@visa/cli 5.0.0-rc.354 → 5.0.0-rc.356

package/README.md

@@ -454,17 +454,19 @@ Deterministic preconditions always resolve to a specific code:
 | The signer exited (the `error` text carries its exit code and last stderr) | `native_runtime_closed` | `platform` |
 | The login keychain is locked or unavailable to the signer | `keychain_locked_or_unavailable` | `platform` |
 
-**The Console says "Waiting on this agent to reconnect its wallet key"**
+**The Console says "This agent's approval needs renewing"**
 `get_status` answers `walletKey` for the selected agent (and `walletKeys` for
 every agent this machine holds): `state` is what the wallet store on this
 machine says (`installed`, `wallet_setup_pending`, `missing`, `revoking`,
 `revoked`, or `unreadable` with the reason), `authority` is what Visa says
 about that key right now (`live`, `expired`, `absent`, or `unreachable`; it is
 asked every time and never remembered), and `nextStep` is the one move that
-follows. An installed key Visa calls `expired` is re-signed in two halves: the
-running agent publishes the repair on its own (or `agent_enroll` does), and the
-owner presses **Repair** on that agent in the Console. `renewalPublished: true`
-means the agent's half is already done.
+follows. The owner's approval of an installed key lasts a year. When it has
+lapsed, the owner renews it in the Visa Console: it renews on its own when
+they open the Console, or with one **Renew** press. Nothing on this machine
+takes part, the agent need not be running, and re-enrolling would mint a
+second agent, so an agent that sees `authority: "expired"` reports it and
+waits.
 
 `unspecified_error` (`platform`) is reserved for failures the CLI cannot
 classify and is intentionally kept on two guards: a wallet binding that does not