primcli 3.0.0-preview.11 → 3.0.0-preview.13

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
-import { $ as readEmailInteraction, A as explainPendingMailNotFound, At as cliInvocation, Bt as formatAlreadySentNotice, C as promptLine$2, Ct as sendOutcomeExitCode, D as formatBrowserLoginInstructions, Dt as successfulSendOutcome, E as canOfferCopyHotkey, Et as serializeErrorPayload, F as latestOwnOutbound, Ft as loadSkillLine, G as clearConsumedPendingMail, Gt as classificationFactLines, H as wakeRecipientField, Ht as emptyEmailListHint, I as readThreadContext, It as currentMailSessionKey, J as readPendingMail, Jt as noFactsMessage, K as clearReadPendingMail, Kt as classificationOf, L as sentInThread, Lt as detectAgentRuntime, M as describeWake, N as displayAddress, Nt as generatedAgentName, O as listenForCopyHotkey, Ot as thrownErrorExitCode, P as formatMailWakeLine, Pt as identitySuggestions, Q as interactionNextActions, Qt as ConnectedAgentKeyRequiredError, R as serverMuted, Rt as detectRuntimeSession, S as approveThenRerunHint, St as sendIdentityFields, T as withApproval, Tt as sentHistoryWindowStart, U as wakeRelationship, Ut as mailReach, V as wakeReadCommand, Vt as withFlagSuggestion, W as claimPendingMail, Wt as readCallerMailFor, X as removePendingMail, Xt as ATTACHMENT_WAIT_MAX_MS, Y as recordPendingMail, Yt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Z as interactionHumanLine, Zt as withAttachmentWait, _ as takesStepUp, _n as setKnownCommands, _t as formatPriorRepliesWarning, a as createOperationCommand, an as selectedOrgFromEnv, at as SEND_OUTCOME_HELP, b as STEP_UP_HEADER$1, bt as priorRepliesThatWentOut, c as formatErrorPayload, cn as credentialsFromUserLogin, ct as buildFollowUpCommand, d as isGrantRefusal, dn as revokeUserLogin, dt as classifySendError, en as createAuthenticatedCliApiClient, et as replyExpectation, f as parameterFlagName, fn as roleKeyLabel, ft as deriveSendIdempotencyKey, g as surfaceUnauthorizedHint, gn as sanitizeForTerminal, gt as formatPriorRepliesCheckSkipped, h as runWithTiming, hn as routeWarningLines, ht as formatDeletedEarlierSendNotice, i as TIME_FLAG_DESCRIPTION, in as resolveCliApiRequestConfig, it as MAX_SEND_WAIT_TIMEOUT_MS, j as bareAddress, jt as connectNextSteps, k as openBrowser, l as hasControlCharacter$1, ln as fetchCliOrgs, lt as buildThrownSendFailureEnvelope, m as refusalDetails, mn as switchCurrentOrg, mt as followUpCommandPrefix, n as API_ERROR_CODES, nn as refreshStoredCliCredentials, o as extractErrorCode, on as CliOrgRefusedError, ot as apiResultHttpStatus, p as readTextFileFlag, pn as roleKeyText, pt as excludeSignalReplies, q as pendingMailPath, qt as isEmailId, r as OPERATION_PATH_FLAGS, rn as refuseOrgSelectionForProfile, rt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, s as extractErrorPayload, sn as RESTRICTED_ROLE_NOTE, st as assertValidIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createCliApiClient, tt as replyInteractionWarning, u as headerFlagName, un as isBuiltInRoleKey, ut as checkPriorReplies, v as writeErrorWithHints, vn as operationManifest, vt as formatSendFailureSummary, w as terminalApprovalIo, wt as sendWaitClampNotice, x as STEP_UP_TOKEN_FLAG_DESCRIPTION, xt as reportSendCommandResult, y as BROWSER_FLAG_DESCRIPTION, yt as formatSendRecordFailureSummary, z as serverRelationship, zt as runtimeSessionVariableList } from "../api-command-CkMEFiBL.js";
-import { $ as parseWebhookEvent, $n as simulateRoute, $t as getRepeatingSend, A as lateMailReread, An as listWakeDispatches, At as deleteWakeSchedule, B as ensureSearchReportsReplyState, Bn as replyToEmail, Bt as getConversation, C as waitOutRetryAfter, Cn as listOrganizationPeople, Ct as createWakeAuthorization, D as encodeReceivedAtSearchCursor, Dn as listSentAttachmentArchiveMembers, Dt as deleteMemory, E as cursorFromAcceptedRows, En as listRoutes, F as AWAITING_VALUES, Ft as downloadSentAttachmentByFilename, G as queryUsesAwaiting, Gt as getFunctionRouting, H as formatRepliesCell, Hn as revokeCredential, Ht as getDefaultNetworkAgent, I as REPLY_STATE_UNSUPPORTED_CODE, It as getAccessMode, Jn as semanticSearch, Jt as getKey, Kn as searchEmails, Kt as getFunctionTestRunTrace, L as ReplyStateUnsupportedError, Ln as redeemCreditCode, Lt as getAccount, M as sinceFromFlags, Mn as pollCliLogin, Mt as downloadEmailAttachmentByFilename, N as sleep$3, Nn as pullWebhookEvent, O as fetchEmailSearchPage, On as listSentEmails, Ot as deleteRoute, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentArchiveMember, Qn as setMemory, Qt as getOwnGrant, R as assertAwaitingFilterRows, Rn as removeDefaultNetworkMember, Rt as getAgentContactPolicy, S as transientFailure, Sn as listMailboxAccess, St as createRoute, T as collectNewAcceptedEmails, Tn as listRoles, U as hasReplyState, Un as rotateKey, Ut as getEmail, V as formatAwaitingCell, Vn as resendAgentSignupVerification, Vt as getCreditBalance, W as isAwaitingRejectedError, Wn as runWakeSchedule, Wt as getFunction, Xn as setFunctionRoute, Xt as getOrgRoutingTopology, Yn as sendEmail, Yt as getMemory, Z as isEmailReceivedEvent, Zn as setFunctionSecret, Zt as getOutboundStatus, _ as describeApiFailure, _n as listEndpoints, _t as cliLogout, a as REPEAT_IDLE_MAX_MINUTES, an as leaveOrganization, ar as unsetFunctionRoute, at as assertAutomatedVerdict, b as retryTransient, bn as listGroups, bt as createFunction, cn as listAgentContacts, cr as updateKey, d as parseRepeatTick, dn as listDefaultNetworkAgents, dr as updateWakeAuthorization, dt as isAutomatedRejectedError, en as getSendFrom, er as startAgentClaim, et as parseFromHeader, f as preparePresenceAliveEmail, fn as listDefaultNetworkMembers, fr as updateWakeSchedule, ft as addDefaultNetworkMember, g as WaitDeadlineReached, gn as listEmails, gt as checkSendability, hn as listEmailRuleResults, hr as whoami, ht as checkDefaultNetworkContactAdmission, i as REPEAT_EVERY_MAX_MINUTES, ir as testFunction, it as AutomatedFilterUnsupportedError, j as quoteDslValue, jn as listWakeSchedules, jt as downloadEmailAttachmentArchiveMember, k as filtersFromFlags, kn as listWakeAuthorizations, kt as deleteWakeAuthorization, l as parseInteractionEnvelope, ln as listAgentNetworks, lr as updateRepeatingSend, m as repeatStopCommand, mn as listEmailAttachmentArchiveMembers, mr as verifyAgentSignup, mt as cancelSentEmailByIdempotencyKey, nn as getThread, nr as startCliLogin, nt as AUTOMATED_FLAG_DESCRIPTION, o as REPEAT_MAX_SENDS_MAX, on as listActivityObjects, or as updateDefaultNetworkMember, ot as automatedRejectedError, p as prepareSignalEmail, pn as listDomains, pr as verifyAgentClaim, pt as cancelSentEmail, qn as searchMemories, qt as getInboxStatus, rn as getWakeSchedule, rr as stopRepeatFromEmail, rt as AUTOMATED_VALUES, s as buildRepeatStopBody, sr as updateFunction, tn as getSentEmail, tr as startAgentSignup, tt as AUTOMATED_FILTER_UNSUPPORTED_CODE, u as parsePresenceEnvelope, ur as updateRoute, ut as hasAutomatedVerdict, vn as listFunctionLogs, vt as completeWebhookEvent, w as SINCE_VALUE_HELP, wn as listRepeatingSends, wt as createWakeSchedule, x as retryingOperation, xn as listKeys, xt as createKey, y as pauseForTransientFailure, yn as listFunctions, yt as createEndpoint, z as awaitingRejectedError, zn as reorderRoutes } from "../repeats-Dj_o6c-X-ChTwFlyB.js";
-import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-DcFHxUL9.js";
+import { $ as readEmailInteraction, A as explainPendingMailNotFound, At as cliInvocation, Bt as formatAlreadySentNotice, C as promptLine$2, Ct as sendOutcomeExitCode, D as formatBrowserLoginInstructions, Dt as successfulSendOutcome, E as canOfferCopyHotkey, Et as serializeErrorPayload, F as latestOwnOutbound, Ft as loadSkillLine, G as clearConsumedPendingMail, Gt as classificationFactLines, H as wakeRecipientField, Ht as emptyEmailListHint, I as readThreadContext, It as currentMailSessionKey, J as readPendingMail, Jt as noFactsMessage, K as clearReadPendingMail, Kt as classificationOf, L as sentInThread, Lt as detectAgentRuntime, M as describeWake, N as displayAddress, Nt as generatedAgentName, O as listenForCopyHotkey, Ot as thrownErrorExitCode, P as formatMailWakeLine, Pt as identitySuggestions, Q as interactionNextActions, Qt as ConnectedAgentKeyRequiredError, R as serverMuted, Rt as detectRuntimeSession, S as approveThenRerunHint, St as sendIdentityFields, T as withApproval, Tt as sentHistoryWindowStart, U as wakeRelationship, Ut as mailReach, V as wakeReadCommand, Vt as withFlagSuggestion, W as claimPendingMail, Wt as readCallerMailFor, X as removePendingMail, Xt as ATTACHMENT_WAIT_MAX_MS, Y as recordPendingMail, Yt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Z as interactionHumanLine, Zt as withAttachmentWait, _ as takesStepUp, _n as setKnownCommands, _t as formatPriorRepliesWarning, a as createOperationCommand, an as selectedOrgFromEnv, at as SEND_OUTCOME_HELP, b as STEP_UP_HEADER$1, bt as priorRepliesThatWentOut, c as formatErrorPayload, cn as credentialsFromUserLogin, ct as buildFollowUpCommand, d as isGrantRefusal, dn as revokeUserLogin, dt as classifySendError, en as createAuthenticatedCliApiClient, et as replyExpectation, f as parameterFlagName, fn as roleKeyLabel, ft as deriveSendIdempotencyKey, g as surfaceUnauthorizedHint, gn as sanitizeForTerminal, gt as formatPriorRepliesCheckSkipped, h as runWithTiming, hn as routeWarningLines, ht as formatDeletedEarlierSendNotice, i as TIME_FLAG_DESCRIPTION, in as resolveCliApiRequestConfig, it as MAX_SEND_WAIT_TIMEOUT_MS, j as bareAddress, jt as connectNextSteps, k as openBrowser, l as hasControlCharacter$1, ln as fetchCliOrgs, lt as buildThrownSendFailureEnvelope, m as refusalDetails, mn as switchCurrentOrg, mt as followUpCommandPrefix, n as API_ERROR_CODES, nn as refreshStoredCliCredentials, o as extractErrorCode, on as CliOrgRefusedError, ot as apiResultHttpStatus, p as readTextFileFlag, pn as roleKeyText, pt as excludeSignalReplies, q as pendingMailPath, qt as isEmailId, r as OPERATION_PATH_FLAGS, rn as refuseOrgSelectionForProfile, rt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, s as extractErrorPayload, sn as RESTRICTED_ROLE_NOTE, st as assertValidIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createCliApiClient, tt as replyInteractionWarning, u as headerFlagName, un as isBuiltInRoleKey, ut as checkPriorReplies, v as writeErrorWithHints, vn as operationManifest, vt as formatSendFailureSummary, w as terminalApprovalIo, wt as sendWaitClampNotice, x as STEP_UP_TOKEN_FLAG_DESCRIPTION, xt as reportSendCommandResult, y as BROWSER_FLAG_DESCRIPTION, yt as formatSendRecordFailureSummary, z as serverRelationship, zt as runtimeSessionVariableList } from "../api-command-D5Tj9C-K.js";
+import { $ as parseWebhookEvent, $n as simulateRoute, $t as getRepeatingSend, A as lateMailReread, An as listWakeDispatches, At as deleteWakeSchedule, B as ensureSearchReportsReplyState, Bn as replyToEmail, Bt as getConversation, C as waitOutRetryAfter, Cn as listOrganizationPeople, Ct as createWakeAuthorization, D as encodeReceivedAtSearchCursor, Dn as listSentAttachmentArchiveMembers, Dt as deleteMemory, E as cursorFromAcceptedRows, En as listRoutes, F as AWAITING_VALUES, Ft as downloadSentAttachmentByFilename, G as queryUsesAwaiting, Gt as getFunctionRouting, H as formatRepliesCell, Hn as revokeCredential, Ht as getDefaultNetworkAgent, I as REPLY_STATE_UNSUPPORTED_CODE, It as getAccessMode, Jn as semanticSearch, Jt as getKey, Kn as searchEmails, Kt as getFunctionTestRunTrace, L as ReplyStateUnsupportedError, Ln as redeemCreditCode, Lt as getAccount, M as sinceFromFlags, Mn as pollCliLogin, Mt as downloadEmailAttachmentByFilename, N as sleep$3, Nn as pullWebhookEvent, O as fetchEmailSearchPage, On as listSentEmails, Ot as deleteRoute, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentArchiveMember, Qn as setMemory, Qt as getOwnGrant, R as assertAwaitingFilterRows, Rn as removeDefaultNetworkMember, Rt as getAgentContactPolicy, S as transientFailure, Sn as listMailboxAccess, St as createRoute, T as collectNewAcceptedEmails, Tn as listRoles, U as hasReplyState, Un as rotateKey, Ut as getEmail, V as formatAwaitingCell, Vn as resendAgentSignupVerification, Vt as getCreditBalance, W as isAwaitingRejectedError, Wn as runWakeSchedule, Wt as getFunction, Xn as setFunctionRoute, Xt as getOrgRoutingTopology, Yn as sendEmail, Yt as getMemory, Z as isEmailReceivedEvent, Zn as setFunctionSecret, Zt as getOutboundStatus, _ as describeApiFailure, _n as listEndpoints, _t as cliLogout, a as REPEAT_IDLE_MAX_MINUTES, an as leaveOrganization, ar as unsetFunctionRoute, at as assertAutomatedVerdict, b as retryTransient, bn as listGroups, bt as createFunction, cn as listAgentContacts, cr as updateKey, d as parseRepeatTick, dn as listDefaultNetworkAgents, dr as updateWakeAuthorization, dt as isAutomatedRejectedError, en as getSendFrom, er as startAgentClaim, et as parseFromHeader, f as preparePresenceAliveEmail, fn as listDefaultNetworkMembers, fr as updateWakeSchedule, ft as addDefaultNetworkMember, g as WaitDeadlineReached, gn as listEmails, gt as checkSendability, hn as listEmailRuleResults, hr as whoami, ht as checkDefaultNetworkContactAdmission, i as REPEAT_EVERY_MAX_MINUTES, ir as testFunction, it as AutomatedFilterUnsupportedError, j as quoteDslValue, jn as listWakeSchedules, jt as downloadEmailAttachmentArchiveMember, k as filtersFromFlags, kn as listWakeAuthorizations, kt as deleteWakeAuthorization, l as parseInteractionEnvelope, ln as listAgentNetworks, lr as updateRepeatingSend, m as repeatStopCommand, mn as listEmailAttachmentArchiveMembers, mr as verifyAgentSignup, mt as cancelSentEmailByIdempotencyKey, nn as getThread, nr as startCliLogin, nt as AUTOMATED_FLAG_DESCRIPTION, o as REPEAT_MAX_SENDS_MAX, on as listActivityObjects, or as updateDefaultNetworkMember, ot as automatedRejectedError, p as prepareSignalEmail, pn as listDomains, pr as verifyAgentClaim, pt as cancelSentEmail, qn as searchMemories, qt as getInboxStatus, rn as getWakeSchedule, rr as stopRepeatFromEmail, rt as AUTOMATED_VALUES, s as buildRepeatStopBody, sr as updateFunction, tn as getSentEmail, tr as startAgentSignup, tt as AUTOMATED_FILTER_UNSUPPORTED_CODE, u as parsePresenceEnvelope, ur as updateRoute, ut as hasAutomatedVerdict, vn as listFunctionLogs, vt as completeWebhookEvent, w as SINCE_VALUE_HELP, wn as listRepeatingSends, wt as createWakeSchedule, x as retryingOperation, xn as listKeys, xt as createKey, y as pauseForTransientFailure, yn as listFunctions, yt as createEndpoint, z as awaitingRejectedError, zn as reorderRoutes } from "../repeats-Dj_o6c-X-ykfsraq6.js";
+import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-cIUz_kxR.js";
 import { A as AGENT_ADDRESS_ENV, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadChatConversationByLocalId, P as agentProfileName, R as loadConnectedAgentProfile, S as resolveCliAuth, T as chatStatePath, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-Ms_0vNjq.js";
 import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-BAQSGxxz.js";
-import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-D39TUEGF.js";
-import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-DVhJu-DF.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-BMr-zPLx.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-DVSsLSRw.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CGgHQ_po.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-gpH2AhIi.js";
 import { a as thrownErrorBody, i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-ch756TXV.js";
 import { a as backgroundListenStatus, c as runBackgroundListen, d as stopBackgroundListen, f as verifyBackgroundListenTarget, o as backgroundListenToken, r as backgroundListenConfiguration, u as startBackgroundListen } from "../listen-background-DyBYca28.js";
 import { ORG_SELECTION_ENV } from "./global-org-flag.js";
@@ -2502,7 +2502,12 @@ const openapiDocument = {
 					"name": "outbound_only",
 					"in": "query",
 					"schema": { "type": "boolean" },
-					"description": "When true, include only outbound DNS records. Verified domains default to outbound-only; pending claims default to all required records."
+					"description": "When true, include only outbound DNS records. Cannot be combined with inbound_only=true. By default, include all records."
+				}, {
+					"name": "inbound_only",
+					"in": "query",
+					"schema": { "type": "boolean" },
+					"description": "When true, include only inbound MX and ownership TXT records. Cannot be combined with outbound_only=true."
 				}],
 				"responses": {
 					"200": {
@@ -4782,7 +4787,7 @@ const openapiDocument = {
 						"description": "Existing named pull destination resumed",
 						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 							"type": "object",
-							"properties": { "data": { "$ref": "#/components/schemas/Endpoint" } }
+							"properties": { "data": { "$ref": "#/components/schemas/CreatedEndpoint" } }
 						}] } } },
 						"headers": {
 							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
@@ -4795,7 +4800,7 @@ const openapiDocument = {
 						"description": "Endpoint created (or reactivated)",
 						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 							"type": "object",
-							"properties": { "data": { "$ref": "#/components/schemas/Endpoint" } }
+							"properties": { "data": { "$ref": "#/components/schemas/CreatedEndpoint" } }
 						}] } } }
 					},
 					"400": {
@@ -21769,7 +21774,7 @@ const openapiDocument = {
 		"/activity/objects": { "get": {
 			"operationId": "listActivityObjects",
 			"summary": "List what you created, or what you were asked",
-			"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes or saved a new version while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended.",
+			"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes or saved a new version while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended. Notices are written by a periodic job and can lag: until the notices record a rule starting to cover you, the first page lists that rule as pending (pending_complete says whether that check finished), and as_of says about when the notices last looked. For what covers you now, read GET /email-rules/covering-me.",
 			"tags": ["Activity"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
@@ -21780,7 +21785,7 @@ const openapiDocument = {
 					"description": "created (the default), asked or concerning.",
 					"schema": {
 						"default": "created",
-						"description": "created (the default): what you created. asked: what other members asked of you, open or answered: rule requests made to you, and objections to rules you wrote; kind may then name only email_rule_request and email_rule_objection. concerning: what other members did that concerns your own mail: a rule that started covering one of your mailboxes, or saved a new version while covering it (email_rule_coverage, the only kind it takes). asked and concerning are for a person's own view only.",
+						"description": "created (the default): what you created. asked: what other members asked of you, open or answered: rule requests made to you, and objections to rules you wrote; kind may then name only email_rule_request and email_rule_objection. concerning: what other members did that concerns your own mail: an active rule that started covering one of your mailboxes, or saved a new version while covering it (email_rule_coverage, the only kind it takes). A rule in draft or observe is not told of; GET /v1/email-rules/covering-me lists it. asked and concerning are for a person's own view only.",
 						"type": "string",
 						"enum": [
 							"created",
@@ -21819,7 +21824,7 @@ const openapiDocument = {
 					"name": "limit",
 					"in": "query",
 					"required": false,
-					"description": "Objects per page, from 1 to 200; defaults to 50.",
+					"description": "Objects per page, from 1 to 200; defaults to 50. With relation=concerning the first page may also hold pending items beyond it.",
 					"schema": {
 						"default": 50,
 						"type": "integer",
@@ -21927,7 +21932,7 @@ const openapiDocument = {
 		"/email-rules/vocabulary": { "get": {
 			"operationId": "getEmailRuleVocabulary",
 			"summary": "Read the column catalog",
-			"description": "What a rule tree you write yourself can say: each column of the current vocabulary with its type, source, meaning, operators and the value each takes, options, and whether it takes min_confidence; and the tree's limits, its stored size included. Built from the checks a saved or tested tree must pass. A tree is {version: tree_version, vocabulary: version, when, questions}. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "What a rule tree you write yourself can say: each column of the current vocabulary with its type, source, meaning, operators and the value each takes, options, and whether it takes min_confidence; and the tree's limits, its stored size included. Built from the checks a saved or tested tree must pass. A tree is {version: tree_version, vocabulary: version, when, questions}. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"responses": {
@@ -21965,7 +21970,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -21997,7 +22002,7 @@ const openapiDocument = {
 		"/email-rules/compile": { "post": {
 			"operationId": "compileEmailRule",
 			"summary": "Compile a rule description",
-			"description": "Turns a plain-English description of which received emails to match into a rule tree over the column contract, with an explanation of what it matches, the assumptions made, and warnings for what the columns cannot express. Where the columns fall short it adds up to five yes/no questions, asked only after the conditions match; they read the subject, the new text and attachment file names, never attachment contents. Nothing is saved. For a rule with no questions, breadth counts, read only, how much of your recent classified mail its conditions match. include_sql returns the SQL it renders to. kind do_not_share compiles for recall. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Turns a plain-English description of which received emails to match into a rule tree over the column contract, with an explanation of what it matches, the assumptions made, and warnings for what the columns cannot express. Where the columns fall short it adds up to five yes/no questions, asked only after the conditions match; they read the subject, the new text and attachment file names, never attachment contents. Nothing is saved. For a rule with no questions, breadth counts, read only, how much of the recent classified mail in evaluation_scope (by default your own mailboxes) its conditions match; for a grant rule with questions, conditions_breadth counts its conditions alone. include_sql returns the SQL it renders to. kind do_not_share compiles for recall. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22052,7 +22057,11 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_scope_not_readable: scope_selection names something you cannot read.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"409": {
+					"description": "email_rule_author_unresolvable: with evaluation_scope selected, you cannot act as a rule's author right now (details.reason left, revoked, suspended, membership_ended or no_mail_read).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"422": {
@@ -22103,7 +22112,7 @@ const openapiDocument = {
 		"/email-rules/test": { "post": {
 			"operationId": "testEmailRule",
 			"summary": "Test a rule against received mail",
-			"description": "Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, or a saved rule by rule_id (its current version, as its author). It reads only mail its author can read and its scope covers. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, or a saved rule by rule_id (its current version, as its author). It reads only mail its author can read and its scope covers. A rule you see only because it covers your own mailboxes runs as you, over only those, from the dashboard or the Primitive CLI. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22149,15 +22158,15 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and a rule decides on what emails say. email_rule_scope_not_readable: scope_selection names something you cannot read.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and a rule decides on what emails say. email_rule_scope_not_readable: scope_selection names something you cannot read. forbidden with details.reason covering_view_only: you read this rule only in the covering view, since it decided on your mail before and covers none of your mailboxes now (details.covering_view).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: rule_id names no rule you can see (details.reason rule_not_found).",
+					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, the caller). details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree or a rule covering you, the caller). details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -22200,7 +22209,7 @@ const openapiDocument = {
 		"/email-rules/look-alikes": { "post": {
 			"operationId": "generateLookAlikes",
 			"summary": "Write look-alike emails a rule should or should not match",
-			"description": "Writes made-up emails that come close to what a grant rule describes, and reports what the rule decides for each, as test-sample would. Most should not match (expected no_match): business near misses from its senders and topic (kind other: an all-clear, a reply with nothing new, a related document, another subject) and private mail (a personal medical bill, pay for named people, a personal purchase, personal banking or tax). By default a third, rounded down, are near cases it should match (expected match, kind other). failed means the rule decided one against expected. Nothing is stored and no mail is read. Keep them, with their expected, with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Writes made-up emails that come close to what a grant rule describes, and reports what the rule decides for each, as test-sample would. Most should not match (expected no_match): business near misses from its senders and topic (kind other: an all-clear, a reply with nothing new, a related document, another subject) and private mail (a personal medical bill, pay for named people, a personal purchase, personal banking or tax). By default a third, rounded down, are near cases it should match (expected match, kind other). failed means the rule decided one against expected. Nothing is stored and no mail is read. Keep them, with their expected, with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22246,15 +22255,15 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_scope_not_readable: scope_selection names something you cannot read.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_scope_not_readable: scope_selection names something you cannot read. forbidden with details.reason covering_view_only: you read this rule only in the covering view, since it decided on your mail before and covers none of your mailboxes now (details.covering_view).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: rule_id names no rule you can see (details.reason rule_not_found), or request_id no rule request you can see (request_not_found).",
+					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found), or request_id no rule request you can see (request_not_found).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree or a request, you). email_rule_request_not_pending: request_id names a request already decided.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, a request or a rule covering you, you). email_rule_request_not_pending: request_id names a request already decided.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"422": {
@@ -22305,7 +22314,7 @@ const openapiDocument = {
 		"/email-rules/test-sample": { "post": {
 			"operationId": "testEmailRuleOnSample",
 			"summary": "Test a rule against a made-up email",
-			"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types and file names; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22351,15 +22360,15 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_scope_not_readable: scope_selection names something you cannot read.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_scope_not_readable: scope_selection names something you cannot read. forbidden with details.reason covering_view_only: you read this rule only in the covering view, since it decided on your mail before and covers none of your mailboxes now (details.covering_view).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: rule_id names no rule you can see (details.reason rule_not_found).",
+					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, you), so it would decide nothing for real. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree or a rule covering you, you), so it would decide nothing for real. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -22403,7 +22412,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRule",
 				"summary": "Create a rule",
-				"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract. It starts in observe (recorded, nothing granted or blocked) unless state is draft, or active for a do_not_share rule. You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes unless you name author or selected (scope_selection names only what you can read). expectations are judged in expectations_check. kind do_not_share blocks sharing what it matches; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract. It starts in observe (recorded, nothing granted or blocked) unless state is draft, or active for a do_not_share rule. You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes unless you name author or selected (scope_selection names only what you can read). expectations are judged in expectations_check. kind do_not_share blocks sharing what it matches; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -22452,7 +22461,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_scope_not_readable: scope_selection names something you cannot read (details.addresses, details.domains).",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_scope_not_readable: scope_selection names something you cannot read (details.addresses, details.domains).",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"409": {
@@ -22499,7 +22508,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "listEmailRules",
 				"summary": "List rules",
-				"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule) and current_version, but not the version's text: read that under current from GET /email-rules/{id}. With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule) and current_version, but not the version's text: read that under current from GET /email-rules/{id}. With matched_email_id, only the rules that matched that email. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [
@@ -22588,7 +22597,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. grant_forbidden with details.reason mail_depth: matched_email_id with access to mail that shows headers only, since which rules matched an email is read from what it says.",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. grant_forbidden with details.reason mail_depth: matched_email_id with access to mail that shows headers only, since which rules matched an email is read from what it says.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -22622,7 +22631,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getEmailRule",
 				"summary": "Read a rule",
-				"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. The current version's text (english, tree, explanation, assumptions, warnings) is under current, and current_version is its number. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. The current version's text (english, tree, explanation, assumptions, warnings) is under current, and current_version is its number. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -22692,7 +22701,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. forbidden with details.reason covering_view_only (your dashboard session or the Primitive CLI only): you may read this rule only because it covers your mailbox; details.covering_view is where (getEmailRuleCoveringMe).",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. forbidden with details.reason covering_view_only (your dashboard session or the Primitive CLI only): you may read this rule only because it covers your mailbox or decided on your mail; details.covering_view is where (getEmailRuleCoveringMe).",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -22737,7 +22746,7 @@ const openapiDocument = {
 			"patch": {
 				"operationId": "updateEmailRule",
 				"summary": "Change a rule",
-				"description": "Renames the rule, saves a new version (english and tree together; earlier versions stay) or restores one (restore_version), changes its state (draft is off; observe; active), its scope (evaluation_scope, with scope_selection when selected) or its saved expectations (judged in expectations_check). Anyone but its author who sees it may only set state draft, and while it is shared only if they manage members from the dashboard. A scope change saves a new version; a shared rule keeps its scope, and a kind never changes. A saved version takes effect at once. if_version refuses a write once a version was saved since you read it; if_revision, once anything changed. Without if_expectations_pass a version is saved even when its expectations fail. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Renames the rule, saves a new version (english and tree together; earlier versions stay) or restores one (restore_version), changes its state (draft is off; observe; active), its scope (evaluation_scope, with scope_selection when selected) or its saved expectations (judged in expectations_check). Anyone but its author who sees it may only set state draft, and while it is shared only if they manage members from the dashboard. A scope change saves a new version; a shared rule keeps its scope, and a kind never changes. A saved version takes effect at once. if_version refuses a write once a version was saved since you read it; if_revision, once anything changed. Without if_expectations_pass a version is saved even when its expectations fail, except on an active rule keys or webhooks read: that write is checked first unless if_expectations_pass is false. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -22770,7 +22779,7 @@ const openapiDocument = {
 						}
 					},
 					"400": {
-						"description": "validation_error: invalid body or tree (details.errors), too large (too_large), a version that no longer renders (version_not_renderable), restore_version names the current version (already_current), or over 20 made-up emails (too_many_expectation_samples). no_expectations: if_expectations_pass with no expectations to judge; nothing was saved.",
+						"description": "validation_error: invalid body or tree (details.errors), too large (too_large), a version that no longer renders (version_not_renderable), restore_version names the current version (already_current), over 20 made-up emails (too_many_expectation_samples), or a kind other than the rule's own (kind_mismatch). no_expectations: if_expectations_pass with no expectations to judge, or a write that removes them from an active rule keys or webhooks read; nothing was saved.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"401": {
@@ -22793,7 +22802,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden (rule_shared): the rule is shared, so only its author or a member manager can turn it off. email_rule_scope_not_readable: scope_selection names something you cannot read. grant_forbidden (mail_depth): if_expectations_pass needs content access to mail when it judges emails by id.",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_author_only: only the rule's author may make this change. forbidden (rule_shared): the rule is shared, so only its author or a member manager can turn it off. email_rule_scope_not_readable: scope_selection names something you cannot read. grant_forbidden (mail_depth): judging a write (if_expectations_pass, or by default) needs content access to mail when it judges emails by id.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -22801,7 +22810,7 @@ const openapiDocument = {
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"409": {
-						"description": "email_rule_conflict: the rule changed (details.reason version_moved with current_version, revision_moved with current_revision, expectations_moved or rule_changed); read it again and retry. email_rule_scope_locked: the rule is shared. email_rule_author_unresolvable: the rule could not run as you over the chosen scope. expectations_failed, expectations_unreadable (details.unreadable) or expectations_undecided, with if_expectations_pass: nothing was saved; details carries current_version, state and expectations_check.",
+						"description": "email_rule_conflict: the rule changed (details.reason version_moved with current_version, revision_moved with current_revision, expectations_moved, rule_changed or readers_changed); read it again and retry. email_rule_scope_locked: the rule is shared. email_rule_author_unresolvable: the rule could not run as you over the chosen scope. expectations_failed, expectations_unreadable (details.unreadable) or expectations_undecided, with if_expectations_pass or by default on an active rule keys or webhooks read (details.read_by): nothing was saved; details carries current_version, state and expectations_check.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -22826,6 +22835,10 @@ const openapiDocument = {
 								}
 							}
 						} }
+					},
+					"503": {
+						"description": "service_unavailable (rule_keys_unread or rule_readers_unread): the keys or readers of an active rule could not be read in time; nothing was saved.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					}
 				},
 				"x-primitive-permission": ["mail:read"]
@@ -22833,7 +22846,7 @@ const openapiDocument = {
 			"delete": {
 				"operationId": "deleteEmailRule",
 				"summary": "Delete a rule",
-				"description": "Deletes a rule with its versions, its decisions and the access it granted. A share of it ends (end_reason rule_deleted), and the member who shared can still list what it handed over. The answer lists the shares it ended (ended_shares) and the unrevoked keys that still list it, which now read nothing through it (keys, other_keys; left out when they could not be read). The author or a reader of all the organization's mail may delete it; while it is shared, only the author or someone who manages members from the dashboard. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Deletes a rule with its versions, its decisions and the access it granted. A share of it ends (end_reason rule_deleted), and the member who shared can still list what it handed over. The answer lists the shares it ended (ended_shares), says whom with (share_notice), and lists the unrevoked keys that still list it, which now read nothing through it (keys, other_keys; left out when they could not be read). The author or a reader of all the organization's mail may delete it; while it is shared, only the author or someone who manages members from the dashboard. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -22881,7 +22894,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. forbidden with details.reason rule_shared: the rule is shared with another member.",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. forbidden with details.reason rule_shared: the rule is shared with another member.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -22927,7 +22940,7 @@ const openapiDocument = {
 		"/email-rules/{id}/decisions": { "get": {
 			"operationId": "listEmailRuleDecisions",
 			"summary": "List a rule's decisions",
-			"description": "What the rule decided for each email it was evaluated against, newest first: whether it matched, whether it nearly did, how each part decided and the answers to its questions, with which email it was (from_address, subject, received_at). Only decisions on emails the caller can read are listed. With matched, only matches (true) or only the rest (false). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "What the rule decided for each email it was evaluated against, newest first: whether it matched, whether it nearly did, how each part decided and the answers to its questions, with which email it was (from_address, subject, received_at). Only decisions on emails the caller can read are listed. With matched, only matches (true) or only the rest (false). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
@@ -23026,7 +23039,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and what a rule decided is read from what emails say.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and what a rule decided is read from what emails say. forbidden with details.reason covering_view_only (your dashboard session or the Primitive CLI only): you may read this rule only because it covers your mailbox or decided on your mail; details.covering_view is where (listEmailRuleDecisionsOnMyMail).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -23071,7 +23084,7 @@ const openapiDocument = {
 		"/emails/{id}/rule-results": { "get": {
 			"operationId": "listEmailRuleResults",
 			"summary": "List every rule's result on an email",
-			"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only), with who receives what it shares (receivers) while it covers you; hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only), with who receives what it shares (receivers) while it covers you; hidden counts deciding rules you cannot see. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -23119,7 +23132,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and what a rule decided is read from what the email says.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and what a rule decided is read from what the email says.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -23155,7 +23168,7 @@ const openapiDocument = {
 		"/email-rules/{id}/versions": { "get": {
 			"operationId": "listEmailRuleVersions",
 			"summary": "Read versions of a rule",
-			"description": "A rule's versions as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Without versions, every version newest first, a page at a time (meta.cursor). With versions, only those named, oldest first; numbers that are not versions of the rule are left out. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "A rule's versions as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Without versions, every version newest first, a page at a time (meta.cursor). With versions, only those named, oldest first; numbers that are not versions of the rule are left out. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
@@ -23196,7 +23209,7 @@ const openapiDocument = {
 					"required": false,
 					"description": "Read only these version numbers, comma-separated, at most 100. Not with limit or cursor.",
 					"schema": {
-						"description": "Read only these version numbers, comma-separated. Without it, every version, newest first, a page at a time.",
+						"description": "Read only these version numbers, comma-separated. Without it, the versions listed, newest first, a page at a time.",
 						"type": "string",
 						"pattern": "^[1-9]\\d{0,8}(,[1-9]\\d{0,8}){0,99}$"
 					}
@@ -23256,7 +23269,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. forbidden with details.reason covering_view_only (your dashboard session or the Primitive CLI only): you may read this rule only because it covers your mailbox or decided on your mail; details.covering_view is where (listEmailRuleVersionsCoveringMe while it covers you).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -23301,7 +23314,7 @@ const openapiDocument = {
 		"/email-rules/{id}/scope": { "get": {
 			"operationId": "getEmailRuleScope",
 			"summary": "Read what a rule covers",
-			"description": "Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -23349,7 +23362,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -23385,7 +23398,7 @@ const openapiDocument = {
 		"/email-rule-scope-options": { "get": {
 			"operationId": "listEmailRuleScopeOptions",
 			"summary": "List what a rule can cover",
-			"description": "How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. For a caller who reads the whole organization, addresses lists the inboxes known as someone's (member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access), not every address that receives mail: may_name_unlisted says when an address that is not listed, such as an inbox nobody has claimed, may be named too. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. For a caller who reads the whole organization, addresses lists the inboxes known as someone's (member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access), not every address that receives mail: may_name_unlisted says when an address that is not listed, such as an inbox nobody has claimed, may be named too. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -23447,7 +23460,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
@@ -23484,7 +23497,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRuleRequest",
 				"summary": "Ask a member for a rule",
-				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -23524,7 +23537,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -23579,7 +23592,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "listEmailRuleRequests",
 				"summary": "List rule requests",
-				"description": "Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [
@@ -23688,7 +23701,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -23721,7 +23734,7 @@ const openapiDocument = {
 		"/email-rule-requests/target-check": { "post": {
 			"operationId": "checkEmailRuleRequestTarget",
 			"summary": "Check whether a member can accept a rule request",
-			"description": "Says, before you ask, whether a member could accept a rule request now under their role, and if not, which permission their role lacks. Nothing is sent and nothing is recorded. Needs members:read, as listing members and their roles does. At most 60 checks an hour. Name them by user id, or by their member mailbox address or verified work email (counted with asking: at most 30 lookups by address an hour). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Says, before you ask, whether a member could accept a rule request now under their role, and if not, which permission their role lacks. Nothing is sent and nothing is recorded. Needs members:read, as listing members and their roles does. At most 60 checks an hour. Name them by user id, or by their member mailbox address or verified work email (counted with asking: at most 30 lookups by address an hour). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -23767,7 +23780,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. grant_forbidden with details.permission members:read: you cannot list members and their roles.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. grant_forbidden with details.permission members:read: you cannot list members and their roles.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -23819,7 +23832,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getEmailRuleRequest",
 				"summary": "Read a rule request",
-				"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. To try it on an email that has not arrived, pass the request's tree to POST /v1/email-rules/test-sample with one you make up, or have look-alikes written (POST /v1/email-rules/look-alikes with request_id); neither stores anything. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. To try it on an email that has not arrived, pass the request's tree to POST /v1/email-rules/test-sample with one you make up, or have look-alikes written (POST /v1/email-rules/look-alikes with request_id); neither stores anything. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -23867,7 +23880,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -23903,7 +23916,7 @@ const openapiDocument = {
 			"delete": {
 				"operationId": "deleteEmailRuleRequest",
 				"summary": "Delete a withdrawn rule request",
-				"description": "Deletes a request you withdrew, for everyone who could see it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Deletes a request you withdrew, for everyone who could see it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -23951,7 +23964,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_request_proposer_only: only the member who made the request may delete it.",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_request_proposer_only: only the member who made the request may delete it.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -23992,7 +24005,7 @@ const openapiDocument = {
 		"/email-rule-requests/{id}/decline": { "post": {
 			"operationId": "declineEmailRuleRequest",
 			"summary": "Decline a rule request",
-			"description": "Declines a pending request made to you. Nothing is written but the decision and, if you give one, its reason (reason, up to 500 characters), which the member who asked sees with the request. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Declines a pending request made to you. Nothing is written but the decision and, if you give one, its reason (reason, up to 500 characters), which the member who asked sees with the request. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24058,7 +24071,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_request_target_only: only the member the request was made to may decline it.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_request_target_only: only the member the request was made to may decline it.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -24098,7 +24111,7 @@ const openapiDocument = {
 		"/email-rule-requests/{id}/withdraw": { "post": {
 			"operationId": "withdrawEmailRuleRequest",
 			"summary": "Withdraw a rule request",
-			"description": "Withdraws a pending request you made. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Withdraws a pending request you made. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24156,7 +24169,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_request_proposer_only: only the member who made the request may withdraw it.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_request_proposer_only: only the member who made the request may withdraw it.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -24196,7 +24209,7 @@ const openapiDocument = {
 		"/email-rule-requests/{id}/accept": { "post": {
 			"operationId": "acceptEmailRuleRequest",
 			"summary": "Accept a rule request",
-			"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked: each email in full with its attachments, but never raw. It does not go back through mail already received. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. To try it on an email that has not arrived, pass the request's tree to POST /v1/email-rules/test-sample with one you make up, or have look-alikes written (POST /v1/email-rules/look-alikes with request_id); neither stores anything. expectation_samples are kept on the rule it writes. Accepting also needs mail:share_own. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked: each email in full with its attachments, but never raw. It does not go back through mail already received. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. To try it on an email that has not arrived, pass the request's tree to POST /v1/email-rules/test-sample with one you make up, or have look-alikes written (POST /v1/email-rules/look-alikes with request_id); neither stores anything. expectation_samples are kept on the rule it writes. Accepting also needs mail:share_own. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24256,7 +24269,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_request_target_only: only the member the request was made to may accept it. forbidden with details.reason first_party_required: accepted from another OAuth app or with an agent token. grant_forbidden with details.permission mail:share_own: the caller's role does not let them share their own mail through email rules.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_request_target_only: only the member the request was made to may accept it. forbidden with details.reason first_party_required: accepted from another OAuth app or with an agent token. grant_forbidden with details.permission mail:share_own: the caller's role does not let them share their own mail through email rules.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -24300,7 +24313,7 @@ const openapiDocument = {
 		"/email-rule-shares": { "get": {
 			"operationId": "listEmailRuleShares",
 			"summary": "List rule shares",
-			"description": "Lists rules shared with you, rules you share, or every share you can see. A share is visible to its two people and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Lists rules shared with you, rules you share, or every share you can see. A share is visible to its two people and the organization's owners and admins. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
@@ -24401,7 +24414,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -24550,7 +24563,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getEmailRuleShare",
 				"summary": "Get a rule share",
-				"description": "One share. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "One share. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -24598,7 +24611,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -24845,7 +24858,7 @@ const openapiDocument = {
 		"/email-rules/covering-me": { "get": {
 			"operationId": "listEmailRulesCoveringMe",
 			"summary": "List the rules over your mail",
-			"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, and the member each belongs to, or the organization. You do not see which keys, webhooks or shares they are (no ids, names, prefixes or URLs), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24911,7 +24924,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -24943,7 +24956,7 @@ const openapiDocument = {
 		"/email-rules/covering-me/{id}": { "get": {
 			"operationId": "getEmailRuleCoveringMe",
 			"summary": "Get a rule over your mail",
-			"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, and the member each belongs to, or the organization. You do not see which keys, webhooks or shares they are (no ids, names, prefixes or URLs), the other inboxes and domains its scope names, or its saved expectations. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24991,7 +25004,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -25027,7 +25040,7 @@ const openapiDocument = {
 		"/email-rules/covering-me/{id}/decisions": { "get": {
 			"operationId": "listEmailRuleDecisionsOnMyMail",
 			"summary": "List what a rule decided about your mail",
-			"description": "What a rule that covers your mailboxes, or decided on your mail, decided about mail at your own mailboxes, newest first: never about anyone else's mail. Each decision is in the words of the version that made it, which can be earlier than the current one: the questions it asked about that email (question_answers) and the columns its conditions read (parts). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"description": "What a rule that covers your mailboxes, or decided on your mail, decided about mail at your own mailboxes, newest first: never about anyone else's mail. Each decision is in the words of the version that made it, which can be earlier than the current one: the questions it asked about that email (question_answers) and the columns its conditions read (parts). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
@@ -25117,7 +25130,135 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and what a rule decided is read from what emails say.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and what a rule decided is read from what emails say.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/email-rules/covering-me/{id}/versions": { "get": {
+			"operationId": "listEmailRuleVersionsCoveringMe",
+			"summary": "Read versions of a rule over your mail",
+			"description": "The versions of a rule that covers one of your own mailboxes now that applied to your mail: its current version and each earlier one that decided on mail at your own mailboxes, so a decision can be read in the words of the version that made it. Each has what the covering view shows of a version: its wording, tree, explanation and assumptions. A version that did neither is not listed. Without versions, newest first, a page at a time (meta.cursor); with versions, only those named that are listed, oldest first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+			"tags": ["Email Rule Oversight"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [
+				{
+					"name": "id",
+					"in": "path",
+					"required": true,
+					"description": "The rule id.",
+					"schema": {
+						"type": "string",
+						"format": "uuid"
+					}
+				},
+				{
+					"name": "limit",
+					"in": "query",
+					"required": false,
+					"description": "Versions per page when versions is not given: 1 to 100, default 50.",
+					"schema": {
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 100
+					}
+				},
+				{
+					"name": "cursor",
+					"in": "query",
+					"required": false,
+					"description": "meta.cursor from the preceding page. Omit for the first page. Not with versions.",
+					"schema": {
+						"type": "string",
+						"maxLength": 200
+					}
+				},
+				{
+					"name": "versions",
+					"in": "query",
+					"required": false,
+					"description": "Read only these version numbers, comma-separated, at most 100. Not with limit or cursor.",
+					"schema": {
+						"description": "Read only these version numbers, comma-separated. Without it, the versions listed, newest first, a page at a time.",
+						"type": "string",
+						"pattern": "^[1-9]\\d{0,8}(,[1-9]\\d{0,8}){0,99}$"
+					}
+				}
+			],
+			"responses": {
+				"200": {
+					"description": "Read versions of a rule over your mail",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": {
+							"data": { "$ref": "#/components/schemas/ListEmailRuleVersionsCoveringMeResult" },
+							"meta": {
+								"$ref": "#/components/schemas/CursorPageMeta",
+								"description": "Absent when versions is given."
+							}
+						}
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"400": {
+					"description": "validation_error: a cursor not returned in meta.cursor, or versions with limit or cursor.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI. forbidden with details.reason no_longer_covers: it decided on your mail before but covers none of your mailboxes now; details.covering_view (getEmailRuleCoveringMe) shows the version that last decided on your mail.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -25154,7 +25295,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRuleObjection",
 				"summary": "Object to a rule over your mail",
-				"description": "Asks the author of a rule that covers one of your own mailboxes now to turn it off. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+				"description": "Asks the author of a rule that covers one of your own mailboxes now to turn it off. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 				"tags": ["Email Rule Oversight"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -25200,7 +25341,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -25255,7 +25396,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "listEmailRuleObjections",
 				"summary": "List objections",
-				"description": "Objections you made, objections to rules you wrote, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+				"description": "Objections you made and objections to rules you wrote (by default), only one of the two, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 				"tags": ["Email Rule Oversight"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [
@@ -25263,12 +25404,13 @@ const openapiDocument = {
 						"name": "box",
 						"in": "query",
 						"required": false,
-						"description": "outgoing (the default): objections you made. incoming: objections to rules you wrote. all: every objection you can see.",
+						"description": "mine (the default): objections you made and objections to rules you wrote, each saying which (is_objector, is_author). outgoing: only those you made. incoming: only those to rules you wrote. all: every objection you can see.",
 						"schema": {
-							"default": "outgoing",
-							"description": "outgoing: objections you made; incoming: objections to rules you wrote; all: every objection you can see (owners and admins see the organization's).",
+							"default": "mine",
+							"description": "mine: objections you made and objections to rules you wrote (is_objector or is_author says which); outgoing: only those you made; incoming: only those to rules you wrote; each in your current membership. all: every objection you can see (owners and admins see the organization's).",
 							"type": "string",
 							"enum": [
+								"mine",
 								"outgoing",
 								"incoming",
 								"all"
@@ -25355,7 +25497,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
+						"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -25388,7 +25530,7 @@ const openapiDocument = {
 		"/email-rule-objections/{id}": { "get": {
 			"operationId": "getEmailRuleObjection",
 			"summary": "Get an objection",
-			"description": "One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"description": "One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -25436,7 +25578,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -25472,7 +25614,7 @@ const openapiDocument = {
 		"/email-rule-objections/{id}/withdraw": { "post": {
 			"operationId": "withdrawEmailRuleObjection",
 			"summary": "Withdraw an objection",
-			"description": "Withdraws a pending objection you made, and clears its message. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"description": "Withdraws a pending objection you made, and clears its message. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -25530,7 +25672,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI. forbidden with details.reason objector_only: only the member who made it can withdraw it.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI. forbidden with details.reason objector_only: only the member who made it can withdraw it.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -25570,7 +25712,7 @@ const openapiDocument = {
 		"/email-rule-objections/{id}/decline": { "post": {
 			"operationId": "declineEmailRuleObjection",
 			"summary": "Decline an objection to your rule",
-			"description": "Declines a pending objection to a rule you wrote, optionally saying why; the rule stays as it is. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"description": "Declines a pending objection to a rule you wrote, optionally saying why; the rule stays as it is. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -25645,7 +25787,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI. forbidden with details.reason author_only: only the rule's author can decline it.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI. forbidden with details.reason author_only: only the rule's author can decline it.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -25685,7 +25827,7 @@ const openapiDocument = {
 		"/email-rule-objections/{id}/accept": { "post": {
 			"operationId": "acceptEmailRuleObjection",
 			"summary": "Accept an objection to your rule",
-			"description": "Accepts a pending objection to a rule you wrote: turns the rule off (state draft), as updating it would, and records the objection accepted, together. You can turn the rule on again later. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"description": "Accepts a pending objection to a rule you wrote: turns the rule off (state draft), as updating it would, and records the objection accepted, together. You can turn the rule on again later. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -25743,7 +25885,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI. forbidden with details.reason author_only: only the rule's author can accept it.",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI. forbidden with details.reason author_only: only the rule's author can accept it.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -26102,6 +26244,218 @@ const openapiDocument = {
 				}
 			}]
 		} },
+		"/mail-imports/google/messages": { "post": {
+			"operationId": "importGoogleMailMessage",
+			"summary": "Import one historical Google Workspace message",
+			"description": "Requires the organization email_import entitlement, granted by staff. Only the configured current owner, using a full personal session or verified first-party CLI, may import into the configured primary mailbox. Primitive verifies the transient provider token and fetches RAW content itself. No raw uploads or client provenance are accepted. Sent, draft, spam and trash messages are skipped. Historical mail appears in normal history without live delivery effects. An indeterminate response requires retrying the same provider ID. User provider credentials are never stored or queued.",
+			"tags": ["Emails"],
+			"security": [{ "BearerAuth": [] }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImportGoogleMailMessageRequest" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Import one historical Google Workspace message",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/ImportGoogleMailMessageResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"400": {
+					"description": "Invalid request parameters",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "validation_error",
+								"message": "Invalid domain format"
+							}
+						}
+					} }
+				},
+				"401": {
+					"description": "mail_import_provider_auth: reauthorize the provider.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"403": {
+					"description": "feature_disabled: the organization lacks email_import; or mail_import_forbidden: identity or current access differs.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"409": {
+					"description": "mail_import_cap_exceeded or mail_import_storage_limit: the fixed pilot budget is exhausted.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"422": {
+					"description": "Mail import input, content, storage or publication fence could not be accepted.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				},
+				"502": {
+					"description": "Provider acquisition failed or exceeded its deadline.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"503": {
+					"description": "mail_import_disabled or mail_import_unavailable; retry the same ID after resolving the cause.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				}
+			},
+			"parameters": [{
+				"in": "header",
+				"name": "X-Primitive-Google-Access-Token",
+				"required": true,
+				"description": "Transient provider user access token. Send only in this redacted header, never in a URL or JSON body. Uses the dedicated configured desktop client and readonly/identity scopes.",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 8192,
+					"writeOnly": true
+				}
+			}, {
+				"name": "Idempotency-Key",
+				"in": "header",
+				"required": false,
+				"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 255
+				}
+			}],
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/mail-imports/google/reconcile": { "post": {
+			"operationId": "reconcileGoogleMailImport",
+			"summary": "Reconcile scoped historical import attempts",
+			"description": "The same configured owner may recover expired attempts after the email_import entitlement is revoked. Recovery does not require that entitlement. Selects only server-owned manifests for the configured mailbox/account/policy. No provider token, object keys, prefixes or email IDs are accepted. Unsettled uploads remain unresolved and charged; this operation does not promise automatic cleanup after a process dies.",
+			"tags": ["Emails"],
+			"security": [{ "BearerAuth": [] }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReconcileGoogleMailImportRequest" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Reconcile scoped historical import attempts",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/ReconcileGoogleMailImportResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"400": {
+					"description": "Invalid request parameters",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "validation_error",
+								"message": "Invalid domain format"
+							}
+						}
+					} }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "mail_import_forbidden: current owner access is required.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				},
+				"503": {
+					"description": "mail_import_disabled: no valid policy is configured; or mail_import_unavailable.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				}
+			},
+			"x-primitive-permission": ["mail:read"],
+			"parameters": [{
+				"name": "Idempotency-Key",
+				"in": "header",
+				"required": false,
+				"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 255
+				}
+			}]
+		} },
 		"/emails/{id}/signal": { "post": {
 			"operationId": "signalEmail",
 			"summary": "Send a read, working or typing signal about an email",
@@ -34312,7 +34666,7 @@ const openapiDocument = {
 				"summary": "List API keys",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). Revoked keys are left out unless include_revoked is true, which lists them too with status revoked, revoked_at and revoked_by, under the same access rules as keys that work. A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+				"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). Revoked keys are left out unless include_revoked is true, which lists them too with status revoked, revoked_at and revoked_by, under the same access rules as keys that work. A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. grant.mail_scope.rule_versions gives each rule it lists directly its current_version, state and version_saved_at. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 				"x-primitive-person-only": { "access": "session_or_cli" },
 				"parameters": [{
 					"name": "cursor",
@@ -34763,7 +35117,7 @@ const openapiDocument = {
 				"summary": "Get an API key",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "One key's metadata, never its secret, with whether it works now (status). A revoked key whose record is kept is answered too, with status revoked, revoked_at and revoked_by, under the same access rules as a key that works: one the caller may not read is 404, revoked or not. Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+				"description": "One key's metadata, never its secret, with whether it works now (status). A revoked key whose record is kept is answered too, with status revoked, revoked_at and revoked_by, under the same access rules as a key that works: one the caller may not read is 404, revoked or not. Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. grant.mail_scope.rule_versions gives each rule it lists directly its current_version, state and version_saved_at. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 				"x-primitive-person-only": { "access": "session_or_cli" },
 				"parameters": [{
 					"name": "id",
@@ -37500,7 +37854,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getRelayAutoJoin",
 				"summary": "Get the auto-join setting",
-				"description": "Whether someone who proves an address on the organization's mail relay domain with Google Workspace joins automatically, and with what access. `option` is null when auto-join is off and an invitation is required; `options` lists the choices. Answers 404 `feature_disabled` unless the organization has mail relay.",
+				"description": "Whether someone who proves an address on the organization's mail relay domain with Google Workspace joins automatically. Auto-joined people have no mail access until an owner or admin assigns a role. `option` is null when auto-join is off and an invitation is required; legacy mail-grant settings read as `no_access`. `options` lists the choices. Answers 404 `feature_disabled` unless the organization has mail relay.",
 				"tags": ["Roles and members"],
 				"security": [{ "BearerAuth": [] }],
 				"responses": {
@@ -37587,7 +37941,7 @@ const openapiDocument = {
 			"put": {
 				"operationId": "setRelayAutoJoin",
 				"summary": "Change the auto-join setting",
-				"description": "`option` is a choice's id from the GET, or null to require an invitation (turning it off needs only members:manage). Choosing an option answers 404 `feature_disabled` unless the organization has mail relay, 400 `validation_error` for an id that is not one of the choices, 403 `grant_forbidden` unless the caller is an owner or admin who can assign roles and send invitations and covers the role the option gives, 409 `role_key_taken` when a custom role already holds that role's key, and 409 `role_assignment_unavailable` when the organization cannot be given that role yet. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `relay_auto_join.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage, and roles:assign to turn it on. API keys are refused.",
+				"description": "`option` is a choice's id from the GET, or null to require an invitation (turning it off needs only members:manage). Auto-joined people have no mail access until an owner or admin assigns a role; legacy mail-grant choices cannot be selected. Choosing an option answers 404 `feature_disabled` unless the organization has mail relay, 400 `validation_error` for an id outside the current catalog, 403 `grant_forbidden` without owner or admin assignment authority, and 409 `role_assignment_unavailable` when the restricted role cannot be assigned yet. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `relay_auto_join.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage, and roles:assign to turn it on. API keys are refused.",
 				"tags": ["Roles and members"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -40313,6 +40667,7 @@ const openapiDocument = {
 									"build_failed",
 									"builder_unavailable",
 									"builtin_role",
+									"chunk_size_mismatch",
 									"chunk_too_large",
 									"chunks_missing",
 									"claim_failed",
@@ -40397,6 +40752,7 @@ const openapiDocument = {
 									"invalid_code",
 									"invalid_cursor",
 									"invalid_email",
+									"invalid_manifest",
 									"invalid_payload_reference",
 									"invalid_request",
 									"invalid_signature",
@@ -40419,6 +40775,22 @@ const openapiDocument = {
 									"latest_message_mismatch",
 									"latest_message_thread_unresolved",
 									"load_test_recipient_not_allowed",
+									"mail_import_cap_exceeded",
+									"mail_import_content_mismatch",
+									"mail_import_deadline",
+									"mail_import_disabled",
+									"mail_import_fenced",
+									"mail_import_forbidden",
+									"mail_import_invalid_input",
+									"mail_import_invalid_provider_response",
+									"mail_import_out_of_window",
+									"mail_import_policy_mismatch",
+									"mail_import_provider_auth",
+									"mail_import_provider_unavailable",
+									"mail_import_storage_failed",
+									"mail_import_storage_limit",
+									"mail_import_too_large",
+									"mail_import_unavailable",
 									"mail_relay_unavailable",
 									"mail_routing_conflict",
 									"mail_topic_edit_conflict",
@@ -42607,6 +42979,35 @@ const openapiDocument = {
 						"format": "uuid",
 						"description": "With `group=message`: the send of this message, when you can read it (under a connected agent key, only its own sends)."
 					},
+					"imported": {
+						"type": ["object", "null"],
+						"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
+						"required": [
+							"from",
+							"method",
+							"verification",
+							"at"
+						],
+						"properties": {
+							"from": {
+								"type": "string",
+								"enum": ["google_workspace"]
+							},
+							"method": {
+								"type": "string",
+								"enum": ["primitive_direct"]
+							},
+							"verification": {
+								"type": "string",
+								"enum": ["provider_fetched"]
+							},
+							"at": {
+								"type": "string",
+								"format": "date-time",
+								"description": "When Primitive acquired this historical message."
+							}
+						}
+					},
 					"snippet": {
 						"type": ["string", "null"],
 						"maxLength": 200,
@@ -42629,6 +43030,7 @@ const openapiDocument = {
 					"automated_reasons",
 					"from_verified",
 					"from_header_email",
+					"imported",
 					"snippet"
 				]
 			},
@@ -43252,6 +43654,40 @@ const openapiDocument = {
 							}
 						}
 					},
+					"attachments": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailAttachment" },
+						"description": "Attachment metadata (file name, type, size), the same items in the same order as `parsed.attachments`. Kept for a credential that reads headers only, where `parsed` is null. Empty when the email has none, its content is withheld (read `status` and `rejection_reason`), or it is not parsed yet or its parse failed (read `parse_status`). No bytes; download a part with `/emails/{id}/attachments/{part_index}`."
+					},
+					"imported": {
+						"type": ["object", "null"],
+						"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
+						"required": [
+							"from",
+							"method",
+							"verification",
+							"at"
+						],
+						"properties": {
+							"from": {
+								"type": "string",
+								"enum": ["google_workspace"]
+							},
+							"method": {
+								"type": "string",
+								"enum": ["primitive_direct"]
+							},
+							"verification": {
+								"type": "string",
+								"enum": ["provider_fetched"]
+							},
+							"at": {
+								"type": "string",
+								"format": "date-time",
+								"description": "When Primitive acquired this historical message."
+							}
+						}
+					},
 					"snippet": {
 						"type": ["string", "null"],
 						"maxLength": 200,
@@ -43281,6 +43717,8 @@ const openapiDocument = {
 					"from_verified",
 					"from_header_email",
 					"from_name",
+					"attachments",
+					"imported",
 					"snippet"
 				]
 			},
@@ -43802,6 +44240,35 @@ const openapiDocument = {
 						"items": { "$ref": "#/components/schemas/EmailAttachment" },
 						"description": "Attachment metadata for this message, each item as its own detail read reports it: `parsed.attachments` on `/emails/{id}` for inbound, `attachments` on `/sent-emails/{id}` for outbound, in the same order. Empty when there are none or an inbound message has no parsed content. No bytes or download URLs; download a part with `/emails/{id}/attachments/{part_index}` or `/sent-emails/{id}/attachments/{part_index}`."
 					},
+					"imported": {
+						"type": ["object", "null"],
+						"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
+						"required": [
+							"from",
+							"method",
+							"verification",
+							"at"
+						],
+						"properties": {
+							"from": {
+								"type": "string",
+								"enum": ["google_workspace"]
+							},
+							"method": {
+								"type": "string",
+								"enum": ["primitive_direct"]
+							},
+							"verification": {
+								"type": "string",
+								"enum": ["provider_fetched"]
+							},
+							"at": {
+								"type": "string",
+								"format": "date-time",
+								"description": "When Primitive acquired this historical message."
+							}
+						}
+					},
 					"copies": {
 						"type": "array",
 						"items": {
@@ -44072,6 +44539,33 @@ const openapiDocument = {
 							}
 						}
 					},
+					"unsubscribe": {
+						"type": "object",
+						"additionalProperties": false,
+						"required": ["url"],
+						"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+						"properties": {
+							"url": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 700,
+								"pattern": "^[Hh][Tt][Tt][Pp][Ss]://(?:[A-Za-z0-9\\-._~:/?#\\[\\]@!$&'()*+;=]|%[0-9A-Fa-f]{2})+$",
+								"description": "Absolute https URL that unsubscribes the recipient, at most 700 characters of URL characters only: printable ASCII with no spaces, double quotes, angle brackets or commas (percent-encode a comma as %2C), `%` only as a percent-encoded byte, `[` and `]` only around an IPv6 address host, a port from 1 to 65535, no `=?` (which mail readers can decode as an encoded word), and no user name or password. The host must be public: not a single-label name, `localhost` or a name under `.localhost`, `.internal`, `.local`, `.home.arpa` or `.localdomain`, or a loopback, link-local, private, shared, reserved, multicast or unspecified IP address, including an IPv6 address that embeds one. The scheme is written in lower case."
+							},
+							"one_click": {
+								"type": "boolean",
+								"default": true,
+								"description": "Whether to also write `List-Unsubscribe-Post: List-Unsubscribe=One-Click`, which tells the receiver it may unsubscribe with a single POST to `url`. Set false when `url` needs the recipient to open a page and confirm."
+							},
+							"mailto": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 254,
+								"pattern": "^[A-Za-z0-9!$'*+=_~-]+(?:\\.[A-Za-z0-9!$'*+=_~-]+)*@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$",
+								"description": "An address to also offer as a `mailto:` unsubscribe, written after `url`. The address alone, without the `mailto:` prefix: at most 64 letters, digits and `.!$'*+=_~-` before the `@`, and a dotted domain after it. An `=` is written as `%3D` in the header."
+							}
+						}
+					},
 					"headers": {
 						"type": "object",
 						"maxProperties": 25,
@@ -45117,6 +45611,33 @@ const openapiDocument = {
 						"type": "boolean",
 						"description": "Send an informational message the receiver need not answer or wake for. It is sent as an `ack` signal (status `received`) about the message in `in_reply_to`, whose note is `body_text` (at most 2000 characters, which may be omitted). Receivers see it as `fyi: true`. Plain text only: it cannot be combined with `body_html`, `attachments`, `payload_attachments` or `scheduled_at`, and on `/send-mail` it requires `in_reply_to`."
 					},
+					"unsubscribe": {
+						"type": "object",
+						"additionalProperties": false,
+						"required": ["url"],
+						"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+						"properties": {
+							"url": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 700,
+								"pattern": "^[Hh][Tt][Tt][Pp][Ss]://(?:[A-Za-z0-9\\-._~:/?#\\[\\]@!$&'()*+;=]|%[0-9A-Fa-f]{2})+$",
+								"description": "Absolute https URL that unsubscribes the recipient, at most 700 characters of URL characters only: printable ASCII with no spaces, double quotes, angle brackets or commas (percent-encode a comma as %2C), `%` only as a percent-encoded byte, `[` and `]` only around an IPv6 address host, a port from 1 to 65535, no `=?` (which mail readers can decode as an encoded word), and no user name or password. The host must be public: not a single-label name, `localhost` or a name under `.localhost`, `.internal`, `.local`, `.home.arpa` or `.localdomain`, or a loopback, link-local, private, shared, reserved, multicast or unspecified IP address, including an IPv6 address that embeds one. The scheme is written in lower case."
+							},
+							"one_click": {
+								"type": "boolean",
+								"default": true,
+								"description": "Whether to also write `List-Unsubscribe-Post: List-Unsubscribe=One-Click`, which tells the receiver it may unsubscribe with a single POST to `url`. Set false when `url` needs the recipient to open a page and confirm."
+							},
+							"mailto": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 254,
+								"pattern": "^[A-Za-z0-9!$'*+=_~-]+(?:\\.[A-Za-z0-9!$'*+=_~-]+)*@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$",
+								"description": "An address to also offer as a `mailto:` unsubscribe, written after `url`. The address alone, without the `mailto:` prefix: at most 64 letters, digits and `.!$'*+=_~-` before the `@`, and a dotted domain after it. An `=` is written as `%3D` in the header."
+							}
+						}
+					},
 					"headers": {
 						"type": "object",
 						"maxProperties": 25,
@@ -50236,7 +50757,7 @@ const openapiDocument = {
 								},
 								"state": {
 									"type": "string",
-									"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule began covering your mailbox), new_version, or baseline (it already covered you when notices began)."
+									"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule was made or turned active over your mailboxes, or an active rule came to reach you; once per rule, not per mailbox), new_version, or baseline (it already covered you when notices began). pending: a rule started covering your mailbox and the notices have not recorded that start yet (a restart within an hour of the last start notice is recorded without a new one); its id is then the rule's, and created_at when the rule last changed."
 								},
 								"created_at": {
 									"type": "string",
@@ -50245,7 +50766,7 @@ const openapiDocument = {
 								"ended_at": {
 									"type": ["string", "null"],
 									"format": "date-time",
-									"description": "When it was deleted, replaced or revoked, when an API key expired, when a repeating send stopped, or when a rule request or objection was decided (accepted, declined or withdrawn); null otherwise."
+									"description": "When it was deleted, replaced or revoked, when an API key expired, when a repeating send stopped, or when a rule request or objection was decided (accepted, declined or withdrawn); null otherwise, as on every coverage notice."
 								},
 								"owned_now": {
 									"type": "string",
@@ -50273,6 +50794,11 @@ const openapiDocument = {
 										"id",
 										"name"
 									]
+								},
+								"rule_id": {
+									"description": "For email_rule_coverage, always: the rule it is about, since names need not be unique (for pending, the same as id). GET /v1/email-rules/covering-me/{rule_id} shows the rule while it covers you, or as it last decided on your mail; otherwise it answers not_found.",
+									"type": "string",
+									"format": "uuid"
 								}
 							},
 							"required": [
@@ -50315,6 +50841,15 @@ const openapiDocument = {
 					"next_cursor": {
 						"description": "Pass as cursor to read the next page; null on the last page. A page can hold fewer items than limit, or none, while next_cursor is set.",
 						"type": ["string", "null"]
+					},
+					"as_of": {
+						"type": ["string", "null"],
+						"format": "date-time",
+						"description": "With relation=concerning only: about when the notices last looked at your organization; null if never or unread. Coverage since may have no notice yet."
+					},
+					"pending_complete": {
+						"description": "With relation=concerning, on the first page only: whether the check for rules that started covering you without their start notice (state pending, listed ahead of the notices and beyond limit) was finished. false: some may be missing. Absent where there is nothing to check.",
+						"type": "boolean"
 					}
 				},
 				"required": [
@@ -50514,7 +51049,7 @@ const openapiDocument = {
 					"checked": {
 						"type": "integer",
 						"minimum": 0,
-						"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+						"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 					},
 					"matched": {
 						"type": "integer",
@@ -50524,6 +51059,33 @@ const openapiDocument = {
 				},
 				"required": ["checked", "matched"]
 			},
+			"EmailRuleScopeSelection": {
+				"type": "object",
+				"properties": {
+					"addresses": {
+						"maxItems": 100,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"minLength": 3,
+							"maxLength": 320,
+							"pattern": "^[^\\s@]+@[^\\s@]+$"
+						}
+					},
+					"domains": {
+						"maxItems": 50,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 253,
+							"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+						}
+					}
+				},
+				"additionalProperties": false,
+				"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
+			},
 			"CompileEmailRuleRequest": {
 				"type": "object",
 				"properties": {
@@ -50541,7 +51103,17 @@ const openapiDocument = {
 					"include_sql": {
 						"description": "Also return the SQL the rule renders to. Off by default.",
 						"type": "boolean"
-					}
+					},
+					"evaluation_scope": {
+						"description": "The scope breadth is counted over, as a test of the tree runs it: send the one you will save the rule with. Nothing is saved. own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those mail:share_own lets you share). author: all you can read, inboxes added later included. selected: what scope_selection names.",
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						]
+					},
+					"scope_selection": { "$ref": "#/components/schemas/EmailRuleScopeSelection" }
 				},
 				"required": ["english"],
 				"additionalProperties": false
@@ -50562,14 +51134,23 @@ const openapiDocument = {
 					"warnings": {
 						"type": "array",
 						"items": { "type": "string" },
-						"description": "Parts of the description the column contract cannot express, and how the rule handles them. It also has notes on reading automated, from_mailing_list or sender_relationship, a sender address the description does not give, and a grant worded as a prohibition. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
+						"description": "Parts of the description the column contract cannot express, how the rule handles them, and the compiler's own notes on the rule (the Email Rules docs list them). When the rule has no questions and its conditions hold for nearly all of your recent mail (see breadth), or it is a grant rule whose conditions alone hold for over 20% of at least 20 emails (see conditions_breadth), the first warning says so."
 					},
 					"compiled_by": {
 						"type": "string",
 						"description": "An opaque name for the version of the rule compiler that produced the rule, such as rule-compiler-v1. Send it back as compiled_by when you save the rule."
 					},
+					"kind": {
+						"description": "The kind it was compiled for. Send it with the tree to a test.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
 					"breadth": {
-						"description": "How many of your recent emails its conditions hold for, counted over your own mailboxes whatever scope you save it with, warning or not. Null when not counted in full: a rule with questions, headers-only access, no test of it possible as you, or a count that failed or ran out of time. Writes ignore it, so a compile answer (without include_sql) can be sent back unchanged.",
+						"description": "How many recent emails its conditions hold for, warning or not, counted over evaluation_scope as sent (by default your own mailboxes, whatever scope you save it with). Null when not counted in full: a rule with questions, headers-only access, no test of it possible as you, a count that failed or ran out of time, or, with no scope sent, a rule that holds only for mail to To or Cc addresses outside your own mailboxes (a warning says so). Writes ignore it, so a compile answer (without include_sql) can be sent back unchanged.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
+					"conditions_breadth": {
+						"description": "For a grant rule with questions, breadth counted on its conditions alone: the emails its questions are asked about. Null for any other rule, or when not counted in full (as breadth).",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
 					"sql": {
@@ -50597,6 +51178,34 @@ const openapiDocument = {
 					"compiled_by"
 				]
 			},
+			"EmailRuleTested": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": ["string", "null"],
+						"format": "uuid"
+					},
+					"version": {
+						"type": ["integer", "null"],
+						"exclusiveMinimum": 0
+					},
+					"vocabulary": { "type": "string" },
+					"kind": {
+						"description": "The kind it was tested as.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
+					"note": {
+						"description": "Present when a tree was sent without kind, so it was tested as grant.",
+						"type": "string"
+					}
+				},
+				"required": [
+					"id",
+					"version",
+					"vocabulary"
+				]
+			},
 			"EmailRuleScopeWarning": {
 				"type": "object",
 				"properties": {
@@ -50714,33 +51323,6 @@ const openapiDocument = {
 				],
 				"additionalProperties": false
 			},
-			"EmailRuleScopeSelection": {
-				"type": "object",
-				"properties": {
-					"addresses": {
-						"maxItems": 100,
-						"type": "array",
-						"items": {
-							"type": "string",
-							"minLength": 3,
-							"maxLength": 320,
-							"pattern": "^[^\\s@]+@[^\\s@]+$"
-						}
-					},
-					"domains": {
-						"maxItems": 50,
-						"type": "array",
-						"items": {
-							"type": "string",
-							"minLength": 1,
-							"maxLength": 253,
-							"pattern": "^[^\\s@]+\\.[^\\s@]+$"
-						}
-					}
-				},
-				"additionalProperties": false,
-				"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
-			},
 			"EmailRuleExpectationSampleInput": {
 				"type": "object",
 				"properties": {
@@ -50827,6 +51409,16 @@ const openapiDocument = {
 							"pattern": "^[^\\u0000]*$"
 						}
 					},
+					"attachment_names": {
+						"maxItems": 10,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 255,
+							"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+						}
+					},
 					"automated": { "type": "boolean" },
 					"from_mailing_list": { "type": "boolean" },
 					"spam_score": {
@@ -50860,7 +51452,7 @@ const openapiDocument = {
 					},
 					"scope_selection": { "$ref": "#/components/schemas/EmailRuleScopeSelection" },
 					"rule_id": {
-						"description": "A saved rule you can see. Its current version is tested, with its author's access.",
+						"description": "A saved rule you can see. Its current version is tested, with its author's access; one you see only because it covers your mailboxes, with yours, over only those (dashboard or Primitive CLI only).",
 						"type": "string",
 						"format": "uuid"
 					},
@@ -50917,25 +51509,7 @@ const openapiDocument = {
 			"TestEmailRuleResult": {
 				"type": "object",
 				"properties": {
-					"rule": {
-						"type": "object",
-						"properties": {
-							"id": {
-								"type": ["string", "null"],
-								"format": "uuid"
-							},
-							"version": {
-								"type": ["integer", "null"],
-								"exclusiveMinimum": 0
-							},
-							"vocabulary": { "type": "string" }
-						},
-						"required": [
-							"id",
-							"version",
-							"vocabulary"
-						]
-					},
+					"rule": { "$ref": "#/components/schemas/EmailRuleTested" },
 					"window": {
 						"type": "object",
 						"properties": {
@@ -51183,6 +51757,11 @@ const openapiDocument = {
 								"minimum": 0,
 								"description": "Emails decided on their conditions: matched, near_miss and no_match, less any missing a fact the rule reads."
 							},
+							"conditions_held": {
+								"description": "Of decided, how many its conditions alone held for. Compile's breadth and conditions_breadth count this over recent mail in the scope sent to it, by default your own; here it is counted over the emails this test decided.",
+								"type": "integer",
+								"minimum": 0
+							},
 							"conditions": {
 								"type": "array",
 								"items": {
@@ -51250,7 +51829,7 @@ const openapiDocument = {
 							"warnings": {
 								"type": "array",
 								"items": { "type": "string" },
-								"description": "What to look at first, such as what stopped every email when nothing matched."
+								"description": "What to look at first, such as what stopped every email when nothing matched. On a test of the recent window, a grant rule whose conditions held for more than 20% of at least 20 emails checked (at least 90% if it has no questions), or for every one of fewer, gets a warning saying so, before those about what it decided."
 							}
 						},
 						"required": [
@@ -51406,6 +51985,10 @@ const openapiDocument = {
 								"type": "array",
 								"items": { "type": "string" }
 							},
+							"attachment_names": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
 							"automated": { "type": "boolean" },
 							"from_mailing_list": { "type": "boolean" }
 						},
@@ -51416,6 +51999,7 @@ const openapiDocument = {
 							"subject",
 							"text",
 							"attachment_types",
+							"attachment_names",
 							"automated",
 							"from_mailing_list"
 						],
@@ -51491,7 +52075,7 @@ const openapiDocument = {
 					},
 					"scope_selection": { "$ref": "#/components/schemas/EmailRuleScopeSelection" },
 					"rule_id": {
-						"description": "A saved rule you can see: its current version and words.",
+						"description": "A saved rule you can see, or one that covers your mailboxes (as you, sent to one of them; dashboard or Primitive CLI only): its current version and words.",
 						"type": "string",
 						"format": "uuid"
 					},
@@ -51540,25 +52124,7 @@ const openapiDocument = {
 			"GenerateLookAlikesResult": {
 				"type": "object",
 				"properties": {
-					"rule": {
-						"type": "object",
-						"properties": {
-							"id": {
-								"type": ["string", "null"],
-								"format": "uuid"
-							},
-							"version": {
-								"type": ["integer", "null"],
-								"exclusiveMinimum": 0
-							},
-							"vocabulary": { "type": "string" }
-						},
-						"required": [
-							"id",
-							"version",
-							"vocabulary"
-						]
-					},
+					"rule": { "$ref": "#/components/schemas/EmailRuleTested" },
 					"look_alikes": {
 						"type": "array",
 						"items": { "$ref": "#/components/schemas/EmailRuleLookAlike" }
@@ -51621,7 +52187,7 @@ const openapiDocument = {
 					},
 					"scope_selection": { "$ref": "#/components/schemas/EmailRuleScopeSelection" },
 					"rule_id": {
-						"description": "A saved rule you can see. Its current version is tested.",
+						"description": "A saved rule you can see, or one that covers your mailboxes (as you; dashboard or Primitive CLI only). Its current version is tested.",
 						"type": "string",
 						"format": "uuid"
 					},
@@ -51692,6 +52258,17 @@ const openapiDocument = {
 									"maxLength": 255
 								}
 							},
+							"attachment_names": {
+								"description": "File names of those attachments, which the classifier and the questions read. With attachment_types, the same number, paired in order.",
+								"maxItems": 20,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 255,
+									"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+								}
+							},
 							"automated": {
 								"description": "Whether the email was sent automatically, as its headers would show. Defaults to false.",
 								"type": "boolean"
@@ -51722,25 +52299,7 @@ const openapiDocument = {
 			"TestEmailRuleOnSampleResult": {
 				"type": "object",
 				"properties": {
-					"rule": {
-						"type": "object",
-						"properties": {
-							"id": {
-								"type": ["string", "null"],
-								"format": "uuid"
-							},
-							"version": {
-								"type": ["integer", "null"],
-								"exclusiveMinimum": 0
-							},
-							"vocabulary": { "type": "string" }
-						},
-						"required": [
-							"id",
-							"version",
-							"vocabulary"
-						]
-					},
+					"rule": { "$ref": "#/components/schemas/EmailRuleTested" },
 					"received_at": {
 						"type": "string",
 						"format": "date-time",
@@ -51932,6 +52491,15 @@ const openapiDocument = {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it."
 					},
+					"pending_objections": {
+						"description": "To its author, on the dashboard or the Primitive CLI: objections to it waiting for their answer (GET /email-rule-objections). A write's answer leaves it out when it could not be read in time: absent is not 0.",
+						"type": "integer",
+						"minimum": 0
+					},
+					"objection_notice": {
+						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"type": "string"
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -51949,6 +52517,27 @@ const openapiDocument = {
 						"type": "array",
 						"items": { "$ref": "#/components/schemas/EmailRuleScopeWarning" }
 					},
+					"expectations": {
+						"description": "Its saved expectations, each list by email id, as stored: on every create, and on an update that set or removed them.",
+						"type": "object",
+						"properties": {
+							"match": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"format": "uuid"
+								}
+							},
+							"no_match": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"format": "uuid"
+								}
+							}
+						},
+						"required": ["match", "no_match"]
+					},
 					"expectation_samples": {
 						"description": "Its saved made-up emails, when this write set or added some.",
 						"type": "array",
@@ -52046,6 +52635,14 @@ const openapiDocument = {
 							"endpoints",
 							"shares_ended"
 						]
+					},
+					"notice": {
+						"description": "After a write that saved a version of an active rule keys or webhooks read without checking it first: what it changes, and how to have the next one checked.",
+						"type": "string"
+					},
+					"share_notice": {
+						"description": "After a write that ended the rule's share: that it did, given even when affects is not, with whom it was with and the version they accepted when those can be read.",
+						"type": "string"
 					}
 				},
 				"required": [
@@ -52268,7 +52865,7 @@ const openapiDocument = {
 						}
 					},
 					"warnings": {
-						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
+						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test, or on a grant rule that tests only who an email was sent to (on a rule request, every compiler note on the rule).",
 						"maxItems": 10,
 						"type": "array",
 						"items": {
@@ -52286,6 +52883,10 @@ const openapiDocument = {
 					"breadth": {
 						"description": "Ignored (the compile answer's breadth).",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
+					"conditions_breadth": {
+						"description": "Ignored.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					}
 				},
 				"required": [
@@ -52355,6 +52956,15 @@ const openapiDocument = {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it."
 					},
+					"pending_objections": {
+						"description": "To its author, on the dashboard or the Primitive CLI: objections to it waiting for their answer (GET /email-rule-objections). A write's answer leaves it out when it could not be read in time: absent is not 0.",
+						"type": "integer",
+						"minimum": 0
+					},
+					"objection_notice": {
+						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"type": "string"
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -52453,6 +53063,15 @@ const openapiDocument = {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it."
 					},
+					"pending_objections": {
+						"description": "To its author, on the dashboard or the Primitive CLI: objections to it waiting for their answer (GET /email-rule-objections). A write's answer leaves it out when it could not be read in time: absent is not 0.",
+						"type": "integer",
+						"minimum": 0
+					},
+					"objection_notice": {
+						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"type": "string"
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -52550,7 +53169,7 @@ const openapiDocument = {
 						}
 					},
 					"warnings": {
-						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
+						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test, or on a grant rule that tests only who an email was sent to (on a rule request, every compiler note on the rule).",
 						"maxItems": 10,
 						"type": "array",
 						"items": {
@@ -52569,6 +53188,15 @@ const openapiDocument = {
 						"description": "Ignored (the compile answer's breadth).",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
+					"conditions_breadth": {
+						"description": "Ignored.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
+					"kind": {
+						"description": "Must be the rule's own (400 kind_mismatch).",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
 					"evaluation_scope": {
 						"type": "string",
 						"enum": [
@@ -52627,7 +53255,7 @@ const openapiDocument = {
 						"maximum": 2147483647
 					},
 					"if_expectations_pass": {
-						"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; on emails the rule cannot read: 409 expectations_unreadable; undecided: 409 expectations_undecided (each with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
+						"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; on emails the rule cannot read: 409 expectations_unreadable; undecided: 409 expectations_undecided (each with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged. Omitted: judged as with true when the write saves a version or changes the scope of an active rule that API keys or webhooks read and that has expectations. false: never judged first.",
 						"type": "boolean"
 					},
 					"restore_version": {
@@ -52675,6 +53303,10 @@ const openapiDocument = {
 					"other_keys": {
 						"description": "How many more keys, not revoked, list the rule that you may not read. They are not named.",
 						"type": "integer"
+					},
+					"share_notice": {
+						"description": "When the delete ended a share: that it did, with whom it was with and the version they accepted when those can be read.",
+						"type": "string"
 					}
 				},
 				"required": ["deleted"]
@@ -52849,11 +53481,16 @@ const openapiDocument = {
 								"count": {
 									"type": "integer",
 									"exclusiveMinimum": 0
+								},
+								"reads_in_full": {
+									"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
+									"type": "integer",
+									"minimum": 0
 								}
 							},
 							"required": ["owner", "count"]
 						},
-						"description": "API keys that work now (not revoked, expired or suspended) whose access lists the rule, or its live share: they read what it matches. Owner: the member who holds each, or the organization."
+						"description": "API keys that work now (not revoked, expired or suspended) and hold mail:read, whose access lists the rule or its live share. Owner: who holds each, or the organization."
 					},
 					"webhooks": {
 						"type": "array",
@@ -52894,11 +53531,21 @@ const openapiDocument = {
 								"count": {
 									"type": "integer",
 									"exclusiveMinimum": 0
+								},
+								"hosts": {
+									"description": "Distinct sites they deliver to (the domain a host is registered under, an app's own name on a known app platform, or a function URL service in its region), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
+									"type": "array",
+									"items": { "type": "string" }
+								},
+								"hosts_not_listed": {
+									"description": "Hosts past those listed.",
+									"type": "integer",
+									"minimum": 0
 								}
 							},
 							"required": ["owner", "count"]
 						},
-						"description": "Webhooks that are sent what it matches: those whose key, as delivery acts as it, lists the rule or its live share (owner: the member who holds that key, or the organization), and the webhooks of the member the rule is shared with (owner: that member)."
+						"description": "Webhooks taking received mail, bounces or reports that are sent what it matches: those of the key delivery acts as, when it lists the rule or its live share (owner: its holder, or the organization), and those of the member it is shared with (owner: that member)."
 					},
 					"shares": {
 						"type": "array",
@@ -52935,7 +53582,7 @@ const openapiDocument = {
 							},
 							"required": ["beneficiary", "count"]
 						},
-						"description": "The rule's live share, if it has one (a rule is shared at most once): the member it gives what it matches to."
+						"description": "The rule's live share (at most one), by its member, if they can read it and it is among their newest 20 shares."
 					}
 				},
 				"required": [
@@ -52943,7 +53590,7 @@ const openapiDocument = {
 					"webhooks",
 					"shares"
 				],
-				"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+				"description": "Who receives what the rule shares, by person and count. As receivers, empty unless it is an active grant rule."
 			},
 			"ListEmailRuleResultsResult": {
 				"type": "object",
@@ -53405,7 +54052,7 @@ const openapiDocument = {
 						}
 					},
 					"warnings": {
-						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
+						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test, or on a grant rule that tests only who an email was sent to (on a rule request, every compiler note on the rule).",
 						"maxItems": 10,
 						"type": "array",
 						"items": {
@@ -53423,6 +54070,15 @@ const openapiDocument = {
 					"breadth": {
 						"description": "Ignored (the compile answer's breadth).",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
+					"conditions_breadth": {
+						"description": "Ignored.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
+					"kind": {
+						"description": "Only grant.",
+						"type": "string",
+						"const": "grant"
 					}
 				},
 				"required": [
@@ -53798,6 +54454,15 @@ const openapiDocument = {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it."
 					},
+					"pending_objections": {
+						"description": "To its author, on the dashboard or the Primitive CLI: objections to it waiting for their answer (GET /email-rule-objections). A write's answer leaves it out when it could not be read in time: absent is not 0.",
+						"type": "integer",
+						"minimum": 0
+					},
+					"objection_notice": {
+						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"type": "string"
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -54018,7 +54683,7 @@ const openapiDocument = {
 						}
 					},
 					"warnings": {
-						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
+						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test, or on a grant rule that tests only who an email was sent to (on a rule request, every compiler note on the rule).",
 						"maxItems": 10,
 						"type": "array",
 						"items": {
@@ -54037,6 +54702,15 @@ const openapiDocument = {
 						"description": "Ignored (the compile answer's breadth).",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
+					"conditions_breadth": {
+						"description": "Ignored.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
+					"kind": {
+						"description": "Only grant.",
+						"type": "string",
+						"const": "grant"
+					},
 					"expectation_samples": {
 						"description": "Made-up emails the rule must match or not, such as look-alikes it must never match, kept on the rule this accept writes.",
 						"minItems": 1,
@@ -54054,7 +54728,7 @@ const openapiDocument = {
 					"rule": { "$ref": "#/components/schemas/EmailRuleWithVersion" },
 					"share": { "$ref": "#/components/schemas/EmailRuleShare" },
 					"notice": {
-						"description": "What is now shared, in words.",
+						"description": "What is now shared, in words. When you changed the rule and it can now match mail the request left out by who it was sent to (such as mail where an address is only copied), that comes first.",
 						"type": "string"
 					}
 				},
@@ -54078,6 +54752,34 @@ const openapiDocument = {
 				"items": {
 					"type": "object",
 					"properties": {
+						"imported": {
+							"type": ["object", "null"],
+							"properties": {
+								"from": {
+									"type": "string",
+									"const": "google_workspace"
+								},
+								"method": {
+									"type": "string",
+									"const": "primitive_direct"
+								},
+								"verification": {
+									"type": "string",
+									"const": "provider_fetched"
+								},
+								"at": {
+									"type": "string",
+									"format": "date-time"
+								}
+							},
+							"required": [
+								"from",
+								"method",
+								"verification",
+								"at"
+							],
+							"default": null
+						},
 						"delivery_report": {
 							"type": ["object", "null"],
 							"properties": {
@@ -54315,6 +55017,7 @@ const openapiDocument = {
 						}
 					},
 					"required": [
+						"imported",
 						"id",
 						"message_id",
 						"domain_id",
@@ -54390,7 +55093,11 @@ const openapiDocument = {
 						"exclusiveMinimum": 0
 					},
 					"receivers": {
-						"description": "Null when it could not be read in time; try again.",
+						"description": "Null when it could not be read in time, or for a rule shown in draft or observe that turned active or was deleted after the page was read; try again.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleReceivers" }, { "type": "null" }]
+					},
+					"receivers_once_active": {
+						"description": "For a grant rule in draft or observe: who would receive what it matches once it is turned active. None of them receives anything yet. Null for any other rule, and as receivers is null.",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleReceivers" }, { "type": "null" }]
 					},
 					"created_at": {
@@ -54408,6 +55115,7 @@ const openapiDocument = {
 					"covers",
 					"current_version",
 					"receivers",
+					"receivers_once_active",
 					"created_at"
 				]
 			},
@@ -54478,7 +55186,11 @@ const openapiDocument = {
 						"description": "Null when covers_now is false."
 					},
 					"receivers": {
-						"description": "Null when covers_now is false (who receives it now is not about your mail), or when it could not be read in time.",
+						"description": "Null when covers_now is false (who receives it now is not about your mail), when it could not be read in time, or for a rule shown in draft or observe that turned active or was deleted after it was read; try again.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleReceivers" }, { "type": "null" }]
+					},
+					"receivers_once_active": {
+						"description": "As on the list; also null when covers_now is false.",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleReceivers" }, { "type": "null" }]
 					},
 					"created_at": {
@@ -54508,6 +55220,7 @@ const openapiDocument = {
 					"covers",
 					"current_version",
 					"receivers",
+					"receivers_once_active",
 					"created_at",
 					"covers_now",
 					"current"
@@ -54625,6 +55338,10 @@ const openapiDocument = {
 				"type": "array",
 				"items": { "$ref": "#/components/schemas/EmailRuleDecisionOnMyMail" }
 			},
+			"ListEmailRuleVersionsCoveringMeResult": {
+				"type": "array",
+				"items": { "$ref": "#/components/schemas/EmailRuleCoveringMeVersion" }
+			},
 			"EmailRuleObjection": {
 				"type": "object",
 				"properties": {
@@ -54665,8 +55382,14 @@ const openapiDocument = {
 						"description": "Who wrote the rule.",
 						"$ref": "#/components/schemas/EmailRuleObjectionPerson"
 					},
-					"is_objector": { "type": "boolean" },
-					"is_author": { "type": "boolean" },
+					"is_objector": {
+						"type": "boolean",
+						"description": "Whether you made it, in your current membership."
+					},
+					"is_author": {
+						"type": "boolean",
+						"description": "Whether it is to a rule you wrote, in your current membership."
+					},
 					"message": {
 						"description": "Why the objector objects; null when none was given, or once withdrawn.",
 						"type": ["string", "null"]
@@ -54884,6 +55607,82 @@ const openapiDocument = {
 					"outbound_ready"
 				]
 			},
+			"ImportGoogleMailMessageRequest": {
+				"type": "object",
+				"properties": { "message_id": {
+					"type": "string",
+					"pattern": "^[A-Za-z0-9_-]{1,128}$"
+				} },
+				"required": ["message_id"],
+				"additionalProperties": false
+			},
+			"ImportGoogleMailMessageResult": { "anyOf": [
+				{
+					"type": "object",
+					"properties": {
+						"status": {
+							"type": "string",
+							"enum": ["imported", "already_present"]
+						},
+						"email_id": {
+							"type": "string",
+							"format": "uuid",
+							"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+						}
+					},
+					"required": ["status", "email_id"]
+				},
+				{
+					"type": "object",
+					"properties": { "status": {
+						"type": "string",
+						"enum": [
+							"suppressed",
+							"in_progress",
+							"indeterminate"
+						]
+					} },
+					"required": ["status"]
+				},
+				{
+					"type": "object",
+					"properties": {
+						"status": {
+							"type": "string",
+							"const": "skipped"
+						},
+						"reason": {
+							"type": "string",
+							"enum": [
+								"excluded_label",
+								"out_of_window",
+								"too_large",
+								"provider_missing"
+							]
+						}
+					},
+					"required": ["status", "reason"]
+				}
+			] },
+			"ReconcileGoogleMailImportRequest": {
+				"type": "object",
+				"properties": {},
+				"additionalProperties": false
+			},
+			"ReconcileGoogleMailImportResult": {
+				"type": "object",
+				"properties": {
+					"cleaned": {
+						"type": "integer",
+						"minimum": 0
+					},
+					"unresolved": {
+						"type": "integer",
+						"minimum": 0
+					}
+				},
+				"required": ["cleaned", "unresolved"]
+			},
 			"ThreadMute": {
 				"type": "object",
 				"required": [
@@ -55078,6 +55877,7 @@ const openapiDocument = {
 				"type": "object",
 				"description": "What an inbound email says, as plain text, with the fields that identify it.",
 				"required": [
+					"imported",
 					"id",
 					"thread_id",
 					"received_at",
@@ -55098,6 +55898,35 @@ const openapiDocument = {
 					"attachments"
 				],
 				"properties": {
+					"imported": {
+						"type": ["object", "null"],
+						"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
+						"required": [
+							"from",
+							"method",
+							"verification",
+							"at"
+						],
+						"properties": {
+							"from": {
+								"type": "string",
+								"enum": ["google_workspace"]
+							},
+							"method": {
+								"type": "string",
+								"enum": ["primitive_direct"]
+							},
+							"verification": {
+								"type": "string",
+								"enum": ["provider_fetched"]
+							},
+							"at": {
+								"type": "string",
+								"format": "date-time",
+								"description": "When Primitive acquired this historical message."
+							}
+						}
+					},
 					"id": {
 						"type": "string",
 						"format": "uuid",
@@ -58590,6 +59419,24 @@ const openapiDocument = {
 										"agent_address",
 										"person"
 									]
+								},
+								"address_warnings": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"address": { "type": "string" },
+											"reason": { "type": "string" },
+											"description": { "type": "string" }
+										},
+										"required": [
+											"address",
+											"reason",
+											"description"
+										],
+										"additionalProperties": {}
+									},
+									"description": "Notes on the key's grant, worked out from it on every read: whole_mailbox, an address or domain listed beside email rules, which the key reads in full; no_send_address, with address empty, a key that can send but lists only email rules. The notes that need the organization's mailboxes and domains (member_address, unowned_domain) are given only when the grant is written. Only rules not deleted and shares not ended count. Empty, or absent, for a key on a template, and empty for a revoked key."
 								}
 							},
 							"required": [
@@ -59442,6 +60289,27 @@ const openapiDocument = {
 							"additionalProperties": {}
 						}
 					},
+					"rules_added": {
+						"description": "Each rule (or share) the edit put on a key that reads mail, with granted_emails, how many emails it has already shared, which the key can now read while it is active: counted up to 10,000, with more: true past that; null when not counted.",
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"id": { "type": "string" },
+								"granted_emails": {
+									"type": ["integer", "null"],
+									"minimum": 0,
+									"maximum": 9007199254740991
+								},
+								"more": {
+									"type": "boolean",
+									"const": true
+								}
+							},
+							"required": ["id", "granted_emails"],
+							"additionalProperties": {}
+						}
+					},
 					"grant_unguarded": {
 						"description": "Present, as true, when the grant was changed without expected_grant_ref, so the change was not checked against changes made since the key was read. Send grant.ref from GET /v1/keys/{id} as expected_grant_ref to have such a change refused instead (409 conflict, details.reason grant_changed).",
 						"type": "boolean",
@@ -59877,6 +60745,24 @@ const openapiDocument = {
 								"rotated_to": {
 									"description": "The id of the newest key rotated from this key that the caller may read; null until it is rotated, or when the caller may read no key rotated from it. A revoked one is still named: GET /v1/keys/{id} answers it.",
 									"type": ["string", "null"]
+								},
+								"address_warnings": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"address": { "type": "string" },
+											"reason": { "type": "string" },
+											"description": { "type": "string" }
+										},
+										"required": [
+											"address",
+											"reason",
+											"description"
+										],
+										"additionalProperties": {}
+									},
+									"description": "Notes on the key's grant, worked out from it on every read: whole_mailbox, an address or domain listed beside email rules, which the key reads in full; no_send_address, with address empty, a key that can send but lists only email rules. The notes that need the organization's mailboxes and domains (member_address, unowned_domain) are given only when the grant is written. Only rules not deleted and shares not ended count. Empty, or absent, for a key on a template, and empty for a revoked key."
 								}
 							},
 							"required": [
@@ -59976,6 +60862,24 @@ const openapiDocument = {
 					"rotated_to": {
 						"description": "The id of the newest key rotated from this key that the caller may read; null until it is rotated, or when the caller may read no key rotated from it. A revoked one is still named: GET /v1/keys/{id} answers it.",
 						"type": ["string", "null"]
+					},
+					"address_warnings": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"address": { "type": "string" },
+								"reason": { "type": "string" },
+								"description": { "type": "string" }
+							},
+							"required": [
+								"address",
+								"reason",
+								"description"
+							],
+							"additionalProperties": {}
+						},
+						"description": "Notes on the key's grant, worked out from it on every read: whole_mailbox, an address or domain listed beside email rules, which the key reads in full; no_send_address, with address empty, a key that can send but lists only email rules. The notes that need the organization's mailboxes and domains (member_address, unowned_domain) are given only when the grant is written. Only rules not deleted and shares not ended count. Empty, or absent, for a key on a template, and empty for a revoked key."
 					}
 				},
 				"required": [
@@ -62746,6 +63650,29 @@ const openapiDocument = {
 				],
 				"description": "A default wake schedule the install creates for the function: the command it sends, a 5-field cron expression and timezone, and the scheduler sender localpart on the installed address's domain. The owner can change or delete it after install."
 			},
+			"EndpointCreateWarning": {
+				"type": "object",
+				"properties": {
+					"code": { "type": "string" },
+					"message": { "type": "string" },
+					"endpoint_id": {
+						"description": "The other webhook a same_path_as_another_endpoint warning names.",
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					}
+				},
+				"required": ["code", "message"],
+				"additionalProperties": {}
+			},
+			"CreatedEndpoint": { "allOf": [{ "$ref": "#/components/schemas/Endpoint" }, {
+				"type": "object",
+				"properties": { "warnings": {
+					"description": "For a webhook (kind http). same_path_as_another_endpoint: another webhook you can see, on and not deleted, sends to the same scheme, host and path with any query string, so each email both receive is delivered twice; endpoint_id names it (at most 5, newest first). The URL is never echoed. Empty when none; absent when it could not be checked (a caller who may not read endpoints, or a failed read). Other codes may be added.",
+					"type": "array",
+					"items": { "$ref": "#/components/schemas/EndpointCreateWarning" }
+				} }
+			}] },
 			"EndpointUpdateWarning": {
 				"type": "object",
 				"properties": {
@@ -63148,8 +64075,11 @@ const KEY_WRITE_OPERATION_IDS = /* @__PURE__ */ new Set([
 	"credentials:update-key",
 	"credentials:revoke-credential"
 ]);
-/** The operations the CLI generates commands for: the manifest without the key writes. */
-const cliOperationManifest = operationManifest.filter((operation) => !KEY_WRITE_OPERATION_IDS.has(`${operation.tagCommand}:${operation.command}`));
+const CREDENTIAL_HEADER_OPERATION_IDS = /* @__PURE__ */ new Set(["emails:import-google-mail-message"]);
+/** Every operation id the CLI generates no command for. */
+const CLI_OMITTED_OPERATION_IDS = /* @__PURE__ */ new Set([...KEY_WRITE_OPERATION_IDS, ...CREDENTIAL_HEADER_OPERATION_IDS]);
+/** The operations the CLI generates commands for: the manifest without CLI_OMITTED_OPERATION_IDS. */
+const cliOperationManifest = operationManifest.filter((operation) => !CLI_OMITTED_OPERATION_IDS.has(`${operation.tagCommand}:${operation.command}`));
 // src/oclif/commands/activity.ts
 const API_KEY_FLAG$3 = Flags.string({
 	description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
@@ -63183,6 +64113,7 @@ async function call$1(request) {
 		};
 	}
 }
+/** A time as "YYYY-MM-DD HH:MM" in UTC; anything that is not a time, as given. */
 function minute(value) {
 	if (!value) return "";
 	const date = new Date(value);
@@ -63244,31 +64175,46 @@ function formatAskedRows(items, complete = false) {
 	const line = (cells) => cells.map((cell, i) => i === cells.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ");
 	return [line(header), ...rows.map(line)].join("\n");
 }
+/** Where to see what covers you now, whatever the notices have caught up with. */
+const COVERING_NOW = `\`primitive email-rule-oversight list-email-rules-covering-me\` shows what covers you now.`;
 /**
 * One line per coverage notice: what it told (started, new_version, or
 * baseline for a rule that already covered you when notices began), when, the
-* rule's name then, and its author. No id: a notice's id is not a rule's, and
-* no command takes it. `complete` says the listing is the whole of it (from
-* the first page to the last, nothing withheld), the only time an empty one
-* means no notice has been written for you.
+* rule's name then, and its author; and, first, each rule that covers you now
+* whose notice is not written yet (pending, dated when the rule last
+* changed), then the rule's id (rule_id; a pending row's own id is the
+* rule's), never the notice's own id, which no command takes.
+* `complete` says the listing is the whole of it (from the first page to the
+* last, nothing withheld). Even then an empty one is no promise that nothing
+* covers you: notices can lag, so it
+* says how far they go (`asOf`, when the server says) and where to look now.
 */
-function formatConcerningRows(items, complete = false) {
-	if (items.length === 0) return complete ? "No other member's rule has covered your mail since these notices began." : "Nothing to show.";
+function formatConcerningRows(items, complete = false, asOf, pendingComplete) {
+	const unfinished = pendingComplete === false ? "The check for rules that cover you with no notice written yet did not finish, so some may be missing: run this again in a moment." : null;
+	if (items.length === 0) return complete ? `${asOf ? `Nothing recorded for you as of ${minute(asOf)} UTC.` : "Nothing recorded for you yet."} Notices can lag, so a rule that starts covering your mail may not appear here yet. ${COVERING_NOW}` : unfinished ? `${unfinished} ${COVERING_NOW}` : "Nothing to show.";
 	const rows = items.map((item) => [
 		item.state,
 		minute(item.created_at),
 		item.name ?? "(unnamed)",
-		item.created_through.name ?? item.created_through.id ?? ""
+		item.created_through.name ?? item.created_through.id ?? "",
+		item.rule_id ?? (item.state === "pending" ? item.id : "")
 	]);
 	const header = [
 		"NOTICE",
 		"WHEN (UTC)",
 		"RULE",
-		"AUTHOR"
+		"AUTHOR",
+		"RULE ID"
 	];
 	const widths = header.map((h, i) => Math.max(h.length, ...rows.map((row) => (row[i] ?? "").length)));
-	const line = (cells) => cells.map((cell, i) => i === cells.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ");
-	return [line(header), ...rows.map(line)].join("\n");
+	const line = (cells) => cells.map((cell, i) => i === cells.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ").trimEnd();
+	const pending = items.some((item) => item.state === "pending") ? ["", `pending: the rule covers you now and its notice is not written yet. ${COVERING_NOW}`] : [];
+	return [
+		line(header),
+		...rows.map(line),
+		...pending,
+		...unfinished ? ["", pending.length > 0 ? unfinished : `${unfinished} ${COVERING_NOW}`] : []
+	].join("\n");
 }
 /** What was left out, and why: no counts, only the kinds and what would show them. */
 function formatWithheld(withheld) {
@@ -63300,6 +64246,8 @@ async function runActivityList(command, flags, relation) {
 	const items = [];
 	let covers = "";
 	let withheld = [];
+	let asOf;
+	let pendingComplete;
 	let cursor = flags.cursor;
 	for (let page = 0; page < (flags.all ? 50 : 1); page += 1) {
 		const result = await call$1(listActivityObjects({
@@ -63326,6 +64274,11 @@ async function runActivityList(command, flags, relation) {
 		}
 		covers = result.data.covers;
 		withheld = result.data.withheld;
+		if (page === 0) {
+			const first = result.data;
+			asOf = first.as_of;
+			pendingComplete = first.pending_complete;
+		}
 		items.push(...result.data.items);
 		cursor = result.data.next_cursor ?? void 0;
 		if (!cursor) break;
@@ -63335,12 +64288,14 @@ async function runActivityList(command, flags, relation) {
 			covers,
 			items,
 			withheld,
-			next_cursor: cursor ?? null
+			next_cursor: cursor ?? null,
+			...asOf !== void 0 ? { as_of: asOf } : {},
+			...pendingComplete !== void 0 ? { pending_complete: pendingComplete } : {}
 		}, null, 2));
 		return;
 	}
-	const complete = flags.state === "all" && !flags.cursor && !cursor && withheld.length === 0;
-	command.log(relation === "asked" ? formatAskedRows(items, complete) : relation === "concerning" ? formatConcerningRows(items, complete) : formatActivityRows(covers, items));
+	const complete = flags.state === "all" && !flags.cursor && !cursor && withheld.length === 0 && pendingComplete !== false;
+	command.log(relation === "asked" ? formatAskedRows(items, complete) : relation === "concerning" ? formatConcerningRows(items, complete, asOf, pendingComplete) : formatActivityRows(covers, items));
 	const notShown = formatWithheld(withheld);
 	if (notShown) command.log(`\n${notShown}`);
 	if (cursor) command.log(`\nMore: ${resumeCommand(command.config.bin, flags, cursor, relation)}`);
@@ -63423,9 +64378,11 @@ var ActivityAskedCommand = class ActivityAskedCommand extends Command {
 	}
 };
 var ActivityConcerningCommand = class ActivityConcerningCommand extends Command {
-	static description = `List what other members did that concerns your own mail, newest first: each time another member's rule started covering one of your mailboxes (started), or saved a new version while covering it (new_version), named as the rule was then, with its author. A rule that already covered you when these notices began is listed once as baseline.
+	static description = `List what other members did that concerns your own mail, newest first: each time another member's rule started covering your mailboxes, that is, it was made or turned active over them or an active rule came to reach you, once per rule, not per mailbox (started), or saved a new version while covering it (new_version), named as the rule was then, with its author. A rule that already covered you when these notices began is listed once as baseline. A rule in draft or observe grants and blocks nothing and gets no notice while it stays there, though \`primitive email-rule-oversight list-email-rules-covering-me\` lists it; turning it active is what is listed, and a rule that covers you again within an hour of its last started or baseline notice gets no new one, though a version it saved meanwhile is listed as new_version. A rule that stops covering you, a rename, and changes to its keys, webhooks or share are not listed.
 
-  Signed in with \`primitive login\`, you see the notices about your own mail under your current membership. A key, an app or an agent has none. The rules that cover you now, with their ids, are listed by \`primitive email-rule-oversight list-email-rules-covering-me\`; ask a rule's author to turn it off with \`primitive email-rule-oversight create-email-rule-objection --rule-id <rule-id>\`. With --json each item's id is the notice's, not the rule's.`;
+  Notices can lag. Until a start is written, a rule that now covers you is listed first as pending, dated when the rule last changed, and with --json its id is the rule's. When the check for such rules did not finish, the listing says so and --json carries pending_complete: false; run it again in a moment.
+
+  Signed in with \`primitive login\`, you see the notices about your own mail under your current membership. A key, an app or an agent has none. The rules that cover you now, with their ids, are listed by \`primitive email-rule-oversight list-email-rules-covering-me\`; ask a rule's author to turn it off with \`primitive email-rule-oversight create-email-rule-objection --rule-id <rule-id>\`. The table's RULE ID, and rule_id with --json, is the rule's id, which \`primitive email-rule-oversight get-email-rule-covering-me <rule-id>\` and create-email-rule-objection --rule-id take; with --json each notice's own id is the notice's, not the rule's.`;
 	static summary = "List rules that started covering your mail or changed";
 	static examples = ["<%= config.bin %> activity concerning", "<%= config.bin %> activity concerning --all --json"];
 	static flags = {
@@ -67804,11 +68761,12 @@ async function sendFromAnswer(apiClient, authFailureContext, purpose) {
 		const missing = await missingSendPermission(apiClient);
 		if (missing) throw new MissingSendPermissionError(missing);
 	}
-	const parts = [typeof data.reason === "string" && data.reason.trim() ? data.reason.trim().replace(/\.?$/, ".") : "This credential has no single address to send from, so --from has no default."];
+	const nothingListed = addresses.length === 0 && domains.length === 0;
+	const parts = [typeof data.reason === "string" && data.reason.trim() ? data.reason.trim().replace(/\.?$/, ".") : nothingListed ? "This credential lists no address or domain it can send from, so it cannot send." : "This credential has no single address to send from, so --from has no default."];
 	if (addresses.length > 0) parts.push(`Addresses you may send from: ${addresses.join(", ")}.`);
 	if (domains.length > 0) parts.push(`${addresses.length > 0 ? "Also any" : "Any"} address at: ${domains.join(", ")}.`);
 	parts.push(await claimHint(apiClient));
-	parts.push("Pass the address to use with --from <address>.");
+	if (!nothingListed) parts.push("Pass the address to use with --from <address>.");
 	throw new Errors.CLIError(parts.filter((part) => part).join(" "), { exit: 1 });
 }
 /** The address of resolveDefaultFrom. */
@@ -70493,6 +71451,130 @@ async function checkDomains(client) {
 		};
 	}
 }
+const ASKED_PAGE = 50;
+const ASKED_KINDS = ["email_rule_request", "email_rule_objection"];
+/**
+* One page of the caller's activity list; "refused" when the credential may
+* not list activity at all (401 or 403), null when it could not be read.
+*/
+async function activityPage(client, query) {
+	try {
+		const result = await listActivityObjects({
+			client: client.client,
+			query,
+			responseStyle: "fields"
+		});
+		const status = result.response?.status;
+		if (status === 401 || status === 403) return "refused";
+		if (result.error) return null;
+		return result.data?.data ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Up to ASKED_PAGES pages of a list, stopping early once `enough` says the
+* rest cannot matter: the first page (which alone carries what a list says
+* beyond its items), every item read, and whether a page was left unread.
+* "refused" or null as the first page is; a later page that fails to read is
+* a page left unread.
+*/
+async function activityPages(client, query, enough = () => false) {
+	const first = await activityPage(client, query);
+	if (first === "refused" || first === null) return first;
+	const items = [...first.items];
+	let page = first;
+	for (let read = 1;; read += 1) {
+		const cursor = page.next_cursor;
+		if (cursor == null || enough(page)) return {
+			first,
+			items,
+			more: false
+		};
+		if (read >= 5) return {
+			first,
+			items,
+			more: true
+		};
+		const next = await activityPage(client, {
+			...query,
+			cursor
+		});
+		if (next === "refused" || next === null) return {
+			first,
+			items,
+			more: true
+		};
+		items.push(...next.items);
+		page = next;
+	}
+}
+const plural$1 = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+/**
+* What is waiting on a person, read from the activity lists (notification
+* emails can be off, so this is where they are told): rule requests made to
+* them and objections to rules they wrote that are still open, rules that
+* cover their mail now with no notice written yet, and coverage notices from
+* the last RECENT_COVERAGE_DAYS days. Null for a credential that is asked
+* nothing: one the list refuses, one whose list is not a person's own, or one
+* from which every asked kind is withheld. Whatever it could not see (a kind
+* withheld from it, a page it did not read, a pending check the API did not
+* finish) is said, so the row is never OK for it, and counts read past are
+* lower bounds. WARN when anything is waiting or unchecked; never a FAIL.
+*/
+async function checkAskedOfYou(client, now = Date.now()) {
+	const asked = await activityPages(client, {
+		relation: "asked",
+		state: "live",
+		limit: ASKED_PAGE
+	});
+	if (asked === "refused") return null;
+	if (!asked) return {
+		status: "warn",
+		message: "could not check what is waiting for you",
+		hint: "Run `primitive activity asked --state live` and `primitive activity concerning`."
+	};
+	const hidden = new Set(asked.first.withheld.map((entry) => entry.kind));
+	if (asked.first.covers !== "you" || ASKED_KINDS.every((kind) => hidden.has(kind))) return null;
+	const since = now - 6048e5;
+	const read = await activityPages(client, {
+		relation: "concerning",
+		state: "all",
+		limit: ASKED_PAGE
+	}, (page) => {
+		const last = page.items.at(-1);
+		return last !== void 0 && Date.parse(last.created_at) < since;
+	});
+	const concerning = read === "refused" ? null : read;
+	const coverageHidden = concerning?.first.withheld.some((entry) => entry.kind === "email_rule_coverage") ?? false;
+	const coverageUnfinished = concerning !== null && (concerning.more || concerning.first.pending_complete === false);
+	const requests = asked.items.filter((item) => item.kind === "email_rule_request").length;
+	const objections = asked.items.filter((item) => item.kind === "email_rule_objection").length;
+	const waiting = asked.more ? [`at least ${requests + objections} rule requests and objections`] : [...requests > 0 ? [plural$1(requests, "rule request")] : [], ...objections > 0 ? [plural$1(objections, "objection")] : []];
+	const items = concerning?.items ?? [];
+	const pending = items.filter((item) => item.state === "pending").length;
+	const notices = items.filter((item) => (item.state === "started" || item.state === "new_version") && Date.parse(item.created_at) >= since).length;
+	const parts = [
+		...waiting.length > 0 ? [`${waiting.join(" and ")} waiting for you`] : [],
+		...ASKED_KINDS.filter((kind) => hidden.has(kind)).map((kind) => `${kind === "email_rule_request" ? "rule requests" : "objections"} not shown to this credential`),
+		...pending > 0 ? [`${concerning?.first.pending_complete === false ? "at least " : ""}${plural$1(pending, "rule")} ${pending === 1 ? "covers" : "cover"} your mail with no notice written yet`] : [],
+		...notices > 0 ? [`${concerning?.more ? "at least " : ""}${plural$1(notices, "coverage notice")} in the last 7 days`] : [],
+		...coverageHidden ? ["rules over your mail not shown to this credential"] : !concerning ? ["could not check the rules over your mail"] : coverageUnfinished ? ["the check of the rules over your mail did not finish"] : []
+	];
+	if (parts.length === 0) {
+		const asOf = concerning?.first.as_of;
+		return {
+			status: "ok",
+			message: `nothing waiting for you; ${asOf ? `coverage notices as of ${minute(asOf)} UTC` : "coverage notices can lag"}`
+		};
+	}
+	const commands = [...waiting.length > 0 ? ["`primitive activity asked --state live`"] : [], ...pending > 0 || notices > 0 || !concerning || coverageUnfinished ? ["`primitive activity concerning`"] : []];
+	return {
+		status: "warn",
+		message: parts.join("; "),
+		...commands.length > 0 ? { hint: `Run ${commands.join(" and ")}.` } : {}
+	};
+}
 /**
 * A background start that gave up, such as a receiver replacing its lost
 * supervisor, has no terminal to report to. Its saved reason is read
@@ -70521,7 +71603,7 @@ function checkReceiverStart(configDir, profileName) {
 	}
 }
 var DoctorCommand = class DoctorCommand extends Command {
-	static description = `Run a one-shot environment health check: Node version, proxy env, CLI auth resolution, /account reachability, and verified-domain status. With PRIMITIVE_AGENT_PROFILE selected, reports saved identity offline and points to whoami and exact listener status instead of account-only checks. Prints actionable hints for each warning or failure.`;
+	static description = `Run a one-shot environment health check: Node version, proxy env, CLI auth resolution, /account reachability, verified-domain status, and, signed in as yourself, the rule requests and objections waiting for you and the rules that recently started covering your mail. With PRIMITIVE_AGENT_PROFILE selected, reports saved identity offline and points to whoami and exact listener status instead of account-only checks. Prints actionable hints for each warning or failure.`;
 	static summary = "Check the local environment and live API for common problems";
 	static examples = ["<%= config.bin %> doctor", "<%= config.bin %> doctor --api-key prim_..."];
 	static flags = {
@@ -70587,6 +71669,11 @@ var DoctorCommand = class DoctorCommand extends Command {
 						label: "Domains",
 						outcome: domainsOutcome
 					});
+					const asked = await checkAskedOfYou(apiClient);
+					if (asked) rows.push({
+						label: "Asked of you",
+						outcome: asked
+					});
 				}
 			}
 		}
@@ -70609,9 +71696,10 @@ var DoctorCommand = class DoctorCommand extends Command {
 	}
 };
 // src/oclif/commands/domains-zone-file.ts
-function zoneFileUrl(baseUrl, domainId, outboundOnly) {
+function zoneFileUrl(baseUrl, domainId, outboundOnly, inboundOnly = false) {
 	const url = new URL(`${baseUrl.replace(/\/$/, "")}/domains/${encodeURIComponent(domainId)}/zone-file`);
 	if (outboundOnly) url.searchParams.set("outbound_only", "true");
+	if (inboundOnly) url.searchParams.set("inbound_only", "true");
 	return url.toString();
 }
 function contentDispositionFilename(value) {
@@ -70651,7 +71739,8 @@ var DomainsZoneFileCommand = class DomainsZoneFileCommand extends Command {
 		"<%= config.bin %> domains zone-file --id <domain-id>",
 		"<%= config.bin %> domains zone-file --id <domain-id> --output example.com.zone",
 		"<%= config.bin %> domains zone-file --domain example.com --output example.com.zone",
-		"<%= config.bin %> domains zone-file --id <domain-id> --outbound-only"
+		"<%= config.bin %> domains zone-file --id <domain-id> --outbound-only",
+		"<%= config.bin %> domains zone-file --id <domain-id> --inbound-only"
 	];
 	static flags = {
 		"api-key": Flags.string({
@@ -70669,7 +71758,14 @@ var DomainsZoneFileCommand = class DomainsZoneFileCommand extends Command {
 			char: "o",
 			description: "Write the zone file to this path instead of stdout. Defaults to stdout."
 		}),
-		"outbound-only": Flags.boolean({ description: "Include only outbound DNS records. Verified domains default to outbound-only at the API; this flag is explicit for agents and scripts." }),
+		"outbound-only": Flags.boolean({
+			description: "Include only the outbound DNS records. Without it or --inbound-only, the file has every record. Not with --inbound-only.",
+			exclusive: ["inbound-only"]
+		}),
+		"inbound-only": Flags.boolean({
+			description: "Include only the inbound records: MX and the ownership TXT record. Not with --outbound-only.",
+			exclusive: ["outbound-only"]
+		}),
 		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
 	};
 	async run() {
@@ -70706,7 +71802,7 @@ var DomainsZoneFileCommand = class DomainsZoneFileCommand extends Command {
 			if (!domainId) throw new Errors.CLIError("Could not resolve a domain id.", { exit: 1 });
 			let response;
 			try {
-				response = await fetch(zoneFileUrl(requestConfig.resolvedApiBaseUrl, domainId, flags["outbound-only"]), { headers: {
+				response = await fetch(zoneFileUrl(requestConfig.resolvedApiBaseUrl, domainId, flags["outbound-only"], flags["inbound-only"]), { headers: {
 					...requestConfig.headers ?? {},
 					...auth.apiKey ? { authorization: `Bearer ${auth.apiKey}` } : {}
 				} });
@@ -73607,8 +74703,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^3.0.0-preview.11";
-const CLI_VERSION_RANGE = "^3.0.0-preview.11";
+const SDK_VERSION_RANGE = "^3.0.0-preview.13";
+const CLI_VERSION_RANGE = "^3.0.0-preview.13";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -76983,12 +78079,27 @@ function describePermissions(grant) {
 	const permissions = grant.permissions ?? [];
 	return permissions.length > 0 ? permissions.join(", ") : "none";
 }
+/**
+* The notes the server gives on a key's grant on every read (address_warnings),
+* such as an address it reads in full beside its email rules. Read loosely:
+* an older server sends none.
+*/
+function keyNotes(key) {
+	const notes = key.address_warnings;
+	if (!Array.isArray(notes)) return [];
+	return notes.flatMap((note) => {
+		const description = note?.description;
+		return typeof description === "string" ? [description] : [];
+	});
+}
 function formatKeyRows(rows, options = {}) {
 	if (rows.length === 0) return options.includeRevoked ? "No API keys, revoked or not." : "No API keys. Revoked keys are left out; pass --include-revoked to list them too.";
 	return rows.map((row) => {
 		const suspended = row.suspended && row.status !== "revoked" ? " [suspended]" : "";
 		const revoked = row.status === "revoked" ? ` [revoked${row.revoked_at ? ` ${row.revoked_at}` : ""}]` : "";
-		return `${row.id}  ${row.key_prefix}  ${row.name ?? "(unnamed)"}  ${describePermissions(row.grant)}  mail: ${describeMailScope(row.grant)}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${suspended}${revoked}`;
+		const count = keyNotes(row).length;
+		const notes = count > 0 ? ` [${count} ${count === 1 ? "note" : "notes"}: primitive keys get ${row.id}]` : "";
+		return `${row.id}  ${row.key_prefix}  ${row.name ?? "(unnamed)"}  ${describePermissions(row.grant)}  mail: ${describeMailScope(row.grant)}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${suspended}${revoked}${notes}`;
 	}).join("\n");
 }
 function formatKeyDetail(key) {
@@ -77013,6 +78124,11 @@ function formatKeyDetail(key) {
 		lines.push("Permissions:");
 		for (const permission of key.grant.permissions ?? []) lines.push(`  ${permission}`);
 	}
+	const notes = keyNotes(key);
+	if (notes.length > 0) {
+		lines.push("Notes:");
+		for (const note of notes) lines.push(`  ${note.replace(/\r?\n/g, "\n  ")}`);
+	}
 	return lines.join("\n");
 }
 const EVERY_MAILBOX_PRESETS = /* @__PURE__ */ new Set([
@@ -77515,7 +78631,7 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 
   The change runs directly; if your organization requires approval, the command prints the approval link and takes --step-up-token, as for a new key. A key never holds more than you do.
 
-  With --json it prints the key as it is now, in the shape keys get prints, with changed, warnings and address_warnings alongside, notice when its permissions or mail changed, rules_removed when a change took rules off, and rules_not_on_key for rules asked to be taken off that it did not have. A permission or rule change that leaves the grant as it is, with no --name, --expires-at or --no-expiry, sends nothing and prints the key with changed: []. If the key cannot be read back after the change, key_error says why and only the change's fields are printed.`;
+  With --json it prints the key as it is now, in the shape keys get prints, with changed, warnings and address_warnings alongside, notice when its permissions or mail changed, rules_added when a change put rules on it (each with granted_emails, how many emails the rule has already shared), rules_removed when a change took rules off, and rules_not_on_key for rules asked to be taken off that it did not have. A permission or rule change that leaves the grant as it is, with no --name, --expires-at or --no-expiry, sends nothing and prints the key with changed: []. If the key cannot be read back after the change, key_error says why and only the change's fields are printed.`;
 	static summary = "Change an API key";
 	static examples = [
 		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --add mail:send,mail:reply",
@@ -77648,10 +78764,12 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 			client: auth.apiClient.client,
 			path: { id: args.id }
 		})) : null;
+		const standingNotes = after?.ok ? after.data.address_warnings : void 0;
 		if (flags.json) {
 			this.log(JSON.stringify({
 				...after?.ok ? after.data : {},
 				...result.data,
+				...!grantChanged && Array.isArray(standingNotes) ? { address_warnings: standingNotes } : {},
 				...grantChanged ? { notice: HELD_REQUEST_NOTICE } : {},
 				...grantChanged && rulesRemoved.length > 0 ? { rules_removed: rulesRemoved } : {},
 				...rulesNotOnKey.length > 0 ? { rules_not_on_key: rulesNotOnKey } : {},
@@ -87540,6 +88658,26 @@ var ThreadsMutedCommand = class ThreadsMutedCommand extends Command {
 		this.log(JSON.stringify(entries, null, 2));
 	}
 };
+// src/oclif/commands/version.ts
+/** The facts `--version` prints, as fields. `node` is Node's version without its leading v. */
+function versionInfo(config) {
+	return {
+		version: config.version,
+		platform: config.platform,
+		arch: config.arch,
+		node: process.versions.node
+	};
+}
+var VersionCommand = class VersionCommand extends Command {
+	static description = "Print the CLI's version, with the platform, architecture and Node version it runs on: the same line `primitive --version` prints. With --json, print them as fields. Needs no login and does not call the API.";
+	static summary = "Print the CLI version";
+	static examples = ["<%= config.bin %> version", "<%= config.bin %> version --json"];
+	static flags = { json: JSON_OUTPUT_FLAG };
+	async run() {
+		const { flags } = await this.parse(VersionCommand);
+		this.log(flags.json ? JSON.stringify(versionInfo(this.config), null, 2) : this.config.userAgent);
+	}
+};
 // src/oclif/verification-extract.ts
 const CODE_KEYWORD = /\b(?:verification|verify|verifying|one[- ]?time|otp|passcode|pass code|security code|login code|log[- ]?in code|sign[- ]?in code|access code|auth(?:entication)? code|confirmation code|confirm|code|pin|2fa|two[- ]factor|launch code)\b/i;
 const NOT_A_CODE = /\b(?:order|invoice|receipt|total|subtotal|amount|price|paid|charged|phone|tel|call|fax|mobile|ref|reference|ticket|case|account|acct|customer|member|zip|postal|suite|ste|po box|tracking|transaction|txn|item|sku|qty|quantity|street|st|ave|avenue|blvd|road|rd|floor)\b|[#$€£¥]/i;
@@ -89248,6 +90386,7 @@ const COMMANDS = {
 	signal: SignalCommand,
 	doctor: DoctorCommand,
 	billing: BillingCommand,
+	version: VersionCommand,
 	"machine:doctor": MachineDoctorCommand,
 	"emails:latest": EmailsLatestCommand,
 	"emails:attachment": EmailsAttachmentCommand,