchema2 = external_exports.object({
+  call: external_exports.object({
+    status: external_exports.string(),
+    startedAt: external_exports.string(),
+    durationMs: external_exports.number().nullable(),
+    agents: external_exports.array(external_exports.object({ id: external_exports.string(), name: external_exports.string().nullable() }))
+  }),
+  topics: external_exports.array(external_exports.object({
+    goalId: external_exports.string().uuid(),
+    title: external_exports.string(),
+    owner: external_exports.string(),
+    state: external_exports.string(),
+    questions: external_exports.array(external_exports.object({ id: external_exports.string().uuid(), state: external_exports.string(), title: external_exports.string() })),
+    /** `words` is always what they SAID, verbatim — the record, never replaced. `headline` is
+     *  their answer on one line when the call's read wrote one (owner, 2026-10-01: "render them
+     *  summarized like a pre-made option is"), so the row scans like a chosen option and their
+     *  own words stay under it. Absent on every line stored before the read wrote them, and on
+     *  anything that is not an answer. */
+    lines: external_exports.array(external_exports.object({ entryId: external_exports.string().uuid(), words: external_exports.string(), headline: external_exports.string().optional() }))
+  })),
+  unfiled: external_exports.array(external_exports.object({ lineId: external_exports.string().uuid(), words: external_exports.string(), atMs: external_exports.number() })),
+  more: external_exports.object({ lines: external_exports.number(), entries: external_exports.number(), topics: external_exports.number() })
+});
 
 // src/paigy/activity.ts
 function shortenPaths(s) {
@@ -34146,6 +34358,14 @@ var CARRY_ON = "The usage limit that stopped your last turn has reset. Carry on
 var OWED = "That turn was given this when the limit stopped it, and may not have got to it. Act on it now, unless you already have:";
 var names = (list) => list.length <= 1 ? list[0] ?? "" : `${list.slice(0, -1).join(", ")} and ${list[list.length - 1]}`;
 var GATHER_MS = 9e4;
+function outcome(result, paused) {
+  const r = result ?? {};
+  const who = `${paused.length} paused agent${paused.length === 1 ? "" : "s"}: ${names(paused)}`;
+  if (r.sent === false) return `\u26A0 the limit call did not ring (${who}): it was filed as progress, nobody was notified`;
+  if (r.kind === "call" && typeof r.deliveryId === "string") return `\u260E one call for ${who}, placed (delivery ${r.deliveryId})`;
+  if (typeof r.deliveryId === "string") return `\u26A0 the limit call did not ring (${who}): it went out as a card (delivery ${r.deliveryId})`;
+  return `\u26A0 the limit call did not ring (${who}): no delivery came back`;
+}
 function episodes(opts = {}) {
   const gather2 = opts.gatherMs ?? GATHER_MS;
   const later = opts.timer ?? ((fn, ms) => void setTimeout(fn, ms).unref?.());
@@ -34177,8 +34397,10 @@ function episodes(opts = {}) {
           `Claude's usage limit paused ${names(episode.paused)} from ${clock3(episode.since)}.`,
           rest.length ? `It has reset: ${names(episode.running)} ${episode.running.length > 1 ? "are" : "is"} running again, and ${names(rest)} ${rest.length > 1 ? "haven't" : "hasn't"} started again yet.` : `It has reset, and ${episode.paused.length > 1 ? "they have all" : "it has"} carried on.`
         ].join(" ");
-        log?.(`\u260E one call for ${episode.paused.length} paused agent${episode.paused.length === 1 ? "" : "s"}: ${names(episode.paused)}`);
-        void call(text).catch((error) => log?.(`\u26A0 could not place the limit call: ${error.message}`));
+        void call(text).then(
+          (result) => log?.(outcome(result, episode.paused)),
+          (error) => log?.(`\u26A0 could not place the limit call: ${error.message}`)
+        );
       }, gather2);
     }
   };
@@ -34301,7 +34523,7 @@ ${event.result?.trim() || "No result reported."}`, state, rail, opts);
 
 // src/paigy/conversation.ts
 import { randomUUID as randomUUID5 } from "crypto";
-var HARNESS_INSTRUCTION = "You are running as an unattended background harness agent; your user reaches you through Paigy and is not at this terminal. Nothing wakes you after your turn ends but the person, so wait on CI or a deploy inside the turn. The person never sees your turn's final message: it is kept as progress on this Goal. Anything the person needs \u2014 a question, a result, a blocker \u2014 you send through Paigy's contact tool, once; the harness sends nothing on your behalf. What the person says later arrives with the Goal it was said on named in front of it; answer them on that Goal (its id as the contact's parentId). " + DONE_MESSAGE;
+var HARNESS_INSTRUCTION = "You are running as an unattended background harness agent; your user reaches you through Paigy and is not at this terminal. Nothing wakes you after your turn ends but the person, so wait on CI or a deploy inside the turn. The person never sees your turn's final message: it is kept as progress on this Goal. Anything the person needs \u2014 a question, a result, a blocker \u2014 you send through Paigy's contact tool, once; the harness sends nothing on your behalf. What the person says later arrives with the Goal it was said on named in front of it; answer them on that Goal (its id as the contact's parentId).";
 var SAFETY_MS = 6e4;
 var ASK_BEAT_MS = 5e3;
 function beat() {
@@ -34429,9 +34651,9 @@ async function gather(state, rail, held) {
 var GIVEN = "This Goal was given to you, and nobody has started it. Carry on with what you're doing unless it changes that; claim_goal with its id when you take it up.";
 var says = (h) => h.words.length > 0 || h.via === "assigned";
 function whatItIs(h) {
-  const outcome = h.brief.outcome?.trim() ?? "";
-  const name = (h.title ?? outcome).trim().split("\n")[0].trim();
-  return outcome && outcome !== name ? [outcome] : [];
+  const outcome2 = h.brief.outcome?.trim() ?? "";
+  const name = (h.title ?? outcome2).trim().split("\n")[0].trim();
+  return outcome2 && outcome2 !== name ? [outcome2] : [];
 }
 var block = (h) => [
   ...h.via === "assigned" ? [GIVEN] : [],
@@ -34558,11 +34780,11 @@ async function look(session, state, rail, opts) {
       state.goal = { id: brief2.goalId, revision: brief2.revision };
       state.below = baseline(brief2.goalId, brief2.subtree);
     }
-    const outcome = brief2.outcome?.trim() ?? "";
-    const said = (brief2.entries ?? []).map((e) => entryWords(e).trim()).filter((w) => w && w.toLowerCase() !== outcome.toLowerCase());
+    const outcome2 = brief2.outcome?.trim() ?? "";
+    const said = (brief2.entries ?? []).map((e) => entryWords(e).trim()).filter((w) => w && w.toLowerCase() !== outcome2.toLowerCase());
     const left = brief2.earlier ? brief2.earlier.omitted + brief2.earlier.shortened : 0;
     const earlier = left ? `(${left} earlier entries on this Goal are left out or shortened; get_goal with history: true reads them in full.)` : "";
-    const fullText = [outcome, earlier, ...said].filter(Boolean).join("\n\n");
+    const fullText = [outcome2, earlier, ...said].filter(Boolean).join("\n\n");
     send2(session, state, [HARNESS_INSTRUCTION, fullText].filter(Boolean).join("\n\n"));
     return;
   }
@@ -34748,17 +34970,33 @@ ${event.message}`, state, rail, { log: opts.log });
 
 // src/host.ts
 init_dist();
-init_catalog();
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir8 } from "os";
+import { homedir as homedir9 } from "os";
 import { join as join9 } from "path";
 
+// src/broker.ts
+init_evidence();
+init_triage();
+var plural2 = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+function ago(iso, now) {
+  const ms = now - Date.parse(iso);
+  if (!Number.isFinite(ms) || ms < 6e4) return "just now";
+  const minutes = Math.floor(ms / 6e4);
+  if (minutes < 60) return `${plural2(minutes, "minute")} ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${plural2(hours, "hour")} ago`;
+  return `${plural2(Math.floor(hours / 24), "day")} ago`;
+}
+
+// src/host.ts
+init_catalog();
+
 // src/workspaces.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname2, join as join5, resolve as resolve2 } from "path";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 function workspacesFile() {
-  return join5(homedir5(), ".paigy", "workspaces.json");
+  return join5(homedir6(), ".paigy", "workspaces.json");
 }
 function listWorkspaces(deps) {
   try {
@@ -34769,7 +35007,7 @@ function listWorkspaces(deps) {
   }
 }
 function addWorkspace(dir, deps) {
-  const next = resolve2(dir.replace(/^~(?=$|\/)/, homedir5()));
+  const next = resolve2(dir.replace(/^~(?=$|\/)/, homedir6()));
   const all = listWorkspaces(deps);
   if (!all.includes(next)) {
     all.push(next);
@@ -34779,22 +35017,53 @@ function addWorkspace(dir, deps) {
   return all;
 }
 function allowed(cwd, deps) {
-  const target = resolve2(cwd.replace(/^~(?=$|\/)/, homedir5()));
+  const target = resolve2(cwd.replace(/^~(?=$|\/)/, homedir6()));
   return listWorkspaces(deps).some((w) => target === w || target.startsWith(`${w}/`));
 }
 function resolveWakeDir(pinned, deps) {
   if (pinned && allowed(pinned, deps)) {
-    const dir = resolve2(pinned.replace(/^~(?=$|\/)/, homedir5()));
+    const dir = resolve2(pinned.replace(/^~(?=$|\/)/, homedir6()));
     if ((deps.exists ?? existsSync4)(dir)) return dir;
   }
   return listWorkspaces(deps)[0];
 }
+function originOf(dir) {
+  try {
+    if (!statSync3(join5(dir, ".git")).isDirectory()) return null;
+    const config = readFileSync3(join5(dir, ".git", "config"), "utf8");
+    const section = config.split(/^\[/m).find((s) => /^remote\s+"origin"\]/.test(s));
+    return section?.match(/^\s*url\s*=\s*(.+)$/m)?.[1]?.trim() ?? null;
+  } catch {
+    return null;
+  }
+}
+var MAX_CHILDREN = 300;
+var MAX_REPOS = 100;
+function listRepos(deps) {
+  const repos = [];
+  for (const root of listWorkspaces(deps)) {
+    const own = originOf(root);
+    if (own) repos.push({ path: root, remote: own });
+    let children = [];
+    try {
+      children = readdirSync2(root, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort().slice(0, MAX_CHILDREN);
+    } catch {
+    }
+    for (const name of children) {
+      if (repos.length >= MAX_REPOS) return repos;
+      const path = join5(root, name);
+      const remote = originOf(path);
+      if (remote) repos.push({ path, remote });
+    }
+  }
+  return repos.slice(0, MAX_REPOS);
+}
 
 // src/holder.ts
 init_dist();
 import { execFileSync as execFileSync3 } from "child_process";
-import { readFileSync as readFileSync4, readdirSync as readdirSync2 } from "fs";
-import { homedir as homedir6 } from "os";
+import { readFileSync as readFileSync4, readdirSync as readdirSync3 } from "fs";
+import { homedir as homedir7 } from "os";
 import { join as join6 } from "path";
 function isAlive(pid) {
   try {
@@ -34825,8 +35094,8 @@ function holds(pid, procStart, deps) {
   return false;
 }
 function localHolders(deps = {}) {
-  const dir = deps.dir ?? join6(process.env.CLAUDE_CONFIG_DIR?.trim() || join6(homedir6(), ".claude"), "sessions");
-  const list = deps.list ?? ((d) => readdirSync2(d));
+  const dir = deps.dir ?? join6(process.env.CLAUDE_CONFIG_DIR?.trim() || join6(homedir7(), ".claude"), "sessions");
+  const list = deps.list ?? ((d) => readdirSync3(d));
   const read = deps.read ?? ((f) => readFileSync4(f, "utf8"));
   const check = { alive: deps.alive ?? isAlive, started: deps.started ?? psStart };
   const held = /* @__PURE__ */ new Map();
@@ -34854,8 +35123,8 @@ function localHolders(deps = {}) {
 }
 
 // src/owner.ts
-import { closeSync as closeSync2, openSync as openSync2, readSync, readdirSync as readdirSync3 } from "fs";
-import { homedir as homedir7 } from "os";
+import { closeSync as closeSync2, openSync as openSync2, readSync, readdirSync as readdirSync4 } from "fs";
+import { homedir as homedir8 } from "os";
 import { join as join7 } from "path";
 var HEAD_BYTES = 64e3;
 function readHead(file) {
@@ -34872,8 +35141,8 @@ function ownerSession(slot, deps = {}) {
   const m = /^session:([0-9a-f]{8})$/.exec(slot);
   if (!m) return null;
   const prefix = m[1];
-  const root = deps.projectsDir ?? join7(homedir7(), ".claude", "projects");
-  const list = deps.list ?? ((dir) => readdirSync3(dir));
+  const root = deps.projectsDir ?? join7(homedir8(), ".claude", "projects");
+  const list = deps.list ?? ((dir) => readdirSync4(dir));
   const head = deps.head ?? readHead;
   let folders;
   try {
@@ -34990,34 +35259,51 @@ function selfUpdater(deps) {
 }
 
 // src/host.ts
-var HOST_FILE = join9(homedir8(), ".paigy", "host.json");
+var HOST_FILE = join9(homedir9(), ".paigy", "host.json");
+function wakeHarness(slot, saved, claudeTranscript) {
+  if (slot === "Desktop") return void 0;
+  if (saved !== null) return saved === "agy" || saved === "codex" || saved === "claude" ? saved : void 0;
+  if (claudeTranscript) return "claude";
+  if (slot === "mcp-agent" || slot === "Claude Code") return "claude";
+  if (slot === "codex") return "codex";
+  if (slot === "antigravity") return "agy";
+  return void 0;
+}
 var runKey = (slot) => `slot:${slot}`;
 var claimedRun = (sessionId2) => {
   const slot = sessionSlot(sessionId2);
   return { slot, key: runKey(slot) };
 };
 var launchRun = (spec) => ({ session: spec.sessionId });
+var NOTHING_WAITING = "has nothing waiting";
 async function waitingWork(token, session) {
   let found;
   try {
     found = await checkReplies({ token, ...session ? { reach: reachAs(session) } : {} });
   } catch (error) {
+    if (error instanceof RevokedError) return { skip: "was revoked: its credential is gone for good", revoked: true };
+    if (error instanceof ApiError && error.body?.error === "identity_session_mismatch") {
+      return { skip: "is bound to the session it was paired in, which this host cannot name \u2014 run `paigy-harness handoff` as it, in its folder, to record it" };
+    }
     return { skip: `could not read what is waiting (${error.message})` };
   }
-  const n = found.deliveries.length;
-  if (n) return { waiting: n === 1 ? "a message" : `${n} messages` };
   const next = found.claimable;
-  return next ? { waiting: `Goal ${next.goalId.slice(0, 8)}${next.title ? ` "${next.title}"` : ""}` } : { skip: "has nothing waiting" };
+  const about = next ? { goalId: next.goalId, ...next.since ? { since: next.since } : {} } : {};
+  const n = found.deliveries.length;
+  if (n) return { waiting: n === 1 ? "a message" : `${n} messages`, ...about };
+  return next ? { waiting: `Goal ${next.goalId.slice(0, 8)}${next.title ? ` "${next.title}"` : ""}`, ...about } : { skip: NOTHING_WAITING };
 }
 function evict(runs, key, run) {
   if (runs.get(key)?.run === run) runs.delete(key);
 }
 var PRESENCE_FRESH_MS = 3 * 6e4;
+var IDLE_HOLDER_MS = 30 * 6e4;
 function wakeAction(live, now, serverSeenAt, here = {}) {
   if (live) return { action: "skip", why: "run" };
   if (here.holder) return { action: "skip", why: "holder" };
   if (serverSeenAt !== void 0 && now - serverSeenAt < PRESENCE_FRESH_MS) {
     if (here.goneAt !== void 0 && serverSeenAt <= here.goneAt) return { action: "spawn", why: "gone" };
+    if (here.movedAt !== void 0 && now - here.movedAt >= IDLE_HOLDER_MS) return { action: "spawn", why: "idle" };
     return { action: "skip", why: "presence" };
   }
   return { action: "spawn", why: "nobody" };
@@ -35027,9 +35313,45 @@ function startHost(opts) {
   const asHost = { token: opts.token };
   const goneAt = /* @__PURE__ */ new Map();
   const heldHere = /* @__PURE__ */ new Set();
+  const revoked = /* @__PURE__ */ new Map();
+  const isRevoked = (slot) => {
+    const dead = revoked.get(slot);
+    if (dead === void 0) return false;
+    if (readToken(slot) === dead) return true;
+    revoked.delete(slot);
+    return false;
+  };
+  function drop(slot, token) {
+    if (revoked.get(slot) === token) return;
+    revoked.set(slot, token);
+    const sub = listening.get(slot);
+    if (sub) {
+      listening.delete(slot);
+      void sub.close().catch(() => {
+      });
+    }
+    opts.log(`\u2716 ${slotName(slot) ?? slot} was revoked \u2014 its credential is gone for good, so this host stops presenting it (dropped from the roster; pairing again makes a new identity)`);
+  }
+  const recorded = /* @__PURE__ */ new Map();
+  function decide(slot, decision, found, seenAt, said) {
+    const agent2 = slotIdentity(slot).tokenId;
+    if (!agent2) return;
+    const goalId = found?.goalId;
+    const key = `${decision}:${goalId ?? ""}`;
+    if (recorded.get(slot) === key) return;
+    recorded.set(slot, key);
+    void recordDecision({
+      agent: agent2,
+      decision,
+      goalId: goalId ?? null,
+      seenAt: seenAt === void 0 ? null : new Date(seenAt).toISOString(),
+      since: found?.since ?? null,
+      said: said.slice(0, 300)
+    }, asHost).catch((e) => opts.log(`\u25CC could not record that ${slotName(slot) ?? slot} ${decision.replace("_", " ")} (${e.message})`));
+  }
   const refreshIdentities = async () => {
     for (const slot of listSlots()) {
-      if (slot === "Desktop") continue;
+      if (slot === "Desktop" || isRevoked(slot)) continue;
       const token = readToken(slot);
       if (!token) continue;
       const me = await whoAmI({ token }).catch(() => null);
@@ -35055,7 +35377,9 @@ function startHost(opts) {
     void heartbeat({
       version: VERSION,
       harnesses: detectAll().map((a) => ({ name: a.name, label: a.label, status: a.status })),
-      workspaces: listWorkspaces(opts.wsDeps)
+      workspaces: listWorkspaces(opts.wsDeps),
+      // The repos inside them, so a session started for work on one opens IN it (Goal 26982211).
+      repos: listRepos(opts.wsDeps)
     }, asHost).catch(() => {
     });
     void listenSlots().then(sweepSlots).catch(() => {
@@ -35067,6 +35391,19 @@ function startHost(opts) {
       const label = spec.name ?? spec.harness;
       const { slot, key } = claimedRun(spec.sessionId);
       const log = (line) => opts.log(`[${label}] ${line}`);
+      try {
+        saveToken({
+          access_token: spec.token,
+          name: label,
+          device: null,
+          workspace: spec.workspace,
+          harness: spec.harness,
+          session_id: spec.sessionId
+        }, slot);
+      } catch {
+        log("Cannot persist launch identity/runtime; session was not started. Check local storage and relaunch.");
+        continue;
+      }
       const run = runHarness({
         harness: spec.harness,
         cwd: spec.workspace,
@@ -35086,14 +35423,9 @@ function startHost(opts) {
       void heartbeat(void 0, { token: spec.token }).catch(() => {
       });
       void refreshIdentities();
-      try {
-        saveToken({ access_token: spec.token, name: label, device: null, workspace: spec.workspace }, slot);
-      } catch {
-      }
       opts.log(`\u25B6 phone-launched ${label} (${spec.harness}) in ${spec.workspace}`);
     }
   }
-  const SLOT_HARNESS = { "mcp-agent": "claude", codex: "codex", antigravity: "agy" };
   async function presenceMap() {
     const presence = /* @__PURE__ */ new Map();
     try {
@@ -35114,30 +35446,64 @@ function startHost(opts) {
   let lastHolders = /* @__PURE__ */ new Map();
   async function wakeSlot(slot, { presence, holders }, cause = "sweep") {
     {
-      const harness = SLOT_HARNESS[slot] ?? (slot === "Desktop" ? void 0 : "claude");
       const key = runKey(slot);
-      if (!harness) return;
+      if (slot === "Desktop" || isRevoked(slot)) return;
       const live = runs.get(key);
       const tokenId = slotIdentity(slot).tokenId;
       const seenByServer = tokenId ? presence.get(tokenId) : void 0;
       const holder = holders.get(slot);
       if (holder) heldHere.add(slot);
       else if (heldHere.delete(slot)) goneAt.set(slot, Date.now());
-      const decided = wakeAction(!!live, Date.now(), seenByServer, { holder, goneAt: goneAt.get(slot) });
-      if (decided.action === "skip") {
+      const here = { holder, goneAt: goneAt.get(slot) };
+      let decided = wakeAction(!!live, Date.now(), seenByServer, here);
+      const label = slotName(slot) ?? slot;
+      if (decided.action === "skip" && decided.why !== "presence") {
         if (decided.why === "run" && cause === "wake") live?.run.nudge();
-        const name = slotName(slot) ?? slot;
-        opts.log(decided.why === "run" ? `\u25CC ${name} is running here \u2014 ${cause === "wake" ? "woke its pump" : "its pump types the work in"}; not spawning` : decided.why === "holder" ? `\u25B8 ${name} already running (pid ${holder?.pid ?? "?"}) \u2014 not starting a second` : `\u25CC ${name} is working somewhere this host cannot see (heartbeat) \u2014 not spawning`);
+        opts.log(decided.why === "run" ? `\u25CC ${label} is running here \u2014 ${cause === "wake" ? "woke its pump" : "its pump types the work in"}; not spawning` : `\u25B8 ${label} already running (pid ${holder?.pid ?? "?"}) \u2014 not starting a second`);
         return;
       }
-      const label = slotName(slot) ?? slot;
-      const skip = (why) => opts.log(`\u25CC ${label} ${why} \u2014 not spawning`);
+      let taking = "";
+      let found;
+      const skip = (why) => {
+        opts.log(`\u25CC ${label} ${why} \u2014 not spawning${taking}`);
+        if (taking && found) decide(slot, "took_over", found, seenByServer, `${why} \u2014 not spawning${taking}`);
+      };
       const token = readToken(slot);
       if (!token) {
         skip("has no token on this machine");
         return;
       }
-      const owner = ownerSession(slot);
+      const identity = slotIdentity(slot);
+      const owner = !identity.harness || identity.harness === "claude" ? ownerSession(slot) : null;
+      const read = async () => {
+        const got = await waitingWork(token, identity.sessionId ?? owner?.sessionId);
+        if (!("skip" in got)) return got;
+        if (got.revoked) {
+          drop(slot, token);
+          return null;
+        }
+        skip(got.skip);
+        if (decided.why === "presence" && got.skip !== NOTHING_WAITING) decide(slot, "stood_back", null, seenByServer, got.skip);
+        return null;
+      };
+      if (decided.why === "presence") {
+        found = await read() ?? void 0;
+        if (!found) return;
+        const since = found.since;
+        decided = wakeAction(false, Date.now(), seenByServer, { ...here, ...since ? { movedAt: Date.parse(since) } : {} });
+        if (decided.action === "skip") {
+          const said = `is working somewhere this host cannot see (heartbeat) \u2014 ${found.waiting}${since ? ` last moved ${ago(since, Date.now())}; taken over once it sits ${IDLE_HOLDER_MS / 6e4} min untouched` : ", with nothing to say when it last moved"}`;
+          opts.log(`\u25CC ${label} ${said} \u2014 not spawning`);
+          decide(slot, "stood_back", found, seenByServer, said);
+          return;
+        }
+        taking = ` (taking over: ${found.waiting} last moved ${ago(since, Date.now())} while something this host cannot see heartbeats as ${label} and has not touched it)`;
+      }
+      const harness = wakeHarness(slot, identity.harness, !!owner);
+      if (!harness) {
+        skip("has no recorded harness; select its runtime before recovery");
+        return;
+      }
       if (owner && !allowed(owner.cwd, opts.wsDeps)) {
         skip(`ran in ${owner.cwd}, outside the folders this machine granted`);
         return;
@@ -35147,11 +35513,8 @@ function startHost(opts) {
         skip("has no granted folder to wake in");
         return;
       }
-      const found = await waitingWork(token, owner?.sessionId);
-      if ("skip" in found) {
-        skip(found.skip);
-        return;
-      }
+      found ??= await read() ?? void 0;
+      if (!found) return;
       if (runs.has(key)) {
         skip("was started by the wake that read it first");
         return;
@@ -35163,6 +35526,7 @@ function startHost(opts) {
         mode: "bypass",
         prompt: "",
         token,
+        ...identity.sessionId ? { session: identity.sessionId } : {},
         ...owner ? { resume: owner.sessionId } : {},
         // A dead run must not squat the slot — evict so the next wake can respawn. Only ITS entry:
         // a run that is no longer the slot's must not take the live one's place away with it.
@@ -35177,13 +35541,15 @@ function startHost(opts) {
       runs.set(key, { run, label, token });
       void heartbeat(void 0, { token }).catch(() => {
       });
-      opts.log(`\u25B6 ${owner ? "resumed" : "woke"} ${label} (${harness}) \u2014 ${found.waiting} was waiting, in ${workspace}${decided.why === "gone" ? " (its process here ended; its last heartbeat was not waited out)" : ""}`);
+      const woke = `\u25B6 ${owner ? "resumed" : "woke"} ${label} (${harness}) \u2014 ${found.waiting} was waiting, in ${workspace}${decided.why === "gone" ? " (its process here ended; its last heartbeat was not waited out)" : taking}`;
+      opts.log(woke);
+      if (taking) decide(slot, "took_over", found, seenByServer, woke);
     }
   }
   const listening = /* @__PURE__ */ new Map();
   const joining = /* @__PURE__ */ new Set();
   async function listenSlots() {
-    const want = new Set(listSlots().filter((slot) => slot !== "Desktop" && !!readToken(slot)));
+    const want = new Set(listSlots().filter((slot) => slot !== "Desktop" && !!readToken(slot) && !isRevoked(slot)));
     for (const [slot, sub] of [...listening]) {
       if (want.has(slot)) continue;
       listening.delete(slot);
@@ -35204,6 +35570,10 @@ function startHost(opts) {
         listening.set(slot, sub);
         opts.log(`\u25C9 listening for ${slotName(slot) ?? slot}`);
       } catch (e) {
+        if (e instanceof RevokedError) {
+          drop(slot, token);
+          continue;
+        }
         opts.log(`\u25CC not listening for ${slotName(slot) ?? slot} \u2014 ${e.message}`);
       } finally {
         joining.delete(slot);
@@ -35269,7 +35639,7 @@ function startHost(opts) {
     roster: () => {
       const live = new Map([...runs.values()].map((r) => [r.label, r.run]));
       const names2 = /* @__PURE__ */ new Map();
-      for (const key of listSlots()) if (key !== "Desktop") names2.set(slotName(key) ?? key, key);
+      for (const key of listSlots()) if (key !== "Desktop" && !isRevoked(key)) names2.set(slotName(key) ?? key, key);
       for (const label of live.keys()) if (!names2.has(label)) names2.set(label, null);
       return [...names2.entries()].map(([name, slot]) => {
         const id = slot ? slotIdentity(slot) : { voice: null, tokenId: null };
@@ -35337,17 +35707,17 @@ function startBridgeInstalls(bridges, deps = {}) {
   const sleep3 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const running = bridges.map((b) => {
     let proc = null;
-    let outcome;
+    let outcome2;
     try {
       proc = spawn2(b.install);
-      outcome = proc.exited.then(
+      outcome2 = proc.exited.then(
         (code) => code === 0 ? "installed" : "failed",
         () => "failed"
       );
     } catch {
-      outcome = Promise.resolve("failed");
+      outcome2 = Promise.resolve("failed");
     }
-    return { ...b, proc, outcome };
+    return { ...b, proc, outcome: outcome2 };
   });
   return {
     started: running.length,
@@ -35625,7 +35995,7 @@ async function main() {
       process.exit(1);
     }
     const cwd = process.cwd();
-    if (!updateSlot(slot, { workspace: cwd })) {
+    if (!updateSlot(slot, { workspace: cwd, session_id: sessionId() })) {
       console.error(`Slot "${slot}" isn't in this machine's slot file \u2014 this session was spawned by the host, which already owns its wake dir. Run handoff from the terminal that hatched the identity.`);
       process.exit(1);
     }