From fdfd318a39662200f566fb632911b31e8930db85 Mon Sep 17 00:00:00 2001
From: Codex <codex@openai.com>
Date: Thu, 29 Oct 2026 20:33:25 +0000
Subject: [PATCH 01/41] feat(web): apply selected review suggestions in one
 revision

Preview exact replacements across files and publish one changeset using an inspected-head update. Preserve line endings, BOM and mode; leave discussions open. Reuse existing APIs without schema changes.

Validation: 779 web tests on reconciled main, typecheck, lint, production build and four real-server desktop/phone tests. Earlier mutation pass killed all 34 sites before grouping extraction; behavior tests rerun after extraction.
---
 CHANGELOG.md                                  |   4 +
 ROADMAP.md                                    |   2 +-
 apps/web/e2e/review-suggestions.spec.ts       | 109 ++++++++
 .../components/proposal/BatchSuggestions.vue  | 235 ++++++++++++++++++
 .../src/components/proposal/ReviewThreads.vue |   7 +
 apps/web/src/lib/applySuggestion.spec.ts      | 195 ++++++++++++++-
 apps/web/src/lib/applySuggestion.ts           |  91 ++++++-
 docs/adr/0030-fenced-review-suggestions.md    |   9 +-
 docs/guides/web-ui.md                         |   6 +
 9 files changed, 653 insertions(+), 5 deletions(-)
 create mode 100644 apps/web/src/components/proposal/BatchSuggestions.vue

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ac240f42..6bddad6f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,10 @@ on-disk formats are versioned and refuse to open when newer than the build under
 - Use component-specific fast CI for ordinary commits and cancel superseded work. Run the full platform/backend/browser/security matrix during qualification, reuse one server build for SDK runtimes, and retain compiled workspace caches.
 - Separate release preparation from publication. Promote the exact prepared and attested archives/images without rebuilding or repeating the Rust suite, with a three-minute publishing job and two-minute parallel public-install checks. Cold preparation and runner queues remain outside the five-minute ready-candidate publication target.
 
+### Added
+
+- Authors can preview and apply selected review suggestions across files as one proposal revision. Exact source lines, executable mode, BOM and line endings are preserved; conflicting selections are refused and discussions remain open.
+
 ## [0.3.0-beta.7] - 2026-10-29
 
 **Upgrade:** metadata schema 8 and control schema are unchanged from beta.6. Back up before upgrading. Returning to beta.5 or older requires the pre-upgrade backup.
diff --git a/ROADMAP.md b/ROADMAP.md
index 90765423..293ec379 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -103,7 +103,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    historical instructions and source links. Proposal updates now have an atomic inspected-head
    precondition as the prerequisite for safe review edits. Workspace mutations now compare the
    observed base/head in their final transaction, and proposal closing preserves terminal states. The final integration transaction also
-   rechecks the proposal head and open state. Single-line suggestions support explicit author preview and application. Next add batched/range suggestions and requested reviewers. Optional policy-required line-discussion resolution is now implemented
+   rechecks the proposal head and open state. Single-line and batched suggestions support explicit author preview and application across files in one revision. Next add range suggestions and requested reviewers. Optional policy-required line-discussion resolution is now implemented
    across core, API, CLI explanations and Web UI. Preserve drafts, exact-head
    checks and explicit confirmation when a user changes executable work or a review decision.
    Account-backed drafts and non-text conflict resolution remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
diff --git a/apps/web/e2e/review-suggestions.spec.ts b/apps/web/e2e/review-suggestions.spec.ts
index 94441f9f..f4616a17 100644
--- a/apps/web/e2e/review-suggestions.spec.ts
+++ b/apps/web/e2e/review-suggestions.spec.ts
@@ -102,3 +102,112 @@ test('a reviewer proposes code and the author applies the exact replacement with
   await author.close()
   await reviewer.close()
 })
+
+test('the author previews and applies selected suggestions across files in one revision', async ({
+  cast,
+  openAs,
+}, info) => {
+  const { repo } = await freshRepo(cast, 'batch-suggestions')
+  const alice = cast.as('alice')
+  const initial = await commitFiles(
+    alice,
+    repo,
+    {
+      'script.sh': '\uFEFFfirst\r\nsecond\r\nthird\r\n',
+      'note.txt': 'old\n',
+    },
+    'Files for review',
+  )
+  const proposal = await openProposal(alice, repo, {
+    head: initial.head,
+    title: 'Apply reviewed fixes together',
+  })
+  const entries = [
+    { path: 'script.sh', line: 1, replacement: 'one\nextra' },
+    { path: 'script.sh', line: 3, replacement: 'three' },
+    { path: 'note.txt', line: 1, replacement: 'new' },
+  ]
+  const bob = cast.as('bob')
+  for (const entry of entries) {
+    await bob.ok_(
+      bob.post(`/v1/repos/${repo}/proposals/${proposal.id}/threads`, {
+        expected_head: initial.head,
+        anchor: {
+          base: initial.base,
+          head: initial.head,
+          side: 'new',
+          path: entry.path,
+          line: entry.line,
+        },
+        body: `Use reviewed text.\n\n\`\`\`suggestion\n${entry.replacement}\n\`\`\``,
+      }),
+      'create suggestion',
+    )
+  }
+  const url = `/repos/${repo}/proposals/${proposal.id}?tab=reviews`
+  const reviewer = await openAs('bob')
+  await reviewer.goto(url)
+  await expect(reviewer.getByText('Use reviewed text.', { exact: true })).toHaveCount(3)
+  await expect(reviewer.getByText('Apply several suggestions', { exact: true })).toHaveCount(0)
+  const author = await openAs('alice')
+  await author.goto(url)
+  await author.getByText('Apply several suggestions', { exact: true }).click()
+  for (const entry of entries)
+    await author
+      .getByRole('checkbox', { name: `${entry.path}, line ${entry.line}`, exact: true })
+      .check()
+  await author.getByRole('button', { name: 'Review selected suggestions', exact: true }).click()
+  const dialog = author.getByRole('dialog', { name: 'Apply selected suggestions?' })
+  await expect(
+    dialog.getByRole('button', { name: 'Apply selected suggestions', exact: true }),
+  ).toBeEnabled()
+  await expect(dialog).toContainText('3 suggestions in 2 files')
+  expect(
+    (
+      await alice.ok_(
+        alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+        'inspect original revision',
+      )
+    ).proposal.head,
+  ).toBe(initial.head)
+  await author.screenshot({ path: info.outputPath('batch-suggestion-preview.png'), fullPage: true })
+  const mutations: string[] = []
+  author.on('request', (request) => {
+    if (request.method() === 'POST' && new URL(request.url()).pathname.endsWith('/changes'))
+      mutations.push('changes')
+    if (
+      request.method() === 'PATCH' &&
+      new URL(request.url()).pathname.endsWith(`/proposals/${proposal.id}`)
+    )
+      mutations.push('proposal')
+  })
+  await dialog.getByRole('button', { name: 'Apply selected suggestions', exact: true }).click()
+  await expect(dialog).toHaveCount(0)
+  expect(mutations).toEqual(['changes', 'proposal'])
+  const current = await alice.ok_(
+    alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'read resulting revision',
+  )
+  expect(current.proposal.head).not.toBe(initial.head)
+  for (const [path, text] of [
+    ['script.sh', '\uFEFFone\r\nextra\r\nsecond\r\nthree\r\n'],
+    ['note.txt', 'new\n'],
+  ]) {
+    const response = await fetch(
+      `${cast.baseURL}/v1/repos/${repo}/files/${path}?rev=${current.proposal.head}`,
+      { headers: { authorization: `Bearer ${cast.token('alice')}` } },
+    )
+    expect(response.status).toBe(200)
+    expect(Array.from(new Uint8Array(await response.arrayBuffer()))).toEqual(
+      Array.from(new TextEncoder().encode(text)),
+    )
+  }
+  const threads = await bob.ok_(
+    bob.get(`/v1/repos/${repo}/proposals/${proposal.id}/threads`),
+    'read retained discussions',
+  )
+  expect(threads.threads).toHaveLength(3)
+  expect(threads.threads.every((thread: { resolved: boolean }) => !thread.resolved)).toBe(true)
+  await reviewer.close()
+  await author.close()
+})
diff --git a/apps/web/src/components/proposal/BatchSuggestions.vue b/apps/web/src/components/proposal/BatchSuggestions.vue
new file mode 100644
index 00000000..d92fede1
--- /dev/null
+++ b/apps/web/src/components/proposal/BatchSuggestions.vue
@@ -0,0 +1,235 @@
+<script setup lang="ts">
+import { computed, onBeforeUnmount, ref, watch } from 'vue'
+import type { Proposal, ReviewThread } from '@/api/types'
+import { api } from '@/api/instance'
+import { describeError } from '@/api/errors'
+import { useAuth } from '@/stores/auth'
+import { samePrincipal } from '@/lib/identity'
+import { parseSuggestion } from '@/lib/reviewSuggestion'
+import { applySuggestions, previewSuggestions } from '@/lib/applySuggestion'
+import type { SuggestionPreview } from '@/lib/applySuggestion'
+import Alert from '@/ui/Alert.vue'
+import Button from '@/ui/Button.vue'
+import Checkbox from '@/ui/Checkbox.vue'
+import Dialog from '@/ui/Dialog.vue'
+
+const props = defineProps<{ repo: string; proposal: Proposal; threads: ReviewThread[] }>()
+const emit = defineEmits<{ applied: [] }>()
+const auth = useAuth()
+const allowed = computed(
+  () =>
+    props.proposal.state === 'open' &&
+    samePrincipal(props.proposal.author, auth.identity) &&
+    auth.can(props.repo, 'editFiles') &&
+    auth.capabilities?.features.includes('proposals.update_head'),
+)
+const candidates = computed(() =>
+  props.threads.flatMap((thread) => {
+    const suggestion = parseSuggestion(thread.body)
+    if (
+      !suggestion ||
+      thread.resolved ||
+      !thread.anchor ||
+      thread.anchor.side !== 'new' ||
+      thread.anchor.head !== props.proposal.head
+    )
+      return []
+    return [
+      {
+        id: thread.id,
+        version: thread.version,
+        anchor: thread.anchor,
+        replacement: suggestion.replacement,
+      },
+    ]
+  }),
+)
+const selected = ref<string[]>([])
+const choices = computed(() => candidates.value.filter((item) => selected.value.includes(item.id)))
+const open = ref(false),
+  busy = ref(false),
+  error = ref(''),
+  failed = ref(false)
+const previews = ref<SuggestionPreview[]>([])
+let generation = 0,
+  controller: AbortController | undefined,
+  preparedHead = ''
+function resetPreview() {
+  generation++
+  controller?.abort()
+  open.value = busy.value = failed.value = false
+  error.value = ''
+  previews.value = []
+}
+function reset() {
+  selected.value = []
+  resetPreview()
+}
+watch(
+  [
+    () => props.repo,
+    () => props.proposal.id,
+    () => props.proposal.head,
+    () => auth.token,
+    () => auth.identity,
+  ],
+  reset,
+  { flush: 'sync' },
+)
+watch(() => JSON.stringify(choices.value), resetPreview, { flush: 'sync' })
+onBeforeUnmount(resetPreview)
+function choose(id: string, checked: boolean) {
+  selected.value = checked
+    ? [...selected.value, id]
+    : selected.value.filter((value) => value !== id)
+}
+async function inspect() {
+  if (!allowed.value || busy.value || !choices.value.length) return
+  const mine = generation
+  preparedHead = props.proposal.head
+  open.value = busy.value = true
+  failed.value = false
+  error.value = ''
+  previews.value = []
+  controller = new AbortController()
+  try {
+    const result = await previewSuggestions(api, props.repo, preparedHead, choices.value, {
+      token: auth.token,
+      signal: controller.signal,
+      quietUnauthenticated: true,
+    })
+    if (mine === generation) previews.value = result
+  } catch (cause) {
+    if (mine === generation) error.value = describeError(cause)
+  } finally {
+    if (mine === generation) busy.value = false
+  }
+}
+async function apply() {
+  if (!allowed.value || busy.value || failed.value || !previews.value.length) return
+  const mine = generation
+  busy.value = true
+  error.value = ''
+  controller = new AbortController()
+  try {
+    await applySuggestions(
+      api,
+      props.repo,
+      props.proposal.id,
+      props.proposal.stream,
+      preparedHead,
+      previews.value,
+      {
+        token: auth.token,
+        signal: controller.signal,
+        quietUnauthenticated: true,
+      },
+    )
+    if (mine !== generation) return
+    reset()
+    emit('applied')
+  } catch (cause) {
+    if (mine === generation) {
+      failed.value = true
+      error.value = describeError(cause)
+    }
+  } finally {
+    if (mine === generation) busy.value = false
+  }
+}
+</script>
+
+<template>
+  <details v-if="allowed && candidates.length > 1" class="batch">
+    <summary>Apply several suggestions</summary>
+    <p>Choose suggestions from the loaded discussions. They will become one new revision.</p>
+    <ul class="choices">
+      <li v-for="item in candidates" :key="item.id">
+        <Checkbox
+          :model-value="selected.includes(item.id)"
+          :label="`${item.anchor.path}, line ${item.anchor.line}`"
+          :disabled="busy"
+          @update:model-value="(value) => choose(item.id, value)"
+        />
+        <pre v-if="item.replacement">{{ item.replacement }}</pre>
+        <p v-else>Delete this line.</p>
+      </li>
+    </ul>
+    <Button :disabled="!choices.length" @click="inspect">Review selected suggestions</Button>
+  </details>
+  <Dialog v-model="open" title="Apply selected suggestions?" :dismissable="!busy" size="lg">
+    <p>
+      {{ choices.length }} suggestions in {{ previews.length }} files. Checks and approvals must
+      match the new revision. Discussions stay open.
+    </p>
+    <p v-if="busy" role="status">Preparing the change…</p>
+    <Alert v-if="error" tone="bad" live="alert">
+      {{ error }}
+      <p v-if="failed">Close this preview and inspect the current revision before trying again.</p>
+    </Alert>
+    <section v-for="preview in previews" :key="preview.change.path" class="file-preview">
+      <h3>{{ preview.change.path }}</h3>
+      <details>
+        <summary>Current file</summary>
+        <pre>{{ preview.before }}</pre>
+      </details>
+      <details open>
+        <summary>Prepared file</summary>
+        <pre>{{ preview.after }}</pre>
+      </details>
+    </section>
+    <template #footer>
+      <Button :disabled="busy" @click="open = false">Cancel</Button>
+      <Button
+        variant="primary"
+        :disabled="!allowed || !previews.length || failed"
+        :loading="busy"
+        @click="apply"
+        >Apply selected suggestions</Button
+      >
+    </template>
+  </Dialog>
+</template>
+
+<style scoped>
+.batch {
+  padding: var(--s-4);
+  background: var(--surface-2);
+  border-radius: var(--r-sm);
+}
+summary {
+  cursor: pointer;
+  font-weight: 600;
+}
+.batch > p {
+  margin: var(--s-3) 0;
+  color: var(--text-2);
+  font-size: var(--fs-sm);
+}
+.choices {
+  list-style: none;
+  padding: 0;
+  margin: var(--s-3) 0;
+  display: grid;
+  gap: var(--s-4);
+}
+pre {
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  max-height: 20rem;
+  overflow: auto;
+  font-family: var(--font-mono);
+  font-size: var(--fs-sm);
+}
+.choices pre {
+  margin: var(--s-2) 0 0 var(--s-5);
+}
+.file-preview {
+  margin-top: var(--s-4);
+  padding-top: var(--s-3);
+  border-top: 1px solid var(--border);
+}
+.file-preview details {
+  margin-top: var(--s-3);
+}
+</style>
diff --git a/apps/web/src/components/proposal/ReviewThreads.vue b/apps/web/src/components/proposal/ReviewThreads.vue
index 25852123..d0bc8336 100644
--- a/apps/web/src/components/proposal/ReviewThreads.vue
+++ b/apps/web/src/components/proposal/ReviewThreads.vue
@@ -8,6 +8,7 @@ import { usePagedResource } from '@/composables/usePagedResource'
 import { useLiveReload } from '@/composables/useLiveReload'
 import ThreadComposer from './ThreadComposer.vue'
 import ReviewThreadCard from './ReviewThreadCard.vue'
+import BatchSuggestions from './BatchSuggestions.vue'
 import Button from '@/ui/Button.vue'
 import ErrorState from '@/ui/ErrorState.vue'
 const props = defineProps<{ repo: string; proposal: Proposal; quote?: LineQuote | null }>()
@@ -89,6 +90,12 @@ watch([() => props.repo, () => props.proposal.id, () => auth.token], () => {
     >
       No {{ filter }} discussions in the loaded results.
     </p>
+    <BatchSuggestions
+      :repo="repo"
+      :proposal="proposal"
+      :threads="threads.data.value"
+      @applied="emit('applied')"
+    />
     <ReviewThreadCard
       v-for="thread in threads.data.value"
       v-show="filter === 'all' || thread.resolved === (filter === 'resolved')"
diff --git a/apps/web/src/lib/applySuggestion.spec.ts b/apps/web/src/lib/applySuggestion.spec.ts
index 4b1c8191..63ff0edd 100644
--- a/apps/web/src/lib/applySuggestion.spec.ts
+++ b/apps/web/src/lib/applySuggestion.spec.ts
@@ -1,7 +1,12 @@
 // @vitest-environment node
 import { describe, expect, it, vi } from 'vitest'
 import type { Api } from '@/api/endpoints'
-import { applySuggestion, previewSuggestion } from './applySuggestion'
+import {
+  applySuggestion,
+  previewSuggestion,
+  previewSuggestions,
+  applySuggestions,
+} from './applySuggestion'
 
 const anchor = {
   head: 'seen',
@@ -97,3 +102,191 @@ describe('suggestion publication', () => {
     )
   })
 })
+
+describe('batched suggestion publication', () => {
+  it('combines same-file suggestions against their original line numbers', async () => {
+    const { api, raw } = fixture()
+    raw.tree.file.mockResolvedValue({
+      bytes: new TextEncoder().encode('\uFEFFold\r\ntwo\r\n'),
+      truncated: false,
+    })
+    const previews = await previewSuggestions(
+      api,
+      'team/repo',
+      'seen',
+      [
+        { anchor, replacement: 'new' },
+        { anchor: { ...anchor, line: 2, text: 'two' }, replacement: 'more\nlines' },
+      ],
+      context,
+    )
+    expect(previews).toHaveLength(1)
+    expect(previews[0]!.after).toBe('\uFEFFnew\r\nmore\r\nlines\r\n')
+    expect(previews[0]!.change.executable).toBe(true)
+    expect(raw.tree.file).toHaveBeenCalledOnce()
+  })
+
+  it('publishes multiple files as one workspace change and one head update', async () => {
+    const { api, raw } = fixture()
+    const previews = await previewSuggestions(
+      api,
+      'team/repo',
+      'seen',
+      [
+        { anchor, replacement: 'new' },
+        { anchor: { ...anchor, path: 'another.sh' }, replacement: 'another' },
+      ],
+      context,
+    )
+    await applySuggestions(api, 'team/repo', 'proposal', 'dev', 'seen', previews, context)
+    expect(raw.workspaces.modify).toHaveBeenCalledOnce()
+    const body = raw.workspaces.modify.mock.calls[0]![2]
+    expect(body.expected_head).toBe('seen')
+    expect(body.changes.map((change: { path: string }) => change.path)).toEqual([
+      'another.sh',
+      'script.sh',
+    ])
+    expect(raw.proposals.update).toHaveBeenCalledOnce()
+    expect(raw.workspaces.remove).toHaveBeenCalledOnce()
+  })
+
+  it('rejects competing replacements for one original line before reading files', async () => {
+    const { api, raw } = fixture()
+    await expect(
+      previewSuggestions(
+        api,
+        'team/repo',
+        'seen',
+        [
+          { anchor, replacement: 'one' },
+          { anchor, replacement: 'two' },
+        ],
+        context,
+      ),
+    ).rejects.toThrow(/same line/)
+    expect(raw.tree.file).not.toHaveBeenCalled()
+  })
+
+  it('rejects mixed revisions and empty batches before reading files', async () => {
+    const { api, raw } = fixture()
+    await expect(
+      previewSuggestions(
+        api,
+        'team/repo',
+        'seen',
+        [{ anchor: { ...anchor, head: 'stale' }, replacement: 'new' }],
+        context,
+      ),
+    ).rejects.toThrow(/revision/)
+    await expect(previewSuggestions(api, 'team/repo', 'seen', [], context)).rejects.toThrow(
+      /Select/,
+    )
+    expect(raw.tree.file).not.toHaveBeenCalled()
+  })
+})
+
+describe('suggestion limits and ordering', () => {
+  it('applies lower original lines after higher lines even when they insert new lines', async () => {
+    const { api, raw } = fixture()
+    raw.tree.file.mockResolvedValue({
+      bytes: new TextEncoder().encode('first\nsecond\n'),
+      truncated: false,
+    })
+    const [preview] = await previewSuggestions(
+      api,
+      'team/repo',
+      'seen',
+      [
+        { anchor: { ...anchor, text: 'first' }, replacement: 'one\nextra' },
+        { anchor: { ...anchor, line: 2, text: 'second' }, replacement: 'two' },
+      ],
+      context,
+    )
+    expect(preview!.after).toBe('one\nextra\ntwo\n')
+  })
+
+  it('accepts exactly 100 suggestions and rejects 101 before reading files', async () => {
+    const { api, raw } = fixture()
+    const suggestions = Array.from({ length: 100 }, (_, index) => ({
+      anchor: { ...anchor, path: `f${index}` },
+      replacement: 'new',
+    }))
+    expect(await previewSuggestions(api, 'team/repo', 'seen', suggestions, context)).toHaveLength(
+      100,
+    )
+    raw.tree.file.mockClear()
+    await expect(
+      previewSuggestions(api, 'team/repo', 'seen', [...suggestions, suggestions[0]!], context),
+    ).rejects.toThrow(/100/)
+    expect(raw.tree.file).not.toHaveBeenCalled()
+  })
+
+  it('accepts a 4 MiB result and rejects one additional byte', async () => {
+    const { api, raw } = fixture()
+    raw.tree.file.mockResolvedValue({ bytes: new TextEncoder().encode('old'), truncated: false })
+    const replacement = 'x'.repeat(4 * 1024 * 1024)
+    expect(
+      await previewSuggestions(
+        api,
+        'team/repo',
+        'seen',
+        [{ anchor: { ...anchor, text: 'old' }, replacement }],
+        context,
+      ),
+    ).toHaveLength(1)
+    await expect(
+      previewSuggestions(
+        api,
+        'team/repo',
+        'seen',
+        [{ anchor: { ...anchor, text: 'old' }, replacement: replacement + 'x' }],
+        context,
+      ),
+    ).rejects.toThrow(/4 MiB/)
+  })
+
+  it('enforces file fetch bounds, malformed UTF-8 and missing entries', async () => {
+    const { api, raw } = fixture()
+    await previewSuggestion(api, 'team/repo', anchor, 'new', context)
+    expect(raw.tree.file).toHaveBeenCalledWith(
+      'team/repo',
+      'seen',
+      'script.sh',
+      1024 * 1024,
+      context,
+    )
+    raw.tree.file.mockResolvedValue({
+      bytes: new Uint8Array([111, 108, 100, 10, 255]),
+      truncated: false,
+    })
+    await expect(
+      previewSuggestion(api, 'team/repo', { ...anchor, text: 'old' }, 'new', context),
+    ).rejects.toThrow()
+    raw.tree.resolve.mockResolvedValue({})
+    await expect(previewSuggestion(api, 'team/repo', anchor, 'new', context)).rejects.toThrow(
+      /regular text files/,
+    )
+  })
+
+  it('bounds prepared files and records a useful change message', async () => {
+    const { api, raw } = fixture()
+    const preview = await previewSuggestion(api, 'team/repo', anchor, 'new', context)
+    for (const count of [0, 101]) {
+      await expect(
+        applySuggestions(api, 'team/repo', 'p', 'dev', 'seen', Array(count).fill(preview), context),
+      ).rejects.toThrow(/100/)
+    }
+    expect(raw.workspaces.create).not.toHaveBeenCalled()
+    await applySuggestions(api, 'team/repo', 'p', 'dev', 'seen', Array(100).fill(preview), context)
+    expect(raw.workspaces.modify.mock.calls[0]![2].message).toBe('Apply review suggestions')
+    await applySuggestions(api, 'team/repo', 'p', 'dev', 'seen', [preview], context)
+    expect(raw.workspaces.modify.mock.calls[1]![2].message).toBe(
+      'Apply review suggestion to script.sh',
+    )
+    expect(raw.workspaces.remove).toHaveBeenCalledWith(
+      'team/repo',
+      expect.any(String),
+      expect.objectContaining({ quietUnauthenticated: true }),
+    )
+  })
+})
diff --git a/apps/web/src/lib/applySuggestion.ts b/apps/web/src/lib/applySuggestion.ts
index 4cfc97bd..871362d8 100644
--- a/apps/web/src/lib/applySuggestion.ts
+++ b/apps/web/src/lib/applySuggestion.ts
@@ -34,6 +34,76 @@ export async function previewSuggestion(
   return { before, after, change: putFile(anchor.path, after, location.entry.executable) }
 }
 
+export interface SuggestionInput {
+  anchor: ReviewLineAnchor
+  replacement: string
+}
+
+/** Prepare one change per file, applying original line numbers from bottom to top. */
+export async function previewSuggestions(
+  api: Api,
+  repo: string,
+  head: string,
+  suggestions: SuggestionInput[],
+  request: Session,
+): Promise<SuggestionPreview[]> {
+  const files = groupSuggestions(head, suggestions)
+  const result: SuggestionPreview[] = []
+  let bytes = 0
+  for (const path of [...files.keys()].sort()) {
+    request.signal?.throwIfAborted()
+    const preview = await previewFileSuggestions(api, repo, files.get(path)!, request)
+    bytes += new TextEncoder().encode(preview.after).length
+    if (bytes > 4 * 1024 * 1024)
+      throw new Error('The selected changes exceed 4 MiB. Select fewer suggestions.')
+    result.push(preview)
+  }
+  return result
+}
+
+function groupSuggestions(
+  head: string,
+  suggestions: SuggestionInput[],
+): Map<string, SuggestionInput[]> {
+  if (!suggestions.length || suggestions.length > 100)
+    throw new Error('Select between 1 and 100 suggestions.')
+  const seen = new Set<string>()
+  const files = new Map<string, SuggestionInput[]>()
+  for (const suggestion of suggestions) {
+    const anchor = suggestion.anchor
+    if (anchor.head !== head || anchor.side !== 'new')
+      throw new Error('Every suggestion must belong to the current proposed revision.')
+    const key = JSON.stringify([anchor.path, anchor.line])
+    if (seen.has(key)) throw new Error('Choose only one suggestion for the same line.')
+    seen.add(key)
+    const group = files.get(anchor.path) || []
+    group.push(suggestion)
+    files.set(anchor.path, group)
+  }
+  return files
+}
+
+/** Each anchor still addresses the immutable original file's line numbers. */
+async function previewFileSuggestions(
+  api: Api,
+  repo: string,
+  suggestions: SuggestionInput[],
+  request: Session,
+): Promise<SuggestionPreview> {
+  const group = [...suggestions].sort((a, b) => b.anchor.line - a.anchor.line)
+  const first = group[0]!
+  const preview = await previewSuggestion(api, repo, first.anchor, first.replacement, request)
+  for (const suggestion of group.slice(1))
+    preview.after = replaceSuggestedLine(
+      preview.after,
+      suggestion.anchor.line,
+      suggestion.anchor.text,
+      suggestion.replacement,
+    )
+  preview.change = putFile(first.anchor.path, preview.after, preview.change.executable)
+  return preview
+}
+
 /** A private workspace prepares content; only a head-checked update publishes it to the proposal. */
 export async function applySuggestion(
   api: Api,
@@ -44,6 +114,20 @@ export async function applySuggestion(
   preview: SuggestionPreview,
   request: Session,
 ): Promise<void> {
+  return applySuggestions(api, repo, proposal, stream, head, [preview], request)
+}
+
+/** Publish the complete preview in one changeset with one inspected-head update. */
+export async function applySuggestions(
+  api: Api,
+  repo: string,
+  proposal: string,
+  stream: string,
+  head: string,
+  previews: SuggestionPreview[],
+  request: Session,
+): Promise<void> {
+  if (!previews.length || previews.length > 100) throw new Error('Select between 1 and 100 files.')
   request.signal?.throwIfAborted()
   const name = workspaceName()
   const workspace = await api.workspaces.create(repo, { name, stream, from_rev: head }, request)
@@ -55,9 +139,12 @@ export async function applySuggestion(
       repo,
       name,
       {
-        changes: [preview.change],
+        changes: previews.map((preview) => preview.change),
         expected_head: head,
-        message: `Apply review suggestion to ${preview.change.path}`,
+        message:
+          previews.length === 1
+            ? `Apply review suggestion to ${previews[0]!.change.path}`
+            : 'Apply review suggestions',
       },
       request,
     )
diff --git a/docs/adr/0030-fenced-review-suggestions.md b/docs/adr/0030-fenced-review-suggestions.md
index 4180c54a..a640241f 100644
--- a/docs/adr/0030-fenced-review-suggestions.md
+++ b/docs/adr/0030-fenced-review-suggestions.md
@@ -30,8 +30,15 @@ The operation does not integrate a branch, forge an approval, preserve a validat
 content or automatically resolve the discussion. Normal new-head review and exact-tree check
 rules still apply. The old suggestion remains attached to its old revision and readable.
 
+Authors can also select suggestions from loaded discussions for one explicit batch preview.
+All anchors must belong to the current proposed head; duplicate file/line anchors are refused.
+Within each file, replacements run from the last original line upward so inserted or deleted
+lines cannot shift remaining anchors. Up to 100 suggestions and 4 MiB of resulting content
+produce one workspace changeset and one head-checked proposal update. Files are read once
+and every exact source line is checked before publishing. Discussions remain open.
+
 ## Remaining scope
 
-Multi-line anchor ranges, batched application, server-native suggestion metadata and an
+Multi-line anchor ranges, server-native suggestion metadata and an
 explicit native CLI apply command remain future work. Existing CLI/SDK thread body operations
 can read and write the convention without schema changes.
diff --git a/docs/guides/web-ui.md b/docs/guides/web-ui.md
index 4452b19a..291fbd44 100644
--- a/docs/guides/web-ui.md
+++ b/docs/guides/web-ui.md
@@ -607,6 +607,12 @@ and line endings. Existing checks and approvals must match the new revision. The
 stays open until reviewed and resolved separately. Earlier-revision suggestions remain readable
 and copyable; they cannot overwrite newer work.
 
+To combine changes, expand **Apply several suggestions** in the discussions, select the
+suggestions and choose **Review selected suggestions**. Inspect the prepared files before
+confirming. Up to 100 suggestions across files become one revision; conflicting suggestions
+for the same line are refused. Only loaded discussions are included: use **Load more
+discussions** to include older results. The total prepared content is limited to 4 MiB.
+
 Application requires a server with `proposals.update_head` and is limited to regular UTF-8
 files up to 1 MiB. Symlinks, binary files, old-side lines and changed source lines require the
 ordinary editor or CLI. This first version replaces one anchored line, not a selected range.

From 6c56df367c12d6950b2c4de184c2dd23cb81d62b Mon Sep 17 00:00:00 2001
From: Codex <codex@openai.com>
Date: Thu, 29 Oct 2026 20:40:49 +0000
Subject: [PATCH 02/41] feat(web): apply revision-bound suggestions to line
 ranges

Use an explicit range fence in existing discussion bodies, preserve source format, retain range drafts and reject overlapping batches. Show the original file and require author confirmation. No protocol or storage change.

Validation: 785 full web tests before boundary additions, 24 focused final tests, typecheck, six real-server desktop/phone scenarios. Mutation pass killed 66 of 67 candidates; remaining single-line parser default mutation produces the same public result.
---
 CHANGELOG.md                                  |  2 +
 ROADMAP.md                                    |  2 +-
 apps/web/e2e/review-suggestions.spec.ts       | 65 +++++++++++++++++++
 .../components/proposal/BatchSuggestions.vue  |  3 +-
 .../components/proposal/ReviewSuggestion.vue  | 30 +++++++--
 .../components/proposal/ThreadComposer.vue    | 52 +++++++++++++--
 apps/web/src/lib/applySuggestion.spec.ts      | 30 +++++++++
 apps/web/src/lib/applySuggestion.ts           | 28 ++++++--
 apps/web/src/lib/rangeSuggestions.spec.ts     | 52 +++++++++++++++
 apps/web/src/lib/reviewSuggestion.ts          | 41 ++++++++++--
 docs/adr/0030-fenced-review-suggestions.md    | 12 ++--
 docs/guides/web-ui.md                         | 12 ++--
 12 files changed, 295 insertions(+), 34 deletions(-)
 create mode 100644 apps/web/src/lib/rangeSuggestions.spec.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6bddad6f..b92b0a04 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Added
 
+- Review suggestions can replace up to 100 consecutive original lines. Range drafts survive reload, previews show the source file, and batches reject overlapping ranges before publication. Existing one-line suggestions keep their original format.
+
 - Authors can preview and apply selected review suggestions across files as one proposal revision. Exact source lines, executable mode, BOM and line endings are preserved; conflicting selections are refused and discussions remain open.
 
 ## [0.3.0-beta.7] - 2026-10-29
diff --git a/ROADMAP.md b/ROADMAP.md
index 293ec379..38597056 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -103,7 +103,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    historical instructions and source links. Proposal updates now have an atomic inspected-head
    precondition as the prerequisite for safe review edits. Workspace mutations now compare the
    observed base/head in their final transaction, and proposal closing preserves terminal states. The final integration transaction also
-   rechecks the proposal head and open state. Single-line and batched suggestions support explicit author preview and application across files in one revision. Next add range suggestions and requested reviewers. Optional policy-required line-discussion resolution is now implemented
+   rechecks the proposal head and open state. Single-line, range and batched suggestions support explicit author preview and application across files in one revision. Next add requested reviewers. Optional policy-required line-discussion resolution is now implemented
    across core, API, CLI explanations and Web UI. Preserve drafts, exact-head
    checks and explicit confirmation when a user changes executable work or a review decision.
    Account-backed drafts and non-text conflict resolution remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
diff --git a/apps/web/e2e/review-suggestions.spec.ts b/apps/web/e2e/review-suggestions.spec.ts
index f4616a17..79044c85 100644
--- a/apps/web/e2e/review-suggestions.spec.ts
+++ b/apps/web/e2e/review-suggestions.spec.ts
@@ -211,3 +211,68 @@ test('the author previews and applies selected suggestions across files in one r
   await reviewer.close()
   await author.close()
 })
+
+test('a reviewer selects a range and the author confirms the exact prepared file', async ({
+  cast,
+  openAs,
+}, info) => {
+  const { repo } = await freshRepo(cast, 'range-suggestions')
+  const alice = cast.as('alice')
+  const original = '\uFEFFfirst\r\nold one\r\nold two\r\nlast\r\n'
+  const initial = await commitFiles(alice, repo, { 'code.txt': original }, 'Range source')
+  const proposal = await openProposal(alice, repo, { head: initial.head, title: 'Review a block' })
+  const url = `/repos/${repo}/proposals/${proposal.id}`
+  const reviewer = await openAs('bob')
+  await reviewer.goto(url)
+  await reviewer
+    .getByRole('button', { name: 'Discuss new line 2 of code.txt', exact: true })
+    .click()
+  await reviewer.getByRole('button', { name: 'Suggest a replacement', exact: true }).click()
+  await reviewer.getByRole('spinbutton', { name: 'Lines to replace', exact: true }).fill('101')
+  await expect(
+    reviewer.getByRole('button', { name: 'Start discussion', exact: true }),
+  ).toBeDisabled()
+  await reviewer.getByRole('spinbutton', { name: 'Lines to replace', exact: true }).fill('2')
+  await reviewer
+    .getByRole('textbox', { name: 'Replacement code', exact: true })
+    .fill('new one\nnew two\nextra')
+  await reviewer.reload()
+  await expect(
+    reviewer.getByRole('spinbutton', { name: 'Lines to replace', exact: true }),
+  ).toHaveValue('2')
+  await expect(
+    reviewer.getByRole('textbox', { name: 'Replacement code', exact: true }),
+  ).toHaveValue('new one\nnew two\nextra')
+  await reviewer.getByRole('button', { name: 'Start discussion', exact: true }).click()
+  await expect(reviewer.getByRole('region', { name: 'Suggested replacement' })).toBeVisible()
+  const author = await openAs('alice')
+  await author.goto(`${url}?tab=reviews`)
+  await author.getByRole('button', { name: 'Review and apply suggestion', exact: true }).click()
+  const dialog = author.getByRole('dialog', { name: 'Apply this suggestion?' })
+  await expect(dialog).toContainText('lines 2–3')
+  await expect(dialog).toContainText('old two')
+  await expect(dialog).toContainText('new two')
+  await author.screenshot({ path: info.outputPath('range-suggestion-preview.png'), fullPage: true })
+  const before = await alice.ok_(
+    alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'check before range confirmation',
+  )
+  expect(before.proposal.head).toBe(initial.head)
+  await dialog.getByRole('button', { name: 'Apply suggestion', exact: true }).click()
+  await expect(dialog).toHaveCount(0)
+  const after = await alice.ok_(
+    alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'read range revision',
+  )
+  expect(after.proposal.head).not.toBe(initial.head)
+  const response = await fetch(
+    `${alice.base}/v1/repos/${repo}/files/code.txt?rev=${after.proposal.head}`,
+    { headers: { Authorization: `Bearer ${alice.token}` } },
+  )
+  expect(response.status).toBe(200)
+  expect(Buffer.from(await response.arrayBuffer())).toEqual(
+    Buffer.from('\uFEFFfirst\r\nnew one\r\nnew two\r\nextra\r\nlast\r\n'),
+  )
+  await author.close()
+  await reviewer.close()
+})
diff --git a/apps/web/src/components/proposal/BatchSuggestions.vue b/apps/web/src/components/proposal/BatchSuggestions.vue
index d92fede1..522c296c 100644
--- a/apps/web/src/components/proposal/BatchSuggestions.vue
+++ b/apps/web/src/components/proposal/BatchSuggestions.vue
@@ -40,6 +40,7 @@ const candidates = computed(() =>
         version: thread.version,
         anchor: thread.anchor,
         replacement: suggestion.replacement,
+        lines: suggestion.lines,
       },
     ]
   }),
@@ -147,7 +148,7 @@ async function apply() {
       <li v-for="item in candidates" :key="item.id">
         <Checkbox
           :model-value="selected.includes(item.id)"
-          :label="`${item.anchor.path}, line ${item.anchor.line}`"
+          :label="`${item.anchor.path}, ${item.lines ? `lines ${item.anchor.line}–${item.anchor.line + item.lines - 1}` : `line ${item.anchor.line}`}`"
           :disabled="busy"
           @update:model-value="(value) => choose(item.id, value)"
         />
diff --git a/apps/web/src/components/proposal/ReviewSuggestion.vue b/apps/web/src/components/proposal/ReviewSuggestion.vue
index 01e20d9e..33919522 100644
--- a/apps/web/src/components/proposal/ReviewSuggestion.vue
+++ b/apps/web/src/components/proposal/ReviewSuggestion.vue
@@ -56,6 +56,8 @@ watch(
     () => props.proposal.id,
     () => props.proposal.head,
     () => props.thread.id,
+    () => props.thread.version,
+    () => props.thread.body,
     () => auth.token,
   ],
   reset,
@@ -76,6 +78,7 @@ async function inspect() {
       props.thread.anchor,
       props.suggestion.replacement,
       { token: auth.token, quietUnauthenticated: true, signal: controller.signal },
+      props.suggestion.lines,
     )
     if (mine === generation) preview.value = prepared
   } catch (cause) {
@@ -115,8 +118,13 @@ async function apply() {
 <template>
   <section class="suggestion" aria-label="Suggested replacement">
     <strong>Suggested replacement</strong>
+    <p v-if="suggestion.lines" class="muted">
+      Replaces original lines {{ thread.anchor?.line }}–{{
+        (thread.anchor?.line || 0) + suggestion.lines - 1
+      }}.
+    </p>
     <pre v-if="suggestion.replacement" class="replacement">{{ suggestion.replacement }}</pre>
-    <p v-else>Delete this line.</p>
+    <p v-else>Delete {{ suggestion.lines ? `these ${suggestion.lines} lines` : 'this line' }}.</p>
     <div class="actions">
       <CopyButton :text="suggestion.replacement" label="Copy suggested code" with-label />
       <Button v-if="canApply" size="sm" @click="inspect">Review and apply suggestion</Button>
@@ -127,15 +135,23 @@ async function apply() {
     </p>
   </section>
   <Dialog v-model="open" title="Apply this suggestion?" :dismissable="!busy" size="lg">
-    <p>{{ thread.anchor?.path }} · line {{ thread.anchor?.line }}</p>
+    <p>
+      {{ thread.anchor?.path }} ·
+      {{
+        suggestion.lines
+          ? `lines ${thread.anchor!.line}–${thread.anchor!.line + suggestion.lines - 1}`
+          : `line ${thread.anchor?.line}`
+      }}
+    </p>
     <p class="muted">
-      Replaces only this line in the inspected revision. The discussion stays open for review.
+      Replaces {{ suggestion.lines || 1 }} original {{ suggestion.lines ? 'lines' : 'line' }} in the
+      inspected revision. The discussion stays open for review.
     </p>
-    <h3>Current line</h3>
-    <pre class="replacement">{{ thread.anchor?.text }}</pre>
+    <h3>{{ suggestion.lines ? 'Current file' : 'Current line' }}</h3>
+    <pre class="replacement">{{ suggestion.lines ? preview?.before : thread.anchor?.text }}</pre>
     <h3>Replacement</h3>
     <pre v-if="suggestion.replacement" class="replacement">{{ suggestion.replacement }}</pre>
-    <p v-else>Delete this line.</p>
+    <p v-else>Delete {{ suggestion.lines ? `these ${suggestion.lines} lines` : 'this line' }}.</p>
     <p v-if="busy" role="status">Preparing the change…</p>
     <Alert v-if="error" tone="bad" live="alert">{{ error }}</Alert>
     <template #footer>
@@ -160,6 +176,8 @@ async function apply() {
   white-space: pre-wrap;
   overflow-wrap: anywhere;
   font-family: var(--font-mono);
+  max-height: 20rem;
+  overflow: auto;
 }
 .actions {
   display: flex;
diff --git a/apps/web/src/components/proposal/ThreadComposer.vue b/apps/web/src/components/proposal/ThreadComposer.vue
index d79412eb..630b3920 100644
--- a/apps/web/src/components/proposal/ThreadComposer.vue
+++ b/apps/web/src/components/proposal/ThreadComposer.vue
@@ -11,6 +11,7 @@ import { useThreadAnchor } from '@/composables/useThreadAnchor'
 import Alert from '@/ui/Alert.vue'
 import Button from '@/ui/Button.vue'
 import TextArea from '@/ui/TextArea.vue'
+import TextField from '@/ui/TextField.vue'
 import CopyButton from '@/ui/CopyButton.vue'
 
 const props = defineProps<{ repo: string; proposal: Proposal; quote?: LineQuote | null }>()
@@ -27,15 +28,46 @@ const suggestion = computed(() => parseSuggestion(draft.body.value))
 const explanation = computed({
   get: () => suggestion.value?.explanation || '',
   set: (value) => {
-    draft.body.value = formatSuggestion(value, suggestion.value?.replacement || '')
+    draft.body.value = formatSuggestion(
+      value,
+      suggestion.value?.replacement || '',
+      suggestion.value?.lines,
+    )
   },
 })
 const replacement = computed({
   get: () => suggestion.value?.replacement || '',
   set: (value) => {
-    draft.body.value = formatSuggestion(suggestion.value?.explanation || '', value)
+    draft.body.value = formatSuggestion(
+      suggestion.value?.explanation || '',
+      value,
+      suggestion.value?.lines,
+    )
   },
 })
+const lineCount = ref('1')
+watch(
+  () => suggestion.value?.lines,
+  (value) => {
+    lineCount.value = String(value || 1)
+  },
+  { immediate: true },
+)
+const rangeError = computed(() =>
+  suggestion.value &&
+  (!/^\d+$/.test(lineCount.value) || Number(lineCount.value) < 1 || Number(lineCount.value) > 100)
+    ? 'Choose between 1 and 100 original lines.'
+    : '',
+)
+function setLineCount(value: string) {
+  lineCount.value = value
+  if (!rangeError.value && suggestion.value)
+    draft.body.value = formatSuggestion(
+      suggestion.value.explanation,
+      suggestion.value.replacement,
+      Number(value),
+    )
+}
 function suggest() {
   if (selected.anchor.value?.side === 'new')
     draft.body.value = formatSuggestion(draft.body.value, selected.anchor.value.text)
@@ -88,6 +120,7 @@ async function create() {
     !allowed.value ||
     busy.value ||
     stale.value ||
+    !!rangeError.value ||
     !selected.anchor.value ||
     !draft.body.value.trim()
   )
@@ -140,6 +173,17 @@ async function create() {
     <pre class="source">{{ selected.anchor.value.text }}</pre>
     <p class="muted">The server verifies this line against the exact revision you inspected.</p>
     <template v-if="suggestion">
+      <TextField
+        :model-value="lineCount"
+        label="Lines to replace"
+        type="number"
+        :min="1"
+        :max="100"
+        :disabled="busy"
+        :error="rangeError"
+        :hint="`Count original lines starting at line ${selected.anchor.value.line}. Saved with this draft.`"
+        @update:model-value="setLineCount"
+      />
       <TextArea v-model="explanation" label="Explain this suggestion" :disabled="busy" :rows="2" />
       <TextArea
         v-model="replacement"
@@ -147,7 +191,7 @@ async function create() {
         :disabled="busy"
         :rows="5"
         mono
-        hint="Replaces this one line. Multiple replacement lines are allowed. Empty deletes the line. Saved in this tab."
+        hint="Replaces the selected original lines. Empty deletes the range. Saved in this tab."
       />
       <Button size="sm" :disabled="busy" @click="removeSuggestion"
         >Keep as ordinary discussion</Button
@@ -178,7 +222,7 @@ async function create() {
       <Button
         type="submit"
         variant="primary"
-        :disabled="stale || !draft.body.value.trim()"
+        :disabled="stale || !!rangeError || !draft.body.value.trim()"
         :loading="busy"
         >Start discussion</Button
       >
diff --git a/apps/web/src/lib/applySuggestion.spec.ts b/apps/web/src/lib/applySuggestion.spec.ts
index 63ff0edd..214b15a7 100644
--- a/apps/web/src/lib/applySuggestion.spec.ts
+++ b/apps/web/src/lib/applySuggestion.spec.ts
@@ -290,3 +290,33 @@ describe('suggestion limits and ordering', () => {
     )
   })
 })
+
+describe('range suggestion previews', () => {
+  it('previews one range against the anchored revision', async () => {
+    const { api, raw } = fixture()
+    raw.tree.file.mockResolvedValue({
+      bytes: new TextEncoder().encode('\uFEFFold\r\nsecond\r\nlast\r\n'),
+      truncated: false,
+    })
+    const preview = await previewSuggestion(api, 'team/repo', anchor, 'new', context, 2)
+    expect(preview.after).toBe('\uFEFFnew\r\nlast\r\n')
+  })
+
+  it('rejects overlapping ranges before reading or modifying any file', async () => {
+    const { api, raw } = fixture()
+    await expect(
+      previewSuggestions(
+        api,
+        'team/repo',
+        'seen',
+        [
+          { anchor, replacement: 'new', lines: 2 },
+          { anchor: { ...anchor, line: 2, text: 'second' }, replacement: 'other' },
+        ],
+        context,
+      ),
+    ).rejects.toThrow(/overlap/)
+    expect(raw.tree.file).not.toHaveBeenCalled()
+    expect(raw.workspaces.create).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/applySuggestion.ts b/apps/web/src/lib/applySuggestion.ts
index 871362d8..fa12d309 100644
--- a/apps/web/src/lib/applySuggestion.ts
+++ b/apps/web/src/lib/applySuggestion.ts
@@ -2,7 +2,7 @@ import type { Api } from '@/api/endpoints'
 import type { RequestOptions } from '@/api/client'
 import type { FileChange, ReviewLineAnchor } from '@/api/types'
 import { putFile, workspaceName } from './edit'
-import { replaceSuggestedLine } from './reviewSuggestion'
+import { replaceSuggestedRange, suggestionLineCount } from './reviewSuggestion'
 
 type Session = Pick<RequestOptions, 'token' | 'signal' | 'quietUnauthenticated'>
 export interface SuggestionPreview {
@@ -17,6 +17,7 @@ export async function previewSuggestion(
   anchor: ReviewLineAnchor,
   replacement: string,
   request: Session,
+  lines = 1,
 ): Promise<SuggestionPreview> {
   if (anchor.side !== 'new')
     throw new Error('Select a line in the proposed version to suggest a replacement.')
@@ -29,12 +30,13 @@ export async function previewSuggestion(
       'Suggestions apply to regular text files up to 1 MiB. Use the file editor for this file.',
     )
   const before = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(file.bytes)
-  const after = replaceSuggestedLine(before, anchor.line, anchor.text, replacement)
+  const after = replaceSuggestedRange(before, anchor.line, anchor.text, replacement, lines)
   if (after === before) throw new Error('This suggestion does not change the file.')
   return { before, after, change: putFile(anchor.path, after, location.entry.executable) }
 }
 
 export interface SuggestionInput {
+  lines?: number
   anchor: ReviewLineAnchor
   replacement: string
 }
@@ -73,9 +75,13 @@ function groupSuggestions(
     const anchor = suggestion.anchor
     if (anchor.head !== head || anchor.side !== 'new')
       throw new Error('Every suggestion must belong to the current proposed revision.')
-    const key = JSON.stringify([anchor.path, anchor.line])
-    if (seen.has(key)) throw new Error('Choose only one suggestion for the same line.')
-    seen.add(key)
+    const lines = suggestionLineCount(suggestion.lines)
+    for (let offset = 0; offset < lines; offset++) {
+      const key = JSON.stringify([anchor.path, anchor.line + offset])
+      if (seen.has(key))
+        throw new Error('Choose only one suggestion for the same line or overlapping range.')
+      seen.add(key)
+    }
     const group = files.get(anchor.path) || []
     group.push(suggestion)
     files.set(anchor.path, group)
@@ -92,13 +98,21 @@ async function previewFileSuggestions(
 ): Promise<SuggestionPreview> {
   const group = [...suggestions].sort((a, b) => b.anchor.line - a.anchor.line)
   const first = group[0]!
-  const preview = await previewSuggestion(api, repo, first.anchor, first.replacement, request)
+  const preview = await previewSuggestion(
+    api,
+    repo,
+    first.anchor,
+    first.replacement,
+    request,
+    first.lines,
+  )
   for (const suggestion of group.slice(1))
-    preview.after = replaceSuggestedLine(
+    preview.after = replaceSuggestedRange(
       preview.after,
       suggestion.anchor.line,
       suggestion.anchor.text,
       suggestion.replacement,
+      suggestion.lines,
     )
   preview.change = putFile(first.anchor.path, preview.after, preview.change.executable)
   return preview
diff --git a/apps/web/src/lib/rangeSuggestions.spec.ts b/apps/web/src/lib/rangeSuggestions.spec.ts
new file mode 100644
index 00000000..72d5e2b5
--- /dev/null
+++ b/apps/web/src/lib/rangeSuggestions.spec.ts
@@ -0,0 +1,52 @@
+// @vitest-environment node
+import { describe, expect, it } from 'vitest'
+import { formatSuggestion, parseSuggestion, replaceSuggestedRange } from './reviewSuggestion'
+
+describe('range review suggestions', () => {
+  it('round-trips explicit ranges while leaving single-line suggestions unchanged', () => {
+    const body = formatSuggestion('Simplify this block.', 'replacement', 3)
+    expect(body).toContain('```suggestion:-0+2\n')
+    expect(parseSuggestion(body)).toEqual({
+      explanation: 'Simplify this block.',
+      replacement: 'replacement',
+      lines: 3,
+    })
+    expect(formatSuggestion('', 'one', 1)).toBe('```suggestion\none\n```')
+  })
+
+  it('refuses unsupported or invalid ranges instead of treating them as a one-line edit', () => {
+    for (const range of [0, -1, 1.5, 101])
+      expect(() => formatSuggestion('', 'new', range)).toThrow()
+    for (const header of ['suggestion:-1+2', 'suggestion:-0+100', 'suggestion:-0+-1'])
+      expect(parseSuggestion(`\`\`\`${header}\nnew\n\`\`\``)).toBeNull()
+  })
+
+  it('replaces the exact original range and preserves BOM, CRLF and the final newline', () => {
+    expect(
+      replaceSuggestedRange('\uFEFFfirst\r\nsecond\r\nlast\r\n', 1, '\uFEFFfirst', 'new\nblock', 2),
+    ).toBe('\uFEFFnew\r\nblock\r\nlast\r\n')
+    expect(replaceSuggestedRange('first\nsecond\nlast', 2, 'second', '', 2)).toBe('first\n')
+  })
+
+  it('does not extend beyond the source or apply a mismatched starting line', () => {
+    expect(() => replaceSuggestedRange('first\nlast\n', 2, 'last', 'new', 2)).toThrow(
+      /no longer exists/,
+    )
+    expect(() => replaceSuggestedRange('first\nlast', 1, 'changed', 'new', 2)).toThrow(/differs/)
+  })
+})
+
+it('covers exact range boundaries, malformed fences and empty original lines', () => {
+  expect(parseSuggestion(formatSuggestion('', 'new', 100))?.lines).toBe(100)
+  expect(parseSuggestion('```suggestion\n```\n```')).toBeNull()
+  expect(parseSuggestion('```suggestion:-0+999999999999999999999999999\nnew\n```')).toBeNull()
+  for (const line of [0, -1, NaN, 1.5])
+    expect(() => replaceSuggestedRange('one', line, 'one', 'new')).toThrow()
+  expect(replaceSuggestedRange('\nlast', 1, '', 'first')).toBe('first\nlast')
+  expect(replaceSuggestedRange('\nlast', 2, 'last', 'final')).toBe('\nfinal')
+  expect(replaceSuggestedRange('old\r', 1, 'old\r', 'new')).toBe('new')
+  expect(replaceSuggestedRange('first\r\nlast', 2, 'last', 'new\nline')).toBe(
+    'first\r\nnew\r\nline',
+  )
+  expect(replaceSuggestedRange('\uFEFFold\n', 1, '\uFEFFold', '\uFEFFnew')).toBe('\uFEFFnew\n')
+})
diff --git a/apps/web/src/lib/reviewSuggestion.ts b/apps/web/src/lib/reviewSuggestion.ts
index 5cfe6662..82bb4431 100644
--- a/apps/web/src/lib/reviewSuggestion.ts
+++ b/apps/web/src/lib/reviewSuggestion.ts
@@ -2,22 +2,38 @@
 export interface ReviewSuggestion {
   explanation: string
   replacement: string
+  /** Number of original lines, starting at the thread anchor. Defaults to one. */
+  lines?: number
 }
 
-export function formatSuggestion(explanation: string, replacement: string): string {
+export function suggestionLineCount(lines = 1): number {
+  if (!Number.isSafeInteger(lines) || lines < 1 || lines > 100)
+    throw new Error('Choose between 1 and 100 original lines.')
+  return lines
+}
+
+export function formatSuggestion(explanation: string, replacement: string, lines = 1): string {
+  suggestionLineCount(lines)
   const runs = `${explanation}\n${replacement}`.match(/`+/g) || []
   const fence = '`'.repeat(Math.max(3, ...runs.map((run) => run.length + 1)))
-  return `${explanation.trim()}\n\n${fence}suggestion\n${replacement}\n${fence}`.trimStart()
+  const range = lines === 1 ? '' : `:-0+${lines - 1}`
+  return `${explanation.trim()}\n\n${fence}suggestion${range}\n${replacement}\n${fence}`.trimStart()
 }
 
 export function parseSuggestion(body: string): ReviewSuggestion | null {
   const text = body.replace(/\r\n/g, '\n').trimEnd()
-  const match = /(?:^|\n)(`{3,})suggestion\n([\s\S]*)\n\1$/.exec(text)
+  const match = /(?:^|\n)(`{3,})suggestion(?::-0\+(\d+))?\n([\s\S]*)\n\1$/.exec(text)
   if (!match) return null
   const fence = match[1]!
-  const replacement = match[2]!
+  const lines = match[2] === undefined ? 1 : Number(match[2]) + 1
+  if (lines > 100) return null
+  const replacement = match[3]!
   if (replacement.split('\n').some((line) => line.startsWith(fence))) return null
-  return { explanation: text.slice(0, match.index).trim(), replacement }
+  return {
+    explanation: text.slice(0, match.index).trim(),
+    replacement,
+    ...(lines > 1 ? { lines } : {}),
+  }
 }
 
 interface LineSpan {
@@ -72,6 +88,18 @@ export function replaceSuggestedLine(
   expected: string,
   replacement: string,
 ): string {
+  return replaceSuggestedRange(source, line, expected, replacement)
+}
+
+/** A range belongs to the same immutable revision as its first-line anchor. */
+export function replaceSuggestedRange(
+  source: string,
+  line: number,
+  expected: string,
+  replacement: string,
+  lines = 1,
+): string {
+  suggestionLineCount(lines)
   if (source.includes('\0') || replacement.includes('\0'))
     throw new Error('This suggestion requires a text file.')
   const span = locateLine(source, line)
@@ -79,5 +107,6 @@ export function replaceSuggestedLine(
     throw new Error(
       'The source line differs from the reviewed line. Inspect the current change request.',
     )
-  return spliceLine(source, span, replacement)
+  const last = locateLine(source, line + lines - 1)
+  return spliceLine(source, { start: span.start, end: last.end, next: last.next }, replacement)
 }
diff --git a/docs/adr/0030-fenced-review-suggestions.md b/docs/adr/0030-fenced-review-suggestions.md
index a640241f..53c3f7dc 100644
--- a/docs/adr/0030-fenced-review-suggestions.md
+++ b/docs/adr/0030-fenced-review-suggestions.md
@@ -10,8 +10,12 @@ three backticks and is longer than every run of backticks in the explanation and
 An empty replacement requests deletion of the anchored logical line. Other clients retain
 readable text; no database migration, protobuf field or canonical VCS object changes.
 
-The first UI supports one anchor line on the new side, replaced by zero, one or multiple
-lines. It does not interpret general comments, replies, arbitrary Markdown or multiple
+The UI supports one anchor line on the new side, replaced by zero, one or multiple
+lines. A range uses the explicit fence header `suggestion:-0+N`: it replaces the anchor
+and the following `N` original lines (at most 100 lines total). A plain `suggestion`
+header still means exactly one line. The range must exist in the immutable anchored
+revision; the author previews the original file before confirming. Older clients
+retain range bodies as readable text and do not apply them as single-line suggestions. It does not interpret general comments, replies, arbitrary Markdown or multiple
 suggestions as executable instructions. It never executes the suggested code.
 
 Application is an explicit author action after preview. The client requires negotiated
@@ -31,7 +35,7 @@ content or automatically resolve the discussion. Normal new-head review and exac
 rules still apply. The old suggestion remains attached to its old revision and readable.
 
 Authors can also select suggestions from loaded discussions for one explicit batch preview.
-All anchors must belong to the current proposed head; duplicate file/line anchors are refused.
+All anchors must belong to the current proposed head; overlapping original ranges are refused.
 Within each file, replacements run from the last original line upward so inserted or deleted
 lines cannot shift remaining anchors. Up to 100 suggestions and 4 MiB of resulting content
 produce one workspace changeset and one head-checked proposal update. Files are read once
@@ -39,6 +43,6 @@ and every exact source line is checked before publishing. Discussions remain ope
 
 ## Remaining scope
 
-Multi-line anchor ranges, server-native suggestion metadata and an
+Server-native suggestion metadata and an
 explicit native CLI apply command remain future work. Existing CLI/SDK thread body operations
 can read and write the convention without schema changes.
diff --git a/docs/guides/web-ui.md b/docs/guides/web-ui.md
index 291fbd44..0dacf12f 100644
--- a/docs/guides/web-ui.md
+++ b/docs/guides/web-ui.md
@@ -598,8 +598,9 @@ reply drafts.
 ### Suggest a code change (development)
 
 Select a new-side line number in **Files changed**, then **Suggest a replacement**. Explain
-why and enter replacement code; multiple replacement lines are allowed, and an empty field
-deletes the selected line. The draft survives reload in the same tab. Post it as a line discussion.
+why and enter replacement code. **Lines to replace** selects 1–100 original lines starting
+at that line; the count and replacement survive reload in the same tab. Multiple replacement
+lines are allowed, and an empty replacement deletes the selected range. The draft survives reload in the same tab. Post it as a line discussion.
 
 The change request's author can choose **Review and apply suggestion**, inspect the exact
 replacement and explicitly apply it. This creates a new revision, retaining executable mode
@@ -609,13 +610,14 @@ and copyable; they cannot overwrite newer work.
 
 To combine changes, expand **Apply several suggestions** in the discussions, select the
 suggestions and choose **Review selected suggestions**. Inspect the prepared files before
-confirming. Up to 100 suggestions across files become one revision; conflicting suggestions
-for the same line are refused. Only loaded discussions are included: use **Load more
+confirming. Up to 100 suggestions across files become one revision; overlapping suggestions
+for the same original lines are refused. Only loaded discussions are included: use **Load more
 discussions** to include older results. The total prepared content is limited to 4 MiB.
 
 Application requires a server with `proposals.update_head` and is limited to regular UTF-8
 files up to 1 MiB. Symlinks, binary files, old-side lines and changed source lines require the
-ordinary editor or CLI. This first version replaces one anchored line, not a selected range.
+ordinary editor or CLI. A range that extends past the file is refused. The preview shows the original file for
+multi-line replacements; confirm only after inspecting the entire selected range.
 
 
 ## Enable or disable new runs for one agent (development)

From 8b20c45e8504b03e87c03960c54e6c270305beaf Mon Sep 17 00:00:00 2001
From: Codex <codex@openai.com>
Date: Thu, 29 Oct 2026 20:52:15 +0000
Subject: [PATCH 03/41] feat(review): request reviewers across API and clients

Persist author-owned reviewer routing with inspected-set updates, idempotent retries and pre-pagination filtering. Share stream authorization and principal normalization across HTTP/gRPC, CLI, TypeScript/Python SDKs and MCP. Requests grant neither access nor approval. Schema 9 requires a pre-upgrade backup.

Validation: 295 storage/engine tests passed (one existing ignored test); HTTP/gRPC and scoped-token regressions; CLI local/remote and generated contracts; 102 MCP tests; 169 TypeScript and 192 Python SDK tests. Workspace clippy passes. Optional TS response field has an explicit generator regression.
---
 CHANGELOG.md                                  |   2 +
 README.md                                     |   5 +
 SECURITY.md                                   |   6 +-
 apps/web/src/api/schema.gen.ts                |  82 ++++++++
 apps/web/src/api/types.ts                     |   4 +-
 crates/ag-cli/help/workflow.md                |  21 ++
 crates/ag-cli/src/cmds/flow.rs                |  24 ++-
 crates/ag-cli/src/cmds/mod.rs                 |   1 +
 crates/ag-cli/src/cmds/remote.rs              |  24 ++-
 crates/ag-cli/src/cmds/reviewers.rs           | 183 ++++++++++++++++++
 crates/ag-cli/tests/cli.rs                    |  32 +++
 .../tests/golden/json-shapes-remote.json      |  11 ++
 crates/ag-cli/tests/golden/json-shapes.json   |   8 +
 crates/ag-cli/tests/json_shapes.rs            |   2 +
 crates/ag-cli/tests/json_shapes_remote.rs     |   5 +
 crates/ag-cli/tests/remote.rs                 |  64 ++++++
 crates/ag-integrate/src/lib.rs                |   1 +
 crates/ag-integrate/src/review_requests.rs    |  59 ++++++
 crates/ag-integrate/tests/review_requests.rs  |  78 ++++++++
 crates/ag-mcp/src/tools/proposals.rs          |  60 ++++++
 crates/ag-mcp/src/tools/read.rs               |  11 +-
 crates/ag-mcp/tests/review_requests.rs        |  93 +++++++++
 crates/ag-protocol/build.rs                   |   1 +
 crates/ag-protocol/proto/agwp/v1/agwp.proto   |  16 ++
 crates/ag-protocol/src/lib.rs                 |   3 +
 crates/ag-server/src/api/proposals.rs         |  40 ++++
 crates/ag-server/src/grpc.rs                  |   6 +
 crates/ag-server/src/http.rs                  |  13 ++
 crates/ag-server/tests/review_requests.rs     |  80 ++++++++
 .../postgres/0009_proposal_reviewers.sql      |   6 +
 .../sqlite/0009_proposal_reviewers.sql        |   6 +
 crates/ag-storage/src/meta/migrate.rs         |  12 +-
 crates/ag-storage/src/meta/records.rs         |  27 +++
 crates/ag-storage/src/meta/tests.rs           |  28 +++
 docs/adr/0036-requested-reviewers.md          |  31 +++
 docs/adr/README.md                            |   2 +
 docs/protocol/agwp-v1.md                      |  17 ++
 docs/protocol/openapi.json                    | 134 +++++++++++++
 docs/reference/cli-json.md                    |  29 +++
 docs/reference/cli.md                         | 107 +++++++---
 docs/reference/completions/_ag                |  63 ++++++
 docs/reference/completions/_ag.ps1            |  45 +++++
 docs/reference/completions/ag.bash            | 110 ++++++++++-
 docs/reference/completions/ag.elv             |  43 ++++
 docs/reference/completions/ag.fish            | 121 +++++++-----
 docs/reference/help-topics.md                 |  21 ++
 docs/reference/man/ag-proposal-list.1         |   9 +-
 docs/reference/man/ag-proposal-reviewers.1    |  51 +++++
 docs/reference/man/ag-proposal.1              |   3 +
 docs/reference/man/ag-remote-proposals.1      |   5 +-
 docs/reference/man/ag-remote-reviewers.1      |  54 ++++++
 docs/reference/man/ag-remote.1                |   3 +
 .../postgres/0009_proposal_reviewers.sql      |   6 +
 migrations/sqlite/0009_proposal_reviewers.sql |   6 +
 proto/agwp/v1/agwp.proto                      |  16 ++
 sdk/api-policy.json                           |   3 +-
 sdk/python/README.md                          |  37 +++-
 sdk/python/examples/__init__.py               |   1 +
 sdk/python/examples/review_requests.py        |  26 +++
 sdk/python/src/agentgit/_generated/models.py  |  19 ++
 .../src/agentgit/_generated/namespaces.py     |  32 ++-
 .../src/agentgit/_generated/operations.py     |  18 +-
 sdk/python/tests/test_all_operations.py       |   4 +
 sdk/python/tests/test_review_requests.py      | 158 +++++++++++++++
 sdk/typescript/README.md                      |  32 ++-
 sdk/typescript/examples/review-requests.ts    |  21 ++
 sdk/typescript/scripts/generate.mjs           |   5 +
 sdk/typescript/src/generated/api.ts           |   3 +
 sdk/typescript/src/generated/models.ts        |   2 +
 sdk/typescript/src/generated/operations.ts    |  17 +-
 sdk/typescript/src/generated/schema.ts        |  79 ++++++++
 sdk/typescript/test/all-operations.test.ts    |   6 +
 sdk/typescript/test/review-requests.test.ts   | 144 ++++++++++++++
 73 files changed, 2404 insertions(+), 93 deletions(-)
 create mode 100644 crates/ag-cli/src/cmds/reviewers.rs
 create mode 100644 crates/ag-integrate/src/review_requests.rs
 create mode 100644 crates/ag-integrate/tests/review_requests.rs
 create mode 100644 crates/ag-mcp/tests/review_requests.rs
 create mode 100644 crates/ag-server/tests/review_requests.rs
 create mode 100644 crates/ag-storage/migrations/postgres/0009_proposal_reviewers.sql
 create mode 100644 crates/ag-storage/migrations/sqlite/0009_proposal_reviewers.sql
 create mode 100644 docs/adr/0036-requested-reviewers.md
 create mode 100644 docs/reference/man/ag-proposal-reviewers.1
 create mode 100644 docs/reference/man/ag-remote-reviewers.1
 create mode 100644 migrations/postgres/0009_proposal_reviewers.sql
 create mode 100644 migrations/sqlite/0009_proposal_reviewers.sql
 create mode 100644 sdk/python/examples/__init__.py
 create mode 100644 sdk/python/examples/review_requests.py
 create mode 100644 sdk/python/tests/test_review_requests.py
 create mode 100644 sdk/typescript/examples/review-requests.ts
 create mode 100644 sdk/typescript/test/review-requests.test.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b92b0a04..2dd1fc52 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Added
 
+- Authors can request specific reviewers with an inspected-list update across the API and clients. Requests survive new revisions, never grant access or count as approval, and can be filtered before proposal pagination. Development metadata schema 9 requires a pre-upgrade backup.
+
 - Review suggestions can replace up to 100 consecutive original lines. Range drafts survive reload, previews show the source file, and batches reject overlapping ranges before publication. Existing one-line suggestions keep their original format.
 
 - Authors can preview and apply selected review suggestions across files as one proposal revision. Exact source lines, executable mode, BOM and line endings are preserved; conflicting selections are refused and discussions remain open.
diff --git a/README.md b/README.md
index fc6c971c..186703a5 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,11 @@ This is an early public beta: [status and limits](#status-and-limits) are below,
 
 **Upgrade:** persistent follow-up task links and durable task execution limits require metadata schema 8. Back up before opening existing repositories with beta.6 or newer; rollback uses the pre-upgrade backup. [Source-link semantics](docs/adr/0027-task-source-links.md).
 
+**Development (`main`):** requested reviewers add metadata schema 9. Back up before
+opening existing repositories with a development build; rollback restores that backup.
+Requests route review work and do not change permissions or approval policy.
+[Design and compatibility](docs/adr/0036-requested-reviewers.md).
+
 Stream rules can require every line discussion to be resolved before integration, including feedback on earlier revisions.
 
 Review threads support proposed line replacements, with explicit author preview and head-checked application.
diff --git a/SECURITY.md b/SECURITY.md
index befc7960..078f2ebe 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -11,10 +11,12 @@ agents. We take integrity and isolation bugs seriously.
 | `0.3.0-beta.7` | Current patch release; use its binaries after the Release workflow completes. |
 | `0.3.0-beta.6` and earlier prereleases | Upgrade to the current patch release for the fixes to stream scopes, workspace concurrency and retention. |
 
-AgentGit is **beta** software. The current repository metadata schema is **8**;
+AgentGit is **beta** software. The current development repository metadata schema is **9**;
 `ChangesetV1`, tree manifest v1 and repository configuration format 1 remain unchanged.
 The server control database is migrated independently; use the same server version across replicas.
-Beta.7 introduces no storage migration relative to beta.6. Returning to beta.5 or older
+The published beta.6/beta.7 format is schema 8. Development schema 9 adds requested reviewers;
+back up before opening a schema-8 repository with this build. Beta.7 introduces no
+storage migration relative to beta.6. Returning to beta.5 or older
 requires the pre-upgrade backup, not opening the upgraded database with an older binary.
 See [compatibility](docs/architecture/compatibility.md) and [releasing](docs/operations/releasing.md).
 There has been no independent external security audit. Keep backups (`ag backup`) and a Git mirror (`ag git export`).
diff --git a/apps/web/src/api/schema.gen.ts b/apps/web/src/api/schema.gen.ts
index 1feed6b8..8788414f 100644
--- a/apps/web/src/api/schema.gen.ts
+++ b/apps/web/src/api/schema.gen.ts
@@ -902,6 +902,23 @@ export interface paths {
     patch?: never
     trace?: never
   }
+  '/v1/repos/{owner}/{rname}/proposals/{id}/reviewers': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    get?: never
+    /** Replace the inspected set of requested reviewers */
+    put: operations['proposal.set_reviewers']
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
   '/v1/repos/{owner}/{rname}/proposals/{id}/reviews': {
     parameters: {
       query?: never
@@ -3278,6 +3295,11 @@ export interface components {
       page_token: string
       /** @default  */
       repo: string
+      /**
+       * @description Match a requested reviewer before keyset paging.
+       * @default
+       */
+      requested_reviewer: string
       /** @default  */
       state: string
       /** @default  */
@@ -3840,6 +3862,11 @@ export interface components {
     ProposalDetail: {
       /** @default null */
       proposal: components['schemas']['Proposal'] | null
+      /**
+       * @description Routing only; requests do not grant access or count as approval.
+       * @default []
+       */
+      requested_reviewers: string[]
       /** @default [] */
       reviews: components['schemas']['Review'][]
     }
@@ -4244,6 +4271,10 @@ export interface components {
       /** @default [] */
       jobs: components['schemas']['Job'][]
     }
+    RequestedReviewers: {
+      /** @default [] */
+      reviewers: string[]
+    }
     ResolvePathRequest: {
       /** @default  */
       path: string
@@ -4666,6 +4697,17 @@ export interface components {
       /** @default  */
       stream: string
     }
+    /** @description Replaces review routing after comparing the complete inspected set. */
+    SetRequestedReviewersRequest: {
+      /** @default [] */
+      expected_reviewers: string[]
+      /** @default  */
+      id: string
+      /** @default  */
+      repo: string
+      /** @default [] */
+      reviewers: string[]
+    }
     /** @description Execution policy is independent of immutable task instructions and run history. */
     SetTaskAttemptLimitRequest: {
       /**
@@ -7254,6 +7296,7 @@ export interface operations {
         author?: string
         page_size?: number
         page_token?: string
+        requested_reviewer?: string
         state?: string
         stream?: string
         task_id?: string
@@ -7479,6 +7522,45 @@ export interface operations {
       }
     }
   }
+  'proposal.set_reviewers': {
+    parameters: {
+      query?: never
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+        id: string
+      }
+      cookie?: never
+    }
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SetRequestedReviewersRequest']
+      }
+    }
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['RequestedReviewers']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
   'proposal.review': {
     parameters: {
       query?: never
diff --git a/apps/web/src/api/types.ts b/apps/web/src/api/types.ts
index 7d132dfa..c72eda4f 100644
--- a/apps/web/src/api/types.ts
+++ b/apps/web/src/api/types.ts
@@ -30,7 +30,9 @@ export type Review = S['Review']
 export type ReviewThread = S['ReviewThread']
 export type ThreadComment = S['ThreadComment']
 export type ReviewLineAnchor = S['ReviewLineAnchor']
-export type ProposalDetail = S['ProposalDetail']
+// Older servers do not return the additive requested-reviewer routing field.
+export type ProposalDetail = Omit<S['ProposalDetail'], 'requested_reviewers'> &
+  Partial<Pick<S['ProposalDetail'], 'requested_reviewers'>>
 /**
  * The OpenAPI document describes free-form JSON objects (`type: object` with no properties), which the
  * generator renders as `Record<string, never>`. They are open-ended on the wire, so say so.
diff --git a/crates/ag-cli/help/workflow.md b/crates/ag-cli/help/workflow.md
index d3f54bcf..c1dd9b97 100644
--- a/crates/ag-cli/help/workflow.md
+++ b/crates/ag-cli/help/workflow.md
@@ -44,3 +44,24 @@ Where am I? `ag status` shows the workspace, your proposals, your leases, your t
 Is everything healthy? `ag doctor`. What exactly happened? `ag trace`, `ag op show OPERATION`.
 
 More: docs/getting-started.md and docs/tutorials/first-agent-safe-repo.md
+
+Requesting a review
+
+    ag proposal reviewers PROPOSAL                         inspect the requested people
+    ag proposal reviewers PROPOSAL --add user:bob           request Bob's review
+    ag proposal reviewers PROPOSAL --remove user:bob        withdraw that request
+    ag proposal list --requested-reviewer user:bob          find Bob's requested work
+
+The same commands work against a configured server as `ag remote reviewers PROPOSAL ...`
+and `ag remote proposals --requested-reviewer user:bob`.
+Only the author of an open proposal can change its requested reviewers. A request is routing:
+it grants no repository access, records no approval, and adds no integration requirement.
+A new proposal revision keeps the requested people, but previous approvals remain tied to their old head.
+
+Edits compare the list that the command just read. If another writer changes it before the save, the command
+fails instead of overwriting that change. Scripts can require their own inspected list with repeatable
+`--expected IDENTITY`, or `--expect-empty` for an empty list. For example:
+
+    ag proposal reviewers PROPOSAL --add user:carol --expected user:bob
+
+An omitted edit flag only reads the list. Repeating an already-applied add or remove is safe.
diff --git a/crates/ag-cli/src/cmds/flow.rs b/crates/ag-cli/src/cmds/flow.rs
index 6f2edb47..c298d5af 100644
--- a/crates/ag-cli/src/cmds/flow.rs
+++ b/crates/ag-cli/src/cmds/flow.rs
@@ -148,6 +148,9 @@ pub enum ProposalCmd {
         /// Filter by state: open, integrated, closed.
         #[arg(long)]
         state: Option<String>,
+        /// Only proposals that request this reviewer, matched before the limit.
+        #[arg(long, value_name = "IDENTITY")]
+        requested_reviewer: Option<String>,
         /// Show at most this many (0 = all).
         #[arg(short = 'n', long, default_value_t = 200)]
         limit: usize,
@@ -157,6 +160,8 @@ pub enum ProposalCmd {
         /// Proposal id.
         id: String,
     },
+    /// Inspect, add or remove requested reviewers (no approval or access change).
+    Reviewers(crate::cmds::reviewers::ReviewersArgs),
     /// Review the proposal's current head.
     Review {
         /// Proposal id.
@@ -193,8 +198,18 @@ pub enum ProposalCmd {
 
 pub fn proposal(ctx: &Ctx, cmd: &ProposalCmd) -> Result<u8> {
     match cmd {
-        ProposalCmd::List { state, limit } => {
-            let list = ctx.repo.meta().read(|tx| tx.proposals_list(state.as_deref(), Ctx::cap(*limit)))?;
+        ProposalCmd::List { state, requested_reviewer, limit } => {
+            let requested_reviewer = requested_reviewer
+                .as_deref()
+                .map(crate::cmds::reviewers::reviewer_identity)
+                .transpose()?
+                .map(|identity| identity.to_string());
+            let filter = ag_storage::meta::ProposalFilter {
+                state: state.as_deref(),
+                requested_reviewer: requested_reviewer.as_deref(),
+                ..Default::default()
+            };
+            let list = ctx.repo.meta().read(|tx| tx.proposals_page(&filter, None, Ctx::cap(*limit)))?;
             ctx.note_cap(list.len(), *limit, "proposals");
             if list.is_empty() {
                 ctx.note("no proposals match; `ag propose -t TITLE` opens one");
@@ -219,7 +234,8 @@ pub fn proposal(ctx: &Ctx, cmd: &ProposalCmd) -> Result<u8> {
         ProposalCmd::Show { id } => {
             let p = ctx.repo.find_proposal(id)?;
             let reviews = ctx.repo.meta().read(|tx| tx.reviews(&p.id))?;
-            ctx.out(&json!({"proposal": p, "reviews": reviews}), || {
+            let requested_reviewers = ctx.repo.requested_reviewers(&p.id)?;
+            ctx.out(&json!({"proposal": p, "reviews": reviews, "requested_reviewers": requested_reviewers}), || {
                 let mut s = format!(
                     "{}  [{}]\n  {}\n  head {} -> stream '{}'\n  author {}\n",
                     p.id, p.state, p.title, p.head, p.stream, p.author
@@ -227,6 +243,7 @@ pub fn proposal(ctx: &Ctx, cmd: &ProposalCmd) -> Result<u8> {
                 if !p.description.is_empty() {
                     let _ = writeln!(s, "\n{}\n", p.description);
                 }
+                let _ = writeln!(s, "{}", crate::cmds::reviewers::describe(&requested_reviewers));
                 for r in &reviews {
                     let current = if r.head == p.head { "" } else { "  (stale: older head)" };
                     let _ = writeln!(
@@ -241,6 +258,7 @@ pub fn proposal(ctx: &Ctx, cmd: &ProposalCmd) -> Result<u8> {
                 s
             })?;
         }
+        ProposalCmd::Reviewers(args) => return crate::cmds::reviewers::local(ctx, args),
         ProposalCmd::Review { id, approve, request_changes, comment, message } => {
             let decision = match (approve, request_changes, comment) {
                 (true, _, _) => "approve",
diff --git a/crates/ag-cli/src/cmds/mod.rs b/crates/ag-cli/src/cmds/mod.rs
index 2cef6aba..feee5aa8 100644
--- a/crates/ag-cli/src/cmds/mod.rs
+++ b/crates/ag-cli/src/cmds/mod.rs
@@ -14,6 +14,7 @@ pub mod overview;
 pub mod policy;
 pub mod remote;
 pub mod repo;
+pub mod reviewers;
 pub mod shell;
 pub mod topics;
 
diff --git a/crates/ag-cli/src/cmds/remote.rs b/crates/ag-cli/src/cmds/remote.rs
index 2e1fd648..6f8b0bc0 100644
--- a/crates/ag-cli/src/cmds/remote.rs
+++ b/crates/ag-cli/src/cmds/remote.rs
@@ -786,6 +786,9 @@ pub enum RemoteCmd {
         /// Filter: open, integrated, closed.
         #[arg(long)]
         state: Option<String>,
+        /// Only proposals that request this reviewer, matched before paging.
+        #[arg(long, value_name = "IDENTITY")]
+        requested_reviewer: Option<String>,
     },
     /// Show a proposal with its reviews.
     Proposal {
@@ -805,6 +808,8 @@ pub enum RemoteCmd {
         /// Proposal id (any unique prefix).
         id: String,
     },
+    /// Inspect, add or remove requested reviewers (no approval or access change).
+    Reviewers(crate::cmds::reviewers::ReviewersArgs),
     /// Review a proposal's current head.
     Review {
         /// Proposal id.
@@ -1088,7 +1093,14 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                     format!("{} ({}, via {})\nroles: {}", p.identity, p.kind, p.method, p.roles.join(", "))
                 })?;
             }
-            RemoteCmd::Proposals { state } => {
+            RemoteCmd::Proposals { state, requested_reviewer } => {
+                if requested_reviewer.is_some() {
+                    crate::cmds::reviewers::require_support(&c).await?;
+                }
+                let requested_reviewer = requested_reviewer.as_deref()
+                    .map(crate::cmds::reviewers::reviewer_identity)
+                    .transpose()?
+                    .map(|identity| identity.to_string());
                 // Every page: a repository with more proposals than one page must not be silently cut short.
                 let mut all = Vec::new();
                 let mut token = String::new();
@@ -1098,6 +1110,7 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                         .list(c.req(v1::ListProposalsRequest {
                             repo: repo.clone(),
                             state: state.clone().unwrap_or_default(),
+                            requested_reviewer: requested_reviewer.clone().unwrap_or_default(),
                             page_size: ag_protocol::limits::MAX_PAGE_SIZE,
                             page_token: token,
                             ..Default::default()
@@ -1149,6 +1162,7 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                         &p.head[..12],
                         p.author
                     );
+                    t.push_str(&format!("{}\n", crate::cmds::reviewers::describe(&d.requested_reviewers)));
                     for r in &d.reviews {
                         t.push_str(&format!(
                             "  review: {} by {} on {}  {}\n",
@@ -1207,6 +1221,14 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                     return Ok(exit::BLOCKED);
                 }
             }
+            RemoteCmd::Reviewers(args) => {
+                let result = crate::cmds::reviewers::remote(&c, &repo, args).await?;
+                if args.changes_state() {
+                    print_done(cli, &result, || crate::cmds::reviewers::describe(&result.reviewers))?;
+                } else {
+                    print(cli, &result, || crate::cmds::reviewers::describe(&result.reviewers))?;
+                }
+            }
             RemoteCmd::Review { id, approve, request_changes, comment, message } => {
                 let decision = match (approve, request_changes, comment) {
                     (true, _, _) => "approve",
diff --git a/crates/ag-cli/src/cmds/reviewers.rs b/crates/ag-cli/src/cmds/reviewers.rs
new file mode 100644
index 00000000..edf9a660
--- /dev/null
+++ b/crates/ag-cli/src/cmds/reviewers.rs
@@ -0,0 +1,183 @@
+//! Requested reviewers: the same inspected-set edit for local and remote proposals.
+use std::collections::BTreeSet;
+
+use ag_client::{Client, ClientError};
+use ag_protocol::v1;
+use ag_types::Identity;
+use anyhow::{Result, bail};
+use clap::Args;
+
+use crate::ctx::Ctx;
+use crate::exit;
+
+/// Inspect review routing, or add/remove people without replacing a concurrent edit.
+#[derive(Args, Debug)]
+pub struct ReviewersArgs {
+    /// Proposal id or unique prefix.
+    pub id: String,
+    /// Add a requested reviewer; repeat for several identities.
+    #[arg(long, value_name = "IDENTITY")]
+    pub add: Vec<String>,
+    /// Remove a requested reviewer; repeat for several identities.
+    #[arg(long, value_name = "IDENTITY")]
+    pub remove: Vec<String>,
+    /// Require this complete inspected set; repeat for each identity.
+    #[arg(long, value_name = "IDENTITY", conflicts_with = "expect_empty")]
+    pub expected: Vec<String>,
+    /// Require that no reviewers have been requested yet.
+    #[arg(long, conflicts_with = "expected")]
+    pub expect_empty: bool,
+}
+
+struct Edit {
+    reviewers: Vec<Identity>,
+    expected: Vec<Identity>,
+}
+
+/// Review routing names a principal rather than one ephemeral run.
+pub fn reviewer_identity(value: &str) -> Result<Identity> {
+    Ok(Identity::new(value)?.principal())
+}
+
+fn identities(values: &[String]) -> Result<Vec<Identity>> {
+    values.iter().map(|value| reviewer_identity(value)).collect()
+}
+
+impl ReviewersArgs {
+    /// Whether the invocation explicitly requests a change.
+    pub fn changes_state(&self) -> bool {
+        !self.add.is_empty() || !self.remove.is_empty()
+    }
+
+    fn expected(&self, current: &[String]) -> Result<Vec<Identity>> {
+        if self.expect_empty {
+            return Ok(Vec::new());
+        }
+        identities(if self.expected.is_empty() { current } else { &self.expected })
+    }
+
+    fn edit(&self, current: &[String]) -> Result<Option<Edit>> {
+        if !self.changes_state() {
+            if self.expect_empty || !self.expected.is_empty() {
+                bail!("--expected and --expect-empty require --add or --remove");
+            }
+            return Ok(None);
+        }
+        let reviewers = changed_reviewers(current, &self.add, &self.remove)?;
+        Ok(Some(Edit { reviewers, expected: self.expected(current)? }))
+    }
+}
+
+fn changed_reviewers(current: &[String], add: &[String], remove: &[String]) -> Result<Vec<Identity>> {
+    let add = identities(add)?;
+    let remove = identities(remove)?;
+    if add.iter().any(|identity| remove.contains(identity)) {
+        bail!("the same reviewer cannot be both added and removed");
+    }
+    let mut names: BTreeSet<String> = current.iter().cloned().collect();
+    for identity in remove {
+        names.remove(identity.as_str());
+    }
+    names.extend(add.into_iter().map(|identity| identity.to_string()));
+    identities(&names.into_iter().collect::<Vec<_>>())
+}
+
+/// A neutral description: a request never counts as approval or grants access.
+pub fn describe(reviewers: &[String]) -> String {
+    if reviewers.is_empty() {
+        "No reviewers requested.".into()
+    } else {
+        format!("Requested reviewers:\n  {}", reviewers.join("\n  "))
+    }
+}
+
+/// Inspect or change the author-owned list in an embedded repository.
+pub fn local(ctx: &Ctx, args: &ReviewersArgs) -> Result<u8> {
+    let current = ctx.repo.requested_reviewers(&args.id)?;
+    if let Some(edit) = args.edit(&current)? {
+        let reviewers = ctx.repo.set_requested_reviewers(&args.id, &edit.reviewers, &edit.expected, &ctx.me)?;
+        let result = v1::RequestedReviewers { reviewers };
+        ctx.done(&result, || describe(&result.reviewers))?;
+    } else {
+        let result = v1::RequestedReviewers { reviewers: current };
+        ctx.out(&result, || describe(&result.reviewers))?;
+    }
+    Ok(exit::OK)
+}
+
+/// Refuse an older server instead of silently treating a requested-reviewer filter as unrestricted.
+pub async fn require_support(client: &Client) -> Result<()> {
+    if !client.negotiate().await?.features.iter().any(|f| f == ag_protocol::features::PROPOSALS_REVIEW_REQUESTS) {
+        bail!("this server does not support requested reviewers; update it before using this command");
+    }
+    Ok(())
+}
+
+/// Use the same edit over gRPC, negotiating support before reading the list.
+pub async fn remote(client: &Client, repo: &str, args: &ReviewersArgs) -> Result<v1::RequestedReviewers> {
+    require_support(client).await?;
+    let detail = client
+        .proposals()
+        .get(client.req(v1::GetProposalRequest { repo: repo.into(), id: args.id.clone() }))
+        .await
+        .map_err(ClientError::from)?
+        .into_inner();
+    let Some(edit) = args.edit(&detail.requested_reviewers)? else {
+        return Ok(v1::RequestedReviewers { reviewers: detail.requested_reviewers });
+    };
+    let response = client
+        .proposals()
+        .set_reviewers(client.req(v1::SetRequestedReviewersRequest {
+            repo: repo.into(),
+            id: args.id.clone(),
+            reviewers: edit.reviewers.into_iter().map(|identity| identity.to_string()).collect(),
+            expected_reviewers: edit.expected.into_iter().map(|identity| identity.to_string()).collect(),
+        }))
+        .await
+        .map_err(ClientError::from)?
+        .into_inner();
+    Ok(response)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn args() -> ReviewersArgs {
+        ReviewersArgs { id: "p".into(), add: vec![], remove: vec![], expected: vec![], expect_empty: false }
+    }
+    #[test]
+    fn edits_keep_unmentioned_reviewers_and_the_inspected_set() {
+        let mut args = args();
+        args.add = vec!["user:carol".into(), "user:carol".into()];
+        let current = vec!["user:bob".into()];
+        let edit = args.edit(&current).unwrap().unwrap();
+        assert_eq!(edit.reviewers.iter().map(Identity::as_str).collect::<Vec<_>>(), ["user:bob", "user:carol"]);
+        assert_eq!(edit.expected.iter().map(Identity::as_str).collect::<Vec<_>>(), ["user:bob"]);
+        args.expect_empty = true;
+        assert!(args.edit(&current).unwrap().unwrap().expected.is_empty());
+    }
+    #[test]
+    fn removing_a_run_identity_removes_its_canonical_principal() {
+        let mut args = args();
+        args.remove = vec!["agent:bot#attempt".into()];
+        assert!(args.edit(&["agent:bot".into()]).unwrap().unwrap().reviewers.is_empty());
+    }
+    #[test]
+    fn explicit_sets_and_invalid_edits_are_not_silently_ignored() {
+        let mut args = args();
+        assert!(args.edit(&[]).unwrap().is_none());
+        args.expect_empty = true;
+        assert!(args.edit(&[]).is_err());
+        args.expect_empty = false;
+        args.expected = vec!["user:known".into()];
+        assert!(args.edit(&[]).is_err());
+        args.add = vec!["user:new".into()];
+        let edit = args.edit(&[]).unwrap().unwrap();
+        assert_eq!(edit.expected[0].as_str(), "user:known");
+        args.remove = args.add.clone();
+        assert!(args.edit(&[]).is_err());
+        args.remove.clear();
+        args.add = vec!["not an identity".into()];
+        assert!(args.edit(&[]).is_err());
+    }
+}
diff --git a/crates/ag-cli/tests/cli.rs b/crates/ag-cli/tests/cli.rs
index 0d5eea8f..42f8c68f 100644
--- a/crates/ag-cli/tests/cli.rs
+++ b/crates/ag-cli/tests/cli.rs
@@ -645,3 +645,35 @@ fn task_attempt_limit_can_be_inspected_and_extended_without_replacing_the_task()
     assert_eq!(extended["max_attempts"], 2);
     ag.ag(&["agent", "start", "bot", "--task", id]).ok();
 }
+
+#[test]
+fn requested_reviewers_are_inspectable_guarded_and_not_reviews() {
+    let a = Ag::new();
+    a.write("review.txt", "Please inspect this.\n");
+    let proposal = a.propose_as("user:alice", "Review routing");
+    let empty = a.ag(&["--json", "proposal", "reviewers", &proposal]).ok().json();
+    assert_eq!(empty["reviewers"], serde_json::json!([]));
+    let first =
+        a.ag(&["--json", "proposal", "reviewers", &proposal, "--add", "user:bob", "--expect-empty"]).ok().json();
+    assert_eq!(first["reviewers"], serde_json::json!(["user:bob"]));
+    a.write("other.txt", "Not requested from Bob\n");
+    a.propose_as("user:alice", "Unrequested work");
+    let filtered = a.ag(&["--json", "proposal", "list", "--requested-reviewer", "user:bob"]).ok().json();
+    assert_eq!(filtered.as_array().unwrap().len(), 1);
+    assert_eq!(filtered[0]["id"], proposal);
+    let stale = a.ag(&["proposal", "reviewers", &proposal, "--add", "user:carol", "--expect-empty"]);
+    assert!(!stale.out.status.success(), "a stale inspected set must not overwrite review requests");
+    let current = a.ag(&["--json", "proposal", "reviewers", &proposal]).ok().json();
+    assert_eq!(current["reviewers"], first["reviewers"]);
+    let detail = a.ag(&["--json", "proposal", "show", &proposal]).ok().json();
+    assert_eq!(detail["reviews"], serde_json::json!([]));
+    let denied = a.run_as("user:bob", &["proposal", "reviewers", &proposal, "--add", "user:carol"]);
+    assert!(!denied.out.status.success());
+    let changed = a
+        .ag(&["--json", "proposal", "reviewers", &proposal, "--remove", "user:bob", "--add", "user:carol"])
+        .ok()
+        .json();
+    assert_eq!(changed["reviewers"], serde_json::json!(["user:carol"]));
+    a.ag(&["proposal", "close", &proposal]).ok();
+    assert!(!a.ag(&["proposal", "reviewers", &proposal, "--remove", "user:carol"]).out.status.success());
+}
diff --git a/crates/ag-cli/tests/golden/json-shapes-remote.json b/crates/ag-cli/tests/golden/json-shapes-remote.json
index 6877c207..0c5a1d70 100644
--- a/crates/ag-cli/tests/golden/json-shapes-remote.json
+++ b/crates/ag-cli/tests/golden/json-shapes-remote.json
@@ -254,6 +254,9 @@
               "policy_version": "number",
               "proposal": "string",
               "resolved": "bool",
+              "reviewers": [
+                "string"
+              ],
               "role": "string",
               "status": "string",
               "stream": "string",
@@ -415,6 +418,9 @@
         "title": "string",
         "updated_at_ms": "number"
       },
+      "requested_reviewers": [
+        "string"
+      ],
       "reviews": []
     },
     "remote proposals": {
@@ -444,6 +450,11 @@
       "reviewer": "string",
       "timestamp_ms": "number"
     },
+    "remote reviewers": {
+      "reviewers": [
+        "string"
+      ]
+    },
     "remote streams": {
       "streams": [
         {
diff --git a/crates/ag-cli/tests/golden/json-shapes.json b/crates/ag-cli/tests/golden/json-shapes.json
index 31861801..4e9724fa 100644
--- a/crates/ag-cli/tests/golden/json-shapes.json
+++ b/crates/ag-cli/tests/golden/json-shapes.json
@@ -592,6 +592,11 @@
       "reviewer": "string",
       "timestamp": "number"
     },
+    "proposal reviewers": {
+      "reviewers": [
+        "string"
+      ]
+    },
     "proposal show": {
       "proposal": {
         "author": "string",
@@ -606,6 +611,9 @@
         "title": "string",
         "updated_at": "number"
       },
+      "requested_reviewers": [
+        "string"
+      ],
       "reviews": []
     },
     "proposal update": {
diff --git a/crates/ag-cli/tests/json_shapes.rs b/crates/ag-cli/tests/json_shapes.rs
index 2b29aed7..8ba24b1d 100644
--- a/crates/ag-cli/tests/json_shapes.rs
+++ b/crates/ag-cli/tests/json_shapes.rs
@@ -41,6 +41,8 @@ fn the_json_output_of_every_local_command_matches_the_documented_shape() {
     r.rec("snapshot", &a.ag(&["--json", "snapshot", "-m", "nothing changed"]).ok());
     let p1 = r.rec("propose", &a.ag(&["--json", "propose", "-t", "first"]).ok())["id"].as_str().unwrap().to_string();
     r.rec("proposal list", &a.ag(&["--json", "proposal", "list"]).ok());
+    r.rec("proposal reviewers", &a.ag(&["--json", "proposal", "reviewers", &p1, "--add", "user:bob"]).ok());
+    r.rec("proposal reviewers", &a.ag(&["--json", "proposal", "reviewers", &p1]).ok());
     r.rec("proposal show", &a.ag(&["--json", "proposal", "show", &p1]).ok());
     let preview = r.rec("preview", &a.ag(&["--json", "preview", &p1]).ok());
     let tree = preview["candidate_tree"].as_str().unwrap().to_string();
diff --git a/crates/ag-cli/tests/json_shapes_remote.rs b/crates/ag-cli/tests/json_shapes_remote.rs
index c3fa4bcb..68a36e2b 100644
--- a/crates/ag-cli/tests/json_shapes_remote.rs
+++ b/crates/ag-cli/tests/json_shapes_remote.rs
@@ -42,6 +42,11 @@ fn the_json_output_of_every_remote_command_matches_the_documented_shape() {
     let p1 = p1["proposal"]["id"].as_str().unwrap().to_string();
     record_discussions(&mut r, &a, &alice, &p1, &head);
     r.rec("remote proposals", &as_user("user:alice", &alice, &["--json", "remote", "proposals"]).ok());
+    r.rec(
+        "remote reviewers",
+        &as_user("user:alice", &alice, &["--json", "remote", "reviewers", &p1, "--add", "user:bob"]).ok(),
+    );
+    r.rec("remote reviewers", &as_user("user:bob", &bob, &["--json", "remote", "reviewers", &p1]).ok());
     r.rec("remote proposal", &as_user("user:alice", &alice, &["--json", "remote", "proposal", &p1]).ok());
     r.rec("remote prepare", &as_user("user:carol", &carol, &["--json", "remote", "prepare", &p1]).code_is(3));
     r.rec("remote explain", &as_user("user:carol", &carol, &["--json", "remote", "explain", &p1]).code_is(3));
diff --git a/crates/ag-cli/tests/remote.rs b/crates/ag-cli/tests/remote.rs
index d408c901..c19404a9 100644
--- a/crates/ag-cli/tests/remote.rs
+++ b/crates/ag-cli/tests/remote.rs
@@ -484,3 +484,67 @@ fn remote_task_edit_uses_the_server_and_enforces_its_permissions() {
     assert!(!refused.status.success());
     assert!(text(&refused).contains("creator"), "{}", text(&refused));
 }
+
+#[test]
+fn remote_requested_reviewers_route_work_without_granting_review_rights() {
+    let srv = Server::start();
+    let repo = "acme/reviewer-requests";
+    srv.app
+        .repos
+        .create(repo, "main", "", &ag_types::Identity::new("system:test").unwrap(), Default::default())
+        .unwrap();
+    let alice = srv.user("user:alice", repo, Role::Writer);
+    let bob = srv.user("user:bob", repo, Role::Reviewer);
+    let dir = tempfile::tempdir().unwrap();
+    ok(ag(dir.path(), "user:alice", &alice, &["init", "--namespace", repo]));
+    ok(ag(
+        dir.path(),
+        "user:alice",
+        &alice,
+        &["remote", "add", "origin", &format!("{}/{repo}", srv.url), "--token-env", "AG_TOKEN"],
+    ));
+    fs::write(dir.path().join("file.txt"), "Review this\n").unwrap();
+    ok(ag(dir.path(), "user:alice", &alice, &["snapshot", "-m", "Review routing"]));
+    let proposal = proposal_id(&ok(ag(dir.path(), "user:alice", &alice, &["push", "-t", "Review routing"])));
+    let saved: Value = serde_json::from_str(&ok(ag(
+        dir.path(),
+        "user:alice",
+        &alice,
+        &["--json", "remote", "reviewers", &proposal, "--add", "user:bob", "--expect-empty"],
+    )))
+    .unwrap();
+    assert_eq!(saved["reviewers"], serde_json::json!(["user:bob"]));
+    fs::write(dir.path().join("other.txt"), "Not requested from Bob\n").unwrap();
+    ok(ag(dir.path(), "user:alice", &alice, &["snapshot", "-m", "Unrequested work"]));
+    ok(ag(dir.path(), "user:alice", &alice, &["push", "-t", "Unrequested work"]));
+    let listed: Value = serde_json::from_str(&ok(ag(
+        dir.path(),
+        "user:bob",
+        &bob,
+        &["--json", "remote", "proposals", "--requested-reviewer", "user:bob"],
+    )))
+    .unwrap();
+    assert_eq!(listed["proposals"].as_array().unwrap().len(), 1);
+    let detail: Value =
+        serde_json::from_str(&ok(ag(dir.path(), "user:bob", &bob, &["--json", "remote", "proposal", &proposal])))
+            .unwrap();
+    assert_eq!(detail["requested_reviewers"], serde_json::json!(["user:bob"]));
+    assert!(detail["reviews"].as_array().unwrap().is_empty());
+    let denied = ag(dir.path(), "user:bob", &bob, &["remote", "reviewers", &proposal, "--remove", "user:bob"]);
+    assert!(!denied.status.success());
+    let stale = ag(
+        dir.path(),
+        "user:alice",
+        &alice,
+        &["remote", "reviewers", &proposal, "--add", "user:carol", "--expect-empty"],
+    );
+    assert!(!stale.status.success());
+    let removed: Value = serde_json::from_str(&ok(ag(
+        dir.path(),
+        "user:alice",
+        &alice,
+        &["--json", "remote", "reviewers", &proposal, "--remove", "user:bob", "--expected", "user:bob"],
+    )))
+    .unwrap();
+    assert_eq!(removed["reviewers"], serde_json::json!([]));
+}
diff --git a/crates/ag-integrate/src/lib.rs b/crates/ag-integrate/src/lib.rs
index dd246a78..d7514ee0 100644
--- a/crates/ag-integrate/src/lib.rs
+++ b/crates/ag-integrate/src/lib.rs
@@ -36,6 +36,7 @@ mod prepare;
 mod publish;
 mod queue;
 mod repo;
+mod review_requests;
 mod storage;
 mod types;
 mod virtual_ws;
diff --git a/crates/ag-integrate/src/review_requests.rs b/crates/ag-integrate/src/review_requests.rs
new file mode 100644
index 00000000..be78d02e
--- /dev/null
+++ b/crates/ag-integrate/src/review_requests.rs
@@ -0,0 +1,59 @@
+//! Explicit review routing, independent of approval and authorization.
+use crate::{Error, Repository, Result};
+use ag_storage::meta::MetaError;
+use ag_types::Identity;
+use serde_json::json;
+use std::collections::BTreeSet;
+
+fn canonical(identities: &[Identity]) -> Vec<String> {
+    identities.iter().map(|identity| identity.principal().to_string()).collect::<BTreeSet<_>>().into_iter().collect()
+}
+
+fn owns(owner: &str, actor: &Identity) -> bool {
+    match (owner.contains('#'), actor.as_str().contains('#')) {
+        (true, true) => owner == actor.as_str(),
+        _ => owner.split('#').next() == Some(actor.principal().as_str()),
+    }
+}
+
+impl Repository {
+    /// Requested reviewers of the proposal; this does not grant access or record a review.
+    pub fn requested_reviewers(&self, proposal: &str) -> Result<Vec<String>> {
+        let proposal = self.find_proposal(proposal)?;
+        Ok(self.meta.read(|tx| tx.proposal_reviewers(&proposal.id))?)
+    }
+
+    /// The author replaces the inspected reviewer set atomically. Repeating the desired set is a no-op.
+    pub fn set_requested_reviewers(
+        &self,
+        proposal: &str,
+        reviewers: &[Identity],
+        expected: &[Identity],
+        actor: &Identity,
+    ) -> Result<Vec<String>> {
+        if reviewers.len() > 20 || expected.len() > 20 {
+            return Err(Error::Invalid("request at most 20 reviewers".into()));
+        }
+        let proposal = self.find_proposal(proposal)?.id;
+        let (reviewers, expected) = (canonical(reviewers), canonical(expected));
+        self.meta.write(|tx| {
+            let p = tx.proposal(&proposal)?.ok_or_else(|| MetaError::NotFound(format!("proposal {proposal}")))?;
+            if !owns(&p.author, actor) || p.state != "open" {
+                return Ok(Err(Error::Invalid("only the author of an open proposal may request reviewers".into())));
+            }
+            if reviewers.contains(&actor.principal().to_string()) {
+                return Ok(Err(Error::Invalid("request a reviewer other than the author".into())));
+            }
+            let current = tx.proposal_reviewers(&proposal)?;
+            if current == reviewers {
+                return Ok(Ok(current));
+            }
+            if current != expected {
+                return Ok(Err(Error::Conflict("requested reviewers changed; inspect the current list".into())));
+            }
+            tx.proposal_set_reviewers(&proposal, &reviewers)?;
+            tx.audit_append(actor.as_str(), "proposal.reviewers", &proposal, &json!({"reviewers": reviewers}))?;
+            Ok(Ok(reviewers))
+        })?
+    }
+}
diff --git a/crates/ag-integrate/tests/review_requests.rs b/crates/ag-integrate/tests/review_requests.rs
new file mode 100644
index 00000000..f8cd4702
--- /dev/null
+++ b/crates/ag-integrate/tests/review_requests.rs
@@ -0,0 +1,78 @@
+//! Requested reviewers are durable routing, not approval or additional access.
+#![allow(missing_docs)]
+mod common;
+use common::*;
+
+#[test]
+fn reviewer_requests_are_sorted_retryable_and_compare_the_inspected_set() {
+    let f = fx();
+    let author = id("user:alice");
+    let head = f.snap(None, &[("file", "content")], author.as_str());
+    let proposal = f.repo.propose("main", &head, "review", "", &author, None).unwrap();
+    assert!(f.repo.requested_reviewers(&proposal.id).unwrap().is_empty());
+    let desired = [id("user:carol"), id("user:bob")];
+    let result = f.repo.set_requested_reviewers(&proposal.id, &desired, &[], &author).unwrap();
+    assert_eq!(result, ["user:bob", "user:carol"]);
+    assert_eq!(f.repo.requested_reviewers(&proposal.id).unwrap(), result);
+    // A lost response can be retried without another audit event.
+    assert_eq!(f.repo.set_requested_reviewers(&proposal.id, &desired, &[], &author).unwrap(), result);
+    assert!(f.repo.set_requested_reviewers(&proposal.id, &[], &[], &author).is_err());
+    assert_eq!(f.repo.requested_reviewers(&proposal.id).unwrap(), result);
+    let events = f.repo.meta().read(|tx| tx.audit_list(Some(&proposal.id), 100)).unwrap();
+    assert_eq!(events.iter().filter(|e| e.action == "proposal.reviewers").count(), 1);
+    assert!(f.repo.meta().read(|tx| tx.reviews(&proposal.id)).unwrap().is_empty());
+    f.repo.set_requested_reviewers(&proposal.id, &[], &desired, &author).unwrap();
+    assert!(f.repo.requested_reviewers(&proposal.id).unwrap().is_empty());
+}
+
+#[test]
+fn only_the_author_can_request_other_reviewers_on_an_open_proposal() {
+    let f = fx();
+    let author = id("user:alice");
+    let head = f.snap(None, &[("file", "content")], author.as_str());
+    let proposal = f.repo.propose("main", &head, "review", "", &author, None).unwrap();
+    assert!(f.repo.set_requested_reviewers(&proposal.id, &[id("user:carol")], &[], &id("user:bob")).is_err());
+    assert!(f.repo.set_requested_reviewers(&proposal.id, std::slice::from_ref(&author), &[], &author).is_err());
+    let many = (0..21).map(|i| id(&format!("user:u{i}"))).collect::<Vec<_>>();
+    assert!(f.repo.set_requested_reviewers(&proposal.id, &many, &[], &author).is_err());
+    assert!(f.repo.requested_reviewers(&proposal.id).unwrap().is_empty());
+    f.repo.close_proposal(&proposal.id, &author).unwrap();
+    assert!(f.repo.set_requested_reviewers(&proposal.id, &[id("user:bob")], &[], &author).is_err());
+}
+
+#[test]
+fn routing_uses_principals_without_crossing_run_ownership() {
+    let f = fx();
+    let author = id("agent:builder#run-a");
+    let head = f.snap(None, &[("file", "content")], author.as_str());
+    let p = f.repo.propose("main", &head, "review", "", &author, None).unwrap();
+    assert!(f.repo.set_requested_reviewers(&p.id, &[id("user:bob")], &[], &id("agent:builder#run-b")).is_err());
+    assert!(f.repo.set_requested_reviewers(&p.id, &[id("agent:builder#run-b")], &[], &author).is_err());
+    assert_eq!(
+        f.repo.set_requested_reviewers(&p.id, &[id("agent:reviewer#run-a")], &[], &author).unwrap(),
+        ["agent:reviewer"]
+    );
+}
+
+#[test]
+fn requested_reviewer_filter_is_applied_before_keyset_paging() {
+    let f = fx();
+    let author = id("user:alice");
+    let head = f.snap(None, &[("file", "content")], author.as_str());
+    let requested = f.repo.propose("main", &head, "requested", "", &author, None).unwrap();
+    f.repo.set_requested_reviewers(&requested.id, &[id("user:bob")], &[], &author).unwrap();
+    f.repo.propose("main", &head, "not requested", "", &author, None).unwrap();
+    let rows = f
+        .repo
+        .meta()
+        .read(|tx| {
+            tx.proposals_page(
+                &ag_storage::meta::ProposalFilter { requested_reviewer: Some("user:bob"), ..Default::default() },
+                None,
+                1,
+            )
+        })
+        .unwrap();
+    assert_eq!(rows.len(), 1);
+    assert_eq!(rows[0].id, requested.id);
+}
diff --git a/crates/ag-mcp/src/tools/proposals.rs b/crates/ag-mcp/src/tools/proposals.rs
index a3b4a569..9125a10d 100644
--- a/crates/ag-mcp/src/tools/proposals.rs
+++ b/crates/ag-mcp/src/tools/proposals.rs
@@ -93,6 +93,33 @@ fn proposal_update(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolEr
     ))
 }
 
+/// Refuse silently broadened reads or unguarded writes against an older server.
+pub(super) fn require_review_requests(ctx: &CallCtx<'_>, run: Option<&str>) -> Result<(), ToolError> {
+    if !ctx.api.supports("proposals.review_requests", &ctx.opts(run))? {
+        return Err(ToolError::local("server_update_required", "This server does not support requested reviewers.")
+            .hint("Update the server before managing or filtering requested reviewers."));
+    }
+    Ok(())
+}
+
+fn proposal_set_reviewers(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    let repo = ctx.repo(args)?;
+    let run = ctx.run_id(args)?;
+    require_review_requests(ctx, run)?;
+    ctx.check_cancelled()?;
+    let id = str_arg(args, "proposal_id").unwrap_or_default();
+    let value = ctx.api.send(
+        "PUT",
+        &format!("{}/proposals/{}/reviewers", repo_path(&repo), enc(id)),
+        Some(&json!({"reviewers":args["reviewers"],"expected_reviewers":args["expected_reviewers"]})),
+        &ctx.opts(run),
+    )?;
+    Ok(ToolOutput::new(
+        "Requested reviewers saved. Requests do not grant access or record approval.",
+        json!({"reviewers": value.get("reviewers").cloned().unwrap_or(json!([]))}),
+    ))
+}
+
 fn proposal_close(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
     let repo = ctx.repo(args)?;
     let run = ctx.run_id(args)?;
@@ -312,6 +339,39 @@ pub fn tools() -> Vec<ToolDef> {
             output(vec![("proposal", o_obj())], &["proposal"]),
             proposal_update,
         ),
+        def(
+            "proposal_set_reviewers",
+            Group::Propose,
+            "Set requested reviewers",
+            "The author of an open proposal replaces its requested reviewers. Pass the complete desired list and the exact expected_reviewers list read from proposal_status; an empty desired list clears requests. Concurrent edits are refused. Requests grant no access, record no approval and do not change policy.",
+            Ann::SET,
+            input(
+                vec![
+                    p_repo(),
+                    ("proposal_id", t_str("Proposal id (prop_…) or unique prefix.")),
+                    (
+                        "reviewers",
+                        t_arr(
+                            "Complete desired reviewer identities, excluding the author.",
+                            t_str("Reviewer identity, for example user:alice."),
+                            20,
+                        ),
+                    ),
+                    (
+                        "expected_reviewers",
+                        t_arr(
+                            "Exact previously inspected requested reviewer identities.",
+                            t_str("Reviewer identity."),
+                            20,
+                        ),
+                    ),
+                    p_run(),
+                ],
+                &["proposal_id", "reviewers", "expected_reviewers"],
+            ),
+            output(vec![("reviewers", o_arr())], &["reviewers"]),
+            proposal_set_reviewers,
+        ),
         def(
             "proposal_close",
             Group::Propose,
diff --git a/crates/ag-mcp/src/tools/read.rs b/crates/ag-mcp/src/tools/read.rs
index 1a92f1c5..2a883bd5 100644
--- a/crates/ag-mcp/src/tools/read.rs
+++ b/crates/ag-mcp/src/tools/read.rs
@@ -654,7 +654,10 @@ fn predict(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
 fn proposal_list(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
     let repo = ctx.repo(args)?;
     let mut q = page_query(args, 30, 100);
-    for k in ["state", "stream", "author"] {
+    if str_arg(args, "requested_reviewer").is_some_and(|value| !value.is_empty()) {
+        super::proposals::require_review_requests(ctx, None)?;
+    }
+    for k in ["state", "stream", "author", "requested_reviewer"] {
         if let Some(v) = str_arg(args, k).filter(|v| !v.is_empty()) {
             q.push((k, v.to_string()));
         }
@@ -705,6 +708,7 @@ pub fn status_of(ctx: &CallCtx<'_>, repo: &str, id: &str) -> Result<Value, ToolE
     brief["reviews_total"] = json!(reviews.len());
     if let Some(o) = derived.as_object_mut() {
         o.insert("proposal".into(), brief);
+        o.insert("requested_reviewers".into(), json!(arr(&d, "requested_reviewers")));
         o.insert("validations".into(), prep.as_ref().and_then(|p| p.get("validations")).cloned().unwrap_or(json!([])));
         o.insert("prepared".into(), json!(prep.is_some()));
     }
@@ -1063,6 +1067,10 @@ pub fn tools() -> Vec<ToolDef> {
                         ("state", t_enum("Only proposals in this state.", &["open", "integrated", "closed"])),
                         ("stream", t_str("Only proposals for this stream.")),
                         ("author", t_str("Only proposals by this identity.")),
+                        (
+                            "requested_reviewer",
+                            t_str("Only proposals requesting review from this identity; requires server support."),
+                        ),
                     ];
                     p.extend(pagination());
                     p
@@ -1085,6 +1093,7 @@ pub fn tools() -> Vec<ToolDef> {
                     ("verdicts", o_obj()),
                     ("blockers", o_arr()),
                     ("ready_to_integrate", o_bool()),
+                    ("requested_reviewers", o_arr()),
                     ("next_steps", o_arr()),
                 ],
                 &["verdicts", "blockers"],
diff --git a/crates/ag-mcp/tests/review_requests.rs b/crates/ag-mcp/tests/review_requests.rs
new file mode 100644
index 00000000..10baf7ad
--- /dev/null
+++ b/crates/ag-mcp/tests/review_requests.rs
@@ -0,0 +1,93 @@
+//! Requested review routing through the real stdio bridge.
+#![allow(missing_docs)]
+mod common;
+use common::*;
+use serde_json::json;
+
+#[test]
+fn authors_manage_review_requests_without_granting_access_or_approval() {
+    let srv = TestServer::start();
+    let repo = "acme/reviews";
+    srv.repo(repo);
+    srv.seed(repo, "Initial", &[("file.txt", "old\n")]);
+    let author = srv.credential("user:alice", repo, "writer", 3600, &[]);
+    let reader = srv.credential("user:bob", repo, "reader", 3600, &[]);
+    let mut m = Mcp::start(&srv, &author, &["--repo", repo]);
+    m.ok("workspace_create", json!({"name":"change"}));
+    m.ok(
+        "workspace_write_files",
+        json!({"workspace":"change","message":"change","changes":[{"path":"file.txt","op":"put","content":"new\n"}]}),
+    );
+    let proposal = m.ok("propose", json!({"workspace":"change","title":"Review this"}));
+    let id = proposal.structured["proposal"]["id"].as_str().unwrap();
+    let set = json!({"proposal_id":id,"reviewers":["user:bob"],"expected_reviewers":[]});
+    let saved = m.ok("proposal_set_reviewers", set.clone());
+    assert_eq!(saved.structured["reviewers"], json!(["user:bob"]));
+    assert_eq!(m.ok("proposal_set_reviewers", set).structured["reviewers"], json!(["user:bob"]));
+    let missing_guard = m.call("proposal_set_reviewers", json!({"proposal_id":id,"reviewers":[]}));
+    assert!(missing_guard.is_error, "the inspected set is required before a write");
+    let status = m.ok("proposal_status", json!({"proposal_id":id}));
+    assert_eq!(status.structured["requested_reviewers"], json!(["user:bob"]));
+    assert!(status.structured["reviews"]["approvals"].as_array().unwrap().is_empty());
+    let listed = m.ok("proposal_list", json!({"requested_reviewer":"user:bob"}));
+    assert_eq!(listed.structured["proposals"][0]["id"], id);
+    let absent = m.ok("proposal_list", json!({"requested_reviewer":"user:carol"}));
+    assert!(absent.structured["proposals"].as_array().unwrap().is_empty());
+    let stale = m.call("proposal_set_reviewers", json!({"proposal_id":id,"reviewers":[],"expected_reviewers":[]}));
+    assert!(stale.is_error, "stale set must not erase a newer request");
+    let mut other = Mcp::start(&srv, &reader, &["--repo", repo]);
+    assert!(
+        other
+            .call("proposal_set_reviewers", json!({"proposal_id":id,"reviewers":[],"expected_reviewers":["user:bob"]}))
+            .is_error
+    );
+    let mut read_only = Mcp::start(&srv, &reader, &["--repo", repo, "--allow", "read"]);
+    assert!(!read_only.tool_names().contains(&"proposal_set_reviewers".into()));
+    m.ok("proposal_set_reviewers", json!({"proposal_id":id,"reviewers":[],"expected_reviewers":["user:bob"]}));
+    assert!(
+        m.ok("proposal_status", json!({"proposal_id":id})).structured["requested_reviewers"]
+            .as_array()
+            .unwrap()
+            .is_empty()
+    );
+}
+
+#[test]
+fn older_servers_refuse_review_request_writes_and_filters_before_using_them() {
+    use std::io::{BufRead, BufReader, Write};
+    use std::net::TcpListener;
+
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let url = format!("http://{}", listener.local_addr().unwrap());
+    let response = std::thread::spawn(move || {
+        let (mut stream, _) = listener.accept().unwrap();
+        let mut input = BufReader::new(stream.try_clone().unwrap());
+        let mut line = String::new();
+        input.read_line(&mut line).unwrap();
+        assert!(line.starts_with("GET /v1/capabilities "), "{line}");
+        loop {
+            let mut header = String::new();
+            input.read_line(&mut header).unwrap();
+            if header == "\r\n" || header.is_empty() {
+                break;
+            }
+        }
+        let body = r#"{"features":[]}"#;
+        write!(
+            stream,
+            "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
+            body.len(),
+            body
+        )
+        .unwrap();
+    });
+    let mut m = Mcp::spawn(&["--server", &url, "--repo", "acme/reviews"], &[("AG_MCP_TOKEN", "test-token")]);
+    m.request("server/discover", json!({}));
+    m.refused(
+        "proposal_set_reviewers",
+        json!({"proposal_id":"prop_test","reviewers":[],"expected_reviewers":[]}),
+        "server_update_required",
+    );
+    m.refused("proposal_list", json!({"requested_reviewer":"user:bob"}), "server_update_required");
+    response.join().unwrap();
+}
diff --git a/crates/ag-protocol/build.rs b/crates/ag-protocol/build.rs
index c6fe55c9..c02dc33e 100644
--- a/crates/ag-protocol/build.rs
+++ b/crates/ag-protocol/build.rs
@@ -46,6 +46,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     for field in ["old_mode", "new_mode", "truncated"] {
         builder = builder.field_attribute(format!("agwp.v1.FileDiff.{field}"), "#[schema(required = false)]");
     }
+    builder = builder.field_attribute("agwp.v1.ProposalDetail.requested_reviewers", "#[schema(required = false)]");
     builder.compile_fds(fds)?;
     Ok(())
 }
diff --git a/crates/ag-protocol/proto/agwp/v1/agwp.proto b/crates/ag-protocol/proto/agwp/v1/agwp.proto
index c44b18a7..a77069b4 100644
--- a/crates/ag-protocol/proto/agwp/v1/agwp.proto
+++ b/crates/ag-protocol/proto/agwp/v1/agwp.proto
@@ -728,6 +728,8 @@ message GetProposalRequest {
 message ProposalDetail {
   Proposal proposal = 1;
   repeated Review reviews = 2;
+  // Routing only; requests do not grant access or count as approval.
+  repeated string requested_reviewers = 3;
 }
 
 message ListProposalsRequest {
@@ -739,6 +741,8 @@ message ListProposalsRequest {
   string page_token = 6;
   // Match the linked task before paging. Empty matches all tasks.
   string task_id = 7;
+  // Match a requested reviewer before keyset paging.
+  string requested_reviewer = 8;
 }
 
 message ListProposalsResponse {
@@ -756,6 +760,17 @@ message UpdateProposalRequest {
   string expected_head = 5;
 }
 
+// Replaces review routing after comparing the complete inspected set.
+message SetRequestedReviewersRequest {
+  string repo = 1;
+  string id = 2;
+  repeated string reviewers = 3;
+  repeated string expected_reviewers = 4;
+}
+message RequestedReviewers {
+  repeated string reviewers = 1;
+}
+
 message ReviewProposalRequest {
   string repo = 1;
   string id = 2;
@@ -1800,6 +1815,7 @@ service ProposalService {
   rpc Get(GetProposalRequest) returns (ProposalDetail);
   rpc List(ListProposalsRequest) returns (ListProposalsResponse);
   rpc Update(UpdateProposalRequest) returns (Proposal);
+  rpc SetReviewers(SetRequestedReviewersRequest) returns (RequestedReviewers);
   rpc Review(ReviewProposalRequest) returns (Review);
   rpc Comment(CommentProposalRequest) returns (Review);
   rpc ListThreads(ListReviewThreadsRequest) returns (ListReviewThreadsResponse);
diff --git a/crates/ag-protocol/src/lib.rs b/crates/ag-protocol/src/lib.rs
index d9ef3830..44546760 100644
--- a/crates/ag-protocol/src/lib.rs
+++ b/crates/ag-protocol/src/lib.rs
@@ -83,6 +83,8 @@ pub mod features {
 
     /// Proposal head updates can require an inspected head atomically.
     pub const PROPOSALS_UPDATE_HEAD: &str = "proposals.update_head";
+    /// Author-controlled review routing with inspected-set preconditions.
+    pub const PROPOSALS_REVIEW_REQUESTS: &str = "proposals.review_requests";
 
     /// Stream policy can require all line discussions to be resolved before integration.
     pub const POLICY_RESOLVED_THREADS: &str = "policy.resolved_threads";
@@ -105,6 +107,7 @@ pub mod features {
         AGENTS_OPERATE,
         PROPOSALS_REVIEW_HEAD,
         PROPOSALS_UPDATE_HEAD,
+        PROPOSALS_REVIEW_REQUESTS,
         POLICY_RESOLVED_THREADS,
         TREE_SEARCH,
         ISSUES,
diff --git a/crates/ag-server/src/api/proposals.rs b/crates/ag-server/src/api/proposals.rs
index d2a6f919..b9f0b0cc 100644
--- a/crates/ag-server/src/api/proposals.rs
+++ b/crates/ag-server/src/api/proposals.rs
@@ -46,6 +46,7 @@ impl App {
             Ok(v1::ProposalDetail {
                 proposal: Some(convert::proposal(&p)),
                 reviews: reviews.iter().map(convert::review).collect(),
+                requested_reviewers: repo.requested_reviewers(&p.id)?,
             })
         })
         .await
@@ -63,11 +64,18 @@ impl App {
             let some = |s: &str| (!s.is_empty()).then_some(s.to_string());
             let (state, stream, author) = (some(&req.state), some(&req.stream), some(&req.author));
             let task_id = some(&req.task_id);
+            let requested_reviewer = if req.requested_reviewer.is_empty() {
+                None
+            } else {
+                Some(ag_types::Identity::new(&req.requested_reviewer)
+                    .map_err(|e| ApiError::invalid(e.to_string()))?.principal().to_string())
+            };
             let filter = ProposalFilter {
                 state: state.as_deref(),
                 stream: stream.as_deref(),
                 author: author.as_deref(),
                 task_id: task_id.as_deref(),
+                requested_reviewer: requested_reviewer.as_deref(),
             };
             let after = after.as_ref().map(|(at, id)| (*at, id.as_str()));
             // One more than a page, to learn whether there is a next one.
@@ -111,6 +119,38 @@ impl App {
         .await
     }
 
+    /// The author replaces the exact inspected set of requested reviewers.
+    pub async fn set_requested_reviewers(
+        &self,
+        call: &Call,
+        req: v1::SetRequestedReviewersRequest,
+    ) -> ApiResult<v1::RequestedReviewers> {
+        let identities = |values: Vec<String>| -> ApiResult<Vec<ag_types::Identity>> {
+            values
+                .into_iter()
+                .map(|value| ag_types::Identity::new(value).map_err(|e| ApiError::invalid(e.to_string())))
+                .collect()
+        };
+        let reviewers = identities(req.reviewers)?;
+        let expected = identities(req.expected_reviewers)?;
+        self.with_proposal_mut(
+            call,
+            require(&req.repo, "repo")?,
+            Cap::ProposalUpdate,
+            req.id.clone(),
+            move |repo, actor| {
+                let p = repo.find_proposal(&req.id)?;
+                if !super::owns(&p.author, actor) {
+                    return Err(ApiError::denied("only the author may request reviewers"));
+                }
+                Ok(v1::RequestedReviewers {
+                    reviewers: repo.set_requested_reviewers(&p.id, &reviewers, &expected, actor)?,
+                })
+            },
+        )
+        .await
+    }
+
     /// Records a review (approve, request_changes or comment) of the current head.
     pub async fn review_proposal(&self, call: &Call, req: v1::ReviewProposalRequest) -> ApiResult<v1::Review> {
         let decision = require(&req.decision, "decision")?.to_string();
diff --git a/crates/ag-server/src/grpc.rs b/crates/ag-server/src/grpc.rs
index 65482417..647f2630 100644
--- a/crates/ag-server/src/grpc.rs
+++ b/crates/ag-server/src/grpc.rs
@@ -374,6 +374,12 @@ impl ProposalService for Grpc {
     async fn update(&self, request: Request<v1::UpdateProposalRequest>) -> Result<Response<v1::Proposal>, Status> {
         unary!(self, request, "proposal.update", update_proposal)
     }
+    async fn set_reviewers(
+        &self,
+        request: Request<v1::SetRequestedReviewersRequest>,
+    ) -> Result<Response<v1::RequestedReviewers>, Status> {
+        unary!(self, request, "proposal.set_reviewers", set_requested_reviewers)
+    }
     async fn review(&self, request: Request<v1::ReviewProposalRequest>) -> Result<Response<v1::Review>, Status> {
         unary!(self, request, "proposal.review", review_proposal)
     }
diff --git a/crates/ag-server/src/http.rs b/crates/ag-server/src/http.rs
index a83d9359..22bf60dd 100644
--- a/crates/ag-server/src/http.rs
+++ b/crates/ag-server/src/http.rs
@@ -952,6 +952,19 @@ pub fn api_router(app: App) -> (Router, Vec<RouteMeta>) {
         v1::Proposal,
         update_proposal
     );
+    route!(
+        r,
+        meta,
+        put,
+        "put",
+        "/v1/repos/{owner}/{rname}/proposals/{id}/reviewers",
+        "proposal.set_reviewers",
+        "Proposal",
+        "Replace the inspected set of requested reviewers",
+        v1::SetRequestedReviewersRequest,
+        v1::RequestedReviewers,
+        set_requested_reviewers
+    );
     route!(
         r,
         meta,
diff --git a/crates/ag-server/tests/review_requests.rs b/crates/ag-server/tests/review_requests.rs
new file mode 100644
index 00000000..59c043a3
--- /dev/null
+++ b/crates/ag-server/tests/review_requests.rs
@@ -0,0 +1,80 @@
+//! Review routing respects author permissions and optimistic edits.
+mod common;
+use ag_protocol::v1::{self, proposal_service_client::ProposalServiceClient};
+use common::*;
+use serde_json::json;
+use tonic::{Code, Request};
+fn authed<T>(token: &str, value: T) -> Request<T> {
+    let mut request = Request::new(value);
+    request.metadata_mut().insert("authorization", format!("Bearer {token}").parse().unwrap());
+    request
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn requested_reviewers_are_visible_but_only_the_author_can_change_them() {
+    let srv = TestServer::start().await;
+    let admin = srv.admin();
+    assert_eq!(admin.post("/v1/repos", json!({"name":"acme/reviews"})).await.status, 200);
+    let author = user_with_role(&srv, "user:author", "acme/reviews", "writer").await;
+    let reviewer = user_with_role(&srv, "user:bob", "acme/reviews", "reviewer").await;
+    let (head, objects) =
+        Client::new("acme/reviews").commit(vec![], "user:author", "change", &[("file", b"content")], 1_700_000_000_000);
+    upload(&author, "acme/reviews", &objects).await;
+    let proposal = author
+        .post("/v1/repos/acme/reviews/proposals", json!({"stream":"main","head":head.to_string(),"title":"review"}))
+        .await;
+    assert_eq!(proposal.status, 200);
+    let id = proposal.json["id"].as_str().unwrap();
+    let path = format!("/v1/repos/acme/reviews/proposals/{id}/reviewers");
+    let body = json!({"reviewers":["user:bob"],"expected_reviewers":[]});
+    let saved = author.call("PUT", &path, Some(body.clone()), &[]).await;
+    assert_eq!(saved.status, 200, "{}", saved.json);
+    assert_eq!(saved.json["reviewers"], json!(["user:bob"]));
+    assert_eq!(author.call("PUT", &path, Some(body), &[]).await.status, 200);
+    let detail = reviewer.get(&format!("/v1/repos/acme/reviews/proposals/{id}")).await;
+    assert_eq!(detail.json["requested_reviewers"], json!(["user:bob"]));
+    assert!(detail.json["reviews"].as_array().unwrap().is_empty());
+    let matches = reviewer.get("/v1/repos/acme/reviews/proposals?requested_reviewer=user:bob").await;
+    assert_eq!(matches.json["proposals"].as_array().unwrap().len(), 1);
+    assert_eq!(
+        reviewer.get("/v1/repos/acme/reviews/proposals?requested_reviewer=user:carol").await.json["proposals"],
+        json!([])
+    );
+    let scoped = author
+        .post("/v1/credentials", json!({"ttl_secs":600,"scope":{"repos":["acme/reviews"],"streams":["dev"]}}))
+        .await;
+    assert_eq!(scoped.status, 200);
+    let narrow = srv.client(scoped.json["token"].as_str().unwrap());
+    assert_eq!(
+        narrow.call("PUT", &path, Some(json!({"reviewers":[],"expected_reviewers":["user:bob"]})), &[]).await.status,
+        403
+    );
+    let clear = json!({"reviewers":[],"expected_reviewers":["user:bob"]});
+    assert_eq!(reviewer.call("PUT", &path, Some(clear.clone()), &[]).await.status, 403);
+    assert_eq!(author.call("PUT", &path, Some(json!({"reviewers":[],"expected_reviewers":[]})), &[]).await.status, 412);
+    assert_eq!(author.call("PUT", &path, Some(clear), &[]).await.status, 200);
+    let mut grpc = ProposalServiceClient::connect(srv.base.clone()).await.unwrap();
+    let request = v1::SetRequestedReviewersRequest {
+        repo: "acme/reviews".into(),
+        id: id.into(),
+        reviewers: vec!["user:bob".into()],
+        expected_reviewers: vec![],
+    };
+    assert_eq!(
+        grpc.set_reviewers(authed(&author.token, request.clone())).await.unwrap().into_inner().reviewers,
+        ["user:bob"]
+    );
+    assert_eq!(grpc.set_reviewers(authed(&reviewer.token, request)).await.unwrap_err().code(), Code::PermissionDenied);
+    let stale = v1::SetRequestedReviewersRequest {
+        repo: "acme/reviews".into(),
+        id: id.into(),
+        reviewers: vec![],
+        expected_reviewers: vec![],
+    };
+    assert_eq!(grpc.set_reviewers(authed(&author.token, stale)).await.unwrap_err().code(), Code::FailedPrecondition);
+    let principal_request = json!({"reviewers":["agent:reviewer#run-a"],"expected_reviewers":["user:bob"]});
+    assert_eq!(author.call("PUT", &path, Some(principal_request), &[]).await.status, 200);
+    let matches = reviewer.get("/v1/repos/acme/reviews/proposals?requested_reviewer=agent:reviewer%23run-a").await;
+    assert_eq!(matches.json["proposals"].as_array().unwrap().len(), 1);
+    srv.stop().await;
+}
diff --git a/crates/ag-storage/migrations/postgres/0009_proposal_reviewers.sql b/crates/ag-storage/migrations/postgres/0009_proposal_reviewers.sql
new file mode 100644
index 00000000..f9a65a51
--- /dev/null
+++ b/crates/ag-storage/migrations/postgres/0009_proposal_reviewers.sql
@@ -0,0 +1,6 @@
+CREATE TABLE proposal_reviewers (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    reviewer TEXT NOT NULL,
+    PRIMARY KEY (proposal, reviewer)
+);
+CREATE INDEX proposal_reviewers_identity ON proposal_reviewers(reviewer, proposal);
diff --git a/crates/ag-storage/migrations/sqlite/0009_proposal_reviewers.sql b/crates/ag-storage/migrations/sqlite/0009_proposal_reviewers.sql
new file mode 100644
index 00000000..f9a65a51
--- /dev/null
+++ b/crates/ag-storage/migrations/sqlite/0009_proposal_reviewers.sql
@@ -0,0 +1,6 @@
+CREATE TABLE proposal_reviewers (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    reviewer TEXT NOT NULL,
+    PRIMARY KEY (proposal, reviewer)
+);
+CREATE INDEX proposal_reviewers_identity ON proposal_reviewers(reviewer, proposal);
diff --git a/crates/ag-storage/src/meta/migrate.rs b/crates/ag-storage/src/meta/migrate.rs
index 2445d6f3..8366b623 100644
--- a/crates/ag-storage/src/meta/migrate.rs
+++ b/crates/ag-storage/src/meta/migrate.rs
@@ -34,7 +34,7 @@ impl Migration {
 }
 
 /// Schema version understood by this build.
-pub const SCHEMA_VERSION: i64 = 8;
+pub const SCHEMA_VERSION: i64 = 9;
 
 pub(crate) const SQLITE_MIGRATIONS: &[Migration] = &[
     Migration { version: 1, name: "0001_init.sql", sql: include_str!("../../migrations/sqlite/0001_init.sql") },
@@ -65,6 +65,11 @@ pub(crate) const SQLITE_MIGRATIONS: &[Migration] = &[
         name: "0008_task_attempt_limits.sql",
         sql: include_str!("../../migrations/sqlite/0008_task_attempt_limits.sql"),
     },
+    Migration {
+        version: 9,
+        name: "0009_proposal_reviewers.sql",
+        sql: include_str!("../../migrations/sqlite/0009_proposal_reviewers.sql"),
+    },
 ];
 
 pub(crate) const POSTGRES_MIGRATIONS: &[Migration] = &[
@@ -96,6 +101,11 @@ pub(crate) const POSTGRES_MIGRATIONS: &[Migration] = &[
         name: "0008_task_attempt_limits.sql",
         sql: include_str!("../../migrations/postgres/0008_task_attempt_limits.sql"),
     },
+    Migration {
+        version: 9,
+        name: "0009_proposal_reviewers.sql",
+        sql: include_str!("../../migrations/postgres/0009_proposal_reviewers.sql"),
+    },
 ];
 
 #[cfg(test)]
diff --git a/crates/ag-storage/src/meta/records.rs b/crates/ag-storage/src/meta/records.rs
index 99b5e36b..8c464c14 100644
--- a/crates/ag-storage/src/meta/records.rs
+++ b/crates/ag-storage/src/meta/records.rs
@@ -208,6 +208,8 @@ pub struct ProposalFilter<'a> {
     pub author: Option<&'a str>,
     /// Linked task, exactly as stored.
     pub task_id: Option<&'a str>,
+    /// Requested reviewer identity, matched before paging.
+    pub requested_reviewer: Option<&'a str>,
 }
 
 /// The `WHERE … ORDER BY … LIMIT` of [`Tx::proposals_page`] and its arguments (separate so that a test can ask the
@@ -227,6 +229,10 @@ pub(crate) fn proposals_page_clause<'a>(
             clauses.push(format!("{column} = ?{}", args.len()));
         }
     }
+    if let Some(reviewer) = filter.requested_reviewer {
+        args.push(Param::from(reviewer));
+        clauses.push(format!("EXISTS (SELECT 1 FROM proposal_reviewers WHERE proposal_reviewers.proposal = proposals.id AND reviewer = ?{})", args.len()));
+    }
     if let Some((created, id)) = after {
         args.push(Param::from(created));
         args.push(Param::from(id));
@@ -240,6 +246,27 @@ pub(crate) fn proposals_page_clause<'a>(
 impl Tx<'_> {
     // ---- proposals -------------------------------------------------------
 
+    /// The requested reviewer identities, in canonical order.
+    pub fn proposal_reviewers(&self, proposal: &str) -> Result<Vec<String>, MetaError> {
+        self.conn
+            .query("SELECT reviewer FROM proposal_reviewers WHERE proposal = ?1 ORDER BY reviewer", &params![proposal])?
+            .iter()
+            .map(|row| row.string(0))
+            .collect()
+    }
+
+    /// Replaces routing metadata; callers compare the inspected set in the same transaction.
+    pub fn proposal_set_reviewers(&self, proposal: &str, reviewers: &[String]) -> Result<(), MetaError> {
+        self.conn.execute("DELETE FROM proposal_reviewers WHERE proposal = ?1", &params![proposal])?;
+        for reviewer in reviewers {
+            self.conn.execute(
+                "INSERT INTO proposal_reviewers (proposal, reviewer) VALUES (?1, ?2)",
+                &params![proposal, reviewer],
+            )?;
+        }
+        Ok(())
+    }
+
     /// Creates an open proposal.
     pub fn proposal_create(&self, p: &NewProposal<'_>) -> Result<ProposalRow, MetaError> {
         let now = self.now().as_millis();
diff --git a/crates/ag-storage/src/meta/tests.rs b/crates/ag-storage/src/meta/tests.rs
index 136a8ce1..6bf9525a 100644
--- a/crates/ag-storage/src/meta/tests.rs
+++ b/crates/ag-storage/src/meta/tests.rs
@@ -902,3 +902,31 @@ fn schema_seven_preserves_task_attempt_history() {
     assert_eq!(task.description, "Keep λ");
     assert!(upgraded.read(|tx| tx.run("run_old")).unwrap().is_some());
 }
+
+#[test]
+fn schema_eight_review_requests_migrate_and_persist_without_changing_backup() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("meta.db");
+    let backup = dir.path().join("before.db");
+    {
+        let conn = rusqlite::Connection::open(&path).unwrap();
+        for migration in migrate::SQLITE_MIGRATIONS.iter().filter(|m| m.version <= 8) {
+            conn.execute_batch(migration.sql).unwrap();
+        }
+        conn.execute("INSERT INTO meta(key,value) VALUES('schema','8')", []).unwrap();
+        conn.execute("INSERT INTO proposals(id,stream,head,title,description,author,state,created_at,updated_at) VALUES('prop_old','main',?1,'Keep old review','description','user:author','open',1,1)", ["0".repeat(64)]).unwrap();
+        conn.pragma_update(None, "user_version", 8).unwrap();
+    }
+    std::fs::copy(&path, &backup).unwrap();
+    {
+        let upgraded = Meta::open(&path).unwrap();
+        assert!(upgraded.read(|tx| tx.proposal_reviewers("prop_old")).unwrap().is_empty());
+        upgraded.write(|tx| tx.proposal_set_reviewers("prop_old", &["user:bob".into()])).unwrap();
+    }
+    let reopened = Meta::open(&path).unwrap();
+    assert_eq!(reopened.read(|tx| tx.proposal_reviewers("prop_old")).unwrap(), ["user:bob"]);
+    assert_eq!(reopened.read(|tx| tx.proposal("prop_old")).unwrap().unwrap().title, "Keep old review");
+    let untouched = rusqlite::Connection::open(&backup).unwrap();
+    assert_eq!(untouched.pragma_query_value(None, "user_version", |row| row.get::<_, i64>(0)).unwrap(), 8);
+    assert_eq!(untouched.query_row("SELECT COUNT(*) FROM sqlite_master WHERE name='proposal_reviewers'", [], |row| row.get::<_, i64>(0)).unwrap(), 0);
+}
diff --git a/docs/adr/0036-requested-reviewers.md b/docs/adr/0036-requested-reviewers.md
new file mode 100644
index 00000000..467eadd5
--- /dev/null
+++ b/docs/adr/0036-requested-reviewers.md
@@ -0,0 +1,31 @@
+# ADR 0036: explicit requested reviewers
+
+Status: accepted.
+
+## Decision
+
+Store at most 20 requested reviewer identities per proposal as routing metadata. The
+proposal author owns the list. Requests do not grant repository access, count as approval,
+add a policy requirement, send an external message or automatically integrate anything.
+The author cannot request their own review. Actual review permissions remain unchanged.
+
+The list persists across proposal revisions. A review satisfies a request for display only
+when it records approval or requested changes against the current proposal head. Comments
+and decisions on earlier revisions leave the current request pending. The author can remove
+requests explicitly; recording a review does not mutate the requested list.
+
+Replacing the list compares the complete inspected set within the same metadata transaction
+that writes the new set and audit event. Identities are canonicalized to a sorted unique set.
+A retry whose desired set is already stored succeeds without another audit event. A different
+concurrent edit is a conflict. Closed or integrated proposals cannot change their requests.
+Stream-scoped credentials are checked against the proposal's immutable target stream.
+
+Schema 9 adds a relational `proposal_reviewers` table with a composite primary key and a
+reviewer lookup index. The table supports a requested-reviewer filter before keyset paging.
+Back up before upgrading from schema 8; rollback restores that backup. Existing proposals
+start with no requests. No canonical history object, merge rule or policy document changes.
+
+HTTP and gRPC expose the same operation and advertise `proposals.review_requests`.
+Older clients can still review; older servers omit the additive list and the Web UI hides
+request editing when the feature is absent. The CLI and SDKs use the same inspected-set
+precondition as the browser.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 78d9dc9b..cabe75d1 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -46,3 +46,5 @@ which test: [ADR traceability](../architecture/adr-traceability.md).
 - [0034 — Task completion policy precondition](0034-task-finish-policy-precondition.md)
 
 - [0035 — Task completion execution generation](0035-task-completion-generation.md)
+
+- [0036 — Requested reviewers](0036-requested-reviewers.md)
diff --git a/docs/protocol/agwp-v1.md b/docs/protocol/agwp-v1.md
index b4ec2441..baa5afba 100644
--- a/docs/protocol/agwp-v1.md
+++ b/docs/protocol/agwp-v1.md
@@ -356,3 +356,20 @@ Owner, creation metadata, prerequisites and task/run source links are unaffected
 migration is introduced. [Semantics](../adr/0028-task-instruction-refinement.md).
 
 HTTP event subscriptions emit an initial SSE comment after authorization. This acknowledges an idle connection immediately without allocating an event sequence; clients continue to ignore comments and resume using real event IDs.
+
+
+### Requested reviewers (development)
+
+Negotiate `proposals.review_requests` before writing review requests or using the
+`requested_reviewer` proposal-list filter. An older server may ignore unknown filter
+fields; callers must not present that unfiltered result as a personal review queue.
+
+`PUT /v1/repos/{owner}/{repo}/proposals/{id}/reviewers` (`ProposalService.SetReviewers`)
+accepts `reviewers` and `expected_reviewers` arrays. Only the author of an open proposal
+may replace its requested set. A stale set returns HTTP 412 / gRPC FailedPrecondition;
+repeating the already-stored desired set is a successful no-op. Up to 20 unique principal
+identities are retained in sorted order. The author cannot request their own review.
+
+Proposal detail includes optional `requested_reviewers`. A request grants no access and
+is not an approval. It remains after the head moves; review status is evaluated against
+the current head. Schema 9 stores these requests; back up before upgrading from schema 8.
diff --git a/docs/protocol/openapi.json b/docs/protocol/openapi.json
index 347fcaa3..6d21274c 100644
--- a/docs/protocol/openapi.json
+++ b/docs/protocol/openapi.json
@@ -2812,6 +2812,11 @@
             "default": "",
             "type": "string"
           },
+          "requested_reviewer": {
+            "default": "",
+            "description": "Match a requested reviewer before keyset paging.",
+            "type": "string"
+          },
           "state": {
             "default": "",
             "type": "string"
@@ -3880,6 +3885,14 @@
               }
             ]
           },
+          "requested_reviewers": {
+            "default": [],
+            "description": "Routing only; requests do not grant access or count as approval.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
           "reviews": {
             "default": [],
             "items": {
@@ -4505,6 +4518,18 @@
         },
         "type": "object"
       },
+      "RequestedReviewers": {
+        "properties": {
+          "reviewers": {
+            "default": [],
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
       "ResolvePathRequest": {
         "properties": {
           "path": {
@@ -5177,6 +5202,34 @@
         },
         "type": "object"
       },
+      "SetRequestedReviewersRequest": {
+        "description": "Replaces review routing after comparing the complete inspected set.",
+        "properties": {
+          "expected_reviewers": {
+            "default": [],
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "id": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          },
+          "reviewers": {
+            "default": [],
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
       "SetTaskAttemptLimitRequest": {
         "description": "Execution policy is independent of immutable task instructions and run history.",
         "properties": {
@@ -9713,6 +9766,16 @@
               "type": "string"
             }
           },
+          {
+            "in": "query",
+            "name": "requested_reviewer",
+            "required": false,
+            "schema": {
+              "default": "",
+              "description": "Match a requested reviewer before keyset paging.",
+              "type": "string"
+            }
+          },
           {
             "in": "query",
             "name": "state",
@@ -10102,6 +10165,77 @@
         ]
       }
     },
+    "/v1/repos/{owner}/{rname}/proposals/{id}/reviewers": {
+      "put": {
+        "operationId": "proposal.set_reviewers",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SetRequestedReviewersRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RequestedReviewers"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Replace the inspected set of requested reviewers",
+        "tags": [
+          "Proposal"
+        ]
+      }
+    },
     "/v1/repos/{owner}/{rname}/proposals/{id}/reviews": {
       "post": {
         "operationId": "proposal.review",
diff --git a/docs/reference/cli-json.md b/docs/reference/cli-json.md
index 638c16ea..6c6dce2b 100644
--- a/docs/reference/cli-json.md
+++ b/docs/reference/cli-json.md
@@ -1136,6 +1136,16 @@ Their output *is* the data (file contents, a template, a script, a man page, hel
 }
 ```
 
+### ag proposal reviewers
+
+```json
+{
+  "reviewers": [
+    "string"
+  ]
+}
+```
+
 ### ag proposal show
 
 ```json
@@ -1153,6 +1163,9 @@ Their output *is* the data (file contents, a template, a script, a man page, hel
     "title": "string",
     "updated_at": "number"
   },
+  "requested_reviewers": [
+    "string"
+  ],
   "reviews": []
 }
 ```
@@ -1550,6 +1563,9 @@ Their output *is* the data (file contents, a template, a script, a man page, hel
           "policy_version": "number",
           "proposal": "string",
           "resolved": "bool",
+          "reviewers": [
+            "string"
+          ],
           "role": "string",
           "status": "string",
           "stream": "string",
@@ -1758,6 +1774,9 @@ Their output *is* the data (file contents, a template, a script, a man page, hel
     "title": "string",
     "updated_at_ms": "number"
   },
+  "requested_reviewers": [
+    "string"
+  ],
   "reviews": []
 }
 ```
@@ -1807,6 +1826,16 @@ Their output *is* the data (file contents, a template, a script, a man page, hel
 }
 ```
 
+### ag remote reviewers
+
+```json
+{
+  "reviewers": [
+    "string"
+  ]
+}
+```
+
 ### ag remote streams
 
 ```json
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index 480025e6..e4ba4a25 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -43,6 +43,7 @@ Concept pages are available in the terminal: `ag help workflow|policy|leases|ide
 - [`ag proposal`](#ag-proposal)
 - [`ag proposal list`](#ag-proposal-list)
 - [`ag proposal show`](#ag-proposal-show)
+- [`ag proposal reviewers`](#ag-proposal-reviewers)
 - [`ag proposal review`](#ag-proposal-review)
 - [`ag proposal update`](#ag-proposal-update)
 - [`ag proposal close`](#ag-proposal-close)
@@ -126,6 +127,7 @@ Concept pages are available in the terminal: `ag help workflow|policy|leases|ide
 - [`ag remote proposal`](#ag-remote-proposal)
 - [`ag remote prepare`](#ag-remote-prepare)
 - [`ag remote explain`](#ag-remote-explain)
+- [`ag remote reviewers`](#ag-remote-reviewers)
 - [`ag remote review`](#ag-remote-review)
 - [`ag remote discussion`](#ag-remote-discussion)
 - [`ag remote discussion list`](#ag-remote-discussion-list)
@@ -704,11 +706,12 @@ List, review, update or close proposals
 Usage: ag proposal [OPTIONS] <COMMAND>
 
 Commands:
-  list    List proposals, newest first
-  show    Show a proposal with its reviews
-  review  Review the proposal's current head
-  update  Point the proposal at a new head (earlier approvals stop counting)
-  close   Close without integrating
+  list       List proposals, newest first
+  show       Show a proposal with its reviews
+  reviewers  Inspect, add or remove requested reviewers (no approval or access change)
+  review     Review the proposal's current head
+  update     Point the proposal at a new head (earlier approvals stop counting)
+  close      Close without integrating
 
 Options:
   -C, --repo <DIR>     Operate on the repository at this path (default: discovered from the current directory)
@@ -729,16 +732,17 @@ List proposals, newest first
 Usage: ag proposal list [OPTIONS]
 
 Options:
-  -C, --repo <DIR>     Operate on the repository at this path (default: discovered from the current directory)
-      --state <STATE>  Filter by state: open, integrated, closed
-      --as <IDENTITY>  Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
-  -n, --limit <LIMIT>  Show at most this many (0 = all) [default: 200]
-      --json           Machine-readable JSON output
-      --color <WHEN>   Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
-  -q, --quiet          Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
-  -v, --verbose        Explain what is happening on standard error: repository, identity, remote, timing
-  -h, --help           Print help
-  -V, --version        Print version
+  -C, --repo <DIR>                     Operate on the repository at this path (default: discovered from the current directory)
+      --state <STATE>                  Filter by state: open, integrated, closed
+      --as <IDENTITY>                  Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --requested-reviewer <IDENTITY>  Only proposals that request this reviewer, matched before the limit
+      --json                           Machine-readable JSON output
+  -n, --limit <LIMIT>                  Show at most this many (0 = all) [default: 200]
+      --color <WHEN>                   Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet                          Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose                        Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help                           Print help
+  -V, --version                        Print version
 ```
 
 ## ag proposal show
@@ -762,6 +766,31 @@ Options:
   -V, --version        Print version
 ```
 
+## ag proposal reviewers
+
+```text
+Inspect, add or remove requested reviewers (no approval or access change)
+
+Usage: ag proposal reviewers [OPTIONS] <ID>
+
+Arguments:
+  <ID>  Proposal id or unique prefix
+
+Options:
+      --add <IDENTITY>       Add a requested reviewer; repeat for several identities
+  -C, --repo <DIR>           Operate on the repository at this path (default: discovered from the current directory)
+      --as <IDENTITY>        Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --remove <IDENTITY>    Remove a requested reviewer; repeat for several identities
+      --expected <IDENTITY>  Require this complete inspected set; repeat for each identity
+      --json                 Machine-readable JSON output
+      --color <WHEN>         Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+      --expect-empty         Require that no reviewers have been requested yet
+  -q, --quiet                Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose              Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help                 Print help
+  -V, --version              Print version
+```
+
 ## ag proposal review
 
 ```text
@@ -2477,6 +2506,7 @@ Commands:
   proposal    Show a proposal with its reviews
   prepare     What would integrating do now, and what is missing?
   explain     Explain why a server proposal cannot land, with the next commands. Changes nothing
+  reviewers   Inspect, add or remove requested reviewers (no approval or access change)
   review      Review a proposal's current head
   discussion  Read and participate in revision-bound line discussions
   integrate   Integrate a proposal into its stream
@@ -2594,16 +2624,17 @@ List proposals on the server
 Usage: ag remote proposals [OPTIONS]
 
 Options:
-  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
-      --remote <REMOTE>  Remote to use (default: origin)
-      --state <STATE>    Filter: open, integrated, closed
-      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
-      --json             Machine-readable JSON output
-      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
-  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
-  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
-  -h, --help             Print help
-  -V, --version          Print version
+  -C, --repo <DIR>                     Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>                Remote to use (default: origin)
+      --state <STATE>                  Filter: open, integrated, closed
+      --as <IDENTITY>                  Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --requested-reviewer <IDENTITY>  Only proposals that request this reviewer, matched before paging
+      --json                           Machine-readable JSON output
+      --color <WHEN>                   Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet                          Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose                        Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help                           Print help
+  -V, --version                        Print version
 ```
 
 ## ag remote proposal
@@ -2673,6 +2704,32 @@ Options:
   -V, --version          Print version
 ```
 
+## ag remote reviewers
+
+```text
+Inspect, add or remove requested reviewers (no approval or access change)
+
+Usage: ag remote reviewers [OPTIONS] <ID>
+
+Arguments:
+  <ID>  Proposal id or unique prefix
+
+Options:
+      --add <IDENTITY>       Add a requested reviewer; repeat for several identities
+  -C, --repo <DIR>           Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>      Remote to use (default: origin)
+      --as <IDENTITY>        Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --remove <IDENTITY>    Remove a requested reviewer; repeat for several identities
+      --expected <IDENTITY>  Require this complete inspected set; repeat for each identity
+      --json                 Machine-readable JSON output
+      --color <WHEN>         Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+      --expect-empty         Require that no reviewers have been requested yet
+  -q, --quiet                Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose              Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help                 Print help
+  -V, --version              Print version
+```
+
 ## ag remote review
 
 ```text
diff --git a/docs/reference/completions/_ag b/docs/reference/completions/_ag
index a3229871..4ef84b48 100644
--- a/docs/reference/completions/_ag
+++ b/docs/reference/completions/_ag
@@ -504,6 +504,7 @@ never\:"Never colour"))' \
             (list)
 _arguments "${_arguments_options[@]}" : \
 '--state=[Filter by state\: open, integrated, closed]:STATE:_default' \
+'--requested-reviewer=[Only proposals that request this reviewer, matched before the limit]:IDENTITY:_default' \
 '-n+[Show at most this many (0 = all)]:LIMIT:_default' \
 '--limit=[Show at most this many (0 = all)]:LIMIT:_default' \
 '-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
@@ -543,6 +544,30 @@ never\:"Never colour"))' \
 ':id -- Proposal id:_default' \
 && ret=0
 ;;
+(reviewers)
+_arguments "${_arguments_options[@]}" : \
+'*--add=[Add a requested reviewer; repeat for several identities]:IDENTITY:_default' \
+'*--remove=[Remove a requested reviewer; repeat for several identities]:IDENTITY:_default' \
+'(--expect-empty)*--expected=[Require this complete inspected set; repeat for each identity]:IDENTITY:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'(--expected)--expect-empty[Require that no reviewers have been requested yet]' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':id -- Proposal id or unique prefix:_default' \
+&& ret=0
+;;
 (review)
 _arguments "${_arguments_options[@]}" : \
 '-m+[Review text]:MESSAGE:_default' \
@@ -2358,6 +2383,7 @@ never\:"Never colour"))' \
 (proposals)
 _arguments "${_arguments_options[@]}" : \
 '--state=[Filter\: open, integrated, closed]:STATE:_default' \
+'--requested-reviewer=[Only proposals that request this reviewer, matched before paging]:IDENTITY:_default' \
 '--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
 '-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
 '--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
@@ -2440,6 +2466,31 @@ never\:"Never colour"))' \
 ':id -- Proposal id (any unique prefix):_default' \
 && ret=0
 ;;
+(reviewers)
+_arguments "${_arguments_options[@]}" : \
+'*--add=[Add a requested reviewer; repeat for several identities]:IDENTITY:_default' \
+'*--remove=[Remove a requested reviewer; repeat for several identities]:IDENTITY:_default' \
+'(--expect-empty)*--expected=[Require this complete inspected set; repeat for each identity]:IDENTITY:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'(--expected)--expect-empty[Require that no reviewers have been requested yet]' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':id -- Proposal id or unique prefix:_default' \
+&& ret=0
+;;
 (review)
 _arguments "${_arguments_options[@]}" : \
 '-m+[Review text]:MESSAGE:_default' \
@@ -3635,6 +3686,7 @@ _ag__subcmd__proposal_commands() {
     local commands; commands=(
 'list:List proposals, newest first' \
 'show:Show a proposal with its reviews' \
+'reviewers:Inspect, add or remove requested reviewers (no approval or access change)' \
 'review:Review the proposal'\''s current head' \
 'update:Point the proposal at a new head (earlier approvals stop counting)' \
 'close:Close without integrating' \
@@ -3656,6 +3708,11 @@ _ag__subcmd__proposal__subcmd__review_commands() {
     local commands; commands=()
     _describe -t commands 'ag proposal review commands' commands "$@"
 }
+(( $+functions[_ag__subcmd__proposal__subcmd__reviewers_commands] )) ||
+_ag__subcmd__proposal__subcmd__reviewers_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag proposal reviewers commands' commands "$@"
+}
 (( $+functions[_ag__subcmd__proposal__subcmd__show_commands] )) ||
 _ag__subcmd__proposal__subcmd__show_commands() {
     local commands; commands=()
@@ -3744,6 +3801,7 @@ _ag__subcmd__remote_commands() {
 'proposal:Show a proposal with its reviews' \
 'prepare:What would integrating do now, and what is missing?' \
 'explain:Explain why a server proposal cannot land, with the next commands. Changes nothing' \
+'reviewers:Inspect, add or remove requested reviewers (no approval or access change)' \
 'review:Review a proposal'\''s current head' \
 'discussion:Read and participate in revision-bound line discussions' \
 'integrate:Integrate a proposal into its stream' \
@@ -3868,6 +3926,11 @@ _ag__subcmd__remote__subcmd__review_commands() {
     local commands; commands=()
     _describe -t commands 'ag remote review commands' commands "$@"
 }
+(( $+functions[_ag__subcmd__remote__subcmd__reviewers_commands] )) ||
+_ag__subcmd__remote__subcmd__reviewers_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote reviewers commands' commands "$@"
+}
 (( $+functions[_ag__subcmd__remote__subcmd__streams_commands] )) ||
 _ag__subcmd__remote__subcmd__streams_commands() {
     local commands; commands=()
diff --git a/docs/reference/completions/_ag.ps1 b/docs/reference/completions/_ag.ps1
index fa88d2bc..5ba82276 100644
--- a/docs/reference/completions/_ag.ps1
+++ b/docs/reference/completions/_ag.ps1
@@ -460,6 +460,7 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
             [CompletionResult]::new('list', 'list', [CompletionResultType]::ParameterValue, 'List proposals, newest first')
             [CompletionResult]::new('show', 'show', [CompletionResultType]::ParameterValue, 'Show a proposal with its reviews')
+            [CompletionResult]::new('reviewers', 'reviewers', [CompletionResultType]::ParameterValue, 'Inspect, add or remove requested reviewers (no approval or access change)')
             [CompletionResult]::new('review', 'review', [CompletionResultType]::ParameterValue, 'Review the proposal''s current head')
             [CompletionResult]::new('update', 'update', [CompletionResultType]::ParameterValue, 'Point the proposal at a new head (earlier approvals stop counting)')
             [CompletionResult]::new('close', 'close', [CompletionResultType]::ParameterValue, 'Close without integrating')
@@ -467,6 +468,7 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
         }
         'ag;proposal;list' {
             [CompletionResult]::new('--state', '--state', [CompletionResultType]::ParameterName, 'Filter by state: open, integrated, closed')
+            [CompletionResult]::new('--requested-reviewer', '--requested-reviewer', [CompletionResultType]::ParameterName, 'Only proposals that request this reviewer, matched before the limit')
             [CompletionResult]::new('-n', '-n', [CompletionResultType]::ParameterName, 'Show at most this many (0 = all)')
             [CompletionResult]::new('--limit', '--limit', [CompletionResultType]::ParameterName, 'Show at most this many (0 = all)')
             [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
@@ -500,6 +502,26 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
             break
         }
+        'ag;proposal;reviewers' {
+            [CompletionResult]::new('--add', '--add', [CompletionResultType]::ParameterName, 'Add a requested reviewer; repeat for several identities')
+            [CompletionResult]::new('--remove', '--remove', [CompletionResultType]::ParameterName, 'Remove a requested reviewer; repeat for several identities')
+            [CompletionResult]::new('--expected', '--expected', [CompletionResultType]::ParameterName, 'Require this complete inspected set; repeat for each identity')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--expect-empty', '--expect-empty', [CompletionResultType]::ParameterName, 'Require that no reviewers have been requested yet')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
         'ag;proposal;review' {
             [CompletionResult]::new('-m', '-m', [CompletionResultType]::ParameterName, 'Review text')
             [CompletionResult]::new('--message', '--message', [CompletionResultType]::ParameterName, 'Review text')
@@ -1857,6 +1879,7 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('proposal', 'proposal', [CompletionResultType]::ParameterValue, 'Show a proposal with its reviews')
             [CompletionResult]::new('prepare', 'prepare', [CompletionResultType]::ParameterValue, 'What would integrating do now, and what is missing?')
             [CompletionResult]::new('explain', 'explain', [CompletionResultType]::ParameterValue, 'Explain why a server proposal cannot land, with the next commands. Changes nothing')
+            [CompletionResult]::new('reviewers', 'reviewers', [CompletionResultType]::ParameterValue, 'Inspect, add or remove requested reviewers (no approval or access change)')
             [CompletionResult]::new('review', 'review', [CompletionResultType]::ParameterValue, 'Review a proposal''s current head')
             [CompletionResult]::new('discussion', 'discussion', [CompletionResultType]::ParameterValue, 'Read and participate in revision-bound line discussions')
             [CompletionResult]::new('integrate', 'integrate', [CompletionResultType]::ParameterValue, 'Integrate a proposal into its stream')
@@ -1942,6 +1965,7 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
         }
         'ag;remote;proposals' {
             [CompletionResult]::new('--state', '--state', [CompletionResultType]::ParameterName, 'Filter: open, integrated, closed')
+            [CompletionResult]::new('--requested-reviewer', '--requested-reviewer', [CompletionResultType]::ParameterName, 'Only proposals that request this reviewer, matched before paging')
             [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
             [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
             [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
@@ -2010,6 +2034,27 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
             break
         }
+        'ag;remote;reviewers' {
+            [CompletionResult]::new('--add', '--add', [CompletionResultType]::ParameterName, 'Add a requested reviewer; repeat for several identities')
+            [CompletionResult]::new('--remove', '--remove', [CompletionResultType]::ParameterName, 'Remove a requested reviewer; repeat for several identities')
+            [CompletionResult]::new('--expected', '--expected', [CompletionResultType]::ParameterName, 'Require this complete inspected set; repeat for each identity')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--expect-empty', '--expect-empty', [CompletionResultType]::ParameterName, 'Require that no reviewers have been requested yet')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
         'ag;remote;review' {
             [CompletionResult]::new('-m', '-m', [CompletionResultType]::ParameterName, 'Review text')
             [CompletionResult]::new('--message', '--message', [CompletionResultType]::ParameterName, 'Review text')
diff --git a/docs/reference/completions/ag.bash b/docs/reference/completions/ag.bash
index f741d792..0114e11e 100644
--- a/docs/reference/completions/ag.bash
+++ b/docs/reference/completions/ag.bash
@@ -286,6 +286,9 @@ _ag() {
             ag__subcmd__proposal,review)
                 cmd="ag__subcmd__proposal__subcmd__review"
                 ;;
+            ag__subcmd__proposal,reviewers)
+                cmd="ag__subcmd__proposal__subcmd__reviewers"
+                ;;
             ag__subcmd__proposal,show)
                 cmd="ag__subcmd__proposal__subcmd__show"
                 ;;
@@ -355,6 +358,9 @@ _ag() {
             ag__subcmd__remote,review)
                 cmd="ag__subcmd__remote__subcmd__review"
                 ;;
+            ag__subcmd__remote,reviewers)
+                cmd="ag__subcmd__remote__subcmd__reviewers"
+                ;;
             ag__subcmd__remote,streams)
                 cmd="ag__subcmd__remote__subcmd__streams"
                 ;;
@@ -2747,7 +2753,7 @@ _ag() {
             return 0
             ;;
         ag__subcmd__proposal)
-            opts="-C -q -v -h -V --repo --as --json --color --quiet --verbose --help --version list show review update close"
+            opts="-C -q -v -h -V --repo --as --json --color --quiet --verbose --help --version list show reviewers review update close"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -2807,7 +2813,7 @@ _ag() {
             return 0
             ;;
         ag__subcmd__proposal__subcmd__list)
-            opts="-n -C -q -v -h -V --state --limit --repo --as --json --color --quiet --verbose --help --version"
+            opts="-n -C -q -v -h -V --state --requested-reviewer --limit --repo --as --json --color --quiet --verbose --help --version"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -2817,6 +2823,10 @@ _ag() {
                     COMPREPLY=($(compgen -f "${cur}"))
                     return 0
                     ;;
+                --requested-reviewer)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 --limit)
                     COMPREPLY=($(compgen -f "${cur}"))
                     return 0
@@ -2886,6 +2896,48 @@ _ag() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        ag__subcmd__proposal__subcmd__reviewers)
+            opts="-C -q -v -h -V --add --remove --expected --expect-empty --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --add)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remove)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --expected)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         ag__subcmd__proposal__subcmd__show)
             opts="-C -q -v -h -V --repo --as --json --color --quiet --verbose --help --version"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
@@ -3415,7 +3467,7 @@ _ag() {
             return 0
             ;;
         ag__subcmd__remote)
-            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat"
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -4169,7 +4221,7 @@ _ag() {
             return 0
             ;;
         ag__subcmd__remote__subcmd__proposals)
-            opts="-C -q -v -h -V --state --remote --repo --as --json --color --quiet --verbose --help --version"
+            opts="-C -q -v -h -V --state --requested-reviewer --remote --repo --as --json --color --quiet --verbose --help --version"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -4179,6 +4231,10 @@ _ag() {
                     COMPREPLY=($(compgen -f "${cur}"))
                     return 0
                     ;;
+                --requested-reviewer)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 --remote)
                     COMPREPLY=($(compgen -f "${cur}"))
                     return 0
@@ -4282,6 +4338,52 @@ _ag() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        ag__subcmd__remote__subcmd__reviewers)
+            opts="-C -q -v -h -V --add --remove --expected --expect-empty --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --add)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remove)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --expected)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         ag__subcmd__remote__subcmd__streams)
             opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
diff --git a/docs/reference/completions/ag.elv b/docs/reference/completions/ag.elv
index a200a73d..9bd71fa4 100644
--- a/docs/reference/completions/ag.elv
+++ b/docs/reference/completions/ag.elv
@@ -437,12 +437,14 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand --version 'Print version'
             cand list 'List proposals, newest first'
             cand show 'Show a proposal with its reviews'
+            cand reviewers 'Inspect, add or remove requested reviewers (no approval or access change)'
             cand review 'Review the proposal''s current head'
             cand update 'Point the proposal at a new head (earlier approvals stop counting)'
             cand close 'Close without integrating'
         }
         &'ag;proposal;list'= {
             cand --state 'Filter by state: open, integrated, closed'
+            cand --requested-reviewer 'Only proposals that request this reviewer, matched before the limit'
             cand -n 'Show at most this many (0 = all)'
             cand --limit 'Show at most this many (0 = all)'
             cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
@@ -474,6 +476,25 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand -V 'Print version'
             cand --version 'Print version'
         }
+        &'ag;proposal;reviewers'= {
+            cand --add 'Add a requested reviewer; repeat for several identities'
+            cand --remove 'Remove a requested reviewer; repeat for several identities'
+            cand --expected 'Require this complete inspected set; repeat for each identity'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --expect-empty 'Require that no reviewers have been requested yet'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
         &'ag;proposal;review'= {
             cand -m 'Review text'
             cand --message 'Review text'
@@ -1757,6 +1778,7 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand proposal 'Show a proposal with its reviews'
             cand prepare 'What would integrating do now, and what is missing?'
             cand explain 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
+            cand reviewers 'Inspect, add or remove requested reviewers (no approval or access change)'
             cand review 'Review a proposal''s current head'
             cand discussion 'Read and participate in revision-bound line discussions'
             cand integrate 'Integrate a proposal into its stream'
@@ -1837,6 +1859,7 @@ set edit:completion:arg-completer[ag] = {|@words|
         }
         &'ag;remote;proposals'= {
             cand --state 'Filter: open, integrated, closed'
+            cand --requested-reviewer 'Only proposals that request this reviewer, matched before paging'
             cand --remote 'Remote to use (default: origin)'
             cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
             cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
@@ -1901,6 +1924,26 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand -V 'Print version'
             cand --version 'Print version'
         }
+        &'ag;remote;reviewers'= {
+            cand --add 'Add a requested reviewer; repeat for several identities'
+            cand --remove 'Remove a requested reviewer; repeat for several identities'
+            cand --expected 'Require this complete inspected set; repeat for each identity'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --expect-empty 'Require that no reviewers have been requested yet'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
         &'ag;remote;review'= {
             cand -m 'Review text'
             cand --message 'Review text'
diff --git a/docs/reference/completions/ag.fish b/docs/reference/completions/ag.fish
index 51b0452d..4032d7e3 100644
--- a/docs/reference/completions/ag.fish
+++ b/docs/reference/completions/ag.fish
@@ -317,22 +317,24 @@ complete -c ag -n "__fish_ag_using_subcommand propose" -s q -l quiet -d 'Print o
 complete -c ag -n "__fish_ag_using_subcommand propose" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand propose" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand propose" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
-always\t'Always colour'
-never\t'Never colour'"
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -l json -d 'Machine-readable JSON output'
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -s h -l help -d 'Print help'
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -f -a "list" -d 'List proposals, newest first'
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -f -a "show" -d 'Show a proposal with its reviews'
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -f -a "review" -d 'Review the proposal\'s current head'
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -f -a "update" -d 'Point the proposal at a new head (earlier approvals stop counting)'
-complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show review update close" -f -a "close" -d 'Close without integrating'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -f -a "list" -d 'List proposals, newest first'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -f -a "show" -d 'Show a proposal with its reviews'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -f -a "review" -d 'Review the proposal\'s current head'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -f -a "update" -d 'Point the proposal at a new head (earlier approvals stop counting)'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and not __fish_seen_subcommand_from list show reviewers review update close" -f -a "close" -d 'Close without integrating'
 complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from list" -l state -d 'Filter by state: open, integrated, closed' -r
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from list" -l requested-reviewer -d 'Only proposals that request this reviewer, matched before the limit' -r
 complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from list" -s n -l limit -d 'Show at most this many (0 = all)' -r
 complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from list" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
 complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from list" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
@@ -354,6 +356,20 @@ complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcomma
 complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from show" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from show" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from show" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -l add -d 'Add a requested reviewer; repeat for several identities' -r
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -l remove -d 'Remove a requested reviewer; repeat for several identities' -r
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -l expected -d 'Require this complete inspected set; repeat for each identity' -r
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -l expect-empty -d 'Require that no reviewers have been requested yet'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from reviewers" -s V -l version -d 'Print version'
 complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from review" -s m -l message -d 'Review text' -r
 complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from review" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
 complete -c ag -n "__fish_ag_using_subcommand proposal; and __fish_seen_subcommand_from review" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
@@ -1196,35 +1212,36 @@ complete -c ag -n "__fish_ag_using_subcommand push" -s q -l quiet -d 'Print only
 complete -c ag -n "__fish_ag_using_subcommand push" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand push" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand push" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
-always\t'Always colour'
-never\t'Never colour'"
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain review discussion integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l token-env -d 'Environment variable holding the credential' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l ca-file -d 'Extra CA certificate (PEM) to trust' -r -F
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l remote -d 'Remote to use (default: origin)' -r
@@ -1273,6 +1290,7 @@ complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from whoami" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from whoami" -s V -l version -d 'Print version'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from proposals" -l state -d 'Filter: open, integrated, closed' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from proposals" -l requested-reviewer -d 'Only proposals that request this reviewer, matched before paging' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from proposals" -l remote -d 'Remote to use (default: origin)' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from proposals" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from proposals" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
@@ -1318,6 +1336,21 @@ complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from explain" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from explain" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from explain" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -l add -d 'Add a requested reviewer; repeat for several identities' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -l remove -d 'Remove a requested reviewer; repeat for several identities' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -l expected -d 'Require this complete inspected set; repeat for each identity' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -l expect-empty -d 'Require that no reviewers have been requested yet'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -s V -l version -d 'Print version'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review" -s m -l message -d 'Review text' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review" -l remote -d 'Remote to use (default: origin)' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
diff --git a/docs/reference/help-topics.md b/docs/reference/help-topics.md
index 781c43c2..b899b3f9 100644
--- a/docs/reference/help-topics.md
+++ b/docs/reference/help-topics.md
@@ -62,6 +62,27 @@ Where am I? `ag status` shows the workspace, your proposals, your leases, your t
 Is everything healthy? `ag doctor`. What exactly happened? `ag trace`, `ag op show OPERATION`.
 
 More: docs/getting-started.md and docs/tutorials/first-agent-safe-repo.md
+
+Requesting a review
+
+    ag proposal reviewers PROPOSAL                         inspect the requested people
+    ag proposal reviewers PROPOSAL --add user:bob           request Bob's review
+    ag proposal reviewers PROPOSAL --remove user:bob        withdraw that request
+    ag proposal list --requested-reviewer user:bob          find Bob's requested work
+
+The same commands work against a configured server as `ag remote reviewers PROPOSAL ...`
+and `ag remote proposals --requested-reviewer user:bob`.
+Only the author of an open proposal can change its requested reviewers. A request is routing:
+it grants no repository access, records no approval, and adds no integration requirement.
+A new proposal revision keeps the requested people, but previous approvals remain tied to their old head.
+
+Edits compare the list that the command just read. If another writer changes it before the save, the command
+fails instead of overwriting that change. Scripts can require their own inspected list with repeatable
+`--expected IDENTITY`, or `--expect-empty` for an empty list. For example:
+
+    ag proposal reviewers PROPOSAL --add user:carol --expected user:bob
+
+An omitted edit flag only reads the list. Repeating an already-applied add or remove is safe.
 ```
 
 ## policy
diff --git a/docs/reference/man/ag-proposal-list.1 b/docs/reference/man/ag-proposal-list.1
index 9ee9f9fe..f9f6c0a2 100644
--- a/docs/reference/man/ag-proposal-list.1
+++ b/docs/reference/man/ag-proposal-list.1
@@ -4,7 +4,7 @@
 .SH NAME
 ag\-proposal\-list \- List proposals, newest first
 .SH SYNOPSIS
-\fBag proposal list\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-state\fR] [\fB\-\-as\fR] [\fB\-n\fR|\fB\-\-limit\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR]
+\fBag proposal list\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-state\fR] [\fB\-\-as\fR] [\fB\-\-requested\-reviewer\fR] [\fB\-\-json\fR] [\fB\-n\fR|\fB\-\-limit\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR]
 .SH DESCRIPTION
 List proposals, newest first
 .SH OPTIONS
@@ -18,12 +18,15 @@ Filter by state: open, integrated, closed
 \fB\-\-as\fR \fI<IDENTITY>\fR
 Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
 .TP
-\fB\-n\fR, \fB\-\-limit\fR \fI<LIMIT>\fR [default: 200]
-Show at most this many (0 = all)
+\fB\-\-requested\-reviewer\fR \fI<IDENTITY>\fR
+Only proposals that request this reviewer, matched before the limit
 .TP
 \fB\-\-json\fR
 Machine\-readable JSON output
 .TP
+\fB\-n\fR, \fB\-\-limit\fR \fI<LIMIT>\fR [default: 200]
+Show at most this many (0 = all)
+.TP
 \fB\-\-color\fR \fI<WHEN>\fR
 Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
 .TP
diff --git a/docs/reference/man/ag-proposal-reviewers.1 b/docs/reference/man/ag-proposal-reviewers.1
new file mode 100644
index 00000000..cc29e190
--- /dev/null
+++ b/docs/reference/man/ag-proposal-reviewers.1
@@ -0,0 +1,51 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-proposal-reviewers 1  "reviewers 0.3.0-beta.7"
+.SH NAME
+ag\-proposal\-reviewers \- Inspect, add or remove requested reviewers (no approval or access change)
+.SH SYNOPSIS
+\fBag proposal reviewers\fR [\fB\-\-add\fR] [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-as\fR] [\fB\-\-remove\fR] [\fB\-\-expected\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-\-expect\-empty\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fIID\fR>
+.SH DESCRIPTION
+Inspect, add or remove requested reviewers (no approval or access change)
+.SH OPTIONS
+.TP
+\fB\-\-add\fR \fI<IDENTITY>\fR
+Add a requested reviewer; repeat for several identities
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-remove\fR \fI<IDENTITY>\fR
+Remove a requested reviewer; repeat for several identities
+.TP
+\fB\-\-expected\fR \fI<IDENTITY>\fR
+Require this complete inspected set; repeat for each identity
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-\-expect\-empty\fR
+Require that no reviewers have been requested yet
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fIID\fR>
+Proposal id or unique prefix
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-proposal.1 b/docs/reference/man/ag-proposal.1
index fc8f5399..5ce40fbe 100644
--- a/docs/reference/man/ag-proposal.1
+++ b/docs/reference/man/ag-proposal.1
@@ -40,6 +40,9 @@ List proposals, newest first
 ag\-proposal\-show(1)
 Show a proposal with its reviews
 .TP
+ag\-proposal\-reviewers(1)
+Inspect, add or remove requested reviewers (no approval or access change)
+.TP
 ag\-proposal\-review(1)
 Review the proposal\*(Aqs current head
 .TP
diff --git a/docs/reference/man/ag-remote-proposals.1 b/docs/reference/man/ag-remote-proposals.1
index ff5fe0be..59cee64d 100644
--- a/docs/reference/man/ag-remote-proposals.1
+++ b/docs/reference/man/ag-remote-proposals.1
@@ -4,7 +4,7 @@
 .SH NAME
 ag\-remote\-proposals \- List proposals on the server
 .SH SYNOPSIS
-\fBag remote proposals\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-state\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR]
+\fBag remote proposals\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-state\fR] [\fB\-\-as\fR] [\fB\-\-requested\-reviewer\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR]
 .SH DESCRIPTION
 List proposals on the server
 .SH OPTIONS
@@ -21,6 +21,9 @@ Filter: open, integrated, closed
 \fB\-\-as\fR \fI<IDENTITY>\fR
 Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
 .TP
+\fB\-\-requested\-reviewer\fR \fI<IDENTITY>\fR
+Only proposals that request this reviewer, matched before paging
+.TP
 \fB\-\-json\fR
 Machine\-readable JSON output
 .TP
diff --git a/docs/reference/man/ag-remote-reviewers.1 b/docs/reference/man/ag-remote-reviewers.1
new file mode 100644
index 00000000..fbd70a83
--- /dev/null
+++ b/docs/reference/man/ag-remote-reviewers.1
@@ -0,0 +1,54 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-reviewers 1  "reviewers 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-reviewers \- Inspect, add or remove requested reviewers (no approval or access change)
+.SH SYNOPSIS
+\fBag remote reviewers\fR [\fB\-\-add\fR] [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-remove\fR] [\fB\-\-expected\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-\-expect\-empty\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fIID\fR>
+.SH DESCRIPTION
+Inspect, add or remove requested reviewers (no approval or access change)
+.SH OPTIONS
+.TP
+\fB\-\-add\fR \fI<IDENTITY>\fR
+Add a requested reviewer; repeat for several identities
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-remove\fR \fI<IDENTITY>\fR
+Remove a requested reviewer; repeat for several identities
+.TP
+\fB\-\-expected\fR \fI<IDENTITY>\fR
+Require this complete inspected set; repeat for each identity
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-\-expect\-empty\fR
+Require that no reviewers have been requested yet
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fIID\fR>
+Proposal id or unique prefix
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote.1 b/docs/reference/man/ag-remote.1
index 9de894f3..130143e2 100644
--- a/docs/reference/man/ag-remote.1
+++ b/docs/reference/man/ag-remote.1
@@ -61,6 +61,9 @@ What would integrating do now, and what is missing?
 ag\-remote\-explain(1)
 Explain why a server proposal cannot land, with the next commands. Changes nothing
 .TP
+ag\-remote\-reviewers(1)
+Inspect, add or remove requested reviewers (no approval or access change)
+.TP
 ag\-remote\-review(1)
 Review a proposal\*(Aqs current head
 .TP
diff --git a/migrations/postgres/0009_proposal_reviewers.sql b/migrations/postgres/0009_proposal_reviewers.sql
new file mode 100644
index 00000000..f9a65a51
--- /dev/null
+++ b/migrations/postgres/0009_proposal_reviewers.sql
@@ -0,0 +1,6 @@
+CREATE TABLE proposal_reviewers (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    reviewer TEXT NOT NULL,
+    PRIMARY KEY (proposal, reviewer)
+);
+CREATE INDEX proposal_reviewers_identity ON proposal_reviewers(reviewer, proposal);
diff --git a/migrations/sqlite/0009_proposal_reviewers.sql b/migrations/sqlite/0009_proposal_reviewers.sql
new file mode 100644
index 00000000..f9a65a51
--- /dev/null
+++ b/migrations/sqlite/0009_proposal_reviewers.sql
@@ -0,0 +1,6 @@
+CREATE TABLE proposal_reviewers (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    reviewer TEXT NOT NULL,
+    PRIMARY KEY (proposal, reviewer)
+);
+CREATE INDEX proposal_reviewers_identity ON proposal_reviewers(reviewer, proposal);
diff --git a/proto/agwp/v1/agwp.proto b/proto/agwp/v1/agwp.proto
index c44b18a7..a77069b4 100644
--- a/proto/agwp/v1/agwp.proto
+++ b/proto/agwp/v1/agwp.proto
@@ -728,6 +728,8 @@ message GetProposalRequest {
 message ProposalDetail {
   Proposal proposal = 1;
   repeated Review reviews = 2;
+  // Routing only; requests do not grant access or count as approval.
+  repeated string requested_reviewers = 3;
 }
 
 message ListProposalsRequest {
@@ -739,6 +741,8 @@ message ListProposalsRequest {
   string page_token = 6;
   // Match the linked task before paging. Empty matches all tasks.
   string task_id = 7;
+  // Match a requested reviewer before keyset paging.
+  string requested_reviewer = 8;
 }
 
 message ListProposalsResponse {
@@ -756,6 +760,17 @@ message UpdateProposalRequest {
   string expected_head = 5;
 }
 
+// Replaces review routing after comparing the complete inspected set.
+message SetRequestedReviewersRequest {
+  string repo = 1;
+  string id = 2;
+  repeated string reviewers = 3;
+  repeated string expected_reviewers = 4;
+}
+message RequestedReviewers {
+  repeated string reviewers = 1;
+}
+
 message ReviewProposalRequest {
   string repo = 1;
   string id = 2;
@@ -1800,6 +1815,7 @@ service ProposalService {
   rpc Get(GetProposalRequest) returns (ProposalDetail);
   rpc List(ListProposalsRequest) returns (ListProposalsResponse);
   rpc Update(UpdateProposalRequest) returns (Proposal);
+  rpc SetReviewers(SetRequestedReviewersRequest) returns (RequestedReviewers);
   rpc Review(ReviewProposalRequest) returns (Review);
   rpc Comment(CommentProposalRequest) returns (Review);
   rpc ListThreads(ListReviewThreadsRequest) returns (ListReviewThreadsResponse);
diff --git a/sdk/api-policy.json b/sdk/api-policy.json
index 9954d53e..4a8817eb 100644
--- a/sdk/api-policy.json
+++ b/sdk/api-policy.json
@@ -52,7 +52,8 @@
       "task.finish",
       "workspace.delete",
       "workspace.sync",
-      "migration.commit"
+      "migration.commit",
+      "proposal.set_reviewers"
     ],
     "naturalWhenFieldPresent": {
       "workspace.modify": "expected_head"
diff --git a/sdk/python/README.md b/sdk/python/README.md
index bfe7b413..92b80c9b 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -101,7 +101,7 @@ print(status)  # integrated
 | `session` | `negotiate`, `auth_config`, `whoami` (and `client.negotiate()`, which also checks the protocol version) |
 | `repos` | `create`, `describe`, `list`, `configure` |
 | `workspaces` | `create`, `get`, `list`, `modify`, `sync`, `delete` |
-| `proposals` | `create`, `get`, `list`, `update`, `review`, `close` |
+| `proposals` | `create`, `get`, `list`, `update`, `set_reviewers`, `review`, `close` |
 | `integration` | `prepare`, `validate`, `integrate`, `attest`, `attestations` |
 | `queue` | `enqueue`, `list`, `run` |
 | `streams` | `list`, `create`, `head`, `cas`, `reflog` |
@@ -208,6 +208,41 @@ print(landed.outcome.status)  # integrated
 An `integrate` that cannot proceed is **not an error**: it answers `200` with `outcome.status` `blocked`, `conflict`,
 `denied` or `invalid` and a list of blockers with stable `code`s. Errors are for requests that failed.
 
+## Requesting reviewers
+
+On servers advertising `proposals.review_requests`, the proposal author can replace up to 20 requested reviewers. The helper reads the current list and sends it as the precondition. A conflict requires reviewing the newer list; do not blindly overwrite it. Passing an empty list clears the requests.
+
+Requests route attention: they do not grant access, count as an approval, or change integration policy. The list remains after a new proposal revision; decisions still belong to the exact head reviewed. Before using `requested_reviewer` on a listing or pagination, negotiate and require `proposals.review_requests`: an older server may ignore an unknown query field and return a broader list. The filtering helper below performs that check.
+
+<!-- example: sdk/python/examples/review_requests.py#review-requests -->
+
+```python
+from collections.abc import Iterator
+
+from agentgit import AgentGitClient, models
+
+
+def request_review(
+    client: AgentGitClient, repo: str, id: str, reviewers: list[str]
+) -> models.RequestedReviewers:
+    """Replace the inspected routing list; let the caller resolve a concurrent edit."""
+    current = client.proposals.get(repo=repo, id=id)
+    return client.proposals.set_reviewers(
+        repo=repo,
+        id=id,
+        reviewers=reviewers,
+        expected_reviewers=current.requested_reviewers,
+    )
+
+
+def reviews_requested_from(client: AgentGitClient, repo: str, reviewer: str) -> Iterator[models.Proposal]:
+    """Check support before filtering: old servers may ignore unknown query fields."""
+    hello = client.negotiate()
+    if "proposals.review_requests" not in hello.features:
+        raise ValueError("This server does not support requested-reviewer filtering.")
+    yield from client.paginate("proposal.list", repo=repo, requested_reviewer=reviewer)
+```
+
 ## Errors, retries, idempotency and deadlines
 
 <!-- example: sdk/python/examples/errors.py#errors -->
diff --git a/sdk/python/examples/__init__.py b/sdk/python/examples/__init__.py
new file mode 100644
index 00000000..db89c8d0
--- /dev/null
+++ b/sdk/python/examples/__init__.py
@@ -0,0 +1 @@
+"""Executable and reusable examples for the Python SDK."""
diff --git a/sdk/python/examples/review_requests.py b/sdk/python/examples/review_requests.py
new file mode 100644
index 00000000..83781b1c
--- /dev/null
+++ b/sdk/python/examples/review_requests.py
@@ -0,0 +1,26 @@
+# region review-requests
+from collections.abc import Iterator
+
+from agentgit import AgentGitClient, models
+
+
+def request_review(
+    client: AgentGitClient, repo: str, id: str, reviewers: list[str]
+) -> models.RequestedReviewers:
+    """Replace the inspected routing list; let the caller resolve a concurrent edit."""
+    current = client.proposals.get(repo=repo, id=id)
+    return client.proposals.set_reviewers(
+        repo=repo,
+        id=id,
+        reviewers=reviewers,
+        expected_reviewers=current.requested_reviewers,
+    )
+
+
+def reviews_requested_from(client: AgentGitClient, repo: str, reviewer: str) -> Iterator[models.Proposal]:
+    """Check support before filtering: old servers may ignore unknown query fields."""
+    hello = client.negotiate()
+    if "proposals.review_requests" not in hello.features:
+        raise ValueError("This server does not support requested-reviewer filtering.")
+    yield from client.paginate("proposal.list", repo=repo, requested_reviewer=reviewer)
+    # endregion review-requests
diff --git a/sdk/python/src/agentgit/_generated/models.py b/sdk/python/src/agentgit/_generated/models.py
index 85f6f427..83776680 100644
--- a/sdk/python/src/agentgit/_generated/models.py
+++ b/sdk/python/src/agentgit/_generated/models.py
@@ -182,6 +182,7 @@
     "ReportExecutorRequest",
     "RequestValidationRequest",
     "RequestValidationResponse",
+    "RequestedReviewers",
     "ResolvePathRequest",
     "ResolvePathResponse",
     "ResolveRevRequest",
@@ -206,6 +207,7 @@
     "SearchTreeResponse",
     "SetAgentStateRequest",
     "SetPolicyRequest",
+    "SetRequestedReviewersRequest",
     "SetTaskAttemptLimitRequest",
     "SetTaskSchedulingRequest",
     "StartRunRequest",
@@ -1234,6 +1236,7 @@ class ListProposalsRequest:
     page_size: int = field(default=0)
     page_token: str = field(default="")
     repo: str = field(default="")
+    requested_reviewer: str = field(default="")
     state: str = field(default="")
     stream: str = field(default="")
     task_id: str = field(default="")
@@ -1630,6 +1633,7 @@ class Proposal:
 class ProposalDetail:
     """The `ProposalDetail` message."""
     proposal: Proposal = field(default_factory=lambda: Proposal())
+    requested_reviewers: list[str] = field(default_factory=list)
     reviews: list[Review] = field(default_factory=list)
 
 
@@ -1826,6 +1830,12 @@ class RequestValidationResponse:
     jobs: list[Job] = field(default_factory=list)
 
 
+@dataclass(kw_only=True)
+class RequestedReviewers:
+    """The `RequestedReviewers` message."""
+    reviewers: list[str] = field(default_factory=list)
+
+
 @dataclass(kw_only=True)
 class ResolvePathRequest:
     """The `ResolvePathRequest` message."""
@@ -2058,6 +2068,15 @@ class SetPolicyRequest:
     stream: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class SetRequestedReviewersRequest:
+    """Replaces review routing after comparing the complete inspected set."""
+    expected_reviewers: list[str] = field(default_factory=list)
+    id: str = field(default="")
+    repo: str = field(default="")
+    reviewers: list[str] = field(default_factory=list)
+
+
 @dataclass(kw_only=True)
 class SetTaskAttemptLimitRequest:
     """Execution policy is independent of immutable task instructions and run history."""
diff --git a/sdk/python/src/agentgit/_generated/namespaces.py b/sdk/python/src/agentgit/_generated/namespaces.py
index 415d5b06..d38123ad 100644
--- a/sdk/python/src/agentgit/_generated/namespaces.py
+++ b/sdk/python/src/agentgit/_generated/namespaces.py
@@ -182,6 +182,7 @@
     ReportExecutorRequest,
     RequestValidationRequest,
     RequestValidationResponse,
+    RequestedReviewers,
     ResolvePathRequest,
     ResolvePathResponse,
     ResolveRevRequest,
@@ -206,6 +207,7 @@
     SearchTreeResponse,
     SetAgentStateRequest,
     SetPolicyRequest,
+    SetRequestedReviewersRequest,
     SetTaskAttemptLimitRequest,
     SetTaskSchedulingRequest,
     StartRunRequest,
@@ -1182,13 +1184,14 @@ def list(
         author: str | None = None,
         page_size: int | None = None,
         page_token: str | None = None,
+        requested_reviewer: str | None = None,
         state: str | None = None,
         stream: str | None = None,
         task_id: str | None = None,
         options: CallOptions | None = None,
     ) -> ListProposalsResponse:
         """List proposals (`GET /v1/repos/{owner}/{rname}/proposals`, operation `proposal.list`)."""
-        return self._c._call("proposal.list", {"repo": repo, "author": author, "page_size": page_size, "page_token": page_token, "state": state, "stream": stream, "task_id": task_id}, options, ListProposalsResponse)
+        return self._c._call("proposal.list", {"repo": repo, "author": author, "page_size": page_size, "page_token": page_token, "requested_reviewer": requested_reviewer, "state": state, "stream": stream, "task_id": task_id}, options, ListProposalsResponse)
 
     def review(
         self,
@@ -1204,6 +1207,18 @@ def review(
         """Review the current head (`POST /v1/repos/{owner}/{rname}/proposals/{id}/reviews`, operation `proposal.review`)."""
         return self._c._call("proposal.review", {"repo": repo, "id": id, "body": body, "decision": decision, "expected_head": expected_head, "idempotency_key": idempotency_key}, options, Review)
 
+    def set_reviewers(
+        self,
+        *,
+        repo: str,
+        id: str,
+        expected_reviewers: Sequence[str] | None = None,
+        reviewers: Sequence[str] | None = None,
+        options: CallOptions | None = None,
+    ) -> RequestedReviewers:
+        """Replace the inspected set of requested reviewers (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/reviewers`, operation `proposal.set_reviewers`)."""
+        return self._c._call("proposal.set_reviewers", {"repo": repo, "id": id, "expected_reviewers": expected_reviewers, "reviewers": reviewers}, options, RequestedReviewers)
+
     def thread_comments(
         self,
         *,
@@ -2805,13 +2820,14 @@ async def list(
         author: str | None = None,
         page_size: int | None = None,
         page_token: str | None = None,
+        requested_reviewer: str | None = None,
         state: str | None = None,
         stream: str | None = None,
         task_id: str | None = None,
         options: CallOptions | None = None,
     ) -> ListProposalsResponse:
         """List proposals (`GET /v1/repos/{owner}/{rname}/proposals`, operation `proposal.list`)."""
-        return await self._c._call("proposal.list", {"repo": repo, "author": author, "page_size": page_size, "page_token": page_token, "state": state, "stream": stream, "task_id": task_id}, options, ListProposalsResponse)
+        return await self._c._call("proposal.list", {"repo": repo, "author": author, "page_size": page_size, "page_token": page_token, "requested_reviewer": requested_reviewer, "state": state, "stream": stream, "task_id": task_id}, options, ListProposalsResponse)
 
     async def review(
         self,
@@ -2827,6 +2843,18 @@ async def review(
         """Review the current head (`POST /v1/repos/{owner}/{rname}/proposals/{id}/reviews`, operation `proposal.review`)."""
         return await self._c._call("proposal.review", {"repo": repo, "id": id, "body": body, "decision": decision, "expected_head": expected_head, "idempotency_key": idempotency_key}, options, Review)
 
+    async def set_reviewers(
+        self,
+        *,
+        repo: str,
+        id: str,
+        expected_reviewers: Sequence[str] | None = None,
+        reviewers: Sequence[str] | None = None,
+        options: CallOptions | None = None,
+    ) -> RequestedReviewers:
+        """Replace the inspected set of requested reviewers (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/reviewers`, operation `proposal.set_reviewers`)."""
+        return await self._c._call("proposal.set_reviewers", {"repo": repo, "id": id, "expected_reviewers": expected_reviewers, "reviewers": reviewers}, options, RequestedReviewers)
+
     async def thread_comments(
         self,
         *,
diff --git a/sdk/python/src/agentgit/_generated/operations.py b/sdk/python/src/agentgit/_generated/operations.py
index 6be65edd..90a14983 100644
--- a/sdk/python/src/agentgit/_generated/operations.py
+++ b/sdk/python/src/agentgit/_generated/operations.py
@@ -1108,7 +1108,7 @@
         name="list",
         summary="List proposals",
         path_params=('owner', 'rname'),
-        query_params=('author', 'page_size', 'page_token', 'state', 'stream', 'task_id'),
+        query_params=('author', 'page_size', 'page_token', 'requested_reviewer', 'state', 'stream', 'task_id'),
         body="none",
         response="json",
         retry="read",
@@ -1130,6 +1130,21 @@
         idempotency_key=True,
         public=False,
     ),
+    "proposal.set_reviewers": OperationInfo(
+        id="proposal.set_reviewers",
+        http="PUT",
+        route="/v1/repos/{owner}/{rname}/proposals/{id}/reviewers",
+        namespace="proposals",
+        name="set_reviewers",
+        summary="Replace the inspected set of requested reviewers",
+        path_params=('owner', 'rname', 'id'),
+        query_params=(),
+        body="json",
+        response="json",
+        retry="natural",
+        idempotency_key=False,
+        public=False,
+    ),
     "proposal.thread_comments": OperationInfo(
         id="proposal.thread_comments",
         http="GET",
@@ -1924,6 +1939,7 @@
         "get": "proposal.get",
         "list": "proposal.list",
         "review": "proposal.review",
+        "set_reviewers": "proposal.set_reviewers",
         "thread_comments": "proposal.thread_comments",
         "thread_create": "proposal.thread_create",
         "thread_reply": "proposal.thread_reply",
diff --git a/sdk/python/tests/test_all_operations.py b/sdk/python/tests/test_all_operations.py
index 2fae40ca..44991a24 100644
--- a/sdk/python/tests/test_all_operations.py
+++ b/sdk/python/tests/test_all_operations.py
@@ -13,6 +13,7 @@
 
 import httpx
 import pytest
+from examples.review_requests import request_review, reviews_requested_from
 
 from agentgit import (
     NAMESPACE_METHODS,
@@ -158,6 +159,9 @@ def test_workspaces_proposals_reviews_and_the_execution_plane(tour: dict[str, Ag
         alice.proposals.update(repo=REPO, id=p1.id, new_head=m2.head, expected_head=m1.head).head == m2.head
     )
     assert alice.proposals.get(repo=REPO, id=p1.id).proposal.head == m2.head
+    assert request_review(alice, REPO, p1.id, ["user:bob"]).reviewers == ["user:bob"]
+    assert bob.proposals.get(repo=REPO, id=p1.id).requested_reviewers == ["user:bob"]
+    assert [p.id for p in reviews_requested_from(bob, REPO, "user:bob")] == [p1.id]
     bob.proposals.review(repo=REPO, id=p1.id, decision="approve")
     assert (
         bob.proposals.comment(
diff --git a/sdk/python/tests/test_review_requests.py b/sdk/python/tests/test_review_requests.py
new file mode 100644
index 00000000..a3a21e3a
--- /dev/null
+++ b/sdk/python/tests/test_review_requests.py
@@ -0,0 +1,158 @@
+"""Review-routing request and retry contracts, independent of server state."""
+
+from __future__ import annotations
+
+import asyncio
+import json
+
+import httpx
+import pytest
+from examples.review_requests import request_review, reviews_requested_from
+
+from agentgit import AgentGitClient, AgentGitError, AsyncAgentGitClient
+
+
+def test_sends_the_complete_inspected_set_and_retries_a_lost_response() -> None:
+    requests: list[httpx.Request] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        if len(requests) == 1:
+            raise httpx.ReadError("response lost after commit", request=request)
+        return httpx.Response(200, json={"reviewers": ["user:carol"]})
+
+    with AgentGitClient(
+        "http://review.test",
+        "test",
+        http_client=httpx.Client(transport=httpx.MockTransport(respond)),
+        sleep=lambda _delay: None,
+    ) as client:
+        result = client.proposals.set_reviewers(
+            repo="team/app",
+            id="proposal #1",
+            reviewers=["user:carol"],
+            expected_reviewers=["user:bob"],
+        )
+    assert result.reviewers == ["user:carol"]
+    assert len(requests) == 2
+    assert requests[0].method == "PUT"
+    assert requests[0].url.raw_path == b"/v1/repos/team/app/proposals/proposal%20%231/reviewers"
+    assert requests[0].content == requests[1].content
+    assert json.loads(requests[0].content) == {
+        "reviewers": ["user:carol"],
+        "expected_reviewers": ["user:bob"],
+    }
+
+
+def test_preserves_the_requested_reviewer_filter_while_paging() -> None:
+    urls: list[httpx.URL] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        urls.append(request.url)
+        return httpx.Response(
+            200,
+            json={
+                "proposals": [{"id": f"p{len(urls)}"}],
+                "next_page_token": "next" if len(urls) == 1 else "",
+            },
+        )
+
+    with AgentGitClient(
+        "http://review.test",
+        "test",
+        http_client=httpx.Client(transport=httpx.MockTransport(respond)),
+    ) as client:
+        ids = [
+            p.id
+            for p in client.paginate(
+                "proposal.list",
+                repo="team/app",
+                requested_reviewer="user:bob",
+                page_size=1,
+            )
+        ]
+    assert ids == ["p1", "p2"]
+    assert [url.params["requested_reviewer"] for url in urls] == ["user:bob", "user:bob"]
+    assert urls[1].params["page_token"] == "next"
+
+
+def test_async_client_exposes_the_same_guarded_operation() -> None:
+    async def scenario() -> None:
+        def respond(request: httpx.Request) -> httpx.Response:
+            assert json.loads(request.content) == {"reviewers": [], "expected_reviewers": ["user:bob"]}
+            return httpx.Response(200, json={"reviewers": []})
+
+        async with AsyncAgentGitClient(
+            "http://review.test",
+            "test",
+            http_client=httpx.AsyncClient(transport=httpx.MockTransport(respond)),
+        ) as client:
+            result = await client.proposals.set_reviewers(
+                repo="team/app",
+                id="p1",
+                reviewers=[],
+                expected_reviewers=["user:bob"],
+            )
+            assert result.reviewers == []
+
+    asyncio.run(scenario())
+
+
+def test_old_servers_may_omit_requested_reviewers() -> None:
+    def respond(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json={"proposal": {"id": "p1"}, "reviews": []})
+
+    with AgentGitClient(
+        "http://review.test",
+        "test",
+        http_client=httpx.Client(transport=httpx.MockTransport(respond)),
+    ) as client:
+        detail = client.proposals.get(repo="team/app", id="p1")
+    assert detail.proposal.id == "p1"
+    assert detail.requested_reviewers == []
+
+
+def test_helper_keeps_the_inspected_set_when_a_concurrent_edit_is_refused() -> None:
+    requests: list[httpx.Request] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        if request.method == "GET":
+            return httpx.Response(
+                200, json={"proposal": {"id": "p1"}, "reviews": [], "requested_reviewers": ["user:bob"]}
+            )
+        return httpx.Response(
+            412,
+            json={
+                "error": {"code": "failed_precondition", "message": "reviewers changed", "retryable": False}
+            },
+        )
+
+    with AgentGitClient(
+        "http://review.test",
+        "test",
+        http_client=httpx.Client(transport=httpx.MockTransport(respond)),
+    ) as client:
+        with pytest.raises(AgentGitError) as exc:
+            request_review(client, "team/app", "p1", ["user:carol"])
+    assert exc.value.status == 412
+    assert [request.method for request in requests] == ["GET", "PUT"]
+    assert json.loads(requests[1].content) == {
+        "reviewers": ["user:carol"],
+        "expected_reviewers": ["user:bob"],
+    }
+
+
+def test_filter_helper_refuses_unsupported_servers_before_listing() -> None:
+    paths: list[str] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        paths.append(request.url.path)
+        return httpx.Response(200, json={"protocol_version": "agwp.v1", "features": []})
+
+    with AgentGitClient(
+        "http://review.test", "test", http_client=httpx.Client(transport=httpx.MockTransport(respond))
+    ) as client:
+        with pytest.raises(ValueError, match="does not support requested-reviewer filtering"):
+            list(reviews_requested_from(client, "team/app", "user:bob"))
+    assert paths == ["/v1/capabilities"]
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index 8d80d4b0..138af717 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -69,7 +69,7 @@ body, as the protocol prescribes.
 | `session`              | `negotiate`, `authConfig`, `whoami` (and `client.negotiate()`, which also checks the protocol version)  |
 | `repos`                | `create`, `describe`, `list`, `configure`                                                               |
 | `workspaces`           | `create`, `get`, `list`, `modify`, `sync`, `delete`                                                     |
-| `proposals`            | `create`, `get`, `list`, `update`, `review`, `close`                                                    |
+| `proposals`            | `create`, `get`, `list`, `update`, `setReviewers`, `review`, `close`                                    |
 | `integration`          | `prepare`, `validate`, `integrate`, `attest`, `attestations`                                            |
 | `queue`                | `enqueue`, `list`, `run`                                                                                |
 | `streams`              | `list`, `create`, `head`, `cas`, `reflog`                                                               |
@@ -184,6 +184,36 @@ console.log(landed.outcome.status); // integrated
 An `integrate` that cannot proceed is **not an error**: it answers `200` with `outcome.status` `blocked`, `conflict`,
 `denied` or `invalid` and a list of blockers with stable `code`s. Errors are for requests that failed.
 
+## Requesting reviewers
+
+On servers advertising `proposals.review_requests`, the proposal author can replace up to 20 requested reviewers. The helper reads the current list and sends it as the precondition. A conflict requires reviewing the newer list; do not blindly overwrite it. Passing an empty list clears the requests.
+
+Requests route attention: they do not grant access, count as an approval, or change integration policy. The list remains after a new proposal revision; decisions still belong to the exact head reviewed. Before using `requested_reviewer` on a listing or pagination, negotiate and require `proposals.review_requests`: an older server may ignore an unknown query field and return a broader list. The filtering helper below performs that check.
+
+<!-- example: sdk/typescript/examples/review-requests.ts#review-requests -->
+
+```ts
+import type { AgentGitClient } from '@agentgit/client';
+
+/** Replace the inspected routing list. A concurrent edit needs a fresh user decision. */
+export async function requestReview(client: AgentGitClient, repo: string, id: string, reviewers: string[]) {
+  const current = await client.proposals.get({ repo, id });
+  return client.proposals.setReviewers({
+    repo,
+    id,
+    reviewers,
+    expected_reviewers: current.requested_reviewers ?? [],
+  });
+}
+/** Gate the filter: older servers can ignore unknown query fields and return a broader list. */
+export async function* reviewsRequestedFrom(client: AgentGitClient, repo: string, reviewer: string) {
+  const hello = await client.negotiate();
+  if (!hello.features.includes('proposals.review_requests'))
+    throw new Error('This server does not support requested-reviewer filtering.');
+  yield* client.paginate('proposal.list', { repo, requested_reviewer: reviewer });
+}
+```
+
 ## Errors, retries, idempotency and deadlines
 
 <!-- example: sdk/typescript/examples/errors.ts#errors -->
diff --git a/sdk/typescript/examples/review-requests.ts b/sdk/typescript/examples/review-requests.ts
new file mode 100644
index 00000000..b36b3a17
--- /dev/null
+++ b/sdk/typescript/examples/review-requests.ts
@@ -0,0 +1,21 @@
+// #region review-requests
+import type { AgentGitClient } from '@agentgit/client';
+
+/** Replace the inspected routing list. A concurrent edit needs a fresh user decision. */
+export async function requestReview(client: AgentGitClient, repo: string, id: string, reviewers: string[]) {
+  const current = await client.proposals.get({ repo, id });
+  return client.proposals.setReviewers({
+    repo,
+    id,
+    reviewers,
+    expected_reviewers: current.requested_reviewers ?? [],
+  });
+}
+/** Gate the filter: older servers can ignore unknown query fields and return a broader list. */
+export async function* reviewsRequestedFrom(client: AgentGitClient, repo: string, reviewer: string) {
+  const hello = await client.negotiate();
+  if (!hello.features.includes('proposals.review_requests'))
+    throw new Error('This server does not support requested-reviewer filtering.');
+  yield* client.paginate('proposal.list', { repo, requested_reviewer: reviewer });
+}
+// #endregion review-requests
diff --git a/sdk/typescript/scripts/generate.mjs b/sdk/typescript/scripts/generate.mjs
index be79d88a..d376e0cd 100644
--- a/sdk/typescript/scripts/generate.mjs
+++ b/sdk/typescript/scripts/generate.mjs
@@ -241,6 +241,11 @@ function withOpenObjects(doc) {
     target.default = {};
     target.$ref = ref;
   }
+  // Decoded responses are not default-filled in TypeScript. Older servers omit this additive field;
+  // preserve the schema's optionality instead of letting its default [] make it required.
+  const detail = copy.components.schemas.ProposalDetail;
+  const requestedReviewers = detail?.properties?.requested_reviewers;
+  if (requestedReviewers && !detail.required?.includes('requested_reviewers')) delete requestedReviewers.default;
   return copy;
 }
 
diff --git a/sdk/typescript/src/generated/api.ts b/sdk/typescript/src/generated/api.ts
index 504e33e7..df000dec 100644
--- a/sdk/typescript/src/generated/api.ts
+++ b/sdk/typescript/src/generated/api.ts
@@ -103,6 +103,7 @@ export const NAMESPACE_METHODS = {
     get: 'proposal.get',
     list: 'proposal.list',
     review: 'proposal.review',
+    setReviewers: 'proposal.set_reviewers',
     threadComments: 'proposal.thread_comments',
     threadCreate: 'proposal.thread_create',
     threadReply: 'proposal.thread_reply',
@@ -343,6 +344,8 @@ export interface Api {
     list(request: Req<'proposal.list'>, options?: CallOptions): Promise<Res<'proposal.list'>>;
     /** Review the current head (`POST /v1/repos/{owner}/{rname}/proposals/{id}/reviews`, operation `proposal.review`) */
     review(request: Req<'proposal.review'>, options?: CallOptions): Promise<Res<'proposal.review'>>;
+    /** Replace the inspected set of requested reviewers (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/reviewers`, operation `proposal.set_reviewers`) */
+    setReviewers(request: Req<'proposal.set_reviewers'>, options?: CallOptions): Promise<Res<'proposal.set_reviewers'>>;
     /** List thread replies (`GET /v1/repos/{owner}/{rname}/proposals/{id}/threads/{thread_id}/comments`, operation `proposal.thread_comments`) */
     threadComments(request: Req<'proposal.thread_comments'>, options?: CallOptions): Promise<Res<'proposal.thread_comments'>>;
     /** Create a line discussion (`POST /v1/repos/{owner}/{rname}/proposals/{id}/threads`, operation `proposal.thread_create`) */
diff --git a/sdk/typescript/src/generated/models.ts b/sdk/typescript/src/generated/models.ts
index 255ecdff..343aca11 100644
--- a/sdk/typescript/src/generated/models.ts
+++ b/sdk/typescript/src/generated/models.ts
@@ -180,6 +180,7 @@ export type Repo = S['Repo'];
 export type ReportExecutorRequest = S['ReportExecutorRequest'];
 export type RequestValidationRequest = S['RequestValidationRequest'];
 export type RequestValidationResponse = S['RequestValidationResponse'];
+export type RequestedReviewers = S['RequestedReviewers'];
 export type ResolvePathRequest = S['ResolvePathRequest'];
 export type ResolvePathResponse = S['ResolvePathResponse'];
 export type ResolveRevRequest = S['ResolveRevRequest'];
@@ -204,6 +205,7 @@ export type SearchTreeRequest = S['SearchTreeRequest'];
 export type SearchTreeResponse = S['SearchTreeResponse'];
 export type SetAgentStateRequest = S['SetAgentStateRequest'];
 export type SetPolicyRequest = S['SetPolicyRequest'];
+export type SetRequestedReviewersRequest = S['SetRequestedReviewersRequest'];
 export type SetTaskAttemptLimitRequest = S['SetTaskAttemptLimitRequest'];
 export type SetTaskSchedulingRequest = S['SetTaskSchedulingRequest'];
 export type StartRunRequest = S['StartRunRequest'];
diff --git a/sdk/typescript/src/generated/operations.ts b/sdk/typescript/src/generated/operations.ts
index 3df44f37..993037f3 100644
--- a/sdk/typescript/src/generated/operations.ts
+++ b/sdk/typescript/src/generated/operations.ts
@@ -1108,7 +1108,7 @@ export const OPERATIONS = {
     name: 'list',
     summary: 'List proposals',
     pathParams: ['owner', 'rname'],
-    queryParams: ['author', 'page_size', 'page_token', 'state', 'stream', 'task_id'],
+    queryParams: ['author', 'page_size', 'page_token', 'requested_reviewer', 'state', 'stream', 'task_id'],
     body: 'none',
     response: 'json',
     retry: 'read',
@@ -1130,6 +1130,21 @@ export const OPERATIONS = {
     idempotencyKey: true,
     public: false,
   },
+  'proposal.set_reviewers': {
+    id: 'proposal.set_reviewers',
+    http: 'PUT',
+    route: '/v1/repos/{owner}/{rname}/proposals/{id}/reviewers',
+    namespace: 'proposals',
+    name: 'setReviewers',
+    summary: 'Replace the inspected set of requested reviewers',
+    pathParams: ['owner', 'rname', 'id'],
+    queryParams: [],
+    body: 'json',
+    response: 'json',
+    retry: 'natural',
+    idempotencyKey: false,
+    public: false,
+  },
   'proposal.thread_comments': {
     id: 'proposal.thread_comments',
     http: 'GET',
diff --git a/sdk/typescript/src/generated/schema.ts b/sdk/typescript/src/generated/schema.ts
index 7d271b38..d8111bca 100644
--- a/sdk/typescript/src/generated/schema.ts
+++ b/sdk/typescript/src/generated/schema.ts
@@ -899,6 +899,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/repos/{owner}/{rname}/proposals/{id}/reviewers": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /** Replace the inspected set of requested reviewers */
+        put: operations["proposal.set_reviewers"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/repos/{owner}/{rname}/proposals/{id}/reviews": {
         parameters: {
             query?: never;
@@ -3299,6 +3316,11 @@ export interface components {
             page_token: string;
             /** @default  */
             repo: string;
+            /**
+             * @description Match a requested reviewer before keyset paging.
+             * @default
+             */
+            requested_reviewer: string;
             /** @default  */
             state: string;
             /** @default  */
@@ -3861,6 +3883,8 @@ export interface components {
         ProposalDetail: {
             /** @default {} */
             proposal: components["schemas"]["Proposal"];
+            /** @description Routing only; requests do not grant access or count as approval. */
+            requested_reviewers?: string[];
             /** @default [] */
             reviews: components["schemas"]["Review"][];
         };
@@ -4265,6 +4289,10 @@ export interface components {
             /** @default [] */
             jobs: components["schemas"]["Job"][];
         };
+        RequestedReviewers: {
+            /** @default [] */
+            reviewers: string[];
+        };
         ResolvePathRequest: {
             /** @default  */
             path: string;
@@ -4687,6 +4715,17 @@ export interface components {
             /** @default  */
             stream: string;
         };
+        /** @description Replaces review routing after comparing the complete inspected set. */
+        SetRequestedReviewersRequest: {
+            /** @default [] */
+            expected_reviewers: string[];
+            /** @default  */
+            id: string;
+            /** @default  */
+            repo: string;
+            /** @default [] */
+            reviewers: string[];
+        };
         /** @description Execution policy is independent of immutable task instructions and run history. */
         SetTaskAttemptLimitRequest: {
             /**
@@ -7275,6 +7314,7 @@ export interface operations {
                 author?: string;
                 page_size?: number;
                 page_token?: string;
+                requested_reviewer?: string;
                 state?: string;
                 stream?: string;
                 task_id?: string;
@@ -7500,6 +7540,45 @@ export interface operations {
             };
         };
     };
+    "proposal.set_reviewers": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetRequestedReviewersRequest"];
+            };
+        };
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RequestedReviewers"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
     "proposal.review": {
         parameters: {
             query?: never;
diff --git a/sdk/typescript/test/all-operations.test.ts b/sdk/typescript/test/all-operations.test.ts
index d5f85982..25ae8195 100644
--- a/sdk/typescript/test/all-operations.test.ts
+++ b/sdk/typescript/test/all-operations.test.ts
@@ -17,6 +17,7 @@ import {
   type AgentKey,
   type OperationId,
 } from '../src/index.js';
+import { requestReview, reviewsRequestedFrom } from '../examples/review-requests.js';
 import { NAMESPACE_METHODS } from '../src/generated/api.js';
 import { REPO_ROOT, startServer, type RunningServer } from './harness/server.js';
 
@@ -144,6 +145,11 @@ describe('the tour', () => {
       m2.head,
     );
     expect((await alice.proposals.get({ repo, id: p1.id })).proposal.head).toBe(m2.head);
+    expect((await requestReview(alice, repo, p1.id, ['user:bob'])).reviewers).toEqual(['user:bob']);
+    expect((await bob.proposals.get({ repo, id: p1.id })).requested_reviewers).toEqual(['user:bob']);
+    const requested = [];
+    for await (const proposal of reviewsRequestedFrom(bob, repo, 'user:bob')) requested.push(proposal.id);
+    expect(requested).toEqual([p1.id]);
     await bob.proposals.review({ repo, id: p1.id, decision: 'approve' });
     expect(
       (
diff --git a/sdk/typescript/test/review-requests.test.ts b/sdk/typescript/test/review-requests.test.ts
new file mode 100644
index 00000000..9cf89b2e
--- /dev/null
+++ b/sdk/typescript/test/review-requests.test.ts
@@ -0,0 +1,144 @@
+import { describe, expect, it } from 'vitest';
+import { requestReview, reviewsRequestedFrom } from '../examples/review-requests.js';
+import { AgentGitClient, type ProposalDetail, type Res } from '../src/index.js';
+
+const baseUrl = 'http://review.test';
+
+function urlOf(input: Parameters<typeof fetch>[0]): string {
+  return typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+}
+function bodyOf(init: RequestInit | undefined): string {
+  if (typeof init?.body !== 'string') throw new Error('Expected a JSON request body');
+  return init.body;
+}
+
+describe('requested reviewers', () => {
+  it('sends the inspected reviewer set without path fields in the body', async () => {
+    const requests: { url: string; method: string; body: unknown }[] = [];
+    const client = new AgentGitClient({
+      baseUrl,
+      token: 'test',
+      fetch: async (input, init) => {
+        requests.push({ url: urlOf(input), method: init?.method ?? 'GET', body: JSON.parse(bodyOf(init)) });
+        return Response.json({ reviewers: ['user:carol'] });
+      },
+    });
+    const result = await client.proposals.setReviewers({
+      repo: 'team/app',
+      id: 'proposal #1',
+      reviewers: ['user:carol'],
+      expected_reviewers: ['user:bob'],
+    });
+    expect(result.reviewers).toEqual(['user:carol']);
+    expect(requests).toEqual([
+      {
+        url: `${baseUrl}/v1/repos/team/app/proposals/proposal%20%231/reviewers`,
+        method: 'PUT',
+        body: { reviewers: ['user:carol'], expected_reviewers: ['user:bob'] },
+      },
+    ]);
+  });
+
+  it('retries a lost response with the same inspected set', async () => {
+    const bodies: string[] = [];
+    const client = new AgentGitClient({
+      baseUrl,
+      token: 'test',
+      sleep: async () => {},
+      fetch: async (_input, init) => {
+        bodies.push(bodyOf(init));
+        if (bodies.length === 1) throw new TypeError('response lost after commit');
+        return Response.json({ reviewers: ['user:bob'] });
+      },
+    });
+    await expect(
+      client.proposals.setReviewers({
+        repo: 'team/app',
+        id: 'p1',
+        reviewers: ['user:bob'],
+        expected_reviewers: [],
+      }),
+    ).resolves.toEqual({ reviewers: ['user:bob'] });
+    expect(bodies).toHaveLength(2);
+    expect(bodies[1]).toBe(bodies[0]);
+  });
+
+  it('retains the requested-reviewer filter across paginated requests', async () => {
+    const urls: URL[] = [];
+    const client = new AgentGitClient({
+      baseUrl,
+      token: 'test',
+      fetch: async (input) => {
+        urls.push(new URL(urlOf(input)));
+        return Response.json({
+          proposals: [{ id: `p${urls.length}` }],
+          next_page_token: urls.length === 1 ? 'next' : '',
+        });
+      },
+    });
+    const ids: string[] = [];
+    for await (const proposal of client.paginate('proposal.list', {
+      repo: 'team/app',
+      requested_reviewer: 'user:bob',
+      page_size: 1,
+    }))
+      ids.push(proposal.id);
+    expect(ids).toEqual(['p1', 'p2']);
+    expect(urls.map((url) => url.searchParams.get('requested_reviewer'))).toEqual(['user:bob', 'user:bob']);
+    expect(urls[1]!.searchParams.get('page_token')).toBe('next');
+  });
+  it('still reads proposal details from servers that omit reviewer requests', async () => {
+    const legacyModel: Pick<ProposalDetail, 'requested_reviewers'> = {};
+    const legacyResponse: Pick<Res<'proposal.get'>, 'requested_reviewers'> = {};
+    expect(legacyModel.requested_reviewers).toBeUndefined();
+    expect(legacyResponse.requested_reviewers).toBeUndefined();
+    const client = new AgentGitClient({
+      baseUrl,
+      token: 'test',
+      fetch: async () => Response.json({ proposal: { id: 'p1' }, reviews: [] }),
+    });
+    const detail = await client.proposals.get({ repo: 'team/app', id: 'p1' });
+    expect(detail.proposal.id).toBe('p1');
+    expect(detail.requested_reviewers).toBeUndefined();
+  });
+  it('keeps the inspected set when a concurrent edit requires a new decision', async () => {
+    const requests: { method: string; body: unknown }[] = [];
+    const client = new AgentGitClient({
+      baseUrl,
+      token: 'test',
+      fetch: async (_input, init) => {
+        const method = init?.method ?? 'GET';
+        requests.push({ method, body: init?.body ? JSON.parse(bodyOf(init)) : undefined });
+        return method === 'GET'
+          ? Response.json({ proposal: { id: 'p1' }, reviews: [], requested_reviewers: ['user:bob'] })
+          : Response.json(
+              { error: { code: 'failed_precondition', message: 'reviewers changed', retryable: false } },
+              { status: 412 },
+            );
+      },
+    });
+    await expect(requestReview(client, 'team/app', 'p1', ['user:carol'])).rejects.toMatchObject({ status: 412 });
+    expect(requests).toEqual([
+      { method: 'GET', body: undefined },
+      { method: 'PUT', body: { reviewers: ['user:carol'], expected_reviewers: ['user:bob'] } },
+    ]);
+  });
+  it('does not issue a reviewer-filtered listing against an unsupported server', async () => {
+    const urls: string[] = [];
+    const client = new AgentGitClient({
+      baseUrl,
+      token: 'test',
+      fetch: async (input) => {
+        urls.push(urlOf(input));
+        return Response.json({ protocol_version: 'agwp.v1', features: [] });
+      },
+    });
+    const collect = async () => {
+      for await (const proposal of reviewsRequestedFrom(client, 'team/app', 'user:bob'))
+        throw new Error(`Unexpected result ${proposal.id} from unsupported server`);
+    };
+    await expect(collect()).rejects.toThrow('does not support requested-reviewer filtering');
+    expect(urls).toHaveLength(1);
+    expect(new URL(urls[0]!).pathname).toBe('/v1/capabilities');
+  });
+});

From b47079274d8ea78adf81c043fce7731c1d9bdfeb Mon Sep 17 00:00:00 2001
From: Codex <codex@openai.com>
Date: Thu, 29 Oct 2026 20:55:32 +0000
Subject: [PATCH 04/41] feat(web): focus the review workspace on changed code

Move secondary actions and context to a quiet rail, keep primary Review/Land actions and compact readiness visible, and preserve all operational flows. Add author-managed reviewers and a capability-guarded personal review filter with retained conflict drafts.

Validation: 796 web tests, typecheck/lint/build, real-server desktop/phone reviewer flow, final layout/header and accessibility checks, plus retained existing proposal regressions. Hallmark before/after review in light and dark. No main merge.
---
 CHANGELOG.md                                  |   4 +
 ROADMAP.md                                    |   2 +-
 apps/web/DESIGN.md                            |   8 +
 apps/web/e2e/proposal-layout.spec.ts          |  53 ++
 apps/web/e2e/review-requests.spec.ts          |  94 +++
 apps/web/playwright.config.ts                 |   2 +-
 apps/web/src/api/endpoints.spec.ts            |  22 +
 apps/web/src/api/endpoints.ts                 |  13 +
 .../src/components/proposal/ChangesTab.vue    | 100 ++-
 .../proposal/RequestedReviewers.spec.ts       | 111 +++
 .../proposal/RequestedReviewers.vue           | 170 +++++
 .../src/components/proposal/ReviewsTab.vue    |   2 +-
 apps/web/src/composables/useProposalData.ts   |   9 +-
 apps/web/src/views/ProposalView.vue           | 694 +++++++++++-------
 apps/web/src/views/ProposalsView.spec.ts      |  42 +-
 apps/web/src/views/ProposalsView.vue          |  65 +-
 docs/guides/web-ui.md                         |  15 +
 17 files changed, 1122 insertions(+), 284 deletions(-)
 create mode 100644 apps/web/e2e/proposal-layout.spec.ts
 create mode 100644 apps/web/e2e/review-requests.spec.ts
 create mode 100644 apps/web/src/components/proposal/RequestedReviewers.spec.ts
 create mode 100644 apps/web/src/components/proposal/RequestedReviewers.vue

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2dd1fc52..2bd885e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,10 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 - Authors can preview and apply selected review suggestions across files as one proposal revision. Exact source lines, executable mode, BOM and line endings are preserved; conflicting selections are refused and discussions remain open.
 
+### Changed
+
+- The review workspace puts changed code first, keeps Review and Land in the header, and moves secondary actions and context into a quieter side panel. Phone layouts use a compact readiness strip and file navigation. All review, validation and permission states remain available.
+
 ## [0.3.0-beta.7] - 2026-10-29
 
 **Upgrade:** metadata schema 8 and control schema are unchanged from beta.6. Back up before upgrading. Returning to beta.5 or older requires the pre-upgrade backup.
diff --git a/ROADMAP.md b/ROADMAP.md
index 38597056..5440c712 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -103,7 +103,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    historical instructions and source links. Proposal updates now have an atomic inspected-head
    precondition as the prerequisite for safe review edits. Workspace mutations now compare the
    observed base/head in their final transaction, and proposal closing preserves terminal states. The final integration transaction also
-   rechecks the proposal head and open state. Single-line, range and batched suggestions support explicit author preview and application across files in one revision. Next add requested reviewers. Optional policy-required line-discussion resolution is now implemented
+   rechecks the proposal head and open state. Single-line, range and batched suggestions support explicit author preview and application across files in one revision. Requested reviewers route work across Web UI, CLI, MCP and SDKs without changing approval policy. Optional policy-required line-discussion resolution is now implemented
    across core, API, CLI explanations and Web UI. Preserve drafts, exact-head
    checks and explicit confirmation when a user changes executable work or a review decision.
    Account-backed drafts and non-text conflict resolution remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
diff --git a/apps/web/DESIGN.md b/apps/web/DESIGN.md
index 14876f88..03d60cc3 100644
--- a/apps/web/DESIGN.md
+++ b/apps/web/DESIGN.md
@@ -37,6 +37,14 @@ routes, permission checks, keyboard behavior and server-backed data.
 - Dark mode uses the existing paired tokens, not inversion. Motion only explains
   state changes and obeys `prefers-reduced-motion`.
 
+## Review workspace
+
+Lead with the change title and the two primary review/integration actions. Keep the
+four independent readiness states compact; do not put a large status card between
+the title and changed code. Details, requested reviewers and secondary actions live
+in a quiet side panel, after the code on phones. Preserve visible permission guidance
+for unavailable actions and keep file navigation compact on narrow screens.
+
 ## Verification
 
 Run the existing type, lint, unit and real-server browser checks after changes.
diff --git a/apps/web/e2e/proposal-layout.spec.ts b/apps/web/e2e/proposal-layout.spec.ts
new file mode 100644
index 00000000..c3ee8dfa
--- /dev/null
+++ b/apps/web/e2e/proposal-layout.spec.ts
@@ -0,0 +1,53 @@
+import { test, expect } from './fixtures.ts'
+import { freshRepo, commitFiles, openProposal } from './support/world.ts'
+import { expectAccessible } from './support/ui.ts'
+
+for (const viewport of [
+  { name: 'desktop', width: 1440, height: 900 },
+  { name: 'phone', width: 390, height: 844 },
+]) {
+  test(`the ${viewport.name} review workspace keeps changed code ahead of secondary actions`, async ({
+    cast,
+    openAs,
+  }, info) => {
+    const { repo } = await freshRepo(cast, 'review-layout')
+    const alice = cast.as('alice')
+    const revision = await commitFiles(
+      alice,
+      repo,
+      {
+        'src/session.ts':
+          'export function createSession(user: string) {\n  return { user, expiresIn: 3600 }\n}\n',
+        'test/session.test.ts': 'expect(createSession("alex").expiresIn).toBe(3600)\n',
+      },
+      'Bound session lifetime',
+    )
+    const proposal = await openProposal(alice, repo, {
+      head: revision.head,
+      title: 'Expire inactive sessions after one hour',
+    })
+    const page = await openAs('bob')
+    await page.setViewportSize(viewport)
+    await page.goto(`/repos/${repo}/proposals/${proposal.id}`)
+    await expect(page.getByTestId('changes-tab')).toContainText('src/session.ts')
+    await expect(
+      page.getByRole('list', { name: /four independent states/ }).getByText('checking'),
+    ).toHaveCount(0)
+    await page.screenshot({
+      path: info.outputPath(`proposal-${viewport.name}.png`),
+      fullPage: true,
+    })
+    const tabs = await page.getByRole('tablist', { name: 'Change request details' }).boundingBox()
+    expect(tabs!.y).toBeLessThan(viewport.width < 600 ? 650 : 500)
+    const review = await page.getByTestId('act-review').boundingBox()
+    expect(review!.y).toBeLessThan(tabs!.y)
+    await page.getByTestId('act-review').click()
+    await expect(page.getByRole('dialog', { name: 'Write a review' })).toBeVisible()
+    await page.getByRole('button', { name: 'Keep draft and close' }).click()
+    await expectAccessible(page, info, `${viewport.name} review workspace`)
+    expect(await page.evaluate(() => document.documentElement.scrollWidth)).toBeLessThanOrEqual(
+      viewport.width,
+    )
+    await page.close()
+  })
+}
diff --git a/apps/web/e2e/review-requests.spec.ts b/apps/web/e2e/review-requests.spec.ts
new file mode 100644
index 00000000..36ccac11
--- /dev/null
+++ b/apps/web/e2e/review-requests.spec.ts
@@ -0,0 +1,94 @@
+import { test, expect } from './fixtures.ts'
+import { freshRepo, commitFiles, openProposal } from './support/world.ts'
+
+test('requested reviewers persist, follow the current revision and preserve a conflicting draft', async ({
+  cast,
+  openAs,
+  allowConsole,
+}) => {
+  const { repo } = await freshRepo(cast, 'review-requests')
+  const alice = cast.as('alice')
+  const initial = await commitFiles(alice, repo, { 'code.txt': 'first\n' }, 'Review source')
+  const proposal = await openProposal(alice, repo, {
+    head: initial.head,
+    title: 'Ask for a review',
+  })
+  const url = `/repos/${repo}/proposals/${proposal.id}?tab=reviews`
+  const author = await openAs('alice')
+  await author.goto(url)
+  await author.getByRole('button', { name: 'Request review', exact: true }).click()
+  const dialog = author.getByRole('dialog', { name: 'Request reviewers' })
+  await dialog.getByRole('textbox', { name: 'Reviewer identities' }).fill('user:bob')
+  const before = await alice.ok_(
+    alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'read unchanged request',
+  )
+  expect(before.requested_reviewers).toEqual([])
+  await dialog.getByRole('button', { name: 'Save reviewer requests' }).click()
+  await expect(dialog).toHaveCount(0)
+  await author.reload()
+  const requests = author.getByRole('region', { name: 'Requested reviewers' })
+  await expect(requests).toContainText('bob')
+  await expect(requests).toContainText('Review requested')
+  const saved = await alice.ok_(
+    alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'read reviewer request',
+  )
+  expect(saved.proposal.head).toBe(initial.head)
+  expect(saved.requested_reviewers).toEqual(['user:bob'])
+  expect(saved.reviews).toEqual([])
+  await openProposal(alice, repo, { head: initial.head, title: 'No review requested here' })
+  const reviewer = await openAs('bob')
+  await reviewer.goto(`/repos/${repo}/proposals?reviewer=me`)
+  await expect(reviewer.getByRole('checkbox', { name: 'Review requested from me' })).toBeChecked()
+  await expect(reviewer.getByRole('link', { name: 'Ask for a review', exact: true })).toBeVisible()
+  await expect(
+    reviewer.getByRole('link', { name: 'No review requested here', exact: true }),
+  ).toHaveCount(0)
+  await reviewer.reload()
+  await expect(reviewer.getByRole('link', { name: 'Ask for a review', exact: true })).toBeVisible()
+  await reviewer.goto(url)
+  await expect(reviewer.getByRole('button', { name: 'Request review', exact: true })).toHaveCount(0)
+  await cast.as('bob').ok_(
+    cast.as('bob').post(`/v1/repos/${repo}/proposals/${proposal.id}/reviews`, {
+      decision: 'approve',
+      expected_head: initial.head,
+    }),
+    'approve inspected revision',
+  )
+  await author.reload()
+  await expect(requests).toContainText('Reviewed this revision')
+  const next = await commitFiles(alice, repo, { 'code.txt': 'second\n' }, 'New revision')
+  await alice.ok_(
+    alice.call('PATCH', `/v1/repos/${repo}/proposals/${proposal.id}`, {
+      new_head: next.head,
+      expected_head: initial.head,
+    }),
+    'move proposal head',
+  )
+  await author.reload()
+  await expect(requests).toContainText('Review requested')
+  await author.getByRole('button', { name: 'Request review', exact: true }).click()
+  await dialog.getByRole('textbox', { name: 'Reviewer identities' }).fill('user:carol')
+  await alice.ok_(
+    alice.call('PUT', `/v1/repos/${repo}/proposals/${proposal.id}/reviewers`, {
+      reviewers: ['user:dave'],
+      expected_reviewers: ['user:bob'],
+    }),
+    'concurrent reviewer edit',
+  )
+  // This click deliberately provokes the server's inspected-set precondition.
+  allowConsole(/status of 412.*\/proposals\/[^/]+\/reviewers\]$/)
+  await dialog.getByRole('button', { name: 'Save reviewer requests' }).click()
+  await expect(dialog).toContainText('requested reviewers changed')
+  await expect(dialog.getByRole('textbox', { name: 'Reviewer identities' })).toHaveValue(
+    'user:carol',
+  )
+  const retained = await alice.ok_(
+    alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'read winning edit',
+  )
+  expect(retained.requested_reviewers).toEqual(['user:dave'])
+  await author.close()
+  await reviewer.close()
+})
diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts
index 654b52cf..df48e804 100644
--- a/apps/web/playwright.config.ts
+++ b/apps/web/playwright.config.ts
@@ -26,7 +26,7 @@ const screenshots = /screenshots\.spec\.ts/
 // Layout assertions are made at the viewports of the tablet and phone projects, not at desktop size.
 const layout = /responsive\.spec\.ts/
 const small =
-  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|required-discussions|draft-recovery|review-drafts|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
+  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|review-requests|required-discussions|draft-recovery|review-drafts|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
 const desktop = { viewport: { width: 1440, height: 900 } }
 
 export default defineConfig({
diff --git a/apps/web/src/api/endpoints.spec.ts b/apps/web/src/api/endpoints.spec.ts
index 7ee34c13..74007885 100644
--- a/apps/web/src/api/endpoints.spec.ts
+++ b/apps/web/src/api/endpoints.spec.ts
@@ -30,6 +30,9 @@ const invoke = (api: ReturnType<typeof createApi>, operation: string) => {
       options,
     )
 
+  if (operation === 'reviewers')
+    return api.proposals.setReviewers('acme/new', 'proposal-one', ['user:bob'], [], options)
+
   if (operation === 'proposal-update')
     return api.proposals.update('acme/new', 'proposal-one', 'new-head', 'seen-head', options)
 
@@ -61,6 +64,7 @@ describe('repository setup request ownership', () => {
     'workspace-remove',
     'proposal-create',
     'proposal-update',
+    'reviewers',
     'review',
 
     'task-dependency',
@@ -100,6 +104,7 @@ describe('repository setup request ownership', () => {
     'workspace-remove',
     'proposal-create',
     'proposal-update',
+    'reviewers',
     'review',
 
     'task-dependency',
@@ -146,3 +151,20 @@ it('patches an attempt limit with its inspected value and an encoded task id', a
   expect(options?.method).toBe('PATCH')
   expect(JSON.parse(String(options?.body))).toEqual({ max_attempts: 0, expected_max_attempts: 2 })
 })
+
+it('sends requested reviewers and the inspected set to the encoded proposal path', async () => {
+  const request = vi.fn<typeof fetch>().mockResolvedValue(
+    new Response('{"reviewers":["user:bob"]}', {
+      headers: { 'content-type': 'application/json' },
+    }),
+  )
+  const client = new ApiClient({ getToken: () => 'session', fetch: request })
+  await createApi(client).proposals.setReviewers('acme/repo', 'p/one', ['user:bob'], ['user:carol'])
+  const [url, options] = request.mock.calls[0]!
+  expect(String(url)).toContain('/v1/repos/acme/repo/proposals/p%2Fone/reviewers')
+  expect(options?.method).toBe('PUT')
+  expect(JSON.parse(String(options?.body))).toEqual({
+    reviewers: ['user:bob'],
+    expected_reviewers: ['user:carol'],
+  })
+})
diff --git a/apps/web/src/api/endpoints.ts b/apps/web/src/api/endpoints.ts
index a3610c05..29ccf0dc 100644
--- a/apps/web/src/api/endpoints.ts
+++ b/apps/web/src/api/endpoints.ts
@@ -253,6 +253,7 @@ export function createApi(c: ApiClient) {
           stream?: string
           author?: string
           task_id?: string
+          requested_reviewer?: string
           page_size?: number
           page_token?: string
         } = {},
@@ -267,6 +268,18 @@ export function createApi(c: ApiClient) {
       },
       get: (repo: string, id: string, o?: Opts) =>
         c.get<ProposalDetail>(r(repo, `/proposals/${encodeURIComponent(id)}`), undefined, o),
+      setReviewers: (
+        repo: string,
+        id: string,
+        reviewers: string[],
+        expectedReviewers: string[],
+        o?: SessionOpts,
+      ) =>
+        c.json<{ reviewers: string[] }>(r(repo, `/proposals/${encodeURIComponent(id)}/reviewers`), {
+          ...o,
+          method: 'PUT',
+          body: { reviewers, expected_reviewers: expectedReviewers },
+        }),
       comment: (
         repo: string,
         id: string,
diff --git a/apps/web/src/components/proposal/ChangesTab.vue b/apps/web/src/components/proposal/ChangesTab.vue
index e631b01c..5ad4fc92 100644
--- a/apps/web/src/components/proposal/ChangesTab.vue
+++ b/apps/web/src/components/proposal/ChangesTab.vue
@@ -99,31 +99,35 @@ function jump(file: FileDiff) {
       @retry="$emit('retry')"
     />
     <template v-else-if="diff">
-      <p class="base faint">
-        Comparing
-        <code class="mono">{{ diff.base ? shortId(diff.base, 8) : 'the empty tree' }}</code>
-        with the proposal’s head. Context is three lines.
-      </p>
       <div v-if="diff.files.length" class="review-tools">
         <TextField
           v-model="query"
           type="search"
           label="Filter changed files"
-          placeholder="File name or path"
+          placeholder="Filter changed files"
+          hide-label
         />
         <label v-if="storageKey" class="hide-viewed"
           ><input v-model="hideViewed" type="checkbox" aria-label="Hide viewed files" /> Hide viewed
           files</label
         >
-        <span v-if="storageKey" class="faint" role="status"
+        <span v-if="storageKey" class="faint viewed-count" role="status"
           >{{ viewedCount }} of {{ diff.files.length }} loaded files viewed</span
         >
         <Button v-if="query || hideViewed" size="sm" @click="showAll">Show all files</Button>
       </div>
-      <p v-if="storageKey" class="faint progress-note">
-        Viewed marks are saved in this tab for this exact comparison. They do not approve the change
-        request.
-      </p>
+      <details class="comparison-details">
+        <summary>Comparison details</summary>
+        <p class="base faint">
+          Comparing
+          <code class="mono">{{ diff.base ? shortId(diff.base, 8) : 'the empty tree' }}</code>
+          with the proposal’s head. Context is three lines.
+        </p>
+        <p v-if="storageKey" class="faint progress-note">
+          Viewed marks are saved in this tab for this exact comparison. They do not approve the
+          change request.
+        </p>
+      </details>
       <p v-if="storageError" role="status" class="faint">{{ storageError }}</p>
       <div class="layout" :class="{ 'with-nav': diff.files.length > 1 }">
         <nav v-if="diff.files.length > 1" class="files" aria-label="Changed files">
@@ -179,6 +183,8 @@ function jump(file: FileDiff) {
 </template>
 
 <style scoped>
+/* Hallmark · shape: app screen · theme: locked AgentGit · scope: component · v2.0.0 */
+/* Critique: filtering stays at hand; comparison guidance is disclosed and mobile file navigation stays one row. */
 .review-tools {
   display: flex;
   align-items: end;
@@ -203,7 +209,7 @@ function jump(file: FileDiff) {
   font-size: var(--fs-xs);
 }
 .progress-note {
-  margin-bottom: var(--s-3);
+  margin-bottom: 0;
   font-size: var(--fs-xs);
 }
 input[type='checkbox'] {
@@ -242,8 +248,8 @@ input[type='checkbox'] {
   text-decoration: none;
   display: flex;
   flex-direction: column;
-  gap: 2px;
-  padding: 6px var(--s-2);
+  gap: var(--s-1);
+  padding: var(--s-2);
   border-radius: var(--r-sm);
   color: var(--text);
   font-size: var(--fs-sm);
@@ -257,7 +263,7 @@ input[type='checkbox'] {
 }
 .n {
   display: flex;
-  gap: 6px;
+  gap: var(--s-1);
   align-items: center;
   font-size: var(--fs-xs);
 }
@@ -269,10 +275,72 @@ input[type='checkbox'] {
 }
 @media (min-width: 1100px) {
   .layout.with-nav {
-    grid-template-columns: 260px minmax(0, 1fr);
+    grid-template-columns: 200px minmax(0, 1fr);
   }
   .files {
     order: 0;
   }
 }
+
+.comparison-details {
+  margin-bottom: var(--s-3);
+  color: var(--text-2);
+  font-size: var(--fs-xs);
+}
+.comparison-details summary {
+  cursor: pointer;
+}
+.comparison-details .base {
+  margin-top: var(--s-2);
+  margin-bottom: var(--s-2);
+}
+.viewed-count {
+  font-size: var(--fs-sm);
+}
+@media (max-width: 700px) {
+  .review-tools {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
+    gap: var(--s-2);
+    margin-bottom: var(--s-2);
+  }
+  .review-tools :deep(.field) {
+    grid-column: 1 / -1;
+    min-width: 0;
+  }
+  .viewed-count {
+    text-align: right;
+    font-size: var(--fs-xs);
+  }
+  .hide-viewed {
+    font-size: var(--fs-sm);
+  }
+  .files {
+    position: static;
+    max-height: none;
+  }
+  .files ul {
+    display: flex;
+    gap: var(--s-1);
+    overflow-x: auto;
+  }
+  .files li {
+    flex: none;
+    max-width: 85%;
+  }
+  .files a {
+    min-height: 44px;
+    flex-direction: row;
+    align-items: center;
+    gap: var(--s-3);
+  }
+  .files .p {
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+  }
+  .files .n {
+    flex: none;
+  }
+}
 </style>
diff --git a/apps/web/src/components/proposal/RequestedReviewers.spec.ts b/apps/web/src/components/proposal/RequestedReviewers.spec.ts
new file mode 100644
index 00000000..f5626a25
--- /dev/null
+++ b/apps/web/src/components/proposal/RequestedReviewers.spec.ts
@@ -0,0 +1,111 @@
+import { enableAutoUnmount, flushPromises, mount } from '@vue/test-utils'
+import { reactive } from 'vue'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { Proposal } from '@/api/types'
+import RequestedReviewers from './RequestedReviewers.vue'
+
+enableAutoUnmount(afterEach)
+const setReviewers = vi.hoisted(() => vi.fn())
+vi.mock('@/api/instance', () => ({ api: { proposals: { setReviewers } } }))
+const auth = reactive({
+  token: 'original',
+  identity: 'user:alice',
+  capabilities: { features: ['proposals.review_requests'] },
+  can: () => true,
+})
+vi.mock('@/stores/auth', () => ({ useAuth: () => auth }))
+const proposal: Proposal = {
+  id: 'p1',
+  stream: 'main',
+  head: 'h1',
+  title: 'Change',
+  description: '',
+  author: 'user:alice',
+  state: 'open',
+  task_id: '',
+  created_at_ms: 1,
+  updated_at_ms: 1,
+  integrated_as: '',
+}
+function show() {
+  return mount(RequestedReviewers, {
+    props: { repo: 'acme/app', proposal, reviewers: ['user:bob'], reviews: [] },
+    global: { stubs: { Teleport: true } },
+  })
+}
+beforeEach(() => {
+  auth.identity = 'user:alice'
+  auth.token = 'original'
+  auth.capabilities.features = ['proposals.review_requests']
+  setReviewers.mockReset().mockResolvedValue({ reviewers: ['user:carol'] })
+})
+it('saves the requested list with its inspected set only after confirmation', async () => {
+  const wrapper = show()
+  await wrapper.get('button').trigger('click')
+  await wrapper.get('textarea').setValue('user:carol')
+  expect(setReviewers).not.toHaveBeenCalled()
+  await wrapper.get('form').trigger('submit')
+  await flushPromises()
+  expect(setReviewers).toHaveBeenCalledWith(
+    'acme/app',
+    'p1',
+    ['user:carol'],
+    ['user:bob'],
+    expect.objectContaining({ token: 'original' }),
+  )
+  expect(wrapper.emitted('saved')).toBeTruthy()
+})
+it('retains a draft when a concurrent edit is refused', async () => {
+  setReviewers.mockRejectedValue(new Error('requested reviewers changed'))
+  const wrapper = show()
+  await wrapper.get('button').trigger('click')
+  await wrapper.get('textarea').setValue('user:carol')
+  await wrapper.setProps({ reviewers: ['user:dave'] })
+  await wrapper.get('form').trigger('submit')
+  await flushPromises()
+  expect(wrapper.get('textarea').element.value).toBe('user:carol')
+  expect(wrapper.text()).toContain('requested reviewers changed')
+  expect(setReviewers.mock.calls[0]![3]).toEqual(['user:bob'])
+})
+it('shows requests without editing controls to another user and hides unsupported controls', async () => {
+  auth.identity = 'user:bob'
+  const wrapper = show()
+  expect(wrapper.text()).toContain('bob')
+  expect(wrapper.find('button').exists()).toBe(false)
+  auth.capabilities.features = []
+  await flushPromises()
+  expect(wrapper.find('section').exists()).toBe(false)
+})
+
+it('counts only review decisions on the current revision', async () => {
+  const wrapper = show()
+  const review = {
+    id: 1,
+    proposal: 'p1',
+    reviewer: 'user:bob',
+    decision: 'approve',
+    body: '',
+    head: 'old',
+    timestamp_ms: 1,
+  }
+  await wrapper.setProps({ reviews: [review] })
+  expect(wrapper.text()).toContain('Review requested')
+  await wrapper.setProps({ reviews: [{ ...review, head: 'h1', decision: 'comment' }] })
+  expect(wrapper.text()).toContain('Review requested')
+  await wrapper.setProps({ reviews: [{ ...review, head: 'h1', decision: 'request_changes' }] })
+  expect(wrapper.text()).toContain('Reviewed this revision')
+})
+
+it('rejects an oversized list and closes the draft when the session changes', async () => {
+  const wrapper = show()
+  await wrapper.get('button').trigger('click')
+  await wrapper
+    .get('textarea')
+    .setValue(Array.from({ length: 21 }, (_, i) => `user:reviewer-${i}`).join('\n'))
+  await wrapper.get('form').trigger('submit')
+  expect(setReviewers).not.toHaveBeenCalled()
+  expect(wrapper.text()).toContain('Request up to 20 reviewers')
+  auth.token = 'another-session'
+  await flushPromises()
+  expect(wrapper.find('form').exists()).toBe(false)
+})
diff --git a/apps/web/src/components/proposal/RequestedReviewers.vue b/apps/web/src/components/proposal/RequestedReviewers.vue
new file mode 100644
index 00000000..9e09fcc6
--- /dev/null
+++ b/apps/web/src/components/proposal/RequestedReviewers.vue
@@ -0,0 +1,170 @@
+<script setup lang="ts">
+import { computed, onBeforeUnmount, ref, watch } from 'vue'
+import type { Proposal, Review } from '@/api/types'
+import { api } from '@/api/instance'
+import { describeError } from '@/api/errors'
+import { samePrincipal } from '@/lib/identity'
+import { useAuth } from '@/stores/auth'
+import Alert from '@/ui/Alert.vue'
+import Button from '@/ui/Button.vue'
+import Dialog from '@/ui/Dialog.vue'
+import IdentityLabel from '@/ui/IdentityLabel.vue'
+import TextArea from '@/ui/TextArea.vue'
+
+const props = defineProps<{
+  repo: string
+  proposal: Proposal
+  reviewers: string[]
+  reviews: readonly Review[]
+}>()
+const emit = defineEmits<{ saved: [] }>()
+const auth = useAuth()
+const supported = computed(() => auth.capabilities?.features.includes('proposals.review_requests'))
+const allowed = computed(
+  () =>
+    supported.value &&
+    props.proposal.state === 'open' &&
+    samePrincipal(props.proposal.author, auth.identity) &&
+    auth.can(props.repo, 'editFiles'),
+)
+const reviewed = (identity: string) =>
+  props.reviews.some(
+    (review) =>
+      samePrincipal(review.reviewer, identity) &&
+      review.head === props.proposal.head &&
+      (review.decision === 'approve' || review.decision === 'request_changes'),
+  )
+const open = ref(false),
+  busy = ref(false),
+  draft = ref(''),
+  error = ref('')
+const selected = computed(() =>
+  [
+    ...new Set(
+      draft.value
+        .split(/[\n,]+/)
+        .map((value) => value.trim())
+        .filter(Boolean),
+    ),
+  ].sort(),
+)
+const invalid = computed(() => (selected.value.length > 20 ? 'Request up to 20 reviewers.' : ''))
+let expected: string[] = [],
+  generation = 0,
+  controller: AbortController | undefined
+function reset() {
+  generation++
+  controller?.abort()
+  open.value = busy.value = false
+  error.value = ''
+}
+watch([() => props.repo, () => props.proposal.id, () => auth.token, () => auth.identity], reset, {
+  flush: 'sync',
+})
+onBeforeUnmount(reset)
+function edit() {
+  expected = [...props.reviewers]
+  draft.value = expected.join('\n')
+  error.value = ''
+  open.value = true
+}
+async function save() {
+  if (!allowed.value || busy.value || invalid.value) return
+  const mine = generation
+  controller = new AbortController()
+  busy.value = true
+  error.value = ''
+  try {
+    await api.proposals.setReviewers(props.repo, props.proposal.id, selected.value, expected, {
+      token: auth.token,
+      signal: controller.signal,
+      quietUnauthenticated: true,
+    })
+    if (mine !== generation) return
+    open.value = false
+    emit('saved')
+  } catch (cause) {
+    if (mine === generation) error.value = describeError(cause)
+  } finally {
+    if (mine === generation) busy.value = false
+  }
+}
+</script>
+
+<template>
+  <section v-if="supported" class="reviewers" aria-label="Requested reviewers">
+    <div class="heading">
+      <h3>Reviewers</h3>
+      <Button v-if="allowed" size="sm" variant="ghost" @click="edit">Request review</Button>
+    </div>
+    <ul v-if="reviewers.length">
+      <li v-for="reviewer in reviewers" :key="reviewer">
+        <IdentityLabel :identity="reviewer" :size="22" />
+        <span class="status">{{
+          reviewed(reviewer) ? 'Reviewed this revision' : 'Review requested'
+        }}</span>
+      </li>
+    </ul>
+    <p v-else class="muted">No reviewers requested.</p>
+  </section>
+  <Dialog v-model="open" title="Request reviewers" :dismissable="!busy" size="sm">
+    <form id="request-reviewers" @submit.prevent="save">
+      <TextArea
+        v-model="draft"
+        label="Reviewer identities"
+        :rows="5"
+        :disabled="busy"
+        hint="One identity per line, such as user:alex. Requests do not grant access or count as approval."
+        :error="invalid"
+      />
+      <Alert v-if="error" tone="bad" live="alert">{{ error }}</Alert>
+    </form>
+    <template #footer>
+      <Button :disabled="busy" @click="open = false">Cancel</Button>
+      <Button variant="primary" :disabled="!!invalid || !allowed" :loading="busy" @click="save"
+        >Save reviewer requests</Button
+      >
+    </template>
+  </Dialog>
+</template>
+
+<style scoped>
+/* Hallmark · shape: app screen · theme: locked AgentGit · scope: component · v2.0.0 */
+/* Critique: reviewers are a quiet list in the review rail; only the author sees its editing action. */
+.reviewers {
+  min-width: 0;
+}
+.heading {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: var(--s-2);
+}
+h3 {
+  font-size: var(--fs-md);
+  font-weight: 600;
+}
+ul {
+  list-style: none;
+  margin: var(--s-3) 0 0;
+  padding: 0;
+  display: grid;
+  gap: var(--s-3);
+}
+li {
+  display: grid;
+  gap: var(--s-1);
+}
+.status,
+.muted {
+  color: var(--text-2);
+  font-size: var(--fs-sm);
+}
+.muted {
+  margin-top: var(--s-2);
+}
+form {
+  display: grid;
+  gap: var(--s-3);
+}
+</style>
diff --git a/apps/web/src/components/proposal/ReviewsTab.vue b/apps/web/src/components/proposal/ReviewsTab.vue
index feef91ae..22396259 100644
--- a/apps/web/src/components/proposal/ReviewsTab.vue
+++ b/apps/web/src/components/proposal/ReviewsTab.vue
@@ -45,7 +45,7 @@ const stale = (r: Review) => r.head !== props.proposal.head
         >.
       </p>
       <Button
-        variant="primary"
+        variant="secondary"
         icon="check"
         :disabled="!canReview || proposal.state !== 'open'"
         :disabled-reason="
diff --git a/apps/web/src/composables/useProposalData.ts b/apps/web/src/composables/useProposalData.ts
index c56f8172..18641ae5 100644
--- a/apps/web/src/composables/useProposalData.ts
+++ b/apps/web/src/composables/useProposalData.ts
@@ -68,6 +68,7 @@ export function useProposalData(repo: Ref<string>, id: Ref<string>) {
     },
   )
   const proposal = computed(() => detail.data.value?.proposal)
+  const requestedReviewers = computed(() => detail.data.value?.requested_reviewers ?? [])
   const reviews = computed(() => detail.data.value?.reviews ?? [])
 
   const prep = useResource<Preparation | null>(
@@ -111,7 +112,12 @@ export function useProposalData(repo: Ref<string>, id: Ref<string>) {
         },
         { signal },
       )
-      return { ...res, base, head: p.integrated_as || p.head }
+      return {
+        requestedReviewers,
+        ...res,
+        base,
+        head: p.integrated_as || p.head,
+      }
     },
     { immediate: false },
   )
@@ -186,6 +192,7 @@ export function useProposalData(repo: Ref<string>, id: Ref<string>) {
   })
 
   return {
+    requestedReviewers,
     detail,
     proposal,
     reviews,
diff --git a/apps/web/src/views/ProposalView.vue b/apps/web/src/views/ProposalView.vue
index f3ff39bc..bf2abddf 100644
--- a/apps/web/src/views/ProposalView.vue
+++ b/apps/web/src/views/ProposalView.vue
@@ -12,6 +12,7 @@ import ReviewDialog from '@/components/proposal/ReviewDialog.vue'
 import ReviewsTab from '@/components/proposal/ReviewsTab.vue'
 import ProposalComment from '@/components/proposal/ProposalComment.vue'
 import ReviewThreads from '@/components/proposal/ReviewThreads.vue'
+import RequestedReviewers from '@/components/proposal/RequestedReviewers.vue'
 import TimelineTab from '@/components/proposal/TimelineTab.vue'
 import ValidationTab from '@/components/proposal/ValidationTab.vue'
 import { useProposalData } from '@/composables/useProposalData'
@@ -30,7 +31,6 @@ import { useToasts } from '@/stores/toasts'
 import Alert from '@/ui/Alert.vue'
 import Badge from '@/ui/Badge.vue'
 import Button from '@/ui/Button.vue'
-import Card from '@/ui/Card.vue'
 import CopyButton from '@/ui/CopyButton.vue'
 import Dialog from '@/ui/Dialog.vue'
 import ErrorState from '@/ui/ErrorState.vue'
@@ -310,11 +310,31 @@ function changed() {
 
     <template v-else>
       <header class="head">
-        <p class="crumb">
-          <RouterLink :to="`/repos/${repo}/proposals`">Change requests</RouterLink>
-          <span class="faint">/</span>
-          <code class="mono">{{ shortId(proposal.id, 12) }}</code>
-        </p>
+        <div class="crumb-row">
+          <p class="crumb">
+            <RouterLink :to="`/repos/${repo}/proposals`">Change requests</RouterLink>
+            <span class="faint">/</span>
+            <code class="mono">{{ shortId(proposal.id, 12) }}</code>
+          </p>
+          <details class="revision-details">
+            <summary aria-label="Revision details">Details</summary>
+            <ul class="revision-meta" role="list">
+              <li v-if="author?.run" class="faint">
+                run <code class="mono">{{ author.run }}</code>
+              </li>
+              <li v-if="prov?.model" class="faint">
+                model <code class="mono">{{ prov.model }}</code>
+              </li>
+              <li class="faint">
+                head <code class="mono">{{ shortId(proposal.head, 10) }}</code
+                ><CopyButton :text="proposal.head" label="Copy head id" />
+              </li>
+              <li v-if="task" class="faint">
+                task <strong>{{ task.title }}</strong>
+              </li>
+            </ul>
+          </details>
+        </div>
         <div class="title-row">
           <h1 data-testid="proposal-title">
             {{ proposal.title || '(untitled change request)' }}
@@ -330,29 +350,38 @@ function changed() {
             data-testid="proposal-state"
             >{{ proposal.state === 'integrated' ? 'landed' : proposal.state }}</Badge
           >
+          <div v-if="isOpen" class="primary-actions" role="group" aria-label="Primary actions">
+            <Button
+              :variant="can('review') ? 'primary' : 'secondary'"
+              icon="check"
+              :disabled="!can('review')"
+              :disabled-reason="requirementText('review')"
+              data-testid="act-review"
+              @click="reviewing = true"
+              >Review…</Button
+            >
+            <Button
+              :variant="!can('review') && can('integrate') ? 'primary' : 'secondary'"
+              icon="merge"
+              :disabled="!can('integrate')"
+              :disabled-reason="requirementText('integrate')"
+              data-testid="act-integrate"
+              @click="integrating = true"
+              >Land…</Button
+            >
+          </div>
+        </div>
+        <div class="header-context">
+          <ul class="meta" role="list">
+            <li>
+              <IdentityLabel :identity="proposal.author" :size="22" show-kind />
+            </li>
+            <li class="faint">opened <RelativeTime :ms="proposal.created_at_ms" /></li>
+            <li>
+              <Badge mono icon="branch" size="sm">{{ proposal.stream }}</Badge>
+            </li>
+          </ul>
         </div>
-        <ul class="meta" role="list">
-          <li>
-            <IdentityLabel :identity="proposal.author" :size="22" show-kind />
-          </li>
-          <li v-if="author?.run" class="faint">
-            run <code class="mono">{{ author.run }}</code>
-          </li>
-          <li v-if="prov?.model" class="faint">
-            model <code class="mono">{{ prov.model }}</code>
-          </li>
-          <li class="faint">opened <RelativeTime :ms="proposal.created_at_ms" /></li>
-          <li>
-            <Badge mono icon="branch" size="sm">{{ proposal.stream }}</Badge>
-          </li>
-          <li class="faint">
-            head <code class="mono">{{ shortId(proposal.head, 10) }}</code
-            ><CopyButton :text="proposal.head" label="Copy head id" />
-          </li>
-          <li v-if="task" class="faint">
-            task <strong>{{ task.title }}</strong>
-          </li>
-        </ul>
         <p v-if="proposal.description" class="desc">{{ proposal.description }}</p>
       </header>
 
@@ -373,191 +402,216 @@ function changed() {
         >This change request was closed without landing.</Alert
       >
 
-      <Card
-        v-if="states"
-        title="Where it stands"
-        icon="shield"
-        :subtitle="isOpen ? 'Each state is checked on its own' : undefined"
-      >
-        <template v-if="isOpen" #actions>
-          <Button size="sm" icon="refresh" :loading="busy === 'recheck'" @click="recheck"
+      <section v-if="states" class="readiness" aria-label="Merge readiness">
+        <div class="readiness-row">
+          <StateStrip :states="states" compact />
+          <Button
+            v-if="isOpen"
+            size="sm"
+            variant="ghost"
+            class="recheck"
+            icon="refresh"
+            :loading="busy === 'recheck'"
+            @click="recheck"
             >Check again</Button
           >
-        </template>
-        <div class="stand">
-          <StateStrip :states="states" />
-          <p v-if="next" class="next" data-testid="next-step"><strong>Next:</strong> {{ next }}</p>
-          <div
-            v-if="isOpen && prepData && prepData.conflicts.length"
-            class="conflicts"
-            data-testid="conflicts"
+        </div>
+        <p
+          v-if="isOpen && prepData && !blockers.length && !prepData.conflicts.length"
+          class="clear"
+        >
+          Nothing is in the way. This change request can land now.
+        </p>
+        <p
+          v-if="next && (blockers.length || prepData?.conflicts.length || !can('integrate'))"
+          class="next"
+          :class="{ 'after-clear': !blockers.length && !prepData?.conflicts.length }"
+          data-testid="next-step"
+        >
+          <strong>Next:</strong> {{ next }}
+          <a v-if="blockers.length || prepData?.conflicts.length" href="#review-attention"
+            >Details</a
           >
-            <h3>Conflicting paths</h3>
-            <ul role="list">
-              <li v-for="c in prepData.conflicts" :key="c.path">
-                <code class="mono">{{ c.path }}</code>
-                <Badge size="sm" tone="bad">{{ conflictLabel(c) }}</Badge>
-              </li>
-            </ul>
-            <p
-              v-if="prepData.conflicts.some(isDirectoryRenameConflict)"
-              class="faint"
-              data-testid="dir-rename-hint"
-            >
-              One side moved a whole directory while the other changed files under its old name; the
-              merge follows such a move only when it is unambiguous and nothing is in the way.
-            </p>
-            <p class="faint">
-              Nothing is guessed: someone has to choose, file by file, what the result should be.
-            </p>
-            <div class="fixrow">
-              <Button
-                v-for="f in conflictPlan.fixes"
-                :key="f.id"
-                size="sm"
-                :variant="f.id === 'conflict' ? 'primary' : 'secondary'"
-                :data-testid="`fix-${f.id}`"
-                @click="doFix(f.id)"
-                >{{ f.label }}</Button
+        </p>
+      </section>
+
+      <div class="review-layout">
+        <div class="review-content">
+          <Tabs v-model="tab" :tabs="tabs" label="Change request details">
+            <template #changes>
+              <ChangesTab
+                :diff="data.diff.data.value"
+                :review-scope="JSON.stringify([auth.identity, repo, proposal.id])"
+                :can-discuss="
+                  auth.can(repo, 'commentProposal') &&
+                  !!auth.capabilities?.features.includes('proposals.comments')
+                "
+                :loading="data.diff.loading.value"
+                :error="data.diff.error.value"
+                @discuss="discussLine"
+                @retry="data.diff.reload()"
+              />
+            </template>
+            <template #reviews>
+              <ReviewsTab
+                :proposal="proposal"
+                :reviews="data.reviews.value"
+                :summary="data.reviewSummary.value"
+                :can-review="can('review')"
+                :review-reason="requirementText('review')"
+                @review="reviewing = true"
               >
-            </div>
-          </div>
-          <div v-if="isOpen && blockers.length" class="blockers" data-testid="blockers">
-            <h3>What is in the way</h3>
-            <BlockerList :blockers="blockers" hints :plan="planFor" @fix="(id) => doFix(id)" />
-          </div>
-          <p v-else-if="isOpen && prepData && !prepData.conflicts.length" class="clear">
-            Nothing is in the way. This change request can land now.
-          </p>
-          <p v-if="isOpen && data.prep.error.value" class="faint">
-            Could not recompute: {{ (data.prep.error.value as Error).message }}
-          </p>
+                <template #comment>
+                  <ReviewThreads
+                    v-if="threadsSupported"
+                    :repo="repo"
+                    :proposal="proposal"
+                    :quote="lineQuote"
+                    @quoted="lineQuote = null"
+                    @general="useGeneralDiscussion"
+                    @applied="changed" />
+                  <ProposalComment
+                    :repo="repo"
+                    :proposal="proposal"
+                    :quote="generalQuote"
+                    :quote-text="generalQuoteText"
+                    @quoted="generalQuote = null"
+                    @done="changed"
+                /></template>
+              </ReviewsTab>
+            </template>
+            <template #validation>
+              <ValidationTab
+                :prep="prepData"
+                :attestations="data.attestations.data.value ?? []"
+                :can-request="can('requestValidation')"
+                :request-reason="requirementText('requestValidation')"
+                :requesting="busy === 'validate'"
+                :open="isOpen"
+                @request="requestValidation"
+              />
+            </template>
+            <template #provenance>
+              <ProvenanceTab
+                :entries="data.provenance.data.value ?? []"
+                :author-is-agent="authorIsAgent"
+              />
+            </template>
+            <template #timeline>
+              <TimelineTab :repo="repo" :proposal="proposal" />
+            </template>
+          </Tabs>
         </div>
+        <aside class="review-sidebar" aria-label="Review context">
+          <RequestedReviewers
+            :repo="repo"
+            :proposal="proposal"
+            :reviewers="data.requestedReviewers.value"
+            :reviews="data.reviews.value"
+            @saved="changed"
+          />
 
-        <div v-if="isOpen" class="actions" role="group" aria-label="Actions">
-          <Button
-            variant="primary"
-            icon="merge"
-            :disabled="!can('integrate')"
-            :disabled-reason="requirementText('integrate')"
-            data-testid="act-integrate"
-            @click="integrating = true"
-            >Land…</Button
-          >
-          <Button
-            icon="check"
-            :disabled="!can('review')"
-            :disabled-reason="requirementText('review')"
-            data-testid="act-review"
-            @click="reviewing = true"
-            >Review…</Button
-          >
-          <Button
+          <details
             v-if="
-              can('commentProposal') && auth.capabilities?.features.includes('proposals.comments')
-            "
-            icon="comment"
-            @click="tab = 'reviews'"
-            >Discuss…</Button
-          >
-          <Button
-            icon="play"
-            :loading="busy === 'validate'"
-            :disabled="!can('requestValidation')"
-            :disabled-reason="requirementText('requestValidation')"
-            data-testid="act-validate"
-            @click="requestValidation"
-            >Run the checks</Button
-          >
-          <Button
-            icon="stack"
-            :loading="busy === 'enqueue'"
-            :disabled="!can('enqueue')"
-            :disabled-reason="requirementText('enqueue')"
-            data-testid="act-enqueue"
-            @click="enqueue"
-            >Add to queue</Button
-          >
-          <span class="spacer" />
-          <Button
-            variant="danger"
-            icon="x"
-            :disabled="!can('closeProposal')"
-            :disabled-reason="requirementText('closeProposal')"
-            data-testid="act-close"
-            @click="closing = true"
-            >Close…</Button
-          >
-        </div>
-        <ul v-if="isOpen && unavailable.length" class="why" data-testid="unavailable">
-          <li v-for="u in unavailable" :key="u">{{ u }}</li>
-        </ul>
-      </Card>
-
-      <Tabs v-model="tab" :tabs="tabs" label="Change request details">
-        <template #changes>
-          <ChangesTab
-            :diff="data.diff.data.value"
-            :review-scope="JSON.stringify([auth.identity, repo, proposal.id])"
-            :can-discuss="
-              auth.can(repo, 'commentProposal') &&
-              !!auth.capabilities?.features.includes('proposals.comments')
+              isOpen && (blockers.length || prepData?.conflicts.length || data.prep.error.value)
             "
-            :loading="data.diff.loading.value"
-            :error="data.diff.error.value"
-            @discuss="discussLine"
-            @retry="data.diff.reload()"
-          />
-        </template>
-        <template #reviews>
-          <ReviewsTab
-            :proposal="proposal"
-            :reviews="data.reviews.value"
-            :summary="data.reviewSummary.value"
-            :can-review="can('review')"
-            :review-reason="requirementText('review')"
-            @review="reviewing = true"
+            id="review-attention"
+            open
+            class="rail-section policy-details"
           >
-            <template #comment>
-              <ReviewThreads
-                v-if="threadsSupported"
-                :repo="repo"
-                :proposal="proposal"
-                :quote="lineQuote"
-                @quoted="lineQuote = null"
-                @general="useGeneralDiscussion"
-                @applied="changed" />
-              <ProposalComment
-                :repo="repo"
-                :proposal="proposal"
-                :quote="generalQuote"
-                :quote-text="generalQuoteText"
-                @quoted="generalQuote = null"
-                @done="changed"
-            /></template>
-          </ReviewsTab>
-        </template>
-        <template #validation>
-          <ValidationTab
-            :prep="prepData"
-            :attestations="data.attestations.data.value ?? []"
-            :can-request="can('requestValidation')"
-            :request-reason="requirementText('requestValidation')"
-            :requesting="busy === 'validate'"
-            :open="isOpen"
-            @request="requestValidation"
-          />
-        </template>
-        <template #provenance>
-          <ProvenanceTab
-            :entries="data.provenance.data.value ?? []"
-            :author-is-agent="authorIsAgent"
-          />
-        </template>
-        <template #timeline>
-          <TimelineTab :repo="repo" :proposal="proposal" />
-        </template>
-      </Tabs>
+            <summary>What needs attention</summary>
+            <div
+              v-if="isOpen && prepData && prepData.conflicts.length"
+              class="conflicts"
+              data-testid="conflicts"
+            >
+              <h3>Conflicting paths</h3>
+              <ul role="list">
+                <li v-for="c in prepData.conflicts" :key="c.path">
+                  <code class="mono">{{ c.path }}</code>
+                  <Badge size="sm" tone="bad">{{ conflictLabel(c) }}</Badge>
+                </li>
+              </ul>
+              <p
+                v-if="prepData.conflicts.some(isDirectoryRenameConflict)"
+                class="faint"
+                data-testid="dir-rename-hint"
+              >
+                One side moved a whole directory while the other changed files under its old name;
+                the merge follows such a move only when it is unambiguous and nothing is in the way.
+              </p>
+              <p class="faint">
+                Nothing is guessed: someone has to choose, file by file, what the result should be.
+              </p>
+              <div class="fixrow">
+                <Button
+                  v-for="f in conflictPlan.fixes"
+                  :key="f.id"
+                  size="sm"
+                  :variant="f.id === 'conflict' ? 'primary' : 'secondary'"
+                  :data-testid="`fix-${f.id}`"
+                  @click="doFix(f.id)"
+                  >{{ f.label }}</Button
+                >
+              </div>
+            </div>
+            <div v-if="isOpen && blockers.length" class="blockers" data-testid="blockers">
+              <h3>What is in the way</h3>
+              <BlockerList :blockers="blockers" hints :plan="planFor" @fix="(id) => doFix(id)" />
+            </div>
+            <p v-if="isOpen && data.prep.error.value" class="faint">
+              Could not recompute: {{ (data.prep.error.value as Error).message }}
+            </p>
+          </details>
+          <section v-if="isOpen" class="rail-section secondary-actions" aria-label="More actions">
+            <h2>More actions</h2>
+            <Button
+              v-if="
+                can('commentProposal') && auth.capabilities?.features.includes('proposals.comments')
+              "
+              variant="ghost"
+              icon="comment"
+              @click="tab = 'reviews'"
+              >Discuss…</Button
+            >
+            <Button
+              variant="ghost"
+              icon="play"
+              :loading="busy === 'validate'"
+              :disabled="!can('requestValidation')"
+              :disabled-reason="requirementText('requestValidation')"
+              data-testid="act-validate"
+              @click="requestValidation"
+              >Run the checks</Button
+            >
+            <Button
+              variant="ghost"
+              icon="stack"
+              :loading="busy === 'enqueue'"
+              :disabled="!can('enqueue')"
+              :disabled-reason="requirementText('enqueue')"
+              data-testid="act-enqueue"
+              @click="enqueue"
+              >Add to queue</Button
+            >
+            <Button
+              variant="ghost"
+              icon="x"
+              :disabled="!can('closeProposal')"
+              :disabled-reason="requirementText('closeProposal')"
+              data-testid="act-close"
+              @click="closing = true"
+              >Close…</Button
+            >
+          </section>
+          <details v-if="isOpen && unavailable.length" class="rail-section permissions">
+            <summary>Your permissions</summary>
+            <ul class="why" data-testid="unavailable">
+              <li v-for="u in unavailable" :key="u">{{ u }}</li>
+            </ul>
+          </details>
+        </aside>
+      </div>
 
       <ConflictResolver
         v-if="resolving"
@@ -600,6 +654,8 @@ function changed() {
 </template>
 
 <style scoped>
+/* Hallmark · shape: app screen · theme: locked AgentGit · genre: modern-minimal · redesign: full · v2.0.0 */
+/* Critique: code leads; one primary review action, quiet readiness strip and contextual side rail replace the control wall. */
 .proposal {
   display: flex;
   flex-direction: column;
@@ -610,33 +666,27 @@ function changed() {
   flex-direction: column;
   gap: var(--s-3);
 }
-.next {
-  padding: var(--s-2) var(--s-3);
-  background: var(--accent-soft, var(--surface-2));
-  border-radius: var(--r-sm);
-  font-size: var(--fs-sm);
-}
-.fixrow {
+.head {
   display: flex;
+  flex-direction: column;
   gap: var(--s-2);
-  flex-wrap: wrap;
-  margin-top: var(--s-2);
-}
-.why {
-  list-style: none;
-  margin: var(--s-3) 0 0;
-  padding: 0;
-  color: var(--text-2);
-  font-size: var(--fs-xs);
 }
-.head {
+.crumb-row {
   display: flex;
-  flex-direction: column;
+  justify-content: space-between;
+  align-items: baseline;
   gap: var(--s-2);
+  flex-wrap: wrap;
+}
+.revision-details[open] {
+  flex-basis: 100%;
 }
 .crumb {
   font-size: var(--fs-sm);
   color: var(--text-2);
+  display: flex;
+  gap: var(--s-1);
+  align-items: baseline;
 }
 .title-row {
   display: flex;
@@ -645,22 +695,54 @@ function changed() {
   flex-wrap: wrap;
 }
 h1 {
-  overflow-wrap: anywhere;
+  overflow-wrap: break-word;
+  min-width: 0;
 }
-.meta {
+.primary-actions {
+  margin-left: auto;
+  display: flex;
+  gap: var(--s-2);
+}
+.meta,
+.revision-meta {
   list-style: none;
   margin: 0;
   padding: 0;
+  font-size: var(--fs-sm);
+}
+.header-context {
   display: flex;
   align-items: center;
+  gap: var(--s-4);
   flex-wrap: wrap;
-  gap: var(--s-2) var(--s-4);
+}
+.revision-details {
+  color: var(--text-2);
   font-size: var(--fs-sm);
 }
-.meta li {
-  display: inline-flex;
+.revision-details summary {
+  cursor: pointer;
+}
+.meta {
+  display: flex;
+  align-items: center;
+  gap: var(--s-3);
+  flex-wrap: wrap;
+}
+.meta li,
+.revision-meta li {
+  display: flex;
   align-items: center;
-  gap: 4px;
+  gap: var(--s-1);
+  min-width: 0;
+}
+.revision-meta {
+  display: grid;
+  gap: var(--s-3);
+  margin-top: var(--s-3);
+}
+.revision-meta code {
+  overflow-wrap: anywhere;
 }
 .desc {
   white-space: pre-wrap;
@@ -668,21 +750,88 @@ h1 {
   color: var(--text-2);
   max-width: 90ch;
 }
-.stand {
+.readiness {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto;
+  gap: var(--s-2) var(--s-3);
+  padding: var(--s-3) 0;
+  border-top: 1px solid var(--border);
+  border-bottom: 1px solid var(--border);
+}
+.readiness-row {
+  display: contents;
+}
+.readiness-row :deep(.strip) {
+  grid-column: 1;
+  grid-row: 1;
+  align-self: center;
+}
+.recheck {
+  grid-column: 2;
+  grid-row: 1;
+}
+.clear,
+.next {
+  grid-column: 1 / -1;
+  font-size: var(--fs-sm);
+}
+.clear {
+  color: var(--text-2);
+}
+.next {
+  color: var(--text);
+}
+.review-layout {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) 252px;
+  align-items: start;
+  gap: var(--s-6);
+}
+.review-content,
+.review-sidebar {
+  min-width: 0;
+}
+.review-sidebar {
+  display: grid;
+  gap: var(--s-5);
+  padding-top: var(--s-2);
+}
+.rail-section {
+  border-top: 1px solid var(--border);
+  padding-top: var(--s-4);
+}
+.rail-section summary,
+.secondary-actions h2 {
+  font-size: var(--fs-md);
+  font-weight: 600;
+}
+.rail-section summary {
+  cursor: pointer;
+}
+.secondary-actions {
   display: flex;
   flex-direction: column;
-  gap: var(--s-3);
+  align-items: flex-start;
+  gap: var(--s-1);
+}
+.secondary-actions h2 {
+  margin-bottom: var(--s-2);
+}
+.secondary-actions :deep(.btn) {
+  margin-left: calc(-1 * var(--s-3));
+}
+.why {
+  list-style: none;
+  margin: var(--s-3) 0 0;
+  padding: 0;
+  color: var(--text-2);
+  font-size: var(--fs-sm);
+  display: grid;
+  gap: var(--s-2);
 }
 .conflicts,
 .blockers {
-  padding: var(--s-3);
-  border-radius: var(--r-sm);
-  border: 1px solid var(--border);
-  background: var(--surface-2);
-}
-.conflicts {
-  border-color: var(--bad-line);
-  background: var(--bad-soft);
+  padding-top: var(--s-3);
 }
 h3 {
   font-size: var(--fs-sm);
@@ -692,24 +841,67 @@ h3 {
   list-style: none;
   margin: 0 0 var(--s-2);
   padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 4px;
+  display: grid;
+  gap: var(--s-2);
 }
-.clear {
-  color: var(--ok);
-  font-weight: 560;
+.conflicts li {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--s-2);
 }
-.actions {
+.fixrow {
   display: flex;
   flex-wrap: wrap;
   gap: var(--s-2);
-  align-items: center;
-  margin-top: var(--s-4);
-  padding-top: var(--s-4);
-  border-top: 1px solid var(--border);
+  margin-top: var(--s-3);
 }
-.spacer {
-  flex: 1;
+@media (max-width: 1000px) {
+  .review-layout {
+    grid-template-columns: minmax(0, 1fr);
+    gap: var(--s-5);
+  }
+  .review-sidebar {
+    border-top: 1px solid var(--border);
+    padding-top: var(--s-5);
+  }
+}
+@media (max-width: 600px) {
+  .primary-actions {
+    width: 100%;
+    margin-left: 0;
+  }
+  .primary-actions :deep(.btn) {
+    flex: 1;
+  }
+  .readiness-row :deep(.strip) {
+    grid-column: 1 / -1;
+    grid-row: 1;
+  }
+  .recheck {
+    grid-column: 2;
+    grid-row: 2;
+    align-self: center;
+  }
+  .clear,
+  .next {
+    grid-column: 1;
+    grid-row: 2;
+    align-self: center;
+  }
+  .next.after-clear {
+    grid-column: 1 / -1;
+    grid-row: 3;
+  }
+  .recheck :deep(.text) {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    padding: 0;
+    margin: -1px;
+    overflow: hidden;
+    clip: rect(0, 0, 0, 0);
+    white-space: nowrap;
+    border: 0;
+  }
 }
 </style>
diff --git a/apps/web/src/views/ProposalsView.spec.ts b/apps/web/src/views/ProposalsView.spec.ts
index e2611cc2..5e8bb9f7 100644
--- a/apps/web/src/views/ProposalsView.spec.ts
+++ b/apps/web/src/views/ProposalsView.spec.ts
@@ -1,6 +1,7 @@
 import { enableAutoUnmount, flushPromises, mount } from '@vue/test-utils'
 import { createMemoryHistory, createRouter, RouterView } from 'vue-router'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { reactive } from 'vue'
 import LoadMore from '@/ui/LoadMore.vue'
 import ProposalsView from './ProposalsView.vue'
 
@@ -8,7 +9,13 @@ enableAutoUnmount(afterEach)
 afterEach(() => vi.useRealTimers())
 const list = vi.hoisted(() => vi.fn())
 vi.mock('@/api/instance', () => ({ api: { proposals: { list } } }))
-vi.mock('@/stores/auth', () => ({ useAuth: () => ({ can: () => false }) }))
+const auth = reactive({
+  can: () => false,
+  identity: 'user:bob',
+  token: 'session',
+  capabilities: { features: [] as string[] },
+})
+vi.mock('@/stores/auth', () => ({ useAuth: () => auth }))
 const page = (title: string, nextPageToken = '') => ({
   items: [
     { id: title, title, author: 'user:alice', stream: 'main', state: 'open', updated_at_ms: 1 },
@@ -16,6 +23,9 @@ const page = (title: string, nextPageToken = '') => ({
   nextPageToken,
 })
 beforeEach(() => {
+  auth.identity = 'user:bob'
+  auth.token = 'session'
+  auth.capabilities.features = []
   vi.useFakeTimers()
   list.mockReset().mockResolvedValue(page('First request', 'next-page'))
 })
@@ -211,3 +221,33 @@ describe('change request filter navigation', () => {
     )
   })
 })
+
+describe('requested-reviewer routing', () => {
+  it('uses the current principal in bookmarked filters and preserves the filter on pages', async () => {
+    auth.capabilities.features = ['proposals.review_requests']
+    const { w } = await show('/repos/acme/demo/proposals?reviewer=me')
+    expect(list.mock.lastCall![1].requested_reviewer).toBe('user:bob')
+    w.findComponent(LoadMore).vm.$emit('more')
+    await flushPromises()
+    expect(list.mock.lastCall![1]).toMatchObject({
+      requested_reviewer: 'user:bob',
+      page_token: 'next-page',
+    })
+    auth.identity = 'user:carol'
+    await vi.advanceTimersByTimeAsync(200)
+    await flushPromises()
+    expect(list.mock.lastCall![1].requested_reviewer).toBe('user:carol')
+    expect(list.mock.lastCall![1].page_token).toBeUndefined()
+  })
+
+  it('does not show an unfiltered queue when an older server cannot honor the bookmark', async () => {
+    const { w } = await show('/repos/acme/demo/proposals?reviewer=me')
+    expect(list).not.toHaveBeenCalled()
+    expect(w.text()).toContain('does not support requested-reviewer filtering')
+    await w.get('input[type=checkbox]').setValue(false)
+    await vi.advanceTimersByTimeAsync(200)
+    await flushPromises()
+    expect(list).toHaveBeenCalledOnce()
+    expect(list.mock.lastCall![1].requested_reviewer).toBeUndefined()
+  })
+})
diff --git a/apps/web/src/views/ProposalsView.vue b/apps/web/src/views/ProposalsView.vue
index 96c5d01f..ed775c97 100644
--- a/apps/web/src/views/ProposalsView.vue
+++ b/apps/web/src/views/ProposalsView.vue
@@ -6,6 +6,8 @@ import type { Proposal } from '@/api/types'
 import { useRepoName } from '@/composables/useRepoName'
 import { usePageTitle } from '@/composables/usePageTitle'
 import { shortId } from '@/lib/format'
+import { parseIdentity } from '@/lib/identity'
+import Checkbox from '@/ui/Checkbox.vue'
 import Badge from '@/ui/Badge.vue'
 import Button from '@/ui/Button.vue'
 import Icon from '@/ui/Icon.vue'
@@ -40,26 +42,43 @@ const readText = (value: unknown): string => (typeof value === 'string' ? value
 const state = ref(readState(route.query.state))
 const author = ref(readText(route.query.author))
 const query = ref(readText(route.query.q))
+const reviewRequested = ref(route.query.reviewer === 'me')
 function syncFilters() {
   state.value = readState(route.query.state)
   author.value = readText(route.query.author)
   query.value = readText(route.query.q)
+  reviewRequested.value = route.query.reviewer === 'me'
 }
-watch([() => route.query.state, () => route.query.author, () => route.query.q], syncFilters)
-function updateFilters(values: Partial<{ state: StateFilter; author: string; q: string }>) {
+watch(
+  [
+    () => route.query.state,
+    () => route.query.author,
+    () => route.query.q,
+    () => route.query.reviewer,
+  ],
+  syncFilters,
+)
+function updateFilters(
+  values: Partial<{ state: StateFilter; author: string; q: string; reviewer: boolean }>,
+) {
   state.value = values.state ?? state.value
   author.value = values.author ?? author.value
   query.value = values.q ?? query.value
+  reviewRequested.value = values.reviewer ?? reviewRequested.value
   void router.replace({
     query: {
       ...route.query,
       state: state.value === 'open' ? undefined : state.value,
       author: author.value || undefined,
       q: query.value || undefined,
+      reviewer: reviewRequested.value ? 'me' : undefined,
     },
   })
 }
 const auth = useAuth()
+const reviewRequestsSupported = computed(
+  () => !!auth.capabilities?.features.includes('proposals.review_requests'),
+)
 const items = ref<Proposal[]>([])
 const next = ref('')
 const loading = ref(true)
@@ -98,9 +117,14 @@ async function load(append = false) {
   const mine = startLoad(append)
   if (mine === null) return
   try {
+    if (reviewRequested.value && !reviewRequestsSupported.value)
+      throw new Error('This server does not support requested-reviewer filtering.')
     const page = await api.proposals.list(repo.value, {
       state: state.value === 'all' ? undefined : state.value,
       author: author.value.trim() || undefined,
+      requested_reviewer: reviewRequested.value
+        ? parseIdentity(auth.identity).principal
+        : undefined,
       page_size: 50,
       page_token: append ? next.value : undefined,
     })
@@ -118,16 +142,27 @@ async function load(append = false) {
 }
 
 let timer: ReturnType<typeof setTimeout> | undefined
-watch([state, author, repo], () => {
-  serial++
-  items.value = []
-  next.value = ''
-  more.value = false
-  loading.value = true
-  error.value = null
-  clearTimeout(timer)
-  timer = setTimeout(() => void load(), 200)
-})
+watch(
+  [
+    state,
+    author,
+    repo,
+    reviewRequested,
+    reviewRequestsSupported,
+    () => auth.identity,
+    () => auth.token,
+  ],
+  () => {
+    serial++
+    items.value = []
+    next.value = ''
+    more.value = false
+    loading.value = true
+    error.value = null
+    clearTimeout(timer)
+    timer = setTimeout(() => void load(), 200)
+  },
+)
 onBeforeUnmount(() => {
   serial++
   clearTimeout(timer)
@@ -170,6 +205,12 @@ const rows = computed(() => {
       </div>
     </div>
     <div class="tools">
+      <Checkbox
+        v-if="reviewRequestsSupported || reviewRequested"
+        :model-value="reviewRequested"
+        label="Review requested from me"
+        @update:model-value="updateFilters({ reviewer: $event })"
+      />
       <Segmented
         :model-value="state"
         legend="State"
diff --git a/docs/guides/web-ui.md b/docs/guides/web-ui.md
index 0dacf12f..43d179fc 100644
--- a/docs/guides/web-ui.md
+++ b/docs/guides/web-ui.md
@@ -595,6 +595,21 @@ Counts are marked as partial when more pages are available; use **Load more
 discussions** to include older threads. Switching filters preserves expanded
 reply drafts.
 
+### Request reviewers (development)
+
+The author of an open change request can choose **Request review** in its reviewer panel.
+Enter up to 20 identities, one per line, and confirm. This requests attention; it does not
+grant repository access, require approval in policy, or count as a review. Removing an identity
+from the list withdraws that request. If another edit wins first, your draft remains available.
+
+The panel marks a request reviewed only after that person approves or requests changes on
+the current revision. A new revision keeps the requested list and makes prior reviews pending
+again. On **Change requests**, select **Review requested from me** to filter before pagination;
+the URL can be bookmarked. Servers without this capability cannot apply that filter.
+
+This feature requires metadata schema 9. Back up before upgrading a repository; restore that
+pre-upgrade backup to return to beta.7 or older. See [ADR 0036](../adr/0036-requested-reviewers.md).
+
 ### Suggest a code change (development)
 
 Select a new-side line number in **Files changed**, then **Suggest a replacement**. Explain

From eb8acbf4787487d29a49a7283e5a59cf5c1ff4bb Mon Sep 17 00:00:00 2001
From: Codex <codex@openai.com>
Date: Thu, 29 Oct 2026 21:01:12 +0000
Subject: [PATCH 05/41] style: format requested-reviewer additions

---
 crates/ag-server/src/api/proposals.rs | 8 ++++++--
 crates/ag-storage/src/meta/tests.rs   | 8 +++++++-
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/crates/ag-server/src/api/proposals.rs b/crates/ag-server/src/api/proposals.rs
index b9f0b0cc..80c7df47 100644
--- a/crates/ag-server/src/api/proposals.rs
+++ b/crates/ag-server/src/api/proposals.rs
@@ -67,8 +67,12 @@ impl App {
             let requested_reviewer = if req.requested_reviewer.is_empty() {
                 None
             } else {
-                Some(ag_types::Identity::new(&req.requested_reviewer)
-                    .map_err(|e| ApiError::invalid(e.to_string()))?.principal().to_string())
+                Some(
+                    ag_types::Identity::new(&req.requested_reviewer)
+                        .map_err(|e| ApiError::invalid(e.to_string()))?
+                        .principal()
+                        .to_string(),
+                )
             };
             let filter = ProposalFilter {
                 state: state.as_deref(),
diff --git a/crates/ag-storage/src/meta/tests.rs b/crates/ag-storage/src/meta/tests.rs
index 6bf9525a..6099f95e 100644
--- a/crates/ag-storage/src/meta/tests.rs
+++ b/crates/ag-storage/src/meta/tests.rs
@@ -928,5 +928,11 @@ fn schema_eight_review_requests_migrate_and_persist_without_changing_backup() {
     assert_eq!(reopened.read(|tx| tx.proposal("prop_old")).unwrap().unwrap().title, "Keep old review");
     let untouched = rusqlite::Connection::open(&backup).unwrap();
     assert_eq!(untouched.pragma_query_value(None, "user_version", |row| row.get::<_, i64>(0)).unwrap(), 8);
-    assert_eq!(untouched.query_row("SELECT COUNT(*) FROM sqlite_master WHERE name='proposal_reviewers'", [], |row| row.get::<_, i64>(0)).unwrap(), 0);
+    assert_eq!(
+        untouched
+            .query_row("SELECT COUNT(*) FROM sqlite_master WHERE name='proposal_reviewers'", [], |row| row
+                .get::<_, i64>(0))
+            .unwrap(),
+        0
+    );
 }

From 35592e67467fd647b6dc9bdc288a496859a868d2 Mon Sep 17 00:00:00 2001
From: Codex <codex@openai.com>
Date: Thu, 29 Oct 2026 21:09:13 +0000
Subject: [PATCH 06/41] feat(review): resolve non-text conflicts against pinned
 revisions

Keep original blobs, types and executable modes when choosing conflict versions. Compare the inspected branch before merge preparation and in the workspace commit transaction; preserve proposal-head CAS and session-bound cleanup. Expose the target in HTTP/gRPC, SDKs and MCP, and retry sync automatically only when pinned. No storage migration.

Validation: 150 engine tests, HTTP/gRPC pin regression, 812 web tests and six real-server browser cases, 107 MCP tests, 174 TypeScript and 198 Python SDK tests. Type/lint/build, workspace clippy, generator and documentation checks pass.
---
 CHANGELOG.md                                  |   6 +
 ROADMAP.md                                    |   2 +-
 apps/web/e2e/nontext-conflicts.spec.ts        | 157 +++++++++
 apps/web/playwright.config.ts                 |   2 +-
 apps/web/src/api/endpoints.spec.ts            |  15 +
 apps/web/src/api/endpoints.ts                 |  22 +-
 apps/web/src/api/schema.gen.ts                |  12 +
 apps/web/src/api/types.ts                     |   4 +-
 .../proposal/ConflictResolver.spec.ts         | 233 +++++++++++++
 .../components/proposal/ConflictResolver.vue  | 318 +++++++++++-------
 apps/web/src/lib/conflictResolution.spec.ts   | 127 +++++++
 apps/web/src/lib/conflictResolution.ts        |  77 +++++
 apps/web/src/lib/edit-next.spec.ts            |  12 +-
 apps/web/src/lib/edit.ts                      |  14 +-
 crates/ag-integrate/src/virtual_ws.rs         |  68 +++-
 .../tests/workspace_concurrency.rs            |  35 ++
 crates/ag-mcp/src/prompts.rs                  |   9 +-
 crates/ag-mcp/src/tools/workspace.rs          | 205 +++++++++--
 crates/ag-mcp/tests/sync_precondition.rs      |  76 +++++
 crates/ag-protocol/build.rs                   |   1 +
 crates/ag-protocol/proto/agwp/v1/agwp.proto   |   6 +
 crates/ag-protocol/src/lib.rs                 |   4 +
 crates/ag-server/src/api/workspaces.rs        |  45 ++-
 crates/ag-server/tests/pinned_sync.rs         |  64 ++++
 docs/adr/0037-pinned-workspace-sync.md        |  33 ++
 docs/adr/README.md                            |   2 +
 docs/guides/web-ui.md                         |  11 +-
 docs/protocol/agwp-v1.md                      |  13 +
 docs/protocol/openapi.json                    |  10 +
 proto/agwp/v1/agwp.proto                      |   6 +
 sdk/api-policy.json                           |   4 +-
 sdk/python/README.md                          |  19 ++
 sdk/python/src/agentgit/_generated/models.py  |   2 +
 .../src/agentgit/_generated/namespaces.py     |   6 +-
 .../src/agentgit/_generated/operations.py     |   3 +-
 sdk/python/tests/test_all_operations.py       |   6 +
 sdk/python/tests/test_sync_precondition.py    |  98 ++++++
 sdk/typescript/README.md                      |  18 +
 sdk/typescript/scripts/generate.mjs           |  11 +-
 sdk/typescript/src/generated/operations.ts    |   3 +-
 sdk/typescript/src/generated/schema.ts        |  11 +
 sdk/typescript/test/all-operations.test.ts    |   6 +
 sdk/typescript/test/sync-precondition.test.ts |  75 +++++
 43 files changed, 1643 insertions(+), 208 deletions(-)
 create mode 100644 apps/web/e2e/nontext-conflicts.spec.ts
 create mode 100644 apps/web/src/components/proposal/ConflictResolver.spec.ts
 create mode 100644 apps/web/src/lib/conflictResolution.spec.ts
 create mode 100644 apps/web/src/lib/conflictResolution.ts
 create mode 100644 crates/ag-mcp/tests/sync_precondition.rs
 create mode 100644 crates/ag-server/tests/pinned_sync.rs
 create mode 100644 docs/adr/0037-pinned-workspace-sync.md
 create mode 100644 sdk/python/tests/test_sync_precondition.py
 create mode 100644 sdk/typescript/test/sync-precondition.test.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2bd885e4..fd983509 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,12 +14,18 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Added
 
+- Browser conflict resolution can keep either exact binary, oversized or file-type version while preserving blob bytes, executable mode and symlink type. Virtual sync pins the inspected branch through its final transaction and reports its exact target to SDK/MCP clients.
+
 - Authors can request specific reviewers with an inspected-list update across the API and clients. Requests survive new revisions, never grant access or count as approval, and can be filtered before proposal pagination. Development metadata schema 9 requires a pre-upgrade backup.
 
 - Review suggestions can replace up to 100 consecutive original lines. Range drafts survive reload, previews show the source file, and batches reject overlapping ranges before publication. Existing one-line suggestions keep their original format.
 
 - Authors can preview and apply selected review suggestions across files as one proposal revision. Exact source lines, executable mode, BOM and line endings are preserved; conflicting selections are refused and discussions remain open.
 
+### Fixed
+
+- SDKs retry workspace sync automatically only when a nonempty inspected branch head guards the operation. Unguarded calls require explicit unsafe-retry opt-in.
+
 ### Changed
 
 - The review workspace puts changed code first, keeps Review and Land in the header, and moves secondary actions and context into a quieter side panel. Phone layouts use a compact readiness strip and file navigation. All review, validation and permission states remain available.
diff --git a/ROADMAP.md b/ROADMAP.md
index 5440c712..482947bd 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -106,7 +106,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    rechecks the proposal head and open state. Single-line, range and batched suggestions support explicit author preview and application across files in one revision. Requested reviewers route work across Web UI, CLI, MCP and SDKs without changing approval policy. Optional policy-required line-discussion resolution is now implemented
    across core, API, CLI explanations and Web UI. Preserve drafts, exact-head
    checks and explicit confirmation when a user changes executable work or a review decision.
-   Account-backed drafts and non-text conflict resolution remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
+   Binary, oversized and file-type conflicts now support exact version choices; structural rename/file-directory conflicts and account-backed drafts remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
    polling for the aggregate view. A cross-repository event feed remains future work.
 3. **Make GitHub/GitLab cutover complete.** Code history, branch/tag mapping, the original bundle
    and reconciliation already move through Web UI and CLI. Next design and implement resumable
diff --git a/apps/web/e2e/nontext-conflicts.spec.ts b/apps/web/e2e/nontext-conflicts.spec.ts
new file mode 100644
index 00000000..a6e78454
--- /dev/null
+++ b/apps/web/e2e/nontext-conflicts.spec.ts
@@ -0,0 +1,157 @@
+import { test, expect } from './fixtures.ts'
+import { freshRepo, commitFiles, openProposal, integrate } from './support/world.ts'
+import type { Cast } from './support/world.ts'
+
+async function conflict(cast: Cast) {
+  const { repo } = await freshRepo(cast, 'nontext-conflict', {
+    'asset.bin': new Uint8Array([0, 1]),
+    launch: 'base\n',
+  })
+  const alice = cast.as('alice'),
+    dana = cast.as('dana')
+  const ours = await commitFiles(
+    alice,
+    repo,
+    { 'asset.bin': new Uint8Array([0, 2]), launch: 'local\n' },
+    'Change asset and launcher',
+  )
+  const mine = await alice.ok_(
+    alice.post(`/v1/repos/${repo}/workspaces/${ours.workspace}/changes`, {
+      changes: [
+        {
+          path: 'asset.bin',
+          op: 'put',
+          content: Buffer.from([0, 2]).toString('base64'),
+          executable: true,
+        },
+      ],
+      expected_head: ours.head,
+      message: 'Keep asset executable',
+    }),
+    'set exact local mode',
+  )
+  const proposal = await openProposal(alice, repo, {
+    head: mine.head,
+    title: 'Review non-text conflicts',
+  })
+  const other = await commitFiles(
+    dana,
+    repo,
+    { 'asset.bin': new Uint8Array([0, 3]) },
+    'Upstream asset',
+  )
+  const branch = await dana.ok_(
+    dana.post(`/v1/repos/${repo}/workspaces/${other.workspace}/changes`, {
+      changes: [
+        {
+          path: 'launch',
+          op: 'put',
+          content: Buffer.from('branch-target').toString('base64'),
+          file_type: 'symlink',
+        },
+      ],
+      expected_head: other.head,
+      message: 'Launcher becomes a link',
+    }),
+    'set upstream link',
+  )
+  const upstream = await openProposal(dana, repo, {
+    head: branch.head,
+    title: 'Land upstream versions',
+  })
+  await integrate(cast.as('carol'), repo, upstream.id)
+  return { repo, alice, dana, mine, branch, proposal }
+}
+
+test('an author keeps exact binary and symlink versions without a text round trip', async ({
+  cast,
+  openAs,
+}, info) => {
+  const { repo, alice, mine, branch, proposal } = await conflict(cast)
+  const sourceAsset = await alice.ok_(
+    alice.get(`/v1/repos/${repo}/tree/resolve?rev=${mine.head}&path=asset.bin`),
+    'read local asset identity',
+  )
+  const sourceLink = await alice.ok_(
+    alice.get(`/v1/repos/${repo}/tree/resolve?rev=${branch.head}&path=launch`),
+    'read branch link identity',
+  )
+  const page = await openAs('alice')
+  await page.goto(`/repos/${repo}/proposals/${proposal.id}`)
+  await page.getByTestId('fix-conflict').click()
+  const resolver = page.getByTestId('resolver')
+  await expect(resolver.locator('[data-path="asset.bin"]')).toBeVisible()
+  await expect(page.getByTestId('resolve-save')).toBeDisabled()
+  await expect(resolver.locator('textarea')).toHaveCount(0)
+  await resolver
+    .locator('[data-path="asset.bin"]')
+    .getByRole('button', { name: 'Keep mine', exact: true })
+    .click()
+  await resolver
+    .locator('[data-path="launch"]')
+    .getByRole('button', { name: 'Keep the branch’s', exact: true })
+    .click()
+  await page.screenshot({ path: info.outputPath('nontext-resolution.png'), fullPage: true })
+  await page.getByTestId('resolve-save').click()
+  await expect(page.getByRole('dialog')).toHaveCount(0)
+  const detail = await alice.ok_(
+    alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'read resolved revision',
+  )
+  expect(detail.proposal.head).not.toBe(mine.head)
+  for (const [path, source] of [
+    ['asset.bin', sourceAsset.entry],
+    ['launch', sourceLink.entry],
+  ]) {
+    const resolved = await alice.ok_(
+      alice.get(`/v1/repos/${repo}/tree/resolve?rev=${detail.proposal.head}&path=${path}`),
+      'read preserved entry',
+    )
+    expect(resolved.entry).toMatchObject({
+      blob_id: source.blob_id,
+      file_type: source.file_type,
+      executable: source.executable,
+    })
+  }
+  await page.close()
+})
+
+test('a branch change keeps selected resolutions and cannot publish a stale merge', async ({
+  cast,
+  openAs,
+  allowConsole,
+}) => {
+  const { repo, alice, dana, mine, proposal } = await conflict(cast)
+  const page = await openAs('alice')
+  await page.goto(`/repos/${repo}/proposals/${proposal.id}`)
+  await page.getByTestId('fix-conflict').click()
+  const resolver = page.getByTestId('resolver')
+  await resolver
+    .locator('[data-path="asset.bin"]')
+    .getByRole('button', { name: 'Keep mine', exact: true })
+    .click()
+  await resolver
+    .locator('[data-path="launch"]')
+    .getByRole('button', { name: 'Keep the branch’s', exact: true })
+    .click()
+  const next = await commitFiles(
+    dana,
+    repo,
+    { 'later.txt': 'new upstream work' },
+    'Advance branch after inspection',
+  )
+  const upstream = await openProposal(dana, repo, { head: next.head, title: 'Later upstream work' })
+  await integrate(cast.as('carol'), repo, upstream.id)
+  allowConsole(/status of 412.*\/workspaces\/[^/]+\/sync\]$/)
+  await page.getByTestId('resolve-save').click()
+  await expect(page.getByRole('dialog')).toContainText(
+    'Your resolution has not replaced the newer changes',
+  )
+  await expect(page.getByTestId('resolve-save')).toBeDisabled()
+  const current = await alice.ok_(
+    alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'read retained proposal',
+  )
+  expect(current.proposal.head).toBe(mine.head)
+  await page.close()
+})
diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts
index df48e804..4d7676fd 100644
--- a/apps/web/playwright.config.ts
+++ b/apps/web/playwright.config.ts
@@ -26,7 +26,7 @@ const screenshots = /screenshots\.spec\.ts/
 // Layout assertions are made at the viewports of the tablet and phone projects, not at desktop size.
 const layout = /responsive\.spec\.ts/
 const small =
-  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|review-requests|required-discussions|draft-recovery|review-drafts|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
+  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|nontext-conflicts|review-requests|required-discussions|draft-recovery|review-drafts|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
 const desktop = { viewport: { width: 1440, height: 900 } }
 
 export default defineConfig({
diff --git a/apps/web/src/api/endpoints.spec.ts b/apps/web/src/api/endpoints.spec.ts
index 74007885..5a337b15 100644
--- a/apps/web/src/api/endpoints.spec.ts
+++ b/apps/web/src/api/endpoints.spec.ts
@@ -168,3 +168,18 @@ it('sends requested reviewers and the inspected set to the encoded proposal path
     expected_reviewers: ['user:carol'],
   })
 })
+
+it('pins virtual sync to the inspected branch while retaining the initiating session', async () => {
+  const request = vi
+    .fn<typeof fetch>()
+    .mockResolvedValue(new Response('{}', { headers: { 'content-type': 'application/json' } }))
+  const client = new ApiClient({ getToken: () => 'new-session', fetch: request })
+  await createApi(client).workspaces.sync('acme/repo', 'w/one', [], {
+    token: 'original-session',
+    expectedStreamHead: 'inspected',
+  })
+  const [url, options] = request.mock.calls[0]!
+  expect(String(url)).toContain('/workspaces/w%2Fone/sync')
+  expect(JSON.parse(String(options?.body))).toEqual({ expected_stream_head: 'inspected' })
+  expect(new Headers(options?.headers).get('authorization')).toBe('Bearer original-session')
+})
diff --git a/apps/web/src/api/endpoints.ts b/apps/web/src/api/endpoints.ts
index 29ccf0dc..46142e07 100644
--- a/apps/web/src/api/endpoints.ts
+++ b/apps/web/src/api/endpoints.ts
@@ -389,12 +389,24 @@ export function createApi(c: ApiClient) {
         o?: SessionOpts,
       ) => c.post<Workspace>(r(repo, `/workspaces/${encodeURIComponent(name)}/changes`), body, o),
       /** Brings the stream head in. Conflicts change nothing until every one has a resolution. */
-      sync: (repo: string, name: string, resolutions: FileChange[] = [], o?: Opts) =>
-        c.post<SyncWorkspaceResponse>(
+      sync: (
+        repo: string,
+        name: string,
+        resolutions: FileChange[] = [],
+        options?: SessionOpts & { expectedStreamHead?: string },
+      ) => {
+        const { expectedStreamHead, ...request } = options ?? {}
+        return c.post<SyncWorkspaceResponse>(
           r(repo, `/workspaces/${encodeURIComponent(name)}/sync`),
-          resolutions.length ? { resolutions } : {},
-          o,
-        ),
+          {
+            ...(resolutions.length ? { resolutions } : {}),
+            ...(expectedStreamHead !== undefined
+              ? { expected_stream_head: expectedStreamHead }
+              : {}),
+          },
+          request,
+        )
+      },
       remove: (repo: string, name: string, o?: SessionOpts) =>
         c.del<Record<string, never>>(
           r(repo, `/workspaces/${encodeURIComponent(name)}`),
diff --git a/apps/web/src/api/schema.gen.ts b/apps/web/src/api/schema.gen.ts
index 8788414f..f1941b45 100644
--- a/apps/web/src/api/schema.gen.ts
+++ b/apps/web/src/api/schema.gen.ts
@@ -4801,6 +4801,12 @@ export interface components {
       signature: string
     }
     SyncWorkspaceRequest: {
+      /**
+       * @description Optional branch revision inspected while preparing these resolutions.
+       *     A mismatch refuses the sync without moving the workspace.
+       * @default
+       */
+      expected_stream_head: string
       /**
        * @description Accepted and ignored: this operation does not deduplicate (see Conventions above).
        * @default
@@ -4828,6 +4834,12 @@ export interface components {
        * @default
        */
       status: string
+      /**
+       * @description Exact branch revision used for this attempt; empty for an empty branch.
+       *     Older servers omit this field; negotiate workspaces.sync_precondition.
+       * @default
+       */
+      stream_head: string
     }
     Task: {
       /**
diff --git a/apps/web/src/api/types.ts b/apps/web/src/api/types.ts
index c72eda4f..aa90cf2d 100644
--- a/apps/web/src/api/types.ts
+++ b/apps/web/src/api/types.ts
@@ -41,7 +41,9 @@ type OpenObject = Record<string, unknown>
 export type Blocker = Omit<S['Blocker'], 'detail'> & { detail?: OpenObject }
 export type Conflict = S['Conflict']
 export type Workspace = S['Workspace']
-export type SyncWorkspaceResponse = S['SyncWorkspaceResponse']
+// Older servers omit the pinned target revision.
+export type SyncWorkspaceResponse = Omit<S['SyncWorkspaceResponse'], 'stream_head'> &
+  Partial<Pick<S['SyncWorkspaceResponse'], 'stream_head'>>
 export type ValidationStatus = S['ValidationStatus']
 export type Attestation = S['Attestation']
 export type QueueEntry = S['QueueEntry']
diff --git a/apps/web/src/components/proposal/ConflictResolver.spec.ts b/apps/web/src/components/proposal/ConflictResolver.spec.ts
new file mode 100644
index 00000000..5ef4ffde
--- /dev/null
+++ b/apps/web/src/components/proposal/ConflictResolver.spec.ts
@@ -0,0 +1,233 @@
+import { enableAutoUnmount, flushPromises, mount } from '@vue/test-utils'
+import { reactive } from 'vue'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { Proposal } from '@/api/types'
+import { ApiError } from '@/api/errors'
+import ConflictResolver from './ConflictResolver.vue'
+
+enableAutoUnmount(afterEach)
+const api = vi.hoisted(() => ({
+  workspaces: { create: vi.fn(), sync: vi.fn(), remove: vi.fn() },
+  tree: { resolve: vi.fn(), file: vi.fn() },
+  proposals: { update: vi.fn() },
+}))
+vi.mock('@/api/instance', () => ({ api }))
+vi.mock('@/stores/toasts', () => ({ useToasts: () => ({ ok: vi.fn() }) }))
+const auth = reactive({
+  token: 'original',
+  identity: 'user:alice',
+  capabilities: { features: ['proposals.update_head', 'workspaces.sync_precondition'] },
+})
+vi.mock('@/stores/auth', () => ({ useAuth: () => auth }))
+const proposal: Proposal = {
+  id: 'p',
+  title: 'Review',
+  description: '',
+  stream: 'main',
+  head: 'mine-head',
+  author: 'user:alice',
+  state: 'open',
+  task_id: '',
+  integrated_as: '',
+  created_at_ms: 1,
+  updated_at_ms: 1,
+}
+const show = () =>
+  mount(ConflictResolver, {
+    props: { modelValue: true, repo: 'acme/app', proposal },
+    global: { stubs: { Teleport: true } },
+  })
+beforeEach(() => {
+  auth.token = 'original'
+  auth.identity = 'user:alice'
+  auth.capabilities.features = ['proposals.update_head', 'workspaces.sync_precondition']
+  api.workspaces.create.mockReset().mockResolvedValue({ head: 'mine-head' })
+  api.workspaces.sync
+    .mockReset()
+    .mockResolvedValueOnce({
+      status: 'conflicted',
+      head: '',
+      stream_head: 'branch-head',
+      conflicts: [{ path: 'asset.bin', kind: 'binary', message: '' }],
+    })
+    .mockResolvedValue({ status: 'merged', head: 'merged-head' })
+  api.workspaces.remove.mockReset().mockResolvedValue({})
+  api.tree.resolve.mockReset().mockImplementation(async (_repo, head) => ({
+    kind: 'regular',
+    entry: {
+      path: 'asset.bin',
+      blob_id: head === 'mine-head' ? 'mine-blob' : 'branch-blob',
+      file_type: 'regular',
+      executable: head === 'mine-head',
+      size: 3,
+    },
+  }))
+  api.tree.file
+    .mockReset()
+    .mockResolvedValue({ bytes: new Uint8Array([0, 255, 0]), truncated: false })
+  api.proposals.update.mockReset().mockResolvedValue({})
+})
+it('requires an explicit binary choice and publishes its original blob and mode against the pinned branch', async () => {
+  const w = show()
+  await flushPromises()
+  expect(w.get('[data-testid=resolve-save]').attributes('aria-disabled')).toBe('true')
+  expect(w.find('textarea').exists()).toBe(false)
+  await w
+    .findAll('button')
+    .find((b) => b.text() === 'Keep mine')!
+    .trigger('click')
+  await w.get('[data-testid=resolve-save]').trigger('click')
+  await flushPromises()
+  expect(api.workspaces.sync.mock.calls[1]![2]).toEqual([
+    { path: 'asset.bin', op: 'put', blob_id: 'mine-blob', file_type: 'regular', executable: true },
+  ])
+  expect(api.workspaces.sync.mock.calls[1]![3]).toMatchObject({
+    token: 'original',
+    expectedStreamHead: 'branch-head',
+  })
+  expect(api.proposals.update).toHaveBeenCalledWith(
+    'acme/app',
+    'p',
+    'merged-head',
+    'mine-head',
+    expect.objectContaining({ token: 'original' }),
+  )
+})
+it('does not turn an unreadable version into a delete choice', async () => {
+  api.tree.resolve.mockRejectedValue(
+    new ApiError({ status: 403, code: 'permission_denied', message: 'Not allowed to read' }),
+  )
+  const w = show()
+  await flushPromises()
+  expect(w.text()).toContain('Not allowed to read')
+  expect(w.findAll('button').some((b) => b.text() === 'Delete the file')).toBe(false)
+  expect(api.proposals.update).not.toHaveBeenCalled()
+})
+it('cancels stale preparation and cleans up with the original token after its create finishes', async () => {
+  let finish!: (value: object) => void
+  api.workspaces.create.mockImplementation(
+    () =>
+      new Promise((resolve) => {
+        finish = resolve
+      }),
+  )
+  const w = show()
+  await flushPromises()
+  auth.token = 'new-session'
+  await flushPromises()
+  finish({ head: 'mine-head' })
+  await flushPromises()
+  expect(api.workspaces.sync).not.toHaveBeenCalled()
+  expect(api.workspaces.remove).toHaveBeenCalledWith(
+    'acme/app',
+    expect.any(String),
+    expect.objectContaining({ token: 'original' }),
+  )
+  expect(w.emitted('done')).toBeUndefined()
+})
+
+it('preserves selections and blocks retry when the inspected branch moved', async () => {
+  api.workspaces.sync
+    .mockReset()
+    .mockResolvedValueOnce({
+      status: 'conflicted',
+      stream_head: 'branch-head',
+      conflicts: [{ path: 'asset.bin', kind: 'binary' }],
+    })
+    .mockRejectedValue(
+      new ApiError({
+        status: 412,
+        code: 'failed_precondition',
+        message: 'branch head changed: inspect again',
+      }),
+    )
+  const w = show()
+  await flushPromises()
+  await w
+    .findAll('button')
+    .find((b) => b.text() === 'Keep mine')!
+    .trigger('click')
+  await w.get('[data-testid=resolve-save]').trigger('click')
+  await flushPromises()
+  expect(w.text()).toContain('Your resolution has not replaced the newer changes')
+  expect(w.get('[data-testid=resolve-save]').attributes('aria-disabled')).toBe('true')
+  expect(api.proposals.update).not.toHaveBeenCalled()
+})
+it('refuses unpinned servers before creating a workspace', async () => {
+  auth.capabilities.features = ['proposals.update_head']
+  const w = show()
+  await flushPromises()
+  expect(w.text()).toContain('Upgrade the server')
+  expect(api.workspaces.create).not.toHaveBeenCalled()
+})
+
+it('does not move the proposal when a pending save finishes after the session changes', async () => {
+  let finish!: (value: object) => void
+  api.workspaces.sync
+    .mockReset()
+    .mockResolvedValueOnce({
+      status: 'conflicted',
+      stream_head: 'branch-head',
+      conflicts: [{ path: 'asset.bin', kind: 'binary' }],
+    })
+    .mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve
+        }),
+    )
+  const w = show()
+  await flushPromises()
+  await w
+    .findAll('button')
+    .find((b) => b.text() === 'Keep mine')!
+    .trigger('click')
+  await w.get('[data-testid=resolve-save]').trigger('click')
+  await flushPromises()
+  auth.token = 'new-session'
+  await flushPromises()
+  finish({ status: 'merged', head: 'merged-head' })
+  await flushPromises()
+  expect(api.proposals.update).not.toHaveBeenCalled()
+  expect(api.workspaces.remove).toHaveBeenCalledWith(
+    'acme/app',
+    expect.any(String),
+    expect.objectContaining({ token: 'original' }),
+  )
+})
+
+it('retains prepared choices after the proposal advances and submits the original head precondition', async () => {
+  api.proposals.update.mockRejectedValue(
+    new ApiError({ status: 412, code: 'failed_precondition', message: 'proposal head changed' }),
+  )
+  const w = show()
+  await flushPromises()
+  await w
+    .findAll('button')
+    .find((b) => b.text() === 'Keep mine')!
+    .trigger('click')
+  await w.setProps({ proposal: { ...proposal, head: 'concurrent-head' } })
+  expect(w.find('[data-testid=resolver]').exists()).toBe(true)
+  await w.get('[data-testid=resolve-save]').trigger('click')
+  await flushPromises()
+  expect(api.proposals.update).toHaveBeenCalledWith(
+    'acme/app',
+    'p',
+    'merged-head',
+    'mine-head',
+    expect.anything(),
+  )
+  expect(w.text()).toContain('Your resolution has not replaced the newer changes')
+  expect(w.get('[data-testid=resolve-save]').attributes('aria-disabled')).toBe('true')
+})
+
+it('never removes an existing workspace when creation reports a name collision', async () => {
+  api.workspaces.create.mockRejectedValue(
+    new ApiError({ status: 409, code: 'already_exists', message: 'Workspace already exists' }),
+  )
+  const w = show()
+  await flushPromises()
+  expect(w.text()).toContain('Workspace already exists')
+  expect(api.workspaces.sync).not.toHaveBeenCalled()
+  expect(api.workspaces.remove).not.toHaveBeenCalled()
+})
diff --git a/apps/web/src/components/proposal/ConflictResolver.vue b/apps/web/src/components/proposal/ConflictResolver.vue
index 2da94900..ef6fccc4 100644
--- a/apps/web/src/components/proposal/ConflictResolver.vue
+++ b/apps/web/src/components/proposal/ConflictResolver.vue
@@ -2,10 +2,12 @@
 import { computed, onBeforeUnmount, ref, watch } from 'vue'
 import { api } from '@/api/instance'
 import { ApiError, describeError } from '@/api/errors'
-import type { Conflict, FileChange, Proposal } from '@/api/types'
-import { canResolveHere, deleteFile, putFile, workspaceName } from '@/lib/edit'
+import type { Conflict, Proposal } from '@/api/types'
+import { canResolveHere, workspaceName } from '@/lib/edit'
 import { conflictLabel } from '@/lib/conflict-label'
-import { decodeUtf8, looksBinary } from '@/lib/text'
+import { formatBytes } from '@/lib/format'
+import { loadConflictVersion, conflictChange } from '@/lib/conflictResolution'
+import type { ConflictChoice, ConflictVersion } from '@/lib/conflictResolution'
 import { useToasts } from '@/stores/toasts'
 import { useAuth } from '@/stores/auth'
 import Alert from '@/ui/Alert.vue'
@@ -15,179 +17,235 @@ import Skeleton from '@/ui/Skeleton.vue'
 import TextArea from '@/ui/TextArea.vue'
 import CopyButton from '@/ui/CopyButton.vue'
 
-/**
- * Resolve the conflicts of your own change request in the browser. The branch has moved under the change; for
- * each file that both sides changed, see both versions and choose or write the result. Nothing is guessed: the
- * server merges everything else, and the change request moves to the merged version only when every conflict has
- * an answer.
- */
 const props = defineProps<{ modelValue: boolean; repo: string; proposal: Proposal }>()
 const emit = defineEmits<{ 'update:modelValue': [open: boolean]; done: [] }>()
 const toasts = useToasts()
 const auth = useAuth()
-
-type Choice = 'mine' | 'theirs' | 'delete' | 'edit'
 interface Row {
   conflict: Conflict
-  mine: string | null
-  theirs: string | null
-  /** Why it cannot be settled here (binary, renamed, …). */
+  mine: ConflictVersion
+  theirs: ConflictVersion
   blocked: string
-  choice: Choice
+  editable: boolean
+  choice: ConflictChoice
+  editSource: 'mine' | 'theirs'
   text: string
 }
-
+interface Attempt {
+  repo: string
+  proposal: string
+  stream: string
+  head: string
+  branchHead: string
+  workspace: string
+  token: string | null
+  controller: AbortController
+  created: boolean
+  released: boolean
+}
 const phase = ref<'idle' | 'loading' | 'ready' | 'saving' | 'error'>('idle')
 const rows = ref<Row[]>([])
 const error = ref<ApiError | null>(null)
-let draft = ''
-let inspectedHead = ''
-
+let active: Attempt | undefined
 const asError = (e: unknown) =>
   e instanceof ApiError
     ? e
     : new ApiError({ status: 0, code: 'internal', message: describeError(e) })
+const request = (a: Attempt) => ({
+  token: a.token,
+  signal: a.controller.signal,
+  quietUnauthenticated: true,
+})
+const current = (a: Attempt) => active === a && !a.controller.signal.aborted
+const absent = (): ConflictVersion => ({ entry: null, text: null })
 
-async function read(rev: string, path: string): Promise<string | null | 'binary'> {
+async function release(a: Attempt) {
+  if (!a.created || a.released) return
+  a.released = true
   try {
-    const f = await api.tree.file(props.repo, rev, path, 512 * 1024)
-    if (f.truncated) return 'binary'
-    return looksBinary(f.bytes) ? 'binary' : decodeUtf8(f.bytes)
+    await api.workspaces.remove(a.repo, a.workspace, {
+      token: a.token,
+      quietUnauthenticated: true,
+      timeoutMs: 5000,
+    })
   } catch {
-    return null
+    // The private workspace remains visible to its original owner if cleanup fails.
   }
 }
-
+function invalidate() {
+  const previous = active
+  active = undefined
+  previous?.controller.abort()
+  if (previous) void release(previous)
+  phase.value = 'idle'
+}
+async function prepareRow(a: Attempt, conflict: Conflict): Promise<Row> {
+  const row: Row = {
+    conflict,
+    mine: absent(),
+    theirs: absent(),
+    blocked: '',
+    editable: false,
+    choice: '',
+    editSource: 'mine',
+    text: '',
+  }
+  if (!canResolveHere(conflict.kind)) {
+    row.blocked = `${conflictLabel(conflict)}: resolve this structural conflict with the command line.`
+    return row
+  }
+  ;[row.mine, row.theirs] = await Promise.all([
+    loadConflictVersion(api, a.repo, a.head, conflict.path, request(a)),
+    loadConflictVersion(api, a.repo, a.branchHead, conflict.path, request(a)),
+  ])
+  row.editable = [row.mine, row.theirs].every(
+    (v) => !v.entry || (v.entry.file_type === 'regular' && v.text !== null),
+  )
+  row.editSource = row.mine.entry ? 'mine' : 'theirs'
+  row.text = row[row.editSource].text ?? ''
+  if (row.editable) row.choice = row.editSource
+  return row
+}
+async function moveProposal(a: Attempt, head: string) {
+  a.controller.signal.throwIfAborted()
+  if (!head) throw new Error('The merge did not return a revision.')
+  await api.proposals.update(a.repo, a.proposal, head, a.head, request(a))
+  if (!current(a)) return
+  toasts.ok('Conflicts resolved', 'The change request now includes the inspected branch revision.')
+  void release(a)
+  emit('update:modelValue', false)
+  emit('done')
+}
 async function open() {
-  inspectedHead = props.proposal.head
-  if (!auth.capabilities?.features.includes('proposals.update_head')) {
-    error.value = new ApiError({
-      status: 0,
-      code: 'failed_precondition',
-      message: 'Upgrade the server to resolve conflicts with concurrent-update protection.',
-    })
+  invalidate()
+  error.value = null
+  rows.value = []
+  if (
+    !['proposals.update_head', 'workspaces.sync_precondition'].every((feature) =>
+      auth.capabilities?.features.includes(feature),
+    )
+  ) {
+    error.value = asError(
+      new Error('Upgrade the server to resolve conflicts with revision protection.'),
+    )
     phase.value = 'error'
     return
   }
+  const a: Attempt = {
+    repo: props.repo,
+    proposal: props.proposal.id,
+    stream: props.proposal.stream,
+    head: props.proposal.head,
+    branchHead: '',
+    workspace: workspaceName(),
+    token: auth.token,
+    controller: new AbortController(),
+    created: false,
+    released: false,
+  }
+  active = a
   phase.value = 'loading'
-  error.value = null
-  rows.value = []
-  draft = workspaceName()
   try {
-    await api.workspaces.create(props.repo, {
-      name: draft,
-      stream: props.proposal.stream,
-      from_rev: inspectedHead,
-    })
-    const res = await api.workspaces.sync(props.repo, draft)
-    if (res.status !== 'conflicted') {
-      // The branch merges cleanly now (it moved again, or someone else resolved it).
-      await moveProposal(res.head)
+    const workspace = await api.workspaces.create(
+      a.repo,
+      { name: a.workspace, stream: a.stream, from_rev: a.head },
+      request(a),
+    )
+    a.created = true
+    if (!current(a)) {
+      await release(a)
       return
     }
-    const theirsRev = (await api.streams.head(props.repo, props.proposal.stream)).head
-    rows.value = await Promise.all(
-      res.conflicts.map(async (c): Promise<Row> => {
-        const [mine, theirs] = await Promise.all([
-          read(inspectedHead, c.path),
-          read(theirsRev, c.path),
-        ])
-        const blocked = !canResolveHere(c.kind)
-          ? `${conflictLabel(c)}: resolve this one with the command line.`
-          : mine === 'binary' || theirs === 'binary'
-            ? 'This file is binary or too large to edit here: use the command line.'
-            : ''
-        const m = typeof mine === 'string' ? mine : null
-        const t = typeof theirs === 'string' ? theirs : null
-        return {
-          conflict: c,
-          mine: m,
-          theirs: t,
-          blocked,
-          choice: m !== null ? 'mine' : 'theirs',
-          text: m ?? t ?? '',
-        }
-      }),
-    )
+    if (workspace.head !== a.head)
+      throw new Error('The workspace did not open at the inspected revision.')
+    const result = await api.workspaces.sync(a.repo, a.workspace, [], request(a))
+    if (!current(a)) return
+    if (result.status !== 'conflicted') {
+      await moveProposal(a, result.head)
+      return
+    }
+    a.branchHead = result.stream_head ?? ''
+    if (!a.branchHead)
+      throw new Error('The server did not identify the branch revision used for this conflict.')
+    const prepared = await Promise.all(result.conflicts.map((conflict) => prepareRow(a, conflict)))
+    if (!current(a)) return
+    rows.value = prepared
     phase.value = 'ready'
   } catch (e) {
+    // An ambiguous create may have committed; an explicit collision belongs to somebody else.
+    a.created ||= !(e instanceof ApiError && e.code === 'already_exists')
+    void release(a)
+    if (!current(a)) return
     error.value = asError(e)
     phase.value = 'error'
   }
 }
-
-function pick(r: Row, choice: Choice) {
-  r.choice = choice
-  if (choice === 'mine') r.text = r.mine ?? ''
-  else if (choice === 'theirs') r.text = r.theirs ?? ''
+function pick(row: Row, choice: ConflictChoice) {
+  row.choice = choice
+  if (choice === 'mine' || choice === 'theirs') {
+    row.editSource = choice
+    row.text = row[choice].text ?? ''
+  }
 }
-
-const unresolved = computed(() => rows.value.filter((r) => r.blocked).length)
+const unresolved = computed(() => rows.value.filter((row) => row.blocked || !row.choice).length)
 const headChanged = computed(
   () =>
     error.value?.code === 'failed_precondition' &&
-    error.value.message.includes('proposal head changed'),
+    /(?:proposal|branch) head changed/.test(error.value.message),
 )
 const resolutionText = computed(() =>
   rows.value
-    .map((r) => `${r.conflict.path}\n${r.choice === 'delete' ? '(delete file)' : r.text}`)
+    .map(
+      (row) =>
+        `${row.conflict.path}\n${row.choice === 'delete' ? '(delete file)' : row.editable ? row.text : row.choice || '(not selected)'}`,
+    )
     .join('\n\n'),
 )
-
-async function moveProposal(head: string) {
-  await api.proposals.update(props.repo, props.proposal.id, head, inspectedHead)
-  toasts.ok('Conflicts resolved', 'The change request now includes the latest branch.')
-  emit('update:modelValue', false)
-  emit('done')
+function summary(version: ConflictVersion): string {
+  if (!version.entry) return 'Deleted in this revision'
+  const entry = version.entry
+  return `${entry.file_type === 'symlink' ? 'Symbolic link' : 'Regular file'} · ${formatBytes(entry.size)}${entry.executable ? ' · executable' : ''}`
 }
-
 async function save() {
+  const a = active
+  if (!a || !current(a) || phase.value !== 'ready' || unresolved.value || headChanged.value) return
   phase.value = 'saving'
   error.value = null
   try {
-    const resolutions: FileChange[] = rows.value.map((r) =>
-      r.choice === 'delete' ? deleteFile(r.conflict.path) : putFile(r.conflict.path, r.text),
+    const resolutions = rows.value.map((row) =>
+      conflictChange(row.conflict.path, row.choice, row.mine, row.theirs, row.text, row.editSource),
     )
-    const res = await api.workspaces.sync(props.repo, draft, resolutions)
-    if (res.status === 'conflicted') {
-      error.value = new ApiError({
-        status: 409,
-        code: 'conflict',
-        message: 'Some conflicts are still open. Choose a result for every file.',
-      })
-      phase.value = 'ready'
-      return
-    }
-    await moveProposal(res.head)
+    const result = await api.workspaces.sync(a.repo, a.workspace, resolutions, {
+      ...request(a),
+      expectedStreamHead: a.branchHead,
+    })
+    if (!current(a)) return
+    if (result.status === 'conflicted')
+      throw new Error('Some conflicts remain unresolved. Inspect this change again.')
+    await moveProposal(a, result.head)
   } catch (e) {
+    if (!current(a)) return
     error.value = asError(e)
     phase.value = 'ready'
   }
 }
-
-async function cleanup() {
-  const name = draft
-  draft = ''
-  if (!name) return
-  try {
-    await api.workspaces.remove(props.repo, name)
-  } catch {
-    // A leftover draft is harmless.
-  }
-}
-
 watch(
   () => props.modelValue,
-  (on) => {
-    if (on) void open()
-    else {
-      phase.value = 'idle'
-      void cleanup()
-    }
+  (value) => {
+    if (value) void open()
+    else invalidate()
   },
   { immediate: true },
 )
-onBeforeUnmount(() => void cleanup())
+watch(
+  [() => props.repo, () => props.proposal.id, () => auth.token, () => auth.identity],
+  () => {
+    invalidate()
+    if (props.modelValue) emit('update:modelValue', false)
+  },
+  { flush: 'sync' },
+)
+onBeforeUnmount(invalidate)
 </script>
 
 <template>
@@ -221,45 +279,63 @@ onBeforeUnmount(() => void cleanup())
           <div class="cols">
             <div>
               <h4>The branch’s version</h4>
+              <p class="faint">{{ summary(r.theirs) }}</p>
               <pre
                 class="ver"
                 tabindex="0"
                 role="region"
                 :aria-label="`The branch’s version of ${r.conflict.path}`"
-                >{{ r.theirs ?? '(the branch deleted this file)' }}</pre>
+                >{{
+                  r.theirs.text ??
+                  (r.theirs.entry
+                    ? 'No text preview. The original file will be preserved.'
+                    : '(the branch deleted this file)')
+                }}</pre>
             </div>
             <div>
               <h4>Your version</h4>
+              <p class="faint">{{ summary(r.mine) }}</p>
               <pre
                 class="ver"
                 tabindex="0"
                 role="region"
                 :aria-label="`Your version of ${r.conflict.path}`"
-                >{{ r.mine ?? '(you deleted this file)' }}</pre>
+                >{{
+                  r.mine.text ??
+                  (r.mine.entry
+                    ? 'No text preview. The original file will be preserved.'
+                    : '(you deleted this file)')
+                }}</pre>
             </div>
           </div>
+          <p v-if="!r.editable" class="faint">
+            Choose a complete file version. Its bytes, file type and executable mode stay unchanged.
+          </p>
           <div class="pick" role="group" :aria-label="`Keep for ${r.conflict.path}`">
             <Button
               size="sm"
               :variant="r.choice === 'theirs' ? 'primary' : 'secondary'"
+              :aria-pressed="r.choice === 'theirs'"
               @click="pick(r, 'theirs')"
               >Keep the branch’s</Button
             >
             <Button
               size="sm"
               :variant="r.choice === 'mine' ? 'primary' : 'secondary'"
+              :aria-pressed="r.choice === 'mine'"
               @click="pick(r, 'mine')"
               >Keep mine</Button
             >
             <Button
               size="sm"
               :variant="r.choice === 'delete' ? 'primary' : 'secondary'"
+              :aria-pressed="r.choice === 'delete'"
               @click="pick(r, 'delete')"
               >Delete the file</Button
             >
           </div>
           <TextArea
-            v-if="r.choice !== 'delete'"
+            v-if="r.editable && r.choice !== 'delete' && r[r.editSource].entry"
             v-model="r.text"
             :label="`Result for ${r.conflict.path}`"
             :rows="8"
@@ -268,9 +344,9 @@ onBeforeUnmount(() => void cleanup())
           />
         </template>
       </section>
-      <Alert v-if="headChanged" tone="warn" live="alert" title="The change request changed">
+      <Alert v-if="headChanged" tone="warn" live="alert" title="A revision changed">
         Your resolution has not replaced the newer changes. Copy your work, close this dialog, and
-        inspect the updated change request before resolving again.
+        inspect the updated branch and change request before resolving again.
         <CopyButton :text="resolutionText" label="Copy resolution text" with-label />
       </Alert>
       <Alert v-else-if="error" tone="bad" live="alert" title="Not saved">{{ error.message }}</Alert>
diff --git a/apps/web/src/lib/conflictResolution.spec.ts b/apps/web/src/lib/conflictResolution.spec.ts
new file mode 100644
index 00000000..8eba5835
--- /dev/null
+++ b/apps/web/src/lib/conflictResolution.spec.ts
@@ -0,0 +1,127 @@
+// @vitest-environment node
+import { describe, expect, it, vi } from 'vitest'
+import type { Api } from '@/api/endpoints'
+import type { TreeEntry } from '@/api/types'
+import { ApiError } from '@/api/errors'
+import { loadConflictVersion, conflictChange } from './conflictResolution'
+
+const entry = (over: Partial<TreeEntry> = {}): TreeEntry => ({
+  path: 'file',
+  blob_id: 'original-blob',
+  file_type: 'regular',
+  executable: true,
+  size: 3,
+  ...over,
+})
+function fixture() {
+  const raw = {
+    tree: {
+      resolve: vi.fn().mockResolvedValue({ kind: 'regular', entry: entry() }),
+      file: vi.fn().mockResolvedValue({ bytes: new Uint8Array([0, 1, 255]), truncated: false }),
+    },
+  }
+  return { raw, api: raw as unknown as Api }
+}
+const request = { token: 'original-session', quietUnauthenticated: true }
+describe('conflict versions', () => {
+  it('retains binary blob identity and executable mode without re-encoding it', async () => {
+    const { raw, api } = fixture()
+    const version = await loadConflictVersion(api, 'acme/app', 'pinned-head', 'file', request)
+    expect(version.text).toBeNull()
+    expect(conflictChange('file', 'mine', version, { entry: null, text: null }, '')).toEqual({
+      path: 'file',
+      op: 'put',
+      blob_id: 'original-blob',
+      file_type: 'regular',
+      executable: true,
+    })
+    expect(raw.tree.resolve).toHaveBeenCalledWith('acme/app', 'pinned-head', 'file', request)
+  })
+  it('does not download oversized files and keeps a symbolic link as a symbolic link', async () => {
+    const { raw, api } = fixture()
+    raw.tree.resolve.mockResolvedValue({ kind: 'regular', entry: entry({ size: 2 * 1024 * 1024 }) })
+    const large = await loadConflictVersion(api, 'acme/app', 'head', 'file', request)
+    expect(large.text).toBeNull()
+    expect(raw.tree.file).not.toHaveBeenCalled()
+    const link = { entry: entry({ file_type: 'symlink', executable: false }), text: 'target' }
+    expect(conflictChange('file', 'theirs', large, link, '')).toEqual({
+      path: 'file',
+      op: 'put',
+      blob_id: 'original-blob',
+      file_type: 'symlink',
+      executable: false,
+    })
+  })
+  it('recognizes only a definite missing path as deletion, never a failed read', async () => {
+    const { raw, api } = fixture()
+    raw.tree.resolve.mockResolvedValueOnce({ kind: 'missing', entry: null })
+    const missing = await loadConflictVersion(api, 'acme/app', 'head', 'file', request)
+    expect(conflictChange('file', 'mine', missing, missing, '')).toEqual({
+      path: 'file',
+      op: 'delete',
+    })
+    for (const status of [403, 404, 503]) {
+      raw.tree.resolve.mockRejectedValueOnce(
+        new ApiError({
+          status,
+          code: status === 404 ? 'not_found' : 'unavailable',
+          message: 'Failed read',
+        }),
+      )
+      await expect(loadConflictVersion(api, 'acme/app', 'head', 'file', request)).rejects.toThrow(
+        'Failed read',
+      )
+    }
+  })
+  it('preserves BOM, CRLF and mode when text is explicitly edited', () => {
+    const version = { entry: entry(), text: '\uFEFFold\r\n' }
+    const change = conflictChange('file', 'edit', version, version, 'new\n', 'mine')
+    expect(change.executable).toBe(true)
+    expect(
+      new TextDecoder('utf8', { ignoreBOM: true }).decode(
+        Uint8Array.from(atob(change.content!), (x) => x.charCodeAt(0)),
+      ),
+    ).toBe('\uFEFFnew\r\n')
+    expect(() => conflictChange('file', '', version, version, '')).toThrow(/Choose/)
+  })
+})
+
+it('keeps malformed UTF-8 as an intact non-text version and propagates download failure', async () => {
+  const { raw, api } = fixture()
+  raw.tree.file.mockResolvedValueOnce({ bytes: new Uint8Array([0xff, 0x61]), truncated: false })
+  const version = await loadConflictVersion(api, 'acme/app', 'head', 'file', request)
+  expect(version.text).toBeNull()
+  expect(version.entry?.blob_id).toBe('original-blob')
+  raw.tree.file.mockRejectedValueOnce(
+    new ApiError({ status: 503, code: 'unavailable', message: 'Download failed' }),
+  )
+  await expect(loadConflictVersion(api, 'acme/app', 'head', 'file', request)).rejects.toThrow(
+    'Download failed',
+  )
+})
+
+it('refuses incomplete or unknown file metadata before fetching bytes', async () => {
+  const { raw, api } = fixture()
+  for (const value of [null, entry({ blob_id: '' }), entry({ file_type: 'future-type' })]) {
+    raw.tree.resolve.mockResolvedValue({ kind: 'regular', entry: value })
+    await expect(loadConflictVersion(api, 'acme/app', 'head', 'file', request)).rejects.toThrow(
+      /Cannot inspect/,
+    )
+  }
+  expect(raw.tree.file).not.toHaveBeenCalled()
+})
+it('previews the exact size boundary and edits only the selected regular text source', async () => {
+  const { raw, api } = fixture()
+  raw.tree.resolve.mockResolvedValue({ kind: 'regular', entry: entry({ size: 512 * 1024 }) })
+  raw.tree.file.mockResolvedValue({ bytes: new TextEncoder().encode('branch'), truncated: false })
+  expect((await loadConflictVersion(api, 'acme/app', 'head', 'file', request)).text).toBe('branch')
+  const mine = { entry: entry({ executable: true }), text: 'mine' }
+  const theirs = { entry: entry({ executable: false }), text: 'theirs' }
+  expect(conflictChange('file', 'edit', mine, theirs, 'new', 'theirs').executable).toBe(false)
+  for (const invalid of [
+    { entry: null, text: null },
+    { entry: entry(), text: null },
+    { entry: entry({ file_type: 'symlink' }), text: 'target' },
+  ])
+    expect(() => conflictChange('file', 'edit', invalid, theirs, 'new')).toThrow(/cannot be edited/)
+})
diff --git a/apps/web/src/lib/conflictResolution.ts b/apps/web/src/lib/conflictResolution.ts
new file mode 100644
index 00000000..3590c098
--- /dev/null
+++ b/apps/web/src/lib/conflictResolution.ts
@@ -0,0 +1,77 @@
+import type { Api } from '@/api/endpoints'
+import type { RequestOptions } from '@/api/client'
+import type { FileChange, TreeEntry } from '@/api/types'
+import { putFile, deleteFile } from './edit'
+import { decodeUtf8, looksBinary, preserveTextFormat } from './text'
+
+type Session = Pick<RequestOptions, 'token' | 'signal' | 'quietUnauthenticated'>
+export type ConflictChoice = '' | 'mine' | 'theirs' | 'delete' | 'edit'
+export interface ConflictVersion {
+  entry: TreeEntry | null
+  /** Null means no editable preview, not an absent file. */
+  text: string | null
+}
+const PREVIEW_BYTES = 512 * 1024
+
+/** Only an explicit missing-path result means deletion. Failed reads stop preparation. */
+export async function loadConflictVersion(
+  api: Api,
+  repo: string,
+  rev: string,
+  path: string,
+  request: Session,
+): Promise<ConflictVersion> {
+  request.signal?.throwIfAborted()
+  const location = await api.tree.resolve(repo, rev, path, request)
+  const entry = fileEntry(location, path)
+  if (!entry) return { entry: null, text: null }
+  if (entry.size > PREVIEW_BYTES) return { entry, text: null }
+  request.signal?.throwIfAborted()
+  const file = await api.tree.file(repo, rev, path, PREVIEW_BYTES, request)
+  return { entry, text: file.truncated || looksBinary(file.bytes) ? null : decodeUtf8(file.bytes) }
+}
+
+function fileEntry(
+  location: { kind: string; entry: TreeEntry | null },
+  path: string,
+): TreeEntry | null {
+  if (location.kind === 'missing') return null
+  const entry = location.entry
+  if (!entry || !['regular', 'symlink'].includes(entry.file_type) || !entry.blob_id)
+    throw new Error(
+      `Cannot inspect ${path} as a file. Resolve this conflict with the command line.`,
+    )
+  return entry
+}
+
+function editedChange(path: string, source: ConflictVersion, text: string): FileChange {
+  if (source.entry?.file_type !== 'regular' || source.text === null)
+    throw new Error(`This version of ${path} cannot be edited as text.`)
+  return putFile(path, preserveTextFormat(source.text, text), source.entry.executable)
+}
+
+/** Existing versions are referenced by blob, preserving bytes, type and executable mode. */
+export function conflictChange(
+  path: string,
+  choice: ConflictChoice,
+  mine: ConflictVersion,
+  theirs: ConflictVersion,
+  text: string,
+  editSource: 'mine' | 'theirs' = 'mine',
+): FileChange {
+  if (choice === 'delete') return deleteFile(path)
+  if (choice === 'mine' || choice === 'theirs') {
+    const entry = (choice === 'mine' ? mine : theirs).entry
+    return entry
+      ? {
+          path,
+          op: 'put',
+          blob_id: entry.blob_id,
+          file_type: entry.file_type,
+          executable: entry.executable,
+        }
+      : deleteFile(path)
+  }
+  if (choice !== 'edit') throw new Error(`Choose a result for ${path}.`)
+  return editedChange(path, editSource === 'mine' ? mine : theirs, text)
+}
diff --git a/apps/web/src/lib/edit-next.spec.ts b/apps/web/src/lib/edit-next.spec.ts
index 38205230..2d0a8d1a 100644
--- a/apps/web/src/lib/edit-next.spec.ts
+++ b/apps/web/src/lib/edit-next.spec.ts
@@ -51,15 +51,17 @@ describe('editing helpers', () => {
     expect(a).not.toBe(b)
   })
 
-  it('only offers to resolve here what a person can settle by choosing text', () => {
-    for (const k of ['content', 'both_added', 'delete_modify']) expect(canResolveHere(k)).toBe(true)
+  it('offers file choices while leaving structural conflicts to the command line', () => {
     for (const k of [
+      'content',
+      'both_added',
+      'delete_modify',
       'binary',
-      'type_change',
-      'rename_rename',
-      'directory_rename_ambiguous',
       'too_large',
+      'type_change',
     ])
+      expect(canResolveHere(k)).toBe(true)
+    for (const k of ['rename_rename', 'directory_rename_ambiguous', 'file_directory'])
       expect(canResolveHere(k)).toBe(false)
   })
 })
diff --git a/apps/web/src/lib/edit.ts b/apps/web/src/lib/edit.ts
index b2b4b9bd..55369919 100644
--- a/apps/web/src/lib/edit.ts
+++ b/apps/web/src/lib/edit.ts
@@ -130,7 +130,15 @@ export async function proposeChange(api: Api, input: ProposeInput): Promise<Prop
   }
 }
 
-export type ResolvableKind = 'content' | 'both_added' | 'delete_modify'
-const RESOLVABLE = new Set<string>(['content', 'both_added', 'delete_modify'])
-/** Conflicts a person can settle by choosing or editing text; the rest (binary, type changes, renames) need the CLI. */
+export type ResolvableKind =
+  'content' | 'both_added' | 'delete_modify' | 'binary' | 'too_large' | 'type_change'
+const RESOLVABLE = new Set<string>([
+  'content',
+  'both_added',
+  'delete_modify',
+  'binary',
+  'too_large',
+  'type_change',
+])
+/** File conflicts a person can settle by preserving one version or editing regular text; structural conflicts need the CLI. */
 export const canResolveHere = (kind: string): boolean => RESOLVABLE.has(kind)
diff --git a/crates/ag-integrate/src/virtual_ws.rs b/crates/ag-integrate/src/virtual_ws.rs
index 41768547..30632bc2 100644
--- a/crates/ag-integrate/src/virtual_ws.rs
+++ b/crates/ag-integrate/src/virtual_ws.rs
@@ -12,7 +12,7 @@ use std::collections::BTreeMap;
 use ag_changeset::Op;
 use ag_dag::{is_ancestor, merge_bases};
 use ag_merge::merge_trees;
-use ag_storage::meta::WorkspaceRow;
+use ag_storage::meta::{Tx, WorkspaceRow};
 use ag_tree::Tree;
 use ag_types::{BlobId, ChangesetId, FileType, Identity, RepoPath};
 use serde_json::json;
@@ -188,24 +188,66 @@ impl Repository {
         observed: &WorkspaceRow,
         author: &Identity,
         resolutions: &[VirtualChange],
+    ) -> Result<SyncOutcome> {
+        self.sync_virtual_with_target(observed, author, resolutions, None)
+    }
+
+    /// Syncs against exactly the branch head inspected by the caller, including an empty branch.
+    pub fn workspace_sync_virtual_checked_at(
+        &self,
+        observed: &WorkspaceRow,
+        author: &Identity,
+        resolutions: &[VirtualChange],
+        expected_stream_head: Option<&ChangesetId>,
+    ) -> Result<SyncOutcome> {
+        self.sync_virtual_with_target(observed, author, resolutions, Some(expected_stream_head.copied()))
+    }
+
+    fn move_synced_workspace(
+        &self,
+        tx: &Tx<'_>,
+        ws: &WorkspaceRow,
+        base: Option<&ChangesetId>,
+        head: Option<&ChangesetId>,
+        expected_stream_head: Option<Option<ChangesetId>>,
+    ) -> Result<WorkspaceRow> {
+        let actual = tx.stream(&ws.stream)?.and_then(|stream| stream.state.head);
+        check_sync_target(actual, expected_stream_head)?;
+        self.move_workspace(tx, ws, base, head)
+    }
+
+    fn sync_virtual_with_target(
+        &self,
+        observed: &WorkspaceRow,
+        author: &Identity,
+        resolutions: &[VirtualChange],
+        expected_stream_head: Option<Option<ChangesetId>>,
     ) -> Result<SyncOutcome> {
         let ws = observed.clone();
         let name = ws.name.as_str();
         self.meta.read(|tx| tx.workspace_check(&ws)).map_err(crate::workspace::workspace_error)?;
-        let Some(stream_head) = self.meta.read(|tx| tx.stream(&ws.stream))?.and_then(|s| s.state.head) else {
+        let actual = self.meta.read(|tx| tx.stream(&ws.stream))?.and_then(|s| s.state.head);
+        check_sync_target(actual, expected_stream_head)?;
+        let Some(stream_head) = actual else {
             return Ok(SyncOutcome::UpToDate);
         };
         let g = self.graph();
         let Some(ws_head) = ws.head else {
-            self.meta.write_with_error(|tx| self.move_workspace(tx, &ws, Some(&stream_head), Some(&stream_head)))?;
+            self.meta.write_with_error(|tx| {
+                self.move_synced_workspace(tx, &ws, Some(&stream_head), Some(&stream_head), expected_stream_head)
+            })?;
             return Ok(SyncOutcome::FastForwarded { to: stream_head });
         };
         if is_ancestor(&g, &stream_head, &ws_head)? {
-            self.meta.write_with_error(|tx| self.move_workspace(tx, &ws, Some(&stream_head), Some(&ws_head)))?;
+            self.meta.write_with_error(|tx| {
+                self.move_synced_workspace(tx, &ws, Some(&stream_head), Some(&ws_head), expected_stream_head)
+            })?;
             return Ok(SyncOutcome::UpToDate);
         }
         if is_ancestor(&g, &ws_head, &stream_head)? {
-            self.meta.write_with_error(|tx| self.move_workspace(tx, &ws, Some(&stream_head), Some(&stream_head)))?;
+            self.meta.write_with_error(|tx| {
+                self.move_synced_workspace(tx, &ws, Some(&stream_head), Some(&stream_head), expected_stream_head)
+            })?;
             return Ok(SyncOutcome::FastForwarded { to: stream_head });
         }
         let base = match merge_bases(&g, &ws_head, &stream_head)?.as_slice() {
@@ -247,10 +289,24 @@ impl Repository {
             ops,
         )?;
         self.meta.write_with_error(|tx| -> Result<()> {
-            self.move_workspace(tx, &ws, Some(&stream_head), Some(&id))?;
+            self.move_synced_workspace(tx, &ws, Some(&stream_head), Some(&id), expected_stream_head)?;
             tx.audit_append(author.as_str(), "workspace.sync", name, &json!({"merge": id}))?;
             Ok(())
         })?;
         Ok(SyncOutcome::Merged { id })
     }
 }
+
+fn check_sync_target(actual: Option<ChangesetId>, expected: Option<Option<ChangesetId>>) -> Result<()> {
+    if let Some(expected) = expected
+        && actual != expected
+    {
+        let show = |head: Option<ChangesetId>| head.map(|id| id.to_string()).unwrap_or_else(|| "empty".into());
+        return Err(Error::Conflict(format!(
+            "branch head changed: expected {}, found {}; inspect the current branch before resolving",
+            show(expected),
+            show(actual)
+        )));
+    }
+    Ok(())
+}
diff --git a/crates/ag-integrate/tests/workspace_concurrency.rs b/crates/ag-integrate/tests/workspace_concurrency.rs
index 73a4924d..7d5ce309 100644
--- a/crates/ag-integrate/tests/workspace_concurrency.rs
+++ b/crates/ag-integrate/tests/workspace_concurrency.rs
@@ -131,3 +131,38 @@ fn a_sync_merge_cannot_replace_a_concurrent_modification() {
     assert!(tree.get(&RepoPath::new("local").unwrap()).is_some());
     assert!(tree.get(&RepoPath::new("fast").unwrap()).is_some());
 }
+
+#[test]
+fn pinned_sync_refuses_a_branch_that_moved_after_the_user_inspected_it() {
+    let f = fx();
+    let actor = id("user:alice");
+    let base = f.land(None, &[("base", "base")]);
+    let ws = f.repo.workspace_create("review", &StreamName::new("main").unwrap(), &actor).unwrap();
+    let advanced = f.land(Some(base), &[("base", "changed")]);
+    let result = f.repo.workspace_sync_virtual_checked_at(&ws, &actor, &[], Some(&base));
+    assert!(result.is_err(), "stale target must be rejected before the workspace moves");
+    assert_eq!(f.repo.workspace_row("review").unwrap().head, Some(base));
+    assert_eq!(f.repo.meta().read(|tx| tx.stream("main")).unwrap().unwrap().state.head, Some(advanced));
+}
+
+#[test]
+fn pinned_sync_rechecks_the_branch_in_its_final_transaction() {
+    let f = fx();
+    let actor = id("user:alice");
+    let base = f.land(None, &[("base", "base")]);
+    f.repo.workspace_create("review", &StreamName::new("main").unwrap(), &actor).unwrap();
+    let blob = f.repo.put_blob(b"ours".to_vec()).unwrap();
+    f.repo.workspace_modify("review", &[put("ours", blob)], "ours", &actor, Some(&base)).unwrap();
+    let ws = f.repo.workspace_row("review").unwrap();
+    let target = f.land(Some(base), &[("base", "base"), ("upstream", "one")]);
+    let (slow, reached, resume) = paused(&f.repo);
+    let who = actor.clone();
+    let observed = ws.clone();
+    let worker =
+        std::thread::spawn(move || slow.workspace_sync_virtual_checked_at(&observed, &who, &[], Some(&target)));
+    reached.recv_timeout(Duration::from_secs(10)).unwrap();
+    f.land(Some(target), &[("base", "base"), ("upstream", "two")]);
+    resume.send(()).unwrap();
+    assert!(worker.join().unwrap().is_err());
+    assert_eq!(f.repo.workspace_row("review").unwrap().head, ws.head);
+}
diff --git a/crates/ag-mcp/src/prompts.rs b/crates/ag-mcp/src/prompts.rs
index 26f085ec..47051cc1 100644
--- a/crates/ag-mcp/src/prompts.rs
+++ b/crates/ag-mcp/src/prompts.rs
@@ -68,9 +68,9 @@ fn resolve_conflicts(arg: &dyn Fn(&str) -> String) -> String {
     format!(
         "Bring workspace `{ws}` up to date with its stream and resolve conflicts.\n\n\
 1. workspace_sync with no resolutions. If the status is up_to_date, fast_forwarded or merged, you are done.\n\
-2. If it is conflicted, nothing changed: for each listed path read the stream's version (read_file with rev = the stream) and yours (rev = @{ws}), and the history of both sides (log, blame) to understand the intent of each change.\n\
+2. If it is conflicted, nothing changed: for each listed path read the exact stream_head returned by sync (read_file with rev = that changeset, rather than the moving branch name) and yours (rev = @{ws}), and the history of both sides (log, blame) to understand the intent of each change.\n\
 3. Decide the final content of every conflicting path - keep both intents where they are compatible. Do not discard the other side's work silently.\n\
-4. workspace_sync again with resolutions for EVERY conflicting path (full file content).\n\
+4. workspace_sync again with expected_stream_head set to the inspected stream_head and resolutions for EVERY conflicting path. Preserve blob_id, file_type and executable for a whole-file choice; deletion uses op=delete. A server without workspaces.sync_precondition must be upgraded before this guarded operation.\n\
 5. proposal_update to move your proposal to the new head, then proposal_status to check the verdicts.\n\n{RULES}"
     )
 }
@@ -234,6 +234,11 @@ mod tests {
             "request_changes",
             "expected_version",
             "next_page_token",
+            "stream_head",
+            "expected_stream_head",
+            "blob_id",
+            "file_type",
+            "sync_precondition",
         ];
         let mut mentioned = std::collections::BTreeSet::new();
         for p in PROMPTS {
diff --git a/crates/ag-mcp/src/tools/workspace.rs b/crates/ag-mcp/src/tools/workspace.rs
index 478a5ebe..2fc02b24 100644
--- a/crates/ag-mcp/src/tools/workspace.rs
+++ b/crates/ag-mcp/src/tools/workspace.rs
@@ -264,44 +264,120 @@ fn write_files(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError>
     ))
 }
 
+fn resolution_source(value: &Value, index: usize) -> Result<(Value, usize), ToolError> {
+    let text = str_arg(value, "content");
+    let base64 = str_arg(value, "content_base64");
+    let blob = str_arg(value, "blob_id");
+    if [text, base64, blob].into_iter().flatten().count() != 1 {
+        return Err(ToolError::invalid(format!(
+            "resolutions[{index}]: give exactly one of `content`, `content_base64` or `blob_id`"
+        )));
+    }
+    if let Some(blob) = blob {
+        if blob.len() != 64 || !blob.bytes().all(|c| c.is_ascii_hexdigit()) {
+            return Err(ToolError::invalid(format!("resolutions[{index}].blob_id must be a 64-character object id")));
+        }
+        return Ok((json!({"blob_id": blob}), 0));
+    }
+    let bytes = match (text, base64) {
+        (Some(text), _) => text.as_bytes().to_vec(),
+        (_, Some(encoded)) => base64::engine::general_purpose::STANDARD
+            .decode(encoded.trim())
+            .map_err(|e| ToolError::invalid(format!("resolutions[{index}].content_base64: {e}")))?,
+        _ => return Err(ToolError::invalid("a resolution needs one content source")),
+    };
+    Ok((json!({"content": base64::engine::general_purpose::STANDARD.encode(&bytes)}), bytes.len()))
+}
+
+fn resolution(value: &Value, index: usize) -> Result<(Value, usize), ToolError> {
+    let path = str_arg(value, "path").unwrap_or_default();
+    validate_repo_path(path).map_err(|e| ToolError::invalid(format!("resolutions[{index}].path: {e}")))?;
+    let op = str_arg(value, "op").unwrap_or("put");
+    if op == "delete" {
+        if ["content", "content_base64", "blob_id"].iter().any(|field| value.get(field).is_some()) {
+            return Err(ToolError::invalid(format!("resolutions[{index}]: delete takes no content")));
+        }
+        return Ok((json!({"path": path, "op": "delete"}), 0));
+    }
+    if op != "put" {
+        return Err(ToolError::invalid(format!("resolutions[{index}].op must be put or delete")));
+    }
+    let file_type = str_arg(value, "file_type").unwrap_or("regular");
+    if !["regular", "symlink"].contains(&file_type) {
+        return Err(ToolError::invalid(format!("resolutions[{index}].file_type must be regular or symlink")));
+    }
+    let (mut wire, bytes) = resolution_source(value, index)?;
+    wire["path"] = json!(path);
+    wire["op"] = json!("put");
+    wire["file_type"] = json!(file_type);
+    wire["executable"] = json!(value.get("executable").and_then(Value::as_bool).unwrap_or(false));
+    Ok((wire, bytes))
+}
+
+fn parse_resolutions(items: &[Value]) -> Result<Vec<Value>, ToolError> {
+    if items.len() > MAX_CHANGES {
+        return Err(ToolError::invalid("too many resolutions"));
+    }
+    let mut result = Vec::with_capacity(items.len());
+    let mut seen = std::collections::BTreeSet::new();
+    let mut total = 0usize;
+    for (index, item) in items.iter().enumerate() {
+        let (wire, bytes) = resolution(item, index)?;
+        if !seen.insert(wire["path"].to_string()) {
+            return Err(ToolError::invalid("a resolved path appears twice"));
+        }
+        total += bytes;
+        if total > MAX_WRITE_BYTES {
+            return Err(ToolError::local(
+                "too_large",
+                "Resolved content exceeds the 4 MiB limit; use existing blob ids for large files.",
+            ));
+        }
+        result.push(wire);
+    }
+    Ok(result)
+}
+
+fn sync_body(ctx: &CallCtx<'_>, args: &Value, repo: &str, run: Option<&str>) -> Result<Value, ToolError> {
+    let expected = str_arg(args, "expected_stream_head").filter(|head| !head.is_empty());
+    if expected.is_some() && !ctx.api.supports("workspaces.sync_precondition", &ctx.opts(run))? {
+        return Err(ToolError::local(
+            "server_update_required",
+            "This server cannot pin the branch revision for workspace sync.",
+        )
+        .hint("Update the server before applying an inspected conflict resolution."));
+    }
+    let items = args.get("resolutions").and_then(Value::as_array).map(Vec::as_slice).unwrap_or(&[]);
+    let wire = parse_resolutions(items)?;
+    let paths: Vec<&str> = wire.iter().filter_map(|value| value["path"].as_str()).collect();
+    if !paths.is_empty() {
+        check_write_scope(ctx, args, repo, &paths)?;
+    }
+    let mut body = json!({"resolutions": wire});
+    if let Some(expected) = expected {
+        body["expected_stream_head"] = json!(expected);
+    }
+    Ok(body)
+}
+
 fn workspace_sync(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
     let repo = ctx.repo(args)?;
     let run = ctx.run_id(args)?;
     let name = workspace_name(args, "workspace")?;
-    let mut res = Vec::new();
-    for (i, r) in args.get("resolutions").and_then(Value::as_array).into_iter().flatten().enumerate() {
-        let path = str_arg(r, "path").unwrap_or_default();
-        validate_repo_path(path).map_err(|e| ToolError::invalid(format!("resolutions[{i}].path: {e}")))?;
-        let bytes = match (str_arg(r, "content"), str_arg(r, "content_base64")) {
-            (Some(t), None) => t.as_bytes().to_vec(),
-            (None, Some(b)) => base64::engine::general_purpose::STANDARD
-                .decode(b.trim())
-                .map_err(|e| ToolError::invalid(format!("resolutions[{i}].content_base64: {e}")))?,
-            _ => {
-                return Err(ToolError::invalid(format!(
-                    "resolutions[{i}]: give exactly one of `content` or `content_base64`"
-                )));
-            }
-        };
-        res.push((path.to_string(), bytes));
-    }
-    let paths: Vec<&str> = res.iter().map(|(p, _)| p.as_str()).collect();
-    if !paths.is_empty() {
-        check_write_scope(ctx, args, &repo, &paths)?;
-    }
-    let wire: Vec<Value> = res
-        .iter()
-        .map(|(p, b)| json!({"path": p, "op": "put", "content": base64::engine::general_purpose::STANDARD.encode(b)}))
-        .collect();
-    let v = ctx.api.send(
+    let body = sync_body(ctx, args, &repo, run)?;
+    let value = ctx.api.send(
         "POST",
         &format!("{}/workspaces/{}/sync", repo_path(&repo), enc(&name)),
-        Some(&json!({"resolutions": wire})),
+        Some(&body),
         &ctx.opts(run),
     )?;
-    let status = v.get("status").and_then(Value::as_str).unwrap_or("");
+    Ok(sync_output(&name, &value))
+}
+
+fn sync_output(name: &str, value: &Value) -> ToolOutput {
+    let status = value.get("status").and_then(Value::as_str).unwrap_or("");
     let conflicts: Vec<Value> =
-        v.get("conflicts").and_then(Value::as_array).into_iter().flatten().take(200).cloned().collect();
+        value.get("conflicts").and_then(Value::as_array).into_iter().flatten().take(200).cloned().collect();
     let summary = match status {
         "up_to_date" => format!("Workspace `{name}` already contains the stream head."),
         "fast_forwarded" => format!("Workspace `{name}` was fast-forwarded to the stream head."),
@@ -313,12 +389,18 @@ fn workspace_sync(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolErr
     };
     let mut out = ToolOutput::new(
         summary,
-        json!({"status": status, "head": v.get("head").cloned().unwrap_or(json!("")), "conflicts": conflicts}),
+        json!({"status": status, "head": value.get("head").cloned().unwrap_or(json!("")), "stream_head": value.get("stream_head").cloned().unwrap_or(json!("")), "conflicts": conflicts}),
     );
     if status == "conflicted" {
-        out = out.note("Read both versions with read_file (rev = the stream, and rev = @<workspace>), decide the final content of each conflicting path, then call workspace_sync again with `resolutions` for every conflicting path.");
+        let pinned = value.get("stream_head").and_then(Value::as_str).is_some_and(|head| !head.is_empty());
+        let advice = if pinned {
+            "Read both versions at the returned stream_head and your workspace revision. Decide every conflicting path, then repeat workspace_sync with expected_stream_head set to that inspected stream_head and resolutions for every conflict. Existing blob ids preserve binary content, file type and executable mode."
+        } else {
+            "This server did not identify a pinned branch revision. Upgrade it before applying an inspected resolution through MCP, or resolve through the local CLI. Do not treat the moving branch name as the reviewed revision."
+        };
+        out = out.note(advice);
     }
-    Ok(out)
+    out
 }
 
 fn workspace_delete(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
@@ -353,7 +435,11 @@ pub fn tools() -> Vec<ToolDef> {
         "properties": {
             "path": {"type": "string", "maxLength": 1024, "description": "A conflicting path."},
             "content": {"type": "string", "description": "The resolved content as text."},
-            "content_base64": {"type": "string", "description": "The resolved content, base64."}
+            "content_base64": {"type": "string", "description": "The resolved content, base64."},
+            "blob_id": {"type":"string","description":"Existing content blob to retain without downloading or re-encoding it.","minLength":64,"maxLength":64},
+            "op": {"type":"string","enum":["put","delete"],"description":"Defaults to put. Delete takes no content source."},
+            "file_type": {"type":"string","enum":["regular","symlink"],"description":"Type to preserve for put; defaults to regular."},
+            "executable": {"type":"boolean","description":"Executable mode to preserve for put."}
         }
     });
     vec![
@@ -416,13 +502,23 @@ pub fn tools() -> Vec<ToolDef> {
                 vec![
                     p_repo(),
                     ("workspace", t_str_max("Workspace name.", 64)),
-                    ("resolutions", t_arr("Final content for every conflicting path.", resolution, MAX_CHANGES)),
+                    (
+                        "resolutions",
+                        t_arr("Final content or existing blobs for every conflicting path.", resolution, MAX_CHANGES),
+                    ),
+                    (
+                        "expected_stream_head",
+                        t_str("Exact branch head inspected when preparing these resolutions; reject if it moved."),
+                    ),
                     ("lease_id", t_str("Check the resolved paths against this lease before writing.")),
                     p_run(),
                 ],
                 &["workspace"],
             ),
-            output(vec![("status", o_str()), ("head", o_str()), ("conflicts", o_arr())], &["status", "conflicts"]),
+            output(
+                vec![("status", o_str()), ("head", o_str()), ("stream_head", o_str()), ("conflicts", o_arr())],
+                &["status", "conflicts"],
+            ),
             workspace_sync,
         ),
         def(
@@ -474,4 +570,43 @@ mod tests {
             "too_large"
         );
     }
+    #[test]
+    fn resolutions_keep_blob_identity_type_mode_and_deletion() {
+        let blob = "a".repeat(64);
+        let values = parse_resolutions(&[
+            json!({"path":"image.bin","blob_id":blob,"executable":true,"file_type":"regular"}),
+            json!({"path":"link","blob_id":"b".repeat(64),"file_type":"symlink"}),
+            json!({"path":"gone","op":"delete"}),
+        ])
+        .unwrap();
+        assert_eq!(
+            values[0],
+            json!({"path":"image.bin","op":"put","blob_id":blob,"executable":true,"file_type":"regular"})
+        );
+        assert_eq!(values[1]["file_type"], "symlink");
+        assert_eq!(values[2], json!({"path":"gone","op":"delete"}));
+    }
+
+    #[test]
+    fn resolutions_reject_ambiguous_sources_and_duplicate_paths() {
+        for value in [
+            json!({"path":"a","content":"text","blob_id":"a".repeat(64)}),
+            json!({"path":"a","content_base64":"!!"}),
+            json!({"path":"a","blob_id":"short"}),
+            json!({"path":"a","op":"delete","content":"text"}),
+            json!({"path":"a","content":"text","file_type":"directory"}),
+        ] {
+            assert!(parse_resolutions(&[value]).is_err());
+        }
+        assert!(parse_resolutions(&[json!({"path":"a","content":""}), json!({"path":"a","op":"delete"})]).is_err());
+    }
+    #[test]
+    fn sync_guidance_never_treats_an_absent_target_as_a_safe_pin() {
+        let legacy = sync_output("work", &json!({"status":"conflicted","conflicts":[]}));
+        let advice = legacy.notes.join(" ");
+        assert!(advice.contains("upgrade") || advice.contains("Upgrade"));
+        assert!(!advice.contains("expected_stream_head"));
+        let pinned = sync_output("work", &json!({"status":"conflicted","stream_head":"known","conflicts":[]}));
+        assert!(pinned.notes.join(" ").contains("expected_stream_head"));
+    }
 }
diff --git a/crates/ag-mcp/tests/sync_precondition.rs b/crates/ag-mcp/tests/sync_precondition.rs
new file mode 100644
index 00000000..1aae052e
--- /dev/null
+++ b/crates/ag-mcp/tests/sync_precondition.rs
@@ -0,0 +1,76 @@
+//! Pinned conflict resolutions preserve their source and reject an obsolete target.
+#![allow(missing_docs)]
+mod common;
+use common::*;
+use serde_json::json;
+
+#[test]
+fn workspace_sync_returns_and_checks_the_inspected_stream_head() {
+    let srv = TestServer::start();
+    let repo = "acme/pinned";
+    srv.repo(repo);
+    srv.seed(repo, "base", &[("file", "base\n")]);
+    let author = srv.credential("user:author", repo, "writer", 3600, &[]);
+    let mut m = Mcp::start(&srv, &author, &["--repo", repo]);
+    m.ok("workspace_create", json!({"name":"mine"}));
+    let written = m.ok(
+        "workspace_write_files",
+        json!({"workspace":"mine","message":"ours","changes":[{"path":"file","op":"put","content":"ours\n"}]}),
+    );
+    let source = srv
+        .http(&author)
+        .get(&format!("/v1/repos/{repo}/tree/resolve?path=file&rev={}", written.structured["head"].as_str().unwrap()));
+    assert_eq!(source.0, 200);
+    let blob = source.1["entry"]["blob_id"].as_str().unwrap();
+    let inspected = srv.seed(repo, "theirs", &[("file", "theirs\n")]);
+    let sync = m.ok("workspace_sync", json!({"workspace":"mine"}));
+    assert_eq!(sync.structured["status"], "conflicted");
+    assert_eq!(sync.structured["stream_head"], inspected);
+    let newer = srv.seed(repo, "newer", &[("file", "newer\n")]);
+    m.refused("workspace_sync", json!({"workspace":"mine","expected_stream_head":inspected,"resolutions":[{"path":"file","content":"resolved\n"}]}), "failed_precondition");
+    let done = m.ok("workspace_sync", json!({"workspace":"mine","expected_stream_head":newer,"resolutions":[{"path":"file","blob_id":blob,"file_type":"regular","executable":true}]}));
+    assert_eq!(done.structured["status"], "merged");
+    assert_eq!(done.structured["stream_head"], newer);
+    let file = m.ok("read_file", json!({"path":"file","rev":"@mine"}));
+    assert!(file.text.contains("ours"));
+    let result = srv
+        .http(&author)
+        .get(&format!("/v1/repos/{repo}/tree/resolve?path=file&rev={}", done.structured["head"].as_str().unwrap()));
+    assert_eq!(result.0, 200);
+    assert_eq!(result.1["entry"]["blob_id"], blob);
+    assert_eq!(result.1["entry"]["executable"], true);
+}
+
+#[test]
+fn older_servers_refuse_pinned_sync_without_writing() {
+    use std::io::{BufRead, BufReader, Write};
+    use std::net::TcpListener;
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let url = format!("http://{}", listener.local_addr().unwrap());
+    let response = std::thread::spawn(move || {
+        let (mut stream, _) = listener.accept().unwrap();
+        let mut input = BufReader::new(stream.try_clone().unwrap());
+        let mut line = String::new();
+        input.read_line(&mut line).unwrap();
+        assert!(line.starts_with("GET /v1/capabilities "), "{line}");
+        loop {
+            let mut header = String::new();
+            input.read_line(&mut header).unwrap();
+            if header == "\r\n" || header.is_empty() {
+                break;
+            }
+        }
+        let body = r#"{"features":[]}"#;
+        write!(
+            stream,
+            "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
+            body.len(),
+            body
+        )
+        .unwrap();
+    });
+    let mut m = Mcp::spawn(&["--server", &url, "--repo", "acme/pinned"], &[("AG_MCP_TOKEN", "test")]);
+    m.request("server/discover", json!({}));
+    m.refused("workspace_sync", json!({"workspace":"mine","expected_stream_head":"seen"}), "server_update_required");
+    response.join().unwrap();
+}
diff --git a/crates/ag-protocol/build.rs b/crates/ag-protocol/build.rs
index c02dc33e..33d290e1 100644
--- a/crates/ag-protocol/build.rs
+++ b/crates/ag-protocol/build.rs
@@ -47,6 +47,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         builder = builder.field_attribute(format!("agwp.v1.FileDiff.{field}"), "#[schema(required = false)]");
     }
     builder = builder.field_attribute("agwp.v1.ProposalDetail.requested_reviewers", "#[schema(required = false)]");
+    builder = builder.field_attribute("agwp.v1.SyncWorkspaceResponse.stream_head", "#[schema(required = false)]");
     builder.compile_fds(fds)?;
     Ok(())
 }
diff --git a/crates/ag-protocol/proto/agwp/v1/agwp.proto b/crates/ag-protocol/proto/agwp/v1/agwp.proto
index a77069b4..11dc900f 100644
--- a/crates/ag-protocol/proto/agwp/v1/agwp.proto
+++ b/crates/ag-protocol/proto/agwp/v1/agwp.proto
@@ -668,6 +668,9 @@ message SyncWorkspaceRequest {
   // sync changes nothing and reports the conflicts; with them the clean
   // parts of the merge plus these files become a two-parent merge changeset.
   repeated FileChange resolutions = 4;
+  // Optional branch revision inspected while preparing these resolutions.
+  // A mismatch refuses the sync without moving the workspace.
+  string expected_stream_head = 5;
 }
 
 message SyncWorkspaceResponse {
@@ -675,6 +678,9 @@ message SyncWorkspaceResponse {
   string status = 1;
   string head = 2;
   repeated Conflict conflicts = 3;
+  // Exact branch revision used for this attempt; empty for an empty branch.
+  // Older servers omit this field; negotiate workspaces.sync_precondition.
+  string stream_head = 4;
 }
 
 // ---------------------------------------------------------------------------
diff --git a/crates/ag-protocol/src/lib.rs b/crates/ag-protocol/src/lib.rs
index 44546760..a9f3a9a6 100644
--- a/crates/ag-protocol/src/lib.rs
+++ b/crates/ag-protocol/src/lib.rs
@@ -94,10 +94,14 @@ pub mod features {
     /// Task completion compares both the execution generation and retry policy.
     pub const TASK_FINISH_PRECONDITIONS: &str = "tasks.finish_preconditions";
 
+    /// Virtual sync compares the branch revision inspected by a resolving client.
+    pub const WORKSPACES_SYNC_PRECONDITION: &str = "workspaces.sync_precondition";
+
     /// Every feature this implementation knows.
     pub const ALL: &[&str] = &[
         EVENTS_REPLAY,
         WORKSPACES_VIRTUAL,
+        WORKSPACES_SYNC_PRECONDITION,
         EXECUTION_JOBS,
         OBJECTS_CHUNKED,
         AUTH_OIDC,
diff --git a/crates/ag-server/src/api/workspaces.rs b/crates/ag-server/src/api/workspaces.rs
index eb2f55bf..58d1226f 100644
--- a/crates/ag-server/src/api/workspaces.rs
+++ b/crates/ag-server/src/api/workspaces.rs
@@ -116,27 +116,38 @@ impl App {
     ) -> ApiResult<v1::SyncWorkspaceResponse> {
         let repo_name = require(&req.repo, "repo")?.to_string();
         let resolutions = changes(&req.resolutions)?;
+        let expected = if req.expected_stream_head.is_empty() {
+            None
+        } else {
+            Some(parse_id::<ChangesetId>(&req.expected_stream_head, "inspected branch head")?)
+        };
         let admin = self.is_repo_admin(call, &repo_name).await;
         let name = req.name.clone();
-        self.with_workspace_mut(call, &repo_name, Cap::WorkspaceWrite, name.clone(), move |repo, actor, observed| {
+        self.with_workspace_mut(call, &repo_name, Cap::WorkspaceWrite, name, move |repo, actor, observed| {
             check_owner(observed, actor, admin)?;
-            let outcome = repo.workspace_sync_virtual_checked(observed, actor, &resolutions)?;
-            let head = repo.workspace_row(&name)?.head.map(|h| h.to_string()).unwrap_or_default();
-            Ok(match outcome {
-                SyncOutcome::UpToDate => {
-                    v1::SyncWorkspaceResponse { status: "up_to_date".into(), head, conflicts: vec![] }
-                }
-                SyncOutcome::FastForwarded { .. } => {
-                    v1::SyncWorkspaceResponse { status: "fast_forwarded".into(), head, conflicts: vec![] }
+            let current = repo.meta().read(|tx| tx.stream(&observed.stream))?.and_then(|s| s.state.head);
+            let target = expected.or(current);
+            let outcome = repo.workspace_sync_virtual_checked_at(observed, actor, &resolutions, target.as_ref())?;
+            let head = match &outcome {
+                SyncOutcome::FastForwarded { to } => Some(*to),
+                SyncOutcome::Merged { id } => Some(*id),
+                _ => observed.head,
+            }
+            .map(|head| head.to_string())
+            .unwrap_or_default();
+            let (status, conflicts) = match outcome {
+                SyncOutcome::UpToDate => ("up_to_date", vec![]),
+                SyncOutcome::FastForwarded { .. } => ("fast_forwarded", vec![]),
+                SyncOutcome::Merged { .. } => ("merged", vec![]),
+                SyncOutcome::Conflicted { conflicts } => {
+                    ("conflicted", conflicts.iter().map(convert::conflict).collect())
                 }
-                SyncOutcome::Merged { .. } => {
-                    v1::SyncWorkspaceResponse { status: "merged".into(), head, conflicts: vec![] }
-                }
-                SyncOutcome::Conflicted { conflicts } => v1::SyncWorkspaceResponse {
-                    status: "conflicted".into(),
-                    head,
-                    conflicts: conflicts.iter().map(convert::conflict).collect(),
-                },
+            };
+            Ok(v1::SyncWorkspaceResponse {
+                status: status.into(),
+                head,
+                conflicts,
+                stream_head: target.map(|head| head.to_string()).unwrap_or_default(),
             })
         })
         .await
diff --git a/crates/ag-server/tests/pinned_sync.rs b/crates/ag-server/tests/pinned_sync.rs
new file mode 100644
index 00000000..94ee3319
--- /dev/null
+++ b/crates/ag-server/tests/pinned_sync.rs
@@ -0,0 +1,64 @@
+//! Virtual sync binds resolutions to the branch revision the client inspected.
+mod common;
+use ag_protocol::v1::{self, workspace_service_client::WorkspaceServiceClient};
+use common::*;
+use serde_json::json;
+use tonic::{Code, Request};
+fn authorized<T>(token: &str, body: T) -> Request<T> {
+    let mut request = Request::new(body);
+    request.metadata_mut().insert("authorization", format!("Bearer {token}").parse().unwrap());
+    request
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn sync_rejects_a_stale_target_and_reports_the_exact_branch_used() {
+    let server = TestServer::start().await;
+    let admin = server.admin();
+    assert_eq!(admin.post("/v1/repos", json!({"name":"acme/pinned"})).await.status, 200);
+    assert_eq!(
+        admin.post("/v1/repos/acme/pinned/workspaces", json!({"name":"work","stream":"main"})).await.status,
+        200
+    );
+    let sync = "/v1/repos/acme/pinned/workspaces/work/sync";
+    let stale = admin.post(sync, json!({"expected_stream_head":"0".repeat(64)})).await;
+    assert_eq!(stale.status, 412, "{}", stale.json);
+    let workspace = admin.get("/v1/repos/acme/pinned/workspaces/work").await;
+    assert_eq!(workspace.json["head"], "");
+    let (head, objects) =
+        Client::new("acme/pinned").commit(vec![], "user:admin", "first", &[("file", b"content")], 1_700_000_000_000);
+    upload(&admin, "acme/pinned", &objects).await;
+    let published = admin
+        .post(
+            "/v1/repos/acme/pinned/proposals",
+            json!({"stream":"main","head":head.to_string(),"title":"publish initial"}),
+        )
+        .await;
+    assert_eq!(published.status, 200, "{}", published.json);
+    let moved = admin
+        .post(
+            "/v1/repos/acme/pinned/streams/cas",
+            json!({"stream":"main","expected_version":0,"new_head":head.to_string()}),
+        )
+        .await;
+    assert_eq!(moved.status, 200, "{}", moved.json);
+    let synced = admin.post(sync, json!({"expected_stream_head":head.to_string()})).await;
+    assert_eq!(synced.status, 200, "{}", synced.json);
+    assert_eq!(synced.json["head"], head.to_string());
+    assert_eq!(synced.json["stream_head"], head.to_string());
+    let mut grpc = WorkspaceServiceClient::connect(server.base.clone()).await.unwrap();
+    let stale = v1::SyncWorkspaceRequest {
+        repo: "acme/pinned".into(),
+        name: "work".into(),
+        expected_stream_head: "0".repeat(64),
+        ..Default::default()
+    };
+    assert_eq!(grpc.sync(authorized(&admin.token, stale)).await.unwrap_err().code(), Code::FailedPrecondition);
+    let pinned = v1::SyncWorkspaceRequest {
+        repo: "acme/pinned".into(),
+        name: "work".into(),
+        expected_stream_head: head.to_string(),
+        ..Default::default()
+    };
+    assert_eq!(grpc.sync(authorized(&admin.token, pinned)).await.unwrap().into_inner().stream_head, head.to_string());
+    server.stop().await;
+}
diff --git a/docs/adr/0037-pinned-workspace-sync.md b/docs/adr/0037-pinned-workspace-sync.md
new file mode 100644
index 00000000..4c179291
--- /dev/null
+++ b/docs/adr/0037-pinned-workspace-sync.md
@@ -0,0 +1,33 @@
+# ADR 0037: revision-bound workspace conflict resolution
+
+Status: accepted.
+
+## Decision
+
+A client resolving a virtual-workspace conflict must know both immutable revisions it
+is choosing between. `SyncWorkspaceResponse.stream_head` names the exact target branch
+revision used by that attempt, including an empty string for an empty branch. It is not a
+later read of the branch. The response head likewise names the result of this attempt.
+
+A resolving client sends `expected_stream_head` on the next sync. The engine checks that
+head before preparing a merge and inside the metadata transaction that moves the
+workspace. A branch move rejects the operation with the existing failed-precondition
+response. The existing workspace head/base check remains in force. A rejected operation
+does not publish a different workspace or proposal head; prepared immutable objects may
+be reclaimed by normal GC.
+
+The API pins each individual attempt to the branch snapshot it read, including empty
+branches. Clients that need continuity between preview and save negotiate
+`workspaces.sync_precondition`; old servers may ignore unknown request fields and do
+not supply the target revision. Clients must not silently fall back when applying an
+inspected resolution.
+
+For binary, oversized or type-changing files, the Web UI selects an existing version by
+its blob identifier, type and executable bit. It does not decode and re-encode those
+bytes. Definite missing paths may resolve to deletion; failed or unauthorized reads
+remain errors. Text edits retain their original encoding markers, line ending style and
+mode. Structural file/directory and rename conflicts remain explicit CLI work.
+
+The final proposal update still compares its inspected head. Session cancellation keeps
+cleanup tied to the initiating credential. None of this changes policy, approval,
+canonical history or stored metadata formats; no database migration is required.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index cabe75d1..f9ade4e2 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -48,3 +48,5 @@ which test: [ADR traceability](../architecture/adr-traceability.md).
 - [0035 — Task completion execution generation](0035-task-completion-generation.md)
 
 - [0036 — Requested reviewers](0036-requested-reviewers.md)
+
+- [0037 — Pinned workspace sync](0037-pinned-workspace-sync.md)
diff --git a/docs/guides/web-ui.md b/docs/guides/web-ui.md
index 43d179fc..157710ec 100644
--- a/docs/guides/web-ui.md
+++ b/docs/guides/web-ui.md
@@ -388,8 +388,15 @@ the listing, and opening another folder resets it.
 **Resolve the conflict.** When a change request no longer merges with its branch, its author sees *Resolve the
 conflict* (everyone else sees *Copy link to send to the author*). The resolver shows, per file, the branch's version and
 yours, with *Keep the branch's*, *Keep mine*, *Delete the file* and a text box for the result. Saving applies the
-resolutions through the draft and moves the change request to the merged version. Conflicts that are not about text
-(binary files, renames, type changes) say to use the command line.
+resolutions through the draft and moves the change request to the merged version. Binary files, oversized files and
+file-type changes can keep either exact version or delete the file: the original blob, type and executable mode are
+retained without converting bytes to text. Editing is available only for regular text versions. Renames and
+file/directory conflicts remain command-line work.
+
+The resolver pins both the proposal revision and the target branch. If either changes before saving, the newer
+work is preserved and the dialog asks you to inspect it again. Failed reads never mean a deleted file. This flow
+requires `proposals.update_head` and `workspaces.sync_precondition`; older servers need an upgrade before browser
+conflict resolution is available.
 
 ## Plain words
 
diff --git a/docs/protocol/agwp-v1.md b/docs/protocol/agwp-v1.md
index baa5afba..27ae0628 100644
--- a/docs/protocol/agwp-v1.md
+++ b/docs/protocol/agwp-v1.md
@@ -373,3 +373,16 @@ identities are retained in sorted order. The author cannot request their own rev
 Proposal detail includes optional `requested_reviewers`. A request grants no access and
 is not an approval. It remains after the head moves; review status is evaluated against
 the current head. Schema 9 stores these requests; back up before upgrading from schema 8.
+
+### Revision-bound virtual sync (development)
+
+Negotiate `workspaces.sync_precondition` before applying conflict choices from a prior
+preview. Sync replies include `stream_head`, the exact target revision used by the
+attempt. Send it as `expected_stream_head` with resolved files; a changed branch returns
+HTTP 412 / gRPC FailedPrecondition before the workspace can move. The workspace's own
+concurrency checks continue to apply. Older servers may omit the reply field or ignore
+the request field, so silently falling back would lose the preview's protection.
+
+A resolution may reference an existing `blob_id` together with `file_type` and
+`executable`, or delete a path. Keeping a binary or symlink version therefore preserves
+its original bytes and metadata. New text remains an ordinary inline file change.
diff --git a/docs/protocol/openapi.json b/docs/protocol/openapi.json
index 6d21274c..4b5fc3f0 100644
--- a/docs/protocol/openapi.json
+++ b/docs/protocol/openapi.json
@@ -5399,6 +5399,11 @@
       },
       "SyncWorkspaceRequest": {
         "properties": {
+          "expected_stream_head": {
+            "default": "",
+            "description": "Optional branch revision inspected while preparing these resolutions.\nA mismatch refuses the sync without moving the workspace.",
+            "type": "string"
+          },
           "idempotency_key": {
             "default": "",
             "description": "Accepted and ignored: this operation does not deduplicate (see Conventions above).",
@@ -5440,6 +5445,11 @@
             "default": "",
             "description": "\"up_to_date\", \"fast_forwarded\", \"merged\" or \"conflicted\".",
             "type": "string"
+          },
+          "stream_head": {
+            "default": "",
+            "description": "Exact branch revision used for this attempt; empty for an empty branch.\nOlder servers omit this field; negotiate workspaces.sync_precondition.",
+            "type": "string"
           }
         },
         "type": "object"
diff --git a/proto/agwp/v1/agwp.proto b/proto/agwp/v1/agwp.proto
index a77069b4..11dc900f 100644
--- a/proto/agwp/v1/agwp.proto
+++ b/proto/agwp/v1/agwp.proto
@@ -668,6 +668,9 @@ message SyncWorkspaceRequest {
   // sync changes nothing and reports the conflicts; with them the clean
   // parts of the merge plus these files become a two-parent merge changeset.
   repeated FileChange resolutions = 4;
+  // Optional branch revision inspected while preparing these resolutions.
+  // A mismatch refuses the sync without moving the workspace.
+  string expected_stream_head = 5;
 }
 
 message SyncWorkspaceResponse {
@@ -675,6 +678,9 @@ message SyncWorkspaceResponse {
   string status = 1;
   string head = 2;
   repeated Conflict conflicts = 3;
+  // Exact branch revision used for this attempt; empty for an empty branch.
+  // Older servers omit this field; negotiate workspaces.sync_precondition.
+  string stream_head = 4;
 }
 
 // ---------------------------------------------------------------------------
diff --git a/sdk/api-policy.json b/sdk/api-policy.json
index 4a8817eb..68c9d517 100644
--- a/sdk/api-policy.json
+++ b/sdk/api-policy.json
@@ -51,12 +51,12 @@
       "task.depend",
       "task.finish",
       "workspace.delete",
-      "workspace.sync",
       "migration.commit",
       "proposal.set_reviewers"
     ],
     "naturalWhenFieldPresent": {
-      "workspace.modify": "expected_head"
+      "workspace.modify": "expected_head",
+      "workspace.sync": "expected_stream_head"
     }
   },
   "alwaysPresent": {
diff --git a/sdk/python/README.md b/sdk/python/README.md
index 92b80c9b..aafaa6fc 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -517,3 +517,22 @@ if os.environ.get("AGENTGIT_PUBLISH") == "1":
 `migrations.status(id=plan.id)` resumes a report. The same methods exist on
 `AsyncAgentGitClient`. Binary uploads keep one idempotency key across automatic retries.
 See [migration limits and what transfers](../../docs/guides/migrate-from-git.md).
+
+
+### Resolve against an inspected branch revision
+
+Negotiate `workspaces.sync_precondition` before relying on `expected_stream_head` in
+`workspaces.sync`. A conflicting sync returns `stream_head`, the exact branch revision
+used to prepare its conflicts. Read that immutable revision and repeat sync with the
+same `expected_stream_head` plus the chosen resolutions. If the branch moved, the server
+returns a precondition failure instead of applying stale choices. Read and decide again;
+do not silently retry with a newer head.
+
+A resolution can retain an existing `blob_id`, `file_type` and `executable` value without
+fetching or re-encoding its bytes. `op: delete` removes the path. Older servers omit
+`stream_head`; they must be upgraded before using the pinning guarantee.
+
+Workspace sync is retried automatically only when `expected_stream_head` is nonempty.
+An unpinned sync can apply resolutions against a moving branch, so a lost response
+leaves its outcome unknown and is not retried by default. Explicit unsafe-retry opt-in
+remains available for callers that deliberately accept that risk.
diff --git a/sdk/python/src/agentgit/_generated/models.py b/sdk/python/src/agentgit/_generated/models.py
index 83776680..0798bb5e 100644
--- a/sdk/python/src/agentgit/_generated/models.py
+++ b/sdk/python/src/agentgit/_generated/models.py
@@ -2141,6 +2141,7 @@ class SubmitProvenanceRequest:
 @dataclass(kw_only=True)
 class SyncWorkspaceRequest:
     """The `SyncWorkspaceRequest` message."""
+    expected_stream_head: str = field(default="")
     idempotency_key: str = field(default="")
     name: str = field(default="")
     repo: str = field(default="")
@@ -2153,6 +2154,7 @@ class SyncWorkspaceResponse:
     conflicts: list[Conflict] = field(default_factory=list)
     head: str = field(default="")
     status: str = field(default="")
+    stream_head: str = field(default="")
 
 
 @dataclass(kw_only=True)
diff --git a/sdk/python/src/agentgit/_generated/namespaces.py b/sdk/python/src/agentgit/_generated/namespaces.py
index d38123ad..4f0f9feb 100644
--- a/sdk/python/src/agentgit/_generated/namespaces.py
+++ b/sdk/python/src/agentgit/_generated/namespaces.py
@@ -1867,12 +1867,13 @@ def sync(
         *,
         repo: str,
         name: str,
+        expected_stream_head: str | None = None,
         idempotency_key: str | None = None,
         resolutions: Sequence[FileChange | Mapping[str, Any]] | None = None,
         options: CallOptions | None = None,
     ) -> SyncWorkspaceResponse:
         """Bring the stream head into the workspace (with optional conflict resolutions) (`POST /v1/repos/{owner}/{rname}/workspaces/{name}/sync`, operation `workspace.sync`)."""
-        return self._c._call("workspace.sync", {"repo": repo, "name": name, "idempotency_key": idempotency_key, "resolutions": resolutions}, options, SyncWorkspaceResponse)
+        return self._c._call("workspace.sync", {"repo": repo, "name": name, "expected_stream_head": expected_stream_head, "idempotency_key": idempotency_key, "resolutions": resolutions}, options, SyncWorkspaceResponse)
 
 
 
@@ -3503,9 +3504,10 @@ async def sync(
         *,
         repo: str,
         name: str,
+        expected_stream_head: str | None = None,
         idempotency_key: str | None = None,
         resolutions: Sequence[FileChange | Mapping[str, Any]] | None = None,
         options: CallOptions | None = None,
     ) -> SyncWorkspaceResponse:
         """Bring the stream head into the workspace (with optional conflict resolutions) (`POST /v1/repos/{owner}/{rname}/workspaces/{name}/sync`, operation `workspace.sync`)."""
-        return await self._c._call("workspace.sync", {"repo": repo, "name": name, "idempotency_key": idempotency_key, "resolutions": resolutions}, options, SyncWorkspaceResponse)
+        return await self._c._call("workspace.sync", {"repo": repo, "name": name, "expected_stream_head": expected_stream_head, "idempotency_key": idempotency_key, "resolutions": resolutions}, options, SyncWorkspaceResponse)
diff --git a/sdk/python/src/agentgit/_generated/operations.py b/sdk/python/src/agentgit/_generated/operations.py
index 90a14983..502e681e 100644
--- a/sdk/python/src/agentgit/_generated/operations.py
+++ b/sdk/python/src/agentgit/_generated/operations.py
@@ -1817,7 +1817,8 @@
         query_params=(),
         body="json",
         response="json",
-        retry="natural",
+        retry="unsafe",
+        retry_when_field="expected_stream_head",
         idempotency_key=True,
         public=False,
     ),
diff --git a/sdk/python/tests/test_all_operations.py b/sdk/python/tests/test_all_operations.py
index 44991a24..ec56373b 100644
--- a/sdk/python/tests/test_all_operations.py
+++ b/sdk/python/tests/test_all_operations.py
@@ -21,6 +21,7 @@
     AgentGitClient,
     AsyncAgentGitClient,
     CallOptions,
+    FailedPreconditionError,
     PutOp,
     blob_object,
     build_changeset,
@@ -217,6 +218,11 @@ def test_workspaces_proposals_reviews_and_the_execution_plane(tour: dict[str, Ag
     ran = carol.queue.run(repo=REPO, stream="main")
     assert (ran.processed[0].state, ran.processed[0].outcome) == ("done", "integrated")
     Seed.head = m2.head
+    assert "workspaces.sync_precondition" in alice.negotiate().features
+    pinned = alice.workspaces.sync(repo=REPO, name="w1", expected_stream_head=Seed.head)
+    assert pinned.stream_head == Seed.head
+    with pytest.raises(FailedPreconditionError):
+        alice.workspaces.sync(repo=REPO, name="w1", expected_stream_head="0" * 64)
 
     alice.workspaces.create(repo=REPO, name="w2", stream="main")
     m3 = alice.workspaces.modify(repo=REPO, name="w2", changes=[put_file("e.txt", "e\n")])
diff --git a/sdk/python/tests/test_sync_precondition.py b/sdk/python/tests/test_sync_precondition.py
new file mode 100644
index 00000000..5b7711f9
--- /dev/null
+++ b/sdk/python/tests/test_sync_precondition.py
@@ -0,0 +1,98 @@
+import json
+
+import httpx
+import pytest
+
+from agentgit import AgentGitClient, CallOptions, RetryPolicy, UnavailableError
+
+
+def test_sync_sends_inspected_head_and_preserves_blob_resolution() -> None:
+    requests: list[httpx.Request] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(
+            200, json={"status": "merged", "head": "merged", "stream_head": "inspected", "conflicts": []}
+        )
+
+    with AgentGitClient(
+        "http://sync.test", "test", http_client=httpx.Client(transport=httpx.MockTransport(respond))
+    ) as client:
+        result = client.workspaces.sync(
+            repo="team/app",
+            name="work",
+            expected_stream_head="inspected",
+            resolutions=[
+                {
+                    "path": "image.bin",
+                    "op": "put",
+                    "blob_id": "original-blob",
+                    "file_type": "regular",
+                    "executable": True,
+                }
+            ],
+        )
+    assert result.stream_head == "inspected"
+    assert json.loads(requests[0].content)["expected_stream_head"] == "inspected"
+    assert json.loads(requests[0].content)["resolutions"][0]["blob_id"] == "original-blob"
+
+
+def test_older_sync_response_defaults_missing_stream_head() -> None:
+    def respond(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json={"status": "up_to_date", "head": "old", "conflicts": []})
+
+    with AgentGitClient(
+        "http://sync.test", "test", http_client=httpx.Client(transport=httpx.MockTransport(respond))
+    ) as client:
+        result = client.workspaces.sync(repo="team/app", name="work")
+    assert result.stream_head == ""
+
+
+@pytest.mark.parametrize("pin", [None, "", "inspected"])
+def test_only_nonempty_pins_retry_lost_sync_responses(pin: str | None) -> None:
+    bodies: list[bytes] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        bodies.append(request.content)
+        if len(bodies) == 1:
+            raise httpx.ReadError("response lost after applying the merge", request=request)
+        return httpx.Response(
+            200, json={"status": "up_to_date", "head": "merged", "stream_head": "inspected", "conflicts": []}
+        )
+
+    with AgentGitClient(
+        "http://sync.test", "test", http_client=httpx.Client(transport=httpx.MockTransport(respond))
+    ) as client:
+        if pin:
+            assert (
+                client.workspaces.sync(repo="team/app", name="work", expected_stream_head=pin).head
+                == "merged"
+            )
+            assert len(bodies) == 2
+            assert bodies[0] == bodies[1]
+        else:
+            with pytest.raises(UnavailableError) as error:
+                client.workspaces.sync(repo="team/app", name="work", expected_stream_head=pin)
+            assert error.value.attempts == 1
+            assert error.value.outcome_unknown
+            assert len(bodies) == 1
+
+
+def test_unpinned_sync_retains_explicit_unsafe_retry_opt_in() -> None:
+    calls = 0
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        nonlocal calls
+        calls += 1
+        if calls == 1:
+            raise httpx.ReadError("response lost", request=request)
+        return httpx.Response(200, json={"status": "up_to_date", "head": "done", "conflicts": []})
+
+    with AgentGitClient(
+        "http://sync.test", "test", http_client=httpx.Client(transport=httpx.MockTransport(respond))
+    ) as client:
+        result = client.workspaces.sync(
+            repo="team/app", name="work", options=CallOptions(retry=RetryPolicy(retry_unsafe=True))
+        )
+    assert result.head == "done"
+    assert calls == 2
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index 138af717..e882f8c2 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -479,3 +479,21 @@ if (process.env['AGENTGIT_PUBLISH'] === '1') {
 `client.migrations.status({ id: plan.id })` resumes a report. Binary uploads keep one
 idempotency key across automatic retries. See
 [migration limits and what transfers](../../docs/guides/migrate-from-git.md).
+
+### Resolve against an inspected branch revision
+
+Negotiate `workspaces.sync_precondition` before relying on `expected_stream_head` in
+`workspaces.sync`. A conflicting sync returns `stream_head`, the exact branch revision
+used to prepare its conflicts. Read that immutable revision and repeat sync with the
+same `expected_stream_head` plus the chosen resolutions. If the branch moved, the server
+returns a precondition failure instead of applying stale choices. Read and decide again;
+do not silently retry with a newer head.
+
+A resolution can retain an existing `blob_id`, `file_type` and `executable` value without
+fetching or re-encoding its bytes. `op: delete` removes the path. Older servers omit
+`stream_head`; they must be upgraded before using the pinning guarantee.
+
+Workspace sync is retried automatically only when `expected_stream_head` is nonempty.
+An unpinned sync can apply resolutions against a moving branch, so a lost response
+leaves its outcome unknown and is not retried by default. Explicit unsafe-retry opt-in
+remains available for callers that deliberately accept that risk.
diff --git a/sdk/typescript/scripts/generate.mjs b/sdk/typescript/scripts/generate.mjs
index d376e0cd..f6b9a71e 100644
--- a/sdk/typescript/scripts/generate.mjs
+++ b/sdk/typescript/scripts/generate.mjs
@@ -243,9 +243,14 @@ function withOpenObjects(doc) {
   }
   // Decoded responses are not default-filled in TypeScript. Older servers omit this additive field;
   // preserve the schema's optionality instead of letting its default [] make it required.
-  const detail = copy.components.schemas.ProposalDetail;
-  const requestedReviewers = detail?.properties?.requested_reviewers;
-  if (requestedReviewers && !detail.required?.includes('requested_reviewers')) delete requestedReviewers.default;
+  for (const [schemaName, field] of [
+    ['ProposalDetail', 'requested_reviewers'],
+    ['SyncWorkspaceResponse', 'stream_head'],
+  ]) {
+    const schema = copy.components.schemas[schemaName];
+    const property = schema?.properties?.[field];
+    if (property && !schema.required?.includes(field)) delete property.default;
+  }
   return copy;
 }
 
diff --git a/sdk/typescript/src/generated/operations.ts b/sdk/typescript/src/generated/operations.ts
index 993037f3..12e1de6b 100644
--- a/sdk/typescript/src/generated/operations.ts
+++ b/sdk/typescript/src/generated/operations.ts
@@ -1817,7 +1817,8 @@ export const OPERATIONS = {
     queryParams: [],
     body: 'json',
     response: 'json',
-    retry: 'natural',
+    retry: 'unsafe',
+    retryWhenField: 'expected_stream_head',
     idempotencyKey: true,
     public: false,
   },
diff --git a/sdk/typescript/src/generated/schema.ts b/sdk/typescript/src/generated/schema.ts
index d8111bca..af2b984c 100644
--- a/sdk/typescript/src/generated/schema.ts
+++ b/sdk/typescript/src/generated/schema.ts
@@ -4819,6 +4819,12 @@ export interface components {
             signature: string;
         };
         SyncWorkspaceRequest: {
+            /**
+             * @description Optional branch revision inspected while preparing these resolutions.
+             *     A mismatch refuses the sync without moving the workspace.
+             * @default
+             */
+            expected_stream_head: string;
             /**
              * @description Accepted and ignored: this operation does not deduplicate (see Conventions above).
              * @default
@@ -4846,6 +4852,11 @@ export interface components {
              * @default
              */
             status: string;
+            /**
+             * @description Exact branch revision used for this attempt; empty for an empty branch.
+             *     Older servers omit this field; negotiate workspaces.sync_precondition.
+             */
+            stream_head?: string;
         };
         Task: {
             /**
diff --git a/sdk/typescript/test/all-operations.test.ts b/sdk/typescript/test/all-operations.test.ts
index 25ae8195..9121fa26 100644
--- a/sdk/typescript/test/all-operations.test.ts
+++ b/sdk/typescript/test/all-operations.test.ts
@@ -217,6 +217,12 @@ describe('the tour', () => {
     // (queue states: queued, done, blocked, rejected, failed; outcome explains "done": "integrated")
     expect(ran.processed[0]).toMatchObject({ state: 'done', outcome: 'integrated' });
     seedHead = m2.head;
+    expect((await alice.negotiate()).features).toContain('workspaces.sync_precondition');
+    const pinned = await alice.workspaces.sync({ repo, name: 'w1', expected_stream_head: seedHead });
+    expect(pinned.stream_head).toBe(seedHead);
+    await expect(
+      alice.workspaces.sync({ repo, name: 'w1', expected_stream_head: '0'.repeat(64) }),
+    ).rejects.toMatchObject({ status: 412 });
 
     // a second proposal is attested directly and integrated; a third is closed
     await alice.workspaces.create({ repo, name: 'w2', stream: 'main' });
diff --git a/sdk/typescript/test/sync-precondition.test.ts b/sdk/typescript/test/sync-precondition.test.ts
new file mode 100644
index 00000000..c74125e6
--- /dev/null
+++ b/sdk/typescript/test/sync-precondition.test.ts
@@ -0,0 +1,75 @@
+import { expect, it } from 'vitest';
+import { AgentGitClient, type SyncWorkspaceResponse } from '../src/index.js';
+
+it('sends the inspected stream head with a workspace resolution', async () => {
+  let body: unknown;
+  const client = new AgentGitClient({
+    baseUrl: 'http://sync.test',
+    token: 'test',
+    fetch: async (_input, init) => {
+      if (typeof init?.body !== 'string') throw new Error('Expected a JSON request body');
+      body = JSON.parse(init.body);
+      return Response.json({ status: 'merged', head: 'merged', stream_head: 'inspected', conflicts: [] });
+    },
+  });
+  const result = await client.workspaces.sync({
+    repo: 'team/app',
+    name: 'work',
+    expected_stream_head: 'inspected',
+    resolutions: [
+      { path: 'image.bin', op: 'put', blob_id: 'original-blob', file_type: 'regular', executable: true, content: '' },
+    ],
+  });
+  expect(body).toEqual({
+    expected_stream_head: 'inspected',
+    resolutions: [
+      { path: 'image.bin', op: 'put', blob_id: 'original-blob', file_type: 'regular', executable: true, content: '' },
+    ],
+  });
+  expect(result.stream_head).toBe('inspected');
+});
+
+// Older servers lack the additive snapshot field.
+const older: SyncWorkspaceResponse = { status: 'up_to_date', head: 'old', conflicts: [] };
+void older;
+
+it.each([undefined, '', 'inspected'])('only retries a lost sync response with a nonempty pin (%s)', async (pin) => {
+  const sent: string[] = [];
+  const client = new AgentGitClient({
+    baseUrl: 'http://sync.test',
+    token: 'test',
+    sleep: async () => {},
+    fetch: async (_input, init) => {
+      if (typeof init?.body !== 'string') throw new Error('Expected JSON');
+      sent.push(init.body);
+      if (sent.length === 1) throw new TypeError('response lost after applying the merge');
+      return Response.json({ status: 'up_to_date', head: 'merged', stream_head: 'inspected', conflicts: [] });
+    },
+  });
+  const operation = client.workspaces.sync({ repo: 'team/app', name: 'work', expected_stream_head: pin });
+  if (pin) {
+    await expect(operation).resolves.toMatchObject({ head: 'merged' });
+    expect(sent).toHaveLength(2);
+    expect(sent[0]).toBe(sent[1]);
+  } else {
+    await expect(operation).rejects.toMatchObject({ attempts: 1, outcomeUnknown: true });
+    expect(sent).toHaveLength(1);
+  }
+});
+
+it('retains explicit unsafe-retry opt-in for an unpinned sync', async () => {
+  let calls = 0;
+  const client = new AgentGitClient({
+    baseUrl: 'http://sync.test',
+    token: 'test',
+    sleep: async () => {},
+    fetch: async () => {
+      if (++calls === 1) throw new TypeError('response lost');
+      return Response.json({ status: 'up_to_date', head: 'done', conflicts: [] });
+    },
+  });
+  await expect(
+    client.workspaces.sync({ repo: 'team/app', name: 'work' }, { retry: { retryUnsafe: true } }),
+  ).resolves.toMatchObject({ head: 'done' });
+  expect(calls).toBe(2);
+});

From 1cb6d15fb30611b5035a3a378130a903d00f6940 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 21:26:36 +0000
Subject: [PATCH 07/41] feat(review): persist private versioned review drafts

Keep unsubmitted notes isolated by actor with transactional save and clear preconditions. Add schema 10, HTTP/gRPC contracts and no-store responses without shared audit or event publication.

Validated: storage/integration suites, full server suite, migration backup fixture and workspace Clippy.
---
 SECURITY.md                                   |   6 +-
 crates/ag-integrate/src/lib.rs                |   2 +
 crates/ag-integrate/src/review_drafts.rs      | 116 +++++++
 crates/ag-integrate/tests/review_drafts.rs    | 162 ++++++++++
 crates/ag-protocol/proto/agwp/v1/agwp.proto   |  31 ++
 crates/ag-protocol/src/lib.rs                 |   4 +
 crates/ag-server/src/api/mod.rs               |   1 +
 crates/ag-server/src/api/review_drafts.rs     |  76 +++++
 crates/ag-server/src/grpc.rs                  |  18 ++
 crates/ag-server/src/http.rs                  |  45 ++-
 crates/ag-server/tests/review_drafts.rs       | 101 ++++++
 .../postgres/0010_review_drafts.sql           |  12 +
 .../migrations/sqlite/0010_review_drafts.sql  |  12 +
 crates/ag-storage/src/meta/migrate.rs         |  12 +-
 crates/ag-storage/src/meta/mod.rs             |   2 +
 crates/ag-storage/src/meta/review_drafts.rs   |  56 ++++
 crates/ag-storage/src/meta/tests.rs           |  46 +++
 docs/adr/0038-private-review-drafts.md        |  33 ++
 docs/adr/README.md                            |   2 +
 docs/protocol/agwp-v1.md                      |  19 ++
 docs/protocol/openapi.json                    | 297 ++++++++++++++++++
 migrations/postgres/0010_review_drafts.sql    |  12 +
 migrations/sqlite/0010_review_drafts.sql      |  12 +
 proto/agwp/v1/agwp.proto                      |  31 ++
 24 files changed, 1103 insertions(+), 5 deletions(-)
 create mode 100644 crates/ag-integrate/src/review_drafts.rs
 create mode 100644 crates/ag-integrate/tests/review_drafts.rs
 create mode 100644 crates/ag-server/src/api/review_drafts.rs
 create mode 100644 crates/ag-server/tests/review_drafts.rs
 create mode 100644 crates/ag-storage/migrations/postgres/0010_review_drafts.sql
 create mode 100644 crates/ag-storage/migrations/sqlite/0010_review_drafts.sql
 create mode 100644 crates/ag-storage/src/meta/review_drafts.rs
 create mode 100644 docs/adr/0038-private-review-drafts.md
 create mode 100644 migrations/postgres/0010_review_drafts.sql
 create mode 100644 migrations/sqlite/0010_review_drafts.sql

diff --git a/SECURITY.md b/SECURITY.md
index 078f2ebe..a5775107 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -11,11 +11,11 @@ agents. We take integrity and isolation bugs seriously.
 | `0.3.0-beta.7` | Current patch release; use its binaries after the Release workflow completes. |
 | `0.3.0-beta.6` and earlier prereleases | Upgrade to the current patch release for the fixes to stream scopes, workspace concurrency and retention. |
 
-AgentGit is **beta** software. The current development repository metadata schema is **9**;
+AgentGit is **beta** software. The current development repository metadata schema is **10**;
 `ChangesetV1`, tree manifest v1 and repository configuration format 1 remain unchanged.
 The server control database is migrated independently; use the same server version across replicas.
-The published beta.6/beta.7 format is schema 8. Development schema 9 adds requested reviewers;
-back up before opening a schema-8 repository with this build. Beta.7 introduces no
+The published beta.6/beta.7 format is schema 8. Development schema 9 adds requested reviewers and schema 10 adds private review drafts;
+back up before opening a schema-8 or schema-9 repository with this build. Beta.7 introduces no
 storage migration relative to beta.6. Returning to beta.5 or older
 requires the pre-upgrade backup, not opening the upgraded database with an older binary.
 See [compatibility](docs/architecture/compatibility.md) and [releasing](docs/operations/releasing.md).
diff --git a/crates/ag-integrate/src/lib.rs b/crates/ag-integrate/src/lib.rs
index d7514ee0..5c4340b3 100644
--- a/crates/ag-integrate/src/lib.rs
+++ b/crates/ag-integrate/src/lib.rs
@@ -36,6 +36,7 @@ mod prepare;
 mod publish;
 mod queue;
 mod repo;
+mod review_drafts;
 mod review_requests;
 mod storage;
 mod types;
@@ -58,6 +59,7 @@ pub use integrate::{IntegrateRequest, MergePreview, RecoveryReport};
 pub use layout::{InitOptions, Layout, RepoConfig};
 pub use prepare::{Preparation, PrepareContext, ValidationState};
 pub use publish::PublishResult;
+pub use review_drafts::{MAX_REVIEW_DRAFT_BYTES, ReviewDraftInput};
 
 /// Lifecycle state of an operation (re-exported from the metadata store).
 pub use ag_storage::meta::IntentState as PublishState;
diff --git a/crates/ag-integrate/src/review_drafts.rs b/crates/ag-integrate/src/review_drafts.rs
new file mode 100644
index 00000000..f593c3a2
--- /dev/null
+++ b/crates/ag-integrate/src/review_drafts.rs
@@ -0,0 +1,116 @@
+//! Unsubmitted review notes. These neither publish a review nor retain history objects.
+use crate::{Error, Repository, Result};
+use ag_storage::meta::{ReviewDraftRow, Tx};
+use ag_types::{ChangesetId, Identity};
+
+/// Maximum UTF-8 bytes in one private review draft.
+pub const MAX_REVIEW_DRAFT_BYTES: usize = 64 * 1024;
+
+/// A complete draft together with the version its caller inspected.
+#[derive(Clone, Debug)]
+pub struct ReviewDraftInput<'a> {
+    /// Revision inspected by the reviewer; may be an earlier proposal head.
+    pub head: &'a ChangesetId,
+    /// Intended decision: approve, request_changes, or comment.
+    pub decision: &'a str,
+    /// Private, unsubmitted notes.
+    pub body: &'a str,
+    /// Zero means the caller observed no persisted draft.
+    pub expected_version: u64,
+}
+fn next_version(current: u64) -> Result<u64> {
+    current
+        .checked_add(1)
+        .filter(|value| *value <= i64::MAX as u64)
+        .ok_or_else(|| Error::Invalid("review draft version exhausted".into()))
+}
+fn require_version(current: u64, expected: u64) -> Result<()> {
+    if current != expected {
+        return Err(Error::Conflict(
+            "review draft changed on another device; keep your text and inspect the saved draft".into(),
+        ));
+    }
+    Ok(())
+}
+
+impl Repository {
+    /// Reads the exact actor's private notes, including a cleared draft's version.
+    pub fn review_draft(&self, proposal: &str, owner: &Identity) -> Result<Option<ReviewDraftRow>> {
+        let proposal = self.find_proposal(proposal)?;
+        Ok(self.meta.read(|tx| tx.review_draft(&proposal.id, owner.as_str()))?)
+    }
+
+    /// Saves private notes atomically; an identical retry keeps the existing version.
+    pub fn save_review_draft(
+        &self,
+        proposal: &str,
+        owner: &Identity,
+        input: ReviewDraftInput<'_>,
+    ) -> Result<ReviewDraftRow> {
+        validate_content(&input)?;
+        let proposal = self.find_proposal(proposal)?.id;
+        self.meta.write_with_error(|tx| save_in_tx(tx, &proposal, owner, &input))
+    }
+
+    /// Clears only the inspected private draft, retaining its version to reject late device writes.
+    pub fn clear_review_draft(
+        &self,
+        proposal: &str,
+        owner: &Identity,
+        expected_version: u64,
+    ) -> Result<Option<ReviewDraftRow>> {
+        let proposal = self.find_proposal(proposal)?.id;
+        self.meta.write_with_error(|tx| {
+            let Some(current) = tx.review_draft(&proposal, owner.as_str())? else {
+                return Ok(None);
+            };
+            if current.head.is_none() {
+                return Ok(Some(current));
+            }
+            require_version(current.version, expected_version)?;
+            Ok(Some(tx.replace_review_draft(
+                &proposal,
+                owner.as_str(),
+                None,
+                "",
+                "",
+                next_version(current.version)?,
+            )?))
+        })
+    }
+}
+
+fn validate_content(input: &ReviewDraftInput<'_>) -> Result<()> {
+    if !["approve", "request_changes", "comment"].contains(&input.decision) {
+        return Err(Error::Invalid("unknown draft review decision".into()));
+    }
+    if input.body.len() > MAX_REVIEW_DRAFT_BYTES {
+        return Err(Error::Invalid("review draft exceeds 64 KiB".into()));
+    }
+    Ok(())
+}
+
+fn same_content(row: &ReviewDraftRow, input: &ReviewDraftInput<'_>) -> bool {
+    row.head.as_ref() == Some(input.head) && row.decision == input.decision && row.body == input.body
+}
+
+fn save_in_tx(tx: &Tx<'_>, proposal: &str, owner: &Identity, input: &ReviewDraftInput<'_>) -> Result<ReviewDraftRow> {
+    let row = tx.proposal(proposal)?.ok_or_else(|| Error::NotFound(format!("proposal {proposal}")))?;
+    if row.state != "open" {
+        return Err(Error::Invalid("only an open proposal accepts a review draft".into()));
+    }
+    let current = tx.review_draft(proposal, owner.as_str())?;
+    if let Some(row) = current.as_ref().filter(|row| same_content(row, input)) {
+        return Ok(row.clone());
+    }
+    let version = current.as_ref().map_or(0, |row| row.version);
+    require_version(version, input.expected_version)?;
+    Ok(tx.replace_review_draft(
+        proposal,
+        owner.as_str(),
+        Some(input.head),
+        input.decision,
+        input.body,
+        next_version(version)?,
+    )?)
+}
diff --git a/crates/ag-integrate/tests/review_drafts.rs b/crates/ag-integrate/tests/review_drafts.rs
new file mode 100644
index 00000000..6168ee63
--- /dev/null
+++ b/crates/ag-integrate/tests/review_drafts.rs
@@ -0,0 +1,162 @@
+//! Private review drafts are independent of submitted reviews.
+#![allow(missing_docs)]
+mod common;
+use ag_integrate::ReviewDraftInput;
+use common::*;
+use std::sync::{Arc, Barrier};
+
+#[test]
+fn private_drafts_compare_versions_and_keep_tombstones() {
+    let f = fx();
+    let alice = id("user:alice");
+    let bob = id("user:bob");
+    let head = f.snap(None, &[("file", "content")], alice.as_str());
+    let p = f.repo.propose("main", &head, "change", "", &alice, None).unwrap();
+    let input = ReviewDraftInput { head: &head, decision: "comment", body: "private notes", expected_version: 0 };
+    let saved = f.repo.save_review_draft(&p.id, &bob, input.clone()).unwrap();
+    assert_eq!(saved.version, 1);
+    assert_eq!(saved.body, "private notes");
+    assert!(f.repo.review_draft(&p.id, &alice).unwrap().is_none());
+    assert_eq!(f.repo.save_review_draft(&p.id, &bob, input).unwrap().version, 1);
+    assert!(
+        f.repo
+            .save_review_draft(
+                &p.id,
+                &bob,
+                ReviewDraftInput { head: &head, decision: "comment", body: "stale", expected_version: 0 }
+            )
+            .is_err()
+    );
+    let cleared = f.repo.clear_review_draft(&p.id, &bob, 1).unwrap().unwrap();
+    assert_eq!(cleared.version, 2);
+    assert!(cleared.head.is_none());
+    assert!(cleared.body.is_empty());
+    assert!(
+        f.repo
+            .save_review_draft(
+                &p.id,
+                &bob,
+                ReviewDraftInput { head: &head, decision: "comment", body: "old device", expected_version: 1 }
+            )
+            .is_err()
+    );
+    let replacement = f
+        .repo
+        .save_review_draft(
+            &p.id,
+            &bob,
+            ReviewDraftInput { head: &head, decision: "approve", body: "checked", expected_version: 2 },
+        )
+        .unwrap();
+    assert_eq!(replacement.version, 3);
+    assert!(f.repo.clear_review_draft(&p.id, &bob, 2).is_err());
+    assert_eq!(f.repo.review_draft(&p.id, &bob).unwrap().unwrap().body, "checked");
+    assert!(f.repo.meta().read(|tx| tx.reviews(&p.id)).unwrap().is_empty());
+    let audit = f.repo.meta().read(|tx| tx.audit_list(Some(&p.id), 100)).unwrap();
+    assert!(!audit.iter().any(|row| row.details.contains("private notes") || row.details.contains("checked")));
+}
+
+#[test]
+fn two_devices_cannot_overwrite_the_same_draft_version() {
+    let f = fx();
+    let alice = id("user:alice");
+    let reviewer = id("user:bob");
+    let head = f.snap(None, &[("file", "content")], alice.as_str());
+    let p = f.repo.propose("main", &head, "change", "", &alice, None).unwrap();
+    let repo = Arc::new(f.repo.with_object_store(|store| store));
+    let start = Arc::new(Barrier::new(2));
+    let threads: Vec<_> = ["first device", "second device"]
+        .into_iter()
+        .map(|body| {
+            let repo = repo.clone();
+            let start = start.clone();
+            let owner = reviewer.clone();
+            let proposal = p.id.clone();
+            std::thread::spawn(move || {
+                start.wait();
+                repo.save_review_draft(
+                    &proposal,
+                    &owner,
+                    ReviewDraftInput { head: &head, decision: "comment", body, expected_version: 0 },
+                )
+            })
+        })
+        .collect();
+    let results: Vec<_> = threads.into_iter().map(|thread| thread.join().unwrap()).collect();
+    assert_eq!(results.iter().filter(|result| result.is_ok()).count(), 1);
+    let saved = f.repo.review_draft(&p.id, &reviewer).unwrap().unwrap();
+    assert_eq!(saved.version, 1);
+    assert!(saved.body == "first device" || saved.body == "second device");
+}
+
+#[test]
+fn draft_limits_and_closed_proposals_do_not_discard_private_notes() {
+    let f = fx();
+    let author = id("user:alice");
+    let reviewer = id("user:bob");
+    let head = f.snap(None, &[("file", "content")], author.as_str());
+    let p = f.repo.propose("main", &head, "change", "", &author, None).unwrap();
+    let body = "é".repeat(32 * 1024);
+    assert_eq!(
+        f.repo
+            .save_review_draft(
+                &p.id,
+                &reviewer,
+                ReviewDraftInput { head: &head, decision: "comment", body: &body, expected_version: 0 }
+            )
+            .unwrap()
+            .version,
+        1
+    );
+    let oversized = format!("{body}x");
+    assert!(
+        f.repo
+            .save_review_draft(
+                &p.id,
+                &reviewer,
+                ReviewDraftInput { head: &head, decision: "comment", body: &oversized, expected_version: 1 }
+            )
+            .is_err()
+    );
+    assert!(
+        f.repo
+            .save_review_draft(
+                &p.id,
+                &reviewer,
+                ReviewDraftInput { head: &head, decision: "publish", body: "", expected_version: 1 }
+            )
+            .is_err()
+    );
+    f.repo.close_proposal(&p.id, &author).unwrap();
+    assert!(
+        f.repo
+            .save_review_draft(
+                &p.id,
+                &reviewer,
+                ReviewDraftInput { head: &head, decision: "approve", body: "closed", expected_version: 1 }
+            )
+            .is_err()
+    );
+    assert_eq!(f.repo.review_draft(&p.id, &reviewer).unwrap().unwrap().body, body);
+    assert!(f.repo.clear_review_draft(&p.id, &reviewer, 1).unwrap().unwrap().head.is_none());
+}
+
+#[test]
+fn agent_runs_do_not_share_private_drafts() {
+    let f = fx();
+    let author = id("user:alice");
+    let first = id("agent:reviewer#run-a");
+    let second = id("agent:reviewer#run-b");
+    let head = f.snap(None, &[("file", "content")], author.as_str());
+    let p = f.repo.propose("main", &head, "change", "", &author, None).unwrap();
+    f.repo
+        .save_review_draft(
+            &p.id,
+            &first,
+            ReviewDraftInput { head: &head, decision: "comment", body: "run a", expected_version: 0 },
+        )
+        .unwrap();
+    assert!(f.repo.review_draft(&p.id, &second).unwrap().is_none());
+    assert!(f.repo.clear_review_draft(&p.id, &second, 0).unwrap().is_none());
+    assert_eq!(f.repo.review_draft(&p.id, &first).unwrap().unwrap().body, "run a");
+}
diff --git a/crates/ag-protocol/proto/agwp/v1/agwp.proto b/crates/ag-protocol/proto/agwp/v1/agwp.proto
index 11dc900f..8c24f64e 100644
--- a/crates/ag-protocol/proto/agwp/v1/agwp.proto
+++ b/crates/ag-protocol/proto/agwp/v1/agwp.proto
@@ -766,6 +766,34 @@ message UpdateProposalRequest {
   string expected_head = 5;
 }
 
+// Private, unsubmitted review notes for the current acting identity only.
+message ReviewDraft {
+  bool present = 1;
+  uint64 version = 2;
+  string head = 3;
+  string decision = 4;
+  string body = 5;
+  int64 updated_at_ms = 6;
+}
+message GetReviewDraftRequest {
+  string repo = 1;
+  string id = 2;
+}
+message SaveReviewDraftRequest {
+  string repo = 1;
+  string id = 2;
+  string head = 3;
+  string decision = 4;
+  string body = 5;
+  // Zero means no prior draft; all saves compare this version atomically.
+  uint64 expected_version = 6;
+}
+message ClearReviewDraftRequest {
+  string repo = 1;
+  string id = 2;
+  uint64 expected_version = 3;
+}
+
 // Replaces review routing after comparing the complete inspected set.
 message SetRequestedReviewersRequest {
   string repo = 1;
@@ -1821,6 +1849,9 @@ service ProposalService {
   rpc Get(GetProposalRequest) returns (ProposalDetail);
   rpc List(ListProposalsRequest) returns (ListProposalsResponse);
   rpc Update(UpdateProposalRequest) returns (Proposal);
+  rpc GetDraft(GetReviewDraftRequest) returns (ReviewDraft);
+  rpc SaveDraft(SaveReviewDraftRequest) returns (ReviewDraft);
+  rpc ClearDraft(ClearReviewDraftRequest) returns (ReviewDraft);
   rpc SetReviewers(SetRequestedReviewersRequest) returns (RequestedReviewers);
   rpc Review(ReviewProposalRequest) returns (Review);
   rpc Comment(CommentProposalRequest) returns (Review);
diff --git a/crates/ag-protocol/src/lib.rs b/crates/ag-protocol/src/lib.rs
index a9f3a9a6..3ad010e9 100644
--- a/crates/ag-protocol/src/lib.rs
+++ b/crates/ag-protocol/src/lib.rs
@@ -97,6 +97,9 @@ pub mod features {
     /// Virtual sync compares the branch revision inspected by a resolving client.
     pub const WORKSPACES_SYNC_PRECONDITION: &str = "workspaces.sync_precondition";
 
+    /// Private versioned review drafts for the current acting identity.
+    pub const PROPOSALS_REVIEW_DRAFTS: &str = "proposals.review_drafts";
+
     /// Every feature this implementation knows.
     pub const ALL: &[&str] = &[
         EVENTS_REPLAY,
@@ -112,6 +115,7 @@ pub mod features {
         PROPOSALS_REVIEW_HEAD,
         PROPOSALS_UPDATE_HEAD,
         PROPOSALS_REVIEW_REQUESTS,
+        PROPOSALS_REVIEW_DRAFTS,
         POLICY_RESOLVED_THREADS,
         TREE_SEARCH,
         ISSUES,
diff --git a/crates/ag-server/src/api/mod.rs b/crates/ag-server/src/api/mod.rs
index 3f3a3d3c..3a188a52 100644
--- a/crates/ag-server/src/api/mod.rs
+++ b/crates/ag-server/src/api/mod.rs
@@ -23,6 +23,7 @@ mod jobs;
 mod objects;
 mod proposals;
 mod repository;
+mod review_drafts;
 mod review_threads;
 mod run_output;
 mod search;
diff --git a/crates/ag-server/src/api/review_drafts.rs b/crates/ag-server/src/api/review_drafts.rs
new file mode 100644
index 00000000..4be1c8de
--- /dev/null
+++ b/crates/ag-server/src/api/review_drafts.rs
@@ -0,0 +1,76 @@
+//! Owner-private draft operations intentionally do not notify shared repository events.
+use super::{parse_id, require};
+use crate::app::{App, Call};
+use crate::authz::Cap;
+use crate::error::ApiResult;
+use ag_integrate::ReviewDraftInput;
+use ag_protocol::v1;
+use ag_storage::meta::ReviewDraftRow;
+use ag_types::ChangesetId;
+
+fn draft(row: Option<&ReviewDraftRow>) -> v1::ReviewDraft {
+    let Some(row) = row else {
+        return v1::ReviewDraft::default();
+    };
+    v1::ReviewDraft {
+        present: row.head.is_some(),
+        version: row.version,
+        head: row.head.map(|head| head.to_string()).unwrap_or_default(),
+        decision: row.decision.clone(),
+        body: row.body.clone(),
+        updated_at_ms: row.updated_at.as_millis(),
+    }
+}
+
+impl App {
+    /// Reads only the acting identity's private draft.
+    pub async fn get_review_draft(&self, call: &Call, req: v1::GetReviewDraftRequest) -> ApiResult<v1::ReviewDraft> {
+        self.with_proposal(
+            call,
+            require(&req.repo, "repo")?,
+            Cap::ProposalReview,
+            req.id.clone(),
+            move |repo, actor| Ok(draft(repo.review_draft(&req.id, actor)?.as_ref())),
+        )
+        .await
+    }
+    /// Saves private notes with an inspected-version comparison, never a review decision.
+    pub async fn save_review_draft(&self, call: &Call, req: v1::SaveReviewDraftRequest) -> ApiResult<v1::ReviewDraft> {
+        let head: ChangesetId = parse_id(require(&req.head, "head")?, "draft head")?;
+        self.with_proposal(
+            call,
+            require(&req.repo, "repo")?,
+            Cap::ProposalReview,
+            req.id.clone(),
+            move |repo, actor| {
+                let row = repo.save_review_draft(
+                    &req.id,
+                    actor,
+                    ReviewDraftInput {
+                        head: &head,
+                        decision: &req.decision,
+                        body: &req.body,
+                        expected_version: req.expected_version,
+                    },
+                )?;
+                Ok(draft(Some(&row)))
+            },
+        )
+        .await
+    }
+    /// Clears only the inspected private draft and retains its version tombstone.
+    pub async fn clear_review_draft(
+        &self,
+        call: &Call,
+        req: v1::ClearReviewDraftRequest,
+    ) -> ApiResult<v1::ReviewDraft> {
+        self.with_proposal(
+            call,
+            require(&req.repo, "repo")?,
+            Cap::ProposalReview,
+            req.id.clone(),
+            move |repo, actor| Ok(draft(repo.clear_review_draft(&req.id, actor, req.expected_version)?.as_ref())),
+        )
+        .await
+    }
+}
diff --git a/crates/ag-server/src/grpc.rs b/crates/ag-server/src/grpc.rs
index 647f2630..91464144 100644
--- a/crates/ag-server/src/grpc.rs
+++ b/crates/ag-server/src/grpc.rs
@@ -374,6 +374,24 @@ impl ProposalService for Grpc {
     async fn update(&self, request: Request<v1::UpdateProposalRequest>) -> Result<Response<v1::Proposal>, Status> {
         unary!(self, request, "proposal.update", update_proposal)
     }
+    async fn get_draft(
+        &self,
+        request: Request<v1::GetReviewDraftRequest>,
+    ) -> Result<Response<v1::ReviewDraft>, Status> {
+        unary!(self, request, "proposal.get_draft", get_review_draft)
+    }
+    async fn save_draft(
+        &self,
+        request: Request<v1::SaveReviewDraftRequest>,
+    ) -> Result<Response<v1::ReviewDraft>, Status> {
+        unary!(self, request, "proposal.save_draft", save_review_draft)
+    }
+    async fn clear_draft(
+        &self,
+        request: Request<v1::ClearReviewDraftRequest>,
+    ) -> Result<Response<v1::ReviewDraft>, Status> {
+        unary!(self, request, "proposal.clear_draft", clear_review_draft)
+    }
     async fn set_reviewers(
         &self,
         request: Request<v1::SetRequestedReviewersRequest>,
diff --git a/crates/ag-server/src/http.rs b/crates/ag-server/src/http.rs
index 22bf60dd..07ff5c0b 100644
--- a/crates/ag-server/src/http.rs
+++ b/crates/ag-server/src/http.rs
@@ -247,7 +247,11 @@ where
         app.dispatch(ing, op, move |call| f(a, call, req)).await
     }
     .await;
-    finish(result, &request_id)
+    let mut response = finish(result, &request_id);
+    if matches!(op, "proposal.get_draft" | "proposal.save_draft" | "proposal.clear_draft") {
+        response.headers_mut().insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
+    }
+    response
 }
 
 fn finish<T: Serialize>(result: ApiResult<T>, request_id: &str) -> Response {
@@ -952,6 +956,45 @@ pub fn api_router(app: App) -> (Router, Vec<RouteMeta>) {
         v1::Proposal,
         update_proposal
     );
+    route!(
+        r,
+        meta,
+        get,
+        "get",
+        "/v1/repos/{owner}/{rname}/proposals/{id}/review-draft",
+        "proposal.get_draft",
+        "Proposal",
+        "Read your private review draft",
+        v1::GetReviewDraftRequest,
+        v1::ReviewDraft,
+        get_review_draft
+    );
+    route!(
+        r,
+        meta,
+        put,
+        "put",
+        "/v1/repos/{owner}/{rname}/proposals/{id}/review-draft",
+        "proposal.save_draft",
+        "Proposal",
+        "Save your private review draft",
+        v1::SaveReviewDraftRequest,
+        v1::ReviewDraft,
+        save_review_draft
+    );
+    route!(
+        r,
+        meta,
+        delete,
+        "delete",
+        "/v1/repos/{owner}/{rname}/proposals/{id}/review-draft",
+        "proposal.clear_draft",
+        "Proposal",
+        "Clear the inspected private review draft",
+        v1::ClearReviewDraftRequest,
+        v1::ReviewDraft,
+        clear_review_draft
+    );
     route!(
         r,
         meta,
diff --git a/crates/ag-server/tests/review_drafts.rs b/crates/ag-server/tests/review_drafts.rs
new file mode 100644
index 00000000..4d8f263e
--- /dev/null
+++ b/crates/ag-server/tests/review_drafts.rs
@@ -0,0 +1,101 @@
+//! A review draft belongs only to the current caller, never to the whole proposal.
+mod common;
+use ag_protocol::v1::{self, proposal_service_client::ProposalServiceClient};
+use common::*;
+use serde_json::json;
+use tonic::{Code, Request};
+fn authorized<T>(token: &str, value: T) -> Request<T> {
+    let mut request = Request::new(value);
+    request.metadata_mut().insert("authorization", format!("Bearer {token}").parse().unwrap());
+    request
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn account_drafts_are_private_and_versioned_without_submitting_reviews() {
+    let srv = TestServer::start().await;
+    let admin = srv.admin();
+    assert_eq!(admin.post("/v1/repos", json!({"name":"acme/drafts"})).await.status, 200);
+    let bob = user_with_role(&srv, "user:bob", "acme/drafts", "reviewer").await;
+    let carol = user_with_role(&srv, "user:carol", "acme/drafts", "reviewer").await;
+    let (head, objects) =
+        Client::new("acme/drafts").commit(vec![], "user:admin", "change", &[("file", b"content")], 1_700_000_000_000);
+    upload(&admin, "acme/drafts", &objects).await;
+    let proposal = admin
+        .post("/v1/repos/acme/drafts/proposals", json!({"stream":"main","head":head.to_string(),"title":"review"}))
+        .await;
+    let id = proposal.json["id"].as_str().unwrap();
+    let path = format!("/v1/repos/acme/drafts/proposals/{id}/review-draft");
+    let empty = bob.get(&path).await;
+    assert_eq!(empty.status, 200, "{}", empty.json);
+    assert_eq!(empty.headers.get("cache-control").map(String::as_str), Some("no-store"));
+    assert_eq!(empty.json["present"], false);
+    assert_eq!(empty.json["version"], 0);
+    let scoped =
+        bob.post("/v1/credentials", json!({"ttl_secs":600,"scope":{"repos":["acme/drafts"],"streams":["dev"]}})).await;
+    assert_eq!(scoped.status, 200);
+    let narrow = srv.client(scoped.json["token"].as_str().unwrap());
+    assert_eq!(narrow.get(&path).await.status, 403);
+    let reader = user_with_role(&srv, "user:reader", "acme/drafts", "reader").await;
+    assert_eq!(reader.get(&path).await.status, 403);
+    let body = json!({"head":head.to_string(),"decision":"comment","body":"Bob's private notes","expected_version":0});
+    let saved = bob.call("PUT", &path, Some(body.clone()), &[]).await;
+    assert_eq!(saved.status, 200, "{}", saved.json);
+    assert_eq!(saved.json["version"], 1);
+    assert_eq!(bob.call("PUT", &path, Some(body), &[]).await.json["version"], 1);
+    let mut grpc = ProposalServiceClient::connect(srv.base.clone()).await.unwrap();
+    let get = v1::GetReviewDraftRequest { repo: "acme/drafts".into(), id: id.into() };
+    assert_eq!(
+        grpc.get_draft(authorized(&bob.token, get.clone())).await.unwrap().into_inner().body,
+        "Bob's private notes"
+    );
+    assert!(!grpc.get_draft(authorized(&carol.token, get)).await.unwrap().into_inner().present);
+    let stale = v1::SaveReviewDraftRequest {
+        repo: "acme/drafts".into(),
+        id: id.into(),
+        head: head.to_string(),
+        decision: "comment".into(),
+        body: "stale".into(),
+        expected_version: 0,
+    };
+    assert_eq!(grpc.save_draft(authorized(&bob.token, stale)).await.unwrap_err().code(), Code::FailedPrecondition);
+    for other in [&carol, &admin] {
+        let private = other.get(&format!("{path}?owner=user:bob")).await;
+        assert_eq!(private.status, 200);
+        assert_eq!(private.json["present"], false);
+        assert_ne!(private.json["body"], "Bob's private notes");
+    }
+    assert_eq!(
+        bob.call(
+            "PUT",
+            &path,
+            Some(json!({"head":head.to_string(),"decision":"approve","body":"stale","expected_version":0})),
+            &[]
+        )
+        .await
+        .status,
+        412
+    );
+    let cleared = bob.call("DELETE", &format!("{path}?expected_version=1"), None, &[]).await;
+    assert_eq!(cleared.status, 200, "{}", cleared.json);
+    assert_eq!(cleared.json["version"], 2);
+    assert_eq!(cleared.json["present"], false);
+    assert_eq!(cleared.json["body"], "");
+    assert_eq!(
+        bob.call(
+            "PUT",
+            &path,
+            Some(json!({"head":head.to_string(),"decision":"comment","body":"old device","expected_version":1})),
+            &[]
+        )
+        .await
+        .status,
+        412
+    );
+    let clear = v1::ClearReviewDraftRequest { repo: "acme/drafts".into(), id: id.into(), expected_version: 1 };
+    assert_eq!(grpc.clear_draft(authorized(&bob.token, clear)).await.unwrap().into_inner().version, 2);
+    let detail = admin.get(&format!("/v1/repos/acme/drafts/proposals/{id}")).await;
+    assert!(detail.json["reviews"].as_array().unwrap().is_empty());
+    let audit = admin.get(&format!("/v1/repos/acme/drafts/audit?contains={id}")).await;
+    assert!(!audit.json.to_string().contains("Bob's private notes"));
+    srv.stop().await;
+}
diff --git a/crates/ag-storage/migrations/postgres/0010_review_drafts.sql b/crates/ag-storage/migrations/postgres/0010_review_drafts.sql
new file mode 100644
index 00000000..8d58aeb3
--- /dev/null
+++ b/crates/ag-storage/migrations/postgres/0010_review_drafts.sql
@@ -0,0 +1,12 @@
+CREATE TABLE review_drafts (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    owner TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    head TEXT,
+    decision TEXT NOT NULL,
+    body TEXT NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (proposal, owner),
+    CHECK ((head IS NULL AND decision = '' AND body = '') OR
+           (head IS NOT NULL AND decision IN ('approve', 'request_changes', 'comment')))
+);
diff --git a/crates/ag-storage/migrations/sqlite/0010_review_drafts.sql b/crates/ag-storage/migrations/sqlite/0010_review_drafts.sql
new file mode 100644
index 00000000..8d58aeb3
--- /dev/null
+++ b/crates/ag-storage/migrations/sqlite/0010_review_drafts.sql
@@ -0,0 +1,12 @@
+CREATE TABLE review_drafts (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    owner TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    head TEXT,
+    decision TEXT NOT NULL,
+    body TEXT NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (proposal, owner),
+    CHECK ((head IS NULL AND decision = '' AND body = '') OR
+           (head IS NOT NULL AND decision IN ('approve', 'request_changes', 'comment')))
+);
diff --git a/crates/ag-storage/src/meta/migrate.rs b/crates/ag-storage/src/meta/migrate.rs
index 8366b623..b8007d12 100644
--- a/crates/ag-storage/src/meta/migrate.rs
+++ b/crates/ag-storage/src/meta/migrate.rs
@@ -34,7 +34,7 @@ impl Migration {
 }
 
 /// Schema version understood by this build.
-pub const SCHEMA_VERSION: i64 = 9;
+pub const SCHEMA_VERSION: i64 = 10;
 
 pub(crate) const SQLITE_MIGRATIONS: &[Migration] = &[
     Migration { version: 1, name: "0001_init.sql", sql: include_str!("../../migrations/sqlite/0001_init.sql") },
@@ -70,6 +70,11 @@ pub(crate) const SQLITE_MIGRATIONS: &[Migration] = &[
         name: "0009_proposal_reviewers.sql",
         sql: include_str!("../../migrations/sqlite/0009_proposal_reviewers.sql"),
     },
+    Migration {
+        version: 10,
+        name: "0010_review_drafts.sql",
+        sql: include_str!("../../migrations/sqlite/0010_review_drafts.sql"),
+    },
 ];
 
 pub(crate) const POSTGRES_MIGRATIONS: &[Migration] = &[
@@ -106,6 +111,11 @@ pub(crate) const POSTGRES_MIGRATIONS: &[Migration] = &[
         name: "0009_proposal_reviewers.sql",
         sql: include_str!("../../migrations/postgres/0009_proposal_reviewers.sql"),
     },
+    Migration {
+        version: 10,
+        name: "0010_review_drafts.sql",
+        sql: include_str!("../../migrations/postgres/0010_review_drafts.sql"),
+    },
 ];
 
 #[cfg(test)]
diff --git a/crates/ag-storage/src/meta/mod.rs b/crates/ag-storage/src/meta/mod.rs
index 51da4ce1..d1563d73 100644
--- a/crates/ag-storage/src/meta/mod.rs
+++ b/crates/ag-storage/src/meta/mod.rs
@@ -46,6 +46,7 @@ mod derived;
 mod intents;
 mod outbox;
 mod records;
+mod review_drafts;
 mod streams;
 
 use std::fmt::Display;
@@ -73,6 +74,7 @@ pub use pg::{PgOptions, advisory_key, drop_schema, url_has_password, validate_sc
 pub use records::{
     AttestationRow, NewProposal, PinRow, PolicyRow, ProposalFilter, ProposalRow, ReviewRow, WorkspaceRow,
 };
+pub use review_drafts::ReviewDraftRow;
 pub use review_threads::{ReviewThreadAnchorRow, ReviewThreadRow, ThreadCommentRow};
 pub use streams::{ReflogEntry, StreamRow, StreamState};
 
diff --git a/crates/ag-storage/src/meta/review_drafts.rs b/crates/ag-storage/src/meta/review_drafts.rs
new file mode 100644
index 00000000..31d8cacc
--- /dev/null
+++ b/crates/ag-storage/src/meta/review_drafts.rs
@@ -0,0 +1,56 @@
+//! Private review notes, isolated by the caller's full identity.
+use super::db::params;
+use super::{MetaError, Tx, parse, ts};
+use ag_types::{ChangesetId, Timestamp};
+use serde::Serialize;
+
+/// A persisted private draft; a null head is a versioned deletion tombstone.
+#[derive(Clone, Debug, Serialize)]
+pub struct ReviewDraftRow {
+    /// Monotonic per-owner, per-proposal revision.
+    pub version: u64,
+    /// The revision the reviewer inspected, or none after clearing.
+    pub head: Option<ChangesetId>,
+    /// Intended review decision; empty on a tombstone.
+    pub decision: String,
+    /// Unsubmitted text; empty on a tombstone.
+    pub body: String,
+    /// Last change time.
+    pub updated_at: Timestamp,
+}
+
+impl Tx<'_> {
+    /// Returns only the draft matching this exact owner and proposal.
+    pub fn review_draft(&self, proposal: &str, owner: &str) -> Result<Option<ReviewDraftRow>, MetaError> {
+        let rows = self.conn.query(
+            "SELECT version, head, decision, body, updated_at FROM review_drafts WHERE proposal = ?1 AND owner = ?2",
+            &params![proposal, owner],
+        )?;
+        rows.first()
+            .map(|row| {
+                Ok(ReviewDraftRow {
+                    version: row.i64(0)? as u64,
+                    head: row.opt_string(1)?.map(|value| parse(&value, "draft head")).transpose()?,
+                    decision: row.string(2)?,
+                    body: row.string(3)?,
+                    updated_at: ts(row.i64(4)?),
+                })
+            })
+            .transpose()
+    }
+
+    /// Writes the state whose version was already compared in this transaction.
+    pub fn replace_review_draft(
+        &self,
+        proposal: &str,
+        owner: &str,
+        head: Option<&ChangesetId>,
+        decision: &str,
+        body: &str,
+        version: u64,
+    ) -> Result<ReviewDraftRow, MetaError> {
+        let version = i64::try_from(version).map_err(|_| MetaError::Invalid("draft version exhausted".into()))?;
+        self.conn.execute("INSERT INTO review_drafts (proposal, owner, version, head, decision, body, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7) ON CONFLICT (proposal, owner) DO UPDATE SET version = excluded.version, head = excluded.head, decision = excluded.decision, body = excluded.body, updated_at = excluded.updated_at", &params![proposal, owner, version, head.map(|id| id.to_hex()), decision, body, self.now().as_millis()])?;
+        self.review_draft(proposal, owner)?.ok_or_else(|| MetaError::Corrupt("review draft vanished".into()))
+    }
+}
diff --git a/crates/ag-storage/src/meta/tests.rs b/crates/ag-storage/src/meta/tests.rs
index 6099f95e..2ff8ca4c 100644
--- a/crates/ag-storage/src/meta/tests.rs
+++ b/crates/ag-storage/src/meta/tests.rs
@@ -936,3 +936,49 @@ fn schema_eight_review_requests_migrate_and_persist_without_changing_backup() {
         0
     );
 }
+
+#[test]
+fn schema_nine_private_drafts_migrate_persist_and_clear_without_rewinding_versions() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("meta.db");
+    let backup = dir.path().join("before.db");
+    {
+        let conn = rusqlite::Connection::open(&path).unwrap();
+        for migration in migrate::SQLITE_MIGRATIONS.iter().filter(|m| m.version <= 9) {
+            conn.execute_batch(migration.sql).unwrap();
+        }
+        conn.execute("INSERT INTO meta(key,value) VALUES('schema','9')", []).unwrap();
+        conn.execute("INSERT INTO proposals(id,stream,head,title,description,author,state,created_at,updated_at) VALUES('prop_old','main',?1,'Keep existing','description','user:author','open',1,1)", ["0".repeat(64)]).unwrap();
+        conn.execute("INSERT INTO proposal_reviewers(proposal,reviewer) VALUES('prop_old','user:bob')", []).unwrap();
+        conn.pragma_update(None, "user_version", 9).unwrap();
+    }
+    std::fs::copy(&path, &backup).unwrap();
+    let head: ChangesetId = "0".repeat(64).parse().unwrap();
+    {
+        let upgraded = Meta::open(&path).unwrap();
+        assert!(upgraded.read(|tx| tx.review_draft("prop_old", "user:bob")).unwrap().is_none());
+        upgraded
+            .write(|tx| tx.replace_review_draft("prop_old", "user:bob", Some(&head), "comment", "Private notes", 1))
+            .unwrap();
+    }
+    {
+        let reopened = Meta::open(&path).unwrap();
+        let draft = reopened.read(|tx| tx.review_draft("prop_old", "user:bob")).unwrap().unwrap();
+        assert_eq!(draft.body, "Private notes");
+        assert_eq!(draft.version, 1);
+        assert_eq!(reopened.read(|tx| tx.proposal_reviewers("prop_old")).unwrap(), ["user:bob"]);
+        reopened.write(|tx| tx.replace_review_draft("prop_old", "user:bob", None, "", "", 2)).unwrap();
+    }
+    let reopened = Meta::open(&path).unwrap();
+    let cleared = reopened.read(|tx| tx.review_draft("prop_old", "user:bob")).unwrap().unwrap();
+    assert_eq!(cleared.version, 2);
+    assert!(cleared.head.is_none() && cleared.body.is_empty());
+    let untouched = rusqlite::Connection::open(&backup).unwrap();
+    assert_eq!(untouched.pragma_query_value(None, "user_version", |row| row.get::<_, i64>(0)).unwrap(), 9);
+    assert_eq!(
+        untouched
+            .query_row("SELECT COUNT(*) FROM sqlite_master WHERE name='review_drafts'", [], |row| row.get::<_, i64>(0))
+            .unwrap(),
+        0
+    );
+}
diff --git a/docs/adr/0038-private-review-drafts.md b/docs/adr/0038-private-review-drafts.md
new file mode 100644
index 00000000..419f2405
--- /dev/null
+++ b/docs/adr/0038-private-review-drafts.md
@@ -0,0 +1,33 @@
+# ADR 0038: private account-backed review drafts
+
+Status: accepted.
+
+## Decision
+
+Add one private review-decision draft per proposal and full acting identity. It contains
+the inspected head, intended decision and at most 64 KiB of UTF-8 notes. Saving a draft
+never submits a review, approves code, updates the proposal, or broadcasts draft contents.
+Agent runs remain distinct owners; a human account can resume its own draft on another
+device. The API never accepts an owner selector and applies review capability and proposal
+stream authorization before accessing a draft.
+
+Save and clear compare the version read by that device inside their metadata transaction.
+Identical desired content is a no-op retry. Clearing erases the content but retains a
+versioned tombstone so an older device cannot resurrect it. A later draft cannot be cleared
+by cleanup after a review submitted on another device. Existing drafts can be read or
+cleared after proposal closure; new saves require an open proposal.
+
+The browser retains its local tab draft. On opening review, an account draft may restore an
+empty local form. A differing local draft requires an explicit choice; it is not silently
+overwritten. Saving to the account is explicit. Submission remains a separate head-checked
+action, and failure to clear a saved draft does not turn successful submission into failure.
+Old servers retain the local-only behavior, negotiated through `proposals.review_drafts`.
+
+Schema 10 adds `review_drafts`. Back up before opening schema-9 repositories; downgrade
+restores the backup. Draft contents are excluded from public proposal responses, shared
+audit records and repository events; private HTTP responses use `Cache-Control: no-store`.
+Server administrators and backups can still contain these unsubmitted notes.
+
+A draft's head is context, not a history-retention pin. A stale draft must be reviewed
+against the current proposal head before submission. File-edit and general-comment drafts
+are separate future extensions, not implicit members of this first review-draft API.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index f9ade4e2..9c577d93 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -50,3 +50,5 @@ which test: [ADR traceability](../architecture/adr-traceability.md).
 - [0036 — Requested reviewers](0036-requested-reviewers.md)
 
 - [0037 — Pinned workspace sync](0037-pinned-workspace-sync.md)
+
+- [0038 — Private review drafts](0038-private-review-drafts.md)
diff --git a/docs/protocol/agwp-v1.md b/docs/protocol/agwp-v1.md
index 27ae0628..48211c98 100644
--- a/docs/protocol/agwp-v1.md
+++ b/docs/protocol/agwp-v1.md
@@ -386,3 +386,22 @@ the request field, so silently falling back would lose the preview's protection.
 A resolution may reference an existing `blob_id` together with `file_type` and
 `executable`, or delete a path. Keeping a binary or symlink version therefore preserves
 its original bytes and metadata. New text remains an ordinary inline file change.
+
+
+### Private review drafts (development)
+
+Negotiate `proposals.review_drafts`. `GET`, `PUT` and `DELETE` on
+`/v1/repos/{owner}/{repo}/proposals/{id}/review-draft` access only the current full acting
+identity's draft, under the proposal's stream and review permission. There is no owner
+parameter. Private responses use `Cache-Control: no-store` and do not add public review,
+audit-body or repository-event entries.
+
+Save sends `head`, `decision`, `body` (at most 64 KiB UTF-8) and `expected_version`.
+Clear sends `expected_version` as a query parameter. Reads of an absent draft return
+`present=false, version=0`. Clearing content retains an incremented tombstone version;
+late saves using an earlier version fail with HTTP 412 / gRPC FailedPrecondition.
+Identical desired state is an idempotent no-op. A draft may reference an earlier revision,
+but it never pins history or bypasses the actual review's inspected-head check.
+
+Schema 10 stores this private metadata. Back up before upgrading; saved review drafts
+can appear in administrative backups even though they are not in shared proposal APIs.
diff --git a/docs/protocol/openapi.json b/docs/protocol/openapi.json
index 4b5fc3f0..7b3dfc63 100644
--- a/docs/protocol/openapi.json
+++ b/docs/protocol/openapi.json
@@ -645,6 +645,25 @@
         },
         "type": "object"
       },
+      "ClearReviewDraftRequest": {
+        "properties": {
+          "expected_version": {
+            "default": 0,
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "id": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "CloseProposalRequest": {
         "properties": {
           "id": {
@@ -1868,6 +1887,19 @@
         },
         "type": "object"
       },
+      "GetReviewDraftRequest": {
+        "properties": {
+          "id": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "GetRunOutputRequest": {
         "properties": {
           "repo": {
@@ -4659,6 +4691,39 @@
         },
         "type": "object"
       },
+      "ReviewDraft": {
+        "description": "Private, unsubmitted review notes for the current acting identity only.",
+        "properties": {
+          "body": {
+            "default": "",
+            "type": "string"
+          },
+          "decision": {
+            "default": "",
+            "type": "string"
+          },
+          "head": {
+            "default": "",
+            "type": "string"
+          },
+          "present": {
+            "default": false,
+            "type": "boolean"
+          },
+          "updated_at_ms": {
+            "default": 0,
+            "format": "int64",
+            "type": "integer"
+          },
+          "version": {
+            "default": 0,
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
       "ReviewLineAnchor": {
         "description": "A line location is immutable; text is filled from the repository by the server.",
         "properties": {
@@ -5021,6 +5086,38 @@
         },
         "type": "object"
       },
+      "SaveReviewDraftRequest": {
+        "properties": {
+          "body": {
+            "default": "",
+            "type": "string"
+          },
+          "decision": {
+            "default": "",
+            "type": "string"
+          },
+          "expected_version": {
+            "default": 0,
+            "description": "Zero means no prior draft; all saves compare this version atomically.",
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "head": {
+            "default": "",
+            "type": "string"
+          },
+          "id": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "SaveRunOutputRequest": {
         "properties": {
           "output": {
@@ -10175,6 +10272,206 @@
         ]
       }
     },
+    "/v1/repos/{owner}/{rname}/proposals/{id}/review-draft": {
+      "delete": {
+        "operationId": "proposal.clear_draft",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "expected_version",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "format": "int64",
+              "minimum": 0,
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReviewDraft"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Clear the inspected private review draft",
+        "tags": [
+          "Proposal"
+        ]
+      },
+      "get": {
+        "operationId": "proposal.get_draft",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReviewDraft"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Read your private review draft",
+        "tags": [
+          "Proposal"
+        ]
+      },
+      "put": {
+        "operationId": "proposal.save_draft",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SaveReviewDraftRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReviewDraft"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Save your private review draft",
+        "tags": [
+          "Proposal"
+        ]
+      }
+    },
     "/v1/repos/{owner}/{rname}/proposals/{id}/reviewers": {
       "put": {
         "operationId": "proposal.set_reviewers",
diff --git a/migrations/postgres/0010_review_drafts.sql b/migrations/postgres/0010_review_drafts.sql
new file mode 100644
index 00000000..8d58aeb3
--- /dev/null
+++ b/migrations/postgres/0010_review_drafts.sql
@@ -0,0 +1,12 @@
+CREATE TABLE review_drafts (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    owner TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    head TEXT,
+    decision TEXT NOT NULL,
+    body TEXT NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (proposal, owner),
+    CHECK ((head IS NULL AND decision = '' AND body = '') OR
+           (head IS NOT NULL AND decision IN ('approve', 'request_changes', 'comment')))
+);
diff --git a/migrations/sqlite/0010_review_drafts.sql b/migrations/sqlite/0010_review_drafts.sql
new file mode 100644
index 00000000..8d58aeb3
--- /dev/null
+++ b/migrations/sqlite/0010_review_drafts.sql
@@ -0,0 +1,12 @@
+CREATE TABLE review_drafts (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    owner TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    head TEXT,
+    decision TEXT NOT NULL,
+    body TEXT NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (proposal, owner),
+    CHECK ((head IS NULL AND decision = '' AND body = '') OR
+           (head IS NOT NULL AND decision IN ('approve', 'request_changes', 'comment')))
+);
diff --git a/proto/agwp/v1/agwp.proto b/proto/agwp/v1/agwp.proto
index 11dc900f..8c24f64e 100644
--- a/proto/agwp/v1/agwp.proto
+++ b/proto/agwp/v1/agwp.proto
@@ -766,6 +766,34 @@ message UpdateProposalRequest {
   string expected_head = 5;
 }
 
+// Private, unsubmitted review notes for the current acting identity only.
+message ReviewDraft {
+  bool present = 1;
+  uint64 version = 2;
+  string head = 3;
+  string decision = 4;
+  string body = 5;
+  int64 updated_at_ms = 6;
+}
+message GetReviewDraftRequest {
+  string repo = 1;
+  string id = 2;
+}
+message SaveReviewDraftRequest {
+  string repo = 1;
+  string id = 2;
+  string head = 3;
+  string decision = 4;
+  string body = 5;
+  // Zero means no prior draft; all saves compare this version atomically.
+  uint64 expected_version = 6;
+}
+message ClearReviewDraftRequest {
+  string repo = 1;
+  string id = 2;
+  uint64 expected_version = 3;
+}
+
 // Replaces review routing after comparing the complete inspected set.
 message SetRequestedReviewersRequest {
   string repo = 1;
@@ -1821,6 +1849,9 @@ service ProposalService {
   rpc Get(GetProposalRequest) returns (ProposalDetail);
   rpc List(ListProposalsRequest) returns (ListProposalsResponse);
   rpc Update(UpdateProposalRequest) returns (Proposal);
+  rpc GetDraft(GetReviewDraftRequest) returns (ReviewDraft);
+  rpc SaveDraft(SaveReviewDraftRequest) returns (ReviewDraft);
+  rpc ClearDraft(ClearReviewDraftRequest) returns (ReviewDraft);
   rpc SetReviewers(SetRequestedReviewersRequest) returns (RequestedReviewers);
   rpc Review(ReviewProposalRequest) returns (Review);
   rpc Comment(CommentProposalRequest) returns (Review);

From a76e99b330f2e2cc8b3c1044085f437fdeb9a20b Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 21:26:45 +0000
Subject: [PATCH 08/41] feat(clients): expose private review drafts in SDKs and
 MCP

Add current-account read, versioned save and clear with safe retry semantics and capability checks. Keep private draft tools behind the review permission group.

Validated: TypeScript 177 tests and package checks, Python 202 tests and lint/types, MCP 108 tests.
---
 crates/ag-mcp/src/tools/mod.rs                |  10 +-
 crates/ag-mcp/src/tools/proposals.rs          | 105 ++++++++++
 crates/ag-mcp/tests/review_drafts.rs          |  71 +++++++
 crates/ag-mcp/tests/review_requests.rs        |   8 +-
 sdk/api-policy.json                           |   4 +-
 sdk/python/README.md                          |   9 +
 sdk/python/src/agentgit/_generated/models.py  |  41 ++++
 .../src/agentgit/_generated/namespaces.py     |  74 +++++++
 .../src/agentgit/_generated/operations.py     |  48 +++++
 sdk/python/tests/test_all_operations.py       |  16 ++
 sdk/python/tests/test_review_drafts.py        | 135 +++++++++++++
 sdk/typescript/README.md                      |   8 +
 sdk/typescript/src/generated/api.ts           |   9 +
 sdk/typescript/src/generated/models.ts        |   4 +
 sdk/typescript/src/generated/operations.ts    |  45 +++++
 sdk/typescript/src/generated/schema.ts        | 186 ++++++++++++++++++
 sdk/typescript/test/all-operations.test.ts    |  26 +++
 sdk/typescript/test/review-drafts.test.ts     |  92 +++++++++
 18 files changed, 888 insertions(+), 3 deletions(-)
 create mode 100644 crates/ag-mcp/tests/review_drafts.rs
 create mode 100644 sdk/python/tests/test_review_drafts.py
 create mode 100644 sdk/typescript/test/review-drafts.test.ts

diff --git a/crates/ag-mcp/src/tools/mod.rs b/crates/ag-mcp/src/tools/mod.rs
index 94c3b32c..f43dc143 100644
--- a/crates/ag-mcp/src/tools/mod.rs
+++ b/crates/ag-mcp/src/tools/mod.rs
@@ -420,11 +420,19 @@ mod tests {
         for t in reg.all() {
             match t.group {
                 Group::Read => assert!(t.ann.read_only, "{} is in the read group so it must be read-only", t.name),
+                Group::Review if t.name == "review_draft_get" => {
+                    // Private notes require the review opt-in even though reading does not mutate them.
+                    assert!(t.ann.read_only);
+                }
                 _ => assert!(!t.ann.read_only, "{} changes state so it cannot be marked read-only", t.name),
             }
         }
         let destructive: Vec<&str> = reg.all().iter().filter(|t| t.ann.destructive).map(|t| t.name).collect();
-        assert_eq!(destructive, ["workspace_delete", "proposal_close", "integrate"], "{destructive:?}");
+        assert_eq!(
+            destructive,
+            ["workspace_delete", "proposal_close", "review_draft_clear", "integrate"],
+            "{destructive:?}"
+        );
     }
 
     #[test]
diff --git a/crates/ag-mcp/src/tools/proposals.rs b/crates/ag-mcp/src/tools/proposals.rs
index 9125a10d..61f67946 100644
--- a/crates/ag-mcp/src/tools/proposals.rs
+++ b/crates/ag-mcp/src/tools/proposals.rs
@@ -120,6 +120,59 @@ fn proposal_set_reviewers(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput,
     ))
 }
 
+fn review_draft(ctx: &CallCtx<'_>, args: &Value, method: &str) -> Result<ToolOutput, ToolError> {
+    let repo = ctx.repo(args)?;
+    let run = ctx.run_id(args)?;
+    if !ctx.api.supports("proposals.review_drafts", &ctx.opts(run))? {
+        return Err(ToolError::local("server_update_required", "This server does not support private review drafts.")
+            .hint("Update the server before saving or reading account drafts."));
+    }
+    let id = str_arg(args, "proposal_id").unwrap_or_default();
+    let path = format!("{}/proposals/{}/review-draft", repo_path(&repo), enc(id));
+    let value = if method == "GET" {
+        ctx.api.get(&path, &[], &ctx.opts(run))?
+    } else {
+        write_review_draft(ctx, args, &path, run, method)?
+    };
+    let summary = if value.get("present").and_then(Value::as_bool).unwrap_or(false) {
+        "Your private review draft is saved. No review was posted."
+    } else {
+        "No private review draft is saved. No review was posted."
+    };
+    Ok(ToolOutput::new(summary, json!({"draft":value})).block("/draft/body", "review.draft", vec![]))
+}
+
+fn write_review_draft(
+    ctx: &CallCtx<'_>,
+    args: &Value,
+    path: &str,
+    run: Option<&str>,
+    method: &str,
+) -> Result<Value, ToolError> {
+    let version =
+        u64_arg(args, "expected_version").ok_or_else(|| ToolError::invalid("expected_version is required"))?;
+    if method == "DELETE" {
+        return Ok(ctx.api.send("DELETE", &format!("{path}?expected_version={version}"), None, &ctx.opts(run))?);
+    }
+    let text = str_arg(args, "body").unwrap_or_default();
+    if text.len() > 64 * 1024 {
+        return Err(ToolError::invalid("draft body exceeds 64 KiB"));
+    }
+    let body = json!({"expected_version":version,"head":str_arg(args, "head").unwrap_or_default(),
+        "decision":str_arg(args, "decision").unwrap_or_default(),"body":text});
+    Ok(ctx.api.send("PUT", path, Some(&body), &ctx.opts(run))?)
+}
+
+fn review_draft_get(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    review_draft(ctx, args, "GET")
+}
+fn review_draft_save(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    review_draft(ctx, args, "PUT")
+}
+fn review_draft_clear(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    review_draft(ctx, args, "DELETE")
+}
+
 fn proposal_close(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
     let repo = ctx.repo(args)?;
     let run = ctx.run_id(args)?;
@@ -407,6 +460,58 @@ pub fn tools() -> Vec<ToolDef> {
             output(vec![("jobs", o_arr())], &["jobs"]),
             request_validation,
         ),
+        def(
+            "review_draft_get",
+            Group::Review,
+            "Read your private review draft",
+            "Reads only the calling account's saved draft for this proposal. This is not a posted review and does not expose another account's notes.",
+            Ann::READ,
+            input(vec![p_repo(), ("proposal_id", t_str("Proposal id or unique prefix.")), p_run()], &["proposal_id"]),
+            output(vec![("draft", o_obj())], &["draft"]),
+            review_draft_get,
+        ),
+        def(
+            "review_draft_save",
+            Group::Review,
+            "Save your private review draft",
+            "Saves private draft text and a possible decision against the inspected draft version. Does not post approval or notify anyone. A stale version preserves the other edit.",
+            Ann::SET,
+            input(
+                vec![
+                    p_repo(),
+                    ("proposal_id", t_str("Proposal id or unique prefix.")),
+                    (
+                        "expected_version",
+                        t_int("Version returned by review_draft_get; 0 only when no draft exists.", 0, i64::MAX),
+                    ),
+                    ("head", t_str("Exact proposal head the draft refers to.")),
+                    ("decision", t_enum("Unsubmitted draft decision.", &["approve", "request_changes", "comment"])),
+                    ("body", t_str_max("Private notes, up to 64 KiB of UTF-8.", 65536)),
+                    p_run(),
+                ],
+                &["proposal_id", "expected_version", "head", "decision", "body"],
+            ),
+            output(vec![("draft", o_obj())], &["draft"]),
+            review_draft_save,
+        ),
+        def(
+            "review_draft_clear",
+            Group::Review,
+            "Clear your private review draft",
+            "Clears only your saved draft after comparing its inspected version. Newer text is retained on conflict; already cleared drafts are safe to retry.",
+            Ann::DESTROY,
+            input(
+                vec![
+                    p_repo(),
+                    ("proposal_id", t_str("Proposal id or unique prefix.")),
+                    ("expected_version", t_int("Version returned by review_draft_get.", 0, i64::MAX)),
+                    p_run(),
+                ],
+                &["proposal_id", "expected_version"],
+            ),
+            output(vec![("draft", o_obj())], &["draft"]),
+            review_draft_clear,
+        ),
         def(
             "review",
             Group::Review,
diff --git a/crates/ag-mcp/tests/review_drafts.rs b/crates/ag-mcp/tests/review_drafts.rs
new file mode 100644
index 00000000..e719c01e
--- /dev/null
+++ b/crates/ag-mcp/tests/review_drafts.rs
@@ -0,0 +1,71 @@
+//! Account drafts are private notes, not posted review decisions.
+#![allow(missing_docs)]
+mod common;
+use common::*;
+use serde_json::json;
+
+#[test]
+fn private_review_drafts_preserve_other_accounts_and_stale_edits() {
+    let srv = TestServer::start();
+    let repo = "acme/drafts";
+    srv.repo(repo);
+    srv.seed(repo, "Initial", &[("file.txt", "old\n")]);
+    let mut author = Mcp::start(&srv, ADMIN, &["--repo", repo]);
+    author.ok("workspace_create", json!({"name":"change"}));
+    author.ok(
+        "workspace_write_files",
+        json!({"workspace":"change","message":"change","changes":[{"path":"file.txt","op":"put","content":"new\n"}]}),
+    );
+    let proposed = author.ok("propose", json!({"workspace":"change","title":"Review"}));
+    let id = proposed.structured["proposal"]["id"].as_str().unwrap();
+    let head = proposed.structured["proposal"]["head"].as_str().unwrap();
+    let bob_token = srv.credential("user:bob", repo, "reviewer", 3600, &[]);
+    let carol_token = srv.credential("user:carol", repo, "reviewer", 3600, &[]);
+    let mut bob = Mcp::start(&srv, &bob_token, &["--repo", repo, "--allow", "read,review"]);
+    let mut carol = Mcp::start(&srv, &carol_token, &["--repo", repo, "--allow", "read,review"]);
+    let args = json!({"proposal_id":id});
+    let empty = bob.ok("review_draft_get", args.clone());
+    assert_eq!(empty.structured["draft"]["present"], false);
+    let save = json!({"proposal_id":id,"head":head,"decision":"comment","body":"Private notes","expected_version":0});
+    let saved = bob.ok("review_draft_save", save.clone());
+    assert_eq!(saved.structured["draft"]["version"], 1);
+    assert_eq!(bob.ok("review_draft_save", save).structured["draft"]["version"], 1);
+    assert_eq!(carol.ok("review_draft_get", args.clone()).structured["draft"]["present"], false);
+    assert!(
+        bob.call(
+            "review_draft_save",
+            json!({"proposal_id":id,"head":head,"decision":"comment","body":"stale replacement","expected_version":0})
+        )
+        .is_error
+    );
+    let clear = bob.ok("review_draft_clear", json!({"proposal_id":id,"expected_version":1}));
+    assert_eq!(clear.structured["draft"]["present"], false);
+    assert_eq!(clear.structured["draft"]["version"], 2);
+    assert_eq!(bob.ok("review_draft_get", args.clone()).structured["draft"]["body"], "");
+    assert!(
+        bob.call(
+            "review_draft_save",
+            json!({"proposal_id":id,"head":head,"decision":"comment","body":"old device","expected_version":0})
+        )
+        .is_error
+    );
+    assert!(
+        bob.call(
+            "review_draft_save",
+            json!({"proposal_id":id,"head":head,"decision":"comment","body":"missing guard"})
+        )
+        .is_error
+    );
+    let newer = bob.ok(
+        "review_draft_save",
+        json!({"proposal_id":id,"head":head,"decision":"comment","body":"Recovered note","expected_version":2}),
+    );
+    assert_eq!(newer.structured["draft"]["version"], 3);
+    author.ok("proposal_close", json!({"proposal_id":id}));
+    assert_eq!(bob.ok("review_draft_get", args).structured["draft"]["body"], "Recovered note");
+    assert!(
+        !bob.ok("review_draft_clear", json!({"proposal_id":id,"expected_version":3})).structured["draft"]["present"]
+            .as_bool()
+            .unwrap()
+    );
+}
diff --git a/crates/ag-mcp/tests/review_requests.rs b/crates/ag-mcp/tests/review_requests.rs
index 10baf7ad..edaa7f04 100644
--- a/crates/ag-mcp/tests/review_requests.rs
+++ b/crates/ag-mcp/tests/review_requests.rs
@@ -81,7 +81,10 @@ fn older_servers_refuse_review_request_writes_and_filters_before_using_them() {
         )
         .unwrap();
     });
-    let mut m = Mcp::spawn(&["--server", &url, "--repo", "acme/reviews"], &[("AG_MCP_TOKEN", "test-token")]);
+    let mut m = Mcp::spawn(
+        &["--server", &url, "--repo", "acme/reviews", "--allow", "read,propose,review"],
+        &[("AG_MCP_TOKEN", "test-token")],
+    );
     m.request("server/discover", json!({}));
     m.refused(
         "proposal_set_reviewers",
@@ -89,5 +92,8 @@ fn older_servers_refuse_review_request_writes_and_filters_before_using_them() {
         "server_update_required",
     );
     m.refused("proposal_list", json!({"requested_reviewer":"user:bob"}), "server_update_required");
+    m.refused("review_draft_get", json!({"proposal_id":"prop_test"}), "server_update_required");
+    m.refused("review_draft_save", json!({"proposal_id":"prop_test","expected_version":0,"head":"0".repeat(64),"decision":"comment","body":"private"}), "server_update_required");
+    m.refused("review_draft_clear", json!({"proposal_id":"prop_test","expected_version":0}), "server_update_required");
     response.join().unwrap();
 }
diff --git a/sdk/api-policy.json b/sdk/api-policy.json
index 68c9d517..0cee3702 100644
--- a/sdk/api-policy.json
+++ b/sdk/api-policy.json
@@ -52,7 +52,9 @@
       "task.finish",
       "workspace.delete",
       "migration.commit",
-      "proposal.set_reviewers"
+      "proposal.set_reviewers",
+      "proposal.save_draft",
+      "proposal.clear_draft"
     ],
     "naturalWhenFieldPresent": {
       "workspace.modify": "expected_head",
diff --git a/sdk/python/README.md b/sdk/python/README.md
index aafaa6fc..ebb88b98 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -536,3 +536,12 @@ Workspace sync is retried automatically only when `expected_stream_head` is none
 An unpinned sync can apply resolutions against a moving branch, so a lost response
 leaves its outcome unknown and is not retried by default. Explicit unsafe-retry opt-in
 remains available for callers that deliberately accept that risk.
+
+
+Private review drafts use `client.proposals.get_draft`, `save_draft` and `clear_draft`
+(the same names are available on the async client). Negotiate `proposals.review_drafts`
+first. Save the complete draft with the `expected_version` returned by the last read;
+clear it with that guard. A conflict preserves the newer draft. The authenticated actor
+owns the notes; there is no owner argument. Drafts never post reviews or count as approval.
+Clearing removes content but retains a version, preventing stale saves from recreating it.
+Identical retries are safe; reread and decide before changing a conflicting draft.
diff --git a/sdk/python/src/agentgit/_generated/models.py b/sdk/python/src/agentgit/_generated/models.py
index 0798bb5e..6d25dbe5 100644
--- a/sdk/python/src/agentgit/_generated/models.py
+++ b/sdk/python/src/agentgit/_generated/models.py
@@ -27,6 +27,7 @@
     "Changeset",
     "ClaimJobRequest",
     "ClaimJobResponse",
+    "ClearReviewDraftRequest",
     "CloseProposalRequest",
     "CommentProposalRequest",
     "CompareAndSwapRequest",
@@ -72,6 +73,7 @@
     "GetPolicyRequest",
     "GetProposalRequest",
     "GetRepoRequest",
+    "GetReviewDraftRequest",
     "GetRunOutputRequest",
     "GetRunRequest",
     "GetTaskRequest",
@@ -189,6 +191,7 @@
     "ResolveRevResponse",
     "ResolveReviewThreadRequest",
     "Review",
+    "ReviewDraft",
     "ReviewLineAnchor",
     "ReviewProposalRequest",
     "ReviewThread",
@@ -201,6 +204,7 @@
     "RunQueueRequest",
     "RunQueueResponse",
     "RunSpec",
+    "SaveReviewDraftRequest",
     "SaveRunOutputRequest",
     "SearchMatch",
     "SearchTreeRequest",
@@ -447,6 +451,14 @@ class ClaimJobResponse:
     job: Job | None = field(default=None)
 
 
+@dataclass(kw_only=True)
+class ClearReviewDraftRequest:
+    """The `ClearReviewDraftRequest` message."""
+    expected_version: int = field(default=0)
+    id: str = field(default="")
+    repo: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class CloseProposalRequest:
     """The `CloseProposalRequest` message."""
@@ -875,6 +887,13 @@ class GetRepoRequest:
     repo: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class GetReviewDraftRequest:
+    """The `GetReviewDraftRequest` message."""
+    id: str = field(default="")
+    repo: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class GetRunOutputRequest:
     """The `GetRunOutputRequest` message."""
@@ -1887,6 +1906,17 @@ class Review:
     timestamp_ms: int = field(default=0)
 
 
+@dataclass(kw_only=True)
+class ReviewDraft:
+    """Private, unsubmitted review notes for the current acting identity only."""
+    body: str = field(default="")
+    decision: str = field(default="")
+    head: str = field(default="")
+    present: bool = field(default=False)
+    updated_at_ms: int = field(default=0)
+    version: int = field(default=0)
+
+
 @dataclass(kw_only=True)
 class ReviewLineAnchor:
     """A line location is immutable; text is filled from the repository by the server."""
@@ -2008,6 +2038,17 @@ class RunSpec:
     timeout_secs: int = field(default=0)
 
 
+@dataclass(kw_only=True)
+class SaveReviewDraftRequest:
+    """The `SaveReviewDraftRequest` message."""
+    body: str = field(default="")
+    decision: str = field(default="")
+    expected_version: int = field(default=0)
+    head: str = field(default="")
+    id: str = field(default="")
+    repo: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class SaveRunOutputRequest:
     """The `SaveRunOutputRequest` message."""
diff --git a/sdk/python/src/agentgit/_generated/namespaces.py b/sdk/python/src/agentgit/_generated/namespaces.py
index 4f0f9feb..b697c4fb 100644
--- a/sdk/python/src/agentgit/_generated/namespaces.py
+++ b/sdk/python/src/agentgit/_generated/namespaces.py
@@ -27,6 +27,7 @@
     Changeset,
     ClaimJobRequest,
     ClaimJobResponse,
+    ClearReviewDraftRequest,
     CloseProposalRequest,
     CommentProposalRequest,
     CompareAndSwapRequest,
@@ -72,6 +73,7 @@
     GetPolicyRequest,
     GetProposalRequest,
     GetRepoRequest,
+    GetReviewDraftRequest,
     GetRunOutputRequest,
     GetRunRequest,
     GetTaskRequest,
@@ -189,6 +191,7 @@
     ResolveRevResponse,
     ResolveReviewThreadRequest,
     Review,
+    ReviewDraft,
     ReviewLineAnchor,
     ReviewProposalRequest,
     ReviewThread,
@@ -201,6 +204,7 @@
     RunQueueRequest,
     RunQueueResponse,
     RunSpec,
+    SaveReviewDraftRequest,
     SaveRunOutputRequest,
     SearchMatch,
     SearchTreeRequest,
@@ -1128,6 +1132,17 @@ class ProposalsApi:
     def __init__(self, caller: SyncCaller) -> None:
         self._c = caller
 
+    def clear_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        expected_version: int | None = None,
+        options: CallOptions | None = None,
+    ) -> ReviewDraft:
+        """Clear the inspected private review draft (`DELETE /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.clear_draft`)."""
+        return self._c._call("proposal.clear_draft", {"repo": repo, "id": id, "expected_version": expected_version}, options, ReviewDraft)
+
     def close(
         self,
         *,
@@ -1177,6 +1192,16 @@ def get(
         """One proposal with its reviews (`GET /v1/repos/{owner}/{rname}/proposals/{id}`, operation `proposal.get`)."""
         return self._c._call("proposal.get", {"repo": repo, "id": id}, options, ProposalDetail)
 
+    def get_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        options: CallOptions | None = None,
+    ) -> ReviewDraft:
+        """Read your private review draft (`GET /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.get_draft`)."""
+        return self._c._call("proposal.get_draft", {"repo": repo, "id": id}, options, ReviewDraft)
+
     def list(
         self,
         *,
@@ -1207,6 +1232,20 @@ def review(
         """Review the current head (`POST /v1/repos/{owner}/{rname}/proposals/{id}/reviews`, operation `proposal.review`)."""
         return self._c._call("proposal.review", {"repo": repo, "id": id, "body": body, "decision": decision, "expected_head": expected_head, "idempotency_key": idempotency_key}, options, Review)
 
+    def save_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        body: str | None = None,
+        decision: str | None = None,
+        expected_version: int | None = None,
+        head: str | None = None,
+        options: CallOptions | None = None,
+    ) -> ReviewDraft:
+        """Save your private review draft (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.save_draft`)."""
+        return self._c._call("proposal.save_draft", {"repo": repo, "id": id, "body": body, "decision": decision, "expected_version": expected_version, "head": head}, options, ReviewDraft)
+
     def set_reviewers(
         self,
         *,
@@ -2765,6 +2804,17 @@ class AsyncProposalsApi:
     def __init__(self, caller: AsyncCaller) -> None:
         self._c = caller
 
+    async def clear_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        expected_version: int | None = None,
+        options: CallOptions | None = None,
+    ) -> ReviewDraft:
+        """Clear the inspected private review draft (`DELETE /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.clear_draft`)."""
+        return await self._c._call("proposal.clear_draft", {"repo": repo, "id": id, "expected_version": expected_version}, options, ReviewDraft)
+
     async def close(
         self,
         *,
@@ -2814,6 +2864,16 @@ async def get(
         """One proposal with its reviews (`GET /v1/repos/{owner}/{rname}/proposals/{id}`, operation `proposal.get`)."""
         return await self._c._call("proposal.get", {"repo": repo, "id": id}, options, ProposalDetail)
 
+    async def get_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        options: CallOptions | None = None,
+    ) -> ReviewDraft:
+        """Read your private review draft (`GET /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.get_draft`)."""
+        return await self._c._call("proposal.get_draft", {"repo": repo, "id": id}, options, ReviewDraft)
+
     async def list(
         self,
         *,
@@ -2844,6 +2904,20 @@ async def review(
         """Review the current head (`POST /v1/repos/{owner}/{rname}/proposals/{id}/reviews`, operation `proposal.review`)."""
         return await self._c._call("proposal.review", {"repo": repo, "id": id, "body": body, "decision": decision, "expected_head": expected_head, "idempotency_key": idempotency_key}, options, Review)
 
+    async def save_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        body: str | None = None,
+        decision: str | None = None,
+        expected_version: int | None = None,
+        head: str | None = None,
+        options: CallOptions | None = None,
+    ) -> ReviewDraft:
+        """Save your private review draft (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.save_draft`)."""
+        return await self._c._call("proposal.save_draft", {"repo": repo, "id": id, "body": body, "decision": decision, "expected_version": expected_version, "head": head}, options, ReviewDraft)
+
     async def set_reviewers(
         self,
         *,
diff --git a/sdk/python/src/agentgit/_generated/operations.py b/sdk/python/src/agentgit/_generated/operations.py
index 502e681e..08bf8078 100644
--- a/sdk/python/src/agentgit/_generated/operations.py
+++ b/sdk/python/src/agentgit/_generated/operations.py
@@ -1040,6 +1040,21 @@
         idempotency_key=False,
         public=False,
     ),
+    "proposal.clear_draft": OperationInfo(
+        id="proposal.clear_draft",
+        http="DELETE",
+        route="/v1/repos/{owner}/{rname}/proposals/{id}/review-draft",
+        namespace="proposals",
+        name="clear_draft",
+        summary="Clear the inspected private review draft",
+        path_params=('owner', 'rname', 'id'),
+        query_params=('expected_version',),
+        body="none",
+        response="json",
+        retry="natural",
+        idempotency_key=False,
+        public=False,
+    ),
     "proposal.close": OperationInfo(
         id="proposal.close",
         http="POST",
@@ -1100,6 +1115,21 @@
         idempotency_key=False,
         public=False,
     ),
+    "proposal.get_draft": OperationInfo(
+        id="proposal.get_draft",
+        http="GET",
+        route="/v1/repos/{owner}/{rname}/proposals/{id}/review-draft",
+        namespace="proposals",
+        name="get_draft",
+        summary="Read your private review draft",
+        path_params=('owner', 'rname', 'id'),
+        query_params=(),
+        body="none",
+        response="json",
+        retry="read",
+        idempotency_key=False,
+        public=False,
+    ),
     "proposal.list": OperationInfo(
         id="proposal.list",
         http="GET",
@@ -1130,6 +1160,21 @@
         idempotency_key=True,
         public=False,
     ),
+    "proposal.save_draft": OperationInfo(
+        id="proposal.save_draft",
+        http="PUT",
+        route="/v1/repos/{owner}/{rname}/proposals/{id}/review-draft",
+        namespace="proposals",
+        name="save_draft",
+        summary="Save your private review draft",
+        path_params=('owner', 'rname', 'id'),
+        query_params=(),
+        body="json",
+        response="json",
+        retry="natural",
+        idempotency_key=False,
+        public=False,
+    ),
     "proposal.set_reviewers": OperationInfo(
         id="proposal.set_reviewers",
         http="PUT",
@@ -1934,12 +1979,15 @@
         "get": "operations.get",
     },
     "proposals": {
+        "clear_draft": "proposal.clear_draft",
         "close": "proposal.close",
         "comment": "proposal.comment",
         "create": "proposal.create",
         "get": "proposal.get",
+        "get_draft": "proposal.get_draft",
         "list": "proposal.list",
         "review": "proposal.review",
+        "save_draft": "proposal.save_draft",
         "set_reviewers": "proposal.set_reviewers",
         "thread_comments": "proposal.thread_comments",
         "thread_create": "proposal.thread_create",
diff --git a/sdk/python/tests/test_all_operations.py b/sdk/python/tests/test_all_operations.py
index ec56373b..396c55a8 100644
--- a/sdk/python/tests/test_all_operations.py
+++ b/sdk/python/tests/test_all_operations.py
@@ -144,6 +144,7 @@ def test_policy(tour: dict[str, AgentGitClient]) -> None:
 
 
 def test_workspaces_proposals_reviews_and_the_execution_plane(tour: dict[str, AgentGitClient]) -> None:
+    admin = tour["admin"]
     alice, bob, carol, ci = tour["alice"], tour["bob"], tour["carol"], tour["ci"]
     assert alice.workspaces.create(repo=REPO, name="w1", stream="main").name == "w1"
     assert "w1" in [w.name for w in alice.workspaces.list(repo=REPO).workspaces]
@@ -163,6 +164,21 @@ def test_workspaces_proposals_reviews_and_the_execution_plane(tour: dict[str, Ag
     assert request_review(alice, REPO, p1.id, ["user:bob"]).reviewers == ["user:bob"]
     assert bob.proposals.get(repo=REPO, id=p1.id).requested_reviewers == ["user:bob"]
     assert [p.id for p in reviews_requested_from(bob, REPO, "user:bob")] == [p1.id]
+    assert not bob.proposals.get_draft(repo=REPO, id=p1.id).present
+    private_draft = bob.proposals.save_draft(
+        repo=REPO, id=p1.id, expected_version=0, head=m2.head, decision="comment", body="Private draft"
+    )
+    assert private_draft.version == 1
+    assert not admin.proposals.get_draft(repo=REPO, id=p1.id).present
+    assert bob.proposals.get(repo=REPO, id=p1.id).reviews == []
+    with pytest.raises(FailedPreconditionError):
+        bob.proposals.save_draft(
+            repo=REPO, id=p1.id, expected_version=0, head=m2.head, decision="comment", body="Stale overwrite"
+        )
+    cleared_draft = bob.proposals.clear_draft(repo=REPO, id=p1.id, expected_version=private_draft.version)
+    assert not cleared_draft.present
+    assert cleared_draft.version == 2
+    assert bob.proposals.get_draft(repo=REPO, id=p1.id).body == ""
     bob.proposals.review(repo=REPO, id=p1.id, decision="approve")
     assert (
         bob.proposals.comment(
diff --git a/sdk/python/tests/test_review_drafts.py b/sdk/python/tests/test_review_drafts.py
new file mode 100644
index 00000000..bcbdb4c3
--- /dev/null
+++ b/sdk/python/tests/test_review_drafts.py
@@ -0,0 +1,135 @@
+import asyncio
+import json
+
+import httpx
+
+from agentgit import AgentGitClient, AsyncAgentGitClient
+
+DRAFT = {
+    "present": True,
+    "version": 1,
+    "head": "reviewed",
+    "decision": "comment",
+    "body": "Private notes",
+    "updated_at_ms": 1,
+}
+
+
+def test_private_drafts_send_owner_free_guarded_requests() -> None:
+    requests: list[httpx.Request] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(200, json=DRAFT)
+
+    with AgentGitClient(
+        "http://draft.test", "reviewer", http_client=httpx.Client(transport=httpx.MockTransport(respond))
+    ) as client:
+        client.proposals.get_draft(repo="team/app", id="proposal")
+        client.proposals.save_draft(
+            repo="team/app",
+            id="proposal",
+            expected_version=0,
+            head="reviewed",
+            decision="comment",
+            body="Private notes",
+        )
+        client.proposals.clear_draft(repo="team/app", id="proposal", expected_version=1)
+    assert [request.method for request in requests] == ["GET", "PUT", "DELETE"]
+    assert all(request.url.path.endswith("/proposals/proposal/review-draft") for request in requests)
+    assert json.loads(requests[1].content) == {
+        "expected_version": 0,
+        "head": "reviewed",
+        "decision": "comment",
+        "body": "Private notes",
+    }
+    assert requests[2].content == b""
+    assert requests[2].url.params["expected_version"] == "1"
+
+
+def test_lost_draft_save_retries_exactly_the_same_payload() -> None:
+    bodies: list[bytes] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        bodies.append(request.content)
+        if len(bodies) == 1:
+            raise httpx.ReadError("response lost after save", request=request)
+        return httpx.Response(200, json=DRAFT)
+
+    with AgentGitClient(
+        "http://draft.test",
+        "reviewer",
+        http_client=httpx.Client(transport=httpx.MockTransport(respond)),
+        sleep=lambda _: None,
+    ) as client:
+        result = client.proposals.save_draft(
+            repo="team/app",
+            id="proposal",
+            expected_version=0,
+            head="reviewed",
+            decision="comment",
+            body="Private notes",
+        )
+    assert result.body == "Private notes"
+    assert len(bodies) == 2
+    assert bodies[0] == bodies[1]
+
+
+def test_clear_retries_the_same_query_version_even_when_zero() -> None:
+    urls: list[str] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        urls.append(str(request.url))
+        assert request.content == b""
+        if len(urls) == 1:
+            raise httpx.ReadError("response lost after clear", request=request)
+        return httpx.Response(
+            200, json={**DRAFT, "present": False, "body": "", "head": "", "decision": "", "version": 2}
+        )
+
+    with AgentGitClient(
+        "http://draft.test",
+        "reviewer",
+        http_client=httpx.Client(transport=httpx.MockTransport(respond)),
+        sleep=lambda _: None,
+    ) as client:
+        result = client.proposals.clear_draft(repo="team/app", id="proposal", expected_version=0)
+    assert not result.present
+    assert result.version == 2
+    assert urls[0] == urls[1]
+    assert len(urls) == 2
+    assert httpx.URL(urls[0]).params["expected_version"] == "0"
+
+
+def test_async_draft_save_uses_the_same_guard_and_retry_contract() -> None:
+    async def scenario() -> None:
+        bodies: list[bytes] = []
+
+        async def respond(request: httpx.Request) -> httpx.Response:
+            bodies.append(request.content)
+            if len(bodies) == 1:
+                raise httpx.ReadError("response lost after save", request=request)
+            return httpx.Response(200, json=DRAFT)
+
+        async def no_sleep(_delay: float) -> None:
+            pass
+
+        async with AsyncAgentGitClient(
+            "http://draft.test",
+            "reviewer",
+            http_client=httpx.AsyncClient(transport=httpx.MockTransport(respond)),
+            sleep=no_sleep,
+        ) as client:
+            result = await client.proposals.save_draft(
+                repo="team/app",
+                id="proposal",
+                expected_version=0,
+                head="reviewed",
+                decision="comment",
+                body="Private notes",
+            )
+        assert result.body == "Private notes"
+        assert len(bodies) == 2
+        assert bodies[0] == bodies[1]
+
+    asyncio.run(scenario())
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index e882f8c2..2c47c782 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -497,3 +497,11 @@ Workspace sync is retried automatically only when `expected_stream_head` is none
 An unpinned sync can apply resolutions against a moving branch, so a lost response
 leaves its outcome unknown and is not retried by default. Explicit unsafe-retry opt-in
 remains available for callers that deliberately accept that risk.
+
+Private review drafts use `client.proposals.getDraft`, `saveDraft` and `clearDraft`.
+Negotiate `proposals.review_drafts` first. Save the complete draft with the `expected_version`
+returned by the last read; clear it with the same guard. A conflict preserves the newer draft.
+Drafts belong to the authenticated actor, not an owner parameter; they never post a review,
+count as approval or notify reviewers. Clearing removes the content and retains a version
+so stale saves cannot recreate it. Retrying an identical save/clear is safe; reread before
+changing a conflicting draft rather than automatically overwriting it.
diff --git a/sdk/typescript/src/generated/api.ts b/sdk/typescript/src/generated/api.ts
index df000dec..511b8690 100644
--- a/sdk/typescript/src/generated/api.ts
+++ b/sdk/typescript/src/generated/api.ts
@@ -97,12 +97,15 @@ export const NAMESPACE_METHODS = {
     get: 'operations.get',
   },
   proposals: {
+    clearDraft: 'proposal.clear_draft',
     close: 'proposal.close',
     comment: 'proposal.comment',
     create: 'proposal.create',
     get: 'proposal.get',
+    getDraft: 'proposal.get_draft',
     list: 'proposal.list',
     review: 'proposal.review',
+    saveDraft: 'proposal.save_draft',
     setReviewers: 'proposal.set_reviewers',
     threadComments: 'proposal.thread_comments',
     threadCreate: 'proposal.thread_create',
@@ -332,6 +335,8 @@ export interface Api {
     get(request: Req<'operations.get'>, options?: CallOptions): Promise<Res<'operations.get'>>;
   };
   readonly proposals: {
+    /** Clear the inspected private review draft (`DELETE /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.clear_draft`) */
+    clearDraft(request: Req<'proposal.clear_draft'>, options?: CallOptions): Promise<Res<'proposal.clear_draft'>>;
     /** Close without integrating (`POST /v1/repos/{owner}/{rname}/proposals/{id}/close`, operation `proposal.close`) */
     close(request: Req<'proposal.close'>, options?: CallOptions): Promise<Res<'proposal.close'>>;
     /** Add an idempotent discussion comment at the inspected head (`POST /v1/repos/{owner}/{rname}/proposals/{id}/comments`, operation `proposal.comment`) */
@@ -340,10 +345,14 @@ export interface Api {
     create(request: Req<'proposal.create'>, options?: CallOptions): Promise<Res<'proposal.create'>>;
     /** One proposal with its reviews (`GET /v1/repos/{owner}/{rname}/proposals/{id}`, operation `proposal.get`) */
     get(request: Req<'proposal.get'>, options?: CallOptions): Promise<Res<'proposal.get'>>;
+    /** Read your private review draft (`GET /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.get_draft`) */
+    getDraft(request: Req<'proposal.get_draft'>, options?: CallOptions): Promise<Res<'proposal.get_draft'>>;
     /** List proposals (`GET /v1/repos/{owner}/{rname}/proposals`, operation `proposal.list`) */
     list(request: Req<'proposal.list'>, options?: CallOptions): Promise<Res<'proposal.list'>>;
     /** Review the current head (`POST /v1/repos/{owner}/{rname}/proposals/{id}/reviews`, operation `proposal.review`) */
     review(request: Req<'proposal.review'>, options?: CallOptions): Promise<Res<'proposal.review'>>;
+    /** Save your private review draft (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.save_draft`) */
+    saveDraft(request: Req<'proposal.save_draft'>, options?: CallOptions): Promise<Res<'proposal.save_draft'>>;
     /** Replace the inspected set of requested reviewers (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/reviewers`, operation `proposal.set_reviewers`) */
     setReviewers(request: Req<'proposal.set_reviewers'>, options?: CallOptions): Promise<Res<'proposal.set_reviewers'>>;
     /** List thread replies (`GET /v1/repos/{owner}/{rname}/proposals/{id}/threads/{thread_id}/comments`, operation `proposal.thread_comments`) */
diff --git a/sdk/typescript/src/generated/models.ts b/sdk/typescript/src/generated/models.ts
index 343aca11..ff68772c 100644
--- a/sdk/typescript/src/generated/models.ts
+++ b/sdk/typescript/src/generated/models.ts
@@ -26,6 +26,7 @@ export type Blocker = S['Blocker'];
 export type Changeset = S['Changeset'];
 export type ClaimJobRequest = S['ClaimJobRequest'];
 export type ClaimJobResponse = S['ClaimJobResponse'];
+export type ClearReviewDraftRequest = S['ClearReviewDraftRequest'];
 export type CloseProposalRequest = S['CloseProposalRequest'];
 export type CommentProposalRequest = S['CommentProposalRequest'];
 export type CompareAndSwapRequest = S['CompareAndSwapRequest'];
@@ -70,6 +71,7 @@ export type GetOperationRequest = S['GetOperationRequest'];
 export type GetPolicyRequest = S['GetPolicyRequest'];
 export type GetProposalRequest = S['GetProposalRequest'];
 export type GetRepoRequest = S['GetRepoRequest'];
+export type GetReviewDraftRequest = S['GetReviewDraftRequest'];
 export type GetRunOutputRequest = S['GetRunOutputRequest'];
 export type GetRunRequest = S['GetRunRequest'];
 export type GetTaskRequest = S['GetTaskRequest'];
@@ -187,6 +189,7 @@ export type ResolveRevRequest = S['ResolveRevRequest'];
 export type ResolveRevResponse = S['ResolveRevResponse'];
 export type ResolveReviewThreadRequest = S['ResolveReviewThreadRequest'];
 export type Review = S['Review'];
+export type ReviewDraft = S['ReviewDraft'];
 export type ReviewLineAnchor = S['ReviewLineAnchor'];
 export type ReviewProposalRequest = S['ReviewProposalRequest'];
 export type ReviewThread = S['ReviewThread'];
@@ -199,6 +202,7 @@ export type RunOutput = S['RunOutput'];
 export type RunQueueRequest = S['RunQueueRequest'];
 export type RunQueueResponse = S['RunQueueResponse'];
 export type RunSpec = S['RunSpec'];
+export type SaveReviewDraftRequest = S['SaveReviewDraftRequest'];
 export type SaveRunOutputRequest = S['SaveRunOutputRequest'];
 export type SearchMatch = S['SearchMatch'];
 export type SearchTreeRequest = S['SearchTreeRequest'];
diff --git a/sdk/typescript/src/generated/operations.ts b/sdk/typescript/src/generated/operations.ts
index 12e1de6b..15bbe605 100644
--- a/sdk/typescript/src/generated/operations.ts
+++ b/sdk/typescript/src/generated/operations.ts
@@ -1040,6 +1040,21 @@ export const OPERATIONS = {
     idempotencyKey: false,
     public: false,
   },
+  'proposal.clear_draft': {
+    id: 'proposal.clear_draft',
+    http: 'DELETE',
+    route: '/v1/repos/{owner}/{rname}/proposals/{id}/review-draft',
+    namespace: 'proposals',
+    name: 'clearDraft',
+    summary: 'Clear the inspected private review draft',
+    pathParams: ['owner', 'rname', 'id'],
+    queryParams: ['expected_version'],
+    body: 'none',
+    response: 'json',
+    retry: 'natural',
+    idempotencyKey: false,
+    public: false,
+  },
   'proposal.close': {
     id: 'proposal.close',
     http: 'POST',
@@ -1100,6 +1115,21 @@ export const OPERATIONS = {
     idempotencyKey: false,
     public: false,
   },
+  'proposal.get_draft': {
+    id: 'proposal.get_draft',
+    http: 'GET',
+    route: '/v1/repos/{owner}/{rname}/proposals/{id}/review-draft',
+    namespace: 'proposals',
+    name: 'getDraft',
+    summary: 'Read your private review draft',
+    pathParams: ['owner', 'rname', 'id'],
+    queryParams: [],
+    body: 'none',
+    response: 'json',
+    retry: 'read',
+    idempotencyKey: false,
+    public: false,
+  },
   'proposal.list': {
     id: 'proposal.list',
     http: 'GET',
@@ -1130,6 +1160,21 @@ export const OPERATIONS = {
     idempotencyKey: true,
     public: false,
   },
+  'proposal.save_draft': {
+    id: 'proposal.save_draft',
+    http: 'PUT',
+    route: '/v1/repos/{owner}/{rname}/proposals/{id}/review-draft',
+    namespace: 'proposals',
+    name: 'saveDraft',
+    summary: 'Save your private review draft',
+    pathParams: ['owner', 'rname', 'id'],
+    queryParams: [],
+    body: 'json',
+    response: 'json',
+    retry: 'natural',
+    idempotencyKey: false,
+    public: false,
+  },
   'proposal.set_reviewers': {
     id: 'proposal.set_reviewers',
     http: 'PUT',
diff --git a/sdk/typescript/src/generated/schema.ts b/sdk/typescript/src/generated/schema.ts
index af2b984c..0d7f0b90 100644
--- a/sdk/typescript/src/generated/schema.ts
+++ b/sdk/typescript/src/generated/schema.ts
@@ -899,6 +899,25 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/repos/{owner}/{rname}/proposals/{id}/review-draft": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Read your private review draft */
+        get: operations["proposal.get_draft"];
+        /** Save your private review draft */
+        put: operations["proposal.save_draft"];
+        post?: never;
+        /** Clear the inspected private review draft */
+        delete: operations["proposal.clear_draft"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/repos/{owner}/{rname}/proposals/{id}/reviewers": {
         parameters: {
             query?: never;
@@ -1981,6 +2000,17 @@ export interface components {
             /** @default null */
             job: components["schemas"]["Job"] | null;
         };
+        ClearReviewDraftRequest: {
+            /**
+             * Format: int64
+             * @default 0
+             */
+            expected_version: number;
+            /** @default  */
+            id: string;
+            /** @default  */
+            repo: string;
+        };
         CloseProposalRequest: {
             /** @default  */
             id: string;
@@ -2773,6 +2803,12 @@ export interface components {
             /** @default  */
             repo: string;
         };
+        GetReviewDraftRequest: {
+            /** @default  */
+            id: string;
+            /** @default  */
+            repo: string;
+        };
         GetRunOutputRequest: {
             /** @default  */
             repo: string;
@@ -4365,6 +4401,27 @@ export interface components {
              */
             timestamp_ms: number;
         };
+        /** @description Private, unsubmitted review notes for the current acting identity only. */
+        ReviewDraft: {
+            /** @default  */
+            body: string;
+            /** @default  */
+            decision: string;
+            /** @default  */
+            head: string;
+            /** @default false */
+            present: boolean;
+            /**
+             * Format: int64
+             * @default 0
+             */
+            updated_at_ms: number;
+            /**
+             * Format: int64
+             * @default 0
+             */
+            version: number;
+        };
         /** @description A line location is immutable; text is filled from the repository by the server. */
         ReviewLineAnchor: {
             /** @default  */
@@ -4604,6 +4661,24 @@ export interface components {
              */
             timeout_secs: number;
         };
+        SaveReviewDraftRequest: {
+            /** @default  */
+            body: string;
+            /** @default  */
+            decision: string;
+            /**
+             * Format: int64
+             * @description Zero means no prior draft; all saves compare this version atomically.
+             * @default 0
+             */
+            expected_version: number;
+            /** @default  */
+            head: string;
+            /** @default  */
+            id: string;
+            /** @default  */
+            repo: string;
+        };
         SaveRunOutputRequest: {
             /** @default null */
             output: components["schemas"]["RunOutput"] | null;
@@ -7551,6 +7626,117 @@ export interface operations {
             };
         };
     };
+    "proposal.get_draft": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ReviewDraft"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "proposal.save_draft": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SaveReviewDraftRequest"];
+            };
+        };
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ReviewDraft"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "proposal.clear_draft": {
+        parameters: {
+            query?: {
+                expected_version?: number;
+            };
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ReviewDraft"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
     "proposal.set_reviewers": {
         parameters: {
             query?: never;
diff --git a/sdk/typescript/test/all-operations.test.ts b/sdk/typescript/test/all-operations.test.ts
index 9121fa26..5c171127 100644
--- a/sdk/typescript/test/all-operations.test.ts
+++ b/sdk/typescript/test/all-operations.test.ts
@@ -150,6 +150,32 @@ describe('the tour', () => {
     const requested = [];
     for await (const proposal of reviewsRequestedFrom(bob, repo, 'user:bob')) requested.push(proposal.id);
     expect(requested).toEqual([p1.id]);
+    expect((await bob.proposals.getDraft({ repo, id: p1.id })).present).toBe(false);
+    const privateDraft = await bob.proposals.saveDraft({
+      repo,
+      id: p1.id,
+      expected_version: 0,
+      head: m2.head,
+      decision: 'comment',
+      body: 'Private draft',
+    });
+    expect(privateDraft.version).toBe(1);
+    expect((await admin.proposals.getDraft({ repo, id: p1.id })).present).toBe(false);
+    expect((await bob.proposals.get({ repo, id: p1.id })).reviews).toHaveLength(0);
+    await expect(
+      bob.proposals.saveDraft({
+        repo,
+        id: p1.id,
+        expected_version: 0,
+        head: m2.head,
+        decision: 'comment',
+        body: 'Stale overwrite',
+      }),
+    ).rejects.toMatchObject({ status: 412 });
+    const clearedDraft = await bob.proposals.clearDraft({ repo, id: p1.id, expected_version: privateDraft.version });
+    expect(clearedDraft.present).toBe(false);
+    expect(clearedDraft.version).toBe(2);
+    expect((await bob.proposals.getDraft({ repo, id: p1.id })).body).toBe('');
     await bob.proposals.review({ repo, id: p1.id, decision: 'approve' });
     expect(
       (
diff --git a/sdk/typescript/test/review-drafts.test.ts b/sdk/typescript/test/review-drafts.test.ts
new file mode 100644
index 00000000..e2fa823b
--- /dev/null
+++ b/sdk/typescript/test/review-drafts.test.ts
@@ -0,0 +1,92 @@
+import { expect, it } from 'vitest';
+import { AgentGitClient } from '../src/index.js';
+
+const draft = {
+  present: true,
+  version: 1,
+  head: 'reviewed',
+  decision: 'comment',
+  body: 'Private notes',
+  updated_at_ms: 1,
+};
+
+it('sends private draft reads and guarded save/clear requests without an owner parameter', async () => {
+  const calls: { url: string; method: string; body: unknown }[] = [];
+  const client = new AgentGitClient({
+    baseUrl: 'http://draft.test',
+    token: 'reviewer',
+    fetch: async (input, init) => {
+      calls.push({
+        url: typeof input === 'string' ? input : input instanceof URL ? input.href : input.url,
+        method: init?.method ?? 'GET',
+        body: typeof init?.body === 'string' ? JSON.parse(init.body) : undefined,
+      });
+      return Response.json(draft);
+    },
+  });
+  await client.proposals.getDraft({ repo: 'team/app', id: 'proposal' });
+  await client.proposals.saveDraft({
+    repo: 'team/app',
+    id: 'proposal',
+    expected_version: 0,
+    head: 'reviewed',
+    decision: 'comment',
+    body: 'Private notes',
+  });
+  await client.proposals.clearDraft({ repo: 'team/app', id: 'proposal', expected_version: 1 });
+  expect(calls.map((call) => call.method)).toEqual(['GET', 'PUT', 'DELETE']);
+  expect(
+    calls.every((call) => new URL(call.url).pathname.endsWith('/v1/repos/team/app/proposals/proposal/review-draft')),
+  ).toBe(true);
+  expect(calls[1]!.body).toEqual({ expected_version: 0, head: 'reviewed', decision: 'comment', body: 'Private notes' });
+  expect(calls[2]!.body).toBeUndefined();
+  expect(new URL(calls[2]!.url).searchParams.get('expected_version')).toBe('1');
+});
+
+it('retries a lost private-draft save response with the same inspected version and content', async () => {
+  const sent: string[] = [];
+  const client = new AgentGitClient({
+    baseUrl: 'http://draft.test',
+    token: 'reviewer',
+    sleep: async () => {},
+    fetch: async (_input, init) => {
+      if (typeof init?.body !== 'string') throw new Error('Expected JSON');
+      sent.push(init.body);
+      if (sent.length === 1) throw new TypeError('response lost after save');
+      return Response.json(draft);
+    },
+  });
+  await expect(
+    client.proposals.saveDraft({
+      repo: 'team/app',
+      id: 'proposal',
+      expected_version: 0,
+      head: 'reviewed',
+      decision: 'comment',
+      body: 'Private notes',
+    }),
+  ).resolves.toEqual(draft);
+  expect(sent).toHaveLength(2);
+  expect(sent[0]).toBe(sent[1]);
+});
+
+it('retries clear using the same query guard, including version zero', async () => {
+  const urls: string[] = [];
+  const client = new AgentGitClient({
+    baseUrl: 'http://draft.test',
+    token: 'reviewer',
+    sleep: async () => {},
+    fetch: async (input, init) => {
+      urls.push(typeof input === 'string' ? input : input instanceof URL ? input.href : input.url);
+      expect(init?.body).toBeUndefined();
+      if (urls.length === 1) throw new TypeError('response lost after clear');
+      return Response.json({ ...draft, present: false, body: '', head: '', decision: '', version: 2 });
+    },
+  });
+  await expect(
+    client.proposals.clearDraft({ repo: 'team/app', id: 'proposal', expected_version: 0 }),
+  ).resolves.toMatchObject({ present: false, version: 2 });
+  expect(urls).toHaveLength(2);
+  expect(urls[0]).toBe(urls[1]);
+  expect(new URL(urls[0]!).searchParams.get('expected_version')).toBe('0');
+});

From 2eba2d8c284dcbf80d3e7ac1afdee6a911f36e18 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 21:26:46 +0000
Subject: [PATCH 09/41] feat(web): restore explicitly saved account review
 drafts

Preserve tab-local notes while supporting cross-device account drafts. Require a choice for differing notes and guard post-review cleanup against newer edits.

Validated: 830 unit tests, typecheck, lint, build, four browser cases and 77 killed controller mutations.
---
 apps/web/e2e/account-review-draft.spec.ts     | 130 +++++++++
 apps/web/playwright.config.ts                 |   2 +-
 apps/web/src/api/endpoints.spec.ts            |  36 +++
 apps/web/src/api/endpoints.ts                 |  29 ++
 apps/web/src/api/schema.gen.ts                | 186 +++++++++++++
 apps/web/src/api/types.ts                     |   1 +
 .../components/proposal/ReviewDialog.spec.ts  | 177 +++++++++++-
 .../src/components/proposal/ReviewDialog.vue  | 105 +++++++-
 .../composables/useAccountReviewDraft.spec.ts | 191 +++++++++++++
 .../src/composables/useAccountReviewDraft.ts  | 253 ++++++++++++++++++
 10 files changed, 1100 insertions(+), 10 deletions(-)
 create mode 100644 apps/web/e2e/account-review-draft.spec.ts
 create mode 100644 apps/web/src/composables/useAccountReviewDraft.spec.ts
 create mode 100644 apps/web/src/composables/useAccountReviewDraft.ts

diff --git a/apps/web/e2e/account-review-draft.spec.ts b/apps/web/e2e/account-review-draft.spec.ts
new file mode 100644
index 00000000..50c38fc9
--- /dev/null
+++ b/apps/web/e2e/account-review-draft.spec.ts
@@ -0,0 +1,130 @@
+import { test, expect } from './fixtures.ts'
+import { amend, commitFiles, freshRepo, openProposal } from './support/world.ts'
+
+test('private account drafts cross devices without overwriting concurrent work or submitting stale reviews', async ({
+  cast,
+  openAs,
+  allowConsole,
+}, info) => {
+  const { repo } = await freshRepo(cast, 'account-draft')
+  const author = cast.as('alice')
+  const original = await commitFiles(
+    author,
+    repo,
+    { 'code.txt': 'first version\n' },
+    'Review source',
+  )
+  const proposal = await openProposal(author, repo, {
+    head: original.head,
+    title: 'Review from another device',
+  })
+  const path = `/v1/repos/${repo}/proposals/${proposal.id}/review-draft`
+  const url = `/repos/${repo}/proposals/${proposal.id}`
+  await cast
+    .as('admin')
+    .ok_(
+      cast.as('admin').post('/v1/roles', { subject: 'user:carol', repo, role: 'reviewer' }),
+      'grant isolated reviewer',
+    )
+
+  const first = await openAs('bob')
+  await first.goto(url)
+  await first.getByTestId('act-review').click()
+  const firstDialog = first.getByRole('dialog', { name: 'Write a review' })
+  await firstDialog
+    .getByRole('textbox', { name: 'Comment', exact: true })
+    .fill('Reasoning from my first device')
+  await firstDialog.getByRole('radio', { name: 'Request changes', exact: true }).check()
+  await firstDialog.getByRole('button', { name: 'Save draft and close' }).click()
+  await expect(firstDialog).not.toBeVisible()
+  const stored = await cast.as('bob').ok_(cast.as('bob').get(path), 'read own draft')
+  expect(stored.present).toBe(true)
+  expect(stored.body).toBe('Reasoning from my first device')
+  expect(
+    (
+      await author.ok_(
+        author.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+        'no published review',
+      )
+    ).reviews,
+  ).toEqual([])
+  const other = await cast
+    .as('carol')
+    .ok_(cast.as('carol').get(path), 'other reviewer has separate draft')
+  expect(other.present).toBe(false)
+  expect(other.body).toBe('')
+
+  const second = await openAs('bob')
+  await second.goto(url)
+  await second.getByTestId('act-review').click()
+  const secondDialog = second.getByRole('dialog', { name: 'Write a review' })
+  await expect(secondDialog.getByRole('textbox', { name: 'Comment', exact: true })).toHaveValue(
+    stored.body,
+  )
+  await expect(
+    secondDialog.getByRole('radio', { name: 'Request changes', exact: true }),
+  ).toBeChecked()
+  await first.getByTestId('act-review').click()
+  await firstDialog
+    .getByRole('textbox', { name: 'Comment', exact: true })
+    .fill('Newer reasoning from first device')
+  await firstDialog.getByRole('button', { name: 'Save draft and close' }).click()
+  await expect(firstDialog).not.toBeVisible()
+  await secondDialog
+    .getByRole('textbox', { name: 'Comment', exact: true })
+    .fill('Keep this second-device draft')
+  allowConsole(/status of 412.*\/review-draft(?:\?|\])/)
+  await secondDialog.getByRole('button', { name: 'Save draft and close' }).click()
+  await expect(secondDialog.getByText('Account draft storage', { exact: true })).toBeVisible()
+  await expect(secondDialog.getByRole('textbox', { name: 'Comment', exact: true })).toHaveValue(
+    'Keep this second-device draft',
+  )
+  await secondDialog.getByRole('button', { name: 'Reload account draft' }).click()
+  await expect(secondDialog.getByText('Two drafts', { exact: true })).toBeVisible()
+  await secondDialog.getByRole('button', { name: 'Keep this tab draft' }).click()
+  await secondDialog.getByRole('button', { name: 'Save draft and close' }).click()
+  await expect(secondDialog).not.toBeVisible()
+
+  const third = await openAs('bob')
+  await third.goto(url)
+  await third.getByTestId('act-review').click()
+  const thirdDialog = third.getByRole('dialog', { name: 'Write a review' })
+  await expect(thirdDialog.getByRole('textbox', { name: 'Comment', exact: true })).toHaveValue(
+    'Keep this second-device draft',
+  )
+  const changed = await amend(
+    author,
+    repo,
+    original.workspace,
+    { 'code.txt': 'new version\n' },
+    'Changed after the draft',
+  )
+  await author.ok_(
+    author.call('PATCH', `/v1/repos/${repo}/proposals/${proposal.id}`, {
+      new_head: changed.head,
+      expected_head: original.head,
+    }),
+    'advance proposal',
+  )
+  await expect(thirdDialog.getByText('The proposal changed', { exact: true })).toBeVisible()
+  await expect(
+    thirdDialog.getByRole('button', { name: 'Submit review', exact: true }),
+  ).toBeDisabled()
+  await third.screenshot({ path: info.outputPath('account-review-draft.png'), fullPage: true })
+  await thirdDialog.getByRole('button', { name: 'I reviewed the updated changes' }).click()
+  await thirdDialog.getByRole('button', { name: 'Submit review', exact: true }).click()
+  await expect(thirdDialog).not.toBeVisible()
+  const reviewed = await author.ok_(
+    author.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'read published review',
+  )
+  expect(reviewed.reviews).toHaveLength(1)
+  expect(reviewed.reviews[0].head).toBe(changed.head)
+  expect(reviewed.reviews[0].body).toBe('Keep this second-device draft')
+  const cleared = await cast.as('bob').ok_(cast.as('bob').get(path), 'submitted draft cleared')
+  expect(cleared.present).toBe(false)
+  expect(cleared.version).toBeGreaterThan(stored.version)
+  await first.close()
+  await second.close()
+  await third.close()
+})
diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts
index 4d7676fd..57a8d711 100644
--- a/apps/web/playwright.config.ts
+++ b/apps/web/playwright.config.ts
@@ -26,7 +26,7 @@ const screenshots = /screenshots\.spec\.ts/
 // Layout assertions are made at the viewports of the tablet and phone projects, not at desktop size.
 const layout = /responsive\.spec\.ts/
 const small =
-  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|nontext-conflicts|review-requests|required-discussions|draft-recovery|review-drafts|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
+  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|nontext-conflicts|review-requests|required-discussions|draft-recovery|review-drafts|account-review-draft|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
 const desktop = { viewport: { width: 1440, height: 900 } }
 
 export default defineConfig({
diff --git a/apps/web/src/api/endpoints.spec.ts b/apps/web/src/api/endpoints.spec.ts
index 5a337b15..b99fcca7 100644
--- a/apps/web/src/api/endpoints.spec.ts
+++ b/apps/web/src/api/endpoints.spec.ts
@@ -183,3 +183,39 @@ it('pins virtual sync to the inspected branch while retaining the initiating ses
   expect(JSON.parse(String(options?.body))).toEqual({ expected_stream_head: 'inspected' })
   expect(new Headers(options?.headers).get('authorization')).toBe('Bearer original-session')
 })
+
+it('keeps private draft content in the save body and captures the initiating session', async () => {
+  const request = vi
+    .fn<typeof fetch>()
+    .mockResolvedValue(new Response('{}', { headers: { 'content-type': 'application/json' } }))
+  const client = new ApiClient({ getToken: () => 'new-session', fetch: request })
+  await createApi(client).proposals.saveReviewDraft(
+    'acme/repo',
+    'p/one',
+    { head: 'seen', decision: 'comment', body: 'private', expected_version: 0 },
+    { token: 'original', quietUnauthenticated: true },
+  )
+  const [url, options] = request.mock.calls[0]!
+  expect(String(url)).toContain('/proposals/p%2Fone/review-draft')
+  expect(String(url)).not.toContain('private')
+  expect(options?.method).toBe('PUT')
+  expect(new Headers(options?.headers).get('authorization')).toBe('Bearer original')
+  expect(JSON.parse(String(options?.body))).toEqual({
+    head: 'seen',
+    decision: 'comment',
+    body: 'private',
+    expected_version: 0,
+  })
+})
+
+it('sends the clear-draft version in a DELETE query, including zero', async () => {
+  const request = vi
+    .fn<typeof fetch>()
+    .mockResolvedValue(new Response('{}', { headers: { 'content-type': 'application/json' } }))
+  const client = new ApiClient({ getToken: () => 'session', fetch: request })
+  await createApi(client).proposals.clearReviewDraft('acme/repo', 'p/one', 0)
+  const [url, options] = request.mock.calls[0]!
+  expect(String(url)).toContain('/proposals/p%2Fone/review-draft?expected_version=0')
+  expect(options?.method).toBe('DELETE')
+  expect(options?.body).toBeUndefined()
+})
diff --git a/apps/web/src/api/endpoints.ts b/apps/web/src/api/endpoints.ts
index 46142e07..0b4ba535 100644
--- a/apps/web/src/api/endpoints.ts
+++ b/apps/web/src/api/endpoints.ts
@@ -33,6 +33,7 @@ import type {
   Repo,
   Req,
   Review,
+  ReviewDraft,
   ReviewThread,
   ThreadComment,
   RoleBinding,
@@ -268,6 +269,34 @@ export function createApi(c: ApiClient) {
       },
       get: (repo: string, id: string, o?: Opts) =>
         c.get<ProposalDetail>(r(repo, `/proposals/${encodeURIComponent(id)}`), undefined, o),
+      reviewDraft: (repo: string, id: string, options?: SessionOpts) =>
+        c.get<ReviewDraft>(
+          r(repo, `/proposals/${encodeURIComponent(id)}/review-draft`),
+          undefined,
+          options,
+        ),
+      saveReviewDraft: (
+        repo: string,
+        id: string,
+        body: { head: string; decision: string; body: string; expected_version: number },
+        options?: SessionOpts,
+      ) =>
+        c.json<ReviewDraft>(r(repo, `/proposals/${encodeURIComponent(id)}/review-draft`), {
+          ...options,
+          method: 'PUT',
+          body,
+        }),
+      clearReviewDraft: (
+        repo: string,
+        id: string,
+        expectedVersion: number,
+        options?: SessionOpts,
+      ) =>
+        c.del<ReviewDraft>(
+          r(repo, `/proposals/${encodeURIComponent(id)}/review-draft`),
+          { expected_version: expectedVersion },
+          options,
+        ),
       setReviewers: (
         repo: string,
         id: string,
diff --git a/apps/web/src/api/schema.gen.ts b/apps/web/src/api/schema.gen.ts
index f1941b45..1bc94ff7 100644
--- a/apps/web/src/api/schema.gen.ts
+++ b/apps/web/src/api/schema.gen.ts
@@ -902,6 +902,25 @@ export interface paths {
     patch?: never
     trace?: never
   }
+  '/v1/repos/{owner}/{rname}/proposals/{id}/review-draft': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /** Read your private review draft */
+    get: operations['proposal.get_draft']
+    /** Save your private review draft */
+    put: operations['proposal.save_draft']
+    post?: never
+    /** Clear the inspected private review draft */
+    delete: operations['proposal.clear_draft']
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
   '/v1/repos/{owner}/{rname}/proposals/{id}/reviewers': {
     parameters: {
       query?: never
@@ -1976,6 +1995,17 @@ export interface components {
       /** @default null */
       job: components['schemas']['Job'] | null
     }
+    ClearReviewDraftRequest: {
+      /**
+       * Format: int64
+       * @default 0
+       */
+      expected_version: number
+      /** @default  */
+      id: string
+      /** @default  */
+      repo: string
+    }
     CloseProposalRequest: {
       /** @default  */
       id: string
@@ -2758,6 +2788,12 @@ export interface components {
       /** @default  */
       repo: string
     }
+    GetReviewDraftRequest: {
+      /** @default  */
+      id: string
+      /** @default  */
+      repo: string
+    }
     GetRunOutputRequest: {
       /** @default  */
       repo: string
@@ -4347,6 +4383,27 @@ export interface components {
        */
       timestamp_ms: number
     }
+    /** @description Private, unsubmitted review notes for the current acting identity only. */
+    ReviewDraft: {
+      /** @default  */
+      body: string
+      /** @default  */
+      decision: string
+      /** @default  */
+      head: string
+      /** @default false */
+      present: boolean
+      /**
+       * Format: int64
+       * @default 0
+       */
+      updated_at_ms: number
+      /**
+       * Format: int64
+       * @default 0
+       */
+      version: number
+    }
     /** @description A line location is immutable; text is filled from the repository by the server. */
     ReviewLineAnchor: {
       /** @default  */
@@ -4586,6 +4643,24 @@ export interface components {
        */
       timeout_secs: number
     }
+    SaveReviewDraftRequest: {
+      /** @default  */
+      body: string
+      /** @default  */
+      decision: string
+      /**
+       * Format: int64
+       * @description Zero means no prior draft; all saves compare this version atomically.
+       * @default 0
+       */
+      expected_version: number
+      /** @default  */
+      head: string
+      /** @default  */
+      id: string
+      /** @default  */
+      repo: string
+    }
     SaveRunOutputRequest: {
       /** @default null */
       output: components['schemas']['RunOutput'] | null
@@ -7534,6 +7609,117 @@ export interface operations {
       }
     }
   }
+  'proposal.get_draft': {
+    parameters: {
+      query?: never
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+        id: string
+      }
+      cookie?: never
+    }
+    requestBody?: never
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ReviewDraft']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
+  'proposal.save_draft': {
+    parameters: {
+      query?: never
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+        id: string
+      }
+      cookie?: never
+    }
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SaveReviewDraftRequest']
+      }
+    }
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ReviewDraft']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
+  'proposal.clear_draft': {
+    parameters: {
+      query?: {
+        expected_version?: number
+      }
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+        id: string
+      }
+      cookie?: never
+    }
+    requestBody?: never
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ReviewDraft']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
   'proposal.set_reviewers': {
     parameters: {
       query?: never
diff --git a/apps/web/src/api/types.ts b/apps/web/src/api/types.ts
index aa90cf2d..c8f24682 100644
--- a/apps/web/src/api/types.ts
+++ b/apps/web/src/api/types.ts
@@ -27,6 +27,7 @@ export type SearchTreeResponse = S['SearchTreeResponse']
 export type SearchMatch = S['SearchMatch']
 export type Proposal = S['Proposal']
 export type Review = S['Review']
+export type ReviewDraft = S['ReviewDraft']
 export type ReviewThread = S['ReviewThread']
 export type ThreadComment = S['ThreadComment']
 export type ReviewLineAnchor = S['ReviewLineAnchor']
diff --git a/apps/web/src/components/proposal/ReviewDialog.spec.ts b/apps/web/src/components/proposal/ReviewDialog.spec.ts
index 0c2bc0a7..c4179cb9 100644
--- a/apps/web/src/components/proposal/ReviewDialog.spec.ts
+++ b/apps/web/src/components/proposal/ReviewDialog.spec.ts
@@ -7,11 +7,24 @@ import type { Proposal } from '@/api/types'
 import ReviewDialog from './ReviewDialog.vue'
 import { useToasts } from '@/stores/toasts'
 
-const auth = reactive({ identity: 'user:reviewer', token: 'review-token', status: 'ready' })
+const auth = reactive({
+  identity: 'user:reviewer',
+  token: 'review-token',
+  status: 'ready',
+  capabilities: { features: [] as string[] },
+})
 vi.mock('@/stores/auth', () => ({ useAuth: () => auth }))
 
-const { review, capabilities } = vi.hoisted(() => ({ review: vi.fn(), capabilities: vi.fn() }))
-vi.mock('@/api/instance', () => ({ api: { capabilities, proposals: { review } } }))
+const { review, capabilities, reviewDraft, saveReviewDraft, clearReviewDraft } = vi.hoisted(() => ({
+  review: vi.fn(),
+  capabilities: vi.fn(),
+  reviewDraft: vi.fn(),
+  saveReviewDraft: vi.fn(),
+  clearReviewDraft: vi.fn(),
+}))
+vi.mock('@/api/instance', () => ({
+  api: { capabilities, proposals: { review, reviewDraft, saveReviewDraft, clearReviewDraft } },
+}))
 
 const proposal: Proposal = {
   id: 'proposal-one',
@@ -40,6 +53,31 @@ function show() {
 beforeEach(() => {
   sessionStorage.clear()
   Object.assign(auth, { identity: 'user:reviewer', token: 'review-token', status: 'ready' })
+  auth.capabilities.features = []
+  reviewDraft.mockReset().mockResolvedValue({
+    present: false,
+    version: 0,
+    head: '',
+    decision: '',
+    body: '',
+    updated_at_ms: 0,
+  })
+  saveReviewDraft.mockReset().mockResolvedValue({
+    present: true,
+    version: 1,
+    head: 'head-one',
+    decision: 'comment',
+    body: 'Shared draft',
+    updated_at_ms: 1,
+  })
+  clearReviewDraft.mockReset().mockResolvedValue({
+    present: false,
+    version: 2,
+    head: '',
+    decision: '',
+    body: '',
+    updated_at_ms: 2,
+  })
   review.mockReset()
   capabilities.mockReset().mockResolvedValue({ features: ['proposals.review_head'] })
 })
@@ -528,3 +566,136 @@ it('keeps a rejected review and requests sign-in before sending it again', async
   expect(review).toHaveBeenCalledTimes(1)
   w.unmount()
 })
+
+describe('account review drafts', () => {
+  it('saves to the account and closes without submitting a review', async () => {
+    auth.capabilities.features = ['proposals.review_drafts']
+    reviewDraft.mockResolvedValue({
+      present: false,
+      version: 3,
+      head: '',
+      decision: '',
+      body: '',
+      updated_at_ms: 1,
+    })
+    const w = show()
+    await flushPromises()
+    await w.get('textarea').setValue('Shared draft')
+    await w.get('input[value="comment"]').setValue()
+    await w
+      .findAll('button')
+      .find((button) => button.text() === 'Save draft and close')!
+      .trigger('click')
+    await flushPromises()
+    expect(saveReviewDraft).toHaveBeenCalledWith(
+      'acme/demo',
+      'proposal-one',
+      { head: 'head-one', decision: 'comment', body: 'Shared draft', expected_version: 3 },
+      expect.objectContaining({ token: 'review-token' }),
+    )
+    expect(review).not.toHaveBeenCalled()
+    expect(w.emitted('update:modelValue')).toEqual([[false]])
+    w.unmount()
+  })
+
+  it('restores a draft from another device while preserving its inspected head', async () => {
+    auth.capabilities.features = ['proposals.review_drafts']
+    reviewDraft.mockResolvedValue({
+      present: true,
+      version: 3,
+      head: 'old-head',
+      decision: 'request_changes',
+      body: 'Remote reasoning',
+      updated_at_ms: 1,
+    })
+    const w = show()
+    await flushPromises()
+    expect(w.get('textarea').element.value).toBe('Remote reasoning')
+    expect(w.text()).toContain('The proposal changed')
+    expect(w.get('button[type="submit"]').attributes('aria-disabled')).toBe('true')
+    expect(review).not.toHaveBeenCalled()
+    w.unmount()
+  })
+
+  it('retains a local draft until an account conflict is explicitly resolved', async () => {
+    let w = show()
+    await w.get('textarea').setValue('Local reasoning')
+    w.unmount()
+    auth.capabilities.features = ['proposals.review_drafts']
+    reviewDraft.mockResolvedValue({
+      present: true,
+      version: 4,
+      head: 'head-one',
+      decision: 'comment',
+      body: 'Other device reasoning',
+      updated_at_ms: 1,
+    })
+    w = show()
+    await flushPromises()
+    expect(w.get('textarea').element.value).toBe('Local reasoning')
+    expect(w.text()).toContain('Two drafts')
+    expect(w.get('.account-preview').text()).toContain('Comment · head head-one')
+    expect(
+      w
+        .findAll('button')
+        .find((button) => button.text() === 'Save draft and close')!
+        .attributes('aria-disabled'),
+    ).toBe('true')
+    await w
+      .findAll('button')
+      .find((button) => button.text() === 'Use account draft')!
+      .trigger('click')
+    expect(w.get('textarea').element.value).toBe('Other device reasoning')
+    w.unmount()
+  })
+
+  it('keeps a draft visible when an inspected account version is refused', async () => {
+    auth.capabilities.features = ['proposals.review_drafts']
+    saveReviewDraft.mockRejectedValue(
+      new ApiError({ status: 412, code: 'failed_precondition', message: 'Review draft changed' }),
+    )
+    const w = show()
+    await flushPromises()
+    await w.get('textarea').setValue('Do not lose this text')
+    await w
+      .findAll('button')
+      .find((button) => button.text() === 'Save draft and close')!
+      .trigger('click')
+    await flushPromises()
+    expect(w.get('textarea').element.value).toBe('Do not lose this text')
+    expect(w.text()).toContain('Review draft changed')
+    expect(w.emitted('update:modelValue')).toBeUndefined()
+    w.unmount()
+  })
+
+  it('reports a successful review even when a newer account draft prevents cleanup', async () => {
+    auth.capabilities.features = ['proposals.review_drafts']
+    reviewDraft.mockResolvedValue({
+      present: true,
+      version: 4,
+      head: 'head-one',
+      decision: 'comment',
+      body: 'Ready to submit',
+      updated_at_ms: 1,
+    })
+    review.mockResolvedValue({})
+    clearReviewDraft.mockRejectedValue(
+      new ApiError({ status: 412, code: 'failed_precondition', message: 'A newer draft is saved' }),
+    )
+    const w = show()
+    await flushPromises()
+    await w.get('form').trigger('submit')
+    await flushPromises()
+    expect(review).toHaveBeenCalledTimes(1)
+    expect(clearReviewDraft).toHaveBeenCalledWith(
+      'acme/demo',
+      'proposal-one',
+      4,
+      expect.objectContaining({ token: 'review-token' }),
+    )
+    expect(w.emitted('done')).toEqual([[]])
+    expect(useToasts().items.some((toast) => toast.title === 'Comment added')).toBe(true)
+    expect(w.get('textarea').element.value).toBe('')
+    w.unmount()
+  })
+})
diff --git a/apps/web/src/components/proposal/ReviewDialog.vue b/apps/web/src/components/proposal/ReviewDialog.vue
index d4d998a7..ee1b9286 100644
--- a/apps/web/src/components/proposal/ReviewDialog.vue
+++ b/apps/web/src/components/proposal/ReviewDialog.vue
@@ -4,6 +4,7 @@ import { api } from '@/api/instance'
 import { ApiError, describeError } from '@/api/errors'
 import type { Proposal } from '@/api/types'
 import { shortId } from '@/lib/format'
+import { useAccountReviewDraft } from '@/composables/useAccountReviewDraft'
 import { useAuth } from '@/stores/auth'
 import { useToasts } from '@/stores/toasts'
 import Alert from '@/ui/Alert.vue'
@@ -128,12 +129,40 @@ onBeforeUnmount(() => {
   controller?.abort()
 })
 
+const account = useAccountReviewDraft({
+  repo: () => props.repo,
+  proposal: () => props.proposal.id,
+  open: () => props.modelValue,
+  local: { head: reviewedHead, decision, body },
+})
+const locked = computed(() => busy.value || account.saving.value)
+watch(
+  busy,
+  (value) => {
+    if (value) account.cancelPending()
+  },
+  { flush: 'sync' },
+)
+async function saveToAccount() {
+  if (busy.value || !account.canSave.value) return
+  const mine = context
+  if ((await account.save()) && mine === context) {
+    toasts.info('Review draft saved to your account')
+    emit('update:modelValue', false)
+  }
+}
+
 const options = [
   { value: 'approve', label: 'Approve', icon: 'check' },
   { value: 'request_changes', label: 'Request changes', icon: 'alert' },
   { value: 'comment', label: 'Comment', icon: 'comment' },
 ] as const
 
+const accountDecision = computed(
+  () =>
+    options.find((option) => option.value === account.available.value?.decision)?.label || 'Review',
+)
+
 const decisionMessages: Record<Decision, string> = {
   approve: 'Approval recorded',
   request_changes: 'Changes requested',
@@ -159,13 +188,21 @@ function reviewError(value: unknown): ApiError {
 }
 
 async function submit() {
-  if (busy.value || headChanged.value || needsSignIn.value || auth.status !== 'ready') return
+  if (
+    busy.value ||
+    account.saving.value ||
+    headChanged.value ||
+    needsSignIn.value ||
+    auth.status !== 'ready'
+  )
+    return
   const mine = context
   const token = auth.token
   const current = new AbortController()
   controller = current
   const repository = props.repo
   const id = props.proposal.id
+  const cleanupVersion = account.cleanupVersion()
   const submitted = {
     decision: decision.value,
     expected_head: reviewedHead.value,
@@ -182,7 +219,10 @@ async function submit() {
       quietUnauthenticated: true,
     })
     if (mine !== context) return
+    const cleanupError = await account.clearAfterSubmit(cleanupVersion)
+    if (mine !== context) return
     toasts.ok(decisionMessages[submitted.decision])
+    if (cleanupError) toasts.warn('Account draft kept', cleanupError)
     restoring = true
     reset()
     restored.value = false
@@ -212,11 +252,11 @@ async function submit() {
     :model-value="modelValue"
     title="Write a review"
     :description="`Your decision is recorded against head ${shortId(proposal.head, 8)}. If the head changes, it stops counting.`"
-    :dismissable="!busy"
+    :dismissable="!locked"
     @update:model-value="emit('update:modelValue', $event)"
   >
     <form id="review-form" class="form" @submit.prevent="submit">
-      <fieldset :disabled="busy" class="fields">
+      <fieldset :disabled="locked" class="fields">
         <legend class="sr-only">Review details</legend>
         <Alert v-if="headChanged" tone="warn" live="alert" title="The proposal changed">
           Your comment is kept. Review the updated changes before submitting your decision.
@@ -228,13 +268,44 @@ async function submit() {
         <Alert v-if="storageError" tone="warn" title="Review draft storage">{{
           storageError
         }}</Alert>
+        <p v-if="account.loading.value" class="faint" role="status">Checking your account draft…</p>
+        <p v-if="account.restored.value" class="faint" role="status">
+          Your account review draft was restored.
+        </p>
+        <Alert v-if="account.available.value" tone="warn" title="Two drafts">
+          Your text in this tab is unchanged. Choose which draft to continue before saving to your
+          account.
+          <details class="account-preview">
+            <summary>Account draft</summary>
+            <p class="faint">
+              {{ accountDecision }} · head {{ shortId(account.available.value.head, 8) }}
+            </p>
+            <pre tabindex="0" role="region" aria-label="Saved account review comment">{{
+              account.available.value.body || '(no comment)'
+            }}</pre>
+          </details>
+          <div class="draft-actions">
+            <Button size="sm" @click="account.useAccount">Use account draft</Button>
+            <Button size="sm" @click="account.keepLocal">Keep this tab draft</Button>
+          </div>
+        </Alert>
+        <Alert v-if="account.error.value" tone="warn" title="Account draft storage">
+          {{ account.error.value }}
+          <Button size="sm" :disabled="account.loading.value || locked" @click="account.load"
+            >Reload account draft</Button
+          >
+        </Alert>
         <Segmented v-model="decision" legend="Decision" :options="options" />
         <TextArea
           v-model="body"
           label="Comment"
           :rows="5"
           placeholder="What did you check? Anything the author should know?"
-          hint="Plain text. Your unfinished review is saved for this account in this browser tab, including across page reloads."
+          :hint="
+            account.supported.value
+              ? 'Plain text. This tab keeps your edits; Save draft and close also saves them to your account for another device.'
+              : 'Plain text. Your unfinished review is saved for this account in this browser tab, including across page reloads.'
+          "
         />
       </fieldset>
       <Alert v-if="error" tone="bad" live="alert" title="The server did not accept the review">
@@ -244,7 +315,14 @@ async function submit() {
       </Alert>
     </form>
     <template #footer>
-      <Button :disabled="busy" @click="emit('update:modelValue', false)"
+      <Button
+        v-if="account.supported.value"
+        :disabled="busy || !account.canSave.value"
+        :loading="account.saving.value"
+        @click="saveToAccount"
+        >Save draft and close</Button
+      >
+      <Button v-else :disabled="busy" @click="emit('update:modelValue', false)"
         >Keep draft and close</Button
       >
       <Button
@@ -252,7 +330,7 @@ async function submit() {
         form="review-form"
         variant="primary"
         :loading="busy"
-        :disabled="headChanged || needsSignIn || auth.status !== 'ready'"
+        :disabled="account.saving.value || headChanged || needsSignIn || auth.status !== 'ready'"
         >Submit review</Button
       >
     </template>
@@ -272,4 +350,19 @@ async function submit() {
   padding: 0;
   min-width: 0;
 }
+.draft-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--s-2);
+  margin-top: var(--s-2);
+}
+.account-preview {
+  margin-top: var(--s-2);
+}
+.account-preview pre {
+  max-height: 12rem;
+  overflow: auto;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
 </style>
diff --git a/apps/web/src/composables/useAccountReviewDraft.spec.ts b/apps/web/src/composables/useAccountReviewDraft.spec.ts
new file mode 100644
index 00000000..9e556428
--- /dev/null
+++ b/apps/web/src/composables/useAccountReviewDraft.spec.ts
@@ -0,0 +1,191 @@
+import { effectScope, reactive, ref } from 'vue'
+import { flushPromises } from '@vue/test-utils'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { useAccountReviewDraft } from './useAccountReviewDraft'
+
+const api = vi.hoisted(() => ({
+  reviewDraft: vi.fn(),
+  saveReviewDraft: vi.fn(),
+  clearReviewDraft: vi.fn(),
+}))
+vi.mock('@/api/instance', () => ({ api: { proposals: api } }))
+const auth = reactive({
+  identity: 'user:alice',
+  token: 'first-token',
+  status: 'ready',
+  capabilities: { features: ['proposals.review_drafts'] },
+})
+vi.mock('@/stores/auth', () => ({ useAuth: () => auth }))
+const empty = { present: false, version: 0, head: '', decision: '', body: '', updated_at_ms: 0 }
+const saved = {
+  present: true,
+  version: 4,
+  head: 'head-one',
+  decision: 'request_changes',
+  body: 'Handle the timeout.',
+  updated_at_ms: 1,
+}
+const scopes: ReturnType<typeof effectScope>[] = []
+afterEach(() => {
+  scopes.splice(0).forEach((scope) => scope.stop())
+})
+beforeEach(() => {
+  auth.identity = 'user:alice'
+  auth.token = 'first-token'
+  auth.status = 'ready'
+  auth.capabilities.features = ['proposals.review_drafts']
+  api.reviewDraft.mockReset().mockResolvedValue(empty)
+  api.saveReviewDraft.mockReset().mockImplementation(async (_repo, _id, input) => ({
+    ...input,
+    present: true,
+    version: 5,
+    updated_at_ms: 2,
+  }))
+  api.clearReviewDraft.mockReset().mockResolvedValue({ ...empty, version: 5 })
+})
+function show(body = '', decision: 'approve' | 'request_changes' | 'comment' = 'approve') {
+  const local = { head: ref('head-one'), body: ref(body), decision: ref(decision) }
+  const open = ref(true)
+  const scope = effectScope()
+  scopes.push(scope)
+  const draft = scope.run(() =>
+    useAccountReviewDraft({
+      repo: () => 'acme/app',
+      proposal: () => 'proposal-one',
+      open: () => open.value,
+      local,
+    }),
+  )!
+  return { draft, local, open }
+}
+it('restores an account draft into an empty local review without submitting it', async () => {
+  api.reviewDraft.mockResolvedValue(saved)
+  const { draft, local } = show()
+  await flushPromises()
+  expect(local.body.value).toBe(saved.body)
+  expect(local.decision.value).toBe('request_changes')
+  expect(local.head.value).toBe('head-one')
+  expect(draft.version.value).toBe(4)
+  expect(api.saveReviewDraft).not.toHaveBeenCalled()
+})
+it('keeps a differing local review until the user selects the account draft', async () => {
+  api.reviewDraft.mockResolvedValue(saved)
+  const { draft, local } = show('Local reasoning', 'comment')
+  await flushPromises()
+  expect(local.body.value).toBe('Local reasoning')
+  expect(draft.available.value?.body).toBe(saved.body)
+  expect(draft.canSave.value).toBe(false)
+  draft.useAccount()
+  expect(local.body.value).toBe(saved.body)
+  expect(draft.canSave.value).toBe(true)
+})
+it('does not overwrite text typed while the account request is pending', async () => {
+  let finish!: (value: typeof saved) => void
+  api.reviewDraft.mockImplementation(
+    () =>
+      new Promise((resolve) => {
+        finish = resolve
+      }),
+  )
+  const { draft, local } = show()
+  local.body.value = 'Typed while loading'
+  finish(saved)
+  await flushPromises()
+  expect(local.body.value).toBe('Typed while loading')
+  expect(draft.available.value?.body).toBe(saved.body)
+})
+it('saves an inspected version with the original session and preserves a rejected draft', async () => {
+  api.reviewDraft.mockResolvedValue({ ...empty, version: 7 })
+  const { draft, local } = show('Local reasoning', 'comment')
+  await flushPromises()
+  api.saveReviewDraft.mockRejectedValue(new Error('draft changed'))
+  expect(await draft.save()).toBe(false)
+  expect(api.saveReviewDraft).toHaveBeenCalledWith(
+    'acme/app',
+    'proposal-one',
+    { expected_version: 7, head: 'head-one', decision: 'comment', body: 'Local reasoning' },
+    expect.objectContaining({ token: 'first-token' }),
+  )
+  expect(local.body.value).toBe('Local reasoning')
+  expect(draft.error.value).toContain('draft changed')
+})
+it('does not apply a late response from another account', async () => {
+  let finish!: (value: typeof saved) => void
+  api.reviewDraft.mockImplementationOnce(
+    () =>
+      new Promise((resolve) => {
+        finish = resolve
+      }),
+  )
+  const { local } = show()
+  auth.identity = 'user:other'
+  auth.token = 'other-token'
+  await flushPromises()
+  finish(saved)
+  await flushPromises()
+  expect(local.body.value).toBe('')
+})
+it('reports cleanup conflicts separately from review submission', async () => {
+  api.reviewDraft.mockResolvedValue(saved)
+  const { draft } = show()
+  await flushPromises()
+  api.clearReviewDraft.mockRejectedValue(new Error('draft changed'))
+  expect(await draft.clearAfterSubmit()).toContain('draft changed')
+  expect(api.clearReviewDraft).toHaveBeenCalledWith(
+    'acme/app',
+    'proposal-one',
+    4,
+    expect.objectContaining({ token: 'first-token' }),
+  )
+})
+it('does not call draft endpoints for older servers', async () => {
+  auth.capabilities.features = []
+  const { draft } = show()
+  await flushPromises()
+  expect(draft.supported.value).toBe(false)
+  expect(api.reviewDraft).not.toHaveBeenCalled()
+})
+it('refuses more than 64 KiB before sending content', async () => {
+  const { draft } = show('λ'.repeat(32769), 'comment')
+  await flushPromises()
+  expect(await draft.save()).toBe(false)
+  expect(api.saveReviewDraft).not.toHaveBeenCalled()
+  expect(draft.error.value).toContain('64 KiB')
+})
+
+it('keeps a different account draft when the local review is submitted', async () => {
+  api.reviewDraft.mockResolvedValue(saved)
+  const { draft } = show('Other local review', 'comment')
+  await flushPromises()
+  expect(draft.cleanupVersion()).toBeNull()
+  expect(await draft.clearAfterSubmit()).toBe('')
+  expect(api.clearReviewDraft).not.toHaveBeenCalled()
+})
+it('does not close or adopt a late save response after the account changes', async () => {
+  let finish!: (value: typeof saved) => void
+  api.saveReviewDraft.mockImplementation(
+    () =>
+      new Promise((resolve) => {
+        finish = resolve
+      }),
+  )
+  const { draft } = show('Local review', 'comment')
+  await flushPromises()
+  const pending = draft.save()
+  auth.identity = 'user:other'
+  auth.token = 'other-token'
+  await flushPromises()
+  finish(saved)
+  expect(await pending).toBe(false)
+  expect(api.saveReviewDraft.mock.calls[0]![3].token).toBe('first-token')
+})
+
+it('clears the adopted draft after the reviewer explicitly inspects a newer head', async () => {
+  api.reviewDraft.mockResolvedValue(saved)
+  const { draft, local } = show()
+  await flushPromises()
+  local.head.value = 'newly-inspected-head'
+  expect(draft.cleanupVersion()).toBe(4)
+  await draft.clearAfterSubmit(draft.cleanupVersion())
+  expect(api.clearReviewDraft.mock.calls[0]![2]).toBe(4)
+})
diff --git a/apps/web/src/composables/useAccountReviewDraft.ts b/apps/web/src/composables/useAccountReviewDraft.ts
new file mode 100644
index 00000000..63743414
--- /dev/null
+++ b/apps/web/src/composables/useAccountReviewDraft.ts
@@ -0,0 +1,253 @@
+import { computed, onScopeDispose, ref, watch } from 'vue'
+import type { ComputedRef, Ref } from 'vue'
+import { api } from '@/api/instance'
+import { ApiError, describeError } from '@/api/errors'
+import { useAuth } from '@/stores/auth'
+
+type Decision = 'approve' | 'request_changes' | 'comment'
+type AccountDraft = Awaited<ReturnType<typeof api.proposals.reviewDraft>>
+interface LocalDraft {
+  head: Ref<string>
+  decision: Ref<Decision>
+  body: Ref<string>
+}
+interface Options {
+  repo: () => string
+  proposal: () => string
+  open: () => boolean
+  local: LocalDraft
+}
+const isDecision = (value: string): value is Decision =>
+  ['approve', 'request_changes', 'comment'].includes(value)
+
+class AccountReviewDraft {
+  readonly loading = ref(false)
+  readonly saving = ref(false)
+  readonly loaded = ref(false)
+  readonly error = ref('')
+  readonly restored = ref(false)
+  readonly available = ref<AccountDraft | null>(null)
+  readonly supported: ComputedRef<boolean>
+  readonly version: ComputedRef<number | null>
+  readonly canSave: ComputedRef<boolean>
+  private remote = ref<AccountDraft | null>(null)
+  private readonly conflicted = ref(false)
+  private generation = 0
+  private adoptedVersion: number | null = null
+  private controller: AbortController | undefined
+
+  constructor(
+    private options: Options,
+    private auth: ReturnType<typeof useAuth>,
+  ) {
+    this.supported = computed(
+      () => !!auth.capabilities?.features.includes('proposals.review_drafts'),
+    )
+    this.version = computed(() => this.remote.value?.version ?? null)
+    this.canSave = computed(() => this.readyToSave())
+  }
+  private readyToSave() {
+    return (
+      this.supported.value &&
+      this.loaded.value &&
+      !this.loading.value &&
+      !this.saving.value &&
+      !this.available.value &&
+      !this.conflicted.value &&
+      this.auth.status === 'ready'
+    )
+  }
+  private content() {
+    const local = this.options.local
+    return { head: local.head.value, decision: local.decision.value, body: local.body.value }
+  }
+  private same(draft: AccountDraft) {
+    const current = this.content()
+    return (
+      current.head === draft.head &&
+      current.decision === draft.decision &&
+      current.body === draft.body
+    )
+  }
+  private apply(draft: AccountDraft) {
+    if (!isDecision(draft.decision))
+      throw new Error('The saved account draft has an invalid decision.')
+    const local = this.options.local
+    local.head.value = draft.head
+    local.decision.value = draft.decision
+    local.body.value = draft.body
+    this.restored.value = true
+    this.adoptedVersion = draft.version
+  }
+  cancelPending() {
+    this.generation++
+    this.controller?.abort()
+    this.loading.value = this.saving.value = false
+  }
+  private begin() {
+    const mine = ++this.generation
+    this.controller?.abort()
+    this.controller = new AbortController()
+    return {
+      mine,
+      request: {
+        token: this.auth.token,
+        signal: this.controller.signal,
+        quietUnauthenticated: true,
+      },
+    }
+  }
+  activate() {
+    this.cancelPending()
+    this.loaded.value = false
+    this.remote.value = this.available.value = null
+    this.error.value = ''
+    this.restored.value = false
+    this.conflicted.value = false
+    this.adoptedVersion = null
+    if (this.options.open()) void this.load()
+  }
+  private accept(draft: AccountDraft) {
+    if (draft.present && !isDecision(draft.decision))
+      throw new Error('The saved account draft has an invalid decision.')
+    this.remote.value = draft
+    this.loaded.value = true
+    if (!draft.present) return
+    if (this.same(draft)) {
+      this.adoptedVersion = draft.version
+      return
+    }
+    if (!this.options.local.body.value && this.options.local.decision.value === 'approve')
+      this.apply(draft)
+    else this.available.value = draft
+  }
+  async load() {
+    if (
+      !this.supported.value ||
+      !this.options.open() ||
+      this.auth.status !== 'ready' ||
+      this.saving.value
+    )
+      return
+    const { mine, request } = this.begin()
+    this.loading.value = true
+    this.loaded.value = false
+    this.error.value = ''
+    this.restored.value = false
+    this.available.value = null
+    this.adoptedVersion = null
+    this.conflicted.value = false
+    try {
+      const draft = await api.proposals.reviewDraft(
+        this.options.repo(),
+        this.options.proposal(),
+        request,
+      )
+      if (mine === this.generation) this.accept(draft)
+    } catch (cause) {
+      if (mine === this.generation) this.error.value = describeError(cause)
+    } finally {
+      if (mine === this.generation) this.loading.value = false
+    }
+  }
+  useAccount() {
+    if (!this.available.value) return
+    this.apply(this.available.value)
+    this.available.value = null
+  }
+  keepLocal() {
+    this.available.value = null
+    this.restored.value = false
+    this.adoptedVersion = null
+  }
+  async save(): Promise<boolean> {
+    if (!this.canSave.value) return false
+    const submitted = this.content()
+    if (new TextEncoder().encode(submitted.body).length > 64 * 1024) {
+      this.error.value =
+        'Account review drafts are limited to 64 KiB. Keep a local copy of longer notes.'
+      return false
+    }
+    const { mine, request } = this.begin()
+    this.saving.value = true
+    this.error.value = ''
+    try {
+      const draft = await api.proposals.saveReviewDraft(
+        this.options.repo(),
+        this.options.proposal(),
+        { ...submitted, expected_version: this.version.value! },
+        request,
+      )
+      if (mine !== this.generation) return false
+      this.remote.value = draft
+      this.adoptedVersion = draft.version
+      return true
+    } catch (cause) {
+      if (mine === this.generation) {
+        this.error.value = describeError(cause)
+        this.conflicted.value = cause instanceof ApiError && cause.code === 'failed_precondition'
+      }
+      return false
+    } finally {
+      if (mine === this.generation) this.saving.value = false
+    }
+  }
+  cleanupVersion(): number | null {
+    return this.remote.value?.present && this.adoptedVersion === this.version.value
+      ? this.adoptedVersion
+      : null
+  }
+  async clearAfterSubmit(expectedVersion: number | null = this.cleanupVersion()): Promise<string> {
+    if (!this.supported.value || expectedVersion === null) return ''
+    const { mine, request } = this.begin()
+    try {
+      const draft = await api.proposals.clearReviewDraft(
+        this.options.repo(),
+        this.options.proposal(),
+        expectedVersion,
+        request,
+      )
+      if (mine === this.generation) this.remote.value = draft
+      return ''
+    } catch (cause) {
+      return mine === this.generation ? describeError(cause) : ''
+    }
+  }
+}
+
+/** Private account storage for one review, with explicit local/remote conflict choices. */
+export function useAccountReviewDraft(options: Options) {
+  const auth = useAuth()
+  const state = new AccountReviewDraft(options, auth)
+  watch(
+    [
+      options.repo,
+      options.proposal,
+      () => auth.identity,
+      () => auth.token,
+      () => auth.status,
+      state.supported,
+      options.open,
+    ],
+    () => state.activate(),
+    { immediate: true, flush: 'sync' },
+  )
+  onScopeDispose(() => state.cancelPending())
+  return {
+    supported: state.supported,
+    loading: state.loading,
+    saving: state.saving,
+    error: state.error,
+    restored: state.restored,
+    available: state.available,
+    version: state.version,
+    canSave: state.canSave,
+    load: () => state.load(),
+    useAccount: () => state.useAccount(),
+    keepLocal: () => state.keepLocal(),
+    save: () => state.save(),
+    cleanupVersion: () => state.cleanupVersion(),
+    clearAfterSubmit: (version?: number | null) => state.clearAfterSubmit(version),
+    cancelPending: () => state.cancelPending(),
+  }
+}

From 7e48676420e212bc56a8c0e9d0338540bd083b4a Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 21:27:11 +0000
Subject: [PATCH 10/41] feat(cli): manage private review drafts with explicit
 versions

Add remote review-draft get/save/clear, UTF-8 body files and capability guidance. Document cross-client draft behavior and the remaining roadmap work.

Validated: real-server CLI lifecycle, body-boundary unit coverage and documented JSON shapes.
---
 CHANGELOG.md                                  |   2 +
 README.md                                     |   9 +-
 ROADMAP.md                                    |   2 +-
 crates/ag-cli/src/cmds/mod.rs                 |   1 +
 crates/ag-cli/src/cmds/remote.rs              |  13 ++
 crates/ag-cli/src/cmds/review_drafts.rs       | 145 ++++++++++++++
 .../tests/golden/json-shapes-remote.json      |  24 +++
 crates/ag-cli/tests/json_shapes_remote.rs     |  30 +++
 crates/ag-cli/tests/remote.rs                 | 135 +++++++++++++
 docs/guides/remote.md                         |  19 ++
 docs/guides/web-ui.md                         |  15 +-
 docs/reference/cli-json.md                    |  39 ++++
 docs/reference/cli.md                         | 163 ++++++++++++++--
 docs/reference/completions/_ag                | 127 +++++++++++++
 docs/reference/completions/_ag.ps1            |  79 ++++++++
 docs/reference/completions/ag.bash            | 178 +++++++++++++++++-
 docs/reference/completions/ag.elv             |  75 ++++++++
 docs/reference/completions/ag.fish            |  75 +++++---
 .../man/ag-remote-review-draft-clear.1        |  45 +++++
 .../man/ag-remote-review-draft-get.1          |  42 +++++
 .../man/ag-remote-review-draft-save.1         |  69 +++++++
 docs/reference/man/ag-remote-review-draft.1   |  49 +++++
 docs/reference/man/ag-remote.1                |   3 +
 23 files changed, 1283 insertions(+), 56 deletions(-)
 create mode 100644 crates/ag-cli/src/cmds/review_drafts.rs
 create mode 100644 docs/reference/man/ag-remote-review-draft-clear.1
 create mode 100644 docs/reference/man/ag-remote-review-draft-get.1
 create mode 100644 docs/reference/man/ag-remote-review-draft-save.1
 create mode 100644 docs/reference/man/ag-remote-review-draft.1

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fd983509..f365f059 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Added
 
+- Reviewers can explicitly save a private review draft to their account and resume on another device through Web UI, CLI, MCP or SDKs. Local drafts remain available, conflicting drafts require a choice, and versioned saves/clears never overwrite newer notes or submit a review. Development schema 10 requires a pre-upgrade backup.
+
 - Browser conflict resolution can keep either exact binary, oversized or file-type version while preserving blob bytes, executable mode and symlink type. Virtual sync pins the inspected branch through its final transaction and reports its exact target to SDK/MCP clients.
 
 - Authors can request specific reviewers with an inspected-list update across the API and clients. Requests survive new revisions, never grant access or count as approval, and can be filtered before proposal pagination. Development metadata schema 9 requires a pre-upgrade backup.
diff --git a/README.md b/README.md
index 186703a5..90d1eb86 100644
--- a/README.md
+++ b/README.md
@@ -34,10 +34,11 @@ This is an early public beta: [status and limits](#status-and-limits) are below,
 
 **Upgrade:** persistent follow-up task links and durable task execution limits require metadata schema 8. Back up before opening existing repositories with beta.6 or newer; rollback uses the pre-upgrade backup. [Source-link semantics](docs/adr/0027-task-source-links.md).
 
-**Development (`main`):** requested reviewers add metadata schema 9. Back up before
-opening existing repositories with a development build; rollback restores that backup.
-Requests route review work and do not change permissions or approval policy.
-[Design and compatibility](docs/adr/0036-requested-reviewers.md).
+**Development (`main`):** requested reviewers and private account-backed review drafts use
+metadata schema 10. Back up before opening existing repositories with a development build;
+rollback restores that backup. Requests route review work without changing approval policy;
+saving a private draft never submits a review.
+[Requested reviewers](docs/adr/0036-requested-reviewers.md) · [Private drafts](docs/adr/0038-private-review-drafts.md).
 
 Stream rules can require every line discussion to be resolved before integration, including feedback on earlier revisions.
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 482947bd..14a2d7f9 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -106,7 +106,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    rechecks the proposal head and open state. Single-line, range and batched suggestions support explicit author preview and application across files in one revision. Requested reviewers route work across Web UI, CLI, MCP and SDKs without changing approval policy. Optional policy-required line-discussion resolution is now implemented
    across core, API, CLI explanations and Web UI. Preserve drafts, exact-head
    checks and explicit confirmation when a user changes executable work or a review decision.
-   Binary, oversized and file-type conflicts now support exact version choices; structural rename/file-directory conflicts and account-backed drafts remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
+   Binary, oversized and file-type conflicts now support exact version choices. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; account-backed file edits and general comment drafts remain open, as do structural rename/file-directory conflicts. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
    polling for the aggregate view. A cross-repository event feed remains future work.
 3. **Make GitHub/GitLab cutover complete.** Code history, branch/tag mapping, the original bundle
    and reconciliation already move through Web UI and CLI. Next design and implement resumable
diff --git a/crates/ag-cli/src/cmds/mod.rs b/crates/ag-cli/src/cmds/mod.rs
index feee5aa8..0a8f5a26 100644
--- a/crates/ag-cli/src/cmds/mod.rs
+++ b/crates/ag-cli/src/cmds/mod.rs
@@ -14,6 +14,7 @@ pub mod overview;
 pub mod policy;
 pub mod remote;
 pub mod repo;
+pub mod review_drafts;
 pub mod reviewers;
 pub mod shell;
 pub mod topics;
diff --git a/crates/ag-cli/src/cmds/remote.rs b/crates/ag-cli/src/cmds/remote.rs
index 6f8b0bc0..e7669f08 100644
--- a/crates/ag-cli/src/cmds/remote.rs
+++ b/crates/ag-cli/src/cmds/remote.rs
@@ -810,6 +810,11 @@ pub enum RemoteCmd {
     },
     /// Inspect, add or remove requested reviewers (no approval or access change).
     Reviewers(crate::cmds::reviewers::ReviewersArgs),
+    /// Save or restore your private account review notes without submitting them.
+    ReviewDraft {
+        #[command(subcommand)]
+        cmd: crate::cmds::review_drafts::ReviewDraftCmd,
+    },
     /// Review a proposal's current head.
     Review {
         /// Proposal id.
@@ -1229,6 +1234,14 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                     print(cli, &result, || crate::cmds::reviewers::describe(&result.reviewers))?;
                 }
             }
+            RemoteCmd::ReviewDraft { cmd } => {
+                let result = crate::cmds::review_drafts::run(&c, &repo, cmd).await?;
+                if cmd.changes_state() {
+                    print_done(cli, &result, || crate::cmds::review_drafts::describe(&result))?;
+                } else {
+                    print(cli, &result, || crate::cmds::review_drafts::describe(&result))?;
+                }
+            }
             RemoteCmd::Review { id, approve, request_changes, comment, message } => {
                 let decision = match (approve, request_changes, comment) {
                     (true, _, _) => "approve",
diff --git a/crates/ag-cli/src/cmds/review_drafts.rs b/crates/ag-cli/src/cmds/review_drafts.rs
new file mode 100644
index 00000000..815a6b0f
--- /dev/null
+++ b/crates/ag-cli/src/cmds/review_drafts.rs
@@ -0,0 +1,145 @@
+//! Private account review notes; saving never publishes a review.
+use std::path::PathBuf;
+
+use ag_client::{Client, ClientError};
+use ag_protocol::v1;
+use anyhow::{Context, Result, bail};
+use clap::{Args, Subcommand};
+
+/// Read or explicitly replace the signed-in account's review draft.
+#[derive(Subcommand, Debug)]
+pub enum ReviewDraftCmd {
+    /// Read your private draft and its version, including a cleared version.
+    Get {
+        /// Proposal id or unique prefix.
+        id: String,
+    },
+    /// Save private notes; does not submit a review or advance the inspected head.
+    Save(SaveArgs),
+    /// Clear only the private draft version you inspected.
+    Clear {
+        /// Proposal id or unique prefix.
+        id: String,
+        /// Version returned by get; zero means no draft has existed.
+        #[arg(long)]
+        expected_version: u64,
+    },
+}
+
+/// An explicit replacement, never an implicit fetch-and-overwrite.
+#[derive(Args, Debug)]
+pub struct SaveArgs {
+    /// Proposal id or unique prefix.
+    id: String,
+    /// Exact proposal head you inspected.
+    #[arg(long)]
+    head: String,
+    /// Intended review decision; saving does not submit it.
+    #[arg(long, value_parser = ["approve", "request_changes", "comment"])]
+    decision: String,
+    /// Private review notes.
+    #[arg(short, long, default_value = "", conflicts_with = "body_file")]
+    message: String,
+    /// Read UTF-8 notes from this file, preserving line breaks (at most 64 KiB).
+    #[arg(long, value_name = "PATH")]
+    body_file: Option<PathBuf>,
+    /// Version returned by get; use zero only after observing no draft.
+    #[arg(long)]
+    expected_version: u64,
+}
+
+impl ReviewDraftCmd {
+    /// Whether this command explicitly changes stored notes.
+    pub fn changes_state(&self) -> bool {
+        !matches!(self, Self::Get { .. })
+    }
+}
+
+fn body(args: &SaveArgs) -> Result<String> {
+    let text = match &args.body_file {
+        Some(path) => std::fs::read_to_string(path).with_context(|| format!("reading {}", path.display()))?,
+        None => args.message.clone(),
+    };
+    if text.len() > ag_integrate::MAX_REVIEW_DRAFT_BYTES {
+        bail!("review draft exceeds 64 KiB");
+    }
+    Ok(text)
+}
+
+async fn require_support(client: &Client) -> Result<()> {
+    if !client.negotiate().await?.features.iter().any(|f| f == ag_protocol::features::PROPOSALS_REVIEW_DRAFTS) {
+        bail!("this server does not support private review drafts; update it before using this command");
+    }
+    Ok(())
+}
+
+/// Run against the authenticated account, without an owner selector or automatic submission.
+pub async fn run(client: &Client, repo: &str, cmd: &ReviewDraftCmd) -> Result<v1::ReviewDraft> {
+    require_support(client).await?;
+    let mut proposals = client.proposals();
+    let response = match cmd {
+        ReviewDraftCmd::Get { id } => {
+            proposals.get_draft(client.req(v1::GetReviewDraftRequest { repo: repo.into(), id: id.clone() })).await
+        }
+        ReviewDraftCmd::Save(args) => {
+            proposals
+                .save_draft(client.req(v1::SaveReviewDraftRequest {
+                    repo: repo.into(),
+                    id: args.id.clone(),
+                    head: args.head.clone(),
+                    decision: args.decision.clone(),
+                    body: body(args)?,
+                    expected_version: args.expected_version,
+                }))
+                .await
+        }
+        ReviewDraftCmd::Clear { id, expected_version } => {
+            proposals
+                .clear_draft(client.req(v1::ClearReviewDraftRequest {
+                    repo: repo.into(),
+                    id: id.clone(),
+                    expected_version: *expected_version,
+                }))
+                .await
+        }
+    };
+    Ok(response.map_err(ClientError::from)?.into_inner())
+}
+
+/// Show the version needed for the next explicit save or clear.
+pub fn describe(draft: &v1::ReviewDraft) -> String {
+    if !draft.present {
+        return format!("No private review draft. Version {}.", draft.version);
+    }
+    format!(
+        "Private review draft, version {}.\nDecision: {}\nInspected head: {}\n\n{}",
+        draft.version, draft.decision, draft.head, draft.body
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn notes_keep_utf8_and_enforce_the_byte_limit_for_messages_and_files() {
+        let mut args = SaveArgs {
+            id: "p".into(),
+            head: "head".into(),
+            decision: "comment".into(),
+            message: "é".repeat(32 * 1024),
+            body_file: None,
+            expected_version: 0,
+        };
+        assert_eq!(body(&args).unwrap(), args.message);
+        args.message.push('x');
+        assert!(body(&args).unwrap_err().to_string().contains("64 KiB"));
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("notes.md");
+        std::fs::write(&path, "first\r\nsecond\n").unwrap();
+        args.body_file = Some(path.clone());
+        assert_eq!(body(&args).unwrap(), "first\r\nsecond\n");
+        std::fs::write(&path, "x".repeat(64 * 1024 + 1)).unwrap();
+        assert!(body(&args).unwrap_err().to_string().contains("64 KiB"));
+    }
+}
diff --git a/crates/ag-cli/tests/golden/json-shapes-remote.json b/crates/ag-cli/tests/golden/json-shapes-remote.json
index 0c5a1d70..873d3428 100644
--- a/crates/ag-cli/tests/golden/json-shapes-remote.json
+++ b/crates/ag-cli/tests/golden/json-shapes-remote.json
@@ -450,6 +450,30 @@
       "reviewer": "string",
       "timestamp_ms": "number"
     },
+    "remote review-draft clear": {
+      "body": "string",
+      "decision": "string",
+      "head": "string",
+      "present": "bool",
+      "updated_at_ms": "number",
+      "version": "number"
+    },
+    "remote review-draft get": {
+      "body": "string",
+      "decision": "string",
+      "head": "string",
+      "present": "bool",
+      "updated_at_ms": "number",
+      "version": "number"
+    },
+    "remote review-draft save": {
+      "body": "string",
+      "decision": "string",
+      "head": "string",
+      "present": "bool",
+      "updated_at_ms": "number",
+      "version": "number"
+    },
     "remote reviewers": {
       "reviewers": [
         "string"
diff --git a/crates/ag-cli/tests/json_shapes_remote.rs b/crates/ag-cli/tests/json_shapes_remote.rs
index 68a36e2b..a2e78eb3 100644
--- a/crates/ag-cli/tests/json_shapes_remote.rs
+++ b/crates/ag-cli/tests/json_shapes_remote.rs
@@ -41,6 +41,7 @@ fn the_json_output_of_every_remote_command_matches_the_documented_shape() {
     let head = p1["proposal"]["head"].as_str().unwrap().to_string();
     let p1 = p1["proposal"]["id"].as_str().unwrap().to_string();
     record_discussions(&mut r, &a, &alice, &p1, &head);
+    record_review_drafts(&mut r, &a, &bob, &p1, &head);
     r.rec("remote proposals", &as_user("user:alice", &alice, &["--json", "remote", "proposals"]).ok());
     r.rec(
         "remote reviewers",
@@ -179,3 +180,32 @@ fn record_remote_agents(srv: &Server, a: &Ag, token: &str, recorder: &mut Record
     );
     assert!(!repo.meta().read(|tx| tx.agent("cli-bot")).unwrap().unwrap().disabled);
 }
+
+fn record_review_drafts(r: &mut Recorder, a: &Ag, token: &str, proposal: &str, head: &str) {
+    let run = |args: &[&str]| a.run_env("user:bob", args, &[("AG_TOKEN", token)]);
+    r.rec("remote review-draft get", &run(&["--json", "remote", "review-draft", "get", proposal]).ok());
+    r.rec(
+        "remote review-draft save",
+        &run(&[
+            "--json",
+            "remote",
+            "review-draft",
+            "save",
+            proposal,
+            "--head",
+            head,
+            "--decision",
+            "approve",
+            "-m",
+            "Private notes",
+            "--expected-version",
+            "0",
+        ])
+        .ok(),
+    );
+    r.rec("remote review-draft get", &run(&["--json", "remote", "review-draft", "get", proposal]).ok());
+    r.rec(
+        "remote review-draft clear",
+        &run(&["--json", "remote", "review-draft", "clear", proposal, "--expected-version", "1"]).ok(),
+    );
+}
diff --git a/crates/ag-cli/tests/remote.rs b/crates/ag-cli/tests/remote.rs
index c19404a9..70252983 100644
--- a/crates/ag-cli/tests/remote.rs
+++ b/crates/ag-cli/tests/remote.rs
@@ -548,3 +548,138 @@ fn remote_requested_reviewers_route_work_without_granting_review_rights() {
     .unwrap();
     assert_eq!(removed["reviewers"], serde_json::json!([]));
 }
+
+#[test]
+fn remote_private_review_drafts_require_inspected_versions_and_do_not_publish() {
+    let srv = Server::start();
+    let repo = "acme/review-drafts";
+    srv.app
+        .repos
+        .create(repo, "main", "", &ag_types::Identity::new("system:test").unwrap(), Default::default())
+        .unwrap();
+    let alice = srv.user("user:alice", repo, Role::Writer);
+    let bob = srv.user("user:bob", repo, Role::Reviewer);
+    let carol = srv.user("user:carol", repo, Role::Reviewer);
+    let dir = tempfile::tempdir().unwrap();
+    ok(ag(dir.path(), "user:alice", &alice, &["init", "--namespace", repo]));
+    ok(ag(
+        dir.path(),
+        "user:alice",
+        &alice,
+        &["remote", "add", "origin", &format!("{}/{repo}", srv.url), "--token-env", "AG_TOKEN"],
+    ));
+    fs::write(dir.path().join("file.txt"), "Review this\n").unwrap();
+    ok(ag(dir.path(), "user:alice", &alice, &["snapshot", "-m", "Draft target"]));
+    let proposal = proposal_id(&ok(ag(dir.path(), "user:alice", &alice, &["push", "-t", "Draft target"])));
+    let detail: Value =
+        serde_json::from_str(&ok(ag(dir.path(), "user:bob", &bob, &["--json", "remote", "proposal", &proposal])))
+            .unwrap();
+    let head = detail["proposal"]["head"].as_str().unwrap();
+    let empty: Value = serde_json::from_str(&ok(ag(
+        dir.path(),
+        "user:bob",
+        &bob,
+        &["--json", "remote", "review-draft", "clear", &proposal, "--expected-version", "0"],
+    )))
+    .unwrap();
+    assert_eq!(empty["version"], 0);
+    assert_eq!(empty["present"], false);
+    fs::write(dir.path().join("notes.md"), "Private notes\nwith a second line").unwrap();
+    let save = [
+        "--json",
+        "remote",
+        "review-draft",
+        "save",
+        &proposal,
+        "--head",
+        head,
+        "--decision",
+        "request_changes",
+        "--body-file",
+        "notes.md",
+        "--expected-version",
+        "0",
+    ];
+    let saved: Value = serde_json::from_str(&ok(ag(dir.path(), "user:bob", &bob, &save))).unwrap();
+    assert_eq!(saved["version"], 1);
+    assert_eq!(saved["body"], "Private notes\nwith a second line");
+    let retry: Value = serde_json::from_str(&ok(ag(dir.path(), "user:bob", &bob, &save))).unwrap();
+    assert_eq!(retry["version"], 1);
+    let own: Value = serde_json::from_str(&ok(ag(
+        dir.path(),
+        "user:bob",
+        &bob,
+        &["--json", "remote", "review-draft", "get", &proposal],
+    )))
+    .unwrap();
+    assert_eq!(own, saved);
+    assert!(!ag(dir.path(), "user:alice", &alice, &["remote", "review-draft", "get", &proposal]).status.success());
+    let other: Value = serde_json::from_str(&ok(ag(
+        dir.path(),
+        "user:carol",
+        &carol,
+        &["--json", "remote", "review-draft", "get", &proposal],
+    )))
+    .unwrap();
+    assert_eq!(other["present"], false);
+    let stale = ag(
+        dir.path(),
+        "user:bob",
+        &bob,
+        &[
+            "remote",
+            "review-draft",
+            "save",
+            &proposal,
+            "--head",
+            head,
+            "--decision",
+            "comment",
+            "-m",
+            "New notes",
+            "--expected-version",
+            "0",
+        ],
+    );
+    assert!(!stale.status.success());
+    let missing_version = ag(dir.path(), "user:bob", &bob, &["remote", "review-draft", "clear", &proposal]);
+    assert_eq!(missing_version.status.code(), Some(2));
+    let cleared: Value = serde_json::from_str(&ok(ag(
+        dir.path(),
+        "user:bob",
+        &bob,
+        &["--json", "remote", "review-draft", "clear", &proposal, "--expected-version", "1"],
+    )))
+    .unwrap();
+    assert_eq!(cleared["version"], 2);
+    assert_eq!(cleared["present"], false);
+    assert!(!ag(dir.path(), "user:bob", &bob, &save).status.success());
+    let replacement: Value = serde_json::from_str(&ok(ag(
+        dir.path(),
+        "user:bob",
+        &bob,
+        &[
+            "--json",
+            "remote",
+            "review-draft",
+            "save",
+            &proposal,
+            "--head",
+            head,
+            "--decision",
+            "comment",
+            "-m",
+            "New notes",
+            "--expected-version",
+            "2",
+        ],
+    )))
+    .unwrap();
+    assert_eq!(replacement["version"], 3);
+    assert_eq!(replacement["body"], "New notes");
+    assert_eq!(replacement["decision"], "comment");
+    let after: Value =
+        serde_json::from_str(&ok(ag(dir.path(), "user:alice", &alice, &["--json", "remote", "proposal", &proposal])))
+            .unwrap();
+    assert!(after["reviews"].as_array().unwrap().is_empty());
+}
diff --git a/docs/guides/remote.md b/docs/guides/remote.md
index e3cb94af..281d82e9 100644
--- a/docs/guides/remote.md
+++ b/docs/guides/remote.md
@@ -72,6 +72,25 @@ ag pull                                  # the merged result comes back
 - `ag remote remove NAME` deletes the stored credential first; if it cannot, the remote is kept and the error
   names the file.
 
+## Private review drafts
+
+On development servers advertising `proposals.review_drafts`, save review notes to your
+account and resume them in the browser or SDK. Read the draft first, then pass its exact
+version when saving or clearing it. A missing draft starts at version zero; a cleared draft
+keeps its later version. Another device's edit produces a conflict instead of losing notes.
+
+```sh
+ag remote review-draft get prop_…
+ag remote review-draft save prop_… --head CHANGESET_ID --decision comment --body-file notes.md --expected-version 0
+ag remote review-draft clear prop_… --expected-version 1
+```
+
+Use the version actually returned by your preceding command, not the example values above.
+The head records the revision you inspected. Saving does not submit a review, grant approval,
+or notify reviewers. Only the current account can read its draft through the API; server
+administrators and backups can still contain these notes. Files use UTF-8 and retain line
+breaks, with a 64 KiB limit. `--json` returns the draft and its version for scripts.
+
 ## Offline
 
 Nothing about a local repository needs the server:
diff --git a/docs/guides/web-ui.md b/docs/guides/web-ui.md
index 157710ec..daa69305 100644
--- a/docs/guides/web-ui.md
+++ b/docs/guides/web-ui.md
@@ -197,6 +197,19 @@ Diff line-number columns fit the largest number in the displayed patch, includin
 
 **Review drafts.** Closing the review dialog or reloading the page keeps the comment, decision and inspected head in this browser tab, separately for each account, repository and change request. The draft is removed only after the server accepts the review. Storage failures are shown; in that case copy the comment before leaving. Closing the browser tab still removes this local draft. If the author changes the head, the text stays and submission is blocked until you confirm that you reviewed the updated changes. The server checks the inspected head atomically when saving; a concurrent update rejects the review and keeps your text. Older servers without this capability require an upgrade before this UI submits a review.
 
+
+**Account review drafts (development).** On supported servers, **Save draft and close** stores
+this review's text, decision and inspected revision privately for your current account.
+Opening the same review on another device restores it when that tab has no draft. If both
+places have different drafts, choose **Use account draft** or **Keep this tab draft** explicitly.
+Typing alone does not upload changes. The limit is 64 KiB of UTF-8 notes.
+
+A save refused because another device changed the draft keeps your text. A successful review
+clears only the matching saved version; newer notes remain intact. Stored notes do not count
+as reviews or approvals and are not shown in the shared proposal or audit. They are part of
+repository backups, which administrators can access. Servers without this capability retain
+the local-only behavior. File-edit and general-comment drafts remain local to the browser.
+
 **Actions** are *Review*, *Run the checks*, *Land*, *Add to queue* and *Close*. Each is enabled only if your
 roles allow it; the buttons that are off are explained in words under the row ("Land: requires the integrator role"),
 not only in a tooltip. A **Next:** line picks the one thing to do first (a conflict before checks, checks before approvals).
@@ -370,7 +383,7 @@ This uses the server's virtual workspaces: a draft is opened on the branch (from
 applied as one version, the change request is opened from it, and the server workspace is removed. While sending, the editor locks the submitted title and description. Requests and retries retain the initiating credential; leaving or changing account stops unsent follow-up steps and ignores late results. Cancellation does not undo a server operation that already completed; the local draft remains available if completion was not confirmed. Text and symbolic-link targets can be edited. **Rename or move** and **Delete file** open reviewed change requests and preserve the original blob and mode. **Upload files** handles several text or binary files together, with explicit confirmation before replacing existing files (100 files, 4 MiB total).
 If the upload cannot read the branch, **Retry branch** keeps your selected files, destination, title and description.
 
-A workspace separates edits from the branch; it does not make stored objects confidential from other repository readers. Account-backed confidential drafts require a separate authorization boundary.
+A workspace separates edits from the branch; it does not make stored objects confidential from other repository readers. Account-backed file drafts remain future work; the private review-draft endpoint is a separate authorization boundary.
 
 The editor pins the version you read. If someone changes the branch while you type, their work is checked by
 the normal merge and conflict rules. It is not silently replaced by your older copy. Leaving the file, changing
diff --git a/docs/reference/cli-json.md b/docs/reference/cli-json.md
index 6c6dce2b..1347b11d 100644
--- a/docs/reference/cli-json.md
+++ b/docs/reference/cli-json.md
@@ -1826,6 +1826,45 @@ Their output *is* the data (file contents, a template, a script, a man page, hel
 }
 ```
 
+### ag remote review-draft clear
+
+```json
+{
+  "body": "string",
+  "decision": "string",
+  "head": "string",
+  "present": "bool",
+  "updated_at_ms": "number",
+  "version": "number"
+}
+```
+
+### ag remote review-draft get
+
+```json
+{
+  "body": "string",
+  "decision": "string",
+  "head": "string",
+  "present": "bool",
+  "updated_at_ms": "number",
+  "version": "number"
+}
+```
+
+### ag remote review-draft save
+
+```json
+{
+  "body": "string",
+  "decision": "string",
+  "head": "string",
+  "present": "bool",
+  "updated_at_ms": "number",
+  "version": "number"
+}
+```
+
 ### ag remote reviewers
 
 ```json
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index e4ba4a25..72b8c822 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -128,6 +128,10 @@ Concept pages are available in the terminal: `ag help workflow|policy|leases|ide
 - [`ag remote prepare`](#ag-remote-prepare)
 - [`ag remote explain`](#ag-remote-explain)
 - [`ag remote reviewers`](#ag-remote-reviewers)
+- [`ag remote review-draft`](#ag-remote-review-draft)
+- [`ag remote review-draft get`](#ag-remote-review-draft-get)
+- [`ag remote review-draft save`](#ag-remote-review-draft-save)
+- [`ag remote review-draft clear`](#ag-remote-review-draft-clear)
 - [`ag remote review`](#ag-remote-review)
 - [`ag remote discussion`](#ag-remote-discussion)
 - [`ag remote discussion list`](#ag-remote-discussion-list)
@@ -2498,25 +2502,26 @@ Manage remotes and work with proposals, events and policy on a server
 Usage: ag remote [OPTIONS] <COMMAND>
 
 Commands:
-  add         Add a remote
-  list        List remotes
-  remove      Forget a remote
-  whoami      Show who the server thinks you are
-  proposals   List proposals on the server
-  proposal    Show a proposal with its reviews
-  prepare     What would integrating do now, and what is missing?
-  explain     Explain why a server proposal cannot land, with the next commands. Changes nothing
-  reviewers   Inspect, add or remove requested reviewers (no approval or access change)
-  review      Review a proposal's current head
-  discussion  Read and participate in revision-bound line discussions
-  integrate   Integrate a proposal into its stream
-  close       Close a proposal without integrating it
-  streams     List streams
-  events      Show the events of the repository (replay), or follow them live
-  policy      Show or set a stream's policy
-  log         Show history of a revision on the server
-  blame       Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`
-  cat         Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`
+  add           Add a remote
+  list          List remotes
+  remove        Forget a remote
+  whoami        Show who the server thinks you are
+  proposals     List proposals on the server
+  proposal      Show a proposal with its reviews
+  prepare       What would integrating do now, and what is missing?
+  explain       Explain why a server proposal cannot land, with the next commands. Changes nothing
+  reviewers     Inspect, add or remove requested reviewers (no approval or access change)
+  review-draft  Save or restore your private account review notes without submitting them
+  review        Review a proposal's current head
+  discussion    Read and participate in revision-bound line discussions
+  integrate     Integrate a proposal into its stream
+  close         Close a proposal without integrating it
+  streams       List streams
+  events        Show the events of the repository (replay), or follow them live
+  policy        Show or set a stream's policy
+  log           Show history of a revision on the server
+  blame         Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`
+  cat           Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`
 
 Options:
   -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
@@ -2730,6 +2735,126 @@ Options:
   -V, --version              Print version
 ```
 
+## ag remote review-draft
+
+```text
+Save or restore your private account review notes without submitting them
+
+Usage: ag remote review-draft [OPTIONS] <COMMAND>
+
+Commands:
+  get    Read your private draft and its version, including a cleared version
+  save   Save private notes; does not submit a review or advance the inspected head
+  clear  Clear only the private draft version you inspected
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote review-draft get
+
+```text
+Read your private draft and its version, including a cleared version
+
+Usage: ag remote review-draft get [OPTIONS] <ID>
+
+Arguments:
+  <ID>  Proposal id or unique prefix
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote review-draft save
+
+```text
+Save private notes; does not submit a review or advance the inspected head
+
+Usage: ag remote review-draft save [OPTIONS] --head <HEAD> --decision <DECISION> --expected-version <EXPECTED_VERSION> <ID>
+
+Arguments:
+  <ID>  Proposal id or unique prefix
+
+Options:
+  -C, --repo <DIR>
+          Operate on the repository at this path (default: discovered from the current directory)
+      --head <HEAD>
+          Exact proposal head you inspected
+      --remote <REMOTE>
+          Remote to use (default: origin)
+      --as <IDENTITY>
+          Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --decision <DECISION>
+          Intended review decision; saving does not submit it [possible values: approve, request_changes, comment]
+      --json
+          Machine-readable JSON output
+  -m, --message <MESSAGE>
+          Private review notes [default: ""]
+      --body-file <PATH>
+          Read UTF-8 notes from this file, preserving line breaks (at most 64 KiB)
+      --color <WHEN>
+          Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+      --expected-version <EXPECTED_VERSION>
+          Version returned by get; use zero only after observing no draft
+  -q, --quiet
+          Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose
+          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+```
+
+## ag remote review-draft clear
+
+```text
+Clear only the private draft version you inspected
+
+Usage: ag remote review-draft clear [OPTIONS] --expected-version <EXPECTED_VERSION> <ID>
+
+Arguments:
+  <ID>  Proposal id or unique prefix
+
+Options:
+  -C, --repo <DIR>
+          Operate on the repository at this path (default: discovered from the current directory)
+      --expected-version <EXPECTED_VERSION>
+          Version returned by get; zero means no draft has existed
+      --remote <REMOTE>
+          Remote to use (default: origin)
+      --as <IDENTITY>
+          Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json
+          Machine-readable JSON output
+      --color <WHEN>
+          Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet
+          Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose
+          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+```
+
 ## ag remote review
 
 ```text
diff --git a/docs/reference/completions/_ag b/docs/reference/completions/_ag
index 4ef84b48..139365fb 100644
--- a/docs/reference/completions/_ag
+++ b/docs/reference/completions/_ag
@@ -2491,6 +2491,108 @@ never\:"Never colour"))' \
 ':id -- Proposal id or unique prefix:_default' \
 && ret=0
 ;;
+(review-draft)
+_arguments "${_arguments_options[@]}" : \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+":: :_ag__subcmd__remote__subcmd__review-draft_commands" \
+"*::: :->review-draft" \
+&& ret=0
+
+    case $state in
+    (review-draft)
+        words=($line[1] "${words[@]}")
+        (( CURRENT += 1 ))
+        curcontext="${curcontext%:*:*}:ag-remote-review-draft-command-$line[1]:"
+        case $line[1] in
+            (get)
+_arguments "${_arguments_options[@]}" : \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':id -- Proposal id or unique prefix:_default' \
+&& ret=0
+;;
+(save)
+_arguments "${_arguments_options[@]}" : \
+'--head=[Exact proposal head you inspected]:HEAD:_default' \
+'--decision=[Intended review decision; saving does not submit it]:DECISION:(approve request_changes comment)' \
+'(--body-file)-m+[Private review notes]:MESSAGE:_default' \
+'(--body-file)--message=[Private review notes]:MESSAGE:_default' \
+'--body-file=[Read UTF-8 notes from this file, preserving line breaks (at most 64 KiB)]:PATH:_files' \
+'--expected-version=[Version returned by get; use zero only after observing no draft]:EXPECTED_VERSION:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':id -- Proposal id or unique prefix:_default' \
+&& ret=0
+;;
+(clear)
+_arguments "${_arguments_options[@]}" : \
+'--expected-version=[Version returned by get; zero means no draft has existed]:EXPECTED_VERSION:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':id -- Proposal id or unique prefix:_default' \
+&& ret=0
+;;
+        esac
+    ;;
+esac
+;;
 (review)
 _arguments "${_arguments_options[@]}" : \
 '-m+[Review text]:MESSAGE:_default' \
@@ -3802,6 +3904,7 @@ _ag__subcmd__remote_commands() {
 'prepare:What would integrating do now, and what is missing?' \
 'explain:Explain why a server proposal cannot land, with the next commands. Changes nothing' \
 'reviewers:Inspect, add or remove requested reviewers (no approval or access change)' \
+'review-draft:Save or restore your private account review notes without submitting them' \
 'review:Review a proposal'\''s current head' \
 'discussion:Read and participate in revision-bound line discussions' \
 'integrate:Integrate a proposal into its stream' \
@@ -3926,6 +4029,30 @@ _ag__subcmd__remote__subcmd__review_commands() {
     local commands; commands=()
     _describe -t commands 'ag remote review commands' commands "$@"
 }
+(( $+functions[_ag__subcmd__remote__subcmd__review-draft_commands] )) ||
+_ag__subcmd__remote__subcmd__review-draft_commands() {
+    local commands; commands=(
+'get:Read your private draft and its version, including a cleared version' \
+'save:Save private notes; does not submit a review or advance the inspected head' \
+'clear:Clear only the private draft version you inspected' \
+    )
+    _describe -t commands 'ag remote review-draft commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__review-draft__subcmd__clear_commands] )) ||
+_ag__subcmd__remote__subcmd__review-draft__subcmd__clear_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote review-draft clear commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__review-draft__subcmd__get_commands] )) ||
+_ag__subcmd__remote__subcmd__review-draft__subcmd__get_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote review-draft get commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__review-draft__subcmd__save_commands] )) ||
+_ag__subcmd__remote__subcmd__review-draft__subcmd__save_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote review-draft save commands' commands "$@"
+}
 (( $+functions[_ag__subcmd__remote__subcmd__reviewers_commands] )) ||
 _ag__subcmd__remote__subcmd__reviewers_commands() {
     local commands; commands=()
diff --git a/docs/reference/completions/_ag.ps1 b/docs/reference/completions/_ag.ps1
index 5ba82276..f57c5ece 100644
--- a/docs/reference/completions/_ag.ps1
+++ b/docs/reference/completions/_ag.ps1
@@ -1880,6 +1880,7 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('prepare', 'prepare', [CompletionResultType]::ParameterValue, 'What would integrating do now, and what is missing?')
             [CompletionResult]::new('explain', 'explain', [CompletionResultType]::ParameterValue, 'Explain why a server proposal cannot land, with the next commands. Changes nothing')
             [CompletionResult]::new('reviewers', 'reviewers', [CompletionResultType]::ParameterValue, 'Inspect, add or remove requested reviewers (no approval or access change)')
+            [CompletionResult]::new('review-draft', 'review-draft', [CompletionResultType]::ParameterValue, 'Save or restore your private account review notes without submitting them')
             [CompletionResult]::new('review', 'review', [CompletionResultType]::ParameterValue, 'Review a proposal''s current head')
             [CompletionResult]::new('discussion', 'discussion', [CompletionResultType]::ParameterValue, 'Read and participate in revision-bound line discussions')
             [CompletionResult]::new('integrate', 'integrate', [CompletionResultType]::ParameterValue, 'Integrate a proposal into its stream')
@@ -2055,6 +2056,84 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
             break
         }
+        'ag;remote;review-draft' {
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('get', 'get', [CompletionResultType]::ParameterValue, 'Read your private draft and its version, including a cleared version')
+            [CompletionResult]::new('save', 'save', [CompletionResultType]::ParameterValue, 'Save private notes; does not submit a review or advance the inspected head')
+            [CompletionResult]::new('clear', 'clear', [CompletionResultType]::ParameterValue, 'Clear only the private draft version you inspected')
+            break
+        }
+        'ag;remote;review-draft;get' {
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;review-draft;save' {
+            [CompletionResult]::new('--head', '--head', [CompletionResultType]::ParameterName, 'Exact proposal head you inspected')
+            [CompletionResult]::new('--decision', '--decision', [CompletionResultType]::ParameterName, 'Intended review decision; saving does not submit it')
+            [CompletionResult]::new('-m', '-m', [CompletionResultType]::ParameterName, 'Private review notes')
+            [CompletionResult]::new('--message', '--message', [CompletionResultType]::ParameterName, 'Private review notes')
+            [CompletionResult]::new('--body-file', '--body-file', [CompletionResultType]::ParameterName, 'Read UTF-8 notes from this file, preserving line breaks (at most 64 KiB)')
+            [CompletionResult]::new('--expected-version', '--expected-version', [CompletionResultType]::ParameterName, 'Version returned by get; use zero only after observing no draft')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;review-draft;clear' {
+            [CompletionResult]::new('--expected-version', '--expected-version', [CompletionResultType]::ParameterName, 'Version returned by get; zero means no draft has existed')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
         'ag;remote;review' {
             [CompletionResult]::new('-m', '-m', [CompletionResultType]::ParameterName, 'Review text')
             [CompletionResult]::new('--message', '--message', [CompletionResultType]::ParameterName, 'Review text')
diff --git a/docs/reference/completions/ag.bash b/docs/reference/completions/ag.bash
index 0114e11e..49a23afb 100644
--- a/docs/reference/completions/ag.bash
+++ b/docs/reference/completions/ag.bash
@@ -358,6 +358,9 @@ _ag() {
             ag__subcmd__remote,review)
                 cmd="ag__subcmd__remote__subcmd__review"
                 ;;
+            ag__subcmd__remote,review-draft)
+                cmd="ag__subcmd__remote__subcmd__review__subcmd__draft"
+                ;;
             ag__subcmd__remote,reviewers)
                 cmd="ag__subcmd__remote__subcmd__reviewers"
                 ;;
@@ -382,6 +385,15 @@ _ag() {
             ag__subcmd__remote__subcmd__discussion,start)
                 cmd="ag__subcmd__remote__subcmd__discussion__subcmd__start"
                 ;;
+            ag__subcmd__remote__subcmd__review__subcmd__draft,clear)
+                cmd="ag__subcmd__remote__subcmd__review__subcmd__draft__subcmd__clear"
+                ;;
+            ag__subcmd__remote__subcmd__review__subcmd__draft,get)
+                cmd="ag__subcmd__remote__subcmd__review__subcmd__draft__subcmd__get"
+                ;;
+            ag__subcmd__remote__subcmd__review__subcmd__draft,save)
+                cmd="ag__subcmd__remote__subcmd__review__subcmd__draft__subcmd__save"
+                ;;
             ag__subcmd__stream,create)
                 cmd="ag__subcmd__stream__subcmd__create"
                 ;;
@@ -3467,7 +3479,7 @@ _ag() {
             return 0
             ;;
         ag__subcmd__remote)
-            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat"
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -4338,6 +4350,170 @@ _ag() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        ag__subcmd__remote__subcmd__review__subcmd__draft)
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version get save clear"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__review__subcmd__draft__subcmd__clear)
+            opts="-C -q -v -h -V --expected-version --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --expected-version)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__review__subcmd__draft__subcmd__get)
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__review__subcmd__draft__subcmd__save)
+            opts="-m -C -q -v -h -V --head --decision --message --body-file --expected-version --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --head)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --decision)
+                    COMPREPLY=($(compgen -W "approve request_changes comment" -- "${cur}"))
+                    return 0
+                    ;;
+                --message)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -m)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --body-file)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --expected-version)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         ag__subcmd__remote__subcmd__reviewers)
             opts="-C -q -v -h -V --add --remove --expected --expect-empty --remote --repo --as --json --color --quiet --verbose --help --version"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
diff --git a/docs/reference/completions/ag.elv b/docs/reference/completions/ag.elv
index 9bd71fa4..c390478d 100644
--- a/docs/reference/completions/ag.elv
+++ b/docs/reference/completions/ag.elv
@@ -1779,6 +1779,7 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand prepare 'What would integrating do now, and what is missing?'
             cand explain 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
             cand reviewers 'Inspect, add or remove requested reviewers (no approval or access change)'
+            cand review-draft 'Save or restore your private account review notes without submitting them'
             cand review 'Review a proposal''s current head'
             cand discussion 'Read and participate in revision-bound line discussions'
             cand integrate 'Integrate a proposal into its stream'
@@ -1944,6 +1945,80 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand -V 'Print version'
             cand --version 'Print version'
         }
+        &'ag;remote;review-draft'= {
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+            cand get 'Read your private draft and its version, including a cleared version'
+            cand save 'Save private notes; does not submit a review or advance the inspected head'
+            cand clear 'Clear only the private draft version you inspected'
+        }
+        &'ag;remote;review-draft;get'= {
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;review-draft;save'= {
+            cand --head 'Exact proposal head you inspected'
+            cand --decision 'Intended review decision; saving does not submit it'
+            cand -m 'Private review notes'
+            cand --message 'Private review notes'
+            cand --body-file 'Read UTF-8 notes from this file, preserving line breaks (at most 64 KiB)'
+            cand --expected-version 'Version returned by get; use zero only after observing no draft'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;review-draft;clear'= {
+            cand --expected-version 'Version returned by get; zero means no draft has existed'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
         &'ag;remote;review'= {
             cand -m 'Review text'
             cand --message 'Review text'
diff --git a/docs/reference/completions/ag.fish b/docs/reference/completions/ag.fish
index 4032d7e3..c19c7383 100644
--- a/docs/reference/completions/ag.fish
+++ b/docs/reference/completions/ag.fish
@@ -1212,36 +1212,37 @@ complete -c ag -n "__fish_ag_using_subcommand push" -s q -l quiet -d 'Print only
 complete -c ag -n "__fish_ag_using_subcommand push" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand push" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand push" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
-always\t'Always colour'
-never\t'Never colour'"
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review discussion integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "review-draft" -d 'Save or restore your private account review notes without submitting them'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l token-env -d 'Environment variable holding the credential' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l ca-file -d 'Extra CA certificate (PEM) to trust' -r -F
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l remote -d 'Remote to use (default: origin)' -r
@@ -1351,6 +1352,20 @@ complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from reviewers" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -f -a "get" -d 'Read your private draft and its version, including a cleared version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -f -a "save" -d 'Save private notes; does not submit a review or advance the inspected head'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -f -a "clear" -d 'Clear only the private draft version you inspected'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review" -s m -l message -d 'Review text' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review" -l remote -d 'Remote to use (default: origin)' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
diff --git a/docs/reference/man/ag-remote-review-draft-clear.1 b/docs/reference/man/ag-remote-review-draft-clear.1
new file mode 100644
index 00000000..9fc518be
--- /dev/null
+++ b/docs/reference/man/ag-remote-review-draft-clear.1
@@ -0,0 +1,45 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-review-draft-clear 1  "clear 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-review\-draft\-clear \- Clear only the private draft version you inspected
+.SH SYNOPSIS
+\fBag remote review\-draft clear\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fB\-\-expected\-version\fR> <\fIID\fR>
+.SH DESCRIPTION
+Clear only the private draft version you inspected
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-expected\-version\fR \fI<EXPECTED_VERSION>\fR
+Version returned by get; zero means no draft has existed
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fIID\fR>
+Proposal id or unique prefix
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-review-draft-get.1 b/docs/reference/man/ag-remote-review-draft-get.1
new file mode 100644
index 00000000..897da02f
--- /dev/null
+++ b/docs/reference/man/ag-remote-review-draft-get.1
@@ -0,0 +1,42 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-review-draft-get 1  "get 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-review\-draft\-get \- Read your private draft and its version, including a cleared version
+.SH SYNOPSIS
+\fBag remote review\-draft get\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fIID\fR>
+.SH DESCRIPTION
+Read your private draft and its version, including a cleared version
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fIID\fR>
+Proposal id or unique prefix
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-review-draft-save.1 b/docs/reference/man/ag-remote-review-draft-save.1
new file mode 100644
index 00000000..42727f1c
--- /dev/null
+++ b/docs/reference/man/ag-remote-review-draft-save.1
@@ -0,0 +1,69 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-review-draft-save 1  "save 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-review\-draft\-save \- Save private notes; does not submit a review or advance the inspected head
+.SH SYNOPSIS
+\fBag remote review\-draft save\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-m\fR|\fB\-\-message\fR] [\fB\-\-body\-file\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fB\-\-head\fR> <\fB\-\-decision\fR> <\fB\-\-expected\-version\fR> <\fIID\fR>
+.SH DESCRIPTION
+Save private notes; does not submit a review or advance the inspected head
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-head\fR \fI<HEAD>\fR
+Exact proposal head you inspected
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-decision\fR \fI<DECISION>\fR
+Intended review decision; saving does not submit it
+.br
+
+.br
+\fIPossible values:\fR
+.RS 14
+.IP \(bu 2
+approve
+.IP \(bu 2
+request_changes
+.IP \(bu 2
+comment
+.RE
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-m\fR, \fB\-\-message\fR \fI<MESSAGE>\fR [default: ]
+Private review notes
+.TP
+\fB\-\-body\-file\fR \fI<PATH>\fR
+Read UTF\-8 notes from this file, preserving line breaks (at most 64 KiB)
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-\-expected\-version\fR \fI<EXPECTED_VERSION>\fR
+Version returned by get; use zero only after observing no draft
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fIID\fR>
+Proposal id or unique prefix
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-review-draft.1 b/docs/reference/man/ag-remote-review-draft.1
new file mode 100644
index 00000000..b00b3300
--- /dev/null
+++ b/docs/reference/man/ag-remote-review-draft.1
@@ -0,0 +1,49 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-review-draft 1  "review-draft 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-review\-draft \- Save or restore your private account review notes without submitting them
+.SH SYNOPSIS
+\fBag remote review\-draft\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fIsubcommands\fR>
+.SH DESCRIPTION
+Save or restore your private account review notes without submitting them
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH SUBCOMMANDS
+.TP
+ag\-remote\-review\-draft\-get(1)
+Read your private draft and its version, including a cleared version
+.TP
+ag\-remote\-review\-draft\-save(1)
+Save private notes; does not submit a review or advance the inspected head
+.TP
+ag\-remote\-review\-draft\-clear(1)
+Clear only the private draft version you inspected
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote.1 b/docs/reference/man/ag-remote.1
index 130143e2..d8a96077 100644
--- a/docs/reference/man/ag-remote.1
+++ b/docs/reference/man/ag-remote.1
@@ -64,6 +64,9 @@ Explain why a server proposal cannot land, with the next commands. Changes nothi
 ag\-remote\-reviewers(1)
 Inspect, add or remove requested reviewers (no approval or access change)
 .TP
+ag\-remote\-review\-draft(1)
+Save or restore your private account review notes without submitting them
+.TP
 ag\-remote\-review(1)
 Review a proposal\*(Aqs current head
 .TP

From ca0da01f2d098e34da71999c320e98d62489eba5 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 21:40:27 +0000
Subject: [PATCH 11/41] fix(review): preserve source paths across rename
 conflicts

Expose the merge engine's exact per-side source paths through core, API and clients. Read each Web preview at its original path and keep rename/delete choices tied to the inspected revisions.

Validated: full integration and Web suites, API/gRPC regressions in both rename directions, 12 browser cases, CLI/SDK/MCP checks and workspace Clippy.
---
 CHANGELOG.md                                  |   2 +
 ROADMAP.md                                    |   2 +-
 apps/web/e2e/rename-conflicts.spec.ts         | 127 +++++++++++++++++
 apps/web/package.json                         |   2 +-
 apps/web/playwright.config.ts                 |   2 +-
 apps/web/scripts/check-api.mjs                |   2 +-
 apps/web/scripts/generate-api.mjs             |  10 ++
 apps/web/src/api/schema.gen.ts                |  10 ++
 .../proposal/ConflictResolver.spec.ts         | 132 +++++++++++++++++-
 .../components/proposal/ConflictResolver.vue  |  59 +++++---
 apps/web/src/lib/edit-next.spec.ts            |   1 +
 apps/web/src/lib/edit.ts                      |   9 +-
 crates/ag-cli/src/cmds/conflicts.rs           |  65 +++++++++
 crates/ag-cli/src/cmds/explain.rs             |  11 +-
 crates/ag-cli/src/cmds/flow.rs                |   4 +-
 crates/ag-cli/src/cmds/mod.rs                 |   1 +
 crates/ag-cli/src/cmds/remote.rs              |  18 +--
 crates/ag-cli/src/cmds/repo.rs                |   2 +-
 crates/ag-cli/tests/cli.rs                    |  12 +-
 crates/ag-cli/tests/golden/json-shapes.json   |   5 +
 crates/ag-cli/tests/json_shapes.rs            |   9 +-
 crates/ag-cli/tests/remote.rs                 |  40 ++++++
 crates/ag-integrate/src/lib.rs                |   2 +-
 crates/ag-integrate/src/types.rs              |  25 +++-
 crates/ag-integrate/tests/conflict_origins.rs |  23 +++
 crates/ag-mcp/src/tools/workspace.rs          |  17 ++-
 crates/ag-protocol/proto/agwp/v1/agwp.proto   |  12 ++
 crates/ag-protocol/src/lib.rs                 |   4 +
 crates/ag-server/src/api/convert.rs           |  11 +-
 crates/ag-server/tests/conflict_origins.rs    |  88 ++++++++++++
 docs/adr/0039-conflict-source-paths.md        |  35 +++++
 docs/adr/README.md                            |   2 +
 docs/guides/web-ui.md                         |   9 +-
 docs/protocol/agwp-v1.md                      |  11 ++
 docs/protocol/openapi.json                    |  30 ++++
 docs/reference/cli-json.md                    |   5 +
 proto/agwp/v1/agwp.proto                      |  12 ++
 sdk/python/README.md                          |   6 +
 sdk/python/src/agentgit/_generated/models.py  |  10 ++
 .../src/agentgit/_generated/namespaces.py     |   1 +
 sdk/python/tests/test_sync_precondition.py    |  31 ++++
 sdk/typescript/README.md                      |   6 +
 sdk/typescript/scripts/generate.mjs           |   3 +-
 sdk/typescript/src/generated/models.ts        |   1 +
 sdk/typescript/src/generated/schema.ts        |  10 ++
 sdk/typescript/test/sync-precondition.test.ts |  21 ++-
 46 files changed, 846 insertions(+), 54 deletions(-)
 create mode 100644 apps/web/e2e/rename-conflicts.spec.ts
 create mode 100644 apps/web/scripts/generate-api.mjs
 create mode 100644 crates/ag-cli/src/cmds/conflicts.rs
 create mode 100644 crates/ag-integrate/tests/conflict_origins.rs
 create mode 100644 crates/ag-server/tests/conflict_origins.rs
 create mode 100644 docs/adr/0039-conflict-source-paths.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f365f059..aaa12018 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Fixed
 
+- Renamed conflict previews now read each version at its exact source path instead of mistaking a relocated file for deletion. CLI, SDK and MCP retain this metadata; the browser also supports explicit rename/delete choices and requires capable servers.
+
 - SDKs retry workspace sync automatically only when a nonempty inspected branch head guards the operation. Unguarded calls require explicit unsafe-retry opt-in.
 
 ### Changed
diff --git a/ROADMAP.md b/ROADMAP.md
index 14a2d7f9..d58c6ad1 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -106,7 +106,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    rechecks the proposal head and open state. Single-line, range and batched suggestions support explicit author preview and application across files in one revision. Requested reviewers route work across Web UI, CLI, MCP and SDKs without changing approval policy. Optional policy-required line-discussion resolution is now implemented
    across core, API, CLI explanations and Web UI. Preserve drafts, exact-head
    checks and explicit confirmation when a user changes executable work or a review decision.
-   Binary, oversized and file-type conflicts now support exact version choices. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; account-backed file edits and general comment drafts remain open, as do structural rename/file-directory conflicts. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
+   Binary, oversized, file-type and rename/delete conflicts now support exact version choices; renamed content previews retain their per-side source paths. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; account-backed file edits and general comment drafts remain open, as do structural rename/file-directory conflicts. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
    polling for the aggregate view. A cross-repository event feed remains future work.
 3. **Make GitHub/GitLab cutover complete.** Code history, branch/tag mapping, the original bundle
    and reconciliation already move through Web UI and CLI. Next design and implement resumable
diff --git a/apps/web/e2e/rename-conflicts.spec.ts b/apps/web/e2e/rename-conflicts.spec.ts
new file mode 100644
index 00000000..32ab18a8
--- /dev/null
+++ b/apps/web/e2e/rename-conflicts.spec.ts
@@ -0,0 +1,127 @@
+import { test, expect } from './fixtures.ts'
+import { freshRepo, commitFiles, openProposal, integrate } from './support/world.ts'
+
+const base =
+  'heading\nshared line one\nshared line two\nshared line three\nvalue=base\nshared line four\nshared line five\nend\n'
+const mine = base.replace('value=base', 'value=proposal')
+const branch = base.replace('value=base', 'value=branch')
+
+for (const renamed of ['proposal', 'branch']) {
+  test(`renamed ${renamed} side preserves both overlapping edits and writes the selected source`, async ({
+    cast,
+    openAs,
+  }, info) => {
+    const { repo } = await freshRepo(cast, 'rename-conflict', { 'old.txt': base })
+    const alice = cast.as('alice')
+    const dana = cast.as('dana')
+    const ours = await commitFiles(
+      alice,
+      repo,
+      renamed === 'proposal' ? { 'old.txt': null, 'renamed.txt': mine } : { 'old.txt': mine },
+      'Proposal edit',
+    )
+    const proposal = await openProposal(alice, repo, {
+      head: ours.head,
+      title: 'Resolve renamed overlapping edits',
+    })
+    const theirs = await commitFiles(
+      dana,
+      repo,
+      renamed === 'branch' ? { 'old.txt': null, 'renamed.txt': branch } : { 'old.txt': branch },
+      'Branch edit',
+    )
+    const upstream = await openProposal(dana, repo, { head: theirs.head, title: 'Branch update' })
+    await integrate(cast.as('carol'), repo, upstream.id)
+    const page = await openAs('alice')
+    await page.goto(`/repos/${repo}/proposals/${proposal.id}`)
+    await page.getByTestId('fix-conflict').click()
+    const row = page.getByTestId('resolver').locator('[data-path="renamed.txt"]')
+    await expect(row.getByRole('region', { name: 'Your version of renamed.txt' })).toContainText(
+      'value=proposal',
+    )
+    await expect(
+      row.getByRole('region', { name: 'The branch’s version of renamed.txt' }),
+    ).toContainText('value=branch')
+    await expect(row).toContainText('Source: old.txt')
+    await expect(row).not.toContainText('deleted this file')
+    const chooseBranch = renamed === 'proposal'
+    await row
+      .getByRole('button', { name: chooseBranch ? 'Keep the branch’s' : 'Keep mine', exact: true })
+      .click()
+    await page.screenshot({ path: info.outputPath('rename-conflict.png'), fullPage: true })
+    await page.getByTestId('resolve-save').click()
+    await expect(page.getByRole('dialog')).toHaveCount(0)
+    const detail = await alice.ok_(
+      alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+      'resolved proposal',
+    )
+    const expectedHead = chooseBranch ? theirs.head : ours.head
+    const source = await alice.ok_(
+      alice.get(`/v1/repos/${repo}/tree/resolve?rev=${expectedHead}&path=old.txt`),
+      'source identity',
+    )
+    const result = await alice.ok_(
+      alice.get(`/v1/repos/${repo}/tree/resolve?rev=${detail.proposal.head}&path=renamed.txt`),
+      'resolved identity',
+    )
+    expect(result.entry.blob_id).toBe(source.entry.blob_id)
+    const old = await alice.ok_(
+      alice.get(`/v1/repos/${repo}/tree/resolve?rev=${detail.proposal.head}&path=old.txt`),
+      'old path stays absent',
+    )
+    expect(old.kind).toBe('missing')
+    await page.close()
+  })
+
+  test(`rename/delete with ${renamed} rename preserves the existing side`, async ({
+    cast,
+    openAs,
+  }) => {
+    const { repo } = await freshRepo(cast, 'rename-delete', { 'old.txt': base })
+    const alice = cast.as('alice')
+    const dana = cast.as('dana')
+    const ours = await commitFiles(
+      alice,
+      repo,
+      renamed === 'proposal' ? { 'old.txt': null, 'renamed.txt': base } : { 'old.txt': null },
+      'Proposal move or delete',
+    )
+    const proposal = await openProposal(alice, repo, {
+      head: ours.head,
+      title: 'Resolve rename and delete',
+    })
+    const theirs = await commitFiles(
+      dana,
+      repo,
+      renamed === 'branch' ? { 'old.txt': null, 'renamed.txt': base } : { 'old.txt': null },
+      'Branch move or delete',
+    )
+    const upstream = await openProposal(dana, repo, { head: theirs.head, title: 'Branch update' })
+    await integrate(cast.as('carol'), repo, upstream.id)
+    const page = await openAs('alice')
+    await page.goto(`/repos/${repo}/proposals/${proposal.id}`)
+    await page.getByTestId('fix-conflict').click()
+    const row = page.getByTestId('resolver').locator('[data-path="renamed.txt"]')
+    await expect(row).toContainText(
+      renamed === 'proposal' ? '(the branch deleted this file)' : '(you deleted this file)',
+    )
+    await row
+      .getByRole('button', {
+        name: renamed === 'proposal' ? 'Keep mine' : 'Keep the branch’s',
+        exact: true,
+      })
+      .click()
+    await page.getByTestId('resolve-save').click()
+    await expect(page.getByRole('dialog')).toHaveCount(0)
+    const detail = await alice.ok_(
+      alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+      'resolved proposal',
+    )
+    const result = await alice.ok_(
+      alice.get(`/v1/repos/${repo}/tree/resolve?rev=${detail.proposal.head}&path=renamed.txt`),
+      'preserved renamed file',
+    )
+    expect(result.entry.file_type).toBe('regular')
+    await page.close()
+  })
+}
diff --git a/apps/web/package.json b/apps/web/package.json
index c2c871ef..b96be13f 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -18,7 +18,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:e2e": "playwright test",
-    "gen:api": "openapi-typescript ../../docs/protocol/openapi.json -o src/api/schema.gen.ts && prettier --write src/api/schema.gen.ts",
+    "gen:api": "node scripts/generate-api.mjs src/api/schema.gen.ts && prettier --write src/api/schema.gen.ts",
     "check:api": "node scripts/check-api.mjs",
     "pretest:e2e": "npm run build",
     "demo:server": "npm run build && node e2e/demo.ts"
diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts
index 57a8d711..71e85ac2 100644
--- a/apps/web/playwright.config.ts
+++ b/apps/web/playwright.config.ts
@@ -26,7 +26,7 @@ const screenshots = /screenshots\.spec\.ts/
 // Layout assertions are made at the viewports of the tablet and phone projects, not at desktop size.
 const layout = /responsive\.spec\.ts/
 const small =
-  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|nontext-conflicts|review-requests|required-discussions|draft-recovery|review-drafts|account-review-draft|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
+  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|nontext-conflicts|rename-conflicts|review-requests|required-discussions|draft-recovery|review-drafts|account-review-draft|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
 const desktop = { viewport: { width: 1440, height: 900 } }
 
 export default defineConfig({
diff --git a/apps/web/scripts/check-api.mjs b/apps/web/scripts/check-api.mjs
index f84e56fa..332a0fcb 100644
--- a/apps/web/scripts/check-api.mjs
+++ b/apps/web/scripts/check-api.mjs
@@ -20,7 +20,7 @@ function run(cmd, args) {
 }
 
 try {
-  run(bin('openapi-typescript'), ['../../docs/protocol/openapi.json', '-o', out])
+  run(process.execPath, ['scripts/generate-api.mjs', out])
   run(bin('prettier'), ['--config', join(root, '.prettierrc.json'), '--write', out])
   const fresh = readFileSync(out, 'utf8')
   const committed = readFileSync(join(root, 'src/api/schema.gen.ts'), 'utf8')
diff --git a/apps/web/scripts/generate-api.mjs b/apps/web/scripts/generate-api.mjs
new file mode 100644
index 00000000..2fd0a553
--- /dev/null
+++ b/apps/web/scripts/generate-api.mjs
@@ -0,0 +1,10 @@
+// Keep additive fields optional: runtime responses from older servers are not default-filled.
+import { readFileSync, writeFileSync } from 'node:fs'
+import openapiTS, { astToString } from 'openapi-typescript'
+
+const schema = JSON.parse(readFileSync('../../docs/protocol/openapi.json', 'utf8'))
+const conflict = schema.components.schemas.Conflict
+if (!conflict.required?.includes('origin')) delete conflict.properties.origin.default
+const header =
+  '/**\n * This file was auto-generated by openapi-typescript.\n * Do not make direct changes to the file.\n */\n\n'
+writeFileSync(process.argv[2], header + astToString(await openapiTS(schema)))
diff --git a/apps/web/src/api/schema.gen.ts b/apps/web/src/api/schema.gen.ts
index 1bc94ff7..5af76bc6 100644
--- a/apps/web/src/api/schema.gen.ts
+++ b/apps/web/src/api/schema.gen.ts
@@ -2131,9 +2131,19 @@ export interface components {
        * @default
        */
       message: string
+      origin?: components['schemas']['ConflictOrigin'] | null
       /** @default  */
       path: string
     }
+    /** @description Exact paths at the three revisions when source locations differ after a rename. */
+    ConflictOrigin: {
+      /** @default  */
+      base: string
+      /** @default  */
+      ours: string
+      /** @default  */
+      theirs: string
+    }
     CreateIssueRequest: {
       /** @default  */
       body: string
diff --git a/apps/web/src/components/proposal/ConflictResolver.spec.ts b/apps/web/src/components/proposal/ConflictResolver.spec.ts
index 5ef4ffde..93c3958f 100644
--- a/apps/web/src/components/proposal/ConflictResolver.spec.ts
+++ b/apps/web/src/components/proposal/ConflictResolver.spec.ts
@@ -40,7 +40,11 @@ const show = () =>
 beforeEach(() => {
   auth.token = 'original'
   auth.identity = 'user:alice'
-  auth.capabilities.features = ['proposals.update_head', 'workspaces.sync_precondition']
+  auth.capabilities.features = [
+    'proposals.update_head',
+    'workspaces.sync_precondition',
+    'workspaces.conflict_origins',
+  ]
   api.workspaces.create.mockReset().mockResolvedValue({ head: 'mine-head' })
   api.workspaces.sync
     .mockReset()
@@ -231,3 +235,129 @@ it('never removes an existing workspace when creation reports a name collision',
   expect(api.workspaces.sync).not.toHaveBeenCalled()
   expect(api.workspaces.remove).not.toHaveBeenCalled()
 })
+
+it('loads renamed content from each source path and writes the selected bytes at the output path', async () => {
+  api.workspaces.sync
+    .mockReset()
+    .mockResolvedValueOnce({
+      status: 'conflicted',
+      stream_head: 'branch-head',
+      conflicts: [
+        {
+          path: 'renamed.txt',
+          kind: 'content',
+          origin: { base: 'old.txt', ours: 'renamed.txt', theirs: 'old.txt' },
+        },
+      ],
+    })
+    .mockResolvedValue({ status: 'merged', head: 'merged-head' })
+  api.tree.resolve.mockImplementation(async (_repo, head, path) => ({
+    kind: 'regular',
+    entry: {
+      path,
+      blob_id: head === 'mine-head' ? 'mine-blob' : 'branch-blob',
+      file_type: 'regular',
+      executable: false,
+      size: 12,
+    },
+  }))
+  api.tree.file.mockImplementation(async (_repo, head) => ({
+    bytes: new TextEncoder().encode(
+      head === 'mine-head' ? 'my renamed edit' : 'branch original edit',
+    ),
+    truncated: false,
+  }))
+  const w = show()
+  await flushPromises()
+  expect(api.tree.resolve).toHaveBeenCalledWith(
+    'acme/app',
+    'branch-head',
+    'old.txt',
+    expect.anything(),
+  )
+  expect(w.text()).toContain('Source: old.txt')
+  expect(w.text()).toContain('branch original edit')
+  await w
+    .findAll('button')
+    .find((b) => b.text() === 'Keep the branch’s')!
+    .trigger('click')
+  await w.get('[data-testid=resolve-save]').trigger('click')
+  await flushPromises()
+  expect(api.workspaces.sync.mock.calls[1]![2]).toEqual([
+    {
+      path: 'renamed.txt',
+      op: 'put',
+      blob_id: 'branch-blob',
+      file_type: 'regular',
+      executable: false,
+    },
+  ])
+})
+
+it('refuses servers without source-path metadata before preparing a merge', async () => {
+  auth.capabilities.features = ['proposals.update_head', 'workspaces.sync_precondition']
+  const w = show()
+  await flushPromises()
+  expect(w.text()).toContain('Upgrade the server')
+  expect(api.workspaces.create).not.toHaveBeenCalled()
+})
+
+it.each(['mine', 'branch'])(
+  'handles rename/delete with the %s side missing at the output path',
+  async (missing) => {
+    api.workspaces.sync
+      .mockReset()
+      .mockResolvedValueOnce({
+        status: 'conflicted',
+        stream_head: 'branch-head',
+        conflicts: [{ path: 'renamed.txt', kind: 'rename_delete' }],
+      })
+      .mockResolvedValue({ status: 'merged', head: 'merged-head' })
+    api.tree.resolve.mockImplementation(async (_repo, head, path) =>
+      head === `${missing}-head`
+        ? { kind: 'missing', entry: null }
+        : {
+            kind: 'regular',
+            entry: { path, blob_id: 'kept-blob', file_type: 'regular', executable: true, size: 3 },
+          },
+    )
+    const w = show()
+    await flushPromises()
+    expect(w.text()).not.toContain('Not here')
+    expect(w.text()).toContain(
+      missing === 'mine' ? '(you deleted this file)' : '(the branch deleted this file)',
+    )
+    const keep = missing === 'mine' ? 'Keep the branch’s' : 'Keep mine'
+    await w
+      .findAll('button')
+      .find((b) => b.text() === keep)!
+      .trigger('click')
+    await w.get('[data-testid=resolve-save]').trigger('click')
+    await flushPromises()
+    expect(api.workspaces.sync.mock.calls[1]![2]).toEqual([
+      {
+        path: 'renamed.txt',
+        op: 'put',
+        blob_id: 'kept-blob',
+        file_type: 'regular',
+        executable: true,
+      },
+    ])
+  },
+)
+
+it.each(['rename_rename', 'file_directory'])(
+  'keeps %s structural conflicts blocked',
+  async (kind) => {
+    api.workspaces.sync.mockReset().mockResolvedValueOnce({
+      status: 'conflicted',
+      stream_head: 'branch-head',
+      conflicts: [{ path: 'renamed.txt', kind }],
+    })
+    const w = show()
+    await flushPromises()
+    expect(w.text()).toContain('resolve this structural conflict with the command line')
+    expect(api.tree.resolve).not.toHaveBeenCalled()
+    expect(w.get('[data-testid=resolve-save]').attributes('aria-disabled')).toBe('true')
+  },
+)
diff --git a/apps/web/src/components/proposal/ConflictResolver.vue b/apps/web/src/components/proposal/ConflictResolver.vue
index ef6fccc4..6b610b6f 100644
--- a/apps/web/src/components/proposal/ConflictResolver.vue
+++ b/apps/web/src/components/proposal/ConflictResolver.vue
@@ -2,7 +2,7 @@
 import { computed, onBeforeUnmount, ref, watch } from 'vue'
 import { api } from '@/api/instance'
 import { ApiError, describeError } from '@/api/errors'
-import type { Conflict, Proposal } from '@/api/types'
+import type { Conflict, Proposal, SyncWorkspaceResponse } from '@/api/types'
 import { canResolveHere, workspaceName } from '@/lib/edit'
 import { conflictLabel } from '@/lib/conflict-label'
 import { formatBytes } from '@/lib/format'
@@ -79,6 +79,9 @@ function invalidate() {
   if (previous) void release(previous)
   phase.value = 'idle'
 }
+function sourcePath(conflict: Conflict, side: 'ours' | 'theirs') {
+  return conflict.origin?.[side] ?? conflict.path
+}
 async function prepareRow(a: Attempt, conflict: Conflict): Promise<Row> {
   const row: Row = {
     conflict,
@@ -95,8 +98,8 @@ async function prepareRow(a: Attempt, conflict: Conflict): Promise<Row> {
     return row
   }
   ;[row.mine, row.theirs] = await Promise.all([
-    loadConflictVersion(api, a.repo, a.head, conflict.path, request(a)),
-    loadConflictVersion(api, a.repo, a.branchHead, conflict.path, request(a)),
+    loadConflictVersion(api, a.repo, a.head, sourcePath(conflict, 'ours'), request(a)),
+    loadConflictVersion(api, a.repo, a.branchHead, sourcePath(conflict, 'theirs'), request(a)),
   ])
   row.editable = [row.mine, row.theirs].every(
     (v) => !v.entry || (v.entry.file_type === 'regular' && v.text !== null),
@@ -116,17 +119,32 @@ async function moveProposal(a: Attempt, head: string) {
   emit('update:modelValue', false)
   emit('done')
 }
+async function prepareMerge(a: Attempt, result: SyncWorkspaceResponse) {
+  if (result.status !== 'conflicted') {
+    await moveProposal(a, result.head)
+    return
+  }
+  a.branchHead = result.stream_head ?? ''
+  if (!a.branchHead)
+    throw new Error('The server did not identify the branch revision used for this conflict.')
+  const prepared = await Promise.all(result.conflicts.map((conflict) => prepareRow(a, conflict)))
+  if (!current(a)) return
+  rows.value = prepared
+  phase.value = 'ready'
+}
 async function open() {
   invalidate()
   error.value = null
   rows.value = []
   if (
-    !['proposals.update_head', 'workspaces.sync_precondition'].every((feature) =>
-      auth.capabilities?.features.includes(feature),
+    !['proposals.update_head', 'workspaces.sync_precondition', 'workspaces.conflict_origins'].every(
+      (feature) => auth.capabilities?.features.includes(feature),
     )
   ) {
     error.value = asError(
-      new Error('Upgrade the server to resolve conflicts with revision protection.'),
+      new Error(
+        'Upgrade the server to resolve conflicts with source paths and revision protection.',
+      ),
     )
     phase.value = 'error'
     return
@@ -160,17 +178,7 @@ async function open() {
       throw new Error('The workspace did not open at the inspected revision.')
     const result = await api.workspaces.sync(a.repo, a.workspace, [], request(a))
     if (!current(a)) return
-    if (result.status !== 'conflicted') {
-      await moveProposal(a, result.head)
-      return
-    }
-    a.branchHead = result.stream_head ?? ''
-    if (!a.branchHead)
-      throw new Error('The server did not identify the branch revision used for this conflict.')
-    const prepared = await Promise.all(result.conflicts.map((conflict) => prepareRow(a, conflict)))
-    if (!current(a)) return
-    rows.value = prepared
-    phase.value = 'ready'
+    await prepareMerge(a, result)
   } catch (e) {
     // An ambiguous create may have committed; an explicit collision belongs to somebody else.
     a.created ||= !(e instanceof ApiError && e.code === 'already_exists')
@@ -206,9 +214,12 @@ function summary(version: ConflictVersion): string {
   const entry = version.entry
   return `${entry.file_type === 'symlink' ? 'Symbolic link' : 'Regular file'} · ${formatBytes(entry.size)}${entry.executable ? ' · executable' : ''}`
 }
+function readyToSave(a: Attempt) {
+  return current(a) && phase.value === 'ready' && !unresolved.value && !headChanged.value
+}
 async function save() {
   const a = active
-  if (!a || !current(a) || phase.value !== 'ready' || unresolved.value || headChanged.value) return
+  if (!a || !readyToSave(a)) return
   phase.value = 'saving'
   error.value = null
   try {
@@ -279,6 +290,12 @@ onBeforeUnmount(invalidate)
           <div class="cols">
             <div>
               <h4>The branch’s version</h4>
+              <p
+                v-if="r.conflict.origin && r.conflict.origin.theirs !== r.conflict.path"
+                class="faint"
+              >
+                Source: <code>{{ r.conflict.origin.theirs }}</code>
+              </p>
               <p class="faint">{{ summary(r.theirs) }}</p>
               <pre
                 class="ver"
@@ -294,6 +311,12 @@ onBeforeUnmount(invalidate)
             </div>
             <div>
               <h4>Your version</h4>
+              <p
+                v-if="r.conflict.origin && r.conflict.origin.ours !== r.conflict.path"
+                class="faint"
+              >
+                Source: <code>{{ r.conflict.origin.ours }}</code>
+              </p>
               <p class="faint">{{ summary(r.mine) }}</p>
               <pre
                 class="ver"
diff --git a/apps/web/src/lib/edit-next.spec.ts b/apps/web/src/lib/edit-next.spec.ts
index 2d0a8d1a..9ac54c3d 100644
--- a/apps/web/src/lib/edit-next.spec.ts
+++ b/apps/web/src/lib/edit-next.spec.ts
@@ -56,6 +56,7 @@ describe('editing helpers', () => {
       'content',
       'both_added',
       'delete_modify',
+      'rename_delete',
       'binary',
       'too_large',
       'type_change',
diff --git a/apps/web/src/lib/edit.ts b/apps/web/src/lib/edit.ts
index 55369919..eb2233ea 100644
--- a/apps/web/src/lib/edit.ts
+++ b/apps/web/src/lib/edit.ts
@@ -131,11 +131,18 @@ export async function proposeChange(api: Api, input: ProposeInput): Promise<Prop
 }
 
 export type ResolvableKind =
-  'content' | 'both_added' | 'delete_modify' | 'binary' | 'too_large' | 'type_change'
+  | 'content'
+  | 'both_added'
+  | 'delete_modify'
+  | 'rename_delete'
+  | 'binary'
+  | 'too_large'
+  | 'type_change'
 const RESOLVABLE = new Set<string>([
   'content',
   'both_added',
   'delete_modify',
+  'rename_delete',
   'binary',
   'too_large',
   'type_change',
diff --git a/crates/ag-cli/src/cmds/conflicts.rs b/crates/ag-cli/src/cmds/conflicts.rs
new file mode 100644
index 00000000..cb33949b
--- /dev/null
+++ b/crates/ag-cli/src/cmds/conflicts.rs
@@ -0,0 +1,65 @@
+//! Render the source locations of a renamed conflict without changing its result path.
+use ag_integrate::ConflictInfo;
+use ag_protocol::v1;
+
+fn sources(path: &str, origin: Option<(&str, &str, &str)>) -> String {
+    match origin {
+        Some((base, ours, theirs)) if [base, ours, theirs].iter().any(|source| *source != path) => {
+            format!("\n    source paths: base={base}, ours={ours}, theirs={theirs}")
+        }
+        _ => String::new(),
+    }
+}
+
+/// Source paths for an embedded repository conflict, absent for legacy outcomes.
+pub fn local_sources(conflict: &ConflictInfo) -> String {
+    sources(&conflict.path, conflict.origin.as_ref().map(|o| (o.base.as_str(), o.ours.as_str(), o.theirs.as_str())))
+}
+
+/// Source paths returned by a server, absent when talking to an older server.
+pub fn wire_sources(conflict: &v1::Conflict) -> String {
+    sources(&conflict.path, conflict.origin.as_ref().map(|o| (o.base.as_str(), o.ours.as_str(), o.theirs.as_str())))
+}
+
+/// Human-readable embedded conflict, preserving the engine's kind description.
+pub fn local(conflict: &ConflictInfo) -> String {
+    format!("{} ({}){}", conflict.path, conflict.describe(), local_sources(conflict))
+}
+
+/// Human-readable server conflict, including the legacy kind-only fallback.
+pub fn wire(conflict: &v1::Conflict) -> String {
+    let message = if conflict.message.is_empty() { &conflict.kind } else { &conflict.message };
+    format!("{} ({}){}", conflict.path, message, wire_sources(conflict))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn renamed_sources_keep_each_side_and_the_result_path() {
+        let conflict = v1::Conflict {
+            path: "result.txt".into(),
+            kind: "content".into(),
+            message: "conflicting lines".into(),
+            origin: Some(v1::ConflictOrigin {
+                base: "old.txt".into(),
+                ours: "result.txt".into(),
+                theirs: "other.txt".into(),
+            }),
+        };
+        assert_eq!(
+            wire(&conflict),
+            "result.txt (conflicting lines)\n    source paths: base=old.txt, ours=result.txt, theirs=other.txt"
+        );
+    }
+
+    #[test]
+    fn legacy_and_same_path_conflicts_do_not_gain_noise() {
+        let mut conflict = v1::Conflict { path: "a.txt".into(), kind: "content".into(), ..Default::default() };
+        assert_eq!(wire(&conflict), "a.txt (content)");
+        conflict.origin =
+            Some(v1::ConflictOrigin { base: "a.txt".into(), ours: "a.txt".into(), theirs: "a.txt".into() });
+        assert_eq!(wire(&conflict), "a.txt (content)");
+    }
+}
diff --git a/crates/ag-cli/src/cmds/explain.rs b/crates/ag-cli/src/cmds/explain.rs
index d72e7887..9fcaeb7c 100644
--- a/crates/ag-cli/src/cmds/explain.rs
+++ b/crates/ag-cli/src/cmds/explain.rs
@@ -80,7 +80,12 @@ pub fn from_wire(
 ) -> Vec<Explanation> {
     let mut out: Vec<Explanation> = conflicts
         .iter()
-        .map(|c| ag_integrate::explain::explain_conflict_kind(&c.path, &c.kind, &c.message, proposal, Where::Remote))
+        .map(|c| {
+            let mut explanation =
+                ag_integrate::explain::explain_conflict_kind(&c.path, &c.kind, &c.message, proposal, Where::Remote);
+            explanation.why.push_str(&crate::cmds::conflicts::wire_sources(c));
+            explanation
+        })
         .collect();
     out.extend(blockers.iter().map(|b| {
         let detail = serde_json::from_str(&b.detail_json).unwrap_or(serde_json::Value::Null);
@@ -136,7 +141,9 @@ pub fn explain(ctx: &Ctx, a: &ExplainArgs) -> Result<u8> {
         ex.push(explain_invalid(problem, p, Where::Local));
     }
     for c in &prep.preview.conflicts {
-        ex.push(explain_conflict(c, p, Where::Local));
+        let mut explanation = explain_conflict(c, p, Where::Local);
+        explanation.why.push_str(&crate::cmds::conflicts::local_sources(c));
+        ex.push(explanation);
     }
     for b in &prep.blockers {
         ex.push(explain_blocked(b, p, Where::Local));
diff --git a/crates/ag-cli/src/cmds/flow.rs b/crates/ag-cli/src/cmds/flow.rs
index c298d5af..d69351ea 100644
--- a/crates/ag-cli/src/cmds/flow.rs
+++ b/crates/ag-cli/src/cmds/flow.rs
@@ -339,7 +339,7 @@ pub fn print_result(ctx: &Ctx, r: &IntegrationResult, proposal: Option<&str>, co
                 let _ =
                     writeln!(s, "Conflict: the proposal cannot be merged automatically; the stream was not changed.");
                 for c in conflicts {
-                    let _ = writeln!(s, "  {}  ({})", c.path, c.describe());
+                    let _ = writeln!(s, "  {}  ({}){}", c.path, c.describe(), crate::cmds::conflicts::local_sources(c));
                 }
                 if let Some(b) = base {
                     let _ = writeln!(s, "merge base: {}", b.short());
@@ -411,7 +411,7 @@ pub fn preview(ctx: &Ctx, a: &PreviewArgs) -> Result<u8> {
             let _ = writeln!(s, "candidate tree: {t}");
         }
         for c in &pv.conflicts {
-            let _ = writeln!(s, "conflict: {} ({})", c.path, c.describe());
+            let _ = writeln!(s, "conflict: {}", crate::cmds::conflicts::local(c));
         }
         for n in &pv.notes {
             let _ = writeln!(s, "note: {}", n.message);
diff --git a/crates/ag-cli/src/cmds/mod.rs b/crates/ag-cli/src/cmds/mod.rs
index 0a8f5a26..06ae9453 100644
--- a/crates/ag-cli/src/cmds/mod.rs
+++ b/crates/ag-cli/src/cmds/mod.rs
@@ -4,6 +4,7 @@ pub mod admin;
 pub mod agents;
 pub mod auth;
 pub mod config;
+pub mod conflicts;
 pub mod discussions;
 pub mod doctor;
 pub mod explain;
diff --git a/crates/ag-cli/src/cmds/remote.rs b/crates/ag-cli/src/cmds/remote.rs
index e7669f08..5dc810a6 100644
--- a/crates/ag-cli/src/cmds/remote.rs
+++ b/crates/ag-cli/src/cmds/remote.rs
@@ -654,7 +654,11 @@ pub fn pull(ctx: &Ctx, a: &SyncArgs) -> Result<u8> {
         Some(SyncOutcome::FastForwarded { to }) => format!("Fast-forwarded the workspace to {}.", to.short()),
         Some(SyncOutcome::Merged { id }) => format!("Merged remote changes into the workspace ({}).", id.short()),
         Some(SyncOutcome::Conflicted { conflicts }) => {
-            format!("Merged with {} conflict(s); resolve the marked files, then `ag snapshot`.", conflicts.len())
+            format!(
+                "Merged with {} conflict(s); resolve the marked files, then `ag snapshot`.\n{}",
+                conflicts.len(),
+                conflicts.iter().map(crate::cmds::conflicts::local).collect::<Vec<_>>().join("\n")
+            )
         }
     };
     ctx.done(&serde_json::json!({"fetch": report, "workspace": outcome}), || text.clone())?;
@@ -1196,11 +1200,7 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                 print(cli, &p, || {
                     let mut t = format!("strategy: {}\ncandidate tree: {}\n", p.strategy, p.candidate_tree);
                     for cf in &p.conflicts {
-                        t.push_str(&format!(
-                            "conflict: {} ({})\n",
-                            cf.path,
-                            if cf.message.is_empty() { &cf.kind } else { &cf.message }
-                        ));
+                        t.push_str(&format!("conflict: {}\n", crate::cmds::conflicts::wire(cf)));
                     }
                     if !p.problem.is_empty() {
                         t.push_str(&format!("problem: {}\n", p.problem));
@@ -1288,11 +1288,7 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                         "Conflict:\n{}",
                         o.conflicts
                             .iter()
-                            .map(|c| format!(
-                                "  - {} ({})",
-                                c.path,
-                                if c.message.is_empty() { &c.kind } else { &c.message }
-                            ))
+                            .map(|c| format!("  - {}", crate::cmds::conflicts::wire(c)))
                             .collect::<Vec<_>>()
                             .join("\n")
                     ),
diff --git a/crates/ag-cli/src/cmds/repo.rs b/crates/ag-cli/src/cmds/repo.rs
index 6003b704..6b522bc7 100644
--- a/crates/ag-cli/src/cmds/repo.rs
+++ b/crates/ag-cli/src/cmds/repo.rs
@@ -303,7 +303,7 @@ pub fn sync(ctx: &Ctx, a: &SyncArgs) -> Result<u8> {
                 conflicts.len()
             );
             for c in conflicts {
-                let _ = writeln!(s, "  {}  ({})", c.path, c.describe());
+                let _ = writeln!(s, "  {}  ({}){}", c.path, c.describe(), crate::cmds::conflicts::local_sources(c));
             }
             s
         }
diff --git a/crates/ag-cli/tests/cli.rs b/crates/ag-cli/tests/cli.rs
index 42f8c68f..cc106b19 100644
--- a/crates/ag-cli/tests/cli.rs
+++ b/crates/ag-cli/tests/cli.rs
@@ -311,8 +311,18 @@ fn a_content_conflict_after_a_rename_gets_markers_in_the_new_file() {
     let pa = a.propose_as("user:alice", "rename and edit");
     a.ag(&["integrate", &pa]).ok();
 
+    let proposal = a.run_as("user:bob", &["--json", "propose", "-t", "bob edit", "@bob"]).ok().json()["id"]
+        .as_str()
+        .unwrap()
+        .to_string();
+    let preview = a.ag(&["preview", &proposal]).code_is(4).stdout();
+    assert!(preview.contains("source paths: base=a.txt, ours=b.txt, theirs=a.txt"), "{preview}");
+    let explanation = a.ag(&["explain", &proposal]).code_is(4).stdout();
+    assert!(explanation.contains("source paths: base=a.txt, ours=b.txt, theirs=a.txt"), "{explanation}");
+    let integration = a.ag(&["integrate", &proposal]).code_is(4).stdout();
+    assert!(integration.contains("source paths: base=a.txt, ours=b.txt, theirs=a.txt"), "{integration}");
     let r = a.run_as("user:bob", &["sync", "--workspace", "bob"]).code_is(4);
-    assert!(r.stdout().contains("b.txt"), "{}", r.stdout());
+    assert!(r.stdout().contains("source paths: base=a.txt, ours=a.txt, theirs=b.txt"), "{}", r.stdout());
     let marked = fs::read_to_string(bob.join("b.txt")).unwrap();
     assert!(marked.contains("<<<<<<< ours") && marked.contains("ALICE") && marked.contains("BOB"), "{marked}");
 }
diff --git a/crates/ag-cli/tests/golden/json-shapes.json b/crates/ag-cli/tests/golden/json-shapes.json
index 4e9724fa..06bfc311 100644
--- a/crates/ag-cli/tests/golden/json-shapes.json
+++ b/crates/ag-cli/tests/golden/json-shapes.json
@@ -848,6 +848,11 @@
         {
           "kind": "string",
           "message": "string",
+          "origin": {
+            "base": "string",
+            "ours": "string",
+            "theirs": "string"
+          },
           "path": "string"
         }
       ],
diff --git a/crates/ag-cli/tests/json_shapes.rs b/crates/ag-cli/tests/json_shapes.rs
index 8ba24b1d..11d82326 100644
--- a/crates/ag-cli/tests/json_shapes.rs
+++ b/crates/ag-cli/tests/json_shapes.rs
@@ -180,16 +180,17 @@ fn the_json_output_of_every_local_command_matches_the_documented_shape() {
         a.run_as("user:bob", &["proposal", "review", &p, "--approve"]).ok();
         a.ag(&["integrate", &p]).ok();
     };
-    land("docs.md", "d\n", "docs");
+    land("docs.md", "1\n2\n3\n4\n5\n6\n7\n8\n", "docs");
     r.rec("sync", &a.ag(&["--json", "sync", "--workspace", "side"]).ok()); // fast-forward
     r.rec("sync", &a.ag(&["--json", "sync", "--workspace", "side"]).ok()); // up to date
     fs::write(ws.join("side.txt"), "s\n").unwrap();
     a.ag(&["snapshot", "-m", "side", "--workspace", "side"]).ok();
-    land("docs.md", "d2\n", "docs 2");
+    land("docs.md", "1\n2\nd2\n4\n5\n6\n7\n8\n", "docs 2");
     r.rec("sync", &a.ag(&["--json", "sync", "--workspace", "side"]).ok()); // merged
-    fs::write(ws.join("docs.md"), "side's d\n").unwrap();
+    fs::write(ws.join("docs.md"), "1\n2\nside's d\n4\n5\n6\n7\n8\n").unwrap();
     a.ag(&["snapshot", "-m", "side docs", "--workspace", "side"]).ok();
-    land("docs.md", "d3\n", "docs 3");
+    fs::rename(a.root().join("docs.md"), a.root().join("renamed.md")).unwrap();
+    land("renamed.md", "1\n2\nd3\n4\n5\n6\n7\n8\n", "docs 3");
     r.rec("sync", &a.ag(&["--json", "sync", "--workspace", "side"]).code_is(4)); // conflicted
     r.rec("status", &a.ag(&["--json", "status", "--workspace", "side"]).ok()); // a workspace with a base and a pending merge
     r.rec("workspace remove", &a.ag(&["--json", "workspace", "remove", "side"]).ok());
diff --git a/crates/ag-cli/tests/remote.rs b/crates/ag-cli/tests/remote.rs
index 70252983..09a48142 100644
--- a/crates/ag-cli/tests/remote.rs
+++ b/crates/ag-cli/tests/remote.rs
@@ -683,3 +683,43 @@ fn remote_private_review_drafts_require_inspected_versions_and_do_not_publish()
             .unwrap();
     assert!(after["reviews"].as_array().unwrap().is_empty());
 }
+
+#[test]
+fn remote_renamed_conflicts_expose_each_source_without_guessing() {
+    let srv = Server::start();
+    let repo = "acme/renamed-conflict";
+    srv.app
+        .repos
+        .create(repo, "main", "", &ag_types::Identity::new("system:test").unwrap(), Default::default())
+        .unwrap();
+    let token = srv.user("user:alice", repo, Role::Admin);
+    let url = format!("{}/{repo}", srv.url);
+    let a = tempfile::tempdir().unwrap();
+    ok(ag(a.path(), "user:alice", &token, &["init", "--namespace", repo]));
+    ok(ag(a.path(), "user:alice", &token, &["remote", "add", "origin", &url, "--token-env", "AG_TOKEN"]));
+    fs::write(a.path().join("a.txt"), "1\n2\n3\n4\n5\n6\n7\n8\n").unwrap();
+    ok(ag(a.path(), "user:alice", &token, &["snapshot", "-m", "base"]));
+    let base = proposal_id(&ok(ag(a.path(), "user:alice", &token, &["push", "-t", "base"])));
+    ok(ag(a.path(), "user:alice", &token, &["remote", "integrate", &base]));
+    ok(ag(a.path(), "user:alice", &token, &["pull"]));
+    let b = tempfile::tempdir().unwrap();
+    let clone = b.path().join("clone");
+    ok(ag(b.path(), "user:alice", &token, &["clone", &url, clone.to_str().unwrap()]));
+    fs::write(clone.join("a.txt"), "1\n2\nPROPOSAL\n4\n5\n6\n7\n8\n").unwrap();
+    ok(ag(&clone, "user:alice", &token, &["snapshot", "-m", "proposal edit"]));
+    let proposal = proposal_id(&ok(ag(&clone, "user:alice", &token, &["push", "-t", "proposal edit"])));
+    fs::rename(a.path().join("a.txt"), a.path().join("b.txt")).unwrap();
+    fs::write(a.path().join("b.txt"), "1\n2\nSTREAM\n4\n5\n6\n7\n8\n").unwrap();
+    ok(ag(a.path(), "user:alice", &token, &["snapshot", "-m", "rename and edit"]));
+    let renamed = proposal_id(&ok(ag(a.path(), "user:alice", &token, &["push", "-t", "rename and edit"])));
+    ok(ag(a.path(), "user:alice", &token, &["remote", "integrate", &renamed]));
+    for command in ["prepare", "integrate", "explain"] {
+        let output = ag(a.path(), "user:alice", &token, &["remote", command, &proposal]);
+        assert_eq!(output.status.code(), Some(4), "{}", text(&output));
+        assert!(text(&output).contains("source paths: base=a.txt, ours=b.txt, theirs=a.txt"), "{}", text(&output));
+    }
+    let output = ag(a.path(), "user:alice", &token, &["--json", "remote", "prepare", &proposal]);
+    assert_eq!(output.status.code(), Some(4), "{}", text(&output));
+    let detail: Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(detail["conflicts"][0]["origin"], serde_json::json!({"base":"a.txt", "ours":"b.txt", "theirs":"a.txt"}));
+}
diff --git a/crates/ag-integrate/src/lib.rs b/crates/ag-integrate/src/lib.rs
index 5c4340b3..00e32ea8 100644
--- a/crates/ag-integrate/src/lib.rs
+++ b/crates/ag-integrate/src/lib.rs
@@ -70,7 +70,7 @@ pub use storage::{
     MAX_S3_LIST_PAGE, MAX_S3_REQUEST_TIMEOUT_SECS, MAX_S3_RETRIES, MetaConfig, ObjectLockKind, ObjectsConfig,
     StorageConfig,
 };
-pub use types::{Blocker, ConflictInfo, IntegrationResult, NoteInfo, Outcome, Strategy};
+pub use types::{Blocker, ConflictInfo, ConflictOriginInfo, IntegrationResult, NoteInfo, Outcome, Strategy};
 pub use virtual_ws::{VirtualChange, VirtualContent};
 pub use workspace::{Change, SyncOutcome};
 
diff --git a/crates/ag-integrate/src/types.rs b/crates/ag-integrate/src/types.rs
index 9ef51ad8..cec41dcc 100644
--- a/crates/ag-integrate/src/types.rs
+++ b/crates/ag-integrate/src/types.rs
@@ -16,6 +16,17 @@ pub enum Strategy {
     AlreadyIntegrated,
 }
 
+/// Source locations for a conflict whose versions moved to different paths.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ConflictOriginInfo {
+    /// Path in the common merge base.
+    pub base: String,
+    /// Path in the first parent (workspace for sync, target stream for integration).
+    pub ours: String,
+    /// Path in the second parent (stream for sync, proposal for integration).
+    pub theirs: String,
+}
+
 /// One conflicting path.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ConflictInfo {
@@ -29,12 +40,24 @@ pub struct ConflictInfo {
     /// existed have none.
     #[serde(default)]
     pub message: String,
+    /// Exact per-version paths when a rename moved the source; absent for ordinary conflicts and legacy outcomes.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub origin: Option<ConflictOriginInfo>,
 }
 
 impl ConflictInfo {
     /// The wire description of a merge conflict.
     pub fn from_conflict(c: &ag_merge::Conflict) -> Self {
-        ConflictInfo { path: c.path.to_string(), kind: c.kind.code().to_string(), message: c.kind.to_string() }
+        ConflictInfo {
+            path: c.path.to_string(),
+            kind: c.kind.code().to_string(),
+            message: c.kind.to_string(),
+            origin: c.origin.as_ref().map(|o| ConflictOriginInfo {
+                base: o.base.to_string(),
+                ours: o.ours.to_string(),
+                theirs: o.theirs.to_string(),
+            }),
+        }
     }
 
     /// What to show a person: the message, or the code for an outcome stored before messages existed.
diff --git a/crates/ag-integrate/tests/conflict_origins.rs b/crates/ag-integrate/tests/conflict_origins.rs
new file mode 100644
index 00000000..58cb6feb
--- /dev/null
+++ b/crates/ag-integrate/tests/conflict_origins.rs
@@ -0,0 +1,23 @@
+//! Rename-aware conflicts retain source locations when converted or persisted.
+use ag_integrate::ConflictInfo;
+use ag_merge::{Conflict, ConflictKind, ConflictOrigin};
+use ag_types::RepoPath;
+use serde_json::json;
+
+#[test]
+fn conflict_conversion_preserves_all_three_source_paths_and_reads_legacy_outcomes() {
+    let path = |value| RepoPath::new(value).unwrap();
+    let conflict = Conflict {
+        path: path("new.txt"),
+        kind: ConflictKind::Content { regions: 1 },
+        origin: Some(ConflictOrigin { base: path("old.txt"), ours: path("new.txt"), theirs: path("old.txt") }),
+    };
+    let converted = ConflictInfo::from_conflict(&conflict);
+    let encoded = serde_json::to_value(&converted).unwrap();
+    assert_eq!(encoded["origin"], json!({"base":"old.txt","ours":"new.txt","theirs":"old.txt"}));
+    let decoded: ConflictInfo = serde_json::from_value(encoded).unwrap();
+    assert_eq!(decoded, converted);
+    let legacy: ConflictInfo = serde_json::from_value(json!({"path":"file","kind":"content"})).unwrap();
+    assert_eq!(legacy.describe(), "content");
+    assert!(serde_json::to_value(legacy).unwrap().get("origin").is_none_or(|v| v.is_null()));
+}
diff --git a/crates/ag-mcp/src/tools/workspace.rs b/crates/ag-mcp/src/tools/workspace.rs
index 2fc02b24..47453d3f 100644
--- a/crates/ag-mcp/src/tools/workspace.rs
+++ b/crates/ag-mcp/src/tools/workspace.rs
@@ -394,7 +394,7 @@ fn sync_output(name: &str, value: &Value) -> ToolOutput {
     if status == "conflicted" {
         let pinned = value.get("stream_head").and_then(Value::as_str).is_some_and(|head| !head.is_empty());
         let advice = if pinned {
-            "Read both versions at the returned stream_head and your workspace revision. Decide every conflicting path, then repeat workspace_sync with expected_stream_head set to that inspected stream_head and resolutions for every conflict. Existing blob ids preserve binary content, file type and executable mode."
+            "Read both versions at the returned stream_head and your workspace revision. When a conflict has origin paths, read origin.ours at your workspace revision and origin.theirs at stream_head; otherwise use the conflict path. Decide every conflicting path, then repeat workspace_sync with expected_stream_head set to that inspected stream_head and resolutions for every conflict. Existing blob ids preserve binary content, file type and executable mode."
         } else {
             "This server did not identify a pinned branch revision. Upgrade it before applying an inspected resolution through MCP, or resolve through the local CLI. Do not treat the moving branch name as the reviewed revision."
         };
@@ -600,6 +600,21 @@ mod tests {
         }
         assert!(parse_resolutions(&[json!({"path":"a","content":""}), json!({"path":"a","op":"delete"})]).is_err());
     }
+    #[test]
+    fn sync_preserves_renamed_conflict_source_paths() {
+        let conflict = json!({"path":"renamed.txt","kind":"content","message":"both edited",
+            "origin":{"base":"original.txt","ours":"renamed.txt","theirs":"original.txt"}});
+        let legacy = json!({"path":"same.txt","kind":"content","message":""});
+        let out = sync_output(
+            "work",
+            &json!({"status":"conflicted","stream_head":"known",
+            "conflicts":[conflict.clone(),legacy.clone()]}),
+        );
+        assert_eq!(out.data["conflicts"], json!([conflict, legacy]));
+        assert!(out.notes.join(" ").contains("origin.ours"));
+        assert!(out.notes.join(" ").contains("origin.theirs"));
+    }
+
     #[test]
     fn sync_guidance_never_treats_an_absent_target_as_a_safe_pin() {
         let legacy = sync_output("work", &json!({"status":"conflicted","conflicts":[]}));
diff --git a/crates/ag-protocol/proto/agwp/v1/agwp.proto b/crates/ag-protocol/proto/agwp/v1/agwp.proto
index 8c24f64e..ddb1b52a 100644
--- a/crates/ag-protocol/proto/agwp/v1/agwp.proto
+++ b/crates/ag-protocol/proto/agwp/v1/agwp.proto
@@ -880,6 +880,13 @@ message CloseProposalRequest {
 // Integration
 // ---------------------------------------------------------------------------
 
+// Exact paths at the three revisions when source locations differ after a rename.
+message ConflictOrigin {
+  string base = 1;
+  string ours = 2;
+  string theirs = 3;
+}
+
 message Conflict {
   string path = 1;
   // A stable code: "content", "both_added", "delete_modify", "binary", "type_change",
@@ -891,6 +898,11 @@ message Conflict {
   // The conflict in words, with the details the code leaves out (e.g. "content conflict (2 region(s))").
   // Empty for outcomes stored before the field existed. Do not parse it.
   string message = 3;
+  // Absent for ordinary same-path conflicts or outcomes stored by older versions.
+  // For workspace sync, ours is the workspace and theirs is the returned stream_head.
+  // For proposal preparation/integration, ours is the stream and theirs is the proposal.
+  // The resolution is still written to Conflict.path, not to these source paths.
+  ConflictOrigin origin = 4;
 }
 
 message Blocker {
diff --git a/crates/ag-protocol/src/lib.rs b/crates/ag-protocol/src/lib.rs
index 3ad010e9..1f969548 100644
--- a/crates/ag-protocol/src/lib.rs
+++ b/crates/ag-protocol/src/lib.rs
@@ -97,6 +97,9 @@ pub mod features {
     /// Virtual sync compares the branch revision inspected by a resolving client.
     pub const WORKSPACES_SYNC_PRECONDITION: &str = "workspaces.sync_precondition";
 
+    /// Virtual sync conflicts retain exact per-side paths after renames.
+    pub const WORKSPACES_CONFLICT_ORIGINS: &str = "workspaces.conflict_origins";
+
     /// Private versioned review drafts for the current acting identity.
     pub const PROPOSALS_REVIEW_DRAFTS: &str = "proposals.review_drafts";
 
@@ -105,6 +108,7 @@ pub mod features {
         EVENTS_REPLAY,
         WORKSPACES_VIRTUAL,
         WORKSPACES_SYNC_PRECONDITION,
+        WORKSPACES_CONFLICT_ORIGINS,
         EXECUTION_JOBS,
         OBJECTS_CHUNKED,
         AUTH_OIDC,
diff --git a/crates/ag-server/src/api/convert.rs b/crates/ag-server/src/api/convert.rs
index 004f69ab..923d08bd 100644
--- a/crates/ag-server/src/api/convert.rs
+++ b/crates/ag-server/src/api/convert.rs
@@ -243,7 +243,16 @@ pub fn strategy(s: Strategy) -> &'static str {
 }
 
 pub fn conflict(c: &ag_integrate::ConflictInfo) -> v1::Conflict {
-    v1::Conflict { path: c.path.clone(), kind: c.kind.clone(), message: c.message.clone() }
+    v1::Conflict {
+        path: c.path.clone(),
+        kind: c.kind.clone(),
+        message: c.message.clone(),
+        origin: c.origin.as_ref().map(|o| v1::ConflictOrigin {
+            base: o.base.clone(),
+            ours: o.ours.clone(),
+            theirs: o.theirs.clone(),
+        }),
+    }
 }
 
 pub fn outcome(o: &Outcome) -> v1::IntegrationOutcome {
diff --git a/crates/ag-server/tests/conflict_origins.rs b/crates/ag-server/tests/conflict_origins.rs
new file mode 100644
index 00000000..a33b4988
--- /dev/null
+++ b/crates/ag-server/tests/conflict_origins.rs
@@ -0,0 +1,88 @@
+//! The renamed source is never mistaken for a deleted version by a remote client.
+mod common;
+use ag_protocol::v1::{self, workspace_service_client::WorkspaceServiceClient};
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use common::*;
+use serde_json::{Value, json};
+use tonic::Request;
+
+async fn checked(http: &Http, path: &str, body: Value) -> Value {
+    let result = http.post(path, body).await;
+    assert_eq!(result.status, 200, "{}", result.json);
+    result.json
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn renamed_conflicts_report_exact_sources_for_sync_and_proposal_preparation() {
+    let server = TestServer::start().await;
+    let admin = server.admin();
+    let base = "1\n2\n3\n4\n5\n6\n7\n8\n9\n";
+    let ours = "1\n2\nOURS\n4\n5\n6\n7\n8\n9\n";
+    let theirs = "1\n2\nTHEIRS\n4\n5\n6\n7\n8\n9\n";
+    for workspace_renames in [true, false] {
+        let repo = format!("acme/origins-{workspace_renames}");
+        let root = format!("/v1/repos/{repo}");
+        checked(&admin, "/v1/repos", json!({"name":repo})).await;
+        let (seed, objects) =
+            Client::new(&repo).commit(vec![], "user:admin", "base", &[("old.txt", base.as_bytes())], 1_700_000_000_000);
+        upload(&admin, &repo, &objects).await;
+        checked(&admin, &format!("{root}/proposals"), json!({"stream":"main","head":seed.to_string(),"title":"seed"}))
+            .await;
+        checked(
+            &admin,
+            &format!("{root}/streams/cas"),
+            json!({"stream":"main","expected_version":0,"new_head":seed.to_string()}),
+        )
+        .await;
+        for name in ["ours", "theirs"] {
+            checked(&admin, &format!("{root}/workspaces"), json!({"name":name,"stream":"main"})).await;
+        }
+        let mut heads = Vec::new();
+        for (name, text, renamed) in [("ours", ours, workspace_renames), ("theirs", theirs, !workspace_renames)] {
+            let path = if renamed { "new.txt" } else { "old.txt" };
+            let mut changes = vec![json!({"path":path,"op":"put","content":STANDARD.encode(text)})];
+            if renamed {
+                changes.push(json!({"path":"old.txt","op":"delete"}));
+            }
+            let result =
+                checked(&admin, &format!("{root}/workspaces/{name}/changes"), json!({"changes":changes})).await;
+            heads.push(result["head"].as_str().unwrap().to_owned());
+        }
+        checked(&admin, &format!("{root}/proposals"), json!({"stream":"main","head":heads[1],"title":"stream edit"}))
+            .await;
+        checked(
+            &admin,
+            &format!("{root}/streams/cas"),
+            json!({"stream":"main","expected_version":1,"expected_head":seed.to_string(),"new_head":heads[1]}),
+        )
+        .await;
+        let result =
+            checked(&admin, &format!("{root}/workspaces/ours/sync"), json!({"expected_stream_head":heads[1]})).await;
+        let ours_path = if workspace_renames { "new.txt" } else { "old.txt" };
+        let theirs_path = if workspace_renames { "old.txt" } else { "new.txt" };
+        assert_eq!(result["status"], "conflicted");
+        assert_eq!(result["conflicts"][0]["path"], "new.txt");
+        assert_eq!(result["conflicts"][0]["origin"], json!({"base":"old.txt","ours":ours_path,"theirs":theirs_path}));
+        assert_eq!(admin.get(&format!("{root}/workspaces/ours")).await.json["head"], heads[0]);
+        let mut grpc = WorkspaceServiceClient::connect(server.base.clone()).await.unwrap();
+        let mut request = Request::new(v1::SyncWorkspaceRequest {
+            repo: repo.clone(),
+            name: "ours".into(),
+            expected_stream_head: heads[1].clone(),
+            ..Default::default()
+        });
+        request.metadata_mut().insert("authorization", format!("Bearer {}", admin.token).parse().unwrap());
+        let response = grpc.sync(request).await.unwrap().into_inner();
+        assert_eq!(serde_json::to_value(response).unwrap()["conflicts"][0]["origin"], result["conflicts"][0]["origin"]);
+        let proposal = checked(
+            &admin,
+            &format!("{root}/proposals"),
+            json!({"stream":"main","head":heads[0],"title":"rename conflict"}),
+        )
+        .await;
+        let prepared =
+            checked(&admin, &format!("{root}/proposals/{}/prepare", proposal["id"].as_str().unwrap()), json!({})).await;
+        assert_eq!(prepared["conflicts"][0]["origin"], json!({"base":"old.txt","ours":theirs_path,"theirs":ours_path}));
+    }
+    server.stop().await;
+}
diff --git a/docs/adr/0039-conflict-source-paths.md b/docs/adr/0039-conflict-source-paths.md
new file mode 100644
index 00000000..64806b5f
--- /dev/null
+++ b/docs/adr/0039-conflict-source-paths.md
@@ -0,0 +1,35 @@
+# ADR 0039: exact source paths in renamed conflicts
+
+Status: accepted.
+
+## Context
+
+The merge engine already records where each version lives when a rename moves a conflicting
+file. Conflict responses discarded those locations. A browser fetching both versions at the
+output path could therefore mistake a renamed version for a deletion and resolve with the
+wrong content.
+
+## Decision
+
+Preserve the engine's optional `origin` object through core conflict records and HTTP/gRPC:
+`base`, `ours` and `theirs` are exact, nonempty repository paths. `Conflict.path` remains the
+output location for the resolution. Ordinary same-path conflicts have no origin; older stored
+outcomes also remain readable without one. No merge algorithm or metadata schema changes.
+
+The labels refer to merge inputs. For virtual workspace sync, ours is the workspace head and
+theirs is the returned stream head. For proposal preparation and integration, ours is the
+stream and theirs is the proposal. CLI, SDK and MCP expose those source paths without parsing
+the human-readable conflict description.
+
+The browser requires `workspaces.conflict_origins` before opening the resolver, reads each
+side from its exact source path and previews differing locations. It continues to resolve at
+the output path with existing branch/proposal head preconditions. Rename/delete is a
+single-output-path choice and can use the same flow; rename/rename and file/directory cases
+remain unavailable there until a complete multi-path choice is designed.
+
+## Validation
+
+Core serialization tests preserve all three paths and read old records. Real HTTP/gRPC tests
+exercise both rename orientations and the inverted inputs of proposal preparation. Browser
+coverage selects the side whose file does not exist at the output path and checks the final
+blob; it also covers rename/delete on either side.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 9c577d93..0f4ed311 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -52,3 +52,5 @@ which test: [ADR traceability](../architecture/adr-traceability.md).
 - [0037 — Pinned workspace sync](0037-pinned-workspace-sync.md)
 
 - [0038 — Private review drafts](0038-private-review-drafts.md)
+
+- [0039 — Exact conflict source paths](0039-conflict-source-paths.md)
diff --git a/docs/guides/web-ui.md b/docs/guides/web-ui.md
index daa69305..5d67979c 100644
--- a/docs/guides/web-ui.md
+++ b/docs/guides/web-ui.md
@@ -403,12 +403,15 @@ conflict* (everyone else sees *Copy link to send to the author*). The resolver s
 yours, with *Keep the branch's*, *Keep mine*, *Delete the file* and a text box for the result. Saving applies the
 resolutions through the draft and moves the change request to the merged version. Binary files, oversized files and
 file-type changes can keep either exact version or delete the file: the original blob, type and executable mode are
-retained without converting bytes to text. Editing is available only for regular text versions. Renames and
-file/directory conflicts remain command-line work.
+retained without converting bytes to text. Editing is available only for regular text versions. Conflicts requiring multiple output paths,
+including rename/rename and file/directory conflicts, remain command-line work. After a rename, each preview reads its original
+source path and displays it when it differs from the result path. Rename/delete conflicts allow
+an explicit choice between the relocated file and deletion. Servers must advertise
+`workspaces.conflict_origins`; older servers show upgrade guidance instead of ambiguous previews.
 
 The resolver pins both the proposal revision and the target branch. If either changes before saving, the newer
 work is preserved and the dialog asks you to inspect it again. Failed reads never mean a deleted file. This flow
-requires `proposals.update_head` and `workspaces.sync_precondition`; older servers need an upgrade before browser
+requires `proposals.update_head`, `workspaces.sync_precondition` and `workspaces.conflict_origins`; older servers need an upgrade before browser
 conflict resolution is available.
 
 ## Plain words
diff --git a/docs/protocol/agwp-v1.md b/docs/protocol/agwp-v1.md
index 48211c98..8804cb83 100644
--- a/docs/protocol/agwp-v1.md
+++ b/docs/protocol/agwp-v1.md
@@ -405,3 +405,14 @@ but it never pins history or bypasses the actual review's inspected-head check.
 
 Schema 10 stores this private metadata. Back up before upgrading; saved review drafts
 can appear in administrative backups even though they are not in shared proposal APIs.
+
+### Conflict source paths after renames
+
+`Conflict.origin`, when present, contains the nonempty repository paths `base`, `ours` and
+`theirs` where the three versions live. `Conflict.path` remains the output path to resolve.
+For workspace sync, `ours` is the workspace and `theirs` is the returned `stream_head`;
+for proposal preparation/integration the labels mean target stream and proposal respectively.
+Read each version at its source path instead of treating a missing output path as a deletion.
+Ordinary same-path conflicts and legacy stored outcomes have no origin. Never parse paths
+from `message`. Development servers advertise `workspaces.conflict_origins` for fresh sync
+responses; browser resolution requires it together with the existing revision preconditions.
diff --git a/docs/protocol/openapi.json b/docs/protocol/openapi.json
index 7b3dfc63..1606aa1d 100644
--- a/docs/protocol/openapi.json
+++ b/docs/protocol/openapi.json
@@ -867,6 +867,18 @@
             "description": "The conflict in words, with the details the code leaves out (e.g. \"content conflict (2 region(s))\").\nEmpty for outcomes stored before the field existed. Do not parse it.",
             "type": "string"
           },
+          "origin": {
+            "default": null,
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/ConflictOrigin",
+                "description": "Absent for ordinary same-path conflicts or outcomes stored by older versions.\nFor workspace sync, ours is the workspace and theirs is the returned stream_head.\nFor proposal preparation/integration, ours is the stream and theirs is the proposal.\nThe resolution is still written to Conflict.path, not to these source paths."
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
           "path": {
             "default": "",
             "type": "string"
@@ -874,6 +886,24 @@
         },
         "type": "object"
       },
+      "ConflictOrigin": {
+        "description": "Exact paths at the three revisions when source locations differ after a rename.",
+        "properties": {
+          "base": {
+            "default": "",
+            "type": "string"
+          },
+          "ours": {
+            "default": "",
+            "type": "string"
+          },
+          "theirs": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "CreateIssueRequest": {
         "properties": {
           "body": {
diff --git a/docs/reference/cli-json.md b/docs/reference/cli-json.md
index 1347b11d..6577615d 100644
--- a/docs/reference/cli-json.md
+++ b/docs/reference/cli-json.md
@@ -2131,6 +2131,11 @@ Their output *is* the data (file contents, a template, a script, a man page, hel
     {
       "kind": "string",
       "message": "string",
+      "origin": {
+        "base": "string",
+        "ours": "string",
+        "theirs": "string"
+      },
       "path": "string"
     }
   ],
diff --git a/proto/agwp/v1/agwp.proto b/proto/agwp/v1/agwp.proto
index 8c24f64e..ddb1b52a 100644
--- a/proto/agwp/v1/agwp.proto
+++ b/proto/agwp/v1/agwp.proto
@@ -880,6 +880,13 @@ message CloseProposalRequest {
 // Integration
 // ---------------------------------------------------------------------------
 
+// Exact paths at the three revisions when source locations differ after a rename.
+message ConflictOrigin {
+  string base = 1;
+  string ours = 2;
+  string theirs = 3;
+}
+
 message Conflict {
   string path = 1;
   // A stable code: "content", "both_added", "delete_modify", "binary", "type_change",
@@ -891,6 +898,11 @@ message Conflict {
   // The conflict in words, with the details the code leaves out (e.g. "content conflict (2 region(s))").
   // Empty for outcomes stored before the field existed. Do not parse it.
   string message = 3;
+  // Absent for ordinary same-path conflicts or outcomes stored by older versions.
+  // For workspace sync, ours is the workspace and theirs is the returned stream_head.
+  // For proposal preparation/integration, ours is the stream and theirs is the proposal.
+  // The resolution is still written to Conflict.path, not to these source paths.
+  ConflictOrigin origin = 4;
 }
 
 message Blocker {
diff --git a/sdk/python/README.md b/sdk/python/README.md
index ebb88b98..33171910 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -545,3 +545,9 @@ clear it with that guard. A conflict preserves the newer draft. The authenticate
 owns the notes; there is no owner argument. Drafts never post reviews or count as approval.
 Clearing removes content but retains a version, preventing stale saves from recreating it.
 Identical retries are safe; reread and decide before changing a conflicting draft.
+
+Servers advertising `workspaces.conflict_origins` may include `conflict.origin` with
+`base`, `ours`, and `theirs` source paths when a rename moved the file. During workspace
+sync, read `origin.ours` at the workspace head and `origin.theirs` at `stream_head`;
+resolve at `conflict.path`. Without origin metadata, both sides use `conflict.path`.
+For proposal preparation and integration, ours is the target stream and theirs is the proposal.
diff --git a/sdk/python/src/agentgit/_generated/models.py b/sdk/python/src/agentgit/_generated/models.py
index 6d25dbe5..15d04670 100644
--- a/sdk/python/src/agentgit/_generated/models.py
+++ b/sdk/python/src/agentgit/_generated/models.py
@@ -35,6 +35,7 @@
     "CompleteRunRequest",
     "ConfigureRepoRequest",
     "Conflict",
+    "ConflictOrigin",
     "CreateIssueRequest",
     "CreateProposalRequest",
     "CreateRepoRequest",
@@ -526,9 +527,18 @@ class Conflict:
     """The `Conflict` message."""
     kind: str = field(default="")
     message: str = field(default="")
+    origin: ConflictOrigin | None = field(default=None)
     path: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class ConflictOrigin:
+    """Exact paths at the three revisions when source locations differ after a rename."""
+    base: str = field(default="")
+    ours: str = field(default="")
+    theirs: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class CreateIssueRequest:
     """The `CreateIssueRequest` message."""
diff --git a/sdk/python/src/agentgit/_generated/namespaces.py b/sdk/python/src/agentgit/_generated/namespaces.py
index b697c4fb..a71fc4bc 100644
--- a/sdk/python/src/agentgit/_generated/namespaces.py
+++ b/sdk/python/src/agentgit/_generated/namespaces.py
@@ -35,6 +35,7 @@
     CompleteRunRequest,
     ConfigureRepoRequest,
     Conflict,
+    ConflictOrigin,
     CreateIssueRequest,
     CreateProposalRequest,
     CreateRepoRequest,
diff --git a/sdk/python/tests/test_sync_precondition.py b/sdk/python/tests/test_sync_precondition.py
index 5b7711f9..3460dc3d 100644
--- a/sdk/python/tests/test_sync_precondition.py
+++ b/sdk/python/tests/test_sync_precondition.py
@@ -96,3 +96,34 @@ def respond(request: httpx.Request) -> httpx.Response:
         )
     assert result.head == "done"
     assert calls == 2
+
+
+def test_sync_preserves_renamed_conflict_sources_and_legacy_conflicts() -> None:
+    def respond(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            json={
+                "status": "conflicted",
+                "head": "workspace",
+                "stream_head": "stream",
+                "conflicts": [
+                    {
+                        "path": "renamed.txt",
+                        "kind": "content",
+                        "message": "both edited",
+                        "origin": {"base": "original.txt", "ours": "renamed.txt", "theirs": "original.txt"},
+                    },
+                    {"path": "same.txt", "kind": "content", "message": ""},
+                ],
+            },
+        )
+
+    with AgentGitClient(
+        "http://sync.test", "test", http_client=httpx.Client(transport=httpx.MockTransport(respond))
+    ) as client:
+        result = client.workspaces.sync(repo="team/app", name="work")
+    assert result.conflicts[0].origin is not None
+    assert result.conflicts[0].origin.base == "original.txt"
+    assert result.conflicts[0].origin.ours == "renamed.txt"
+    assert result.conflicts[0].origin.theirs == "original.txt"
+    assert result.conflicts[1].origin is None
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index 2c47c782..685d1a57 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -505,3 +505,9 @@ Drafts belong to the authenticated actor, not an owner parameter; they never pos
 count as approval or notify reviewers. Clearing removes the content and retains a version
 so stale saves cannot recreate it. Retrying an identical save/clear is safe; reread before
 changing a conflicting draft rather than automatically overwriting it.
+
+Servers advertising `workspaces.conflict_origins` may include `conflict.origin` with
+`base`, `ours`, and `theirs` source paths when a rename moved the file. During workspace
+sync, read `origin.ours` at the workspace head and `origin.theirs` at `stream_head`;
+resolve at `conflict.path`. Without origin metadata, both sides use `conflict.path`.
+For proposal preparation and integration, ours is the target stream and theirs is the proposal.
diff --git a/sdk/typescript/scripts/generate.mjs b/sdk/typescript/scripts/generate.mjs
index f6b9a71e..97431dd3 100644
--- a/sdk/typescript/scripts/generate.mjs
+++ b/sdk/typescript/scripts/generate.mjs
@@ -242,10 +242,11 @@ function withOpenObjects(doc) {
     target.$ref = ref;
   }
   // Decoded responses are not default-filled in TypeScript. Older servers omit this additive field;
-  // preserve the schema's optionality instead of letting its default [] make it required.
+  // preserve the schema's optionality instead of letting its default make it required.
   for (const [schemaName, field] of [
     ['ProposalDetail', 'requested_reviewers'],
     ['SyncWorkspaceResponse', 'stream_head'],
+    ['Conflict', 'origin'],
   ]) {
     const schema = copy.components.schemas[schemaName];
     const property = schema?.properties?.[field];
diff --git a/sdk/typescript/src/generated/models.ts b/sdk/typescript/src/generated/models.ts
index ff68772c..241a8d38 100644
--- a/sdk/typescript/src/generated/models.ts
+++ b/sdk/typescript/src/generated/models.ts
@@ -34,6 +34,7 @@ export type CompleteJobRequest = S['CompleteJobRequest'];
 export type CompleteRunRequest = S['CompleteRunRequest'];
 export type ConfigureRepoRequest = S['ConfigureRepoRequest'];
 export type Conflict = S['Conflict'];
+export type ConflictOrigin = S['ConflictOrigin'];
 export type CreateIssueRequest = S['CreateIssueRequest'];
 export type CreateProposalRequest = S['CreateProposalRequest'];
 export type CreateRepoRequest = S['CreateRepoRequest'];
diff --git a/sdk/typescript/src/generated/schema.ts b/sdk/typescript/src/generated/schema.ts
index 0d7f0b90..d983a6cc 100644
--- a/sdk/typescript/src/generated/schema.ts
+++ b/sdk/typescript/src/generated/schema.ts
@@ -2141,9 +2141,19 @@ export interface components {
              * @default
              */
             message: string;
+            origin?: components["schemas"]["ConflictOrigin"] | null;
             /** @default  */
             path: string;
         };
+        /** @description Exact paths at the three revisions when source locations differ after a rename. */
+        ConflictOrigin: {
+            /** @default  */
+            base: string;
+            /** @default  */
+            ours: string;
+            /** @default  */
+            theirs: string;
+        };
         CreateIssueRequest: {
             /** @default  */
             body: string;
diff --git a/sdk/typescript/test/sync-precondition.test.ts b/sdk/typescript/test/sync-precondition.test.ts
index c74125e6..a5f65243 100644
--- a/sdk/typescript/test/sync-precondition.test.ts
+++ b/sdk/typescript/test/sync-precondition.test.ts
@@ -1,5 +1,5 @@
 import { expect, it } from 'vitest';
-import { AgentGitClient, type SyncWorkspaceResponse } from '../src/index.js';
+import { AgentGitClient, type Conflict, type SyncWorkspaceResponse } from '../src/index.js';
 
 it('sends the inspected stream head with a workspace resolution', async () => {
   let body: unknown;
@@ -73,3 +73,22 @@ it('retains explicit unsafe-retry opt-in for an unpinned sync', async () => {
   ).resolves.toMatchObject({ head: 'done' });
   expect(calls).toBe(2);
 });
+
+it('preserves distinct source paths for a renamed conflict and accepts legacy conflicts', async () => {
+  const conflict: Conflict = {
+    path: 'renamed.txt',
+    kind: 'content',
+    message: 'both edited',
+    origin: { base: 'original.txt', ours: 'renamed.txt', theirs: 'original.txt' },
+  };
+  const legacy: Conflict = { path: 'same.txt', kind: 'content', message: '' };
+  const client = new AgentGitClient({
+    baseUrl: 'http://sync.test',
+    token: 'test',
+    fetch: async () =>
+      Response.json({ status: 'conflicted', head: 'workspace', stream_head: 'stream', conflicts: [conflict, legacy] }),
+  });
+  const result = await client.workspaces.sync({ repo: 'team/app', name: 'work' });
+  expect(result.conflicts[0]?.origin).toEqual(conflict.origin);
+  expect(result.conflicts[1]?.origin).toBeUndefined();
+});

From dc7f76811f0bb7f00d6775458cb2ea70aa80bcbb Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 21:41:10 +0000
Subject: [PATCH 12/41] feat(onboarding): simplify installation and the first
 reviewed change

Choose a published prerelease when no stable exists, preserve verification and explain exact launch/PATH steps. Rewrite both READMEs and getting-started around a verified beta.7 workflow instead of release chronology.

Validated: 54 release-tool tests, ShellCheck, five killed shell mutations, isolated published archive installation and full first-change smoke, README quickstart and documentation checks.
---
 CHANGELOG.md                        |   2 +
 README.md                           | 426 +++++++++------------------
 README.ru.md                        | 436 ++++++++--------------------
 docs/assets/ui-review-workspace.png | Bin 0 -> 138642 bytes
 docs/getting-started.md             | 408 ++++++++++----------------
 scripts/install.sh                  |  49 +++-
 scripts/test_release_scripts.py     |  80 +++++
 7 files changed, 519 insertions(+), 882 deletions(-)
 create mode 100644 docs/assets/ui-review-workspace.png

diff --git a/CHANGELOG.md b/CHANGELOG.md
index aaa12018..252e1501 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,6 +32,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Changed
 
+- Installation now prefers a stable release and explicitly falls back to a published prerelease when no stable exists. It prints a runnable local-demo command and safe PATH guidance; both READMEs and the getting-started guide lead with a verified install-to-first-change path.
+
 - The review workspace puts changed code first, keeps Review and Land in the header, and moves secondary actions and context into a quieter side panel. Phone layouts use a compact readiness strip and file navigation. All review, validation and permission states remain available.
 
 ## [0.3.0-beta.7] - 2026-10-29
diff --git a/README.md b/README.md
index 90d1eb86..9b2fab5c 100644
--- a/README.md
+++ b/README.md
@@ -1,68 +1,154 @@
-<div align="center">
+# AgentGit
 
-<img src="docs/assets/hero.svg" alt="AgentGit: source control for a world where agents write code too. Four independent verdicts per change: Mergeable, Validated, Approved, Integrated." width="100%">
+**Source control for people and coding agents.**
 
-<br>
+Give agents bounded work, review the exact result, and land changes under rules your repository enforces.
+AgentGit brings a local CLI, a self-hosted Web UI, agent tools and CI together around one review workflow.
 
 [![CI](https://img.shields.io/github/actions/workflow/status/Paffin/AgentGit/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/Paffin/AgentGit/actions/workflows/ci.yml)
-[![Docs](https://img.shields.io/github/actions/workflow/status/Paffin/AgentGit/docs.yml?branch=main&style=flat-square&label=docs)](docs/README.md)
+[![Release](https://img.shields.io/github/v/release/Paffin/AgentGit?include_prereleases&style=flat-square)](https://github.com/Paffin/AgentGit/releases)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue?style=flat-square)](LICENSE)
-[![Status: beta](https://img.shields.io/badge/status-beta-blue?style=flat-square)](#status-and-limits)
 
-**English** · [Русский](README.ru.md) · [Docs](docs/README.md) · [Roadmap](ROADMAP.md) · [Comparison](docs/comparison.md)
+[Get started](#try-agentgit) · [Documentation](docs/README.md) · [Roadmap](ROADMAP.md) · [Русский](README.ru.md)
 
-</div>
+## Try AgentGit
 
-<br>
+Install the published **v0.3.0-beta.7** for Linux (glibc) or macOS, then open a ready-to-use demo.
+No Rust toolchain, Node.js or database setup is needed.
 
-AgentGit is a version control system for repositories that people, coding agents and CI all write to.
+```sh
+curl -fsSL https://raw.githubusercontent.com/Paffin/AgentGit/main/scripts/install.sh | sh -s -- --version 0.3.0-beta.7
+export PATH="$HOME/.local/bin:$PATH"
+ag-server dev --open
+```
+
+The installer verifies the archive checksum and puts the programs in `~/.local/bin`. The server creates a demo
+repository, opens the browser and signs you in. If a browser cannot open automatically, use the link it prints.
+Keep the terminal running; stop with **Ctrl-C**. Restarting preserves the demo data in `./ag-dev-data`.
+
+**In the browser:** open a file, choose **Edit**, propose your change, then review and land it.
+The demo's rules protect `SECURITY.md`, so changing that file shows how a required review blocks landing.
 
-A change lands only when the repository's policy says it may, and the policy is checked in the same transaction that
-moves the branch, so nothing can change between "checked" and "merged". Test results are signed and tied to the exact
-tree they ran on. The final transaction also rechecks the proposal head and open state. Every agent run has its own identity, and every decision ends up in an audit log you can verify.
-The core that stores, merges and recovers never calls a language model; anything smart sits on top and can only propose.
+This demo listens on your machine only and uses temporary development credentials. For a shared server, follow
+[Deployment](docs/operations/deployment.md). For Windows, containers, source builds, a custom install directory or
+manual download verification, see [Install options](docs/getting-started.md#install).
 
-This is an early public beta: [status and limits](#status-and-limits) are below, and nobody but its authors has run it in production.
+## Your first change from the terminal
 
-**Available in the current beta:** repository issues with comments, close/reopen, conflict-safe edits and an atomic handoff to agent tasks with an expected result and explicit file scope. See the [Web UI guide](docs/guides/web-ui.md#repository-issues). Labels, milestones, attachments and provider issue import remain unfinished. Operators can pause and resume new task-bound runs without interrupting existing sessions, and inspect current or historical runs through permanent links. Task creators can reserve a registered agent at creation or reassign queued work; the server and orchestrator enforce the choice. A registered agent still needs a configured executor. The registered-agent view shows expiring executor connection reports and last reported capacity. Its setup wizard prepares repository-scoped credentials and a task executor configuration; host installation remains a separate step. Optional bounded executor output can be viewed, downloaded and deleted from a run page. The current release uses metadata schema 8; take a database backup before upgrading. Older binaries require restoring the pre-upgrade backup.
+With the demo server running, open another terminal in the same starting directory:
 
-**Review in the current beta:** revision-bound line discussions, replies and conflict-safe resolution are shared by Web UI, CLI and MCP. Filter open or resolved threads without losing reply drafts; source anchors retain the exact reviewed revision. CLI JSON response shapes are documented for automation. [Upgrade and rollback guidance](docs/adr/0025-line-review-threads.md).
+```sh
+export PATH="$HOME/.local/bin:$PATH"
+ag login http://127.0.0.1:8080 --token-file ./ag-dev-data/dev/token
+ag clone http://127.0.0.1:8080/demo/welcome
+cd welcome
+printf '\nA change from AgentGit.\n' >> README.md
+ag snapshot -m "Update the readme"
+ag push -t "Update the readme"
+```
 
-**Available since beta.6:** operators can disable or re-enable new runs for an individual agent from the browser or `ag agent disable NAME --remote origin` (`enable` to restore admission). Existing sessions, keys and history are retained. This is included in beta.6 and newer; see [ADR-0026](docs/adr/0026-agent-run-admission.md).
+`ag push` prints the proposal ID and opens the change for review. To land it, use the returned ID:
 
-**Available since beta.6:** Tasks can carry a server-enforced attempt limit. `ag task attempts TASK --max 5 --expected 3` lets an operator extend an exhausted task without losing its history; restart recovery uses durable run records. Zero keeps the existing repository retry policy. Concurrent operator policy changes are protected from stale automatic cancellation, and late results cannot finish a newer task attempt. [Execution limits](docs/adr/0033-task-attempt-limits.md).
+```sh
+ag remote integrate PROPOSAL_ID
+ag pull
+```
 
-**Upgrade:** persistent follow-up task links and durable task execution limits require metadata schema 8. Back up before opening existing repositories with beta.6 or newer; rollback uses the pre-upgrade backup. [Source-link semantics](docs/adr/0027-task-source-links.md).
+If policy blocks a change, `ag remote explain PROPOSAL_ID` names what is missing and the commands that address it.
+The [guided walkthrough](docs/getting-started.md) covers review, agent access and policy rules.
 
-**Development (`main`):** requested reviewers and private account-backed review drafts use
-metadata schema 10. Back up before opening existing repositories with a development build;
-rollback restores that backup. Requests route review work without changing approval policy;
-saving a private draft never submits a review.
-[Requested reviewers](docs/adr/0036-requested-reviewers.md) · [Private drafts](docs/adr/0038-private-review-drafts.md).
+## One workflow, four clear answers
 
-Stream rules can require every line discussion to be resolved before integration, including feedback on earlier revisions.
+A **snapshot** records your work. A **proposal** publishes it for review. **Integration** lands the checked result
+on a **stream** (the shared branch). Each proposal answers four independent questions:
 
-Review threads support proposed line replacements, with explicit author preview and head-checked application.
+| | Question |
+|---|---|
+| **Mergeable** | Can this change combine with the current branch? |
+| **Validated** | Did trusted checks pass on the exact result that would land? |
+| **Approved** | Did eligible reviewers approve the revision being landed? |
+| **Integrated** | Has the shared branch been updated? |
 
-Rules also expose protected-path approvers and check timing without editing JSON; runner settings survive form edits.
+Passing tests does not imply approval. Approval of an old revision does not approve a new one. The server checks
+policy in the transaction that updates the branch; moving code cannot slip between the check and the update.
 
-## Coming from GitHub or GitLab?
+![The review workspace, with changed files in the main area and review controls beside them](docs/assets/ui-review-workspace.png)
 
-Open **Repositories → Import from GitHub / GitLab** to upload a full Git bundle, inspect the branch/tag mapping and publish the verified result. Or run `ag migrate repository.bundle ./project --namespace team/project`. The source stays unchanged, and its original bundle is retained in backups. [Migration guide and metadata limitations](docs/guides/migrate-from-git.md).
+*Development preview: the simplified review workspace above is not yet in beta.7. Published-release details and
+unreleased work are kept separate in the [changelog](CHANGELOG.md) and [roadmap](ROADMAP.md).*
 
-The beta also supports keyboard-driven file finding, recoverable file drafts, and review drafts that stay while you inspect the diff. Web reviews are bound to the exact head you inspected; an author update rejects a stale submission and preserves your text. These changes are included in beta.2 and documented in the [changelog](CHANGELOG.md) and [Web UI guide](docs/guides/web-ui.md).
+## Use the tools you already work with
+
+| Start here | What it gives you |
+|---|---|
+| [Web UI](docs/guides/web-ui.md) | Browse code, edit files, review diffs, discuss changes and manage work. |
+| [CLI](docs/guides/remote.md) | Local repositories, offline snapshots and the same server workflow from your terminal. |
+| [MCP](docs/guides/mcp.md) | Let an agent read, propose and review through explicitly enabled tools. |
+| [TypeScript and Python SDKs](docs/guides/sdks.md) | Build integrations with typed clients for the server API. |
+| [Agents and task execution](docs/guides/agents.md) | Assign scoped work, track runs and control who may land their results. |
+| [CI and workers](docs/guides/validation.md) | Produce signed validation results for the exact candidate tree. |
+
+Agent runs have distinct identities. Stream rules control required checks, reviewers, protected paths and how much
+an agent may change autonomously. An append-only audit trail records decisions. The core merge and policy engine
+does not call a language model. [Concepts](docs/concepts.md) explains the model; [Security](docs/architecture/security.md)
+explains its trust boundaries.
+
+## Bring an existing repository
+
+Create a complete Git bundle, then choose **Repositories → Import from GitHub / GitLab** in the Web UI.
+You can also import locally:
+
+```sh
+git bundle create repository.bundle --all
+ag migrate repository.bundle ./project --namespace team/project
+```
+
+The import previews branch and tag mappings and retains the original bundle. Git export gives you a way back.
+Code and history migrate; issues, comments, pull-request metadata, LFS payloads and CI setup need separate handling.
+Read the [migration guide](docs/guides/migrate-from-git.md) before moving a team.
+
+AgentGit is an early alternative for teams experimenting with policy-controlled agent work. GitHub and GitLab have
+much broader hosting, project management and production experience. [Compare the trade-offs](docs/comparison.md).
+
+## Status and limits
 
-Beta.6 and newer also support editing task instructions before the first run through Web UI, CLI and API, with concurrent-edit protection. This is included in beta.6 and newer. [Task editing](docs/guides/web-ui.md#refine-queued-task-instructions-development).
+**Early public beta.** The current release is [v0.3.0-beta.7](https://github.com/Paffin/AgentGit/releases/tag/v0.3.0-beta.7).
+There is no stable release or published crates.io, npm or PyPI package yet. Native release archives cover Linux and
+macOS on x86_64 and ARM64; the worker sandbox is Linux-only. Windows builds are tested in CI, but a native Windows
+release archive is not yet shipped.
 
-Home keeps queue filters in bookmarkable links and can follow a selected repository live; event bursts share one refresh, while the aggregate view retains bounded polling.
+**Back up before upgrading.** Beta.7 uses metadata schema **8**. The unreleased development code uses schema **10**,
+adding requested reviewers and private account-backed review drafts. Opening a repository with a development build
+can upgrade it; returning to an older binary requires restoring the pre-upgrade backup. See
+[backup and recovery](docs/operations/durability.md) and [release notes](CHANGELOG.md).
 
-Next priorities are complete review workflows and hosting-metadata migration.
-The [roadmap](ROADMAP.md#next) separates delivered features, published releases and remaining qualification.
+**Use it with recoverable data first.** External production qualification and an independent security audit remain
+open. Local mode trusts whoever can write the repository directory. For untrusted clients use the server, and for
+untrusted checks use the [worker sandbox](docs/guides/workers.md), not `ag validate run` on your own shell.
+Keep backups and a Git mirror for data you cannot lose. [Known limits](ROADMAP.md) include hosting-metadata migration,
+LFS and submodules, and qualification on real installations and assistive technology.
+
+## Build and contribute
+
+To work on the CLI, install Rust 1.89 or newer and a C compiler, then:
+
+```sh
+git clone https://github.com/Paffin/AgentGit.git
+cd AgentGit
+cargo install --path crates/ag-cli --locked
+```
+
+See [Contributing](CONTRIBUTING.md) for the server, Web UI, checks and repository conventions.
+For architecture and correctness evidence, start with [the overview](docs/architecture/overview.md),
+[the test strategy](docs/architecture/testing.md) and [the decision records](docs/adr/README.md).
+
+<details>
+<summary>A policy-controlled change, from proposal to integration</summary>
 
 ## See it work
 
-A person, two agents and a CI service share one stream. The output is trimmed from
-[`examples/quickstart.sh`](examples/quickstart.sh), which CI runs on every push and compares line by line with this block.
+This transcript comes from [`examples/quickstart.sh`](examples/quickstart.sh), which CI runs against the CLI.
+It shows an agent being denied, a person being blocked by missing evidence, and the checked change landing:
 
 ```text
 $ ag integrate prop_6eed…                  # as agent:refactor-bot — an agent tries to land code on its own
@@ -88,269 +174,19 @@ strategy: Merge   (algorithm ag-merge/3+ag-diff/1)
 conflict: src/main.rs (content conflict (1 region(s)))                   # exit code 4 — the stream was not touched
 ```
 
-Every refusal says what is missing. Exit code `3` means blocked (supply what is missing and run it again), `4` means refused.
-
-## Install
-
-You need Rust 1.89 or newer and a C compiler (SQLite is built in). Linux, macOS and Windows are built and tested in CI;
-the sandbox and `ag-worker` are Linux-only ([Windows](docs/operations/windows.md)).
-
-```bash
-git clone https://github.com/Paffin/AgentGit && cd AgentGit
-cargo install --path crates/ag-cli          # installs the `ag` binary
-```
-
-The current release target is [`v0.3.0-beta.7`](https://github.com/Paffin/AgentGit/releases/tag/v0.3.0-beta.7). Use the following archives and install commands after its Release workflow completes. Archives contain `ag`, `ag-server`, `ag-worker`, `ag-mcp` and `orchestrator` for Linux and macOS; release verification is tracked by the [Release workflow](https://github.com/Paffin/AgentGit/actions/workflows/release.yml).
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/Paffin/AgentGit/main/scripts/install.sh | sh -s -- --version 0.3.0-beta.7
-docker pull ghcr.io/paffin/agentgit-cli:0.3.0-beta.7
-```
+Exit code `3` means blocked: supply the missing evidence and retry. Exit code `4` means refused.
 
-`--version` is needed while only pre-releases exist. For an existing rc.2 installation, see the [previous rc.2 procedure](docs/getting-started.md#on-020-rc2-until-the-next-release). The [rc.2 verification record](docs/operations/releasing.md) describes that release's checks and limitations; it is not evidence for rc.3. [Install options](docs/getting-started.md#install) has the details.
+</details>
 
-## Quick start
+## Documentation and community
 
-```bash
-mkdir demo && cd demo
-ag init --namespace me/demo                 # creates .ag/ and the stream "main"
-echo "# demo" > README.md
-ag snapshot -m "first"                      # record the directory (not yet visible to others)
-ag propose -t "Initial import"              # verify, publish and open a proposal
-ag integrate <proposal-id>                  # move "main" atomically; any unique id prefix works
-ag log
-```
-
-Next, add a [policy](docs/guides/policy.md), start an [agent](docs/guides/agents.md), or run the whole story with
-`./examples/quickstart.sh`. The full walkthrough is [Getting started](docs/getting-started.md).
-
-### Five minutes with a server, nothing to build
-
-```bash
-ag-server dev                                            # data directory, administrator, demo repository, a sign-in link
-ag login http://127.0.0.1:8080 --token-file ./ag-dev-data/dev/token
-ag clone http://127.0.0.1:8080/demo/welcome              # edit, `ag snapshot`, `ag push -t "my change"`, `ag explain` if refused
-```
-
-`ag-server dev` prints a link that signs you in to the Web UI and the exact commands above. It is an evaluation mode
-(loopback only, plain HTTP, an 8-hour credential), not a deployment. It is included in `v0.3.0-beta.7`. For the previous `v0.2.0-rc.2` archive, [Getting started](docs/getting-started.md#on-020-rc2-until-the-next-release) has the same
-start on rc.2 in a few more lines.
-
-### As a server
-
-```bash
-cargo install --path crates/ag-server
-export AG_BOOTSTRAP_TOKEN=$(openssl rand -hex 32)          # the first administrator's credential
-ag-server admin --data-dir ./ag-data create-repo acme/web
-ag-server admin --data-dir ./ag-data grant --subject user:alice --repo 'acme/*' --role admin
-export AG_TOKEN=$(ag-server admin --data-dir ./ag-data mint --subject user:alice --ttl 86400 | tail -n 1)
-ag-server serve --data-dir ./ag-data &                      # 127.0.0.1:8080, gRPC + HTTP/JSON
-ag clone http://127.0.0.1:8080/acme/web web && cd web      # then edit, `ag snapshot`, `ag push -t "my change"`
-```
-
-The server speaks one protocol, [AGWP v1](docs/protocol/agwp-v1.md), over gRPC and HTTP/JSON on a single port, and serves
-the [Web UI](docs/guides/web-ui.md) on it. Compose, Kubernetes, TLS and PostgreSQL with S3 are covered in
-[Deployment](docs/operations/deployment.md).
-
-## What it does
-
-- Publishes a change in one verified transaction and moves the stream head by compare-and-swap. A crash at any step
-  leaves exactly one outcome; failures are injected at every protocol step in the tests.
-- Merges with a pure, versioned function of base, ours and theirs. Conflicts are typed results reported before anything
-  changes, and a file renamed on one side and edited on the other merges cleanly.
-- Binds validation to the candidate tree. An attestation names the tree, the policy version and the environment, and is
-  signed by an issuer the policy trusts. When the stream moves, the old result stops counting.
-- Keeps a policy per stream: required checks, approvals bound to the reviewed head, protected paths, and an autonomy
-  envelope that says which paths, and how many files, an agent may land without a person.
-- Coordinates agents: an identity per run, tasks, soft and exclusive leases with fencing tokens, conflict prediction and
-  an ordered integration queue.
-- Runs untrusted checks in `ag-worker` inside a sandbox (rootless namespaces or a container) and signs the result.
-- Records an append-only reflog and a hash-chained audit log; `ag verify` checks the whole repository.
-- Imports from and exports to Git with identical tree SHAs, and works fully offline.
-- Ships a [Web UI](docs/guides/web-ui.md), [TypeScript and Python SDKs](docs/guides/sdks.md), an
-  [MCP server](docs/guides/mcp.md) that exposes AgentGit to an agent as tools, and a Go
-  [agent platform](docs/guides/orchestrator.md) that can propose changes but never integrate them.
-
-## How it compares
-
-GitHub, GitLab and Bitbucket are mature hosting platforms with broader project management,
-hosted CI, security scanning, permissions at scale and support. AgentGit has repository issues and
-agent-task handoff; labels, milestones, attachments and hosting-metadata import remain open. The table covers only the question AgentGit is built around:
-how a change lands when several untrusted actors write to one codebase. Cells about the platforms describe their
-public documentation; the page linked below has the sources, the access date and the much longer list of what they do better.
-
-| | GitHub | GitLab | Bitbucket | AgentGit |
-|---|---|---|---|---|
-| Unit of review | pull request | merge request | pull request | proposal |
-| Where merge rules are enforced | the platform: branch protection and rulesets | the platform: protected branches, approval rules, push rules (several need Premium) | the platform: branch permissions, merge checks (enforced on Premium in Cloud) | the stream's policy, evaluated in the transaction that moves the head |
-| A passing check is bound to the exact tree that lands | in the merge queue, which tests a temporary merge of the queue; otherwise to a commit | with merged results pipelines and merge trains (Premium); otherwise to a pipeline | required builds on the head commit; merge queues build a merge result (paid plans, Pipelines) | always: a signed attestation names the tree, policy version and environment |
-| Identity of automated actors | accounts, GitHub Apps, tokens | service accounts, access tokens | accounts, tokens | an identity per agent and per run; credentials can be bound to one run |
-| Policy-bound autonomy for agents | built from branch rules and bot permissions | built from the same pieces | built from the same pieces | built in: allowed paths and a file limit per stream |
-| Tamper-evident audit | an audit log with export; the docs make no integrity claim | audit events (Ultimate); the docs make no integrity claim | an audit log; not compared | hash-chained, checked by `ag audit` and `ag verify` |
-| Self-contained and offline | hosted; Enterprise Server for self-managed | SaaS or self-managed | Cloud or Data Center | local mode needs no server; the server is one binary |
-| Ecosystem | very large | very large, CI and security built in | large, Jira and Pipelines | small: CLI, SDKs (unpublished), MCP, Web UI |
-| Maturity | very high | very high | very high | beta |
-
-The full comparison, including Git, Gerrit and Jujutsu: [AgentGit compared](docs/comparison.md).
-
-## The Web UI
-
-A new user starts on a home page that says what needs attention, with plain labels (the AgentGit word is in a tooltip),
-blockers that come with their fix as a button, guided flows to start a repository or give an agent work, rules presets
-instead of raw JSON, and editing a file and proposing it from the browser. These are included in beta.2.
-What is still missing is on the [roadmap](ROADMAP.md).
-
-Beta.3 adds file-by-file review progress, reload recovery for review drafts, permanent task pages with prerequisite management and confirmed completion/cancellation, and server-side code search with links to matching lines. See the [changelog](CHANGELOG.md) for details and limitations.
-
-A live board of runs, leases, tasks and the merge queue, with four independent verdicts per proposal. These are real
-screenshots of the UI running against a real server, captured by the end-to-end suite.
-
-<p align="center">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/assets/ui-board-dark.png">
-    <img src="docs/assets/ui-board.png" alt="The live board: runs, leases, tasks, the merge queue and four independent verdicts per proposal" width="100%">
-  </picture>
-</p>
-
-<table>
-<tr>
-<td width="34%" align="center" valign="top">
-<img src="docs/assets/ui-proposal.png" alt="A proposal: the four verdicts, what blocks integration, and the diff" width="100%">
-<br><sub>A proposal: four verdicts, what blocks it, the diff</sub>
-</td>
-<td width="33%" align="center" valign="top">
-<img src="docs/assets/ui-admin.png" alt="Administration: the versioned policy and a diff between its versions" width="100%">
-<br><sub>Policy: versioned, append-only, with diffs</sub>
-</td>
-<td width="33%" align="center" valign="top">
-<img src="docs/assets/ui-blame.png" alt="Line-level blame that follows renames" width="100%">
-<br><sub>Blame: line-level, follows renames</sub>
-</td>
-</tr>
-</table>
-
-## How it works
-
-```mermaid
-flowchart LR
-    W["workspace<br/>snapshots"] -->|propose| P["publish<br/>verify every object,<br/>register in ONE transaction"]
-    P --> Q["proposal<br/>reviews bound to the head"]
-    Q -->|integrate| C["candidate<br/>fast-forward or<br/>deterministic merge"]
-    C --> G{"policy, in the<br/>committing transaction"}
-    G -->|allowed| S[("stream head<br/>compare-and-swap<br/>+ reflog + audit")]
-    G -->|blocked / denied| Q
-    C -.->|conflict| W
-
-    classDef step fill:#e8eeff,stroke:#5b6cff,color:#1b2150
-    classDef gate fill:#fff4d6,stroke:#c99a1e,color:#4a3508
-    classDef done fill:#dcf5e8,stroke:#1f9d67,color:#0f3d2e
-    class W,P,Q,C step
-    class G gate
-    class S done
-```
-
-A proposal has four verdicts. They are independent: none implies another, and each changes on its own.
-
-| Verdict | Question | Decided by | Changes when |
-|---|---|---|---|
-| Mergeable | Is there one unambiguous result tree? | the merge engine (`ag preview`) | a change on either side leaves no single result |
-| Validated | Did trusted checks pass on that tree? | signed attestations | the candidate tree or the policy changes |
-| Approved | Did enough eligible people approve that head? | reviews and policy | the author pushes again, or the policy's bar moves |
-| Integrated | Was the stream updated atomically? | one compare-and-swap transaction | never; it is a fact in history |
-
-<p align="center">
-  <img src="docs/assets/ui-proposal-verdicts.png" alt="One proposal in the Web UI: Mergeable and Validated pass, Approved is 0 of 1, Integrated is not yet; below, in words, what is in the way" width="100%">
-</p>
-
-<p align="center">
-  <img src="docs/assets/architecture.svg" alt="Architecture: clients speak AGWP v1 to ag-server, which runs the ag-integrate engine on a deterministic core over SQLite or PostgreSQL metadata and filesystem or S3 objects; a separate execution plane (ag-worker and ag-sandbox) runs untrusted checks." width="100%">
-</p>
-
-Three trust boundaries matter more than the boxes. The core decides without a model, a clock or randomness. The engine runs
-inside the server, so policy is enforced where untrusted clients connect. Untrusted code runs only in a separate
-execution plane, which can report a result but never decides whether it counts. Read more in
-[Concepts](docs/concepts.md), the [architecture overview](docs/architecture/overview.md) and
-[publication and integration](docs/architecture/publication-and-integration.md).
-
-## Guarantees and their tests
-
-Each row names a test in this repository. More than 1,000 Rust tests run in CI, together with the SDK, Web UI and
-orchestrator suites against a real `ag-server`, fuzzing, coverage and mutation gates ([Testing](docs/architecture/testing.md)).
-
-| Guarantee | Test |
-|---|---|
-| A crash at any step of publication or integration recovers to exactly one update | `crash_at_every_step_recovers_to_exactly_one_integration` |
-| No lost update under parallel integrators | `concurrent_integrations_never_lose_an_update` |
-| A lost response never causes a double apply | `idempotent_replay_and_unknown_outcome_recovery` |
-| A check on an old candidate is not reused after the stream moves | `attestation_cannot_be_reused_after_the_stream_moves` |
-| A stale lock holder cannot land into a scope someone else now holds | `fencing_tokens_are_strictly_increasing_and_reject_stale_holders` |
-| Byte formats match an independent Python implementation | `tests/conformance/` |
-| Git history round-trips with identical tree SHAs | `history_survives_a_round_trip_with_identical_git_trees` |
-| Tampering with the audit log or objects is detected | `audit_chain_detects_tampering` |
-
-The threat model and its known limits are in [Security](docs/architecture/security.md).
-
-## Documentation
-
-| | |
-|---|---|
-| Start | [Getting started](docs/getting-started.md), [tutorials](docs/tutorials/README.md), [concepts](docs/concepts.md), [FAQ](docs/faq.md), [comparison](docs/comparison.md) |
-| Guides | [agents](docs/guides/agents.md), [policy](docs/guides/policy.md), [validation](docs/guides/validation.md), [workers](docs/guides/workers.md), [remote](docs/guides/remote.md), [history](docs/guides/history.md), [Git bridge](docs/guides/git-bridge.md) |
-| Clients | [Web UI](docs/guides/web-ui.md), [SDKs](docs/guides/sdks.md), [MCP](docs/guides/mcp.md), [orchestrator](docs/guides/orchestrator.md) |
-| Reference | [CLI](docs/reference/cli.md), [configuration](docs/reference/configuration.md), [AGWP v1](docs/protocol/agwp-v1.md), [OpenAPI](docs/protocol/openapi.json), [object formats](docs/architecture/object-format.md) |
-| Operations | [deployment](docs/operations/deployment.md), [high availability](docs/operations/high-availability.md), [observability](docs/operations/observability.md), [backup](docs/operations/durability.md), [hardening](docs/operations/hardening.md), [troubleshooting](docs/operations/troubleshooting.md) |
-| Design | [architecture](docs/architecture/overview.md), [ADRs](docs/adr/), [ADR traceability](docs/architecture/adr-traceability.md), [security](docs/architecture/security.md), [sandbox](docs/architecture/sandbox.md) |
-
-The docs are checked in CI: the CLI reference is generated from the binary, tutorial commands are run against real
-binaries, and `scripts/check_docs.py` verifies links, test names, `ag` commands and `AG_*` variables. The site builds with
-`mkdocs build --strict` and deploys to GitHub Pages from `main`.
-
-## Status and limits
+- [Getting started](docs/getting-started.md) · [Tutorials](docs/tutorials/README.md) · [FAQ](docs/faq.md)
+- [Policy](docs/guides/policy.md) · [CLI reference](docs/reference/cli.md) · [Configuration](docs/reference/configuration.md)
+- [Deployment](docs/operations/deployment.md) · [Troubleshooting](docs/operations/troubleshooting.md) · [API](docs/protocol/agwp-v1.md)
+- [Join the beta](docs/community/start-here.md) · [Report an issue](https://github.com/Paffin/AgentGit/issues) · [Roadmap](ROADMAP.md)
 
-AgentGit is an early public beta for a single Linux server with SQLite and filesystem storage. The core and the guarantees above are implemented and tested, and so is the platform around it. It has
-not been run in production by anyone but its authors, and there has been no external security audit. The full list is in
-[ROADMAP.md](ROADMAP.md) and [CHANGELOG.md](CHANGELOG.md); the ones that decide whether you can use it today:
-
-- Local mode trusts the local user. Identities are labels, and anyone who can write `.ag/` can bypass policy; tampering
-  is detectable with `ag verify`, not prevented. Against clients you do not control, run `ag-server`.
-- Several server replicas on one PostgreSQL and one S3 bucket are tested with real processes in CI. A PostgreSQL
-  failover, mixed versions during a rolling upgrade, load, and the Kubernetes `ha` overlay on a real cluster are not
-  proven ([high availability](docs/operations/high-availability.md)).
-- Credentials can be bound to one agent run ([ADR-0010](docs/adr/0010-run-bound-credentials.md)), but that is opt-in
-  per client; acting on another agent's run needs `agent.operate`, which a plain writer does not have. Fencing tokens for
-  job claims are optional per request ([ADR-0012](docs/adr/0012-job-claim-fencing.md)).
-- Only prereleases are available; the current beta is `v0.3.0-beta.7`. No stable release, and no
-  crates.io, npm or PyPI package; the 21 `agentgit-<x>` crates are only dry-run
-  ([releasing](docs/operations/releasing.md)). Metadata schema 8 requires a pre-upgrade backup; rollback restores that backup with the older binary.
-- `ag validate run` is not a sandbox. Untrusted code goes through [`ag-worker`](docs/guides/workers.md), whose sandbox
-  shares the host kernel. Verified against real Docker and Podman and cgroup v2; not verified for microVMs, Windows
-  (the worker refuses to run) or macOS beyond a limits-only fallback ([sandbox](docs/architecture/sandbox.md)).
-- PostgreSQL and S3 are tested against a real PostgreSQL and SeaweedFS, not against Amazon S3, MinIO, Ceph or R2.
-- Trees are flat manifests, measured at 100,000 files ([ADR-0006](docs/adr/0006-flat-trees-measured.md)). Performance
-  numbers come from one shared 4-vCPU VM and are not targets ([engine](docs/architecture/performance.md),
-  [server](docs/operations/performance.md)); PostgreSQL, S3, TLS and multi-replica throughput are not measured. The decoded-tree
-  cache and the 3 durable commits per integration were measured on the memory and disk backends only.
-- No history rewriting, tags, submodules or LFS; the Git bridge reports what it cannot carry.
-- The Web UI is tested in Chromium, Firefox and WebKit; OIDC only against Keycloak. There has been no screen-reader pass.
-  `ag-mcp` was not run inside real hosts. The SDKs are unpublished.
-- Nightly fuzzing and weekly mutation checks run in GitHub Actions. Inspect the results on the release commit; a successful coverage run alone does not establish passing mutation checks.
-
-Reasonable today: a team and its agents on one machine, one server or a few replicas, with CI-gated workflows, or
-experimenting with policy-bound autonomy. Not yet: hosting mutually untrusting tenants, or being the only copy of data you
-cannot lose. Keep `ag backup` copies and a Git mirror.
-
-## Try the beta workflow
-
-The public beta is open to small teams: see the
-[scope and release gates](docs/community/beta.md), [start here](docs/community/start-here.md), and the
-[beta milestone](https://github.com/Paffin/AgentGit/milestone/1). Installation problems and confusing workflows are useful feedback.
-
-## Contributing
-
-See [CONTRIBUTING.md](CONTRIBUTING.md). Changes to formats, hashing, merge semantics or the publication protocol start
-with an ADR. Report security issues as described in [SECURITY.md](SECURITY.md). Everyone taking part follows the
-[Code of Conduct](CODE_OF_CONDUCT.md).
+Report vulnerabilities through [Security](SECURITY.md). Everyone taking part follows the [Code of Conduct](CODE_OF_CONDUCT.md).
 
 ## License
 
-Apache License 2.0, see [LICENSE](LICENSE). Copyright 2026 The AgentGit Authors.
+[Apache 2.0](LICENSE). Copyright 2026 The AgentGit Authors.
diff --git a/README.ru.md b/README.ru.md
index 485bf48f..d2f56a15 100644
--- a/README.ru.md
+++ b/README.ru.md
@@ -1,365 +1,161 @@
-<div align="center">
+# AgentGit
 
-<img src="docs/assets/hero.ru.svg" alt="AgentGit: система контроля версий для мира, где код пишут и агенты. Четыре независимых вердикта на изменение: Mergeable, Validated, Approved, Integrated." width="100%">
+**Контроль версий для людей и программирующих агентов.**
 
-<br>
+Поручайте агентам работу с явными границами, проверяйте результат и принимайте изменения по правилам репозитория.
+AgentGit объединяет локальную CLI, собственный Web UI, инструменты агентов и CI в одном процессе ревью.
 
 [![CI](https://img.shields.io/github/actions/workflow/status/Paffin/AgentGit/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/Paffin/AgentGit/actions/workflows/ci.yml)
-[![Docs](https://img.shields.io/github/actions/workflow/status/Paffin/AgentGit/docs.yml?branch=main&style=flat-square&label=docs)](docs/README.md)
+[![Release](https://img.shields.io/github/v/release/Paffin/AgentGit?include_prereleases&style=flat-square)](https://github.com/Paffin/AgentGit/releases)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue?style=flat-square)](LICENSE)
-[![Status: beta](https://img.shields.io/badge/status-beta-blue?style=flat-square)](#статус-и-ограничения)
 
-[English](README.md) · **Русский** · [Документация](docs/README.md) · [Roadmap](ROADMAP.md) · [Сравнение](docs/comparison.md)
+[Начать](#попробовать-agentgit) · [Документация](docs/README.md) · [Roadmap](ROADMAP.md) · [English](README.md)
 
-</div>
+## Попробовать AgentGit
 
-<br>
+Установите опубликованную **v0.3.0-beta.7** для Linux (glibc) или macOS и откройте готовый деморепозиторий.
+Rust, Node.js и отдельная настройка базы данных не нужны.
 
-> Документация в `docs/` написана на английском; ADR-0001 (исходное архитектурное решение) на русском:
-> [`docs/adr/0001-final-architecture.md`](docs/adr/0001-final-architecture.md).
-
-AgentGit — система контроля версий для репозиториев, в которые пишут люди, coding-агенты и CI.
-
-Изменение попадает в ветку, только если это разрешает политика репозитория, и политика проверяется в той же транзакции,
-которая двигает ветку, поэтому между «проверили» и «влили» ничего не успевает измениться. Результаты тестов подписаны и
-привязаны к тому дереву, на котором они запускались. Финальная транзакция также проверяет head и открытое состояние предложения. У каждого запуска агента своя идентичность, а каждое решение
-попадает в журнал аудита, который можно проверить. Ядро, которое хранит, сливает и восстанавливает данные, никогда не
-обращается к языковой модели; всё «умное» живёт поверх него и может только предлагать.
-
-Открытая ранняя бета: [статус и ограничения](#статус-и-ограничения) ниже, и в продакшене его не запускал никто,
-кроме авторов.
-
-**В текущей beta:** задачи из issues, выбор исполнителя, подключение оркестратора через Web UI, управление запуском и постоянные страницы запусков. Сохранение ограниченного вывода stdout/stderr включается отдельно; известные секреты маскируются, запись можно удалить. Для обновления потребуется резервная копия: используется схема метаданных 8. Для отката к старому бинарнику восстановите резервную копию до обновления.
-
-Установка исполнителя и доступ к модели остаются задачами владельца его хоста. Labels, milestones, вложения и импорт обсуждений пока не готовы. [Руководство Web UI](docs/guides/web-ui.md#repository-issues).
-
-**Ревью в текущей beta:** обсуждения по строкам доступны в Web UI, CLI и MCP. Ответы и разрешение замечаний сохраняются на сервере; фильтры открытых и решённых обсуждений не теряют черновики. Привязки сохраняют точную просмотренную ревизию. JSON-контракты CLI документированы для автоматизации. [Обновление и откат](docs/adr/0025-line-review-threads.md).
-
-**Доступно с beta.6:** оператор может отключить или снова разрешить новые запуски отдельного агента из браузера или через `ag agent disable NAME --remote origin` (`enable` для включения). Ключ, история и работающие сессии сохраняются. Функция включена в beta.6 и новее; [ADR-0026](docs/adr/0026-agent-run-admission.md).
-
-**Доступно с beta.6:** Сервер ограничивает число запусков каждой задачи, сохраняя счётчик через историю запусков при перезапуске. Оператор может продолжить исчерпанную задачу командой `ag task attempts TASK --max 5 --expected 3`, не теряя её историю. Нулевой лимит сохраняет прежнюю политику повторов репозитория. Изменение лимита во время запуска защищено от отмены по устаревшей политике; запоздавший результат не завершит более новую попытку. [Лимиты исполнения](docs/adr/0033-task-attempt-limits.md).
-
-**Обновление:** связи задач-продолжений и постоянные лимиты исполнения используют схему метаданных 8. Перед запуском beta.6 или новее на существующих данных сделайте резервную копию; для отката восстановите её. [Семантика связей](docs/adr/0027-task-source-links.md).
-
-В beta.6 и новее доступно редактирование инструкций задачи до первого запуска через Web UI, CLI и API с защитой от одновременных правок. Функция включена в beta.6 и новее. [Редактирование задач](docs/guides/web-ui.md#refine-queued-task-instructions-development).
-
-Главная страница сохраняет фильтры очереди в ссылке и обновляет выбранный репозиторий по событиям; серия событий объединяется в одно обновление, общий обзор сохраняет периодический опрос.
-
-Ближайшие приоритеты — завершение сценариев ревью и перенос метаданных GitHub/GitLab. [Roadmap](ROADMAP.md#next) разделяет готовые возможности, опубликованные выпуски и оставшуюся квалификацию.
-
-В development-версии форма правил также позволяет менять одобряющих для защищённых путей и сроки проверок без редактирования JSON, сохраняя настройки исполнителя.
-
-В development-версии разрешение конфликтов проверяет исходный head change request: параллельные изменения отклоняются вместо перезаписи.
-
-В development-версии рецензент может предложить замену строки, а автор — просмотреть её и применить с проверкой исходной ревизии.
-В development-версии правила ветки могут требовать разрешения всех построчных обсуждений перед интеграцией, включая обсуждения прежних ревизий.
-
-## Переезд с GitHub или GitLab
-
-В **Repositories → Import from GitHub / GitLab** загрузите полный Git bundle, проверьте соответствие веток и тегов и подтвердите публикацию. Либо выполните `ag migrate repository.bundle ./project --namespace team/project`. Источник не изменяется, оригинальный bundle сохраняется в резервных копиях. [Руководство и ограничения переноса метаданных](docs/guides/migrate-from-git.md).
-
-В бета-версии доступны поиск файлов с клавиатуры, восстановление файловых черновиков и сохранение текста ревью при просмотре diff. Веб-ревью привязано к просмотренному head: если автор изменил код, сервер отклонит устаревшую отправку, сохранив ваш текст. Эти изменения включены в beta.2 и отражены в [журнале изменений](CHANGELOG.md) и [руководстве Web UI](docs/guides/web-ui.md).
-
-В beta.3 добавлены отметки просмотренных файлов, восстановление черновика ревью после перезагрузки, отдельные страницы задач с зависимостями и подтверждением завершения или отмены, а также поиск по содержимому с переходом к найденной строке. Возможности и ограничения описаны в [журнале изменений](CHANGELOG.md).
-
-## Как это выглядит
-
-Человек, два агента и CI-сервис работают с одним потоком. Вывод сокращён из
-[`examples/quickstart.sh`](examples/quickstart.sh): CI запускает этот сценарий при каждом push и построчно сверяет его
-с английским README.
-
-```text
-$ ag integrate prop_6eed…                  # as agent:refactor-bot — агент пытается сам влить код
-Denied by policy; the stream was not changed:
-  - actor not allowed to integrate: agents may not integrate unless agent_autonomy.auto_integrate is on …
-
-$ ag integrate prop_6eed…                  # as user:alice
-Blocked (policy v1); the stream was not changed:
-  - check 'tests' has no trusted passing attestation for this exact tree
-  - approvals (default): 0 of 1 required
-  - agent-authored change has no signed provenance
-  - exclusive lease on 'src/**' held by agent:refactor-bot#run_8f78… (stale_or_missing_token)
-candidate tree: 315f74d45183c9e7…
+```sh
+curl -fsSL https://raw.githubusercontent.com/Paffin/AgentGit/main/scripts/install.sh | sh -s -- --version 0.3.0-beta.7
+export PATH="$HOME/.local/bin:$PATH"
+ag-server dev --open
+```
 
-$ ag validate run prop_6eed… --check tests --key ci -- cargo test        # as service:ci
-check 'tests' PASSED on tree 315f74d45183 (policy v1); attestation att_0f1a… signed by service:ci
-$ ag proposal review prop_6eed… --approve                                # as user:bob
-$ ag integrate prop_6eed… --fencing-token 1                              # as user:alice
-Integrated (merge): stream is now at 793a03b6da69 (version 3, was 70e31c72a4d0), 1 file(s) changed.
+Установщик проверит контрольную сумму архива и сохранит программы в `~/.local/bin`. Сервер создаст деморепозиторий,
+откроет браузер и выполнит вход. Если браузер не открылся, перейдите по ссылке из терминала.
+Оставьте терминал работающим; **Ctrl-C** остановит сервер. После повторного запуска данные останутся в `./ag-dev-data`.
 
-$ ag preview prop_2b19…                                                  # параллельная правка той же строки
-strategy: Merge   (algorithm ag-merge/3+ag-diff/1)
-conflict: src/main.rs (content conflict (1 region(s)))                   # код выхода 4 — поток не тронут
-```
+**В браузере:** откройте файл, нажмите **Edit**, предложите изменение, затем проверьте и примите его.
+Правила деморепозитория защищают `SECURITY.md`: изменение этого файла покажет, как обязательное ревью блокирует принятие.
 
-Каждый отказ объясняет, чего не хватает. Код выхода `3` — заблокировано (добавьте недостающее и повторите), `4` — отказ.
+Демо доступно только с вашей машины и использует временные учётные данные. Для общего сервера есть
+[руководство по развёртыванию](docs/operations/deployment.md). Windows, контейнеры, сборка из исходников,
+другой каталог установки и ручная проверка архива описаны в [вариантах установки](docs/getting-started.md#install).
+Документация в `docs/` — на английском.
 
-## Установка
+## Первое изменение из терминала
 
-Нужен Rust 1.89 или новее и компилятор C (SQLite собирается вместе с проектом). Linux, macOS и Windows собираются и
-тестируются в CI; песочница и `ag-worker` работают только на Linux ([Windows](docs/operations/windows.md)).
+Пока демосервер работает, откройте второй терминал в том же исходном каталоге:
 
-```bash
-git clone https://github.com/Paffin/AgentGit && cd AgentGit
-cargo install --path crates/ag-cli          # ставит бинарник `ag`
+```sh
+export PATH="$HOME/.local/bin:$PATH"
+ag login http://127.0.0.1:8080 --token-file ./ag-dev-data/dev/token
+ag clone http://127.0.0.1:8080/demo/welcome
+cd welcome
+printf '\nA change from AgentGit.\n' >> README.md
+ag snapshot -m "Update the readme"
+ag push -t "Update the readme"
 ```
 
-Текущий кандидат — [`v0.3.0-beta.7`](https://github.com/Paffin/AgentGit/releases/tag/v0.3.0-beta.7). Используйте архивы для установки после успешного завершения Release workflow. Они содержат `ag`, `ag-server`, `ag-worker`, `ag-mcp` и `orchestrator` для Linux и macOS; проверки выпуска отражены в [Release workflow](https://github.com/Paffin/AgentGit/actions/workflows/release.yml).
+`ag push` напечатает ID предложения и опубликует изменение для ревью. Чтобы принять его, подставьте полученный ID:
 
-```bash
-curl -fsSL https://raw.githubusercontent.com/Paffin/AgentGit/main/scripts/install.sh | sh -s -- --version 0.3.0-beta.7
-docker pull ghcr.io/paffin/agentgit-cli:0.3.0-beta.7
+```sh
+ag remote integrate PROPOSAL_ID
+ag pull
 ```
 
-Пока есть только пре-релизы, `--version` обязателен. Если у вас установлена rc.2, используйте [инструкцию для rc.2](docs/getting-started.md#on-020-rc2-until-the-next-release). [Отчёт о проверке rc.2](docs/operations/releasing.md) относится только к тому выпуску и не подтверждает готовность rc.3. Подробности — в [вариантах установки](docs/getting-started.md#install).
+Если правила блокируют изменение, `ag remote explain PROPOSAL_ID` покажет, чего не хватает и какие команды помогут.
+[Пошаговое руководство](docs/getting-started.md) объясняет ревью, доступ агентов и правила репозитория.
 
-## Быстрый старт
+## Один процесс, четыре понятных ответа
 
-```bash
-mkdir demo && cd demo
-ag init --namespace me/demo                 # создаёт .ag/ и поток "main"
-echo "# demo" > README.md
-ag snapshot -m "first"                      # записать каталог (другим пока не виден)
-ag propose -t "Initial import"              # проверить, опубликовать и открыть proposal
-ag integrate <proposal-id>                  # атомарно сдвинуть "main"; достаточно уникального префикса id
-ag log
-```
+**Snapshot** сохраняет вашу работу. **Proposal** публикует её для ревью. **Integration** принимает проверенный
+результат в **stream** — общую ветку. У каждого предложения четыре независимых состояния:
 
-Дальше можно добавить [политику](docs/guides/policy.md), запустить [агента](docs/guides/agents.md) или прогнать всю
-историю целиком: `./examples/quickstart.sh`. Подробный разбор: [Getting started](docs/getting-started.md).
-
-### Пять минут с сервером, ничего не собирая
+| | Вопрос |
+|---|---|
+| **Mergeable** | Можно ли объединить изменение с текущей веткой? |
+| **Validated** | Прошли ли доверенные проверки на том результате, который будет принят? |
+| **Approved** | Одобрили ли нужные ревьюеры именно эту ревизию? |
+| **Integrated** | Обновилась ли общая ветка? |
 
-```bash
-ag-server dev                                            # каталог данных, администратор, демо-репозиторий, ссылка для входа
-ag login http://127.0.0.1:8080 --token-file ./ag-dev-data/dev/token
-ag clone http://127.0.0.1:8080/demo/welcome              # правьте, `ag snapshot`, `ag push -t "my change"`, при отказе `ag remote explain <id>`
-```
+Успешные тесты не заменяют ревью. Одобрение старой ревизии не одобряет новую. Сервер проверяет правила
+в той же транзакции, которая обновляет ветку: между проверкой и записью нельзя незаметно подменить результат.
 
-`ag-server dev` печатает ссылку, которая входит в Web UI, и те же команды. Это режим для знакомства (только loopback,
-обычный HTTP, учётные данные на 8 часов), а не развёртывание. Он включён в `v0.3.0-beta.7`. Для прежних архивов `v0.2.0-rc.2` [Getting started](docs/getting-started.md#on-020-rc2-until-the-next-release) описывает тот же старт на
-rc.2 несколькими строками длиннее.
+![Экран ревью: изменённые файлы в основной области, действия и ревьюеры сбоку](docs/assets/ui-review-workspace.png)
 
-### Как сервер
+*Это разрабатываемый интерфейс: упрощённый экран ревью выше ещё не входит в beta.7.
+Опубликованные изменения и текущая разработка разделены в [changelog](CHANGELOG.md) и [roadmap](ROADMAP.md).*
 
-```bash
-cargo install --path crates/ag-server
-export AG_BOOTSTRAP_TOKEN=$(openssl rand -hex 32)          # учётные данные первого администратора
-ag-server admin --data-dir ./ag-data create-repo acme/web
-ag-server admin --data-dir ./ag-data grant --subject user:alice --repo 'acme/*' --role admin
-export AG_TOKEN=$(ag-server admin --data-dir ./ag-data mint --subject user:alice --ttl 86400 | tail -n 1)
-ag-server serve --data-dir ./ag-data &                      # 127.0.0.1:8080, gRPC + HTTP/JSON
-ag clone http://127.0.0.1:8080/acme/web web && cd web      # дальше правьте, `ag snapshot`, `ag push -t "my change"`
-```
+## Выберите удобный инструмент
 
-Сервер говорит на одном протоколе, [AGWP v1](docs/protocol/agwp-v1.md), по gRPC и HTTP/JSON на одном порту и отдаёт на
-нём же [Web UI](docs/guides/web-ui.md). Compose, Kubernetes, TLS и PostgreSQL с S3 описаны в
-[Развёртывании](docs/operations/deployment.md).
-
-## Что умеет
-
-- Публикует изменение одной проверенной транзакцией и двигает голову потока через compare-and-swap. Сбой на любом шаге
-  оставляет ровно один исход; в тестах сбои внедряются на каждом шаге протокола.
-- Сливает чистой версионированной функцией от base, ours и theirs. Конфликты — типизированный результат, о котором
-  сообщается до любых изменений; файл, переименованный на одной стороне и изменённый на другой, сливается без конфликта.
-- Привязывает валидацию к дереву-кандидату. Аттестация называет дерево, версию политики и окружение и подписана
-  издателем, которому доверяет политика. Когда поток сдвинулся, старый результат перестаёт засчитываться.
-- Хранит политику на каждый поток: обязательные проверки, одобрения, привязанные к просмотренной голове, защищённые пути
-  и конверт автономности: в какие пути и сколько файлов агент может влить без человека.
-- Координирует агентов: идентичность на каждый запуск, задачи, мягкие и эксклюзивные lease с fencing-токенами,
-  предсказание конфликтов и упорядоченная очередь интеграции.
-- Запускает недоверенные проверки в `ag-worker` внутри песочницы (rootless namespaces или контейнер) и подписывает
-  результат.
-- Ведёт append-only reflog и журнал аудита с хеш-цепочкой; `ag verify` проверяет весь репозиторий.
-- Импортирует из Git и экспортирует в него с теми же SHA деревьев и целиком работает офлайн.
-- Поставляется с [Web UI](docs/guides/web-ui.md), [SDK для TypeScript и Python](docs/guides/sdks.md),
-  [MCP-сервером](docs/guides/mcp.md), который отдаёт агенту AgentGit как набор инструментов, и
-  [платформой агентов](docs/guides/orchestrator.md) на Go, которая может предлагать изменения, но не интегрировать их.
-
-## Сравнение с GitHub, GitLab и Bitbucket
-
-GitHub, GitLab и Bitbucket — зрелые платформы с более широкими возможностями управления проектами,
-хостируемым CI, сканированием безопасности, правами доступа в большом масштабе и поддержкой. В AgentGit уже
-есть issues репозитория и передача задач агентам; labels, milestones, вложения и импорт метаданных хостинга ещё не готовы. В таблице только тот вопрос,
-вокруг которого построен AgentGit: как попадает в кодовую базу изменение, когда пишут несколько недоверенных
-участников. Ячейки про платформы описывают их публичную документацию; на странице по ссылке ниже есть источники, дата
-обращения и куда более длинный список того, в чём они сильнее.
-
-| | GitHub | GitLab | Bitbucket | AgentGit |
-|---|---|---|---|---|
-| Единица ревью | pull request | merge request | pull request | proposal |
-| Где применяются правила слияния | платформа: защита веток и rulesets | платформа: защищённые ветки, правила одобрения, push rules (многое требует Premium) | платформа: права на ветки, merge checks (в Cloud принудительно на Premium) | политика потока, вычисляется в транзакции, которая двигает голову |
-| Успешная проверка привязана к точному дереву, которое вливается | в merge queue, где тестируется временное слияние очереди; иначе к коммиту | через merged results pipelines и merge trains (Premium); иначе к пайплайну | required builds на головном коммите; merge queues собирают результат слияния (платные планы, Pipelines) | всегда: подписанная аттестация называет дерево, версию политики и окружение |
-| Идентичность автоматических участников | аккаунты, GitHub Apps, токены | сервисные аккаунты, access tokens | аккаунты, токены | идентичность на агента и на запуск; учётные данные можно привязать к одному запуску |
-| Автономность агентов в рамках политики | собирается из правил веток и прав ботов | собирается из тех же частей | собирается из тех же частей | встроена: разрешённые пути и лимит файлов на поток |
-| Аудит, в котором видна подмена | журнал аудита с экспортом; в документации нет утверждений о целостности | события аудита (Ultimate); утверждений о целостности нет | журнал аудита; не сравнивали | хеш-цепочка, проверяется `ag audit` и `ag verify` |
-| Самодостаточность и офлайн | облако; для своей установки Enterprise Server | SaaS или своя установка | Cloud или Data Center | локальному режиму сервер не нужен; сервер — один бинарник |
-| Экосистема | очень большая | очень большая, CI и безопасность встроены | большая, Jira и Pipelines | небольшая: CLI, SDK (не опубликованы), MCP, Web UI |
-| Зрелость | очень высокая | очень высокая | очень высокая | beta |
-
-Полное сравнение, включая Git, Gerrit и Jujutsu: [AgentGit compared](docs/comparison.md) (на английском).
-
-## Web UI
-
-Новый пользователь попадает на главную страницу, где сказано, что требует внимания; подписи простыми словами (термин
-AgentGit в подсказке), у блокировок есть кнопка с исправлением, есть пошаговые сценарии (создать репозиторий, дать
-агенту работу), пресеты правил вместо сырого JSON и правка файла с предложением изменения прямо в браузере. Всё это в
-`main`, а не в архивах rc.2. Чего ещё нет, написано в [дорожной карте](ROADMAP.md).
-
-Живая доска запусков, lease, задач и очереди слияния с четырьмя независимыми вердиктами на каждый proposal. Это
-настоящие скриншоты UI, работающего с настоящим сервером; их снимает сквозной набор тестов.
-
-<p align="center">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/assets/ui-board-dark.png">
-    <img src="docs/assets/ui-board.png" alt="Живая доска: запуски, lease, задачи, очередь слияния и четыре независимых вердикта на proposal" width="100%">
-  </picture>
-</p>
-
-<table>
-<tr>
-<td width="34%" align="center" valign="top">
-<img src="docs/assets/ui-proposal.png" alt="Proposal: четыре вердикта, что мешает интеграции, и дифф" width="100%">
-<br><sub>Proposal: четыре вердикта, что блокирует, дифф</sub>
-</td>
-<td width="33%" align="center" valign="top">
-<img src="docs/assets/ui-admin.png" alt="Администрирование: версионированная политика и дифф между её версиями" width="100%">
-<br><sub>Политика: версии только добавляются, есть диффы</sub>
-</td>
-<td width="33%" align="center" valign="top">
-<img src="docs/assets/ui-blame.png" alt="Построчный blame, который следует за переименованиями" width="100%">
-<br><sub>Blame: построчный, следует за переименованиями</sub>
-</td>
-</tr>
-</table>
-
-## Как это работает
-
-```mermaid
-flowchart LR
-    W["workspace<br/>снимки"] -->|propose| P["публикация<br/>проверка каждого объекта,<br/>регистрация в ОДНОЙ транзакции"]
-    P --> Q["proposal<br/>ревью привязаны к голове"]
-    Q -->|integrate| C["кандидат<br/>fast-forward или<br/>детерминированный merge"]
-    C --> G{"политика, в<br/>фиксирующей транзакции"}
-    G -->|разрешено| S[("голова потока<br/>compare-and-swap<br/>+ reflog + аудит")]
-    G -->|заблокировано / отказ| Q
-    C -.->|конфликт| W
-
-    classDef step fill:#e8eeff,stroke:#5b6cff,color:#1b2150
-    classDef gate fill:#fff4d6,stroke:#c99a1e,color:#4a3508
-    classDef done fill:#dcf5e8,stroke:#1f9d67,color:#0f3d2e
-    class W,P,Q,C step
-    class G gate
-    class S done
+| С чего начать | Для чего |
+|---|---|
+| [Web UI](docs/guides/web-ui.md) | Просмотр и редактирование кода, ревью, обсуждения и управление работой. |
+| [CLI](docs/guides/remote.md) | Локальные репозитории, снимки без сети и работа с сервером из терминала. |
+| [MCP](docs/guides/mcp.md) | Чтение, предложения и ревью через явно разрешённые инструменты агента. |
+| [TypeScript и Python SDK](docs/guides/sdks.md) | Интеграции через типизированные клиенты серверного API. |
+| [Агенты и выполнение задач](docs/guides/agents.md) | Назначение ограниченной работы, история запусков и управление правом принимать результат. |
+| [CI и workers](docs/guides/validation.md) | Подписанные результаты проверок для точного дерева изменений. |
+
+У запусков агентов отдельные идентичности. Правила ветки задают обязательные проверки, ревьюеров, защищённые пути
+и пределы самостоятельной работы агента. Решения записываются в журнал аудита. Ядро слияния и проверки правил
+не вызывает языковую модель. [Основные понятия](docs/concepts.md) объясняют устройство,
+[модель безопасности](docs/architecture/security.md) — границы доверия.
+
+## Перенести существующий репозиторий
+
+Создайте полный Git bundle и выберите **Repositories → Import from GitHub / GitLab** в Web UI.
+Либо импортируйте его локально:
+
+```sh
+git bundle create repository.bundle --all
+ag migrate repository.bundle ./project --namespace team/project
 ```
 
-У proposal четыре вердикта. Они независимы: ни один не следует из другого, и каждый меняется сам по себе.
-
-| Вердикт | Вопрос | Кто решает | Меняется, когда |
-|---|---|---|---|
-| Mergeable | Есть ли один однозначный итоговый результат? | движок слияния (`ag preview`) | изменение с любой стороны лишает результат однозначности |
-| Validated | Прошли ли доверенные проверки на этом дереве? | подписанные аттестации | меняется дерево-кандидат или политика |
-| Approved | Одобрило ли эту голову достаточно подходящих людей? | ревью и политика | автор запушил снова или изменилась планка политики |
-| Integrated | Обновился ли поток атомарно? | одна транзакция compare-and-swap | никогда: это факт истории |
+Импорт позволяет проверить соответствие веток и тегов и сохраняет исходный bundle. Git export оставляет путь назад.
+Код и история переносятся; issues, комментарии, метаданные pull requests, LFS и настройка CI требуют отдельной работы.
+Перед переносом команды прочитайте [руководство по миграции](docs/guides/migrate-from-git.md).
 
-<p align="center">
-  <img src="docs/assets/ui-proposal-verdicts.png" alt="Один proposal в Web UI: Mergeable и Validated пройдены, Approved 0 из 1, Integrated ещё нет; ниже словами сказано, что мешает" width="100%">
-</p>
+AgentGit — ранняя альтернатива для команд, которые пробуют работу агентов под правилами репозитория.
+У GitHub и GitLab значительно шире возможности хостинга, управления проектами и опыт эксплуатации.
+[Сравнение и компромиссы](docs/comparison.md).
 
-<p align="center">
-  <img src="docs/assets/architecture.svg" alt="Архитектура: клиенты говорят с ag-server по AGWP v1, он запускает движок ag-integrate на детерминированном ядре поверх метаданных SQLite или PostgreSQL и объектов в файлах или S3; отдельная плоскость исполнения (ag-worker и ag-sandbox) запускает недоверенные проверки." width="100%">
-</p>
+## Статус и ограничения
 
-Важнее самих блоков три границы доверия. Ядро принимает решения без модели, часов и случайности. Движок работает внутри
-сервера, поэтому политика применяется там, где подключаются недоверенные клиенты. Недоверенный код выполняется только
-в отдельной плоскости исполнения: она может сообщить результат, но не решает, засчитывается ли он. Подробнее:
-[Concepts](docs/concepts.md), [обзор архитектуры](docs/architecture/overview.md) и
-[публикация и интеграция](docs/architecture/publication-and-integration.md).
+**Ранняя публичная beta.** Текущий выпуск — [v0.3.0-beta.7](https://github.com/Paffin/AgentGit/releases/tag/v0.3.0-beta.7).
+Стабильного выпуска и опубликованных пакетов в crates.io, npm и PyPI пока нет. Готовые архивы доступны для Linux
+и macOS на x86_64 и ARM64; песочница worker работает только на Linux. Windows проверяется в CI,
+но отдельный готовый архив для Windows ещё не выпускается.
 
-## Гарантии и тесты
+**Перед обновлением сделайте резервную копию.** В beta.7 используется схема метаданных **8**.
+Неопубликованная разработка использует схему **10**, которая добавляет назначенных ревьюеров и личные черновики ревью.
+Запуск сборки из разработки может обновить репозиторий; для возврата к старому бинарнику потребуется восстановить
+копию до обновления. Подробнее: [резервное копирование](docs/operations/durability.md) и [история выпусков](CHANGELOG.md).
 
-В каждой строке назван тест из этого репозитория. В CI идёт более 1000 тестов на Rust, а также наборы SDK, Web UI и
-оркестратора против настоящего `ag-server`, фаззинг и гейты покрытия и мутационного тестирования
-([Testing](docs/architecture/testing.md)).
+**Начните с данных, которые можно восстановить.** Внешняя проверка в production и независимый аудит безопасности
+ещё впереди. Локальный режим доверяет тому, кто может записывать в каталог репозитория. Для недоверенных клиентов
+нужен сервер, а для недоверенных проверок — [песочница worker](docs/guides/workers.md), а не `ag validate run`
+в вашей оболочке. Сохраняйте резервные копии и Git-зеркало важных данных. В [roadmap](ROADMAP.md) перечислены
+оставшиеся ограничения: перенос метаданных хостинга, LFS, submodules и проверки на реальных установках
+и со вспомогательными технологиями.
 
-| Гарантия | Тест |
-|---|---|
-| Сбой на любом шаге публикации или интеграции восстанавливается ровно в одно обновление | `crash_at_every_step_recovers_to_exactly_one_integration` |
-| Параллельные интеграторы не теряют обновлений | `concurrent_integrations_never_lose_an_update` |
-| Потерянный ответ не приводит к повторному применению | `idempotent_replay_and_unknown_outcome_recovery` |
-| Проверка старого кандидата не используется повторно после сдвига потока | `attestation_cannot_be_reused_after_the_stream_moves` |
-| Держатель устаревшего lock не может влить код в область, которой теперь владеет другой | `fencing_tokens_are_strictly_increasing_and_reject_stale_holders` |
-| Бинарные форматы совпадают с независимой реализацией на Python | `tests/conformance/` |
-| История Git проходит туда и обратно с теми же SHA деревьев | `history_survives_a_round_trip_with_identical_git_trees` |
-| Подмена журнала аудита или объектов обнаруживается | `audit_chain_detects_tampering` |
+## Сборка и участие в разработке
 
-Модель угроз и её известные пределы: [Security](docs/architecture/security.md).
+Для работы над CLI установите Rust 1.89 или новее и компилятор C:
 
-## Документация
+```sh
+git clone https://github.com/Paffin/AgentGit.git
+cd AgentGit
+cargo install --path crates/ag-cli --locked
+```
 
-| | |
-|---|---|
-| Начало | [Getting started](docs/getting-started.md), [туториалы](docs/tutorials/README.md), [Concepts](docs/concepts.md), [FAQ](docs/faq.md), [сравнение](docs/comparison.md) |
-| Руководства | [агенты](docs/guides/agents.md), [политики](docs/guides/policy.md), [валидация](docs/guides/validation.md), [воркеры](docs/guides/workers.md), [работа с сервером](docs/guides/remote.md), [история](docs/guides/history.md), [мост с Git](docs/guides/git-bridge.md) |
-| Клиенты | [Web UI](docs/guides/web-ui.md), [SDK](docs/guides/sdks.md), [MCP](docs/guides/mcp.md), [оркестратор](docs/guides/orchestrator.md) |
-| Справочник | [CLI](docs/reference/cli.md), [конфигурация](docs/reference/configuration.md), [AGWP v1](docs/protocol/agwp-v1.md), [OpenAPI](docs/protocol/openapi.json), [форматы объектов](docs/architecture/object-format.md) |
-| Эксплуатация | [развёртывание](docs/operations/deployment.md), [высокая доступность](docs/operations/high-availability.md), [наблюдаемость](docs/operations/observability.md), [резервные копии](docs/operations/durability.md), [hardening](docs/operations/hardening.md), [диагностика](docs/operations/troubleshooting.md) |
-| Устройство | [архитектура](docs/architecture/overview.md), [ADR](docs/adr/), [соответствие ADR реализации](docs/architecture/adr-traceability.md), [безопасность](docs/architecture/security.md), [песочница](docs/architecture/sandbox.md) |
+[Contributing](CONTRIBUTING.md) описывает сборку сервера, Web UI, проверки и правила работы с репозиторием.
+Устройство проекта раскрывают [обзор архитектуры](docs/architecture/overview.md),
+[стратегия тестирования](docs/architecture/testing.md) и [архитектурные решения](docs/adr/README.md).
+[Пример в английском README](README.md#build-and-contribute) показывает полный путь от отказа по правилам до принятия изменения;
+его сценарий [`examples/quickstart.sh`](examples/quickstart.sh) выполняется в CI.
 
-Документацию проверяет CI: справочник CLI генерируется из бинарника, команды туториалов запускаются на настоящих
-бинарниках, а `scripts/check_docs.py` сверяет ссылки, имена тестов, команды `ag` и переменные `AG_*` с кодом. Сайт
-собирается через `mkdocs build --strict` и публикуется на GitHub Pages из `main`.
+## Документация и сообщество
 
-## Статус и ограничения
+- [Начало работы](docs/getting-started.md) · [Учебные сценарии](docs/tutorials/README.md) · [FAQ](docs/faq.md)
+- [Правила репозитория](docs/guides/policy.md) · [Справочник CLI](docs/reference/cli.md) · [Настройка](docs/reference/configuration.md)
+- [Развёртывание](docs/operations/deployment.md) · [Решение проблем](docs/operations/troubleshooting.md) · [API](docs/protocol/agwp-v1.md)
+- [Участие в beta](docs/community/start-here.md) · [Сообщить о проблеме](https://github.com/Paffin/AgentGit/issues) · [Roadmap](ROADMAP.md)
 
-AgentGit — ранняя публичная бета для одного Linux-сервера с SQLite и файловым хранилищем. Ядро и перечисленные гарантии реализованы и протестированы, как и платформа вокруг него. В продакшене
-проект не использовал никто, кроме авторов, внешнего аудита безопасности не было. Полный список — в
-[ROADMAP.md](ROADMAP.md) и [CHANGELOG.md](CHANGELOG.md); то, от чего зависит, можно ли пользоваться уже сейчас:
-
-- Локальный режим доверяет локальному пользователю. Идентичности — просто метки, и тот, кто может писать в `.ag/`,
-  способен обойти политику; подмену можно обнаружить через `ag verify`, но не предотвратить. Для клиентов, которых вы не
-  контролируете, запускайте `ag-server`.
-- Несколько реплик сервера на одном PostgreSQL и одном бакете S3 проверены в CI настоящими процессами. Не доказаны:
-  отказоустойчивое переключение PostgreSQL, смешанные версии при плавном обновлении, нагрузка и оверлей `ha` для
-  Kubernetes на настоящем кластере ([высокая доступность](docs/operations/high-availability.md)).
-- Учётные данные можно привязать к одному запуску агента ([ADR-0010](docs/adr/0010-run-bound-credentials.md)), но это
-  включается на стороне клиента; действовать в чужом запуске можно только с `agent.operate`, которого у обычного
-  writer нет. Токен ограждения (fencing) для захвата заданий передаётся по желанию клиента
-  ([ADR-0012](docs/adr/0012-job-claim-fencing.md)).
-- Доступны только пре-релизы; текущий кандидат — `v0.3.0-beta.7` (GitHub и GHCR). Стабильного релиза нет, пакетов в
-  crates.io, npm и PyPI нет; 21 крейт `agentgit-<x>` проверен только пробной публикацией
-  ([релизы](docs/operations/releasing.md)). Схема метаданных 8 требует резервной копии перед обновлением; для отката к beta.5 или старее восстановите копию до обновления.
-- `ag validate run` не песочница. Недоверенный код идёт через [`ag-worker`](docs/guides/workers.md), чья песочница
-  делит с хостом ядро. Проверено на настоящих Docker и Podman и cgroup v2; не проверено для microVM, Windows (воркер
-  отказывается запускаться) и macOS, кроме запасного режима с одними лимитами ([песочница](docs/architecture/sandbox.md)).
-- PostgreSQL и S3 проверены на настоящем PostgreSQL и SeaweedFS, но не на Amazon S3, MinIO, Ceph и R2.
-- Деревья хранятся плоскими манифестами, измерено до 100 000 файлов ([ADR-0006](docs/adr/0006-flat-trees-measured.md)).
-  Цифры производительности сняты на одной общей виртуальной машине с 4 vCPU и целями не являются
-  ([движок](docs/architecture/performance.md), [сервер](docs/operations/performance.md)); пропускная способность с
-  PostgreSQL, S3, TLS и несколькими репликами не измерялась. Кэш декодированных деревьев и 3 долговечных коммита на
-  интеграцию измерены только на дисковом и in-memory бэкендах.
-- Нет переписывания истории, тегов, submodules и LFS; мост с Git сообщает, что не может перенести.
-- Web UI проверен в Chromium, Firefox и WebKit; OIDC только с Keycloak. Проверки со скринридером не было. `ag-mcp` не
-  запускали внутри настоящих хостов. SDK не опубликованы.
-- Ночной фаззинг и еженедельное мутационное тестирование запускаются на GitHub. Проверяйте результаты на коммите релиза: успешное покрытие само по себе не означает, что все мутации обнаруживаются тестами.
-
-Сейчас подойдёт: команда и её агенты на одной машине, одном сервере или нескольких репликах, процессы с проверками в
-CI, эксперименты с автономностью агентов в рамках политики. Пока не подойдёт: хостинг взаимно недоверяющих арендаторов и
-роль единственной копии данных, которые нельзя потерять. Делайте копии через `ag backup` и держите зеркало в Git.
-
-## Подготовка беты
-
-Открыт публичный бета-тест. Для беты зафиксированы [поддерживаемый сценарий и критерии готовности](docs/community/beta.md),
-создан [milestone](https://github.com/Paffin/AgentGit/milestone/1) и [вход для участников](docs/community/start-here.md).
-Нужны внешние проверки установки и реальных задач с агентами; полезны и отчёты о том, где процесс непонятен.
-Независимые пилоты ещё нужны; метка beta не означает подтверждённую готовность к критичной эксплуатации.
-
-## Участие
-
-См. [CONTRIBUTING.md](CONTRIBUTING.md). Изменения форматов, хеширования, семантики слияния и протокола публикации
-начинаются с ADR. О проблемах безопасности сообщайте, как описано в [SECURITY.md](SECURITY.md). Все участники следуют
-[Кодексу поведения](CODE_OF_CONDUCT.md).
+Об уязвимостях сообщайте по инструкции [Security](SECURITY.md). Участники следуют [кодексу поведения](CODE_OF_CONDUCT.md).
 
 ## Лицензия
 
-Apache License 2.0, см. [LICENSE](LICENSE). Copyright 2026 The AgentGit Authors.
+[Apache 2.0](LICENSE). Copyright 2026 The AgentGit Authors.
diff --git a/docs/assets/ui-review-workspace.png b/docs/assets/ui-review-workspace.png
new file mode 100644
index 0000000000000000000000000000000000000000..f900ea6847c1e6143a5a5d37d95619b85de8aa7e
GIT binary patch
literal 138642
zcmdSAWmH>D)Hcjr3beF9u~NJ(#f!TaDDGaoxChr@g#yLhAryCLaT44mxVt+fxI@0Q
z_j9lB{qz2OKRH<|E1b2NGiPS@%-+|&u25w~DJ)D9OcWFpEE(y~swgOEKT%Ln2cA7a
z-Z}EIPDMd^g(CA=RNW)va0$(0LWdIl*!Eyi|0^`HJs3L}^7k^>T!+D6fox<wZ%Ca}
zAdtH&_>=sV2yBQ;Q|rZCJc!0Bt-x+LJsw|CMFkfX+3=t1*kTYmT(YX7g8uK{D4+V?
zt^UtXl<W}y|Lnd~Ji-2-+poNy@&0GL`+v^Z@y)*v@i%<S$3)F1M9s(p`T5iT+lqv|
zyu6N>tc-z*jAHCf`VRs^Lbm_ukBEk;9>Ekhq3Kp})zI4N>McAzD@!R`RaUa3=togh
z+H18SQ*#TAW4ixd=DMG5=@mZyg!<Um)mHq>SGr%+za+9pg`r}fxBv5RqatcfI+*0r
zQs9%U3DqgOj|{RhN@kDP|Bb<_g{-2IN=%}~D$Y+j#;k-S=skJKs;9DW_BScGp6kWc
z#q;NVL_cXsqf%0WKq}-WXJh(ax|6J?e_Q{QlD}=9w_{FYUYNg~H}MHzBz)Ez^J=S4
zrjJf~pjf(pFkEg>Zh%cgMH5h0^PK?I4~71D@!_KFHe5OXcJ=3s)A{n0M(@?u<`#P*
zEj{yZ>&XO_Os{{(<88)ruQwDrh=+?CyDcpnE;r`q_*-Q67r;Q&SJPKf(}4S-@HV`x
z!G&CbqhR3V<@s;+ny(BjjP-A+!bzq3Wu5b=yWU(Ax7;0FqiQT-NF`dg|327HbuGkU
zUkNvk4Z^73+TKyvozD7qq_Xi6apAAeiqisuzv*#pD@j<rSR(jfHV1j0N`LjlaB7Nk
zCPBmKQ8P#a+WRYEb+@Ldt8DRJ%%JgmLs4B=L`y+NV@1x7XQ;;t8nmm&*x0i!k9239
z+#tTiY*Bola*-<m+`nTcd!6zIFEdtIZAn>PJq7!&bbyXQw*Te>df{eXddcM1N8#A#
zsZoG2D{asH0d}xX*eQD)W)+?~C=C>!l$f3bdYBZNpAyMVjI65*<3v@?E}7`x)eaHx
zyfMqtqkaG0xY)i67k@XMnS=K3IFs?^--kYXzVdx_^N`boP=8I9=L?w%8$RJu*CD~m
z_gC928<eSTcM4y8aVJJqdwV`lC`-xc%jl@;MF0}qNA+#g%F&bN8_^`{4MNaA=d+;@
zmhk@*GALEaK6uAzzXLq2+o&_~ErcuXv-#hA)BZb{ZCNzT9P~6C#o!zoDyR!#tuZ_P
zItL=DR6nMzs74A-Ra(r*S)r|<qFB{5mav&eGE-7ePJ<YwW@qKk{D;nPicg}O<$aBd
z(b@dPB~*_jE6!yTmRNUjs2P=km!9CUH7CCOY-)-teY&KyB5$3DV*U6LYXLnEs@<-1
zvbZ-jZ%1midJf9nFR`{=>nz09y*&E)&8C;RPx^&>XLU`)d5Z~pb>})+6u1N&RDAQ}
zQJixMk#6IU5rociXHlDww^^`tpplS}nzczZ^cp#Ws{&2om&L^fgv`N3m3iWo`ME|W
z+e8qLv#^wuFImh&sR%`5ov1*Ygo=WIM$kTw)b@`s9g?EZupfeMk?Meg%8#_|C<*!d
zHLKEtP&)nDN;3@Ps$L#6|0rCO`>^;MEeH*D!DU;>y4d2};b4t?;x!XF_gYuZMaWLM
zd3sGEUnyS4dJY$m%fkL!>>AXMfltV8W{P8pNU5B!3i9ahW@jF)?cuP{`|GP0UF*-E
zX91zxoe*JPcvl--!c*H+KB3dOH}tHqo4Shw5tO%S>b3u???=t~2-B@Wv-3Xdue(gC
zt5iy5uev|W1rd71Mp;U4slE?Q=sHixxQ93H8$Y+2BVMXg)CO*#oW(nQ?ylLI(lZfe
zZ~Y>#XRGeQd6wmME-b5>VN#+STA`ufqS3`?90gE;Qtp)x3fP%6kHz;){DK!obGu<_
z+I<;pgKM}xiDKWgw&YlpV<Ti;Z1HSN?n=Z%q+K#mvdKsooOC^qn((k(VP3*#e_2T_
z6g(Ne*{_y5&w8L~zU=sR!vt&f5%nCPztg=BddH?hz8z@@-1m=<271dnX#%1wVpe_w
zXH>&%K#iV_Akjw|t74<yV}#JBzTn1q^NdATkM$qF$=DRlHK&6}lT#65OY__|L>05Y
z-Kq^PMtn4dJTD?{jPfmBAcy1lE`Qt9bkn?8mQmBX#4Oo;`R+KNIFHYQXGV9P<%4is
ztFo?)f{tF;jpw9k!uVO$xO1ydTdgW4CMFpB$md{9|FR+}*qn=;-0iw2a6v!hg8n0e
zsV^1c$7ELx86%ae%9yMk8S-4{8c-JE<`YnU!@t4G#hsXtV7hu$qM97aq#&P=zIvEh
zYr9m88V|(Y{1GbjunHCaz`!s+nloK^9CL$FH@;N#y+MHVii@+-b>~7&bldx23jbE=
z+p|c&jiAnqN2(M<cu#mQwd{B`J4RU=J{kEtS|*OtmE*b#5}VQz$gQUUxFugpimFdq
zMr7G7VLhEfK_{6fUgXsl`&|^Jo1<S=N``5X#b_HC79)%*5xz2nPo$XD?B=*Qs*<3!
zRMncCl2KHuW_SJ*7wLBb*hkNwJy%sx1&lS!9s34$x41CgogN(kqmP<}Z>43Wzoeu@
zlCzhj)nT6<Se4kE?@umm1(sH)%Q@`MFy{{FQfQ6fyqIC0n3>XT^_a?@kjh+cRnyP}
zahu1v4$U`NRW3I=&aC;$>t)mxXew|F;yz$7(le;=nbGwQXPw_{lHySml;xS4o6Z-z
z0>j=}g5-EAa&V*IyhS->RR?`7g_WR*rOc44aRn*4yID6FTgdD+FZh6nASN?YA$+pM
zEPYx*w`!!X;+Q^{W;7rZ;x;xk_|RA9lW==xE+?njgpw*X0y@9lB!7)tp<C`1l5_-i
zKYY*7;WNm*+;loUMg5ldQwEhH+`L*+0bFy`_s6sDf7L8T$WFz`d{#Xq^>e4z?gm}x
zaEM46$X>3dXh273-oKAai>If3H+U~tV<PA|c}*U2nMR!Y=75yzSFuzO^2&Pha7iJ+
zYqCh-R)19gJVH?`F1h6AO5~|SVO(OKf2Xo8=q4~VJxyQGGx*y|MHmKI8JOm^mZp8-
zH=w<tEyN{^>2NGBu`HpcE-WpoMAB63qXen?n|QiW&!?g)YZTwIEWh@To?K-bc)xs6
zke*s0d`G9zq?I`f+?vZR%Q#Hp#*%c|9dqw4+uu)P#$fqPb=cx|xdxe`y!YW!S6`U2
zX>vIJ;z<m<nkjIWsxuHo9_s3t#!-vSc*K;tYAYU2Bcl4G^?d_F+Aa<YQ#*_1RL)m+
z1?jO-uu>t53PGUsi_T29^$g*mh2LlPRueIRrhGegSGtFhzJdLzCc9J)qenq!EvCm^
zL@0T|KVX$5;8qiLlf6NSRiTA9b{(pCfR>%UlF>i9c!c;qkGIqsW{EIz@aR%63+S;r
zJ>5v<LRd)XVM>6Ohb4ML0Gp0Mop}!dc;7v9ILvbG9hzm&tmN>e@4M&3teOZN*B7uO
z7aAss^}fqh-yA-{>tDG+-$TZShR!-Kxza7?b9WRMt9B$$y}(??8|$EEPa|_%v41cS
zai*quQr+HwF{v?hYEfGrx=@)={2ir{YbW#9X763(WM#HRn9eQ)3dIYfRgOP*%3_8Q
zI2@1g3D5#B!-7P!+d1VuF`B9F6v=W9LjwwT><z|^)%cp9-s0x-$w^DUT}3V?|E%})
zv<hizjk2e;?u(g5J198YA^D~S^#&pX(?xETw{}DZ*X~~?02~6?g{M}u)6J*O5N;bS
zERFK&O2CSnk8E*R=I<e>VkZ}2>(a{8=J#Iu{HOa+rKv^*DSXt8wwRyPq?!c<j_zE9
zn_ImvNg9Ej-1w+e+gF&;gQJ>v!`}mpV@GGhz$8n*TqlNofZXLvthR6KZJNLecDXsZ
zflb0=?QngJOJTp8j)`7KoklrGA5u-V2zKAO-wKB>xAJhXkqdc0O;lT39qY_BF^)PE
z`sMUMlD7ERli4DUAt529FW{~su5WTsaio+ba`m{IYbajnD84{_MkMp#XM$DeJ}iWB
zc{E$`@Y^S37ZxamGh)CG-#oOn{L1Pz`=dn&xU;hZ7jfFHczB2zjq!5bA5LR$j;h5v
zV{$xk+_&BjAb6}Txu$0*dt|g=5dfDCcF0iid}OBk_zIseecWcWVoz@Oo$PC}dP+#M
zBRniNp8j(K{G+mN?Ll|sTRNU>|F+>U$h+lL0Xeg~Ewwv<-VX&?<PqO+vESbpDR*6%
zS#Lj>7Js+m;Ww(PffE`f=)E)Wlk4nSYS#B=Gp<wM2~}scv$MXiXLaF7o_QXIl+-V(
zH~Z@LdK2KNP&6!&yW^<G(muvZ+uNh3;HK1j+F(WEC8MwImpzxP1LC+S)FcEPEUA2m
z(=`r`9)$w2!mD8=LmwY^y20JK;)TWs+F1fB78WI4ahs9gqXkVwr<>Y7Z0KQ(;UmMM
zU%*}Fc%wqd1SDFI*JEIOGD9_x(Y=DB6^-ZPu|w{+TU&YN+0!q&)BLq}eF-Y~mek4x
z4oAxh1r4#?Qvy7eUzIB#iEuzVtsaD1B(ZENy(}5#4Zok&TP)sAyW#+reU4^trp}UG
zE$8aGI+XLOT(>0M8ti8bIGY^i^+<$0_de#6@~6!sDsFccTQ<%&q=G_}D5I6+R~7D-
zI~5c(TswZTktUTT#U|0S?c7CEs)FCq(|bA$!jN9e3}VZ|WLaqe#ix@J^w@#L;+1bw
zn|m(-i^4gGSAVj>RSW5%{-R0Z_ca`D2hAJBGNfmir(*cNI<y2#Or+9s(!wWe+=L?o
zgO1qeHKS~KE*otd;kt0psKyw@QqG9lin~q45xyyaeLaqzuXR)B9aqU7Ovtyd4$#@D
zdo^C(;wr>Xry*X*e+JAq+uGSCO0sMb#R$bvTpIOS^`=Cy)|uW+$Dd7;GYd85G!ZC(
zVlzk7;~qAo((4iFDH)u;n{O~_;^G^L%J_gM_t#eOYN~28A9YjH(>biRYuw@bvnM{n
zw{Gy2o#u2>i8n4hLPAVT4`+8`6RMxZ&iecN`MlR>Q(ssxdMv-tVvfw<o$j8h)vAZp
z0F}6i7&02a!oWkMSQl8Yhg0F(Fk$QQhRGWBZQbB#O6RQ}uE)4=txDy0sD}51OuPmj
z4Z;t{QP_F)#S1?I{4cT6==%G2Hn)c7&!Y1|V?UyVNK&*VXu1@a>m=J?V)iXgc?i3G
z$2%U_=+Ay<_hiNqiXqCbrC&~GXV}Z@b(5@>M!%eI*PHI|`G7n(!RWv7Z@;61YIZbd
zRqK-f!vZwjN4|_#nuWxq6xBKR@ZNa|yE+4mCj7~1>6u(T?qDy_qkXPnQ_v;Sy<Ei?
zB8|Om2R80jm)43@@-Q~bFL!{$K9%Q==dE?I#0#W90Il3LD2L+skSjwjYX*d|4MS-X
zU%bc=&|T}+Z~~g+Nd-uzQ(tLuInXh6AuxMgp2lg>o9*uW8Ihe}hKxNPwgUy!$6L&F
zO;9`6pEG4H>EXr2S@M4P$eDkg9$*|Wkvzg?IIs50v5iHd7>lJL`|#_hE8zeZr4>Lk
z=j0?k#L@c(dKVvkC1uFqa^^C^(pL!YT6;hb4-1<v)h~2>2u}Fe00h1k2}%ly-htr2
zLzGBoe!D_oN07dL%=xmD=3b236|mI{ogGfrGI$#V`)Y4zrL#A@zC%LdGY_+Nd9lIe
z)Qm7euMG02P%>~5xJKsk#$ieqFT<Y|&I}XqNbCu?N#7;efotJ<`Vf*o$j329-j+G$
z?D$$YtyZN&>+IwQPb=*~YstunGW`HS`ap*lC$5+dg}7xU>6~oko!&%_Y>EPmkaRdX
zs&U7?i8#_>1azFQOpb&MWSl-sUuG#%d3^Wrz8OorJepf-#gul=6LU66$qI3!@1*La
zUn)}3=i%XTKU~E<<Qq0YkM_7<mr=KMQMP<0Aoc=c4y{a1?>%~_qWy@7E4~6fHa2>a
z>vA{TU6%*_2B5_=64Fv7II3TgQP9)FIAmpH9jilwO=i(2Em-t_A`oQ;S`!_rYT_oV
zec4Kef|Z8#6aq5!!}`-7_1i%=zKC19<uW=fBMhj#0_||h{tn!*{S3tD8^(0N?Pfaz
zVv><lg81GQq?OE9FfCXDe?){Wwpb)X3Z*7`6jCse(Ne+H>OVDtwjB6r{n;B*6`<y}
zHX=WXwszbN?zuM;jrB>gj)C_z2^&|H@CNTRF)T3Tyl+@`i0LgmRDjnXeSW4s7l90H
ze)2t)lJY>m(I!qo{usY6_ST#6ot8A`WGzxiChT>qo@hDU)LgQn!Vbe+ae+O<8k8GE
z?)-PbXeUpwy<GZ#Jtt^?X+7b&kdIFg@QYrOk0r9R<&)%Wf@kU%O_!5B94B_e)+&N6
zLONtFd7Wmerk`e4{Eh|DXqVo!h`=HsyoyiANb7hl?6uv8I1Jd#6$y{1fhHxAc6E27
z8BzqXRCY_R_&<rtBLIBCC+~g8jE{{ozk6>KruE`MiAA{fyKmNR>w{WIN<#`VzF+aP
zZMD68FRDX2UTG_TlCib9DLisH*w4P_&8Vj>Q{3bdSbxvv_}ijVf0IQ?Q2{VfM$L3n
z3*i~(V6Rw#xWa!woU_F*aNBny*CWck<lfw(J`EPy){Va8#3xj$Qul8L&HMHGK$F%;
zP!PDu$xD&u43&R@GuMBkIJ(+To{pS&U!Bb1Ljmp1<_@<G+YcTcS@X2GvJRdd%|?Jk
z3pH0Jq*O9wZuc#LpGA)Cq!=);2{&a$tgK-nAqT;dr<dzo8f=$7mDym~I~lt~P2Dw^
zo}q8s4l&4H{7!B;kuz0=7VdVq#No95rG#C1eY9C_W|kMAQEFGO*mRO>+`@gdH_=@9
zrMN`XMIO2=ey6{vC)6Z3xBaHk)06PyC-s-^77O6%8NkIlKHlz^uij!!QK64BV>zvv
z)?>zM8KT4(K=+aM2bW|moF@e(=w!D#Q}fd{o1`RNnrQIH>gb%1!^K58r6U&MmaD}L
zA0)PU)?DGYmsh>C`1^i~$AEvlx{JmKFlAqiXap4NWJFitsWu$_+?}g85NsD=(j8XS
zQdPOFij<Xc*y!)*aJu8H$SywG+)zw?0pvNvyOK}Utd{(Z8xa%70`Q87y}95CeyE#L
zejpif=B4J*AFHZzAfz^P`?|2NkW{b@t)xBOy0V0Are2gEL}dzvGF)Phklzv2ufB5d
zT*u#-14zY(kq*-jIOAj7tfRbV6iD|?nr)Guo$A>BoFEGY@iuGiz-HhpV8r!1Gc06+
zH2cex>ud<^HEwKjV(u~BhFlg6y`kzGtQO}Rk7C)>gm9iyaINitcTcttx|`j?$z>-{
z3%1w?9a!`<wJ)U^>i*7}h}_HkMIxKN%WL{ZHO$sCa*^90R;KU{h$k1}4r7e(-!d_p
zI9@r5EO(pxpfX~iO(pwQh&tk8y)0MXY5@9JI}LcE-K1lT;NMjhGB8q~4QZQgSqvg3
zDI|d|y93ypo14-yvgE=*W91Rw8?+lDfL=BP8JM7Rou{ryOUB*#=38t_Gx!>iS`lk2
ztu*Wq5rA5H%7=NITn-jXL_OmR%{GtCRcS)k56sP9&(PrE;p1H^LO_Cm^}ctVSCm3E
zo_DRJh$Z=dq+H1}e;xnIOt06Nm^SZK(L#W6KK9UWXxG8#Jl7BRhK~dk$vB2ZSierx
zmCFa!aB+!uilGKPsj01*#Zz#_;=eC`Tj}t12Vii~J}dnbq&ypuD~<yL-mdo8<&jdW
zw+r(YToLcrz!$;4IV#GQ4OYr%5|v>N*TaPAzncpIhIi1VEva!Vr-OWx)UD*KSq^W<
zU_%d9ftZA(4pJ%c)P>TRyoS%`Q-y3Zpc6oNNYqXwReSO0{m&}cYKwb&q;MR04V9U+
z1>VulUdFe)G4!y9ckF2kTm_Ax^lCC*Q#QXY5RhnCHT5|Rc<phzQzfE>%M!uNkYkO2
zo=jLC&)%rDJW?XJp%9`)xtkA#A0VENE1H2MUgudyhiSfHfQ1#4Fd(|m1B?kPh15|i
zd;++WmtcD9n8xL+(>uKgGxyB=mDFZX&X9MV_a^Q6L#5ha!L>}*FFR8JLDs4GKi^lE
z6n+nG!;Xk?FK#-limj|_q&Zg~`gu6t%gd-(S+0mq^vIir`Dve>p8Y}S{V5CR=#vwZ
zhtxqJlB=)dEg?JL85{j#myN|z0U%{&VS3;W>7x_B<z#l<Qg6}E1Za&Scb3w*rPd%b
zBhOC90T3S0wD<ZIDYNwJ_|)Xww>KQ9*c9`O>4Huf6L<Bw77An{?j_X=kpA4B5KOnY
zN2L$%m>C#{WQMN6;@7)3Kx(u`yFuE~a##Fx45eiaR!<%CiZTMJ3^f>}KsOT@JlJ1d
zSh)mdb8er3VY3)C3)-wTg+yVyjK(grT>h}iqG;YljK%jZHv#49Eh-0&;(x<OMHS}j
zA|k_wSXM#CR7^|?A#V(ue7n8n3NIHaU^F9Xzio#GaPfN%7we@YB@3jI0SQeRyv}Jp
z209E_u2_<+1lEhqUhx2F9@$cBCf>B^5{T)p$H?1OyJSV~`U;U8aU6#GtMO33VG1MP
zVE;bWEM-9X9TKc0C-sf`mIdZR#$dGU@1}=VW@^9`TSR<FXb&{Y!&;i3UFHNE(_h{!
z-*>nx%$8yisfEu}p$gm|FC7fm4KWCd4adbM3_$xI-}D@fQPI$gs%h6Moz)3cW)!5#
zFa3rcRt=pWo|C7gX6hHGvihZ5GR=cp-ROncj7~dJo5U8tShLK03^qLt^o-n<KG%o8
z{T$x<ga=7{x7abQ)UAnYZrH1whE7*VY!oONwtlH~?QCa)Y?*C6)dpci;q3Kb%gM>8
zaehLbsx9TRv%FeADi!L*9*y)-7gzAvY%`KSF*EbN7gj}1A@kZpf5=+T>uED)RRy&d
z0}%kh1_d5st34#j{PJ+_DrkaHHug4(7)ok)xEjkaz!33up4<LmbILjGXtKK+>*9O^
z56^hr_@g{@S0A{s{uu*fHoWd>utPn+oSHMgX4~K6l9gKK=I5mJHiVP41`K~RR*61I
zOxqvV1-ku=cRjle*1X4Yt+Vpo?`D#T`YgaGP-kiy4vOvneI?T5@i-<SuWsvI+VVsY
zRXjGb4mz?T(R$$E*PGo8nYM3sSXFoUQk0TXRH1mG^vzd|Xeft#a@dZawKcXP&DO~r
z8xG6twYMvaIQT+5;b86ti&N-*Z_+TtoFU?EJC~KN3{9V{lsgzn4wWAnn3{+w{kkm#
zaf6(#Ry23!YQNaNI9RgiTFs^%b^>lyX6tTb+35}&Zi7_qtZl1|wn#|cuzyuHRi6y4
zF66dHB*Ug_ev$DzIHXo@xw7*coqrjifeCpZPj4-)H=YHG2c%*~zG07u(p&bk^gBG4
z;h&x@$G>|2+$O2~<HwIp&WPo5;9_8S=DY^rfsy{PfKd!Hv*fiy&94e21QEsT_Wjt|
z<v}5n9m&3xbyi(#_x*>Nu*%=EhDt*=GaH25C00!BxFbU&kdtx8?jJJ9Bx1#J>l~Tb
z^r$stVOfP%KA=u?KuLMM&TeuOq%x{n6O&Tch;ZYQvnU<sRALqzvL%ja0rogcE%H2`
z#M%gstCuyU_HRU-hnI(tsPj+(7XDWXGwAo5P9*Mms8@f1+y=2n$Rs{Xa87aQa00lS
zR#xHZx~S=1x>|rHr@Q&WHvhcMynX&DWSCdO$(gzm<jX4P-Gmp9H)Fq2W7Kagnq+}Q
zU5V@shM)ts^S@4tzIA#OhJ8%oURW)7MCRt~>>QKo>g7-yMRK8UNAfj*BmQsM?Y^S_
zoab8sY^O_P&S2z_ghoMU+L65P-7GN+_;EqcuQ-XRd^(S8cqsXR>w(FT?+s6x#(x?-
zFc8v)hK82wH>^XaUI0Lpmc*N;rc4S<`>$y~noAbc6eWPVy1J)}3Un*oGXD{JdTWJ&
zT)o#cp3hU^fXt<~B28mSYc4ZUoOF9~!Ah6x!FjnRBQ++UN62R}d2cf~y^9G$?yn;0
zM~nJZIy$;p;Nj}z7`_6Q!fr+Q9k66<SEEw&E;3#!Y6W=zwRif+_g;{^J#|L8>4N_w
zhk%k~*uqTDnnJY)4p*`L&E~o}$rm9DkG<y{)n^-V?CCoD8m!LGpNHaOJi?DJd!`O{
z{c_Q<^g*rkLXS<U)q9#b$A@F_)UqC#5!OXEzli+Ien0rc1z+q--Guz=th*pR4$l8T
zO$1Go<9TdU5&ONfLhfR+T8MYke#Z4kcGxZY8jF~x8vg5B=?*`*g>c6~58EJz$Wo|)
zM@<HKiY96=d*2>M8@0P>a?ecP8_wj3PcwULp6W<xbY2{rdG%0-xG#I`y~>JPtds!S
zaYbfoDQaoW<OLZ?wcJlW&O3)(Wi^GTyr&}9$D&T8I-B_s76#yVH$CXazc;B;;;EC%
zay79SUE1xsjwMZQxOI#kL1yv0hgAxPmcuQeQpH28$j~r_ZII(vJJabr&CC|2dEI^D
zlWAxj{R{N^Bh_~KRgs<j8>6*(GfoGmnQTn2^QV6{AJElU3mIEfiF`heCDCibo<eFH
zx@YsI7gs+<<O@*mTsenQ46SBjecng(O|DOb_~DLxqGS{g$CPZip!vwfQJHPVrSk3W
z1=GimPN!kYN%6bJcMujk#>18yw`Z}?!?J!pnDT#E047Db^*>VhrTkhmhtfmxB5rW6
z>iLWPv@aQ+F2GBW?9AHW3*MH_gd-dJv7e*uzJu@3e|k6hZ(K(Ow(h(nLH5?4Vbx&O
zM$Q#As%X^R2&9z)C#75*`^k0|uHWPt)VX#JTMWE0YthbClpbn46>I<p2c&|2?rdBK
zfB4*!e_>Tn`JScyli9t{KT=bBrU_LqZxQ1YuFwKAVr^}X+n2TMtiq0no&Zz?dt%q{
zK4i)7?mZ`W7`dXnoF@z>hWgqo_}@b7z3oLUG%&8Unl?&AR$0~5r+h`_#nDRh2#W&G
z)9jMBbKodNOZgIaWpB}T9&9i&lpMD-Vk<t{-+Q~{kExz1%v<(SewirC&GGI+4XnLS
zj3yamwzJKiC{=Cj+xD1FWB~M0j@6o+8a;h>%J}hP!s?HaeV&ZJRagHk1${|vS^=hy
z)RI~%Ka@_f<U%W$E3;|JyY9InTsOnRYRH#z@Kmd;iHjNglb3LORIQVwK6xAX`YwR^
zZ_}J!e!3}9Y-1~Nu5^xukGqX5UtmA~+7iwi!U2}czdKx=DTylg`}{@E$yn9P+SPT4
zpXT)o^hl%19ZcnK{F>7^!z+Jj0YBs9HLSg5UtTD^oX{G_1v_h;Vx9%Yzc1~#NufJn
z_alzC#;j7!pry>o^vN;J@7CDNr{7kNOa92fAgeecqc|iZJ2KEWpq4-gpZyv9Uy&OF
zW6pEy96W)MN?Gl7KKXp<mgCPdMR}`^hiojj*>!VL-Rye-`DZb6Cv`6|R3<q>E3^X4
zV)a6tAc+WjODAc0FLh&0fbY9XJuy9XT?t7;wP8IimCvIU(%CO}P1WhfZ1|8cLYN8A
z>9l1BN+9DHN=QW;37gb?nnm&VQEQv8@93Fm<K6c1yQ$5(sPp+$*Ny#@As0;n_ht8o
z(58&CCfkxwdg(qLoBPq{r+x+S3Kfg3*QTb9x?6*P2npX?HfBYhKEZysjZflnKCGeT
zXP6b^e;*KFA2ouDUp>lEVqz-{ma`8h*~KLI^UO~T`CH}%e;F19+oni3XY=(ohu_QR
zDp5_}%L4Ms!V&^9zDG2Df2l@z^WB@h*t~B|J(C&tyB2a%KYjk$2%=Y`zIXlS&xVY=
z?n44{#WV;tHqAz9cl}tHIE3C&s~AGikv2@pp=f_?{6)USWf)s~F`)YSC!7<Q-L!7)
z3;y495!E;?0$jpK#R#)i5yH$@j5Iwe38kv~vzjP{MSuSvrEP?Wm{MO|z36S}Tk3bz
zQIEX7xkxDRaPctVT%C=L%}zt108^Bb>|g6+%Afphsygf%b!d%`sP`Yq*w`==6Sfjd
z3>L7S{*MjH+w;+Wx_|9a)E)op49chfgZ!QU4Kt{hV>IM{m^CQZ)x`U|TE|7wlA1LC
z5sltL9m4+bp#EIXg#MQoc;)c#O%(r8@wWe35X1RzX8ylx%=)L_Zx8=}+y6h^_aEIr
zzJ`d5rlO{~qNXAM0PqDE8NEBB#3dw5e3cwSkQ@`65Sx@>{Kpt&mE~<*Y+}E^1Nh<?
zwvnua(5?#JcY;>#+%KE09=|(vItAEgq?VKpG(k&wDptVmy@Lw^$RdlHn#tto8tUz(
zg>U|K!uO_oZ|o4NVO*jehpx}vDF|s%BT)li3MP49Ul6a9n1V{szq@t`HWTl64I~jE
zkT%-O_3#lmj`f~}b|x=2GjGz~3yc_m`=#Ql#5SX!%Sp?Bff!Hy^hNd95|@njIGYaj
zgYHk2i1-{!$9STL1VeSJV$kPntxRk!$w)~VnVA*ckpOgrjdsGDM)zn?`iz|^rI7pH
zdbvP-lgRDBz`&cy(JW!JG`k1%06`OJ`INGRh^hd*GmM|M67pgZJ~$H`6XH3Y=QS?G
ze@CWh{FTGA(ghs&z(8M(^?1gOK2%{ykwSPt-L>_`3=H%d)@|}1j~vIz&o7)n%xh|%
zI$_#|hE=gsrTF`Qx-}Hnaz{i7-EYbC_aCAJ@ivKx`=GjgMXUwty4m96<5#otTs>T~
z(a=nrE$-?jSERln)w*|iH<m4XDjSCv2hEaFl#J?J``+_?X0&YhZ;w7rUGTWE-<}@X
z;7}@UV>CHCYuC8lv_0>n9m#UMzu!Yn!m@afL=Y`=28h*t-ruovyFzF4cro^BbTyQ!
za<PTm>DD7{K!nbpf?U`PIx)lIK{eW^Ml`%H0@%&FnXrOlzJ5zheREP;C?w#9Px#R4
zehhoKlhoV}lzbT(9<E>KB{5OQv<F+m@12#ZuBze&ERDPOwdr6Txb01xwdaP|@?niy
zUZis~(9x|9m1q>Yse7CZP?Idz`r%+z^Q22sNAD!_EFjzDw483}>N|AK6m(829_`qY
zv#L3QxG#a-3s*)(v2;1}!+79h8l=<Xxw`HE_q$`G{X=3`5}rIr0)cvy;KAeEr`*VN
z{#c%@zFoRYiJ+hmpEEP`r)b04H9y6#m}~70uqgN<V5&yOs(6v|gUZIHmyO=Sx9o&f
zc5`JjZ7uKLzn4T0&ZktM$EMO`(Utl30=UrPY12I@4x1DCSx6ybhldps9CTtZCXRst
z6I4^%Z4GF8Vh?gj=L9?<eEs@01&gntA~~P$Mn@v;6~*4n=-}WW@b=WRyYjs-wWy{}
z9n@uG`$2%HLjRF4)3M3-&U~t%_DR%7<Qc(4of#ANmmq<HoX{CGvMaK~`okqqTvCrW
z3tXw?pw6D1iyg!Vu=Ys@^T1ZXXUEL&F;rUY1rg85I?utzc#HYz;?}F#_Jb??-#Ct4
zT?S1))xIYs?+Yv+hKHzbaekMt9G?y`9_A824uz{)U8|F%>fn^q?#IYvso3euGP|CS
zgRZznv!l=g-qx)bSA*R3nEPH@;tsREx|#+TH>WW~tgnBFn9Jxe+a#pg+3EITAGu<M
zd|)37-4_8gI`x(^Tn7Agi2WfOH(|=frDA}*#xygzz{C=|>%m9{e>s$bj3K2w8zel1
zK$iNhdvTs)6(A%fgXM!hP&Zl-HF=*|A4DBV21|y9KEJ~zZ}8gSzbgV&P;}bet+M&f
zoAwqe$wx$#9;n}KpSr+CLmykc9{7>?EBVc3Go-t+0t9ef3Nxgkej6wi+2DH+92KS5
z>qc%FOw|)vpjDVtR#s6#L4j*veE)Ow6?TZ4xovx;+TCUPbVaM%T2(-R*q&6pYQsNL
z%F@R<goAYA+3G)%KPA=+p1*3|IA;L6!(=;47)m&y%P(J^7k}WQPJEmQ7G-pv&qzH>
zW_I(w<qORH1>NgELs2rk%t(M9LhsiLIf}9k+vWP8{lg<8$?>s_52It%w8%C0;|D7a
zSu05MtbK4Ja{;&=!UdSM?7q(rh-P7-N>0y8PK+P=*SiTX+%t2WkVS-cHK`sP%842z
z?GA|CTzG10Nx3X}v3N>WMn&k_rZ&V!6qoh@dSdsvg;B_Yj<r><kaM1Brq>Nxkju*q
zo^pkud48RF8uT6`m9^TBW#i)<6e51A>gu0+k4N;Iztp>BF6(=ZTDoD8q6G!%HM>{a
z+$mDeTgJ?OZ_pa9ER0H1_L}45;@b1`@&ca;Bo7vjEPT;DqsYN5KLZkp`vj&FRgMY@
z)WKOTyG8@0u+{7|_4Jz5LZXP64P89;XUk;NNah~d>Lus1?F6*7wPAy{mU29489nqT
z5roj`(HP*m_~*~O)B^DqiuTH_%Qc~D9UYC@DBa=_DEFvO4(*pzwA8dz)pMZhr?rgD
z!1FvOELYcC#QM}=S`t_Ek%;t^hiFn^R3sJ}F#(pK@A_;$70;oA2h?tIv|NtIZ64EL
z`*I1gzOiw8xqmj2=IWx=DjA791`L~=tk!2w3M6R=YFWFR<6-j<i`k#=j^=Bg<KPs!
zh>NY0l6#ivHI+4mI5|6Wu(Ml!oxX3h?H9Vk7-ojMJwTe*x7gUY3rHiq&tP_D)YLjV
z_tgptJCeX}?V`3g<eLK*rHn{2qp&HRJsE~nul}7o(8JTpvPdb5vsR&0Q~svPiM^ZG
z%rCO$myPdnSL~!qbbqdhed(nV*|MKQVr(p~QHmG0t6T(PB&vL1KvtO2=g5|{)!B7#
zKHC||tfDIy@Y?=f7Eu;abAJ3yyoRgR5~?6jPeVg1D<^Zt9(6XuytTC*^!dB0qQ%Tl
zl`Mde91D(AM0{#|Xn4urMW(Ldr}6?D0CtQ^2e?=-fo}e(LwaoL`9;E0EZ3ogNp-i`
zyLfvemF(IeLim_y^X<jKbh^8iMk<gCLxx@kjn9)L=G6|t>(|>`JIJLe@mY$yVkU;C
zATh{HR@O=0+jbAF!D%Ng7WA#w>}VWE#;3Rmi<tL^$kN*iO5st24p;eXSDsPx?Jd_i
zNYHQK@^LiZMCukXdvex(54^nE^FtOnQ|ybs*4=vDs^d`*-yCj*C)*ojHadWEGGazq
z(LB*yk*F=oP#R~pOW>N@o3S5{kVeP^ndK*){j<4OXXem#C7zZWcA(qVwlaakD59ZZ
z*1ZBwP5lAlwtqfEoo&tcP+xK3nduJiu%mRmdlV{Yn0ndlqh8r^wJO{U)x81`5fD5L
zdP++2hE?RP04+p@N&sALP&dAnKXIE_T6|pb;G@M;AC_EbjJLkdIkK&gPA=lHd9h(3
zj)9%iaRhWT+u1zs35|@-cL_wt#0>k~a)A{apUyap%X0RP$|n%-?F4cz{?!ObUXadC
zmgp<!hA`n0;$}CoFfxYYHIHu~0~uwVNwDYOkD|U}6Ix-vhd6p+Qk&arnbOzH<!0Iw
zk8*M`HxoM%6zuDW0z%y9&vEow?S=~o4`6~#$r{t$*<IayNHXZZdAhoapWKV69Yq#D
zS+FRwR>{2FaKF67#LpZoWcI1j3+pnw>jQvEr=@HH>&s!{#~*zNEi(MLhGx`5J~w{=
zLJO2qRG!^!i1!+IdmYAYKmM^mOyMXkfvz9A$&JzAxbu4HdQe<UoSw>Z@mFk80gc8-
zkp_sIjGRh#S{lDbVCtXw?CGYp{45~_yt{p~yQh}9(mBEL;p61^`hkWZ&2UP`C6?&^
z{A8ocEg3>yT|*><C@gHz#(8sdJFg(0fq||nhzz^8LS;j?84Az`AI`V#?1fvL_Xv4(
zl{3{_O@;AvV&)NDT{YTXV1iFD0|Nu;9N0Kn*IS@P(!CZ+yJjt3XK4mjzP>HL*Jd;s
z{sa=#79qWnB-IYXP4>c63kv9Pn19Q|hyi$Y59vW`2E9E60bBGO0;|96Mv<gE2uI;C
zug{~NthMYXe?Nu6G}|>~U<!8Imxm8-lk2)4&Xt$saGSQZotmelXO;HRy9Xx6#Tj$Z
zCm|7MBDBgwlG*9n3bpNP9g?(~eWc%-=9#gxH@=g=S|VY|G!XK8U|^t;)sao3H&k$z
zyFAOMtBgrVd(XtAX8aV>IPOgKUx7tY&SQ?6dXd`)8itPhUv?O7Xu(ev$b_fI7sU)T
z0Xx~vF3CR9#SJAHNl67|A9kmhuW899OS4i#iTxS@wQ(~(4IT&9OfMKYsN%yc`aoUn
zN@{@%mN^pD+Z$4mYb+KE+DO37?PzlA_#{`!P}t<|aCf<wBjoI8C^ukER!&aMOyHy7
zd4DynI0jY=;y4>g@L9uMV@mfKQn-e24YBmGu$@JmzjS+>-@t=e(xO_Mbw#HU+}+jn
z)R5xV-t?=bK7>1n*Iqw^lK*v9mg=HbH;<K-6)g>QB&AS=#6-dUR!~q-@a-+<@oxXd
z=&xT#>Gi`IJUcyhfVz&Ak!J`wM!d3Kg*0b*d0T6*lGIRo-45=AzQMs_4^P=jd|yvb
z&sY_eoSgTz^;CF<c=d~V0FIm;76Zxd&o~sU$_9!p$h^R4ZB5|n$j#%lA;4e!)o=w|
z*u%^F9ARp0E9i4?nz-&JZ-&S8`2EyRHadf!I}iSeN}TGBHv0blfzcyroYwho9@A#H
zW&fNvZH`-Jq;J;!-a*u842K)Z%io>I)(}|mT8w)0A{_G}@QDW(;{(ZJHJ-2s@RyH6
zOtltEPnYCK8gKKuCj&k5!=OU;)lNH{DLWsDZL23BT1_@6o0fb~g_*J%V{VehLr$2W
z&^<pF`IqEvg;K>d-s?~+WNDN*bp!*v_frUsta7Ev2!85SQ1k_@Ix#L`a-#fXeX8_(
zSC?D)LP25v0+Hcp*C&L{5MmVeKnT4rAA~@m@@Z3~JM}Kf){TfO@PKv6@lf(yzPJS@
zFBuu70AH(yhKk*s{Lh2Kaoc8}CXQ-$60S|RLlRu#lk0x`FjhK+uSyb)&Tvp#n%B-H
zc{GUkay45>%{u_y-YL315vF-|vB1;W8<i9vFW`Qdmmg#%ZCMmTbj8kwwa;DT;mH6x
z0-@fyAFZe@4D7GMe2~0E9I}R?FX{=2NchxJLn&P#eyu>!lOWU7)RY&}lnWW?9<msq
z>W}Rk9KnyLyYsZ-@I|yw^$dWKA&>YSR$N?(9)gJAr4QzLrHXj;axV@Aj6I*kOdXSn
zmWk<KtU_bba55lphzlDe*g^UzJg+m~p52ayhIWI7);p4=uA+*K{URHpUe8&SJyYO$
zAYK?{ZfZWyWqCeuGc+YIbLR?Y>a&%?A_K#(-=*nxg0YYpr9q>!f{v`$)IH+h`{_U?
zDVE*-f#!r6L#5UgNUOpyx9{sf+1~5z?P0i{L5t^9-f#V#^<|!vbzeqgXsf^2kSUOo
znx;aY!c^F~jjWr0ZJ<r>V(rc}RK-d~cPTx%Je+S{pCch5QSR1l4W`iOGa+3d=kv^1
z+a?Hp!tAW+=62=Vd@xh$cY%JD)0i8Ah1mYE;+?9`@1oP{xiR;G==Agy?6Ti=fKjua
z%x5!jPCEk1;PZ>3qA7S=>2Ux%`Wdr2H(@?I$6ZmN7CDZOX!C#cxgF#FI@1S0CaK+(
zOS|cE5X<hWA3vUvJbSijuzAsys&+*o7?Yg5P;F<Ci(cnyx8LOMd^BCjgZ25d#OBV<
z)zQ?Suq;x${Z#!v0`>M>0C>^_DYO{GwmX=g^fB}njh8rktx6(M4_fllYjxeo@~by!
za-wE_2NJ>!K8mRo#9JqD*py35B)!JCZFTa}|DrzGRj1;bxi7!v*u^Wv@2*>Gl^Idv
zQh%9wMIqE?P<`1ySg1Xx{rlvkl)HRtd=kWJ9P!pU*Zn?yspXF%55@oZ7E+PZF~k+t
zKpfJPaqn&@ZHA;i=w89!a2hq_r<x&yX>|?ty2H6;cj#(7Fsg5GK!IGSePFTUq<bRQ
zLJ3*Mx;&UJ^+Ph?pmh=(<`NPTS^)h8zx8M24FK~6)Ac^bd#WZk$1sH->HJ>r&-9C6
zKId&~k-CqbC;N%bomAK%97To*B#ZYXTAaQuN(f^0Q^4>lN8NR$1xN%3C<3s7^%~(x
z>SvW6b%%tKy2$JbK{_{&4Cz$N-+8o+)oGNHOu5=GHkMZuOjl~H2n)566C(3nYbz^m
zD^sar47Ei|iMHh8@^aUsjxCLYnML6BTN)Zo1qGkAjK&SgNV71~!8fENPE>*GJ#Q6A
zcnbVG``Tho1MHd03+t2Xqj})WK_6Yz7-3q827Qm2Kx_)3`}?gI?n*e0*cJodWjG4u
zO?u0|dNN4jgZP~eSI4NBE8z4#qtoL$tQH3KidieLT1L%O5>gT0_1&{Q6J(+X2H&oG
zzR;;J+ht&2R~@I{D>f58zaL^`!eSCyA^{062RtP^D;P3w(3-vRmK_FDGwz9O1vdR~
zSeYKNR}QD428QgdRI}K7EP#j1hO_Ww%&hqS5M5DFO6X!Es+f6{Yn#3AbVLnWUa!<D
zt}0a<FYQn446AbgcI&oAf3$s0A1Waqn;}m;CwhXWPz7{9c*k%`=^hiC6wA!;KBuIp
z<8Nc1kU3ZF>Q}Ct<vLOnWs-dKY_>Hrwv+KlO>oWKCAEiNAW{TSmQhBMw&I-jKkBj<
zdhRGFz653%#l*!{se8~YS|%zXCMvAGzy14^c*O(Cd4kd^CT4AHU_c=i(TThB_<M%*
zQHg-y_2w24f^bvrM|dg2D)cYr?O*Z-7QN@3<C{z6)8_N!LlOv(halANv%0#vs-Bpt
zo~n+lj!ur#Ou@g9^}C?|Md*3E`u8=EU;nS_KmRxQ@qfxql>dihsQ-_2qt|E^*zD}=
zdAzA2{l(JBIxM&Z+!(5z?3Ve`dY7$LOH{Ny$8|8r#MoRhMW^14yg>GV!&=!$<sBRr
zoL@Q=Ih4Y{@Q!V4c`ZBpn^C9Ng~aF2De%OMIH&D<ZDg$afck`hkRT#5BAv62RM_KL
zNGDqrdm%1&<-#aLiUqyosTNNCT@;Q$?cP_lYHl^pg-f{i<u*0eESDvx{lLfV5y=%_
zsgX>No$a)QjG}^)>E9Z6$nrNUBG!NkV-$gu_te;prQtGI?OD}RF1x!qhekvp(ctN+
zVuQjY*ZNESuC6Wyt}N;UEf2p_yRio1hc|x}s)(RgFk0_{yW$H?7PFQ?q>gOHZsmOV
z$VX4i+rYr!vr8UQbSGhx>~-zI-l_#K062WH)RFX(*CSJ#N=;8W4d$BUR7Z*oOG;Np
zzYW8ehjeRJhXa8wJntE*oGW2SkTfyvdH#n$DJ+Eh4E78TKt1w#bcDz0{a&pu58cw&
zRa!^yeQA}k{L<u9k+#ml=q15LN)cd(x`BajOZ<TV$tyzKd={QtfRXQu!Yeo(xyS1D
zkK#O&9i?TT^S9i>NlAhXG-<FFCpY6ql7vgJXJb~YTPR=#w%phM0J>tN<}yPTg^BF-
zurZ$x^!I1mzj3!$3fWO&NC*6JvHRzb`?A9iy_ZNu5*<lQa$@P^_Zk63fdtO4b{asB
zm3IF5`A5-jz$jRBROF4tOe<vCPDNAG$d|~9e$P+q0iW#k_~dldP4$t0ujP23qfEby
z05*JRWRT^gC;(Y7Dz0V(b%MJ~xsM)`<LK?M$}>spoVrR5(aFfk@ren|{LWxV)YL$r
z8Hw$EolS{Ve`s(y3ey)~Kq4Y&wiCY{4+^5QgvZ;0HEj6n;GaBu2em2*5(#d4adEqg
ztwlB~9#FTV$0{UjZvATj({aU3SCo2Iq!Z(#2{AFxuyBBPk4x|yP0zLSxEp4;NW&Py
zQC!L$uwZoeZAr;c#NE-)ex@zyMnKT>#1_%tSrAOaNtXO-hmwHRe&BFmc=I@QBX&%M
zlhx?@ix(tbO-)Z|adV5|D!mWSsHHXg51!tpbaI7G7Ahm-k`ab3?BU62H`|~(vFyA$
zZLw);mJCf{K?3-ln%ha$wDMW4<}#AzJ=OJ<I-J)0=G!0mn|ffL)oMdJEpK@_XX^kD
zK@&S;OQr4=6KvycF>k3Q^1Y^A(XS}pGE&KHSybvZxEwGje8~mFwsdC%y#=Lkh&`_-
zRlF>F!AwYD!}uq2&Fx?PCYF!67}2}aEoU{|i<$F>hqiTAoI+l=<9w8eXxv!bDVLI3
ztN9XV2)0C!gg8xf&io7eSW5<ekkZBG1TeZ^T5h6h3{Uk27P(Mjwa41}skDG;w>2Wd
zHmgENPK1GmVe}tyB>1J1gZU;MU}|ob+2{nzMHK$}@r+tR0w2{x=Q+3LL&v7`e^@~6
zAY-9}^~UfJ=h{go1|ea?g?F6+QqouDIHz+-kL0}F9nYB<wnm>Lc_=-dcQ{jH;}xro
zDTbdE6sE>Ia&%V=RK~^xxb5?YxVX7BH8hys3Hx@O(}(Xc9ghE=;IY6XB=ouHaV2>p
z;N*f3es}{2%lrDX(9pOh;Qrpq*}TQ`;IqBL;Pz0VQd&t#hr+Jvglcpa|K8^Pv<O|%
zueU25P~%T4zD+w^RqR?Snk~L-rvn!@!VM6$(Vk4VQ%*M>r;Xuq9}FDjrT&2qr;F3X
zW{iuGzCMrJRh0|tslBoD^K){bTcfwb!}(r(aj_K~){K5d`BsO)npoKFe2}M-VzFuC
zba`uiiV>+Fi@KsvZ4Aua*gDYC(_4{~k)8Tomn!5_U=T@i_`&y|$3e~V>)oB1BBRb?
zd>XqI$iYcG?V%NKloENbV(RCOCZEeN{o$a&WCO5Qql)+fhm_K<_+%an9S@zaJnruE
ztVlAF^-Rf9p~VRQwCnUk_2c{y>0#Nfxw)~|)%*~<R9$uX;+1^<sN?k&1*NgE$?0k1
zSawJ>(N!@Q=fQN9dA+k}lgC}y;{*-UFm9p$M*f-2qdyfZujR-IsuAuQQWPrgg;V3V
zecV2g=`JamYABHNevv0Z$l0iKoGUs@Bpc;D2gl$z)YvlXA9OEtzQ#rjMGDWgE}!KG
zTI?|eT{RoHh``hPG8tK!aYR7JlUw$PA5nQmg!xsSTLA$9vOfQ8Z*NiXId=@5iL1(1
z`C>JLHMt*v=SKA-<A!6L&m}7Em9*5=Yph0E&lQj*wpOz(FDx#sZ6b%O6OzeN!^&Zy
zly$7HumK5YE#`!{gzd<$M%K&C;ubo=r`xZxQrar+nUDD0Y?q?wAN5Ns9{g4iJn$9I
z>vI)bZ$WCqZ5s3Qi1YMr;m`KB!=1n-!6hVEe=yw=UK8OGdXs#`@uvuX9Dd*YPe|tr
zse`oIV%Qo|Wj^O0=my#I6FTs+1-G-av1@9o%E~Ghcu7QK>)Tmtx4OH#dLfdQQlpUQ
z8M!5irB!eFCS1tvcuft1<mb|Q(d;fHn&RnGv{Q!J&GG{XlCxi}(3L*NEeyO7Jd$nk
z-04CmtIS*(#coDQ)dy*Y<UZ=UDPFE$Fp77GS*Bb{1&WJDWe9;1;yBAzR_Bv6hbx#3
zD4Q)~XR8TQ*2x{=(aRTh`;DH!QT>vt#~hcy6jEm;*4TuYA~S>d8yQ7IVc<wR2)(EZ
zmxxkHgWZIRs^nRs*5eSdu+M|>-8X&CpJinku^`cJKSH9fmi_9~m`)%&H{`rz!>PHn
zkc+)Wm-dd=Lk;lLZ%aTaB{C87E;>8A%w8ojwCB8_R<B{~m&B|^0b|Ir8WeOR#x}6$
zY@w#6T5mTm=3X4^2RjX#o#l1rI4dfm!z9_2yr6XRoIL?zk;KHj8d(-X!c*4PBmzeQ
zGgs9_P?N#TWj-7-;qUwRO%~9B0TOON0tCZ7J{Jdji^?TDIy#HbRVP)h!Q`p}a(QLd
zR#3<F(2C?1o;NPS-qA72$SQ(;5U_)KdzgN!LaKzO+hyO02{NkLRRM-bjTpA9I&=|#
z(_q~}R_!Q+y0Jv9r^<*aa2+3}Bas-d{L4tO&W=6t&szmOG{^*BM`tk%kV=IB`%|^P
z^*aqnt#c){EGiCn=0){7Hyadc62i$6_A<UQ5}oHClP_YHMZK_|iA_psG4o4aFDyI!
z7*<gfle4guK0WG3QZQ<Lwrm#{7uRIPcs;)sSq)g|IcHfw@!>%aL4z;UaBxrw(Qv0R
z<ynertH>xwB+?_C^^H@JPMf_0_S!*bD)CcBQCO(;nag@{TURzov^pMHN=I)}nEwwL
z?fX;aG`8qS+Y|&MOfx}??!*P@mIcVtfS&P9hD0mf(%Z&HK0Lgv6|~!coM-g=g9E1e
zjjj)mCU?F|cL_Wgm*lki^GVIiiUxwfBN&z&FX#IRK#hvs|3%zee?{4LVgD*O1_($?
zt29VRH-ZAv4bsxx-3kiQBHi8H9nwAY00TpJ3=KoRr_cR7YrTKKyS`t3a=8`*GhEko
z?tSdz`0US(iL%4Bdkf1uf2==#Xwy5bp{Hc(6yE3d-S}Hx_%yb0FS(sg+S{ewIek1>
z31f^&{8jj{np+;FaDbZstAeUpPOyQJ5{~k`<~NrWLGR`QsrS9bx&&!Na@W2XyVF>h
z==!eLxe-b8g_0p#Gx5BP1U}CXvjn^OYOH27ybm4n7H-2!=Afffs=t)Y;Pw5ty;v#Q
zi)SpQji7bSy?3_Ih!biE&?Qu5&p)UzNAgL108_;lXT&+lh3&+5j+2#J&&3s_<Hg3V
z2GkjO2)~|?m}|Q@JkR`nHGTFn1BaM=#7_MOhALHlsVGZtF^@QXS+fBi2^s%jNnEY%
ztjSIJJ0~~y;pwy1yEGf2`VXo#h@?%|sMz1XW1>`%4vorD;w}^m_157QDrG+V)6OCr
zFUb1^b7kKp+nnv-hte>=_PN?RvY4CNVA6g6r)z>R%@C;GLB8BJT>1LxIXMZ*zsEfl
z+J23W_Cit*A7KV)+2Zj!o_-In9T`_;q`O;^^=z*9ke}*~k&e}Z7M>wS$hZ&YS7e>n
zdz_`X@z(H}Q+Q3S%$)8sZlg6Ou*d}k^!Io?rgGwbjfYJ$X}MS|_Rn`^mzUcuY+$JH
zc=e4^pAd|{Lq40xRd{X>hSLKQ%sLH2xg;d&W!A99{hB21Y3sT6r@1S<z6_-YwU!em
zzzlGDpzNg7q-ISm)*TfXQR!V1PA-(Ghk*2pCQ!1sh2}-X0rlKFE!xLy`uN2a0S;Aw
z=QaFC>nxpbb#3Lw&!90^X-#oH)m1GH8}SGsuk(0W?)=*M0@-T`d9o4RmcFD~zcRAK
z*Zi0{BvInw)}QkpdauJht>m{qo4LhTd>aD==F9=Fr_<hahN_l}(L-U&=tH=N9W5_)
zg3VNobL_B&j0Q?hzhcF_b^BZ;!F`{f??a^l$)Lx^Z>nfyvOce!HE{zxLhjq89}~M9
zVTt9AtM|bhWiu1DXsFCqzHh2%htmoBZkVGH<wq~DO7vOu5NI?(K_SM$aR~+m;}Jd7
zT@yPw-&z+uT&<z+=s4W2{|Mr#CbxL#kM|vkycV%)94j;*#6}6YM7^|LsEgt*c_j?$
zBj9FP&?B@PeOI@8QIF3w=WVOK7#q%TPtw3n%_$}&<#Ft{9n?Mh5y32Yi6s!L;8lJO
zBc8H+@7a=|ks!xBQj%2T<k5@4qse71-t=2#F<l?<Nb<L~s??cT=a)Vt_B;=JzPXPa
zv+syGi9N);t+5&Z{V2SB>6NCahQ=&b>Ve8kq2%B=WEUCPlqBbgWP#g}kP{NH*ocUT
zd^GylvSL|08j_P`m)bf%cIAqYt;$4+SE)I<>eDF%PQf7-cEjy?GRwMA=CjEkRdlor
zM|5O30<9;nlqIY6<fP^JhjBOLEMb|ddDCQT!4Unwca93hCrN4JdY!rro%)e|_TT$E
ze$z9qkQ3o(J+E57_<XZ&GMCe>@fQ0|agNa{Pb@SZGxUsAm{pZaZL)%FYitfaDyd?3
z-tLJ!EdO=gpueu5heG?Gr0JS^$M0%PniWj4J>jI?6n4#y%jZS~xrH8O^*Z8;uU#33
z`-h)lVpg)&(Y1Ux$u)__D{mq9Ilc%9TAm(oaB#RF6Kcm(hiv)2|MKAWe(BGx8ArZW
z#4s_P(~PT`@O8r-4bTzMHj49#uKjk9n3(%b&Ihm}XuA&zo)lT#X2E2iF!LKeDP>to
zDgmc%VM`!|#tmtgZ!CsA6nR)g_!c@n3hEp@swKCxbI#kk%5of*gRixv&I^EG(PHP(
z{g_n6+c-Fh6XReZjlT3~oY34vjey@8RgXX5>hT^A7%Rf+)>8i&E0X^Ek-QRmozZ;N
z_A0F=KYj}|r&W1tFT(4;S98==^#4)rrK@EfWxsTt62Ch_y?<oX_Jv7iC=rkQAgjC8
z2f-zn5?4mZvP5@;KYT(z8X?QwgF$AkRVQ>}3aqGKg7u^m^svd{si$JHX-!~II%fLk
zUr9P5Rp|WqEJMQkMyO&UoQ%!SXOE7mva)=Q^BMM<>0dI}Qr`9Mqi}GUkB7Oci%R;1
zU%Ov<Y_4wtD@Pew+u<<pD7-B?8;@*9hECN|>XX!$;N1tOX_P(Y7M7;>Ymre!?E6UX
zx25Ex-`?idTcYIFo1f-rsUvCSWo6ef80qPc5q!!yViMB)Y<xT2Fm<V5sp<)h`Ip(D
z(*$7L^86w+z8;5NUQ#+E@iCc0_JUJk(dE^(Vwa(Xk%85hOZw3?mw|0J&i#(*QjHL#
zG2KG?ec}#rTzIm+&u{(PdRjdJpQG=XuyGrXeJ@BFAMDd&dGqnOBi&Mn=8TiSfIBkO
zm(-;MO$Z|VPZPb#=9)rIsbBcZ=cht?uy|Js!KsU_Ho(T|l}pLq5i~|?#+5-s4;e^~
z6~b#ae+CQf=$eUVQc+c0O$(MKr7MTEdP47GXyZ~oDs%_A$_93IeRNssSP#j`3k%sy
zWy#7tKigJORb_n2b9{2rI+D@B3yEh-xl3#FqJKqq_*Y+U^l<LoD2XMAH6E!|qP%~*
z9Ets79+$a3M!v9A`ls~AJ6~eehgVYeE{+)wgCEbF<Godnz*3>lu}xZw#%nB6-*=Rt
zRk2r%R$oIU#rN7j3@9?Us6xTf8`)!gE6hZ&R^@Va+z>kS+}{3(6J2djsF8(-!)<D#
zM!8qU;pC>>?!z(x^+rKPF7p!MtCkm6EQ}{LIstyk0<!TVu8FEaWoG2?nlDDi#__^H
zH{^EBa%~$LsWl9S`iDkylsS_ASea)RWQ<zY^-c8DO=?aiEqjRW8%)~=`Rf;Lmk*Q{
zW8)lVYVm5>enm@0i)V+!Za9IZdw>vb&ifGE>=CE;RTviets#g=Ydlv&8jWXOU|x@a
zf_Q4GV1&HXs3@{p&u4k5;25*yWaM-sqamfy=^&*jM9RLT=7-J%8>A?Ya{qL((Zrgs
z@$;2pQeurcx8N%tIsvx%OgCO2^?Th4SM=%(hshde=MZIxo}CvM(zsYJZjWSLtDt8l
zJ}aU2*k6wc@zGdDB2o9=iz>abwHeT}xFm@!eaA9I)!OXN=36+YmbS`pErI23Dj(gm
z81uYs+tEbvR$EoodaM19OBgW)pUYZzQJkNQ^weu-=d=3y`lVlAYN_7wM*9A9w(<bz
zZLxta2-AOF4Y+no>AKmk522Fm{>BKOk?*Ay7S@$CSb;kEySBW9i+LFsuKtr;RTw<5
zW6T(cN$jxE(ZIe5QRJ(#hKwA?w*9?8KpIrs<!2@atP@(Kb<K=}v*K(46Yx9{{bin_
zojlk~_tqN>*PE@Us&kqJ>P!ZuW%5@N6H|LgN><9q)N)E?-u9U?2?WD}0%F`{*$tzn
zPGXt0>yle%2}*Uu2aAidCtFpM#;foT(G^O0lKO^*R%H8HKRcUJmK6U_3usL)Jyquj
z`P~{To4DY6W4Czp0oZx0?z?>7;&wu?*DN=oR@cNnRz(TLdwU(3qUUFoyCNm^{<>Tv
zpQPm>{lmuc9}SdQWB+%2k}+fTF9`dbZ{!3<s3+z6Jtp0we!2Y%dPSDx-zi#ISp`&*
zI<htLkld`?VPYSfPMN?b+h1R+lI(@Zi)}bR)vV*H`(~r73y)GyOL{hXSX4Lf^MTQA
zd?TzLqg(j#B@)%1WT>vvQgOq~IYjGT$*8j^7)<V47=^e7@zQ?C-3z;UDv-5*N=vGZ
zCvv<vZV|GNxSE^1`mveEsuvE!EmTw>EAC>duMg}P$c*c08TwXAj<CSAl7F}!Q$*(-
z&PtbQ5DXDKVme@pRn1Cd_QYwrjq5B|iOlj}9_!9KjpK&s8J%Vy^-K0U60&#!uc-Rv
zWe{Zy6*Ub81$QF6D|k}@l8fo-*S@iTKgTa1B`=SKj@9I{+XK??3AX+H!@y1Qm?o5*
z-*=jnA12N_I~&?=wwiZe25<J!^5PmOa5P0ySdYhhT8FEb=>>idsHDcj6uKVwmFUhF
zAJCm%8$W}zY>s-a-N2~@{9u;;K1ZAeX8pE{ZPFA)O;`uCR5XXVs_M7eBF6H)hgi?u
zR`;lulFg4+a93o*WYw57gp6L*d5dW7Y!VB3@<sSQxbP=ZpDz$WrMySuEZhx{5dS14
zHPAmWW_sUIGbohig};VJ6;gIySf;g_<mk3Or1Ki62+(l7rG=s3#V$hIMb>$*SXhg_
zmDk<`6teyGew9%ElKU>W&80PHzl@{!@?&}SO1t7ONTR0w{0lN%vbYyz#l@8lcS-|Z
zjt&klZBTywIaSrZ3i{{fQ8lxWV)t&Ayuzm!81?QA%5OXH>aq=6f24YJ99DoJbv0Ge
zh0SV;$cbqsN6n~$vS~f7ZEDV9`cUx@=-9!4RlB8ge?9QFAhYhe73E@F>~xx^$zf4h
z8RftuKX-W8X3KPU8TSB7+f60g(;h-ojJQttJGZ?QG5hmplA|hJ$JBCAlOcx>gGv5G
zTvoTu^JHTIc5zVZv>G#EU-<4rzzHNTN2kgW%8VNLcw)J1T2@#B2UsmYciCdMdOY&M
zbDxZit%{v8E7Oej_&Bmk2B|Kks;pXKZN7f6FRA*JkKr@C)Mb!{DV4t^cka4bHKf1*
zH!c2?GfrXtWZiNq#K2fzQUW?F^%N%hXYyB590lnB2BDAn6H=qi$QH&;W>Dk`dT(oQ
zOLTXAR3Fw;J0j&m%$}bM)^(8LkT;s`A8X*|>9jhBiBeE{qu7UkFT0oU$ak@a_^rq6
zszGzOe`dz&NSrU!`z96ssAOZiVS><xkxDegtPbXZEE{R~=Z{84K*>1f4cXFRv`uXj
zwX)g^QD<p^H|)dP5C{IAR>Fj9-#WAO{R3oDc=`)P$TXwyDJXIcHwFoqQ`tPlMGaQ6
ziIm;ff!U3S+kr#*wd6BNCfVVw`1lZYW@;L0At$#kU$^t5o-p#0<KZG;z7V0TH~rq<
zf2+59aiG%(uW3VEo=Uc5pbX0n7laePBsGGi>w^*AKM6?iDD9O`aJm~8v(=+`7GAIS
z{=JmNK!2x1k$MrlOg`;a0#ixVqDT9nCMqX?=k04reGLAL$jEor52BBUbgGvwx1(Aq
zgc<1RPf8ytA0=av3hu4lfTE8qaea4%&v%tYU93Q_jJzeblQw)Ttd@CmvyAa2QoWpQ
zHT8zgX9VvqiYB$q-F^L>6O=cFU1|cnWZ!%@dv3|A3Xr}!&XWbkvLpiD2?{NB(lAU{
za(EW2E6}x_a5wF?c1yPgd1>%{_r0PTDu`q~H^;mifwG%6>#F?=GS^P-T_7%t@8GeF
zCmSFkR-UK!ZoViAUS3hT!P$4!nEB83Bddk#^%yNE&Tkykvd^FaYn5G~d8BO{BKXj>
z=aPORZYXCKm@ggXN5_WBGBUGCHN5QSk3W7CSGj4Tp`qcj*~*votR2&mv438c{5u`^
zGSw!=&9xWL|D|P(hk5^0>iFaRm~DRWnbyQp?6F9R5%N3|<@rHzpXtr_o7X=7>IW|#
zVTx-=YN+RVz+$Z#IH&vyKs{#Xw*0B7oZh^ExNrvub}2BYrL+8Ai-l^?9B?QMj!OmE
z+IoH|^HK5iI={*Rst6ek*C<q7NdXW0R-7LW&K~9VKX%v0X1Z{m>dr>1^NtYiG7mS;
zf4={txSzs+HLd3{{VVo&Ei0EHmbzxVJ<IKT&din8#Y*6A@^KElkG5g$_O>h5srExM
zSC6<qc~CGH6`%a6SJS`q1B#!2K8?AB*?6&H)X084be*XzIeeEnrD5qb1|3e}Z3b;t
zt%}`GtkbP`p-0f~OqW*Kj1?wf*&v^wQs+_an(fjJ^jqdzs<1-zM8HTM2&UbQoVM`R
z1R<m)*VxRo3o=m^TM>K8xiH3k*&m0Ft=@fm2MB6#9)95LR(h3LkTH8IEfItdtM^#A
zF%G#wLFwq|d~&`k>@>RMqSNMWt*OS|L<2m-!ggzR?-jn>@;N`jBJFCjc&nV;yti0!
z-5&WtZe-*jm0U_nDvX3HGmd6yD2c0<-}Pn^<k$f?1I56QZZ9i2Gf|E+z*9wIv#%8e
z=8DJ+#9LceXVwt1J$eNH9__jZtFYXJFPt{}_}rmfpYJZTs3ZQ|q9#<OSX0_kP!QH#
zfDi_VW;*SRn%mt&yj6?!Dm;J{8KK><z&Kr^oVOC`i#kADTL#+$hfn^c=A=N+V;vyV
z+-^L31pG}iC(2T%Vw!boDJM`C;B6fJc2UcuS*BZV1*t&ESk@0lL!0Q8)o3vmv>p0;
zJeXh2^zXXb7-&6DAhvgWA|hmYdSIndvpkvO_$@;u16#k6t&&W$#uA!&Hs{N&WY=J}
zUs)5P7F%EV^Q+$1-#9o)v1P*E>o<TRv}LLBLAFKm!{7es-J`5o%w6uw!)-%X3c>P%
z{{5sVB<ft9Rnx`H!#g2msq`1716x7(knf`TzUsD(*1o+Hz5HCS!$olc)Q(S&xN0bw
zRaL&Or{sz2HtT~J<<DF;Gj!*Z_;aPPBf9nXUHVrHz<Q0CD|K|XCYuv=bG&O!;{~V4
zSBlra73Z~HKDaS|<nM2@(2!M-AymEyMSD)h?z?+D(mz`u5qGeM#1mZxc4PEd`&Fih
zI)t&2kL6~_9;Y_<e<!a#zd;Y#k8U#Bp1FNOe0Kyz`|AYz+V+p8-GiHq=VuruG6|ZQ
zzrqverfuJIZ$LKAm;LkOKU*_0=GOCL1=5Cdd@=fRnKXfMsbR3X+CkZA2`%o%UR4-4
zzmZ<ddEA|n3SRE-pb><R+94M=XCXjZ1>`Ft5@OWHs1?xAWL<``hx*v~BrTv@HZU*%
zm_A^5JL=Y{s|6EXs4e5)Z*TX-{A(xhs<F`2(ERLi?bg)bJ32mDtWz}I_xgj@GcRhB
z%L%jmLaoHa>r3y@;Go#p-_vCoivy+ZaV}*43BG(4e*Ayg3TOxZzU<$xr@a4f6J8OW
z587>wSo2X(6vERTvHo>9UNXNS(nyerdGV5H=-(gvp#7eGa?JGZ5g-l!_kX^&5&U1j
z;s2lD>;K1&13+MU=Lqcq=n1y}zE#!1A>$LEB#gJC^h!uW%Z%;}NOLXRS66*@{>VbU
z++VIyp$m4V%EF#oLt~I3-8obZNMvo%;^#w2-6kGE?_00s$%Y|cDmtpIt%fL{Z+DGT
zPI;lJ>19O{KMvrjv@EG3!^61P_}fzrp3+Sldwsx51>!?47ssK&APw4hd%0{lkW>Pd
zuq9@H`=(>4&*%%{ZlfnxB;)mN-M!=1VheQ-DaaB5=Wz`OhjjGBMR#{n9Irw0$Ufis
zR{KIJ*TKB@VxumMphP;tef6#+bSQL=K+P~9R0SCPI|yy{^jh6H`IvKK#fFJib3uix
zv@GG<wjgodLrnupKW$d)S`f|u*TpC5w}Z!*s0pNhzfiB`s~qq=oA?TvLESTAm3P~7
zt&ZCsPuk=k`mC(r0GtiO%RI*<7a(iC%r{`-fnRw%*Jye#p?Z7i=WKhPN;X@N=Z=B0
zfjB>0V3gp_ladwP4$!$3AM(x4&o>)vB_qfsxaLAwXfL|-W(Zm#BiVbKs&}g$Z`FcX
zG1G)nli~(r+gx0Z&n{pM`nxr&gbbg!fB%lEJy_(m>D!`&U1%gGPzX7O7G!@-|7z)K
z`!-R?cIw6$*d@P9h{bYm@N>t3!uV}cm09l`6Y%^%5%A28nag_c&M~%TT`vNxqYaYV
zd?L}%(b4M;U_$BY_b6H}MF3mg;FS7rq;h$A?bv0YBLUDoUfA7SaXA-kICyPlM4|-d
zX6FuRRQy%H{Eln|>v4&(HID>fbyl=2w2=4smVYV^PXAz&HL?(KeQSZ$D5AqZU_Z0>
zhYsDpxGV_Bb-5=X6L;Q`{P8eSAI6;GbbJJ`>(;tWca85Rx_OfwF<n!d7q-VX$q_kJ
zRGM=fp9MV%<MUs}kTyE5&n#GKG|V!Uko^1^%*9&7n=fn1&~|p!U+|>P%!Z5@3|Uz<
zHFUrE7ML8&%@n5Y=Z!8YW7(DvbLOZ|a2baqRyJE!X5i_4tmuLtv_j^v?cc%jn6f(*
zN#YtQ8U{uz5Md|eA|Or0oTVSpF7H{Imi42|R?SguQ9t&oM@0+neVg2Q&HWHtKkTg~
z<beC;M;vU!QQ`z0ZG?Az7h2ibW6v%f`d&HabD;gRBmKx_jNM5VMIoo-EgLdEPo!IK
zSFf`<w8ArxS!HWu-Di0&2Yi|cejiq#R&IPRU?S$uI_Aeh2z#A>{`j%0qswXU7w{Wr
zg2^cI<sm&KBRem(n4+%F+)Td(L!pcYxFB$U<2*UvlU6=E7+=l3U6{H2?5uh=`m?;T
zW_R>yEX@WI=?=V$cuJTF9Bk~2A!yfOL>;$_r=L5k|EC3%fLsE~3~IUW@y|*elA<}v
zCm6W+*u#B8q;sC>LD&~(T=^4A%M-nO6Ju4$4Gzm-91Et;tAP=v<|h5I{7nt>^{z$f
z<>j_@x;k?%*}o+qWS&ktCRSfQb~bTYT{rgN;F>U}NFaac_=|(70d7{9q>9t$`#*EU
znx|&KEG{K()(&8Qpgb1i;t<GJzn{{AP9)l2oR5x8o6r4%wVJrK{Q-q88K)c1zxQc}
z{|*ZbYtQ4dOMmYdHqc~I6F!P-CKi%AY1J6tB1z)%!Z)V%fjt_qgI7-ap+hrPc4c=!
zz$J0Daq+l6=!QYTx2FoZC;>}Ffx-Iaj=73V^|w-8;H=n%O=dll02XS%1O`oEGcqqb
zC$+%~KGDla$>?9G2uOTJun2W`)jU)QZHG+H_B;{m#%Sagu6mxm&b7dzd!`{u(-iFm
zcv6CRLgsNjvv<lxnsA*{RaM#MKDYdAq;0c9u_=gaZTJsL$h0n9F11cbGk6`IuLoU2
z?^F2h$EGRO0%)MA!UhsPtE;VheWj9uSBv+idWzWWM~hQAY2Md4$~73WDd#C!PFX`o
zhEX`;#d`Ba=DUPVa<bdJhbvLnGCy!8lmbfhj4btK(I>`pmzQeLag>yGJz9kkcDAdR
z8mYadEaZH;dPQ@W%-#|%TkrB^^S~j=B^$5f@qOIU=k7d4R@RbUvH)j2^UWJzt0^L6
zzBipsM2E6e&}aFa5&zN8*eumc<}-QI{mZIx`FOeIc0vLGMz4U}9V`uKb&@~cWWFgS
zrvR#UjrTAOiq0)MH*?&@I9doAktWNVG{k_Ew1l{XvYLTT)%g>a2w*w@PisYif`U?!
zh}2nEuhS)LS?m3++3lWO62yXz?R;B}$#Sr@C0BP>FQ0&8b_YPZXmVRhq5!MeW|>}f
z33TZsQAX-_?C<$Ha|z&~4o?#v)_N{Q&Bd(4Z{Jl9hWUA>MhcQ<Zl8hBG%&m?E<+-1
z=nz-+Qtb6aj~pPc0`V%YD3By(l>284FE?FAejofuKg(lYAuGT97q_DZ5s@bQsitUW
zC+8H$jHrhq7}esf{CkqVvT7Fcfaq4(Au9a)>HGcURTmpefxeFcR4PTC&Vl9)VB-Nb
zvqq~q#t%I7JP7+Jdpb(L$}G@@#M#+6vONa+7XnG9OMFkY8^~ng^{z<<an2!X$urLN
zmauSN$;Lk_IbSJT-Pp$!l;}^!&N22hrz%t<)syEe%ZsC(+^nACGYkx9kR*+L{pM1m
z`IrVg+V=Va=B5H`5V^VelNsN19Cxqu?G;truFocXnD{v=^GgcTd2$_Xi37=yp||@&
zOmkyHQ!%P}r^KhzP=8tZ%Y^M6XS11)nxd7>M*zFQRjTW6QuMa$JyuPbZLi7}Jc)2>
zvgYrT9GyMenvmB#AuhEvkzuDGVVgy8ew>Zn?8qoPTUzF97&|yP7+%ja%Sm^A6CEpC
zzo1J;&j6@x`dX5b(t}2uMy|Gt3D(ed59GNl5J|Fgvgu>YV9jAsgZ#DglcV*C1Q%W9
znz5W8ItHzcax#l$RJ}bVo)G(-p4tOozKaVNM#M{2r~9K1-o4M^?skap%Z6RN>s&$}
zX9w1>jS|ogfsDvj&FJwVdFB^`%gKtPplALbXQt9!JO(X%7YZs0d!RmfZ}(+6?q#MU
zEZm~75X9Ehp#|hGaXwP_7tlv9$dJBs`BU8hD7oO5<m5M*2nY*3#h@?9i4;bCe3)tp
zFYKNmgj8@;S*f(WzE~$o^6)+VYx<8~yE&82e3MzdGtNE^*f(T)0^6Jp57x<)l$1`H
zdj3;}ef{+U8_6egRuCvpM#B=neK@b!-XDV>!&b#cWW%{r)0n7vfvE%VMSL|jEKJm5
zy{^&`dJ~hPN}{5o+L_;EZ^5~KY$Dz3pJk9a-z-=VtKX%rQFL55LeDVZFpn#UqZCD7
zOLv=J=*PzYiiUxPi9SaCmqh2EF>G-BdhPBKrM#4PHC3g!Gd7}zf3N(l1ZuqJb#)^j
zwFc*!9h`F@?4h!9&9@udV@*&utTDEHMurpNCiAm0oo~^+K7e52TvMhqm`~4OikIfD
z_{jUq%(wXLe-K}M{YA*!u&8r#;?<x{l^)j_{OXBv6!3-8_4$WcQpLfx;Y<6Q(iBwE
zxQ@ARfhx84HTt`X_)*}mTh^qc_@fAMk*_&Jo4j-keYD;|o<_!PGR)L5F$w+A{uXyt
zG;+cY=a=1D>U`B^h6Z1<i?frXlCB}8OaQ}F&dP}u5t_YxHf0HHAaT5b(UV4jrV$XG
zrY`u@^yG>lhr`k+IT@c`o3Cg0Mom&|Nfr(f5mDqy+-piE*&=Qx!LW|-m7LpTdnLDM
zO;Wy516Q*tUFi=|HcWeo*IvigCa`R`n!clHc^tjZP43-S?MvxVgb-4GSBJ^;WxRt>
zA~uW8@L{~$)4loq{=rSq(T=mR(VNp>HG14Oo)KW<_YV#Ijzelys{XwI0B=Vcf1jQ2
z1+2pPy64e_`OBmiMWuz}C_(*_e==S>Ek#`@SXdDC3L$uB_yv4PiLvE+Weavx;8y(A
z7DbuaUYpA;%5fv7TazW8*UWEjBxR<+LI_MIRZb@Snn8Jr5elBd)2z%K_{jWCv;Hn2
z24d6@o<26E!kK&U`NG*~j1BJTEEe<g@-uwlJ4+sp8C?MYbXhn=e3L<5rZo>8Eh0Ty
z4&5N!Cy+Cv@SmT7P%onY5ccfp56U#t%;NE4m)oe2=@_>+>^iqhxSL(nVWbV_$b%x&
znS)Q4!Vbpa?I(K}b)I9#T;5z7RNEQ}!N<YP4w6ClyYD_rio6qK^e2;(yiF$j6*>fo
zl=bMjm(@+oDL_ugkR+^3s2=bO6_#e<;*&`t2w_hGgEFv<350xF*MY`#qKFdcin#Qp
zWkg>21_y-zKXE~2C0aMeZO`){7P%TWc6NGbdR%fsjM)A9y70wtRKn3&Hv^vQZ_!15
z4L#ks?C)+awOet}m?Pt_J!`F{d1ZPE1{O9}7WuZU`4?YHu4^aQ*}50moU$IG37tAQ
zo4;3<?L@XzeM^0~FjM7&hadBATlqpXY=@h4%-5`2U2Iu`6Fbl}T>NUDfM6h4YMRrs
zEV(XwXl&*iz;45x>xCWXqb>NR@?F?HXZ_Gj;OTOLjY!l>mc?puX`R7Z8}AJkFwx9p
zYji|-bB`eE9T+%hf|(@g+9dpw=e5z^^1--@N^_C)0&6uFfx)Km9L19)7K$p`j(Jy)
z<@+33Ee2s@-$7cAUoA<eCCbkSNZX849#cFLYPdp<+nHIN3g$t)4|nn{*Vfkg8u=zz
znf4dBA+yIWXT(ij$1BdnzZ0Tlvrqvjnc9wozJG9FH@~pLG`+9C&*Sm+Iw9VuT>|A{
zc5Yt7wVUcMP9ZRjZF0lbUyfW3@L1PP?J51X5AFoBGbI6iFiO_xgsA7=;w=$k54Rlm
zfqp6!BP`*V>2pi8Uq3kTVOR%KY-RL}V1-RaLRy?Wg`5Y6(7V@f8OA?B%A5O>=H_?>
zTxF!?vzFCI<ic4}S?ASgaezVO6bmgq$KlK_DhhakmmlZ+Kt+Y5=#I5lL0M#;hq}Ms
z0wal8LK18u{cMPLg)GV3f}_``vXG4%fDB|jN!*JErVW+&n3VOs4Femi4xK3T0tpB?
za8_s7X4aLC>>>HhiMA>8!m^To1V9$+0TqEU_fnenHGQO@{wCb;8j}eY9IRFlLG}0U
zZC^}ptQ|@G!AKyJLiwdJGWz%4#&)Ycl;GXFktLz|iA|Cz%dOq}BQg7h@8GE0T(_6!
z{}mH^j(%#2o@JO>Fk)cz<)gBqYLOrE8ujrgNE*wks>-RUNlB#_&8R(8-C<xb<iCiG
z`VIG7y*VFD^9-5i@!9yQmNG!9p)2mP5WkI%c_aP$XLzEfd)ARtwKXw01<bHtMGCi(
z!v?-JxXqxF8XI#2X~>d;Q&c)SKB+yZ)}J2=-c<JRLen6?B7=G&pA-L4TC8{9_pp-6
zE6o>Zx<9nnQj6c-VeIe6LW~ace@_ZEE6gX?t3RL5YGMpOkd%=wFg9~A=@$lS%B|Xn
z0ei~E^ck(wrjMKlr=_%gX#ePlKg@}Ive9uH+YJm<3~j7(74Fu5I8{5v+I+^3d%<nc
zK8og1P++SZ@#rVAh%n^m&$-Fsg;i<kV2>K>5nWyiY_bxnGFFenr@3CZ65;#~8<+hd
zrb99^oAL=_)Z<FygC;C|?nfN!Pcsb+qQpasN|j5R`>l&DTrDQ_w|i7i*E6%zCyN|i
z876`Llx4^rEC){eSQCQ5&9@uk&%}NJ&p~w|)cSt2r3v;s;bfK<j{twF#JcKa6iz6|
z;^}hmTFYzhQ&d2hzvzb^NW##vohGMw|9P>9VXf8pO&3yGu5<)|ZMoE@=j-a7JriMn
z2`3!^&O7pe^tK!z<**tM26x?iMNQ1KpIBo%8%}T2F23mhccIGB^<;x{laDu}#gqTw
z;U4%B^J+9ye2{Rqnvw%6&3+v%Hnbo(9lmB}0w89UNmwG6`C$WUOK|0JC2z<cg|L9z
z4jq{i=Op)MLEnV>dLC8g@DzUci!uKM++4*43&_!jL9SA%PcnNGHG$RDPVNvKJmPA%
zh2tAPFFrq5iMQz;da;W2Un%Ulif&WG>IMesLaPth!ZhQuZS=`$?c5waLAd9T-jM69
zR_8g+6`9TKBDjsYO~;=<{(H>>j|pME5)+S4LErcK=u?i66?V$fHZM|gLLF$A-!}w4
zDS>E#M3AUGW}r3V-*0%JKo1nQrMB$8vO}xQARXw48!EDwns$nfLy*VxM`Gr9ncFyM
zLEJjquEcaSk+$Adi9^03dg``w@sj^WqkwMtRaxb~FZX_H`8URY|NZLp|7)TW5EuXR
z)m}zOMuCe<n3NhB2_&1Z52(7RLEfNdvW8=75;d8MMu_IBOs{{j0$%tyGPGFczn`8@
zPQ*7K&{!o}5Ia;l08RV((^s_I+#u-1$1JX*GWl_FD{0ji?UWGPm_wCw&3K*aZY4&0
z_Ds$AKg&wMkG`y-Tln=mnq!*XXsPKE6?F}NO<i04{^gcl^KXoom!iMU)MC=H{@v5}
zRgaEFC>ArDa^Vu2=CQbpB6dmtu{fP>{~JK1y%ZijWB#8Ou;Ec;@V}4pMs&>nU1FiH
zy86>Lzkot<8SMsq=i;?vm1cP1ODDE}!CZ&vIi^N^{R8g~4cFG!#@QzZJ@FVD1n|r1
z7#{x@$JNdfofH?ME9OgD(wRK(z!K^gqn#QI)x!7xzy6jPsJ$$%8y(0hLI~j+$ayZ9
z?)_98vL(bO0?`wbJXgfd?95P_AoRU_8n%h*-uev}5{V?KvuQk8N^LELf3H~8<g)y8
zLsnT?Sqg7Hf}eSRu}e>DYbz|&1mS?4sRDkhrB{IL@VHf4%0fzqUkkoKh?Qn$Y5DJZ
zy!!$`INjrS`Z5@9jUTbPek>xT^c%_aCMzqpOrsyucIHNY&}29a!}kK;!z^Xq+b-?#
z9vQi$wB-FY#6&z^wIc2WHs9)dF;fu5@q&be5QqF~V43KI@Gs?t&m=qP`iZWj+ee-S
zc#A6$2wkBl5P^}>5s}z7?~m<SF`@=BchsS>SIj+qQa}47gZd<c3kNe|sKKB4J#{*2
zZ&^%2LccFJrJz4@AG|^LPSLTZp%PD5zYl)qUpltzadJkoa2w-J0{aFARxnIWjNbVM
z0+7sc9*F?pC=?bHzMHS7J@1&3=J=uv%T3V1eVk58ukiz}h^+i=Fpgs|P?<S5khx;e
zM&;edNH;XVG&I5(Do6kP=U~m~3Y`??#@|c*#nVUOdV@2g`IfySPKU_>uo`pa!GU1p
z{?*0)#m!X6_pXm(sNMP~_orFYU~XW^RV@EWCVhFVQ#=-v=lkyZ4KH7{weQLhy|Aw@
zNUZ7)ecnJUUGCA_eg<$C=|H)wE01mSZH!%RBXnDMQ<e7xGx1Aqi?@$3=_2&3d^9l)
z3#mJ?arJ%P4aj!oh~Z~9bRtp39@@{MDgEdnzO49rV_nu3Hbb((QXA8YgPcKL1A`&k
zYQw>{K?0_c{^63`lFl1Kt6grl{mYxxya<{e8kJtdJ1ds@Wie4y%BRplq+>oE<6@i7
zb=D#+nYFb$ulok#1<CbU@M6d&^GhKkvmopPnDCdSz@VQu#}@a#ef)fSqB29DR)x1>
zQjYN`Ww+xewbQm9p_eRP4gL*Nz6vdLXjhcYn*#)zc;N@Imv_QcG&CmW`u$J+n;xm~
z{McH*F$X7FLYw5{MP7p|4-aZ`3``9B+ohg%tf*hbm2pNVA%ld3xT@-xEPCm=ejjC|
z!hN+{EBNN@!OP!}x;MB}+zO9<O{gfS{|7Tsjm&o&uB51_xcC~yopuwLv0HpsYqPtc
zsS+UcbhCA2=<-=s_7+}~<n+MnHaAQ{jyw-X3{?!wyYmyhK}2g1S_(!wg98Ja8q<5Q
zD%TK`VPsmqpC!gA@eFifBI+>#M2p7+aJ7<?!SyBNcG*4%rKO}?-LHxRJfppMa8J6D
z&o{YWy8tT(StJ(#6tb~aS6R;&d18rRCLa?dJ>P-)?gvlp9ex0nJbV4a7fd(TadM=X
zn>%5a!1aF$794QARgqR6oa{2{zxgp$q{<=)nXI0Cg0(N~R{!M3_e<pU`o;zr>~3vs
z$&d?Ih%9&*GmG2U9NbEr1ETlU*2Oyj-(nHg`yi{M`~i@Lt-jnpJPmemaID>*b6-7Y
zf>YI4w~biz#`-q7>}hWdR=B!xnD?mEew0!g-`<wy<>kH03l9mgo^M2L+1^{2kci;6
znc2!K*1{nsaM_-VsT;8c%avAER`Fx-CZ{++6v4x3e|oYsD1YldML@4057%x4T>qHz
zq_*$|d{P`yaH_6Z7Fv$Nppzq|rcm<4#55MX4$r2974|$3Nm5?f-VzjaKd+7`v;Cr=
z@Y(HU3ujM{IEbPnMoUv>?zufy77HOMJPYNz-kTT9P}_yewM_|<h)h4fRGYAVTpEzk
zR`+loi$9G#x?Lk7!%d1!EG#W8%`MdIooh6O9;k7)c|VF<BGLV1wpFXc-$B{oPMt*)
zZurD3%I9hc+xu#RMW@g6bhM(=$uN-qaiixx&HenFH<WUzytf+*T60bXY_>KQHYNsK
zPD}5l6s6y0ET!!p3;3S>?lIMSwJ=qbVG2uMUV4b)TwN_4+JF6)!*cxe@>{3I>};=m
zirvZO()E$DgOmfOb;{$j9j0V<Jx$HVAzGXpF>hSKZizN|Q<l_=^P{7qGet$Uv8kyP
zA#*e)_k>mS){00PYt7MsVazlEuj(!r<B5C`O%GyzFXSnbkBe*XFrp2cinofDDe2w#
zrEH3l`g>(XwpTQa)I~3D!Tr&W00&CLWmnfSN+2C0<2%*vm?UWDn~wN5JuqmUFG6T2
zjf$WD8nCp@zs&lHQCr|1%KDnOi^TL}6hU1O&?JUH8GBiW`-~6lxn8AI{5*We;~14r
ze?+CYFKP48Qkw#M8>9(K=j(f7si<hiWe$Yug<X4!C0A)!W0p4##5tp$P0+M?-3F`Y
zXI~<BDTQA9jE9;d7PQ^5#*`=a!Kfl{Bu%5mNvtGMc&_Zp{y|fHLu#AbGO!*si}C>g
zI<4vE0<2aUBiZ-H*L9!A;f7B2<t2JS_%g-I!@cek@ML|fQJ&wWtkB{*l8M?%;f+L}
zn3zEE_t$OnR#y1TV>x#UN4cKR$vxKOw9P2Y6t#VbF`*>r<g_(a^5p*M1%=RB4v9*G
z_2iP{`b{r%Kjr$ugehK2;qc4?t)jx->E!sl(dU{bM@Qm<Y)w$*KUelCJS;_Exnz+4
zE(dMsX(lIfVEYVM-ckj9f*(EI&`K5Xtn?b*`I-Mo_gT}!(I?;h`~_jIW5mpkqH!0@
zX+qwb6*in@RP5~R418B%C$Jxm8{s5pzA4_t@bUwIf4HIE<CLYd5OCR9;}+)kvvm`B
z{Rd1Fa(D`wHU2W1T-~#58=cOMf2%THE{4R%&*VYU0OHSKsBes&MjoGWx414?7-}pf
zCz&zicTv)jiIG$bqEX>xIt`7k7v#orpC}b{xg1vNL74Rzjov<;#QQq{eraD3mo8pp
z4tyLd-+cnDh@w#v?~fe~_*lnnn?f+GrEoPjv)EGMorZ9u{Ct|TOcG_AN#A)xWRWk4
z{AfD26QaJ4>jz3=Q;icyKu3pY?&arPpxMbf4uTzNK8v=W*vNP#<(TPiIH6eAETd&!
z@4vKfEmNA~r|@|0G;RDT5hdsM{=E}4K_h3f6ajLqq9E3UD;}}BkmFwma<4K+&eTvF
zO$ejyY_V9KoQ{;dkn>0=&e@CUSTfiQvlyyGOjHhI+zG;KB15d!MZ`Jjb(Z*{dJs}^
z!EIn@+v#mIQXfRN*5$d~=ms>Zy@;kVk?2LcThaMO$NU~UT~kTim(uwzB7+)l7M7q{
z(sifRp$KX2m$fH-aw+bvWTX^vFPE1M1Ir*&H6&Vsmq*UhBr-wIGrt1}%wYiInUfy`
zndZwK_lf&*?A?9iG}lm_!VkxxwV)e(IiC@PPCzKRoViLuM5=&mqVU2}o&7Gs`3t@f
zu5z4h@n^s=X3Ri!84wqfpdr#I;^oys^oNw!-fQ_d$GDZSn$;6?Z?%S&A;S;ioUj$>
zG9Mje>{G<ry(oP`z>=;|GbFK%J7=jNeCOof%hK*U)x$}R)^;rxQ&667*E2s0R_ZL~
z`qsI5xF5&e^!1#3GhB-wcA4V!fBJbFpeu$-#Y`hQ81+lB3p_9MLVa4nZikrE*IO|}
zmMYMg=wDAUpEaB;k&~$zwGKu<!&QH)nVEaF-xJZ{SBS#Ez#yM0><!G>SH24g4{o$o
z8&D-a8g-T4dP?C<*A#SGE(^GKd<W*tiZhGC?`5;)HjCj4Pr^wvIl{?AM0E8Rf-4zq
zt)jL;UP4I$2ZtCuY6KA(C=!^i+oO_){#G1}d^8Zf%>49r%%NoNz;L;$&NHi>kz}sn
zxk8usUzQ3nEN4$F^Ha;+Vbh$0>hFXDym>*S;>^m5ikg~2*c-g$fY8S$Gc0;-d<K22
z@V=JDi)`p8J+v_5Ii(b3E$O6Ij<UrD<e!BUGX0ZtrklV-dV$Q&s^%t|o}O9^VkyZ_
zSE!Hc>s!loOB$W`=T!Ll98W)b89bVbb~7YjaQ#IPK*q(zR`>-;|DDf$gM)wX^7L6t
z(zue+-a_`;nz~$BTlg%}QTuFlcY43`i7tL*s?GVSMo&P%(X*pvZ0r$cW&oh0t6vV&
z2G16+5is^_dCXuP=IwF%`*-xyXXseZ(cHGSSo7~6U~ZD6*%ywM-kMS(n5|Dr66;3C
z$I+gHmS)FlkWkq7-ndBJ23DPOx&|Ixr+PX%E#`*&&YWSch{dBop1^Q&_!+_lzOxcD
z!NqEF`H4xk<goAQ+<0n>n;gW<%1q@b6RmZ5dulXmIH+lka0swS4JmX0dt`rwiwy?{
z2aGRt_?^LyxR=&Uds)>|*B9G^V7-O6P@aEn@>!B_8EGL7B$X=*U{<T+>`q3=7);ei
zO1(Y#s?GD%v&4gPN|qdTa)A-@sEqGQVY03u320Aid!#S$`Upxj+op5XtkE4q#-pkz
z^flRmwT7C8M##ZSW}E7I6!1YQ^eEse!pE5d(Q$Ec@zL42x$vP8Ia$@)l0hvvzi86C
z7UO2?r6=6A2<2IBKU%>i1<e%_-o9sn^6Gm3<eF}B){Q63*W@;4sz{mGz{KjVINm)C
z8$5g}SN={#OSnT#H^9>bF-v>r3J>^5W5U4&O&-gt&8<Am9ke-T*2m?83fxad&{!!J
z&8<9i?)o@*yZ;M^P!__h5cNS>6*!bs^!1lP61pSnjg^HKI*(+T%>r1rE705wI<bS3
zG3ZFFXQB(J&=~W$@4kHl2mMsxcD41ark3>XXa!~D*ckYOS63GI+a<kkT&#C25<lC?
z3J9C2^)$86oXf6Q<(!<_-kdx0FRCkJ*^etMEaa%Lwldd0IzHQ#kSFKPS8sE?#suzv
z&<--ty|tRoHs9S~GOP0fYkvUf_QZ7fE^DMVeQtQ&Qk|WRUE=v&f1L5qAS92HvHG5X
zgfQ<Fi>-;lT&5&@Z4#DdR4`ib+0LZ*?h0wzuk^A!XsId*7w^E}V4bVm*7~k2f97<J
z1^ZzOsO&{zEY2VOx}gb6YDeeUimG+#F8q@fQ02N$My}IhzrPgO*&MkklU9(EqXEA$
zpA)%#T;A!l6(3$!*$EedSBv;o)v7(3G6X4s@n-XhMlNUe5Kr;!4`t1Xyi@<2TP<dk
z=E`-}SWfZPd+HU*?au_@6P9Z0R=CY_?^Y~MrrWe+U1Rn4*})7U3GbQ!bXH~J3kBMx
z61!<oNQj<*cX%6-JMhl}M$>$@Ec$sgMd7KEbBgO!{BB+AH1pQ(W!E3dW+67Sn;AEo
z+bB4CVbamXhr%ts|7ij7?{}ajw2X{{Pro`a0=6($QKr=7Ds8w9pNj#7$Kl~a#7#8c
zG#8C{&yc)k9bf}A>x1m@vVY)VM8YqS?;b+9@%`B(#m4@_NHN-^*Tkg<3k3zsPoI`}
zTVAi5PYRz{`QNh8`kvj0p$K}PGne$(E7MkVawFiWoYvwPIt$~D>52Odt9fq9!&;Sx
zJ7K$NdT!~$w$=G71WLslF0$8W2ZK#bb|V78w(+*uUY%LP0bI1XZcQs;RyGC$1eKxB
zpO>9DUuI@x^xxC%j>j-IFTbM{mnY><B_kK~`l#)71Bk-$E6NTw^R2wz$11sRb3pBo
z`Sq^|(A?yIb(WVOf+1;M_hm2p$ToSAtvfBwFi*}#vo2#O;V>=xgSloLT+nU!Go1`b
z?g-yyN-3+V@;jdLT<1to)B)lF{CZrA^`7f+l?3LBdl<G9m#UooR%^^>rh)dZ$=2iL
zF5NVnLc=QQ&4}>%c;@-u2X)=YQ{(FI#uU9)NvgJkVTt+}nD7%Jr^UPy*)z;DCoK4h
z)ZhS&vw%KKvY`jgpITy}?s@b2W+N$Ge1mv@M}_4=_0vxpQ<apBKM#Q3_Tz^bVX1EJ
zbA!|JNC&_D*C*xI-%-Iy{gGLxNva90THQ+D=3sl>{br~jD63aPLvw7%TiDwO1#@vF
zHY2C$ljm7LlChbkg$A^AeSg(+`)aCH#`XgW%Eq%!aw<#=EC8VF#74*3JeYZcYJUL<
z3wwTF-AZMYokOpYE{N-a1kJpHvSN-73+RW8sdFd<NK}$LpFKs(ypjNBR}h&8-mH|U
zsLrCK(Gd$7?YF2Ds7Pem&5c>zcg$-=WYnhoVneHGeGF<hEhKGh#{k0WH*f{R`e&BQ
zjHg`B7rx*wO`z!PN0y6r|LdFoK$3#Aa+R<iMu{oZMx~>P1P^aWB>=3S-=?I^Pc$`!
z#RtqX3m*v9Lr5|zN|>~$O%%z>#3oGkSji~YZ7Gfx#3Nn;K#H<)y5n_tbD-Y`QRz_a
zD=K$}cg!Q0pYQZKu&>gOiT!^~NynXBJdjeIPIEq+CtqmgigVjK{K;(varHqfL-xpP
z)ZHNJcc0Xa;r2>=6h9o^v}9}@5K38coSwd$J6a2MuY%|_wo5za+pzSlf7vH%ElmsG
z=Ragf&UPMDQ{%Ms@y0*D7)<_fA(w*8+v$e7(bDn6L-E9-5MqGO=5-d}d~+uAu#5xL
zOc$$LMeWN4ln9$ROtMRgefaurg5`}CPa7M!kUg$P64)@|3(pLDj(jw>J9!+op29z1
zQSe8{Y00kb{`p=R5O79($fVx~@lZ70nJ&O(8PB0cjIHmUHK6$Wx$zE0*jg=09CG{V
ziQ7a*e-smr<c9wvE%}oyZNUS?)LN2Wiqo3#`CfTx80c^|WL0UBrOqlTY3~K`Uvyd`
zh?(h`8$I0om#t+;k}O*;BCd}mjZH2JTfFRA3KlHJ>^^IY<!vgoM@EKtlYvu26u<@U
zb)>jKLq$MDB=&@g!MU&xuzBQ@1&8m-l}6?7x7{A+kN_{VQ+BOHT<JcnI!gx~MCocu
z>NNsDBtX~4M^4V>y}|<tnc`Su*}I0Z2xyY)yg#$I=h?wzX=k~JzxmAUdP;0=Y;mZS
zjFpUuiJBQ5_eObTzN7?mLGZ}IJn<G0t1p!@Zd4*ctQD;*EhJ^O#uw2jOCp~t81?&i
z$IaJwof4sB?<#e6xl;J;95I4<!91L=qPCFJ_@>J~tA};I=NOx}JMT+Vqa({cv`jrM
z$Pff!`AD~WTst{8<58<Ng&dqhBO+E=vV$)IICmL7A>J~*y@agfhL(U$%7}DoZ^~-J
zIo3zJ@S3JD=l)m|id&(h015#QGb3YN_}cQaevCD%60vGC5@BIsb{N23B}IPd<hA1l
zSa73<hu^!tUtYTD<|G0&IfCr)=x7<=!Ym(pb8p+9mJgPb!Cdx@0x5*Ay<(-59M}-^
zo|u6XXVU6q!o~|+mgC={4fO8F4b>1#Ys;x($u?ZPF#0}U>&JStf9o?HewUTA=3h}s
zRZdgE)=e%7Og0Ml57%|tGyl0OLp0`aiK3+nwloX11<R)mB!4i3iQl+x6NYokaKiq=
zZ-_9x+tT<v11?5`*z=fm8$Je3c)B1&km+ADT9-)R5$MmKFCn~hd%w1>hY=BztC_eb
zr0ufh9G#sj>EtEaoZVYCE7Zx6!R;(G8E(ZB4~_ZWCe2M#k5gc@M%amq6Yw9dvJ}ct
zms(|(-Jb<FN861-xM2Tm_ky~J@{&Z6{)k=!tr7=MYqUJz%|&%?bSPvtDwge{H2>$%
z)PS43pKE)~e%X_I$<3lovwGK`CHrp#95_{NHi}By1&f&59_UyB&8^OSv$gXH-B;Gh
z&5cLZogbzUU<ILKX8`)kiIYR0QBPNdzKul>-V@U2b&I2GQzXzMacL>3Ofs&yKZodt
z7g&dotY4IE?c+n*JA;yo#l^*MYm45ZJ#zc;OfpEtl#PS+@bLKgGjzb)1wI9~QEs~v
zySzDmtvYTl4x_tI!N+J$#gT&ZpRQw0caq^P-Y3)BT@CEkTGg4v6w2<W=YoJ!Lc_(y
z%v_qzlh=p5*Ik=&d8Yyc<@CTv|484^+qb|Zv_ftSc7+?)3+AchInlR080Kn|P{rgi
zOS@iM&RQf5D+~dYW9@RQXTHmzOGQR7$L8i1>Slh7VUfXjj%mWsSy*i0>*9h*8SnH*
zQ(OH#*j(B*<`e8TKpN#K=vNR`FfjZyK$vuFeALK?s1TRS!c2NmLdHHV1fnZ|7_Ck5
z&q6_L*%uKoxmi>A3^e92nL?-cSMy{y&VoJ(3m>GWIyE`%4}it8Zsu~vX>y0W5fp;c
zn^_2*R)RNpAz<NopiNd_*k=ygKivK(cYJxl4*e*PZZH_>Vptq8Z!}&;(wPpLe=fTl
zM-74Aozy(hn~OF3kO@1};&!pRi{lc_^@>?I^wD-HO-E>o^OAXMJR{xA$@UhM%F5KN
zj6vHUP?#BzcHFwCbZY;zxD%+lA#vHOr;;FLg))BM#@=<ZN}^@{Lu^r~RsT$<p|JS-
zCpDW4H)Nc#YHS=@g#6&pNL=K~cY?a+Q8ncJ7aoS7B)Tzvf~aVE#_mWQLS@zH5hl8M
zf!vC%IA*T=WU~D9i7*^9cO&XiFfVyOB_Vv<(saS+yS=h>2Ph?5I!(^(JXCH&hmoKO
z@q>K7bxz=QFDzTkyT;mY@%ElYKd+Fmo0^)ugjrSvW);6>qF+j<bi}h`HBL$E;J@O}
zzJCvYHksM|#G5`O<E#J9siNZ8bd9AVe#&yK_R}mJk5VZnr0);i<mBYNrVGUN`Hr#*
zu!zAI5a>Jy!j%^%7u@eSEXHS;g<0-<QnaYWe_f6Dr<)acf9>#l^zPk(t)Oeko25%;
zkfb}C>o54&f1=I;ie3#7`Rg35pcC#3y8J^l%$)v#SbJ(wA|i8mIY0>k`@=v|bETq<
z`GAz)i2hh5^-YXSF#gW$WX8P#=@=LSRq4nbN5$NFh)Qj*?hC8e$)y0a5B-7Sk4Ko-
zy%Cq>`vW9*8oSfAA|I|vT(QXcL6NI*XQ}l4djKXG`_ANY)*e=;t3b+E$K15o6s=n4
z{Yhh3DcPximvB*5o}7YDv-2uVt|*A!hJNYl8n|mzz;Qdt>cqs@nO<mh<u0?7pB{vk
z1%wm1-*pwBjT98@fwR^q`yQdJks0|&n2D)`ZE)~LJ5KUO%X{n7Pw7Ku<qrB?Pf10^
z^xg6M%MgaBudsG-d{VEiuRp`-dU_{*7!`%rKf<W;i`n(NT1`!app1^gc)x=5A2_v)
zyfS=Ffs-;27C<K;<UQPQ;f_S5PiW8~*-@5k;+q0xU+dx9_Uiw`+*?LP-SuzZCI|>f
ziIhk;Lw5)WNH<7JcMjcxbayj!cQ+^^-5?E0cMe_8_B^laUh8?D|I2%=`<_=U*D#C|
z`?vS;J&xmp?~E>|E?b>dgrFpWZQCmaoQFr8l}xO3TXXw+d8cm8>_C;??o=^ied5%R
z>eN9nS@y6rG;}c`jt;5NV7D+YgrZLX>o$OARJvze)mEr4@CW)AT@eM}fLddR&k|x{
zKPMa49^;sq(YSIq)xsU{vs90p@@k!7Djr<1^Qhu>ei(BGMfut?5)u*$LSOcKM|yqc
zJ;($*IycE0rlE7OS&x9Xwje*xC|GZUGbAEd53(!vwDqZ|au&FJ0=l5ItgLann!X*K
z<$OTB7y`l*9m*IqGzm$`jkUFB0nbvClSWC8)i}DyNVk&mWRH`#L7TF}t5EIF`1#E~
zPDbam_Xsbzk~Sf_aa#s3ngeS1kK~D*z({JF;&B4cl|(G$B*|Z>{as!+l__l2t!}fD
z8;KZ4&%VIn4)>wI6{GmP&$V<sZhnvDjGqD4OS@AQ1`)x)tz<fngI0|lzdOYk=t?s4
z!PTarrLH%dO5xm)(`rab!3P;fJQmxdSrkC9Xz90rMyDh+>kZ_y_Q-l&OdzqC<X?s+
zWv6j4XfC$8Z+_21u{``hKUe8~wl!N@rTu&)yS)4xFD@lBP1cW`TTgHNqjcv^xmp(O
zD|tq!%ZOJ9Eu&Vu!{$A|PSc?{z?4S}rEs(j7PT96-PqypJg7Y^v|5w3k%4^Q@H8ns
zGfCBt9Bk!d-LLUhWg5Od;g7t=LNRR#E|0?*1P>poS7$C^5ACO5j3}0;JjrLM%nL<|
zNXl_vyYX?+gbw-N?H-lWfZWuqAj>R-G*6vjpS!JzC@a#`;&pP=RVM}9Uo9@Fu(vTH
zL3&-`cXoErYfuE>jY5ZV5b5u?x(ZZhT569LgSrz?<?XONvprLUg--Yu9}mA6L|Kc?
z*8i-#!q<?HX%r{MeMLkN;0Kx_YHC`-3*&<eivzLdm#Dkbkkd~#;ACowdoWi<0BTuC
zNwc%`vg*prIcsW^q7n-h!$wyGS{+L4Qf)>__|K)y{Z_OSL5q~OU?ckr^uvX$)kVY$
z&@(_rO6Jl9^wIRWIuoy)RA(D02??mC`9cS;(+_GL*WK4;Zv`E5+bS}&TaZ{_wY9ae
zo5R&z4)i9UVP2rUxVGzbWh(S2$X3n<BF5xsuGwMd<$ij=AcI;K7iXwLl><s6|BlGM
zBrD}BV2TDZT?Lx4;U{eFuDrTG*QSspRx8)+YO(m9sAN6g<|lL3zjm-ath?SjGUEKF
z<ddpxkd7@oLq|O_^z`WS{UZUOI5&JxVz)x5h>?JGR#wZ-6+BDiB*ewtRMR7lqTt~#
zvJ6F+WS*<D9zat<w%r|O(BVt~hwU|X1Ou;c&3QbV;DScH*v@I#`Ccb$g4cw@<1V_O
z#ATQdE(SkXTK!&BgXp|pqO-rN@@A>2QJD`ggX&zm%5}>R`ntUTjN>=E4a$w@MlTLC
z%v<X=S%U+S+U0QFg6LfYs@$uGj<)!PnXOIO1796zq#1-LY07uF{8tNT`8Cb(wcQCs
z5w3_m53kR(<)hR_M=$R`t~j?Bj<?$w#KvFEDR@{eJox7Vltq%Rn6@k%SwW_+EORae
zw*jw4TJrM7wjh6fc*BG;P}4<ZHEw^T{i?X%KRf)yi=U5)6tNXTa#r}mRUF1S?-se;
zxgTWWrAyFkVb#m8Ss-dfg#UKAXd%DS^|`-#Q==F?a9#PcMBv31+<$ETR;<v*<Btyv
zoEOA%tPAD4&Gj}D3Fp+NhXeD|;t~qcE5RcppC&@e)HK!OJbg{T+4JUX$G}?udh8JE
z&S`Uf-OStU{&QgkOjrIL9bHN3pw*}1vOE>}Pt=sO=JI|wHN$U@44e&S-d<b<vQJGV
zF9$i%gBjplz2y`@C?q94@G{re$4^Zn#U?<s20NA&zktTg%-`?MU#of$C37%nfSBF$
zz<}{<vripD$$|NjITTezDlM6rQTD_<_7Zfl42kj4S*Y*9stT%&okF(KSBO<rm1Ck4
zjD1FymwXLIzIe6{7#0>6X7GBs!GBbNJ(BdXKW1Wux~JjcJquN?@?qy6k=6m~x4e#g
zDTg&<xe5jwfpyknG3IubxR^RiI-3yfH<#<hwS4f$Am~r)>AL_?>~$`Grh<0me!=g3
zg;^2&xMOGP;V>qU_xxb4*$(S)B^|zQfAP(8ai`g`V+a`;`IZb3;rUcK#V99=+_bE=
z^<qmGnxOl!Z%3MUEv(v_zl|?GKK`nU{@OQ#-}6^8%4Ra8A|eBLl(Vbls4mlp`MnmZ
zU7`1(y<lnG8Jg#`Y#gw4e|z^cUZ1zt3<@|-PM7U>eq&wYN7v3Sw?Crq=$RIj5Pr-x
z6n*Gu%4_pD4e?UHa{pMz#7fNJ^5XDGGmh5eIWGsF(2>^w5|KYOzi_H*89MR9LgYvX
zZv$t29fKVvs?jDmyX80z-@fV31q28^i%a;%0e`K{S#^Btz>f?rXb2~zsN-Pdl@+A8
z_Hce?>xSeVbrcb(`jcJO@tk3gjY@j2`+cy&uxJP=Xn<q<mh7BBc%_D+c5Dmt(W7T|
zdjs98>JH?k7l~4fV{%rj0rd`a{PEFWzJ-WNNn#JDTzgwtG7JrEtGdmhS<R1yJ2wDj
z`rheBI6j*tJP*aAMJ#+v)$Ot&%M(e`oKdH3(AFJVG2oGi-`t!xjnlPQQNm#|_j2hk
z_~<x5s<h9Q)#Nmwo8pH%7&`l1Em-~-zddC}pZf!2Ums8=Z0EL>97g@5;%XCY9@cVx
zNTV%aw)d=F_+!&*mVvm-`UI7Xf~ulMlZ)%&HyDKQW^FbWZ2FuT3&g4n4z1B`<gm!F
z`gaaav?rsUD74|TClQP3(Rzv>r5r=l>%Mmn#kb=+I5bjuK0|me2)0JY+Y?tc#t-#A
zA{_w&Hc7>LATON3qNixDc=C5Ny40$(K@P?No^I#u_II@I7a4a?A37h+U!zV=PL5BE
z!`eKK`<4%nGCcQkl*bemR5!FC(BtBDqB(m_LwOg&Oq<SSmr_246n3DjNl{zx9-RDv
zrs7|pXTjtC`N$O+-;Z=?rm|IAES2J|@3J#6_=yN#La_CX_4{>P8~*v&nGC}i=%|+4
zlr}Z$%+-@pCNw<HHqOFZoLvll)!vFNe*}f)RkfAy^JC+X)HXN)OQFi?>)OxvU+&Q&
zbStQMTsk{36VD4vf%MmI=Qfe09SCr?>PhNv@bJBk90Wb~EI2!H99H2(1R3vY>)Le;
z6SK3Y2!4${4*c$$4f2mVygg;Wq`a^WE|iwU)Sy~4-OY(Wz%VH|E339v8Zg64TITCg
zr<D{H`IeiQ1uZ8>F<L2Knm}}p;K$bT1v;RXA+^EAb;=zS0MV>cu?lX0H5U`Cxf4@&
z_%Y++2G<MfU|^###%z<md>=<=sP<k#Ls_VqiGy8DM9B9_t~+;)S|XJCW7ZWg$#jm4
z6?yjHvzrG6hm4bOA{0jz6WWfp9|E9}WMU)%d%_d6VoC<}rZneZR3PUH-8CUjm03(5
z%$D_l1JulkV=5<`m41)+O!D$7mE4wUwry|cw?VmTr*2v~n~JE>5jEL%K-*eOdWgu+
z7Xw#$Fk=~BYI8b8SagXziSfrwV9<iEoPpWxh}FOyfL?GZ<hjNgw=ybtczAC8L>o!t
z3CDOe^$3_Ve!M;2;5WD!UX;{5zA!1%Jm-05B)|sjC&aEik2eX4iF+(66rM~yov*(Z
zt3lB)0Nu3vf)4VEb`2~b5(IQ)MrO1;<=7tC&t9KYoj5$JU5FXI;-<q0d0JbMI&8Xb
z@<9}Fnit7i1W6SjS3)-!e`{Y+fWb7ZELAE@X$eP!Hq=*{D)C!EM_Lzv(*4odvCP+d
zifCc+VEQ1?aVi>r<Vm18!nk-f!GFN+_twKRt{!!X>Q0SGb@TGWdQa|#IdXy>b^k}M
z!>z7cWoDWtxSvt(mkk1-BM73Zpv~yWW`<n3qa%XJ_R?9`v`8FXBK_)FPR-|EgiR3s
zx(_`+EElWF;A>zmtOrpVjNGVn__h*q<4}r?tU64{-IvjR9QdjEb9A;ao+p>{!RYZ`
zRdvZMNb}>$ru{jz`a&#<&f=k_k<8`Px)A9YJJAN6#-sph7%l%?g-!zyxDO|4E-GA_
zF`<m;DmTv7vp<(lKe~dbIU}r1e#tSq%={Oh`z<^Yesd&)%~h^ZUAlt8>fIA?A@egp
z?9T0?%q0y-9~FOrRwa}VS|theFab03WOND1kK@k63+gq=us{ENRt*els_HYCjJ1+i
zBj0l9-<LKGLX5M9FpQ9&=vSX0d+j@BN)FIb!z25!v1phkZp(-U{wDoi6m`IZ<h8Wu
zy)A`Q^zUPHOfTHVXO2@F9tM{F){%~s^Y6^e9F36hQf=P$O%T*uwga=EtaU_Fa+7~D
zo=Sq{!-H}Vu{fgT2#gPUe6oJ3#(3ogUymoidy|r!GRJPdkQ4fz==Po--r7*1^I$Sy
z><o#lJhJ5}H#N6p0VRw=-RY8S=B5KJ@^pgWI!J|1+-85b1L!6I$VDvZm5WnYoIO|V
z8hV`5BhMepnIBwr93HARtlj$i&-S0~)%56SA;%0cR7>9a{mvHw#UjeVE84L|88V9}
z!)2G>9C-~pKdY->soChb-dukT@K;b2N%n0{Nr`U%mK2>MWrF7`2z2B8x!>tG&Vr5J
zNAPof$d+i1nVD(5`IxWq_l%#UFYfT&8Y-3=U2ith5ibCl2rD)=3>6ji4Ash9^DmWV
z&qS-vVrV>G%|h3G^LlAuo{oe$+I$+M`-_WdIeu}hibvcTcYQsaKWaDIKZ!@(opL|9
zO-^iZwl#gRE{{qu2}}piAGo>@(2ESLJa=xJ=ACV7rnmG$3|dkW5>yk|TO4-=Z~0jB
zrSp0>;8(1S*4BEU^x*^<E|ByF|Lkx+a$37v?wD6s8ELtyY6!+2*sc+o#`PBe?Q0yO
zco<A>dB#92%z8Rs#=+s`=`LOgRIvuxQ@=X5yE~WsLteLN9>s_5?q@9yG8777G4Yy7
z@oK$yuvD9(p>N4F;6w8031(k!zu|kPT}~@Q$at4+N#;}UZAZ<=kABNx!E}-`l;RRJ
z<D#|Uq4*B+)}(Y4q!1EPDjHvl{6~+J@ggc<bvD0Jz7QKf+}f4=92)R=LD%#Irxe&%
zH{o7X_q$wR$z1lqL}b@8`^zo<E$5#j^7pTT+yCe~K0=WQk^)>QmLmgGB1y?O_dibm
z_00aa-k>8Yt<)0qY(5pFWZ>79&0komtc)2@I{troZ#8x_#_T#)$2U|6%0#SChfdyh
zOESuJ@0NvpGt&PzpY6ra@%xb-b42hLjHk=p5bAdwOv|4tvT=H~`v~o@JVg-NUm3Qk
zQ2dwh>&0E{#VRU_UyOfZZ|^M!dm%{u*K*AN*K!<2W?Xu)zvkN#lT3;l-{DDd`imft
z%sBS~mqOrw{eEE5Wn)rf5`56XA&}-BGR>OdS}i-<l*-iev}bh5SLJ7_?EiHq|K&x<
ziv9aE|2L6^1Ful9nWfFe-l9_Xhx|*c1~aa8<#iu23bGL@HU<)gL<Dk*#tJqnPF)FE
zEft;b*#W-3gSr?8|Gr(1Zc#t5RI?=076j?FiYN&_%T=D1mrqDkj7eMxvXlGS2cedh
z9gvkCLW`8DV^%Cx7y0t|vZ&g=ngv=7?1Ru#D2U1@KSUH37JhB~n%np_EH|t+7yI8x
zvV5M(Hy<+AmfuC<9!@&Z@mT?B(zBbnxkejq2tOpHLh4KNXc>a@36G#Z3dq;iH=$gF
zb`gzSfr{+R8y&!`6_p4RABcs)sD`8Em6Y}Vea6M*v~O$|TnWe+DD?6RC}|bPO#jli
zZ9M?fr63^XWhXjHFj8!MOmu9t!9Cx0@-|#zdScw@Kfhd9?1Y0;5jDARn{AU%@Kuay
zT5X`84vs7X?wdmu&RNZJadeWqddQCm-xhRWQo?cdJV~x`BO$vL&K8MZ!}f+YGn-rq
zqZ31fe&#+`ic@<Lj%4!R$EL-x%{5$WdY(VYGJa{?{4IN|G>lE)8F_)xI;%GmJG&!=
zk?2N6t>Z(4QK~Adcl~ADGj%g{38cPp^u<>1P0%scQOFumR>JwKx{&5~uOg-*NOS<G
z%D+bc_bSSH&9Ea>DWH}n#Fzi5`@C*M9=D!n`W+#^e~>u1>kr{l4eW}J-|LEvo8AAa
z#%RNEb90l9hC1GBYikzE&dv_O?HZks*wK6<gW>k~dURr<+H$`2_VH8Srz6_!QSq@>
zg(gvPX>kb|?S{ioknDoN;`u>LeC$0SX0+5FN*nOBxw}79d76H>91NbA3CjU?qMciH
z87qRD=hsSUEP9h~h-CILPZJZPr6gtYuX08d{&{H%-HMevF<>bL#ai3YXK`zJt4gf>
z9@M;41;+dqpbsk%O>X-D?2Qx3HJHs7zBaKMw>d-ky{^|Z6P>|M8FUdw5^<;OR3QZ;
zxuYL=pX}jHx$NW552dikh=_pX*#J1_Ia$vF+k*4uWpp0OYfvhn+v;Yt8{nNX%Wmfg
z<@LNT4NbLhb4zh#*u@YD;INr1{h^;U`)RDoxq)+-EiERc`f&8yW`)i;l)cKT)%JkT
zk=;=aGD1cb(c$2hlb=1FWpyL5`cvxTM<!o8JLi_OBU!Bo5%b{xY5~G&MbT!PzxHKb
zh7}!k7LiFJhdd?`0$m3w_$i>1o@tCT`{eug@0#d`+%0VbIk=xX6fVxw0fr=dRllBS
zVKG-ICvn&YbOM6>EaJsZMR~T^Dx!bDf|tWIppVKgSDFNtyG>chgJZ-=6$;gz@6*XR
zm9jzl0nN(7nKw5Dk<HFqZX<slYpz`G%og~_`HPC`fIcUG_`x_CJHuJufC=~}0D=Sn
z)v83rZo>Rp8hZG90zt75tz^FwD!!w6claCoQ+qkxrlX}U6;-i(yEZYnMt*p5ZeF>%
zva-YKw{*2borxE9gJsta2SvHm@}LGWO`2JD7MAncX$U=oD<<WD*%kh*{>ObV040>O
zu&|K6RH{(^NkU4B4~siGOp!6jm(yx7?DpSP10q;08=FkHGyrG_WBmM@tTe}FLBqgc
zpxHsP_{(PgN2;pwhd34ty3iEA8?;ut!}>0z9=*E(uCidVpM8UUA3FbCMpfjdxJC1V
z%!kdm`|Tgpp!4o0s=HrK_hC(y&L$NCF2CXFm{_y}QWSaXubJa(?C<7yFAnR>W{cGt
z-h!Dr;1PhA91)G!ZD(P2iQmoXaBhDkUMf_TaWlNbZS~qQmBZA`d|S07AvQfdCT0-Z
z4yL57&A`T2DmRi*rdjU=NGWNer=cPJ+6ie3Y4;+CpfvM?ih5p?_JrKyd-Gy*;A!y_
zLv^-y<#oP(NhZ>je&a;U>*$LS7WvSVvl;1ZHeohVeHO=VIom<TM4sfib>?2cXvJ%(
zQ{OJM&jX@>vNYBbc3t-osSP(tLSzMz$!iC@c4td6PHSItzc&8(s=it<{8o^Gl4IlE
zz@1il;N!BBX<|{;_S|zi^W^CTx6dZP9o*Ku*mI%KSZO!5qwq8UF#sXH>GN~{=Yb<c
zIfKHg8YvwMS6%K>N~frys_dmo4{P15OE3Z1x9oZwGiE}1BqPhM)XZ2$M)AiYV*5H5
zhfxAgE0)@Xz9Hl2G<&ksaN8ZjT_<{^BSIs?gCmW^+wXtZp9VT(1%_*~J0}A_YIAz(
z7OK%RFeIfLrfC_Aif$Lmxkj}#pDG9OgM^@vATSUxGBQ$NQr;kk2Y``|q=eM2>9%}O
zY({kXyNY*Y44!*~!2_J-uUSNk%(kVue{iSGv0IEivU)2)(`OV(Hk|b=@ZS$ap?$Gz
zrx1yMP+?H(-gE+ra-x&RS(aRZF&adhE=gWUHYOsyz;KN@o<wEgk8gf}7?`+0(gnnO
z)|R>2&|aeLjOH)KA;oS;!^|{0zMUqHK%s(alqe`C#0#y^^}XjMDXLPh>94moW&v=Q
z7I*-8WCW~M;$$qQflN<HNzwiDXZ%I3tj+Q@BEn>SHIM7%R=y(vz-LOHt))628XFtS
zzTq$ThIyq<KZxYCxtxVy4AxAKfKVrUWf2`6!$iIrAU>i{O*ia`)G?TAYW_-yjo%-y
zj}3`AaUVff{zxJ`&G8p{qyif2rW&u@BP;0Y<qF<v?4*DgwG07Aex;w}QgeF_5-*z#
z8H8%NSpo%=4nhQ%dy@)BgO2{(1yIvc<L_)YSpO;>eBR=9=p>^gg<?>HxelsF81UJ1
z@XmK;7&_i{c%G^@&rMN_7aAB5!IZ0=k=#D2OC+mCH$~IPU?#qi^FI`5bTXTk5LZgo
z5$>?|bRiRTcAIK|LNv%lUH$bu5fqSruWk;!c*hBQ5@D|?40OD{{$4L_^7I|R0CYmN
z+|`(-fqE!Jj}S}fJX!g(dNy~pAM~y3`eKjnThSJrPNB+1H$I^{iSR#LM0p&Qbim;h
zpgw;H?AGSLQ;A#eLEm10?)6XBN<Vi^uBM`I$3YtXN(Q;Gcu{TCC3u=hzffhuxwvOZ
zK)g@`5%{86(qZBKP#({1Q`-nK&YjKmb<tn+wp~G6@$B)elCxZ7;nvp3NQ|!a9V;bA
zz`dsWy>3SgQuo>UU+p5CAvhw~_?bx073x`-i!=LQwMGzD243VIwepOZ6v;0N=5BNC
zv52ng*xpA0I5^ldk0p?bd_AlS%0OGf9|a79P1%j`*o1@x`czUXGCGE{ChdS$OS}T?
z=l%g6$Z$<AN7?N_!(73RU_vx;Wo2cd`+?XHsa&Ht%emiYeVZ9weo;Y{0L+ljbwmmd
z^Q~0t46GM<d3l9JMODtA%t1L$d7QQ1icUfO|4Z1!F~a#)a0WkS8J#Zp-8C?s>PhnN
zrbS+33W+Ojjr;@!xdwWgM=sD&7zoi4MEKf3FxZB?-L-jm<6y0^@l~ChO*<<_3$N#A
z_XklL*1rD!d}JonuV4L--WF$-xZkfOqaPedsaCkG!>^b8+yQ$+fGBm2J(<mk&xTC}
zXR5c5IzW>IvbyCaExiZG^F;{)2K{VU201tus)(N4BDvDwLJ1e-B9H5kZ@F~si6C4o
zc15Yr9UO3t3(nx7xw7aA1YxRu2)|N(Zr({hIM9_1T8slIR4k0oo^PI594T+4Nj^rc
zmWd;k)ega1?}LM(o3R++{Ix{ICB<b-)!lGD6@Jn)l=_`6E6%Wcue*EX`wMD%7LSKM
z5v+iSv9kOU>Ix={ZVxAtZ3=Qq3e|~~4Az+Ib$0s!qjk(!OozG>=5AMUeS6Y2XJ5W(
za&eHSk(18e`-QcQhX?3QbDz{X3zck4JA@P!;}34LU03sahBLI<%(P`fQ|iyGoZrsX
zSoamPYyQH0{W?JGE3Da8OjXPnG<z8X?CoIq>-g76|7#7C2e{~;B*_WU0|<m*?m3di
zXB>7=q^o_p&RZc4(H=nI8fSsVuT%7wa)pM5?oN;9jOul5c)xu4^6xCp-E{4170^=I
zIM`GbR&=~Xm8HWD6nB6(ln#rGtb662hDN}2a<m?9*|0bB(}~60^mC`}JW5b;QBi=u
zze<{Q6v7#Sskym)28;O$mm8xEF|5n|!g+Uc9kee32?;nSR)U}<v!Jaj?DNi4IrR8^
z>YQN?pj8z~kC;0vbf=g0L^9elKvM&7WN4)utQzcUs4MB+%{i7YH8C5lJ*(eGm|D6b
zu#1y#NEn)OpH5#`nw^_83E_POh|E)Cld4Jzp74b#sniI-=m8n`gbdsBOS9HL=t~EQ
zpuLP0HlG^oZTpU_@<%SYI^JxGaRRnZtDWOU-C<_p(N?z-EiMjD+uhb%8xI0H0ss^<
zPtmaFN;8p#P#-ek(z8UpD)8~suVZ<8f(|d>EU7Fk47SPv%{d+1bRztB-8GFugY84S
zTMxMkt1~Bg(ANoXptB3zc~pY!H?Md{Yom!4``r*IArQGEG}C|Iv#%fHn?pj1eO)wE
z%bQs)=mQdmb(&mV(>3QMC2b9j@*vBe7zD5n>zmdBS*d`I-Ni~UTQtsMuZ+`QcEX_D
zXnG$b3dU-j>>TPH=0jmkHM78GGc`2-U=%VE|AxoZw&0wI8g;h8;G)>kA|jnfVqGyN
zW`a_N2Aa_-D+X$g=+js)PU<XJH;1;tDDYMt%3(F%A19|FX}+1Te}hhZ`}_XSZ0M$A
zsTDazo^)8av*o?>z`3_G@r=}}scE5&R$T-}7ziUJtE&eN6QUxc6y=xkd+r$m@a;JX
zozj36qO)kX7+|fY^XsL6%Jk~(#iq?J6SR5sLo_7xJlv%YO_-|F&_HTab<8-tN-3kw
z&Ff(9d5Ey7z$xW$ZXH|oL*-)6xo(TIl8|h>$nN>M+*_88_f}GL&blMvEe-kk1;6Sm
zi?7!089*6`0QBrT+z1Nl&1q&aZpLjyJIdR(^2!#E<+OzPL<yjj(zswqmH7IDm?RGc
zf8AgpsG`lw%gQUz?3(D&jPhCK?1fOvCzQkE1O8p-?mhmgI8=#_OStJ}XwS-v_}chh
zMJZq&d~^EfvOTpOMb+&P+PQ3Zf&x<9Dr6UvX&C^WZg@wOciJ-k>cOH;Syfn4A47?p
zN=eMt7Icf0mhLSrx*fTp-=XIj<%Wg?71F9^Bfk3g&*>>R0{p2h<dRmeoNgEI72WSk
z(U+?S#0KgjXxn0D@om=Sl`oJ{C1n5ToYWT<Zq40kg3GsHlJ%>Qmn=0k)lhp$!O1-B
zg7!uCJEUzfRaqxh+1KO$Cc6uZizjJle@N;wvvK_7<oc#8r&9YJjRqw&Nsa_bpH!6n
z4ExQcg`r`-ZkszlA8mGK<>=(7%V1{o;E23Pjhm^oi_VwY)<KxdlaD}e$s?$Z`p@|i
zM<q{ILC?q-m+vfWq>rxHER%#v$!Q{Na!?D_`H2Q;Y(v$YMbS57<cWOM*U2BPt$Y!0
z0?CH&uqtsQb#pT--$6PqE8gh}YiX%Gw&MKfg~+5W@qLV_<l*M;Y&sX%iT%_{l;4Wt
zK7r6*RQjW`y{$t?cviL%sw=|pg1=s@!M^^!fxf;0z$7-j=LLh+m=(;Jl^Ade9><Jt
z=VSQiF@0={QXV7HQIH+_s|hP=l;?g;%H=8uqUj%^>+NHZk4`i-&&z+OG$lLo?^pBD
zrG?76k6(PMZc?mTQtSYK0wax3Ppv2gmrAk4KUFi}VGFPS6U+wsm#gW(zwhFsN5X$O
zq5s}q@c&n;`kytf{}XrSl2*a^|95u&(_rwQXYIq(MML|apZ`Z`?*GKo{%@H6k<X~e
ze-3isX+(A@bC2O6DX1fDyQ;hTU%m9ewNr>lYpjh3OUV!G=M<M6kd_;f9_btT`|-%!
z0cgGWwU506y#sx{UQk0z9Pda;t2b3<&zXz-x4A{HW*EItBB;rzXtML(6*EG9{(Tjc
z9sgMda8_cm)6|qRsVS(2qOoyHe2<3?qt&8d@vzvKbV?Fh>+)Q+Z%KB2$It!!6=M`v
z2qTiHoia<ReZT+3M((B2Gb=<i$Cy7i&@Z_xdC{)t5n>6)0adWC9!Y!<Qtm6z5)l&9
zlGKvclK%Qd7gCW)&D-#ff=*XBjCrgx5Cc4q;zpnq$u}!dE9R0_40p<5Ccmco8I+J{
z_k*Gvmsu3q9{J_1jN*h65C{fJ`oUkZP-)cz_a`SU&ZF+@^d{lq7FW(4{qVF&@bCZ1
zNTmQhqHyqQYxZq%oOPp^x8c1-tpF7H)PMy`N-!=VSw~*^lge&Yw4K7sIKL&hukS5<
z5I&BsvR}56dVeyM?~6*tQRcG}UYu^-7-+=g&BQ>_x9}vovGxg=jy=lUDOP+Om>tLW
zR4_Fr&eG7>W81#CUs6Jn`A7})f=bd+{q9sf=A^Uf3X)||juM;y^6;kZIb4hh{O%(a
zHL$~EIjPR&Hod()m4N1spH@pIZf<ObK;;dtq=KP8peInNM1zvcf%pbJ!!>M);GCyH
z4@tFOO~tG+{tAimjw<OsWED&g75gd<D`P6?d^#*02xXuoM_lRCr%QtCNC$hnw`|sz
zb-bL(hcOw^La`Og^}$zk&z~Wb-kP8)xpE#Xg3=NB=VYUrx*O{XUL&f<%RFA^*jCE0
zC%131&TcrvZiP1@!NXtCY$C9hKNHJCX0e}+znFtG4ZWbUV;<v6%K~6);quBtCN4HE
zO2&jMyaXGqMT@mZ9gn;>5aD?2roX@b8LZemTCm$%8w2=GlS~h;UmE4AyW)Aq`JC(}
zEe12B^=rkaU5=b+<DK7_OLp)+u^iR7Ub-xL!#g3PuwseV#v7i^7skI4f#?9vXE7M|
zXd`cl1su~5?$xX6#m?}hRW>({zsWDZ7rMtiH#kAGe$%(jElzyh{G1#c2S=Tt7}Z=)
zOQvigbl5B8<J;=KEN$(@GctS@m5)G*^3!y=X>J~LZrUZBYZ97z@Bt#eE;R&l=$Gi8
zuE7D2Yp&-T{>{Z2#;V4E?+Q9z0?r8N$r#9brL_cFy#adnv#q?bYC=(#T}y&h3Y+EN
z3mgRujJBOxn2*$$%CpBkoUJJEeum!IS6Bsqs04;z-m;MBWf3&k7>B%R2?z&A46Ow%
zP$BbEfSfi2Bs!zw<ISw6!!Yb+84uSC4JTMx|ME6DpAmw$3!l|t4T8#bUyDjc!|y!T
zj*D_Vg||4Y_2C0K3kh^R*?9nAx+IIS=T=7RcJ*zGsE2N6bgWwAW(3t={&8UpX*L-;
zjJv!*lMKkNo6TkT<_iOojjmo?E+>T-1?vQf<<SW-<t}KTLvh;rCJ+ICx*<L>)_eCl
zqWEpAkI1JT{IZn#T!N=K*CkIQ+z%i-+nVOog>js|(E--)E#DXsI#F`Wx;C+WE>-Um
zq>S@q<L8AwtcFImEd?==?whk`ELgu<f0t@a<hpfr{X0oz*ZM#$L1lr@^nj#iz(i+J
zHC7FOvhegeHE_e3fVH#UAbEntmxh`?^Q!f7D@ILzbh*Ck2gg$vbfb0S{dz%@!{h$<
zIoEOZPs`2*i;fNgO-yu`kU~NW^DKB820pqWF$yh-XJ}=Ky6xP^s>l|>tZszD0e`q|
zprIV+_3H>iu2PXyCkHUt(AJS<q@@f9SY267EY-xoBeJr#<Z<hL;mFQT>u_e<a(dM6
z{n-a7G!Ge`Lt!#SqZ2(h^>>Sr_g>9BQwV27nI%f;oDWfzmFonmW~Qd4I*og=9n1WP
z?)WlF+HJvBtJXx%Jg)$YSZe5FXi!M*W?8wC=le(j5a6pCao<@<1}E>31jMt0g8Y8%
z?_(2G@PoP4Z>xb#O|Fh*yI}+zlFD)JiZhGi7sNa~K_S78yQ57;u^SW{5C*dJv^4#P
zwXtz-6fk9hEH&=^*%uvQDSh~CBuar#MNew^P$hyfrT}unA@<01^cIRnj$<iCPu<UI
z>WgK__*`zc3_1(8S1CbR9lyu*<*z9Mv)>0@H}z-u8Ey7iBD?kcJdSj2FY)k_-6Ib!
zuD5b>^72Y@27+!ebm8ETr_;U!pk}vQ55Z5++;V2W+p$vBS&i}VaQp<{-lc22RjPsB
z-nYEYCu6ZaBG;&`H%CH3UiX>pPg6Oqg;z&(n;M&C*})e<PM2rCNT%ntOiBiqbBdye
ztLyW5H&i#r?LR9U)vKKu<@>x7wQTo4i8KXVnr$>&xM?W1=h9QXzC1p$uLftX+I=uf
zW{Pic8bEMEG`j+(D^Qow^AfMmx+{+}Rff0W`r0$4L7$o5&Fz7ixoTwdM)?ma86B1P
zo>LE<6z}L!o!S=%`Rv5>Z&`Q@KP}y>oj!<I;e3hci`vQ^<ZozOy6HAr-<W?>B(rO5
zl$rPYh(!O-80YEDucmcuY{FD)gTm%YZz3X`S&$82H_^^;6~ninqwe+CZ>8a<JN(UW
zgLv`cfU`!XPC~nkoGUvz7*9&B^(<7{%ru{df+RsRd4g~0riZxdLP0IgYX_r<6f)Hi
z{3kQvr?lPMs_p93)j(S-oY{<U)N6KDhkI<^o6(ZA1z)f%hnZS%)TQF^29l%_ia9gc
z7-;W%?=3$6gsn+{c$C%Bq8Sw<|Gu;H;GY}Xo^@4A%PR%>I5ElQmR0w}<MNNeYHhI2
zhfRT-!3=JwQ;6d*?`B$-*+XyKF)wUUdy$5R#^O-MhVy|-lPnK!aY*#pRZDqedP=hR
zK#JMG+l&Jch<-Fl>hM6uApjbwEY}w(7S8cs=c786FIIa@q_8FqhreN}-N6K1)v||O
z*XRdx^;j}t_+0dyhx3JcHi9mef|a}^G-ETB_d)j}%JC}H%+zbA-KlB<S8hu0bL~WU
zn=|#rQ=p!^P8WTDT|poqHeALVXN@D}m~2F#<_*7NbLuU0V$gt2#Ky)BYc(D9jqozl
zNGNIhnG-M0IU1i5^Es|1?@F0T(9n9%dzmPa#TwP%j+ZLoYV!%Yc?E|l$0c$yv*e><
zW504}vcKPpNAYt<-x{l;<K;J+yae-!G11J3d^8G<>RRKS);U&$o{<!Hr<(jydz>-U
z?6N{iI?A*0Wxsq~1ecB1YwR4Ro$0)*lL4$1)=oAv{j$rqKSFm4bUgNx(&LhOZacqM
zUYfF^`k8pyTnIR1bx4rmv<)>x+}Y0Va6N1+K|7o$=1^U^9$v-EyZ!pbOQk=7DJT1B
zxx?<pjB1*~#NI95qOWA1s0x1H>eq~HE}o&S2W|E|XOaKa%;ISRN&S^-{Wi}B<@Div
zY%?}0N<P$B7cxZC{4M=#>k5nFxu_K?YRIHc$H1%_v1c3S-b_q#GIyig!_4I+LrcAh
zk%<zK%l<D^;I?)86}}RS>HoZgf7tIk1wlF|kX0Z_9I3*s*av4Qa2w;pPjYg=;+}qm
zH=?cUWIAQNyAw_u5@G^@<zN>Z+sxLqS=`9Z|FTq!iq)>yQ_&IF#AW5A;$-7<7z?`s
z4bM>bi=U^fh>{MTr`LaKsFZqSQ<(Gz^9a=1S_Knm9?tz*u&cQ%ts>ha?(?<h*(TXI
zDzwB?JFG@zQ&M&1E5}?*RG!jpI%=lQaksmjHm8&jVdG<BoEfcF*C_{=*%G0p3rJG!
zMAW4sUf^vJTt0YzVBQ7Zr0Z=?b`}m!j!;nJM~&nB%da33Ol?6`ujyT6+-*U3+^wM9
zeLsbPNX}l`UYq#2c(<3QbxFZ=U|Eav(ea4_gXi?OHaQ)EiRrP}n5b5d)#B4H{HP3N
z+Y5kRPPCr;u;1$G=}=d@EyzIo^|je_bzNalZ;jdrv7q<&Tg~zVYfzl6U1#cQuCbFY
zevu?8o64<ZEGac$snxzQ_+@or3!$Vw;|<l@=Y!i;eX^SyIO}VksKnCy)(0nW=-B|q
z>)$A$GP{N)Mp=-DTP64b!P0^{0mQ9%Aap?LMa%Wix885w(;yyRE}dRxlR(Pp$<F&Z
z15%;Cgr-^L{F>*tXYgs$JqTT{nN4zWLaaSr%4Bbe*}KVp+8epkisHPtyDnBt#I4)k
z&TLsfK@7>VRo(u6le9KC0o7FKTwlxafsP1r78h`}X+A|ZY_vJ-3%8Dn;Lx~O^5owq
zb`z_uR>u9kns=7V0-?9eA%SpQRF)($J!F{;8U64#RsR4E!I|e6zc&{E-4PX!%j=TP
znbVp_oBnKTW_>KQ00-^yPaGU9B0Mb7L@1GF-Hk@3k5A)F!*J#F!BVO2h&-_ATKlB8
zd1NRG1R_8_)l5z=+k76mcYy7U57DVvYv;jl<cO_pmxP^ph%EQFhbgpu;_tJG5HI8%
z48S!vFNff3`2lF0wk)#*rO+4{IIeqp5_7L53mzdaLi6lF7TB41R`=88KBc6aSV~5{
zPS3CX(-V{f0WaH@wVkTg^uY7}fxe>R!mH<3hdj-&FFfPEIhmC{!vs1RHe+c`CJis0
z_VlyMb<cd8u3XR0=yed>hK-X7+HH19b|gb3s%m0bl$QKmILFzE_J1_x-Ofzk$s85@
z8EUS9&L_=|9P*`@Kc|BnW<`cJhgq4KZ)TfS{<+Q~X1o!R^IUeS0svT_iSJqxk`bvo
zT3Q~5t0k)j(~6{R5dtmO95XF->IPWs{2YGiLVh_T9SB^x-Q;HIqdy+q$o9Z=LnUNJ
zaqrWuQi%oJ2USm`uwG-^7w2vY-tovAsfbE6eK)b?nwgOyWEWuJG5;0g%50ZL;=izD
z-;9E~%~{y~MbFFY@tw5%+DX%HN%jgUvhCc%#8Q~`*+fgGPiMm7JWEY=;)pgi01C%_
zkORX`;Q9djrFFygB$%G+@?`&lFJ-gyLA@oBNv>FNi$+pPjqY57JFK9*Vrx38&19*}
z6Zg6-H_>0+@9VSS2`Amgww=-9@cR7MGV|*5t?nQ)r?1-V@tphld_Y?CbK&pb!KAX;
zd5w@Vq!%cQ;lGl-(os-C-5ho#O%ij``R^!Ip>;JZtS!zv!yNCaJJ4#0m)u$xD=o`%
zzmm6Emf`0a-8zUK1bUs9e&%`{!3npvHm4*dwLiVzS34-zz}F=>qNAfOOX~O<ad{MM
zu(0fIi;E{<YdY~0jW(ozvs}mHVo9lvfeHZ@o62eg|N4`|sTO^?{UY-{mp>-8=SGaH
z4d24)srW2=t?Ts(_ucX-1*xwW^PUyA_(cCgj1HTgnQ^<rV)0gz>Bh3Xy`|U}q!iQH
zNzem~rL=CQl%?USkB!TUzAUatl#z;=cyg93vtzG+=(k#;8&}&ndaTZn91~5SGSr5j
zakOt%M}%+2Krq9^#!+^Wa-+M#y)7poc6@qFm^7Cr{Pa0u=oT3TW!`2xN{EeNCR4Gt
zr|jE`Ue3pM+IzJ$&3eTYHLl7A8uPzUDp&<2B&BVmVjs)AG%fc&iT0MZPspg8On26!
zGHFmuz{s19N;tD_4m>l<R{OI;WW{!|1mHE0+!w=L=nA1X>Nld~CdQkQrd?*4oY^vW
zT^F~CH4e1ei~rREPCyl|&zzKs`ud4NBC-iP6SJBM;A6`f5Y(y$ZH%}0wvu{NMCNAh
zhzwB5F5L@+{$h*_Ti3$j^E~4d6zp)X@WL)O9m`c;9`oaG6#&!x)1}xzHfMl<I}f*%
zN_<C4>vo+zFrhZmT)!(l3k2Up6N}g7p9_k7C7idvlXh&G@3z`+E<~rWn0ttzSTvtD
z=T5#kS`COWrrH{Jo)<7_eqUxglseCuC#9t^^(|H`KR<soyxDttp^>8q>oFQnJZ{?j
zuMRszR#aI?fGeXWBDVvF3TL4k&D(&2!p50zqdNhc6GvaSHXpzB+vBw>?~x+UEf{Ta
zKcd<dZJUkz0XICTwi+UImBhC%FoZJZJ7RMaQ7Gr(6xZybD;U>=s0y(2lJWD_+|<)7
zVAntI@slg3($TtzMC*glGfkBC498$z{SxpsPhtzbS_}yt5QwY{*~C)R@*^$6OUA<)
zRslp4XATYpWz0Egnbo~690FD7DR}{TO|S;OhSBQ+f-&s(S@_kBGt*@t5C@OA8@`Dk
z%I=(wYWJI~H|<s?XfO*7in0~z>nAUu92n@Y33gb(F<h^%Zm$o*NR0YS_0`{$3VN^r
z$S8z-c5y`Pv6U*n#=+KYHn{Qf(_G<wPDglOT1rMrObRU>!@#K==VJ*wq<lB(#(}#w
zx(+m;r`LwAt#|x%D`dQ(dO|oTmw^LjcLMkAE7|(fhYR$yD|_b1$ne9lz;rsQ9(7G*
ztzv4rKu@I20NI%(;vMre!RFf9ipZatPp#BW9^~~|Hf?0Yb}VugWyLsXc|sx*bIP7R
z=UQ@e1Bes(WbF8YCTzvy+am#Lwxnzu__5l(bmL}5Wt6R+L}f?FM80s{*^l4rfBs}(
z-=*x1@N6}&j|Xlq65LvHLs|_OTfiJrCYS5ECq4D06P3710yI=iC}bkLt}yD<h-MpT
z``@t_GtI)i#jZboT>qiE@N|_xrmZ)hJb#ls*A8<EhwCQxoY7x9JI1TLEj4bYfsu*S
z_x8EJs2MmcUx^mm>)H^GeQ<NiD@ced%&cqwE;8~$#Bn=q;Ry<V6XGG+iegO@okYyI
zJ(E0;$tLxKB_uR24nEa=R=-krIIht<-YLdSq;7gCHBtx<HrrE4NPD^ITTtoK*1D-o
z7m>j&1mTcVl*GJf%dnoEU&Gtp1`Gs!u5k9;{zSQ~Sl-A3Z#1Nch?_a<xHf!4GKl56
zsHj99{9LEe4jA2-_(;>N(iG+8kMn#(FbfhsOi|B?HS6T<>OJGy>3>6LaV?$m22m!>
z%MltSQa~)m*_bj}lRFo2>NjDgjyJSB&v)V7lRpp&rJbkTxsKJiFj4v-<rwsP^KMS#
zLo<2AD@@$1lERFr1g&%<?~kflJj`Ty9?f4X3!{8~hbOlfb$8rpx1pcTd+g2xJZ3$M
zXVXP&7d&6tJym^xPcbd#8+*mn2dI9w9TkVkIZQMT(zn}>sp6T*hB;mOWGOcpDS>v?
zwmT0qQVs!C8PPfiV+@QjG?^6bHb>9HF+Y_2kt}Q?hBAf{4nFt0linf&P=j$>^axR|
ziTOn?MJ}n-;(Vl>WL)gc+*xpghp|M_TcT#R`YHojh6h;M_&De?OjRqT<L4w}W#wiM
zzF}tIKikCx{^7gRuEc9O{qA+uS~P6u%r{E*_Q(W8ALSm%#=>FzbXtqcqaj9yM)oi)
zLf9)}!q@!~^zl(Y%rHdoFtM;`+$gAz<QVu#+QAi9Uy)QsO2U(<I5u+lGKT*hSr<1{
zf3<@HH7Fu{V|6uWCb=|>zHQ0-`W28Z6ql2n6h0{b=!2TXVdH>Zul%P^4r_4c4cw#q
zK{F-2$pY1kH}G`^`bknO)~N?q<NkbwaF~mz(b}4Kuw28aQlXauoovU@U?1_sQqq&h
zHE8X${GqUl+hN=g>E7PnVO(5{pu2*hAYV2U4;Cz$WTXf9t1OqVt>je9q!~4Tu!Dl7
zhK#)wuS6h>^zX<!31ZWV)G;};kVLmD9-b?|IRv{_$02sOlrVzKsJI4&6-D1EO1s4k
z{_8{?(NZuc$`p%Dh(Sg}zuUU$E4^<p|Blk2mU>}nQs7)R{}U}ufkXudr@1RGF75W)
zromH#niITB*Q@^AO6M$|dh6-lYLe9N2xwbgnDJN`L^O~KZ35foU2f3(10)|9pLc$H
zdvw;lbNrBY;JJcn4m1@lUySks#_w?>H(@}7)VH>_RteEVwm(6lm@Y46O&sC(xS#1?
zs21;G)FmYw(QWBf_Kidzc}Y`(7XD3$IU;bWqGZC!Pi62*jh>WRzexMxPr-D*;)$E&
zGD1VaJ7F?yrNf}iKmltT5sxh#T?M+A;v#gzYPy1zXXnQTkn;P<>UcAAL&vFA3E958
zozewDYaU_<OoV?R{X!NeVPQA_B|JnjctSzmK+|L4-0j<KcN$^p*bONDb0%JD*!`X1
zUy>*$Ca#*$WGB&ee<Szy`ub*kw{04cMuKJ+A#LfIJKBDM=BP!zwXOT+u+j-O1q14k
z*P^>-vZg$I?H~s+uG*ukSQGu=#nG{y8~pAhGdN)*A%l3iClUTWi<n-4M6aGz*dJfx
zlXi!5tUE#4{s$!z0BG4OEd_y<gyEu+yx7#(n?JF*GKd~%nR5cXYO<=oR{f|_ho<%s
zS0Qn_h{d-A1bBij=Rq`h6+h0(2u^Wr-Fvn{3aoF36)|GMVl7h-etafK1Tk1$IVa++
zy%`k<@v(h4BvG^0;&)#E9`4@Y;_6DE5l3Vup{SLep~H`yM<n2BIr8TYDL7aLpZ6r;
ztKc5NtiKo1NbjI6{WeVTlYI&7zLfe_=pl=xL(`}LRmOvHJ3&2J!%6?8nYvASsL6KR
z#zrwF>67_#55u0-(!tHGNq)|@Sv7N29R&sE0+O(}Am>l^)?Nxzx^unnvob4P;1LC<
zk<E*zmptG7!x~@Zxd&1SUcb6xWXjM9-sY~x6z1uVfqjoLA#`Ea-_5z4B-}_mK0cYj
zr-6Cm|FHEcM6qc_+MNl)YI=pcfgbWV!_aafBctM*tw`)HT7@pbJdrTeJKS=8y({tk
zTrT<*hV;;2_{ZMQKwL2=Y9^XmXzv?Bbe5#znVTbCY8F=tR}vb4^j7HGHER!{g;co>
zG>5m;?{T|*{*#h7eXvlfAH9JlV_F23daq0P*!*;$P9IGg!Jy?x9D{rPA-~h-+59O+
zHHfYKDU+|SFF&s%jKf$T)N^g{&yRQ5Bn<x=CMPEcuCph89jMI4CPQZZZKtCdz-tE;
zk6YcqeT|8Yg>iOruK(L)vP?*<ppM|A%Z{@j%C@GQs+k(^DSL8~5sSZ*q+{FSyw%rz
zYIA^mq&7;}+c)FnQgh(?-1S1B-MrA^T4_Kvzrl*vNP@cu$FCIkECXt+w5@*16B&nz
zb690XJA~it>?P}EO*iqAML#A7oe{6nqCP!?`xMvWVCF9yO8AK{&>q@tp$v?SEA=~&
zNb525ZB8Z{ir|C&3A*An*+y`fxaYqCSw;bmb80U7PdZ}tjgzQj$6Y-igF<0VYnVg?
zWYp9jI5(Z&&WN1NDfk7lc8G~fSpcdK00<Crn8Dk6&|eQGbq#24>%QJhp07VAsJA%~
zbn9(QjxBkyB2NO%AA}!Y5b!(l83{NAoR(0%d&gA!@cWFHD-_n|@NH%^XlS9%lPdD!
zt<uJbR*Pd>+ah|#w)P*Mms_)&eWwL+!dVo>r>qY)%IW8*M>$(u&ZDRVyJGNRCsp$1
zx#m9@x}c|1<V%^}9fCbB8w(S#esU~Y!uZ?(8e=n`g)$s}`d1OV$_-FW>MdrCfA~~*
z@)PdwL7`AH^qO>awy7!Jy6q@nV1_<eBX^Y)6*70I7!}A^6eRSFq~mkgDXThlhd(!;
z4JIM)bau#}@Hs<Y@|Ml?5w;gQ=&8)b&?K(FH_sv0o+4ZJ&6z-3J~hzYR(EA}W0Q}^
z(sb(QXJc$DNtd0{<*AL&iV33@MHSW`7jIzQ$cGTk6lS%5@5cS6OxcEVWEasJcCaD*
zq;*74luk1AzQv?5fwQ84f*4{GNWtk|(KJ0SoF1;l#-aKeYXh3(nk>wb$2wuo#;k;~
zwmGG^R(qLw*;{Xi_Erd~Y(v+E?QA7KG;J)D=G8=2wCae;g_xE1_rGE!&r`Sa(6A7#
zI>$EeS0*oPL$F(2R(agJg&kE?uFPK+f+DyF5>Eu+v23?@Zn;<!Vk_uwki@yFn`AGD
zgpra{J6!#m0tkvlPkR^<b)~`X`Qn^21}<*L#adQmN5zx*#Y-46;-bdxc)o#${`ZKd
zAP~o)-^t`j)HZ>uJ*?fq*81?-+HFL35eN*)Fx?~g8Op@<GUG?!N7gqp{&T<7b=51-
z{3*WJ!v%vnl8W`_;o&lDc|~E3SIS6a15$swRFpGPUV6ys=ZiMgcZj$8kZ6ffCV^5{
z?fl&@M_2_%IZ1<-R-jqTa<O?ol{#u+vK{FZmZP0pQmjpR3=BInJwH<LQmcs~8Y9xU
zy}(9i{q*(pM2R(V?egv+x7B?;)~c&~MpM8i9H~5$O(p4Xr%*nnL4$HK-p;=F>iNy+
zL3dIvo_(cm1m4}%N;bPi66mJ)6OXT1Oes>grq9ZozyMOj$k-@@%R7Y>`^l4AKIQPC
ze)G8*yS=DrbeN!1Wfd+ChMqag9P*}!dn&s%i`5=Eg4bi7{abZ8kL3lIhuW&QCY`M%
zHpIa%kTuN+SRWlB>e2hAhzo!CY_7(NK#SSC4a4MayU|^IhW<B9gN21d!07-_A|ZP!
z=nYmMVBau=#mqLVOXV9kd+eH<x+GO)F$)SVUs<FvOU_1&AJLi1`H1)=3U*Y!{|zB9
z5mgamW}>{Ux*$NdN-8D@v)@s7dp3&yrAEz_Zl<KQwbftL-(x*s?Mt%{ny3Gwt*z>$
zU3~hR+g7-gB7J8dmFI1(?0|I-rOD8)6%EC82?OK=CG^=*0n(#K?1azR`(OT1hnf`@
zFE@JM%<d+FEVG7rN?Qw@TF{H|wsdYnw40UWy{fXL;+9<9tNX({3T@?ad)Aohar*V$
zc!@~KAmH)Bd5x`ao|7^zy8b``0ExW3nxZ;Q(r)_#bY3qCWQ?eO_Vjw-F$*C@&n*}q
zMLH>5F^pHED6*UmPCf%C>PJ2r#pf?sib-i<DR<%-R_Z-@h6N=dV3VKt3TveAZkviy
zct0vVmW+f_L4e3alt^thIE(ySYC`%*=Yxv5)0b+)MSOKo;qYiDWp2XP?=tTz4vT0p
zCYZWYMw{6^;kykOPr(_M`6xk8&lrQ5Xqd?;G4yeDbv-_@*rn4v4aZS+ic0LWmYyDS
zWQYTi)#9l)ZhG3lh+1xi&zA=9u$desDv!}tQZXrhG61LLzrKJ3wKxa^J>z%CZ9{mE
zg5MhMYeU>Ma+8A4BP4uD3zcYA0g9~3!jGRme)Q3OL<X6(25%D(-e$RHZ*QL<E2{8E
zpqPlJE8by|F#%U}l(^zo-49WTo=@m*&93}KXI({$)UUoj;k!n@Gynh%AC2<*=UgA9
zRrMWI^~JoLyc8ZkeF%93>1gx`3Mp)@F5E+BEif?}rK@;XQCJxCWiAxNL85f!g_YBE
z1P8-vvJWncu*ew8m?+!0LRUupU)~}<yL_V{q+=xURut*4v<bA$6932l(iFhV)nfGH
z-?!%P&7AKU*S|kK%KRzf^KTmH|F(Z_hh7}}`CB9;$a$Y%uNRl?ChOL0ZhZmU=lgPS
zF#P$!k@#0)5t5iR@dem`U%|cG_QCdC&~wcHi=f{<<Lff@pSLVLg4^`}$rjx|^2&d$
zUTrP<!7}bNr3`>9Ec>r^6G?Nj^TX4XyA?+kbu>~n?Qn~t+Ur4a5b>!6K4)$8E360Y
z*-wvQ{||F#85UL7w|y0bOH!po1TI8cK)M-_QW}O%0qO3XK}1Aa>Fyl58<g%Ex*LX;
zW~g^v_x0T0-p}vz@`-~(j{|1!z4lt?|2)qh#-oQ1UAU^^T1L0X2%kkf>w8T(U)EB7
z4XN7u<#LB=n;6jk7piy9MY9Oo{>Mtj3XNH~;!BZgbnr`lr@2b~8wAEnL@(2c5j@o2
z!f!Dy)a7P>;9JaukIm;*AXx57q$*=*3>ny_<r=u$rp~y2l<exzZFa%?pDUQRYN_)%
z)1YQSdML%-d~B+9tg*i^q`%*fo}i%x%<6xZRaEaGtIR-E(nTFK0;&Q&n4u^{sNF)v
zjo-O6wV0SJXRw2~^q-@n1=#gc{Lb+>PK<P?MA1}bwMnEYSSbhkdx5BJf0DKgP*;^v
zu|v7yx#69iUE|0RUI0emHw#PE_I#A5Ni4a3U-$|W)2G?}xI8?yBq}Q_vk10m+r->2
zWq|G(N>u4B#O2+rry!pfT4;7(t+z=%j#6ITK~1i1u0q^STiZ4jfjTQwqNCKk=`_iT
z#=IcgCdc1ekk-%%(D`ncc6TISFtjV&+17SU%VgC1B_5D*trs)!2DGaUqy0Vn6pCgK
zAn>WaO=C}~`k%fd-S@>ACpf(>zvP5c2-cu}k#JaDUguPY>CL!&LhQBWhC63v7#p8d
zI(xdIet+XZ)CITFwCqA$8Tf>_1nCne4BJ1aM?FuCDmC9bN*f;P#g<`7;5rzMso(%1
zjCGA$gO}}0u75*E{b=~!eC_3TLM6qQO=mqdPHkvvbh%??v9+2ve}8cQ*~+u10k&?R
z#XoH$Wg|1&37};Z0994_Xp83>&&E<Rt(CzZ82$3dV<BpqD>)&>6-a{sDlQWwqc`j7
zSZW~`sHkTk<bB5XmhZi|e34EAD+rhs)D-6448t@HXdiVnk-Np{vuh_!yk-^AS5^IV
zeB@FY3bxqZ*V~MHt`vAhDarNRm8GUKp17yGQ+vNFx<=TQJ!k6Y+LY5%nW$URmWK1e
z*|8<#o{>|4>4R$%AA1B}k3kE}>1^9SuJ$>Uh7g^B#{9O4dh!tSO+0_<#sb{k?k-Rq
zm@Jhw)R^DAdC6yZv3=RMRq!7w_Px9U%h~5ISB#9>(0B_j?sn>~uJKws)pq?o1Jl)(
zt04|h$c4MjLQ^!8>Y!EiXknYqxvt3eD>i0nq{w~vDPD+c@wAZRuhM`asus^3^_-;I
zueDQOFK8<^*ixI`atH+3ra+C1R7Pj^$Q!B-<dh@AYy{?NeHwzIh1`$6=O8*4z&O2d
z&fLldDmh4MTLLB~%sONUOps2IBNq%*U+5|0hpME8%f8p-uo6SL$jT}jR6B5wKTDpp
zsj&T6_o+<=!S95_KE??&H$3cHIV4cYtGKHcVTV~32re`Xzm%gYE$zeVHy$sZ-Kh#g
z`n@t)T9ayvg(EN@vVN@0J_2CzM9`1$Z#Ahy7wMVFleWaf#K674cg)%FedTY-4#~=R
z0Bu3d6muqSEw4`(!E$dBU6pTX%))ZBa+HkxnTM{|#0ovJ$`^c&g1!gMlse-{@`|A0
zGr$lvq@Y(*GNY;6uM{6e&ChRf*~vXXk??Y=u|Q*UpD61i{8Q%f#N6E6K;Hzx)`HvO
zAMq1n;A$2;JJ=qrZVQ|b0CX>?;?S=w{hNGax_kykB)<|}{W5xDuQz!IcqN4DHV-F=
z$%)s97?c$?+~zaXx{?WIG`WSmH)d^pw$a|#!^)Mu#FSy9aKu;8Y<hKZRisyI)X_+r
zZ;?-Qz+mvvpPqlO%?2y!%6Z?xzK_z%sV{p+;~^Zs{B0Fbn%MWC-yDwDk_z^zgv<s0
z<^%7}=Oh1d$$l0nc74R>?v9O(Gb>P~qO2+c-~WW-2kww&-&;V=()bZMIWqP_&^;@$
zOQ+t;pcxmz45qs3GAg~r>GBwa$5XX&M;@4`TLn3Vh}_IcghlXHt)`5_vHj%ah>N2+
z9W|Y;)p)4`%`6k}s*Cv|K7mqxXK@{!OvD0hB?lPh6?mHTKA*}|jCb+6>{JueZ<d`6
zQ+XD#r&Ia#DM?Pl`rNg1&0POfdtYqi%Kl}TZ8UVtmnj1-cB={<SDj3At}hvEYolSL
zHZ-+<k@`fMabPd8v!e?h7?g%GD`qo~WUOqz4#6*)Rk=y}A_EgR4+#x7Ml}7i@_d!{
zCgZlR{RtP=_Tbmj;+gM6C<E<ZyQf*tOT~qkM<hj_t>vh2o2nh*_BS&xZ?3_)ew1&{
zfl$4oFRnJIql*{O^BfM89wC`@+qXm@z~T|{BsNW}vRW?Me9`mjD&!@XoW8<f>sZnQ
z=3+Yo<id}iG4QM30Ola3Et6oXrVOO4SUkCYPv>2xS8v|&ThJ@LdL+RxOvCW^RCk6U
zuyFHoCY!3g{Lf|2EoQ?!rxZ1Ndh-E)SL@GTwZtiF=adk0WMOtwC`Gcyo=&yJN6Xv(
zy+;%jaCr0QAu*!n6P%M=r6}nSpWFIo3w+BM|J`7?=<IE0wANMi)inruoP6!UG3A>P
zIK1YhXXjVe)eRB+oE`McOf>W)1h*&Rg@px(*UniyHBA2!w9hXq+gD1c`jeH3A?q>X
zw+eAWqL`G5fI#l($M#D0$baUcOKXNABDZ3~SLLDC%&N)Jm&^6E*{=h>1w_Mt$!O2G
z;XQdH_hR_wkVHO-0e5U_W@A6oi%JCc7w+R~@PyZ?#tV5}zEnd1<tHd8xIaXWL0MEZ
zEikza7@ef?UfiyYSFrm@zl8)gSiB>)(I9SMVC2_&|2|KS{^#f;l`%gKBBBkA>Z9nr
zyk7hj0=K`R95OhN#mSbOwWu|X{Sv!{mbT=?h!`1v=9tR#3-n%u$~3<TIhjKgm*Pi0
zGwWwf1o3<kf?X5!Pi<y4h<8fn>)3q;RD@ZQmv1l&3J~nk?`0Iq%2>&z>TW>(b2Ge^
zhUVz_*u$f_gSSBB<z4Z^nPu=uf>f&k=X)77&Hp@?PBa)awgMf}qoYVhDZsKj>p6gW
zt9%JeFN2BCHc1l<Q{QgwAj|U!|9g3C$o>4X|E7mj4yA!)ai!%<l6-ovrIZxixc}5|
z2^2o3TFh3pt3GA!3*CNu8fsPHjZ4GJ-GRf=EmyP`72AH-*vS|Z$>!?n&M<<d$re&y
z<9d~2Jcz|?b*q#d&3KzDqdQ&S^Zo-e^bat-sH=a;*75_Ht7dyI6B}Ex9a9^__2pBM
z6IsoGi9L(`6q>8N;Y+9)GWo0_oU*pbtBrNM*<_Y>M}w=(DeFakcKoB`NO#0sC6nvV
z!b&+?TU%50oVYDF!O+;;FAtb?JT}b!xfCDcM?twW*2(T{gH!k@nfLV#)0?F50JfI2
zG_b9vaDT;5>)#MhBq`vw^eLV#BI3u(IWN(ceV8lNbdAa4AWPpQdvx0Pd)B}R`*{!N
zyNNbIq?Dp6R4o(YOBTEd*SWJyvViD3@P{zu{rnO2s~ST_K|a5<A6wB;`>hDO?-e^M
zwSu^O<T9?f)ot%Q3j^2G1cG{x3W@Ht6Pkx%+?dM8_5NosE;_G1+qtx4xmb?p&!6Yn
z56@zXL6jdw&rZfikoRfW8CWe(CE3=2Jil_sC>z7)OYUm*(06U`05Uv2f}K%!ejd@i
zyLZqgMeEE}b!kp}ad(4Z-XS6Jz|RjcXl!P)O1h@_2j|QfM6Tw&*pkJxls~A;Z2U$_
zTek#CkxU#kHN9(Xdn3n(Q6<&YrJcYttfV&7+Y4Vli)e_7si&LQfOwv{1NL~Hr=m{f
z>Qag#T%`X%se?5`Jii#>dO6{8W_<ZuU8cZ#omq8S?0OmhP22Cz<-ts^N{s1n6dCGd
zVYqeM>HS+BcRAg{o!OFfl1CmMOnZA?3K}?wQKtZ{5!F@a9X@aL^A3@?h_@us;sz9&
z9NIzmAT5Z9^6x*M$Oi`o(Y>aP2{d_fCFKgX>$G$Zqo|}@6JsM|T<4Qh=aY+zivwYg
zU)PPPEa`?A1&IXv<%#y|8{9cFFL=vg`)6O~8G@={C#MdM<}yfi)0k9ozZ(eFj3&<;
z#zl1R9yu6E5+!9Mms(6#XRUqu$65_epjk81U;MaDPA+<m%^V?vi2_#}H?x^J;cP}h
z6fdUnP{KbL>w4yz#3w1R+-zoR+C1jfHx?rzqxHCqMdnq*<-c=|@;X;mDGv4Ly*bV#
zRU|Fa8?;B{7(t~JiAbKA-WIvC%zzWZ^@LvoAbL+s=DYup)FO-T;M`pFa`w3kY*YO(
zF+QQiZpJ=;!<yXHKeaY;oNKN4gxf?dCvHRuYD_MVdjM%)AH8e{rvgO1DvO2Q(*dh}
z74U+$7iqLRYbV3q^dP(3PuT~1(j3ry&sN|`I`9(Wva^s(YNwlHF*9zGq7Kz2W;W0_
z!739FEakeAs-B*X?;1=#IX&;|8?u_N>;U^+;&tM0XJlM<<F9(tit;6YXRbu-tEzGy
zOg5d*P>?fX(@?W2_}2X>eNvs|0W}*T6STNJ*_wK;9Z(l(s$$=DIh=CX%_i3~OzcGG
zaOMre5GNF0eTwWVU@F+vt_f{;QF%*roxo>jX{%2Oo2xUGophyeqYy52pLY!MJlP#n
z%j%V;(bzJReLkFd0FDS=VOxp~1+udWbNft?vGxgHBNd%<eypz#N7UI;_`_ieoD?)*
z)+@ki(ZWu9KdPw<-`Q%2%$$dsaXB>CYtl8@+<^T*mssii@RO+-durmZ@c(K7hYfrD
z^#)2x_G_OF<%(Qy7K+@cgbMZ>l$~xy{M^wQvd+44#OeQTg6~~0R#gZ0`V7q<Q_L28
zu`O+}_v$!1$m@uRjAYesnM*g($sx(N!ulsz01o97c>{W?x5nU=AnejZ%S0!m_95GD
za$y3mFmA?bZnvlGj{`V<)Rb9vkG*o){u|iZ!PgkwR>r^I0gZ>UKJPz21f;#tfP4Q9
zz>K;7W&gkX<1U}qTtfZBtx@^1w)1tI4(O;O)IS}59F`BEHkCUka-ngl8q?TgB1w7z
zXnI$aj{ygTm_S%I^!8h3#nxfi4euaQ;=Oa0!d>;hk*BdwRZPD|>f8tr(%d%luV`re
z<m;SIIkJ=Z4_dE<5T8NqZH)l`!CXtOojL@Z7JOAea<0L3yH#Pa-iw}-vjW}c3A^5+
zdj9J=VU$@ZK2@(QH99Wp;sRy7Vdn_S`vA2Vy>)$P-}2|`{r$f@QTXPQwu4h-4ZO`q
z@F7)35$?-dok_%TrOleTo%Qeke7d4VN;o?9N@>467AZF-*EToVbShQ=lVQBad%2g^
z3a5{A^H%<OHVJZc%o<rvEZ77;?kp@!{Z8`|;>2<2^yJt|rbN^P?%DyLXzL13X>=dF
z=5Cho=6Bv@I3{I)IU}5EL3hx*!MRfi+_>-S^!AYq%>*0#aNmXa@}LEFdeNjaZo<P}
z!7<ML@jt&%ntGnieS8~vmPe2LGwH)MGz~y)G)-rCnYA_2Z20p|jh#ww3dR-q^y!9@
zq>#=8)5EP}Iq}B!=7)KKtIr}MKzY5ClNno*v=dh7^9h7;!^K4{hsige%azj+tIL&a
z(h_~pzWb37;^~vX<CSA`OqcBGl3T)1(S0dPDsaC4Gb*WHo{@<u!@5#k{j8cWNB->e
z*n|*ZY-9~AH^)AW9MR5|<eW}7_jz=0J>96Dn7=y5$Hh))aV`@FfXbO_?FI+o#N5)-
zAJ|!TcE~ymc_n3Q^yZI`GZ=WgFYsTopNx+8&7G!mpd<~(GQ<;2tkg$W=7f3N*X(5s
z>OCc8EG<z*Q*K+oYV!%FQ5Bnd=F*_Ja+quH;Y^!Ivxv1u)NayC?J~gk63oqsq8AYO
z)<CRk-G^@@>qB9+T}T#NqL=N~s~GTE<*WbKGs?NedZ<@o4t}JmTxdwpCnxyPtwdKC
z{&YJEI+d($3aNk@zH4hUhbTQh8DvRsB`&b{nx9*A-kC+V7LOb{WTL*8Zem1#Xo$t<
zN`Agq?~)M(s(*1QI3vP7#)=3NP(h>^PnxYy5s_vJ&`alsjI=DmHv237Jo0;}hf`%;
z{A_F`tr;?QtwB`<DBWxugL+F36Y0`Qrn4R$#qj+bPo#&!4zgOdi)pY7n*!oe-t}3;
z+1^4p^@gx2y{XK&hI5Zh=3t>@G7y<N<vddv4KkrIqhyjgV5_e?J;LZyTk!X<A-lpN
zNaoNJ&m#V+mfG65XM{)<Qi_EUd+XE`*_?UL0j;tdUbZ*F<vaatvjR7>gVQzsDk+UV
zoFCU;BA4f92FPTcrbl!3bZbtp|BS99@uwY7s*{qDjGK9(vfl4}xO@M7dEUj(kSslU
zLKMgEVF`!d_PSX0_6xZE5mLJz9UTQ+M$jN6d;hQS^AymB%vEeBH$DTP8LYb1Uzs+8
zHwQ=wpK7QorAeAkRDOum;jhX<h4i1C1fe;S8l2O;HjAZBaZg=NK+nMtUGZ$Cn4;qO
za_DTVLPMpqrLq8I92Z4`7Tatp=ir!Y*RU<gPl}d}^=NcV6o%!*<d8t0dDnTI55}A(
z+Uhs9vi&`5xAoE1EC}$9Ldm(&3*$PKDHz`fax#i*b>sM5W_}w>i@19zV<P$?p6E~W
zN6`&62j1xG_~Yhz+}s9<(X^l9HihIO4d?c)ab=0F*4g#EI!oCF8gIxo7aHANmUl1B
zhEf|0Mx8tMimuAXnWYJ+9B!^@b87#Aon`a3FBJbFKd-UIJ07W^C)vPD5!oDLX%c~f
z*igD&muY6gUXiSZ#mecbSt{f*KaT-<0;;|X-|!jKd^{7{pLDQUtn4WFebfZKwWV!(
z4w|1bGcxga7ra2z>e7!NH1vGSerr)tPglEUG<oZt);*zEUFpVB(P3oKVh;DQEq52I
z0(9P8{&O!I8?SaMCJT9Ym*$>R;-Vl+TRntx9GMvz3Q7D;rkA~f8n(mICba8#%#+Qq
z<$Ck|YtXLP-T~@qIGjPNq92+d?MQ<~Pt1dEAP&^Bz}DwF<gF%}T%8h|KI;2RMxU*W
z_x<?sB$hBYmQ7o`<LM{0CdC)p+BUjP6T@kgMMLve;6&5a%gMtd;&M^D6S=7{kWeyT
z>6-}O_|jME>j%n&rF|HQie=<vvf2UAq29|qNx<=X>Q)@sTNDt5Q%3;}0twvaM9(P5
zBBMl+ku@cQy**9MrjsWk;-pjymn)H*abZp0s`h4DOs;-#y77i2i+QN75!J}Wt-5TD
z9xX>sBnv#(DUVohx?XcQTi$aq&hZg&H2IyzKGSRYKQE>yRV=@LM#qmgNV6fjo19@T
zJA)M8HfJ$Y8k~PFXt3(fWLnk4L-}1O5dz?xW~W(~5FT#VTS%4yyb@OPIRMroBNKF@
zK(>uS0UA`9O~C{gtYbZ6HgXdiJ1Dy)?7=I5O?ok01Ca+<;j8QQVC#AWVmlz53e@L6
zeDr7s<zs`P$eYTDF15Uw!Du)e)`(&St-<Wv+ymnSEW$K;(y}_Ls!<iKq-^~O9OH9i
zstW41%ex+AT3WXIfD8=EaVl$U3JVLloR^lyDl78|=@`42ol(O*W9_dwf;fq~<BwTa
zrNY>`*~cfxcaQ}`^H>DW72E;?ESW4<r9yv3L^+mLP;q*ntnX+{Kgb^yOj9)A*P4z|
zP#8$$!3)1=)$+yJY;Z%(jFmkm7BO8j50ZHugCI$Gk*E|swX-UXcm~Zfe&~NsU&vTy
zMv#xo^&>*UV6w$+x};!c&4I9zyGkxZ-qU$!aHGZRuDHH_X6Zf#V>7ZwgX*z^12&ne
za%<Ed!oDaaDgW84t!ZN?&Wd6RL8O9{<;Ga^UQId!6sZzGK$(%B{u|B(N;TR53=6C@
zCX(4~%1=#t2_EBQCs!EtsHm9`&tMQ?)j4dEQ2aTPjE?yk%?>}&<awzM?#!EAk^GgH
z%;CVm!Swpg>$R~$Elqbm-X{6JiGc*JXwY;Fyf$Bu%^QFN3rLRa!^lac$u!8T4L4BV
zmwjGY*q_#IuaQb1`z-|e6Kc;@<y>Cgw5l$a`nNcqjS0VpfI#)>z#1S1ws)y&7Dg1l
z(^l{73kUs{94=~OlKztaj%)I$FXCrtc_FC_q(eHxRdyw(Iy?%=eDQ+JBEC))HPDj%
zxu`fk1;1;w)G1gbKav|L;e}q3RjPV>djlp)E#uD-WlJW6RcuMd$1Vik&c)?rj$+a~
z7gN{$wRq&ihYtaGuP;jcR5W%qH!MkLp<H}+kV0V8Que#7goGrb09N#8RON-GC1XD0
zt~4Vfqw70~_YzW4F|7=D-b91U-ONl(L1BSpoE}0o-u@Aoj9~u?dK%{>Sny7xqDmgA
z+{7fZ(!EmG9G(1jHWf`iiBBoqpA2?k?E^h+ZOE*$rdh%Bt*N-q>gpoxO3g+ivPXjY
z4K1kYB0*?2c1yA4(Gj)*sBqfYbUNyyZHNBKJHb$oP>JwCeC1%8Tlm`kke_VY&cD0I
z-^|1T@?xBGO`)OL19sT`Gkk%{g7F)2I=xozvaGDEyqtsR!AD5>p0mmw>Mv-0-sp+T
z32MuSCH;t|8=VhR(bd)M;8$OmK4y(A)<4BN1W4hG?!S4H8+;g)7+$?I`zVs^%U)Jy
zi7-fnD7^-D*H<#Hhy<7{_u;ALt&YxY`-NxKVe7{&*K2j>GyEk>pDX1C|7r&cFfoaa
zqTbF*kPVitzH<^sRxs>X3l<<782E1^pc3I&^*t;A4+iU}7@*GzIc&V<RhE~eeZ^t4
znsAEf?X?a9Vg9BTuLFmJWsLe8%I8Ft;~rhh!dLMTGlEbRj6!tqpk95c&8lg29hO$T
zXGagG*~Vbphw+x%rmNAu_13zP$j%0cPe;^A1)tOP+P8tk4Ho@cvj(U54D&}5Z*<sU
zqibbQy8VR~pM`!cur!UZk3<a?_r!L;2XZzKXM<;S`s`S*jLcwSjgGeW`PaYrwJu{z
z^c^5lQj$&uX~ZOXf3qpha+tQ8=R7-ebv>sPK0H0OnV$RbUg^7ti04`Rz|BC63wf^@
zYZF_6{+-W}Pt9>3TgKldOJjwXzxBN0xAS*p>lUHQXU)ea_OKh9w|yK<A8SoOO_N+a
zf3gB*5LD?R$03+*y+u?(ft8Ul-bmEQ$mrzf7aXFeN-C;GsV&fCm`cafYcoQ4qhhUK
zOmkU~Q(=e`=}@Y`X1VR9j2^}O_wH_mrg{gnKZh}TPG`7T&#@%;w`d*(#!+1^FKUy;
zra+V;HHg+om7;zUK6`Q^2ye>ZXi>QMh84b8?>IT;FQr|Nt-^uVb(Wv;NgQuae$}*-
zo`AgCFz`4Vih~vY@0>A>F3(?4*-$=_FMglg3x;l&N6qAOHl^~xTIW|;n)I7Dgx*Db
z!N-YtljE6l9J4ns;08lqPcz0=L=|UcNgMz?=WN;R<rL#!Db6|;8Qx=@Q}jidOR(J#
zYHPF%nQf&3TFvK#7s`lv#4*Ih#Ki8y?^AvY$e;wzctLDY+Iwulzi2hg-8JRp-pIdy
z{~p1>7#!&EqO-<o{H%Q%y2}>@?(UpzH=2TPa;MJLv+&vd<T*o*>A(&7MEJ?=+Sx=h
zBiY{3b#!o(=Sg114}eQe5pfH<x*p{43whSn8Ac@nKe;$eVH!Uvi#Lu0XBe=iN7<%{
zNk~Y5#e{(#YO}JkLgf?HV#1m0MoBp*eQ9cDwz;v+0m<wSQmbuZNf7XWp}WJZpOH|)
zcWgTp@xuZGe@6eTs<Dxqh3^a|*Vel8=&8J$o1KiMfW=r|VWKgm6&&$l%F0iZF>X9h
zH>wBo!l)>JQ|%L$MZ}2BA#2f_np3fC8#y_EkABkS2p~Ee(hM6eGwZm5-n;3>U5G(l
zv^`iA<b7Lv9ZlCa+#g;P^Sd0LC6Zc6J9T36C?Us`)pcM-28K^J8@3Ku`Gt)Y-Aw<h
z1%yI#@}_c!e|?D{{;u#n_U8|0u8NGU&MFPXXGj%hX2@#+4uPLeyRX|{tFEt&NIv@K
zRF;OBUv(d!@k9PJ(lkl|HCr$QUTQR%8P)s;S(B?~iuv#c+v9I(OGDyVxTBNfiGnaX
zwMqv6?XuGoJO(FQ+rhK>LBO4qlk^Lz*R36Hwh=U>rnU{L@{i7{y#V5D@qBHLow~u$
zn0f!&V{(m>Og5&Cu|_^>0(4MvVvX%=Ra=4TBN0xT%&X7(QH$;MV*2ofy!518S-Di9
z4ur4CVme0At_|auqxod>=*<HJkITwhCr|Ziu3X{duPk3Z&=AN^VGnHd_<Pen`>h^{
zIcFHsxa4CsKC$@82nIlXi-C43&NUhr)D>~t3{E7^_I^@QQOQC#)+f9mA2Ht^j^aU-
z73sxWJA<UzR#^q<Ag7J_Z`eJVarF7V*WDlS8EW2xx#BnB85t|S^Ij;v8Gi2cByp+m
zkIdWS8m1jgbNVw<GZwPyY&E4;m5w(Ftb2m0nySz)x+F1S>2T}GqR7~DX{I3g+&B%m
zSaZ5Rs+^k{m3bUvlh2s1u%{zfWk*B9(qzByy<v8J_}8s{swQ`7X-$RIT!vNvrCxk0
zf7ds>mr)TB9M-#etT0c|jP4*fqiQ-j_0Lex867{Z8Tc2@$f5>uye!qeqKL>j<pSIB
zM~aA)=zL_0O{T+5wVqHuQ|_Vr&QH3HiQPgNXDkVOhmC1yI__B{rhkVN)aab92>S>J
z57R}{-M%3*TOOG8Z`Au;6GU2>yBB*#tIN52`UkfgKfa2F`j~Gve)&?Shp^oFw-v>Q
zn6f_2>|UB@Oo<-tYX&a64eNi8RQGP_s;VDh{W>^WyM$Js$}1gi0*0u-6gRkE|M^;C
zg9>7iJ-P^`gm~4%YMh2QhtT!)kzMlED@)zKe9Uj++kn08?Hzrrx^)fLTcdyfQ%L~p
ze``pTR?~yA|MOEIJN>U~O8-}Nt7~YC<hOGAzkBg}_q-J~)DrVC+(9$Xe;qEL6L9rZ
z|L2eR|JUO3|Kt~3HM@7q0d^t4s`N<GA2=E$B_)B!?ArVKy3zZ=^@B#Czk2??=R_Yp
zS^C@}YYVqkw{>-JVCT&)m0)dCau%1+l=yD&<KKUD?}Ad%)RhF|kd%RmwYR&6iJ`kh
zfE?2D`Rfk`0=5LlfB&Xmym_>(i?1qPjNrZV;Bb5zUGSTuf}>=<sm^-U(lgfr6D|cD
zz6-`!z}NflHM`K)JIHuf<)2*;!)8z!6&_w9a5-tM>9%z-GRk;;eSLcXAtoZirR0CZ
z_r@BT;3B_E!Js!Z_I-i3Sbs9pigzP?y3TEqXES*wL7TvC-sINkZa1__xZbtot+=he
zEu1@p{7vtNOaF)dagdGHQ$Tt!7#!$hh5%btO<?kBB|9Orj_XXuwBgfbuHRs?OHWgf
zlQEHLtl?w~-5~u6f2`Bw(p36mIH*qcQ<h0wLJ$3~gXQC{A^oN&q@)^9^(OC~nLwx9
z#2LYA>y=NsLt6pCEq5o&`;k~;zf++|Bv?!FPET}rt@2AU-GK1}SdZ3B*72>U2d?R;
zyhT`NOM~dntf$fo^V+Yu8@)w<N$1z#OlNE5Zvsxc*_z}09h{k(0@62T&;{6`W|fPu
z{F~H@I4^}kox1Kjr;mL(EOepIXMs;dCZ5mRy1<kr?rwOMR1rT#K)oepBm?CX|AK*u
z4n2%ArZ#v7Dy&XjoTYJ}=Va!0jB#B)dW0k$Sg5x&1|kh;X%T|J|H8g}Lrp!B<56(N
zqOEb$=d?a}YHX&c&S!-zuR4M3QlTFmA6-^Dx5*?-)mY?aG#c$)<o{!9^C>FE;&XI#
z987}n`b_AuvxCG3=nsV*oq|%rppcM{OZ3Df#Gp1KR-vbNupUS-4FoCq7L417Z6H!k
zP7GhOirex)TJ9~TqVnEpT;{UYgXw@gC~dvgMfAueKwvB1%N|@qE{+*lSry*PWKCk(
zm0UtiXEnJ$-4;cSsWJu7jdF5YuBdqdE7UGAj**cuFmmbe8MCStd3d-7gH{g5qm|Qw
z=)_4xex9{v`L~)Q49}h4^BD95P5?*#I5RfBjO-C#T>aYRj>gID?rFjHL%tBaP=;Sm
zpC84$atn$c&_k$PN#slK<6|GGU?#j}zjg>g4F!e-rnjKehCkZ&E+e~&7aP_aZJ9e-
z<60J!V+kqsQ+B!b6ip;0b1=ap6CM)idATvp9t$NJi4!n=C3(I=NXU@G14A|XLruxI
zP@H$YK4&=UNFOHf*e#Kc&)<^<q%(S|gQU5a39jev%x_*>TUx*4jVY)obbzhyY_dfw
zJO!nCp8FX-qM}zkHt~15+=;2zRgT9_!SO4jj70ObcWdc&f%z$6`&MqevB8_03W-_*
z80$lQLxfMk9O_<mZb(R_v%eE#@+;D)-0gb-k;cbQZvq;@UA*Sc366EStjRag_x_=;
zt&knJceI0;dfW>JUN+v>Z%*2a#f>r+Uj?eJSHES?oh*g>1<1Yl;34r<l1W!cXr*tN
zv&;O;V892OPR3s5hu-+!>-(l=^IJL=joeoyX#yev-mb^)74|bpMOR6X8tcsS%%!lh
z^v6xe`HLZHYRvki{)PL^yKkuON(g<a#jFEjF*`Tr9(mjyv)f{xY-J*{tZl73;aQL}
zFl~=d@KaFstf{i)g6$Gf|4tBoa&&gnfC)yxV}r^c#QxOH_R&@2i=%PVE+!E+JL+tj
z>BTAzjrlqagC`k*z(&M#Fs(osP_zH@=g)Q13p@C4OSB>_SlF&J>dBXC&$pKSWl6X8
zY2^>5Tf&VV!o1E=Gi98|c2)ahDfx}0m>tmSgPF^HKQmEL(I(GRPiK?}P)Djs{#>9|
zk7L;`(O217Sue&5Cfk2I9Deo%zA+P-T9?hirhxNBpOfC+UXEge7K0LzJ?$Dpv%sJr
z;L|rg@V$Ae{4?h?GysosCdY)?bpkL8+4P&&NVllSh_iDLGgA|`yN4say-9TEC5yFq
zFWIABarj~3&eXa%i7KUitCs?}-L8=59c^uGQDf{p*7J_XX9K%Q)?J<WFwfH$Tt=Fx
z{kN6fzBB<sLI4~aIRHva!d|R@G#eVk#=dQIzf>{s@zF_?0&EiCHcS_a-m7oTXyss>
z7j!GDE*&19$VLIFahT0;Tx;8ohLvu^+$!})lxU4OAf8Q2FL2P_$g?igzQgk0XWzE8
zJl`K}8|`2D)zel(ITsxhA<}5W)^In!P**Zr7f4rKvJjP&Q0~|#kfRzNh>i33`X!gy
z`a9RB_05Vy@2NN}h+t#m6Vr_$6&F<vyx~dwthCe~&YSlU5y>s^z~1zW;Gm51K;;{J
zmf3vZp76m;R#-0>D7Kr=Q|RvM(m~hpuj@5=`Q56b!kw4L_;>ZRaFCcL32*<x!2$K`
zyVq60Alay$kT5^vT3u7NI@siV+&g<t`P-1XGN6cD6Mt(YmfZ3&?ydLvA6QUaJ8e72
z;7@CF@6J|f#1p3_3%PZ)g25*?p%O*-JIq|xls^R67thETS!hktG8YkAI0!9vA1OeW
z2ap{~A+MLjg!BE)7UDQN-|*g;u^6Nw3P%z7P@UX~j8_@NtnXcvXBMKyh_uzToq{&u
z_>Xg<!2A2x(%-JJXiQ8c1xXJ{G|f7zrjll<=@q6Ogo@hG5E!w57v{qUnX(Edp+8ev
z^8u&PPY5BkHbe2Un<*`D5cLwW+5ME$n>^%lcI06Tp_v&P3^;pDN3V>|@<5`JT@Tuq
zjr-oHO#6Zk;)#ZHN`nlVQBDr<79;1aM2(~ueExiIz{raeZ;$u8LKkS6q|c=TaSr_b
zaRZ<<9*kg68?=7P%A&B|y>dGk2z}84zuLI1kgjY35ub0KXz=hcAxoJ#nImJeA+K`Q
z?5Y>ze%mB#hms4_mje#{-~eb&Xs3NWOjZ8Vml{U8N3xNsuZ+i1C{S(bGq(OoRW7Qq
z5|?7}jAeFTpz$EGgqMwqN)jXBj7&+u^3dz?W9**p?mQ-h_r(c2BfrJ_R9~I5UGu45
zL9fEWpfzEZx9RwBKToVJK2=&r15LVXU~NrIukX^F2V7v%gDD{)L8?C@L957AffK=*
zSxkN>HQ0TBev!40$p;>1nUel~IVYW+HZOu}BhqMuiJ2JzrSKe(HGypcdAGDKS@QMk
zSBpqG`qy+Ji2`+LX`%}1>ax(b`BlC5?o)Y&G`&&wz3aOX(S5a4sV&|k`FdU;-g3ys
zxiM&3@ZHvKe$mqtM9#|KAN-DohljxoPe$fFKqsRwuO4AOx&#BdB)$Q?v*|ukMFXMS
zw8!#LOwYhzS=`;(aFKmM=Z|;G7}h-4X+l1y87E95c$Z={-&9N@Tq(w}^_$_6C4>QC
zQ?opSgFR#do)U7_Z%n)nw?=|v**prYjaA_75^xbXPyJ7zZ?~edRm6%KN-yjP>`Q~<
zBg~&d`%!ei4y7cdS#&GjFbm2mi7Ls-jqwiqbZk_~nz7hBnoHfsM+B>23;ylD)4+S8
z@RSx?P3d!{b9^-M=&$yq?fR(Op2>h1^wQ1G0YxlkW<ecQiM7lFdbGKT?T3TJbKBhK
zSZZsaVCB^-8eo>Iv^+}1Zx9`c0lx3}ao+5E(&PNXkmg*s04Z0sO8(pz8zA#CWr2NS
zJyT&*F{(|$LV>Qm>IMNss?moX4xql@90C>gnKv4ILau6+P-FS@92c;PM;P4v1lS;U
zmpS9AJ2~i4@IrfZaS0X@*Q;gWgzWs{r>Q><N9WZH6c2`c`<SW!s|7sbyM|!t*TVhr
z4RU$*{wa=POrCX(ii*k#BFo+}-&XxI-g$~^P}gwjgTK{Yc@8pEEaT&&>E8ouTEY!}
zv;gy!&ku-6f!#+<&-_d?MHS7+WoME;_~D5%W``S{LxPf;>xzS)yz1p#trfFBr@8jK
zFNE1eMw=RR90DAiJ3FGSo&xnCX=b_3l%)2uRuR6ST9lpVn^pU8Hkwh8*$d>*=1kc1
zTatcWx;W1cAC|fZ^5Q(kE@xzSDEr6k(d!zZo>c7)jK<cpHIa0AGpX@EQ5%2GGE0W`
zPiJeFDI+3c5~3pH%p~Dr_aB)PtrM%>YRw*btzOh2W9{@zHb)I!Hi@9UwHwSI)rhhk
zD4v+fKIH;7HxZYS^@&Wco;!(v)OwL2w(dk>2h3wLrN532Cz|HMclm!w8h$CdO1{(k
zocV5iaf&L%ef%y1w4Nhl2Lpq?yI9YM<uCltQ&tR-^e=KhzWqc>KxIHB45c~aw%u;0
z+Gue<#g^n{=(Rte84%R4+nuTRdv;DG^4|9|*du`8dpMTcLCcEcpYgWb#EC-E>t=sW
zNmd3<=(Csn^#@Cvig3U}vOyxadBwFoXVPvl7KFU2OsBDPvY<@`iR6L>W;Od)Zu=hR
zN2de98YBaHqKrhh-`VP>yEC4ITfkPYcx_W59#TbF-wsDlX`vj5?hz=xd29RB8lulX
zI9FG-C7i?BZQ;WRo)u03DFG#<9u|(*yF1fW$0y?R=K=YA+Np!jzJSwqNMRu&#Y;s?
z2Uk0Q!Ydhta273TUf-Pfj`g9Po^H<P`ZJwes2qc(I3Yb-Qcj<<uuZb~ESOA}2Y@X9
z>?B&ibJs?^rY5Nt(<WKx!{^L8apX~ly82)9k(F=iR?g4PO=T=SPZVnOQA9^LYpS-4
zhhmH|8+Z)svOVtX&VsO=pi}zum+{<&3B}d;$7ZFo`kI;&$|(ypSRx>0d|EV{tuv`U
zsKdlcr>->mBWM6hnLGqCn-^gTGHS-`O4&^=6*1CoyHuQ?UPF&G#H)03vgrENOLId~
zO1;`#>q}(W|HdXO6(dCKjM_eZ_UwhQdAq-OF7RCMEtFZIj2Jm2T~rZ~vNG@ABv<{g
z(I%$+J?-L*;c<nK&pmso#b=`++qKb81uTo6&YQl!VVEkSmLMY<uN5!LTbN-XlYWB0
zV5XyOQhgwT#eRqTOYA<rs|0zyqQb$gm@n?;H3$JleZF@$I*sF2vZ(Oq5&GgblQdC(
zI#9z?3o%q<u@Lm&m9taxcCtbIH<F1qEL_9f-0<W^&)-M3dks-N&<@{BsORb^w{-Qv
zY)#K}b(X<Y;<=qHn`{{_HZjFQb!@27Fk48(mz52Z9fo01<<}dj5GnzU@T3jr5KCm^
zy03gg*zS~FmO(gA>I0{2StwLJoBPvFn>@MTsPklXGSeLSiIsiRr)m9Uui-$MQzz}9
zFCw{Yb@s<lt^rZ$@Com2NZa$x^$nI3_V6>xt4-A2LD%&MC`tcXC-;<tPU9U}jikI5
z3om`_B@EG0HqQSCar;VO)2(>A+;kbcx+z4uhfH%o{2zUU`@J54{rA6cpdBd-@etIW
z;NW^yW76E7mz(SUJh9R!oe<c+b8$)N$%oqD%zG)d#2;^b{Tjf}Q_WVvHy;+pkROas
z!BrdRM<Wl)1~Tm*^I}B5g^dz{SzmJ#nt|B?&DP%8QC=Y-DXAmCU#5q#yVqPj6&@7E
zsCNrM>?q68-q!L!n%u*<2$Os?5fzmpp*Wi0EjN3W`EZ(a>;WYfs63%$eZ}OsI~F*P
zbp}w+qtXVD!PBjPh;1ctS!Qi2V1@%sm>Am|eR)-}f2{S7K6|>Nax$~^3^6y@&MrD4
z_uJ56@%%rT-adHnAQKA&flyG#9@aOn9rp(D>P3gTyVJrAX(=vrcpNg$HSGAs3A_)_
zdV2=av86Z#yN>)dl)q<_<<|G9<2K&F^4~3#WsyiD#i&#B<*>hK#>F8U${%d1@;ls~
zG)4#OH^L1UyTdMx%?XD2pAeFY>u}j_y$8v{n*G^2=Zy!|5Fa@?+<COA;M1rsSfj!?
zhWIcE-ahAN%Mf5KH?&IJ)%3HL3)qnAYENq3Is!Fl)z8Q&J1!H^OKldTM!*N_qK6jD
z=tWd_x)HS0dR_^PE2Hr5GEm2L;ZQ^RyciMJi8UNvRzQP`K7gKiJw80<t#Z;7F)NG6
z81*HTW+0J5Mjf^NwB3oV#0&y6JkVw1=I<aZZY-|A*ETy8i<o1i4fWghfwVHHjiFvE
zE34Qp4=0I?TC|A_*8~xU7f42KtOkTuTbYY{<!>k7F(dfw0li{(xFX8ds6FsNiJ|(W
zyi(+*;T#M=QDgOOlP<2#8H=JcFmZt>u-S^QP~77E;rgO2pK`N7x6Xcjg1Z_j?!Fdl
zS+e2gwVFAU`=#}PcERnu7n0G^a3<|%HaFDqZyC1HDm^m*rr0=>H<5w!kjKSo$Lk;%
zn0U+9uP1*b#Gs{(8%{JjDYm0mq=7g+z0|nA)I)=7*48$z26rN@wzRc&QD{Vf*o&T?
zT2ZqvHTeStndPKsE$dG(?v=XkI#gS1xC2}@<`U_!-Y+piDIpiw;I9_7$<&N@c}7Fm
zSx0^$>Y)_ySA1Nb5|0NDMxhZq<l~EF7CT|W4c8dgCBP(AqTD9cpUR!<%wrp=2Q`kw
z?#q=mv-Q%}(yEJ_np%kneusVkC7<Wi-az8g@Dkh8r*q#$<9Cd0Y;0WLX?{OmQgfaD
z`t>1CSqi+#N9L9!EA83TVOOvQ8>&M-cV`4_j4vWg#$~E5endtW7~$f>MMTah;TH6|
z3N6Pc&xJpI)uT!5jWN2#eQNl0CYyJEaeuxJ>(Qerk`3LS{2s2F^5wV8Tt2;T@YGy#
z*1j2fN(r<*=DipWPV{B^;qULy@-i{G-aZDgp1z!3BAZ~R8OQzcfHy|ng*wJG={O$$
zVX_@KVLD^Yws*(1V#9rJpV1m`ZSQQCRsD%4%%Oz1^@1*_dF9;6Rnnmi#Y8>0{ntf*
z+q>qw6JN^|mc;5Oq>(=&B34ACk*i3rs$OP=)_1L69(-{osFs5yb8IP!zT4gT`*&q_
zCDs(7NKw`UapY!+&pB^mOibr|q?%CBy6p#ym#<zO?R_WMpHE$&YI1+)i-D+txTDPn
zv&cMYlM%O-bguZ)LrKpU4y-T&&Qlxn;F=vj?pH>3bhLADa6-_YSP!vA<3*_ns*6M@
zoEJqE?uZx}Q5=d)$~T*tS?!a*<dq#9#_1{DhOygJ2xjt(HaT0;f-t0YJkO5!(G{UV
zp@zp%g}>Zd+?^4n4kY_|qjQhXh>VUa)C`W+)+<JXb8~Y!$JIUU+Ue{8md;<YHeH}6
zqNP1#_uxgXLwHVB+{2rT;5#Sv;NYOU3Vxrr)deL52Y-Ge`?q%Pxb<dSt-%T8hCjot
z=pfbfbO%vUrk3h1cWOWD^BCLlLB1-(aUwqZy)pB)u2A^d7ic6AAt7=S=>&`x?4LAE
z+WIwEcvxB4*{Q2~t%xs(oh^8+d!M@|u)?=qq$y6OIBWP_Leh6e0hP$rdVc@>%yMmg
zc|>LM<8w;PTb74>w>a2GM<)vz9>*AiUVTG0llAg_8wwi52EvXjwLTwz0TbhFjjh$l
zlFp=2hffM$oRT9<SKp+jnNhbKek_$>zOuw;()zldDW&P7?WOe>Vis2BD;M*cq4eJy
zrb*J|S+9MrdU9}_O=xL@vicMGtxgV=O=4N<NV{w#TRpTbjUGVxMHb5MhcVX_LtvM>
zD(@nS1*c_)#9-)HvOvEBMG<b$gAx{QAQBxJGw*aF8rc~Z<ajivMKr&qVf&=_AZiXH
zORy$VDkQPRl3k6aWTCDnEI@i(7X37fYRgyn>TG*1v)_@Z?=3HTCd22%fU8-8q&yja
z3MvHaSJ&p81k8C~@1vlK#Y*l<MuD{abihqjss2<e66`}6BSw6*?nKf8yW8(<ngx2S
zC)NeXzSVg9w#b56c{0I)jqTz;p_=M3q~gl66}I_W0hfN@(B~c=&kY(N53k9@#NWin
z)08r~&&Kmk!iR?SN-@eHhSdlpF{fDH5|64*{)qf}e0>2&?%RNRV?!Oe;oDR$M_q7?
zuoI~jAHkdXO1L@nCb8+q<?+iGJR%PJm6>~!uKEr52i!$=94^jk6zd?~#`u17e|gaU
zEQ|6{$d)AOLm*clEVN`wM0$QRA$gjY*Pt{`ub*$dh%YfNcxRBwoxl4FRFs6=I$C6C
z8B6O}kqg+^F0?@D6fdFvH5o3Em-N-Ot|Ky;J}ZsDXTR7i+xRIf7x*Rjp<YOt?Y*P&
zMZ6cicd&w_#o9$grcQ%`llmL3VeV49PklK`xEa!2#Z)(qsddeBWuBbJI%;Od1s*Fm
zW29y9K5ER*+P{X=Qa-1B4lg;tVk-gPzyw`6A$F&u#3x2e1esQG;P^i3zYmVLTL~Tq
zoyk7+#5N|BE$%YscAzxE$L@1mPgxx@b@xJ-bZnlLiGC<)BP{cGvqD{x$t`X`gg$+V
zu3lSf+cZ%<s~JY;)1Oc67MijXQ=7a_1gh`;7UX5QX_!rP-U+<v<98YKw{0RJBARP<
zI|u#0kn4q|A5Xp^J>Q)T@56wE6@3*Ce?=t!gm_&jVR>eN9K`wnn?1Hzk2N_xpT^Ak
zJGq<f<{Er2n&KJB_GJpPOsgSFy2t9A7k)qKs%_G4u`uJohYOEBeNS}M2|DNI$p!y+
z*!tSqwSE2~fG>Wxeeh4y$#z^IR4No0=6TP@L1KVPs3UFdmZ@o^10C`Q3M2y&cQ3s<
zSZH!jSkU?PX+h()5D)Duf!>l&Y0}>~S1`@~>Y1dp1KM1NM8^xYqfgTa978M<_s#Vl
zds_#m1mfo?@?n<Y?_2K^sx5y#u2Lf28Bd&a#;HvAKP~4ER*i}x8=OBte3QA9RHd)6
z8*|^z&;kcRqUbs5++;bI5sP3`q`H$8l-SaA2$dW8BdXTp{0#V|K*F6UjDN$C;}z3U
zz@nAO;Iuxv&5%Z9m&-=50Y8D(_iod+WNL#NME52S=9!u<`u{*t57UgFp3&|eqB5;t
zN%}LiRDYWQijofZYDj<Y+0q4plDqjidXK0x<8JaQluT~+sQ<L%J8JcnaR!sl*S#M{
zgFC`*331QI*-|gW!790~)^uF(H`7T~6YkZ;I0sBFu9rYp!dar{Tw8%$u+Bkz*5EQa
zO*Fl+@TL6RRW30>hb5!Yvtz}rGqW-;(22P;*mi}RYoQ;}Ku`ZmRZ%+i(rTFP4ur>e
z_7>{z+S7**mC%6~Ynv4|cg4iylX8^YDGHE{yJa)QMoaWw!1H^Sc>o)15XJIW@PD-c
zm%57+e6!&^tZ>S*qRuU>-@s>MXe_NY#k~#ew?%?U_LtkIR{6c9&f|`*zq|9^qs^_y
zKYu9&448Bagh6SAeqEhH3jaV(K5R!}&u!N=r@#$ZVWZN;!%JwS{t<9R@SmT#;O+v`
z3R1d6F_lR-hS5Wm+GMKU32OjQqlbSjCsilq4%OklU=Nunh1Co)PZXOrR8HE0PEnw+
zX>!4AF`&nVyVmu(X2{frCa{j1w3LaPvLtpjZKusvB4hj0+fB&T_XNsIu1cGC?<gu_
z+0rbk#a}fcxw1=xm3()Sc>y}msC6#i`HHFK(<aiS6GT0Lw9jpczM#NzMc#=G>9+{E
z?Y$aEsJAC!(cj=G+&sK(2;cQN|7{GS+p39qrJCC8+Hc=p?4XA<1;RyCcw(71EmlSc
z3W#k<S>DI`V000fB|43wl{N@B`OT6+;4{Hhq%t=Dc-s~yOzZ}0IQUZ088wBPXc7!h
z6+sE-r78<&#!ba74L_Nc;*qCF{0e(a#bNn1Bjdq5d+?k5BIWUpwX0$Vu%QCB;;Bj)
zbM(hg7M*m1slw+0ij7Lp<;vUa`rp8W3rxtVjqXzH!HBM_wTvX10NlkoH_}H&+OA8u
zE5B?y1`-6|qXm=2sf|s7r(1}^te4M7o)MA@ddx}4;sgV4)jq`gEiYS*aZh+{=?|sx
zMOj{Vk7IY)Ne@ucqjS1FLNVDpQ*=!NoJx)y<;S`GqXmt}?_3yqnelf7-53A(o#>eA
zmcWID{eW2OaS6|&LVh^TL25{Jb&UE1Is1*hPjw<qMtt%LqfGOBBriBMrN-0xZrq>i
zEqjCOxv8ogm!xJ09{;K4O~e8rQQkA+r`%(!b9rxAnHFlj3erBO702Lr;A9x{x0P$g
zC9wNElf>TN+6LMAt!|XD>LU}K{E(M?Q54=;*er<x!m!gXOq6W%dSE+RV|TIYARa{=
zjdtBzcRYP?6X1OCr>!ulFmKBo@kyW0Ibqq@({&fU9H}8=+50`;AoZQ4h3QD0Jl6h7
zWpGw@7CkOigTrJDX!O&G*8*MD&Gt9tcblTZHWc^aVrM=wPOFfH9T~u9O>?ubuz*qA
zd>*>*-PlNXy509)Z6;+R>(g_5o`=RqLz?7t-{`=I;3h$HD9>~8+K;fL5#a_W=Hlj>
z-n?&Pzt9>b)MC6`c>pJ560`?k4(B4#++JX!hGASIzF(<!T^MFgS}(pgtX(=(0{K(`
zIzt??#b4TR#iV9*dYBd!?da5i$saOU9w@$4!xdD=yujmE3rs}GSgsY}*hVsEcQcaA
zCq8>!hZ@(rff}%u^CuXhp)v6{r}~oml=Lw&vE}5|wmDWu`+5zd$sIivImDbgf^NIs
z7wu)U=Lc*$wO@<NZRZ<g`DZJw)ix+^fttR%4g<s})VD?8^8t*+;7!NQm@|Sy#rJYg
z2nl^QQDPe1lvE4I<kpiDE(3@GAo6h%Mq<b6RexmHIhqeR2PR61;7Y6c&e<-nKS9}G
zge2VHa`p0=<2t&EpVO4xMch%w@qN#Dx$cLggyP{XBOPg3vy)$jll${C%|5XaUqDsi
zMlZ|G)*Vj0V_#n%z;urg1ZRKl{=zK__O+O2y9a+pjzNoY>$@+YI%dx46J-9Q6UbFF
z)9hTLgy%T{i!ozH9)vD+a@7F>=$Vm;&d)~g<L%{&E|5ZX250j!7K&uhdW~+~%l0j%
z)GJn!mjN~Cw*|2CWu3_j?3%v*sgpe~0`2<(CjdkSqSw3jO9v2#eQj>*j~!zkF0daX
zcbE{!-NN1=FxO^peVfb;_qe<awb^~S`vUn!jaUt+Y_+u)ll!*Tf?-H$#qORMo4?<h
zw&$$}$MC%6&26E@a|yLguIJ;nIcq!E8>#ZjbxlIN=y1Dva2>ucJXNNLl{1s0ki=zl
zs6<OEiGFl2-n3cjD=ssnrmkM^j@}*i^#d8={2XdVYSi%5!rWMt>BuXr^WCbqc7MNS
zkeDs^0MYH1*w_FK)ve7=58|gJCbRB$)C&0W1h(^;=Yp(TvsLEu>>B`-<T99;-zrrj
z%FCuRnd8A6l<tj>18R2CXDo#EFnBoCaw)7|_~-@n&gQD=eb<6Pc{noC5eiijIavlb
zlUkj0)-?8%`jpu0You$?8zEZZ&<XqHO8#;0jg^wLCWlX5%|Io~GRq-2fLshu2tz__
z-_n|O2YCd8=TJP6j**)B&1<<kvf&x^KVws)XqN+FmwpMvJ>(r#Pfri%aXT@f*t?(e
z$>1Ns3Gv~X(Mn~>7LQy&j7@Ls$Hnd#L=IP(O^eez6(bBJCg>AN6&HWk{B_ipivJ@x
z&`_QnOOv4{b+~=<>l35`V)jhKQhO=4uu<UbI3g-=a+3Ng(Omt`ssPV{o!v&>CdU&Y
z@`p*aW3c4QkF=%h{EBHxR_Bu)RE*84(zGx6oY%eim|UE&0=HruZ0udlCarYUyYf^?
zADV(qw%p9r<m4MrUHqyJFJyp-m?+-IYG&#~rTElO+q{g0_6bAKiLv5yM7@58PcZ@d
zGW12ZTbmi`Pkg{fa<|=Hkh2K?em{*)!2RT}4k9%E#@t1gtO0@(x%VeCHw@WDky!mE
zxn&Ea3AkX}yB77sp!`H$PR`zG6IbEn@M-Rd^d^3CFOmDvi3O7(x}8yWgRODfQB3Ot
zs<Kb3{?@H>vl0bgy`5NXl7_?KUEmSF@tX{oq|N4^;>o$oXV&GpO8wUFD<%d;uFXEH
zXT?Q=Q)cz~2t?R(j@_+hzo_o89F2yNDv5JLn6w;uY;rPp<Kh#vV(PPlXrXeO(Ze!u
z(tbW;_J4?b%djZBw(TE9R6szbqy<SyX&6Gfq`RfNyHP}tl<w~CE~TWqYv`f7^IhCt
z*Yn=ne|x_Ew|730Gv~~?*0GLb-+%jC$(HNI&9xQDVH7*PQ3QF|!@;2#-&5rRu!cAN
z?f1u`ij|EdV}+>*wTNQ9I<3;t+a~f~-FlG%!#@iGhl!L&kwAeXpp&hIsCGt0C2_l)
zT+HKDk9uigV$IH_QE4VOxwq9>oiDQ(eQZ;b>|JOqwr(gC|2_+jFn6~U1M&o%RVLCk
zjvJO)us>)DG3KAIp!2rZW{3KQ_rHZVWfJ;SD;GgluM$=?OgdTT&iiEN#ojSvKKU>D
zx5Oj^aAPh&X7_q|`MzW!=b=rB>-1B0BGvOYrcYb2svX1zCS)5BnSsiA@oM9;S>PF%
zS97@^{49GXJk7z91#u}3O&KKtl~kSW%FL0k#M4uvA>b1v(oSIvgo3XX!5V~mV@Aqf
zFNZ_U*rB!7bwDRyku4SaBaqu={iJi;Y;!^1pm(I{OSLAaT;h3C0R*Dr0Gwoh2sMFV
zWK+u2k9AiV1<z8hd*!+5GsmB@^}XYDl743AmLmiq1ZJ!i8F!(vJam`WIXE&G-g{qn
zxE;Ou;Uk2taozUVYhj0h6lT~(sV87U_r%wIq1hF^LxjJT-;gFr#O5YgV$vK?d3<LJ
zM%F+rurs@gPk>ipu#Z{|c|qH3K0s2BE?@tXv0%o|*^5&chL)tutE998NSh!-QM18#
zt+>r?lR9LN{o^^8MsXsq+uGy#(#_#AGv8U3Qlpk(CUQ_80MJ&T|BrZfcbcN^%&?V2
zwB4-sdqdIM7W}6;zTzOfyEd7R`%H(jn~KWPYR))4`L|WAi4yS#;<B;UF(RI~-Z6fD
zwv2ExTf`XP?K!BJGAsfz(*i5~u{z~*VA2|lOBUdJvbR!<x<5^SB3<$PE`0rG62vhb
z?$51A=+tm(z2i=wvggiL`1b(2>_PL-h69qoHIIq4j)D2|4e5JwU43H(Xl`?Lc64Y8
zJpvWwd|8<QX730s%J<_>Y_faxViIEWO|HjV{dhTpNllL1ox9ggR@!yN@{BLFb`@+(
zLBkm+I;iQ$Jy&-QZz)hKRtf<gTK28?`^%$y=Gn-w@Q{G@ow6bNG;{Gy3c`b!7um@P
zy_<m;s^xmBN9BnfkOxZZ(Ke+sMpvp6CYb?}*TpjgPNJDz?A80ZQz4+BY7Pn16zlK}
zP1*PBkUQ{wj6b=*;O`$`Z#-7(9yowh6Zo1c^EEnl1nFC2HK>ZRgouLRSdl)Bi(@7I
zM{La8u`qOs_-Ydq*jVOy>YZah!KRh8po;U3|8QRlAMXa^@`!G$ZWK3*_lS_MU{*(#
zi_76EDY)2h7i9Ny%7ENq%v`E{@89Krs?I)06d4w+B)5E`1RA;(6=hj57Vq!~Xa`ny
zHz&Rd=(+W{>=PTgFAoqvV(2GQS8<lKNt#Q0M|wX(y>|_Zb29L7v2Y3RIz|%FTS_ZS
zQ_UaoeaR*#-_Zl2x9Xdkp?Q&4ufo1~Tx&v{hG$ye19shU+p}yeJ&{BDxShFbpX%(h
zh?v2tSJa94?A$<J(zLd_El_e!#Bu$*J-0d4dlB|?aV=qjX14YUjB+i-#L3`kli0nk
z^0ouzv0Jze((44!wFnpfB0$4v13aW!mmPWsHJg4$hPPM8t*xw#rB3Id6FP9X^sSLX
zv`h@%Q&)fa5trWh7_#hEV2Eiy4VEAOEEAupi`v?6>=jqp7zd0)!^cNU=9=#$%$@?_
z;(PWPHYHi5kkHWkgJB5)$t3=<Nji;*v7yg*q{NT-Ol+tSU)kvJ=^&NJ$@nao#LH1?
zs+69c(*n^NocH}yP`CV=zJYXIqJvv+9S)BPO^(U0!b>|Ct!m}x>2OC)NK%9Im;UK2
z0TEZP?aP7EWMasT1`aqfpuc>{Zg)2~^x@s4<;;-NfwwAhGisCtwAM!7UcuVf-<QK^
zk%<XizQx-+C@2VU`FS;}gL3GTSu93%Pp_&Vj{8VA_<~d@eOo;j$O?S1oUV_BP#p2+
zl9Iy~nuQVw2^u;n$P<CAMav4>f{yh%`*S-GF1#7oNFWM8LY53}=4L9knoI^c@fb(!
z_D7;1{A)~6VcMS7p?`BF=Q$#hX0t<7Pu=w@4<tXSGIK1h7skeJ1r#af<AuH%v^hon
z-g_P<e1oC;R=oAf3JT*ZOYf<ptH1KUsjI64(T)HV(@U?i<S1Kj(EaX}-SN?sAL7R5
zhAeTV5J(<)@%hDH!d$M;)Ccyd-}D<Rz&REeO+P+7((HK{;9q(GW=$o~`ooD8O<lS0
z_<*e*vfg+W6Y*(ACZ^rQczpwd{$y6Yx!e!tvRQu?Q$vAe_s?LWqu2I;%lD+*jc>zx
ze?r%Tp4goKzC|1*A8k)6V0&?L0&P0qVDgW+2YaR@KK^w2dkt2~3%gl5g0(fwxny?&
z=JxH;92`3%-*3K*WYWBeoHj?fX>B;U?d8D*yv}ZAde#gw1;qcR8&+XG#&>x3-?n<J
z2m0W{1IVEf{#OyQ-`SFl^uN7;|J{ZEpi>6!Sw^_EZ;5rifB)V`3uU+D^w;>9|4={r
za|-hNfwYX2iyZ6kPXIh$(C>f5w!rNF`2RkW|9QUu&%b>5*SZ8JlOC%xVtZ`DFD~l+
z$Qw5c>nXeY*PBLo_m$V^AQ0n0+MA0hC?trvhSB#TIQV1>5Eok1O)Z<PY+ZF7wM?a&
zf5HLQe1i5{TAH^MBr4iUa&j-(zCSXBOYWP&M5w)A{y>iwTGkvE{x!We_ss*Trix!!
z$?%hVp;Ib75xq9@wc!i6UsiITYDCdTdD^q`dqsQvktC3jkB@CQkFYVYvQ}3~4b}uR
zGgT=?<GREc;SQW0*pC60q5%@@(=0mRFQ!JjUTm3w5LbzIcDO~St{!@K+_0bW3g-Fw
zlyoXKDUm00jncz5B#n*z<7<LXh9cn?_Z8iq;+&!!!B*CU?7_22b<7wNmX!^I!r-35
zEyi$%h`xONx^h^qfTo_0^xG4QsxfecO9A0{a0l20+>b(}AMu=?zIfnA<n9KYqVOVI
z0D53cC*%WdN$!-4SaJ;P83&b5Sh>5SY?zarE9Ug~Alx(~Q)a7fl6BZ^PdVJLeDGIl
z+n<0Cr3YVtDFhQC3oMM_pJQjPueXFsv&hR98V389$K_Lc`b&xpQh$b9EKzWKjITPa
z`bH6K>Zx=uvC&HmGBV+Rc@5HYXi6yv?ieK_P!p3<zI*=(St%*l4<>@bf7e$ICj)*B
z{1fmPkNlZLPy4?0hE$D|n7U+(tF@IMG)Z?kQcEP|{d{|401&~>NT@?FG=;OfOwo?o
zZ8i+ObH3KD;HvlWFEpK(pa1h`a@7NH$T=X&+G5GK&L<PM88v$#9prs?H>&Y;V}_4~
zlGNVs?HVFC=Wg);C)?89g|RRFRPWy7hyVN(s60Hhyq*LBMmhbQ!DL<v5}HQiy~puj
z-QS+bQPv%q3=>b`a^o*)Z*Nb7e|B%J3YUvox%i)d>s?RAK@sW~Bf>BGGa)@Kv(ys|
zK{@IYO6E6L)|s%A-CRPq#;VKm4vPaP_gYT%E5wkHKX7s7)hV(Rb`1=0R=SnUj$*@K
zofwEOV~BNkGnZ}u;t8;Pv#||yA?v`LZLXo$-+5YAX2Yw21(y&1FS=1L0B2#}ui@e~
z9<LqD(@Fb&J$n7*a7`rTw}raBeJR0sT~bxr??AMaDRZtw9md%7<>mK1mgZ)&jV5+3
z9G7M9L`MIBo;(rnfKQ56UHym~FyR!^&;ULBpU~w#T1rZ1*ydrI!J|~pm;b&{A#s(r
zEv1wtrGH<j%Ta8x<PJTzM|bvt`y|Smnc%ycRBx=vd|P8V6S2(_bUAH`<>eKSs>SQ~
zWV8}w(j-v6d)F(KnU$l|L<0{u?(@$IH%9Bu#YN)oj#CHyj*N+pRn5x$5*riH{}saU
z`+^2}+>bgZ?~7+=o$kJbp!7|d<G5Us+_<|d@@$i`-kHTjY{b5C<d+iu?&l|>rS&Cy
zl&P8L8yN@3k0cpcr94;Fr*Qet{=I5;%$b7e@=Ucvx2?_0Da_Y%Z8>@k_L-sb*Y+UQ
zDWzh2aR!~v!UC_#(zx3&P`rOA{B=>iKIot>X*UnGcND}-V|aLYxH_4eOYcuwE{IC5
zFi(S>8ovqXp>XhUZXZ4wA@xTXQ3Xy`wHhrdoI-*s7em?H^mCenTHGx<OQy1~!eVQu
zaH!Y&6WB)^o2iadVoN{AX9VARTYAK{j1-ADNozWCR2^Gis)|vG{h?1pe2yqCCTX%i
zM&9z4my^|SDUyTP3>MaO_ydvJkoLiAbH|81pxrglgM^Ao$19<%tSqQdsl2cC0&WZi
zWtEiviLgnRxEK;5>h@5)Ru)V=;0K{5b3q?T-gKSKCXVEZVgVfoHFa;^ZOzDc6x_n>
zR#pA6(j_)a=!@q_mE|>S14(Rl)nC6Zqs1V2Z{-Sv{s2)TX^RNw?|6xfW?fudKy(Uq
zU(5ByqjycNwD|EKWCna6((SHKc1Pq@`NRZ-cF!WNL8LB_j{MRNO2=ay84-AjR!q}&
zx;;rH?VyXlk}cKO-w!E2|G3%C1k=Q#)!w?@^8w9IW9O;VR{}MKP<_4m(wpVGFOLZ7
zojBZX6y8yrt;aZQ&sNC$No9OTHM&!mH|iJd6{W90SJ@-nKO^Ef7-);IlqZ_0uu3=%
zLA96-#`%r&!DgWKQg(P4D7FmX?x2ECF2>u1zM_ZIjz#9ziCXKH*Vj_gsyI}~$!EK`
zJKtYyMgaS>-wDxBj*%5>Q*+v|ue?zW=e{#QG{nZneo4NIeU&j&ZK|2{aF=Y!c>BcS
z#6^mg)l_FGUnZ(fPZJVB<-L8r1hkX4<84lw&1WK9mw74Q96g5n1*L;f7X)lP-JGjC
zZuYp2g$gRG$6QKNQd1)%K4<ib$SP0*0-F-`IyE`|){)lMwN@8CKAoqF`zxvBPSm8G
z^kCwjj&G%yVag!X@#&+6t`;93by9vh@gFoo!+d>1U03J9JFglVxEq;yB<o10`^$`X
zbQDrM>|K9)|40Uf1gcgWNGdr_{ALo_1bDU<k4s^3w9tTB>*I1S8Sh;G+`P2IMXg%|
ziDHV}pMLboeYlX*F$3&DX`=XP4%B`1vnwh_@~w%C2B7GpGRZqVMY(p^%_>gsjASO}
zu)gxosZmx^icXG}DhZk2#(Ps9_{7goqrr)ZohuRxjE{lJPOt5$(oP{Fa`x%|1jSqS
zu9XZU!#V^I2<u2ROY{<-@)!Nb?dd|B2!{q%JGXd!*lJ?4?EvH#1ugeHKu<Pny5_y7
zs;FSBs5rytUBug<pm+zH$}RhuDs#y#3^CgOApj)(%-o+xtY-pHkd=4Y8!3pX%33X{
zqIN4|FH~a8umzgGk>_L^=jJBhC7f-J`GD%^Lht=f+!6hef?sv^gqM=?bb|->aSY-W
zex>u?S5{i}GNN;H;NiRz=XY<ksEkVX5VJ-LWR_LLz%IO)rZlN@X&$y|jZ~GF{fX`K
z=J8F_!MQ3(2KsU6BQh-Lhh+hij%TsiP|41e{1Z=rm#&-s%zk?`-vqhld{3bOMi-tK
z-e?Hx1imD(wocX>E4A#8`EB&ml}C0efHE@yW=+dWOG`ZWn^_IizE7_l_r!=pS1TiF
zpE(-B^eZY}hlf+X87>oQu<;Q-V&DSuX{j5dOap$KI6z@VLW<P3PCCvWqF(}Ihc|O(
zAC;ues(qlEissWTE90}1{k!op804(PmPN;%zz*U#@qJ#MzvbKM=2(TuHC@`PC2UJg
zsunw7NOg7C5w<}QXmYKz>wJO#TcJ20sd|4^C&0$ua{S9<0Rr{v>sd=~a5ZlNh7K6G
z<uhVRw9AOVF2J@wHPNUEkbG*z)1`E56gBqieSLl7+mntv(_moL7F1Uu(8}K%8T~W%
zv$2lrQQzjskEW+*3G5z7lFVkarU}PVmREpABqH_3$iQkAaERVfgj7H+btb!9pq7@&
z6G<~{rDiG@gYb-b`tKx|>L>X}L04=P)@M4GF6OtVsZ^vL5pivycnc4Ig+?HVj7q?C
z1o8=PZZPL4+-^=j(29})@KX30oQ3%%3r*3@Ou6x7@ZXwah9ZMJq`~1F75>1;|M0kK
zRF?7QD?7A6B*{-ycb=B7+P;xyHX?@>Q_wC*sf#Iihd%OdQPH&eEld1C_QQ&6Vp@=5
zltOKjnk9FAL|jyr;exHI$$(FMW;>Z95%0?*vQHucfm9~U!(FYe3impgSkC90@Pvd5
zS);JP=Yc~aB6x0lG(1{7Na&@bNVZ1_=ewzl!6@udOFbP)ddKK5A$Mb06&{b>6Q(#z
zsXzw|nS5}a%7tHX6QRkSceuSrHSknit&@|vQoYf{z*^;bL!?z|i<9^M>e33H`s~o3
ztE*FT+W5=G%N41j8LyLL)EAeHt^;xek{0m>Mg|qSvugK)Uks{+G(H8L{mAwAkNhTh
zNylrTP&TT&tP6;BRrclsU?UoHgq-hjI&QU3y~+p*4gvvHU=~?)GDlTm<ax8o;<)+-
zlWa}kPiRmw!`{rLM0z@uaP%!b1+>v*boPAj#TKu(BqB1}`OU$COYa$@_Q}Mk-rSg2
zQKDL*cHMeJ=y`oV-jj<<lRWY>)V=+MGMC3+A7|*LUtS{2Ei{(_t2Y(+DuB_XTYUnC
z4j#+MprD<^%?id5CP#uPJZz#Cy-}r}h{!}P=T(LbS7Ec5qMp8<DYwsFqR!5nBD|$1
zrzfCQ$Zp*}1VmY&!=GJPsL^4WXKu0ibnqfC0{DM57~GNzgFdM^$G)}v_A5nja+JLM
z^_Ffcefn!&3UcJbLqx;_d3}bGREC;V870Beh~o0hw_B2MEFTH31hR<o9z`?<w-`W&
zEJsSq#<g#J2LHIaJ~bCgip8@d^p*Sq&-#n6zH(D#y8MA;Y=1hvA&g^A>Z_=o!jzO4
zFUN!D%K&hMa-*ZQRA8!gd~<xWJAy1H$}gy*QlikJjU-?Vk58DgFnWuH*IQzPu4<x+
zv<zH^873{MaB4q;ElXdVZbhM4-$cH5jE{=z0JVnR%F5I8of4HJQNVfg#$BBbgt=x5
zk9Uj7`n>xSDxJdYaIr{yGMpC|5u3ZQPB1%F2e#K_F1K>C?GWJN9}+Q>p!QShAJA@Q
zw_kLc2fdyRW`~KOjg2>$m{MJfox2I)ufs8LDUUT9&UQaAGN+GhkfZ^lH<bw$<a~D%
znp08~yn9892fFebjEje(6o%y4>FK)CDcpMS_{Doxz)#&C$-D;QO`7em64Oawaj1;t
zj3-$uBEfl93iqqi@{R89K%tF^vD%Ky>98?Y>k@H<SCCfBM;|{lF;ZSpR^&RUP+k3@
z>_c2!oF>G<a;xhyfG8UNKwT6O(SA&JfSRT!OPTMLFZZ_#7vBr#VG0D`vu}`=4GRmu
z%j;lbWYTNn7xxntHB=&ZQj-#{E;rch5mqf*Uh;1j><}*@Zo<aKEF*#!;DLI&vjO<`
z2dcc%+|qbt@*Hx&mW&yoBBQ&spe|?JTsAz2l+9x5is2H;zWExy{JO6sPd6uc3t$FI
z?|kuMj0$6oOpQmHJd6Z1;lcSURY;w=>)&3$_fiHc2Dh1@5vtG>Zf@twuQqJ%x3{As
zqvm*?ZixX=zGO~Um%Z3vDl{kK8y-#~gbp%Vdof0O^2mgkE$8Y!xU$1|56#%D?DvNF
zJ}x#KJ_bA|svSnNE&Dy%mkq+z7#03O0pM~0L*>!M!9r*K(kN`Ou&9u#%l2|+{IUWD
zs2QZ><PYIs%AErf(ZQB4Ss!wDl)6`LufIntncMpeNxrg^XIjTrD63Y(jR&njKy4%B
z`h2izvm(J}_~>Hv303;<Kh$4X1>jiZHN67FPsRKtL?y&eH-@V0(*x3N9ilN`y`myO
zq6)rFam7h#<5x1*G&7sFwjR9uUVjSAfjxp`@6~1GG|Ky&vW&9ra>&}-g}w=82ghIB
zlDr0{rX|GnNw6jv-|iM!?9$*hogZ?#owkCV%&BBrZK*UHEKy#>Vq)Elw8%Z7NxuU^
zLvx%=aBwUG3U_J}NFMmpt_+n7v`zl?`KEFFfZR4yZE1HrV1Z=qeC_-U!Aq-5Up0<v
z(<JYt+2mTuHA*U{gn{XUqP(of^<GhNb@i<Jc^*2&=qa2*hJ&Nmbu>Q(5V08pm|Xt7
z`Z*)5yxb@|_G_ENLsMu;6j(+!tFw3u0;<NxhS(i8roiFCX?ND`Zsam#cP5mGMM|}<
z9_{D}oHr-3NB8^A!9UYXz-~Pk30UgVnkn1H#`1+<F2$bCxY9$Lf$JFkb)hBmMMer+
zlQceSG>U#ZS!aw@yDYIJ%PENYT|9WHDM`TE(L0#{nH(Fs==7QW`uOqpwPf#t;(TG`
z@8A4v-SXUz&UHNd(VTDrE-ot1*Z*f%&+azB;uPR808V5spT0hOu&}(m958H6VFbK$
zPoO4yM?u{iV)vU2z_}o!bOey(7JK5G-WZ_1+B7zqWi?kI_sNXJXbQ#UoXb-^9@&hH
zTi7+<<>G0a92?6lF*7!hyhi}AA1?Q!3!lknZV(6$Pjk3pl#Q`Dug-~+hqKA6?940>
zB<!>l6j?deV_BmhGHymqN5=yYQw#HM3ypSWD`yt3WQYA6_a9g(`QP9~IySsK$Xq&%
zO0;v|=N%j$PfoJ!jO8~0?cR-p#0;xhR$k|(#@5<(p4&B@E(xzC>vV-)jS~?!u%e9i
z42y}1Zb;~VD^h&7w@83FqBNQ5|J0YGZ#yB|D3gfOuJ9AnSPye`b(7=%dh*IMzZ2Y#
z$o0)`$7EZ`PQ`IyKftnz3j^C`b>@Z-T+2rl!P?|%I*ZSGW(lLp1H0TV#xkLvz;pm~
zhQ1=6I-Zi4klod+3P!n+NEHo@Pam*_I1mgF=Hec~dGm@YE1%b_UaA6X2F7#e-90U6
zE>FVI6~M4+BnYE8?ah->QmWKL#eH#Sr%ZCqfHCW#n$hHRe4oMx5IILr5S|UDaM#>u
zK=5WA5?D8kO<AmF5>bpQ&DT!`R+4H$2V-AptN#ESCa2fs*RZrOd$E%=W^V3z$oYO*
zhBE`%ycPF?o0_`XhkK=Qv)<R3n7i{C%KW;^)5x$m-oew|ZHV+9NP9rrX39PJd7zj8
zvc>(I1wL(!8+rcbgh^H_u}ZBaw<{Cx!$I4OLM^n)i$B%(Rv}v^TY-fuJ0#J1tGqX#
zLt^vuZS**`#q|0(yxR%O(6G^6P){`~+(Y9bckH0q2Q7)adcp-=v9X3mlY*GM*?l6t
zi2_v)!+ZHL#s$ETufqx^BGO4a$fBjR7j18svt}p3hgLt!Aby5Jp~>I(hYLF1H8@5v
zC8m8e=tRZsR&Lr)m&o;%hwbrHd(HA00c#q_Oiw1LPpWfGhB$R@bW_kJr`@+$ao0=m
z;Ri6r;^H!q4ce(P8|)n-=Ts9~XIq&YTaNb)*!12d_0i|*<_ud9S$RP>YI{NLRT*CS
zrNtKeIj~s!0oYZEcFRJY9ju3ONF$7wVa^BaZj&KN0A!g_oKH?kxp=kS4{&F7c6s5@
zGR^Cy6=5_2_E>_|R$hi*?NgaLbyJUSMZ`GhHJV?(!5A}9?+{2BOk}j!m<kgR4&Io_
zi-^xx1N7w%dh!qg=?Z*vJPLBMg+?d0?nWW=b;FQ;EIMueACA@9*E270*f-9aAWctC
z2*$iVbHhuaoPpX~PdF$t@+baO&OKl|Vil=O6v@NrUukR5X?;#;xC`i+U?pMv+A}#h
zDlaF~*V9vPd#fh@%x??(diWfD9)cJeAfqTp$nx3wbk;Aqah0+5+*^2Ei34y<L#_`x
zB9yH(^_F$BvNEZ*h8OZsj+K#aU!U!q_L7alMx}cDd(D=H8e3r(clGPR3Hg-y3}AiE
zs(-z>F;k7+)RR+VIr3F&r?NbK#02(kPIdiMvW6b2!dVgdZFLTjDW5Kr5!AwKL^I`X
z{naBxLf?EPN`74sXKZ%ds<^_1<zr`-@^79tx}FPfmeGQcJ-;(TQTlBBdQ?hoRBDc@
zim$&%y2^2oCA<<Db-A2ej}C0Ij1;R!J-1%5f|aDD*lAx2HmE&SW2J3vZGBl+UtbUG
zU|b!2`!)7U>HU!EqM1@wdfu8U`Q8Y>5c~bvz$77^z@lw7i@EBxq2ab`RDz+=aj;re
zQcd1|8_)CbYkGFBuCB6ax~&lVd!%*w;;v0%vM{#7_)B78;+JGC_~WNLG-PBQu2)Z&
zv|AH6JUy;{WHfo0s=d$J2C@e#d!psBFug!!8udEMs@T{!YdKMA>KM$uAGPnh7J&Tv
zJSdLq_gs6S(>WpNBLdl~fhV7V88s>C>I&?9V-sCX-9vM}IEgd#4QFG#LAF8WKCgrR
z$8(<bPD6TV?H*U9QUA@_xGDn^H4_{CWTuu!eU?JKhb0(bZyOeEFw&5*7~FRY*heYe
zb`soYeajT&z)=mbWJsL&@YN!|O8+hh_$=PQdADFbusr0c&F5M?HX~hLL{``zZ-Ffc
zoWdW_$W<Lj1lxw8aXoPE`+F6BL`}Q{xV*u)wfZYPKyDr7A~y>uIiK8z21y5%<S3U2
z1hPKmylUpVa|<Q-ToN!IsTeb;rl7M#L7&t;NdIQxyn*5(dJkT%SzjD<HR{~2)joF_
zX=xGa`CPSKz0gfqTktx&SQxzqeJTu5aS4fvifV&~+*+4<Ue`lXR^s9>Vm=E54HfWl
zWI37mHXMX+u2i*z2fz;5?^lxrv6=I<Kc8t*-&wR#5S54gQJkIJS8u84+lr#+;C^?z
zTvTwE0uR6xxl^9=*VaCe{YEZnZSESAVchEABA{Ua?Yo(B^IMwtrBIporMbBqSGTi!
z`_Of4j48HCkgp~nvjGE17fH%iSwiW$8743gxl!XQz@+AWys!(f+7<~lsEB9{hl@%w
zT}GM~^OhD6lRUFK>us>pp-DRw`>q$Mx?lCw8ClY6LYq{#8>tvba~(#p9$Z=<EwEEw
zQczF~-sZlgAi5$ew0|04fY0Mrsn>gkhgFhRf0Era>(j=+y^U9#*bupHsa;l9z9DR5
zV<RJ48uHzd460$%9Z5$;JYDRPP}DmyNXVPS4`;d0(XX}O1|-FH7BYjLCrzDKr@Vf?
z*2o+V-B|*?)xAbEnI&^B&S=-;10v`CKLUyqT6CSE#J`t_4Vvpc0;@r)OZHITZ^?#d
zXB*1X;6h#wL_F)x%d?~Co2z$!h{VoHC{~G61v(rMmGYUl+2wv>U?$t%Z@J*yvibZF
zciL+zGHj*khDWR3LsD7-XbNKZ-@KrBd!(hQm_)$R0<v{khuVkOxta8~za*WWY!}5h
zjP-TtA2$<V=v*#MJc3godW>K7Gd^Hu_s{uRGJEa$>hGYwphE%S`_g9*Ng^L<Wn^S1
zX-;<29Dv^>&jiYSvlh2)C!&5WjHRRyXSF#sSF7d0Hpn(kHN7^2Kqa<m7)(IjE2G+d
zB3rXM%mBiEKsp-Y4@BnOt33yKh#%lefO;Qjxa#12xm-^B2J&BJNr;I#S<WxnsaTu3
zswtS;JL|XqT!7Ca&C1OMc@h9>t<!x}Zj15y2<0T}&9}4j6{tK-Mwo9^f*(W@wgz)?
z^)lAIo)@JA(K{Ps<xL^kSO`jqxNN5v8{NIVX1P`$vxeu;cv3hkjqwgRN>fw49}AF>
zv~ImOwc>*Ii1$`n%*gR;q=U~IF(2{%#};V00~{R93r02MC>(@`kyvWTOLWYP2FP5f
zD#!FrDF*NZQPr!t&V>dX9pT`_@zR`a%_pR3x2}JRmF<Y#h>F6;BXU|BsPY~f%p(hZ
zwpTdzWr1o(H}$w^B?wH}AYtM0R|CDr!@W6ksvr#81ZOjnPf+EXBuK+D^3?JrgG{qU
zg@t=w+#FseD9<vR4OgocjNnbpHE(jl`UPB34sK5PB!v_eH)p5PJ32ZlmE1!1@2e5X
zG);m~w!985H)5l4(TU6~EDu-5<-umWNS{W2%C6U)m6-*c<stDbUm6r#U0nlIwo0t#
z?}h9&`pQuX024ychB=##10;M^d#pR#zy8+p>hD}iMuM`d2Y}ygd4)R!XH{n-2i{T<
z$0dfh-^Rv9W~QI`7=6{Kb?Ip9wOg;vYiv}k@+dA{1@hqj>*^Y7<B1AAC%}-LzZZOx
zNlF$W7hV@P$~ZcWXhPLpYynQ8^J(_oVIO31$n;Xn+dAd-zg)UtM)yT>)rD&P)=8^O
z7Pk$EHbkkdpiC#GcqcL(tZX%pkLSTw`M!gXw4IFn1)g4Nkuv9eWAkQ5g7O>}G#&@{
z`0$8@f%W+48sin_ba|%c_sVYy9v%WS5iK6ucS&U1N~KB0`uh5n<5e@9Rn=9dDz_bL
z2CJNvmdeQKcp&)z1eF2LGy@z9(chW%M_L`TaY|w!^CL;5a?vt3b<NL9v)Ozxu^w$n
zw2&RioPF^cbLpOAs7!XHNBp5CcR%|EdP+A`6;xcZr^?DIwpyN^wx;6m0>6V#@~aQB
zk5YW5`mj3J!3tO&b$Py^1^6%Kt{G2JQW`y_0s;Azk;CF6Fuw-!I^V@+162U9ZS>qU
zB1xbkBKOm}kQXObGLKs!NSyBJuvAyOte?Gq%RbauZr<OLR=1Xwpge6`i}1dyTYhI9
zTof#_FX2zg*P9=Cz8VfA|DGr-Rn$lGwM}43R#dzipig=4Ys}|cSSz8a5+Vb|+Lb+X
z?e@oeMU_0`+Dag%r8S3nf?Z?)f3UyX5Y80g@37BX4YXRENBnL41_?t0g0ZmCiP)SK
zHoq|aC^E<>+}VN8LG^P-l$V!{V>IQD<DtnSBPDBg-4;g&e)J{sz1h-;(3leU^&WA;
zp{9L6uK}%$%q)F^JH+fMwduz5!}v0DI!VxuW@WC?9mQiU?HTCi^jfj~Y%N1b9n|`7
zFTj(JXN_pVi2)65u$0FqDRigF{W?CgR&W-}VvoBH*bc!33k^`IakJCWA@&fW7NI!P
zq0Zu9E^lx?MnWL(*%2Pe5U9BxB(#KVd|Dy}cqX1Cw{qz(A4b^RPtU4cJeacer^0lz
zRfNRiG&O|PTzhhVfZ-Ld-L&sx5?oW<ia(MW48Or$RFZ0uQ~N2wuqY&n8;1ZdBd<8@
zzXQlHTCGb>+z(b?iLW~LfD8^54c(i?1$grQ1kcM{<g7^TRlr1P{_;q|a3H6yhG=2d
zYk6pZMSV<h+}H{&k-`1+#=v!^-rNM-Cm{YSk<oQzX;eghbi~nWN~@W<M;Muq-Q@z{
zlrREpE32H2t+m-bisQ?-fEa_eudktMyDxgeXzbUi!~{6`0OBa1xNLT8$GBV~fGC9R
z`K)L3XjY#OV1aD(*B6&^_yI_p6KUK36LTlsOE^`Y@KqAr7z_1YF%vx#^}}F&1~;E^
zw6r($4&4tFw)V`GQ5YC+yjv7^T|Vs;qd)6J!|&ex4N8BwDn((#&V^AwiWh_rN(^<0
ziK5c-(#)ZcfPvQWmJV89@3bNX4!c5TF#shYQ*sABrRryUu^%i05({_wvW}(pcxWi!
zipKd#6F_V(R1`5WExj{tNOaS6B_>MPo6ac_WTGw9B*OwhKpo(Q@8E5;c*52*Ak8S+
z{Au4*C1A5EYUkSveqZ@8qYZUTJx_MT2Br5O<eN*Gfo#R#X6<sBpLqWm--s^7>w0M(
z1dRbXffM1Jp3cnY&x6f&$~2~*btj4hj2=Du-L)ZVfkGS5gM!byb1=cpNM;cU;>6Ti
z?0Ny?jOxyIYosoBql*PunUsPeIEAgqs%D`mo*C@|zxMb55F_<~_QWd(q=X8INfDFt
zM1$dg_Y55;kCLob*dw?LmOlf@J3NI}p-Z<~Ee`5UpE-osngxZN|4p3=X+@eqq0xjk
zPsk`L%gZ`=^t#Z5)U;UH*o0O2lGXe~!XBO+UW37qFYpClJ!$!PZ@CL`b3aJ!(^}9%
z36ktB6b2_GgU=awn9-e)T+fWGOMvSW=#0Q|^KvPB-s33MDTff8vg1v0chxE#9bg#g
zxv4K-;$vXEruj9fy<W#r2uufTPR1ict!lz*+0rqD7$IU}k~SW&;^K7iVH`vo#O<d_
zj=W5Ah`+oF&+Gv+oB0g&V0?1qp(l~5bd9lSc6R#<5D@QMhdh1itG3+%`V6~7`+bj{
zs}?D_op1mFqYWurXpzG^SEq8Tv({aMip~(QwcFbogH3an$Hq7C;NTz@FTn$>?<tX=
zb&buTLyiE6gRyh*5V&N55ZXFEF;<*jnZBGpR;gh5SsBD~<q6t+fF(unvKTZS8(MPC
zj_S|Eia8PSvRfZ95E0#{CVNo*lr=p3zj;!UVqy|mZ$vg@%QL?z7%I_jK7p%}-bJ*2
zvpF6Z5bOyQEfNpf7|`jLJJ;rUh4GSM>>)A2(+|WaLOtwLOz!}1r(3-D`Sa(A5bN?!
z$sna$THEo5guk7GSCivm&q&34_4d}Wo2UkL8ROC-MS-5rYS4?|oCd2@Xdxn|{oW!^
zYEAh_CTZ5|@Yl@aEV1FK@N7vjF>Ji_p-EB_()5%xi=;;fa(6EBhPaz}(RAMc)K8$G
z`lSALV_{}DA%ufSKLtgh&;8aB$7J&n@Ne$TWt_<I+<ESMG}aOUg7?GSTI3oa4n#hn
zu$d%WKzebjarJ5gyeOH`;rpGF`|CBg$>XDAP)vb$&lBB~=k9mYGvHNz&&?ztFDW1-
zdwH;_2Y`p4x+CmIBnTZJ0^4+StM@N-Fv&1k48}(Sm8<=u;?`h8pYI2?Q}{+pznn(R
zvQ;uy<{Nv-3Ynnbsm!}u$4G+IW=6J_^u`+itJ^u&25Ul(q*G}b#O2QXiZ^uLfC7*M
z0wiXf!SZ!HY<PT(2vVAY+UO}4Q?l^)xazTA6DqmpeaBKt5%_xR!;bbj`{m%alhwoP
zvv3O#2XB;T3cQwE{U7r7@%Te|aL;}GB&Z;!H9R)-#)1uQv8KXG-|hIW2puLR{f5VI
zVN8{6ADYbU<!Wyp1VTXP#F(b<2&6)!wjIs!*($#-1ygGX0^*RI20xer1sltJ)7>wF
z2g%WQOFarIGv0(AF%}x*c7k4y9(}Rg<+Qu*vNwYobgZ+y%L$J7`O~`6K}K0oZ}i#O
zj@QaUf0X*fQ{N}ZNY6pcP-T&Pfe3vvomxZUdccnWNgQrj717vikgQ(6vRG_!?Z{p-
zD}GH3fgDfOMKs@eVn|y4S9TD=f3kx<J&KQ(RBNZ`WC9(8nPUu0@OFYlratw-f+nx<
z297dI$w3xegTG%!{6`N0x|)YWf9bm58>U?UXnGz-A!z^gBmXF1{{R1S$bIOqK|W+9
zdY!u$@7+OgPhU%iCYzO43Kg>9KT)u7UfiD9dsOe~IGxtg|Kyy5RzVa-6pbY9_fx#~
zn;L~kMUcw<`-T^!JT%#Q?HZeDtA4*<ssHDt-$1Hz5dH-8n}OY{Ai@q>CIGC_cn{Uc
z?zIRCzF}&?pBotHv?t;xFx{g88!lLNi%Ht<ZRY=8I=H(e5T4w2ymAemk-f=eofB*i
zm^Y#f0z-mbZkD^xSP~R5qBb)g>?Yj2yk5{BZ9u0<)zw>LGLi4m%Nn_1yXFoKJX0|T
zgF3{nYMgq0K{H-AGBPR*lA*ZF{37zbvryR0xCF4bB@^*>b$12f@pOV-M0RG(pF9aV
zkd+9S)Z7sJikh;Fb{+Xn8UT{sKNN^eQL^1H^8uNn-Sm{~E_apJ*G|(M9Km=qL4?d-
z{rvv)!bU;CwSvA})KB~D94GZHg>)bqK5wDZWOB_Ow7YlE%2<b6XUbS>!Rjy%z^3)+
zatOKH1eXxi3xu<rdVRNJGIaF-<BMRdAf={df5rmO_V}nCZF@FDZxSpIfc)SIqIW?a
zjKHnyyQeS4<t8(Obti+>MSZEe|G9KGET-dc@D<QnoL7!AFGsZ-ZL*NOd|kL27w|T=
zDu#nc&QiD%f5w(tjCa}y2y54Q+=BQn^Q*wg63W6-hqdoJb8`r0(T?V$3og4#JX+0W
zPFAHjJQwa`ljG0^8zWdX!KArnN^+Rg4>`H;mG2>(O)%q_YJ$*2?tzCvd*kK7!p@J;
z=zg`XTP-#;rxdsrOuHETh3Xo~if9aWf1n9zv9km5piWj(Qp3>*1u?5@Fxi2`#JQhC
zFMBvF`bd?XCP8AAM9F;<1sc@3wnVkm{cdb}DeRTGF2CIJIya=gdb`nPGrrXS02I7&
zcnPTcykpH_yK5PA51lj9o_vM%FoNrG#c?`lquP=bbxZieUIHG!pqW^xj6Hed`wOg2
z<LN^OLq~R_j3c0N*h?zMyt-Kc1E++Tm?)+(wvC0fUZzRdPT^B>LoD)jjF%>sKs+On
zV<Vv6Gdh!JpsP!gz$eF_?sh$JvH)yR4w$Flq!F1*S&|DdsNiU9Hts)>1KiV8I5(}`
zX^8#rZ^w_y%YStLAoAcD(Ewf|ahIjDo}NNJboFOch~0cmSJ+tCF4vc(ac+)VQXOis
z@#=Bvon-AXbbrQg9coaMSjJf@$5<fMroH6N_D)rd6{TgSqT6$M4xlW9MnQ=|WdWFb
zB&{S^<S4o;D{%pl+G2lSws(to5}v+-oCXOuche_bVMAfyCJb+#9P$bO$`6`o5Zd?e
zJEef!TFl=o2@B)pdz$z9IRH#iw?_G%l9VE6NYL82t2@x>_VI0nU3pwM98v<GfMQdh
zGTtWMKpgYRO;s;Ioxa!^AM8$3wG}UKOneLh{SpybB_4qN>H#G8QuNl=)=S^Ztlo#6
zpYkcBKX?(acX*uK#OTj56zaNAT~60eqZ%d!_yv%WkYAj>h<$ka5Asm(ShSKuhR0VJ
zB$}}*6?oTx<R<rKV~fC!BP=$O6byzWG0-uAlHFh0Us+KpEffgWY#FtE5O{ZjK{G%c
z<OVi?G_x!kQl<(<Wpgbi&#BnF3<{Yt;N6887F$PAx|ce4a)HG!3r`7P+M=Q(1N;M)
z2ZANUf5u$bGd4z*pwLDo#<xo4WM`G5gAvL<tiMl&mgfY}kN0gxA^l0r^6~=5w|~&U
zaHpv7hLO4(<zWi=@VG%SRm8@8<aq}Ijv*!UTgIcc<u)W+n>e|7`SkOpBNV^rc~eH8
zlW;Tn#KcUF6#fpruG!E7%yU4%O@J`#<Wo>Xwoe<_K6QV_2Vla&J{ntaWIZ}A!c_ra
zy#<e>(yfkn=_CNt`$nqb6`76f2Tz{n?<j>(7ngEwnFZ%YOw8ALIc5iK<A5#Uc5)-8
zqoX5hGrTKuKHV-HjiTLbbBm7)5*ul=oPd!6+*3DSfg)AHUtU>}ZD=%S)2Jjx*^BI-
zxH#_?v0anjIwpo63=bX>Nr=`p813$cnf`!ez|J%L&7u6=4Ze4sD1<JXXH_5{?+{qp
zOy|?;Jmj-oD_N?N8(ph^y9Cw;Y<)GUAZzDn5_NUhYj$tT&x~A+mQ1j7YgV9Sd1tZL
z;|pYMfb!gSg%%who;`W7q~}Pmunn33qEPGUM4_ydXt_9$J=o|8n=o62(;;30C77_F
zO()Ly#85ng`%X8qQ4^?Y0t51HLW*W&pRdo%<9P_9?2Olmq!e=l0lr41p{lK#IEd*Z
z;`UPOkJA79W&uJu*W7RNMeWpIznk^^91ExW{`tnQduebFozzep2K;j^;4WJ7eM5gB
z{QUv%`ltU*?Z*CF8RV*e&EUuJt{40d<$LJsL&xjk@&8;V&nu6IiH)73pSg~?y0*TC
zg@MHg$J;vihk_K?L*G);5_hz*T1$}q+Y2}VBa?@ROvZoW2CF0t9Sz;Z)6)yT{`5{Q
zO)Z7<+6Auj{U~jjpAj(;F)7#y7!>rh^mHVhe}C^|zwGQ|{5Xy{j=DNranl#SS}+Om
zfU%Q?F6hl)hr-8T*@Di+u0COVcu#mqvWH=E(9WlS764QK8T3U;I=T=Ev5(;U$g~E*
z7m?p|*F&EpT{c?xk0iglvYLf8uKe1=JGYeA)&HabJcw~nqvPb=9Qt~Od)|}XO4Pr5
zz%Q@#vmoiP#ISstf-blla`EzjJRGW#<q_U01y8=;-F7+LJg%MO?PhsqXWJ9K^<Na@
zxQt3PhK9$qSdGfyc<&p~2!SE~g+g&|ZSHJwUJ8j%^-0ovf4YzZR=2biszw9d<*8YG
zwAFO0b@%J<&*1-nnKn4c*n)xx$cBr5roMzfNO+F;e0_cG18-hw>01hVr?JIXAiWxO
z7h>GIKmhs>21lf%<YOg9?WkT7OK4!Pc>2Bu_5)dn&C~Q1v?EZ@YW_77Glr6KD5n>(
zJ(TC~RWfY=CDXf-x6*GOp<Z}=L-4gbwu?&v;XhoSQ^t-nV_hm*Qam7@T~akl65y+o
zo1Gms_;0f3XEz+&C(|_j&VV!K6dYshiSss1z-0qBS9WIZSd|6EvxLsbi?P!VFkQ`K
zMq#P4+^wIQor=;T<vQxU)AIw}F0d_t^m+!}UozrB(&8$WjxI7AMg|C3Sd#HhCbMC$
z!2%_%ZF`7#u(GyN#bCmqb72h5J0SGa{pdKmj;N6r2@y#xUNs1hGax1g9S(GwuKL|-
zY>#beC21*r`I*3yD|=;E69a0ftb^bphYaGTXQKWRG9;J{_w7qScu0U^L56^^ZdB{*
zzSH70kYwVvO=V((eyhu0&C5<kO&%2)r`B(4i~jm`3Kyn=Lg`dZ4JGfri{5qaF|6uO
zu-?OaWZDeIqJH1L6Y^TC$P4&9^4=d$#==MN^;MA80|&H6o}Qd}vD!Zq6EO%tU$kIQ
z61bqJYr0i66)iweX-sInsQ(Y;+C^bl5pW+R#1s*MdbfGS4}_!l^!LsJNiL|8q;_~J
zKW`-hIhFy|bfb|QSc$_`k?9C|Mgc>Nb-1m!Lj79mnr*kds+z-g-C5ieiA-EV%*hJ6
zwh?km4Wm0mK5$z)3+VrZF8uU6C_@Q>jTvMrYd1M$2u{{mg6osaX_$UoZ{b>B59Ava
zalHSZIQGK%=CJt%%!Eni3M<>s$HiJn4Nd2l?Kkl^tzS)yCfP<<ca0Y^uOtlo{6-sM
zlX(OV-w+ea(iY84)i!35K77(rF#<3);&6wzyDKQ>+Al8HJu0pur*g&gKq94#%wnTe
z&18;Mj3NL~10x?WeKWzyppra>^AdEFI_sRD1z3h|i)L9#?Q{}w@C@1K6kI}c;o#VQ
z8V&NkK~u6vRHEf}F)ceiJ3UjwFbu@5F1^xbrB}}>C=wuA({DlD($O2wP4i`u95U5t
zuzLqG$J6nab#<S*CdMKc#TG|PX}IGj#0Bh5<r7Fwu~eFT)+NNlZnI7&qz4c^#sVwx
zQII-bf4#wza5<214MOQlea|;X^mYoxFu4D=T4tKKDH?U>fAtLH>li9kCG&G{O^t|n
zT1{;_&az9=x~kPIOqq3_J)?LRz7q06z3Tq*5((RVqAQyL(qJEO_3M#sfBf*1l!M7L
zjmGr!lVogc3d+DTsfTO#80e}j7AiR)9_PP(mX~>%hi+PI?uXloAWmJ~J#h)~<y7az
zP+hpx*B}w~#uKp5ww)~Vv<GvIa`yV9#XqfAvb=d{;dFqwZF>5Bkhe`G`rmQeo^GFI
z<ZR19N*&%jrKC82KoX@%&sznVt{*2N9fB!!tIOycA`-(QC{<bpjOed)i0d^!qEqGN
z0aC@BJx*SUKrwj^X^X9w$MGG(USVXVLVyirj~CvCvK)VY{G*UKi|?pT8|y^q^;_$A
zr`$OO;?$JlJx%w^E!RIJpu)R8=*@yzo$}SGQwRQ$Dh?)OdtaX-uVcp)QpCi5d892S
zn85%uJ5Ns!cUX*x{Lh}-1NsEc2N%OfLK4%VAbSaXgu43rRt-~~{d#>LqCJrjk(roS
z9ZV<OH-7N}(K3i6n04G_H`#dtfZh<N{q)`<d65u5uS?s5jkK8J;_13+RL8SpqyDI<
zFsfSza5}q2BXGal5?X}41r-ZczxpRaHm%ClEnh<d4$l*yW&>TD(`_8ojY(|<75mM6
zOfVEW$~wX2b{}hutH4)d4g3+@<Zv0E#@CcTX|dBajBt60mck`9*kwFgzBU(EG0oEf
zKsIyrcGnT1H38+edg=`T`j}sk#{^gP7)*IuR4uhY(+CgY$;I{gM%xXSstFG0Uf4a8
ziWZCcUqZXV!pg?R#zZauNultBq;ZXqAY5Cf)O;oXtY`+{7-jgRJll$Cp^V2$2Z^st
zsPZn_pMd=GN@hoX&_w?@*lh3}HSInKdhHz5lh~>t?SZN3YSa+RGQ^<&XHms&`)yN0
zEi@ZDA$Xa9<SRdV(v=;y!loAAO)e!{jI<!>vE55~5Wkm_f{E2hO-Wf;_@4?WQqM@w
zX>a)wO-l=<uOB@kT&unrcdX<dWIwg?YpeT=oQx>;nzYt7A0{~M6<cYE2nqohfq#<Q
z`4V@4@#^Y&wb}gly%#8Nc-V<Ql&Qmt!PpXnIUznr;__M!N=<!xzAgC8SG%@3^Os<Y
zmInxl0(_dcOiUgf%LdG5S95WImAksMWTJ0CfQcRv71ur3OHU6zRFPBl1`-ihomlHw
z21?Ca4iL9H4O6xJuryg<>WDiAJq9u=p5@(@Cg%>h0Q-}jiCsI<uBh$F^}g5+xG}6M
zqZg>&Eqtzqovl?8RLcxrTRUECltJ0?-viQ*KoUZ(>p<ijv*@7cV0S-YruRh#y-3f`
zq#-$(cdn1$!rjU@1qHtmub~IjETgiqaSo^zL=rj!j*ynZw1F}*_C3cGd!x0R*geb0
z3AGd39=Z<YEr=B-UeehSQ4??l&45!5(kWibpV=#~m$h21XSOo|?+NI23wKPb))#R<
z&n~rhvFsF7A?Bd(d|UTuP`kVMP}a!L-=oP1>*#19f(+PQ_@_5=)vfox(YgUcXSk0D
z__%g-Ovzkc!uz4gT<Pan{fXk|avavHFPk7%)1J3CS!OW$;gdK!x^60MtJNn@5l%P9
zukV6q8>;teU0{y(pFY7*2_}nF9IPi7q;@&okIo$3wzbyr22;4~4l8?aRPCbaHTa33
zjcyYA;BKU<=R>b4(crb)S#8>8Yp~y$OVfmC5=f!X8-_?ygeFY2FQk2vRV=~NYz0xD
zYwI1<y;wAKmm~vKs?LH>nhO30AW^yA%I_=#KSpT$`_TcUuE|3n%H0((?IR^Wj4`Ry
zIFAoT{_acQ+y)uu5$n>SA;Do$VQ~->a$g332uS<+M4nNlGf|AGhlbJaW~|7~2_OgJ
zvI#79H}!nUfJQc$fYB88Wj+tb<f#0JHsS8A7T|-h(tWU;D8IzeDYF`z0{tILS4YS7
zGCK;7+gotP%1s2J4{}5L#!$XvB^ygzV-w>l^AQrBu+gejiS`(PpCXtm2iEz@fc^6E
z56D_>3D>gfQc+qvCmuw~u9M0mH1oV!NLP02t2x<ZP0q4E!-z*~ZJLAvAIzoR0dK~c
z6o9DnWan_~N5s?}Rd6AmEzHo+P*~8G<Z;N^nYp0@i-UMtAh!vX)VbD&4`m&8*rkKX
z$f!$mA@%mBNKLh5-@Gp6uC`lS+mg<A&yb%#e}U9D2(u@Wl7`Jurhi0iGBYzR)5`)(
z`43-tRgQ^@@r39&t1YC_qfu~&+;mBDi0t*$A%J>#4|k76Fym-EY6(19wr_G?n7(?#
z4(FMp)UP&Fu*C(Lbl-l%Xw_rx$S<jSdL)bOs3s)qGWKh!@7I3xOtY)}nh@g*u9^X3
z<PRJC`LdKG<L$8kj{!3igV#pVH&`DxCyMQAya;<4O&07;x=REcWMnej-7^8Pey7b?
z0y+3O8w=xI)IB7|A?{<z77T{@nsK@k%xpm86kl4*NXym9bYf?9n#uFg-Jn+E#$>?*
zGoMXb%F@!e7vxlxqLYxMH{LU2tgS75vfrJmlOEKXOPq<H$->sC^Xy;Ak&b6GVRc;1
zol8vQ2*fJgH1E|G6GP0N@vOC62J{}*qiE9}@v_hcWh<>Fmz9&cib>1)S^!ksrJi)C
zti<tFd(>b3C{+$o><1u_?wrU^!a$cn_~~hE$}0Ne<U}6J!@=%=P3Jmos6oDBow>}p
zqZ|zBS&Nz*jKQZ=RzV^4hf^})3E^w39#)_jpLnmG`h_RwP{`WY8lK4xf~W3^vw=rR
z?KOGFOcONP<}|fPoHXMgL&qW<o1Oi%35*VbF_np|h>6F=ju54{lN<>dsn=^>8jvk)
z#RL5PyM8s_7AG|rTj)fkr0icV!Nbd_ry~5Jce&ZwO!m1RB;f715p&vus#loYRy3f+
zK`Cgs+*i(M2NG&Nz(qYsW8F^qMO9Qx)dGs62j;q&z-Yv?`sa_fKmX|mdjT_SCumm^
z?sKoLuI}PaugACw<AKR=SK7M?OATJ5C3oO-&>@5Wi9*CBD96u8$J6|YgJ7nb*ZHJN
z#A-ho{)*MX9QT5w>o%z&X0~C(B@!d*tAM~6;S}uh_wo9!RgxVF$`*@_wfo(X(0!Uu
z6*DtH9bKR77?|qjrx)_u0auUX{*up?urS!#FP*kKPft23g4MyaY*b1?A!y>K9Bypf
z2e>MP$M`M!^U=Z7cP`muDWhHWOVy_dvCtk~2Jc4~uY_DWTp~V{J_zr|48a>DB^j^T
z;!&Ylpac>}FQL5OJjaHX<X*q7*_-!(ZGs|{Q}1YOxJ^V!1r^K`iMTyCrphL*G(cj4
zf`-Oiwc@mJAydw$1O~k$fKvqA#TAjzhVz3vSooLK?z7+os*{7(@l&9?#K>e|Ez~~R
zZQH0%dQ22)oLZusUAa{PV4Bs%{-s?@=zomW6cp_5cIp5k|HVg(-w~G)p{y5X2qM1m
zTN5Qx1EC8k)%%W8gQ77nW8TbpeP;SY9x2+wxLsqeQElDbNQMk`^O$PZu}dLLY_>BR
zXxQN?rDvh-&ohw^Fo<mS@BrO4yc#P4>xDMYM#tmMItgr~K%_POwT+m--EJ&AY&N^Q
z#MLnjEv<#9z!=roI3_ZbHl<>1^jA1kq@;q-^|U{(|Mmi;ct5>>DY*<!XhIem9k4Ml
zM#d+S+4QRY{hz~rODQD^0mOks&7$-6p=C!s3l|p<evU;~;jON%QVoxFn)Z)i<_shu
zUcctC|Fw9S(Wy}V%s9ia?;h*6$!j+{uT0FB`q!96%2y8u#j1ZgEf?G49Us^!>xa`U
zATfG5j^=axiXN=PAEgIpC!LN%ia<VW04kDR1|GeJHX)bex32`!mQZ>c8nv1=b*2E&
zd8CEZ$VWydFd7|x1%b{f9JacvKXsHXHT2N`NGFW7|2|yzrA|;P!DBMvx?UVaR;B}J
z>J*6QR{NK>xdGdSW*)E{u)Cd*l1+@VIiDRNkjZiRDt&+aGHa5T_=8USw=(q!i`p$)
z5Ot|Ey6#Dk6|PJ9<u_lY=AUyStqKzlgErJKK-{xbsj4=b+*4q0qO6yl{-2z>=MH6o
z0RW)+e>i)qfU4Fu`WHn|KtNhrr5ou+y1QFix;qu6yBnmtyQRCkd(qwbf8G1r=i=O)
zSQiGXnRCAJJY)Pu&;2z>&$h32xUzIILK70|8fP5$L&R%msrahZ=#r^YO8|gGOj<^D
zffEp|BAVhoTpSw(1A{C=ZVzxK;ts%KUg(J@S~+_<%b>i@$<jyx4So$7WZZq<NK{k+
zO*wAnVWMZ$X*OVQtn>F5RaeLPrHG@(iZfg5g|Yv<dCN$JfZ(AejaJ>l4MNnJcsV(f
zEG))yU?6<&(NjTePDohTgzU`Mg5o<WaQXbboz&(B(Xc7gswYMyj9JaDIxcZ&wRpxz
z84&*N>}IF~u~4&qqH%n`!?|ByNhQ(e+pn)J-2)QHOp#V0$m)?l`BCZ2?=EdwV&vh0
z;X&it{JewlM3Ovye|4}lSiW2I>)bpg(R{f)#N#Ck47D<inlvFUiwT#-5w&_v<diWg
zDq1!%$(#uY5>>;-4$LYe1cI$OI3AwmAMO0x#)@A5E6qVYu{eBg<CF8Y*k^5aIn%q%
z$UcvweL_9`#VMhxT4yf}!+!gB`ONW|Vr+jx#PP0etiwXRW_)s#I;9@iaRZ?JnzdUk
z4kvBfFDRlv(UFZ@eO_yEb=d!7l*(dr=CfZ*m%?$sdMaQUo~^%dr82B-?e>tI1AN=6
zb9Vy+ec9Q$l@mZ13V20;Vmx>(JM?dH5EwxhCcB_|vJxi7$Juoe0?|P;4Gtb&DYjCg
zM;f3BKn_gr$cRpp?d>nBxcEp%YzVDZJe!f`ZZcRsS7Hs((b8@MW(XRZF=sG26-B~(
z+%#MEj%dM8+jJVqsej-k!6<NCeUF<M9viv60l`AqHt@V#zm13-3#RD(B%e`HZMvM5
zf8XfDN3ubqu!e4mf`+DFFqxsh;Gofhpz0s!|I^nGIQ2KTw<<!I3tIoFWP#)EmDIon
z+Y|o6C$?A(0}c25E@WZ79w8bXgKA)Rc2@T${iBC3lBA?K!|0R-hZhRT(R^#IOqe$O
z8GN=~|3DvWRTTg_hL)yTnY%9@(QwXQG%q;HuWpQA7MfC00!SWEzmS)MD@DW6lGF9<
zrXx3uv&Lj5-{ZCK`GZ9xfaWn`4SGE7WhVy@j(PaSN2(6~b<AfdUR3Wq`V=;1{8)bh
z;humDZEvmp-lZ{nmQo0+q0v}zyJ#B?JfGaZq*A^Hp5pfZjzS*F-nzctivqa+in)0d
zdwTyX;DQB+;s3X`>_4ydgbNz?6xjJLw=VU!F296+{Zo8&4-1Qv5&a?yf@g&J6aD=B
zfG7p#?>--8R}DL0S4^BCaQ%~B7ndXu@BC9KUdc>{mHDios)>$yFQhH6tf`m`o>B{1
z$*b3yJHmXr-vg5w9^<q+;VeJ=(|VPC(IA--MABd&AE5&Btw(zMzXIPr0BA#bG6q_1
zVqyBf3Hng-cU>hbWxqyD`6&@pY$H-Y>+pffp*cug&rw{`NM7AiSY2D$Q|`q%!Yh|s
zlAoPfuexG74FHMceO?quJw%;|QrwJ2`KMQVqXx`iW2a+!?HTXGprM|Aap14sM4zy8
z(<%7N$f^s<3-R-LAIDw6E>(@t_6`k?oXWsQp`x-z%owI0iHXT5MJj`mF8Dy8<{m^Y
zq}H_=jIIWU4PYQ-Q-GU{%)hdUg<&e5PaZHJ1|RUKXYV5mr-&4jLsA^65ihgFD0{t$
zxp{he`d9M}by9kAe!8`_1^&ZZ8VbvH<kun>r>Ka2ukc-$#72!-tjkaL=<VcZm)ncy
z&+3YQ&*uj-uKHVW4BA@du%Pjl;r^UujHB}F4W<!O5R(#7??$~F{GuhV3i4YuJO92#
zTPuH@yggqRcxDp^E3Al~vbd{utZy{xIfNo$z&E>_*f6(07T1o6h;{#}2df!mEc15f
zkkGc)kdZQf2fDm^-OK=*JEh!*vWeUd>C`N^7{|l6Ig+}6UmV=_3OHtd5Rp=eg&(&f
z?7umM8)c1^85taExj1@py-{;dM$H^TE4AooxtNnlSNfAg_%ZJ*=@76Ub;9`}U?pm{
zrtWNGUT?zvbN+zCtTI)PiDy!eJ^m?jYoY@+!__>ABTFn!<;C&FII2b>i}tMHTd<C6
ze3y2~iX=qb^`6{B%7im7ug-dL4P(Gn`oMgy>3BGSuYB!ZnAR*$f870&-gSlPt7C$m
z5X?_`TZVW-wFNsIP89TOASo7=lRxqc>g0CK8qY^d%OjU6bl63GzR1@*-~Q(ccrcVd
zXNWpysDQ5krV4~W_;_A1?>HUFFRH;Zs=~7T@+Tu#y|91B#bziG?byJd{DyX=E?fzd
zu5C#lN(YXRllK->ci)e&RcmW02YkZ0=50xI)f<Yz9?sxzKjv>rnz6cIKML|qKJ%mJ
zwfQ)9aR408`)4qLCkS4BAv7trdzV8Aw77F7Tf0LbP%*QHOOLl;_}ia>j>`0jZzwN*
zj|XjbcQxa)me>c*6)3s%_36#e6JpT~2Lz1m%rTPjr2f5jyjvwjh3zfnTFSh`lf#1>
zyx+lmi07qf&7<e!CFA5}W#IfwL8qmm3G7vQjC-2inR^h8Dn`4V<+AL=;Pz&j(u~NB
zY{7O0+lq$_{_V7-exn;aT%%0mBb0T4&qyvdyEWUP#~lx^ZrB^g%2P2E5TOq_#;I6n
zY~~X#jk_($xr098!(sPnIZ2jJ7Okk3zF^f7l^a_d&t}+q!{ZW}mRP{)?kuORU6Gp`
z-oyoc(&*B3jmPCaJ1!IiR@7Y&5Ek=g`-9DZIYuKST&|zsE9HG(CV?gQ7dI1oa+)!D
z3BpzR^&&|!cY6#;o2B5tk!ytA)@m*u<9WC+(~wO_&$#pT$l2<R56bkPoWW~0eBxzM
zZtw56K8Mx*2y&2C!}9H3Ai;esKlq{fUEFu=9oqKA%_>zu5!M(l!SH*MC7c>_Gouls
zyxby-(v{VKktDxm%V`c$L<dRf)&{;^;R22`RE&ppW2{X@hz(7YOz~&sDcs{p6>Uvn
zWlc(MvU9&6^6GDE>>dqAy%AjQ?%F|ExY8;8P!E=kS4V)}bu?GZdH(#>YDSfxKjV8n
z_Bk0yEo3oU(wnNl0H8kuC{sEDf>g7(l1&51tJf+g&U9K@S^!5+%iRFFVj#Z~8!N8v
zXB{wEGPW*^q4jjMx08?eLrpSSp+Pfcqmw*&Jqn_C8T`8a#f1u8v{`_$af3(r5m=&V
zDF1l69~^tmou9V+k?8y>6stMsuyeb`e(1}{n^{*z|8@CgalQhv1<tSIMIpLFHAdiM
z;msL_Vaxi}S$S?pTzDNk>q@E4kP$iJzOqMUvPV(i=6gH0lMrVw#C}3~@>oWyMNtxw
z5_eDWsVvT70bZiFe<TJal02=1m_nuDwmXt`15?NGsKL(GR9P5Ws)L2}YA{UnJ+=ul
z{#}L$GQ4%3;~w$x4rqNTg9t|V!z<T`hD)&d8GQE1^nq@U=RFvU5`ls7s^Mg6TUnjY
zF05dvNb$4(52FG((kh@eKJ>lh=Wk~e7n*7WSS;f^Nr03tI-rJydP0drDgHo7a{5dF
z<3sCODU{96s8=wdvNc;+Xc3IdiQ{e&GuYF?nK|@TiX9`dW`gngJxcFGmSQby`~1AE
z1^Wo%WFo_@Kq=4PA(>DK@)8fEA%5>$n;N9<B`ee4`5^>xGH-DC$up0uI@%Z+ogA8>
zE~=T8T~q$EEWYH&9i)y92{slZHe4mXlq&nKgHAp?e2LQl?mUX={xTB_+ChU~uRYbn
zjn~EPwcju7y_w3&>I8a6JUY7E)3KivQE5D0j%Pb#$l8RZD@|(<z?&YN726=ACmF)5
z;XHPJ?51HS>8kkNH7l1%jiVY(TT@nM-D7EtrVs3)3pNU1Kl|MM7-IFs8(4dx8P6%A
zNC!l{Eb8o!|2!tuTDdv91_lIiaIi@yv8iclHtkKhJ+D2UPUJqgKgv(YOG!y_Rv-6T
z2$X;A%P5>Ft(-7y$ZNVhnXU9ns|~9yD=SL~=&R~exUjz@_t>l}2V{G<hfT0NvRZB+
z0daI5{ffYYS#YggyUY#k^W&S|at6%Bx_NJihN-EkQYpa~spzPbB^Obp=4KA3qb92r
zo^28JTGQrlb9$EE9W#KWMNwa#vh+-a3V-4xJ~S{$Lpd7xK-JwUiyDO}6(Bt@5{drq
zF&`#r`kte05pqLkyt0_GZ2Imzs=~+Tmr|=X+_{7V#`g9$85u%v?_Zala0-HTZ-8i*
zQ9zF&F-71&tn^HzibpLdC|MNi52mmvPc$-FxFzt@O3rns@UR+67_ML>B@ojPe<Y&r
zgHmjtI&@H1S6`U6=+9bdc9KySp09}*LYA0qa@em<VikUi&*OP;gH=M8e<s8HEY~42
zO09*D4{v=iTfH9@CX?%Uh^ww<_U&7Rgj5pq(&G}Rq2U(bOpZB)yl33LiO9_9?q1Zh
zT5Q-o+^8IJVP)Mqo1$vGKD3z1*qX;EY!P&ys~=z|WpNylHcoT^z(W`bOk8Z7;Y6Ot
z%&_Z(O5=@<^;)ZC`OCebR9-q7ZjZg6Vu9j;5IU`_n;#7g1%}YlMP)*EWQY!kGczT}
zT-*{?=3ix3{XxVB&v=W}LU7Swk4&m;)5i4FKDsfGxu(AbwmU|qyxjEkn?L&<ky`^t
znyr1X3X~JIDro~VC8M!578BiHWYXk`iCb9e3-m6bOf%r!avp-XrekAWTyC`qn+Jym
zcQ<@QkQb^<#l}J&{g6mVNe9yy<4^(Y!0l+=1?ceqK)-f6oHUudDQ|AP&T6e#Y+59x
z(U44`xB2?~BD&bY&+!5`qcm5Cly^v6Mn<E-c1vPLg=yxCPMY6~JY9k+)RX^e0g>kn
zKVe=aq}3h{pQ6!~tRy#!sO>G3;R{?1O7uy$vgoT!4e(rhu^x7ET<Lll8U>snkV3Lm
zFjqwfB`qpE$vHjNmONZ*r#^EsxRWG}8?O|}MDTgw)L0mr_b8TpV5VWEEU*tukJR&2
z$0_v}eYnKslZc(GZ{0@2pb-_n1DXQR<RoNwV_;^^Zm$O*ZlK?Cs(Q3J-=j=!*s+C-
zEtLz1aLzLsL9NOZfH_HzI`^D@P)qeoULwBIQ_5s=aCEXgm6QN%x-FndD@JHD@z#5#
zwJZWYl%{gAR;A05?_Tsfv>q2p<S9IIuC>uRn=}IMdbzi1YQr#{xK2)i3eiXVr^6FI
z8MvR?+f{~B;=;qTU`m&ob|H`fL~GFaAYila9iA?^kVhX*ccPL2mw+@A-%55?Ugt1}
z%QjPUscOYw=WLxBgtq+iXGKVWzrU=CN~!r}UMd<cR!=~g{hsLlS3{GS)YOuz5h()r
z%+VnE{#R_FX&g$bs%$Rponu78<2}D5;xy|WW7?@YV37g6XVN=4ku{CO#+HxoyB3;X
zZ(iPPohpW54CR&fbBjkakBgjlN50AVI3iPlHn(>}@Y6JTyYus!085+A{_r6~rv9Rv
z_4D}Dz`japc57!n0v0(1<*X{J>+$7x&(|Phmw9SRr`0ACN<`J!Syv9Fi>@D1TUoBv
zXan8RvDo5BM9gHc8;B87RE+J7LsIxbLVAa;pc?_<4Vh7nB8!T&WWRA2Mxv^%gUT)~
zWs#je>#ZP+RfCuLV@ikJLP%awc+u*}7@2g8bj0yufQ}?J8HL(p+ZT%qQ3CDd_TaZX
zeXU2sEBOe<DF;caO18)wOKu|wtR)ZhZRG|_fnlD@On*jtN=tHbvUBF<^Rva8?+z9_
zvpRzZ2QPx{!6a4I@P73JO*M{OFj4LY6*<Y+TWCGTC{SPGulxutn~iih52RjlY(6=2
z?_c9CsWN%-HP%=ZD)1}xkfOKmaF(?;CA*&+4Uylam*fl&uWxNty{|Qy%o`NNTw6=l
zRtFV)MTcCVrW-A^_eF@K_5JyaR;QuLUJn%Q+^&un%3Pw(Q<p+44(F>(Nhm&w1qKCq
zJU);Mq<w#sfIQ2iuI8Cv{(SWdfJV=D`p_D4r1E?>Kr1q{IWxx>Rw0{Chs~@cGqb~U
za%_5=v_f*vPLIi+P*p&H=mR}H2}$)H)N2tTBFd-6Dd;?+oe{6Q<T=J%sq53rq26BV
ziRpvkW;f`&E5@Q8?6ESbePu8#n5|9fO(;u8mBf{5Umi}m&9pS53tXIBl$Bem>UvV1
zEI;1Ijc7%K<Ybk?SQ>c+`M*as^Mi_3`g+eVt}{o@r!)1h_VFzMqfDx$k!bCzaO4GQ
znfnVB>yZ`DTsg#ytZtVv9wX4pQz}zZ_r^E3Kx{Cja@~A!O|2KW5YLi2Z|Ps=y^6NN
zx^R@-JJ`oEQ*hCenCE>G_XBU6Z0Y7iQA@dxzoS=G$;mY61>=ZS!Kb#5CMIH~3;|-u
z1f<+9ltu=krA_hg#Zkf^iDs5te|ScaH|QD}$gBC1(WNm=WoBeie<Vf0#3sNY0LJj3
zgpFK|Xr{S%2G^I(@1bta_r7`iPz2cA5c|4|g<x!MV4=K2UBfCl7^9pLeBLs^+BDdL
zJcTtkLIvsVcR=xUzLanxdXqs;GK)y5myzNB)yeG;>EP&y_Q28{MneoE{OD-=o(^bT
z)_-_AJJ1~i2lB{VC8M$4%s{G>(eUObq(5k2brCV|1Ix@;Mx>fAyTW~F9Q~~3C+{*{
zFS)dvA2zRV!CVwAb#XAJzcs$qh4%gd|8;bGH{ptegao(qrgd&8O9=Io4V2%@2npj6
zZs&{H<EWJZ6}n?y>rABQDTFvdK|$i|tnrEQ>0)&$itgt)vvi%Oy<&~#>BH|yxp8s1
zan~)-uXoDL%Y!@&k7ng%+YrcR?O0XuhHJgLFbI*-i`;}C9`;^5s3asMNcab|KA$|D
zR^|fq4(+W~_)kAS8qIZn<SWClk|mtP1UaL`*x0Lsu5&(U*p`zM=j*3OkRO4Il@fRQ
zc#)r<pP;6;x3@BkqM#@%*!JS3NZ!pZXSE^|Y;8qU>?(n$yUT61)-+<Gv)|pZjUDq?
z{z9hi!XxrXWmJlb&3O%^(h_lDkJ9YO&01P1G!6mJ#eH{g!B2nwS|Lhd*?Qxhilm;R
zn_m~iX;fzJ6#rhw-7YO(IUs?e$5K<{m|jbRZ)j+wL$y+x1o!LaLJiz}6??~uPK9(z
zZzW{%?nJo9_^I)r@#<i<!~+N~1MG}xmzpZhN0&)4Lps^?fHT4Usb9bDJe(k<VZ6~#
zhVcC2GBhxBdTg47nE`uqm6)3P;BoG{dnsu-?LkoRr_>(v`#mN$TH3#@MR<7l*Q|#*
z-OaqW)T-5jQbG>b4Hg$?cg-3yOKBd6h|19_^u<==jfE)<1vo3>u<4}v^)Fs4*cXfQ
z8`(+<>&Yvte{-~#{v)#_#wV$&sH~~3t*Ne~tnfX^hBY14*+zJ+HaJs$7gm8OFt?%M
zE;=9zdpRHbck}(F%l#8!oP&Qr49^e6Ld@e&D7?HnS6jskwV;JIS|Aj(Cg3|h@aTu!
z)zcG(%iS=kxx2etU+<DBa#Df_N{{bZT(jb8oeT`3Lqi=cw6rJ{az?Af&|I(2<3<47
zMib7Gy--C~_8lRX2)6jlu-48N;5<O6<FB`u8qd&P;issVE;rrYT~c*4iu>N)#jt97
zr)pc|yaZ+2j&}ZRLxYQF_GbTYV-~-kvF#Ksz)~huI>r2m*ZE|1ER!TiJS@C8FR#jE
z$rWBqLRmdNX{F9XLQ+yvN~zkV(&&hed)e!z4XNk+@dBOGmV{VuLywu+dFB@hDG3AA
z58*(fh=ioB+auGRAMHOxcuEOwTh2mm#0?9?h6bGp+c{Beg=>H3%=^OaQlLAI4ut(q
ztJhnXxRcC!d#aSKA}Ie>sRemks!#e0&rf&wKt!2={`b>0PRFG94oX$RhY;Rx9>SKf
z#3Da#BeJ>4qTP3Av(7h0tSnf=V%Ef~OJ^p#Eb$b?+V%9h@2_AjX5;Ukd>Zt54+Dte
zalR-D+RO6h_8iIV)cV~gsaPaEZwSttIazA9x=E<X<?C~r$q*j5t$q<_eR$xdQLm0}
zK}9zvry_T|bNNe&Z<Cw;^s)u^fY(zLw4e$MlTLd5d+1U_-_!rJB7v6enB4L9A-CPy
z`2%*t(xIV&@bLC!koy-R0}*j?5T<Wmjf}Pruq*QxPP(2YlpP&2ePg#qgdVSiF)=5#
zobYzQD-N7v(aOL5Y<clMhdhkUW-nUnn!o{ZKQ_^9t{+3iO7q!l-GJkLQZ&%P;b#^X
z7iV|vd%neGGPp}tE1WJK8tli^gU?Sd%(UB^4X{-XLxRlDU9(t@eqFCS1z|6AI<1uI
zpO^EC$3B1l^XHGEe?Uk!1jvr#N}Z48T^V}kZrihifMjQ|ukUx;uW1n>p==f8#=wKZ
z9+|XZovL&nhx=k&)|jFh8XUCEy~{!rlr=>_-et#6p*6mQ@}6}(0Aw(Gcvu?T*e565
zsgk9Ljh-YX%l2hM3XqhdtXvZzlvxQGskT`1HC1P}`s{Kyd2m3zlu;IQd_kjLRp)$r
z_OpD0oTk|hLW`UF^36L66nM6ZR>GqpGA?UK^8`1pniW2S*Zooymd+9t^NSU<K%r-z
zU3t(v6;w624|iFK{d5|3)z#0#{$m`|M2=QLOz%^&hYuDbuZX5X=CZGYBq9+taZzTz
zzzY#U1Ht^-*|oksocA1;j(E(nfkW1%iw)Ad!ULp3xncJ~XQ9!Plk#LeF{o;j{s1KH
zQJY%OU(iR<r-%2sCFboHM1=`xByV0ni(GL*TxvPFF~CK%oUKS`?xHYRDwvAyi}GUI
zhz$XCvBi_Sr3GMAn;IXRtNALSFQI)@X11d3O2DYMd0jb}#O*h*bu`-?rHA0E){{QG
z4udf37HwZsJv21HX?JyS7Bj$DSuwAn(MYXIu9;Od#h6#z>aejrv``b8#1uh+bKais
z^}NjOCU*-m>Lg<6sI-srfqa|~=Gcjl+>zb&WHeN(Q96}}g!Ut!pF5dMa_@3jO+Vh<
z)#cf#qub5uuSU*d*h55kwth8ks1KJR!8`St4)@1iKfr!0EiQ@E@J>-&ZfbIprAT{X
zv`LppB8X<8R(@Ix?VE|o*7i2@liQ+f%fvIY?t0$ohU3wkmPV;#*wIpE5G*_FyAOeS
z3~LFeD>D$t`IB$IM1OY<Dc7mnkh1#D*%O~di_7G2#p7ID?VNa}`emxSYvsckftF!N
zEniE2MboRYgzvlOBgdNDme;0}ABkA0IO%H3TLP$63cfuc)l*q5^{b~9HQ~{S8NxnE
z36c2)2F6OKs54vG9H06?N*4jKZRK}Jj0fv-Y0#)Yy=x8qXJaq5z9$cv+6rK`?C<Lr
z5)=wex>cDF4!L*S7oxjWW`JT2mUT6PJx_c09>pL-C+$TZkM{SLyF}NR1fOf}NyXc-
zyjWoKY^Wp~3C3p3c`&&;nA=#@43OA_O2^|f8RP#XnSXk4j&P=;!)<-up-*CR8%j!p
z#M`pTavYwVbwR*7qd;eA&5o*kiL2mg<FQSP4VQ0-<-~pFp(RsT^CQdri)3$%3Fpp-
zXWxB4x~7J>s5B~?kM$KR(aH`q1a~cq_WP=u;u&^@mahr5Z=P7n$4ub(e+8FBe+cP%
zhk~m%xAIkq<)HMlLboK7)z|*(C1jpdjVnvuIv1JSkTNH^1bTDH9>>Fk3^OeeN&L9z
zWG3VBV55-4XgnXE<&c1&=0^bD61fIWN~IVjr{X0Bi?M^%vTzXR3KTd+bwhM7o=AFD
zogbfufXghXXSKI?(D~%zbm+deBl8nE=3IrIPmM3>KlAAy?7sx?XAe}(qp3m_w~HOQ
z=~oxDQXNoVn8%`&-J(v^_!XNre^CPK%(+`=&g*+y`P>)gx{~*v7heY|-P}3DY#p9W
zvggq;QB&tU*to@&)u*h)k!!eqXDZ~YMOIFrF)C0;zr`jOXy))8U@cm1Fcr|{TLYg9
z*l{GJMk~bZau_P?Y(pCea_xQEgM4$gvzMhL#TAv5!Qx?ZDd&7PAqp7fKsM);k`l$L
zGuUMzvNiGE<6uu>#H}J`0>Eu*QqsVhwL6a&r6n;5vy!@aL6Q`N7N28CorCVf&OX_*
zOvO0Eii&*O8su3`RWz^U#WCmV{Z<s4NHBg_a6g{h7)LeYd++CWum1gAI9_p=YSvX5
zkEFJ>wH>ca&CJBDiqFnnQ|`C$L&?H~pzpUx-6SWF<&s{y9fjbe09a~*`ESLz?-iH3
z^ZRz`Uf)z_ub>;bJzg;WR|`03yk@#F_S5-6RFYe$@+XIOvCh5YP+Habo27PYp8w9x
zT4q<5c-Rk{gT-CC7iqYx=E)HWsZmKpbY!JPSq3xpem$U_Pq>5(htM}X1P2etQ+XWU
zP>@I*mlTn}ZZ_wxRjeMil!nQAw%w6LR6<6981W9`i-CB~cMG%9-y5G-KY%6ga_oy=
zRp&y58AGjLP-C?ry-aTn^^Ea`4V(c__vH0EV~r5xTwSPibv4RqMCl-S>CotRC{e4T
zqPE0r?X6cl`Smcj*!5}&7rg_qs1aWpP6g1(0g%v=v&`-)3!79JF+S}bHoj1RZ$)GU
zFrdEhNV!?gn97q*!75#(TWaDrgn{`L(9td1Kbl@LmfXjvRho?O7OsD2h`B&P1%OEE
z234&$2Tx^Q=*TN5kcHqmojqXJpjaSUd`5z7KXNK=TeJD#B|9)x1Lkl`X_mX7w6wOM
zs;IIs3ooyXw6e6IU|pT$#K6P1CS<5TKR&ZT_5TEafc6<Ad(((`J1b|)Q2ruZBfRH9
z98Xs+P%cZT9)5kiB11m->m6&)>Ki14xiY(f#a1KJJfKhguxbtakN={Lj(8v<>ov3&
zvDTrwhKl7^s8wFR_`l7LzqfbR|NH{~{`1S~$JM`o|Gj<p^Zs9(3F;NW%YU;pz=NIt
z|2{YXg!UAF(j)p$_Te-&>aE{@fQ=>`#>|x0p(ti8+S@<_bS$%j*Gsc?vjmR^$C@p)
zR73+03}8wWjy1AMtur(IMn9GHa9H3!0nr3bDcDP39ggO0E#i$0@bvh{DpAl+H5vzc
zGfg<I0sY3$bb~TC7h87h$49e`Nv=1oOiLdCMjR5B1_B)n3S@2<lu$5M%6VI<|NYk9
zdi=Wy*n?jDUj=1h!jf65P4RIs`(qoOjvB1)X(=~1H>uT{*AE+OLE;+`Eb`$>Euj)f
zZ#ADU|EmPj(_6oDb+yYG+O)0D9ZpSPaZ<K1b1Ge=H~Fghz(CBD^*qXF$$BK}A2cB$
zV^s>2E1(w9FFNqn7H71?AxWGj$cjX2G5c@YCSktp+1t>a`1oBr<FN{OgoJDaOlBrV
z5Fr@VQ)@o|5W3JDJ}Nuli^y7{PDa`PT$NH$vwyk3N?RBUfo$a$6j*9jD~rkH7aiW2
zO*73PK<4H!FwmQHnvMHqrz=V{Ten@;Gyw&K#_(>FqT1myekCxJV8?7v$tYCZ9r>R|
zSSjTLEHu<t(`^z;Izpam^QD8q2s9Epxw$5N4N1wt%k#Ji#_`6B8Z+~`ywH~KwWT95
zxWEfv2WVmT>x20{BdPO_RW`QPSzp^XrX*V8RLqy_J^tpYH1Ltb?3gahEtjYW3&T3>
z&V5K<A6VBAqgiZnj!6wkVxq3!Dfg1Hw%u77X$f0_$bdqpyXSF4R#sM7_(`)LGSbn!
z2%OMN3%5>_z12ho^U6}YQ{y@ss&6p1jr+4M!nrTVKGkm0!@j3oIh?O>)c5q{t0a~3
zat;tzySJWhcR{vV1{4UOUw+IsQ^}Ez|3?N5&HzQIql~km5YAd(WCBWRYHA{yiLr*q
zkcHa3$bqe#tSl~%Q)((sH}6a|T-xZ4>!_6^C#w{EydX0G#aV9gB7A=lQvpz+H7bs3
z7&_lidf!;-==d#PDY6u3jC@&Xdz_NEq7f$~w~mO6G?gv&G*CoWz?MnnWoBmiZST|H
zeCWE=<kkpU0pO^)z{8(eh7rgX@Jk5(=e)-7^WI1T#XdKPCys;tZaHN23E;5{iZZRr
z+{YpjHCS0KC-lHI#UynbQl#1HIG@!DDg}XNu{5g5v8mHuJL$vC4LVJ(^?;dp1K-)*
z1u#ztaB$^x7+V+_`WbT-Rnh1g=@<heBgT|Ov^-B^6J!SkEZ@viBO*{xFw~|UADetQ
zua}$La<w3#(86zBo=>6w>qUQl!`33FtlZ+UtDfaWf3I5Wj-jzKR5JkZ(_92xzt0K~
z_xnxO>hFU<LTc)gYjja`Z0vHA(c^%hOdPc;m(wY~<3X4>P2mr!^o*k9<mACrZ9c$n
z$oIW95f2Om)LmL_C0C%)jjh(=1<|CL`u9kl_FfkHOS%t=$^XUDU?>SdBbiX_dbfSa
z+382B=`NADh895vG8b8w`&6xiUFfh>9(MbKHyFgk#C1Zm0VMT{>EWwQO-;a(wq8le
zV!py)JU=LpkjUmC4*WS7(J|3^ARX`&e6S*n8-gt)2SmgXt%hFo5GWjUyvYhRgdEND
zSn9pQP1%a=`$N;2hC{az<jD^)9iQ6ciqy4-9m{E6y@I6|aw?aSktv<50AUtJwDA(y
zA>b%SN87XGBK$k>$ciH(vgOF6R+w(6hj27>bcgDhJ>l@mX-l_gq@_+ej0_K#X!L|r
zYOt6QpkZ-(EFS<#Z}ans=h-aWL1zuVc@-1$zFH#7x5aRVHwE<$*P;Gp{tgR{*_ceT
zF6jgPTf-f%7cO=fobDu<m8SlVG+X5pWOHW1V8@PIZ6f_^V8%s1^k}YPV|_}38~?tp
zNYl|^<b{}+SWaZi3at>#uVxJ=TGa;UlbtmnOsptBk_F%GGL>gJ(bu)uV!jfqQqf(l
zU%WqrhB|jBWeTLR#q6ul>Fl)s`~9F4C8e6AsK3Chv6TP)$urL)$Q3Gp)wllN{oZW?
z|D_&5y+nTTU$oI1u74Iae;@SW<lX<92YZ#oXw2ZV+a>4cw}0xexL^3JR1KN^{-h79
zfKa;Jip}7nXsJ!0#1V#jH@yG9)AyMjOlwc*3rGhzY`V?>d33&id+P=N7D>-@{?sm)
zoG)GEST}S6bA-q4mh0U326YDjC=L;63$4;x^rqXYRN@Hm<m7VBxICJDADMj-Mfz<|
zw_}(WSQ%Q|rW#pGRvNn$YcGN?T8LgdH+d*&MkS`QbQqQ_t+s3!$smQiF{aurtkb=Y
zT?VGuM7H(v`-$}clNfR`94?d1+x<B4YWL1d!Rzl=*_5EtG|t)ysieDS04WA0i=(9<
z`TkK~e5o$zr+a#iycx{OyZ9M>P!*jVy!eA_o6H|BsNY|rFF>qNjDpf;>%Dh>?{J^X
z#d>~V<k^5zX_6Yt?K3Vv{~(?9+TGT6NaEi9-e=yBX-6Q@n-sXZKQr0&RdPVwQ;m;j
zY}HUS4^9j$i1j6n0Tyysr~Lke4=}%Aa2>5uxb)no+9T4i@KEI&Ie0Q7QKO=iE!8yk
z%&HAnLSZk1F-PLBJ2&PEiuWB$mL+3mj+TQZ{8t)1-2@e1k+5weN&>+uIlFDM?Xuyv
zJ2pkaFSA&t>TemD`CTli1lV#6OuB&1bIjhLBd7hlPFP*s^rCGo>B@YeLGRyVDC=Qr
z-?oN<6`mMHOZ$m*BxWjHZq5H;a=CYCWMFV$cyQ=0`W-bHtwmAM2$bTiPj1*-Gu$fk
z`DCQ9xVLN>`uaJviCfRivLX_00M2!ZxG$HzFd_0c;dk>{O+};Ux1UGSc5&X>+IbJK
zg&>E#F`KHo6@~m}7-!IpSUXp4m{oVEdpz+}cTEhC^MUISF3iuPQEOelHAC)K$eZEN
zU({ha<e=x35*BX|>kzJr{J8epyzTVyPIk+!G>kLsAS5t=g(1&OeT6N0+WJhAqlVWj
zW}r*Jcs55`+x`*t#PBrumSh1L5t-9{yDm4a7RWq_7=tJ>$$*q^yd{HMUr+Jbe?P#N
zbbF#(QjaW$;HJDX*Vfj~{C;6>&T)Ty+41bbWF}OHeC{hB-wT?ZwMr58dY6<U4z`7B
zG)zhl;RVJpEKtJ%%(x&k1_nl8H$1)T;KU#yxi8@ka?%3WjCN)T-Wz8YdZxtBo`Dq^
zsK1Crv}9awZ>`xfI1=ZHlKtd|+tE{o%g#?yA0A#N8cqK+sbFYY(&Jq;SwHz)#eQLP
zeXy9qqmZ-nGFxOMO;#5`<)W$Uj<~xYsuqxsc$}~5(zMdhATn4gMux^77gx!QCLD+3
zCHNdV4K6fHpOW<uYIBiAka75a<8rIBm^{sHs39knTyz11hLe_uK%&iaw-yO*ZnVL}
z=$M@{HMN?{UIx`+_CPIQWt-1bTmt0QH<kA@g(F}%d3dqogz{K4J~3wa>Q4hcZd&Wv
z`y;L_k=znV=HF@7UPEbotvevivh5*Rr`#0^L(z^-t{&@xq4q;-Y_e}+Rb)}!q)ZO(
zPxW-iJZ3GIkb?(JQ?Qk%-&=I7+%=!5d2~At15(beODmohyBa61Dnn!;T;Q(B>Np0z
zHBfinn<$3d`jEv9tAA5OcX2;?s&jZQd1}5JKfMBpoTm+22M1&2V{+wVRFL{2wX)y}
z*cqxOX&%GZu&#HNWYUcucjDDqxJ4u1b;#vSzL_ge-*u97Dtvc6CUYd%o0>XW2TA5u
znta;7(^9w{&Sq%T*A5{aR}XWKXs84=7F*rxKyLRs^#|@<2tO{H?(F*(L;_x~yDqb9
zHMCrsq~_6$Au4#HmbC5id&Yg`L-A?N1_x$3-sjbvB```YJ6f}5zc=Tu9$m^A_#V;-
zVlU~I>)KCBBH)}4o}#B6r<$?>!M!R~5%3P1zE&f^C^gPlGMjy^*zeVLbkzO$8<aM|
z0IFp~&E~xKO`GS~oFUM2p2>{eWz%^+&{T}ozqop64`zTokWx)7C?{Fy;`sS>L16(5
zER6g|HfluyrQ*6XvoU5VzTba<B^RK^Y~M3~T{#u#a$7ypuLV0|XJfnQx^Bu(9A}q)
zwN=LA#ju8AfXxMlzP|#x6Js{}yV)wC%CKa1KHjSMevK+uljGl^7uI;p{zy__0^uTI
zj>+e7B3Sm=J57G!O_=}tMbA=t+<Zkrfjs<R>2K2FJd#3J-Wv>P*%v?&4krd@9}d7q
z?F~u`ksY*E=8MS<nf6s_u3dV1$)Hlio{<6SwFFi=U7g)PC_6Fc;LEDoF%)W142EF2
zXqES0k41aBqavebF@4#Q#-~RaCQB#g8qgfr68416+L1cS%{TTi>@fFDXDH1)zHRN}
zO#Xi7hlB*)s7UHO7DFenDq69b!y*660zdw4Ui`Nj9x5ukaG$8;U}^=irtieAoYPaR
zSr|vl`2%Rz#w#-C6swhBsETABZoa39XGmIyx|0PQ+DHZYS=SBMOB4Ow%ANW0bF$|V
z$uUxe5Y+!_0S=!{c6X!AWbsBPYB(+El;o{iOTPb>!`CLADi66-2*c_UD5)}?|B<>s
zISsL93lI|<Y$Ye5iD_{Ltj3Fv<2be?bpQk!t(j$<B_S&MHi2tzHJ>O_(^8z$N}ob6
zQzlt2u4@9Kz<+uJV`UyXc~NyfLyKsGr&_Qz<W@5g&Hq4KS)eo1Tl!4|>{A}#;1SMt
z!_EM^k#s2K?(PvcN1SPLayR^osOk>*A?x8>w_;Rh=TB}C<niwb@|W%HQ!6p|7#1%d
zl1$f0D3@)%_eY*FtjiCU5>wH}BqSZ8Va-C#6tsnD)_c&<eryR+pt~aJ!i2u(C|}~=
zo5hk5ZaxLB%)5?CyP;U{$)vTo7RqY=#Pbo^S5={*qU8m7-cCQ$y-E)ycZf;Iup^ws
zDfubrsm-I{BEywhNLe_^NWXbc%L&^P_vJZ30x~l`u1j@WBBLj-*GJ4RC;gEtNN2U(
zDt-!FAVeiS%@6MDLDE)ZQ;vH3)y&m`R9<%&m&+8^Y7I6@Hi&L8QWQ*5eSe7jbJMQ-
z&W%A~$;jCFe7b6N;TB<he0*g-B2rvjD(6RP=n<gvA*JzP5@5^~h@D43`;PaBbFMYd
z^hDPBiiwIV%F7x!ry<1^qo8084;0=xe*wF0;0i)lRdmNR5z8Meq7I}dZy8gZNZ0gf
z`3tqJ5?7SjeQP1{#X4PaOeLa4Xvv~s9GT74{+qs3n!nOO&3z~#&a~G%Lyl-x3?P`j
z_^nN&<*_vHjwPO;)yEhE#$ZpnkHX*PlDiQ1aO7CZ0eet*8<Qx-j}rYcq=XGjJDfFU
zglXaQw)1t@+JrkY1<_fP<A{aJE-i$d20+UqlCz_Ue8>LTWs_}xTAB4|Y1!#vbyIF*
z_e1yy8SkCOVqbxek5*cw1;{2SS*j^dPhY*I3R@PyH`||Ht}|f1$9yD7snwJFDjJ^C
zkfT87M~b;JJeoy_%X+kOc6FZ3yJL}9>$rFL;nOF1Q>ERW!H`B)umB72f0Hz6Mn7pn
zuOZV)Fro?QQ4t!-j>-xHq#Y@+6Qr^p2KMOqgEy;>5uuCmEcDpy)~csr4UJ((yl%VF
zubsiB0w+QJtpkptE#C#2(|pDph>c+Ekufao^4xnmF#AUT*vas3+wg8BH|V8e5Du1g
zr!jH%w!u#CBkptfWEO@`R3<7z6h<o$Bhzqh<Ukbsx>Ewp9`yOAm$;%Mq8!X83*c)2
zfx+O!W|>=%nZt=CnJeMNpXh{`-K&GKQ~cL+cAtA!#fX+xn#|?w2YFir$-?{1jpLs(
z-a6qh^y;>4H!mn#Xtdg08r>1`^^D~Es8?*2i7p?~|LlLCQ&qH3Jvw%SF!N;N6r8-c
z$h<H;lEje2jrg5T;E|)MofGLeh1G?$d9#rxwPhL5g0Wg9#l?&eKoz#$#pNO{iThi4
zc)V(XjjPje;4jCTB@s5{>^#G{oT)A=I3<&J%6rWNef{-=@iXa`F8W{4i^qBAbL}%d
z_8kki>9U(=9KIZ{-(6hT*Mujg($bwDu5eyH>_$W+l)D^X2^fb;;d6^=E4R30=13UP
ze)Ytj_oJ#UN@6r=AXcgPQJI&Y*VWk-7-&1IK+oUa0SJMCdrGaoujZWg`_Qv7qBG_A
zl+>7sHWs?&Ga?fDB$#&gUGM)at;16MVRu?3epJr<R>ZcM*zoP@N50)W)BUpv=kqY4
z4>+AEGs2y`v%{Z)#|c}eht!X_nw-{~OrY=B9Ck<ZD|lHLo<jliEU)*%EsP*b9~T%#
zz=%jjS2sOAZDBNb^IU9bL_tO2Cn7Y;mx39RNJ0MaJURgIKwWHldKt;3e{?9K=PEsM
z@ug004{8k_;qQt?HP*HuQhuHC@(SI^xLURWo=<6*#p>ccZh6dxFoy7&n}%EDKIygK
zei<DuiPl%-@z!o<vVm0Wi!N`PnVq)QCnuv>hSbN7YjX)kKy=m&o!SrzMzi(fS$SpC
zzI$~LEPj}jKUMvQKxfTq+T6L<oJd*rM5|_PPaA$aqQOc7EcOR`r$M=ZSEdV9pcI0@
zmcfA9DfrY}jES{2irR|IHeSg{*Ho{9XHDH)!O6~8tV@##c{-+=wGAw_Iw{vL9!>*n
ztn2q&sz+-AN>o&^uSOrqkVD??Vdmm?P8VzdV$z)V##ZCZ#cO~knD~9RIvSpX8A2h8
zjD%2Z{8iLT5rDJif|%#4%^UYmmbYV9EQ9&IL~l|fWhKSs$48zS@xMPm(O^^T%Fp18
z>WIVHoZ5~fPQQVC?8puN-5LQ1>FzVRhEdx94uA4^mfxbweOGwZ`IwMh52G*{k)s0z
zrfe|($=sLsFm5ymlV}Y0_2uy1f|W#$JrOyGOR3HEq~YF%$eO*D!PnsOpl!^&Ir<EW
z5Ybgkd(Vs{j$Jpuo6_EZokVsTCny_sU82ZET$ru?nGm@QQch*@^9&k|z_a;mL-5(A
zAWMMiUIy>%8Amm@##7Lq*x{)M5nE{(z@V%JIy&MrCdCv5vu>!vB6osLw>uUhnSZ0`
zzWAfFtMHXlSXtQDQ*>-C?ubQe+1;Itie^Y#aH3e>_>Mq5kwsEe{9$#2-L_4(pvrV?
z`=B~Vxp;oe&-S>_2SvJRg``X1Cvh$@@_XK3{E?XT;B}$kWFAjI`Xt%Ny6JRw^i~4O
zc;4@_0p;Dh*S-V6w=y~{vtH{b08g?llOWY2L^<9I@`nfk?yglSZ!z10ED)EHK?Up?
zrekm?6_sWzS9ZXTIJeZe&pT5azr#1j2!LUx$HyIyHdJke?*b}}#?Al$;xi+uT=W;-
z@}1ntDbAT)8ZtK#jr~yIv?0n3ZM~kg==8SoNvSOP+eL+aq)*~GqU*OOpCm`J0UMp!
zN{L}j4!67U`mmN|#oL>%N)WLtE}0XYAW8>9Bp|0()wyB0zf3v?YMliN#y;j9r8o;%
zlH}%~)BOrHD4J{d?uq13u{YZ&fm{$keK#fUw@)sVAwYUj`TZphY`XeXoi`B)r&Q_y
z#P)Hu?#=y>7ow&9^~3pneDn<xDb4mmNRHQ@Rm)vbz2gV!kNvVzP8El3KiVJ4U&l3E
zB#d^n_uDMkKktNd6KUeiu+*r3j!vE79HE{nA{ODIpbEK-5OUPty^Woj2z-tA+0qhc
zsWC|O3~AhSZmx^R^{2PM7dgTTW5^MS+0IBCC`!zs-Qc@jB{b^Ei8_;e;O3i2vA==A
z!*#TPLqhoNlrPf!ZC;ad^t%m5Ny~93ADs^2@{&N2g*Z~fZ8MO%9I?Buf@B`BkFZ*4
z(7H7Pe1G2FKMA)e;<|VC`_(2RHIKNCXIg}bUvKfS5<gI~%-30Z6vkR8jJx!}ZwAdf
zskLUr#v(bm9-24GwdqtCQi$aPKmFM6fUHRaC6buoL(b2<7OKyGu&gvwTl=@{(p%sA
zF&dqS?v2DH0+s8^#LPfh4WEtFvo;{$YG##W2=n6L;3UzgHXB^e7yp9!g&tSO?RK$V
z?dHzkzQfmH(ht@KU@|eQu>w6bIX-ROsU{N1v3%B`oROs_tH$6erkF;@9nB~4aV-7&
z?@Kk0hgsQKfGwlrE-)P_8H^K+M@~%5u(&u|RAj#~c1}iBTcSS@G)<ccnM2F1wz6P0
zTW7jMgwUHp;p3=Ro-DknzTiU#g~PAEGxM7bw)wAA)E6*|DY&uObl;0a>ra$GbJ~ky
z+_;}Hj&^OifenR-eyJix@yXIUQD){2-!Bjt8ivPK^uun<1_qJ&GJ{_Wo-I)1=I&!4
z<7|-p{v=EKtDpGOOw>P|ULGG2-S5b887fMmbBf~xh5j0?{1w3Nc4poufb{9pC;Rw7
z_-#@nbnC3FY;-9?@evvB)Hu8yCI*iAFLb}OzHRu%nj7{7MOZDjO7*OP&)oeM`_FVd
z?zttqOwZ5mp@%|~%x;gy%Yv`AuVihQ=~jFDM#JSO_Lr!v2&JoRJa?Z@*9+aIFO$@#
zE$I(CaV&(G#hH#=d7k%Y`z0o7BmyOxZucydTE)Id=7mPy`F-UzvFV!}yqLbk@mTqw
zqWFo4v%z2p?s|V>#C`v3o=i0=CTi&HPIojFC+YU(Y&nUUWE|aym}K<$#JOf2Jr$*R
zu1s3dtSaoQiQ%avi7DAYn{#v^VY;$KzRLOCwL>?ze7VqS<;VXDl!?ctM;pLS_f%r9
zbliug)?zu4K(edM%l;N;b|!yw;A1Fs(8$w`r-!HjTIG7oN`;kQ`-%t)?A5MJm^@mX
zrk6Nj3-X5><q9xA2q4!Kl@_YFhs{PcB2~hO(K>xedxCD!_$D@l%i3&nT;nm5+Qls0
ze9!*qu_Seh_-!_bZMK*^RbEjrntSVaG_1qEl}>%R;#NKMbE}`k>7gy0A(cjKsXnET
zBMx`JYwe~bML=kptb2EAvb=mLEw?KMzAc3?--31SpN{7i`C9b51o=J3ChGns@s_Mi
zVS80`^w!6}dr=MaCl4KZR5Yx{^OI$|7dn(S0pep!XntX1GsWB%r^&Uc#~`(Qx2O9W
z&B(wwwjg3tJlZ^KJ?n`eKcwT<D=oD7u({HswE?JKDivd%#~x8owh{Y2QuG-M@{7UI
zCb^DA1j}2<r|K;{J@Xz`O)~v@CYTox50p`ewj3o8m6U99IhJO{T}EcXHc3b^W8rna
zi?2Ywo}tqLf?~riSPMic*z~)}I$hg==M`b&3FT&7r=6vrGgbkj!HE9w(gXb`K{p)N
z7o@CKVS~vB-aD%~utrv`ce35TscEdtrtdt;RtDO_m^}6yVkKeTep{w7o#;T87}mfA
z(r)Al#7`v!^Ly>TB9Z4{5j)W_?4qJB{SX-wc~aVuYzz%ySHmDr+a#Q4{MM?yV8+2s
zP^0&vPpUc8-_ToeRlaDV%u5I5q;a}F<)H%SD^NOaqm!4F{aerMJI@ibski@<VJ5N=
zh}0%`aqgRHx<7q1Tf%+0hn&jQ-qI1Xs+E%%--)Y7%}m1#01f%XEIPd-rK7T^)q&lE
zfx!Wvfy9C5qRK3$p<hW$DP}E1=<d76?&DnTL$?`5$|DK^hTKS7S)CLhZD3QFI1ZN9
z61wol?m+p*rOBLXf&v?LT4lWQQ*VO)L4FTKeiLr3+-$kS7A$o0d{r&)t(V^4brYwL
zfUqVdBVCe0H$9#_YLgd$eKt8E?6hV)Cta8>{+Yg5XmfU$x>TS3?6q@#)>12yIo};(
zhMVR-jLSbFT3J)^Hm&f0;k?3g>`;AjzSfJ?q2S3Mh5yqhLM+;%>lvN5ZG^{NxM2Wj
z=_lk10C-4y`-_tqpU+=sw*ILklUk|qnpsBVWXoVadX8-sRd>Bx)_<*OMEef2Jp^#A
zS7knSzVU!N;kACSR#J@kzdQl}P#=7%fWvC8xRnEYjeGKteGgV|;99d#U+MfZ@^`z1
zFhkcx(s}QGHPknxODU!l;Pmthhym>4=r;XrV~5oghdY}auiT&JH~vicfs94hYEw{q
zk41;XCU%wBA)6i^W!`_({Ww?8&iC<;@fAK*?obVlx>l172{E-j*gJ&`(c}X)1R7_M
z7Q`}_E_KPl`8egZlL@q;p}`D|cHeMzalVv|j1H&U%m9StV6j4XH<6Wa8PA4$u0o6v
z&c;&J;FXj@ZE(`X3q`e%`#xGa+LVMO5{>fF-zB~!Ke7(=S7sb0O|kP#TM@3zOus7I
zQ}nk$be54VCZcRZ29wQ8%ji6k=FTjDcu0dUdE|?$X@z)hcM*+e{nhp#<ELZP2?afQ
zG*`={$-cU&pI46qI;_}4M9m)sQs);G+J4V9H`?w8YFk2`;DUWi01CMj4hsh;7D7*n
zsEhAS9ua}^ejDL7NEL8QX<)y!p=KvA#^@ClL*AM2S~>Nx4>njRkmBZak{J>8x_KyH
znD7h1Rd=j7a^Ac+6=$BUlG^|?k%AGQ$*-Cm<y*A<{VDCnZ(UOhtWCVPqdpyL7rV=a
zlT2U-K9s;UaoJzr7M{MisF}&(Fc+lU|EVuVv)OtsdtZg;##y`B&c~GcnFns>&#<<?
zE&-3%`t_C_pDy3Iu$08m!pQLQ#?S!J@%WG-*IF5pbgwNodHGQ^5FUPbZ46>y!4e8C
z+t`Ty8SXm@AL-qt7n_>9(OF#QJN)`_efTn;;Lx%?#uoi&RviyvLRGH9o;N*4DIV?6
zn8{1x$Ky;ih`5%x3~BHlwbHjZXr2ZKlxT+>k2TT={&3v%rfLFOna5aIk$8q#d4(T7
z4tPVI!Cy?xOcoB}VLTH2H3NT9D>%VDAX~C;R9GoXO%0`mhWb&|4TIN7_GIR$9a>QJ
z={!g%m&{tIbDwJW^N09<n@tb*Pme$d@q`O%MWcw(rep@$Sq8a`t@5_Y>hj8z<A~su
z!Oh!?4-tQ(*vB%;e{wed;??$yzqE|Mc$k&Wei*?Qlz$(z%A2{pjOERMly+14yKhYI
zQ-)?Jn~Gvakw&4Stfi;6k+!n1rK7ZGNmE_0VX^B!Z5{B;2P)Hx5M-B`0t3<>17cFc
z>|aJA5cJK@y#F`Ju$<8UBppxO%p9v90yWuP>HmFWs1LoSJMaIBgZ|!5bbkClN;@8%
zULwh%L^M65H6X%&5vzBp&-ldbfv)}UEAXAJz_EeoQjnbe-rF=XCW>SjMgQNszPx*I
zLXr)#>$J1A`+Hwh5*4ZM|K9Ek{e#o+YIs~skhH%cRDqZxfAEhgE-?T7z5Q5iwS)D0
zN0dcfijISylbJIF^^hE%N3R5fkt2?(@cExSs=pTPLtY0g43m=RpKPpbl)*1<;69G&
zYQn)$!2L%Qe%0x9NQyE^L1O^l+<KQ!k>?)-!UM#t1#O7l-joABR1tt@Bq#55s)E<f
z!u{XdZ}HCF#>Iw5j)#j&ONjM}4)hHT4~!T?c?v2DDkc+=cB7OQ{~q}F!QSb&R;f!L
zI_b~GE8Y_Q?}t!d5Kq!@eE#=!piD`FWnP@P0lY#=vwQ!*F_B90LT7~w<VtJqPGn^1
zh`WJ^vVUxR6lae~UNOt|S@aRQ^?;*_nf7B%s_tXHzOfBSouQN(U|3xDN?+H~5!Xjb
zH@~j3Tn^1|3J$)YKp+jp;VKd9$k~#NO-gbbyd14mkuk_JIOMptT*=XANAp6u5p*M^
zqmxk=cP-nn#xPVW0C{M<o>$iH{7paWoShc5jSvU_mE(A$g0uaBfJ_s4V1TM9xwRy{
z?CZkQP{Vw~<vvcU`~K72W1))zmIA%a_1dAt%*b`MU6FIr<YcS|?)|kb3!|m;-FiS2
zBn$|ZbBY3%QWpcH{MC*t*g05S_m>eb_Y=q|$YUm)ZN=q{jB*+hg>9td#ZiY;RaM&_
z{P(vMKqhHY+_9v%v}&VAbxn@6mXE7@Zg5BtyX#$BmfXao;uQ3c2jtX6R=2-<#D~Ls
zmdm4~FZIG8)N|f~YHw#MB05^{-$U~RPPSFnH$iVh0>aA8XAS=J&pBM~cL6V;n|p4_
z_px955Ymvu2FC?)B#~$$%2)t5iOUykTibvX=VZ(msNqs_&LJl=c(v0*<l6ZkN(J5a
zo;u5~p-BD@Yi}78*Vc6l6C(ivBmqM3Bm}nr!7V_5;O-V64Z+<S4G9q3-Q8UpZQR}6
z-QDe5<ecYz?|ZB6t@p?6I(2@edN<vBuQk`4V~#n700dh4W3cn)<j91XtJ8Rz>MiTH
z#HJUgD=FCM@ilhiP32=NG1!qr(z4PlEX)x>;Ypr9^KZxI>x&=yhhY1o;(eSv>C9SR
z|B5AlQhGd`8Tpk?Q&RMZ^qm$jSsxK&KVxEtMve1mk}=soim&sgZ+?MaVs~_FU9B*h
zK}VRtW&e}hQ%Bbb5C#QjZZADf3Z^UiVM08rTlo`g%A1s%paX$r%1r%UPFdKGMpRUo
z(cRt43(_m`&L_JQ<|QvT%-84^)%jzr5!z5n@;cp*lEJ*qCQdHYz6*MFP}ZkMB+7Ve
ziG}(4!-rN+56{dTgYE?Qa!+-{&Xm>ltMiSMtB6)XQlgsKyx2Ns)=w27)@yW{H~)13
zAto&};7j}a3)0}|<K#b96yg{9^AZ^eeQ=C%AN`PpnISAFJWT>#Q^O}?q1_TAE-D%J
z0t4LO%scWcU>J`?%fiM~3H0SZG&g5-CzxGtzs#@rVxS_TEZb`pC4y=)0XvwC>yk?p
za$ebki<R{IZovw6$A-KJ6qX$5iw0D1*>?*PRAHN+s|EPgWrd|l*htub4dGN@iF`?U
zV`F2mTE4K;QE2F2sZ$`>`B*La;Xa;J#b<PJRAUboM_sig4{^Yl0pdKM8yyxFY9Dq`
zG>KdGDrAWbUqachLWA9YZNZpwm?f9TsS%&jjD!TZ0a%q<?Npy&y?ou#-W|9Y&L-ua
zn)+SWMj_)={nJQkBXQG*u6T>ME>fuT!J&SKs2rsa^M3PgNj#hgJz<iLgk&VyJZCQ>
ziR&#5$qmzo&&t9iBuvWU0=2+zjhK@3JvBZShWuQAWIE9G4Gs%Wv-|T;m?wYm;A#CH
zApTQPQ-5)<pGUA}%3Bn9=b?B(vhJh&%j0LmEwY6-1T^T%BmAtfDa~%-L*CiNlRgoB
zR@TSsL4l!x5ivPRrxi(*A_hrX4eA_L8O2vI*g*HNo6hp!veG7RlB$!6`BTw)|LE#S
zb%f(1wDk2a0gZeb3!?LSs7!vT%U{4)>U2$wTjN8Jp?Mpv=K(d5Cu~ptS;7Cgy?1JI
zp<vwch>7(h$goM7Mbzc_B^0>ncz8%?*chpX)<Rem-9&HfXQgl<fy*K?9LIs-;aY~&
zVl*MLAz;a7I_?b^=Zx<7NFq$YUAjUqFpwwq6Th~V$4$r2>Uf(3EN&dlR{5dIio-P(
zz6IV*P-W<gmRMSFI&r@l&Tq06v}bewz5Eymb4G(spklBZ1=x8ZP+fQTC)py|^yUMS
zT!d7V<aH;GI=X{_|K40)^4j%3<Op&;^?%;dU^Nj*tlnPQf045@vn%vY_72i=GUbu<
zjF*^Tn{Wu&{?wm?L4Y??q@Ll~H^Z)KJ2En$0|->_cE=~0;0ZOxxkgvV>xzyjVMrxH
zXB)ExPBH!@WUDh?r>pkBTHpa1|FJb{WT)N1;RXn(qNBcqobkqYR}g`=FL@JH@87el
zDGR3=AK5rLoYHO0($X5PO{rL$yBsBlSnCC_&~1(}nGB?kG=w;8jp^@SpD+$xu7ZGI
zZ*N~)eF6btah`{g^VA2PPWT8xO1R?7lX;dOlbIKbBS%o1BGc(YeGo<+3Sgl1AFL)k
zi-6C^2X?{t-;pdt8eTp=jA5y{nVi<$zA|B<bO2i@HPlznj^}#;{U|?}tZxW))a<iW
zHpt$@i!jxptOq5u9-(9_YTO4BlCa3ow;!6Tzh$TjRns_(N#Zlf%ZgKdY`?1=<M=nm
zB>;x%XY1^F9DK2X&##_JYy*-MW2W(VvA*HyWAB>l8gQoAUqEqjaB=XWm`jWr<etLF
z&VV!T_FY&Bp|i6xdP1dowPl({9F#q}iePfGP;tT$?b`A9_yNfi2mwtTnlT4OJJr3+
z-9C{!BP&9p0XXR7G62GMe_Yg$nLcOLUewO?NzKk}L~uoDB%!?jci`gF(%KeRWp_GI
z(k5pzmYrAP!~+o^Nw3=BaNcjNojRR?qFI>Ho{WY*VFdP<uf-D#wY(dKA7nqX{l_52
zHJXZ^UJH0DVd&n4#l)02osdG8SHA}&Fhw=~NnK9$hLvcot%6R}#=^lWmaNm^(UGKv
z+0Co@K7{&!xAT9$ge&gmcGyvho|uT3uu9$clVfui{miT(oy&8IV+PuH&d0u9`4N5c
zsc|5gQ6!q}{3<Ma;dRBBepzF;!%KCsVu<hvfyYf$?(c^sdUSTtC9XBPx!uRXlP6D}
zfFToLz6#BFzf)0n(B9i?GFLSNnzwXwb-mr4%OYkIuvrHu&?8r}0;-EDW%8k+qP^A|
zt6^Z8NmmyV#r*L#2KE(PS%k%gXrd2OeTpvtz=~+LgnWJpRr8w%r`93{BEO&~9Hr$3
z6QvhtM?kUj;&MjSXvu=X0yNci3S5+{v_?4k&VYSOaoO(I5E_-*;h{c<!*=u0ygcvG
z(|hQ@=Ee~icuamW-5H+Z{qkj5)b%bGas>E%XeN{5Lv}8Q%7q4A(cYW8)-_Yhkng(j
zbv7G$Ygg^-?d(uQKvVdXX<UzRjrK2TIng5-%~3B0O|L*Bc7p+?oRZ#q>VNU%Nd{d7
z-0`flHM^;*g=%GGnQE|i3A?6*nOYoA_xpEl=t1*Mk0{_kWRg;_>5qh;uvM}ZGcYU!
zEj-}8<9XS%)RRN3Cm{v8MkhO-wvI7iswM>oaAPSVGgC55zbi#h!nUV)k7RZe^OH|c
zmpGteG?CNg_Bp|fgO34$M&_sXA7H5U42d3V;b_9N;}Q#VtJGw4u&eJ1nA?RW`4TZ#
zT~{iYs_$)VL1yda6h*H#y0DKFD~(jjCHTeT9-NOYy!uD)Dl=)9$38GHloh)FhrqBL
zB)$O&H)E-lvX#NpafUE|TvkrncekL<<}v!fL~~NR_Eh?%^blft`08u9qxBZq(>$SF
zNs5{NoHUr}QZK*i8FS`XqFug&<n(%Fh<qE@7K~uLMs;zIky|8roKKWLBxTil@ISl&
zWKfC6U9keG_uoPSQg#h5v1V#brcOs<JUGy`?8pq&D42++DnQpZ+URao9dM<^o~YGY
z#>K~N6SSccltEgcY|51m0W)BlqBDwwmHPJ}Dxe*<Fs@1BFzWwV`W$`R+jRB3e$N%`
z<LrsC*t>SDVBFx&`!cECMMX?)dbjBcFN!5q<EHtg&ech&o+$<%CT`8%d4p{{5dgI>
zngj`}d8o*#Kbn3cr6nEhE=D3DhzGtd(DtugU)sJ5J=PU$)yAL2B5xHu;jweMb{Hr+
zo^JQW{?i|NSykpUM+qk4S-A}L4T@Ooi#{3J?JoxbmzlkCpD{ar9ZQWRnL#XLPPei1
zzi6%+4mh@Zsex|fF)-x$!IOJ;r{_gu`r1|V>A&R0VJSyCY2`W{MhCA>0C-Yacy$gX
zOAE}|!}qv`iz*HWjxuIAtSOk%GXH#4_WKihqi|n`%_$;Bm?MekDu8}pUwbe00NUPT
z7riTI>#bp${L~6harxUhqt!dTmy{}{9?_SP?}&Y<R=$77ah-b*k@+_id`1P-?ab!Z
zHUP7v^Zlw4+~yaOjnUvfnNK6!&P*n{sX;-uPl*D&uGf8;xk|_31!P=$5WOdeE-O>;
z!jA=A;hKSc@Z7XK{yyN_1N6mf5S^UXl~qMEhSiLgh-$b{P*A|}3-<u(=lPHKEW(;o
zzof4(M)wyMF2W4-4@Nl|NLy=uQe5>9<+p^*dt>(m-_O8w`6%9xz{CqE3Pmi$H3TIB
ztDWA#`u;x*FA?W$>;KOAfXK{$b4@~tp1_m7R(0t?wF(SI0fQAx8C_A#qpT2vt{j(j
z0~7g&ACt*!076>`3Tk1r`C)u=x>OB}&7L4SiHk_|c6KgKapMKWvbs#(lnEKD*8(<#
zawN0k+J&=67e18gEqUN<*_{c=L@QCP-R9Lw$)7)FP^jR6Dk2oIPt#tl!r4oqZ>_{s
zV)xE-e0`>D?P!cJbfdYsb$ujTpusPd)pjFR0OV1C(;}$53IdjOnE{uLiwdVtxreS#
zYmY|FX=I5JFW?i}89N`wT#Y?ndX?e_<jU@kL)5VFumQtea@##y-+El;A9hbNo<9dx
zc!nlIR57HeG1HaSo>`=hif@6<_uw!CEpzzAk~*jD!l1h-PpmK6SOvApV2Ns<Nn90;
za?L0DcR^X)cw@$Dwc1Qa7-+j3Ux7Q<0c8bD8GVNEv}CVMZe;l&MBf}Mmi5yItLw;v
z<Fq&?<JTZlIAT4q8LxJZNv>HGi>L&BCE%6a-qE98r*o7`aukXccA7u8JKmLa{W`vi
zCu40@JQ`~ZSPBhOR7qw}g*=suXSDb5Pq#7qQTRs4X!SQmOGuf~q~m8IAVBnFjxHhk
zlhJUFs4aZwY-4h$Ig{7Mro2zDuBL`FJBmxciXYtp2M0%l<r7nBx_{hsmA;RRB^C={
zKI>>1<maWyUn}(W&QQEanwW{_9v&UW9d!A2pn3@{8>3Yj$QOuNAO9hu!Pm&=w{>KJ
ztYR5~gW|h2ijIPQc6b#3$pW9_;WHnFZ)QAeDk|)@L{+uWGmlvr87XZ9=ch@>-OmvL
zHUZ{8{9_T8J&-7bsr-#le4od0eN(g4L4gnL6MX-)Vi@>4IXQBAuP&c~g2MjW-On)-
z^}P1xt_W&u42%ROTT)r4PL&6jD+jkb4kaGCz=^Co!MJG>718=R6bxdy6mwOd*4W?Z
zb{vwtdNoah$AbO(HMKH4G>a6N<$@aoT!zKMe!F}4y<xbXUO74j?ZFaxGt&}s0c3P^
z7J4SF><<i-2A_G>jw0yD$*<3=4rVxP+L~K?<5@&&v>$ChLbyg*B-S}*I*D{q1WJs6
zX9P}$&nx~rlN_hps>SGZ>*>^yIQXxNe_X1e40$}ScfqEWevoNyQpIECaFy#KRILN+
zV+>n%ISx%1cQ^^}Ifq{@+<5ljG0UQBii;cn?BcVxul#*}&MWcDc6)}GYrMJngP!Lt
zht1w_K?;vUs}ZWW_#K^Qa!N7{HEwStW5}W_VD*dRF<(Kime<zKcE(_Orn4R4a{4o^
z(a=J}@B--Vw!4$&72DC8R6&Izi-u4T8pqJlwZPF8>+wRhh%?-|_a=7Ya3dsR-G1+9
ztzQgtJfo#a&M1w;@is4$)qItBHM3lLnZa<y0Fde>ZY1u;ji$3uZr3=0Zd|tzdj_Ou
zq`{0vv{z%5Wd>y+dG(36k7{e}BN}JTtMhUXcQ%K{BgY}4;Taie()N?N8?CK1#P1+9
zJ_UP<u9R*50OW4&Cku#ItF#hO=bt%o+k!zVsYO@RL#e)~E2LZs%3Z7+MG#EcI9~4;
z#Y@+Exrl2kemigz04(^F#=#cRkzqO0+3FVBt=ug(6}5LwpNvPX4nu`Y6$S?A#bcO9
z`ul;0Xm6xKV1nXkn|K(U8~*f+KulCJBq)4is6eu0wWl-NasAY6QgbM?zrcm(Qp|@X
zTw%VmrK?np(XxbMDC5tcKaRJ@_ATHXnk=`!-L{voIZe$9nRwkEC979uwWq)^Q&_ZX
zwS4}rCwWP3XR4gXdGk#eh2Lb2xux89Os5_dn7)AM_d1nhr=!bt;h2v<+7t6<s>4s5
zbX4KyJFRY&C>n4F3QCpP1PM4^m#t|X^upjS{w5?{Or=Dd$;ntDPZcsX!3-i(b{JNz
zYFi=NRa9{CX}ymgUAgHDEe*{~GQ`JHuWyf|G~y=m)9}cYvZ^}VOn?1PQg;BDp&8E4
z^8|vCp9O>~mq{p}BRqQxDs-tOD}9qPlk00zpzmiO&=#8^5znr3>Z_CC&s1vk^+q^b
zPEIEJll7oQ#ERT(jaJGp9Uc*uH?yu&jYP9fN_FNl!eb!~4e!vW?Sw>6cP1htLM+eE
z7YH0|@F!jVh$CkTspKf+30PvE?oO>;<g6K)h8Xl}a!V47!QxFfq!p@oGd(3StTv6R
ze{{UJ(H3FpjE)@LY&pW-Vlid4SZu#y*_(wsi-ys0X;f9ktCm|#M4{wIMJa=!F<QMR
z{&CzAbXiTx#S@h!t2P^x7xh7p7}vUEx$O;f1qGG67Jc@RUpP74h;OlEWoOM+*_Kq0
zahjgitkT2~vD^F@osJ4k!o=KfWt@UTIMT2p3N*_LOULWhrqt)csWnB^p*Aqg47^=B
zP6<LTxK3Yh3Yq^G0YQ!G#;p+9Y>VC#YJ#;4Nib-rz$;yp8xSKEFw;7!J2tCM+w~e-
zGpGSJm|crS1Ksq^B4G)KZb$TKPCI-<cS6-p){(&HXuw3xU)|d?)z*dXuQ%*+RTHtB
zRoGoR*zQSpbqA<bTgdbAX`jK>Rc(!s&KHTWTB>#Ce%3yHwYaE%2cEI%UVd%TyBfUh
zgB!R!@|@pFHEe5`{(SjN|8Dl?=yh)jRD>l{MnNIG^H_j#f^?4SGturLNf$-qxaGHi
z$BOTnNd>>I-?<EN*lf?+%;mkOQd3fD2ie}7T$p^23Bog4FdMS3GlAr#x2fE})FnJ7
z)YK}oFwl;amVU6m|B;@ao|!(~VvV-^Y<C*MArV(?r2t$aH;buR$-lSnziSzSl^9Sp
ztXQz(gBbnb_JN$`-LBJBa;od4odQ8F5szK7M8}E+4W9Dg@d^=J0k9YO6!8K(A}EMH
zQ|AQ+20xRn>CDD#N{m;Qmz&%5wtb19KaPABB5_Lc!-o&qZFjmc(`Ytvaf!I?!po@P
z;6TVv{S7=f=97Mrq@|8Wk4GvI5fPmp|Gq@s^zrd=aIlxP@A9YVeH5q93#Q=weg9DF
z83UK@lC2S04Gn*rGV7;?Fo(0O;uP^VtQ^JP?(X7mxSY2$&5dFpPSY}j!SO^~zkdDF
z&jadKEzDi8;DW2OUE7@jKPn0!^gTS2KQ+`Q2{)!zEVf6PWkb<jT`h9i%K<vXp`oFd
z0(x1Y04k;=->1rB%UhmyKN=nx$qc@{llT=&&XM@pTPA6dH8FP&j|3Bw>v~^Q>A){6
zFf{dKZ*N;}?!2w3(5dce@GA@q;6XE#RP3bbV54-UoxYl0TB|%UvBDxswGZS3RH~{#
zx_+HutO4I$Twtu=esX(c=7o%K9a)j=wnR2-mTDT2OS$z5i#_%3xI^|d7*#>dDAt>D
z?@fDQP!r-QQH9A+Rq)xjh@cxA<p+vxc-Yu|5_D&0>x9E?XcX+py_hqaaXVk{PyqZe
z@i5Q8nS0OK=l}^x7qu>KCplAY!_Yhng_4Yl?D%YE1Bl&|dypF{JBF1#oZAaOKR@sG
z?M{C!?qk^4)Fj>`MyFn3wbNM^K*SA%m`CVyn?g&<k-YNtdQGN^{hWk5P*i^mr_yr)
zmaPOn7d_arU1M|+C+2<891cC5OiMz3igGgeoJNJ>WV0Jsj#OPrKOY~}u_#Dr!0j}J
z?+6y92!j&Nj5S-@TBxX~A}sYKi!_{|LT$~|mdfE^Hf{<&*8h@UKVfJWS3^5;+}VGw
zHSnrqPql?5{6-;C!6?yh@9eXPL3U~>=G33a$jECR&#A=FK*}W@owCxhE`y;v9~Yi0
z=g>dW(M|Vx|1)l|Tco&v;<K@l@o28*(T!@g?e^|gzaEI-;Jlz9gqHk>eMY#MK|y|a
zsoP1}NkNenE%3{cjD!Su2w=kMXPs(sy}Z2(BTNIqER#jLoSd8(6)yL$g_F!BZJi}w
zO0&-TJ3U1iF=25E=cw4&+|<-|IYBn6x3sheeGm!?a>`j3tAg(&1Wj`#hJE=?)yK!j
zv$akz1AF^5%zjT+!`<B5-WyQ`jcSY9JbAp$k3bFy9iKB$C55@`vO+%^LKPvs(33MZ
zl+pcTyzpHbp(9lkk+G45jLe1CD<`)`7cyXjB=8#r*={Wu^Y!cWjGMa<0!EYPT<;s3
z^dw@^)J3PtOK6-v0TsY})q>qKn!E0^yhXgLkgnj6u%7Pr`JKmFT9hBiNFw5s11at{
zF^~((cc-hgI}YP(w<#@NBi&b;L};Ll`h4<ZG}(Pjs6f&=ArqhQb@|F3FHUb&e9Eux
zqt`vK!qVwVW1)j%uylGmyHouqz`pbKvwzy1$DvemRt|)2pk{M<{GO*P)c!!)yO~3X
z=jUZnkhHWIiN1mU<>fhp09m}_#c^6J1;?aSjrj>w5DGOh*^Le}G}Wk+&cf=KQXCr@
zskL4r4ddd0wzf8_C@Ji2_ZKV7J7i~5B3d8QY1VXOuHfc`=cN+fD&8Ty)OxA%RHbi<
z#iR%paaE4=>J=|<gV=yI@^<@M0(R>faE@Cr&;{AApYFFZ%@%X=II>!-KXZ5jTJvY!
zc+sMNe89@4i>!9_%f}20)AvdSaCn%bG7OgP*VEmZ?0mK2qZq5%?*AVwfPLKRTPG<M
zSxl%}m103&%989SsLz$<*<uI>8WHRDY0p%$@^YpOpPMKI4=*N!Orl6}6o1+_FfIqb
zlm!?Oi|&4gcTSG)ot;W1e-sr~zDR4MQt9;4Arn>S;NJ?2<7W%yW25Qk=^iy!ff<_K
zEHpj6hZH~WF96RU+_i-%Y*BPmt*)cfegFDCJkBhgB?YXgF^hxg;@M>WOQ2+<QeuH>
z%>m@3cc2r}kRM;yL2~P#z%97aF+|ESd1g3NE}lYKqs6USZosB9*}a~*-s*?PWZYYw
z?S@ups#N0K?)naRMJ<u~Q{4p?S5>LZIioo_oTUUd=(`U2PB2Dxt`FvI0SAq&p{Zi)
z96+UxVC>aC3hyB%e&6bgFIpr@!2c_$$rHq${0w!)0;L}KR2G+MJ<#)HRw;w2l$o4>
zldw0QO-OyKXNtx04$hF~22K$8`XeQ{RZGtni~NXO^e1B=ODkUh57Odl;=OrFNlxL9
z%eeV->Q`CLXpwFA&QQT#t2JKcP=02r)qJ}%GH*1q;bwoq-tU2>Qo{|YGyC~(v#37=
z1Mq5%yKFL?B`Aa`dQ?8CR@#urwzl;c4kh(@SmWvFXwTN#vp9`foie96QW@uRfRI&W
zIgroDY+|;3e4t>g^5p5$09*#(F%lUrzo`~1V=$5}uOxN8a)jMf<<Sy`=8tx?*3Gj9
zEjK(f0nSR>WK(GlV~-q8E91GZmJgOB;*2M#7zBL@iy%wk4ZXjtPpmeQ3N&M~&>UI9
z_hwf)u41Ds_ol0Q!Y8O)3Ar7VMvK=~ZNKf^8ppsUZHm&i)0b6==3Itz^4ez2G90z>
zB}_~J*bPQT&wmdx<}9$jLMVJl>}IiiOH3xH|CN%l?)k}LH0;M{7aaT1KE~@_)y(8<
z2K&zM>AGECB~8aVH;b+?@|$5f;o()(A;F=kzgIkuOw?dOrwfVie%-733OauG{r>@V
z1cb+7zfzi3d?F?c4Ga=NDOR9a0xvAwUvw9>-Ws8iV0oXCygLgY8Y?mtz?GJgdWIhG
z4SYR>$3*wa3NPezS9NV_p(c}sURgoV(+w;lqP^+9i-w!0AezwSYZiUK$fQrPqOt+w
zCNtIC6}EGO!xp2Z%J<Nh>)R#(T8|+81MXaZ00}dK{4W5J{qy>NCF$TA-Oji_bdHJw
z?Z#cT_@<*~@%~5;1sPeT=G)67Q+rT#B*Z&`jVl?)+Hwux2AKJY_lVeu`R1BfwZ9XX
z<m{9S0Zxa0`0Rt(VI#{(F80pH->EP#LP-4*hVvoSII_CGJ>84KC@3hF1Op6*l6$_b
z0R^cBBZ!vPLT4Hkd+AnxwF4dO%4CK5$JOXg>1wb4quE-A`$;|o*U!B552Th-byKDD
z>GRJLheT~hN3v=+j^W;YF^5d#WNhviwoecrGu$ONd7`1?f12-UW080i8+lg+_jkHN
zU+<Gkkj*EXgTk?Z<GIz%V3#dj)Fu!=gPF}HXE9~~8=0BL<c0K;nDNVzF2$(GNHw^5
z%XstodQytf%A~wuPft(5OqI#pnDfDPi_r?Oa?;k;k*tbWnJ+dQy6o{nf_OkN$Rr(4
zZsptj2_(i`?NGqip65Y)@bt4^NOTZ)Y0j@KXD$jP6Uz|61U{;lMCU|YVe>m(*QKC(
z^uwWV?HV$ay8CHWe|?%aB^MPEQldLD2}<u+{8$sU>IMn>jYbl7ZkLlorqfi{f}fi9
zIR`CuiZG4s$DnL(St&|swXbl<1&h+yr~GF7swj+L(mM5YgC=^rxd?+t4F<$Bt4{oW
z|Nh+>m7a@LVY$_tdJsbD8&~*k*R8PMbPcn)wON9Y$9_Cfs|gV`!>eoJQP|<a%~OLA
z8|<9~(C^F^{u8h_nxzUf<7BOD_#^z|9^E{e;4(9tYw%hkot&CTV6*m!yGfejSE0?j
z*uco}nMw^vlrK>Lr=Be7?Z|Ml{y_(Uo_Zgu8UFk>>$js;8UTZ=7*T7kI6iiQo=(*2
zu*l{QmzJ7iwBq8i1O|s24CRYEI&#W}LeDQQ{0Lc8G&D@c+qEpQds8}dySo8*(eDix
zpM*qtgi`?^G@X9%pMvfB;&TBd<}&FeL50yB!YVFuJ##>?6+H1992)xD$$mke{2XEU
zV|1qh&<84T<ax6>tb1#1z4^xR@T$~h@75k=ZG^?7UV(7j;q5!x+jcKvfKxppcp4oY
zwK+VPWMTj$c-zp4KxuZ_q<eC5va#<xwySPBQ%ylZ(xQNjg5v4^duJBr6V5trZ&r7E
z!-_A#<_D4$2Kh3JiOv%2zU<6wsmsqdcMB;VvMV(cN4XqI9Ozc3CkJs{I;Sl;*!p4T
zyFa}}#lFU}+i#Y~P5FxZ1`u(<?U!^T(tNPOLP^ErN~a+gw@p_prsM1L<C1m$+_I%l
z!6X-KZ!$hIus=glGv{=4cm!r(dNO*nQ$*a>*wp9~1Dr;3<a0)oD^Z@J;gmWbAxcZn
z&OJNBCL{|W<gvQ`Q(B4%!5Pa}E7^i5j<z1kPXr`l*1nhfDj|`?r8_h0-KqKLSE+R=
zMMb6EZL&vt>oATi-W!%@NJ#Qha?~bjqM}<}YjjmrRkybfR8*pk($d38Yp)mhTviSL
z2CBLzz4Hi}mDf#fl5=(Jlf4(7vbtm+;<NO41L(-qiBR!G-GzwBKJxJL$uN+Rq}7$k
zcED?=oLDk=C5CZ8x@<CAY=5CcvfmOG8W<La!)aw^Ue#b=I1(Peg)<To82BeZl03ux
z^IbjA^cF`&O+U;OrKTZ1x}G=!i}%Q5)yR{FnRK+R&9mxQE`Kf&UQtm2i(rv$CCp?+
zM@PrNzyOu%bfwQuEr;y{n*ADW9OyxT!vO^i8Hd5~>%nokI{N^l^)1DtOO;&`9yQvr
z;vfh|PC3vzA^cwjoB?^3d9`g_t{;t%GEu`t*IJvzn=ZL}u%q)-RRx3u0`M8VHAp{v
zsBt;d5LdrBkHP@;Q<qw}G(^P0`}boOO3KN>;lZXEewpBy*ibcKHPV4*jO|eV3=4Rm
zcWH*((CqXjz`qCz{<Zab%L-bZ!%`0x8c<I2R2du%j8Wr=B&hQ<=g&6?xSq#dm2s5D
zAn%;+eRF>3@Ze8YmT*TWsDT!Kd6YyXSH#=+JrDRs=@kvRx=#BlEL{8qOs%+G*A(k!
zxS#IK*v>ZEBYPu@tqcsZ7-_iN?cQ*6?T|^Hca3@4(x4m5=?dz~`lN5$T(}&7+o#t#
z{s=1~GVmPKbmct~JI0KIjEmY!<1i0Dd>eqx@$x?f(#V*SbX34T@I%EbFb*eHsVZ$i
z1a8KCv84`B5X&YXZfrQ7sz0*x<CREO`$YoS)N4O#(tw26gapY2cjukSnVl->Lk64c
zafCb9<z-9?{jBcp=lc2-$l|4?rJzhpgQQY0goH$NwYQs@Srr-?Ma9QUAgNq*WrKwu
zd7x8ey{X_X>UqB&=WQFnsme4^O~*aeN2Ky;y8sdD(Y*(H`WlC6$-#@ePSsnZIaf_M
zSz8)X=f)qNZC2c-h?^s&XKzE#QvI*eQDY`mU?DHC3mTD!8M9&5YooxCY=}&fPNQ)A
z#4RT|80h^i-UywYm&+QU%f-66)%fN0M4uSKT@26sXPgKwx93Xg#HW}6a%==K*n~+D
z(=drkFFZXE&nioX^h9&y)LCv6eXW~QS{>WJUdO?CIgw>a2EhvJkR^rvn0`;nuEH<N
zxU%QBXvTW%^$Z0?8lt2W`6qLIy(lG%`{PF`Rn-{eNfi~~Rk}?IS_&EACV7VuUoQsY
z;~c{CmB5aU{>y}T@DrpG2C>b<-y<I3y?!2b?J(rGH!(gQ%W3XiJG?j#|HVDaZNwGP
zg^G&Q1zx=!66CnwWYpDZ0Q$l}>D>tm7OiX~cibC%g6|N>uR6pq9+Ek%KR$ly@b7GS
zJPu)gzaP^XNXyI9XQsGZEJ7$jtEoVxoPjH^W`K&gv5AUd^+(BTni_7X)8W;ZmHom(
zfR>k>fRh3V2?+o)bB%)*Yvp$d5X&plf(CH()j3|sjAata;{2zs8JMvIk^Xy|%Sv^T
zyi^dcV3xT`cmWLEoq}+e5IEjs8yEms{vI*dilmLN{-!i0B`7GUq0!qpxp{gLBX=>l
zlolJy>A);fz+F2L@Rpl)7Zjmf+f@;D&3y?xcyHEiVOt8ZFYfPGeFC~3*mbOZ+;EAW
zuS7)#y5>FZSPm<Y?^Fy0D~pxgbd1`^e}K%@a~s0koD5NPryJ9hgz^%Dv-5!^=ANl%
zKF{dXY7#BSXw`&;tK;t}ANmu;Y4Q#^eCh0Mzc81~fOBP6g2x^*c}`|zbQG;}=`x6`
zn9aGjSI6G+h6+H8dU5q6Cfk5gJeoNqIGi$Lg{5F_ls<PTNyqb0@iQ;4^9Z|vogd&p
zf?f;9rr!Ud^zqw((9EbTwfP44{)uJR!F}>TPDf|P3wmW_2<jC-KRkR6r`WyX|5i_s
zQ&OVhZ>#mTvY%Mq%2{PZYRo_ZUZBtwr%h4whSO?4@Fzc;b}XrQjL}4qd+nue%O+M%
zc!7oTytcM(aX;i8$HBu0_iET)sqvgwu)lG2d2yH%{^c?@=D2m)P>#C8O!^73xAzJi
zJrA8`=&!nf`<?nwkerJV_<0+=dh;@r_>72+UW8vJDk})_gossdfpdw{@8$w1^k^7p
zYl{(Bq+d#fo6oo3s+1YfOVRfwaP!zNE}yDTfwTXd;Gc#GNbg1d@<8rBd!9A%H$~1h
z-yKEdb5+srtGfSwOhrWj9Ed<^A$3m>zUFsXyG2>0E&No*X}ySfRKQ`g`9?8$b1Ah^
zauROM;dDGzZnU?xUVndy>*xER@;^w`&q+LPnbOas+7kP}AtE?)O(UY;Uyopr55}Mw
z85mWW^%b&jFGOuA^eK)I)3NkF5Hl_v=4}z0Y6uDnW#we!;En8!v`EM+yFYMsc?nL|
z`xoG(kkDAq`1=9&1(h-&vdvg?u%xA@E2O#)mkuk7u2ySsW52{o%1U~PgJFGi8|UWs
z5D2QPv;NCzHOMdTQH4MtyWGW^z~4gMhZ*3dMN_-PPe}uC=c<&uyi3iFw>$PTpBbal
z#2=3T2Mg#~u~Y{d+ZL9VKrFK$KU=||7;sQjO>9lMDliBz)T_faWV>3y5U{|PFJN_p
z8THkTEdnfpyp%j+gYOLO4Z=VRpMibzx=a+z49fgUM->x9!zU#J#M{pk_YVQQKKqS!
zWD|QfO;p*EU0Jjx)rJWAmza#?zdw@U1ndnQEDu&NxB3ftSgu4+9G-9ph$v4b2-Drl
z(?>I0>A=uzigq#}Avo>yqC)>Sp<dwK0S44!qoW7Ym2*-<m;cM0tN=P%qS*P`Ka?>h
z0z5sV*^;>U48It$BEBbjzFvMky}jvtTusmwN&AIW2sEC1w*brqBf38pSO0W1yYv){
z21|GIo>-$kkArgf<B|i))K@y9I=k@L*e|jYIE+CW`Lk8MOFKX{SW=V`1reds)%8&#
z>E-%f^;&1ge0%?88LFqX^^ZiwhzotNniE(}lB1(H!CB@oarT!H`xqI5pQW!4Mvbu~
zS-u`9;WhH{0mg7pR8(ZUC@r;E&xUeAcszL0BfkYb%7AJ^u>XHkHQmeX|04x;1_~I2
zEq-4Fg@EBZ^K%AdsikHzGFqNuYng;3z3?3dmLG*T*FpcQ+S*g4QH42fUD#Y?uYe7p
zcmIeUcmC1~xO{FYqac-B?}iMt5ai7S1)d0$?~{B?jO_r+<9yWe%NOyjm~FKZcMDWB
zPs^Lxyh^Iq1MJUG4xk1!xGa`YWr^nlfVc4o0Rq&bK*gu0hqgC6_jT;Eh}%?SsWhL6
zMa$X=50tWD3Komx+ao3`EA!_5k2jdFEz}xc*@}ZE31ny$&;*hi(`Tm04>Q|q04p>J
z{s0RtmUa2=M71?2I$ULwmJ(Rw0FIB`{>8FTpH|SzZ6t!|&1f%Suk21rpy60ftx4AU
z(#PwbSzeH)?lX%T;GL=W?Z<3=C?RyR>|Qnuj2<7YxzZVxz%{u6?|_CDy8z*H&u_rT
zGKf{ljy_K06M=3H#H>w5vOu!sf#%d-z~U{Ss7zVg%{4FRjH_n8p!}|<XFLOwjU|={
zYC~6j(?8Y$*|F%P)}@Wg$jidQBZ`QNbJ8Bu>g4v$c=_tp=0s&%Q3)B#-b{XmEENN(
zHzfxQ78D*lS#`G_;o9ei$K2a42JEhbB0@6WrWpGufay#mB$T-FA2vFcqLfn3=DKtA
z(dN5{?w|I+G|-R5zhavxC`fx#6|&O2KObZU{Y@$z=n`0+?hMokZlWHw-kL3L|85qg
znJifWsrrU;t$3Hsm8~OB+V6@APzV6*Qw3)H7lOV%_?`yQ6^|WFHZKVdi_0}iC4qpM
zM#@1q`$t3WL#z1gPSn)zV+lhckuj0xtg$j7U?!h}hU8-SrUh(MpaXXUJ>8i~VHv?2
z$vRpLy8`+inYoFHAI-<#bW#9@d=55kwbf1MQ=+~cTa$j(?fqmxHnXreeBa0ip6A7d
zy+yIb`}d745PCGA9l`n1HCp(;o*rZ$6`fm1$YLGLmULYA%CkfTehY}y=Df?gzM%$<
ziNR9+g4tqawjQX1eE<$yx<kOO<!YbS{raM$;ARlilnnsFlOKE=z{)&->;%8Nq`(SY
z!E8IlT_<{t84_79mjH4X4%SmV#@jYBkNfL@<RJFn7Uv(!W|r8AjFfC?p^VchNsVF|
zhHRIB+nb~NuvzO==Ws`;rL~;#_mcg+zi`K!9~<oDd-TpteA3cE9v-cRt$kOwm!ZW<
zwDGF9j{&WXkB{#w%ik;JH32O?kzHEmE%gUEDZsj)@UYqtMZbqk=h2C~pUGeMqab`1
zX6;0lifd-m*5+ekXL){$o0^{Adw;#0ms!$_n?w*$D1kEDXX{r>f6NUG>JP3rEJbBS
z$)0BL@+1DOIpk%Oq~6|-dt^U`c|FOLaCdiaFxO&}5#!Z*M?8NHH23fS;@C^=-><Y6
zt>nwxfB*h_+yZjXh}Z2KDp88B*kAt+tw;&8ZA5hzdxIa4Xz;O}{4-NXcqnc6x8KN-
zpMqkq-5mciNS%RtYUCg)l9suCJ|^I-kbtu)@v`HqNY|gQ-l@wS-e0{@d<KY&{=OLw
zeyG=LWRx{}bLoNO9ATAL8;A&U1g-N3=klO1$B+%NIJ79XG^2ca|C@<`R>dM9sU<HS
zGFVhFJV9`N^<Pv_SuF|g-vnO&PsCB*&Hw!@@W20o>?%-F-8TeG+z)9aYk*U_wz`bH
z41{_C#Z~hDJLA*S`$xL@)&vH=c!aQz0RT|oLzZa*tkDm$kPMKs-}5!P^NIZ%ZxHUj
zBzZ`^3(-`15%(g6I)|Kwq6a*0tcPf>n?f6c8qV<_6kk=|-@eZRQvE^kLA0cuysZxq
z<UN2eZ8lCCUgd?o8WQc_F(_B$WFiSGGjbL>IvU0}uoGT^hSNw^V&YqFCSGqU;6n*M
zg+y3Hq?M#)f&3+c9O^yeL;|V93&fyzT3`MaUh=%2KE)Qrm=MhSg~7-2Jdqu;wgQL^
z|Evm<<oEB{*w~&Ud|m<fEK`E5^7!nHE$e;g%w$N~R=aO;VF3h3F5%kk8qm`JKKSh4
z&LRWol!yq4hyN<#g17%SVZr+zBzV=+g~o=&M}~w4f%%PyIK_X3b}9UShyMBP7U`QC
zdB4a)-p=2@8LS$3x_~Y=pvpFfHDi^sEn<HDSSMq`>#S>{plf1dr|ZZkksV*k4ldCF
zm$+uLnw`&&5^(g!bIOku(jFC9;;(P7>^NPX3(M;0fIRQ%yLU-c*t8Ic?h`~r=evA3
z9R66bu@|m*|FEQf)q36KzNaXl%IUsVWo>+qZ%(0XK3j=LzkyVM!Ofy@omDq%%I}D{
zn{Z~6l=E1~H>;*JfT)gIBN~r@Mn_-Sv`IzF+#DGAMKpj>u!nRM6caVVDZq)0apZf?
zr8U>KLj)tQippj~ljly=**VPy;>OUFGtl+VrljmHu-f|>Q{-+B{5EC9@t?BND8qAQ
zO60CQQKZ!K)hco`6Ipe;BblzHxN1d*KFR|;LT9Xv`yKtyizm@#`tp8v`42h|*l$bx
zW3#<OA0EYIicoB}XTtsN)EYJ(X*UHk$cT<QKEEnn-ZV+iMm{>?>5Eb{-2UOSrPwSd
z&sV<l4QK_C0GZFX`_qI~D=YGAPileTdC0OzIAg<YlP6GrX!Cv3aZP%2c?@x`eTq)_
zafA#6`mVMN-W$ZQ=$uI&HP_AHu&4>0{do)0^?{VOcrJ%Xi<Xu)AdPpq9v@R$`bpLD
zX4Q{TPd$K;b9=h3E;bkc(c41sh_k<Tc3kgDfBfE(#z3;-HkeFlk=Gft7Qw;vV_>pB
z*lEK8q6n2(C2dolfk}MN{xGqW_B%d4*qDrROCtU_$&{xSXDE_~|J#=rkEB9?#4bG(
z0*E9Hqg_dT*e))V-O3*W2<0j)cRa$wUt<9>V*ozK;o(V4eZkL@=csMI_%qoMQJefT
zqFEv?`^LU8IyRDt=H^s~2otU<>y%62Jl7M+7!%hz-WVId<8Y!;KAyJx3YZ#7#Imn^
zn-c<ceqKjk-(0QfUY8=B6OYU2=<p{NrWj81V7D61T0l;BIPBga>x*|jJ{%nEU!Q0)
z*?0X367-c^{tHv<%~{~`9ZM5Y^Cb=RGk|-89-Z3$*<EsW@??#2Ngb&~ct}VZOwgBL
zX?MZ-a{b^cfKaW@oL^end~>-jn#EY5SHsWGr>uCRJ)Fa;C{0g2PK7034Pw|iQ4~?2
zUTwdX4huk!pyD;;wwiy-D9f0wSq@#<VARW;hu-3IWfod&Fihf!$@5HG*u1Q-`?VKF
z5f&$?EL<s_B6v2vdse*FF*<E&S+eni-~ATt<_*HnFtCHw12d>pHxB5S=h&g!8zWnc
zwpm>_ciG_$)vF&M=^9a|zlMl_5dh=LxIqLr22@EYELSl^=DCQsSVvFb%2$T41#K4p
z_#@=QsO-+?&qMo%zjq}cT3k#_RC;;gyU*E(hzc{MmOPajntz4mI=A8Od9_n*3ood1
zTJvwqi4c3jdb*=G?P@FIYMdc~(dL)o>FfKvw!623klmp9mfy2mTzsu3IxaYx9oooB
zM?_?kA7#15>2T|q7;+RW;1iX6dsL0Smnqd&@A~i=CE!#R=P8#ND;jt?plxGgW8iUH
z{V?xo>52eG2sCsBg$5fI)w^8zYSrwf3lC58(x?=3X9_j=)Ep0hY(w_u7PASf^XB)9
zEvZ{oIbp;5g3ln2oJpzFN?1-V)QQf4&HjRMtydzB>6eqJZ&T8myQunm;`j1$a<w(J
z*fi!8<m8~0+Yy$U*4}w|7^L;fQ)*(O!^<frmH_X~vGr`@1*U&@6r1IBWKjZ-Q#_|J
zF!jT&9VwU3@!#Q)Y8Y+~ohibqtjfqmhh3{beyhZ8y$&3NxXQ)uG(baPx+Oe<GMYvI
zi`IKAKK`av+E~e`r5XVgpp&an>ukKYUN2F1R{xWECvRMfyH}l6@{Sgs5Fd9qx-+G|
z1C@dd+y#Aj<ElwbPnKsutZ@BaO}eN#cDQ)fPg2sPFcX`rx3-ewa$JV;IY((=R%*?1
zsFh}2aKQBM-_xO(TC^;un`PLq{ZNh$zkDD$dga`ariXw)4dTo`2XNLKq&s|Ki4k|n
z_F6ICf~&-Fq!Tq~Od<6NnNV8*FynJ_%$-sR<Mg;Y?+9^qMc9<<i(>Q9*c=<(<M~k!
zx<-oB$|CB=>ydA)txpJNs)6f{ii%Qtdb$A?!8iI`o%Qj8Ibc5uTF`BNghw}v+%6Yl
z7x&(i8x@A;5IL()T&gNcR)yv1d^xXahUM%Zd~xKvUdd6!#KJ5$nFiw2(^)Bg)*1d}
zeX+^U(_*d3*Jv77>ClOIylGW_6cGyr3?8MQY*Ba9WWt8Z^w0w$2;*mGfhi)$3Xj9f
z!bUVPNWtG`G99Ai1S3YIDqw&*x0VvvsKiJ%h>M6IyFV*sz?vx9rrh|kWmU8zHZ_$h
zts^ZhZQxBgRi=-PjV<Y!wKbO0X4|H)*+k=l{ovW_7&PXb(R^VEi69UZTqaj_S4r;9
z_^ABCW&eW(r1!)RRLW*V4e7?(a4{P0PIGbCczE0!`%tuZ)$QBynv<o4r<0NbBYDHY
zii5KuqUmb7dBgcd;8K{Y1kp8sE)I7r4nLY7>uB$idbQ>f?-m1V8_-jPe?c6R&S9z$
z??Y>?VMIQwisRaGmX%gfkQRxLqvqnUY)Rvi<gUvq$Vvzf>s44?UCXPeS)0hPeIlks
z7V_G~nox|slYcHE#*{#`uk+JTp5o}`SF;a`Lm{0|MPZR%y$upd>Z+O)KuZjpTCR6(
z*C7)bB|lr2aCuVl>J<qpYMG$li&w9EB}FkP*zG_r<}(kN2y<D$`VVEbH-+^VA8NUW
zI7?=+<p6y*@`7!ETLEvw^S$qTSFNvCj}s+WoA40bY|T9@BJHY~jR65E24*}|VwwQx
zd@Zdl03CNU%$-&x+@7pf6c*N>pUYq@oGdfp@3T@X70!7bk|BO`d||1pOFHuS$<wv9
zwIO<?A;H(BXs9vF>D>4DN!s)Kc%IXSZGHZWpFcCPK(8KiW|~)0F#!49yM~sbH`u7o
zyk5Wj{n2DU*^wO)JK74cag0t6iwP*Z`wPS{mE*Hpuv(7*Fl55c{bInM#)0H~SY8YJ
z!F3V&*pJcDiJPZqIH#APXau70t+NeT5rfS?Nlg@#1oTGZU1J3d3=DYDF`$ZxKNLcy
zGB#$f-QQ27(5$l`Y9Bnj+Mr;!-`{`d9;{$IC9{$_$71(lm|Wj}LJjS1%6(X7;LUWW
z$xywr%;NM)gbf%_wexVCU0TgfNgb$DjtH!HW>d^aXEJ;0sH<M5&-kb$Gu1R}I;bro
zAMUi?-)&=&@pEjBXLf5fIx432{MtV^b{p7;wWWvJTm1eY^q!c`=OXMo4fUq6n&x5B
zcVm*Iw6K>i-a_OGM$gUJ=;=S<2uTM4XLbn49qUb7<Ewd-5U+y8Sw!Od5BMD&dhyZr
zG;M*4sRt^dj9N$7xsCQ|)rjE?VTC=^9{jh*VdhHM^}2feY_lhH3O(ads_pJf9EV}K
zZ#NHGU1W5$2D`&<LrR--!nFn*YJc}rm4+Y=)UjSzadA1>*;Tq1oxwvT5uTwXXe%`>
zioCq<R-TcJ#nNDVqO@@Qmg9Uzp1JHF78=UwusK|NWikur-kYn_th7O;*;<^iL@Yar
z%0|S8^vF-BKi(%RDJ!b9UXuX+a(&a9)UhlD%c{T`SxZZ6JMeSvdGk4GxF5xQdryb{
zRJMGKLLP<s&S)j$jZPA1N)T2!@i_7Exn0hUl?ngx=~_f!xQ6nzNZx%hZzWDp3~<!E
z5Ohpq7)jODtwBFXY4kPW7cWD_7?dU7PK+Sp=do;QjyR6`>e8k01S;_1VDRTzLk-0Q
zQoCoMB=8^CSH@|YJl&m1P09Bj&Ajo6<neNxV&;uu);qrv9nHe9KaEu(a(LH#fUr*m
z694m?f4$L)HxOUGT)E+=9l<L|ll6($(bkD()^EgApV(d6>Iz$C5V+uTR8u2H>B^6*
z?(YKGZlChUy`E}Yqq9ijM!cfrz_}M#Q#QMqc{yWaaLFtnDtJ6ST?1@4rPzpxb;j3&
zG-hXmf~46eYb;4J4U;l5+GYn&Mq*e%atT^9|L&<3l(JH5H-7$yzaHMlTlf0J0y$09
z0%q9<Nl98>!bqE&xM{l_UAj2i=>6W?<FT>$?5Wc!sw`weLYsy(>P6Eh*OdW8JjD+@
z$?F2Ll=!r@m6S3|eSL3v#-jE-Ro(9&-PX4m=ZokO#e9u2qj4$V?69ob>Fo`ylzQXX
zWs8fYiMw{HZCYE}CantTvlRpQUWf>eZ^@oZ6l7+;!F}BtUIO%k<|rQR`v{wVV6ZG<
zT}(4gTErl%IGWvv_sfN$Mb+KxcK8(RhDEy)H?Fl+X70nJfQ0HlzE`GfiJ{Frlh{-o
z9PRBr!OPcn$5DU1(JGfWcNq&ziXdH(8gmz-Ud~KPSufd->yq#Tcr7m;b2|Jkad%wO
zVeuI#JQVrrAM6Vy(iSDVJtWvJD%+6jP_}0||7KS^owM!!iYA7Ig@qAjFjdZbb2)q#
zUu_0ghY@D<Rn1yf*Xhq(vLjl<5uZ-{Z+>IRmAJ}Eg?WHG4W`||*!s?Rt*BC@bCek{
z5SBPOBjU8X*c|Ch>smk8%feDBw`du`8@r2UtxSqima&krvhpo2FAonV?b#i!y91t9
z89lLV+T$OIG!x<+Y|yPN%8h<V_p*l`DSZC?*>Pb0I}T2b=(p=@M@B{lz*o=YVYKUi
ztKtWtQk=9}KPRc@;pD85?+TaG{CU&1&0#fv-GWk*-uH&VOsWIg$v}QJUTc~lIPeDF
zX=g`1RQ^5*&eu>bcEoW<`vl>2{^{b%Ltw+ma%b~FIb&T1dUJV_Ut5Exx4E%tQ?#R2
zllzZNnroH4DvQbGf~V>&*|WE1scC7dupjov!v_ORqMAI~2HGO_&1t|4>13UkE{mFq
z%1~GP^2AU|P3_u^t;R$HIAQd~^Rx*zIcAs+<X#+vgn%J-3NCXl+wceHC#he^=i9??
zXy@De)@CkLHDs8XnHId}49f@kBF@GPj(SpT!gu=MH9ZQ^BiU!mLoq86XX})PHK>R3
z;VXVU1Kst<7i+fpgfIuD&CgK+HX0^6P8iDhas%fC7K*b~VP)K*<zIa)qC`}tb*Q-_
z6NvM(q)nUH!Sc}j>H271Qfn$}Z~(C@$yAe$$Q0&@u2E4f%PcJ_<at>Sm>QrtG+t`G
zmBUg{pjIu&bp-KIXUCdx97rs`9rcT0F`Z&Jd9_!5`U$1wMXkfBwrWa*4>oloFlKrN
z6~=k+1pngV0=TrM5n7++JMIdwo1Ws+MpWyZ_119C?lEs}%A#!7e$x|=%O}q;yPBP$
zU`&@bbphqjP=*+d3qhy7;atO`&{RyiF~|i2)MPgI;^&M5{uTQlb5_0HDnd>RCEx%V
zc;t$t<8sO}ky^AQD?3Df_00|zCcQpbSt2rkMGM&(=dOjynr`k75VM%fq(%&fStu74
zp8GyWeoOwD&35BGfqi<!qe~7TO5fRd)<koM@%Y?!eQQgx>r*b;=;$%m-nW?~Ij$R@
zsdD`;ub~WP;|Y9hBB8mX6<Se1CaHy5gYmlwUdI?FeT#*`7Qt}8&gl5txsjI9a%0ca
z<NOjG7i3<LF^fryk#aKLUO_Pk_^(Kr!2{cMsJ4X_vR|LeNJC}@b_gVDD~hgeadIyG
zDC!bL+E(Lugq&*+cFno+CVMs`pEU1#L|d3l&@j-SHs&~>J8FoCe$C%zaqoJmX~g3U
zgeML23C&DKcGLrj=1w{~y9R>gbb(LP*1v!hDG&jQro?>?W;bU>d}<s%oRG6iyWKrj
zEFk?rdb)1hhA{l~uh*Gx_V6B&EF(J&Z)V^?n2gS2p)W?M|8noZTyHi8D5f*t0qPRK
zAwt8Vu-?2mzp1{wynLmG#Brq|U*qzk-lZ|-ci$vK_MB$sp{Yo(M1YuAnH0nK$H@1W
z;@&gn5D>xyI|Kq|xm;LL0o1}IlY7OyV5u7)J88-uK+I0_j-GLXFAGQpNiqHh{UM>o
z+Ct0_0M&rVAD}Mt;RD+%`~^*igyCtoYv1WyG3YWx)a&cp83b3*Jbii(7}XafQ{}}6
z#{@-&;3foNM#qHxH!G*f;LhUYx}!}1e7XGP1%j5H=GSmy;d`9cnO^HJmIXfMb3Hf#
z|9$-r;KKj=n_Y1Y#>b@<;*9zD_^Fu2M%AZc$_<^ib_o#YCI2H6WDpMegUAw5!O?@M
z;wX<WQamLIi<s_d^*y-Kei1Ni;&YI&@;C8W9$8Q^DO!n%IXbFYSiE|)PxexzulpN9
zV)SFd$A7z~`<C}3X_{G4@-Y)by5mzPx$VtY0r-IK>Q@;x;U1EIY|%8@!*RB|J2GR^
zv|08X;aV7U9OTH5S;daG{-T^x^1v*wj(z^)NBZQo*WxjB@v!<riMT_u-p=0L{xVrP
ztK)&2r{cJ8R3|1u_hhaTs;(-^!TH{CCf%=K7M|Xr0yE;Ws;|EktVwV)BGsNN8LPs|
z*;vVUau_w8SYGZoy;w}U{rRBWW`@)sXD(Mi#F)bt5GWE@txD~bx2r$tJW4_I3?Kr$
zXNz@X9;ZXhXx~|<-Gjx@Et~*FIv^YZwc25JK2`#?5*$?`fpKfIXUp?!cdkmOx{s`G
z5(?#iiq_lJ!{xYWXJsYlquaCA6Pc2fBw<{>+3(N1)7nCH@_b9?N=O197!(mJs@0gM
zw3e=~ipLz}rJmBMR~LW3P5vp-JN&0@OR@9^5sxMTf$?OHj-anhV1ypt*kJ$WT;IWX
zht5x4-k#`BQC!C9yv9y8s&G>f-r0cs!{4Q2kc>??Q+={gX|c0;SfCX20y}|0>lK#G
z_N;)@Vd!vZ!y`oLD&CDI*9CqGq4u60EUcB-YP(te^?778UGuBkIO(M}xZ{xuoctO2
zN_@=JCaPhjn%DVx#mv=NycHLJ7!ac*;Iv@nvfUf>BPK0}tevhHDuxYx1N^w=ELp&Z
z%>>wIt<{P*IH_b>gCaw%mQM3fr<lW3$i?r*eDzD$Z2&7OlBLG-j#kLG306Gp3wMV9
z5`3N(mzA0L0w2G4um5L5ipLPQ*4)kf$pEBf(AQT?#2t9despN4DGqNzxc&s-;QN;p
zzqI64{Xi2zwQa50iUr7bl|v@Zw$=Lz^T9oIK;MoC3B%*Cz?9dhHmCVS9eTMYxyxl|
zcI2-<wu=c&<hgp}>akt!oSg`EHL5FhhDP`1Ks|NdKn$Z*zcRf30=2)G#Da1=AAZPN
z7)A>D|Jpn2s3_O=-@8RoL3AsnqzFg}NK0F!bi)u*(jZ8;QVIe}H%Jc*HFOP1%FrP_
zgmjKDL)W<n-TOWJocFBr`<+<p{Bh<l7VBZw!*f4(T-WuzK40>#WS{*`K_|ZQNHYc1
zZz>9Y2jy0(UDd=nqx@~5R9=V3ZAL<}fsRV_RJ4w{gRJZmqjZqrj`W*daH6D{tQpV!
z%s7Qq;h_<6_IIA`edD*G*RZ{I(ll1%E`|_OOc6Dm>gwoNMKy)Rcr14cy6<l^d5k?L
zwIE9)_`4iVMoupLdU7pvydsM452qHUFlxn%1SGk4IGLp8eTxj1t3L%~RmD{SHC)F+
z*YZ3tN|U<?WM1q^qKXDZ{8KKbnWhO^{OM0HFYEZ9Ha0Geo?6`z?a?m#@}>FPw?<x8
zp#-CV;`B<SWwBp$d0d<pN+=MCWUU(tF8sq{sOpL+69YqxPHy_!w@$)rmIH=q1HOiS
z1_*Cr+r7cRashf8rYvtH4nLcg#;jRt@mfm<C>n^7EB0nUuDb)ntZ+D8wt3W0FfXCf
zMUc_QeI5~IXB6;wjD6rpw(f|}&bL`~3o!*DDWu%|>(Jc7f~WZHpr)Ll=$I7!yuglV
zlc4X@`Dw+z?9$I=$uvQUrw;>z4s^+P1+$g&^3kW??Xdj#_GSgpaq1uGcDLN|s9djG
zbw2IfFAYx-arW7EKn1Jsh<acO?h9%vaHI+szjJuVsPQy`{oT9Eu?_d}rx!tte|BTJ
zpXcW1$U0M84w2<s14J6opN)@F1%#FlucJq;Ao_@z<Ul1ztiaoBHRT64D9NRIup5Wr
zv~fsjMaA9YIjI1Ef9Nkw3A-jrN%516oPunu&VpyhP^(P|{_Ol#B>Xj;hnw44c#LYI
z+-0!%h8pGoC5(v9ddWK|@FF<yvSBcXv>QmNk**9D>W!Lmof9VlBBZki7D|8j?vJ&R
z)1u8tl071f_6?Mf%jD}9Q=k`qJ^4_^fe~fkt~BwW+3ilfsr8_5N~(y5km&+8Gs?t0
z1e(c3+_t*B;)UJHbV${&Q>B!=O5?u15UOgX2Vm5pD?=GCBvfQqdN;h}_+;KGt__y5
z1zf8Et?nEYkDDf%{q0Plw=W42RXNO#P5K>zY$9>Q%?A8SKzdMSgQ|dcfPQO=-!-*d
z?Xe159-pBkA&DFsU>O3NfYP_^&<aWKOSrmLISJ=m5HpqT>htmNq3Ud#PMR(O`{~J%
zMu*)PYU9%crOg<t)s<~{>3D@z4j`Po`~389XX9z~cIb-1L$`$`Xk?LogZshJ?En_g
zmSvb1UiKj>{{3<bTkL2oFkS0+0Gb*^(S5!QiKf7uFe-89t%vKEI5hi9>>4a0@2PsL
zojp|ff0c^QTwB2d_Raf688o(JIQ?=CQfmw50L}H(2Y|D4>u(a=KPrTO{dziFNowlO
zmyYm1d|7{anBvCkKWK4<yY%<P01RTQ=Q7u6pPfw*a<y{Z4m9+q7+*RFzb(gJ=YIO~
z+njQ>o15CQi0zVa(e+=`=x7m~VfIw5g^R7G{bxXpwzFt)@s#Dk!*}}@Z9U297v9j+
z2MH=bL=HRWF`cP1&(lsrJt_sNU<j{+U~RkseLeSA&+;8Kt-(@Z=o4z#^a-w8=Vscq
z6ADbEwl_jocWt@8vy0N#qrd$D;OV5pnb|pAui~u)s?b%Vkx%IxM`aIKZAa>}c8gE^
z?u7xrm@-!*9Y*APd_@YklY=Z3c3OMUKCd({s4Q9$fh7X8`wj$Xgm$42z*<RzswVg-
z6@aDg=mubg(A2xK(z9c>P^&(5bPUZ$=gA8Vt`QI!<vr!;xJPoA3g!I;>LQL5KKY2D
zPd73iR8uSG<%Qk{0Fc_}>fIMunD37id#q;On9U;#JF1)h_-A$v<2|Non1S-&-c<@~
zB7+&K!|IUXl7AUj9e%L)Sr>zg3o^#D$cE__CAq{4`gFaW7eG&OC_I&RHF?(F>mQw(
z+OW9fE#VgMgTjIZ+J_fpH&z;YCK$@qXjs$~J{Pq$y-eRUhR>eJpVKr;a+_pWs;yN{
zkGJF0DlIIAf4gjzawtQ#GAG<twCb?^w6w4y?CJGG{w|2}JV4=cPSwy*+!)HUz<la{
z%EERf<Z5bVf6Gu_(|XYEK>q;1Ud!F$*O8a70aTeD0}rJX_{&4dmD;hg)h|c9fQf&P
zh_X)>xMS$V#bNYl^E}bp_KTnDmAU$WFQfb_Wl%qbLW)e=&SH^6wd>N=@xk_xLWA>&
z`zc%vCWioR64XPri^Y)LxM5-PlFJl(0nlW|G|SB7KCIwIu(#P05aidI2l2$6chnSY
z!)$zng~x66#>N#=#Mj3*2^lHxGc%`M6!qL;W)dihRKEl`Ccr%&Z_12@lcAaMeisGV
zu!+e_TU5jBc909Jtn7}S2N}8sly-qTnD@_3>lfy{#z!Q8%tRm+R+EC=!pyvS2JBUF
zZW2iWEJDeKi!-A8`xkk;U{?lAOkHbRysHL)vc~-N((J})wXj#VT;E06@D%aSjYG%6
z;N+&eOJnRkwtmS4fb1uF3VYsTazfZZ=0wchqdT5A+1X<FS~4(#l`IJe%Z>r0)r?D_
zO3EtPQozug)<a~~Z~&OxczIw8^X;U0Hm0ibO=hDaKF|ue1Ct9zHbp(hta``&o$`q2
zb)AYypC5m&69Au`v$g|Y%eO#hdvbZOdi~|VXtvGa?j$Ynk_ld&^7LG^M!TAK&;;`@
z+&7R8ngVE*q4kl$97qr5k|IZPd2cTB7O)zzUp>(~_SnvvT?g~|hf~MsXohh{hEaxQ
z_iOFa7q?A`3N>AmJ(1V0VzFk5NzRAZXyCD=m5SG(l-b`4nCRO;$&_<`dr}d+>-qVp
zmPAdq$*Q+?PsD{iR_2NzWsT!KLF@aahfEA2*5k;~mSz0U*F-J~xC_;ky&(<^of)6r
z#N-&%Ij8d3kHJR?MJMahAN)A90CFar4$q`33!;hH!d$l<6NQ~l+gx%{4gNZ$N(d}t
zs79)utEpjsgtA>l%LVziZ75pUXm&yJvOdeK%0vSb8bXa)C8ctYb&XQ|d$nO}re@@1
zHwnT&j7-DFOk3aj<%BKFV+!AWUdoX#jfs>B%PGi>ar7I}8Hec?e@M@bh%PfnYBQr=
z82qQqqnODIWp#~7Z&2?aG(pCAvNZhQna=EEBJP|1zh<u(h&{a<zD%e2XI>DJ=Ah#+
zMCIAE8<Okr+bW<yzEH8=h>NQmqqzZ$0VOV846iH#EkS@SwY((ML<yUD*;X;sbw80A
z$#%8aCDV9Trd`IGu!-uDg_Zg3mEmP;)O(>MIj0Oh!=M?h3eZa>7~)iJ1(GLaTfmD?
z=^Z^iBMNR`3YGy4PnLcamF<<mtn)U6PMJW*IC=nj%pYG<aNvf^F>c~VEUjy4PJPs<
z^2p&(oJjQ&@5=G*0ba+lLl1X1DqkS2gYlN0wzs#-D99MDhOU0k3C-$Bw`%K7Jrd`U
z7;eeT%26$RZ2w4ce50&hO{V_120u{J$u(ZBjekf{RG;K}b$^}(p?je!B(-UV;T|K`
zX?j$d+QAP1Q0ohlw)z%5eJ>|l$pI%Fp`+t6*~$e2ChbrSIM|_C??T1wgZ0Q1Qx&hY
z0N_@Mpvu5Nw?Qp$v;7Nbi~xF6L6u;$wlmLLkG>(D`Ydiy(gRYBFKCzfo$@OGJr0HX
zkysMQ)wR`TXF{m4fynLc)>&d=&=~JhIO=dR)&dPNqa5PD#bfRt7UTTH=)6-O=hVSz
zz`4O2S%uuHjvIK8rs$8~dOFNl(eK+{tD8o<;|F?9WrZF0YZEqHIOx$8Y5*n&kaicZ
zn~^u4-@6g)Kro{Xb{Ov_SfG?7KuB-QFA^I#x`z~25JQRzpz5A0k6V<{$>(FUC^bok
zi#2<ro(x1$iM(|^a7z{OX+12pb9UyplP5$ZH{4-oKQ5qVfo7^rYLS9zG#eBq<awaw
zs%DaZuS@FMEm>N&b$_7ueLhKXkB&uI=JBT)FCpCu$!A&*izc|_J7SX}?sIS`ypd=z
z`xFy}1YNk7{eDo&^AREWmLN>`8RYVxZAW$YR$RDnNtV=$bQuE7$nygeghYkPO0pH3
z^GwIR+O89=iofHgMkWR)I(Zx@6~z=HY;6#PS)GM*@v^vW_MA8ne0{Nt`JdSa8NHoR
zc#1E0b)?Q^JkMs;1z0>DzY_9RpdO5150coz_a$L9j_Zfp4nL8a<<vcFLvaDg#;`R+
z+zx5I!+Qa7b$hj!0R6DeWpXYa8-YG>J#cT>^fWl)hMM=v1`cPDw|8~0fxTiaa3+BM
zeHKNI%OXt6+-%&-AEOkk6Jw*JcNC)(jc=GWS(^k)>iFPBv=SqL|E!PoIKxX;V64)%
z((*)Q%tP-ImZMNnQPGSLy1Wc@UDomLCs^Pv4{rPLGf!J~SPBCt+f<$M03#3igNCc?
zP0^5{u6SO(2sZ7n+JkC?Mn8-sBm~!3ZqdycCah3MZ08v~eY;k>Z4%s1fb7dn%Y!9+
z+O#od>HF3>$4G&70!H_?_I^>*Ny4wT_Ssy5TZ5k#LPK71#tDJN>NK?igPwSB8TXhi
zuYoMo&qS2ZR`0hoTl<>F)&)Y7RX&OA4W7F~9CRrJj=3Tac{8CBv#>Q7@E6Ywq-V{`
zDwL5Lygiv4YEy)&R`y&R25Fita#ltb?V*e3xmEfH``Gu*zn29V_aNqhQQ(d4rxOMq
z;7yDz7h_N4y?&Jdd%X3YMTkCQFYnJ4>BWTwxWIH;%8qe(zh=nXoJm`2Te($VLiW{b
zg!@bD?MJ+p>(fx<7U5ttO=L`jg3NO^?ODudc>R~TA-~$Fg1Pxc@?oiGo86LbKe5Wk
zHIj0D(Zb}mx-VT>d>@9#J&aD&;ysu<9X(~U^ACBq^i5A{hig9K<8)wP5SIj0_2v6W
zdf9Z&)=xZbA+)$7T<B%O%O^;+IM@d{o{m=F9d8!g%KIrg=4E9Gq^)~x_W>Qtre8Rd
z7dzDYdwLgeSp^%Tc{s{r>&wJQ6sz7Y4KPR~5Z1U1E_gI`7np9yx+^_|TP!C;EK7PC
zi3oo=Lp?rn!kxYwZg10hIB)2~vjOF9c2S{}=_kM>@wl|4fBdPmq7Y6il;H3u!9)JF
zu_wo#?y+HIoC*A~1cOeQvnz)RRM@TU8I)-ASoU06;?!y%bTuX8QsD$b%;N_Z^mauz
z1QIxG0nKnct+Iw1Fnt`(79HQQ8v%=o`P=!|y5?_lN6cqywhMGB<Yg9H2(~2FYr*03
z`ST#5dLW8FkHC+z)|OSV1g@m3F18A?@*3(Y%M%D<%s}8at><Rz{C>W!*rkII`-jH(
z;h86%Pz$idi+a@qdsC8OEc(0422x^$)v{uUn)3gKy-E*dBSsjvom?ZiNp{=T*7~KT
zNoVC(;Ku+vI^-z+r@>0uG1E2S4-~!W%B6gSw_4Ww{>lY3gepC!eFm5WzMD;syydZ-
zy3(}7>J>J93H_1acwzrc5SXVHKMhiQ1B~79^nO{rryX3z@#N1b$%E!@IjsF+2f--t
z|A>nlsiMn>6aNn03EPR<daEun{5<u?hF^QzjU|b0Atz^mBs`6z=#hb!yeJR_Mw}5y
zJSL{<Or-QLUn6weJF=(eAzZlra-hP?T6b;y=4{}ja#!pTOA|?jrAAAsIBv$C+ru@9
z{6xELw$A>Hp9LPUIx7i&2SNhn=AB1h!Rhs-VgkbEw6LDi`PH*cpN^GJF)4`Mkw0SN
z3H<{;7UP1LM^3n}_;33`@XXJ?{(mJH{Pl<b$DEXZeck^kCRL0AO*heT32nbF`_e%8
zJLv$z;{TkNbCaIhIqz`55iX5Ybldlu3x1ub#gCpqut83js>kc4T%Jh?>QLxBO_mG}
zR@<P3`b@{_1y!^%HV^T@#GTge7hb4@v4E<_F3srj$xZ-+W<PY-cc^QeD;l7B#7w_7
zEBm$aS&Wn&vFzIpFZwE$5pQj60dpYWWu~dDfg|LCPu>M^`)3GrRd}((NzML%p4i2`
zeea!YWUL*^puvaFZskV{PwcYgFv1Z~NyqMkz!7ej;kD~MKD?%?tRn1oVlGHrD_TvQ
z_-E;)DaL=shg#f&L5vG=)EcQ8k)BTfe25{7p<t@IrnuO5{{~{5l#={47W?KCUK>YB
zd7Wk@;*#Qq@$b7Kz}*eL;iu1Bn_MwOiTAYxYYV;WM@Hg2!qJ0#4{BZ=Ph={q4%<T7
zXWlsg5<fT30e2Xw-B4Q(L|&p?y_8?g8BY7q^u*t=JHtO<Z!u00mHKdpCM`2pE}TqW
zr@Fy=vMXDvI@IIhg-cf*Z#5!3u|K{>l3({2*{SiwoL4ObHBQ91(^g}NA)aKdz91<z
zH8edBa2hE{iJ^sgUw_@E8V%?z+9R5*^Fb9xZ!d?mnJMbuLC(b8PRz;5@glkgv(q|7
zh7y91sI+_|AvrRuFg@jCl+xzQrn^s~qX$QT;XJRZ7Dyj1tdYQT^E?x^BqZ1w?#Dqt
zIJ3jZ<se3eV@pA*Td2aS<|_Z@z22XH%JMEK8f-0~I(BS?yssQJ|GtkaK(IV@hgT$y
z9@*EI%Sg`-Y+Y8&mo9TXp__Sp;EsRt_@q@bo4X%Ah>4BWl$KS1xt3ZiLvI=xDWYh%
zX-!ij6Y0Os-^;ldD{7zMAGZe}(_yKijij;C^3PeUkntR<(68)={Q9-8;|Z|edV0)Q
zKcJn#KiJ#fYwvSBQKNoo43A<ZK{l8b1T4RkmC<MFK;OoT?&g-}s)Ax%h4xMNKn-*G
z_Ob(f3n`1NL+)wWgzCI+-=w;h1C!L{Os>QH<R@LB97+{4yhd6T5wUs2UPz~A2Xzp9
zIRpg4()L-%1U(fMZXV%$)kBU1OP!fdh7qQU)!nAVq7AP5Wk8)o+U8R0fN{vm$^@2%
z%xuui%zMCznw*5>)w7nfR+w|Xte|}WI1|jzgOsQ;-GhgZ^yKraRNl>~dtW&)8cH*K
zQQYu0$w-^sv2xwi7!^Q})POEa&x7s!nCH=>7IkM}V4Ry@U}a^F=Bo{k&@tC~HGB;P
zT{~F_sL7+iba*!CWfOH`Fc?BYH#8U`*yrp|QAy04oM)&8ATGZGWZ!#4By%KST9?>!
z8TjF;4yYI#WelqGfi^J^B&zmD@RV|UiMhRIthyb4yY4eD@($1+Ixo?&vo{TC#p!@?
z3h=+Eyg!*Su2C>fo_Y@MbsEEhVIqOQfAT5JMz~tEzKsM$159M=ohT_6hNo-wC@giZ
zv|oYubC>NGiPuHU$pWl&!XVFI)9u;6a(kIsMte=|69(ep?+C76yRM<E#>EXouP-k5
z4zLI_d7wWf<GVYh8)pbttYUvwL(EnSYlPh8Oo8_@wXny?Ze(R>v`s3_aj@NIZo{1=
zG1OtX-9X7)vkUDc!Vyzf6MS$ki0+^UU(U47b>FcA5z1&Kd7Z`}&r8F|;qKJBgSPP0
zP+kb&uqVTWJ?h+)8w%}1?iJuhE_buhxB;gh2E|HT8<DqPc4z{pzG#sd`C%(jVs>^G
zV%MFGj)Sf}dX7kqj)B*9<eB6<H_S|QRn<dP8Dub0wXKs`{WdkRx{^|FVU`oro#64(
zS2f_ST(GSCiG_5IWY0F%=CH6wB;^C85D@CKa<M#?mj2C~&t(O=NTp;}SNuz#IgZ~D
zdkhQ=T(zXEupUbgeRG#n96h&htdB^M43q>jt?NGI!S}E0?e&>a42QN}@l%<wb@#o_
z^|53&5ULLJ4X*bNWhdQG2eEY80*>vf#D}Zps<z;rCDf-0LB&*!2><r4V%2}BE#lwT
zIa8SN&V668QaFc6O{0T${#q_BUk3lmuOH8y2LaCSAOF!30Md(tN<fxWzYylI>)m!4
zX6P4)DG;whr*)(=cA_C~Q~=OL_+@jPGy8ZSCe%tGZY44z!pOq%HaTU7n!1XLLpX;s
zfO)p?0eVHX<4ix0F67RGCUA!Z9AH)cY4``MWA;{hdb)+a4zHJfhSUd+!rh~#(OM}q
z@Y-E4D6vPierMC*`Q8Ri<*9`%^#Mf2J~6GRr{hdrfLx2(+@WOZ#oDEzF35m>y~8qr
z>L0{y^7jQ9z5X~D-7U45vgkVscz@-JwW*O&KY)2GS&0}UKm06yP!WN6^AE(zyc&1(
zgcf)PzO0WxQynp5CIkCqC2ruMnNdZL1>0FVX?@)nN{)nf3_ly1DI}+ey{5o~0CG{5
z$)X8oLPM@gsy?V?QHVMZ=8@(j@V!m*-e+dcP2zc&&d<f=jg^=}c4<&JCXg;Y_^{J=
z-6Z2c+cl4cS^?yWX`ZZxWJ2Xb3t*nbqN8D74~@6L#IT1^J?uPUI}qAg7f%yc^-`!#
z$wb{{Wp!UZ$cjbl$B1wGKE^|Mo^18c&R<U~nBEQD{yEwNWYa{HV%GZ+^WwmB+Oea(
zy=2uC)G2r7MnkQJ1#D2R2NTO{Ye}<h3dP&`u|?cmT-Bbl!6olE`<_aTA^|liAu-XQ
z)(M3uI{vXA(gB4Hw&KJAYD8dvp;*j5Y*KG?!J^GUpH{b8#A%=El}UtYJr0Zt-VP!M
zif3)EP;p7VE1R1rAtyk`F$xYl=dwH^*em`KS!&ifS!Yj3E#SPg4rJ{FD+bDpqD9)}
zF)v*lUa`7mH)UbSmp^(lttxO3lI7%VDv+f$ove>*N%;qrUdr!D6*Umq{Dtw9tjGSK
z&<TP@=IE5eDa2g&P~$G6$bW!h1{>EQl^xn|jy-mE*S}YKEYd*uZGh@t=MOQDI~-!-
z;!~{^kr!geb7f|U%@hXv3)F|;1Ox;-Yhyg#oqH^i+18WA??pr2*fD<Qv$O1r3hU2d
zU?MNFw3b@~>>fa+eM>V5`u<IWoT)AF02_5UA5ui@v#TlNsXMU_aiK~+?W@mm^y_*k
zyKrv`{RaM1<HeE5*cHHz*~M(LEehXZVPphbArmJPqr~$lj?s6Rb4<fLg;7M&4Y1TB
zgs7v3bSm|F<N%Wbd8Le9x#bWmz}+I78_ajfQYSW#;op)WE`S`wYq;ir@in;;T%$X$
zp8!BBvPg?7OI@_fGWP~=jo}Thi+f`)s20KzcAnz4WSURXCGyF*;oQ7Lsyi-;EJ7tl
zz0+@6I4z=E6>jBZ6%?f9j^x^B?72?froyUkVlb4Vwq<p7697F3bm>yj+VSy41_%l+
zcmJd$YtBP`U^@>8MV@SI<t4ZkL><>-*Sg$4VTsz?mtRTb`OXUH%MSjxOU<Z+onW6$
zn}E%rDxgR7114)s?fsms1tLmns>9{sz8v_+k3WN4Xou`{UHZ38UcLH;S9wXz?FIUe
zV7#!ThoIDr03K<9f&MCt)MzIs(Ms!iI1jll4^OExdO|+B-157S&wgEY3>h_RjudT>
zSWCV=dP9^Fk{H3p?=mC;_$H2XZrCcW=VY9Q*Ug8a#y{K911I%|i|k2K>?6(<>{b`W
zy!WJ+zf|arJEO;)Fk?=3oM^a)FPcV4T{T~I_!Xc{ffp>xG4N%kt-f|g`m-<VDdS-%
zVSc-Dm|p(SYPvDXldZjEpv|I>vB!&fY@}MR##!vu+?P&4o*c!Lg!oU7qd`-NA)R5_
zi4{LETeV=@794#~EABZ_WnsJmkFkDS!#tDr5^C2u^b>_=8ZY3X4`^xEsfBs1Hsn^m
zt12R3=yQGj{pn6@LWa+>P3VQn9dTmKRFA0AwA53Cc6ntw^+TuD!HBNl_wW16%FH(!
zC%q0ue6~Hij|2h67p7a`@TueOfjJcwHS-#?nT^FoeG#7$K)N|-o@#L0-Pu0v@wAxw
zT;E3M!e7nyT-(4EK`RjQ_QAm*h~}17+oCqT=t=M;B%f7S4%E0x9_-zx)K-~U9Zm~b
z<kYFGT!=mc;9TDj9zj(c<{D;r1~*21{HR3m_#xFbVS29w12LZ&h&D77x2NTD18Ks4
z6kW;=#Qv-<{}x@UBJ~aSS=-m=-1jP!O9ozN9ZgXg?>2miQGK%BDaRw+_Fncq0)nm5
z#V!iLmuiBm09F(q5uwt6P_~x`N%zH`)S#=BPue0AE6tscu=Xo>s`dVv4DzE>qfmss
z-;ekEg}(9CqoW~ae7wB5er7MUnC^<C!?G|aJQA}t(c++?)N9i&CChM^-AQ1~1dowG
z^+nB@ARR%;`cMdKF;Hlu9epGq&dPe{4uD#8tMTXAWfp$kobh8i)PS%}>TZ8nk&%`z
zZWAG>13m(TwKC5htIfTStqceJT&Sc*5yaGb;*q4}Le#2EMfMMmJ7<iZ9D`Hu-;kb%
ziGfku)K!khH$@@Zl^G{)&}{Q?HxD;1)5Co<M7v6tWBaFtyRvehLyQFT6+oDF1E*(3
z^Cqd|7rq}B*l}RPfiS)^nyacVCt&GS7JgooQp}D(?pGD)XqQ{|_nW@yn6ro+g}p)V
zhPrxT`76!$j?1O#13xSoo7ow*k6*`f)6vZw*X~-bthDtcJ>V12TY!IHRgF+(V5nNt
zVg-<qh=_@~OcO-3c*EI3K}v@N<cN3w74q~~XYuInK(F!!m@O(r*;V&A_!T770|=TV
zuThTp0J!z)NF=#d3)AISj8*pbn`-aE!)f)6Znb!aU8_U-UnmWnQs6f%eeclx3n#i(
zpqvProm(<OmzI}HE>^S-4$je*Vjyp-Mn<|QD*=1_o)Bw-KG}73rA^UCda`49*tFS6
zK<UfL1YVjnp0Qa5Qa%8J4G^J#vyx4}NPI6e$8W}yZNKo*6VE5@q0yklk5loEib{m_
z<7aA_cf`?X6sei5ZR?SA%kH@|0#N%WzNRyhYCJarZ(d17<K&>c?yIc#$)N_>*c<DZ
z%_dWukvi|TA!>+#9Uni}Z2`mkrb6?)Y%Ke`Qg`k)2I`(pX_3xHe3H5tjj<Q^-1$gG
zev=CBz3$E;(>`P~{__~YB|#gXelxXb;0^sHv3;+x5*sEP)ErABOHME7F00iOaJO39
zD`^X-QUsi;vb#JyPjz%G*ZfOBkCKJOazA&!C!3GAG43qLdLDP=yngYb8(22^R);-L
zhc>8d!Am^aVCIupVbk2)Jc1k?RIB(Hk&u_h-1BpbumyGKJY1kzIae1P9Bg4>VI40t
zS5jgx$*9oFoRyaLXfKsMM<tO3dP++geT{l`Wf_S?!f|Gp&*hJf33O}SliBF(F&pyP
zOD~D9s#c5sdGqE?3aYU@c{Wyo2evOvQDM{(zG(P6c_vEt%$zK6R&ehrtY2fi>B-ih
zX=xl885te5Cq)NqeEWp%Gi_>{CK$;pBmtbew5Y=qcEr>hT4s>ky)S<1#U=&i1gz;i
zGc~)_?gDIqu-6v$$Hfpm&MIzob*&A6^Ezo`XJyT^OPhkLcYx7Q{h~ayTTon_Hn>db
zVvFkQ9Zb^-uCT?9C=)Jnr1?HQV+&D#n|Z~Yaf6I39a&ub;D&NvpRt?3*DF`A4h{`1
zK-!P6zs^n<K)mO>(g%|uEDG0m9E?SRh6Bh6P0lpnpbLEyvFr0BeBO~f?o6V1x;HZm
zlM@<B+{A7Y8yipl@%lF$G&$Ap@EUx0-=%EXb#`U@15Ttr!N)c{S$AUN`K&P0L`4NO
zt)G{ty-nJpfkd|7i@s$aX`Y+Ey1F`5*S(tLbM(``^Bvc|+rFvI`6<%0P)jAp+t1T{
z(o)embrW@G8(mu1bj|nG;GlZX`AuYFV>--K)MIO{6Url}d@1oHl6mDNreH3FUqe%K
zcZg`RRVC_a8;1QpCAVn?Dmo?xc_gjv;VVIF+dakiH-c4e9=5io-k|}{U<a!dvlM7W
zfPQ^UQzg38H-E|$esl!zvwIvNjTQ6HV+NSM>F++Ky{f9dX}`HeK)?uCK6;O*zDMv)
z`Am85*$;I4ET2RW@$Gp}y-R{w>mbDucrr3F5PsYDm#^o%PX%u6X-g(#enR*W5fN(v
z?BqRq4`5cz^z=_@KSq~-Ur+bZ1%Ps7dpl*~Eud)fIeY2z2yxUkdm4mS3HB#hg^1mC
zbQ-qqYorjrt@<Z7@Ez={>_W(TOH>|s*h-b!`uZvLAL)1*us=_pwkgtPY=M=Ldi}8P
z@wTKq#lUl+3Xy-XQgaQPmu?J}Qmlz+X)4Cj92}I#r_){kO+a0K^oxL65~8Z9xjNqS
z*$(YJxcr)8n%8*eYPR|P*2cGuoT&}B$cSLybjqE-Bj?%l6jMWkKg5aJRlGHdPi8}~
z_4Yt%sgoLBFBU2vANU1b8!NR^v^gFdoH_NrxVP~KyUqG1V@c(#*c|fmmEHzg5B^J2
zrhVRf#fyF*h$|A+XUS)_8>@lBWQTzjiNM~{V2Z$#l~#7jf-y*ePNn;PgsE9iQilHS
z!g^x0j{(_NawjkGy3<E&JyH2E(Ju%qW2*rKksTFM@6eggYVt#c&wf8?6f@{W;I$Z&
zlhw&fLO&7|5qFQK5{{WcmC}ba2K<Nx)3LN<gM^m6twQo}V5I6RI5h1SUY#;!`HSe}
zkFWy~ME<E*LlZO=laoH)hFuxL)yRWfg0p^h_YC)pRC(`5ZXP%KoZ72e$$@@?HC=4<
ziz3OHLoa%#Rm%0Tl0^82AJ6rG*M$4#k;HB{z&?`}j6=GTctQ#cO59uW=JR#Qs^a3}
z?>lOL)8KfeUFC78Fus$_JUCKeWhEFLJ$4ol=KZbTl?r&-K>%8>9=ufqc%^;Qh0dh$
zItiW?S+4IkARcASV~xy_dpRwI@Ft=d@%d5?8HVEZ9LY33X`*r$)NOdZ9+Xk2)?0Ll
zIIaV6SF)hn%3l1`Ys?@xHKgcybZbAzae7Y)JrZhgG5+I`(q*0}SNiO0R)j#KKO-<V
z@?Bx*zCldf_+Ggo@)u||GE(){-lwth?F3$nHTQ$7m>@y>Ba_7qy*xJ5UZgVO)yf=;
z)Z$5}9f&f1^iIv}eVXko+8q}lJ9i=AzlT};`RYjHUkuha1aY;mP5{Jn#9s0APyG~q
zMOyJ>Auj?|yrhTDPqekG!3Noh=6TWU3xmPfVhbNMjHDKqoV)WU0U<#%$QwL5%lxgV
zX=&Y}B9EbOA-Q~FbKV;?5aObQDdNB37bk8I-gCaexb(;0^b56PZvxz9d>RVw*>Koh
zKvu}5NP2!<sVkE)i;(Bm=kxdE8JHUGq~i80U)mdFH?tj|KGD)mU~9pp)^O9=n>(VP
z`)<Tt7B~3ah#!qc*h`6L7o)*bO%G^nbd%Fn<2|;Fh<R26Kn_6w<lv1vnl}$-Ce<aa
zQ6(X9SAPk5SNsmVAXT|lbswk-<^J$Z^#@#!U!My!-AR8XP5!qP=%57T`rDriltiZg
zeHw@6w@&c?UkpazAA-XFM;_fNcsEW@iPAE0P&RzrF&^(+#PC%&*qg-{xR*voLg88A
IlNWFQ3%4muSO5S3

literal 0
HcmV?d00001

diff --git a/docs/getting-started.md b/docs/getting-started.md
index 690d98e2..28d7184f 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -1,341 +1,231 @@
-# Getting started
+# Get started with AgentGit
 
-Five minutes, and nothing to build: **no Rust, no Node, no tokens to make by hand.** You download the programs, start an
-evaluation server that sets itself up, sign in, land a first change, and see a policy say no and tell you why.
+Install once, open the local demo, and make your first reviewed change. The release includes
+the Web UI and all five programs; you do not need Rust, Node.js, a database server, or an API key.
 
-> **Version.** This guide targets the published [`v0.3.0-beta.5` candidate](https://github.com/Paffin/AgentGit/releases/tag/v0.3.0-beta.5), which includes `ag-server dev`, `ag login`,
-> `ag explain` and policy presets. If you still use the previous candidate, use
-> [the 0.2.0-rc.2 procedure](#on-020-rc2-until-the-next-release). This is an early public beta; independent production qualification is still pending.
+This guide uses the published [v0.3.0-beta.7](https://github.com/Paffin/AgentGit/releases/tag/v0.3.0-beta.7)
+for Linux and macOS. AgentGit is an early public beta. Use the demo to evaluate the workflow;
+[deployment and backup instructions](operations/deployment.md) cover a real team server.
 
-## 1. Get the programs
+## 1. Install
 
-A release archive for Linux or macOS (x86_64 and aarch64). The script checks the checksum before it installs anything and
-puts `ag`, `ag-server`, `ag-worker` and `ag-mcp` in `~/.local/bin`:
+Copy this into a terminal on Linux or macOS:
 
-```bash
-curl -fsSL https://raw.githubusercontent.com/Paffin/AgentGit/main/scripts/install.sh | sh -s -- --version 0.3.0-beta.5   # use the candidate version
+```sh
+curl -fsSL https://raw.githubusercontent.com/Paffin/AgentGit/main/scripts/install.sh | sh -s -- --version 0.3.0-beta.7
+export PATH="$HOME/.local/bin:$PATH"
 ag --version
 ```
 
-(No stable release exists yet, so `latest` skips pre-releases and the script needs `--version`. More ways, including
-the container images, Homebrew and building from source, are under [Install](#install).)
+The installer detects Intel/AMD or ARM, verifies the archive checksum, and installs into
+`~/.local/bin` without `sudo`. If GitHub CLI is installed and signed in, it also verifies build
+provenance. [Read the installer](../scripts/install.sh) or [choose another installation method](#install).
 
-## 2. Start the evaluation server
+## 2. Open the demo
 
-```bash
-ag-server dev
+```sh
+ag-server dev --open
 ```
 
-```text
-AgentGit dev server: for trying AgentGit out, not for real work
-  - loopback only (127.0.0.1), plain HTTP; do not expose this port
-  - one administrator (user:dev); its credential lives 8 hours, is replaced at every start and is kept in /home/you/ag-dev-data/dev/token
-  - the demo repository demo/welcome has the `agents` policy preset (`ag remote policy main --explain` says what it means); data in /home/you/ag-dev-data
+The browser opens a signed-in demo repository, `demo/welcome`. Keep this terminal running.
+No account creation or manual token setup is needed. If the browser does not open, use the
+link printed in the terminal. That link signs in as you; do not share it.
 
-Open in a browser (signs you in; the link carries the credential, so do not share it):
-  http://127.0.0.1:8080/repos/demo/welcome#token=agt_…
+The demo listens on your own machine, uses `./ag-dev-data`, and keeps its repositories when
+restarted from the same directory. Stop it with **Ctrl-C**. Starting it again replaces the
+short-lived demo sign-in credentials. This local evaluation mode is separate from
+[production deployment](operations/deployment.md).
 
-A second user, user:reviewer, can approve what user:dev proposes (nobody's own approval counts); its credential is in /home/you/ag-dev-data/dev/reviewer-token.
+## 3. Make your first change
 
-Command line:
-  ag login http://127.0.0.1:8080 --token-file /home/you/ag-dev-data/dev/token
-  ag clone http://127.0.0.1:8080/demo/welcome
+In the browser:
 
-Credential expires 2026-10-21T10:16:50.403Z. Stop with Ctrl-C; start again with the same --data-dir to keep everything.
-```
-
-That one command made the data directory `./ag-dev-data` (delete it to start over), an administrator with a fresh
-credential, a demo repository with four sample files, and the `agents` [policy preset](guides/policy.md#start-from-a-preset).
-Start it again with the same directory and your repository, history and any policy changes stay; only the credential is replaced, and the old one stops working.
-Options: `--port N` (`0` picks a free one), `--data-dir DIR`, `--open` (opens the browser for you).
-
-**What differs from a real deployment**, and why you should not keep anything you care about here: it listens on
-`127.0.0.1` only and speaks plain HTTP (it refuses another address unless you add `--allow-non-loopback`); its single
-administrator credential lives 8 hours, where a deployment's default is 24 hours and its cap 30 days, and changes at every start; the
-policy is a fixed preset; there is no single sign-on, no TLS, no backups. For a real server see [Deploying `ag-server`](operations/deployment.md).
+1. Open **Code**, then `src/greeting.py`.
+2. Choose **Edit**, change `Hello` to `Hi`, and choose **Propose change**.
+3. Review the diff and give the change a title. Submit it as a change request.
+4. Open the change request and choose **Land**. The demo policy lets you land this simple change.
 
-*Containers (not run here: this machine has no Docker daemon).* In a container the server has to listen on all of its own
-interfaces, so publish the port to your loopback only:
-`docker run --rm -p 127.0.0.1:8080:8080 ghcr.io/paffin/agentgit-server:<a version that has `dev`> dev --data-dir /data --host 0.0.0.0 --allow-non-loopback`.
-The browser link works as printed; for the command line, fetch the credential from the container's `/data/dev/token`
-(`docker cp CONTAINER:/data/dev/token -` writes it as a tar stream) and pass it to `ag login --token-stdin`.
+Your change is now in the `main` stream. A change request is the reviewable unit; landing it
+checks policy before moving the stream. The [Git comparison](concepts-cheatsheet.md) maps
+these terms to branches, commits, and pull requests you already know.
 
-## 3. Sign in
+### Prefer the command line?
 
-**In the browser**, open the link from the banner. It signs you in and opens the demo repository's live board. The
-credential is in the part of the address after `#`, which a browser never sends to a server; the page removes it from the
-address bar at once. The trade-offs are written down in [The Web UI](guides/web-ui.md#signing-in).
+Open a second terminal in the directory where you started the demo, then run:
 
-**On the command line**, run the two commands from the banner:
-
-```bash
-ag login http://127.0.0.1:8080 --token-file ~/ag-dev-data/dev/token
+```sh
+export PATH="$HOME/.local/bin:$PATH"
+ag login http://127.0.0.1:8080 --token-file ./ag-dev-data/dev/token
 ag clone http://127.0.0.1:8080/demo/welcome
 cd welcome
 ```
 
-```text
-Logged in to http://127.0.0.1:8080 as user:dev (the credential expires 2026-10-21T10:16:50.403Z).
-Saved in ~/.config/agentgit/credentials.json (readable by you only); `ag clone`, `ag fetch`, `ag push` and `ag remote` to this server use it.
-Cloned demo/welcome into welcome (1 changeset(s), 4 blob(s)); stream 'main' at acdaaa5b59af.
-```
-
-`ag login` asks the server who the credential belongs to before it saves anything, and the saved file is yours alone
-(mode 0600). From now on `ag clone`, `ag fetch`, `ag push` and `ag remote …` to this server need no token. A variable such as
-`AG_TOKEN` still takes precedence, so a script can say which credential it wants. `ag logout URL` forgets it.
+The server also prints these commands with the actual address and absolute credential path.
+Use those if you chose another port or data directory. Login saves the credential in your
+user configuration; future `ag` commands use it automatically.
 
-## 4. Your first change
+Edit `src/greeting.py` in your editor, then:
 
-```bash
-sed -i.bak 's/Hello/Hi/' src/greeting.py && rm src/greeting.py.bak    # or edit it with any editor
-ag status                                  # shows: modified  src/greeting.py
-ag snapshot -m "A friendlier greeting"     # record the working directory (no staging area)
-ag push -t "A friendlier greeting"         # publish it and open a proposal on the server
-ag remote proposals                        # the id is the first column; any unique prefix works
-ag remote integrate prop_90168b            # the policy decides; here it lets a person land their own change
+```sh
+ag status
+ag snapshot -m "A friendlier greeting"
+ag push -t "A friendlier greeting"
+ag remote proposals
+ag remote integrate <proposal-id>
 ag pull
 ```
 
-```text
-Snapshot fe468b68f68b in workspace 'default'
-Uploaded 2 object(s) and opened proposal prop_90168b6ce4176298a007 -> 'main'.
-Integrated (fast_forward): stream is now at fe468b68f68b (version 2), 1 file(s) changed.
-```
-
-You made a **snapshot** (a private record of your directory), **published** it as a **proposal**, and the server
-**integrated** it: it checked the **policy** and moved the stream `main` with a compare-and-swap. Refresh the live board in the
-browser and the change is there. [Concepts](concepts.md) has the vocabulary; [Git to AgentGit](concepts-cheatsheet.md) maps it
-from what you already know.
-
-## 5. See the policy say no, and why
+Use the proposal ID printed by `ag push`; a unique prefix works too. `snapshot` records your
+working directory without a staging step. `push` publishes it for review, and `integrate`
+lands it if policy permits. [Remote workflow](guides/remote.md) covers the complete loop.
 
-The demo policy protects `SECURITY.md`: a change to it needs an approval from somebody other than its author.
+## 4. See what a policy protects
 
-```bash
-echo "Report problems to security@example.org." >> SECURITY.md
-ag snapshot -m "Contact address"
-ag push -t "Contact address"
-ag remote integrate prop_05ff36       # exit status 3: blocked (the id from `ag push`, or the newest in `ag remote proposals`)
-```
-
-```text
-Blocked (policy v1); the stream was not changed:
-  - approvals (SECURITY.md): 0 of 1 required
-Provide what is missing, then run `ag remote integrate prop_05ff36` again.
-  ag remote review prop_05ff36 --approve
-`ag remote prepare prop_05ff36` shows what is still missing.
-```
+The demo protects `SECURITY.md`. Propose a change to that file and try to land it: AgentGit
+asks for another person's approval and explains why. Your own approval does not count.
 
-Nobody's own approval counts, so the demo made a second user for you. Review as her, then land it as yourself:
+From a cloned demo repository, inspect the rules and a blocked change with:
 
-```bash
-AG_TOKEN=$(cat ~/ag-dev-data/dev/reviewer-token) ag remote review prop_05ff36 --approve
-ag remote integrate prop_05ff36
-```
-
-Exit status **3** means *blocked*: something you can provide is missing, and the output names the command that provides it.
-**4** means *refused*: a conflict or a denial. Scripts and agents branch on those, not on the text.
-
-What the policy allows and refuses, in plain words, read from the policy document itself:
-
-```bash
+```sh
 ag remote policy main --explain
+ag remote explain <proposal-id>
 ```
 
-For a proposal in a repository of your own, `ag explain [PROPOSAL]` says why it does not land yet and lists the exact
-commands that fix each reason (a check to run, a review to ask for, a lease to take, a conflict to resolve).
-
-## Where to go next
-
-- **Let an agent in.** `ag agent register`, `ag agent start`, and the autonomy envelope the `agents` preset sets: [Running agents](guides/agents.md), and
-  [Your first agent-safe repository](tutorials/first-agent-safe-repo.md) (its commands are run by the tests).
-- **Choose a policy.** `ag policy preset list` shows `solo`, `team`, `agents` and `strict`; [Policy](guides/policy.md#start-from-a-preset).
-- **Come from Git.** [Git to AgentGit](concepts-cheatsheet.md) and [Migrating from Git](tutorials/migrating-from-git.md).
-- **Run it for a team.** [Deploying `ag-server`](operations/deployment.md) and the [team-server tutorial](tutorials/team-server.md).
+To complete the example, the demo provides a second reviewer credential at
+`./ag-dev-data/dev/reviewer-token` relative to the directory where the server started.
+Use that identity for a review, then return to your own identity to land the change.
+[The agent-safe repository tutorial](tutorials/first-agent-safe-repo.md) walks through
+approval, checks, leases, and refused changes step by step.
 
-## On 0.2.0-rc.2 (until the next release)
+## Troubleshooting
 
-The pre-release has no `dev` command, so the server needs three steps of its own. These were run against the published
-`v0.2.0-rc.2` Linux archive (checksum verified by `install.sh`):
+| What happened | Next step |
+|---|---|
+| `ag: command not found` | Run `export PATH="$HOME/.local/bin:$PATH"` in this terminal, or use the exact program path printed by the installer. Add that directory to your shell's startup file if you want it in future terminals. |
+| Port 8080 is in use | Start `ag-server dev --open --port 0`; it picks a free port and prints the correct login commands. |
+| The browser did not open | Copy the local sign-in link from the server terminal. |
+| Download discovery failed or GitHub rate-limited it | Use the version-pinned install command above. [Release downloads](https://github.com/Paffin/AgentGit/releases) are also available directly. |
+| An old demo login stopped working | Use the new link or login command printed after restarting the server. |
 
-```bash
-export AG_BOOTSTRAP_TOKEN=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n')   # the administrator secret, from the environment
-ag-server admin --data-dir ./ag-data create-repo demo/welcome
-ag-server serve --data-dir ./ag-data &                                           # 127.0.0.1:8080
-export AG_TOKEN=$AG_BOOTSTRAP_TOKEN                                              # every ag command below uses it
-ag clone http://127.0.0.1:8080/demo/welcome && cd welcome
-echo "# welcome" > README.md
-ag snapshot -m "first" && ag push -t "First change"
-ag remote integrate prop_…           # there is no policy yet, so a person's change lands
-```
+## Install
 
-In the browser, open `http://127.0.0.1:8080/` and paste `$AG_BOOTSTRAP_TOKEN` as the access token. The bootstrap token is
-all-powerful; use it only to make real credentials (`ag-server admin mint`), then unset it.
-There is no `ag login` in rc.2: keep `AG_TOKEN` set, or use `--token-stdin` with `ag clone`. Stop the server with `kill %1` (or Ctrl-C if it runs in its own terminal).
+The release archive contains `ag`, `ag-server`, `ag-worker`, `ag-mcp`, and `orchestrator`.
+The Web UI is embedded in `ag-server`; there is no separate frontend server to configure.
 
-## Install
+| Platform | Available release archive |
+|---|---|
+| Linux with glibc | x86_64 and ARM64 |
+| macOS | Intel and Apple Silicon |
+| Windows | Build from source; a native release archive is not published yet |
+| Alpine / musl | Use the container image or build from source |
 
-AgentGit ships three programs: `ag` (the command line), `ag-server` (the network server, with `ag-server dev` for trying it
-out) and `ag-worker` (runs validation jobs), and `ag-mcp` for agents. Pick the way that suits you:
+### Installer options
 
-> **Building from source always works.** What was verified about the release files is in
-> [Releasing](operations/releasing.md#evidence).
+The version-pinned command above is reproducible. Omitting `--version` selects the latest
+stable release; while no stable release exists, it selects and identifies the latest
+published prerelease. It never selects a draft release.
 
-**1. Release archive (Linux and macOS, x86_64 and aarch64)** — a script that checks what it downloads:
+```sh
+# Inspect the planned version, platform and destination without installing.
+sh scripts/install.sh --version 0.3.0-beta.7 --dry-run
 
-```bash
-curl -fsSL https://raw.githubusercontent.com/Paffin/AgentGit/main/scripts/install.sh | sh -s -- --version 0.3.0-beta.5   # no stable release yet: `latest` skips pre-releases
-ag --version                              # ag 0.3.0-beta.2 (549555c82219 2026-10-27): version, commit, commit date
+# Choose a directory you own. Binaries go into /your/path/bin.
+sh scripts/install.sh --version 0.3.0-beta.7 --prefix /your/path
 ```
 
-It works out your platform, downloads `agentgit-<version>-<target>.tar.gz` and `SHA256SUMS`, refuses to install
-anything if the checksum differs, additionally verifies the build-provenance attestation when the GitHub CLI is
-installed and logged in, and installs `ag`, `ag-server`, `ag-worker` and `ag-mcp` into `~/.local/bin` (no root). Options:
-`--version X.Y.Z`, `--prefix DIR`, `--dry-run` (print what it would do), `--require-attestation`. Read it first
-if you like: [`scripts/install.sh`](../scripts/install.sh) is short and `shellcheck`-clean. The Linux binaries
-need glibc (Alpine/musl is not supported; use the container image or build from source). Doing it by hand:
-
-```bash
-V=0.3.0-beta.2; T=x86_64-unknown-linux-gnu          # or aarch64-unknown-linux-gnu, aarch64-apple-darwin, x86_64-apple-darwin
-curl -fsSLO https://github.com/Paffin/AgentGit/releases/download/v$V/agentgit-$V-$T.tar.gz
-curl -fsSLO https://github.com/Paffin/AgentGit/releases/download/v$V/SHA256SUMS
-sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c SHA256SUMS --ignore-missing
-gh attestation verify agentgit-$V-$T.tar.gz --repo Paffin/AgentGit     # optional, needs gh
-tar xzf agentgit-$V-$T.tar.gz && install agentgit-$V-$T/ag* ~/.local/bin/
-```
+These examples assume you downloaded [install.sh](../scripts/install.sh). Its `--help` also
+lists mirror and target options. Use `--require-attestation` to require a successful
+`gh attestation verify` check, or `--no-attestation` to explicitly use checksum verification
+alone. The installer prints a copyable command to launch the demo, even if the destination
+is not on your PATH. It does not change shell profiles or start a server automatically.
+
+### Containers
 
-**2. Container images** (`linux/amd64` and `linux/arm64`, distroless, non-root):
-`docker run --rm ghcr.io/paffin/agentgit-cli:0.3.0-beta.5 --version`, and
-`ghcr.io/paffin/agentgit-server` for the server — see [Deploying `ag-server`](operations/deployment.md).
+Images for Linux AMD64 and ARM64 are published as `ghcr.io/paffin/agentgit-cli` and
+`ghcr.io/paffin/agentgit-server`. Use the `0.3.0-beta.7` tag for this guide. See the
+[container deployment instructions](operations/deployment.md) for ports, persistent data,
+credentials, and the validation worker.
 
-**3. Homebrew / Scoop.** The repository carries a formula and a manifest *template* under
-[`packaging/`](../packaging) and `scripts/render_packaging.py` fills them from a release's `SHA256SUMS` (every
-release attaches the rendered `agentgit.rb`). There is no tap and no Scoop bucket yet, and the release workflow does not build
-a Windows archive yet (the Windows port is tested by its own workflow), so treat both as unpublished.
+### Build from source
 
-**4. From source.** You need Rust **1.89+** and a C compiler (SQLite is compiled in). `git` and `python3` are
-optional (Git bridge, demo script).
+The CLI requires Rust **1.89+** and a C compiler. SQLite is included:
 
-```bash
+```sh
 git clone https://github.com/Paffin/AgentGit
 cd AgentGit
-cargo install --path crates/ag-cli      # installs `ag` into ~/.cargo/bin
-cargo install --path crates/ag-server   # optional: the server
+cargo install --locked --path crates/ag-cli
 ag --version
 ```
 
-Or just build it: `cargo build --release -p agentgit-cli` → `target/release/ag`. (The crates are not on crates.io yet. Their packages are named `agentgit-*`, so Cargo's `-p` flag says
-`-p agentgit-cli`, while the directories (`crates/ag-cli`), binaries and library names keep the short `ag` names;
-[Releasing](operations/releasing.md#cratesio) has the scheme and the publish order.)
+For the embedded Web UI, build the frontend before the server (Node.js **22.18+** is required here):
+
+```sh
+npm ci --prefix apps/web
+npm run build --prefix apps/web
+cargo install --locked --path crates/ag-server
+ag-server dev --open
+```
+
+Homebrew and Scoop packaging templates are in [`packaging/`](../packaging). A maintained tap
+or bucket is not published yet; do not treat those templates as an installed package source.
+[Release engineering](operations/releasing.md) describes the archives and verification.
 
 ## Your first repository, without a server
 
-```bash
+Use the CLI entirely locally when you do not need shared review or a browser:
+
+```sh
 mkdir hello && cd hello
-export AG_IDENTITY=user:alice            # who you are; defaults to user:$USER
-ag init --namespace me/hello             # creates .ag/ and the stream "main"
-
-echo "# hello" > README.md
-ag status                                # added README.md
-ag snapshot -m "first"                   # record the working directory (a *snapshot*)
-ag propose -t "Initial import"           # publish it and open a proposal
-ag integrate <proposal-id>               # move the stream "main" to include it
+ag init --namespace me/hello
+printf '# Hello\n' > README.md
+ag snapshot -m "First version"
+ag propose -t "Initial import"
+ag integrate <proposal-id>
 ag log
 ```
 
-Proposal ids are long; any unique prefix of at least six characters works
-(`ag integrate prop_8f3a`). `ag proposal list` shows them.
-
-What just happened, in AgentGit terms:
-
-1. `snapshot` stored your files as immutable *blobs* and a *changeset* in your **workspace**. Nothing is
-   visible to anyone else yet.
-2. `propose` **published** the changeset — every object was re-read and verified, then registered in a
-   single transaction — and opened a **proposal** targeting the stream `main`.
-3. `integrate` computed the result (a fast-forward here, a deterministic merge in general), checked
-   **policy**, and atomically moved the head of `main` with a compare-and-swap.
-
-Read [Concepts](concepts.md) for the full vocabulary.
+`ag propose` prints the ID; `ag proposal list` shows it again. Local work lives in `.ag/`.
 
 ## Working with a team (or with agents)
 
-```bash
-ag workspace create alice-fix --dir ../alice-fix   # an isolated line of work, in its own directory
-cd ../alice-fix && $EDITOR src/lib.rs
-ag snapshot -m "fix off-by-one" --workspace alice-fix
-ag propose @alice-fix -t "Fix off-by-one"
-ag preview <proposal>          # what would integration do? conflicts? (changes nothing)
-ag integrate <proposal>
-ag sync --workspace alice-fix  # bring the stream's new head into the workspace
-```
-
-If two people edit the same lines, `integrate` reports a **conflict** (exit code 4) and leaves the
-stream untouched. Run `ag sync`: the clean parts are applied and conflicting files get
-`<<<<<<< ours` markers. Resolve them, `ag snapshot`, `ag proposal update <id> @workspace`, integrate again.
+Connect with `ag login https://YOUR-SERVER`, then clone the repository URL your team gives
+you. [The remote workflow](guides/remote.md) covers fetch, push, review, and offline work.
+[Migrate from Git](guides/migrate-from-git.md) when you already have a repository.
 
 ## Making "landed" mean something
 
-By default anyone who is not an agent can integrate. Pick a [preset](guides/policy.md#start-from-a-preset) to require
-reviews, or reviews and a signed check, and read back what it means:
-
-```bash
-ag policy preset list                       # solo, team, agents, strict
-ag policy preset apply team --ci-key ci    # one approval from somebody else, and a signed check named "tests"
-ag policy explain                           # the policy in plain words, read from the document itself
-
-ag integrate <proposal>          # exit code 3: "check 'tests' has no trusted passing attestation…"
-ag explain <proposal>            # why, and the exact commands that fix each reason
-ag validate run <proposal> --check tests --key ci -- cargo test
-ag --as user:bob proposal review <proposal> --approve     # somebody else: your own approval does not count
-ag integrate <proposal>          # lands; the attestation names the exact tree that was checked
-```
-
-A preset is an ordinary policy document, so you can `ag policy preset show team > policy.json`, edit it and
-`ag policy set policy.json`; `ag init --preset team` chooses one when the repository is made. Or write one by hand:
-`ag policy example > policy.json`.
-
-Details: [Policy reference](guides/policy.md), [Validation](guides/validation.md).
-
-A longer version of this, with an agent, a lease and a refused integration at every step, is
-[Your first agent-safe repository](tutorials/first-agent-safe-repo.md); its commands are run by the tests.
+Choose a [policy preset](guides/policy.md#start-from-a-preset) for approvals, protected paths,
+and checks. The [agent-safe repository tutorial](tutorials/first-agent-safe-repo.md) shows
+a complete, tested example.
 
 ## Running agents
 
-```bash
-ag agent register refactor-bot          # identity + signing key
-ag agent start refactor-bot             # prints: act as agent:refactor-bot#run_…
-export AG_IDENTITY=agent:refactor-bot#run_…
-ag lease acquire 'src/**' --exclusive   # prints a fencing token
-```
-
-See [Agents guide](guides/agents.md) for the full loop (tasks, leases, provenance, autonomy limits).
+Start with [the agents guide](guides/agents.md). It covers the MCP server, agent identities,
+scoped credentials, executor setup, tasks, and leases.
 
 ## The whole story in one script
 
-[`examples/quickstart.sh`](../examples/quickstart.sh) runs a human, two agents and a CI service through
-policy, a blocked integration, a lease, a conflict and its resolution. Run it and read its output:
-
-```bash
-cargo build --release -p agentgit-cli && ./examples/quickstart.sh
-```
+[`examples/quickstart.sh`](../examples/quickstart.sh) demonstrates a human, two agents and a
+CI service working through a conflict and policy checks. It uses an existing `ag` binary.
 
 ## Machine-readable output and exit codes
 
-Every command accepts `--json`. Exit codes are stable: `0` ok, `1` error, `2` usage error,
-`3` blocked (something you can provide is missing), `4` refused (conflict / denied / invalid).
-Scripts and agents should branch on these, not on message text. See the
-[CLI reference](reference/cli.md).
+Every command accepts `--json`. Exit codes are **0** success, **1** error, **2** usage error,
+**3** blocked by a requirement you can provide, and **4** refused (conflict, denial or invalid
+result). Scripts should use those codes and JSON fields. See the [CLI reference](reference/cli.md).
 
 ## Where things live
 
-```text
-hello/
-├── README.md             your files
-└── .ag/
-    ├── config.json       namespace, default stream
-    ├── meta.db           SQLite: index, streams, reflog, audit, policy…  (+ -wal/-shm while open)
-    ├── store/objects/    immutable, content-addressed blobs and changesets
-    └── keys/             agent and issuer private keys (0600) — keep out of untrusted environments
-```
+Your local repository uses `.ag/` for configuration, metadata, objects and private keys.
+The demo server uses `./ag-dev-data` by default. Back up local repositories with
+`ag backup <dir>` and verify them with `ag verify`; [server operations](operations/deployment.md)
+cover shared storage and backups. Removing the installed binaries does not remove repositories.
+
+<a id="on-020-rc2-until-the-next-release"></a>
+
+## Upgrading from 0.2.0-rc.2
 
-Back it up with `ag backup <dir>`; check it with `ag verify`.
+That historical candidate did not have `ag-server dev` or saved `ag login` sessions. Use a
+current release for this walkthrough. If you must maintain it, the
+[rc.2 release record](operations/releasing.md#evidence) documents its limits; do not apply
+newer metadata migrations without a backup and a tested upgrade path.
diff --git a/scripts/install.sh b/scripts/install.sh
index 7f990349..a2f08d77 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -10,9 +10,9 @@
 # check fails. Read it before piping it into a shell; it is short on purpose.
 #
 # Options:
-#   --version X.Y.Z   the release to install (default: the latest non-prerelease)
+#   --version X.Y.Z   pin a release (default: latest stable, or latest published prerelease if none)
 #   --prefix DIR      install under DIR (default: $AG_PREFIX, else ~/.local); binaries go to DIR/bin
-#   --dry-run         say what would happen, download and install nothing
+#   --dry-run         show the selected release, download no archive and install nothing
 #   --require-attestation   fail unless `gh attestation verify` ran and passed (needs `gh auth login`)
 #   --no-attestation  never run `gh attestation verify`
 #   --target TRIPLE   override platform detection (x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu,
@@ -114,10 +114,31 @@ sha256_of() {
 if [ "$version" = latest ]; then
   [ -z "$base_url" ] || die "--base-url needs an explicit --version"
   command -v curl >/dev/null 2>&1 || die "need curl to look up the latest release (or pass --version)"
-  final=$(curl -fsSLI -o /dev/null -w '%{url_effective}' "https://github.com/$REPO/releases/latest") ||
-    die "could not look up the latest release (pass --version X.Y.Z)"
-  version=${final##*/}
-  case "$version" in v[0-9]*) ;; *) die "no published release found at https://github.com/$REPO/releases (pass --version, or build from source)" ;; esac
+  lookup=$(curl -sSLI -o /dev/null -w '%{http_code} %{url_effective}' "https://github.com/$REPO/releases/latest") ||
+    die "could not reach GitHub to look up a release (pass --version X.Y.Z to skip discovery)"
+  status=${lookup%% *}
+  final=${lookup#* }
+  case "$status:$final" in
+    "200:https://github.com/$REPO/releases/tag/v"[0-9]*) version=${final##*/} ;;
+    "200:https://github.com/$REPO/releases" | "200:https://github.com/$REPO/releases/" | 404:*) version="" ;;
+    *) die "could not look up the stable release (HTTP $status; pass --version X.Y.Z to skip discovery)" ;;
+  esac
+  case "$version" in
+    v[0-9]*) ;;
+    *)
+      # The unauthenticated API lists published releases only. Keep the one-item response
+      # small and require draft=false as well; never install an unreleased candidate.
+      release=$(curl -fsSL --retry 3 "https://api.github.com/repos/$REPO/releases?per_page=1") ||
+        die "could not look up a published release (pass --version X.Y.Z)"
+      printf '%s\n' "$release" | grep -Eq '"draft"[[:space:]]*:[[:space:]]*false' ||
+        die "no published release found at https://github.com/$REPO/releases (pass --version, or build from source)"
+      version=$(printf '%s\n' "$release" | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)
+      case "$version" in
+        v[0-9]*-*) say "Using published prerelease $version (no stable release found)." ;;
+        v[0-9]*) say "Using published release $version." ;;
+        *) die "no published release found at https://github.com/$REPO/releases (pass --version, or build from source)" ;;
+      esac ;;
+  esac
 fi
 version=${version#v}
 case "$version" in
@@ -147,7 +168,7 @@ say "AgentGit $version for $target"
 say "  from    $base_url/$archive"
 say "  into    $bindir ($BINARIES)"
 if [ "$dry_run" -eq 1 ]; then
-  say "dry run: nothing was downloaded or installed"
+  say "dry run: no archive was downloaded or installed"
   exit 0
 fi
 
@@ -213,7 +234,19 @@ fi
 
 say "installed:$installed"
 "$bindir/ag" --version 2>/dev/null || warn "installed, but '$bindir/ag --version' did not run on this machine"
+shell_quote() { printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"; }
 case ":${PATH:-}:" in
   *":$bindir:"*) ;;
-  *) say "note: $bindir is not on your PATH; add it, e.g.  export PATH=\"$bindir:\$PATH\"" ;;
+  *)
+    say "To use ag in this terminal:"
+    say "  export PATH=$(shell_quote "$bindir"):\"\$PATH\"" ;;
+esac
+case "$version" in
+  0.0.* | 0.1.* | 0.2.0-rc.[12])
+    say "This legacy release predates the local demo and saved login."
+    say "See https://github.com/$REPO/blob/main/docs/getting-started.md#on-020-rc2-until-the-next-release" ;;
+  *)
+    say "Try the local demo in your browser:"
+    say "  $(shell_quote "$bindir/ag-server") dev --open"
+    say "Already have a team server? Run ag login https://YOUR-SERVER to connect." ;;
 esac
diff --git a/scripts/test_release_scripts.py b/scripts/test_release_scripts.py
index 955a0efa..0de5d8d3 100644
--- a/scripts/test_release_scripts.py
+++ b/scripts/test_release_scripts.py
@@ -11,6 +11,7 @@
 import os
 import pathlib
 import re
+import shlex
 import shutil
 import subprocess
 import sys
@@ -282,6 +283,77 @@ def test_install_sh_installs_and_runs(self):
         self.assertTrue((prefix / "share/doc/agentgit/LICENSE").is_file())
         self.assertEqual(list((prefix / "bin").glob(".*")), [], "no temporary files left behind")
 
+    def discover_release(self, stable, latest, lookup_error=None):
+        tools = self.dir / "discovery-tools"
+        tools.mkdir(exist_ok=True)
+        curl = tools / "curl"
+        lookup = lookup_error or ("200 " + (stable or "https://github.com/Paffin/AgentGit/releases"))
+        lookup_command = "exit 7" if lookup_error == "network" else "printf '%s' " + shlex.quote(lookup)
+        curl.write_text("#!/bin/sh\n" +
+                        "case \"$*\" in\n" +
+                        "  *releases/latest*) " + lookup_command + ";;\n" +
+                        "  *api.github.com*) printf '%s' " + shlex.quote(json.dumps(latest)) + ";;\n" +
+                        "  *) exit 1;;\nesac\n")
+        curl.chmod(0o755)
+        return run("sh", SCRIPTS / "install.sh", "--dry-run", "--target", self.target,
+                   env={"PATH": str(tools) + os.pathsep + os.environ["PATH"], "AG_VERSION": ""})
+
+    def test_default_install_prefers_stable_release(self):
+        result = self.discover_release("https://github.com/Paffin/AgentGit/releases/tag/v1.2.3",
+                                       [{"tag_name": "v2.0.0-beta.1", "draft": False, "prerelease": True}])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("AgentGit 1.2.3 for", result.stdout)
+        self.assertNotIn("2.0.0-beta.1", result.stdout)
+
+    def test_default_install_falls_back_to_published_prerelease(self):
+        result = self.discover_release(None, [{"tag_name": "v0.3.0-beta.7", "draft": False, "prerelease": True}])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("AgentGit 0.3.0-beta.7 for", result.stdout)
+        self.assertIn("prerelease", result.stdout)
+
+    def test_default_install_uses_published_release_after_stable_404(self):
+        result = self.discover_release(None, [{"tag_name": "v0.3.0-beta.7", "draft": False}],
+                                       lookup_error="404 https://github.com/Paffin/AgentGit/releases/latest")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("AgentGit 0.3.0-beta.7 for", result.stdout)
+
+    def test_default_install_fails_clearly_on_network_error(self):
+        result = self.discover_release(None, [{"tag_name": "v0.3.0-beta.7", "draft": False}], lookup_error="network")
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("could not reach GitHub", result.stderr)
+        self.assertNotIn("Using published prerelease", result.stdout)
+
+    def test_default_install_does_not_treat_http_errors_as_a_beta_selection(self):
+        for status in ("401", "403", "429", "503"):
+            with self.subTest(status=status):
+                result = self.discover_release(None, [{"tag_name": "v0.3.0-beta.7", "draft": False}],
+                                               lookup_error=status + " https://github.com/Paffin/AgentGit/releases/latest")
+                self.assertNotEqual(result.returncode, 0)
+                self.assertNotIn("Using published prerelease", result.stdout)
+
+    def test_default_install_refuses_missing_or_draft_releases(self):
+        for releases in ([], [{"tag_name": "v0.3.0-beta.7", "draft": True, "prerelease": True}]):
+            with self.subTest(releases=releases):
+                result = self.discover_release(None, releases)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertIn("no published release", result.stderr)
+
+    def test_install_next_steps_are_copyable_with_a_shell_sensitive_prefix(self):
+        prefix = self.dir / "Agent's tools $(touch UNEXPECTED)"
+        release = self.release_dir()
+        result = run("sh", SCRIPTS / "install.sh", "--version", self.version, "--prefix", prefix,
+                     "--base-url", f"file://{release}", "--no-attestation")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        start = next(line.strip() for line in result.stdout.splitlines() if " dev --open" in line)
+        launched = run("sh", "-c", start, cwd=self.dir)
+        self.assertEqual(launched.returncode, 0, launched.stderr)
+        self.assertIn("ag-server", launched.stdout)
+        path = next(line.strip() for line in result.stdout.splitlines() if "export PATH=" in line)
+        activated = run("sh", "-c", path + "\nag --version", cwd=self.dir)
+        self.assertEqual(activated.returncode, 0, activated.stderr)
+        self.assertIn(self.version, activated.stdout)
+        self.assertFalse((self.dir / "UNEXPECTED").exists())
+
     def test_install_sh_works_under_dash_when_available(self):
         ag_testkit.require_component("dash", self.id(), shutil.which("dash"), "dash is not installed")
         p, prefix = self.install(shell="dash")
@@ -326,6 +398,14 @@ def test_an_incomplete_archive_does_not_replace_an_existing_install(self):
                 self.assertIn(binary, result.stderr)
                 self.assertEqual(old.read_text(), "old installation")
 
+    def test_legacy_install_does_not_recommend_commands_it_did_not_ship(self):
+        self.version = "0.2.0-rc.2"
+        result, _ = self.install()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertNotIn("dev --open", result.stdout)
+        self.assertNotIn("ag login", result.stdout)
+        self.assertIn("legacy release", result.stdout)
+
     def test_pre_beta4_archives_install_without_an_orchestrator(self):
         self.version = "0.3.0-beta.3"
         d = self.release_dir()

From 6210f9974da0da124ed18795c1705a72f6f79274 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 21:45:40 +0000
Subject: [PATCH 13/41] feat(distribution): prepare native Windows installation

Package the supported Windows clients in a deterministic ZIP, verify downloads before per-user installation, and require native first-use smoke before future release publication. Keep current beta.7 availability explicit.

Validated: 15 offline PowerShell/package tests, 54 POSIX regression tests, workflow/docs checks and nine killed targeted mutations. Native Windows and PowerShell 5.1 remain gated in CI.
---
 .github/workflows/windows.yml     |  30 ++++
 CHANGELOG.md                      |   2 +
 ROADMAP.md                        |  17 +-
 docs/operations/windows.md        |  58 +++++--
 scripts/install.ps1               | 174 +++++++++++++++++++
 scripts/package_release.py        |  76 +++++---
 scripts/smoke_windows_release.ps1 |  26 +++
 scripts/test_windows_release.py   | 276 ++++++++++++++++++++++++++++++
 8 files changed, 617 insertions(+), 42 deletions(-)
 create mode 100644 scripts/install.ps1
 create mode 100644 scripts/smoke_windows_release.ps1
 create mode 100644 scripts/test_windows_release.py

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index bedf9222..41d00e2c 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -37,6 +37,14 @@ jobs:
           git config --show-origin --get-all core.autocrlf
           where.exe nasm
         continue-on-error: true
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: apps/web/package-lock.json
+      - name: Build the embedded Web UI
+        shell: bash
+        run: scripts/build_ui.sh
       - name: Build everything that is portable
         run: cargo build --workspace --all-targets
       # The execution plane (ag-sandbox, ag-worker) is Linux-only: ag-sandbox is empty here, ag-worker is a
@@ -60,3 +68,25 @@ jobs:
         run: |
           $env:AG = "$PWD\target\debug\ag.exe"
           .\examples\quickstart.ps1
+
+      - name: Windows archive and installer regression tests
+        run: python scripts/test_windows_release.py
+      - name: Installer tests on Windows PowerShell 5.1
+        shell: pwsh
+        run: |
+          $env:AG_TEST_PWSH = (Get-Command powershell.exe).Source
+          python scripts/test_windows_release.py
+      - name: Package, install and run the native Windows client
+        shell: pwsh
+        run: |
+          $version = python -c "import pathlib,tomllib; print(tomllib.loads(pathlib.Path('Cargo.toml').read_text())['workspace']['package']['version'])"
+          ./scripts/smoke_windows_release.ps1 -Version $version -BinDir target/debug
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: windows-install-rehearsal
+          path: |
+            dist/*.zip
+            dist/SHA256SUMS
+            dist/install.ps1
+          if-no-files-found: error
+          retention-days: 14
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 252e1501..b0703527 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Added
 
+- The release pipeline prepares a native Windows x64 ZIP with the CLI, server and MCP, plus a per-user PowerShell installer that verifies checksums. Native install-and-first-use smoke is required before publishing; the first Windows archive is not yet released.
+
 - Reviewers can explicitly save a private review draft to their account and resume on another device through Web UI, CLI, MCP or SDKs. Local drafts remain available, conflicting drafts require a choice, and versioned saves/clears never overwrite newer notes or submit a review. Development schema 10 requires a pre-upgrade backup.
 
 - Browser conflict resolution can keep either exact binary, oversized or file-type version while preserving blob bytes, executable mode and symlink type. Virtual sync pins the inspected branch through its final transaction and reports its exact target to SDK/MCP clients.
diff --git a/ROADMAP.md b/ROADMAP.md
index d58c6ad1..1eb0f953 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -95,10 +95,10 @@ result, understand policy decisions and land a verified change. Migration must l
 team reach that workflow without losing its history or silently discarding hosting metadata.
 Work in the following order; keep each deliverable usable across the relevant clients.
 
-1. **Deliver the next development slice.** Beta.5 is published; its Linux archive checksum,
-   provenance and upgrade to development schema 7 have been verified. Admission controls and
-   task sources are already merged; they need their own subsequent release and schema-8 upgrade
-   notice, not a replacement beta.5 tag.
+1. **Deliver the next development slice.** Beta.7 is published with metadata schema 8.
+   Its Linux archive installation and first reviewed change have been exercised end to end.
+   The next release must include the development review workflow and its schema-10 upgrade
+   notice with backup/rollback guidance; existing beta tags remain immutable.
 2. **Finish the daily task and review workflow.** Queued-task refinement now preserves
    historical instructions and source links. Proposal updates now have an atomic inspected-head
    precondition as the prerequisite for safe review edits. Workspace mutations now compare the
@@ -116,7 +116,9 @@ Work in the following order; keep each deliverable usable across the relevant cl
    source YAML alone is not a working validation pipeline. Keep Git export and rollback visible
    in the [migration guide](docs/guides/migrate-from-git.md).
 4. **Qualify the real first-use experience.** Native archives already include the orchestrator;
-   browser setup prepares scoped executor access. Record an end-to-end run in a real MCP host
+   browser setup prepares scoped executor access. The Linux beta.7 archive now has an isolated
+   install-to-first-change smoke, and the installer/READMEs lead with that path. Record an
+   end-to-end run in a real MCP host
    ([#50](https://github.com/Paffin/AgentGit/issues/50)), clean macOS published-archive installation
    ([#52](https://github.com/Paffin/AgentGit/issues/52)), a screen-reader session
    ([#53](https://github.com/Paffin/AgentGit/issues/53)) and a physical-phone session
@@ -124,8 +126,9 @@ Work in the following order; keep each deliverable usable across the relevant cl
    ([#51](https://github.com/Paffin/AgentGit/issues/51)); automated browser runs do not substitute
    for these reports. The development rules form now edits protected-path approvers and check timing while preserving
    runner settings. Keep the dev sign-in exchange and remaining advanced controls on the onboarding backlog.
-5. **Finish distribution and widen support deliberately.** Verify Homebrew installation, add
-   a Windows release archive, publish crates and SDKs when registry ownership/trusted publishing
+5. **Finish distribution and widen support deliberately.** Verify Homebrew installation and
+   run the prepared Windows ZIP/PowerShell installer pipeline on a native Windows runner before
+   publishing its first archive. Publish crates and SDKs when registry ownership/trusted publishing
    is configured, and qualify installation outside CI. A stable tag follows the
    [beta exit evidence](docs/community/beta.md#release-gates), not a count of shipped features.
 6. **Qualify deployment and server follow-ups.** Compose and kind deployment already run in CI.
diff --git a/docs/operations/windows.md b/docs/operations/windows.md
index ad69a580..670485f3 100644
--- a/docs/operations/windows.md
+++ b/docs/operations/windows.md
@@ -23,24 +23,54 @@ what works, what is adapted, what is refused, and which tests prove each stateme
 | `ag clone/fetch/pull/push`, `ag remote` | works | TLS is rustls with bundled roots (no OpenSSL, no Windows certificate store) |
 | `ag-server` (HTTP/JSON + gRPC, SQLite metadata, filesystem objects) | works | console process; Ctrl+C / Ctrl+Break / closing the console stop it gracefully |
 | PostgreSQL metadata, S3 objects | client code compiles and its offline tests run; **not exercised against a server on Windows** | the backend suites need a PostgreSQL / S3 test server (Linux job) |
-| Web UI, SDKs, Go orchestrator | not part of this page | not run by the Windows workflow |
+| Web UI | embedded build and HTTP first-use smoke in development Windows packaging | interactive browser qualification on Windows remains open |
+| SDKs, Go orchestrator | not part of this page | no native executor is included in the Windows ZIP |
 | `ag-sandbox`, `ag-worker` | **not supported** | the sandbox is Linux namespaces/seccomp/cgroups (or a container runtime). `ag-worker.exe` builds, but every invocation prints *"not supported on this platform"* and exits 2 (`crates/ag-worker/tests/unsupported.rs`). `ag validate run` still works: it runs a command **without** sandboxing, as it does everywhere. |
 
 ## Install
 
-Build from source (a release installer is the release track's job, see [Releasing](releasing.md)):
-
-1. Rust 1.89+ (`rustup`), the *MSVC* toolchain (`x86_64-pc-windows-msvc`).
-2. Visual Studio Build Tools with the **Desktop development with C++** workload (SQLite and the TLS libraries
-   are compiled from source). The CI runner also has NASM on `PATH`; whether a clean machine needs it is **(unverified)**.
-3. `cargo install --path crates/ag-cli` and `cargo install --path crates/ag-server`.
-4. Git for Windows only if you use `ag git ...`.
-
-A built binary needs no installer; whether it needs the Visual C++ redistributable depends on the CRT linkage
-(**unverified**: build with `-C target-feature=+crt-static` to avoid it).
-
-The demo from the README runs on Windows as [`examples/quickstart.ps1`](../../examples/quickstart.ps1) (PowerShell 7
-and Windows PowerShell 5.1); CI runs it in both.
+**The published beta.7 release has no Windows archive.** For that release, build from source using the
+instructions below. The development release workflow now prepares a native x86_64 ZIP with `ag.exe`,
+`ag-server.exe` (including the Web UI) and `ag-mcp.exe`. It excludes the Linux-only worker and the
+executor that has not been qualified on Windows. A native Windows build, isolated install and first-use
+smoke test must pass before the ZIP can be included in a future tagged release.
+
+To try an unpublished build, download the `windows-install-rehearsal` artifact from a successful
+[Windows workflow](../../.github/workflows/windows.yml) run and extract it into a folder you own.
+It contains the distribution ZIP, `SHA256SUMS` and `install.ps1`. From that folder, use the version in
+the ZIP filename (replace `VERSION` below):
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\install.ps1 -Version VERSION -BaseUrl . -NoAttestation -Prefix "$env:LOCALAPPDATA\AgentGit-preview"
+& "$env:LOCALAPPDATA\AgentGit-preview\bin\ag-server.exe" dev --open
+```
+
+Stop any running AgentGit programs before upgrading an existing installation.
+The installer verifies the ZIP checksum before writing executables. It only extracts the three named
+programs and does not change your PowerShell profile or permanent `PATH`. Its final output includes
+commands for adding the installation to the current terminal and opening the demo. A custom directory
+can contain spaces or brackets. Remove that installation directory to uninstall; demo data remains in
+`ag-dev-data` beneath the directory where you launched the server.
+
+A public release's download can additionally be verified with `gh attestation verify` when GitHub CLI is
+installed and signed in; `-RequireAttestation` makes that mandatory. Rehearsal artifacts are not attested,
+so use `-NoAttestation` when testing one with a signed-in GitHub CLI. Without an explicit version the
+installer selects a published release that actually contains a Windows ZIP. Until one exists, it says
+so without installing anything. The executables are not Authenticode-signed; this flow does not bypass
+Windows application trust decisions.
+
+### Build from source today
+
+1. Install Rust 1.89+ (`rustup`), using `x86_64-pc-windows-msvc`.
+2. Install Visual Studio Build Tools with **Desktop development with C++**. SQLite and TLS libraries
+   compile from source. CI also has NASM on `PATH`; whether a clean machine needs it remains unverified.
+3. Run `cargo install --path crates/ag-cli --locked` and `cargo install --path crates/ag-server --locked`.
+4. Install Git for Windows only if you use `ag git ...`.
+
+The future release ZIP builds with a static C runtime to avoid requiring a separate Visual C++
+redistributable. That packaging path still needs its first Windows release-run qualification.
+The CLI demo also runs as [`examples/quickstart.ps1`](../../examples/quickstart.ps1), tested in
+PowerShell 7 and Windows PowerShell 5.1.
 
 ## What AgentGit does with your files on Windows
 
diff --git a/scripts/install.ps1 b/scripts/install.ps1
new file mode 100644
index 00000000..e8249196
--- /dev/null
+++ b/scripts/install.ps1
@@ -0,0 +1,174 @@
+<#
+.SYNOPSIS
+Installs AgentGit's native Windows CLI, server and MCP client for the current user.
+.DESCRIPTION
+Downloads a published Windows ZIP and SHA256SUMS, verifies it, then installs only the
+three expected executables. No administrator rights or permanent PATH edits are needed.
+Windows archives are planned for the next release; beta.7 has no Windows ZIP.
+.PARAMETER Version
+Release version, without v. By default prefer the newest published stable release,
+or a prerelease when no stable release has a compatible Windows archive.
+.PARAMETER Prefix
+Installation directory; defaults to LOCALAPPDATA\AgentGit. Binaries go in bin.
+.PARAMETER BaseUrl
+Release mirror URL or local directory, for offline installation. Requires Version.
+#>
+[CmdletBinding()]
+param(
+    [string]$Version = 'latest',
+    [string]$Prefix = '',
+    [string]$BaseUrl = '',
+    [switch]$DryRun,
+    [switch]$RequireAttestation,
+    [switch]$NoAttestation
+)
+$ErrorActionPreference = 'Stop'
+
+function Find-WindowsRelease {
+    param([object[]]$Releases)
+    return @($Releases | Where-Object {
+        $expected = 'agentgit-' + ($_.tag_name -replace '^v', '') + '-x86_64-pc-windows-msvc.zip'
+        $_.draft -eq $false -and $_.tag_name -and @($_.assets | Where-Object { $_.name -ceq $expected }).Count
+    })
+}
+
+function Get-LatestWindowsVersion {
+    $firstPreview = $null
+    $page = 1
+    do {
+        $url = "https://api.github.com/repos/Paffin/AgentGit/releases?per_page=100&page=$page"
+        $batch = Invoke-RestMethod -Uri $url -Headers @{'User-Agent'='AgentGit installer'} -TimeoutSec 30
+        $compatible = @(Find-WindowsRelease $batch)
+        $stable = @($compatible | Where-Object { $_.prerelease -eq $false })
+        if ($stable.Count) { return $stable[0].tag_name }
+        if (-not $firstPreview -and $compatible.Count) { $firstPreview = $compatible[0] }
+        $page++
+    } while ($batch.Count -eq 100)
+    if (-not $firstPreview) { throw 'No Windows archive published yet. See docs/operations/windows.md for source builds.' }
+    Write-Host "Using published prerelease $($firstPreview.tag_name) (no compatible stable release found)."
+    return $firstPreview.tag_name
+}
+
+function Resolve-Version {
+    param([string]$Requested)
+    if ($Requested -eq 'latest') {
+        if ($BaseUrl) { throw '-BaseUrl requires an explicit -Version.' }
+        $Requested = Get-LatestWindowsVersion
+    }
+    $clean = $Requested -replace '^v', ''
+    if ($clean -notmatch '^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]+)?$') { throw "Invalid release version: $Requested" }
+    return $clean
+}
+
+function Get-ReleaseFile {
+    param([string]$Base, [string]$Name, [string]$Destination)
+    if ($Base -match '^https?://') {
+        Invoke-WebRequest -UseBasicParsing -Uri ($Base.TrimEnd('/') + '/' + $Name) -OutFile $Destination -TimeoutSec 30
+    }
+    else {
+        if ($Base.StartsWith('file://')) { $Base = ([Uri]$Base).LocalPath }
+        Copy-Item -LiteralPath (Join-Path $Base $Name) -Destination $Destination
+    }
+}
+
+function Assert-Checksum {
+    param([string]$Archive, [string]$Sums, [string]$Name)
+    $pattern = '^([0-9a-fA-F]{64})\s+\*?' + [regex]::Escape($Name) + '$'
+    $matches = @(Get-Content -LiteralPath $Sums | Where-Object { $_ -match $pattern })
+    if ($matches.Count -ne 1) { throw "SHA256SUMS must contain exactly one checksum for $Name." }
+    $expected = [regex]::Match($matches[0], $pattern).Groups[1].Value
+    if ((Get-FileHash -LiteralPath $Archive -Algorithm SHA256).Hash -ne $expected) {
+        throw 'Archive checksum mismatch. Nothing was installed.'
+    }
+    Write-Host 'Archive checksum verified.'
+}
+
+function Assert-Attestation {
+    param([string]$Archive)
+    # Windows PowerShell 5.1 converts native stderr into ErrorRecords. Inspect native exit
+    # codes explicitly so an unauthenticated gh can fall back to checksum-only verification.
+    $ErrorActionPreference = 'Continue'
+    if ($NoAttestation) { return }
+    $gh = Get-Command gh -ErrorAction SilentlyContinue
+    if ($gh) {
+        & $gh.Source auth status *> $null
+        if ($LASTEXITCODE -eq 0) {
+            & $gh.Source attestation verify $Archive --repo Paffin/AgentGit
+            if ($LASTEXITCODE -ne 0) { throw 'Build-provenance verification failed. Nothing was installed.' }
+            return
+        }
+    }
+    if ($RequireAttestation) { throw '-RequireAttestation needs the GitHub CLI installed and logged in.' }
+    Write-Host 'Note: checksum verified; build provenance needs an authenticated GitHub CLI.'
+}
+
+function Expand-Executables {
+    param([string]$Archive, [string]$Top, [string]$Destination)
+    Add-Type -AssemblyName System.IO.Compression.FileSystem
+    $zip = [IO.Compression.ZipFile]::OpenRead($Archive)
+    try {
+        foreach ($binary in @('ag.exe', 'ag-server.exe', 'ag-mcp.exe')) {
+            $entries = @($zip.Entries | Where-Object { $_.FullName -ceq "$Top/$binary" })
+            if ($entries.Count -ne 1) { throw "Archive must contain exactly one $binary. Nothing was installed." }
+            # Only exact known entries are extracted; arbitrary paths in the archive are never used.
+            $inputStream = $entries[0].Open()
+            try {
+                $outputStream = [IO.File]::Create((Join-Path $Destination $binary))
+                try { $inputStream.CopyTo($outputStream) } finally { $outputStream.Dispose() }
+            }
+            finally { $inputStream.Dispose() }
+        }
+    }
+    finally { $zip.Dispose() }
+}
+
+function Quote-Path {
+    param([string]$Path)
+    return "'" + $Path.Replace("'", "''") + "'"
+}
+
+try {
+    if ($RequireAttestation -and $NoAttestation) { throw 'Choose either -RequireAttestation or -NoAttestation.' }
+    $architecture = $env:PROCESSOR_ARCHITEW6432
+    if (-not $architecture) { $architecture = $env:PROCESSOR_ARCHITECTURE }
+    if ($architecture -and $architecture -ne 'AMD64') { throw 'Native archives currently support x86_64 Windows only.' }
+    $resolved = Resolve-Version $Version
+    if (-not $Prefix) {
+        if (-not $env:LOCALAPPDATA) { throw 'LOCALAPPDATA is not set; pass -Prefix with a directory you own.' }
+        $Prefix = Join-Path $env:LOCALAPPDATA 'AgentGit'
+    }
+    $Prefix = [IO.Path]::GetFullPath($Prefix)
+    $bin = Join-Path $Prefix 'bin'
+    $top = "agentgit-$resolved-x86_64-pc-windows-msvc"
+    $name = "$top.zip"
+    if (-not $BaseUrl) { $BaseUrl = "https://github.com/Paffin/AgentGit/releases/download/v$resolved" }
+    Write-Host "AgentGit $resolved for Windows x86_64"
+    Write-Host "  from $BaseUrl/$name"
+    Write-Host "  into $bin"
+    if ($DryRun) { Write-Host 'Dry run: nothing was downloaded or installed.'; return }
+    $temp = Join-Path ([IO.Path]::GetTempPath()) ('agentgit-install-' + [guid]::NewGuid().ToString('N'))
+    New-Item -ItemType Directory -Path $temp | Out-Null
+    try {
+        $archive = Join-Path $temp $name
+        Get-ReleaseFile $BaseUrl $name $archive
+        $sums = Join-Path $temp 'SHA256SUMS'
+        Get-ReleaseFile $BaseUrl 'SHA256SUMS' $sums
+        Assert-Checksum $archive $sums $name
+        Assert-Attestation $archive
+        Expand-Executables $archive $top $temp
+        New-Item -ItemType Directory -Path $bin -Force | Out-Null
+        foreach ($binary in @('ag.exe', 'ag-server.exe', 'ag-mcp.exe')) {
+            Copy-Item -LiteralPath (Join-Path $temp $binary) -Destination (Join-Path $bin $binary) -Force
+        }
+    }
+    finally { Remove-Item -LiteralPath $temp -Recurse -Force }
+    Write-Host 'Installed ag.exe, ag-server.exe and ag-mcp.exe.'
+    Write-Host 'To use ag in this terminal:'
+    Write-Host ('  $env:Path = ' + (Quote-Path $bin) + ' + [IO.Path]::PathSeparator + $env:Path')
+    Write-Host 'Try the local demo in your browser:'
+    Write-Host ('  & ' + (Quote-Path (Join-Path $bin 'ag-server.exe')) + ' dev --open')
+}
+catch {
+    Write-Error $_ -ErrorAction Continue
+    exit 1
+}
diff --git a/scripts/package_release.py b/scripts/package_release.py
index b69fca08..1beb8c6d 100644
--- a/scripts/package_release.py
+++ b/scripts/package_release.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """Builds the release archives and checksums. Python 3 standard library only, so it behaves the same on the
-Linux and macOS runners (BSD tar has no --sort/--mtime).
+Linux, macOS and Windows runners (BSD tar has no --sort/--mtime).
 
     scripts/package_release.py archive --version 0.2.0 --target x86_64-unknown-linux-gnu \\
         --bin-dir target/x86_64-unknown-linux-gnu/release --out dist
@@ -10,7 +10,8 @@
 `ag-server`, `ag-worker`, `ag-mcp`, `orchestrator`, LICENSE, NOTICE, THIRD_PARTY_LICENSES.md and README.md, plus `completions/` and `man/` when the files exist
 (`--include-dir completions=PATH`). It is deterministic: entries sorted, owner 0:0, modes 0755/0644, a fixed
 mtime (SOURCE_DATE_EPOCH, else the HEAD commit time) and no gzip timestamp, so the same inputs give the same
-bytes.
+bytes. Windows x86_64 archives use .zip and contain the supported ag.exe, ag-server.exe and ag-mcp.exe;
+the Linux-only worker and unqualified Windows executor are not included.
 """
 
 from __future__ import annotations
@@ -24,10 +25,14 @@
 import subprocess
 import sys
 import tarfile
+import time
+import zipfile
 
 ROOT = pathlib.Path(__file__).resolve().parent.parent
 RUST_BINARIES = ["ag", "ag-server", "ag-worker", "ag-mcp"]
 BINARIES = [*RUST_BINARIES, "orchestrator"]
+WINDOWS_TARGET = "x86_64-pc-windows-msvc"
+WINDOWS_BINARIES = ["ag.exe", "ag-server.exe", "ag-mcp.exe"]
 DOCS = ["LICENSE", "NOTICE", "README.md", "THIRD_PARTY_LICENSES.md"]
 
 
@@ -56,41 +61,70 @@ def add(tar: tarfile.TarFile, arcname: str, data: bytes | None, mode: int, mtime
         tar.addfile(info, io.BytesIO(data))
 
 
-def cmd_archive(args: argparse.Namespace) -> None:
-    mtime = source_date_epoch()
-    top = f"agentgit-{args.version}-{args.target}"
+def archive_entries(args: argparse.Namespace) -> list[tuple[str, bytes, int]]:
     bin_dir = pathlib.Path(args.bin_dir)
-    entries: list[tuple[str, bytes, int]] = []  # (path inside the top dir, content, mode)
-    for b in BINARIES:
-        p = bin_dir / b
-        if not p.is_file():
-            die(f"{p} does not exist (build the Rust binaries and Go orchestrator; see docs/operations/releasing.md)")
-        entries.append((b, p.read_bytes(), 0o755))
-    for d in DOCS:
-        entries.append((d, (ROOT / d).read_bytes(), 0o644))
-    for spec in args.include_dir or []:
+    entries: list[tuple[str, bytes, int]] = []
+    binaries = WINDOWS_BINARIES if args.target == WINDOWS_TARGET else BINARIES
+    for binary in binaries:
+        path = bin_dir / binary
+        if not path.is_file():
+            die(f"{path} does not exist (build the binaries; see docs/operations/releasing.md)")
+        entries.append((binary, path.read_bytes(), 0o755))
+    for doc in DOCS:
+        entries.append((doc, (ROOT / doc).read_bytes(), 0o644))
+    entries.extend(included_entries(args.include_dir or []))
+    return sorted(entries)
+
+
+def included_entries(specs: list[str]) -> list[tuple[str, bytes, int]]:
+    entries: list[tuple[str, bytes, int]] = []
+    for spec in specs:
         name, _, path = spec.partition("=")
         src = pathlib.Path(path)
         if not src.is_dir():
             print(f"note: {src} does not exist; no {name}/ in the archive", file=sys.stderr)
             continue
-        for f in sorted(p for p in src.rglob("*") if p.is_file()):
-            entries.append((f"{name}/{f.relative_to(src).as_posix()}", f.read_bytes(), 0o644))
-    out = pathlib.Path(args.out)
-    out.mkdir(parents=True, exist_ok=True)
-    dest = out / f"{top}.tar.gz"
+        for file in sorted(p for p in src.rglob("*") if p.is_file()):
+            entries.append((f"{name}/{file.relative_to(src).as_posix()}", file.read_bytes(), 0o644))
+    return entries
+
+
+def write_tar(dest: pathlib.Path, top: str, entries: list[tuple[str, bytes, int]], mtime: int) -> None:
     raw = io.BytesIO()
     with tarfile.open(fileobj=raw, mode="w", format=tarfile.PAX_FORMAT) as tar:
         add(tar, top, None, 0o755, mtime, is_dir=True)
         seen_dirs: set[str] = set()
-        for rel, data, mode in sorted(entries):
+        for rel, data, mode in entries:
             parent = os.path.dirname(rel)
             if parent and parent not in seen_dirs:
                 seen_dirs.add(parent)
                 add(tar, f"{top}/{parent}", None, 0o755, mtime, is_dir=True)
             add(tar, f"{top}/{rel}", data, mode, mtime)
-    with open(dest, "wb") as f, gzip.GzipFile(filename="", mode="wb", fileobj=f, mtime=0, compresslevel=9) as gz:
+    with open(dest, "wb") as file, gzip.GzipFile(filename="", mode="wb", fileobj=file, mtime=0, compresslevel=9) as gz:
         gz.write(raw.getvalue())
+
+
+def write_zip(dest: pathlib.Path, top: str, entries: list[tuple[str, bytes, int]], mtime: int) -> None:
+    # ZIP timestamps have two-second precision and cover 1980 through 2107.
+    timestamp = time.gmtime(min(max(mtime, 315532800), 4354819198))[:6]
+    with zipfile.ZipFile(dest, "w", compression=zipfile.ZIP_DEFLATED, compresslevel=9) as archive:
+        for rel, data, mode in entries:
+            info = zipfile.ZipInfo(f"{top}/{rel}", timestamp)
+            info.create_system = 3
+            info.external_attr = mode << 16
+            info.compress_type = zipfile.ZIP_DEFLATED
+            archive.writestr(info, data, compresslevel=9)
+
+
+def cmd_archive(args: argparse.Namespace) -> None:
+    entries = archive_entries(args)
+    top = f"agentgit-{args.version}-{args.target}"
+    out = pathlib.Path(args.out)
+    out.mkdir(parents=True, exist_ok=True)
+    windows = args.target == WINDOWS_TARGET
+    dest = out / (top + (".zip" if windows else ".tar.gz"))
+    writer = write_zip if windows else write_tar
+    writer(dest, top, entries, source_date_epoch())
     print(dest)
 
 
diff --git a/scripts/smoke_windows_release.ps1 b/scripts/smoke_windows_release.ps1
new file mode 100644
index 00000000..9f59b77a
--- /dev/null
+++ b/scripts/smoke_windows_release.ps1
@@ -0,0 +1,26 @@
+# Build a Windows archive from existing binaries, install it in isolation, then exercise first use.
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$Version,
+    [Parameter(Mandatory=$true)][string]$BinDir,
+    [string]$Out = 'dist'
+)
+$ErrorActionPreference = 'Stop'
+python scripts/package_release.py archive --version $Version --target x86_64-pc-windows-msvc --bin-dir $BinDir --out $Out
+if ($LASTEXITCODE) { throw 'Windows archive packaging failed.' }
+Copy-Item -LiteralPath (Join-Path $PSScriptRoot 'install.ps1') -Destination (Join-Path $Out 'install.ps1')
+$zip = Join-Path $Out "agentgit-$Version-x86_64-pc-windows-msvc.zip"
+python scripts/package_release.py sums $zip | Set-Content -Encoding utf8 (Join-Path $Out 'SHA256SUMS')
+if ($LASTEXITCODE) { throw 'Windows archive checksum generation failed.' }
+$prefix = Join-Path ([IO.Path]::GetTempPath()) ('agentgit-windows-smoke-' + [guid]::NewGuid().ToString('N'))
+try {
+    & "$PSScriptRoot/install.ps1" -Version $Version -BaseUrl ([IO.Path]::GetFullPath($Out)) -Prefix $prefix -NoAttestation
+    if ($LASTEXITCODE) { throw 'Windows isolated installation failed.' }
+    foreach ($binary in @('ag.exe', 'ag-server.exe', 'ag-mcp.exe')) {
+        & (Join-Path $prefix "bin/$binary") --version
+        if ($LASTEXITCODE) { throw "$binary did not run from the installed archive." }
+    }
+    python scripts/onboarding_smoke.py --ag (Join-Path $prefix 'bin/ag.exe') --server (Join-Path $prefix 'bin/ag-server.exe')
+    if ($LASTEXITCODE) { throw 'Installed Windows first-use workflow failed.' }
+}
+finally { Remove-Item -LiteralPath $prefix -Recurse -Force -ErrorAction SilentlyContinue }
diff --git a/scripts/test_windows_release.py b/scripts/test_windows_release.py
new file mode 100644
index 00000000..9b355aaf
--- /dev/null
+++ b/scripts/test_windows_release.py
@@ -0,0 +1,276 @@
+#!/usr/bin/env python3
+"""Offline tests for the native Windows archive and per-user installer."""
+from __future__ import annotations
+
+import hashlib
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+import zipfile
+
+ROOT = Path(__file__).resolve().parent.parent
+SCRIPTS = ROOT / "scripts"
+PACKAGE = Path(os.environ.get("AG_TEST_PACKAGE", str(SCRIPTS / "package_release.py")))
+INSTALLER = Path(os.environ.get("AG_TEST_WINDOWS_INSTALLER", str(SCRIPTS / "install.ps1")))
+PWSH = os.environ.get("AG_TEST_PWSH") or shutil.which("pwsh")
+TARGET = "x86_64-pc-windows-msvc"
+VERSION = "9.9.9-rc.1"
+BINARIES = ["ag.exe", "ag-server.exe", "ag-mcp.exe"]
+
+
+def run(*args, **kwargs):
+    return subprocess.run([str(a) for a in args], capture_output=True, text=True, **kwargs)
+
+
+class WindowsArchive(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.bin = self.root / "bin"
+        self.bin.mkdir()
+        for name in BINARIES:
+            (self.bin / name).write_bytes((name + "\n").encode())
+
+    def archive(self, destination="dist", epoch="1700000000"):
+        env = dict(os.environ, SOURCE_DATE_EPOCH=epoch)
+        return run(sys.executable, PACKAGE, "archive", "--version", VERSION,
+                   "--target", TARGET, "--bin-dir", self.bin, "--out", self.root / destination, env=env)
+
+    def test_zip_contains_supported_windows_binaries_and_docs(self):
+        result = self.archive()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        archive = Path(result.stdout.strip())
+        self.assertEqual(archive.name, f"agentgit-{VERSION}-{TARGET}.zip")
+        with zipfile.ZipFile(archive) as package:
+            names = package.namelist()
+            top = f"agentgit-{VERSION}-{TARGET}/"
+            for name in BINARIES + ["LICENSE", "NOTICE", "README.md", "THIRD_PARTY_LICENSES.md"]:
+                self.assertIn(top + name, names)
+            self.assertFalse(any("ag-worker" in name or "orchestrator" in name for name in names))
+            self.assertTrue(all(name.startswith(top) for name in names))
+            self.assertEqual(package.read(top + "ag.exe"), b"ag.exe\n")
+
+    def test_zip_is_deterministic_and_handles_early_epochs(self):
+        first = self.archive("one", "1")
+        second = self.archive("two", "1")
+        self.assertEqual(first.returncode, 0, first.stderr)
+        self.assertEqual(second.returncode, 0, second.stderr)
+        self.assertEqual(Path(first.stdout.strip()).read_bytes(), Path(second.stdout.strip()).read_bytes())
+        with zipfile.ZipFile(Path(first.stdout.strip())) as archive:
+            self.assertTrue(all(entry.date_time[0] >= 1980 for entry in archive.infolist()))
+
+    def test_missing_supported_binary_does_not_create_archive(self):
+        (self.bin / "ag-mcp.exe").unlink()
+        result = self.archive()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("ag-mcp.exe", result.stderr)
+        self.assertFalse(list(self.root.rglob("*.zip")))
+
+
+class ReleaseInputs(unittest.TestCase):
+    def test_release_checksum_recipe_includes_windows_zip(self):
+        import glob
+        import shlex
+        workflow = (ROOT / ".github/workflows/release.yml").read_text()
+        recipe = next(line.strip().split("|", 1)[0].strip() for line in workflow.splitlines()
+                      if "package_release.py sums dist/" in line)
+        patterns = shlex.split(recipe)[3:]
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "dist").mkdir()
+            for name in ["linux-x64.tar.gz", "linux-arm.tar.gz", "mac-x64.tar.gz", "mac-arm.tar.gz",
+                         "windows.zip", "ag.cdx.json", "server.cdx.json", "worker.cdx.json", "mcp.cdx.json"]:
+                (root / "dist" / name).write_bytes(name.encode())
+            files = [path for pattern in patterns for path in glob.glob(str(root / pattern))]
+            result = run(sys.executable, PACKAGE, "sums", *files)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual(len(result.stdout.strip().splitlines()), 9)
+            self.assertIn("windows.zip", result.stdout)
+        self.assertIn("set -- dist/*.zip; test $# = 1", workflow)
+        release = workflow.split("  release:\n", 1)[1]
+        self.assertIn("windows-binaries", release.split("    steps:", 1)[0])
+
+
+@unittest.skipUnless(PWSH, "PowerShell not available; Windows CI runs installer tests")
+class WindowsInstaller(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.dist = self.root / "dist"
+        self.dist.mkdir()
+        self.prefix = self.root / "Agent's [tools] $(never-run)"
+        self.top = f"agentgit-{VERSION}-{TARGET}"
+        self.archive = self.dist / f"{self.top}.zip"
+        self.make_archive()
+
+    def make_archive(self, missing=None, extra=None):
+        with zipfile.ZipFile(self.archive, "w") as archive:
+            for name in BINARIES:
+                if name != missing:
+                    archive.writestr(f"{self.top}/{name}", ("binary-" + name).encode())
+            if extra:
+                archive.writestr(extra, "untrusted extra")
+        self.write_sum()
+
+    def write_sum(self):
+        digest = hashlib.sha256(self.archive.read_bytes()).hexdigest()
+        (self.dist / "SHA256SUMS").write_text(f"{digest}  {self.archive.name}\n")
+
+    def install(self, *args):
+        return run(PWSH, "-NoProfile", "-File", INSTALLER, "-Version", VERSION,
+                   "-BaseUrl", self.dist, "-Prefix", self.prefix, "-NoAttestation", *args)
+
+    def test_installs_supported_binaries_without_changing_profile(self):
+        result = self.install()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        for name in BINARIES:
+            self.assertEqual((self.prefix / "bin" / name).read_bytes(), ("binary-" + name).encode())
+        self.assertIn("ag-server.exe", result.stdout)
+        self.assertIn("dev --open", result.stdout)
+        self.assertIn("Agent''s [tools] $(never-run)", result.stdout)
+        self.assertFalse((self.root / "never-run").exists())
+
+    def test_checksum_failure_does_not_touch_existing_install(self):
+        (self.prefix / "bin").mkdir(parents=True)
+        old = self.prefix / "bin" / "ag.exe"
+        old.write_bytes(b"old installation")
+        self.archive.write_bytes(self.archive.read_bytes() + b"corruption")
+        result = self.install()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("checksum", result.stderr.lower())
+        self.assertEqual(old.read_bytes(), b"old installation")
+        self.assertFalse((self.prefix / "bin" / "ag-server.exe").exists())
+
+    def test_missing_binary_is_rejected_before_installing_anything(self):
+        self.make_archive(missing="ag-mcp.exe")
+        result = self.install()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("ag-mcp.exe", result.stderr)
+        self.assertFalse(self.prefix.exists())
+
+    def test_extra_archive_paths_are_not_extracted(self):
+        self.make_archive(extra=f"{self.top}/../../escaped.txt")
+        result = self.install()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertFalse((self.root / "escaped.txt").exists())
+        self.assertEqual(sorted(p.name for p in (self.prefix / "bin").iterdir()), sorted(BINARIES))
+
+    def discovered(self, releases=None, failure=False):
+        import json
+        payload = json.dumps(releases or []).replace("'", "''")
+        response = "throw 'Network unavailable'" if failure else f"return @(ConvertFrom-Json '{payload}')"
+        installer = str(INSTALLER).replace("'", "''")
+        prefix = str(self.prefix).replace("'", "''")
+        command = ("function Invoke-RestMethod { param($Uri, $Headers) " + response + " }; "
+                   + f"& '{installer}' -Prefix '{prefix}' -DryRun -NoAttestation")
+        return run(PWSH, "-NoProfile", "-Command", command)
+
+    @staticmethod
+    def release(version, preview=False, asset=True, draft=False):
+        name = f"agentgit-{version}-{TARGET}.zip"
+        return {"tag_name": "v" + version, "draft": draft, "prerelease": preview,
+                "assets": [{"name": name}] if asset else []}
+
+    def test_discovery_prefers_a_compatible_stable_release(self):
+        result = self.discovered([self.release("3.0.0-beta.1", True), self.release("2.0.0")])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("AgentGit 2.0.0 for Windows", result.stdout)
+
+    def test_discovery_skips_non_windows_and_draft_releases(self):
+        result = self.discovered([self.release("9.0.0", asset=False),
+                                  self.release("8.0.0", draft=True),
+                                  self.release("3.0.0-beta.1", True)])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("Using published prerelease v3.0.0-beta.1", result.stdout)
+
+    def test_real_rest_json_array_paginates_to_a_compatible_release(self):
+        import http.server
+        import json
+        import threading
+        from urllib.parse import parse_qs, urlparse
+        seen = []
+        pages = {
+            "1": [self.release(f"9.0.{i}", asset=False) for i in range(100)],
+            "2": [self.release("2.0.0")],
+        }
+
+        class Handler(http.server.BaseHTTPRequestHandler):
+            def do_GET(handler):
+                page = parse_qs(urlparse(handler.path).query)["page"][0]
+                seen.append(page)
+                payload = json.dumps(pages[page]).encode()
+                handler.send_response(200)
+                handler.send_header("Content-Type", "application/json")
+                handler.end_headers()
+                handler.wfile.write(payload)
+
+            def log_message(self, *args):
+                pass
+
+        server = http.server.HTTPServer(("127.0.0.1", 0), Handler)
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        script = self.root / "local-rest-installer.ps1"
+        script.write_text(INSTALLER.read_text().replace(
+            "https://api.github.com/repos/Paffin/AgentGit/releases",
+            f"http://127.0.0.1:{server.server_port}/releases"))
+        try:
+            result = run(PWSH, "-NoProfile", "-File", script, "-Prefix", self.prefix,
+                         "-DryRun", "-NoAttestation", timeout=20)
+        finally:
+            server.shutdown()
+            server.server_close()
+            thread.join(timeout=5)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("AgentGit 2.0.0 for Windows", result.stdout)
+        self.assertEqual(seen, ["1", "2"])
+
+    def test_no_windows_archive_or_network_failure_installs_nothing(self):
+        absent = self.discovered([self.release("0.3.0-beta.7", True, asset=False)])
+        self.assertNotEqual(absent.returncode, 0)
+        self.assertIn("No Windows archive published yet", absent.stderr)
+        failed = self.discovered(failure=True)
+        self.assertNotEqual(failed.returncode, 0)
+        self.assertIn("Network unavailable", failed.stderr)
+        self.assertFalse(self.prefix.exists())
+
+    def unauthenticated_github(self, require=False):
+        tools = self.root / "tools"
+        tools.mkdir()
+        command = tools / ("gh.cmd" if os.name == "nt" else "gh")
+        content = "@echo authentication required 1>&2\n@exit /b 1\n" if os.name == "nt" else "#!/bin/sh\necho 'authentication required' >&2\nexit 1\n"
+        command.write_text(content)
+        command.chmod(0o755)
+        env = dict(os.environ, PATH=str(tools) + os.pathsep + os.environ.get("PATH", ""))
+        args = ["-RequireAttestation"] if require else []
+        return run(PWSH, "-NoProfile", "-File", INSTALLER, "-Version", VERSION,
+                   "-BaseUrl", self.dist, "-Prefix", self.prefix, *args, env=env)
+
+    def test_unauthenticated_gh_stderr_allows_checksum_only_install(self):
+        result = self.unauthenticated_github()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("checksum", result.stdout.lower())
+        self.assertTrue((self.prefix / "bin" / "ag.exe").is_file())
+
+    def test_required_attestation_rejects_unauthenticated_gh_before_install(self):
+        result = self.unauthenticated_github(require=True)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("RequireAttestation", result.stderr)
+        self.assertFalse(self.prefix.exists())
+
+    def test_dry_run_does_not_download_or_create_directories(self):
+        self.archive.unlink()
+        result = self.install("-DryRun")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("dry run", result.stdout.lower())
+        self.assertFalse(self.prefix.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

From 3b676b20b82012d3e157e0cf2763d66b92126961 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 21:55:16 +0000
Subject: [PATCH 14/41] docs: persist continuous development backlog and
 recovery state

---
 dev/continuous-progress.md | 60 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 dev/continuous-progress.md

diff --git a/dev/continuous-progress.md b/dev/continuous-progress.md
new file mode 100644
index 00000000..026c1157
--- /dev/null
+++ b/dev/continuous-progress.md
@@ -0,0 +1,60 @@
+# Continuous AgentGit progress
+
+Status: **CONTINUE**. Completing a slice does not complete the platform roadmap.
+
+## Recovery and authorization
+
+- Working branch: `codex/roadmap-review-workflows`.
+- Original base: `2ad73082106615c5ce1ac0831b9444eb3955b20f` (beta.7).
+- Audited current remote main on 2026-10-29: `8a0019424b37bd9ef42739389a0e7a1f7945c660`.
+- Local implementation tip before this checkpoint: `ed58caeb2ff4ed10874b80a151c45187be6fe56c`.
+- User says **do not merge yet**; accumulate a larger batch. Do not merge, force-push, publish a release or replace tags. Draft PR and CI qualification are the next delivery step.
+- Use ub-mode and the existing Hallmark/Web design direction. Keep CLI, SDK and Web behavior aligned; avoid speculative frameworks.
+- On resume: read this file, inspect worktree, fetch main, inspect open PR/CI, retain unmerged changes, continue a runnable backlog item.
+
+## Implemented but not merged
+
+| Slice | Evidence |
+|---|---|
+| Single/range/batched review suggestions with exact-head guard | commits `8e047a9`, `226be48`; Web and browser suites, mutation checks |
+| Requested reviewers across core/API/CLI/SDK/MCP/Web, metadata9 | `c5cd1a8`, `29d7a9b`; core/API/client tests; ADR0036 |
+| Code-first review page and responsive secondary actions | `97b3df9`; desktop/phone screenshots and browser checks |
+| Binary/type/oversized conflict choices and pinned workspace sync | `214a0ea`; core150, HTTP/gRPC, Web812, browser6; ADR0037 |
+| Private account review drafts and guarded cleanup, metadata10 | `f8e7fcb`, `5f6bf25`, `e18b594`, `dde140c`; storage/core302, server274, MCP108, Web830, SDK177/202; ADR0038 |
+| Rename conflict source paths retained through every client | `58cf3a5`; integration suite, HTTP/gRPC both orientations, Web836, browser12, SDK178/203, CLI56+3; ADR0039 |
+| Install/README EN+RU simplification | `c4a7179`; release-script54, ShellCheck, real published beta7 install/login/clone/edit/push/integrate/pull; README quickstart2 |
+| Windows ZIP/PowerShell installer and native CI gate | `ed58cae`;15 offline PowerShell/package tests,54 POSIX regressions,9 selected mutations killed, workflow/docs checks; native execution still pending |
+
+Detailed action and validation logs: `/workspace/agentgit-evidence/WORK_LOG.txt` and per-slice logs in that directory. Cumulative binary-safe patch: `/workspace/agentgit-evidence/roadmap-review-workflows.patch`. Logs outside the checkout are supporting artifacts, not substitutes for committed tests.
+
+## Current audit
+
+Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceability/testing, Web UX review, beta gates. GitHub currently has no open PR and four open qualification issues: #50 real MCP host, #51 external pilots, #53 screen reader, #55 physical phone. Main advanced by CI-only #133/#134/#135 (prepared releases, reusable permissions, background runner headroom). Main's background qualification is running; do not call it green merely because fast checks pass.
+
+## Prioritized backlog
+
+| ID | Priority/status | Work and dependency | Acceptance/evidence required |
+|---|---|---|---|
+| D1 | P0 IN PROGRESS | Reconcile unmerged batch with current main; retain new prepared-release/CI design | clean rebase, no lost Windows/install changes; static CI/skip/docs gates pass |
+| D2 | P0 READY after D1 | Push working branch, open draft PR, inspect mandatory CI; **never merge** | exact head checks, fix actual failures; native Windows ZIP/install/PS5.1 evidence |
+| R1 | P1 READY | Select next daily-review slice from task2 | small end-to-end deliverable with tests/review; no roadmap reduction |
+| R2 | P1 OPEN | Private general discussion drafts | per-account isolation, stale-save/clear protections, UI restore, SDK/CLI parity |
+| R3 | P1 OPEN | Account-backed file-edit drafts | immutable base, byte/mode preservation, conflicts keep local work; no automatic publication |
+| R4 | P1 OPEN | Multi-path rename/file-directory resolution | complete explicit result, preserve independent clean edits; never infer deletion from failed reads |
+| R5 | P1 OPEN | Cross-repository work feed | pagination/scopes, full initial snapshot and reconnect behavior |
+| M1 | P1 OPEN | Resumable hosting metadata import: issues/comments first | preview, mapping/idempotency/checkpoint, retry without duplication; PR/releases/identity later |
+| Q1 | P1 BLOCKED external | #50 real MCP host | actual named host/version + full bounded task workflow and denied scope; scripted protocol is not enough |
+| Q2 | P1 BLOCKED external | #51 five pilots and retention/case studies | external participants and permission; no invented users; requires recruitment authorization/contact |
+| Q3 | P1 BLOCKED device | #53 screen reader | actual reader/browser/OS and observed speech/focus |
+| Q4 | P1 BLOCKED device | #55 physical phone | actual device/browser and keyboard/network recovery; viewport emulation insufficient |
+| P1 | P2 OPEN | Verify Homebrew; publish Windows only after native CI; crates/SDK registry ownership | real install and package ownership/trusted-publishing setup, no unsupported availability claims |
+| S1 | P2 OPEN | Deployment/HA: failover, mixed-build upgrade, replica reaping/load/TLS | concrete backend environments and failure evidence; baseline CI isn't production qualification |
+| S2 | P2 OPEN | Server follow-ups: required job fencing, audit client addresses, shared tree cache, same-stream scheduling, merge notes on wire | compatibility contracts and concurrency/behavior tests |
+| L1 | P3 DEFERRED by roadmap trigger | Hierarchical trees/packfiles/GC generations/streaming, VM isolation/pools | measurements justify scope; no premature architecture |
+
+## Immediate next actions
+
+1. Preserve pre-rebase branch; rebase local batch onto `origin/main`, resolve CI/release conflicts using newest architecture.
+2. Run skip-source gate (new Windows tests currently use `unittest.skipUnless`, inspect against repository helper policy), workflow/release/docs compatibility and focused changed-code checks.
+3. Open draft PR for whole batch and await/repair CI while implementing the next independent R1 slice.
+4. Update this checkpoint with new SHAs, PR, CI URLs, failures and next item. Keep release gates open until evidence really exists.

From 93bc4776aa2dac3623c2f1a8c39f6cc451a7947a Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 21:57:52 +0000
Subject: [PATCH 15/41] fix(ci): qualify Windows artifacts in prepared releases

Keep the current fast promotion pipeline while moving Windows packaging into candidate preparation. Require its checksum-covered ZIP in candidate manifests, enforce PowerShell availability and preserve historical beta.7 release recognition. Persist the continuous backlog and audit status.

Validated: fast tooling suite, candidate11, request26, Windows15, CI policy18, workflow18 and skip-source gate.
---
 .github/workflows/ci.yml              |  1 +
 .github/workflows/prepare-release.yml | 50 +++++++++++++++++++++++++--
 .github/workflows/windows.yml         |  1 +
 dev/continuous-progress.md            | 30 +++++++++-------
 docs/community/beta.md                |  2 +-
 scripts/release_candidate.py          |  9 +++--
 scripts/test_release_candidate.py     | 16 +++++++--
 scripts/test_windows_release.py       |  6 ++--
 8 files changed, 92 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6d06b43..cd5862c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -83,6 +83,7 @@ jobs:
           for test in test_ci_policy test_release_candidate test_request_release test_release_scripts test_check_workflows test_web_e2e_workflow test_check_dependabot test_py39_compat; do
             python3 "scripts/$test.py"
           done
+          python3 scripts/test_windows_release.py WindowsArchive ReleaseInputs
 
   rust:
     name: Linux unit and storage contracts
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index 21321932..1af8e4a3 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -173,6 +173,51 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+  windows-binaries:
+    name: native Windows archive
+    timeout-minutes: 45
+    if: needs.verify.outputs.needed == 'true'
+    needs: verify
+    runs-on: windows-latest
+    env:
+      VERSION: ${{ needs.verify.outputs.version }}
+      SOURCE_DATE_EPOCH: ${{ needs.verify.outputs.epoch }}
+      RUSTFLAGS: -C target-feature=+crt-static
+      AG_REQUIRE_COMPONENTS: shell:powershell
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          key: release-windows
+          cache-workspace-crates: true
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: apps/web/package-lock.json
+      - name: Build the embedded Web UI
+        shell: bash
+        run: scripts/build_ui.sh
+      - name: Build supported Windows binaries with a static CRT
+        run: cargo build --release --locked -p agentgit-cli -p agentgit-server -p agentgit-mcp
+      - name: Test the installer, package and run the native archive
+        shell: pwsh
+        run: |
+          python scripts/test_windows_release.py
+          if ($LASTEXITCODE) { throw 'Windows packaging tests failed.' }
+          ./scripts/smoke_windows_release.ps1 -Version $env:VERSION -BinDir target/release
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: archive-x86_64-pc-windows-msvc
+          path: dist/*.zip
+          if-no-files-found: error
+          retention-days: 14
+
   sbom:
     timeout-minutes: 15
     if: needs.verify.outputs.needed == 'true'
@@ -373,7 +418,7 @@ jobs:
     timeout-minutes: 10
     if: needs.verify.outputs.needed == 'true'
     name: assemble and attest the candidate
-    needs: [verify, qualify, scripts, binaries, sbom, manifest]
+    needs: [verify, qualify, scripts, binaries, windows-binaries, sbom, manifest]
     runs-on: ubuntu-latest
     env:
       PUBLISH: ${{ needs.verify.outputs.publish }}
@@ -398,8 +443,9 @@ jobs:
           set -euo pipefail
           ls -la dist
           set -- dist/*.tar.gz; test $# = 4
+          set -- dist/*.zip; test $# = 1; test -f "$1"
           set -- dist/*.cdx.json; test $# = 4
-          python3 scripts/package_release.py sums dist/*.tar.gz dist/*.cdx.json | tee dist/SHA256SUMS
+          python3 scripts/package_release.py sums dist/*.tar.gz dist/*.zip dist/*.cdx.json | tee dist/SHA256SUMS
           (cd dist && sha256sum -c SHA256SUMS)
           python3 scripts/render_packaging.py --version "$VERSION" --sums dist/SHA256SUMS --out dist --only homebrew
           ruby -c dist/agentgit.rb
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 41d00e2c..71063f23 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -15,6 +15,7 @@ concurrency:
 env:
   CARGO_TERM_COLOR: always
   CARGO_INCREMENTAL: "0"
+  AG_REQUIRE_COMPONENTS: shell:powershell
 
 jobs:
   windows:
diff --git a/dev/continuous-progress.md b/dev/continuous-progress.md
index 026c1157..4146590b 100644
--- a/dev/continuous-progress.md
+++ b/dev/continuous-progress.md
@@ -1,6 +1,6 @@
 # Continuous AgentGit progress
 
-Status: **CONTINUE**. Completing a slice does not complete the platform roadmap.
+Status: **CONTINUE**. Rebased on current main; draft PR preparation and P0 structural-sync repair underway. Completing a slice does not complete the platform roadmap.
 
 ## Recovery and authorization
 
@@ -16,28 +16,28 @@ Status: **CONTINUE**. Completing a slice does not complete the platform roadmap.
 
 | Slice | Evidence |
 |---|---|
-| Single/range/batched review suggestions with exact-head guard | commits `8e047a9`, `226be48`; Web and browser suites, mutation checks |
-| Requested reviewers across core/API/CLI/SDK/MCP/Web, metadata9 | `c5cd1a8`, `29d7a9b`; core/API/client tests; ADR0036 |
-| Code-first review page and responsive secondary actions | `97b3df9`; desktop/phone screenshots and browser checks |
-| Binary/type/oversized conflict choices and pinned workspace sync | `214a0ea`; core150, HTTP/gRPC, Web812, browser6; ADR0037 |
-| Private account review drafts and guarded cleanup, metadata10 | `f8e7fcb`, `5f6bf25`, `e18b594`, `dde140c`; storage/core302, server274, MCP108, Web830, SDK177/202; ADR0038 |
-| Rename conflict source paths retained through every client | `58cf3a5`; integration suite, HTTP/gRPC both orientations, Web836, browser12, SDK178/203, CLI56+3; ADR0039 |
-| Install/README EN+RU simplification | `c4a7179`; release-script54, ShellCheck, real published beta7 install/login/clone/edit/push/integrate/pull; README quickstart2 |
-| Windows ZIP/PowerShell installer and native CI gate | `ed58cae`;15 offline PowerShell/package tests,54 POSIX regressions,9 selected mutations killed, workflow/docs checks; native execution still pending |
+| Single/range/batched review suggestions with exact-head guard | commits `fdfd318`, `6c56df3`; Web and browser suites, mutation checks |
+| Requested reviewers across core/API/CLI/SDK/MCP/Web, metadata9 | `8b20c45`, `eb8acbf`; core/API/client tests; ADR0036 |
+| Code-first review page and responsive secondary actions | `b470792`; desktop/phone screenshots and browser checks |
+| Binary/type/oversized conflict choices and pinned workspace sync | `35592e6`; core150, HTTP/gRPC, Web812, browser6; ADR0037 |
+| Private account review drafts and guarded cleanup, metadata10 | `1cb6d15`, `a76e99b`, `2eba2d8`, `7e48676`; storage/core302, server274, MCP108, Web830, SDK177/202; ADR0038 |
+| Rename conflict source paths retained through every client | `ca0da01`; integration suite, HTTP/gRPC both orientations, Web836, browser12, SDK178/203, CLI56+3; ADR0039 |
+| Install/README EN+RU simplification | `dc7f768`; release-script54, ShellCheck, real published beta7 install/login/clone/edit/push/integrate/pull; README quickstart2 |
+| Windows ZIP/PowerShell installer and native CI gate | `6210f99`;15 offline PowerShell/package tests,54 POSIX regressions,9 selected mutations killed, workflow/docs checks; native execution still pending |
 
 Detailed action and validation logs: `/workspace/agentgit-evidence/WORK_LOG.txt` and per-slice logs in that directory. Cumulative binary-safe patch: `/workspace/agentgit-evidence/roadmap-review-workflows.patch`. Logs outside the checkout are supporting artifacts, not substitutes for committed tests.
 
 ## Current audit
 
-Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceability/testing, Web UX review, beta gates. GitHub currently has no open PR and four open qualification issues: #50 real MCP host, #51 external pilots, #53 screen reader, #55 physical phone. Main advanced by CI-only #133/#134/#135 (prepared releases, reusable permissions, background runner headroom). Main's background qualification is running; do not call it green merely because fast checks pass.
+Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceability/testing, Web UX review, beta gates. GitHub audit found no open PR and four open qualification issues: #50 real MCP host, #51 external pilots, #53 screen reader, #55 physical phone. Issue #52 is closed with real published beta.7 macOS arm64 checksum/provenance and57 checks ([evidence](https://github.com/Paffin/AgentGit/issues/52#issuecomment-6508589245)); Finder quarantine/Homebrew remain outside that proof. Main advanced by CI-only #133/#134/#135 (prepared releases, reusable permissions, background runner headroom). Main's background qualification is running; do not call it green merely because fast checks pass.
 
 ## Prioritized backlog
 
 | ID | Priority/status | Work and dependency | Acceptance/evidence required |
 |---|---|---|---|
-| D1 | P0 IN PROGRESS | Reconcile unmerged batch with current main; retain new prepared-release/CI design | clean rebase, no lost Windows/install changes; static CI/skip/docs gates pass |
-| D2 | P0 READY after D1 | Push working branch, open draft PR, inspect mandatory CI; **never merge** | exact head checks, fix actual failures; native Windows ZIP/install/PS5.1 evidence |
-| R1 | P1 READY | Select next daily-review slice from task2 | small end-to-end deliverable with tests/review; no roadmap reduction |
+| D1 | P0 DONE | Reconcile unmerged batch with current main; retain new prepared-release/CI design | clean rebase, no lost Windows/install changes; static CI/skip/docs gates pass |
+| D2 | P0 IN PROGRESS | Push working branch, open draft PR, inspect mandatory CI; **never merge** | exact head checks, fix actual failures; native Windows ZIP/install/PS5.1 evidence |
+| R1 | P0 IN PROGRESS | Fix structural sync losing independent incoming add/edit/delete when file/directory merge falls back to ours | retain raw conflicting candidate, apply explicit choices before tree validation; both orientations/no partial workspace mutation |
 | R2 | P1 OPEN | Private general discussion drafts | per-account isolation, stale-save/clear protections, UI restore, SDK/CLI parity |
 | R3 | P1 OPEN | Account-backed file-edit drafts | immutable base, byte/mode preservation, conflicts keep local work; no automatic publication |
 | R4 | P1 OPEN | Multi-path rename/file-directory resolution | complete explicit result, preserve independent clean edits; never infer deletion from failed reads |
@@ -58,3 +58,7 @@ Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceab
 2. Run skip-source gate (new Windows tests currently use `unittest.skipUnless`, inspect against repository helper policy), workflow/release/docs compatibility and focused changed-code checks.
 3. Open draft PR for whole batch and await/repair CI while implementing the next independent R1 slice.
 4. Update this checkpoint with new SHAs, PR, CI URLs, failures and next item. Keep release gates open until evidence really exists.
+
+## Reconciliation checkpoint
+
+Rebase on `8a00194` completed without losing application changes. Retained main's fast publish workflow; moved Windows build/verification into `prepare-release.yml`. New candidate manifests require and checksum the Windows ZIP without changing recognition of historical published beta.7. Fixed the new PowerShell tests to use the repository's required-component helper; fast tooling runs only shell-independent Windows archive contracts. Full PowerShell tests are required in native jobs. Beta programme status corrected from beta.5 to the actual published beta.7; external gates remain open.
diff --git a/docs/community/beta.md b/docs/community/beta.md
index d1b98251..3067e8c8 100644
--- a/docs/community/beta.md
+++ b/docs/community/beta.md
@@ -2,7 +2,7 @@
 
 AgentGit offers an early public beta for small teams working with coding agents. The goal is to let a team review and land agent changes with checks tied to the exact candidate tree and a clear explanation when policy blocks a change.
 
-**Current status: early public beta (`0.3.0-beta.5`).** This opens the supported single-server workflow to early adopters; it does not claim independent pilot results or production readiness. The remaining qualification gates below stay visible.
+**Current status: early public beta (`0.3.0-beta.7`).** This opens the supported single-server workflow to early adopters; it does not claim independent pilot results or production readiness. The remaining qualification gates below stay visible.
 
 ## Supported beta target
 
diff --git a/scripts/release_candidate.py b/scripts/release_candidate.py
index 4ac8ea89..74dbd9b1 100644
--- a/scripts/release_candidate.py
+++ b/scripts/release_candidate.py
@@ -14,12 +14,17 @@
 EXTRA = {'candidate.json', 'candidate-images.json', 'RELEASE_NOTES.md'}
 
 
+def candidate_assets(version):
+    """New candidates include Windows; older published POSIX releases stay recognizable."""
+    return required_assets(version) | EXTRA | {f'agentgit-{version}-x86_64-pc-windows-msvc.zip'}
+
+
 def validate(directory, sha, version, run_id):
     validate_request('candidate/source', sha, version)
     if type(run_id) not in (str, int) or not str(run_id).isdigit() or int(run_id) <= 0:
         raise ValueError('invalid preparation run')
     directory = Path(directory)
-    expected = required_assets(version) | EXTRA
+    expected = candidate_assets(version)
     actual = {p.name for p in directory.iterdir() if p.is_file()}
     if actual != expected or any(p.is_symlink() or not p.is_file() for p in directory.iterdir()):
         raise ValueError('candidate files differ from the required release set')
@@ -53,7 +58,7 @@ def create(directory, sha, version, run_id):
     validate_request(os.environ.get('GITHUB_REPOSITORY', 'test/repo'), sha, version)
     directory = Path(directory)
     (directory / 'candidate.json').write_text(json.dumps({'sha': sha, 'version': version, 'run_id': int(run_id)}))
-    expected = required_assets(version) | EXTRA
+    expected = candidate_assets(version)
     if {p.name for p in directory.iterdir()} != expected:
         raise ValueError('incomplete candidate')
     sums = ''.join(hashlib.sha256((directory / name).read_bytes()).hexdigest() + '  ' + name + '\n'
diff --git a/scripts/test_release_candidate.py b/scripts/test_release_candidate.py
index 42a3ff6d..2897f660 100644
--- a/scripts/test_release_candidate.py
+++ b/scripts/test_release_candidate.py
@@ -7,8 +7,8 @@
 import tempfile
 import unittest
 
-from release_candidate import create, validate
-from request_release import required_assets, resolve_candidate, request_release
+from release_candidate import candidate_assets, create, validate
+from request_release import resolve_candidate, request_release
 from test_request_release import Api, BASE, REPO, SHA, green
 
 VERSION = '1.2.3'
@@ -18,7 +18,7 @@ class CandidateFiles(unittest.TestCase):
     def setUp(self):
         self.temp = tempfile.TemporaryDirectory()
         self.root = Path(self.temp.name)
-        for name in required_assets(VERSION):
+        for name in candidate_assets(VERSION):
             (self.root / name).write_bytes(b'checked artifact')
         (self.root / 'RELEASE_NOTES.md').write_text('Release notes')
         (self.root / 'candidate-images.json').write_text(json.dumps({
@@ -47,6 +47,16 @@ def test_tampering_or_missing_archive_is_rejected(self):
         with self.assertRaises(ValueError):
             validate(self.root, SHA, VERSION, 7)
 
+    def test_windows_zip_is_required_and_covered_by_candidate_checksums(self):
+        archive = self.root / f'agentgit-{VERSION}-x86_64-pc-windows-msvc.zip'
+        self.assertTrue(archive.is_file(), 'prepared candidates must include the native Windows archive')
+        archive.write_bytes(b'tampered Windows archive')
+        with self.assertRaisesRegex(ValueError, 'checksum'):
+            validate(self.root, SHA, VERSION, 7)
+        archive.unlink()
+        with self.assertRaisesRegex(ValueError, 'required release set'):
+            validate(self.root, SHA, VERSION, 7)
+
     def test_path_traversal_duplicates_extra_files_and_symlinks_are_rejected(self):
         sums = self.root / 'SHA256SUMS'
         original = sums.read_text()
diff --git a/scripts/test_windows_release.py b/scripts/test_windows_release.py
index 9b355aaf..5a7b3294 100644
--- a/scripts/test_windows_release.py
+++ b/scripts/test_windows_release.py
@@ -12,6 +12,8 @@
 import unittest
 import zipfile
 
+import ag_testkit
+
 ROOT = Path(__file__).resolve().parent.parent
 SCRIPTS = ROOT / "scripts"
 PACKAGE = Path(os.environ.get("AG_TEST_PACKAGE", str(SCRIPTS / "package_release.py")))
@@ -76,7 +78,7 @@ class ReleaseInputs(unittest.TestCase):
     def test_release_checksum_recipe_includes_windows_zip(self):
         import glob
         import shlex
-        workflow = (ROOT / ".github/workflows/release.yml").read_text()
+        workflow = (ROOT / ".github/workflows/prepare-release.yml").read_text()
         recipe = next(line.strip().split("|", 1)[0].strip() for line in workflow.splitlines()
                       if "package_release.py sums dist/" in line)
         patterns = shlex.split(recipe)[3:]
@@ -96,9 +98,9 @@ def test_release_checksum_recipe_includes_windows_zip(self):
         self.assertIn("windows-binaries", release.split("    steps:", 1)[0])
 
 
-@unittest.skipUnless(PWSH, "PowerShell not available; Windows CI runs installer tests")
 class WindowsInstaller(unittest.TestCase):
     def setUp(self):
+        ag_testkit.require_component("shell:powershell", self.id(), PWSH, "PowerShell is not installed")
         self.tmp = tempfile.TemporaryDirectory()
         self.addCleanup(self.tmp.cleanup)
         self.root = Path(self.tmp.name)

From a58b8805344085cec15807de40457bea14d95c89 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:01:22 +0000
Subject: [PATCH 16/41] fix(sync): preserve clean changes across structural
 conflicts

Resolve virtual file/directory conflicts against the full candidate instead of an incomplete fallback. Refuse unsafe local sync and legacy pending snapshots before acknowledging lost changes, including forced snapshots.

Validated: 239 merge/integration tests, targeted structural and legacy regressions, clippy and independent review.
---
 CHANGELOG.md                                  |   2 +
 crates/ag-integrate/src/virtual_ws.rs         |   3 +-
 crates/ag-integrate/src/workspace.rs          |  51 ++++-
 crates/ag-integrate/tests/structural_sync.rs  | 174 ++++++++++++++++++
 crates/ag-merge/src/tree.rs                   |  35 +++-
 .../ag-merge/tests/structural_resolution.rs   |  50 +++++
 crates/ag-protocol/src/lib.rs                 |   4 +
 dev/continuous-progress.md                    |  17 +-
 docs/adr/0040-structural-sync-resolutions.md  |  38 ++++
 docs/adr/README.md                            |   2 +
 docs/architecture/adr-traceability.md         |  19 +-
 docs/protocol/agwp-v1.md                      |  10 +
 12 files changed, 396 insertions(+), 9 deletions(-)
 create mode 100644 crates/ag-integrate/tests/structural_sync.rs
 create mode 100644 crates/ag-merge/tests/structural_resolution.rs
 create mode 100644 docs/adr/0040-structural-sync-resolutions.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b0703527..34fc5bc0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,6 +28,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Fixed
 
+- Structural workspace sync preserves independent incoming additions, edits and deletions while applying explicit file/directory resolutions. Incomplete choices fail without moving the workspace; local structural sync and legacy pending snapshots refuse unsafe fallback commits.
+
 - Renamed conflict previews now read each version at its exact source path instead of mistaking a relocated file for deletion. CLI, SDK and MCP retain this metadata; the browser also supports explicit rename/delete choices and requires capable servers.
 
 - SDKs retry workspace sync automatically only when a nonempty inspected branch head guards the operation. Unguarded calls require explicit unsafe-retry opt-in.
diff --git a/crates/ag-integrate/src/virtual_ws.rs b/crates/ag-integrate/src/virtual_ws.rs
index 30632bc2..a0348d67 100644
--- a/crates/ag-integrate/src/virtual_ws.rs
+++ b/crates/ag-integrate/src/virtual_ws.rs
@@ -273,8 +273,7 @@ impl Repository {
             if resolutions.is_empty() || !unresolved.is_empty() {
                 return Ok(SyncOutcome::Conflicted { conflicts: infos });
             }
-            let ops = self.ops_towards(&result, &wanted);
-            result = result.apply(&ops, &self.limits)?;
+            result = merged.resolve_paths(&wanted, &self.limits)?;
         }
         let ops = ours.diff(&result);
         let id = self.commit(
diff --git a/crates/ag-integrate/src/workspace.rs b/crates/ag-integrate/src/workspace.rs
index 5fb0bdf5..e9f55104 100644
--- a/crates/ag-integrate/src/workspace.rs
+++ b/crates/ag-integrate/src/workspace.rs
@@ -209,10 +209,39 @@ impl Repository {
             .collect())
     }
 
+    // Old binaries could leave a pending merge built from a structural fallback.
+    // Recheck its original inputs rather than trusting the pending list of paths.
+    fn validate_pending_snapshot(&self, ws: &WorkspaceRow, pending: &Pending) -> Result<()> {
+        let head = ws.head.ok_or_else(|| Error::Invalid("pending merge has no workspace head".into()))?;
+        let bases = merge_bases(&self.graph(), &head, &pending.theirs)?;
+        let [base] = bases.as_slice() else {
+            return Err(Error::Invalid(
+                "pending merge has no unique merge base; back up edits before resetting".into(),
+            ));
+        };
+        let merged = merge_trees(
+            &self.tree_of(base)?,
+            &self.tree_of(&head)?,
+            &self.tree_of(&pending.theirs)?,
+            &RepoBlobs(self),
+            &self.limits,
+        )
+        .map_err(|error| Error::Invalid(error.to_string()))?;
+        if merged.conflicts.iter().any(|c| matches!(c.kind, ConflictKind::FileDirectory { .. })) {
+            return Err(Error::Conflict(
+                "pending file/directory merge may lack incoming files; back up local edits, reset the workspace, \
+                 then retry with explicit structural resolutions; snapshot was not created, even with --force"
+                    .into(),
+            ));
+        }
+        Ok(())
+    }
+
     /// Records the state of `dir` as the workspace's next snapshot. Returns
     /// `None` if nothing changed. While a conflicted sync is pending, the
     /// snapshot becomes the merge changeset (parents: head + the stream head
     /// that was merged) and refuses to proceed if conflict markers remain.
+    /// Legacy pending file/directory merges are refused even with `force`.
     pub fn snapshot(
         &self,
         name: &str,
@@ -222,10 +251,13 @@ impl Repository {
         force: bool,
     ) -> Result<Option<ChangesetId>> {
         let ws = self.workspace_row(name)?;
+        let pending = self.pending_merge(name)?;
+        if let Some(pending) = &pending {
+            self.validate_pending_snapshot(&ws, pending)?;
+        }
         let rules = IgnoreRules::load(dir)?;
         let head_tree = self.tree_or_empty(ws.head.as_ref())?;
         let (tree, _) = scan_against(self, dir, &rules, true, &head_tree)?;
-        let pending = self.pending_merge(name)?;
         if tree == head_tree && pending.is_none() {
             return Ok(None);
         }
@@ -269,7 +301,8 @@ impl Repository {
     }
 
     /// Brings the stream's head into the workspace and updates `dir`.
-    /// The directory must have no uncommitted changes.
+    /// The directory must have no uncommitted changes. A file/directory clash is
+    /// refused before changing the directory or workspace metadata.
     pub fn sync_workspace(&self, name: &str, dir: &Path, author: &Identity) -> Result<SyncOutcome> {
         if self.pending_merge(name)?.is_some() {
             return Err(Error::Conflict("a conflicted sync is pending; resolve the files and snapshot first".into()));
@@ -316,6 +349,7 @@ impl Repository {
         let base_tree = self.tree_of(&base)?;
         let merged = merge_trees(&base_tree, &ours_tree, &theirs_tree, &RepoBlobs(self), &self.limits)
             .map_err(|e| Error::Invalid(e.to_string()))?;
+        require_directory_sync_safe(&merged.conflicts)?;
         if merged.is_clean() {
             let ops = ours_tree.diff(&merged.tree);
             let id = self.commit(
@@ -398,3 +432,16 @@ impl Repository {
 fn has_markers(bytes: &[u8]) -> bool {
     bytes.split(|b| *b == b'\n').any(|l| l.starts_with(b"<<<<<<< ours") || l.starts_with(b">>>>>>> theirs"))
 }
+
+// A structural fallback is not the complete merged state. Do not turn it into a
+// pending directory merge whose next snapshot would discard clean incoming edits.
+fn require_directory_sync_safe(conflicts: &[ag_merge::Conflict]) -> Result<()> {
+    let Some(conflict) = conflicts.iter().find(|c| matches!(c.kind, ConflictKind::FileDirectory { .. })) else {
+        return Ok(());
+    };
+    Err(Error::Conflict(format!(
+        "file/directory conflict at '{}': this sync left the workspace and directory unchanged; \
+         use explicit virtual workspace resolutions, or change and snapshot the local layout before retrying",
+        conflict.path
+    )))
+}
diff --git a/crates/ag-integrate/tests/structural_sync.rs b/crates/ag-integrate/tests/structural_sync.rs
new file mode 100644
index 00000000..e9508cdd
--- /dev/null
+++ b/crates/ag-integrate/tests/structural_sync.rs
@@ -0,0 +1,174 @@
+//! Resolving one structural conflict must preserve every clean merge change.
+mod common;
+
+use ag_integrate::{SyncOutcome, VirtualChange, VirtualContent};
+use ag_types::{FileType, RepoPath, StreamName};
+use common::*;
+
+fn delete(path: &str) -> VirtualChange {
+    VirtualChange::Delete { path: RepoPath::new(path).unwrap() }
+}
+fn put(path: &str, text: &str) -> VirtualChange {
+    VirtualChange::Put {
+        path: RepoPath::new(path).unwrap(),
+        content: VirtualContent::Bytes(text.as_bytes().to_vec()),
+        file_type: FileType::Regular,
+        executable: false,
+    }
+}
+
+#[test]
+fn structural_resolution_preserves_clean_add_edit_delete_for_both_sides_and_choices() {
+    for workspace_has_file in [false, true] {
+        for choose_file in [false, true] {
+            let f = fx();
+            let actor = id("user:alice");
+            let base = f.land(None, &[("stable", "same"), ("edited", "before"), ("removed", "old")]);
+            let mut our_files = vec![("stable", "same"), ("edited", "before"), ("removed", "old"), ("local", "ours")];
+            let mut their_files = vec![("stable", "same"), ("edited", "after"), ("added", "theirs")];
+            let file = [("clash", "file")];
+            let directory = [("clash/a", "a"), ("clash/sub/b", "b")];
+            our_files.extend(if workspace_has_file { &file[..] } else { &directory[..] });
+            their_files.extend(if workspace_has_file { &directory[..] } else { &file[..] });
+            let ours = f.snap(Some(base), &our_files, "user:alice");
+            let theirs = f.land(Some(base), &their_files);
+            let observed =
+                f.repo.workspace_create_at("work", &StreamName::new("main").unwrap(), &actor, Some(&ours)).unwrap();
+            let before = f.repo.workspace_sync_virtual_checked_at(&observed, &actor, &[], Some(&theirs)).unwrap();
+            assert!(matches!(before, SyncOutcome::Conflicted { .. }));
+            assert_eq!(f.repo.workspace_row("work").unwrap().head, Some(ours));
+            let resolutions = if choose_file {
+                vec![put("clash", "chosen file"), delete("clash/a"), delete("clash/sub/b")]
+            } else {
+                vec![delete("clash")]
+            };
+            let merged =
+                f.repo.workspace_sync_virtual_checked_at(&observed, &actor, &resolutions, Some(&theirs)).unwrap();
+            let SyncOutcome::Merged { id: head } = merged else { panic!("{merged:?}") };
+            assert_eq!(
+                f.read(&head, "added").as_deref(),
+                Some("theirs"),
+                "clean addition, ours-file={workspace_has_file}, choose-file={choose_file}"
+            );
+            assert_eq!(f.read(&head, "edited").as_deref(), Some("after"), "clean edit must survive");
+            assert_eq!(f.read(&head, "removed"), None, "clean deletion must survive");
+            assert_eq!(f.read(&head, "local").as_deref(), Some("ours"));
+            assert_eq!(f.read(&head, "stable").as_deref(), Some("same"));
+            assert_eq!(f.read(&head, "clash").as_deref(), choose_file.then_some("chosen file"));
+            assert_eq!(f.read(&head, "clash/a").as_deref(), (!choose_file).then_some("a"));
+            assert_eq!(f.read(&head, "clash/sub/b").as_deref(), (!choose_file).then_some("b"));
+            assert_eq!(f.repo.changeset(&head).unwrap().parents, [ours, theirs]);
+            assert_eq!(f.repo.workspace_row("work").unwrap().base, Some(theirs));
+            assert_eq!(f.head(), Some(theirs), "sync must not move the shared stream");
+            assert!(f.repo.fsck().unwrap().is_ok());
+        }
+    }
+}
+
+#[test]
+fn incomplete_structural_resolution_cannot_silently_discard_descendants() {
+    let f = fx();
+    let actor = id("user:alice");
+    let base = f.land(None, &[("base", "same")]);
+    let ours = f.snap(Some(base), &[("base", "same"), ("clash", "ours")], "user:alice");
+    let theirs = f.land(Some(base), &[("base", "same"), ("clash/child", "theirs"), ("added", "keep")]);
+    let observed = f.repo.workspace_create_at("work", &StreamName::new("main").unwrap(), &actor, Some(&ours)).unwrap();
+    let result = f.repo.workspace_sync_virtual_checked_at(&observed, &actor, &[put("clash", "chosen")], Some(&theirs));
+    assert!(result.is_err(), "keeping a file must not implicitly delete the unseen child: {result:?}");
+    let after = f.repo.workspace_row("work").unwrap();
+    assert_eq!(after.head, observed.head);
+    assert_eq!(after.base, observed.base);
+    assert_eq!(f.head(), Some(theirs));
+}
+
+#[test]
+fn directory_sync_refuses_structural_conflicts_unchanged_and_can_retry_after_snapshot() {
+    for workspace_has_file in [false, true] {
+        let f = fx();
+        let actor = id("user:alice");
+        let base = f.land(None, &[("stable", "same"), ("edited", "before"), ("removed", "old")]);
+        let mut our_files = vec![("stable", "same"), ("edited", "before"), ("removed", "old"), ("local", "ours")];
+        let mut their_files = vec![("stable", "same"), ("edited", "after"), ("added", "theirs")];
+        let file = [("clash", "file")];
+        let directory = [("clash/child", "child")];
+        our_files.extend(if workspace_has_file { &file[..] } else { &directory[..] });
+        their_files.extend(if workspace_has_file { &directory[..] } else { &file[..] });
+        let ours = f.snap(Some(base), &our_files, "user:alice");
+        let theirs = f.land(Some(base), &their_files);
+        let observed =
+            f.repo.workspace_create_at("work", &StreamName::new("main").unwrap(), &actor, Some(&ours)).unwrap();
+        let dir = tempfile::tempdir().unwrap();
+        f.repo.workspace_checkout("work", dir.path()).unwrap();
+        let result = f.repo.sync_workspace("work", dir.path(), &actor);
+        assert!(result.is_err(), "directory sync must not treat its fallback as the full merge: {result:?}");
+        let error = result.unwrap_err().to_string();
+        assert!(error.contains("file/directory") && error.contains("unchanged"), "{error}");
+        let after = f.repo.workspace_row("work").unwrap();
+        assert_eq!(after.head, observed.head);
+        assert_eq!(after.base, observed.base);
+        assert!(!f.repo.workspace_is_merging("work").unwrap());
+        assert!(f.repo.workspace_status("work", dir.path()).unwrap().is_empty());
+        assert_eq!(std::fs::read_to_string(dir.path().join("edited")).unwrap(), "before");
+        assert!(dir.path().join("removed").exists());
+        assert!(!dir.path().join("added").exists());
+
+        // Adopt the branch's structural shape explicitly, then retry the ordinary merge.
+        if workspace_has_file {
+            std::fs::remove_file(dir.path().join("clash")).unwrap();
+            std::fs::create_dir(dir.path().join("clash")).unwrap();
+            std::fs::write(dir.path().join("clash/child"), "child").unwrap();
+        } else {
+            std::fs::remove_dir_all(dir.path().join("clash")).unwrap();
+            std::fs::write(dir.path().join("clash"), "file").unwrap();
+        }
+        let chosen = f.repo.snapshot("work", dir.path(), "Choose the branch layout", &actor, false).unwrap().unwrap();
+        assert_eq!(f.repo.changeset(&chosen).unwrap().parents, [ours]);
+        let result = f.repo.sync_workspace("work", dir.path(), &actor).unwrap();
+        let SyncOutcome::Merged { id: head } = result else { panic!("{result:?}") };
+        assert_eq!(f.read(&head, "added").as_deref(), Some("theirs"));
+        assert_eq!(f.read(&head, "edited").as_deref(), Some("after"));
+        assert_eq!(f.read(&head, "removed"), None);
+        assert_eq!(f.read(&head, "local").as_deref(), Some("ours"));
+        assert_eq!(f.repo.changeset(&head).unwrap().parents, [chosen, theirs]);
+        assert_eq!(f.head(), Some(theirs));
+        assert!(!f.repo.workspace_is_merging("work").unwrap());
+        assert!(f.repo.workspace_status("work", dir.path()).unwrap().is_empty());
+    }
+}
+
+#[test]
+fn legacy_structural_pending_snapshot_is_refused_even_with_force() {
+    for force in [false, true] {
+        let f = fx();
+        let actor = id("user:alice");
+        let base = f.land(None, &[("base", "same")]);
+        let ours = f.snap(Some(base), &[("base", "same"), ("clash", "ours")], "user:alice");
+        let theirs = f.land(Some(base), &[("base", "same"), ("clash/child", "theirs"), ("added", "keep")]);
+        f.repo.workspace_create_at("work", &StreamName::new("main").unwrap(), &actor, Some(&ours)).unwrap();
+        let dir = tempfile::tempdir().unwrap();
+        f.repo.workspace_checkout("work", dir.path()).unwrap();
+        // Old versions recorded this pending merge after copying only the fallback tree.
+        let pending = serde_json::json!({"theirs":theirs,"paths":["clash"]}).to_string();
+        f.repo
+            .meta()
+            .write(|tx| {
+                tx.workspace_update("work", Some(&theirs), Some(&ours))?;
+                tx.meta_set("workspace.work.merging", &pending)
+            })
+            .unwrap();
+        std::fs::write(dir.path().join("clash"), "user's unsaved resolution").unwrap();
+        let observed = f.repo.workspace_row("work").unwrap();
+        let result = f.repo.snapshot("work", dir.path(), "Attempt legacy resolution", &actor, force);
+        assert!(result.is_err(), "force={force} must not commit a legacy incomplete tree: {result:?}");
+        let message = result.unwrap_err().to_string();
+        assert!(message.contains("file/directory") && message.contains("back up"), "{message}");
+        let after = f.repo.workspace_row("work").unwrap();
+        assert_eq!(after.head, observed.head);
+        assert_eq!(after.base, observed.base);
+        assert!(f.repo.workspace_is_merging("work").unwrap());
+        assert_eq!(f.repo.meta().read(|tx| tx.meta_get("workspace.work.merging")).unwrap(), Some(pending));
+        assert_eq!(std::fs::read_to_string(dir.path().join("clash")).unwrap(), "user's unsaved resolution");
+        assert!(!dir.path().join("added").exists());
+        assert_eq!(f.head(), Some(theirs));
+    }
+}
diff --git a/crates/ag-merge/src/tree.rs b/crates/ag-merge/src/tree.rs
index 562eb7d7..2d72d322 100644
--- a/crates/ag-merge/src/tree.rs
+++ b/crates/ag-merge/src/tree.rs
@@ -295,6 +295,9 @@ pub struct TreeMerge {
     /// Explanations of what the merge decided on its own, ordered by (side, directory). Empty for
     /// `ag-merge/2`.
     pub notes: Vec<MergeNote>,
+    // A file/directory clash cannot inhabit Tree. Retain its exact merged entries for an
+    // explicit resolution instead of later reconstructing them from the fallback tree.
+    unresolved_entries: Option<BTreeMap<RepoPath, Entry>>,
 }
 
 impl TreeMerge {
@@ -302,6 +305,33 @@ impl TreeMerge {
     pub fn is_clean(&self) -> bool {
         self.conflicts.is_empty()
     }
+
+    /// Applies explicit resolved path states before validating the resulting tree.
+    ///
+    /// Unlike the best-effort [`Self::tree`], this preserves the clean parts of a merge
+    /// containing a file/directory clash. A caller must supply all desired structural
+    /// changes: keeping a file never implicitly deletes entries beneath it.
+    pub fn resolve_paths(
+        &self,
+        replacements: &BTreeMap<RepoPath, Option<Entry>>,
+        limits: &Limits,
+    ) -> Result<Tree, TreeError> {
+        let mut entries = match &self.unresolved_entries {
+            Some(entries) => entries.clone(),
+            None => self.tree.iter().map(|(path, entry)| (path.clone(), *entry)).collect(),
+        };
+        for (path, entry) in replacements {
+            match entry {
+                Some(entry) => {
+                    entries.insert(path.clone(), *entry);
+                }
+                None => {
+                    entries.remove(path);
+                }
+            }
+        }
+        Tree::from_entries(entries, limits)
+    }
 }
 
 /// Three-way merges `ours` and `theirs` relative to `base`.
@@ -447,7 +477,7 @@ pub(crate) fn merge_incremental(
         Err(e) => return Err(e.into()),
     };
     conflicts.sort_by(|a, b| a.path.cmp(&b.path));
-    Ok(Some(TreeMerge { tree, conflicts, notes: plan.notes.clone() }))
+    Ok(Some(TreeMerge { tree, conflicts, notes: plan.notes.clone(), unresolved_entries: None }))
 }
 
 /// The reference algorithm: visit every path of the three trees and build the merged map from scratch.
@@ -503,6 +533,7 @@ pub(crate) fn merge_full(
             }
         }
     }
+    let unresolved_entries = (!file_dir.is_empty()).then(|| merged.clone());
     for (file, inside) in file_dir {
         conflicts.push(Conflict { path: file, kind: ConflictKind::FileDirectory { inside }, origin: None });
     }
@@ -520,7 +551,7 @@ pub(crate) fn merge_full(
         // silently drop everything "theirs" added: it is an error, never a clean result.
         Err(e) => return Err(e.into()),
     };
-    Ok(TreeMerge { tree, conflicts, notes: plan.notes.clone() })
+    Ok(TreeMerge { tree, conflicts, notes: plan.notes.clone(), unresolved_entries })
 }
 
 /// A file that moved on at least one side and is merged at its new path.
diff --git a/crates/ag-merge/tests/structural_resolution.rs b/crates/ag-merge/tests/structural_resolution.rs
new file mode 100644
index 00000000..1d61bce4
--- /dev/null
+++ b/crates/ag-merge/tests/structural_resolution.rs
@@ -0,0 +1,50 @@
+//! A structural resolution starts from every merged entry, not the fallback tree.
+use ag_merge::{BlobIo, IoError, merge_trees};
+use ag_object::hash_blob;
+use ag_tree::{Entry, Tree, TreeError};
+use ag_types::{BlobId, FileType, Limits, RepoPath};
+use std::collections::BTreeMap;
+
+struct NoBlobs;
+impl BlobIo for NoBlobs {
+    fn read_blob(&self, _: &BlobId) -> Result<Vec<u8>, IoError> {
+        panic!("disjoint paths need no blob reads")
+    }
+    fn write_blob(&self, _: Vec<u8>) -> Result<BlobId, IoError> {
+        panic!("resolving paths preserves existing blobs")
+    }
+}
+fn path(value: &str) -> RepoPath {
+    RepoPath::new(value).unwrap()
+}
+fn entry(value: &str, file_type: FileType, executable: bool) -> Entry {
+    Entry { content: hash_blob(value.as_bytes()), file_type, executable }
+}
+fn tree(files: &[(&str, Entry)]) -> Tree {
+    Tree::from_entries(files.iter().map(|(name, entry)| (path(name), *entry)), &Limits::default()).unwrap()
+}
+
+#[test]
+fn multiple_structural_choices_preserve_all_exact_entries_and_the_original_fallback() {
+    let regular = entry("file", FileType::Regular, true);
+    let link = entry("../target", FileType::Symlink, false);
+    let clean = entry("\0binary", FileType::Regular, false);
+    let base = Tree::empty();
+    let ours = tree(&[("first", regular), ("second/leaf", link), ("ours", regular)]);
+    let theirs = tree(&[("first/link", link), ("first/executable", regular), ("second", regular), ("clean", clean)]);
+    let merged = merge_trees(&base, &ours, &theirs, &NoBlobs, &Limits::default()).unwrap();
+    assert_eq!(merged.conflicts.len(), 2);
+    assert_eq!(merged.tree, ours, "the legacy best-effort tree does not change");
+    let unresolved = merged.resolve_paths(&BTreeMap::new(), &Limits::default());
+    assert!(matches!(unresolved, Err(TreeError::FileDirectoryConflict { .. })));
+    let choices = BTreeMap::from([(path("first"), None), (path("second"), None)]);
+    let resolved = merged.resolve_paths(&choices, &Limits::default()).unwrap();
+    assert_eq!(resolved.get(&path("first/link")), Some(&link));
+    assert_eq!(resolved.get(&path("first/executable")), Some(&regular));
+    assert_eq!(resolved.get(&path("second/leaf")), Some(&link));
+    assert_eq!(resolved.get(&path("ours")), Some(&regular));
+    assert_eq!(resolved.get(&path("clean")), Some(&clean));
+    assert_eq!(merged.tree, ours, "resolving never mutates the preview");
+    let small = Limits { max_tree_entries: 1, ..Limits::default() };
+    assert!(matches!(merged.resolve_paths(&choices, &small), Err(TreeError::TooManyEntries(5))));
+}
diff --git a/crates/ag-protocol/src/lib.rs b/crates/ag-protocol/src/lib.rs
index 1f969548..c6f799cf 100644
--- a/crates/ag-protocol/src/lib.rs
+++ b/crates/ag-protocol/src/lib.rs
@@ -100,6 +100,9 @@ pub mod features {
     /// Virtual sync conflicts retain exact per-side paths after renames.
     pub const WORKSPACES_CONFLICT_ORIGINS: &str = "workspaces.conflict_origins";
 
+    /// Structural virtual sync resolves the complete merged candidate, preserving independent changes.
+    pub const WORKSPACES_STRUCTURAL_RESOLUTION: &str = "workspaces.structural_resolution";
+
     /// Private versioned review drafts for the current acting identity.
     pub const PROPOSALS_REVIEW_DRAFTS: &str = "proposals.review_drafts";
 
@@ -109,6 +112,7 @@ pub mod features {
         WORKSPACES_VIRTUAL,
         WORKSPACES_SYNC_PRECONDITION,
         WORKSPACES_CONFLICT_ORIGINS,
+        WORKSPACES_STRUCTURAL_RESOLUTION,
         EXECUTION_JOBS,
         OBJECTS_CHUNKED,
         AUTH_OIDC,
diff --git a/dev/continuous-progress.md b/dev/continuous-progress.md
index 4146590b..870bdebf 100644
--- a/dev/continuous-progress.md
+++ b/dev/continuous-progress.md
@@ -29,7 +29,7 @@ Detailed action and validation logs: `/workspace/agentgit-evidence/WORK_LOG.txt`
 
 ## Current audit
 
-Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceability/testing, Web UX review, beta gates. GitHub audit found no open PR and four open qualification issues: #50 real MCP host, #51 external pilots, #53 screen reader, #55 physical phone. Issue #52 is closed with real published beta.7 macOS arm64 checksum/provenance and57 checks ([evidence](https://github.com/Paffin/AgentGit/issues/52#issuecomment-6508589245)); Finder quarantine/Homebrew remain outside that proof. Main advanced by CI-only #133/#134/#135 (prepared releases, reusable permissions, background runner headroom). Main's background qualification is running; do not call it green merely because fast checks pass.
+Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceability/testing, Web UX review, beta gates. Initial GitHub audit found no open PR and four open qualification issues: #50 real MCP host, #51 external pilots, #53 screen reader, #55 physical phone. Issue #52 is closed with real published beta.7 macOS arm64 checksum/provenance and57 checks ([evidence](https://github.com/Paffin/AgentGit/issues/52#issuecomment-6508589245)); Finder quarantine/Homebrew remain outside that proof. Main advanced by CI-only #133/#134/#135 (prepared releases, reusable permissions, background runner headroom). Main's background qualification is running; do not call it green merely because fast checks pass.
 
 ## Prioritized backlog
 
@@ -37,7 +37,7 @@ Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceab
 |---|---|---|---|
 | D1 | P0 DONE | Reconcile unmerged batch with current main; retain new prepared-release/CI design | clean rebase, no lost Windows/install changes; static CI/skip/docs gates pass |
 | D2 | P0 IN PROGRESS | Push working branch, open draft PR, inspect mandatory CI; **never merge** | exact head checks, fix actual failures; native Windows ZIP/install/PS5.1 evidence |
-| R1 | P0 IN PROGRESS | Fix structural sync losing independent incoming add/edit/delete when file/directory merge falls back to ours | retain raw conflicting candidate, apply explicit choices before tree validation; both orientations/no partial workspace mutation |
+| R1 | P0 DONE | Fix structural sync losing independent incoming add/edit/delete when file/directory merge falls back to ours | retain raw conflicting candidate, apply explicit choices before tree validation; both orientations/no partial workspace mutation |
 | R2 | P1 OPEN | Private general discussion drafts | per-account isolation, stale-save/clear protections, UI restore, SDK/CLI parity |
 | R3 | P1 OPEN | Account-backed file-edit drafts | immutable base, byte/mode preservation, conflicts keep local work; no automatic publication |
 | R4 | P1 OPEN | Multi-path rename/file-directory resolution | complete explicit result, preserve independent clean edits; never infer deletion from failed reads |
@@ -62,3 +62,16 @@ Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceab
 ## Reconciliation checkpoint
 
 Rebase on `8a00194` completed without losing application changes. Retained main's fast publish workflow; moved Windows build/verification into `prepare-release.yml`. New candidate manifests require and checksum the Windows ZIP without changing recognition of historical published beta.7. Fixed the new PowerShell tests to use the repository's required-component helper; fast tooling runs only shell-independent Windows archive contracts. Full PowerShell tests are required in native jobs. Beta programme status corrected from beta.5 to the actual published beta.7; external gates remain open.
+
+## Active delivery / CI
+
+- Draft PR [#136](https://github.com/Paffin/AgentGit/pull/136), base main, head `codex/roadmap-review-workflows`. **Do not merge.**
+- Pushed head `93bc4776aa2dac3623c2f1a8c39f6cc451a7947a` after rebase and prepared-pipeline adaptation.
+- Windows native/PowerShell5.1 run explicitly dispatched on that head: [40962143088](https://github.com/Paffin/AgentGit/actions/runs/40962143088), in progress.
+- PR fast CI [40962144429](https://github.com/Paffin/AgentGit/actions/runs/40962144429), Web [40962144494](https://github.com/Paffin/AgentGit/actions/runs/40962144494), Docs [40962144418](https://github.com/Paffin/AgentGit/actions/runs/40962144418); statuses must be refreshed before claiming success.
+- P0 structural sync repair passed239 merge/integrate tests (3 existing ignored), targeted regressions and independent review. Virtual sync preserves complete candidate; local sync and legacy pending snapshots fail closed before unsafe writes.
+- Overall goal remains CONTINUE. The prior stop marked only a milestone; installation/README completion is not platform completion.
+
+## Next available product slice
+
+R4: bounded whole-file/directory choices in Web. Dependency P0 is repaired. A server-supplied complete candidate path list is necessary: input-tree union can miss synthetic paths from directory renames. Do not infer rename mappings in the browser. Bound metadata and browser work; refuse incomplete previews, preserve exact blobs/types/modes and independent changes, require pinned revision/capability guards. Keep multi-target rename/rename separate until explicitly supported.
diff --git a/docs/adr/0040-structural-sync-resolutions.md b/docs/adr/0040-structural-sync-resolutions.md
new file mode 100644
index 00000000..5584cee4
--- /dev/null
+++ b/docs/adr/0040-structural-sync-resolutions.md
@@ -0,0 +1,38 @@
+# ADR 0040: resolve the complete structural merge candidate
+
+Status: accepted.
+
+## Context
+
+A file/directory clash cannot be represented by a valid tree. The merge engine previously
+returned the workspace tree as a best-effort fallback. Virtual sync then applied explicit
+resolutions to that fallback, which could discard unrelated clean additions, edits and
+deletions from the incoming branch. Directory sync could also save the fallback as a pending
+merge and later commit an incomplete snapshot.
+
+## Decision
+
+Retain the pre-validation entry map only for structural conflicts. Explicit virtual-sync
+resolutions apply to that complete candidate before final tree validation. Keeping a file
+requires explicit deletion of conflicting descendants; choosing a directory removes the
+colliding file. The server never silently chooses the discarded subtree. Existing object,
+path and tree limits still apply. Invalid or incomplete choices do not move the workspace.
+The `workspaces.structural_resolution` capability identifies this guarantee to clients.
+
+The ordinary merge algorithm, its version and its public best-effort tree remain unchanged.
+The additional map exists only for a structural conflict; clean merges do not acquire it.
+No persistent schema or object format changes.
+
+Local directory sync refuses a structural clash before changing files, base, head or pending
+state. A caller can explicitly change and snapshot its layout before retrying, or use virtual
+sync with a complete resolution. Snapshots of legacy structural pending merges are also
+refused, including with `--force`; the caller must preserve its edited files and reset/retry
+instead of silently committing an incomplete result. Ordinary text-conflict workflows remain.
+
+## Validation
+
+Repository tests cover both structural orientations and choices, preserve independent clean
+add/edit/delete operations, check merge parents and workspace/stream heads, and verify that
+invalid resolutions do not mutate the workspace. Merge tests retain exact blob/type/mode and
+handle multiple clashes. Local tests check unchanged files/state and a successful explicit
+layout retry; legacy pending tests cover ordinary and forced snapshots.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 0f4ed311..35fdf1cb 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -54,3 +54,5 @@ which test: [ADR traceability](../architecture/adr-traceability.md).
 - [0038 — Private review drafts](0038-private-review-drafts.md)
 
 - [0039 — Exact conflict source paths](0039-conflict-source-paths.md)
+
+- [0040 — Complete structural sync resolutions](0040-structural-sync-resolutions.md)
diff --git a/docs/architecture/adr-traceability.md b/docs/architecture/adr-traceability.md
index b93ddd57..848be26f 100644
--- a/docs/architecture/adr-traceability.md
+++ b/docs/architecture/adr-traceability.md
@@ -47,7 +47,7 @@ Legend: ✅ implemented and tested · 🟡 partly · 🔜 planned (see the [road
 | Outbox | ✅ | at-least-once; the one in-process consumer is tree derivation, run inline after each commit (no background dispatcher; failures are recorded and retried by the next pass, and shown by `ag doctor`, `/readyz` and the `agwp_derive_*` metrics) |
 | Isolated execution plane | 🟡 | `ag-worker` + [`ag-sandbox`](sandbox.md): claims jobs, verifies the exact tree, runs the check isolated, signs; [guide](../guides/workers.md). The OCI backend is checked against real Docker and Podman in CI. Not yet: VM-level isolation, Windows workers, worker pools/labels |
 | Agent Platform in Go (orchestrator, sessions, advisor, semantic index) | ✅ | `services/agent-orchestrator`, tested against the real server ([guide](../guides/orchestrator.md)). Trust boundary (§3): it holds a scoped credential, and `TestOrchestratorNeverIntegrates` fails on any call to integrate, set policy, grant roles, create repositories or approve. Advisor, reviewers and semantic index are deterministic heuristics by default and can be switched to a model (any OpenAI-compatible endpoint you configure); models only propose comments. No simulated agent ships; the optional live path was run once, by hand, with one model |
-| MCP server for agents (`ag-mcp`) | ✅ | stdio, 31 tools, `integrate` only behind `--enable-integrate`, no administration; protocol, CLI and end-to-end suites against a real in-process server ([ADR-0008](../adr/0008-mcp-server.md), [guide](../guides/mcp.md)). Not run inside Claude Code, Claude Desktop or the Agent SDKs |
+| MCP server for agents (`ag-mcp`) | ✅ | stdio, role-gated tools, `integrate` only behind `--enable-integrate`, no administration; protocol, CLI and end-to-end suites against a real in-process server ([ADR-0008](../adr/0008-mcp-server.md), [guide](../guides/mcp.md)). Not run inside Claude Code, Claude Desktop or the Agent SDKs |
 | SHA-256 domain-separated IDs; custom canonical binary format; protobuf is transport only | ✅ | + independent-implementation vectors |
 | Crash recovery, object availability, unknown commit outcome | ✅ | tests above |
 | GC by generations | 🟡 | age-based grace period + roots; no separate generations |
@@ -123,3 +123,20 @@ the wire contract, stale generation rejection and current-generation completion.
 server/shell-executor scheduler scenarios cover restart, operator policy changes during work
 and a late first session while a second run owns the task. Capability tests refuse an older
 server before sending a conditional completion.
+
+## Development review workflow — ADR-0036 through ADR-0039
+
+These capabilities are implemented in the development branch and remain separate from beta.7's published schema8.
+
+| Capability | Status | Evidence and remaining scope |
+|---|---|---|
+| Requested reviewers | ✅ | [ADR-0036](../adr/0036-requested-reviewers.md); author-only inspected-list update, exact review permissions; API/CLI/SDK/MCP/Web tests. Routing never grants approval/access. |
+| Revision-pinned virtual sync | ✅ | [ADR-0037](../adr/0037-pinned-workspace-sync.md); final branch/head checks, exact blob/type/mode choices; HTTP/gRPC and browser regressions. Multi-path structural choices remain open. |
+| Private account review drafts | 🟡 | [ADR-0038](../adr/0038-private-review-drafts.md); owner isolation, versioned save/clear, guarded post-submit cleanup. General comments and file-edit drafts are not covered. |
+| Renamed conflict source paths | ✅ | [ADR-0039](../adr/0039-conflict-source-paths.md); both rename orientations through HTTP/gRPC, CLI and browser; older servers cannot silently lose a side. |
+
+The [continuous checkpoint](../../dev/continuous-progress.md) records pending CI, unmerged work and the next correctness task. These rows do not close the beta's external qualification gates.
+
+## ADR-0040 — structural sync safety
+
+[ADR-0040](../adr/0040-structural-sync-resolutions.md) retains the full structural candidate for explicit virtual-sync resolutions. Tests preserve independent incoming additions, edits and deletions for both orientations and choices, reject invalid trees before workspace movement, and keep exact blob/type/mode metadata. Local structural sync and snapshots of legacy structural pending merges fail closed; `--force` does not bypass this protection. A complete browser structural chooser remains an open product task.
diff --git a/docs/protocol/agwp-v1.md b/docs/protocol/agwp-v1.md
index 8804cb83..6ff562bc 100644
--- a/docs/protocol/agwp-v1.md
+++ b/docs/protocol/agwp-v1.md
@@ -416,3 +416,13 @@ Read each version at its source path instead of treating a missing output path a
 Ordinary same-path conflicts and legacy stored outcomes have no origin. Never parse paths
 from `message`. Development servers advertise `workspaces.conflict_origins` for fresh sync
 responses; browser resolution requires it together with the existing revision preconditions.
+
+### Complete structural sync resolutions
+
+With `workspaces.structural_resolution`, virtual sync applies the supplied path states to the
+complete merge candidate, including independent clean incoming changes. Keeping a file above
+incoming descendants requires deleting those descendants explicitly; deleting the colliding
+file can retain the directory. The final tree must be valid and satisfy the existing limits.
+Incomplete choices fail without changing the workspace. Combine this capability with
+`workspaces.sync_precondition` when sending choices from an inspected preview. Older servers
+can lose clean incoming edits in structural cases and must not be used for this flow.

From 944730ddf7b196e9fd95bb28670b624aabea3ab8 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:05:26 +0000
Subject: [PATCH 17/41] fix(release): require Windows artifacts for future
 versions

Preserve historical POSIX-only release recognition while detecting and repairing incomplete uploads after beta.7. Validate SemVer precedence rather than comparing version text.

Validated: 28 release-request tests, candidate/CI contracts and six killed ordering mutants.
---
 CHANGELOG.md                    |  2 ++
 scripts/request_release.py      | 20 +++++++++++++++++---
 scripts/test_request_release.py | 31 ++++++++++++++++++++++++++++++-
 3 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 34fc5bc0..43df25c4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,6 +28,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Fixed
 
+- Release completeness checks require the Windows ZIP for versions newer than beta.7, so an interrupted future upload is repaired instead of being mistaken for a complete release. Historical POSIX-only releases remain recognized.
+
 - Structural workspace sync preserves independent incoming additions, edits and deletions while applying explicit file/directory resolutions. Incomplete choices fail without moving the workspace; local structural sync and legacy pending snapshots refuse unsafe fallback commits.
 
 - Renamed conflict previews now read each version at its exact source path instead of mistaking a relocated file for deletion. CLI, SDK and MCP retain this metadata; the browser also supports explicit rename/delete choices and requires capable servers.
diff --git a/scripts/request_release.py b/scripts/request_release.py
index 39b8c93b..7fe7b113 100644
--- a/scripts/request_release.py
+++ b/scripts/request_release.py
@@ -10,6 +10,8 @@
 
 PREPARE_WORKFLOW = '.github/workflows/prepare-release.yml'
 TARGETS = ('x86_64-unknown-linux-gnu', 'aarch64-unknown-linux-gnu', 'aarch64-apple-darwin', 'x86_64-apple-darwin')
+# Published releases through this tag shipped only the four POSIX native archives.
+LAST_POSIX_ONLY_RELEASE = '0.3.0-beta.7'
 
 
 class GitHub:
@@ -143,11 +145,23 @@ def validate_request(repo, sha, version):
 
 
 
+def version_order(version):
+    """SemVer precedence for already validated versions; build metadata does not affect ordering."""
+    main, _, prerelease = version.split('+', 1)[0].partition('-')
+    core = tuple(int(part) for part in main.split('.'))
+    identifiers = tuple((0, int(part)) if part.isdigit() else (1, part)
+                        for part in prerelease.split('.'))
+    return core, not bool(prerelease), identifiers
+
+
 def required_assets(version):
     from package_release import RUST_BINARIES
-    return ({f'agentgit-{version}-{target}.tar.gz' for target in TARGETS}
-            | {f'agentgit-{version}-{binary}.cdx.json' for binary in RUST_BINARIES}
-            | {'SHA256SUMS', 'agentgit.rb'})
+    assets = ({f'agentgit-{version}-{target}.tar.gz' for target in TARGETS}
+              | {f'agentgit-{version}-{binary}.cdx.json' for binary in RUST_BINARIES}
+              | {'SHA256SUMS', 'agentgit.rb'})
+    if version_order(version) > version_order(LAST_POSIX_ONLY_RELEASE):
+        assets.add(f'agentgit-{version}-x86_64-pc-windows-msvc.zip')
+    return assets
 
 
 def is_published(release, version):
diff --git a/scripts/test_request_release.py b/scripts/test_request_release.py
index 33982c1f..9d552491 100644
--- a/scripts/test_request_release.py
+++ b/scripts/test_request_release.py
@@ -7,7 +7,7 @@
 
 import yaml
 
-from request_release import GitHub, TARGETS, checks_pending, main, request_release, required_assets, wait_checks, workflow_runs
+from request_release import GitHub, TARGETS, checks_pending, main, request_release, required_assets, is_published, wait_checks, workflow_runs
 
 
 REPO = 'acme/project'
@@ -41,6 +41,35 @@ def test_native_archive_binary_does_not_imply_a_separate_rust_sbom(self):
         self.assertNotIn('agentgit-0.3.0-beta.4-orchestrator.cdx.json', assets)
         self.assertIn('agentgit-0.3.0-beta.4-ag-mcp.cdx.json', assets)
 
+    def test_windows_archive_requirement_preserves_historical_releases(self):
+        for version in ('0.2.0-rc.2', '0.2.9', '0.3.0-1', '0.3.0-alpha.10', '0.3.0-beta.7', '0.3.0-beta.7+build.10'):
+            with self.subTest(version=version):
+                self.assertFalse(any(name.endswith('.zip') for name in required_assets(version)))
+                release = {'draft': False, 'assets': [dict(name=name, state='uploaded', size=1)
+                                                     for name in required_assets(version)]}
+                self.assertTrue(is_published(release, version))
+        for version in ('0.3.0-beta.8', '0.3.0-beta.10', '0.3.0-beta.rc', '0.3.0-rc.1', '0.3.0', '0.3.1', '1.0.0+build.7'):
+            with self.subTest(version=version):
+                self.assertIn(f'agentgit-{version}-x86_64-pc-windows-msvc.zip', required_assets(version))
+
+    def test_missing_future_windows_archive_is_repaired(self):
+        version = '0.3.0-beta.8'
+        zip_name = f'agentgit-{version}-x86_64-pc-windows-msvc.zip'
+        api = Api()
+        assets = [dict(name=name, state='uploaded', size=1)
+                  for name in required_assets(version) if name != zip_name]
+        release = {'draft': False, 'assets': assets}
+        api.values[BASE + '/releases/tags/v' + version] = release
+        self.assertFalse(is_published(release, version))
+        seen = []
+        result = request_release(api, REPO, SHA, version, lambda _api, _base, sha: seen.append(sha))
+        self.assertEqual(result, 'requested v' + version)
+        self.assertEqual(seen, [SHA])
+        self.assertEqual(api.writes[-1], (BASE + '/actions/workflows/release.yml/dispatches',
+                                         {'ref': 'v' + version, 'inputs': {'version': version, 'publish': 'true'}}))
+        release['assets'].append(dict(name=zip_name, state='uploaded', size=1))
+        self.assertTrue(is_published(release, version))
+
     def test_qualification_includes_all_expensive_suites(self):
         root = Path(__file__).resolve().parent.parent
         doc = yaml.safe_load((root / '.github/workflows/qualification.yml').read_text())

From 3d33f5173cb57a12926ccabca246f30c34ef2cb4 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:11:32 +0000
Subject: [PATCH 18/41] feat(sync): describe bounded structural resolution
 scopes

Expose complete candidate path scopes for explicit file/directory choices, including synthetic rename destinations. Bound path copies, mark truncated scopes incomplete and preserve legacy optional metadata in clients.

Validated: 243 core tests, HTTP/gRPC scope regressions, client suites, bounded-scope mutations and independent review.
---
 CHANGELOG.md                                  |   2 +
 apps/web/scripts/generate-api.mjs             |   5 +-
 apps/web/src/api/schema.gen.ts                |  14 +++
 crates/ag-cli/src/cmds/conflicts.rs           |   1 +
 crates/ag-integrate/src/lib.rs                |   4 +-
 crates/ag-integrate/src/types.rs              |  19 +++
 crates/ag-integrate/src/virtual_ws.rs         |  13 ++-
 crates/ag-integrate/tests/conflict_origins.rs |  17 +++
 crates/ag-mcp/src/tools/workspace.rs          |  13 +++
 crates/ag-merge/src/lib.rs                    |   2 +
 crates/ag-merge/src/scopes.rs                 |  58 ++++++++++
 crates/ag-merge/src/tree.rs                   |   6 +
 crates/ag-merge/tests/structural_scope.rs     | 109 ++++++++++++++++++
 crates/ag-protocol/proto/agwp/v1/agwp.proto   |  13 +++
 crates/ag-protocol/src/lib.rs                 |   4 +
 crates/ag-server/src/api/convert.rs           |   4 +
 crates/ag-server/tests/structural_scope.rs    |  93 +++++++++++++++
 dev/continuous-progress.md                    |  16 ++-
 docs/adr/0041-structural-conflict-previews.md |  41 +++++++
 docs/adr/README.md                            |   2 +
 docs/protocol/agwp-v1.md                      |  12 ++
 docs/protocol/openapi.json                    |  31 +++++
 proto/agwp/v1/agwp.proto                      |  13 +++
 sdk/python/README.md                          |   5 +
 sdk/python/src/agentgit/_generated/models.py  |   9 ++
 .../src/agentgit/_generated/namespaces.py     |   1 +
 sdk/python/tests/test_sync_precondition.py    |  30 +++++
 sdk/typescript/README.md                      |   5 +
 sdk/typescript/scripts/generate.mjs           |   1 +
 sdk/typescript/src/generated/models.ts        |   1 +
 sdk/typescript/src/generated/schema.ts        |  14 +++
 sdk/typescript/test/sync-precondition.test.ts |  19 +++
 32 files changed, 573 insertions(+), 4 deletions(-)
 create mode 100644 crates/ag-merge/src/scopes.rs
 create mode 100644 crates/ag-merge/tests/structural_scope.rs
 create mode 100644 crates/ag-server/tests/structural_scope.rs
 create mode 100644 docs/adr/0041-structural-conflict-previews.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 43df25c4..cbdf95f0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Added
 
+- Fresh structural sync previews include bounded candidate path scopes and an explicit completeness flag. Clients can account for synthetic rename destinations without guessing or treating a truncated preview as complete.
+
 - The release pipeline prepares a native Windows x64 ZIP with the CLI, server and MCP, plus a per-user PowerShell installer that verifies checksums. Native install-and-first-use smoke is required before publishing; the first Windows archive is not yet released.
 
 - Reviewers can explicitly save a private review draft to their account and resume on another device through Web UI, CLI, MCP or SDKs. Local drafts remain available, conflicting drafts require a choice, and versioned saves/clears never overwrite newer notes or submit a review. Development schema 10 requires a pre-upgrade backup.
diff --git a/apps/web/scripts/generate-api.mjs b/apps/web/scripts/generate-api.mjs
index 2fd0a553..606bc036 100644
--- a/apps/web/scripts/generate-api.mjs
+++ b/apps/web/scripts/generate-api.mjs
@@ -4,7 +4,10 @@ import openapiTS, { astToString } from 'openapi-typescript'
 
 const schema = JSON.parse(readFileSync('../../docs/protocol/openapi.json', 'utf8'))
 const conflict = schema.components.schemas.Conflict
-if (!conflict.required?.includes('origin')) delete conflict.properties.origin.default
+for (const field of ['origin', 'resolution_scope']) {
+  if (conflict.properties[field] && !conflict.required?.includes(field))
+    delete conflict.properties[field].default
+}
 const header =
   '/**\n * This file was auto-generated by openapi-typescript.\n * Do not make direct changes to the file.\n */\n\n'
 writeFileSync(process.argv[2], header + astToString(await openapiTS(schema)))
diff --git a/apps/web/src/api/schema.gen.ts b/apps/web/src/api/schema.gen.ts
index 5af76bc6..d7c27c8e 100644
--- a/apps/web/src/api/schema.gen.ts
+++ b/apps/web/src/api/schema.gen.ts
@@ -2134,6 +2134,7 @@ export interface components {
       origin?: components['schemas']['ConflictOrigin'] | null
       /** @default  */
       path: string
+      resolution_scope?: components['schemas']['ConflictResolutionScope'] | null
     }
     /** @description Exact paths at the three revisions when source locations differ after a rename. */
     ConflictOrigin: {
@@ -2144,6 +2145,19 @@ export interface components {
       /** @default  */
       theirs: string
     }
+    /** @description Exact candidate paths at or beneath one file/directory conflict root. */
+    ConflictResolutionScope: {
+      /**
+       * @description False if any candidate was omitted; clients must not offer automatic subtree choices then.
+       * @default false
+       */
+      complete: boolean
+      /**
+       * @description Ordered candidate entries, including the root. At most 100 paths per root and 1000 in one response.
+       * @default []
+       */
+      paths: string[]
+    }
     CreateIssueRequest: {
       /** @default  */
       body: string
diff --git a/crates/ag-cli/src/cmds/conflicts.rs b/crates/ag-cli/src/cmds/conflicts.rs
index cb33949b..ad1bdda3 100644
--- a/crates/ag-cli/src/cmds/conflicts.rs
+++ b/crates/ag-cli/src/cmds/conflicts.rs
@@ -47,6 +47,7 @@ mod tests {
                 ours: "result.txt".into(),
                 theirs: "other.txt".into(),
             }),
+            ..Default::default()
         };
         assert_eq!(
             wire(&conflict),
diff --git a/crates/ag-integrate/src/lib.rs b/crates/ag-integrate/src/lib.rs
index 00e32ea8..21e0e5b1 100644
--- a/crates/ag-integrate/src/lib.rs
+++ b/crates/ag-integrate/src/lib.rs
@@ -70,7 +70,9 @@ pub use storage::{
     MAX_S3_LIST_PAGE, MAX_S3_REQUEST_TIMEOUT_SECS, MAX_S3_RETRIES, MetaConfig, ObjectLockKind, ObjectsConfig,
     StorageConfig,
 };
-pub use types::{Blocker, ConflictInfo, ConflictOriginInfo, IntegrationResult, NoteInfo, Outcome, Strategy};
+pub use types::{
+    Blocker, ConflictInfo, ConflictOriginInfo, IntegrationResult, NoteInfo, Outcome, ResolutionScopeInfo, Strategy,
+};
 pub use virtual_ws::{VirtualChange, VirtualContent};
 pub use workspace::{Change, SyncOutcome};
 
diff --git a/crates/ag-integrate/src/types.rs b/crates/ag-integrate/src/types.rs
index cec41dcc..e2cbd381 100644
--- a/crates/ag-integrate/src/types.rs
+++ b/crates/ag-integrate/src/types.rs
@@ -27,6 +27,21 @@ pub struct ConflictOriginInfo {
     pub theirs: String,
 }
 
+/// Bounded complete candidate paths for one explicit structural choice.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ResolutionScopeInfo {
+    /// Exact candidate entry paths at or beneath the conflicting root, in path order.
+    pub paths: Vec<String>,
+    /// False when either preview bound omitted any candidate path.
+    pub complete: bool,
+}
+
+impl From<ag_merge::ResolutionScope> for ResolutionScopeInfo {
+    fn from(scope: ag_merge::ResolutionScope) -> Self {
+        Self { paths: scope.paths.into_iter().map(|path| path.to_string()).collect(), complete: scope.complete }
+    }
+}
+
 /// One conflicting path.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ConflictInfo {
@@ -43,6 +58,9 @@ pub struct ConflictInfo {
     /// Exact per-version paths when a rename moved the source; absent for ordinary conflicts and legacy outcomes.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub origin: Option<ConflictOriginInfo>,
+    /// Present only for file/directory conflicts in a fresh virtual sync preview.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resolution_scope: Option<ResolutionScopeInfo>,
 }
 
 impl ConflictInfo {
@@ -52,6 +70,7 @@ impl ConflictInfo {
             path: c.path.to_string(),
             kind: c.kind.code().to_string(),
             message: c.kind.to_string(),
+            resolution_scope: None,
             origin: c.origin.as_ref().map(|o| ConflictOriginInfo {
                 base: o.base.to_string(),
                 ours: o.ours.to_string(),
diff --git a/crates/ag-integrate/src/virtual_ws.rs b/crates/ag-integrate/src/virtual_ws.rs
index a0348d67..ac609b2e 100644
--- a/crates/ag-integrate/src/virtual_ws.rs
+++ b/crates/ag-integrate/src/virtual_ws.rs
@@ -263,7 +263,18 @@ impl Repository {
 
         let mut result = merged.tree.clone();
         if !merged.is_clean() {
-            let infos: Vec<ConflictInfo> = merged.conflicts.iter().map(ConflictInfo::from_conflict).collect();
+            let mut scopes = merged.structural_resolution_scopes();
+            let infos: Vec<ConflictInfo> = merged
+                .conflicts
+                .iter()
+                .map(|conflict| {
+                    let mut info = ConflictInfo::from_conflict(conflict);
+                    if matches!(conflict.kind, ag_merge::ConflictKind::FileDirectory { .. }) {
+                        info.resolution_scope = scopes.remove(conflict.path.as_str()).map(Into::into);
+                    }
+                    info
+                })
+                .collect();
             let mut wanted: BTreeMap<RepoPath, Option<ag_tree::Entry>> = BTreeMap::new();
             for r in resolutions {
                 wanted.insert(r.path().clone(), self.change_to_target(r)?);
diff --git a/crates/ag-integrate/tests/conflict_origins.rs b/crates/ag-integrate/tests/conflict_origins.rs
index 58cb6feb..3020fc4e 100644
--- a/crates/ag-integrate/tests/conflict_origins.rs
+++ b/crates/ag-integrate/tests/conflict_origins.rs
@@ -21,3 +21,20 @@ fn conflict_conversion_preserves_all_three_source_paths_and_reads_legacy_outcome
     assert_eq!(legacy.describe(), "content");
     assert!(serde_json::to_value(legacy).unwrap().get("origin").is_none_or(|v| v.is_null()));
 }
+
+#[test]
+fn ordinary_and_legacy_conflicts_keep_their_existing_serialized_shape() {
+    let old = json!({"path":"file","kind":"content","message":"overlap"});
+    let decoded: ConflictInfo = serde_json::from_value(old.clone()).unwrap();
+    assert!(decoded.resolution_scope.is_none());
+    assert_eq!(serde_json::to_value(&decoded).unwrap(), old);
+    let fresh = ConflictInfo::from_conflict(&Conflict {
+        path: RepoPath::new("file").unwrap(),
+        kind: ConflictKind::Content { regions: 1 },
+        origin: None,
+    });
+    assert_eq!(
+        serde_json::to_value(fresh).unwrap(),
+        json!({"path":"file","kind":"content","message":"content conflict (1 region(s))"})
+    );
+}
diff --git a/crates/ag-mcp/src/tools/workspace.rs b/crates/ag-mcp/src/tools/workspace.rs
index 47453d3f..2f0cb693 100644
--- a/crates/ag-mcp/src/tools/workspace.rs
+++ b/crates/ag-mcp/src/tools/workspace.rs
@@ -615,6 +615,19 @@ mod tests {
         assert!(out.notes.join(" ").contains("origin.theirs"));
     }
 
+    #[test]
+    fn sync_preserves_incomplete_structural_preview() {
+        let conflict = json!({"path":"docs","kind":"file_directory","message":"",
+            "resolution_scope":{"paths":["docs","docs/guide.md"],"complete":false}});
+        let legacy = json!({"path":"old","kind":"file_directory","message":""});
+        let out = sync_output(
+            "work",
+            &json!({"status":"conflicted","stream_head":"known",
+            "conflicts":[conflict.clone(),legacy.clone()]}),
+        );
+        assert_eq!(out.data["conflicts"], json!([conflict, legacy]));
+    }
+
     #[test]
     fn sync_guidance_never_treats_an_absent_target_as_a_safe_pin() {
         let legacy = sync_output("work", &json!({"status":"conflicted","conflicts":[]}));
diff --git a/crates/ag-merge/src/lib.rs b/crates/ag-merge/src/lib.rs
index afcf55ed..eae949bd 100644
--- a/crates/ag-merge/src/lib.rs
+++ b/crates/ag-merge/src/lib.rs
@@ -49,10 +49,12 @@
 
 mod dirrename;
 mod rename;
+mod scopes;
 mod text;
 mod tree;
 
 pub use dirrename::{MAX_AMBIGUOUS_CANDIDATES, MAX_DIRECTORY_PAIRS};
+pub use scopes::{MAX_RESOLUTION_PATHS_TOTAL, MAX_RESOLUTION_SCOPE_PATHS, ResolutionScope};
 
 pub use rename::{
     MAX_COPY_SOURCES, MAX_SIMILARITY_CANDIDATES, MAX_SIMILARITY_FILE_SIZE, MAX_SIMILARITY_WORK, MIN_COPY_SIMILARITY,
diff --git a/crates/ag-merge/src/scopes.rs b/crates/ag-merge/src/scopes.rs
new file mode 100644
index 00000000..26964e45
--- /dev/null
+++ b/crates/ag-merge/src/scopes.rs
@@ -0,0 +1,58 @@
+//! Bounded candidate-path metadata for explicit structural resolution.
+use std::collections::BTreeMap;
+
+use crate::{Conflict, ConflictKind};
+use ag_tree::Entry;
+use ag_types::RepoPath;
+
+/// Most candidate paths described for one file/directory conflict, including its root.
+pub const MAX_RESOLUTION_SCOPE_PATHS: usize = 100;
+/// Most candidate paths copied across all structural scopes in one preview.
+pub const MAX_RESOLUTION_PATHS_TOTAL: usize = 1000;
+
+/// Candidate paths affected by one structural choice. Incomplete scopes cannot drive a whole-subtree choice.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ResolutionScope {
+    /// Exact candidate entry paths in path order; a complete scope includes the colliding root.
+    pub paths: Vec<RepoPath>,
+    /// True only when every candidate entry at or beneath the root is present.
+    pub complete: bool,
+}
+
+impl ResolutionScope {
+    fn include(&mut self, path: &RepoPath, remaining: &mut usize) {
+        if self.paths.len() < MAX_RESOLUTION_SCOPE_PATHS && *remaining > 0 {
+            self.paths.push(path.clone());
+            *remaining -= 1;
+        } else {
+            self.complete = false;
+        }
+    }
+}
+
+pub(crate) fn collect_scopes<'a>(
+    conflicts: &'a [Conflict],
+    entries: Option<&BTreeMap<RepoPath, Entry>>,
+) -> BTreeMap<&'a str, ResolutionScope> {
+    let Some(entries) = entries else {
+        return BTreeMap::new();
+    };
+    let mut scopes: BTreeMap<&str, ResolutionScope> = conflicts
+        .iter()
+        .filter_map(|conflict| {
+            matches!(conflict.kind, ConflictKind::FileDirectory { .. })
+                .then_some((conflict.path.as_str(), ResolutionScope { paths: Vec::new(), complete: true }))
+        })
+        .collect();
+    let mut remaining = MAX_RESOLUTION_PATHS_TOTAL;
+    // A single candidate scan: look up only its own path and component ancestors.
+    // Borrowed root keys avoid allocation for every ancestor of every candidate.
+    for path in entries.keys() {
+        for root in std::iter::once(path.as_str()).chain(path.ancestors()) {
+            if let Some(scope) = scopes.get_mut(root) {
+                scope.include(path, &mut remaining);
+            }
+        }
+    }
+    scopes
+}
diff --git a/crates/ag-merge/src/tree.rs b/crates/ag-merge/src/tree.rs
index 2d72d322..12f7a509 100644
--- a/crates/ag-merge/src/tree.rs
+++ b/crates/ag-merge/src/tree.rs
@@ -306,6 +306,12 @@ impl TreeMerge {
         self.conflicts.is_empty()
     }
 
+    /// Describes every candidate path beneath each file/directory conflict, subject to fixed bounds.
+    /// A scope that is incomplete must not be used for automatic whole-subtree replacement.
+    pub fn structural_resolution_scopes(&self) -> BTreeMap<&str, crate::ResolutionScope> {
+        crate::scopes::collect_scopes(&self.conflicts, self.unresolved_entries.as_ref())
+    }
+
     /// Applies explicit resolved path states before validating the resulting tree.
     ///
     /// Unlike the best-effort [`Self::tree`], this preserves the clean parts of a merge
diff --git a/crates/ag-merge/tests/structural_scope.rs b/crates/ag-merge/tests/structural_scope.rs
new file mode 100644
index 00000000..c1e0352d
--- /dev/null
+++ b/crates/ag-merge/tests/structural_scope.rs
@@ -0,0 +1,109 @@
+//! Structural preview scopes enumerate the candidate, including relocated files.
+use ag_merge::{BlobIo, IoError, merge_trees};
+use ag_object::hash_blob;
+use ag_tree::{Entry, Tree};
+use ag_types::{BlobId, FileType, Limits, RepoPath};
+use std::cell::RefCell;
+use std::collections::BTreeMap;
+
+#[derive(Default)]
+struct Blobs(RefCell<BTreeMap<BlobId, Vec<u8>>>);
+impl BlobIo for Blobs {
+    fn read_blob(&self, id: &BlobId) -> Result<Vec<u8>, IoError> {
+        Ok(self.0.borrow().get(id).unwrap().clone())
+    }
+    fn write_blob(&self, data: Vec<u8>) -> Result<BlobId, IoError> {
+        let id = hash_blob(&data);
+        self.0.borrow_mut().insert(id, data);
+        Ok(id)
+    }
+}
+fn tree(blobs: &Blobs, files: &[(String, String)]) -> Tree {
+    Tree::from_entries(
+        files.iter().map(|(path, content)| {
+            (
+                RepoPath::new(path).unwrap(),
+                Entry {
+                    content: blobs.write_blob(content.as_bytes().to_vec()).unwrap(),
+                    file_type: FileType::Regular,
+                    executable: false,
+                },
+            )
+        }),
+        &Limits::default(),
+    )
+    .unwrap()
+}
+fn files(entries: &[(&str, &str)]) -> Vec<(String, String)> {
+    entries.iter().map(|(path, content)| (path.to_string(), content.to_string())).collect()
+}
+
+#[test]
+fn scope_includes_relocated_candidate_paths_and_excludes_similar_siblings() {
+    let blobs = Blobs::default();
+    let base = tree(&blobs, &files(&[("lib/a", "aaa"), ("lib/b", "bbb"), ("lib/c", "ccc")]));
+    let ours = tree(&blobs, &files(&[("src/a", "aaa"), ("src/b", "bbb"), ("src/c", "ccc")]));
+    let theirs = tree(
+        &blobs,
+        &files(&[
+            ("lib/a", "aaa"),
+            ("lib/b", "bbb"),
+            ("lib/c", "ccc"),
+            ("lib/new", "new"),
+            ("src", "file"),
+            ("src-other", "sibling"),
+        ]),
+    );
+    assert!(ours.get(&RepoPath::new("src/new").unwrap()).is_none());
+    assert!(theirs.get(&RepoPath::new("src/new").unwrap()).is_none());
+    let merged = merge_trees(&base, &ours, &theirs, &blobs, &Limits::default()).unwrap();
+    let scopes = merged.structural_resolution_scopes();
+    assert_eq!(scopes.len(), 1);
+    let scope = &scopes["src"];
+    assert!(scope.complete);
+    assert_eq!(
+        scope.paths.iter().map(RepoPath::as_str).collect::<Vec<_>>(),
+        ["src", "src/a", "src/b", "src/c", "src/new"]
+    );
+}
+
+#[test]
+fn scopes_are_bounded_per_root_and_globally_and_mark_omissions() {
+    let blobs = Blobs::default();
+    let base = Tree::empty();
+    let ours = tree(&blobs, &files(&[("big", "file")]));
+    let children = (0..100).map(|i| (format!("big/{i:03}"), format!("child{i}"))).collect::<Vec<_>>();
+    let exact = tree(&blobs, &children[..99]);
+    let exact_merge = merge_trees(&base, &ours, &exact, &blobs, &Limits::default()).unwrap();
+    let exact_scope = exact_merge.structural_resolution_scopes().remove("big").unwrap();
+    assert_eq!(exact_scope.paths.len(), 100);
+    assert!(exact_scope.complete, "exact limit is still a complete preview");
+    let theirs = tree(&blobs, &children);
+    let merged = merge_trees(&base, &ours, &theirs, &blobs, &Limits::default()).unwrap();
+    let scope = merged.structural_resolution_scopes().remove("big").unwrap();
+    assert_eq!(scope.paths.len(), 100);
+    assert_eq!(scope.paths[0].as_str(), "big");
+    assert!(!scope.complete);
+
+    let root_files = (0..501).map(|i| (format!("root{i:04}"), format!("file{i}"))).collect::<Vec<_>>();
+    let child_files = (0..501).map(|i| (format!("root{i:04}/child"), format!("child{i}"))).collect::<Vec<_>>();
+    let merged =
+        merge_trees(&base, &tree(&blobs, &root_files), &tree(&blobs, &child_files), &blobs, &Limits::default())
+            .unwrap();
+    let scopes = merged.structural_resolution_scopes();
+    assert_eq!(scopes.len(), 501);
+    assert_eq!(scopes.values().map(|scope| scope.paths.len()).sum::<usize>(), 1000);
+    assert!(scopes["root0499"].complete);
+    assert!(!scopes["root0500"].complete);
+    assert!(scopes["root0500"].paths.is_empty());
+}
+
+#[test]
+fn ordinary_conflicts_do_not_have_structural_scopes() {
+    let blobs = Blobs::default();
+    let a = tree(&blobs, &files(&[("file", "a")]));
+    let b = tree(&blobs, &files(&[("file", "b")]));
+    let merged = merge_trees(&Tree::empty(), &a, &b, &blobs, &Limits::default()).unwrap();
+    assert!(!merged.is_clean());
+    assert!(merged.structural_resolution_scopes().is_empty());
+}
diff --git a/crates/ag-protocol/proto/agwp/v1/agwp.proto b/crates/ag-protocol/proto/agwp/v1/agwp.proto
index ddb1b52a..299a63f6 100644
--- a/crates/ag-protocol/proto/agwp/v1/agwp.proto
+++ b/crates/ag-protocol/proto/agwp/v1/agwp.proto
@@ -887,6 +887,15 @@ message ConflictOrigin {
   string theirs = 3;
 }
 
+// Exact candidate paths at or beneath one file/directory conflict root.
+message ConflictResolutionScope {
+  // Ordered candidate entries; a complete scope includes the root.
+  // At most 100 paths per root and 1000 in one response. Incomplete scopes may be empty.
+  repeated string paths = 1;
+  // False if any candidate was omitted; clients must not offer automatic subtree choices then.
+  bool complete = 2;
+}
+
 message Conflict {
   string path = 1;
   // A stable code: "content", "both_added", "delete_modify", "binary", "type_change",
@@ -903,6 +912,10 @@ message Conflict {
   // For proposal preparation/integration, ours is the stream and theirs is the proposal.
   // The resolution is still written to Conflict.path, not to these source paths.
   ConflictOrigin origin = 4;
+  // Optional bounded scope for file_directory in fresh virtual sync previews.
+  // Missing or incomplete metadata cannot drive a whole-subtree choice.
+  // Does not include paths that exist only in source trees, or indicate a selected side.
+  ConflictResolutionScope resolution_scope = 5;
 }
 
 message Blocker {
diff --git a/crates/ag-protocol/src/lib.rs b/crates/ag-protocol/src/lib.rs
index c6f799cf..c392a469 100644
--- a/crates/ag-protocol/src/lib.rs
+++ b/crates/ag-protocol/src/lib.rs
@@ -103,6 +103,9 @@ pub mod features {
     /// Structural virtual sync resolves the complete merged candidate, preserving independent changes.
     pub const WORKSPACES_STRUCTURAL_RESOLUTION: &str = "workspaces.structural_resolution";
 
+    /// Bounded complete candidate paths for explicit file/directory resolution.
+    pub const WORKSPACES_STRUCTURAL_PREVIEW: &str = "workspaces.structural_preview";
+
     /// Private versioned review drafts for the current acting identity.
     pub const PROPOSALS_REVIEW_DRAFTS: &str = "proposals.review_drafts";
 
@@ -113,6 +116,7 @@ pub mod features {
         WORKSPACES_SYNC_PRECONDITION,
         WORKSPACES_CONFLICT_ORIGINS,
         WORKSPACES_STRUCTURAL_RESOLUTION,
+        WORKSPACES_STRUCTURAL_PREVIEW,
         EXECUTION_JOBS,
         OBJECTS_CHUNKED,
         AUTH_OIDC,
diff --git a/crates/ag-server/src/api/convert.rs b/crates/ag-server/src/api/convert.rs
index 923d08bd..c13504c3 100644
--- a/crates/ag-server/src/api/convert.rs
+++ b/crates/ag-server/src/api/convert.rs
@@ -247,6 +247,10 @@ pub fn conflict(c: &ag_integrate::ConflictInfo) -> v1::Conflict {
         path: c.path.clone(),
         kind: c.kind.clone(),
         message: c.message.clone(),
+        resolution_scope: c
+            .resolution_scope
+            .as_ref()
+            .map(|scope| v1::ConflictResolutionScope { paths: scope.paths.clone(), complete: scope.complete }),
         origin: c.origin.as_ref().map(|o| v1::ConflictOrigin {
             base: o.base.clone(),
             ours: o.ours.clone(),
diff --git a/crates/ag-server/tests/structural_scope.rs b/crates/ag-server/tests/structural_scope.rs
new file mode 100644
index 00000000..42e57621
--- /dev/null
+++ b/crates/ag-server/tests/structural_scope.rs
@@ -0,0 +1,93 @@
+//! Only fresh structural sync previews expose a bounded complete candidate scope.
+mod common;
+use ag_protocol::v1::{self, workspace_service_client::WorkspaceServiceClient};
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use common::*;
+use serde_json::{Value, json};
+use tonic::Request;
+
+async fn checked(http: &Http, path: &str, body: Value) -> Value {
+    let response = http.post(path, body).await;
+    assert_eq!(response.status, 200, "{}", response.json);
+    response.json
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn fresh_sync_reports_candidate_scope_at_the_exact_target() {
+    let server = TestServer::start().await;
+    let admin = server.admin();
+    let capabilities = admin.get("/v1/capabilities?supported_versions=agwp.v1").await;
+    assert!(
+        capabilities.json["features"].as_array().unwrap().iter().any(|value| value == "workspaces.structural_preview")
+    );
+    let root = "/v1/repos/acme/scope";
+    checked(&admin, "/v1/repos", json!({"name":"acme/scope"})).await;
+    let (base, objects) =
+        Client::new("acme/scope").commit(vec![], "user:admin", "base", &[("base", b"unchanged")], 1_700_000_000_000);
+    upload(&admin, "acme/scope", &objects).await;
+    checked(&admin, &format!("{root}/proposals"), json!({"stream":"main","head":base.to_string(),"title":"base"}))
+        .await;
+    checked(
+        &admin,
+        &format!("{root}/streams/cas"),
+        json!({"stream":"main","expected_version":0,"new_head":base.to_string()}),
+    )
+    .await;
+    for name in ["ours", "theirs"] {
+        checked(&admin, &format!("{root}/workspaces"), json!({"name":name,"stream":"main"})).await;
+    }
+    let ours = checked(
+        &admin,
+        &format!("{root}/workspaces/ours/changes"),
+        json!({"changes":[{"path":"clash","op":"put","content":STANDARD.encode("file")}]}),
+    )
+    .await;
+    let theirs = checked(
+        &admin,
+        &format!("{root}/workspaces/theirs/changes"),
+        json!({"changes":[
+            {"path":"clash/a","op":"put","content":STANDARD.encode("a")},
+            {"path":"clash/b","op":"put","content":STANDARD.encode("b")},
+            {"path":"unrelated","op":"put","content":STANDARD.encode("keep")}
+        ]}),
+    )
+    .await;
+    checked(&admin, &format!("{root}/proposals"), json!({"stream":"main","head":theirs["head"],"title":"target"}))
+        .await;
+    checked(
+        &admin,
+        &format!("{root}/streams/cas"),
+        json!({"stream":"main","expected_version":1,"expected_head":base.to_string(),"new_head":theirs["head"]}),
+    )
+    .await;
+    let result =
+        checked(&admin, &format!("{root}/workspaces/ours/sync"), json!({"expected_stream_head":theirs["head"]})).await;
+    assert_eq!(result["status"], "conflicted");
+    assert_eq!(result["stream_head"], theirs["head"]);
+    assert_eq!(
+        result["conflicts"][0]["resolution_scope"],
+        json!({"paths":["clash","clash/a","clash/b"],"complete":true})
+    );
+    assert_eq!(admin.get(&format!("{root}/workspaces/ours")).await.json["head"], ours["head"]);
+    let mut grpc = WorkspaceServiceClient::connect(server.base.clone()).await.unwrap();
+    let mut request = Request::new(v1::SyncWorkspaceRequest {
+        repo: "acme/scope".into(),
+        name: "ours".into(),
+        expected_stream_head: theirs["head"].as_str().unwrap().into(),
+        ..Default::default()
+    });
+    request.metadata_mut().insert("authorization", format!("Bearer {}", admin.token).parse().unwrap());
+    let response = serde_json::to_value(grpc.sync(request).await.unwrap().into_inner()).unwrap();
+    assert_eq!(response["conflicts"], result["conflicts"]);
+    let proposal =
+        checked(&admin, &format!("{root}/proposals"), json!({"stream":"main","head":ours["head"],"title":"ours"}))
+            .await;
+    let preview =
+        checked(&admin, &format!("{root}/proposals/{}/prepare", proposal["id"].as_str().unwrap()), json!({})).await;
+    assert_eq!(preview["conflicts"][0]["kind"], "file_directory");
+    assert!(
+        preview["conflicts"][0].get("resolution_scope").is_none_or(Value::is_null),
+        "scope only belongs to fresh virtual sync"
+    );
+    server.stop().await;
+}
diff --git a/dev/continuous-progress.md b/dev/continuous-progress.md
index 870bdebf..823e8ce8 100644
--- a/dev/continuous-progress.md
+++ b/dev/continuous-progress.md
@@ -8,7 +8,7 @@ Status: **CONTINUE**. Rebased on current main; draft PR preparation and P0 struc
 - Original base: `2ad73082106615c5ce1ac0831b9444eb3955b20f` (beta.7).
 - Audited current remote main on 2026-10-29: `8a0019424b37bd9ef42739389a0e7a1f7945c660`.
 - Local implementation tip before this checkpoint: `ed58caeb2ff4ed10874b80a151c45187be6fe56c`.
-- User says **do not merge yet**; accumulate a larger batch. Do not merge, force-push, publish a release or replace tags. Draft PR and CI qualification are the next delivery step.
+- User reiterated on 2026-10-29: **work only in a separate branch; merge all into the next release only when explicitly told**. Do not merge, force-push, publish a release or replace tags. Draft PR and CI qualification are the next delivery step.
 - Use ub-mode and the existing Hallmark/Web design direction. Keep CLI, SDK and Web behavior aligned; avoid speculative frameworks.
 - On resume: read this file, inspect worktree, fetch main, inspect open PR/CI, retain unmerged changes, continue a runnable backlog item.
 
@@ -75,3 +75,17 @@ Rebase on `8a00194` completed without losing application changes. Retained main'
 ## Next available product slice
 
 R4: bounded whole-file/directory choices in Web. Dependency P0 is repaired. A server-supplied complete candidate path list is necessary: input-tree union can miss synthetic paths from directory renames. Do not infer rename mappings in the browser. Bound metadata and browser work; refuse incomplete previews, preserve exact blobs/types/modes and independent changes, require pinned revision/capability guards. Keep multi-target rename/rename separate until explicitly supported.
+
+### Update after P0 repair
+
+Pushed `a58b8805344085cec15807de40457bea14d95c89` to PR136: complete structural candidate resolution, local fail-closed sync, and legacy pending snapshot guard (force cannot bypass). Merge/integrate239 passed,3 existing ignored, clippy and independent review passed. Latest fast CI run40962581592; Docs40962581342 succeeded. Previous fast CI on93bc477 was cancelled by the newer push, not treated as a code failure. Windows40962143088 still builds the earlier93bc477 head; it cannot qualify the later head until a follow-up native run.
+
+Next R4 implementation contract under review: fresh structural sync conflicts get optional bounded `resolution_scope` with candidate paths and a completeness bit. This covers synthetic directory-rename destinations that are absent from both source trees. Web must refuse incomplete scopes and older servers, group nested conflicts under minimal roots, preserve selected blob/type/mode and explicitly remove other affected paths. File/path/request budgets and branch/proposal/session guards are mandatory. No new account-draft schema is needed for this slice.
+
+### Explicit merge/release hold reaffirmed
+
+Verified PR136 remains Draft, OPEN, mergedAt=null; main does not contain working commits93bc477/a58b880/944730d. Continue development/CI on the separate branch. Do not merge or publish any release until the user directly instructs it; the generic continuous objective never overrides this hold.
+
+### Structural preview dependency validated
+
+Core/API `resolution_scope` implemented: max100 paths per conflict/max1000 per response, complete flag, synthetic rename destinations, exact prefix boundaries and legacy compatibility. Current source passed243 merge/integrate tests (3 existing ignored), HTTP/gRPC scope checks, Clippy, seven selected mutations and independent review. SDK179/204 + MCP3 and CLI31+3 shape checks passed. Web whole-root chooser is now being implemented with a shared request/path budget. Fast CI on a58b880 succeeded (Linux, tooling, SDK, Go); its Web/Docs/Security checks succeeded. Native Windows93bc477 compiled and is running tests, not yet qualified.
diff --git a/docs/adr/0041-structural-conflict-previews.md b/docs/adr/0041-structural-conflict-previews.md
new file mode 100644
index 00000000..084091d9
--- /dev/null
+++ b/docs/adr/0041-structural-conflict-previews.md
@@ -0,0 +1,41 @@
+# ADR 0041: bounded structural conflict previews
+
+Status: accepted.
+
+## Context
+
+An explicit file/directory choice must account for every affected candidate path. The union
+of the two source trees is insufficient: directory-rename propagation can create a candidate
+path that appears in neither source. Guessing in the browser can retain unwanted files or
+silently imply deletion of a path the user never inspected.
+
+## Decision
+
+A fresh virtual-sync file/directory conflict may carry `resolution_scope` with candidate
+`paths` and `complete`. The paths are at or beneath the conflict root in deterministic order.
+A complete scope includes that root and every candidate descendant. Limits are 100 paths per
+scope and 1,000 across one response; any omitted path makes that scope incomplete. Incomplete
+scopes can be empty. Ordinary conflicts, legacy outcomes and proposal preparation do not
+invent scope metadata. Clients negotiate `workspaces.structural_preview`.
+
+The server scans retained candidate paths once and matches actual component ancestors,
+without copying unrelated repository entries or reproducing rename detection in clients.
+This metadata is a preview, not authorization or a server-selected resolution. Existing
+workspace and branch revision checks still bind the eventual operation.
+
+The browser groups nested conflicts under minimal file/directory roots, reads each source
+subtree at its pinned revision, and offers an explicit choice of the complete source side.
+It preserves original blobs, types and modes. The resulting batch retains chosen paths and
+explicitly deletes other affected paths, including synthetic candidate destinations. A
+missing, malformed, truncated or over-budget preview cannot enable this action. Other
+structural conflict kinds remain separate work.
+
+No metadata migration, object-format change or merge-algorithm version change is needed.
+
+## Validation
+
+Core tests cover synthetic relocated paths, sibling prefix boundaries, exact limits and
+aggregate exhaustion. HTTP/gRPC tests bind scopes to the inspected stream and preserve the
+absence of scope on ordinary/legacy data. Client tests preserve incomplete previews rather
+than synthesizing completeness. Browser scenarios cover both file/directory orientations,
+revision races, metadata preservation and independent clean changes.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 35fdf1cb..6248f85f 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -56,3 +56,5 @@ which test: [ADR traceability](../architecture/adr-traceability.md).
 - [0039 — Exact conflict source paths](0039-conflict-source-paths.md)
 
 - [0040 — Complete structural sync resolutions](0040-structural-sync-resolutions.md)
+
+- [0041 — Bounded structural conflict previews](0041-structural-conflict-previews.md)
diff --git a/docs/protocol/agwp-v1.md b/docs/protocol/agwp-v1.md
index 6ff562bc..104f4d56 100644
--- a/docs/protocol/agwp-v1.md
+++ b/docs/protocol/agwp-v1.md
@@ -426,3 +426,15 @@ file can retain the directory. The final tree must be valid and satisfy the exis
 Incomplete choices fail without changing the workspace. Combine this capability with
 `workspaces.sync_precondition` when sending choices from an inspected preview. Older servers
 can lose clean incoming edits in structural cases and must not be used for this flow.
+
+### Structural preview scope
+
+Negotiate `workspaces.structural_preview` before using a file/directory conflict's optional
+`resolution_scope`. `paths` lists candidate paths at or beneath that conflict's root;
+`complete: true` guarantees the root and every candidate descendant are present. The server
+limits this to 100 paths per conflict and 1,000 across the response. A scope can be empty and
+incomplete; absence or `complete: false` cannot authorize a whole-subtree choice. Source paths
+alone do not cover synthetic destinations introduced by directory-rename propagation.
+
+Scopes are fresh virtual-sync metadata, not stored historical proof. Preserve the existing
+`stream_head` precondition when submitting explicit puts/deletes to the complete candidate.
diff --git a/docs/protocol/openapi.json b/docs/protocol/openapi.json
index 1606aa1d..c58684ec 100644
--- a/docs/protocol/openapi.json
+++ b/docs/protocol/openapi.json
@@ -882,6 +882,18 @@
           "path": {
             "default": "",
             "type": "string"
+          },
+          "resolution_scope": {
+            "default": null,
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/ConflictResolutionScope",
+                "description": "Optional bounded scope for file_directory in fresh virtual sync previews.\nMissing or incomplete metadata cannot drive a whole-subtree choice.\nDoes not include paths that exist only in source trees, or indicate a selected side."
+              },
+              {
+                "type": "null"
+              }
+            ]
           }
         },
         "type": "object"
@@ -904,6 +916,25 @@
         },
         "type": "object"
       },
+      "ConflictResolutionScope": {
+        "description": "Exact candidate paths at or beneath one file/directory conflict root.",
+        "properties": {
+          "complete": {
+            "default": false,
+            "description": "False if any candidate was omitted; clients must not offer automatic subtree choices then.",
+            "type": "boolean"
+          },
+          "paths": {
+            "default": [],
+            "description": "Ordered candidate entries, including the root. At most 100 paths per root and 1000 in one response.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
       "CreateIssueRequest": {
         "properties": {
           "body": {
diff --git a/proto/agwp/v1/agwp.proto b/proto/agwp/v1/agwp.proto
index ddb1b52a..299a63f6 100644
--- a/proto/agwp/v1/agwp.proto
+++ b/proto/agwp/v1/agwp.proto
@@ -887,6 +887,15 @@ message ConflictOrigin {
   string theirs = 3;
 }
 
+// Exact candidate paths at or beneath one file/directory conflict root.
+message ConflictResolutionScope {
+  // Ordered candidate entries; a complete scope includes the root.
+  // At most 100 paths per root and 1000 in one response. Incomplete scopes may be empty.
+  repeated string paths = 1;
+  // False if any candidate was omitted; clients must not offer automatic subtree choices then.
+  bool complete = 2;
+}
+
 message Conflict {
   string path = 1;
   // A stable code: "content", "both_added", "delete_modify", "binary", "type_change",
@@ -903,6 +912,10 @@ message Conflict {
   // For proposal preparation/integration, ours is the stream and theirs is the proposal.
   // The resolution is still written to Conflict.path, not to these source paths.
   ConflictOrigin origin = 4;
+  // Optional bounded scope for file_directory in fresh virtual sync previews.
+  // Missing or incomplete metadata cannot drive a whole-subtree choice.
+  // Does not include paths that exist only in source trees, or indicate a selected side.
+  ConflictResolutionScope resolution_scope = 5;
 }
 
 message Blocker {
diff --git a/sdk/python/README.md b/sdk/python/README.md
index 33171910..a7cbbdab 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -551,3 +551,8 @@ Servers advertising `workspaces.conflict_origins` may include `conflict.origin`
 sync, read `origin.ours` at the workspace head and `origin.theirs` at `stream_head`;
 resolve at `conflict.path`. Without origin metadata, both sides use `conflict.path`.
 For proposal preparation and integration, ours is the target stream and theirs is the proposal.
+
+With `workspaces.structural_preview`, fresh workspace sync conflicts may include
+`resolution_scope.paths` for a file/directory conflict. The scope is bounded; only
+`complete: true` identifies a complete set. An absent scope or `complete: false`
+must not authorize deleting unlisted paths or treating the listed paths as exhaustive.
diff --git a/sdk/python/src/agentgit/_generated/models.py b/sdk/python/src/agentgit/_generated/models.py
index 15d04670..26a7bc39 100644
--- a/sdk/python/src/agentgit/_generated/models.py
+++ b/sdk/python/src/agentgit/_generated/models.py
@@ -36,6 +36,7 @@
     "ConfigureRepoRequest",
     "Conflict",
     "ConflictOrigin",
+    "ConflictResolutionScope",
     "CreateIssueRequest",
     "CreateProposalRequest",
     "CreateRepoRequest",
@@ -529,6 +530,7 @@ class Conflict:
     message: str = field(default="")
     origin: ConflictOrigin | None = field(default=None)
     path: str = field(default="")
+    resolution_scope: ConflictResolutionScope | None = field(default=None)
 
 
 @dataclass(kw_only=True)
@@ -539,6 +541,13 @@ class ConflictOrigin:
     theirs: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class ConflictResolutionScope:
+    """Exact candidate paths at or beneath one file/directory conflict root."""
+    complete: bool = field(default=False)
+    paths: list[str] = field(default_factory=list)
+
+
 @dataclass(kw_only=True)
 class CreateIssueRequest:
     """The `CreateIssueRequest` message."""
diff --git a/sdk/python/src/agentgit/_generated/namespaces.py b/sdk/python/src/agentgit/_generated/namespaces.py
index a71fc4bc..5af514f6 100644
--- a/sdk/python/src/agentgit/_generated/namespaces.py
+++ b/sdk/python/src/agentgit/_generated/namespaces.py
@@ -36,6 +36,7 @@
     ConfigureRepoRequest,
     Conflict,
     ConflictOrigin,
+    ConflictResolutionScope,
     CreateIssueRequest,
     CreateProposalRequest,
     CreateRepoRequest,
diff --git a/sdk/python/tests/test_sync_precondition.py b/sdk/python/tests/test_sync_precondition.py
index 3460dc3d..7fc8c5f3 100644
--- a/sdk/python/tests/test_sync_precondition.py
+++ b/sdk/python/tests/test_sync_precondition.py
@@ -127,3 +127,33 @@ def respond(_request: httpx.Request) -> httpx.Response:
     assert result.conflicts[0].origin.ours == "renamed.txt"
     assert result.conflicts[0].origin.theirs == "original.txt"
     assert result.conflicts[1].origin is None
+
+
+def test_sync_preserves_incomplete_structural_preview_and_absent_scope() -> None:
+    def respond(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            json={
+                "status": "conflicted",
+                "head": "workspace",
+                "stream_head": "stream",
+                "conflicts": [
+                    {
+                        "path": "docs",
+                        "kind": "file_directory",
+                        "message": "",
+                        "resolution_scope": {"paths": ["docs", "docs/guide.md"], "complete": False},
+                    },
+                    {"path": "old", "kind": "file_directory", "message": ""},
+                ],
+            },
+        )
+
+    with AgentGitClient(
+        "http://sync.test", "test", http_client=httpx.Client(transport=httpx.MockTransport(respond))
+    ) as client:
+        result = client.workspaces.sync(repo="team/app", name="work")
+    assert result.conflicts[0].resolution_scope is not None
+    assert result.conflicts[0].resolution_scope.paths == ["docs", "docs/guide.md"]
+    assert result.conflicts[0].resolution_scope.complete is False
+    assert result.conflicts[1].resolution_scope is None
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index 685d1a57..56288774 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -511,3 +511,8 @@ Servers advertising `workspaces.conflict_origins` may include `conflict.origin`
 sync, read `origin.ours` at the workspace head and `origin.theirs` at `stream_head`;
 resolve at `conflict.path`. Without origin metadata, both sides use `conflict.path`.
 For proposal preparation and integration, ours is the target stream and theirs is the proposal.
+
+With `workspaces.structural_preview`, fresh workspace sync conflicts may include
+`resolution_scope.paths` for a file/directory conflict. The scope is bounded; only
+`complete: true` identifies a complete set. An absent scope or `complete: false`
+must not authorize deleting unlisted paths or treating the listed paths as exhaustive.
diff --git a/sdk/typescript/scripts/generate.mjs b/sdk/typescript/scripts/generate.mjs
index 97431dd3..a03ce821 100644
--- a/sdk/typescript/scripts/generate.mjs
+++ b/sdk/typescript/scripts/generate.mjs
@@ -247,6 +247,7 @@ function withOpenObjects(doc) {
     ['ProposalDetail', 'requested_reviewers'],
     ['SyncWorkspaceResponse', 'stream_head'],
     ['Conflict', 'origin'],
+    ['Conflict', 'resolution_scope'],
   ]) {
     const schema = copy.components.schemas[schemaName];
     const property = schema?.properties?.[field];
diff --git a/sdk/typescript/src/generated/models.ts b/sdk/typescript/src/generated/models.ts
index 241a8d38..0a0a5f59 100644
--- a/sdk/typescript/src/generated/models.ts
+++ b/sdk/typescript/src/generated/models.ts
@@ -35,6 +35,7 @@ export type CompleteRunRequest = S['CompleteRunRequest'];
 export type ConfigureRepoRequest = S['ConfigureRepoRequest'];
 export type Conflict = S['Conflict'];
 export type ConflictOrigin = S['ConflictOrigin'];
+export type ConflictResolutionScope = S['ConflictResolutionScope'];
 export type CreateIssueRequest = S['CreateIssueRequest'];
 export type CreateProposalRequest = S['CreateProposalRequest'];
 export type CreateRepoRequest = S['CreateRepoRequest'];
diff --git a/sdk/typescript/src/generated/schema.ts b/sdk/typescript/src/generated/schema.ts
index d983a6cc..b31dad96 100644
--- a/sdk/typescript/src/generated/schema.ts
+++ b/sdk/typescript/src/generated/schema.ts
@@ -2144,6 +2144,7 @@ export interface components {
             origin?: components["schemas"]["ConflictOrigin"] | null;
             /** @default  */
             path: string;
+            resolution_scope?: components["schemas"]["ConflictResolutionScope"] | null;
         };
         /** @description Exact paths at the three revisions when source locations differ after a rename. */
         ConflictOrigin: {
@@ -2154,6 +2155,19 @@ export interface components {
             /** @default  */
             theirs: string;
         };
+        /** @description Exact candidate paths at or beneath one file/directory conflict root. */
+        ConflictResolutionScope: {
+            /**
+             * @description False if any candidate was omitted; clients must not offer automatic subtree choices then.
+             * @default false
+             */
+            complete: boolean;
+            /**
+             * @description Ordered candidate entries, including the root. At most 100 paths per root and 1000 in one response.
+             * @default []
+             */
+            paths: string[];
+        };
         CreateIssueRequest: {
             /** @default  */
             body: string;
diff --git a/sdk/typescript/test/sync-precondition.test.ts b/sdk/typescript/test/sync-precondition.test.ts
index a5f65243..4561f76c 100644
--- a/sdk/typescript/test/sync-precondition.test.ts
+++ b/sdk/typescript/test/sync-precondition.test.ts
@@ -92,3 +92,22 @@ it('preserves distinct source paths for a renamed conflict and accepts legacy co
   expect(result.conflicts[0]?.origin).toEqual(conflict.origin);
   expect(result.conflicts[1]?.origin).toBeUndefined();
 });
+
+it('preserves incomplete structural previews and leaves absent scopes absent', async () => {
+  const conflict: Conflict = {
+    path: 'docs',
+    kind: 'file_directory',
+    message: '',
+    resolution_scope: { paths: ['docs', 'docs/guide.md'], complete: false },
+  };
+  const legacy: Conflict = { path: 'old', kind: 'file_directory', message: '' };
+  const client = new AgentGitClient({
+    baseUrl: 'http://sync.test',
+    token: 'test',
+    fetch: async () =>
+      Response.json({ status: 'conflicted', head: 'workspace', stream_head: 'stream', conflicts: [conflict, legacy] }),
+  });
+  const result = await client.workspaces.sync({ repo: 'team/app', name: 'work' });
+  expect(result.conflicts[0]?.resolution_scope).toEqual({ paths: ['docs', 'docs/guide.md'], complete: false });
+  expect(result.conflicts[1]?.resolution_scope).toBeUndefined();
+});

From 09cf619bc7efb9ec4d51ca2e0633c78642efd88e Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:18:27 +0000
Subject: [PATCH 19/41] feat(web): resolve bounded file and directory conflicts

Offer explicit whole-source choices from complete pinned previews, preserving exact blobs and clean changes. Bound requests and paths, show removed destinations, and refuse unsupported or incomplete scopes.

Validated: 849 Web tests, twelve browser cases, types/build/lint, mutations and independent review.
---
 CHANGELOG.md                                  |   2 +
 ROADMAP.md                                    |   2 +-
 apps/web/e2e/structural-conflicts.spec.ts     | 129 +++++++++++++
 apps/web/playwright.config.ts                 |   2 +-
 .../proposal/ConflictResolver.spec.ts         | 115 +++++++++++-
 .../components/proposal/ConflictResolver.vue  | 174 +++++++++++++++++-
 apps/web/src/lib/structuralResolution.spec.ts | 126 +++++++++++++
 apps/web/src/lib/structuralResolution.ts      | 128 +++++++++++++
 dev/continuous-progress.md                    |   8 +-
 docs/guides/web-ui.md                         |  11 +-
 10 files changed, 686 insertions(+), 11 deletions(-)
 create mode 100644 apps/web/e2e/structural-conflicts.spec.ts
 create mode 100644 apps/web/src/lib/structuralResolution.spec.ts
 create mode 100644 apps/web/src/lib/structuralResolution.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cbdf95f0..115b4b52 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Added
 
+- Browser file/directory conflicts support explicit whole-file or whole-folder choices with bounded complete previews, exact blob/type/mode preservation, visible removed paths and pinned revision checks. Independent clean changes survive; incomplete previews remain blocked.
+
 - Fresh structural sync previews include bounded candidate path scopes and an explicit completeness flag. Clients can account for synthetic rename destinations without guessing or treating a truncated preview as complete.
 
 - The release pipeline prepares a native Windows x64 ZIP with the CLI, server and MCP, plus a per-user PowerShell installer that verifies checksums. Native install-and-first-use smoke is required before publishing; the first Windows archive is not yet released.
diff --git a/ROADMAP.md b/ROADMAP.md
index 1eb0f953..8baa0248 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -106,7 +106,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    rechecks the proposal head and open state. Single-line, range and batched suggestions support explicit author preview and application across files in one revision. Requested reviewers route work across Web UI, CLI, MCP and SDKs without changing approval policy. Optional policy-required line-discussion resolution is now implemented
    across core, API, CLI explanations and Web UI. Preserve drafts, exact-head
    checks and explicit confirmation when a user changes executable work or a review decision.
-   Binary, oversized, file-type and rename/delete conflicts now support exact version choices; renamed content previews retain their per-side source paths. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; account-backed file edits and general comment drafts remain open, as do structural rename/file-directory conflicts. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
+   Binary, oversized, file-type and rename/delete conflicts now support exact version choices; renamed content previews retain their per-side source paths. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; account-backed file edits and general comment drafts remain open. Bounded file/directory conflicts now support whole-source choices with complete candidate previews; multi-target rename conflicts and larger structural cases remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
    polling for the aggregate view. A cross-repository event feed remains future work.
 3. **Make GitHub/GitLab cutover complete.** Code history, branch/tag mapping, the original bundle
    and reconciliation already move through Web UI and CLI. Next design and implement resumable
diff --git a/apps/web/e2e/structural-conflicts.spec.ts b/apps/web/e2e/structural-conflicts.spec.ts
new file mode 100644
index 00000000..f6d947c1
--- /dev/null
+++ b/apps/web/e2e/structural-conflicts.spec.ts
@@ -0,0 +1,129 @@
+import { test, expect } from './fixtures.ts'
+import { freshRepo, commitFiles, openProposal, integrate } from './support/world.ts'
+
+for (const keepFolder of [true, false])
+  for (const directorySide of ['proposal', 'branch']) {
+    test(`chooses ${keepFolder ? 'folder' : 'file'} against ${directorySide} folder and preserves independent clean edits`, async ({
+      cast,
+      openAs,
+    }, info) => {
+      const { repo } = await freshRepo(cast, 'structural-conflict')
+      const alice = cast.as('alice'),
+        dana = cast.as('dana')
+      const folder = { 'clash/nested/run': 'run\n', 'clash/link': 'target\n' }
+      const ours = await commitFiles(
+        alice,
+        repo,
+        directorySide === 'proposal'
+          ? { ...folder, 'mine-clean.txt': 'mine clean\n' }
+          : { clash: 'my file\n', 'mine-clean.txt': 'mine clean\n' },
+        'Proposal layout',
+      )
+      const theirs = await commitFiles(
+        dana,
+        repo,
+        directorySide === 'branch'
+          ? { ...folder, 'branch-clean.txt': 'branch clean\n' }
+          : { clash: 'branch file\n', 'branch-clean.txt': 'branch clean\n' },
+        'Branch layout',
+      )
+      const owner = directorySide === 'proposal' ? alice : dana,
+        source = directorySide === 'proposal' ? ours : theirs
+      const exact = await owner.ok_(
+        owner.post(`/v1/repos/${repo}/workspaces/${source.workspace}/changes`, {
+          expected_head: source.head,
+          message: 'Preserve type and mode',
+          changes: [
+            {
+              path: 'clash/nested/run',
+              op: 'put',
+              content: Buffer.from('run\n').toString('base64'),
+              executable: true,
+            },
+            {
+              path: 'clash/link',
+              op: 'put',
+              content: Buffer.from('target').toString('base64'),
+              file_type: 'symlink',
+            },
+          ],
+        }),
+        'set exact entries',
+      )
+      const proposal = await openProposal(alice, repo, {
+        head: directorySide === 'proposal' ? exact.head : ours.head,
+        title: 'Choose a whole folder',
+      })
+      const upstream = await openProposal(dana, repo, {
+        head: directorySide === 'branch' ? exact.head : theirs.head,
+        title: 'Branch structure',
+      })
+      await integrate(cast.as('carol'), repo, upstream.id)
+      const page = await openAs('alice')
+      await page.goto(`/repos/${repo}/proposals/${proposal.id}`)
+      await page.getByTestId('fix-conflict').click()
+      const row = page.getByTestId('resolver').locator('[data-path="clash"]')
+      await expect(row).toBeVisible()
+      await expect(page.getByTestId('resolve-save')).toBeDisabled()
+      await row
+        .getByRole('button', {
+          name: keepFolder
+            ? directorySide === 'proposal'
+              ? 'Keep mine (2 files)'
+              : 'Keep the branch’s (2 files)'
+            : directorySide === 'proposal'
+              ? 'Keep the branch’s (1 file)'
+              : 'Keep mine (1 file)',
+          exact: true,
+        })
+        .click()
+      await page.screenshot({ path: info.outputPath('structural-conflict.png') })
+      await page.getByTestId('resolve-save').click()
+      await expect(page.getByRole('dialog')).toHaveCount(0)
+      const detail = await alice.ok_(
+        alice.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+        'resolved proposal',
+      )
+      const head = detail.proposal.head
+      if (keepFolder)
+        for (const path of ['clash/nested/run', 'clash/link']) {
+          const result = await alice.ok_(
+            alice.get(`/v1/repos/${repo}/tree/resolve?rev=${head}&path=${path}`),
+            'preserved entry',
+          )
+          const original = await alice.ok_(
+            alice.get(`/v1/repos/${repo}/tree/resolve?rev=${exact.head}&path=${path}`),
+            'source entry',
+          )
+          expect(result.entry).toEqual(original.entry)
+        }
+      for (const path of ['mine-clean.txt', 'branch-clean.txt'])
+        expect(
+          (
+            await alice.ok_(
+              alice.get(`/v1/repos/${repo}/tree/resolve?rev=${head}&path=${path}`),
+              'independent edit',
+            )
+          ).entry,
+        ).not.toBeNull()
+      expect(
+        (
+          await alice.ok_(
+            alice.get(`/v1/repos/${repo}/tree/resolve?rev=${head}&path=clash`),
+            'folder chosen',
+          )
+        ).kind,
+      ).toBe(keepFolder ? 'dir' : 'file')
+      if (!keepFolder)
+        for (const path of ['clash/link', 'clash/nested/run'])
+          expect(
+            (
+              await alice.ok_(
+                alice.get(`/v1/repos/${repo}/tree/resolve?rev=${head}&path=${path}`),
+                'removed child',
+              )
+            ).kind,
+          ).toBe('missing')
+      await page.close()
+    })
+  }
diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts
index 71e85ac2..22669daa 100644
--- a/apps/web/playwright.config.ts
+++ b/apps/web/playwright.config.ts
@@ -26,7 +26,7 @@ const screenshots = /screenshots\.spec\.ts/
 // Layout assertions are made at the viewports of the tablet and phone projects, not at desktop size.
 const layout = /responsive\.spec\.ts/
 const small =
-  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|nontext-conflicts|rename-conflicts|review-requests|required-discussions|draft-recovery|review-drafts|account-review-draft|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
+  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|nontext-conflicts|rename-conflicts|structural-conflicts|review-requests|required-discussions|draft-recovery|review-drafts|account-review-draft|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
 const desktop = { viewport: { width: 1440, height: 900 } }
 
 export default defineConfig({
diff --git a/apps/web/src/components/proposal/ConflictResolver.spec.ts b/apps/web/src/components/proposal/ConflictResolver.spec.ts
index 93c3958f..daebb67c 100644
--- a/apps/web/src/components/proposal/ConflictResolver.spec.ts
+++ b/apps/web/src/components/proposal/ConflictResolver.spec.ts
@@ -8,7 +8,7 @@ import ConflictResolver from './ConflictResolver.vue'
 enableAutoUnmount(afterEach)
 const api = vi.hoisted(() => ({
   workspaces: { create: vi.fn(), sync: vi.fn(), remove: vi.fn() },
-  tree: { resolve: vi.fn(), file: vi.fn() },
+  tree: { resolve: vi.fn(), file: vi.fn(), list: vi.fn() },
   proposals: { update: vi.fn() },
 }))
 vi.mock('@/api/instance', () => ({ api }))
@@ -356,8 +356,119 @@ it.each(['rename_rename', 'file_directory'])(
     })
     const w = show()
     await flushPromises()
-    expect(w.text()).toContain('resolve this structural conflict with the command line')
+    expect(w.text()).toContain('Not here')
     expect(api.tree.resolve).not.toHaveBeenCalled()
     expect(w.get('[data-testid=resolve-save]').attributes('aria-disabled')).toBe('true')
   },
 )
+
+it('groups nested structural conflicts and emits exact whole-folder puts and synthetic deletes', async () => {
+  auth.capabilities.features.push('workspaces.structural_preview')
+  api.workspaces.sync
+    .mockReset()
+    .mockResolvedValueOnce({
+      status: 'conflicted',
+      stream_head: 'branch-head',
+      conflicts: [
+        {
+          path: 'a',
+          kind: 'file_directory',
+          resolution_scope: { complete: true, paths: ['a', 'a/synthetic', 'a/run'] },
+        },
+        { path: 'a/run', kind: 'content' },
+      ],
+    })
+    .mockResolvedValue({ status: 'merged', head: 'merged-head' })
+  api.tree.resolve.mockImplementation(async (_repo, head, path) =>
+    head === 'mine-head'
+      ? {
+          kind: 'regular',
+          entry: { path, blob_id: 'file-blob', file_type: 'regular', executable: false, size: 3 },
+        }
+      : { kind: 'dir', entry: null },
+  )
+  api.tree.list = vi.fn().mockResolvedValue({
+    entries: [{ name: 'run', kind: 'file', blob_id: 'run-blob', executable: true, size: 3 }],
+    nextPageToken: '',
+  })
+  const w = show()
+  await flushPromises()
+  expect(w.findAll('section.row')).toHaveLength(1)
+  expect(w.get('[data-testid=resolve-save]').attributes('aria-disabled')).toBe('true')
+  await w
+    .findAll('button')
+    .find((b) => b.text() === 'Keep the branch’s (1 file)')!
+    .trigger('click')
+  expect(w.text()).toContain('a/synthetic')
+  await w.get('[data-testid=resolve-save]').trigger('click')
+  await flushPromises()
+  expect(api.workspaces.sync.mock.calls[1]![2]).toEqual([
+    { path: 'a', op: 'delete' },
+    { path: 'a/run', op: 'put', blob_id: 'run-blob', file_type: 'regular', executable: true },
+    { path: 'a/synthetic', op: 'delete' },
+  ])
+})
+it.each([
+  undefined,
+  { complete: false, paths: ['a'] },
+  { complete: true, paths: ['a', 'outside'] },
+  { complete: true, paths: ['a/child'] },
+])('blocks incomplete or invalid structural preview %j', async (scope) => {
+  auth.capabilities.features.push('workspaces.structural_preview')
+  api.workspaces.sync.mockReset().mockResolvedValue({
+    status: 'conflicted',
+    stream_head: 'branch-head',
+    conflicts: [{ path: 'a', kind: 'file_directory', resolution_scope: scope }],
+  })
+  const w = show()
+  await flushPromises()
+  expect(w.text()).toContain('Not here')
+  expect(w.get('[data-testid=resolve-save]').attributes('aria-disabled')).toBe('true')
+  expect(api.tree.resolve).not.toHaveBeenCalled()
+})
+
+it('requires structural capability even when a complete scope is present', async () => {
+  api.workspaces.sync.mockReset().mockResolvedValue({
+    status: 'conflicted',
+    stream_head: 'branch-head',
+    conflicts: [
+      { path: 'a', kind: 'file_directory', resolution_scope: { complete: true, paths: ['a'] } },
+    ],
+  })
+  const w = show()
+  await flushPromises()
+  expect(w.text()).toContain('Upgrade the server')
+  expect(api.tree.resolve).not.toHaveBeenCalled()
+})
+it('makes an absent source an explicit removal including synthetic candidate descendants', async () => {
+  auth.capabilities.features.push('workspaces.structural_preview')
+  api.workspaces.sync
+    .mockReset()
+    .mockResolvedValueOnce({
+      status: 'conflicted',
+      stream_head: 'branch-head',
+      conflicts: [
+        {
+          path: 'a',
+          kind: 'file_directory',
+          resolution_scope: { complete: true, paths: ['a', 'a/synthetic'] },
+        },
+      ],
+    })
+    .mockResolvedValue({ status: 'merged', head: 'merged-head' })
+  api.tree.resolve.mockResolvedValue({ kind: 'missing', entry: null })
+  const w = show()
+  await flushPromises()
+  await w
+    .findAll('button')
+    .find((b) => b.text() === 'Remove path (absent in mine)')!
+    .trigger('click')
+  expect(w.text()).toContain('No file or folder at this path')
+  expect(w.text()).toContain('a/synthetic')
+  await w.get('[data-testid=resolve-save]').trigger('click')
+  await flushPromises()
+  expect(api.workspaces.sync.mock.calls[1]![2]).toEqual([
+    { path: 'a', op: 'delete' },
+    { path: 'a/synthetic', op: 'delete' },
+  ])
+})
diff --git a/apps/web/src/components/proposal/ConflictResolver.vue b/apps/web/src/components/proposal/ConflictResolver.vue
index 6b610b6f..3c060383 100644
--- a/apps/web/src/components/proposal/ConflictResolver.vue
+++ b/apps/web/src/components/proposal/ConflictResolver.vue
@@ -6,6 +6,14 @@ import type { Conflict, Proposal, SyncWorkspaceResponse } from '@/api/types'
 import { canResolveHere, workspaceName } from '@/lib/edit'
 import { conflictLabel } from '@/lib/conflict-label'
 import { formatBytes } from '@/lib/format'
+import {
+  structuralRoots,
+  within,
+  scopePaths,
+  loadStructuralSide,
+  structuralChanges,
+} from '@/lib/structuralResolution'
+import type { TreeEntry } from '@/api/types'
 import { loadConflictVersion, conflictChange } from '@/lib/conflictResolution'
 import type { ConflictChoice, ConflictVersion } from '@/lib/conflictResolution'
 import { useToasts } from '@/stores/toasts'
@@ -21,7 +29,13 @@ const props = defineProps<{ modelValue: boolean; repo: string; proposal: Proposa
 const emit = defineEmits<{ 'update:modelValue': [open: boolean]; done: [] }>()
 const toasts = useToasts()
 const auth = useAuth()
+interface Structural {
+  paths: string[]
+  mine: TreeEntry[]
+  theirs: TreeEntry[]
+}
 interface Row {
+  structural?: Structural
   conflict: Conflict
   mine: ConflictVersion
   theirs: ConflictVersion
@@ -39,6 +53,7 @@ interface Attempt {
   branchHead: string
   workspace: string
   token: string | null
+  structuralBudget: { remaining: number }
   controller: AbortController
   created: boolean
   released: boolean
@@ -93,6 +108,7 @@ async function prepareRow(a: Attempt, conflict: Conflict): Promise<Row> {
     editSource: 'mine',
     text: '',
   }
+  if (conflict.kind === 'file_directory') return prepareStructural(a, row)
   if (!canResolveHere(conflict.kind)) {
     row.blocked = `${conflictLabel(conflict)}: resolve this structural conflict with the command line.`
     return row
@@ -109,6 +125,93 @@ async function prepareRow(a: Attempt, conflict: Conflict): Promise<Row> {
   if (row.editable) row.choice = row.editSource
   return row
 }
+async function prepareStructural(a: Attempt, row: Row): Promise<Row> {
+  try {
+    if (!auth.capabilities?.features.includes('workspaces.structural_preview'))
+      throw new Error('Upgrade the server to choose a complete file or folder.')
+    const paths = scopePaths(row.conflict.path, row.conflict.resolution_scope)
+    const [mine, theirs] = await Promise.all([
+      loadStructuralSide(api, a.repo, a.head, row.conflict.path, request(a), a.structuralBudget),
+      loadStructuralSide(
+        api,
+        a.repo,
+        a.branchHead,
+        row.conflict.path,
+        request(a),
+        a.structuralBudget,
+      ),
+    ])
+    if (new Set([...mine, ...theirs].map((entry) => entry.path)).size > 100)
+      throw new Error('This folder is too large to resolve here. Use the command line.')
+    row.structural = { paths, mine, theirs }
+  } catch (cause) {
+    row.blocked = describeError(cause)
+  }
+  return row
+}
+function unsupportedChildren(conflicts: Conflict[], root: string) {
+  return conflicts.some(
+    (child) =>
+      within(root, child.path) && child.kind !== 'file_directory' && !canResolveHere(child.kind),
+  )
+}
+function scopeWithChildren(conflict: Conflict, conflicts: Conflict[]): Conflict {
+  try {
+    const paths = scopePaths(conflict.path, conflict.resolution_scope)
+    const covered = conflicts
+      .filter((child) => within(conflict.path, child.path))
+      .map((child) => child.path)
+    return {
+      ...conflict,
+      resolution_scope: { complete: true, paths: [...new Set([...paths, ...covered])] },
+    }
+  } catch {
+    return conflict
+  }
+}
+function mergeRows(conflicts: Conflict[]): Conflict[] {
+  const roots = structuralRoots(conflicts)
+  const total = conflicts.reduce(
+    (sum, conflict) => sum + (conflict.resolution_scope?.paths.length ?? 0),
+    0,
+  )
+  return conflicts
+    .filter(
+      (conflict) =>
+        !roots.some(
+          (root) =>
+            within(root, conflict.path) &&
+            (root !== conflict.path || conflict.kind !== 'file_directory'),
+        ),
+    )
+    .map((conflict) => {
+      if (!roots.includes(conflict.path)) return conflict
+      const unsupported = unsupportedChildren(conflicts, conflict.path)
+      if (total > 1000 || unsupported) return { ...conflict, resolution_scope: null }
+      return scopeWithChildren(conflict, conflicts)
+    })
+}
+function rowChanges(row: Row) {
+  if (row.structural) {
+    const selected = row.choice === 'mine' ? row.structural.mine : row.structural.theirs
+    const other = row.choice === 'mine' ? row.structural.theirs : row.structural.mine
+    return structuralChanges(row.structural.paths, selected, other)
+  }
+  return [
+    conflictChange(row.conflict.path, row.choice, row.mine, row.theirs, row.text, row.editSource),
+  ]
+}
+function fileCount(entries: TreeEntry[]) {
+  return String(entries.length) + (entries.length === 1 ? ' file' : ' files')
+}
+function structuralLabel(side: string, entries: TreeEntry[]) {
+  return entries.length ? `Keep ${side} (${fileCount(entries)})` : `Remove path (absent in ${side})`
+}
+function removedPaths(row: Row) {
+  if (!row.structural || !row.choice) return []
+  const selected = row.choice === 'mine' ? row.structural.mine : row.structural.theirs
+  return row.structural.paths.filter((path) => !selected.some((entry) => entry.path === path))
+}
 async function moveProposal(a: Attempt, head: string) {
   a.controller.signal.throwIfAborted()
   if (!head) throw new Error('The merge did not return a revision.')
@@ -127,8 +230,22 @@ async function prepareMerge(a: Attempt, result: SyncWorkspaceResponse) {
   a.branchHead = result.stream_head ?? ''
   if (!a.branchHead)
     throw new Error('The server did not identify the branch revision used for this conflict.')
-  const prepared = await Promise.all(result.conflicts.map((conflict) => prepareRow(a, conflict)))
+  const prepared = await Promise.all(
+    mergeRows(result.conflicts).map((conflict) => prepareRow(a, conflict)),
+  )
   if (!current(a)) return
+  const paths = new Set(
+    prepared.flatMap((row) =>
+      row.structural
+        ? [
+            ...row.structural.paths,
+            ...row.structural.mine.map((entry) => entry.path),
+            ...row.structural.theirs.map((entry) => entry.path),
+          ]
+        : [row.conflict.path],
+    ),
+  )
+  if (paths.size > 1000) throw new Error('Too many paths to resolve here. Use the command line.')
   rows.value = prepared
   phase.value = 'ready'
 }
@@ -157,6 +274,7 @@ async function open() {
     branchHead: '',
     workspace: workspaceName(),
     token: auth.token,
+    structuralBudget: { remaining: 100 },
     controller: new AbortController(),
     created: false,
     released: false,
@@ -223,9 +341,7 @@ async function save() {
   phase.value = 'saving'
   error.value = null
   try {
-    const resolutions = rows.value.map((row) =>
-      conflictChange(row.conflict.path, row.choice, row.mine, row.theirs, row.text, row.editSource),
-    )
+    const resolutions = rows.value.flatMap(rowChanges)
     const result = await api.workspaces.sync(a.repo, a.workspace, resolutions, {
       ...request(a),
       expectedStreamHead: a.branchHead,
@@ -286,6 +402,56 @@ onBeforeUnmount(invalidate)
           <span class="faint">{{ conflictLabel(r.conflict) }}</span>
         </h3>
         <Alert v-if="r.blocked" tone="warn" title="Not here">{{ r.blocked }}</Alert>
+        <template v-else-if="r.structural">
+          <p>
+            Choose one complete version of this path. Files from the other version will be removed.
+          </p>
+          <div class="pick" role="group" :aria-label="`Keep for ${r.conflict.path}`">
+            <Button
+              :variant="r.choice === 'mine' ? 'primary' : 'secondary'"
+              :aria-pressed="r.choice === 'mine'"
+              @click="r.choice = 'mine'"
+              >{{ structuralLabel('mine', r.structural.mine) }}</Button
+            >
+            <Button
+              :variant="r.choice === 'theirs' ? 'primary' : 'secondary'"
+              :aria-pressed="r.choice === 'theirs'"
+              @click="r.choice = 'theirs'"
+              >{{ structuralLabel('the branch’s', r.structural.theirs) }}</Button
+            >
+          </div>
+          <p v-if="r.choice" class="faint">
+            This choice removes {{ removedPaths(r).length }} other
+            {{ removedPaths(r).length === 1 ? 'path' : 'paths' }} from the merge result.
+          </p>
+          <details>
+            <summary>Files in each version</summary>
+            <template v-if="r.choice"
+              ><p><strong>Paths removed by this choice</strong></p>
+              <ul>
+                <li v-for="path in removedPaths(r)" :key="path">
+                  <code>{{ path }}</code>
+                </li>
+              </ul></template
+            >
+            <p><strong>Your version</strong></p>
+            <p v-if="!r.structural.mine.length">No file or folder at this path.</p>
+            <ul>
+              <li v-for="entry in r.structural.mine" :key="entry.path">
+                <code>{{ entry.path }}</code> · {{ entry.file_type
+                }}{{ entry.executable ? ' · executable' : '' }}
+              </li>
+            </ul>
+            <p><strong>The branch’s version</strong></p>
+            <p v-if="!r.structural.theirs.length">No file or folder at this path.</p>
+            <ul>
+              <li v-for="entry in r.structural.theirs" :key="entry.path">
+                <code>{{ entry.path }}</code> · {{ entry.file_type
+                }}{{ entry.executable ? ' · executable' : '' }}
+              </li>
+            </ul>
+          </details>
+        </template>
         <template v-else>
           <div class="cols">
             <div>
diff --git a/apps/web/src/lib/structuralResolution.spec.ts b/apps/web/src/lib/structuralResolution.spec.ts
new file mode 100644
index 00000000..983179dc
--- /dev/null
+++ b/apps/web/src/lib/structuralResolution.spec.ts
@@ -0,0 +1,126 @@
+import { expect, it, vi } from 'vitest'
+import {
+  structuralRoots,
+  loadStructuralSide,
+  structuralChanges,
+  scopePaths,
+} from './structuralResolution'
+const entry = (path: string, blob_id = path) => ({
+  path,
+  blob_id,
+  file_type: 'regular',
+  executable: true,
+  size: 3,
+})
+it('groups every nested conflict under a minimal structural root', () => {
+  expect(
+    structuralRoots([
+      { path: 'a/b', kind: 'content' },
+      { path: 'a', kind: 'file_directory' },
+      { path: 'a/nested', kind: 'file_directory' },
+      { path: 'z', kind: 'content' },
+    ] as never),
+  ).toEqual(['a'])
+})
+it('requires complete bounded scope confined to the conflict root', () => {
+  expect(scopePaths('a', { complete: true, paths: ['a', 'a/synthetic'] })).toEqual([
+    'a',
+    'a/synthetic',
+  ])
+  for (const scope of [
+    null,
+    { complete: false, paths: ['a'] },
+    { complete: true, paths: ['a/b'] },
+    { complete: true, paths: ['a', 'ab/file'] },
+    { complete: true, paths: ['a', 'a/../escape'] },
+  ])
+    expect(() => scopePaths('a', scope)).toThrow()
+  expect(() =>
+    scopePaths('a', {
+      complete: true,
+      paths: ['a', ...Array.from({ length: 100 }, (_, i) => `a/${i}`)],
+    }),
+  ).toThrow()
+})
+it('preserves exact selected blobs and explicitly deletes synthetic and unselected paths', () => {
+  expect(
+    structuralChanges(['a', 'a/synthetic', 'a/other'], [entry('a/kept')], [entry('a/other')]),
+  ).toEqual([
+    { path: 'a', op: 'delete' },
+    { path: 'a/kept', op: 'put', blob_id: 'a/kept', file_type: 'regular', executable: true },
+    { path: 'a/other', op: 'delete' },
+    { path: 'a/synthetic', op: 'delete' },
+  ])
+})
+it('reads pinned paginated directory entries without downloading file bytes', async () => {
+  const api = {
+    tree: {
+      resolve: vi.fn().mockResolvedValue({ kind: 'dir', entry: null }),
+      list: vi
+        .fn()
+        .mockResolvedValueOnce({
+          entries: [{ name: 'link', kind: 'symlink', blob_id: 'l', executable: false, size: 6 }],
+          nextPageToken: 'next',
+        })
+        .mockResolvedValueOnce({
+          entries: [{ name: 'run', kind: 'file', blob_id: 'r', executable: true, size: 3 }],
+          nextPageToken: '',
+        }),
+    },
+  }
+  const signal = new AbortController().signal
+  expect(
+    await loadStructuralSide(api as never, 'repo', 'pinned', 'a', { signal, token: 'original' }),
+  ).toEqual([
+    { path: 'a/link', blob_id: 'l', file_type: 'symlink', executable: false, size: 6 },
+    { path: 'a/run', blob_id: 'r', file_type: 'regular', executable: true, size: 3 },
+  ])
+  expect(api.tree.list).toHaveBeenLastCalledWith(
+    'repo',
+    { rev: 'pinned', path: 'a', page_size: 100, page_token: 'next' },
+    { signal, token: 'original' },
+  )
+})
+it('refuses unbounded, malformed, unreadable or cancelled source snapshots', async () => {
+  const api = {
+    tree: {
+      resolve: vi.fn().mockResolvedValue({ kind: 'dir', entry: null }),
+      list: vi.fn().mockResolvedValue({
+        entries: Array.from({ length: 101 }, (_, i) => ({
+          name: `f${i}`,
+          kind: 'regular',
+          blob_id: 'b',
+          size: 0,
+          executable: false,
+        })),
+        nextPageToken: '',
+      }),
+    },
+  }
+  await expect(loadStructuralSide(api as never, 'r', 'h', 'a', {})).rejects.toThrow()
+  api.tree.list.mockResolvedValue({
+    entries: [{ name: '../escape', kind: 'regular', blob_id: 'b' }],
+    nextPageToken: '',
+  })
+  await expect(loadStructuralSide(api as never, 'r', 'h', 'a', {})).rejects.toThrow()
+  api.tree.list.mockRejectedValue(new Error('Forbidden'))
+  await expect(loadStructuralSide(api as never, 'r', 'h', 'a', {})).rejects.toThrow('Forbidden')
+  const abort = new AbortController()
+  abort.abort()
+  await expect(
+    loadStructuralSide(api as never, 'r', 'h', 'a', { signal: abort.signal }),
+  ).rejects.toThrow()
+})
+
+it('shares request budget across roots and rejects excessive conflict counts', async () => {
+  const api = { tree: { resolve: vi.fn().mockResolvedValue({ kind: 'missing', entry: null }) } }
+  const budget = { remaining: 1 }
+  await loadStructuralSide(api as never, 'r', 'h', 'a', {}, budget)
+  await expect(loadStructuralSide(api as never, 'r', 'h', 'b', {}, budget)).rejects.toThrow(
+    'too many requests',
+  )
+  expect(api.tree.resolve).toHaveBeenCalledTimes(1)
+  expect(() =>
+    structuralRoots(Array.from({ length: 1001 }, () => ({ path: 'a', kind: 'content' })) as never),
+  ).toThrow('Too many conflicts')
+})
diff --git a/apps/web/src/lib/structuralResolution.ts b/apps/web/src/lib/structuralResolution.ts
new file mode 100644
index 00000000..a707cc98
--- /dev/null
+++ b/apps/web/src/lib/structuralResolution.ts
@@ -0,0 +1,128 @@
+import type { Api } from '@/api/endpoints'
+import type { RequestOptions } from '@/api/client'
+import type { Conflict, FileChange, TreeEntry } from '@/api/types'
+import { pathProblem } from './edit'
+
+export const within = (root: string, path: string) => path === root || path.startsWith(`${root}/`)
+export function structuralRoots(conflicts: Conflict[]): string[] {
+  if (conflicts.length > 1000)
+    throw new Error('Too many conflicts to resolve here. Use the command line.')
+  const roots = conflicts
+    .filter((c) => c.kind === 'file_directory')
+    .map((c) => c.path)
+    .sort()
+  return roots.filter((path) => !roots.some((other) => other !== path && within(other, path)))
+}
+export function scopePaths(root: string, scope: Conflict['resolution_scope']): string[] {
+  if (scope?.complete !== true || !scope.paths.includes(root))
+    throw new Error(
+      'The server did not provide a complete folder preview. Resolve this conflict with the command line.',
+    )
+  if (
+    scope.paths.length > 100 ||
+    scope.paths.some((path) => !within(root, path) || pathProblem(path))
+  )
+    throw new Error(
+      'The folder preview is invalid or too large. Resolve this conflict with the command line.',
+    )
+  return [...new Set(scope.paths)].sort()
+}
+function validEntry(entry: TreeEntry): TreeEntry {
+  if (
+    !['regular', 'symlink'].includes(entry.file_type) ||
+    !entry.blob_id ||
+    pathProblem(entry.path)
+  )
+    throw new Error('Cannot preserve this file type. Resolve this conflict with the command line.')
+  return entry
+}
+export async function loadStructuralSide(
+  api: Api,
+  repo: string,
+  rev: string,
+  root: string,
+  request: RequestOptions,
+  budget = { remaining: 100 },
+): Promise<TreeEntry[]> {
+  request.signal?.throwIfAborted()
+  if (--budget.remaining < 0)
+    throw new Error('This folder preview needs too many requests. Use the command line.')
+  const location = await api.tree.resolve(repo, rev, root, request)
+  if (location.kind === 'missing') return []
+  if (location.kind !== 'dir') {
+    if (!location.entry || location.entry.path !== root) throw new Error('Invalid file preview.')
+    return [validEntry(location.entry)]
+  }
+  return loadDirectory(api, repo, rev, root, request, budget)
+}
+async function loadDirectory(
+  api: Api,
+  repo: string,
+  rev: string,
+  root: string,
+  request: RequestOptions,
+  budget: { remaining: number },
+): Promise<TreeEntry[]> {
+  const files: TreeEntry[] = [],
+    dirs = [root]
+  let calls = 0
+  for (const path of dirs) {
+    let page_token = ''
+    do {
+      request.signal?.throwIfAborted()
+      if (++calls > 100 || --budget.remaining < 0)
+        throw new Error('This folder is too large to resolve here. Use the command line.')
+      const page = await api.tree.list(repo, { rev, path, page_size: 100, page_token }, request)
+      appendEntries(page.entries, path, files, dirs)
+      page_token = page.nextPageToken
+    } while (page_token)
+  }
+  if (new Set(files.map((file) => file.path)).size !== files.length)
+    throw new Error('Invalid duplicate folder entries.')
+  return files
+}
+function appendEntries(
+  entries: Awaited<ReturnType<Api['tree']['list']>>['entries'],
+  path: string,
+  files: TreeEntry[],
+  dirs: string[],
+) {
+  for (const entry of entries) {
+    if (!entry.name || entry.name.includes('/') || pathProblem(entry.name))
+      throw new Error('Invalid folder preview.')
+    const full = `${path}/${entry.name}`
+    if (entry.kind === 'dir') dirs.push(full)
+    else
+      files.push(
+        validEntry({
+          path: full,
+          blob_id: entry.blob_id,
+          file_type: entry.kind === 'file' ? 'regular' : entry.kind,
+          executable: entry.executable,
+          size: entry.size,
+        }),
+      )
+  }
+  if (files.length > 100 || dirs.length > 100)
+    throw new Error('This folder is too large to resolve here. Use the command line.')
+}
+export function structuralChanges(
+  paths: string[],
+  selected: TreeEntry[],
+  other: TreeEntry[],
+): FileChange[] {
+  const keep = new Map(selected.map((entry) => [entry.path, entry]))
+  const all = new Set([...paths, ...keep.keys(), ...other.map((entry) => entry.path)])
+  return [...all].sort().map((path) => {
+    const entry = keep.get(path)
+    return entry
+      ? {
+          path,
+          op: 'put',
+          blob_id: entry.blob_id,
+          file_type: entry.file_type,
+          executable: entry.executable,
+        }
+      : { path, op: 'delete' }
+  })
+}
diff --git a/dev/continuous-progress.md b/dev/continuous-progress.md
index 823e8ce8..64fc0343 100644
--- a/dev/continuous-progress.md
+++ b/dev/continuous-progress.md
@@ -40,7 +40,7 @@ Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceab
 | R1 | P0 DONE | Fix structural sync losing independent incoming add/edit/delete when file/directory merge falls back to ours | retain raw conflicting candidate, apply explicit choices before tree validation; both orientations/no partial workspace mutation |
 | R2 | P1 OPEN | Private general discussion drafts | per-account isolation, stale-save/clear protections, UI restore, SDK/CLI parity |
 | R3 | P1 OPEN | Account-backed file-edit drafts | immutable base, byte/mode preservation, conflicts keep local work; no automatic publication |
-| R4 | P1 OPEN | Multi-path rename/file-directory resolution | complete explicit result, preserve independent clean edits; never infer deletion from failed reads |
+| R4 | P1 PARTIAL | Bounded file/directory Web choices; multi-target rename and larger structural cases remain open | complete explicit result, preserve independent clean edits; never infer deletion from failed reads |
 | R5 | P1 OPEN | Cross-repository work feed | pagination/scopes, full initial snapshot and reconnect behavior |
 | M1 | P1 OPEN | Resumable hosting metadata import: issues/comments first | preview, mapping/idempotency/checkpoint, retry without duplication; PR/releases/identity later |
 | Q1 | P1 BLOCKED external | #50 real MCP host | actual named host/version + full bounded task workflow and denied scope; scripted protocol is not enough |
@@ -89,3 +89,9 @@ Verified PR136 remains Draft, OPEN, mergedAt=null; main does not contain working
 ### Structural preview dependency validated
 
 Core/API `resolution_scope` implemented: max100 paths per conflict/max1000 per response, complete flag, synthetic rename destinations, exact prefix boundaries and legacy compatibility. Current source passed243 merge/integrate tests (3 existing ignored), HTTP/gRPC scope checks, Clippy, seven selected mutations and independent review. SDK179/204 + MCP3 and CLI31+3 shape checks passed. Web whole-root chooser is now being implemented with a shared request/path budget. Fast CI on a58b880 succeeded (Linux, tooling, SDK, Go); its Web/Docs/Security checks succeeded. Native Windows93bc477 compiled and is running tests, not yet qualified.
+
+### Web structural choice validated
+
+Whole-source file/directory UI completed:849 Web unit tests,12 desktop/phone browser cases (8 structural,4 nontext), types/build/lint passed.43 helper mutations and3 targeted Vue mutations caught. Independent review found no blocker. The real browser test caught `tree.list` kind `file` versus `TreeEntry.file_type` `regular`; normalization and a real-kind regression fixed it before commit. Scope/root containment, shared100-request budget,100-source-path/root and1000-dialog-path bounds are enforced. Renamed multi-target conflicts and over-budget structural cases remain open.
+
+CLI follow-up is implementing actual virtual-workspace list/show/create/sync/delete commands (not merely schema tests), using the same pinned-resolution API and complete/incomplete scope output. Lifecycle tests pass; duplicate-path parity and final CLI checks underway. No merge/release permitted.
diff --git a/docs/guides/web-ui.md b/docs/guides/web-ui.md
index 5d67979c..ec26ba27 100644
--- a/docs/guides/web-ui.md
+++ b/docs/guides/web-ui.md
@@ -403,12 +403,19 @@ conflict* (everyone else sees *Copy link to send to the author*). The resolver s
 yours, with *Keep the branch's*, *Keep mine*, *Delete the file* and a text box for the result. Saving applies the
 resolutions through the draft and moves the change request to the merged version. Binary files, oversized files and
 file-type changes can keep either exact version or delete the file: the original blob, type and executable mode are
-retained without converting bytes to text. Editing is available only for regular text versions. Conflicts requiring multiple output paths,
-including rename/rename and file/directory conflicts, remain command-line work. After a rename, each preview reads its original
+retained without converting bytes to text. Editing is available only for regular text versions.
+After a rename, each preview reads its original
 source path and displays it when it differs from the result path. Rename/delete conflicts allow
 an explicit choice between the relocated file and deletion. Servers must advertise
 `workspaces.conflict_origins`; older servers show upgrade guidance instead of ambiguous previews.
 
+For a file/directory collision, the author can choose a complete source file or folder. The dialog shows
+file counts and the exact candidate paths removed by that choice inside its details. Original blobs, symbolic
+links and executable modes are retained; unrelated clean changes survive. This requires
+`workspaces.structural_preview` and a complete server scope. The browser refuses incomplete previews,
+more than 100 source paths per root, more than 1,000 affected paths overall, or more than 100 tree requests.
+Other multi-target rename conflicts and larger cases remain command-line/API work.
+
 The resolver pins both the proposal revision and the target branch. If either changes before saving, the newer
 work is preserved and the dialog asks you to inspect it again. Failed reads never mean a deleted file. This flow
 requires `proposals.update_head`, `workspaces.sync_precondition` and `workspaces.conflict_origins`; older servers need an upgrade before browser

From 52ad4cc6f8ed67380fc1dd18801dcce127975e8d Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:20:39 +0000
Subject: [PATCH 20/41] feat(cli): manage virtual workspaces with pinned
 resolutions

Add explicit lifecycle commands and guarded resolution JSON. Preserve scope metadata without making conflict choices or moving proposals; retain binary/type/mode fields and reject ambiguous or duplicate inputs.

Validated: real-server structural lifecycle, stale-head behavior, CLI contracts and generated help; record OS facts in native CI.
---
 .github/workflows/windows.yml                 |   3 +-
 CHANGELOG.md                                  |   2 +
 crates/ag-cli/src/cmds/mod.rs                 |   1 +
 crates/ag-cli/src/cmds/remote.rs              |  11 +
 crates/ag-cli/src/cmds/virtual_workspaces.rs  | 314 ++++++++++++++++++
 .../tests/golden/json-shapes-remote.json      |  38 +++
 crates/ag-cli/tests/json_shapes_remote.rs     |  13 +
 crates/ag-cli/tests/virtual_workspaces.rs     | 113 +++++++
 dev/continuous-progress.md                    |   6 +
 docs/guides/remote.md                         |  42 +++
 docs/reference/cli-json.md                    |  63 ++++
 docs/reference/cli.md                         | 155 +++++++++
 docs/reference/completions/_ag                | 177 ++++++++++
 docs/reference/completions/_ag.ps1            | 112 +++++++
 docs/reference/completions/ag.bash            | 240 ++++++++++++-
 docs/reference/completions/ag.elv             | 106 ++++++
 docs/reference/completions/ag.fish            |  79 +++--
 .../man/ag-remote-workspace-create.1          |  48 +++
 .../man/ag-remote-workspace-delete.1          |  42 +++
 docs/reference/man/ag-remote-workspace-list.1 |  39 +++
 docs/reference/man/ag-remote-workspace-show.1 |  42 +++
 docs/reference/man/ag-remote-workspace-sync.1 |  48 +++
 docs/reference/man/ag-remote-workspace.1      |  55 +++
 docs/reference/man/ag-remote.1                |   3 +
 24 files changed, 1719 insertions(+), 33 deletions(-)
 create mode 100644 crates/ag-cli/src/cmds/virtual_workspaces.rs
 create mode 100644 crates/ag-cli/tests/virtual_workspaces.rs
 create mode 100644 docs/reference/man/ag-remote-workspace-create.1
 create mode 100644 docs/reference/man/ag-remote-workspace-delete.1
 create mode 100644 docs/reference/man/ag-remote-workspace-list.1
 create mode 100644 docs/reference/man/ag-remote-workspace-show.1
 create mode 100644 docs/reference/man/ag-remote-workspace-sync.1
 create mode 100644 docs/reference/man/ag-remote-workspace.1

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 71063f23..93f23ad8 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -31,8 +31,9 @@ jobs:
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           cache-workspace-crates: true
-      - name: Show the toolchain and Git
+      - name: Show the operating system, toolchain and Git
         run: |
+          Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber, OSArchitecture | Format-List
           rustc -Vv
           git --version
           git config --show-origin --get-all core.autocrlf
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 115b4b52..465c404b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 ### Added
 
+- `ag remote workspace list/show/create/sync/delete` exposes the virtual workspace workflow from the CLI. Explicit resolution files require a pinned stream head and capable server; JSON output retains complete/incomplete structural scopes without choosing paths automatically.
+
 - Browser file/directory conflicts support explicit whole-file or whole-folder choices with bounded complete previews, exact blob/type/mode preservation, visible removed paths and pinned revision checks. Independent clean changes survive; incomplete previews remain blocked.
 
 - Fresh structural sync previews include bounded candidate path scopes and an explicit completeness flag. Clients can account for synthetic rename destinations without guessing or treating a truncated preview as complete.
diff --git a/crates/ag-cli/src/cmds/mod.rs b/crates/ag-cli/src/cmds/mod.rs
index 06ae9453..8e3f26ff 100644
--- a/crates/ag-cli/src/cmds/mod.rs
+++ b/crates/ag-cli/src/cmds/mod.rs
@@ -19,6 +19,7 @@ pub mod review_drafts;
 pub mod reviewers;
 pub mod shell;
 pub mod topics;
+pub mod virtual_workspaces;
 
 use crate::ctx::Ctx;
 
diff --git a/crates/ag-cli/src/cmds/remote.rs b/crates/ag-cli/src/cmds/remote.rs
index 5dc810a6..e66e0032 100644
--- a/crates/ag-cli/src/cmds/remote.rs
+++ b/crates/ag-cli/src/cmds/remote.rs
@@ -841,6 +841,11 @@ pub enum RemoteCmd {
         #[command(subcommand)]
         cmd: crate::cmds::discussions::DiscussionCmd,
     },
+    /// Inspect and explicitly sync server-side workspaces without a checkout.
+    Workspace {
+        #[command(subcommand)]
+        cmd: crate::cmds::virtual_workspaces::WorkspaceCmd,
+    },
     /// Integrate a proposal into its stream.
     Integrate {
         /// Proposal id.
@@ -1257,6 +1262,12 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                 if cmd.changes_state() { print_done(cli, &value, || message)?; }
                 else { print(cli, &value, || message)?; }
             }
+            RemoteCmd::Workspace { cmd } => {
+                let (value, message, conflicted) = crate::cmds::virtual_workspaces::run(&c, &repo, cmd).await?;
+                if cmd.changes_state() && !conflicted { print_done(cli, &value, || message)?; }
+                else { print(cli, &value, || message)?; }
+                if conflicted { return Ok(exit::REFUSED); }
+            }
             RemoteCmd::Integrate { id, fencing_tokens } => {
                 let res = c
                     .integration()
diff --git a/crates/ag-cli/src/cmds/virtual_workspaces.rs b/crates/ag-cli/src/cmds/virtual_workspaces.rs
new file mode 100644
index 00000000..e051f29c
--- /dev/null
+++ b/crates/ag-cli/src/cmds/virtual_workspaces.rs
@@ -0,0 +1,314 @@
+//! Explicit server-side workspace operations; no checkout or automatic conflict choice.
+use std::io::Read;
+use std::path::{Path, PathBuf};
+
+use ag_client::{Client, ClientError};
+use ag_protocol::{features, v1};
+use anyhow::{Context, Result, bail};
+use clap::{Args, Subcommand};
+use serde_json::{Value, json};
+
+/// Server-side workspace lifecycle.
+#[derive(Subcommand, Debug)]
+pub enum WorkspaceCmd {
+    /// List server-side workspaces.
+    List,
+    /// Show a server-side workspace.
+    Show {
+        /// Server-side workspace name.
+        name: String,
+    },
+    /// Create an isolated workspace, optionally at an existing revision.
+    Create {
+        /// New workspace name.
+        name: String,
+        /// Stream to follow.
+        #[arg(long, default_value = "main")]
+        stream: String,
+        /// Starting revision instead of the stream head.
+        #[arg(long, value_name = "REVISION")]
+        from: Option<String>,
+    },
+    /// Merge the stream into a workspace; conflicts leave it unchanged.
+    Sync(SyncArgs),
+    /// Delete the named server-side workspace.
+    Delete {
+        /// Server-side workspace name.
+        name: String,
+    },
+}
+
+/// Optional explicit resolutions and their inspected stream revision.
+#[derive(Args, Debug)]
+pub struct SyncArgs {
+    /// Server-side workspace name.
+    name: String,
+    /// Explicit FileChange JSON array; content is base64, or use an existing blob_id.
+    #[arg(long, value_name = "PATH", requires = "expected_stream_head")]
+    resolutions: Option<PathBuf>,
+    /// Exact nonempty stream head inspected in the preceding sync result.
+    #[arg(long, value_name = "CHANGESET")]
+    expected_stream_head: Option<String>,
+}
+
+impl WorkspaceCmd {
+    /// Whether this invocation may change a server-side workspace.
+    pub fn changes_state(&self) -> bool {
+        !matches!(self, Self::List | Self::Show { .. })
+    }
+}
+
+fn require_features(cmd: &WorkspaceCmd, supported: &[String]) -> Result<()> {
+    let mut needed = vec![features::WORKSPACES_VIRTUAL];
+    if let WorkspaceCmd::Sync(args) = cmd {
+        if args.expected_stream_head.is_some() {
+            needed.push(features::WORKSPACES_SYNC_PRECONDITION);
+        }
+        if args.resolutions.is_some() {
+            needed.push(features::WORKSPACES_STRUCTURAL_RESOLUTION);
+        }
+    }
+    for feature in needed {
+        if !supported.iter().any(|value| value == feature) {
+            bail!("server does not support {feature}; update it before using this command");
+        }
+    }
+    Ok(())
+}
+
+fn parse_resolution(value: Value) -> Result<v1::FileChange> {
+    let object = value.as_object().context("each resolution must be an object")?;
+    let allowed = ["path", "op", "content", "blob_id", "executable", "file_type"];
+    if let Some(key) = object.keys().find(|key| !allowed.contains(&key.as_str())) {
+        bail!("unknown resolution field {key}");
+    }
+    let change: v1::FileChange = serde_json::from_value(value.clone()).context("invalid resolution")?;
+    ag_types::RepoPath::new(&change.path)?;
+    validate_resolution_content(object, &change)?;
+    Ok(change)
+}
+
+fn validate_resolution_content(object: &serde_json::Map<String, Value>, change: &v1::FileChange) -> Result<()> {
+    match change.op.as_str() {
+        "put" => {
+            if object.contains_key("content") == !change.blob_id.is_empty() {
+                bail!("put requires exactly one of base64 content or blob_id");
+            }
+        }
+        "delete" => {
+            if ["content", "blob_id", "executable", "file_type"].iter().any(|key| object.contains_key(*key)) {
+                bail!("delete accepts only path and op");
+            }
+        }
+        _ => bail!("resolution op must be put or delete"),
+    }
+    Ok(())
+}
+
+fn resolutions(path: Option<&Path>) -> Result<Vec<v1::FileChange>> {
+    let Some(path) = path else { return Ok(Vec::new()) };
+    const MAX_BYTES: u64 = 8 * 1024 * 1024;
+    let mut bytes = Vec::new();
+    std::fs::File::open(path)
+        .with_context(|| format!("opening {}", path.display()))?
+        .take(MAX_BYTES + 1)
+        .read_to_end(&mut bytes)?;
+    if bytes.len() as u64 > MAX_BYTES {
+        bail!("resolution file exceeds 8 MiB");
+    }
+    let values: Vec<Value> = serde_json::from_slice(&bytes).context("resolutions must be a JSON array")?;
+    if values.is_empty() || values.len() > ag_protocol::limits::MAX_BATCH as usize {
+        bail!("resolution array must contain 1 to {} entries", ag_protocol::limits::MAX_BATCH);
+    }
+    let changes = values.into_iter().map(parse_resolution).collect::<Result<Vec<_>>>()?;
+    require_unique_paths(&changes)?;
+    Ok(changes)
+}
+
+fn require_unique_paths(changes: &[v1::FileChange]) -> Result<()> {
+    let mut paths = std::collections::BTreeSet::new();
+    if changes.iter().any(|change| !paths.insert(change.path.as_str())) {
+        bail!("a resolution path appears more than once");
+    }
+    Ok(())
+}
+
+fn describe_workspace(workspace: &v1::Workspace) -> String {
+    format!(
+        "{} -> {}\nhead: {}\nbase: {}\nowner: {}",
+        workspace.name, workspace.stream, workspace.head, workspace.base, workspace.owner
+    )
+}
+
+fn describe_sync(result: &v1::SyncWorkspaceResponse) -> String {
+    let mut message =
+        format!("{}\nworkspace head: {}\nstream head: {}", result.status, result.head, result.stream_head);
+    for conflict in &result.conflicts {
+        message.push_str(&format!("\nconflict: {}", super::conflicts::wire(conflict)));
+        if let Some(scope) = &conflict.resolution_scope {
+            message.push_str(&format!(
+                "\n    resolution scope ({}): {}",
+                if scope.complete { "complete" } else { "incomplete" },
+                scope.paths.join(", ")
+            ));
+        }
+    }
+    message
+}
+
+async fn sync(client: &Client, repo: &str, args: &SyncArgs) -> Result<(Value, String, bool)> {
+    if let Some(head) = &args.expected_stream_head {
+        head.parse::<ag_types::ChangesetId>().context("expected stream head must be a full changeset id")?;
+    }
+    let result = client
+        .workspaces()
+        .sync(client.req(v1::SyncWorkspaceRequest {
+            repo: repo.into(),
+            name: args.name.clone(),
+            resolutions: resolutions(args.resolutions.as_deref())?,
+            expected_stream_head: args.expected_stream_head.clone().unwrap_or_default(),
+            ..Default::default()
+        }))
+        .await
+        .map_err(ClientError::from)?
+        .into_inner();
+    let message = describe_sync(&result);
+    let conflicted = result.status == "conflicted";
+    Ok((serde_json::to_value(result)?, message, conflicted))
+}
+
+/// Executes only the operation explicitly named by the caller.
+pub async fn run(client: &Client, repo: &str, cmd: &WorkspaceCmd) -> Result<(Value, String, bool)> {
+    require_features(cmd, &client.negotiate().await?.features)?;
+    let result = match cmd {
+        WorkspaceCmd::Sync(args) => return sync(client, repo, args).await,
+        WorkspaceCmd::List => list(client, repo).await,
+        WorkspaceCmd::Show { name } => show(client, repo, name).await,
+        WorkspaceCmd::Create { name, stream, from } => create(client, repo, name, stream, from.as_deref()).await,
+        WorkspaceCmd::Delete { name } => delete(client, repo, name).await,
+    };
+    result.map(|(value, message)| (value, message, false))
+}
+
+async fn list(client: &Client, repo: &str) -> Result<(Value, String)> {
+    let result = client
+        .workspaces()
+        .list(client.req(v1::ListWorkspacesRequest { repo: repo.into() }))
+        .await
+        .map_err(ClientError::from)?
+        .into_inner();
+    let message = if result.workspaces.is_empty() {
+        "No server-side workspaces.".into()
+    } else {
+        result.workspaces.iter().map(describe_workspace).collect::<Vec<_>>().join("\n\n")
+    };
+    Ok((serde_json::to_value(result)?, message))
+}
+
+async fn show(client: &Client, repo: &str, name: &str) -> Result<(Value, String)> {
+    let result = client
+        .workspaces()
+        .get(client.req(v1::GetWorkspaceRequest { repo: repo.into(), name: name.into() }))
+        .await
+        .map_err(ClientError::from)?
+        .into_inner();
+    let message = describe_workspace(&result);
+    Ok((serde_json::to_value(result)?, message))
+}
+
+async fn create(client: &Client, repo: &str, name: &str, stream: &str, from: Option<&str>) -> Result<(Value, String)> {
+    let result = client
+        .workspaces()
+        .create(client.req(v1::CreateWorkspaceRequest {
+            repo: repo.into(),
+            name: name.into(),
+            stream: stream.into(),
+            from_rev: from.unwrap_or_default().into(),
+            ..Default::default()
+        }))
+        .await
+        .map_err(ClientError::from)?
+        .into_inner();
+    let message = describe_workspace(&result);
+    Ok((serde_json::to_value(result)?, message))
+}
+
+async fn delete(client: &Client, repo: &str, name: &str) -> Result<(Value, String)> {
+    client
+        .workspaces()
+        .delete(client.req(v1::DeleteWorkspaceRequest { repo: repo.into(), name: name.into() }))
+        .await
+        .map_err(ClientError::from)?;
+    Ok((json!({}), format!("Deleted server-side workspace {name}.")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn applying_resolutions_requires_both_pinning_and_structural_support() {
+        let command = WorkspaceCmd::Sync(SyncArgs {
+            name: "w".into(),
+            resolutions: Some("r.json".into()),
+            expected_stream_head: Some("head".into()),
+        });
+        let virtual_only = vec![features::WORKSPACES_VIRTUAL.into()];
+        assert!(require_features(&WorkspaceCmd::List, &virtual_only).is_ok());
+        assert!(require_features(&command, &virtual_only).unwrap_err().to_string().contains("sync_precondition"));
+        let mut supported = virtual_only;
+        supported.push(features::WORKSPACES_SYNC_PRECONDITION.into());
+        assert!(require_features(&command, &supported).unwrap_err().to_string().contains("structural_resolution"));
+        supported.push(features::WORKSPACES_STRUCTURAL_RESOLUTION.into());
+        assert!(require_features(&command, &supported).is_ok());
+    }
+
+    #[test]
+    fn resolution_json_keeps_bytes_and_metadata_and_rejects_ambiguous_writes() {
+        let binary =
+            parse_resolution(json!({"path":"a","op":"put","content":"AP8=","executable":true,"file_type":"regular"}))
+                .unwrap();
+        assert_eq!(binary.content, [0, 255]);
+        assert!(binary.executable);
+        let blob =
+            parse_resolution(json!({"path":"link","op":"put","blob_id":"existing","file_type":"symlink"})).unwrap();
+        assert_eq!(blob.blob_id, "existing");
+        assert_eq!(blob.file_type, "symlink");
+        assert_eq!(parse_resolution(json!({"path":"a","op":"delete"})).unwrap().op, "delete");
+        for invalid in [
+            json!({"path":"a","op":"put","content_base64":"eA=="}),
+            json!({"path":"a","op":"put","content":"eA==","blob_id":"existing"}),
+            json!({"path":"a","op":"put"}),
+            json!({"path":"a","op":"delete","content":""}),
+            json!({"path":"a","op":"put","content":"!"}),
+            json!({"path":"../a","op":"delete"}),
+        ] {
+            assert!(parse_resolution(invalid.clone()).is_err(), "{invalid}");
+        }
+    }
+    #[test]
+    fn resolution_files_are_nonempty_and_bounded_before_network_io() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("choices.json");
+        std::fs::write(&path, "[]").unwrap();
+        assert!(resolutions(Some(&path)).is_err());
+        let mut valid = br#"[{"path":"empty","op":"put","content":""}]"#.to_vec();
+        valid.resize(8 * 1024 * 1024, b' ');
+        std::fs::write(&path, &valid).unwrap();
+        assert_eq!(resolutions(Some(&path)).unwrap().len(), 1);
+        valid.push(b' ');
+        std::fs::write(&path, &valid).unwrap();
+        assert!(resolutions(Some(&path)).unwrap_err().to_string().contains("8 MiB"));
+        let oversized: Vec<_> =
+            (0..=ag_protocol::limits::MAX_BATCH).map(|i| json!({"path":format!("file-{i}"),"op":"delete"})).collect();
+        std::fs::write(&path, serde_json::to_vec(&oversized).unwrap()).unwrap();
+        assert!(resolutions(Some(&path)).is_err());
+    }
+    #[test]
+    fn duplicate_resolution_paths_are_rejected_from_the_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("choices.json");
+        std::fs::write(&path, r#"[{"path":"a","op":"put","content":""},{"path":"a","op":"delete"}]"#).unwrap();
+        assert!(resolutions(Some(&path)).unwrap_err().to_string().contains("more than once"));
+    }
+}
diff --git a/crates/ag-cli/tests/golden/json-shapes-remote.json b/crates/ag-cli/tests/golden/json-shapes-remote.json
index 873d3428..25ea65ad 100644
--- a/crates/ag-cli/tests/golden/json-shapes-remote.json
+++ b/crates/ag-cli/tests/golden/json-shapes-remote.json
@@ -507,6 +507,44 @@
         "streams": []
       }
     },
+    "remote workspace create": {
+      "base": "string",
+      "created_at_ms": "number",
+      "head": "string",
+      "name": "string",
+      "owner": "string",
+      "stream": "string",
+      "updated_at_ms": "number"
+    },
+    "remote workspace delete": {},
+    "remote workspace list": {
+      "workspaces": [
+        {
+          "base": "string",
+          "created_at_ms": "number",
+          "head": "string",
+          "name": "string",
+          "owner": "string",
+          "stream": "string",
+          "updated_at_ms": "number"
+        }
+      ]
+    },
+    "remote workspace show": {
+      "base": "string",
+      "created_at_ms": "number",
+      "head": "string",
+      "name": "string",
+      "owner": "string",
+      "stream": "string",
+      "updated_at_ms": "number"
+    },
+    "remote workspace sync": {
+      "conflicts": [],
+      "head": "string",
+      "status": "string",
+      "stream_head": "string"
+    },
     "status#remote": {
       "base": "string",
       "changes": [],
diff --git a/crates/ag-cli/tests/json_shapes_remote.rs b/crates/ag-cli/tests/json_shapes_remote.rs
index a2e78eb3..7f55a7e6 100644
--- a/crates/ag-cli/tests/json_shapes_remote.rs
+++ b/crates/ag-cli/tests/json_shapes_remote.rs
@@ -42,6 +42,7 @@ fn the_json_output_of_every_remote_command_matches_the_documented_shape() {
     let p1 = p1["proposal"]["id"].as_str().unwrap().to_string();
     record_discussions(&mut r, &a, &alice, &p1, &head);
     record_review_drafts(&mut r, &a, &bob, &p1, &head);
+    record_virtual_workspace(&mut r, &a, &alice, &head);
     r.rec("remote proposals", &as_user("user:alice", &alice, &["--json", "remote", "proposals"]).ok());
     r.rec(
         "remote reviewers",
@@ -209,3 +210,15 @@ fn record_review_drafts(r: &mut Recorder, a: &Ag, token: &str, proposal: &str, h
         &run(&["--json", "remote", "review-draft", "clear", proposal, "--expected-version", "1"]).ok(),
     );
 }
+
+fn record_virtual_workspace(r: &mut Recorder, a: &Ag, token: &str, head: &str) {
+    let run = |args: &[&str]| a.run_env("user:alice", args, &[("AG_TOKEN", token)]);
+    r.rec(
+        "remote workspace create",
+        &run(&["--json", "remote", "workspace", "create", "scratch", "--stream", "main", "--from", head]).ok(),
+    );
+    r.rec("remote workspace list", &run(&["--json", "remote", "workspace", "list"]).ok());
+    r.rec("remote workspace show", &run(&["--json", "remote", "workspace", "show", "scratch"]).ok());
+    r.rec("remote workspace sync", &run(&["--json", "remote", "workspace", "sync", "scratch"]).ok());
+    r.rec("remote workspace delete", &run(&["--json", "remote", "workspace", "delete", "scratch"]).ok());
+}
diff --git a/crates/ag-cli/tests/virtual_workspaces.rs b/crates/ag-cli/tests/virtual_workspaces.rs
new file mode 100644
index 00000000..b53c1a85
--- /dev/null
+++ b/crates/ag-cli/tests/virtual_workspaces.rs
@@ -0,0 +1,113 @@
+//! Server-side workspaces through the real CLI, including guarded structural resolution.
+#![allow(missing_docs)]
+mod common;
+use ag_server::authz::Role;
+use common::{Ag, Server};
+use serde_json::json;
+
+#[test]
+fn virtual_workspace_lifecycle_pins_structural_choices_and_preserves_other_files() {
+    let server = Server::start();
+    let repo = "acme/virtual-cli";
+    server.create_repo(repo);
+    let token = server.user("user:alice", repo, Role::Admin);
+    let a = Ag::bare();
+    let run = |args: &[&str]| a.run_env("user:alice", args, &[("AG_TOKEN", &token)]);
+    let url = format!("{}/{repo}", server.url);
+    run(&["init", "--namespace", repo]).ok();
+    run(&["remote", "add", "origin", &url, "--token-env", "AG_TOKEN"]).ok();
+    a.write("base.txt", "unchanged");
+    run(&["snapshot", "-m", "base"]).ok();
+    let base = run(&["--json", "push", "-t", "base"]).ok().json();
+    run(&["remote", "integrate", base["proposal"]["id"].as_str().unwrap()]).ok();
+    run(&["pull"]).ok();
+    a.write("clash", "file");
+    run(&["snapshot", "-m", "ours"]).ok();
+    let ours = run(&["--json", "push", "-t", "ours"]).ok().json();
+    let ours_head = ours["proposal"]["head"].as_str().unwrap();
+    let ours_id = ours["proposal"]["id"].as_str().unwrap();
+    let created = run(&["--json", "remote", "workspace", "create", "resolve", "--stream", "main", "--from", ours_head])
+        .ok()
+        .json();
+    assert_eq!(created["head"], ours_head);
+    assert_eq!(created["base"], ours_head);
+    let listed = run(&["--json", "remote", "workspace", "list"]).ok().json();
+    assert!(listed["workspaces"].as_array().unwrap().iter().any(|w| w["name"] == "resolve"));
+
+    let b = Ag::bare();
+    let other = |args: &[&str]| b.run_env("user:alice", args, &[("AG_TOKEN", &token)]);
+    other(&["clone", &url, "."]).ok();
+    b.write("clash/a", "a");
+    b.write("clash/b", "b");
+    b.write("unrelated", "keep");
+    other(&["snapshot", "-m", "theirs"]).ok();
+    let theirs = other(&["--json", "push", "-t", "theirs"]).ok().json();
+    other(&["remote", "integrate", theirs["proposal"]["id"].as_str().unwrap()]).ok();
+    other(&["pull"]).ok();
+    let inspected = run(&["--json", "remote", "workspace", "sync", "resolve"]).code_is(4).json();
+    assert_eq!(inspected["status"], "conflicted");
+    assert_eq!(inspected["head"], ours_head);
+    assert_eq!(
+        inspected["conflicts"][0]["resolution_scope"],
+        json!({"paths":["clash","clash/a","clash/b"],"complete":true})
+    );
+    let target = inspected["stream_head"].as_str().unwrap();
+    a.write(
+        "resolutions.json",
+        &serde_json::to_string(&json!([
+            {"path":"clash","op":"put","content":"ZmlsZQ=="},
+            {"path":"clash/a","op":"delete"}, {"path":"clash/b","op":"delete"}
+        ]))
+        .unwrap(),
+    );
+    run(&["remote", "workspace", "sync", "resolve", "--resolutions", "resolutions.json"]).code_is(2);
+    b.write("unrelated", "keep newer");
+    other(&["snapshot", "-m", "advance"]).ok();
+    let advanced = other(&["--json", "push", "-t", "advance"]).ok().json();
+    other(&["remote", "integrate", advanced["proposal"]["id"].as_str().unwrap()]).ok();
+    let stale = run(&[
+        "remote",
+        "workspace",
+        "sync",
+        "resolve",
+        "--resolutions",
+        "resolutions.json",
+        "--expected-stream-head",
+        target,
+    ]);
+    assert!(!stale.out.status.success());
+    assert_eq!(run(&["--json", "remote", "workspace", "show", "resolve"]).ok().json()["head"], ours_head);
+    let current = run(&["--json", "remote", "workspace", "sync", "resolve"]).code_is(4).json();
+    let applied = run(&[
+        "--json",
+        "remote",
+        "workspace",
+        "sync",
+        "resolve",
+        "--resolutions",
+        "resolutions.json",
+        "--expected-stream-head",
+        current["stream_head"].as_str().unwrap(),
+    ])
+    .ok()
+    .json();
+    assert_eq!(applied["status"], "merged");
+    let result = applied["head"].as_str().unwrap();
+    assert_eq!(run(&["remote", "cat", &format!("{result}:unrelated")]).ok().stdout(), "keep newer");
+    assert_eq!(run(&["remote", "cat", &format!("{result}:clash")]).ok().stdout(), "file");
+    assert_eq!(run(&["--json", "remote", "proposal", ours_id]).ok().json()["proposal"]["head"], ours_head);
+    other(&["pull"]).ok();
+    for index in 0..100 {
+        b.write(&format!("clash/wide-{index}"), "wide");
+    }
+    other(&["snapshot", "-m", "wide directory"]).ok();
+    let wide = other(&["--json", "push", "-t", "wide"]).ok().json();
+    other(&["remote", "integrate", wide["proposal"]["id"].as_str().unwrap()]).ok();
+    run(&["remote", "workspace", "create", "wide", "--from", ours_head]).ok();
+    let incomplete = run(&["--json", "remote", "workspace", "sync", "wide"]).code_is(4).json();
+    assert_eq!(incomplete["conflicts"][0]["resolution_scope"]["complete"], false);
+    assert_eq!(run(&["--json", "remote", "workspace", "show", "wide"]).ok().json()["head"], ours_head);
+    run(&["remote", "workspace", "delete", "wide"]).ok();
+    run(&["remote", "workspace", "delete", "resolve"]).ok();
+    assert!(!run(&["remote", "workspace", "show", "resolve"]).out.status.success());
+}
diff --git a/dev/continuous-progress.md b/dev/continuous-progress.md
index 64fc0343..7bf32f51 100644
--- a/dev/continuous-progress.md
+++ b/dev/continuous-progress.md
@@ -95,3 +95,9 @@ Core/API `resolution_scope` implemented: max100 paths per conflict/max1000 per r
 Whole-source file/directory UI completed:849 Web unit tests,12 desktop/phone browser cases (8 structural,4 nontext), types/build/lint passed.43 helper mutations and3 targeted Vue mutations caught. Independent review found no blocker. The real browser test caught `tree.list` kind `file` versus `TreeEntry.file_type` `regular`; normalization and a real-kind regression fixed it before commit. Scope/root containment, shared100-request budget,100-source-path/root and1000-dialog-path bounds are enforced. Renamed multi-target conflicts and over-budget structural cases remain open.
 
 CLI follow-up is implementing actual virtual-workspace list/show/create/sync/delete commands (not merely schema tests), using the same pinned-resolution API and complete/incomplete scope output. Lifecycle tests pass; duplicate-path parity and final CLI checks underway. No merge/release permitted.
+
+### Coordinated CLI/Web/SDK slice complete locally
+
+Web849 tests and12 browser cases passed. CLI virtual-workspace lifecycle now implemented (five explicit commands), with pinned resolution files, capability guards, duplicate/ambiguous JSON rejection, complete/incomplete scope output and no automatic proposal mutation. Final lifecycle/unit/clippy and159 generated reference files checked. SDK179/204 and MCP3 passed for the same scope contract. Independent reviews found no blockers. Next push will include these commits in the existing draft PR only; no merge/tag/release is authorized.
+
+Windows run40962143088 is still on earlier93bc477 and currently in Test; do not count it as latest-head proof. A subsequent native run on the final pushed head is required. Full Web matrix will be dispatched on that final head; local desktop/phone tests are not a substitute for all browser/identity-provider gates. Add OS/build metadata to the next Windows log for exact qualification evidence.
diff --git a/docs/guides/remote.md b/docs/guides/remote.md
index 281d82e9..87c89469 100644
--- a/docs/guides/remote.md
+++ b/docs/guides/remote.md
@@ -129,3 +129,45 @@ It reads the server's current preparation without requesting validation jobs or
 Use `ag --json remote explain PROPOSAL` in scripts: exit 0 means ready, 3 means a requirement is missing,
 and 4 means refused, conflicted or already closed. The result includes the candidate tree and policy version.
 An explanation is a snapshot; integration always checks the current policy and candidate again.
+
+## Server-side workspaces
+
+Use `ag remote workspace` for an isolated workspace on the server, without a local checkout:
+
+```bash
+ag remote workspace list
+ag remote workspace create review-fix --stream main --from <proposal-head>
+ag remote workspace show review-fix
+ag --json remote workspace sync review-fix
+```
+
+A conflicting sync exits with code 4 and leaves the workspace unchanged. Its JSON includes the
+workspace `head`, the exact `stream_head` inspected, and every conflict. For file/directory conflicts,
+`resolution_scope.paths` lists the candidate paths and `resolution_scope.complete` says whether that
+list is complete. An incomplete list is not permission to discard the omitted files. Read both versions
+and choose every change explicitly; the CLI does not select a side, generate deletions, or update a proposal.
+
+Save your choices as a JSON array of `FileChange` objects. `content` is standard base64 (including an
+explicit empty string for an empty file); alternatively use `blob_id` to preserve existing binary data.
+Carry over `file_type` and `executable` when choosing an existing version. A deletion has only `path`
+and `op`:
+
+```json
+[
+  {"path": "clash", "op": "put", "content": "ZmlsZQ==", "file_type": "regular", "executable": false},
+  {"path": "clash/a", "op": "delete"},
+  {"path": "clash/b", "op": "delete"}
+]
+```
+
+Apply that file against the `stream_head` from the sync you inspected:
+
+```bash
+ag --json remote workspace sync review-fix --resolutions choices.json --expected-stream-head <stream-head>
+ag remote workspace delete review-fix
+```
+
+`--resolutions` requires `--expected-stream-head`. The CLI refuses application unless the server
+advertises both guarded sync and structural resolution support. A changed stream head rejects the
+operation; inspect a fresh sync result before deciding again. Deleting a workspace removes that
+server-side workspace, not its proposal or the stream.
diff --git a/docs/reference/cli-json.md b/docs/reference/cli-json.md
index 6577615d..bd4a55c4 100644
--- a/docs/reference/cli-json.md
+++ b/docs/reference/cli-json.md
@@ -1913,6 +1913,69 @@ Their output *is* the data (file contents, a template, a script, a man page, hel
 }
 ```
 
+### ag remote workspace create
+
+```json
+{
+  "base": "string",
+  "created_at_ms": "number",
+  "head": "string",
+  "name": "string",
+  "owner": "string",
+  "stream": "string",
+  "updated_at_ms": "number"
+}
+```
+
+### ag remote workspace delete
+
+```json
+{}
+```
+
+### ag remote workspace list
+
+```json
+{
+  "workspaces": [
+    {
+      "base": "string",
+      "created_at_ms": "number",
+      "head": "string",
+      "name": "string",
+      "owner": "string",
+      "stream": "string",
+      "updated_at_ms": "number"
+    }
+  ]
+}
+```
+
+### ag remote workspace show
+
+```json
+{
+  "base": "string",
+  "created_at_ms": "number",
+  "head": "string",
+  "name": "string",
+  "owner": "string",
+  "stream": "string",
+  "updated_at_ms": "number"
+}
+```
+
+### ag remote workspace sync
+
+```json
+{
+  "conflicts": [],
+  "head": "string",
+  "status": "string",
+  "stream_head": "string"
+}
+```
+
 ## ag show
 
 ### ag show
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index 72b8c822..9b9861c7 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -139,6 +139,12 @@ Concept pages are available in the terminal: `ag help workflow|policy|leases|ide
 - [`ag remote discussion start`](#ag-remote-discussion-start)
 - [`ag remote discussion reply`](#ag-remote-discussion-reply)
 - [`ag remote discussion resolve`](#ag-remote-discussion-resolve)
+- [`ag remote workspace`](#ag-remote-workspace)
+- [`ag remote workspace list`](#ag-remote-workspace-list)
+- [`ag remote workspace show`](#ag-remote-workspace-show)
+- [`ag remote workspace create`](#ag-remote-workspace-create)
+- [`ag remote workspace sync`](#ag-remote-workspace-sync)
+- [`ag remote workspace delete`](#ag-remote-workspace-delete)
 - [`ag remote integrate`](#ag-remote-integrate)
 - [`ag remote close`](#ag-remote-close)
 - [`ag remote streams`](#ag-remote-streams)
@@ -2514,6 +2520,7 @@ Commands:
   review-draft  Save or restore your private account review notes without submitting them
   review        Review a proposal's current head
   discussion    Read and participate in revision-bound line discussions
+  workspace     Inspect and explicitly sync server-side workspaces without a checkout
   integrate     Integrate a proposal into its stream
   close         Close a proposal without integrating it
   streams       List streams
@@ -3042,6 +3049,154 @@ Options:
           Print version
 ```
 
+## ag remote workspace
+
+```text
+Inspect and explicitly sync server-side workspaces without a checkout
+
+Usage: ag remote workspace [OPTIONS] <COMMAND>
+
+Commands:
+  list    List server-side workspaces
+  show    Show a server-side workspace
+  create  Create an isolated workspace, optionally at an existing revision
+  sync    Merge the stream into a workspace; conflicts leave it unchanged
+  delete  Delete the named server-side workspace
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote workspace list
+
+```text
+List server-side workspaces
+
+Usage: ag remote workspace list [OPTIONS]
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote workspace show
+
+```text
+Show a server-side workspace
+
+Usage: ag remote workspace show [OPTIONS] <NAME>
+
+Arguments:
+  <NAME>  Server-side workspace name
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote workspace create
+
+```text
+Create an isolated workspace, optionally at an existing revision
+
+Usage: ag remote workspace create [OPTIONS] <NAME>
+
+Arguments:
+  <NAME>  New workspace name
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --stream <STREAM>  Stream to follow [default: main]
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --from <REVISION>  Starting revision instead of the stream head
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote workspace sync
+
+```text
+Merge the stream into a workspace; conflicts leave it unchanged
+
+Usage: ag remote workspace sync [OPTIONS] <NAME>
+
+Arguments:
+  <NAME>  Server-side workspace name
+
+Options:
+  -C, --repo <DIR>
+          Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>
+          Remote to use (default: origin)
+      --resolutions <PATH>
+          Explicit FileChange JSON array; content is base64, or use an existing blob_id
+      --as <IDENTITY>
+          Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --expected-stream-head <CHANGESET>
+          Exact nonempty stream head inspected in the preceding sync result
+      --json
+          Machine-readable JSON output
+      --color <WHEN>
+          Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet
+          Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose
+          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+```
+
+## ag remote workspace delete
+
+```text
+Delete the named server-side workspace
+
+Usage: ag remote workspace delete [OPTIONS] <NAME>
+
+Arguments:
+  <NAME>  Server-side workspace name
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
 ## ag remote integrate
 
 ```text
diff --git a/docs/reference/completions/_ag b/docs/reference/completions/_ag
index 139365fb..74c25638 100644
--- a/docs/reference/completions/_ag
+++ b/docs/reference/completions/_ag
@@ -2772,6 +2772,146 @@ never\:"Never colour"))' \
     ;;
 esac
 ;;
+(workspace)
+_arguments "${_arguments_options[@]}" : \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+":: :_ag__subcmd__remote__subcmd__workspace_commands" \
+"*::: :->workspace" \
+&& ret=0
+
+    case $state in
+    (workspace)
+        words=($line[1] "${words[@]}")
+        (( CURRENT += 1 ))
+        curcontext="${curcontext%:*:*}:ag-remote-workspace-command-$line[1]:"
+        case $line[1] in
+            (list)
+_arguments "${_arguments_options[@]}" : \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+&& ret=0
+;;
+(show)
+_arguments "${_arguments_options[@]}" : \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':name -- Server-side workspace name:_default' \
+&& ret=0
+;;
+(create)
+_arguments "${_arguments_options[@]}" : \
+'--stream=[Stream to follow]:STREAM:_default' \
+'--from=[Starting revision instead of the stream head]:REVISION:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':name -- New workspace name:_default' \
+&& ret=0
+;;
+(sync)
+_arguments "${_arguments_options[@]}" : \
+'--resolutions=[Explicit FileChange JSON array; content is base64, or use an existing blob_id]:PATH:_files' \
+'--expected-stream-head=[Exact nonempty stream head inspected in the preceding sync result]:CHANGESET:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':name -- Server-side workspace name:_default' \
+&& ret=0
+;;
+(delete)
+_arguments "${_arguments_options[@]}" : \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':name -- Server-side workspace name:_default' \
+&& ret=0
+;;
+        esac
+    ;;
+esac
+;;
 (integrate)
 _arguments "${_arguments_options[@]}" : \
 '*--fencing-token=[Fencing tokens of exclusive leases the author holds]:FENCING_TOKENS:_default' \
@@ -3907,6 +4047,7 @@ _ag__subcmd__remote_commands() {
 'review-draft:Save or restore your private account review notes without submitting them' \
 'review:Review a proposal'\''s current head' \
 'discussion:Read and participate in revision-bound line discussions' \
+'workspace:Inspect and explicitly sync server-side workspaces without a checkout' \
 'integrate:Integrate a proposal into its stream' \
 'close:Close a proposal without integrating it' \
 'streams:List streams' \
@@ -4068,6 +4209,42 @@ _ag__subcmd__remote__subcmd__whoami_commands() {
     local commands; commands=()
     _describe -t commands 'ag remote whoami commands' commands "$@"
 }
+(( $+functions[_ag__subcmd__remote__subcmd__workspace_commands] )) ||
+_ag__subcmd__remote__subcmd__workspace_commands() {
+    local commands; commands=(
+'list:List server-side workspaces' \
+'show:Show a server-side workspace' \
+'create:Create an isolated workspace, optionally at an existing revision' \
+'sync:Merge the stream into a workspace; conflicts leave it unchanged' \
+'delete:Delete the named server-side workspace' \
+    )
+    _describe -t commands 'ag remote workspace commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__workspace__subcmd__create_commands] )) ||
+_ag__subcmd__remote__subcmd__workspace__subcmd__create_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote workspace create commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__workspace__subcmd__delete_commands] )) ||
+_ag__subcmd__remote__subcmd__workspace__subcmd__delete_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote workspace delete commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__workspace__subcmd__list_commands] )) ||
+_ag__subcmd__remote__subcmd__workspace__subcmd__list_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote workspace list commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__workspace__subcmd__show_commands] )) ||
+_ag__subcmd__remote__subcmd__workspace__subcmd__show_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote workspace show commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__workspace__subcmd__sync_commands] )) ||
+_ag__subcmd__remote__subcmd__workspace__subcmd__sync_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote workspace sync commands' commands "$@"
+}
 (( $+functions[_ag__subcmd__show_commands] )) ||
 _ag__subcmd__show_commands() {
     local commands; commands=()
diff --git a/docs/reference/completions/_ag.ps1 b/docs/reference/completions/_ag.ps1
index f57c5ece..dcf222cf 100644
--- a/docs/reference/completions/_ag.ps1
+++ b/docs/reference/completions/_ag.ps1
@@ -1883,6 +1883,7 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('review-draft', 'review-draft', [CompletionResultType]::ParameterValue, 'Save or restore your private account review notes without submitting them')
             [CompletionResult]::new('review', 'review', [CompletionResultType]::ParameterValue, 'Review a proposal''s current head')
             [CompletionResult]::new('discussion', 'discussion', [CompletionResultType]::ParameterValue, 'Read and participate in revision-bound line discussions')
+            [CompletionResult]::new('workspace', 'workspace', [CompletionResultType]::ParameterValue, 'Inspect and explicitly sync server-side workspaces without a checkout')
             [CompletionResult]::new('integrate', 'integrate', [CompletionResultType]::ParameterValue, 'Integrate a proposal into its stream')
             [CompletionResult]::new('close', 'close', [CompletionResultType]::ParameterValue, 'Close a proposal without integrating it')
             [CompletionResult]::new('streams', 'streams', [CompletionResultType]::ParameterValue, 'List streams')
@@ -2276,6 +2277,117 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
             break
         }
+        'ag;remote;workspace' {
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('list', 'list', [CompletionResultType]::ParameterValue, 'List server-side workspaces')
+            [CompletionResult]::new('show', 'show', [CompletionResultType]::ParameterValue, 'Show a server-side workspace')
+            [CompletionResult]::new('create', 'create', [CompletionResultType]::ParameterValue, 'Create an isolated workspace, optionally at an existing revision')
+            [CompletionResult]::new('sync', 'sync', [CompletionResultType]::ParameterValue, 'Merge the stream into a workspace; conflicts leave it unchanged')
+            [CompletionResult]::new('delete', 'delete', [CompletionResultType]::ParameterValue, 'Delete the named server-side workspace')
+            break
+        }
+        'ag;remote;workspace;list' {
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;workspace;show' {
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;workspace;create' {
+            [CompletionResult]::new('--stream', '--stream', [CompletionResultType]::ParameterName, 'Stream to follow')
+            [CompletionResult]::new('--from', '--from', [CompletionResultType]::ParameterName, 'Starting revision instead of the stream head')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;workspace;sync' {
+            [CompletionResult]::new('--resolutions', '--resolutions', [CompletionResultType]::ParameterName, 'Explicit FileChange JSON array; content is base64, or use an existing blob_id')
+            [CompletionResult]::new('--expected-stream-head', '--expected-stream-head', [CompletionResultType]::ParameterName, 'Exact nonempty stream head inspected in the preceding sync result')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;workspace;delete' {
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
         'ag;remote;integrate' {
             [CompletionResult]::new('--fencing-token', '--fencing-token', [CompletionResultType]::ParameterName, 'Fencing tokens of exclusive leases the author holds')
             [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
diff --git a/docs/reference/completions/ag.bash b/docs/reference/completions/ag.bash
index 49a23afb..dfd49796 100644
--- a/docs/reference/completions/ag.bash
+++ b/docs/reference/completions/ag.bash
@@ -370,6 +370,9 @@ _ag() {
             ag__subcmd__remote,whoami)
                 cmd="ag__subcmd__remote__subcmd__whoami"
                 ;;
+            ag__subcmd__remote,workspace)
+                cmd="ag__subcmd__remote__subcmd__workspace"
+                ;;
             ag__subcmd__remote__subcmd__discussion,list)
                 cmd="ag__subcmd__remote__subcmd__discussion__subcmd__list"
                 ;;
@@ -394,6 +397,21 @@ _ag() {
             ag__subcmd__remote__subcmd__review__subcmd__draft,save)
                 cmd="ag__subcmd__remote__subcmd__review__subcmd__draft__subcmd__save"
                 ;;
+            ag__subcmd__remote__subcmd__workspace,create)
+                cmd="ag__subcmd__remote__subcmd__workspace__subcmd__create"
+                ;;
+            ag__subcmd__remote__subcmd__workspace,delete)
+                cmd="ag__subcmd__remote__subcmd__workspace__subcmd__delete"
+                ;;
+            ag__subcmd__remote__subcmd__workspace,list)
+                cmd="ag__subcmd__remote__subcmd__workspace__subcmd__list"
+                ;;
+            ag__subcmd__remote__subcmd__workspace,show)
+                cmd="ag__subcmd__remote__subcmd__workspace__subcmd__show"
+                ;;
+            ag__subcmd__remote__subcmd__workspace,sync)
+                cmd="ag__subcmd__remote__subcmd__workspace__subcmd__sync"
+                ;;
             ag__subcmd__stream,create)
                 cmd="ag__subcmd__stream__subcmd__create"
                 ;;
@@ -3479,7 +3497,7 @@ _ag() {
             return 0
             ;;
         ag__subcmd__remote)
-            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat"
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -4628,6 +4646,226 @@ _ag() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        ag__subcmd__remote__subcmd__workspace)
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version list show create sync delete"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__workspace__subcmd__create)
+            opts="-C -q -v -h -V --stream --from --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --stream)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --from)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__workspace__subcmd__delete)
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__workspace__subcmd__list)
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__workspace__subcmd__show)
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__workspace__subcmd__sync)
+            opts="-C -q -v -h -V --resolutions --expected-stream-head --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --resolutions)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --expected-stream-head)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         ag__subcmd__show)
             opts="-C -q -v -h -V --copies --repo --as --json --color --quiet --verbose --help --version"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
diff --git a/docs/reference/completions/ag.elv b/docs/reference/completions/ag.elv
index c390478d..949c156c 100644
--- a/docs/reference/completions/ag.elv
+++ b/docs/reference/completions/ag.elv
@@ -1782,6 +1782,7 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand review-draft 'Save or restore your private account review notes without submitting them'
             cand review 'Review a proposal''s current head'
             cand discussion 'Read and participate in revision-bound line discussions'
+            cand workspace 'Inspect and explicitly sync server-side workspaces without a checkout'
             cand integrate 'Integrate a proposal into its stream'
             cand close 'Close a proposal without integrating it'
             cand streams 'List streams'
@@ -2154,6 +2155,111 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand -V 'Print version'
             cand --version 'Print version'
         }
+        &'ag;remote;workspace'= {
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+            cand list 'List server-side workspaces'
+            cand show 'Show a server-side workspace'
+            cand create 'Create an isolated workspace, optionally at an existing revision'
+            cand sync 'Merge the stream into a workspace; conflicts leave it unchanged'
+            cand delete 'Delete the named server-side workspace'
+        }
+        &'ag;remote;workspace;list'= {
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;workspace;show'= {
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;workspace;create'= {
+            cand --stream 'Stream to follow'
+            cand --from 'Starting revision instead of the stream head'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;workspace;sync'= {
+            cand --resolutions 'Explicit FileChange JSON array; content is base64, or use an existing blob_id'
+            cand --expected-stream-head 'Exact nonempty stream head inspected in the preceding sync result'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;workspace;delete'= {
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
         &'ag;remote;integrate'= {
             cand --fencing-token 'Fencing tokens of exclusive leases the author holds'
             cand --remote 'Remote to use (default: origin)'
diff --git a/docs/reference/completions/ag.fish b/docs/reference/completions/ag.fish
index c19c7383..28446849 100644
--- a/docs/reference/completions/ag.fish
+++ b/docs/reference/completions/ag.fish
@@ -1212,37 +1212,38 @@ complete -c ag -n "__fish_ag_using_subcommand push" -s q -l quiet -d 'Print only
 complete -c ag -n "__fish_ag_using_subcommand push" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand push" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand push" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
-always\t'Always colour'
-never\t'Never colour'"
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "review-draft" -d 'Save or restore your private account review notes without submitting them'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review-draft" -d 'Save or restore your private account review notes without submitting them'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "workspace" -d 'Inspect and explicitly sync server-side workspaces without a checkout'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l token-env -d 'Environment variable holding the credential' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l ca-file -d 'Extra CA certificate (PEM) to trust' -r -F
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l remote -d 'Remote to use (default: origin)' -r
@@ -1397,6 +1398,22 @@ complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from discussion" -f -a "start" -d 'Start a thread on the exact revision and line you inspected'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from discussion" -f -a "reply" -d 'Reply to an open line discussion'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from discussion" -f -a "resolve" -d 'Resolve or reopen a thread only at the version you read'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -f -a "list" -d 'List server-side workspaces'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -f -a "show" -d 'Show a server-side workspace'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -f -a "create" -d 'Create an isolated workspace, optionally at an existing revision'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -f -a "sync" -d 'Merge the stream into a workspace; conflicts leave it unchanged'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from workspace" -f -a "delete" -d 'Delete the named server-side workspace'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from integrate" -l fencing-token -d 'Fencing tokens of exclusive leases the author holds' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from integrate" -l remote -d 'Remote to use (default: origin)' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from integrate" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
diff --git a/docs/reference/man/ag-remote-workspace-create.1 b/docs/reference/man/ag-remote-workspace-create.1
new file mode 100644
index 00000000..c731ac9b
--- /dev/null
+++ b/docs/reference/man/ag-remote-workspace-create.1
@@ -0,0 +1,48 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-workspace-create 1  "create 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-workspace\-create \- Create an isolated workspace, optionally at an existing revision
+.SH SYNOPSIS
+\fBag remote workspace create\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-stream\fR] [\fB\-\-as\fR] [\fB\-\-from\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fINAME\fR>
+.SH DESCRIPTION
+Create an isolated workspace, optionally at an existing revision
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-stream\fR \fI<STREAM>\fR [default: main]
+Stream to follow
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-from\fR \fI<REVISION>\fR
+Starting revision instead of the stream head
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fINAME\fR>
+New workspace name
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-workspace-delete.1 b/docs/reference/man/ag-remote-workspace-delete.1
new file mode 100644
index 00000000..323bee46
--- /dev/null
+++ b/docs/reference/man/ag-remote-workspace-delete.1
@@ -0,0 +1,42 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-workspace-delete 1  "delete 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-workspace\-delete \- Delete the named server\-side workspace
+.SH SYNOPSIS
+\fBag remote workspace delete\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fINAME\fR>
+.SH DESCRIPTION
+Delete the named server\-side workspace
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fINAME\fR>
+Server\-side workspace name
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-workspace-list.1 b/docs/reference/man/ag-remote-workspace-list.1
new file mode 100644
index 00000000..71baedd2
--- /dev/null
+++ b/docs/reference/man/ag-remote-workspace-list.1
@@ -0,0 +1,39 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-workspace-list 1  "list 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-workspace\-list \- List server\-side workspaces
+.SH SYNOPSIS
+\fBag remote workspace list\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR]
+.SH DESCRIPTION
+List server\-side workspaces
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-workspace-show.1 b/docs/reference/man/ag-remote-workspace-show.1
new file mode 100644
index 00000000..4be8b291
--- /dev/null
+++ b/docs/reference/man/ag-remote-workspace-show.1
@@ -0,0 +1,42 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-workspace-show 1  "show 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-workspace\-show \- Show a server\-side workspace
+.SH SYNOPSIS
+\fBag remote workspace show\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fINAME\fR>
+.SH DESCRIPTION
+Show a server\-side workspace
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fINAME\fR>
+Server\-side workspace name
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-workspace-sync.1 b/docs/reference/man/ag-remote-workspace-sync.1
new file mode 100644
index 00000000..04201c0c
--- /dev/null
+++ b/docs/reference/man/ag-remote-workspace-sync.1
@@ -0,0 +1,48 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-workspace-sync 1  "sync 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-workspace\-sync \- Merge the stream into a workspace; conflicts leave it unchanged
+.SH SYNOPSIS
+\fBag remote workspace sync\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-resolutions\fR] [\fB\-\-as\fR] [\fB\-\-expected\-stream\-head\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fINAME\fR>
+.SH DESCRIPTION
+Merge the stream into a workspace; conflicts leave it unchanged
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-resolutions\fR \fI<PATH>\fR
+Explicit FileChange JSON array; content is base64, or use an existing blob_id
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-expected\-stream\-head\fR \fI<CHANGESET>\fR
+Exact nonempty stream head inspected in the preceding sync result
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fINAME\fR>
+Server\-side workspace name
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-workspace.1 b/docs/reference/man/ag-remote-workspace.1
new file mode 100644
index 00000000..7972373a
--- /dev/null
+++ b/docs/reference/man/ag-remote-workspace.1
@@ -0,0 +1,55 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-workspace 1  "workspace 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-workspace \- Inspect and explicitly sync server\-side workspaces without a checkout
+.SH SYNOPSIS
+\fBag remote workspace\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fIsubcommands\fR>
+.SH DESCRIPTION
+Inspect and explicitly sync server\-side workspaces without a checkout
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH SUBCOMMANDS
+.TP
+ag\-remote\-workspace\-list(1)
+List server\-side workspaces
+.TP
+ag\-remote\-workspace\-show(1)
+Show a server\-side workspace
+.TP
+ag\-remote\-workspace\-create(1)
+Create an isolated workspace, optionally at an existing revision
+.TP
+ag\-remote\-workspace\-sync(1)
+Merge the stream into a workspace; conflicts leave it unchanged
+.TP
+ag\-remote\-workspace\-delete(1)
+Delete the named server\-side workspace
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote.1 b/docs/reference/man/ag-remote.1
index d8a96077..1588df33 100644
--- a/docs/reference/man/ag-remote.1
+++ b/docs/reference/man/ag-remote.1
@@ -73,6 +73,9 @@ Review a proposal\*(Aqs current head
 ag\-remote\-discussion(1)
 Read and participate in revision\-bound line discussions
 .TP
+ag\-remote\-workspace(1)
+Inspect and explicitly sync server\-side workspaces without a checkout
+.TP
 ag\-remote\-integrate(1)
 Integrate a proposal into its stream
 .TP

From c33bc9e242e2f917c932f54ef37e0327613744a7 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:25:54 +0000
Subject: [PATCH 21/41] fix(ci): isolate native PowerShell installer
 environment

---
 .github/workflows/windows.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 93f23ad8..4d706f59 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -74,9 +74,13 @@ jobs:
       - name: Windows archive and installer regression tests
         run: python scripts/test_windows_release.py
       - name: Installer tests on Windows PowerShell 5.1
-        shell: pwsh
+        # Start Python from Windows PowerShell too: inheriting pwsh's PSModulePath
+        # prevents the nested 5.1 process from loading its own utility module.
+        shell: powershell
         run: |
           $env:AG_TEST_PWSH = (Get-Command powershell.exe).Source
+          & $env:AG_TEST_PWSH -NoProfile -Command '$PSVersionTable; Get-Command Get-FileHash -ErrorAction Stop | Format-List Name, Source'
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           python scripts/test_windows_release.py
       - name: Package, install and run the native Windows client
         shell: pwsh

From 36f99cdf079728f4c624d01e8ba24dac4f376061 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:31:20 +0000
Subject: [PATCH 22/41] feat(api): store private versioned proposal comment
 drafts

---
 crates/ag-integrate/src/comment_drafts.rs     |  84 +++++
 crates/ag-integrate/src/draft_version.rs      |  33 ++
 crates/ag-integrate/src/lib.rs                |   3 +
 crates/ag-integrate/src/review_drafts.rs      |  15 +-
 crates/ag-integrate/tests/comment_drafts.rs   | 164 ++++++++++
 crates/ag-protocol/proto/agwp/v1/agwp.proto   |  29 ++
 crates/ag-protocol/src/lib.rs                 |   4 +
 crates/ag-server/src/api/comment_drafts.rs    |  74 +++++
 crates/ag-server/src/api/mod.rs               |   1 +
 crates/ag-server/src/grpc.rs                  |  18 ++
 crates/ag-server/src/http.rs                  |  49 ++-
 crates/ag-server/tests/comment_drafts.rs      | 126 ++++++++
 .../postgres/0011_comment_drafts.sql          |  10 +
 .../migrations/sqlite/0011_comment_drafts.sql |  10 +
 crates/ag-storage/src/meta/comment_drafts.rs  |  52 ++++
 crates/ag-storage/src/meta/migrate.rs         |  12 +-
 crates/ag-storage/src/meta/mod.rs             |   2 +
 crates/ag-storage/src/meta/tests.rs           |  53 ++++
 docs/adr/0042-private-comment-drafts.md       |  30 ++
 docs/adr/README.md                            |   2 +
 docs/protocol/openapi.json                    | 291 +++++++++++++++++-
 migrations/postgres/0011_comment_drafts.sql   |  10 +
 migrations/sqlite/0011_comment_drafts.sql     |  10 +
 proto/agwp/v1/agwp.proto                      |  29 ++
 24 files changed, 1094 insertions(+), 17 deletions(-)
 create mode 100644 crates/ag-integrate/src/comment_drafts.rs
 create mode 100644 crates/ag-integrate/src/draft_version.rs
 create mode 100644 crates/ag-integrate/tests/comment_drafts.rs
 create mode 100644 crates/ag-server/src/api/comment_drafts.rs
 create mode 100644 crates/ag-server/tests/comment_drafts.rs
 create mode 100644 crates/ag-storage/migrations/postgres/0011_comment_drafts.sql
 create mode 100644 crates/ag-storage/migrations/sqlite/0011_comment_drafts.sql
 create mode 100644 crates/ag-storage/src/meta/comment_drafts.rs
 create mode 100644 docs/adr/0042-private-comment-drafts.md
 create mode 100644 migrations/postgres/0011_comment_drafts.sql
 create mode 100644 migrations/sqlite/0011_comment_drafts.sql

diff --git a/crates/ag-integrate/src/comment_drafts.rs b/crates/ag-integrate/src/comment_drafts.rs
new file mode 100644
index 00000000..304703f4
--- /dev/null
+++ b/crates/ag-integrate/src/comment_drafts.rs
@@ -0,0 +1,84 @@
+//! Unsubmitted discussion notes. These neither publish a review nor retain history objects.
+use crate::draft_version::{next_version, require_version};
+use crate::{Error, Repository, Result};
+use ag_storage::meta::{CommentDraftRow, Tx};
+use ag_types::{ChangesetId, Identity};
+
+/// Maximum UTF-8 bytes in one private comment draft.
+pub const MAX_COMMENT_DRAFT_BYTES: usize = 16 * 1024;
+
+/// A complete draft together with the version its caller inspected.
+#[derive(Clone, Debug)]
+pub struct CommentDraftInput<'a> {
+    /// Revision inspected by the commenter; may be an earlier proposal head.
+    pub head: &'a ChangesetId,
+    /// Private, unsubmitted notes.
+    pub body: &'a str,
+    /// Zero means the caller observed no persisted draft.
+    pub expected_version: u64,
+}
+
+impl Repository {
+    /// Reads the exact actor's private notes, including a cleared draft's version.
+    pub fn comment_draft(&self, proposal: &str, owner: &Identity) -> Result<Option<CommentDraftRow>> {
+        let proposal = self.find_proposal(proposal)?;
+        Ok(self.meta.read(|tx| tx.comment_draft(&proposal.id, owner.as_str()))?)
+    }
+
+    /// Saves private notes atomically; an identical retry keeps the existing version.
+    pub fn save_comment_draft(
+        &self,
+        proposal: &str,
+        owner: &Identity,
+        input: CommentDraftInput<'_>,
+    ) -> Result<CommentDraftRow> {
+        validate_content(&input)?;
+        let proposal = self.find_proposal(proposal)?.id;
+        self.meta.write_with_error(|tx| save_in_tx(tx, &proposal, owner, &input))
+    }
+
+    /// Clears only the inspected private draft, retaining its version to reject late device writes.
+    pub fn clear_comment_draft(
+        &self,
+        proposal: &str,
+        owner: &Identity,
+        expected_version: u64,
+    ) -> Result<Option<CommentDraftRow>> {
+        let proposal = self.find_proposal(proposal)?.id;
+        self.meta.write_with_error(|tx| {
+            let Some(current) = tx.comment_draft(&proposal, owner.as_str())? else {
+                return Ok(None);
+            };
+            if current.head.is_none() {
+                return Ok(Some(current));
+            }
+            require_version(current.version, expected_version)?;
+            Ok(Some(tx.replace_comment_draft(&proposal, owner.as_str(), None, "", next_version(current.version)?)?))
+        })
+    }
+}
+
+fn validate_content(input: &CommentDraftInput<'_>) -> Result<()> {
+    if input.body.contains('\0') {
+        return Err(Error::Invalid("comment draft contains NUL".into()));
+    }
+    if input.body.len() > MAX_COMMENT_DRAFT_BYTES {
+        return Err(Error::Invalid("comment draft exceeds 16 KiB".into()));
+    }
+    Ok(())
+}
+
+fn same_content(row: &CommentDraftRow, input: &CommentDraftInput<'_>) -> bool {
+    row.head.as_ref() == Some(input.head) && row.body == input.body
+}
+
+fn save_in_tx(tx: &Tx<'_>, proposal: &str, owner: &Identity, input: &CommentDraftInput<'_>) -> Result<CommentDraftRow> {
+    tx.proposal(proposal)?.ok_or_else(|| Error::NotFound(format!("proposal {proposal}")))?;
+    let current = tx.comment_draft(proposal, owner.as_str())?;
+    if let Some(row) = current.as_ref().filter(|row| same_content(row, input)) {
+        return Ok(row.clone());
+    }
+    let version = current.as_ref().map_or(0, |row| row.version);
+    require_version(version, input.expected_version)?;
+    Ok(tx.replace_comment_draft(proposal, owner.as_str(), Some(input.head), input.body, next_version(version)?)?)
+}
diff --git a/crates/ag-integrate/src/draft_version.rs b/crates/ag-integrate/src/draft_version.rs
new file mode 100644
index 00000000..d8346b13
--- /dev/null
+++ b/crates/ag-integrate/src/draft_version.rs
@@ -0,0 +1,33 @@
+//! Shared optimistic version contract for independent private draft slots.
+use crate::{Error, Result};
+
+pub(crate) fn next_version(current: u64) -> Result<u64> {
+    current
+        .checked_add(1)
+        .filter(|value| *value <= i64::MAX as u64)
+        .ok_or_else(|| Error::Invalid("private draft version exhausted".into()))
+}
+
+pub(crate) fn require_version(current: u64, expected: u64) -> Result<()> {
+    if current != expected {
+        return Err(Error::Conflict(
+            "private draft changed on another device; keep your text and inspect the saved draft".into(),
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn versions_fit_the_database_and_never_wrap() {
+        assert_eq!(next_version(0).unwrap(), 1);
+        assert_eq!(next_version(i64::MAX as u64 - 1).unwrap(), i64::MAX as u64);
+        assert!(next_version(i64::MAX as u64).is_err());
+        assert!(next_version(u64::MAX).is_err());
+        assert!(require_version(2, 2).is_ok());
+        assert!(require_version(2, 1).is_err());
+    }
+}
diff --git a/crates/ag-integrate/src/lib.rs b/crates/ag-integrate/src/lib.rs
index 21e0e5b1..1e6ba6f5 100644
--- a/crates/ag-integrate/src/lib.rs
+++ b/crates/ag-integrate/src/lib.rs
@@ -22,7 +22,9 @@ mod admin;
 mod api_support;
 mod backup;
 mod blame;
+mod comment_drafts;
 mod derive;
+mod draft_version;
 mod directory;
 mod error;
 pub mod explain;
@@ -47,6 +49,7 @@ mod workspace;
 pub use api_support::{FileDiff, MAX_NEGOTIATED};
 pub use backup::BackupReport;
 pub use blame::{Blame, BlameLine, BlameOptions, DEFAULT_BLAME_COMMITS, MAX_BLAME_FILE_SIZE, MAX_BLAME_LINES};
+pub use comment_drafts::{CommentDraftInput, MAX_COMMENT_DRAFT_BYTES};
 pub use derive::{DeriveReport, DeriveStatus, KEYFRAME_INTERVAL};
 pub use directory::publish_new_directory;
 pub use error::Error;
diff --git a/crates/ag-integrate/src/review_drafts.rs b/crates/ag-integrate/src/review_drafts.rs
index f593c3a2..38604ca6 100644
--- a/crates/ag-integrate/src/review_drafts.rs
+++ b/crates/ag-integrate/src/review_drafts.rs
@@ -1,4 +1,5 @@
 //! Unsubmitted review notes. These neither publish a review nor retain history objects.
+use crate::draft_version::{next_version, require_version};
 use crate::{Error, Repository, Result};
 use ag_storage::meta::{ReviewDraftRow, Tx};
 use ag_types::{ChangesetId, Identity};
@@ -18,20 +19,6 @@ pub struct ReviewDraftInput<'a> {
     /// Zero means the caller observed no persisted draft.
     pub expected_version: u64,
 }
-fn next_version(current: u64) -> Result<u64> {
-    current
-        .checked_add(1)
-        .filter(|value| *value <= i64::MAX as u64)
-        .ok_or_else(|| Error::Invalid("review draft version exhausted".into()))
-}
-fn require_version(current: u64, expected: u64) -> Result<()> {
-    if current != expected {
-        return Err(Error::Conflict(
-            "review draft changed on another device; keep your text and inspect the saved draft".into(),
-        ));
-    }
-    Ok(())
-}
 
 impl Repository {
     /// Reads the exact actor's private notes, including a cleared draft's version.
diff --git a/crates/ag-integrate/tests/comment_drafts.rs b/crates/ag-integrate/tests/comment_drafts.rs
new file mode 100644
index 00000000..7743a3a8
--- /dev/null
+++ b/crates/ag-integrate/tests/comment_drafts.rs
@@ -0,0 +1,164 @@
+//! Private discussion drafts are independent of review decisions and public comments.
+mod common;
+use ag_integrate::{CommentDraftInput, ReviewDraftInput};
+use common::*;
+use std::sync::{Arc, Barrier};
+
+#[test]
+fn comment_and_review_drafts_are_separate_private_slots() {
+    let f = fx();
+    let owner = id("user:alice");
+    let other = id("user:bob");
+    let head = f.snap(None, &[("file", "content")], owner.as_str());
+    let proposal = f.propose(head, "change", owner.as_str());
+    f.repo
+        .save_review_draft(
+            &proposal,
+            &owner,
+            ReviewDraftInput { head: &head, decision: "approve", body: "review notes", expected_version: 0 },
+        )
+        .unwrap();
+    let comment = f
+        .repo
+        .save_comment_draft(
+            &proposal,
+            &owner,
+            CommentDraftInput { head: &head, body: "private discussion", expected_version: 0 },
+        )
+        .unwrap();
+    assert_eq!(comment.version, 1);
+    assert!(f.repo.comment_draft(&proposal, &other).unwrap().is_none());
+    assert_eq!(f.repo.review_draft(&proposal, &owner).unwrap().unwrap().body, "review notes");
+    f.repo.clear_review_draft(&proposal, &owner, 1).unwrap();
+    assert_eq!(f.repo.comment_draft(&proposal, &owner).unwrap().unwrap().body, "private discussion");
+    f.repo
+        .save_review_draft(
+            &proposal,
+            &owner,
+            ReviewDraftInput { head: &head, decision: "comment", body: "independent", expected_version: 2 },
+        )
+        .unwrap();
+    f.repo.clear_comment_draft(&proposal, &owner, 1).unwrap();
+    assert_eq!(f.repo.review_draft(&proposal, &owner).unwrap().unwrap().body, "independent");
+    assert!(f.repo.meta().read(|tx| tx.reviews(&proposal)).unwrap().is_empty());
+    let audit = f.repo.meta().read(|tx| tx.audit_list(Some(&proposal), 100)).unwrap();
+    assert!(
+        !audit.iter().any(|row| row.details.contains("private discussion") || row.details.contains("review notes"))
+    );
+}
+
+#[test]
+fn versions_tombstones_and_identical_retries_keep_newer_notes() {
+    let f = fx();
+    let owner = id("user:alice");
+    let head = f.snap(None, &[("file", "content")], owner.as_str());
+    let proposal = f.propose(head, "change", owner.as_str());
+    assert!(f.repo.clear_comment_draft(&proposal, &owner, 0).unwrap().is_none());
+    let input = CommentDraftInput { head: &head, body: "first", expected_version: 0 };
+    assert_eq!(f.repo.save_comment_draft(&proposal, &owner, input.clone()).unwrap().version, 1);
+    assert_eq!(f.repo.save_comment_draft(&proposal, &owner, input).unwrap().version, 1);
+    assert!(
+        f.repo
+            .save_comment_draft(
+                &proposal,
+                &owner,
+                CommentDraftInput { head: &head, body: "stale", expected_version: 0 }
+            )
+            .is_err()
+    );
+    let another_head = f.snap(Some(head), &[("file", "updated")], owner.as_str());
+    assert!(
+        f.repo
+            .save_comment_draft(
+                &proposal,
+                &owner,
+                CommentDraftInput { head: &another_head, body: "first", expected_version: 0 }
+            )
+            .is_err()
+    );
+    let cleared = f.repo.clear_comment_draft(&proposal, &owner, 1).unwrap().unwrap();
+    assert!(cleared.head.is_none() && cleared.body.is_empty());
+    assert_eq!(cleared.version, 2);
+    assert_eq!(f.repo.clear_comment_draft(&proposal, &owner, 1).unwrap().unwrap().version, 2);
+    assert!(
+        f.repo
+            .save_comment_draft(
+                &proposal,
+                &owner,
+                CommentDraftInput { head: &head, body: "late device", expected_version: 1 }
+            )
+            .is_err()
+    );
+    assert_eq!(
+        f.repo
+            .save_comment_draft(
+                &proposal,
+                &owner,
+                CommentDraftInput { head: &head, body: "newer", expected_version: 2 }
+            )
+            .unwrap()
+            .version,
+        3
+    );
+    assert!(f.repo.clear_comment_draft(&proposal, &owner, 1).is_err());
+    assert_eq!(f.repo.comment_draft(&proposal, &owner).unwrap().unwrap().body, "newer");
+}
+
+#[test]
+fn closed_proposals_keep_editable_drafts_and_enforce_utf8_byte_limit() {
+    let f = fx();
+    let owner = id("user:alice");
+    let first_run = id("agent:worker#first");
+    let second_run = id("agent:worker#second");
+    let head = f.snap(None, &[("file", "content")], owner.as_str());
+    let proposal = f.propose(head, "change", owner.as_str());
+    f.repo.close_proposal(&proposal, &owner).unwrap();
+    let body = "é".repeat(8 * 1024);
+    let input = CommentDraftInput { head: &head, body: &body, expected_version: 0 };
+    assert_eq!(f.repo.save_comment_draft(&proposal, &first_run, input).unwrap().version, 1);
+    assert!(f.repo.comment_draft(&proposal, &second_run).unwrap().is_none());
+    let too_big = format!("{body}x");
+    assert!(
+        f.repo
+            .save_comment_draft(
+                &proposal,
+                &first_run,
+                CommentDraftInput { head: &head, body: &too_big, expected_version: 1 }
+            )
+            .is_err()
+    );
+    assert!(
+        f.repo
+            .save_comment_draft(
+                &proposal,
+                &first_run,
+                CommentDraftInput { head: &head, body: "bad\0note", expected_version: 1 }
+            )
+            .is_err()
+    );
+    assert_eq!(f.repo.comment_draft(&proposal, &first_run).unwrap().unwrap().body, body);
+    assert_eq!(f.repo.clear_comment_draft(&proposal, &first_run, 1).unwrap().unwrap().version, 2);
+}
+
+#[test]
+fn simultaneous_devices_cannot_replace_the_same_comment_version() {
+    let f = fx();
+    let owner = id("user:alice");
+    let head = f.snap(None, &[("file", "content")], owner.as_str());
+    let proposal = f.propose(head, "change", owner.as_str());
+    let repo = Arc::new(f.repo.with_object_store(|store| store));
+    let start = Arc::new(Barrier::new(2));
+    let workers = ["first", "second"]
+        .into_iter()
+        .map(|body| {
+            let (repo, start, owner, proposal) = (repo.clone(), start.clone(), owner.clone(), proposal.clone());
+            std::thread::spawn(move || {
+                start.wait();
+                repo.save_comment_draft(&proposal, &owner, CommentDraftInput { head: &head, body, expected_version: 0 })
+            })
+        })
+        .collect::<Vec<_>>();
+    let results = workers.into_iter().map(|worker| worker.join().unwrap()).collect::<Vec<_>>();
+    assert_eq!(results.iter().filter(|result| result.is_ok()).count(), 1);
+    assert_eq!(repo.comment_draft(&proposal, &owner).unwrap().unwrap().version, 1);
+}
diff --git a/crates/ag-protocol/proto/agwp/v1/agwp.proto b/crates/ag-protocol/proto/agwp/v1/agwp.proto
index 299a63f6..5b364d32 100644
--- a/crates/ag-protocol/proto/agwp/v1/agwp.proto
+++ b/crates/ag-protocol/proto/agwp/v1/agwp.proto
@@ -794,6 +794,32 @@ message ClearReviewDraftRequest {
   uint64 expected_version = 3;
 }
 
+// Private, unsubmitted general discussion notes for the current acting identity.
+message CommentDraft {
+  bool present = 1;
+  uint64 version = 2;
+  string head = 3;
+  string body = 4;
+  int64 updated_at_ms = 5;
+}
+message GetCommentDraftRequest {
+  string repo = 1;
+  string id = 2;
+}
+message SaveCommentDraftRequest {
+  string repo = 1;
+  string id = 2;
+  string head = 3;
+  string body = 4;
+  // Zero means no prior draft; all saves compare this version atomically.
+  uint64 expected_version = 5;
+}
+message ClearCommentDraftRequest {
+  string repo = 1;
+  string id = 2;
+  uint64 expected_version = 3;
+}
+
 // Replaces review routing after comparing the complete inspected set.
 message SetRequestedReviewersRequest {
   string repo = 1;
@@ -1877,6 +1903,9 @@ service ProposalService {
   rpc GetDraft(GetReviewDraftRequest) returns (ReviewDraft);
   rpc SaveDraft(SaveReviewDraftRequest) returns (ReviewDraft);
   rpc ClearDraft(ClearReviewDraftRequest) returns (ReviewDraft);
+  rpc GetCommentDraft(GetCommentDraftRequest) returns (CommentDraft);
+  rpc SaveCommentDraft(SaveCommentDraftRequest) returns (CommentDraft);
+  rpc ClearCommentDraft(ClearCommentDraftRequest) returns (CommentDraft);
   rpc SetReviewers(SetRequestedReviewersRequest) returns (RequestedReviewers);
   rpc Review(ReviewProposalRequest) returns (Review);
   rpc Comment(CommentProposalRequest) returns (Review);
diff --git a/crates/ag-protocol/src/lib.rs b/crates/ag-protocol/src/lib.rs
index c392a469..7f5a6288 100644
--- a/crates/ag-protocol/src/lib.rs
+++ b/crates/ag-protocol/src/lib.rs
@@ -109,6 +109,9 @@ pub mod features {
     /// Private versioned review drafts for the current acting identity.
     pub const PROPOSALS_REVIEW_DRAFTS: &str = "proposals.review_drafts";
 
+    /// Private versioned general discussion drafts for the current acting identity.
+    pub const PROPOSALS_COMMENT_DRAFTS: &str = "proposals.comment_drafts";
+
     /// Every feature this implementation knows.
     pub const ALL: &[&str] = &[
         EVENTS_REPLAY,
@@ -128,6 +131,7 @@ pub mod features {
         PROPOSALS_UPDATE_HEAD,
         PROPOSALS_REVIEW_REQUESTS,
         PROPOSALS_REVIEW_DRAFTS,
+        PROPOSALS_COMMENT_DRAFTS,
         POLICY_RESOLVED_THREADS,
         TREE_SEARCH,
         ISSUES,
diff --git a/crates/ag-server/src/api/comment_drafts.rs b/crates/ag-server/src/api/comment_drafts.rs
new file mode 100644
index 00000000..102440a6
--- /dev/null
+++ b/crates/ag-server/src/api/comment_drafts.rs
@@ -0,0 +1,74 @@
+//! Owner-private draft operations intentionally do not notify shared repository events.
+use super::{parse_id, require};
+use crate::app::{App, Call};
+use crate::authz::Cap;
+use crate::error::ApiResult;
+use ag_integrate::CommentDraftInput;
+use ag_protocol::v1;
+use ag_storage::meta::CommentDraftRow;
+use ag_types::ChangesetId;
+
+fn draft(row: Option<&CommentDraftRow>) -> v1::CommentDraft {
+    let Some(row) = row else {
+        return v1::CommentDraft::default();
+    };
+    v1::CommentDraft {
+        present: row.head.is_some(),
+        version: row.version,
+        head: row.head.map(|head| head.to_string()).unwrap_or_default(),
+        body: row.body.clone(),
+        updated_at_ms: row.updated_at.as_millis(),
+    }
+}
+
+impl App {
+    /// Reads only the acting identity's private draft.
+    pub async fn get_comment_draft(&self, call: &Call, req: v1::GetCommentDraftRequest) -> ApiResult<v1::CommentDraft> {
+        self.with_proposal(
+            call,
+            require(&req.repo, "repo")?,
+            Cap::ProposalComment,
+            req.id.clone(),
+            move |repo, actor| Ok(draft(repo.comment_draft(&req.id, actor)?.as_ref())),
+        )
+        .await
+    }
+    /// Saves private notes with an inspected-version comparison, never a review decision.
+    pub async fn save_comment_draft(
+        &self,
+        call: &Call,
+        req: v1::SaveCommentDraftRequest,
+    ) -> ApiResult<v1::CommentDraft> {
+        let head: ChangesetId = parse_id(require(&req.head, "head")?, "draft head")?;
+        self.with_proposal(
+            call,
+            require(&req.repo, "repo")?,
+            Cap::ProposalComment,
+            req.id.clone(),
+            move |repo, actor| {
+                let row = repo.save_comment_draft(
+                    &req.id,
+                    actor,
+                    CommentDraftInput { head: &head, body: &req.body, expected_version: req.expected_version },
+                )?;
+                Ok(draft(Some(&row)))
+            },
+        )
+        .await
+    }
+    /// Clears only the inspected private draft and retains its version tombstone.
+    pub async fn clear_comment_draft(
+        &self,
+        call: &Call,
+        req: v1::ClearCommentDraftRequest,
+    ) -> ApiResult<v1::CommentDraft> {
+        self.with_proposal(
+            call,
+            require(&req.repo, "repo")?,
+            Cap::ProposalComment,
+            req.id.clone(),
+            move |repo, actor| Ok(draft(repo.clear_comment_draft(&req.id, actor, req.expected_version)?.as_ref())),
+        )
+        .await
+    }
+}
diff --git a/crates/ag-server/src/api/mod.rs b/crates/ag-server/src/api/mod.rs
index 3a188a52..f12dc344 100644
--- a/crates/ag-server/src/api/mod.rs
+++ b/crates/ag-server/src/api/mod.rs
@@ -14,6 +14,7 @@ use crate::error::{ApiError, ApiResult};
 
 mod admin;
 mod agents;
+mod comment_drafts;
 mod convert;
 mod events;
 mod history;
diff --git a/crates/ag-server/src/grpc.rs b/crates/ag-server/src/grpc.rs
index 91464144..61cf60fb 100644
--- a/crates/ag-server/src/grpc.rs
+++ b/crates/ag-server/src/grpc.rs
@@ -392,6 +392,24 @@ impl ProposalService for Grpc {
     ) -> Result<Response<v1::ReviewDraft>, Status> {
         unary!(self, request, "proposal.clear_draft", clear_review_draft)
     }
+    async fn get_comment_draft(
+        &self,
+        request: Request<v1::GetCommentDraftRequest>,
+    ) -> Result<Response<v1::CommentDraft>, Status> {
+        unary!(self, request, "proposal.get_comment_draft", get_comment_draft)
+    }
+    async fn save_comment_draft(
+        &self,
+        request: Request<v1::SaveCommentDraftRequest>,
+    ) -> Result<Response<v1::CommentDraft>, Status> {
+        unary!(self, request, "proposal.save_comment_draft", save_comment_draft)
+    }
+    async fn clear_comment_draft(
+        &self,
+        request: Request<v1::ClearCommentDraftRequest>,
+    ) -> Result<Response<v1::CommentDraft>, Status> {
+        unary!(self, request, "proposal.clear_comment_draft", clear_comment_draft)
+    }
     async fn set_reviewers(
         &self,
         request: Request<v1::SetRequestedReviewersRequest>,
diff --git a/crates/ag-server/src/http.rs b/crates/ag-server/src/http.rs
index 07ff5c0b..1a79190f 100644
--- a/crates/ag-server/src/http.rs
+++ b/crates/ag-server/src/http.rs
@@ -248,7 +248,15 @@ where
     }
     .await;
     let mut response = finish(result, &request_id);
-    if matches!(op, "proposal.get_draft" | "proposal.save_draft" | "proposal.clear_draft") {
+    if matches!(
+        op,
+        "proposal.get_draft"
+            | "proposal.save_draft"
+            | "proposal.clear_draft"
+            | "proposal.get_comment_draft"
+            | "proposal.save_comment_draft"
+            | "proposal.clear_comment_draft"
+    ) {
         response.headers_mut().insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
     }
     response
@@ -995,6 +1003,45 @@ pub fn api_router(app: App) -> (Router, Vec<RouteMeta>) {
         v1::ReviewDraft,
         clear_review_draft
     );
+    route!(
+        r,
+        meta,
+        get,
+        "get",
+        "/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft",
+        "proposal.get_comment_draft",
+        "Proposal",
+        "Read your private comment draft",
+        v1::GetCommentDraftRequest,
+        v1::CommentDraft,
+        get_comment_draft
+    );
+    route!(
+        r,
+        meta,
+        put,
+        "put",
+        "/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft",
+        "proposal.save_comment_draft",
+        "Proposal",
+        "Save your private comment draft",
+        v1::SaveCommentDraftRequest,
+        v1::CommentDraft,
+        save_comment_draft
+    );
+    route!(
+        r,
+        meta,
+        delete,
+        "delete",
+        "/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft",
+        "proposal.clear_comment_draft",
+        "Proposal",
+        "Clear the inspected private comment draft",
+        v1::ClearCommentDraftRequest,
+        v1::CommentDraft,
+        clear_comment_draft
+    );
     route!(
         r,
         meta,
diff --git a/crates/ag-server/tests/comment_drafts.rs b/crates/ag-server/tests/comment_drafts.rs
new file mode 100644
index 00000000..a4dda9b1
--- /dev/null
+++ b/crates/ag-server/tests/comment_drafts.rs
@@ -0,0 +1,126 @@
+//! Account discussion notes are private, versioned and independent of review decisions.
+mod common;
+use ag_protocol::v1::{self, proposal_service_client::ProposalServiceClient};
+use common::*;
+use serde_json::json;
+use tonic::{Code, Request};
+
+fn authorized<T>(token: &str, value: T) -> Request<T> {
+    let mut request = Request::new(value);
+    request.metadata_mut().insert("authorization", format!("Bearer {token}").parse().unwrap());
+    request
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn writers_can_resume_private_comment_drafts_without_posting_reviews() {
+    let server = TestServer::start().await;
+    let admin = server.admin();
+    assert_eq!(admin.post("/v1/repos", json!({"name":"acme/comments"})).await.status, 200);
+    let writer = user_with_role(&server, "user:writer", "acme/comments", "writer").await;
+    let other = user_with_role(&server, "user:other", "acme/comments", "reviewer").await;
+    let reader = user_with_role(&server, "user:reader", "acme/comments", "reader").await;
+    let (head, objects) =
+        Client::new("acme/comments").commit(vec![], "user:admin", "change", &[("file", b"content")], 1_700_000_000_000);
+    upload(&admin, "acme/comments", &objects).await;
+    let proposal = admin
+        .post("/v1/repos/acme/comments/proposals", json!({"stream":"main","head":head.to_string(),"title":"comment"}))
+        .await;
+    let id = proposal.json["id"].as_str().unwrap();
+    let path = format!("/v1/repos/acme/comments/proposals/{id}/comment-draft");
+    let absent = writer.get(&path).await;
+    assert_eq!(absent.status, 200, "{}", absent.json);
+    assert_eq!(absent.json["present"], false);
+    assert_eq!(absent.json["version"], 0);
+    assert_eq!(absent.headers.get("cache-control").map(String::as_str), Some("no-store"));
+    let body = json!({"head":head.to_string(),"body":"Writer's private note","expected_version":0});
+    let saved = writer.call("PUT", &path, Some(body.clone()), &[]).await;
+    assert_eq!(saved.status, 200, "{}", saved.json);
+    assert_eq!(saved.json["version"], 1);
+    assert_eq!(writer.call("PUT", &path, Some(body), &[]).await.json["version"], 1);
+    let mut grpc = ProposalServiceClient::connect(server.base.clone()).await.unwrap();
+    let get = v1::GetCommentDraftRequest { repo: "acme/comments".into(), id: id.into() };
+    assert_eq!(
+        grpc.get_comment_draft(authorized(&writer.token, get.clone())).await.unwrap().into_inner().body,
+        "Writer's private note"
+    );
+    assert!(!grpc.get_comment_draft(authorized(&other.token, get)).await.unwrap().into_inner().present);
+    let stale = v1::SaveCommentDraftRequest {
+        repo: "acme/comments".into(),
+        id: id.into(),
+        head: head.to_string(),
+        body: "stale".into(),
+        expected_version: 0,
+    };
+    assert_eq!(
+        grpc.save_comment_draft(authorized(&writer.token, stale)).await.unwrap_err().code(),
+        Code::FailedPrecondition
+    );
+    let invalid = json!({"head":head.to_string(),"body":"é".repeat(8193),"expected_version":1});
+    assert_eq!(writer.call("PUT", &path, Some(invalid), &[]).await.status, 400);
+    for account in [&other, &admin] {
+        assert_eq!(account.get(&format!("{path}?owner=user:writer")).await.json["present"], false);
+    }
+    let denied = reader.get(&path).await;
+    assert_eq!(denied.status, 403);
+    assert_eq!(denied.headers.get("cache-control").map(String::as_str), Some("no-store"));
+    let narrow = writer
+        .post("/v1/credentials", json!({"ttl_secs":600,"scope":{"repos":["acme/comments"],"streams":["other"]}}))
+        .await;
+    assert_eq!(narrow.status, 200, "{}", narrow.json);
+    assert_eq!(server.client(narrow.json["token"].as_str().unwrap()).get(&path).await.status, 403);
+    assert_eq!(
+        writer
+            .call("PUT", &path, Some(json!({"head":head.to_string(),"body":"stale","expected_version":0})), &[])
+            .await
+            .status,
+        412
+    );
+
+    let review_path = format!("/v1/repos/acme/comments/proposals/{id}/review-draft");
+    assert_eq!(admin.call("PUT", &review_path, Some(json!({"head":head.to_string(),"decision":"approve","body":"independent review","expected_version":0})), &[]).await.status,200);
+    assert_eq!(
+        admin
+            .call(
+                "PUT",
+                &path,
+                Some(json!({"head":head.to_string(),"body":"independent discussion","expected_version":0})),
+                &[]
+            )
+            .await
+            .status,
+        200
+    );
+    assert_eq!(admin.call("DELETE", &format!("{path}?expected_version=1"), None, &[]).await.status, 200);
+    assert_eq!(admin.get(&review_path).await.json["body"], "independent review");
+    assert_eq!(admin.post(&format!("/v1/repos/acme/comments/proposals/{id}/close"), json!({})).await.status, 200);
+    let closed = writer
+        .call(
+            "PUT",
+            &path,
+            Some(json!({"head":head.to_string(),"body":"still private after closure","expected_version":1})),
+            &[],
+        )
+        .await;
+    assert_eq!(closed.status, 200, "{}", closed.json);
+    assert_eq!(closed.json["version"], 2);
+    let cleared = writer.call("DELETE", &format!("{path}?expected_version=2"), None, &[]).await;
+    assert_eq!(cleared.status, 200, "{}", cleared.json);
+    assert_eq!(cleared.json["version"], 3);
+    assert_eq!(cleared.json["present"], false);
+    assert_eq!(cleared.json["body"], "");
+    assert_eq!(writer.call("DELETE", &format!("{path}?expected_version=2"), None, &[]).await.json["version"], 3);
+    assert_eq!(
+        writer
+            .call("PUT", &path, Some(json!({"head":head.to_string(),"body":"late","expected_version":2})), &[])
+            .await
+            .status,
+        412
+    );
+    let clear = v1::ClearCommentDraftRequest { repo: "acme/comments".into(), id: id.into(), expected_version: 2 };
+    assert_eq!(grpc.clear_comment_draft(authorized(&writer.token, clear)).await.unwrap().into_inner().version, 3);
+    let detail = admin.get(&format!("/v1/repos/acme/comments/proposals/{id}")).await;
+    assert!(detail.json["reviews"].as_array().unwrap().is_empty());
+    let audit = admin.get(&format!("/v1/repos/acme/comments/audit?contains={id}")).await;
+    assert!(!audit.json.to_string().contains("Writer's private note"));
+    server.stop().await;
+}
diff --git a/crates/ag-storage/migrations/postgres/0011_comment_drafts.sql b/crates/ag-storage/migrations/postgres/0011_comment_drafts.sql
new file mode 100644
index 00000000..9b69ad81
--- /dev/null
+++ b/crates/ag-storage/migrations/postgres/0011_comment_drafts.sql
@@ -0,0 +1,10 @@
+CREATE TABLE comment_drafts (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    owner TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    head TEXT,
+    body TEXT NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (proposal, owner),
+    CHECK (head IS NOT NULL OR body = '')
+);
diff --git a/crates/ag-storage/migrations/sqlite/0011_comment_drafts.sql b/crates/ag-storage/migrations/sqlite/0011_comment_drafts.sql
new file mode 100644
index 00000000..9b69ad81
--- /dev/null
+++ b/crates/ag-storage/migrations/sqlite/0011_comment_drafts.sql
@@ -0,0 +1,10 @@
+CREATE TABLE comment_drafts (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    owner TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    head TEXT,
+    body TEXT NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (proposal, owner),
+    CHECK (head IS NOT NULL OR body = '')
+);
diff --git a/crates/ag-storage/src/meta/comment_drafts.rs b/crates/ag-storage/src/meta/comment_drafts.rs
new file mode 100644
index 00000000..d37ab355
--- /dev/null
+++ b/crates/ag-storage/src/meta/comment_drafts.rs
@@ -0,0 +1,52 @@
+//! Private discussion notes, isolated by the caller's full identity.
+use super::db::params;
+use super::{MetaError, Tx, parse, ts};
+use ag_types::{ChangesetId, Timestamp};
+use serde::Serialize;
+
+/// A persisted private draft; a null head is a versioned deletion tombstone.
+#[derive(Clone, Debug, Serialize)]
+pub struct CommentDraftRow {
+    /// Monotonic per-owner, per-proposal revision.
+    pub version: u64,
+    /// The revision the commenter inspected, or none after clearing.
+    pub head: Option<ChangesetId>,
+    /// Unsubmitted text; empty on a tombstone.
+    pub body: String,
+    /// Last change time.
+    pub updated_at: Timestamp,
+}
+
+impl Tx<'_> {
+    /// Returns only the draft matching this exact owner and proposal.
+    pub fn comment_draft(&self, proposal: &str, owner: &str) -> Result<Option<CommentDraftRow>, MetaError> {
+        let rows = self.conn.query(
+            "SELECT version, head, body, updated_at FROM comment_drafts WHERE proposal = ?1 AND owner = ?2",
+            &params![proposal, owner],
+        )?;
+        rows.first()
+            .map(|row| {
+                Ok(CommentDraftRow {
+                    version: row.i64(0)? as u64,
+                    head: row.opt_string(1)?.map(|value| parse(&value, "draft head")).transpose()?,
+                    body: row.string(2)?,
+                    updated_at: ts(row.i64(3)?),
+                })
+            })
+            .transpose()
+    }
+
+    /// Writes the state whose version was already compared in this transaction.
+    pub fn replace_comment_draft(
+        &self,
+        proposal: &str,
+        owner: &str,
+        head: Option<&ChangesetId>,
+        body: &str,
+        version: u64,
+    ) -> Result<CommentDraftRow, MetaError> {
+        let version = i64::try_from(version).map_err(|_| MetaError::Invalid("draft version exhausted".into()))?;
+        self.conn.execute("INSERT INTO comment_drafts (proposal, owner, version, head, body, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6) ON CONFLICT (proposal, owner) DO UPDATE SET version = excluded.version, head = excluded.head, body = excluded.body, updated_at = excluded.updated_at", &params![proposal, owner, version, head.map(|id| id.to_hex()), body, self.now().as_millis()])?;
+        self.comment_draft(proposal, owner)?.ok_or_else(|| MetaError::Corrupt("comment draft vanished".into()))
+    }
+}
diff --git a/crates/ag-storage/src/meta/migrate.rs b/crates/ag-storage/src/meta/migrate.rs
index b8007d12..09fcb447 100644
--- a/crates/ag-storage/src/meta/migrate.rs
+++ b/crates/ag-storage/src/meta/migrate.rs
@@ -34,7 +34,7 @@ impl Migration {
 }
 
 /// Schema version understood by this build.
-pub const SCHEMA_VERSION: i64 = 10;
+pub const SCHEMA_VERSION: i64 = 11;
 
 pub(crate) const SQLITE_MIGRATIONS: &[Migration] = &[
     Migration { version: 1, name: "0001_init.sql", sql: include_str!("../../migrations/sqlite/0001_init.sql") },
@@ -75,6 +75,11 @@ pub(crate) const SQLITE_MIGRATIONS: &[Migration] = &[
         name: "0010_review_drafts.sql",
         sql: include_str!("../../migrations/sqlite/0010_review_drafts.sql"),
     },
+    Migration {
+        version: 11,
+        name: "0011_comment_drafts.sql",
+        sql: include_str!("../../migrations/sqlite/0011_comment_drafts.sql"),
+    },
 ];
 
 pub(crate) const POSTGRES_MIGRATIONS: &[Migration] = &[
@@ -116,6 +121,11 @@ pub(crate) const POSTGRES_MIGRATIONS: &[Migration] = &[
         name: "0010_review_drafts.sql",
         sql: include_str!("../../migrations/postgres/0010_review_drafts.sql"),
     },
+    Migration {
+        version: 11,
+        name: "0011_comment_drafts.sql",
+        sql: include_str!("../../migrations/postgres/0011_comment_drafts.sql"),
+    },
 ];
 
 #[cfg(test)]
diff --git a/crates/ag-storage/src/meta/mod.rs b/crates/ag-storage/src/meta/mod.rs
index d1563d73..b4a1978c 100644
--- a/crates/ag-storage/src/meta/mod.rs
+++ b/crates/ag-storage/src/meta/mod.rs
@@ -42,6 +42,7 @@ mod review_threads;
 
 mod agents;
 mod changesets;
+mod comment_drafts;
 mod derived;
 mod intents;
 mod outbox;
@@ -64,6 +65,7 @@ use db::{Conn, SqliteConn, params};
 
 pub use agents::{AgentRow, LeaseRow, ProvenanceRow, QueueRow, RunRow, TaskRow};
 pub use changesets::ChangesetInfo;
+pub use comment_drafts::CommentDraftRow;
 pub use db::{Dialect, Param, Row, Value};
 pub use intents::{IntentRow, IntentState, NewIntent};
 pub use issues::{IssueActivityRow, IssueFilter, IssueRow};
diff --git a/crates/ag-storage/src/meta/tests.rs b/crates/ag-storage/src/meta/tests.rs
index 2ff8ca4c..c411fa70 100644
--- a/crates/ag-storage/src/meta/tests.rs
+++ b/crates/ag-storage/src/meta/tests.rs
@@ -982,3 +982,56 @@ fn schema_nine_private_drafts_migrate_persist_and_clear_without_rewinding_versio
         0
     );
 }
+
+#[test]
+fn schema_ten_upgrade_preserves_review_drafts_and_adds_independent_comment_tombstones() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("meta.db");
+    let backup = dir.path().join("before.db");
+    let head: ChangesetId = "0".repeat(64).parse().unwrap();
+    {
+        let conn = rusqlite::Connection::open(&path).unwrap();
+        for migration in migrate::SQLITE_MIGRATIONS.iter().filter(|m| m.version <= 10) {
+            conn.execute_batch(migration.sql).unwrap();
+        }
+        conn.execute("INSERT INTO meta(key,value) VALUES('schema','10')", []).unwrap();
+        conn.execute("INSERT INTO proposals(id,stream,head,title,description,author,state,created_at,updated_at) VALUES('prop_old','main',?1,'Keep existing','','user:author','closed',1,1)", [head.to_hex()]).unwrap();
+        conn.execute("INSERT INTO review_drafts(proposal,owner,version,head,decision,body,updated_at) VALUES('prop_old','user:alice',7,?1,'comment','Existing private review',1)", [head.to_hex()]).unwrap();
+        conn.execute("INSERT INTO review_drafts(proposal,owner,version,head,decision,body,updated_at) VALUES('prop_old','user:bob',9,NULL,'','',1)", []).unwrap();
+        conn.pragma_update(None, "user_version", 10).unwrap();
+    }
+    std::fs::copy(&path, &backup).unwrap();
+    {
+        let upgraded = Meta::open(&path).unwrap();
+        assert_eq!(
+            upgraded.read(|tx| tx.review_draft("prop_old", "user:alice")).unwrap().unwrap().body,
+            "Existing private review"
+        );
+        assert_eq!(upgraded.read(|tx| tx.review_draft("prop_old", "user:bob")).unwrap().unwrap().version, 9);
+        assert!(upgraded.read(|tx| tx.comment_draft("prop_old", "user:alice")).unwrap().is_none());
+        upgraded
+            .write(|tx| tx.replace_comment_draft("prop_old", "user:alice", Some(&head), "Independent note", 1))
+            .unwrap();
+    }
+    {
+        let reopened = Meta::open(&path).unwrap();
+        assert_eq!(
+            reopened.read(|tx| tx.comment_draft("prop_old", "user:alice")).unwrap().unwrap().body,
+            "Independent note"
+        );
+        reopened.write(|tx| tx.replace_comment_draft("prop_old", "user:alice", None, "", 2)).unwrap();
+        assert_eq!(reopened.read(|tx| tx.review_draft("prop_old", "user:alice")).unwrap().unwrap().version, 7);
+    }
+    let reopened = Meta::open(&path).unwrap();
+    let cleared = reopened.read(|tx| tx.comment_draft("prop_old", "user:alice")).unwrap().unwrap();
+    assert_eq!(cleared.version, 2);
+    assert!(cleared.head.is_none() && cleared.body.is_empty());
+    let untouched = rusqlite::Connection::open(&backup).unwrap();
+    assert_eq!(untouched.pragma_query_value(None, "user_version", |row| row.get::<_, i64>(0)).unwrap(), 10);
+    assert_eq!(
+        untouched
+            .query_row("SELECT COUNT(*) FROM sqlite_master WHERE name='comment_drafts'", [], |row| row.get::<_, i64>(0))
+            .unwrap(),
+        0
+    );
+}
diff --git a/docs/adr/0042-private-comment-drafts.md b/docs/adr/0042-private-comment-drafts.md
new file mode 100644
index 00000000..a8ad01db
--- /dev/null
+++ b/docs/adr/0042-private-comment-drafts.md
@@ -0,0 +1,30 @@
+# ADR 0042: private account-backed proposal comment drafts
+
+Status: accepted.
+
+## Decision
+
+General proposal comments have one private draft per proposal and full acting identity,
+separate from review-decision drafts. Schema 11 adds `comment_drafts` without rewriting
+review drafts. Its body is bounded to 16 KiB of UTF-8, matching a posted comment; the
+inspected head supplies context but does not pin retained history. Agent runs remain
+distinct owners. No API accepts an owner selector.
+
+Get, save and clear require proposal-comment permission and stream access. They are
+available after proposal closure, like posting a general comment. Saves and clears
+compare the inspected version in the metadata transaction. Identical retries are
+no-ops; cleared drafts retain versioned tombstones so stale devices cannot resurrect
+notes. Draft text never enters shared audit records, events or public proposal data.
+Private HTTP responses use `Cache-Control: no-store`; administrators and backups can
+still access stored notes.
+
+CLI, SDK and MCP expose explicit get/save/clear operations under the
+`proposals.comment_drafts` capability. Web preserves tab-local drafts and explicitly
+saves to the account. An empty form may restore saved notes; differing text requires a
+choice. Saving never posts a comment. Posting still checks the inspected proposal head.
+Cleanup uses the captured account and version, and cleanup failure cannot turn a
+successful post into a failed post or cause duplicate submission.
+
+Back up before opening an older repository with this development build. Downgrades
+require restoring that backup. Thread replies and file-edit drafts remain outside this
+slice.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 6248f85f..3fd3ce01 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -58,3 +58,5 @@ which test: [ADR traceability](../architecture/adr-traceability.md).
 - [0040 — Complete structural sync resolutions](0040-structural-sync-resolutions.md)
 
 - [0041 — Bounded structural conflict previews](0041-structural-conflict-previews.md)
+
+- [0042 — Private proposal comment drafts](0042-private-comment-drafts.md)
diff --git a/docs/protocol/openapi.json b/docs/protocol/openapi.json
index c58684ec..00b722bc 100644
--- a/docs/protocol/openapi.json
+++ b/docs/protocol/openapi.json
@@ -645,6 +645,25 @@
         },
         "type": "object"
       },
+      "ClearCommentDraftRequest": {
+        "properties": {
+          "expected_version": {
+            "default": 0,
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "id": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "ClearReviewDraftRequest": {
         "properties": {
           "expected_version": {
@@ -682,6 +701,35 @@
         },
         "type": "object"
       },
+      "CommentDraft": {
+        "description": "Private, unsubmitted general discussion notes for the current acting identity.",
+        "properties": {
+          "body": {
+            "default": "",
+            "type": "string"
+          },
+          "head": {
+            "default": "",
+            "type": "string"
+          },
+          "present": {
+            "default": false,
+            "type": "boolean"
+          },
+          "updated_at_ms": {
+            "default": 0,
+            "format": "int64",
+            "type": "integer"
+          },
+          "version": {
+            "default": 0,
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
       "CommentProposalRequest": {
         "description": "A discussion entry, never an approval or a request-changes vote.",
         "properties": {
@@ -926,7 +974,7 @@
           },
           "paths": {
             "default": [],
-            "description": "Ordered candidate entries, including the root. At most 100 paths per root and 1000 in one response.",
+            "description": "Ordered candidate entries; a complete scope includes the root.\nAt most 100 paths per root and 1000 in one response. Incomplete scopes may be empty.",
             "items": {
               "type": "string"
             },
@@ -1865,6 +1913,19 @@
         },
         "type": "object"
       },
+      "GetCommentDraftRequest": {
+        "properties": {
+          "id": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "GetIssueRequest": {
         "properties": {
           "number": {
@@ -5147,6 +5208,34 @@
         },
         "type": "object"
       },
+      "SaveCommentDraftRequest": {
+        "properties": {
+          "body": {
+            "default": "",
+            "type": "string"
+          },
+          "expected_version": {
+            "default": 0,
+            "description": "Zero means no prior draft; all saves compare this version atomically.",
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "head": {
+            "default": "",
+            "type": "string"
+          },
+          "id": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "SaveReviewDraftRequest": {
         "properties": {
           "body": {
@@ -10262,6 +10351,206 @@
         ]
       }
     },
+    "/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft": {
+      "delete": {
+        "operationId": "proposal.clear_comment_draft",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "expected_version",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "format": "int64",
+              "minimum": 0,
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CommentDraft"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Clear the inspected private comment draft",
+        "tags": [
+          "Proposal"
+        ]
+      },
+      "get": {
+        "operationId": "proposal.get_comment_draft",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CommentDraft"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Read your private comment draft",
+        "tags": [
+          "Proposal"
+        ]
+      },
+      "put": {
+        "operationId": "proposal.save_comment_draft",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SaveCommentDraftRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CommentDraft"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Save your private comment draft",
+        "tags": [
+          "Proposal"
+        ]
+      }
+    },
     "/v1/repos/{owner}/{rname}/proposals/{id}/comments": {
       "post": {
         "operationId": "proposal.comment",
diff --git a/migrations/postgres/0011_comment_drafts.sql b/migrations/postgres/0011_comment_drafts.sql
new file mode 100644
index 00000000..9b69ad81
--- /dev/null
+++ b/migrations/postgres/0011_comment_drafts.sql
@@ -0,0 +1,10 @@
+CREATE TABLE comment_drafts (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    owner TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    head TEXT,
+    body TEXT NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (proposal, owner),
+    CHECK (head IS NOT NULL OR body = '')
+);
diff --git a/migrations/sqlite/0011_comment_drafts.sql b/migrations/sqlite/0011_comment_drafts.sql
new file mode 100644
index 00000000..9b69ad81
--- /dev/null
+++ b/migrations/sqlite/0011_comment_drafts.sql
@@ -0,0 +1,10 @@
+CREATE TABLE comment_drafts (
+    proposal TEXT NOT NULL REFERENCES proposals(id),
+    owner TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    head TEXT,
+    body TEXT NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (proposal, owner),
+    CHECK (head IS NOT NULL OR body = '')
+);
diff --git a/proto/agwp/v1/agwp.proto b/proto/agwp/v1/agwp.proto
index 299a63f6..5b364d32 100644
--- a/proto/agwp/v1/agwp.proto
+++ b/proto/agwp/v1/agwp.proto
@@ -794,6 +794,32 @@ message ClearReviewDraftRequest {
   uint64 expected_version = 3;
 }
 
+// Private, unsubmitted general discussion notes for the current acting identity.
+message CommentDraft {
+  bool present = 1;
+  uint64 version = 2;
+  string head = 3;
+  string body = 4;
+  int64 updated_at_ms = 5;
+}
+message GetCommentDraftRequest {
+  string repo = 1;
+  string id = 2;
+}
+message SaveCommentDraftRequest {
+  string repo = 1;
+  string id = 2;
+  string head = 3;
+  string body = 4;
+  // Zero means no prior draft; all saves compare this version atomically.
+  uint64 expected_version = 5;
+}
+message ClearCommentDraftRequest {
+  string repo = 1;
+  string id = 2;
+  uint64 expected_version = 3;
+}
+
 // Replaces review routing after comparing the complete inspected set.
 message SetRequestedReviewersRequest {
   string repo = 1;
@@ -1877,6 +1903,9 @@ service ProposalService {
   rpc GetDraft(GetReviewDraftRequest) returns (ReviewDraft);
   rpc SaveDraft(SaveReviewDraftRequest) returns (ReviewDraft);
   rpc ClearDraft(ClearReviewDraftRequest) returns (ReviewDraft);
+  rpc GetCommentDraft(GetCommentDraftRequest) returns (CommentDraft);
+  rpc SaveCommentDraft(SaveCommentDraftRequest) returns (CommentDraft);
+  rpc ClearCommentDraft(ClearCommentDraftRequest) returns (CommentDraft);
   rpc SetReviewers(SetRequestedReviewersRequest) returns (RequestedReviewers);
   rpc Review(ReviewProposalRequest) returns (Review);
   rpc Comment(CommentProposalRequest) returns (Review);

From acbdb9fe7bf9a50a35807db22b2fc741be66ab4f Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:33:12 +0000
Subject: [PATCH 23/41] feat(clients): expose private comment drafts in SDKs
 and MCP

---
 crates/ag-mcp/src/tools/mod.rs                |   4 +-
 crates/ag-mcp/src/tools/proposals.rs          | 107 ++++++++--
 crates/ag-mcp/tests/review_drafts.rs          |  82 ++++++--
 crates/ag-mcp/tests/review_requests.rs        |   7 +
 sdk/api-policy.json                           |   4 +-
 sdk/python/README.md                          |   6 +
 sdk/python/src/agentgit/_generated/models.py  |  39 ++++
 .../src/agentgit/_generated/namespaces.py     |  72 +++++++
 .../src/agentgit/_generated/operations.py     |  48 +++++
 sdk/python/tests/test_all_operations.py       |  14 ++
 sdk/python/tests/test_review_drafts.py        |  43 ++--
 sdk/typescript/README.md                      |   6 +
 sdk/typescript/src/generated/api.ts           |   9 +
 sdk/typescript/src/generated/models.ts        |   4 +
 sdk/typescript/src/generated/operations.ts    |  45 +++++
 sdk/typescript/src/generated/schema.ts        | 185 +++++++++++++++++-
 sdk/typescript/test/all-operations.test.ts    |  16 ++
 sdk/typescript/test/review-drafts.test.ts     | 165 ++++++++--------
 18 files changed, 723 insertions(+), 133 deletions(-)

diff --git a/crates/ag-mcp/src/tools/mod.rs b/crates/ag-mcp/src/tools/mod.rs
index f43dc143..69ca0a67 100644
--- a/crates/ag-mcp/src/tools/mod.rs
+++ b/crates/ag-mcp/src/tools/mod.rs
@@ -420,7 +420,7 @@ mod tests {
         for t in reg.all() {
             match t.group {
                 Group::Read => assert!(t.ann.read_only, "{} is in the read group so it must be read-only", t.name),
-                Group::Review if t.name == "review_draft_get" => {
+                Group::Review if matches!(t.name, "review_draft_get" | "comment_draft_get") => {
                     // Private notes require the review opt-in even though reading does not mutate them.
                     assert!(t.ann.read_only);
                 }
@@ -430,7 +430,7 @@ mod tests {
         let destructive: Vec<&str> = reg.all().iter().filter(|t| t.ann.destructive).map(|t| t.name).collect();
         assert_eq!(
             destructive,
-            ["workspace_delete", "proposal_close", "review_draft_clear", "integrate"],
+            ["workspace_delete", "proposal_close", "review_draft_clear", "comment_draft_clear", "integrate"],
             "{destructive:?}"
         );
     }
diff --git a/crates/ag-mcp/src/tools/proposals.rs b/crates/ag-mcp/src/tools/proposals.rs
index 61f67946..c9910d39 100644
--- a/crates/ag-mcp/src/tools/proposals.rs
+++ b/crates/ag-mcp/src/tools/proposals.rs
@@ -120,34 +120,43 @@ fn proposal_set_reviewers(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput,
     ))
 }
 
-fn review_draft(ctx: &CallCtx<'_>, args: &Value, method: &str) -> Result<ToolOutput, ToolError> {
+fn private_draft(ctx: &CallCtx<'_>, args: &Value, method: &str, kind: &str) -> Result<ToolOutput, ToolError> {
     let repo = ctx.repo(args)?;
     let run = ctx.run_id(args)?;
-    if !ctx.api.supports("proposals.review_drafts", &ctx.opts(run))? {
-        return Err(ToolError::local("server_update_required", "This server does not support private review drafts.")
-            .hint("Update the server before saving or reading account drafts."));
+    if !ctx.api.supports(&format!("proposals.{kind}_drafts"), &ctx.opts(run))? {
+        return Err(ToolError::local(
+            "server_update_required",
+            "This server does not support this private draft type.",
+        )
+        .hint("Update the server before saving or reading account drafts."));
     }
     let id = str_arg(args, "proposal_id").unwrap_or_default();
-    let path = format!("{}/proposals/{}/review-draft", repo_path(&repo), enc(id));
+    let path = format!("{}/proposals/{}/{kind}-draft", repo_path(&repo), enc(id));
     let value = if method == "GET" {
         ctx.api.get(&path, &[], &ctx.opts(run))?
     } else {
-        write_review_draft(ctx, args, &path, run, method)?
+        write_private_draft(ctx, args, &path, run, method, kind)?
     };
+    Ok(private_draft_output(value, kind))
+}
+
+fn private_draft_output(value: Value, kind: &str) -> ToolOutput {
     let summary = if value.get("present").and_then(Value::as_bool).unwrap_or(false) {
-        "Your private review draft is saved. No review was posted."
+        "Your private draft is saved. Nothing was posted."
     } else {
-        "No private review draft is saved. No review was posted."
+        "No private draft is saved. Nothing was posted."
     };
-    Ok(ToolOutput::new(summary, json!({"draft":value})).block("/draft/body", "review.draft", vec![]))
+    let block = if kind == "comment" { "comment.draft" } else { "review.draft" };
+    ToolOutput::new(summary, json!({"draft":value})).block("/draft/body", block, vec![])
 }
 
-fn write_review_draft(
+fn write_private_draft(
     ctx: &CallCtx<'_>,
     args: &Value,
     path: &str,
     run: Option<&str>,
     method: &str,
+    kind: &str,
 ) -> Result<Value, ToolError> {
     let version =
         u64_arg(args, "expected_version").ok_or_else(|| ToolError::invalid("expected_version is required"))?;
@@ -155,22 +164,25 @@ fn write_review_draft(
         return Ok(ctx.api.send("DELETE", &format!("{path}?expected_version={version}"), None, &ctx.opts(run))?);
     }
     let text = str_arg(args, "body").unwrap_or_default();
-    if text.len() > 64 * 1024 {
-        return Err(ToolError::invalid("draft body exceeds 64 KiB"));
+    let limit = if kind == "comment" { 16 * 1024 } else { 64 * 1024 };
+    if text.len() > limit {
+        return Err(ToolError::invalid(format!("draft body exceeds {limit} UTF-8 bytes")));
+    }
+    let mut body = json!({"expected_version":version,"head":str_arg(args, "head").unwrap_or_default(),"body":text});
+    if kind == "review" {
+        body["decision"] = json!(str_arg(args, "decision").unwrap_or_default());
     }
-    let body = json!({"expected_version":version,"head":str_arg(args, "head").unwrap_or_default(),
-        "decision":str_arg(args, "decision").unwrap_or_default(),"body":text});
     Ok(ctx.api.send("PUT", path, Some(&body), &ctx.opts(run))?)
 }
 
 fn review_draft_get(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
-    review_draft(ctx, args, "GET")
+    private_draft(ctx, args, "GET", "review")
 }
 fn review_draft_save(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
-    review_draft(ctx, args, "PUT")
+    private_draft(ctx, args, "PUT", "review")
 }
 fn review_draft_clear(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
-    review_draft(ctx, args, "DELETE")
+    private_draft(ctx, args, "DELETE", "review")
 }
 
 fn proposal_close(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
@@ -189,6 +201,16 @@ fn proposal_close(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolErr
     ))
 }
 
+fn comment_draft_get(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    private_draft(ctx, args, "GET", "comment")
+}
+fn comment_draft_save(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    private_draft(ctx, args, "PUT", "comment")
+}
+fn comment_draft_clear(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    private_draft(ctx, args, "DELETE", "comment")
+}
+
 fn request_validation(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
     let repo = ctx.repo(args)?;
     let run = ctx.run_id(args)?;
@@ -512,6 +534,57 @@ pub fn tools() -> Vec<ToolDef> {
             output(vec![("draft", o_obj())], &["draft"]),
             review_draft_clear,
         ),
+        def(
+            "comment_draft_get",
+            Group::Review,
+            "Read your private comment draft",
+            "Reads only the calling account's saved draft for this proposal. This is not a posted comment and does not expose another account's notes.",
+            Ann::READ,
+            input(vec![p_repo(), ("proposal_id", t_str("Proposal id or unique prefix.")), p_run()], &["proposal_id"]),
+            output(vec![("draft", o_obj())], &["draft"]),
+            comment_draft_get,
+        ),
+        def(
+            "comment_draft_save",
+            Group::Review,
+            "Save your private comment draft",
+            "Saves a private general comment draft against the inspected draft version. Does not post a comment or notify anyone. Works on closed proposals too. A stale version preserves the other edit.",
+            Ann::SET,
+            input(
+                vec![
+                    p_repo(),
+                    ("proposal_id", t_str("Proposal id or unique prefix.")),
+                    (
+                        "expected_version",
+                        t_int("Version returned by comment_draft_get; 0 only when no draft exists.", 0, i64::MAX),
+                    ),
+                    ("head", t_str("Exact proposal head the draft refers to.")),
+                    ("body", t_str_max("Private notes, up to 16 KiB of UTF-8.", 16384)),
+                    p_run(),
+                ],
+                &["proposal_id", "expected_version", "head", "body"],
+            ),
+            output(vec![("draft", o_obj())], &["draft"]),
+            comment_draft_save,
+        ),
+        def(
+            "comment_draft_clear",
+            Group::Review,
+            "Clear your private comment draft",
+            "Clears only your saved draft after comparing its inspected version. Newer text is retained on conflict; already cleared drafts are safe to retry.",
+            Ann::DESTROY,
+            input(
+                vec![
+                    p_repo(),
+                    ("proposal_id", t_str("Proposal id or unique prefix.")),
+                    ("expected_version", t_int("Version returned by comment_draft_get.", 0, i64::MAX)),
+                    p_run(),
+                ],
+                &["proposal_id", "expected_version"],
+            ),
+            output(vec![("draft", o_obj())], &["draft"]),
+            comment_draft_clear,
+        ),
         def(
             "review",
             Group::Review,
diff --git a/crates/ag-mcp/tests/review_drafts.rs b/crates/ag-mcp/tests/review_drafts.rs
index e719c01e..15461eab 100644
--- a/crates/ag-mcp/tests/review_drafts.rs
+++ b/crates/ag-mcp/tests/review_drafts.rs
@@ -2,10 +2,28 @@
 #![allow(missing_docs)]
 mod common;
 use common::*;
-use serde_json::json;
+use serde_json::{Value, json};
 
 #[test]
 fn private_review_drafts_preserve_other_accounts_and_stale_edits() {
+    exercise_drafts("review");
+}
+
+#[test]
+fn private_comment_drafts_work_after_closure_without_posting() {
+    exercise_drafts("comment");
+}
+
+fn exercise_drafts(kind: &str) {
+    let get = format!("{kind}_draft_get");
+    let save_tool = format!("{kind}_draft_save");
+    let clear_tool = format!("{kind}_draft_clear");
+    let draft_args = |mut value: Value| {
+        if kind == "comment" {
+            value.as_object_mut().unwrap().remove("decision");
+        }
+        value
+    };
     let srv = TestServer::start();
     let repo = "acme/drafts";
     srv.repo(repo);
@@ -24,47 +42,75 @@ fn private_review_drafts_preserve_other_accounts_and_stale_edits() {
     let mut bob = Mcp::start(&srv, &bob_token, &["--repo", repo, "--allow", "read,review"]);
     let mut carol = Mcp::start(&srv, &carol_token, &["--repo", repo, "--allow", "read,review"]);
     let args = json!({"proposal_id":id});
-    let empty = bob.ok("review_draft_get", args.clone());
+    let empty = bob.ok(&get, args.clone());
     assert_eq!(empty.structured["draft"]["present"], false);
-    let save = json!({"proposal_id":id,"head":head,"decision":"comment","body":"Private notes","expected_version":0});
-    let saved = bob.ok("review_draft_save", save.clone());
+    let save = draft_args(
+        json!({"proposal_id":id,"head":head,"decision":"comment","body":"Private notes","expected_version":0}),
+    );
+    let saved = bob.ok(&save_tool, save.clone());
     assert_eq!(saved.structured["draft"]["version"], 1);
-    assert_eq!(bob.ok("review_draft_save", save).structured["draft"]["version"], 1);
-    assert_eq!(carol.ok("review_draft_get", args.clone()).structured["draft"]["present"], false);
+    assert_eq!(bob.ok(&save_tool, save).structured["draft"]["version"], 1);
+    assert_eq!(carol.ok(&get, args.clone()).structured["draft"]["present"], false);
+    if kind == "comment" {
+        // Character limits alone must not permit an oversized UTF-8 body.
+        bob.refused(
+            &save_tool,
+            json!({"proposal_id":id,"head":head,"body":"é".repeat(8193),"expected_version":1}),
+            "invalid_arguments",
+        );
+        assert_eq!(bob.ok(&get, args.clone()).structured["draft"]["version"], 1);
+        bob.ok("review_draft_save", json!({"proposal_id":id,"head":head,"decision":"comment","body":"Separate review note","expected_version":0}));
+        assert_eq!(bob.ok(&get, args.clone()).structured["draft"]["body"], "Private notes");
+    }
     assert!(
         bob.call(
-            "review_draft_save",
-            json!({"proposal_id":id,"head":head,"decision":"comment","body":"stale replacement","expected_version":0})
+            &save_tool,
+            draft_args(json!({"proposal_id":id,"head":head,"decision":"comment","body":"stale replacement","expected_version":0}))
         )
         .is_error
     );
-    let clear = bob.ok("review_draft_clear", json!({"proposal_id":id,"expected_version":1}));
+    let clear = bob.ok(&clear_tool, json!({"proposal_id":id,"expected_version":1}));
     assert_eq!(clear.structured["draft"]["present"], false);
     assert_eq!(clear.structured["draft"]["version"], 2);
-    assert_eq!(bob.ok("review_draft_get", args.clone()).structured["draft"]["body"], "");
+    assert_eq!(bob.ok(&get, args.clone()).structured["draft"]["body"], "");
     assert!(
         bob.call(
-            "review_draft_save",
-            json!({"proposal_id":id,"head":head,"decision":"comment","body":"old device","expected_version":0})
+            &save_tool,
+            draft_args(
+                json!({"proposal_id":id,"head":head,"decision":"comment","body":"old device","expected_version":0})
+            )
         )
         .is_error
     );
     assert!(
         bob.call(
-            "review_draft_save",
-            json!({"proposal_id":id,"head":head,"decision":"comment","body":"missing guard"})
+            &save_tool,
+            draft_args(json!({"proposal_id":id,"head":head,"decision":"comment","body":"missing guard"}))
         )
         .is_error
     );
     let newer = bob.ok(
-        "review_draft_save",
-        json!({"proposal_id":id,"head":head,"decision":"comment","body":"Recovered note","expected_version":2}),
+        &save_tool,
+        draft_args(
+            json!({"proposal_id":id,"head":head,"decision":"comment","body":"Recovered note","expected_version":2}),
+        ),
     );
     assert_eq!(newer.structured["draft"]["version"], 3);
     author.ok("proposal_close", json!({"proposal_id":id}));
-    assert_eq!(bob.ok("review_draft_get", args).structured["draft"]["body"], "Recovered note");
+    if kind == "comment" {
+        let closed =
+            bob.ok(&save_tool, json!({"proposal_id":id,"head":head,"body":"Closed note","expected_version":3}));
+        assert_eq!(closed.structured["draft"]["version"], 4);
+        bob.ok(&clear_tool, json!({"proposal_id":id,"expected_version":4}));
+        assert_eq!(bob.ok("review_draft_get", args).structured["draft"]["body"], "Separate review note");
+        let (status, public) = srv.admin().get(&format!("/v1/repos/{repo}/proposals/{id}"));
+        assert_eq!(status, 200);
+        assert_eq!(public["reviews"].as_array().unwrap().len(), 0);
+        return;
+    }
+    assert_eq!(bob.ok(&get, args).structured["draft"]["body"], "Recovered note");
     assert!(
-        !bob.ok("review_draft_clear", json!({"proposal_id":id,"expected_version":3})).structured["draft"]["present"]
+        !bob.ok(&clear_tool, json!({"proposal_id":id,"expected_version":3})).structured["draft"]["present"]
             .as_bool()
             .unwrap()
     );
diff --git a/crates/ag-mcp/tests/review_requests.rs b/crates/ag-mcp/tests/review_requests.rs
index edaa7f04..7b7130d4 100644
--- a/crates/ag-mcp/tests/review_requests.rs
+++ b/crates/ag-mcp/tests/review_requests.rs
@@ -95,5 +95,12 @@ fn older_servers_refuse_review_request_writes_and_filters_before_using_them() {
     m.refused("review_draft_get", json!({"proposal_id":"prop_test"}), "server_update_required");
     m.refused("review_draft_save", json!({"proposal_id":"prop_test","expected_version":0,"head":"0".repeat(64),"decision":"comment","body":"private"}), "server_update_required");
     m.refused("review_draft_clear", json!({"proposal_id":"prop_test","expected_version":0}), "server_update_required");
+    m.refused("comment_draft_get", json!({"proposal_id":"prop_test"}), "server_update_required");
+    m.refused(
+        "comment_draft_save",
+        json!({"proposal_id":"prop_test","expected_version":0,"head":"0".repeat(64),"body":"private"}),
+        "server_update_required",
+    );
+    m.refused("comment_draft_clear", json!({"proposal_id":"prop_test","expected_version":0}), "server_update_required");
     response.join().unwrap();
 }
diff --git a/sdk/api-policy.json b/sdk/api-policy.json
index 0cee3702..66a0b977 100644
--- a/sdk/api-policy.json
+++ b/sdk/api-policy.json
@@ -54,7 +54,9 @@
       "migration.commit",
       "proposal.set_reviewers",
       "proposal.save_draft",
-      "proposal.clear_draft"
+      "proposal.clear_draft",
+      "proposal.save_comment_draft",
+      "proposal.clear_comment_draft"
     ],
     "naturalWhenFieldPresent": {
       "workspace.modify": "expected_head",
diff --git a/sdk/python/README.md b/sdk/python/README.md
index a7cbbdab..493fa64b 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -546,6 +546,12 @@ owns the notes; there is no owner argument. Drafts never post reviews or count a
 Clearing removes content but retains a version, preventing stale saves from recreating it.
 Identical retries are safe; reread and decide before changing a conflicting draft.
 
+Private general-comment drafts use `client.proposals` methods `get_comment_draft`, `save_comment_draft` and `clear_comment_draft`
+with the same inspected-version and retry rules. Negotiate `proposals.comment_drafts`
+first. These drafts contain `head` and `body` (up to 16 KiB of UTF-8), remain separate
+from review-decision drafts, and can be saved on closed proposals. Saving or clearing
+a draft never posts a comment; post explicitly after inspecting the current proposal head.
+
 Servers advertising `workspaces.conflict_origins` may include `conflict.origin` with
 `base`, `ours`, and `theirs` source paths when a rename moved the file. During workspace
 sync, read `origin.ours` at the workspace head and `origin.theirs` at `stream_head`;
diff --git a/sdk/python/src/agentgit/_generated/models.py b/sdk/python/src/agentgit/_generated/models.py
index 26a7bc39..ecf88f85 100644
--- a/sdk/python/src/agentgit/_generated/models.py
+++ b/sdk/python/src/agentgit/_generated/models.py
@@ -27,8 +27,10 @@
     "Changeset",
     "ClaimJobRequest",
     "ClaimJobResponse",
+    "ClearCommentDraftRequest",
     "ClearReviewDraftRequest",
     "CloseProposalRequest",
+    "CommentDraft",
     "CommentProposalRequest",
     "CompareAndSwapRequest",
     "CompleteJobRequest",
@@ -69,6 +71,7 @@
     "GcResponse",
     "GetCandidateRequest",
     "GetChangesetRequest",
+    "GetCommentDraftRequest",
     "GetIssueRequest",
     "GetJobRequest",
     "GetOperationRequest",
@@ -206,6 +209,7 @@
     "RunQueueRequest",
     "RunQueueResponse",
     "RunSpec",
+    "SaveCommentDraftRequest",
     "SaveReviewDraftRequest",
     "SaveRunOutputRequest",
     "SearchMatch",
@@ -453,6 +457,14 @@ class ClaimJobResponse:
     job: Job | None = field(default=None)
 
 
+@dataclass(kw_only=True)
+class ClearCommentDraftRequest:
+    """The `ClearCommentDraftRequest` message."""
+    expected_version: int = field(default=0)
+    id: str = field(default="")
+    repo: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class ClearReviewDraftRequest:
     """The `ClearReviewDraftRequest` message."""
@@ -469,6 +481,16 @@ class CloseProposalRequest:
     repo: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class CommentDraft:
+    """Private, unsubmitted general discussion notes for the current acting identity."""
+    body: str = field(default="")
+    head: str = field(default="")
+    present: bool = field(default=False)
+    updated_at_ms: int = field(default=0)
+    version: int = field(default=0)
+
+
 @dataclass(kw_only=True)
 class CommentProposalRequest:
     """A discussion entry, never an approval or a request-changes vote."""
@@ -864,6 +886,13 @@ class GetChangesetRequest:
     rev: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class GetCommentDraftRequest:
+    """The `GetCommentDraftRequest` message."""
+    id: str = field(default="")
+    repo: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class GetIssueRequest:
     """The `GetIssueRequest` message."""
@@ -2057,6 +2086,16 @@ class RunSpec:
     timeout_secs: int = field(default=0)
 
 
+@dataclass(kw_only=True)
+class SaveCommentDraftRequest:
+    """The `SaveCommentDraftRequest` message."""
+    body: str = field(default="")
+    expected_version: int = field(default=0)
+    head: str = field(default="")
+    id: str = field(default="")
+    repo: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class SaveReviewDraftRequest:
     """The `SaveReviewDraftRequest` message."""
diff --git a/sdk/python/src/agentgit/_generated/namespaces.py b/sdk/python/src/agentgit/_generated/namespaces.py
index 5af514f6..1fe949cf 100644
--- a/sdk/python/src/agentgit/_generated/namespaces.py
+++ b/sdk/python/src/agentgit/_generated/namespaces.py
@@ -27,8 +27,10 @@
     Changeset,
     ClaimJobRequest,
     ClaimJobResponse,
+    ClearCommentDraftRequest,
     ClearReviewDraftRequest,
     CloseProposalRequest,
+    CommentDraft,
     CommentProposalRequest,
     CompareAndSwapRequest,
     CompleteJobRequest,
@@ -69,6 +71,7 @@
     GcResponse,
     GetCandidateRequest,
     GetChangesetRequest,
+    GetCommentDraftRequest,
     GetIssueRequest,
     GetJobRequest,
     GetOperationRequest,
@@ -206,6 +209,7 @@
     RunQueueRequest,
     RunQueueResponse,
     RunSpec,
+    SaveCommentDraftRequest,
     SaveReviewDraftRequest,
     SaveRunOutputRequest,
     SearchMatch,
@@ -1134,6 +1138,17 @@ class ProposalsApi:
     def __init__(self, caller: SyncCaller) -> None:
         self._c = caller
 
+    def clear_comment_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        expected_version: int | None = None,
+        options: CallOptions | None = None,
+    ) -> CommentDraft:
+        """Clear the inspected private comment draft (`DELETE /v1/repos/{owner}/{rname}/proposals/{id}/comment-draft`, operation `proposal.clear_comment_draft`)."""
+        return self._c._call("proposal.clear_comment_draft", {"repo": repo, "id": id, "expected_version": expected_version}, options, CommentDraft)
+
     def clear_draft(
         self,
         *,
@@ -1194,6 +1209,16 @@ def get(
         """One proposal with its reviews (`GET /v1/repos/{owner}/{rname}/proposals/{id}`, operation `proposal.get`)."""
         return self._c._call("proposal.get", {"repo": repo, "id": id}, options, ProposalDetail)
 
+    def get_comment_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        options: CallOptions | None = None,
+    ) -> CommentDraft:
+        """Read your private comment draft (`GET /v1/repos/{owner}/{rname}/proposals/{id}/comment-draft`, operation `proposal.get_comment_draft`)."""
+        return self._c._call("proposal.get_comment_draft", {"repo": repo, "id": id}, options, CommentDraft)
+
     def get_draft(
         self,
         *,
@@ -1234,6 +1259,19 @@ def review(
         """Review the current head (`POST /v1/repos/{owner}/{rname}/proposals/{id}/reviews`, operation `proposal.review`)."""
         return self._c._call("proposal.review", {"repo": repo, "id": id, "body": body, "decision": decision, "expected_head": expected_head, "idempotency_key": idempotency_key}, options, Review)
 
+    def save_comment_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        body: str | None = None,
+        expected_version: int | None = None,
+        head: str | None = None,
+        options: CallOptions | None = None,
+    ) -> CommentDraft:
+        """Save your private comment draft (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/comment-draft`, operation `proposal.save_comment_draft`)."""
+        return self._c._call("proposal.save_comment_draft", {"repo": repo, "id": id, "body": body, "expected_version": expected_version, "head": head}, options, CommentDraft)
+
     def save_draft(
         self,
         *,
@@ -2806,6 +2844,17 @@ class AsyncProposalsApi:
     def __init__(self, caller: AsyncCaller) -> None:
         self._c = caller
 
+    async def clear_comment_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        expected_version: int | None = None,
+        options: CallOptions | None = None,
+    ) -> CommentDraft:
+        """Clear the inspected private comment draft (`DELETE /v1/repos/{owner}/{rname}/proposals/{id}/comment-draft`, operation `proposal.clear_comment_draft`)."""
+        return await self._c._call("proposal.clear_comment_draft", {"repo": repo, "id": id, "expected_version": expected_version}, options, CommentDraft)
+
     async def clear_draft(
         self,
         *,
@@ -2866,6 +2915,16 @@ async def get(
         """One proposal with its reviews (`GET /v1/repos/{owner}/{rname}/proposals/{id}`, operation `proposal.get`)."""
         return await self._c._call("proposal.get", {"repo": repo, "id": id}, options, ProposalDetail)
 
+    async def get_comment_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        options: CallOptions | None = None,
+    ) -> CommentDraft:
+        """Read your private comment draft (`GET /v1/repos/{owner}/{rname}/proposals/{id}/comment-draft`, operation `proposal.get_comment_draft`)."""
+        return await self._c._call("proposal.get_comment_draft", {"repo": repo, "id": id}, options, CommentDraft)
+
     async def get_draft(
         self,
         *,
@@ -2906,6 +2965,19 @@ async def review(
         """Review the current head (`POST /v1/repos/{owner}/{rname}/proposals/{id}/reviews`, operation `proposal.review`)."""
         return await self._c._call("proposal.review", {"repo": repo, "id": id, "body": body, "decision": decision, "expected_head": expected_head, "idempotency_key": idempotency_key}, options, Review)
 
+    async def save_comment_draft(
+        self,
+        *,
+        repo: str,
+        id: str,
+        body: str | None = None,
+        expected_version: int | None = None,
+        head: str | None = None,
+        options: CallOptions | None = None,
+    ) -> CommentDraft:
+        """Save your private comment draft (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/comment-draft`, operation `proposal.save_comment_draft`)."""
+        return await self._c._call("proposal.save_comment_draft", {"repo": repo, "id": id, "body": body, "expected_version": expected_version, "head": head}, options, CommentDraft)
+
     async def save_draft(
         self,
         *,
diff --git a/sdk/python/src/agentgit/_generated/operations.py b/sdk/python/src/agentgit/_generated/operations.py
index 08bf8078..592b74c9 100644
--- a/sdk/python/src/agentgit/_generated/operations.py
+++ b/sdk/python/src/agentgit/_generated/operations.py
@@ -1040,6 +1040,21 @@
         idempotency_key=False,
         public=False,
     ),
+    "proposal.clear_comment_draft": OperationInfo(
+        id="proposal.clear_comment_draft",
+        http="DELETE",
+        route="/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft",
+        namespace="proposals",
+        name="clear_comment_draft",
+        summary="Clear the inspected private comment draft",
+        path_params=('owner', 'rname', 'id'),
+        query_params=('expected_version',),
+        body="none",
+        response="json",
+        retry="natural",
+        idempotency_key=False,
+        public=False,
+    ),
     "proposal.clear_draft": OperationInfo(
         id="proposal.clear_draft",
         http="DELETE",
@@ -1115,6 +1130,21 @@
         idempotency_key=False,
         public=False,
     ),
+    "proposal.get_comment_draft": OperationInfo(
+        id="proposal.get_comment_draft",
+        http="GET",
+        route="/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft",
+        namespace="proposals",
+        name="get_comment_draft",
+        summary="Read your private comment draft",
+        path_params=('owner', 'rname', 'id'),
+        query_params=(),
+        body="none",
+        response="json",
+        retry="read",
+        idempotency_key=False,
+        public=False,
+    ),
     "proposal.get_draft": OperationInfo(
         id="proposal.get_draft",
         http="GET",
@@ -1160,6 +1190,21 @@
         idempotency_key=True,
         public=False,
     ),
+    "proposal.save_comment_draft": OperationInfo(
+        id="proposal.save_comment_draft",
+        http="PUT",
+        route="/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft",
+        namespace="proposals",
+        name="save_comment_draft",
+        summary="Save your private comment draft",
+        path_params=('owner', 'rname', 'id'),
+        query_params=(),
+        body="json",
+        response="json",
+        retry="natural",
+        idempotency_key=False,
+        public=False,
+    ),
     "proposal.save_draft": OperationInfo(
         id="proposal.save_draft",
         http="PUT",
@@ -1979,14 +2024,17 @@
         "get": "operations.get",
     },
     "proposals": {
+        "clear_comment_draft": "proposal.clear_comment_draft",
         "clear_draft": "proposal.clear_draft",
         "close": "proposal.close",
         "comment": "proposal.comment",
         "create": "proposal.create",
         "get": "proposal.get",
+        "get_comment_draft": "proposal.get_comment_draft",
         "get_draft": "proposal.get_draft",
         "list": "proposal.list",
         "review": "proposal.review",
+        "save_comment_draft": "proposal.save_comment_draft",
         "save_draft": "proposal.save_draft",
         "set_reviewers": "proposal.set_reviewers",
         "thread_comments": "proposal.thread_comments",
diff --git a/sdk/python/tests/test_all_operations.py b/sdk/python/tests/test_all_operations.py
index 396c55a8..bf90dd2e 100644
--- a/sdk/python/tests/test_all_operations.py
+++ b/sdk/python/tests/test_all_operations.py
@@ -254,6 +254,20 @@ def test_workspaces_proposals_reviews_and_the_execution_plane(tour: dict[str, Ag
     m4 = alice.workspaces.modify(repo=REPO, name="w3", changes=[put_file("f.txt", "f\n")])
     p3 = alice.proposals.create(repo=REPO, stream="main", head=m4.head, title="third")
     assert alice.proposals.close(repo=REPO, id=p3.id).state == "closed"
+    assert not bob.proposals.get_comment_draft(repo=REPO, id=p3.id).present
+    comment_draft = bob.proposals.save_comment_draft(
+        repo=REPO, id=p3.id, head=p3.head, body="Private follow-up", expected_version=0
+    )
+    assert comment_draft.version == 1
+    assert not admin.proposals.get_comment_draft(repo=REPO, id=p3.id).present
+    assert not bob.proposals.get_draft(repo=REPO, id=p3.id).present
+    with pytest.raises(FailedPreconditionError) as stale_comment:
+        bob.proposals.save_comment_draft(
+            repo=REPO, id=p3.id, head=p3.head, body="Stale follow-up", expected_version=0
+        )
+    assert stale_comment.value.status == 412
+    assert bob.proposals.clear_comment_draft(repo=REPO, id=p3.id, expected_version=1).version == 2
+
     alice.workspaces.delete(repo=REPO, name="w3")
 
 
diff --git a/sdk/python/tests/test_review_drafts.py b/sdk/python/tests/test_review_drafts.py
index bcbdb4c3..0b4065d9 100644
--- a/sdk/python/tests/test_review_drafts.py
+++ b/sdk/python/tests/test_review_drafts.py
@@ -2,6 +2,7 @@
 import json
 
 import httpx
+import pytest
 
 from agentgit import AgentGitClient, AsyncAgentGitClient
 
@@ -15,7 +16,8 @@
 }
 
 
-def test_private_drafts_send_owner_free_guarded_requests() -> None:
+@pytest.mark.parametrize("kind", ["review", "comment"])
+def test_private_drafts_send_owner_free_guarded_requests(kind: str) -> None:
     requests: list[httpx.Request] = []
 
     def respond(request: httpx.Request) -> httpx.Response:
@@ -25,29 +27,34 @@ def respond(request: httpx.Request) -> httpx.Response:
     with AgentGitClient(
         "http://draft.test", "reviewer", http_client=httpx.Client(transport=httpx.MockTransport(respond))
     ) as client:
-        client.proposals.get_draft(repo="team/app", id="proposal")
-        client.proposals.save_draft(
+        getattr(client.proposals, "get_draft" if kind == "review" else "get_comment_draft")(
+            repo="team/app", id="proposal"
+        )
+        getattr(client.proposals, "save_draft" if kind == "review" else "save_comment_draft")(
             repo="team/app",
             id="proposal",
             expected_version=0,
             head="reviewed",
-            decision="comment",
+            **({"decision": "comment"} if kind == "review" else {}),
             body="Private notes",
         )
-        client.proposals.clear_draft(repo="team/app", id="proposal", expected_version=1)
+        getattr(client.proposals, "clear_draft" if kind == "review" else "clear_comment_draft")(
+            repo="team/app", id="proposal", expected_version=1
+        )
     assert [request.method for request in requests] == ["GET", "PUT", "DELETE"]
-    assert all(request.url.path.endswith("/proposals/proposal/review-draft") for request in requests)
+    assert all(request.url.path.endswith(f"/proposals/proposal/{kind}-draft") for request in requests)
     assert json.loads(requests[1].content) == {
         "expected_version": 0,
         "head": "reviewed",
-        "decision": "comment",
+        **({"decision": "comment"} if kind == "review" else {}),
         "body": "Private notes",
     }
     assert requests[2].content == b""
     assert requests[2].url.params["expected_version"] == "1"
 
 
-def test_lost_draft_save_retries_exactly_the_same_payload() -> None:
+@pytest.mark.parametrize("kind", ["review", "comment"])
+def test_lost_draft_save_retries_exactly_the_same_payload(kind: str) -> None:
     bodies: list[bytes] = []
 
     def respond(request: httpx.Request) -> httpx.Response:
@@ -62,12 +69,12 @@ def respond(request: httpx.Request) -> httpx.Response:
         http_client=httpx.Client(transport=httpx.MockTransport(respond)),
         sleep=lambda _: None,
     ) as client:
-        result = client.proposals.save_draft(
+        result = getattr(client.proposals, "save_draft" if kind == "review" else "save_comment_draft")(
             repo="team/app",
             id="proposal",
             expected_version=0,
             head="reviewed",
-            decision="comment",
+            **({"decision": "comment"} if kind == "review" else {}),
             body="Private notes",
         )
     assert result.body == "Private notes"
@@ -75,7 +82,8 @@ def respond(request: httpx.Request) -> httpx.Response:
     assert bodies[0] == bodies[1]
 
 
-def test_clear_retries_the_same_query_version_even_when_zero() -> None:
+@pytest.mark.parametrize("kind", ["review", "comment"])
+def test_clear_retries_the_same_query_version_even_when_zero(kind: str) -> None:
     urls: list[str] = []
 
     def respond(request: httpx.Request) -> httpx.Response:
@@ -93,7 +101,9 @@ def respond(request: httpx.Request) -> httpx.Response:
         http_client=httpx.Client(transport=httpx.MockTransport(respond)),
         sleep=lambda _: None,
     ) as client:
-        result = client.proposals.clear_draft(repo="team/app", id="proposal", expected_version=0)
+        result = getattr(client.proposals, "clear_draft" if kind == "review" else "clear_comment_draft")(
+            repo="team/app", id="proposal", expected_version=0
+        )
     assert not result.present
     assert result.version == 2
     assert urls[0] == urls[1]
@@ -101,7 +111,8 @@ def respond(request: httpx.Request) -> httpx.Response:
     assert httpx.URL(urls[0]).params["expected_version"] == "0"
 
 
-def test_async_draft_save_uses_the_same_guard_and_retry_contract() -> None:
+@pytest.mark.parametrize("kind", ["review", "comment"])
+def test_async_draft_save_uses_the_same_guard_and_retry_contract(kind: str) -> None:
     async def scenario() -> None:
         bodies: list[bytes] = []
 
@@ -120,12 +131,14 @@ async def no_sleep(_delay: float) -> None:
             http_client=httpx.AsyncClient(transport=httpx.MockTransport(respond)),
             sleep=no_sleep,
         ) as client:
-            result = await client.proposals.save_draft(
+            result = await getattr(
+                client.proposals, "save_draft" if kind == "review" else "save_comment_draft"
+            )(
                 repo="team/app",
                 id="proposal",
                 expected_version=0,
                 head="reviewed",
-                decision="comment",
+                **({"decision": "comment"} if kind == "review" else {}),
                 body="Private notes",
             )
         assert result.body == "Private notes"
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index 56288774..6b753a4b 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -506,6 +506,12 @@ count as approval or notify reviewers. Clearing removes the content and retains
 so stale saves cannot recreate it. Retrying an identical save/clear is safe; reread before
 changing a conflicting draft rather than automatically overwriting it.
 
+Private general-comment drafts use `client.proposals` methods `getCommentDraft`, `saveCommentDraft` and `clearCommentDraft`
+with the same inspected-version and retry rules. Negotiate `proposals.comment_drafts`
+first. These drafts contain `head` and `body` (up to 16 KiB of UTF-8), remain separate
+from review-decision drafts, and can be saved on closed proposals. Saving or clearing
+a draft never posts a comment; post explicitly after inspecting the current proposal head.
+
 Servers advertising `workspaces.conflict_origins` may include `conflict.origin` with
 `base`, `ours`, and `theirs` source paths when a rename moved the file. During workspace
 sync, read `origin.ours` at the workspace head and `origin.theirs` at `stream_head`;
diff --git a/sdk/typescript/src/generated/api.ts b/sdk/typescript/src/generated/api.ts
index 511b8690..fce28632 100644
--- a/sdk/typescript/src/generated/api.ts
+++ b/sdk/typescript/src/generated/api.ts
@@ -97,14 +97,17 @@ export const NAMESPACE_METHODS = {
     get: 'operations.get',
   },
   proposals: {
+    clearCommentDraft: 'proposal.clear_comment_draft',
     clearDraft: 'proposal.clear_draft',
     close: 'proposal.close',
     comment: 'proposal.comment',
     create: 'proposal.create',
     get: 'proposal.get',
+    getCommentDraft: 'proposal.get_comment_draft',
     getDraft: 'proposal.get_draft',
     list: 'proposal.list',
     review: 'proposal.review',
+    saveCommentDraft: 'proposal.save_comment_draft',
     saveDraft: 'proposal.save_draft',
     setReviewers: 'proposal.set_reviewers',
     threadComments: 'proposal.thread_comments',
@@ -335,6 +338,8 @@ export interface Api {
     get(request: Req<'operations.get'>, options?: CallOptions): Promise<Res<'operations.get'>>;
   };
   readonly proposals: {
+    /** Clear the inspected private comment draft (`DELETE /v1/repos/{owner}/{rname}/proposals/{id}/comment-draft`, operation `proposal.clear_comment_draft`) */
+    clearCommentDraft(request: Req<'proposal.clear_comment_draft'>, options?: CallOptions): Promise<Res<'proposal.clear_comment_draft'>>;
     /** Clear the inspected private review draft (`DELETE /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.clear_draft`) */
     clearDraft(request: Req<'proposal.clear_draft'>, options?: CallOptions): Promise<Res<'proposal.clear_draft'>>;
     /** Close without integrating (`POST /v1/repos/{owner}/{rname}/proposals/{id}/close`, operation `proposal.close`) */
@@ -345,12 +350,16 @@ export interface Api {
     create(request: Req<'proposal.create'>, options?: CallOptions): Promise<Res<'proposal.create'>>;
     /** One proposal with its reviews (`GET /v1/repos/{owner}/{rname}/proposals/{id}`, operation `proposal.get`) */
     get(request: Req<'proposal.get'>, options?: CallOptions): Promise<Res<'proposal.get'>>;
+    /** Read your private comment draft (`GET /v1/repos/{owner}/{rname}/proposals/{id}/comment-draft`, operation `proposal.get_comment_draft`) */
+    getCommentDraft(request: Req<'proposal.get_comment_draft'>, options?: CallOptions): Promise<Res<'proposal.get_comment_draft'>>;
     /** Read your private review draft (`GET /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.get_draft`) */
     getDraft(request: Req<'proposal.get_draft'>, options?: CallOptions): Promise<Res<'proposal.get_draft'>>;
     /** List proposals (`GET /v1/repos/{owner}/{rname}/proposals`, operation `proposal.list`) */
     list(request: Req<'proposal.list'>, options?: CallOptions): Promise<Res<'proposal.list'>>;
     /** Review the current head (`POST /v1/repos/{owner}/{rname}/proposals/{id}/reviews`, operation `proposal.review`) */
     review(request: Req<'proposal.review'>, options?: CallOptions): Promise<Res<'proposal.review'>>;
+    /** Save your private comment draft (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/comment-draft`, operation `proposal.save_comment_draft`) */
+    saveCommentDraft(request: Req<'proposal.save_comment_draft'>, options?: CallOptions): Promise<Res<'proposal.save_comment_draft'>>;
     /** Save your private review draft (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/review-draft`, operation `proposal.save_draft`) */
     saveDraft(request: Req<'proposal.save_draft'>, options?: CallOptions): Promise<Res<'proposal.save_draft'>>;
     /** Replace the inspected set of requested reviewers (`PUT /v1/repos/{owner}/{rname}/proposals/{id}/reviewers`, operation `proposal.set_reviewers`) */
diff --git a/sdk/typescript/src/generated/models.ts b/sdk/typescript/src/generated/models.ts
index 0a0a5f59..374f9359 100644
--- a/sdk/typescript/src/generated/models.ts
+++ b/sdk/typescript/src/generated/models.ts
@@ -26,8 +26,10 @@ export type Blocker = S['Blocker'];
 export type Changeset = S['Changeset'];
 export type ClaimJobRequest = S['ClaimJobRequest'];
 export type ClaimJobResponse = S['ClaimJobResponse'];
+export type ClearCommentDraftRequest = S['ClearCommentDraftRequest'];
 export type ClearReviewDraftRequest = S['ClearReviewDraftRequest'];
 export type CloseProposalRequest = S['CloseProposalRequest'];
+export type CommentDraft = S['CommentDraft'];
 export type CommentProposalRequest = S['CommentProposalRequest'];
 export type CompareAndSwapRequest = S['CompareAndSwapRequest'];
 export type CompleteJobRequest = S['CompleteJobRequest'];
@@ -67,6 +69,7 @@ export type GcRequest = S['GcRequest'];
 export type GcResponse = S['GcResponse'];
 export type GetCandidateRequest = S['GetCandidateRequest'];
 export type GetChangesetRequest = S['GetChangesetRequest'];
+export type GetCommentDraftRequest = S['GetCommentDraftRequest'];
 export type GetIssueRequest = S['GetIssueRequest'];
 export type GetJobRequest = S['GetJobRequest'];
 export type GetOperationRequest = S['GetOperationRequest'];
@@ -204,6 +207,7 @@ export type RunOutput = S['RunOutput'];
 export type RunQueueRequest = S['RunQueueRequest'];
 export type RunQueueResponse = S['RunQueueResponse'];
 export type RunSpec = S['RunSpec'];
+export type SaveCommentDraftRequest = S['SaveCommentDraftRequest'];
 export type SaveReviewDraftRequest = S['SaveReviewDraftRequest'];
 export type SaveRunOutputRequest = S['SaveRunOutputRequest'];
 export type SearchMatch = S['SearchMatch'];
diff --git a/sdk/typescript/src/generated/operations.ts b/sdk/typescript/src/generated/operations.ts
index 15bbe605..01473c77 100644
--- a/sdk/typescript/src/generated/operations.ts
+++ b/sdk/typescript/src/generated/operations.ts
@@ -1040,6 +1040,21 @@ export const OPERATIONS = {
     idempotencyKey: false,
     public: false,
   },
+  'proposal.clear_comment_draft': {
+    id: 'proposal.clear_comment_draft',
+    http: 'DELETE',
+    route: '/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft',
+    namespace: 'proposals',
+    name: 'clearCommentDraft',
+    summary: 'Clear the inspected private comment draft',
+    pathParams: ['owner', 'rname', 'id'],
+    queryParams: ['expected_version'],
+    body: 'none',
+    response: 'json',
+    retry: 'natural',
+    idempotencyKey: false,
+    public: false,
+  },
   'proposal.clear_draft': {
     id: 'proposal.clear_draft',
     http: 'DELETE',
@@ -1115,6 +1130,21 @@ export const OPERATIONS = {
     idempotencyKey: false,
     public: false,
   },
+  'proposal.get_comment_draft': {
+    id: 'proposal.get_comment_draft',
+    http: 'GET',
+    route: '/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft',
+    namespace: 'proposals',
+    name: 'getCommentDraft',
+    summary: 'Read your private comment draft',
+    pathParams: ['owner', 'rname', 'id'],
+    queryParams: [],
+    body: 'none',
+    response: 'json',
+    retry: 'read',
+    idempotencyKey: false,
+    public: false,
+  },
   'proposal.get_draft': {
     id: 'proposal.get_draft',
     http: 'GET',
@@ -1160,6 +1190,21 @@ export const OPERATIONS = {
     idempotencyKey: true,
     public: false,
   },
+  'proposal.save_comment_draft': {
+    id: 'proposal.save_comment_draft',
+    http: 'PUT',
+    route: '/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft',
+    namespace: 'proposals',
+    name: 'saveCommentDraft',
+    summary: 'Save your private comment draft',
+    pathParams: ['owner', 'rname', 'id'],
+    queryParams: [],
+    body: 'json',
+    response: 'json',
+    retry: 'natural',
+    idempotencyKey: false,
+    public: false,
+  },
   'proposal.save_draft': {
     id: 'proposal.save_draft',
     http: 'PUT',
diff --git a/sdk/typescript/src/generated/schema.ts b/sdk/typescript/src/generated/schema.ts
index b31dad96..852975ac 100644
--- a/sdk/typescript/src/generated/schema.ts
+++ b/sdk/typescript/src/generated/schema.ts
@@ -882,6 +882,25 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Read your private comment draft */
+        get: operations["proposal.get_comment_draft"];
+        /** Save your private comment draft */
+        put: operations["proposal.save_comment_draft"];
+        post?: never;
+        /** Clear the inspected private comment draft */
+        delete: operations["proposal.clear_comment_draft"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/repos/{owner}/{rname}/proposals/{id}/comments": {
         parameters: {
             query?: never;
@@ -2000,6 +2019,17 @@ export interface components {
             /** @default null */
             job: components["schemas"]["Job"] | null;
         };
+        ClearCommentDraftRequest: {
+            /**
+             * Format: int64
+             * @default 0
+             */
+            expected_version: number;
+            /** @default  */
+            id: string;
+            /** @default  */
+            repo: string;
+        };
         ClearReviewDraftRequest: {
             /**
              * Format: int64
@@ -2022,6 +2052,25 @@ export interface components {
             /** @default  */
             repo: string;
         };
+        /** @description Private, unsubmitted general discussion notes for the current acting identity. */
+        CommentDraft: {
+            /** @default  */
+            body: string;
+            /** @default  */
+            head: string;
+            /** @default false */
+            present: boolean;
+            /**
+             * Format: int64
+             * @default 0
+             */
+            updated_at_ms: number;
+            /**
+             * Format: int64
+             * @default 0
+             */
+            version: number;
+        };
         /** @description A discussion entry, never an approval or a request-changes vote. */
         CommentProposalRequest: {
             /** @default  */
@@ -2163,7 +2212,8 @@ export interface components {
              */
             complete: boolean;
             /**
-             * @description Ordered candidate entries, including the root. At most 100 paths per root and 1000 in one response.
+             * @description Ordered candidate entries; a complete scope includes the root.
+             *     At most 100 paths per root and 1000 in one response. Incomplete scopes may be empty.
              * @default []
              */
             paths: string[];
@@ -2779,6 +2829,12 @@ export interface components {
              */
             rev: string;
         };
+        GetCommentDraftRequest: {
+            /** @default  */
+            id: string;
+            /** @default  */
+            repo: string;
+        };
         GetIssueRequest: {
             /**
              * Format: int64
@@ -4685,6 +4741,22 @@ export interface components {
              */
             timeout_secs: number;
         };
+        SaveCommentDraftRequest: {
+            /** @default  */
+            body: string;
+            /**
+             * Format: int64
+             * @description Zero means no prior draft; all saves compare this version atomically.
+             * @default 0
+             */
+            expected_version: number;
+            /** @default  */
+            head: string;
+            /** @default  */
+            id: string;
+            /** @default  */
+            repo: string;
+        };
         SaveReviewDraftRequest: {
             /** @default  */
             body: string;
@@ -7611,6 +7683,117 @@ export interface operations {
             };
         };
     };
+    "proposal.get_comment_draft": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CommentDraft"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "proposal.save_comment_draft": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SaveCommentDraftRequest"];
+            };
+        };
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CommentDraft"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "proposal.clear_comment_draft": {
+        parameters: {
+            query?: {
+                expected_version?: number;
+            };
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CommentDraft"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
     "proposal.comment": {
         parameters: {
             query?: never;
diff --git a/sdk/typescript/test/all-operations.test.ts b/sdk/typescript/test/all-operations.test.ts
index 5c171127..fe48fad0 100644
--- a/sdk/typescript/test/all-operations.test.ts
+++ b/sdk/typescript/test/all-operations.test.ts
@@ -270,6 +270,22 @@ describe('the tour', () => {
     const m4 = await alice.workspaces.modify({ repo, name: 'w3', changes: [putFile('f.txt', 'f\n')] });
     const p3 = await alice.proposals.create({ repo, stream: 'main', head: m4.head, title: 'third' });
     expect((await alice.proposals.close({ repo, id: p3.id })).state).toBe('closed');
+    expect((await bob.proposals.getCommentDraft({ repo, id: p3.id })).present).toBe(false);
+    const commentDraft = await bob.proposals.saveCommentDraft({
+      repo,
+      id: p3.id,
+      head: p3.head,
+      body: 'Private follow-up',
+      expected_version: 0,
+    });
+    expect(commentDraft.version).toBe(1);
+    expect((await admin.proposals.getCommentDraft({ repo, id: p3.id })).present).toBe(false);
+    expect((await bob.proposals.getDraft({ repo, id: p3.id })).present).toBe(false);
+    await expect(
+      bob.proposals.saveCommentDraft({ repo, id: p3.id, head: p3.head, body: 'Stale follow-up', expected_version: 0 }),
+    ).rejects.toMatchObject({ status: 412 });
+    expect((await bob.proposals.clearCommentDraft({ repo, id: p3.id, expected_version: 1 })).version).toBe(2);
+
     await alice.workspaces.delete({ repo, name: 'w3' });
   });
 
diff --git a/sdk/typescript/test/review-drafts.test.ts b/sdk/typescript/test/review-drafts.test.ts
index e2fa823b..ed9e6b51 100644
--- a/sdk/typescript/test/review-drafts.test.ts
+++ b/sdk/typescript/test/review-drafts.test.ts
@@ -1,92 +1,99 @@
-import { expect, it } from 'vitest';
+import { describe, expect, it } from 'vitest';
 import { AgentGitClient } from '../src/index.js';
 
-const draft = {
-  present: true,
-  version: 1,
-  head: 'reviewed',
-  decision: 'comment',
-  body: 'Private notes',
-  updated_at_ms: 1,
-};
-
-it('sends private draft reads and guarded save/clear requests without an owner parameter', async () => {
-  const calls: { url: string; method: string; body: unknown }[] = [];
-  const client = new AgentGitClient({
-    baseUrl: 'http://draft.test',
-    token: 'reviewer',
-    fetch: async (input, init) => {
-      calls.push({
-        url: typeof input === 'string' ? input : input instanceof URL ? input.href : input.url,
-        method: init?.method ?? 'GET',
-        body: typeof init?.body === 'string' ? JSON.parse(init.body) : undefined,
-      });
-      return Response.json(draft);
-    },
-  });
-  await client.proposals.getDraft({ repo: 'team/app', id: 'proposal' });
-  await client.proposals.saveDraft({
-    repo: 'team/app',
-    id: 'proposal',
-    expected_version: 0,
+describe.each(['review', 'comment'] as const)('%s drafts', (kind) => {
+  const names =
+    kind === 'review'
+      ? ({ get: 'getDraft', save: 'saveDraft', clear: 'clearDraft' } as const)
+      : ({ get: 'getCommentDraft', save: 'saveCommentDraft', clear: 'clearCommentDraft' } as const);
+  const decision = kind === 'review' ? { decision: 'comment' } : {};
+  const draft = {
+    present: true,
+    version: 1,
     head: 'reviewed',
-    decision: 'comment',
+    ...decision,
     body: 'Private notes',
-  });
-  await client.proposals.clearDraft({ repo: 'team/app', id: 'proposal', expected_version: 1 });
-  expect(calls.map((call) => call.method)).toEqual(['GET', 'PUT', 'DELETE']);
-  expect(
-    calls.every((call) => new URL(call.url).pathname.endsWith('/v1/repos/team/app/proposals/proposal/review-draft')),
-  ).toBe(true);
-  expect(calls[1]!.body).toEqual({ expected_version: 0, head: 'reviewed', decision: 'comment', body: 'Private notes' });
-  expect(calls[2]!.body).toBeUndefined();
-  expect(new URL(calls[2]!.url).searchParams.get('expected_version')).toBe('1');
-});
+    updated_at_ms: 1,
+  };
 
-it('retries a lost private-draft save response with the same inspected version and content', async () => {
-  const sent: string[] = [];
-  const client = new AgentGitClient({
-    baseUrl: 'http://draft.test',
-    token: 'reviewer',
-    sleep: async () => {},
-    fetch: async (_input, init) => {
-      if (typeof init?.body !== 'string') throw new Error('Expected JSON');
-      sent.push(init.body);
-      if (sent.length === 1) throw new TypeError('response lost after save');
-      return Response.json(draft);
-    },
-  });
-  await expect(
-    client.proposals.saveDraft({
+  it('sends private draft reads and guarded save/clear requests without an owner parameter', async () => {
+    const calls: { url: string; method: string; body: unknown }[] = [];
+    const client = new AgentGitClient({
+      baseUrl: 'http://draft.test',
+      token: 'reviewer',
+      fetch: async (input, init) => {
+        calls.push({
+          url: typeof input === 'string' ? input : input instanceof URL ? input.href : input.url,
+          method: init?.method ?? 'GET',
+          body: typeof init?.body === 'string' ? JSON.parse(init.body) : undefined,
+        });
+        return Response.json(draft);
+      },
+    });
+    await client.proposals[names.get]({ repo: 'team/app', id: 'proposal' });
+    await client.proposals[names.save]({
       repo: 'team/app',
       id: 'proposal',
       expected_version: 0,
       head: 'reviewed',
-      decision: 'comment',
+      ...decision,
       body: 'Private notes',
-    }),
-  ).resolves.toEqual(draft);
-  expect(sent).toHaveLength(2);
-  expect(sent[0]).toBe(sent[1]);
-});
+    });
+    await client.proposals[names.clear]({ repo: 'team/app', id: 'proposal', expected_version: 1 });
+    expect(calls.map((call) => call.method)).toEqual(['GET', 'PUT', 'DELETE']);
+    expect(
+      calls.every((call) => new URL(call.url).pathname.endsWith(`/v1/repos/team/app/proposals/proposal/${kind}-draft`)),
+    ).toBe(true);
+    expect(calls[1]!.body).toEqual({ expected_version: 0, head: 'reviewed', ...decision, body: 'Private notes' });
+    expect(calls[2]!.body).toBeUndefined();
+    expect(new URL(calls[2]!.url).searchParams.get('expected_version')).toBe('1');
+  });
+
+  it('retries a lost private-draft save response with the same inspected version and content', async () => {
+    const sent: string[] = [];
+    const client = new AgentGitClient({
+      baseUrl: 'http://draft.test',
+      token: 'reviewer',
+      sleep: async () => {},
+      fetch: async (_input, init) => {
+        if (typeof init?.body !== 'string') throw new Error('Expected JSON');
+        sent.push(init.body);
+        if (sent.length === 1) throw new TypeError('response lost after save');
+        return Response.json(draft);
+      },
+    });
+    await expect(
+      client.proposals[names.save]({
+        repo: 'team/app',
+        id: 'proposal',
+        expected_version: 0,
+        head: 'reviewed',
+        ...decision,
+        body: 'Private notes',
+      }),
+    ).resolves.toEqual(draft);
+    expect(sent).toHaveLength(2);
+    expect(sent[0]).toBe(sent[1]);
+  });
 
-it('retries clear using the same query guard, including version zero', async () => {
-  const urls: string[] = [];
-  const client = new AgentGitClient({
-    baseUrl: 'http://draft.test',
-    token: 'reviewer',
-    sleep: async () => {},
-    fetch: async (input, init) => {
-      urls.push(typeof input === 'string' ? input : input instanceof URL ? input.href : input.url);
-      expect(init?.body).toBeUndefined();
-      if (urls.length === 1) throw new TypeError('response lost after clear');
-      return Response.json({ ...draft, present: false, body: '', head: '', decision: '', version: 2 });
-    },
+  it('retries clear using the same query guard, including version zero', async () => {
+    const urls: string[] = [];
+    const client = new AgentGitClient({
+      baseUrl: 'http://draft.test',
+      token: 'reviewer',
+      sleep: async () => {},
+      fetch: async (input, init) => {
+        urls.push(typeof input === 'string' ? input : input instanceof URL ? input.href : input.url);
+        expect(init?.body).toBeUndefined();
+        if (urls.length === 1) throw new TypeError('response lost after clear');
+        return Response.json({ ...draft, present: false, body: '', head: '', decision: '', version: 2 });
+      },
+    });
+    await expect(
+      client.proposals[names.clear]({ repo: 'team/app', id: 'proposal', expected_version: 0 }),
+    ).resolves.toMatchObject({ present: false, version: 2 });
+    expect(urls).toHaveLength(2);
+    expect(urls[0]).toBe(urls[1]);
+    expect(new URL(urls[0]!).searchParams.get('expected_version')).toBe('0');
   });
-  await expect(
-    client.proposals.clearDraft({ repo: 'team/app', id: 'proposal', expected_version: 0 }),
-  ).resolves.toMatchObject({ present: false, version: 2 });
-  expect(urls).toHaveLength(2);
-  expect(urls[0]).toBe(urls[1]);
-  expect(new URL(urls[0]!).searchParams.get('expected_version')).toBe('0');
 });

From 4304dc82bf234e1054503e0475b01328f60e6eb0 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:33:35 +0000
Subject: [PATCH 24/41] feat(cli): save and resume private comment drafts

---
 crates/ag-cli/src/cmds/comment_drafts.rs      | 149 +++++++++++++++
 crates/ag-cli/src/cmds/mod.rs                 |  37 ++++
 crates/ag-cli/src/cmds/remote.rs              |  13 ++
 crates/ag-cli/src/cmds/review_drafts.rs       |  21 +--
 crates/ag-cli/tests/comment_drafts.rs         | 107 +++++++++++
 docs/guides/remote.md                         |  18 ++
 docs/reference/cli.md                         | 165 ++++++++++++++---
 docs/reference/completions/_ag                | 126 +++++++++++++
 docs/reference/completions/_ag.ps1            |  78 ++++++++
 docs/reference/completions/ag.bash            | 174 +++++++++++++++++-
 docs/reference/completions/ag.elv             |  74 ++++++++
 docs/reference/completions/ag.fish            |  79 ++++----
 .../man/ag-remote-comment-draft-clear.1       |  45 +++++
 .../man/ag-remote-comment-draft-get.1         |  42 +++++
 .../man/ag-remote-comment-draft-save.1        |  54 ++++++
 docs/reference/man/ag-remote-comment-draft.1  |  49 +++++
 docs/reference/man/ag-remote.1                |   3 +
 17 files changed, 1167 insertions(+), 67 deletions(-)
 create mode 100644 crates/ag-cli/src/cmds/comment_drafts.rs
 create mode 100644 crates/ag-cli/tests/comment_drafts.rs
 create mode 100644 docs/reference/man/ag-remote-comment-draft-clear.1
 create mode 100644 docs/reference/man/ag-remote-comment-draft-get.1
 create mode 100644 docs/reference/man/ag-remote-comment-draft-save.1
 create mode 100644 docs/reference/man/ag-remote-comment-draft.1

diff --git a/crates/ag-cli/src/cmds/comment_drafts.rs b/crates/ag-cli/src/cmds/comment_drafts.rs
new file mode 100644
index 00000000..eb9f23c0
--- /dev/null
+++ b/crates/ag-cli/src/cmds/comment_drafts.rs
@@ -0,0 +1,149 @@
+//! Private account comment notes; saving never posts a comment.
+use std::path::PathBuf;
+
+use ag_client::{Client, ClientError};
+use ag_protocol::v1;
+use anyhow::Result;
+use clap::{Args, Subcommand};
+
+/// Read or explicitly replace the signed-in account's comment draft.
+#[derive(Subcommand, Debug)]
+pub enum CommentDraftCmd {
+    /// Read your private draft and its version, including a cleared version.
+    Get {
+        /// Proposal id or unique prefix.
+        id: String,
+    },
+    /// Save private notes; does not post a comment or advance the inspected head.
+    Save(SaveArgs),
+    /// Clear only the private draft version you inspected.
+    Clear {
+        /// Proposal id or unique prefix.
+        id: String,
+        /// Version returned by get; zero means no draft has existed.
+        #[arg(long)]
+        expected_version: u64,
+    },
+}
+
+/// An explicit replacement, never an implicit fetch-and-overwrite.
+#[derive(Args, Debug)]
+pub struct SaveArgs {
+    /// Proposal id or unique prefix.
+    id: String,
+    /// Exact proposal head you inspected.
+    #[arg(long)]
+    head: String,
+    /// Private comment notes.
+    #[arg(short, long, default_value = "", conflicts_with = "body_file")]
+    message: String,
+    /// Read UTF-8 notes from this file, preserving line breaks (at most 16 KiB).
+    #[arg(long, value_name = "PATH")]
+    body_file: Option<PathBuf>,
+    /// Version returned by get; use zero only after observing no draft.
+    #[arg(long)]
+    expected_version: u64,
+}
+
+impl CommentDraftCmd {
+    /// Whether this command explicitly changes stored notes.
+    pub fn changes_state(&self) -> bool {
+        !matches!(self, Self::Get { .. })
+    }
+}
+
+fn body(args: &SaveArgs) -> Result<String> {
+    super::private_draft_body(
+        &args.message,
+        args.body_file.as_deref(),
+        ag_integrate::MAX_COMMENT_DRAFT_BYTES,
+        "comment draft exceeds 16 KiB",
+    )
+}
+
+async fn require_support(client: &Client) -> Result<()> {
+    super::require_private_draft_support(client, ag_protocol::features::PROPOSALS_COMMENT_DRAFTS, "comment").await
+}
+
+/// Run against the authenticated account, without an owner selector or automatic submission.
+pub async fn run(client: &Client, repo: &str, cmd: &CommentDraftCmd) -> Result<v1::CommentDraft> {
+    require_support(client).await?;
+    let mut proposals = client.proposals();
+    let response = match cmd {
+        CommentDraftCmd::Get { id } => {
+            proposals
+                .get_comment_draft(client.req(v1::GetCommentDraftRequest { repo: repo.into(), id: id.clone() }))
+                .await
+        }
+        CommentDraftCmd::Save(args) => {
+            proposals
+                .save_comment_draft(client.req(v1::SaveCommentDraftRequest {
+                    repo: repo.into(),
+                    id: args.id.clone(),
+                    head: args.head.clone(),
+                    body: body(args)?,
+                    expected_version: args.expected_version,
+                }))
+                .await
+        }
+        CommentDraftCmd::Clear { id, expected_version } => {
+            proposals
+                .clear_comment_draft(client.req(v1::ClearCommentDraftRequest {
+                    repo: repo.into(),
+                    id: id.clone(),
+                    expected_version: *expected_version,
+                }))
+                .await
+        }
+    };
+    Ok(response.map_err(ClientError::from)?.into_inner())
+}
+
+/// Show the version needed for the next explicit save or clear.
+pub fn describe(draft: &v1::CommentDraft) -> String {
+    if !draft.present {
+        return format!("No private comment draft. Version {}.", draft.version);
+    }
+    format!("Private comment draft, version {}.\nInspected head: {}\n\n{}", draft.version, draft.head, draft.body)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn commands_report_mutation_and_display_the_version_needed_for_the_next_write() {
+        assert!(!CommentDraftCmd::Get { id: "p".into() }.changes_state());
+        assert!(CommentDraftCmd::Clear { id: "p".into(), expected_version: 3 }.changes_state());
+        let mut draft = v1::CommentDraft { version: 3, ..Default::default() };
+        assert_eq!(describe(&draft), "No private comment draft. Version 3.");
+        draft.present = true;
+        draft.head = "inspected".into();
+        draft.body = "Private notes".into();
+        assert_eq!(describe(&draft), "Private comment draft, version 3.\nInspected head: inspected\n\nPrivate notes");
+    }
+
+    #[test]
+    fn notes_keep_utf8_and_enforce_the_byte_limit_for_messages_and_files() {
+        let mut args = SaveArgs {
+            id: "p".into(),
+            head: "head".into(),
+            message: "é".repeat(8 * 1024),
+            body_file: None,
+            expected_version: 0,
+        };
+        assert_eq!(body(&args).unwrap(), args.message);
+        args.message.push('x');
+        assert!(body(&args).unwrap_err().to_string().contains("16 KiB"));
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("notes.md");
+        std::fs::write(&path, "first\r\nsecond\n").unwrap();
+        args.body_file = Some(path.clone());
+        assert_eq!(body(&args).unwrap(), "first\r\nsecond\n");
+        std::fs::write(&path, [0xff]).unwrap();
+        assert!(body(&args).unwrap_err().to_string().contains("UTF-8"));
+
+        std::fs::write(&path, "x".repeat(16 * 1024 + 1)).unwrap();
+        assert!(body(&args).unwrap_err().to_string().contains("16 KiB"));
+    }
+}
diff --git a/crates/ag-cli/src/cmds/mod.rs b/crates/ag-cli/src/cmds/mod.rs
index 8e3f26ff..694360c5 100644
--- a/crates/ag-cli/src/cmds/mod.rs
+++ b/crates/ag-cli/src/cmds/mod.rs
@@ -3,6 +3,7 @@
 pub mod admin;
 pub mod agents;
 pub mod auth;
+pub mod comment_drafts;
 pub mod config;
 pub mod conflicts;
 pub mod discussions;
@@ -44,3 +45,39 @@ impl StreamSel {
         self.stream.clone().or_else(|| self.stream_flag.clone()).unwrap_or_else(|| ctx.default_stream())
     }
 }
+
+/// Read a private draft without allocating an unbounded file into memory.
+fn private_draft_body(
+    message: &str,
+    path: Option<&std::path::Path>,
+    limit: usize,
+    too_large: &str,
+) -> anyhow::Result<String> {
+    use anyhow::Context;
+    use std::io::Read;
+    let bytes = match path {
+        Some(path) => {
+            let mut bytes = Vec::new();
+            std::fs::File::open(path)
+                .with_context(|| format!("reading {}", path.display()))?
+                .take(limit as u64 + 1)
+                .read_to_end(&mut bytes)
+                .with_context(|| format!("reading {}", path.display()))?;
+            bytes
+        }
+        None => {
+            anyhow::ensure!(message.len() <= limit, "{too_large}");
+            message.as_bytes().to_vec()
+        }
+    };
+    anyhow::ensure!(bytes.len() <= limit, "{too_large}");
+    String::from_utf8(bytes).context("private draft must be UTF-8")
+}
+
+async fn require_private_draft_support(client: &ag_client::Client, capability: &str, kind: &str) -> anyhow::Result<()> {
+    anyhow::ensure!(
+        client.negotiate().await?.features.iter().any(|feature| feature == capability),
+        "this server does not support private {kind} drafts; update it before using this command"
+    );
+    Ok(())
+}
diff --git a/crates/ag-cli/src/cmds/remote.rs b/crates/ag-cli/src/cmds/remote.rs
index e66e0032..4d68abd1 100644
--- a/crates/ag-cli/src/cmds/remote.rs
+++ b/crates/ag-cli/src/cmds/remote.rs
@@ -819,6 +819,11 @@ pub enum RemoteCmd {
         #[command(subcommand)]
         cmd: crate::cmds::review_drafts::ReviewDraftCmd,
     },
+    /// Save or restore a private general comment without posting it.
+    CommentDraft {
+        #[command(subcommand)]
+        cmd: crate::cmds::comment_drafts::CommentDraftCmd,
+    },
     /// Review a proposal's current head.
     Review {
         /// Proposal id.
@@ -1247,6 +1252,14 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                     print(cli, &result, || crate::cmds::review_drafts::describe(&result))?;
                 }
             }
+            RemoteCmd::CommentDraft { cmd } => {
+                let result = crate::cmds::comment_drafts::run(&c, &repo, cmd).await?;
+                if cmd.changes_state() {
+                    print_done(cli, &result, || crate::cmds::comment_drafts::describe(&result))?;
+                } else {
+                    print(cli, &result, || crate::cmds::comment_drafts::describe(&result))?;
+                }
+            }
             RemoteCmd::Review { id, approve, request_changes, comment, message } => {
                 let decision = match (approve, request_changes, comment) {
                     (true, _, _) => "approve",
diff --git a/crates/ag-cli/src/cmds/review_drafts.rs b/crates/ag-cli/src/cmds/review_drafts.rs
index 815a6b0f..3d5c719c 100644
--- a/crates/ag-cli/src/cmds/review_drafts.rs
+++ b/crates/ag-cli/src/cmds/review_drafts.rs
@@ -3,7 +3,7 @@ use std::path::PathBuf;
 
 use ag_client::{Client, ClientError};
 use ag_protocol::v1;
-use anyhow::{Context, Result, bail};
+use anyhow::Result;
 use clap::{Args, Subcommand};
 
 /// Read or explicitly replace the signed-in account's review draft.
@@ -56,21 +56,16 @@ impl ReviewDraftCmd {
 }
 
 fn body(args: &SaveArgs) -> Result<String> {
-    let text = match &args.body_file {
-        Some(path) => std::fs::read_to_string(path).with_context(|| format!("reading {}", path.display()))?,
-        None => args.message.clone(),
-    };
-    if text.len() > ag_integrate::MAX_REVIEW_DRAFT_BYTES {
-        bail!("review draft exceeds 64 KiB");
-    }
-    Ok(text)
+    super::private_draft_body(
+        &args.message,
+        args.body_file.as_deref(),
+        ag_integrate::MAX_REVIEW_DRAFT_BYTES,
+        "review draft exceeds 64 KiB",
+    )
 }
 
 async fn require_support(client: &Client) -> Result<()> {
-    if !client.negotiate().await?.features.iter().any(|f| f == ag_protocol::features::PROPOSALS_REVIEW_DRAFTS) {
-        bail!("this server does not support private review drafts; update it before using this command");
-    }
-    Ok(())
+    super::require_private_draft_support(client, ag_protocol::features::PROPOSALS_REVIEW_DRAFTS, "review").await
 }
 
 /// Run against the authenticated account, without an owner selector or automatic submission.
diff --git a/crates/ag-cli/tests/comment_drafts.rs b/crates/ag-cli/tests/comment_drafts.rs
new file mode 100644
index 00000000..f029799b
--- /dev/null
+++ b/crates/ag-cli/tests/comment_drafts.rs
@@ -0,0 +1,107 @@
+//! Comment drafts are private notes for writers, including after proposal closure.
+#![allow(missing_docs)]
+mod common;
+use ag_server::authz::Role;
+use common::{Ag, Server};
+
+#[test]
+fn writers_keep_private_versioned_comment_drafts_without_posting_or_touching_review_drafts() {
+    let server = Server::start();
+    let repo = "acme/comment-drafts";
+    server.create_repo(repo);
+    let alice = server.user("user:alice", repo, Role::Writer);
+    let bob = server.user("user:bob", repo, Role::Writer);
+    let reader = server.user("user:reader", repo, Role::Reader);
+    let a = Ag::bare();
+    let run = |args: &[&str]| a.run_env("user:alice", args, &[("AG_TOKEN", &alice)]);
+    run(&["init", "--namespace", repo]).ok();
+    run(&["remote", "add", "origin", &format!("{}/{repo}", server.url), "--token-env", "AG_TOKEN"]).ok();
+    a.write("file.txt", "body");
+    run(&["snapshot", "-m", "target"]).ok();
+    let proposal = run(&["--json", "push", "-t", "target"]).ok().json();
+    let id = proposal["proposal"]["id"].as_str().unwrap();
+    let head = proposal["proposal"]["head"].as_str().unwrap();
+    a.write("notes.md", "Private comment\r\nsecond line\n");
+    let args = [
+        "--json",
+        "remote",
+        "comment-draft",
+        "save",
+        id,
+        "--head",
+        head,
+        "--body-file",
+        "notes.md",
+        "--expected-version",
+        "0",
+    ];
+    let first = run(&args).ok().json();
+    assert_eq!(first["version"], 1);
+    assert_eq!(first["head"], head);
+    assert_eq!(first["body"], "Private comment\r\nsecond line\n");
+    assert_eq!(run(&args).ok().json(), first);
+    let other =
+        a.run_env("user:bob", &["--json", "remote", "comment-draft", "get", id], &[("AG_TOKEN", &bob)]).ok().json();
+    assert_eq!(other["present"], false);
+    assert_eq!(run(&["--json", "remote", "comment-draft", "get", id]).ok().json(), first);
+    assert!(
+        !a.run_env("user:reader", &["remote", "comment-draft", "get", id], &[("AG_TOKEN", &reader)])
+            .out
+            .status
+            .success()
+    );
+    assert!(run(&["--json", "remote", "discussion", "list", id]).ok().json()["threads"].as_array().unwrap().is_empty());
+
+    assert!(
+        !run(&["remote", "comment-draft", "save", id, "--head", head, "-m", "stale", "--expected-version", "0"])
+            .out
+            .status
+            .success()
+    );
+    // A second role lets the same account also keep a distinct review-decision draft.
+    server.user("user:alice", repo, Role::Reviewer);
+    run(&[
+        "remote",
+        "review-draft",
+        "save",
+        id,
+        "--head",
+        head,
+        "--decision",
+        "approve",
+        "-m",
+        "Private review",
+        "--expected-version",
+        "0",
+    ])
+    .ok();
+    assert_eq!(run(&["--json", "remote", "review-draft", "get", id]).ok().json()["body"], "Private review");
+    assert_eq!(run(&["--json", "remote", "comment-draft", "get", id]).ok().json(), first);
+    run(&["remote", "close", id]).ok();
+    let closed = run(&[
+        "--json",
+        "remote",
+        "comment-draft",
+        "save",
+        id,
+        "--head",
+        head,
+        "-m",
+        "Notes after closure",
+        "--expected-version",
+        "1",
+    ])
+    .ok()
+    .json();
+    assert_eq!(closed["version"], 2);
+    assert_eq!(closed["body"], "Notes after closure");
+    run(&["remote", "comment-draft", "clear", id]).code_is(2);
+    assert!(!run(&["remote", "comment-draft", "clear", id, "--expected-version", "1"]).out.status.success());
+    let cleared = run(&["--json", "remote", "comment-draft", "clear", id, "--expected-version", "2"]).ok().json();
+    assert_eq!(cleared["present"], false);
+    assert_eq!(cleared["version"], 3);
+    assert!(!run(&args).out.status.success());
+    let detail = run(&["--json", "remote", "proposal", id]).ok().json();
+    assert!(detail["reviews"].as_array().unwrap().is_empty());
+    assert_eq!(detail["proposal"]["head"], head);
+}
diff --git a/docs/guides/remote.md b/docs/guides/remote.md
index 87c89469..23b20bf3 100644
--- a/docs/guides/remote.md
+++ b/docs/guides/remote.md
@@ -91,6 +91,24 @@ or notify reviewers. Only the current account can read its draft through the API
 administrators and backups can still contain these notes. Files use UTF-8 and retain line
 breaks, with a 64 KiB limit. `--json` returns the draft and its version for scripts.
 
+## Private comment drafts
+
+On development servers advertising `proposals.comment_drafts`, writers can save a general
+proposal comment privately before posting it. These notes are separate from review-decision
+drafts. Read the draft first and use its returned version for every save or clear.
+
+```sh
+ag remote comment-draft get prop_…
+ag remote comment-draft save prop_… --head CHANGESET_ID --body-file notes.md --expected-version 0
+ag remote comment-draft clear prop_… --expected-version 1
+```
+
+The versions above are examples; use the values returned by your preceding command. The head
+records the revision you inspected. Saving never posts a comment or sends a notification.
+Drafts remain available on closed proposals and only the current account can read them through
+the API; server administrators and backups can still contain them. UTF-8 files retain their
+line breaks and are limited to 16 KiB. `--json` includes the version, including after clearing.
+
 ## Offline
 
 Nothing about a local repository needs the server:
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index 9b9861c7..a002411a 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -132,6 +132,10 @@ Concept pages are available in the terminal: `ag help workflow|policy|leases|ide
 - [`ag remote review-draft get`](#ag-remote-review-draft-get)
 - [`ag remote review-draft save`](#ag-remote-review-draft-save)
 - [`ag remote review-draft clear`](#ag-remote-review-draft-clear)
+- [`ag remote comment-draft`](#ag-remote-comment-draft)
+- [`ag remote comment-draft get`](#ag-remote-comment-draft-get)
+- [`ag remote comment-draft save`](#ag-remote-comment-draft-save)
+- [`ag remote comment-draft clear`](#ag-remote-comment-draft-clear)
 - [`ag remote review`](#ag-remote-review)
 - [`ag remote discussion`](#ag-remote-discussion)
 - [`ag remote discussion list`](#ag-remote-discussion-list)
@@ -2508,27 +2512,28 @@ Manage remotes and work with proposals, events and policy on a server
 Usage: ag remote [OPTIONS] <COMMAND>
 
 Commands:
-  add           Add a remote
-  list          List remotes
-  remove        Forget a remote
-  whoami        Show who the server thinks you are
-  proposals     List proposals on the server
-  proposal      Show a proposal with its reviews
-  prepare       What would integrating do now, and what is missing?
-  explain       Explain why a server proposal cannot land, with the next commands. Changes nothing
-  reviewers     Inspect, add or remove requested reviewers (no approval or access change)
-  review-draft  Save or restore your private account review notes without submitting them
-  review        Review a proposal's current head
-  discussion    Read and participate in revision-bound line discussions
-  workspace     Inspect and explicitly sync server-side workspaces without a checkout
-  integrate     Integrate a proposal into its stream
-  close         Close a proposal without integrating it
-  streams       List streams
-  events        Show the events of the repository (replay), or follow them live
-  policy        Show or set a stream's policy
-  log           Show history of a revision on the server
-  blame         Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`
-  cat           Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`
+  add            Add a remote
+  list           List remotes
+  remove         Forget a remote
+  whoami         Show who the server thinks you are
+  proposals      List proposals on the server
+  proposal       Show a proposal with its reviews
+  prepare        What would integrating do now, and what is missing?
+  explain        Explain why a server proposal cannot land, with the next commands. Changes nothing
+  reviewers      Inspect, add or remove requested reviewers (no approval or access change)
+  review-draft   Save or restore your private account review notes without submitting them
+  comment-draft  Save or restore a private general comment without posting it
+  review         Review a proposal's current head
+  discussion     Read and participate in revision-bound line discussions
+  workspace      Inspect and explicitly sync server-side workspaces without a checkout
+  integrate      Integrate a proposal into its stream
+  close          Close a proposal without integrating it
+  streams        List streams
+  events         Show the events of the repository (replay), or follow them live
+  policy         Show or set a stream's policy
+  log            Show history of a revision on the server
+  blame          Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`
+  cat            Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`
 
 Options:
   -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
@@ -2862,6 +2867,124 @@ Options:
           Print version
 ```
 
+## ag remote comment-draft
+
+```text
+Save or restore a private general comment without posting it
+
+Usage: ag remote comment-draft [OPTIONS] <COMMAND>
+
+Commands:
+  get    Read your private draft and its version, including a cleared version
+  save   Save private notes; does not post a comment or advance the inspected head
+  clear  Clear only the private draft version you inspected
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote comment-draft get
+
+```text
+Read your private draft and its version, including a cleared version
+
+Usage: ag remote comment-draft get [OPTIONS] <ID>
+
+Arguments:
+  <ID>  Proposal id or unique prefix
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote comment-draft save
+
+```text
+Save private notes; does not post a comment or advance the inspected head
+
+Usage: ag remote comment-draft save [OPTIONS] --head <HEAD> --expected-version <EXPECTED_VERSION> <ID>
+
+Arguments:
+  <ID>  Proposal id or unique prefix
+
+Options:
+  -C, --repo <DIR>
+          Operate on the repository at this path (default: discovered from the current directory)
+      --head <HEAD>
+          Exact proposal head you inspected
+      --remote <REMOTE>
+          Remote to use (default: origin)
+      --as <IDENTITY>
+          Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+  -m, --message <MESSAGE>
+          Private comment notes [default: ""]
+      --body-file <PATH>
+          Read UTF-8 notes from this file, preserving line breaks (at most 16 KiB)
+      --json
+          Machine-readable JSON output
+      --color <WHEN>
+          Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+      --expected-version <EXPECTED_VERSION>
+          Version returned by get; use zero only after observing no draft
+  -q, --quiet
+          Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose
+          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+```
+
+## ag remote comment-draft clear
+
+```text
+Clear only the private draft version you inspected
+
+Usage: ag remote comment-draft clear [OPTIONS] --expected-version <EXPECTED_VERSION> <ID>
+
+Arguments:
+  <ID>  Proposal id or unique prefix
+
+Options:
+  -C, --repo <DIR>
+          Operate on the repository at this path (default: discovered from the current directory)
+      --expected-version <EXPECTED_VERSION>
+          Version returned by get; zero means no draft has existed
+      --remote <REMOTE>
+          Remote to use (default: origin)
+      --as <IDENTITY>
+          Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json
+          Machine-readable JSON output
+      --color <WHEN>
+          Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet
+          Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose
+          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+```
+
 ## ag remote review
 
 ```text
diff --git a/docs/reference/completions/_ag b/docs/reference/completions/_ag
index 74c25638..be623128 100644
--- a/docs/reference/completions/_ag
+++ b/docs/reference/completions/_ag
@@ -2593,6 +2593,107 @@ never\:"Never colour"))' \
     ;;
 esac
 ;;
+(comment-draft)
+_arguments "${_arguments_options[@]}" : \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+":: :_ag__subcmd__remote__subcmd__comment-draft_commands" \
+"*::: :->comment-draft" \
+&& ret=0
+
+    case $state in
+    (comment-draft)
+        words=($line[1] "${words[@]}")
+        (( CURRENT += 1 ))
+        curcontext="${curcontext%:*:*}:ag-remote-comment-draft-command-$line[1]:"
+        case $line[1] in
+            (get)
+_arguments "${_arguments_options[@]}" : \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':id -- Proposal id or unique prefix:_default' \
+&& ret=0
+;;
+(save)
+_arguments "${_arguments_options[@]}" : \
+'--head=[Exact proposal head you inspected]:HEAD:_default' \
+'(--body-file)-m+[Private comment notes]:MESSAGE:_default' \
+'(--body-file)--message=[Private comment notes]:MESSAGE:_default' \
+'--body-file=[Read UTF-8 notes from this file, preserving line breaks (at most 16 KiB)]:PATH:_files' \
+'--expected-version=[Version returned by get; use zero only after observing no draft]:EXPECTED_VERSION:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':id -- Proposal id or unique prefix:_default' \
+&& ret=0
+;;
+(clear)
+_arguments "${_arguments_options[@]}" : \
+'--expected-version=[Version returned by get; zero means no draft has existed]:EXPECTED_VERSION:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+':id -- Proposal id or unique prefix:_default' \
+&& ret=0
+;;
+        esac
+    ;;
+esac
+;;
 (review)
 _arguments "${_arguments_options[@]}" : \
 '-m+[Review text]:MESSAGE:_default' \
@@ -4045,6 +4146,7 @@ _ag__subcmd__remote_commands() {
 'explain:Explain why a server proposal cannot land, with the next commands. Changes nothing' \
 'reviewers:Inspect, add or remove requested reviewers (no approval or access change)' \
 'review-draft:Save or restore your private account review notes without submitting them' \
+'comment-draft:Save or restore a private general comment without posting it' \
 'review:Review a proposal'\''s current head' \
 'discussion:Read and participate in revision-bound line discussions' \
 'workspace:Inspect and explicitly sync server-side workspaces without a checkout' \
@@ -4079,6 +4181,30 @@ _ag__subcmd__remote__subcmd__close_commands() {
     local commands; commands=()
     _describe -t commands 'ag remote close commands' commands "$@"
 }
+(( $+functions[_ag__subcmd__remote__subcmd__comment-draft_commands] )) ||
+_ag__subcmd__remote__subcmd__comment-draft_commands() {
+    local commands; commands=(
+'get:Read your private draft and its version, including a cleared version' \
+'save:Save private notes; does not post a comment or advance the inspected head' \
+'clear:Clear only the private draft version you inspected' \
+    )
+    _describe -t commands 'ag remote comment-draft commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__comment-draft__subcmd__clear_commands] )) ||
+_ag__subcmd__remote__subcmd__comment-draft__subcmd__clear_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote comment-draft clear commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__comment-draft__subcmd__get_commands] )) ||
+_ag__subcmd__remote__subcmd__comment-draft__subcmd__get_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote comment-draft get commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__comment-draft__subcmd__save_commands] )) ||
+_ag__subcmd__remote__subcmd__comment-draft__subcmd__save_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote comment-draft save commands' commands "$@"
+}
 (( $+functions[_ag__subcmd__remote__subcmd__discussion_commands] )) ||
 _ag__subcmd__remote__subcmd__discussion_commands() {
     local commands; commands=(
diff --git a/docs/reference/completions/_ag.ps1 b/docs/reference/completions/_ag.ps1
index dcf222cf..ae776a30 100644
--- a/docs/reference/completions/_ag.ps1
+++ b/docs/reference/completions/_ag.ps1
@@ -1881,6 +1881,7 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('explain', 'explain', [CompletionResultType]::ParameterValue, 'Explain why a server proposal cannot land, with the next commands. Changes nothing')
             [CompletionResult]::new('reviewers', 'reviewers', [CompletionResultType]::ParameterValue, 'Inspect, add or remove requested reviewers (no approval or access change)')
             [CompletionResult]::new('review-draft', 'review-draft', [CompletionResultType]::ParameterValue, 'Save or restore your private account review notes without submitting them')
+            [CompletionResult]::new('comment-draft', 'comment-draft', [CompletionResultType]::ParameterValue, 'Save or restore a private general comment without posting it')
             [CompletionResult]::new('review', 'review', [CompletionResultType]::ParameterValue, 'Review a proposal''s current head')
             [CompletionResult]::new('discussion', 'discussion', [CompletionResultType]::ParameterValue, 'Read and participate in revision-bound line discussions')
             [CompletionResult]::new('workspace', 'workspace', [CompletionResultType]::ParameterValue, 'Inspect and explicitly sync server-side workspaces without a checkout')
@@ -2135,6 +2136,83 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
             break
         }
+        'ag;remote;comment-draft' {
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('get', 'get', [CompletionResultType]::ParameterValue, 'Read your private draft and its version, including a cleared version')
+            [CompletionResult]::new('save', 'save', [CompletionResultType]::ParameterValue, 'Save private notes; does not post a comment or advance the inspected head')
+            [CompletionResult]::new('clear', 'clear', [CompletionResultType]::ParameterValue, 'Clear only the private draft version you inspected')
+            break
+        }
+        'ag;remote;comment-draft;get' {
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;comment-draft;save' {
+            [CompletionResult]::new('--head', '--head', [CompletionResultType]::ParameterName, 'Exact proposal head you inspected')
+            [CompletionResult]::new('-m', '-m', [CompletionResultType]::ParameterName, 'Private comment notes')
+            [CompletionResult]::new('--message', '--message', [CompletionResultType]::ParameterName, 'Private comment notes')
+            [CompletionResult]::new('--body-file', '--body-file', [CompletionResultType]::ParameterName, 'Read UTF-8 notes from this file, preserving line breaks (at most 16 KiB)')
+            [CompletionResult]::new('--expected-version', '--expected-version', [CompletionResultType]::ParameterName, 'Version returned by get; use zero only after observing no draft')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;comment-draft;clear' {
+            [CompletionResult]::new('--expected-version', '--expected-version', [CompletionResultType]::ParameterName, 'Version returned by get; zero means no draft has existed')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
         'ag;remote;review' {
             [CompletionResult]::new('-m', '-m', [CompletionResultType]::ParameterName, 'Review text')
             [CompletionResult]::new('--message', '--message', [CompletionResultType]::ParameterName, 'Review text')
diff --git a/docs/reference/completions/ag.bash b/docs/reference/completions/ag.bash
index dfd49796..2168009b 100644
--- a/docs/reference/completions/ag.bash
+++ b/docs/reference/completions/ag.bash
@@ -322,6 +322,9 @@ _ag() {
             ag__subcmd__remote,close)
                 cmd="ag__subcmd__remote__subcmd__close"
                 ;;
+            ag__subcmd__remote,comment-draft)
+                cmd="ag__subcmd__remote__subcmd__comment__subcmd__draft"
+                ;;
             ag__subcmd__remote,discussion)
                 cmd="ag__subcmd__remote__subcmd__discussion"
                 ;;
@@ -373,6 +376,15 @@ _ag() {
             ag__subcmd__remote,workspace)
                 cmd="ag__subcmd__remote__subcmd__workspace"
                 ;;
+            ag__subcmd__remote__subcmd__comment__subcmd__draft,clear)
+                cmd="ag__subcmd__remote__subcmd__comment__subcmd__draft__subcmd__clear"
+                ;;
+            ag__subcmd__remote__subcmd__comment__subcmd__draft,get)
+                cmd="ag__subcmd__remote__subcmd__comment__subcmd__draft__subcmd__get"
+                ;;
+            ag__subcmd__remote__subcmd__comment__subcmd__draft,save)
+                cmd="ag__subcmd__remote__subcmd__comment__subcmd__draft__subcmd__save"
+                ;;
             ag__subcmd__remote__subcmd__discussion,list)
                 cmd="ag__subcmd__remote__subcmd__discussion__subcmd__list"
                 ;;
@@ -3497,7 +3509,7 @@ _ag() {
             return 0
             ;;
         ag__subcmd__remote)
-            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat"
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -3686,6 +3698,166 @@ _ag() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        ag__subcmd__remote__subcmd__comment__subcmd__draft)
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version get save clear"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__comment__subcmd__draft__subcmd__clear)
+            opts="-C -q -v -h -V --expected-version --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --expected-version)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__comment__subcmd__draft__subcmd__get)
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__comment__subcmd__draft__subcmd__save)
+            opts="-m -C -q -v -h -V --head --message --body-file --expected-version --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --head)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --message)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -m)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --body-file)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --expected-version)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         ag__subcmd__remote__subcmd__discussion)
             opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version list replies start reply resolve"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
diff --git a/docs/reference/completions/ag.elv b/docs/reference/completions/ag.elv
index 949c156c..e9681690 100644
--- a/docs/reference/completions/ag.elv
+++ b/docs/reference/completions/ag.elv
@@ -1780,6 +1780,7 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand explain 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
             cand reviewers 'Inspect, add or remove requested reviewers (no approval or access change)'
             cand review-draft 'Save or restore your private account review notes without submitting them'
+            cand comment-draft 'Save or restore a private general comment without posting it'
             cand review 'Review a proposal''s current head'
             cand discussion 'Read and participate in revision-bound line discussions'
             cand workspace 'Inspect and explicitly sync server-side workspaces without a checkout'
@@ -2020,6 +2021,79 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand -V 'Print version'
             cand --version 'Print version'
         }
+        &'ag;remote;comment-draft'= {
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+            cand get 'Read your private draft and its version, including a cleared version'
+            cand save 'Save private notes; does not post a comment or advance the inspected head'
+            cand clear 'Clear only the private draft version you inspected'
+        }
+        &'ag;remote;comment-draft;get'= {
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;comment-draft;save'= {
+            cand --head 'Exact proposal head you inspected'
+            cand -m 'Private comment notes'
+            cand --message 'Private comment notes'
+            cand --body-file 'Read UTF-8 notes from this file, preserving line breaks (at most 16 KiB)'
+            cand --expected-version 'Version returned by get; use zero only after observing no draft'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;comment-draft;clear'= {
+            cand --expected-version 'Version returned by get; zero means no draft has existed'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
         &'ag;remote;review'= {
             cand -m 'Review text'
             cand --message 'Review text'
diff --git a/docs/reference/completions/ag.fish b/docs/reference/completions/ag.fish
index 28446849..4ea5aa3e 100644
--- a/docs/reference/completions/ag.fish
+++ b/docs/reference/completions/ag.fish
@@ -1212,38 +1212,39 @@ complete -c ag -n "__fish_ag_using_subcommand push" -s q -l quiet -d 'Print only
 complete -c ag -n "__fish_ag_using_subcommand push" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand push" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand push" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
-always\t'Always colour'
-never\t'Never colour'"
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review-draft" -d 'Save or restore your private account review notes without submitting them'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "workspace" -d 'Inspect and explicitly sync server-side workspaces without a checkout'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review-draft" -d 'Save or restore your private account review notes without submitting them'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "comment-draft" -d 'Save or restore a private general comment without posting it'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "workspace" -d 'Inspect and explicitly sync server-side workspaces without a checkout'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l token-env -d 'Environment variable holding the credential' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l ca-file -d 'Extra CA certificate (PEM) to trust' -r -F
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l remote -d 'Remote to use (default: origin)' -r
@@ -1367,6 +1368,20 @@ complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -f -a "get" -d 'Read your private draft and its version, including a cleared version'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -f -a "save" -d 'Save private notes; does not submit a review or advance the inspected head'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -f -a "clear" -d 'Clear only the private draft version you inspected'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -f -a "get" -d 'Read your private draft and its version, including a cleared version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -f -a "save" -d 'Save private notes; does not post a comment or advance the inspected head'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -f -a "clear" -d 'Clear only the private draft version you inspected'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review" -s m -l message -d 'Review text' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review" -l remote -d 'Remote to use (default: origin)' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
diff --git a/docs/reference/man/ag-remote-comment-draft-clear.1 b/docs/reference/man/ag-remote-comment-draft-clear.1
new file mode 100644
index 00000000..499b0930
--- /dev/null
+++ b/docs/reference/man/ag-remote-comment-draft-clear.1
@@ -0,0 +1,45 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-comment-draft-clear 1  "clear 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-comment\-draft\-clear \- Clear only the private draft version you inspected
+.SH SYNOPSIS
+\fBag remote comment\-draft clear\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fB\-\-expected\-version\fR> <\fIID\fR>
+.SH DESCRIPTION
+Clear only the private draft version you inspected
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-expected\-version\fR \fI<EXPECTED_VERSION>\fR
+Version returned by get; zero means no draft has existed
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fIID\fR>
+Proposal id or unique prefix
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-comment-draft-get.1 b/docs/reference/man/ag-remote-comment-draft-get.1
new file mode 100644
index 00000000..ced919c6
--- /dev/null
+++ b/docs/reference/man/ag-remote-comment-draft-get.1
@@ -0,0 +1,42 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-comment-draft-get 1  "get 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-comment\-draft\-get \- Read your private draft and its version, including a cleared version
+.SH SYNOPSIS
+\fBag remote comment\-draft get\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fIID\fR>
+.SH DESCRIPTION
+Read your private draft and its version, including a cleared version
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fIID\fR>
+Proposal id or unique prefix
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-comment-draft-save.1 b/docs/reference/man/ag-remote-comment-draft-save.1
new file mode 100644
index 00000000..805fe419
--- /dev/null
+++ b/docs/reference/man/ag-remote-comment-draft-save.1
@@ -0,0 +1,54 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-comment-draft-save 1  "save 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-comment\-draft\-save \- Save private notes; does not post a comment or advance the inspected head
+.SH SYNOPSIS
+\fBag remote comment\-draft save\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-m\fR|\fB\-\-message\fR] [\fB\-\-body\-file\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fB\-\-head\fR> <\fB\-\-expected\-version\fR> <\fIID\fR>
+.SH DESCRIPTION
+Save private notes; does not post a comment or advance the inspected head
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-head\fR \fI<HEAD>\fR
+Exact proposal head you inspected
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-m\fR, \fB\-\-message\fR \fI<MESSAGE>\fR [default: ]
+Private comment notes
+.TP
+\fB\-\-body\-file\fR \fI<PATH>\fR
+Read UTF\-8 notes from this file, preserving line breaks (at most 16 KiB)
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-\-expected\-version\fR \fI<EXPECTED_VERSION>\fR
+Version returned by get; use zero only after observing no draft
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.TP
+<\fIID\fR>
+Proposal id or unique prefix
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-comment-draft.1 b/docs/reference/man/ag-remote-comment-draft.1
new file mode 100644
index 00000000..5bb859af
--- /dev/null
+++ b/docs/reference/man/ag-remote-comment-draft.1
@@ -0,0 +1,49 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-comment-draft 1  "comment-draft 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-comment\-draft \- Save or restore a private general comment without posting it
+.SH SYNOPSIS
+\fBag remote comment\-draft\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fIsubcommands\fR>
+.SH DESCRIPTION
+Save or restore a private general comment without posting it
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH SUBCOMMANDS
+.TP
+ag\-remote\-comment\-draft\-get(1)
+Read your private draft and its version, including a cleared version
+.TP
+ag\-remote\-comment\-draft\-save(1)
+Save private notes; does not post a comment or advance the inspected head
+.TP
+ag\-remote\-comment\-draft\-clear(1)
+Clear only the private draft version you inspected
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote.1 b/docs/reference/man/ag-remote.1
index 1588df33..428c9f3a 100644
--- a/docs/reference/man/ag-remote.1
+++ b/docs/reference/man/ag-remote.1
@@ -67,6 +67,9 @@ Inspect, add or remove requested reviewers (no approval or access change)
 ag\-remote\-review\-draft(1)
 Save or restore your private account review notes without submitting them
 .TP
+ag\-remote\-comment\-draft(1)
+Save or restore a private general comment without posting it
+.TP
 ag\-remote\-review(1)
 Review a proposal\*(Aqs current head
 .TP

From d1f19a3bdb3daf2cf72a0875192c43a31b24553c Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:33:35 +0000
Subject: [PATCH 25/41] feat(web): save discussion drafts across devices

---
 apps/web/e2e/account-comment-draft.spec.ts    |  95 ++++++
 apps/web/playwright.config.ts                 |   2 +-
 apps/web/src/api/endpoints.spec.ts            |  42 +++
 apps/web/src/api/endpoints.ts                 |  29 ++
 apps/web/src/api/schema.gen.ts                | 185 +++++++++++-
 apps/web/src/api/types.ts                     |   1 +
 .../proposal/ProposalComment.spec.ts          | 141 +++++++++
 .../components/proposal/ProposalComment.vue   |  83 +++++-
 .../useAccountCommentDraft.spec.ts            | 154 ++++++++++
 .../src/composables/useAccountCommentDraft.ts |  35 +++
 apps/web/src/composables/useAccountDraft.ts   | 235 +++++++++++++++
 .../src/composables/useAccountReviewDraft.ts  | 280 +++---------------
 12 files changed, 1028 insertions(+), 254 deletions(-)
 create mode 100644 apps/web/e2e/account-comment-draft.spec.ts
 create mode 100644 apps/web/src/components/proposal/ProposalComment.spec.ts
 create mode 100644 apps/web/src/composables/useAccountCommentDraft.spec.ts
 create mode 100644 apps/web/src/composables/useAccountCommentDraft.ts
 create mode 100644 apps/web/src/composables/useAccountDraft.ts

diff --git a/apps/web/e2e/account-comment-draft.spec.ts b/apps/web/e2e/account-comment-draft.spec.ts
new file mode 100644
index 00000000..32b66445
--- /dev/null
+++ b/apps/web/e2e/account-comment-draft.spec.ts
@@ -0,0 +1,95 @@
+import { test, expect } from './fixtures.ts'
+import { amend, commitFiles, freshRepo, openProposal } from './support/world.ts'
+
+test('account comment drafts cross devices, preserve newer work and require head reinspection', async ({
+  cast,
+  openAs,
+  allowConsole,
+}, info) => {
+  const { repo } = await freshRepo(cast, 'comment-account')
+  const author = cast.as('alice')
+  const change = await commitFiles(author, repo, { 'code.txt': 'first\n' }, 'Discuss source')
+  const proposal = await openProposal(author, repo, {
+    head: change.head,
+    title: 'Account discussion drafts',
+  })
+  const url = `/repos/${repo}/proposals/${proposal.id}?tab=reviews`
+  const path = `/v1/repos/${repo}/proposals/${proposal.id}/comment-draft`
+  const first = await openAs('alice')
+  await first.goto(url)
+  const firstText = first.getByRole('textbox', { name: 'Add to the discussion', exact: true })
+  await firstText.fill('Private reasoning from the first device')
+  await first.getByRole('button', { name: 'Save draft', exact: true }).click()
+  await expect(first.getByText('Draft saved to your account', { exact: true })).toBeVisible()
+  const stored = await author.ok_(author.get(path), 'read private comment draft')
+  expect(stored.body).toBe('Private reasoning from the first device')
+  const publicState = await author.ok_(
+    author.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'read shared proposal',
+  )
+  expect(publicState.reviews).toEqual([])
+  const other = await cast.as('bob').ok_(cast.as('bob').get(path), 'read another account draft')
+  expect(other.present).toBe(false)
+
+  const second = await openAs('alice')
+  await second.goto(url)
+  const secondText = second.getByRole('textbox', { name: 'Add to the discussion', exact: true })
+  await expect(secondText).toHaveValue(stored.body)
+  await firstText.fill('Newer work on first device')
+  await first.getByRole('button', { name: 'Save draft', exact: true }).click()
+  await expect
+    .poll(async () => (await author.ok_(author.get(path), 'read newer draft')).body)
+    .toBe('Newer work on first device')
+  await secondText.fill('Keep second device text')
+  allowConsole(/status of 412.*\/comment-draft(?:\?|\])/)
+  await second.getByRole('button', { name: 'Save draft', exact: true }).click()
+  await expect(
+    second.getByRole('button', { name: 'Reload account draft', exact: true }),
+  ).toBeVisible()
+  await expect(secondText).toHaveValue('Keep second device text')
+  await second.getByRole('button', { name: 'Reload account draft', exact: true }).click()
+  await expect(second.getByText('An account draft is available', { exact: true })).toBeVisible()
+  await second.getByRole('button', { name: 'Keep tab draft', exact: true }).click()
+  await second.getByRole('button', { name: 'Save draft', exact: true }).click()
+  await expect
+    .poll(async () => (await author.ok_(author.get(path), 'read replaced draft')).body)
+    .toBe('Keep second device text')
+
+  const next = await amend(author, repo, change.workspace, { 'code.txt': 'second\n' }, 'New head')
+  await author.ok_(
+    author.patch(`/v1/repos/${repo}/proposals/${proposal.id}`, { new_head: next.head }),
+    'advance proposal',
+  )
+  const third = await openAs('alice')
+  await third.goto(url)
+  const thirdText = third.getByRole('textbox', { name: 'Add to the discussion', exact: true })
+  await expect(thirdText).toHaveValue('Keep second device text')
+  await expect(third.getByRole('button', { name: 'Add comment', exact: true })).toBeDisabled()
+  await third.screenshot({ path: info.outputPath('account-comment-draft.png'), fullPage: true })
+  await third
+    .getByRole('button', { name: 'I have inspected the current changes', exact: true })
+    .click()
+  await third.getByRole('button', { name: 'Add comment', exact: true }).click()
+  await expect(thirdText).toHaveValue('')
+  await expect
+    .poll(async () => (await author.ok_(author.get(path), 'read cleared draft')).present)
+    .toBe(false)
+  const posted = await author.ok_(
+    author.get(`/v1/repos/${repo}/proposals/${proposal.id}`),
+    'read posted comment',
+  )
+  expect(posted.reviews).toHaveLength(1)
+  expect(posted.reviews[0].body).toBe('Keep second device text')
+  expect(posted.reviews[0].head).toBe(next.head)
+
+  await author.ok_(
+    author.post(`/v1/repos/${repo}/proposals/${proposal.id}/close`),
+    'close proposal',
+  )
+  await third.reload()
+  await thirdText.fill('Follow-up on a closed proposal')
+  await third.getByRole('button', { name: 'Save draft', exact: true }).click()
+  await expect
+    .poll(async () => (await author.ok_(author.get(path), 'closed proposal draft')).body)
+    .toBe('Follow-up on a closed proposal')
+})
diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts
index 22669daa..72490f00 100644
--- a/apps/web/playwright.config.ts
+++ b/apps/web/playwright.config.ts
@@ -26,7 +26,7 @@ const screenshots = /screenshots\.spec\.ts/
 // Layout assertions are made at the viewports of the tablet and phone projects, not at desktop size.
 const layout = /responsive\.spec\.ts/
 const small =
-  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|nontext-conflicts|rename-conflicts|structural-conflicts|review-requests|required-discussions|draft-recovery|review-drafts|account-review-draft|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
+  /(responsive|accessibility|code-workflows|code-search|task-details|task-history|review-workbench|review-threads|review-suggestions|nontext-conflicts|rename-conflicts|structural-conflicts|review-requests|required-discussions|draft-recovery|review-drafts|account-review-draft|account-comment-draft|multi-file-edit|execution-control|proposal-comments|run-details|run-recovery|task-assignment|task-refinement|task-attempt-limit|home-live|policy-controls|executor-presence|executor-setup|run-output)\.spec\.ts/
 const desktop = { viewport: { width: 1440, height: 900 } }
 
 export default defineConfig({
diff --git a/apps/web/src/api/endpoints.spec.ts b/apps/web/src/api/endpoints.spec.ts
index b99fcca7..e95dc680 100644
--- a/apps/web/src/api/endpoints.spec.ts
+++ b/apps/web/src/api/endpoints.spec.ts
@@ -219,3 +219,45 @@ it('sends the clear-draft version in a DELETE query, including zero', async () =
   expect(options?.method).toBe('DELETE')
   expect(options?.body).toBeUndefined()
 })
+
+it('keeps account comment drafts distinct from reviews and sends private text only in the body', async () => {
+  const request = vi
+    .fn<typeof fetch>()
+    .mockImplementation(
+      async () => new Response('{}', { headers: { 'content-type': 'application/json' } }),
+    )
+  const client = new ApiClient({ getToken: () => 'current-session', fetch: request })
+  const proposals = createApi(client).proposals
+  await proposals.commentDraft('acme/repo', 'p/one', { token: 'captured-session' })
+  await proposals.saveCommentDraft(
+    'acme/repo',
+    'p/one',
+    { head: 'inspected', body: 'unsubmitted notes', expected_version: 7 },
+    { token: 'captured-session' },
+  )
+  expect(request.mock.calls).toHaveLength(2)
+  for (const [url, options] of request.mock.calls) {
+    expect(String(url)).toContain('/proposals/p%2Fone/comment-draft')
+    expect(String(url)).not.toContain('unsubmitted')
+    expect(new Headers(options?.headers).get('authorization')).toBe('Bearer captured-session')
+  }
+  const [, saved] = request.mock.calls[1]!
+  expect(saved?.method).toBe('PUT')
+  expect(JSON.parse(String(saved?.body))).toEqual({
+    head: 'inspected',
+    body: 'unsubmitted notes',
+    expected_version: 7,
+  })
+})
+
+it('clears a private comment draft using its inspected version query', async () => {
+  const request = vi
+    .fn<typeof fetch>()
+    .mockResolvedValue(new Response('{}', { headers: { 'content-type': 'application/json' } }))
+  const client = new ApiClient({ getToken: () => 'session', fetch: request })
+  await createApi(client).proposals.clearCommentDraft('acme/repo', 'p/one', 0)
+  const [url, options] = request.mock.calls[0]!
+  expect(String(url)).toContain('/proposals/p%2Fone/comment-draft?expected_version=0')
+  expect(options?.method).toBe('DELETE')
+  expect(options?.body).toBeUndefined()
+})
diff --git a/apps/web/src/api/endpoints.ts b/apps/web/src/api/endpoints.ts
index 0b4ba535..589dae47 100644
--- a/apps/web/src/api/endpoints.ts
+++ b/apps/web/src/api/endpoints.ts
@@ -34,6 +34,7 @@ import type {
   Req,
   Review,
   ReviewDraft,
+  CommentDraft,
   ReviewThread,
   ThreadComment,
   RoleBinding,
@@ -297,6 +298,34 @@ export function createApi(c: ApiClient) {
           { expected_version: expectedVersion },
           options,
         ),
+      commentDraft: (repo: string, id: string, options?: SessionOpts) =>
+        c.get<CommentDraft>(
+          r(repo, `/proposals/${encodeURIComponent(id)}/comment-draft`),
+          undefined,
+          options,
+        ),
+      saveCommentDraft: (
+        repo: string,
+        id: string,
+        body: { head: string; body: string; expected_version: number },
+        options?: SessionOpts,
+      ) =>
+        c.json<CommentDraft>(r(repo, `/proposals/${encodeURIComponent(id)}/comment-draft`), {
+          ...options,
+          method: 'PUT',
+          body,
+        }),
+      clearCommentDraft: (
+        repo: string,
+        id: string,
+        expectedVersion: number,
+        options?: SessionOpts,
+      ) =>
+        c.del<CommentDraft>(
+          r(repo, `/proposals/${encodeURIComponent(id)}/comment-draft`),
+          { expected_version: expectedVersion },
+          options,
+        ),
       setReviewers: (
         repo: string,
         id: string,
diff --git a/apps/web/src/api/schema.gen.ts b/apps/web/src/api/schema.gen.ts
index d7c27c8e..2aed6046 100644
--- a/apps/web/src/api/schema.gen.ts
+++ b/apps/web/src/api/schema.gen.ts
@@ -885,6 +885,25 @@ export interface paths {
     patch?: never
     trace?: never
   }
+  '/v1/repos/{owner}/{rname}/proposals/{id}/comment-draft': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /** Read your private comment draft */
+    get: operations['proposal.get_comment_draft']
+    /** Save your private comment draft */
+    put: operations['proposal.save_comment_draft']
+    post?: never
+    /** Clear the inspected private comment draft */
+    delete: operations['proposal.clear_comment_draft']
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
   '/v1/repos/{owner}/{rname}/proposals/{id}/comments': {
     parameters: {
       query?: never
@@ -1995,6 +2014,17 @@ export interface components {
       /** @default null */
       job: components['schemas']['Job'] | null
     }
+    ClearCommentDraftRequest: {
+      /**
+       * Format: int64
+       * @default 0
+       */
+      expected_version: number
+      /** @default  */
+      id: string
+      /** @default  */
+      repo: string
+    }
     ClearReviewDraftRequest: {
       /**
        * Format: int64
@@ -2017,6 +2047,25 @@ export interface components {
       /** @default  */
       repo: string
     }
+    /** @description Private, unsubmitted general discussion notes for the current acting identity. */
+    CommentDraft: {
+      /** @default  */
+      body: string
+      /** @default  */
+      head: string
+      /** @default false */
+      present: boolean
+      /**
+       * Format: int64
+       * @default 0
+       */
+      updated_at_ms: number
+      /**
+       * Format: int64
+       * @default 0
+       */
+      version: number
+    }
     /** @description A discussion entry, never an approval or a request-changes vote. */
     CommentProposalRequest: {
       /** @default  */
@@ -2153,7 +2202,8 @@ export interface components {
        */
       complete: boolean
       /**
-       * @description Ordered candidate entries, including the root. At most 100 paths per root and 1000 in one response.
+       * @description Ordered candidate entries; a complete scope includes the root.
+       *     At most 100 paths per root and 1000 in one response. Incomplete scopes may be empty.
        * @default []
        */
       paths: string[]
@@ -2764,6 +2814,12 @@ export interface components {
        */
       rev: string
     }
+    GetCommentDraftRequest: {
+      /** @default  */
+      id: string
+      /** @default  */
+      repo: string
+    }
     GetIssueRequest: {
       /**
        * Format: int64
@@ -4667,6 +4723,22 @@ export interface components {
        */
       timeout_secs: number
     }
+    SaveCommentDraftRequest: {
+      /** @default  */
+      body: string
+      /**
+       * Format: int64
+       * @description Zero means no prior draft; all saves compare this version atomically.
+       * @default 0
+       */
+      expected_version: number
+      /** @default  */
+      head: string
+      /** @default  */
+      id: string
+      /** @default  */
+      repo: string
+    }
     SaveReviewDraftRequest: {
       /** @default  */
       body: string
@@ -7594,6 +7666,117 @@ export interface operations {
       }
     }
   }
+  'proposal.get_comment_draft': {
+    parameters: {
+      query?: never
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+        id: string
+      }
+      cookie?: never
+    }
+    requestBody?: never
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['CommentDraft']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
+  'proposal.save_comment_draft': {
+    parameters: {
+      query?: never
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+        id: string
+      }
+      cookie?: never
+    }
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SaveCommentDraftRequest']
+      }
+    }
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['CommentDraft']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
+  'proposal.clear_comment_draft': {
+    parameters: {
+      query?: {
+        expected_version?: number
+      }
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+        id: string
+      }
+      cookie?: never
+    }
+    requestBody?: never
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['CommentDraft']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
   'proposal.comment': {
     parameters: {
       query?: never
diff --git a/apps/web/src/api/types.ts b/apps/web/src/api/types.ts
index c8f24682..4206fbe5 100644
--- a/apps/web/src/api/types.ts
+++ b/apps/web/src/api/types.ts
@@ -28,6 +28,7 @@ export type SearchMatch = S['SearchMatch']
 export type Proposal = S['Proposal']
 export type Review = S['Review']
 export type ReviewDraft = S['ReviewDraft']
+export type CommentDraft = S['CommentDraft']
 export type ReviewThread = S['ReviewThread']
 export type ThreadComment = S['ThreadComment']
 export type ReviewLineAnchor = S['ReviewLineAnchor']
diff --git a/apps/web/src/components/proposal/ProposalComment.spec.ts b/apps/web/src/components/proposal/ProposalComment.spec.ts
new file mode 100644
index 00000000..6ff8f4b8
--- /dev/null
+++ b/apps/web/src/components/proposal/ProposalComment.spec.ts
@@ -0,0 +1,141 @@
+import { enableAutoUnmount, flushPromises, mount } from '@vue/test-utils'
+import { reactive } from 'vue'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import ProposalComment from './ProposalComment.vue'
+import type { Proposal } from '@/api/types'
+enableAutoUnmount(afterEach)
+const api = vi.hoisted(() => ({
+  comment: vi.fn(),
+  commentDraft: vi.fn(),
+  saveCommentDraft: vi.fn(),
+  clearCommentDraft: vi.fn(),
+}))
+vi.mock('@/api/instance', () => ({ api: { proposals: api } }))
+const toasts = vi.hoisted(() => ({ ok: vi.fn(), info: vi.fn(), warn: vi.fn() }))
+vi.mock('@/stores/toasts', () => ({ useToasts: () => toasts }))
+const auth = reactive({
+  identity: 'user:alice',
+  token: 'token',
+  status: 'ready',
+  can: () => true,
+  capabilities: { features: ['proposals.comments', 'proposals.comment_drafts'] },
+})
+vi.mock('@/stores/auth', () => ({ useAuth: () => auth }))
+const empty = { present: false, version: 0, head: '', body: '', updated_at_ms: 0 }
+const saved = { present: true, version: 2, head: 'old', body: 'Account comment', updated_at_ms: 1 }
+const proposal = { id: 'p', head: 'current' } as Proposal
+const show = () => mount(ProposalComment, { props: { repo: 'r', proposal } })
+beforeEach(() => {
+  sessionStorage.clear()
+  auth.identity = 'user:alice'
+  auth.token = 'token'
+  auth.capabilities.features = ['proposals.comments', 'proposals.comment_drafts']
+  api.commentDraft.mockReset().mockResolvedValue(empty)
+  api.saveCommentDraft.mockReset().mockResolvedValue(saved)
+  api.clearCommentDraft.mockReset().mockResolvedValue(empty)
+  api.comment.mockReset().mockResolvedValue({})
+  Object.values(toasts).forEach((mock) => mock.mockClear())
+})
+it('explicitly saves the account draft without publishing or clearing local text', async () => {
+  const w = show()
+  await flushPromises()
+  await w.get('textarea').setValue('Draft')
+  await w
+    .findAll('button')
+    .find((b) => b.text() === 'Save draft')!
+    .trigger('click')
+  await flushPromises()
+  expect(api.saveCommentDraft).toHaveBeenCalledWith(
+    'r',
+    'p',
+    { body: 'Draft', head: 'current', expected_version: 0 },
+    expect.objectContaining({ token: 'token' }),
+  )
+  expect(api.comment).not.toHaveBeenCalled()
+  expect(w.get('textarea').element.value).toBe('Draft')
+})
+it('restores account text but requires reinspection of an old head before posting', async () => {
+  api.commentDraft.mockResolvedValue(saved)
+  const w = show()
+  await flushPromises()
+  expect(w.get('textarea').element.value).toBe(saved.body)
+  expect(w.text()).toContain('earlier head')
+  expect(
+    w
+      .findAll('button')
+      .find((b) => b.text() === 'Add comment')!
+      .attributes('aria-disabled'),
+  ).toBe('true')
+})
+it('successful publication stays successful if account cleanup encounters newer work', async () => {
+  api.commentDraft.mockResolvedValue({ ...saved, head: 'current' })
+  api.clearCommentDraft.mockRejectedValue(new Error('newer draft'))
+  const w = show()
+  await flushPromises()
+  await w.trigger('submit')
+  await flushPromises()
+  expect(api.comment).toHaveBeenCalledTimes(1)
+  expect(api.clearCommentDraft).toHaveBeenCalledWith(
+    'r',
+    'p',
+    2,
+    expect.objectContaining({ token: 'token' }),
+  )
+  expect(w.emitted('done')).toHaveLength(1)
+  expect(w.get('textarea').element.value).toBe('')
+  expect(toasts.warn).toHaveBeenCalled()
+  expect(w.text()).not.toContain('newer draft')
+})
+it('keeps tab-only fallback on older servers', async () => {
+  auth.capabilities.features = ['proposals.comments']
+  const w = show()
+  await flushPromises()
+  expect(w.text()).not.toContain('Save draft')
+  expect(api.commentDraft).not.toHaveBeenCalled()
+})
+it('keeps a different account draft when publishing the tab draft', async () => {
+  const key = `agentgit.proposal-comment.v1:${JSON.stringify(['user:alice', 'r', 'p'])}`
+  sessionStorage.setItem(
+    key,
+    JSON.stringify({ version: 1, body: 'Tab comment', head: 'current', requestId: 'request' }),
+  )
+  api.commentDraft.mockResolvedValue({ ...saved, head: 'current' })
+  const w = show()
+  await flushPromises()
+  expect(w.text()).toContain('An account draft is available')
+  expect(w.get('textarea').element.value).toBe('Tab comment')
+  await w
+    .findAll('button')
+    .find((b) => b.text() === 'Keep tab draft')!
+    .trigger('click')
+  await w.trigger('submit')
+  await flushPromises()
+  expect(api.comment).toHaveBeenCalledTimes(1)
+  expect(api.clearCommentDraft).not.toHaveBeenCalled()
+})
+it('ignores a post response after switching accounts without clearing the new account draft', async () => {
+  let finish!: () => void
+  api.comment.mockImplementationOnce(
+    () =>
+      new Promise<void>((resolve) => {
+        finish = resolve
+      }),
+  )
+  api.commentDraft.mockResolvedValue({ ...saved, head: 'current' })
+  const w = show()
+  await flushPromises()
+  await w.trigger('submit')
+  expect(api.comment).toHaveBeenCalledWith(
+    'r',
+    'p',
+    expect.anything(),
+    expect.objectContaining({ token: 'token' }),
+  )
+  auth.identity = 'user:bob'
+  auth.token = 'bob-token'
+  await flushPromises()
+  finish()
+  await flushPromises()
+  expect(api.clearCommentDraft).not.toHaveBeenCalled()
+  expect(w.emitted('done')).toBeUndefined()
+})
diff --git a/apps/web/src/components/proposal/ProposalComment.vue b/apps/web/src/components/proposal/ProposalComment.vue
index 4c8e6cf7..7c4434b1 100644
--- a/apps/web/src/components/proposal/ProposalComment.vue
+++ b/apps/web/src/components/proposal/ProposalComment.vue
@@ -7,6 +7,7 @@ import { describeError } from '@/api/errors'
 import { useAuth } from '@/stores/auth'
 import { useToasts } from '@/stores/toasts'
 import { useCommentDraft } from '@/composables/useCommentDraft'
+import { useAccountCommentDraft } from '@/composables/useAccountCommentDraft'
 import Alert from '@/ui/Alert.vue'
 import Button from '@/ui/Button.vue'
 import TextArea from '@/ui/TextArea.vue'
@@ -26,6 +27,12 @@ const draft = useCommentDraft(
   () => (auth.identity ? JSON.stringify([auth.identity, props.repo, props.proposal.id]) : ''),
   () => props.proposal.head,
 )
+const account = useAccountCommentDraft({
+  repo: () => props.repo,
+  proposal: () => props.proposal.id,
+  open: () => supported.value && allowed.value,
+  local: draft,
+})
 const form = ref<HTMLFormElement | null>(null)
 watch(
   () => props.quote,
@@ -61,10 +68,23 @@ onBeforeUnmount(() => {
   generation++
   controller?.abort()
 })
+async function saveToAccount() {
+  if (busy.value) return
+  if (await account.save()) toasts.ok('Draft saved to your account')
+}
 async function submit() {
-  if (busy.value || !supported.value || !allowed.value || stale.value || !draft.body.value.trim())
+  if (
+    busy.value ||
+    account.loading.value ||
+    account.saving.value ||
+    !supported.value ||
+    !allowed.value ||
+    stale.value ||
+    !draft.body.value.trim()
+  )
     return
   const mine = generation
+  const cleanupVersion = account.cleanupVersion()
   controller = new AbortController()
   busy.value = true
   error.value = ''
@@ -86,6 +106,10 @@ async function submit() {
     if (mine !== generation) return
     draft.clear()
     toasts.ok('Comment added')
+    const cleanupError = await account.clearAfterSubmit(cleanupVersion)
+    if (mine !== generation) return
+    if (cleanupError)
+      toasts.warn(`Comment added, but the account draft could not be cleared: ${cleanupError}`)
     emit('done')
   } catch (cause) {
     if (mine === generation) error.value = describeError(cause)
@@ -101,9 +125,32 @@ async function submit() {
       v-model="draft.body.value"
       label="Add to the discussion"
       :rows="4"
-      :disabled="busy"
-      hint="Comments do not approve changes. Your draft is saved in this tab."
+      :disabled="busy || account.loading.value"
+      :hint="
+        account.supported.value
+          ? 'Comments do not approve changes. Drafts stay in this tab until you save them to your account.'
+          : 'Comments do not approve changes. Your draft is saved in this tab.'
+      "
     />
+    <Alert v-if="account.available.value" tone="info" title="An account draft is available">
+      Keep your tab draft or restore the saved account draft.
+      <div class="draft-actions">
+        <Button size="sm" :disabled="busy" @click="account.useAccount()"
+          >Restore account draft</Button
+        >
+        <Button size="sm" :disabled="busy" @click="account.keepLocal()">Keep tab draft</Button>
+      </div>
+    </Alert>
+    <Alert v-else-if="account.restored.value" tone="info">Your account draft was restored.</Alert>
+    <Alert v-if="account.error.value" tone="warn">
+      {{ account.error.value }}
+      <Button
+        size="sm"
+        :disabled="busy || account.loading.value || account.saving.value"
+        @click="account.load()"
+        >Reload account draft</Button
+      >
+    </Alert>
     <Alert v-if="draft.error.value" tone="warn">{{ draft.error.value }}</Alert>
     <Alert v-if="stale" tone="warn" title="The change request has a new head">
       Your draft refers to an earlier head. Inspect the current changes before posting.
@@ -112,13 +159,24 @@ async function submit() {
       >
     </Alert>
     <Alert v-if="error" tone="bad" live="alert">{{ error }}</Alert>
-    <Button
-      type="submit"
-      variant="primary"
-      :loading="busy"
-      :disabled="stale || !draft.body.value.trim()"
-      >Add comment</Button
-    >
+    <div class="draft-actions">
+      <Button
+        type="submit"
+        variant="primary"
+        :loading="busy"
+        :disabled="
+          stale || !draft.body.value.trim() || account.loading.value || account.saving.value
+        "
+        >Add comment</Button
+      >
+      <Button
+        v-if="account.supported.value"
+        :loading="account.saving.value"
+        :disabled="busy || !account.canSave.value"
+        @click="saveToAccount"
+        >Save draft</Button
+      >
+    </div>
   </form>
 </template>
 
@@ -129,6 +187,11 @@ async function submit() {
   align-items: start;
   gap: var(--s-3);
 }
+.draft-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--s-2);
+}
 .comment-form :deep(.field) {
   width: 100%;
 }
diff --git a/apps/web/src/composables/useAccountCommentDraft.spec.ts b/apps/web/src/composables/useAccountCommentDraft.spec.ts
new file mode 100644
index 00000000..8f5595f1
--- /dev/null
+++ b/apps/web/src/composables/useAccountCommentDraft.spec.ts
@@ -0,0 +1,154 @@
+import { effectScope, reactive, ref } from 'vue'
+import { flushPromises } from '@vue/test-utils'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { useAccountCommentDraft } from './useAccountCommentDraft'
+import { ApiError } from '@/api/errors'
+const api = vi.hoisted(() => ({
+  commentDraft: vi.fn(),
+  saveCommentDraft: vi.fn(),
+  clearCommentDraft: vi.fn(),
+}))
+vi.mock('@/api/instance', () => ({ api: { proposals: api } }))
+const auth = reactive({
+  identity: 'user:alice',
+  token: 'token',
+  status: 'ready',
+  capabilities: { features: ['proposals.comment_drafts'] },
+})
+vi.mock('@/stores/auth', () => ({ useAuth: () => auth }))
+const empty = { present: false, version: 0, head: '', body: '', updated_at_ms: 0 }
+const saved = { present: true, version: 2, head: 'old', body: 'Account notes', updated_at_ms: 1 }
+const scopes: ReturnType<typeof effectScope>[] = []
+afterEach(() => scopes.splice(0).forEach((s) => s.stop()))
+beforeEach(() => {
+  auth.identity = 'user:alice'
+  auth.token = 'token'
+  auth.capabilities.features = ['proposals.comment_drafts']
+  api.commentDraft.mockReset().mockResolvedValue(empty)
+  api.saveCommentDraft.mockReset().mockResolvedValue(saved)
+  api.clearCommentDraft.mockReset().mockResolvedValue({ ...empty, version: 3 })
+})
+function show(body = '') {
+  const scope = effectScope()
+  scopes.push(scope)
+  const local = { body: ref(body), head: ref('current') }
+  const draft = scope.run(() =>
+    useAccountCommentDraft({ repo: () => 'r', proposal: () => 'p', open: () => true, local }),
+  )!
+  return { draft, local }
+}
+it('restores only empty local content and keeps the inspected head', async () => {
+  api.commentDraft.mockResolvedValue(saved)
+  const { local } = show()
+  await flushPromises()
+  expect(local.body.value).toBe(saved.body)
+  expect(local.head.value).toBe('old')
+  expect(api.saveCommentDraft).not.toHaveBeenCalled()
+})
+it('keeps differing local content until explicitly adopting the account draft', async () => {
+  api.commentDraft.mockResolvedValue(saved)
+  const { draft, local } = show('Local')
+  await flushPromises()
+  expect(local.body.value).toBe('Local')
+  expect(draft.canSave.value).toBe(false)
+  draft.useAccount()
+  expect(local.body.value).toBe(saved.body)
+  expect(draft.cleanupVersion()).toBe(2)
+})
+it('rejects oversized UTF8 notes and uses the fetched version for explicit saves', async () => {
+  const { draft, local } = show('Notes')
+  await flushPromises()
+  local.body.value = 'я'.repeat(8193)
+  expect(await draft.save()).toBe(false)
+  expect(api.saveCommentDraft).not.toHaveBeenCalled()
+  local.body.value = 'Notes'
+  expect(await draft.save()).toBe(true)
+  expect(api.saveCommentDraft).toHaveBeenCalledWith(
+    'r',
+    'p',
+    { head: 'current', body: 'Notes', expected_version: 0 },
+    expect.objectContaining({ token: 'token' }),
+  )
+})
+it('ignores a load completing after account change', async () => {
+  let finish!: (v: typeof saved) => void
+  api.commentDraft.mockImplementationOnce(() => new Promise((r) => (finish = r)))
+  const { local } = show()
+  auth.identity = 'user:other'
+  auth.token = 'other'
+  await flushPromises()
+  finish(saved)
+  await flushPromises()
+  expect(local.body.value).toBe('')
+})
+it('never clears a different account draft and treats cleanup conflicts as a warning', async () => {
+  api.commentDraft.mockResolvedValue(saved)
+  const { draft } = show('Local')
+  await flushPromises()
+  draft.keepLocal()
+  expect(draft.cleanupVersion()).toBe(null)
+  expect(await draft.clearAfterSubmit()).toBe('')
+  expect(api.clearCommentDraft).not.toHaveBeenCalled()
+  await draft.load()
+  draft.useAccount()
+  api.clearCommentDraft.mockRejectedValue(new Error('Newer draft'))
+  expect(await draft.clearAfterSubmit()).toContain('Newer draft')
+})
+it('does not call account APIs on older servers', async () => {
+  auth.capabilities.features = []
+  const { draft } = show()
+  await flushPromises()
+  expect(draft.supported.value).toBe(false)
+  expect(api.commentDraft).not.toHaveBeenCalled()
+})
+it('preserves text typed while the account load is pending', async () => {
+  let finish!: (v: typeof saved) => void
+  api.commentDraft.mockImplementationOnce(() => new Promise((r) => (finish = r)))
+  const { local, draft } = show()
+  local.body.value = 'Typed while loading'
+  finish(saved)
+  await flushPromises()
+  expect(local.body.value).toBe('Typed while loading')
+  expect(draft.available.value).toEqual(saved)
+})
+it('cleans up the submitted version even if later local work changes the account version', async () => {
+  api.commentDraft.mockResolvedValue(saved)
+  const { draft } = show()
+  await flushPromises()
+  const submittedVersion = draft.cleanupVersion()
+  api.saveCommentDraft.mockResolvedValue({ ...saved, version: 3 })
+  await draft.save()
+  await draft.clearAfterSubmit(submittedVersion)
+  expect(api.clearCommentDraft).toHaveBeenCalledWith(
+    'r',
+    'p',
+    2,
+    expect.objectContaining({ token: 'token' }),
+  )
+})
+
+it('accepts exactly 16 KiB of UTF8 text', async () => {
+  const { draft } = show('я'.repeat(8192))
+  await flushPromises()
+  expect(await draft.save()).toBe(true)
+  expect(api.saveCommentDraft).toHaveBeenCalledTimes(1)
+})
+it('requires reload after a conflicting save without discarding local work', async () => {
+  const { draft, local } = show('Keep my comment')
+  await flushPromises()
+  api.saveCommentDraft.mockRejectedValue(
+    new ApiError({
+      status: 412,
+      code: 'failed_precondition',
+      message: 'Another device saved a draft',
+    }),
+  )
+  expect(await draft.save()).toBe(false)
+  expect(draft.canSave.value).toBe(false)
+  expect(local.body.value).toBe('Keep my comment')
+  api.commentDraft.mockResolvedValue(saved)
+  await draft.load()
+  expect(draft.available.value?.body).toBe(saved.body)
+  draft.keepLocal()
+  expect(draft.canSave.value).toBe(true)
+})
diff --git a/apps/web/src/composables/useAccountCommentDraft.ts b/apps/web/src/composables/useAccountCommentDraft.ts
new file mode 100644
index 00000000..d50ce4fe
--- /dev/null
+++ b/apps/web/src/composables/useAccountCommentDraft.ts
@@ -0,0 +1,35 @@
+import type { Ref } from 'vue'
+import { api } from '@/api/instance'
+import { useAccountDraft } from './useAccountDraft'
+type AccountDraft = Awaited<ReturnType<typeof api.proposals.commentDraft>>
+type Content = { head: string; body: string }
+interface Options {
+  repo: () => string
+  proposal: () => string
+  open: () => boolean
+  local: { head: Ref<string>; body: Ref<string> }
+}
+/** Private account storage for one proposal comment. */
+export function useAccountCommentDraft(options: Options) {
+  const local = options.local
+  return useAccountDraft<AccountDraft, Content>({
+    ...options,
+    capability: 'proposals.comment_drafts',
+    maxBytes: 16 * 1024,
+    sizeError:
+      'Account discussion drafts are limited to 16 KiB. Keep a local copy of longer notes.',
+    content: () => ({ head: local.head.value, body: local.body.value }),
+    same: (draft) => local.head.value === draft.head && local.body.value === draft.body,
+    empty: () => !local.body.value,
+    validate: () => {},
+    apply: (draft) => {
+      local.head.value = draft.head
+      local.body.value = draft.body
+    },
+    read: (request) => api.proposals.commentDraft(options.repo(), options.proposal(), request),
+    write: (content, request) =>
+      api.proposals.saveCommentDraft(options.repo(), options.proposal(), content, request),
+    remove: (version, request) =>
+      api.proposals.clearCommentDraft(options.repo(), options.proposal(), version, request),
+  })
+}
diff --git a/apps/web/src/composables/useAccountDraft.ts b/apps/web/src/composables/useAccountDraft.ts
new file mode 100644
index 00000000..58804848
--- /dev/null
+++ b/apps/web/src/composables/useAccountDraft.ts
@@ -0,0 +1,235 @@
+import { computed, onScopeDispose, ref, shallowRef, watch } from 'vue'
+import type { ComputedRef } from 'vue'
+import type { RequestOptions } from '@/api/client'
+import { ApiError, describeError } from '@/api/errors'
+import { useAuth } from '@/stores/auth'
+
+type SessionOpts = Pick<RequestOptions, 'token' | 'signal' | 'quietUnauthenticated'>
+
+interface StoredDraft {
+  present: boolean
+  version: number
+  head: string
+  body: string
+}
+interface Content {
+  head: string
+  body: string
+}
+interface Options<D extends StoredDraft, C extends Content> {
+  repo: () => string
+  proposal: () => string
+  open: () => boolean
+  capability: string
+  maxBytes: number
+  sizeError: string
+  content: () => C
+  same: (draft: D) => boolean
+  empty: () => boolean
+  apply: (draft: D) => void
+  validate: (draft: D) => void
+  read: (request: SessionOpts) => Promise<D>
+  write: (content: C & { expected_version: number }, request: SessionOpts) => Promise<D>
+  remove: (version: number, request: SessionOpts) => Promise<D>
+}
+
+class AccountDraftState<D extends StoredDraft, C extends Content> {
+  readonly loading = ref(false)
+  readonly saving = ref(false)
+  readonly loaded = ref(false)
+  readonly error = ref('')
+  readonly restored = ref(false)
+  readonly available = shallowRef<D | null>(null)
+  readonly supported: ComputedRef<boolean>
+  readonly version: ComputedRef<number | null>
+  readonly canSave: ComputedRef<boolean>
+  private remote = shallowRef<D | null>(null)
+  private readonly conflicted = ref(false)
+  private generation = 0
+  private adoptedVersion: number | null = null
+  private controller: AbortController | undefined
+
+  constructor(
+    private options: Options<D, C>,
+    private auth: ReturnType<typeof useAuth>,
+  ) {
+    this.supported = computed(() => !!auth.capabilities?.features.includes(options.capability))
+    this.version = computed(() => this.remote.value?.version ?? null)
+    this.canSave = computed(() => this.readyToSave())
+  }
+  private readyToSave() {
+    return (
+      this.supported.value &&
+      this.loaded.value &&
+      !this.loading.value &&
+      !this.saving.value &&
+      !this.available.value &&
+      !this.conflicted.value &&
+      this.auth.status === 'ready'
+    )
+  }
+  private content() {
+    return this.options.content()
+  }
+  private apply(draft: D) {
+    this.options.validate(draft)
+    this.options.apply(draft)
+    this.restored.value = true
+    this.adoptedVersion = draft.version
+  }
+  cancelPending() {
+    this.generation++
+    this.controller?.abort()
+    this.loading.value = this.saving.value = false
+  }
+  private begin() {
+    const mine = ++this.generation
+    this.controller?.abort()
+    this.controller = new AbortController()
+    return {
+      mine,
+      request: {
+        token: this.auth.token,
+        signal: this.controller.signal,
+        quietUnauthenticated: true,
+      },
+    }
+  }
+  activate() {
+    this.cancelPending()
+    this.loaded.value = false
+    this.remote.value = this.available.value = null
+    this.error.value = ''
+    this.restored.value = false
+    this.conflicted.value = false
+    this.adoptedVersion = null
+    if (this.options.open()) void this.load()
+  }
+  private accept(draft: D) {
+    if (draft.present) this.options.validate(draft)
+    this.remote.value = draft
+    this.loaded.value = true
+    if (!draft.present) return
+    if (this.options.same(draft)) {
+      this.adoptedVersion = draft.version
+      return
+    }
+    if (this.options.empty()) this.apply(draft)
+    else this.available.value = draft
+  }
+  async load() {
+    if (
+      !this.supported.value ||
+      !this.options.open() ||
+      this.auth.status !== 'ready' ||
+      this.saving.value
+    )
+      return
+    const { mine, request } = this.begin()
+    this.loading.value = true
+    this.loaded.value = false
+    this.error.value = ''
+    this.restored.value = false
+    this.available.value = null
+    this.adoptedVersion = null
+    this.conflicted.value = false
+    try {
+      const draft = await this.options.read(request)
+      if (mine === this.generation) this.accept(draft)
+    } catch (cause) {
+      if (mine === this.generation) this.error.value = describeError(cause)
+    } finally {
+      if (mine === this.generation) this.loading.value = false
+    }
+  }
+  useAccount() {
+    if (!this.available.value) return
+    this.apply(this.available.value)
+    this.available.value = null
+  }
+  keepLocal() {
+    this.available.value = null
+    this.restored.value = false
+    this.adoptedVersion = null
+  }
+  async save(): Promise<boolean> {
+    if (!this.canSave.value) return false
+    const submitted = this.content()
+    if (new TextEncoder().encode(submitted.body).length > this.options.maxBytes) {
+      this.error.value = this.options.sizeError
+      return false
+    }
+    const { mine, request } = this.begin()
+    this.saving.value = true
+    this.error.value = ''
+    try {
+      const draft = await this.options.write(
+        { ...submitted, expected_version: this.version.value! },
+        request,
+      )
+      if (mine !== this.generation) return false
+      this.remote.value = draft
+      this.adoptedVersion = draft.version
+      return true
+    } catch (cause) {
+      if (mine === this.generation) {
+        this.error.value = describeError(cause)
+        this.conflicted.value = cause instanceof ApiError && cause.code === 'failed_precondition'
+      }
+      return false
+    } finally {
+      if (mine === this.generation) this.saving.value = false
+    }
+  }
+  cleanupVersion(): number | null {
+    return this.remote.value?.present ? this.adoptedVersion : null
+  }
+  async clearAfterSubmit(expectedVersion: number | null = this.cleanupVersion()): Promise<string> {
+    if (!this.supported.value || expectedVersion === null) return ''
+    const { mine, request } = this.begin()
+    try {
+      const draft = await this.options.remove(expectedVersion, request)
+      if (mine === this.generation) this.remote.value = draft
+      return ''
+    } catch (cause) {
+      return mine === this.generation ? describeError(cause) : ''
+    }
+  }
+}
+
+/** Versioned account storage shared by review and discussion drafts. */
+export function useAccountDraft<D extends StoredDraft, C extends Content>(options: Options<D, C>) {
+  const auth = useAuth()
+  const state = new AccountDraftState(options, auth)
+  watch(
+    [
+      options.repo,
+      options.proposal,
+      () => auth.identity,
+      () => auth.token,
+      () => auth.status,
+      state.supported,
+      options.open,
+    ],
+    () => state.activate(),
+    { immediate: true, flush: 'sync' },
+  )
+  onScopeDispose(() => state.cancelPending())
+  return {
+    supported: state.supported,
+    loading: state.loading,
+    saving: state.saving,
+    error: state.error,
+    restored: state.restored,
+    available: state.available,
+    version: state.version,
+    canSave: state.canSave,
+    load: () => state.load(),
+    useAccount: () => state.useAccount(),
+    keepLocal: () => state.keepLocal(),
+    save: () => state.save(),
+    cleanupVersion: () => state.cleanupVersion(),
+    clearAfterSubmit: (version?: number | null) => state.clearAfterSubmit(version),
+    cancelPending: () => state.cancelPending(),
+  }
+}
diff --git a/apps/web/src/composables/useAccountReviewDraft.ts b/apps/web/src/composables/useAccountReviewDraft.ts
index 63743414..0f63b023 100644
--- a/apps/web/src/composables/useAccountReviewDraft.ts
+++ b/apps/web/src/composables/useAccountReviewDraft.ts
@@ -1,253 +1,49 @@
-import { computed, onScopeDispose, ref, watch } from 'vue'
-import type { ComputedRef, Ref } from 'vue'
+import type { Ref } from 'vue'
 import { api } from '@/api/instance'
-import { ApiError, describeError } from '@/api/errors'
-import { useAuth } from '@/stores/auth'
-
+import { useAccountDraft } from './useAccountDraft'
 type Decision = 'approve' | 'request_changes' | 'comment'
 type AccountDraft = Awaited<ReturnType<typeof api.proposals.reviewDraft>>
-interface LocalDraft {
-  head: Ref<string>
-  decision: Ref<Decision>
-  body: Ref<string>
-}
+type Content = { head: string; body: string; decision: Decision }
 interface Options {
   repo: () => string
   proposal: () => string
   open: () => boolean
-  local: LocalDraft
+  local: { head: Ref<string>; body: Ref<string>; decision: Ref<Decision> }
 }
-const isDecision = (value: string): value is Decision =>
-  ['approve', 'request_changes', 'comment'].includes(value)
-
-class AccountReviewDraft {
-  readonly loading = ref(false)
-  readonly saving = ref(false)
-  readonly loaded = ref(false)
-  readonly error = ref('')
-  readonly restored = ref(false)
-  readonly available = ref<AccountDraft | null>(null)
-  readonly supported: ComputedRef<boolean>
-  readonly version: ComputedRef<number | null>
-  readonly canSave: ComputedRef<boolean>
-  private remote = ref<AccountDraft | null>(null)
-  private readonly conflicted = ref(false)
-  private generation = 0
-  private adoptedVersion: number | null = null
-  private controller: AbortController | undefined
-
-  constructor(
-    private options: Options,
-    private auth: ReturnType<typeof useAuth>,
-  ) {
-    this.supported = computed(
-      () => !!auth.capabilities?.features.includes('proposals.review_drafts'),
-    )
-    this.version = computed(() => this.remote.value?.version ?? null)
-    this.canSave = computed(() => this.readyToSave())
-  }
-  private readyToSave() {
-    return (
-      this.supported.value &&
-      this.loaded.value &&
-      !this.loading.value &&
-      !this.saving.value &&
-      !this.available.value &&
-      !this.conflicted.value &&
-      this.auth.status === 'ready'
-    )
-  }
-  private content() {
-    const local = this.options.local
-    return { head: local.head.value, decision: local.decision.value, body: local.body.value }
-  }
-  private same(draft: AccountDraft) {
-    const current = this.content()
-    return (
-      current.head === draft.head &&
-      current.decision === draft.decision &&
-      current.body === draft.body
-    )
-  }
-  private apply(draft: AccountDraft) {
-    if (!isDecision(draft.decision))
-      throw new Error('The saved account draft has an invalid decision.')
-    const local = this.options.local
-    local.head.value = draft.head
-    local.decision.value = draft.decision
-    local.body.value = draft.body
-    this.restored.value = true
-    this.adoptedVersion = draft.version
-  }
-  cancelPending() {
-    this.generation++
-    this.controller?.abort()
-    this.loading.value = this.saving.value = false
-  }
-  private begin() {
-    const mine = ++this.generation
-    this.controller?.abort()
-    this.controller = new AbortController()
-    return {
-      mine,
-      request: {
-        token: this.auth.token,
-        signal: this.controller.signal,
-        quietUnauthenticated: true,
-      },
-    }
-  }
-  activate() {
-    this.cancelPending()
-    this.loaded.value = false
-    this.remote.value = this.available.value = null
-    this.error.value = ''
-    this.restored.value = false
-    this.conflicted.value = false
-    this.adoptedVersion = null
-    if (this.options.open()) void this.load()
-  }
-  private accept(draft: AccountDraft) {
-    if (draft.present && !isDecision(draft.decision))
-      throw new Error('The saved account draft has an invalid decision.')
-    this.remote.value = draft
-    this.loaded.value = true
-    if (!draft.present) return
-    if (this.same(draft)) {
-      this.adoptedVersion = draft.version
-      return
-    }
-    if (!this.options.local.body.value && this.options.local.decision.value === 'approve')
-      this.apply(draft)
-    else this.available.value = draft
-  }
-  async load() {
-    if (
-      !this.supported.value ||
-      !this.options.open() ||
-      this.auth.status !== 'ready' ||
-      this.saving.value
-    )
-      return
-    const { mine, request } = this.begin()
-    this.loading.value = true
-    this.loaded.value = false
-    this.error.value = ''
-    this.restored.value = false
-    this.available.value = null
-    this.adoptedVersion = null
-    this.conflicted.value = false
-    try {
-      const draft = await api.proposals.reviewDraft(
-        this.options.repo(),
-        this.options.proposal(),
-        request,
-      )
-      if (mine === this.generation) this.accept(draft)
-    } catch (cause) {
-      if (mine === this.generation) this.error.value = describeError(cause)
-    } finally {
-      if (mine === this.generation) this.loading.value = false
-    }
-  }
-  useAccount() {
-    if (!this.available.value) return
-    this.apply(this.available.value)
-    this.available.value = null
-  }
-  keepLocal() {
-    this.available.value = null
-    this.restored.value = false
-    this.adoptedVersion = null
-  }
-  async save(): Promise<boolean> {
-    if (!this.canSave.value) return false
-    const submitted = this.content()
-    if (new TextEncoder().encode(submitted.body).length > 64 * 1024) {
-      this.error.value =
-        'Account review drafts are limited to 64 KiB. Keep a local copy of longer notes.'
-      return false
-    }
-    const { mine, request } = this.begin()
-    this.saving.value = true
-    this.error.value = ''
-    try {
-      const draft = await api.proposals.saveReviewDraft(
-        this.options.repo(),
-        this.options.proposal(),
-        { ...submitted, expected_version: this.version.value! },
-        request,
-      )
-      if (mine !== this.generation) return false
-      this.remote.value = draft
-      this.adoptedVersion = draft.version
-      return true
-    } catch (cause) {
-      if (mine === this.generation) {
-        this.error.value = describeError(cause)
-        this.conflicted.value = cause instanceof ApiError && cause.code === 'failed_precondition'
-      }
-      return false
-    } finally {
-      if (mine === this.generation) this.saving.value = false
-    }
-  }
-  cleanupVersion(): number | null {
-    return this.remote.value?.present && this.adoptedVersion === this.version.value
-      ? this.adoptedVersion
-      : null
-  }
-  async clearAfterSubmit(expectedVersion: number | null = this.cleanupVersion()): Promise<string> {
-    if (!this.supported.value || expectedVersion === null) return ''
-    const { mine, request } = this.begin()
-    try {
-      const draft = await api.proposals.clearReviewDraft(
-        this.options.repo(),
-        this.options.proposal(),
-        expectedVersion,
-        request,
-      )
-      if (mine === this.generation) this.remote.value = draft
-      return ''
-    } catch (cause) {
-      return mine === this.generation ? describeError(cause) : ''
-    }
-  }
+function parseDecision(value: string): Decision {
+  if (value === 'approve' || value === 'request_changes' || value === 'comment') return value
+  throw new Error('The saved account draft has an invalid decision.')
 }
-
-/** Private account storage for one review, with explicit local/remote conflict choices. */
+/** Private account storage for one review. */
 export function useAccountReviewDraft(options: Options) {
-  const auth = useAuth()
-  const state = new AccountReviewDraft(options, auth)
-  watch(
-    [
-      options.repo,
-      options.proposal,
-      () => auth.identity,
-      () => auth.token,
-      () => auth.status,
-      state.supported,
-      options.open,
-    ],
-    () => state.activate(),
-    { immediate: true, flush: 'sync' },
-  )
-  onScopeDispose(() => state.cancelPending())
-  return {
-    supported: state.supported,
-    loading: state.loading,
-    saving: state.saving,
-    error: state.error,
-    restored: state.restored,
-    available: state.available,
-    version: state.version,
-    canSave: state.canSave,
-    load: () => state.load(),
-    useAccount: () => state.useAccount(),
-    keepLocal: () => state.keepLocal(),
-    save: () => state.save(),
-    cleanupVersion: () => state.cleanupVersion(),
-    clearAfterSubmit: (version?: number | null) => state.clearAfterSubmit(version),
-    cancelPending: () => state.cancelPending(),
-  }
+  const local = options.local
+  return useAccountDraft<AccountDraft, Content>({
+    ...options,
+    capability: 'proposals.review_drafts',
+    maxBytes: 64 * 1024,
+    sizeError: 'Account review drafts are limited to 64 KiB. Keep a local copy of longer notes.',
+    content: () => ({
+      head: local.head.value,
+      body: local.body.value,
+      decision: local.decision.value,
+    }),
+    same: (draft) =>
+      local.head.value === draft.head &&
+      local.body.value === draft.body &&
+      local.decision.value === draft.decision,
+    empty: () => !local.body.value && local.decision.value === 'approve',
+    validate: (draft) => {
+      parseDecision(draft.decision)
+    },
+    apply: (draft) => {
+      local.head.value = draft.head
+      local.body.value = draft.body
+      local.decision.value = parseDecision(draft.decision)
+    },
+    read: (request) => api.proposals.reviewDraft(options.repo(), options.proposal(), request),
+    write: (content, request) =>
+      api.proposals.saveReviewDraft(options.repo(), options.proposal(), content, request),
+    remove: (version, request) =>
+      api.proposals.clearReviewDraft(options.repo(), options.proposal(), version, request),
+  })
 }

From 6745639d270811ad3a22a77736a0b1778f1c858b Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:34:18 +0000
Subject: [PATCH 26/41] docs: record private comment drafts and ongoing roadmap
 work

---
 CHANGELOG.md                          |  1 +
 README.md                             |  4 ++--
 README.ru.md                          |  2 +-
 ROADMAP.md                            |  4 ++--
 SECURITY.md                           |  6 +++---
 dev/continuous-progress.md            | 16 +++++++++++++++-
 docs/architecture/adr-traceability.md |  6 +++++-
 7 files changed, 29 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 465c404b..51ac23d6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 - The release pipeline prepares a native Windows x64 ZIP with the CLI, server and MCP, plus a per-user PowerShell installer that verifies checksums. Native install-and-first-use smoke is required before publishing; the first Windows archive is not yet released.
 
+- General proposal comments gain separate private account drafts across Web, CLI, SDK and MCP, with explicit save and version-checked cleanup. Development schema 11 preserves existing review drafts; back up before upgrading.
 - Reviewers can explicitly save a private review draft to their account and resume on another device through Web UI, CLI, MCP or SDKs. Local drafts remain available, conflicting drafts require a choice, and versioned saves/clears never overwrite newer notes or submit a review. Development schema 10 requires a pre-upgrade backup.
 
 - Browser conflict resolution can keep either exact binary, oversized or file-type version while preserving blob bytes, executable mode and symlink type. Virtual sync pins the inspected branch through its final transaction and reports its exact target to SDK/MCP clients.
diff --git a/README.md b/README.md
index 9b2fab5c..138b7bee 100644
--- a/README.md
+++ b/README.md
@@ -117,8 +117,8 @@ There is no stable release or published crates.io, npm or PyPI package yet. Nati
 macOS on x86_64 and ARM64; the worker sandbox is Linux-only. Windows builds are tested in CI, but a native Windows
 release archive is not yet shipped.
 
-**Back up before upgrading.** Beta.7 uses metadata schema **8**. The unreleased development code uses schema **10**,
-adding requested reviewers and private account-backed review drafts. Opening a repository with a development build
+**Back up before upgrading.** Beta.7 uses metadata schema **8**. The unreleased development code uses schema **11**,
+adding requested reviewers and private account-backed review and comment drafts. Opening a repository with a development build
 can upgrade it; returning to an older binary requires restoring the pre-upgrade backup. See
 [backup and recovery](docs/operations/durability.md) and [release notes](CHANGELOG.md).
 
diff --git a/README.ru.md b/README.ru.md
index d2f56a15..795e03a0 100644
--- a/README.ru.md
+++ b/README.ru.md
@@ -120,7 +120,7 @@ AgentGit — ранняя альтернатива для команд, кото
 но отдельный готовый архив для Windows ещё не выпускается.
 
 **Перед обновлением сделайте резервную копию.** В beta.7 используется схема метаданных **8**.
-Неопубликованная разработка использует схему **10**, которая добавляет назначенных ревьюеров и личные черновики ревью.
+Неопубликованная разработка использует схему **11**, которая добавляет назначенных ревьюеров и личные черновики ревью и комментариев.
 Запуск сборки из разработки может обновить репозиторий; для возврата к старому бинарнику потребуется восстановить
 копию до обновления. Подробнее: [резервное копирование](docs/operations/durability.md) и [история выпусков](CHANGELOG.md).
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 8baa0248..e9a853b9 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -97,7 +97,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
 
 1. **Deliver the next development slice.** Beta.7 is published with metadata schema 8.
    Its Linux archive installation and first reviewed change have been exercised end to end.
-   The next release must include the development review workflow and its schema-10 upgrade
+   The next release must include the development review workflow and its schema-11 upgrade
    notice with backup/rollback guidance; existing beta tags remain immutable.
 2. **Finish the daily task and review workflow.** Queued-task refinement now preserves
    historical instructions and source links. Proposal updates now have an atomic inspected-head
@@ -106,7 +106,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    rechecks the proposal head and open state. Single-line, range and batched suggestions support explicit author preview and application across files in one revision. Requested reviewers route work across Web UI, CLI, MCP and SDKs without changing approval policy. Optional policy-required line-discussion resolution is now implemented
    across core, API, CLI explanations and Web UI. Preserve drafts, exact-head
    checks and explicit confirmation when a user changes executable work or a review decision.
-   Binary, oversized, file-type and rename/delete conflicts now support exact version choices; renamed content previews retain their per-side source paths. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; account-backed file edits and general comment drafts remain open. Bounded file/directory conflicts now support whole-source choices with complete candidate previews; multi-target rename conflicts and larger structural cases remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
+   Binary, oversized, file-type and rename/delete conflicts now support exact version choices; renamed content previews retain their per-side source paths. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; general proposal comments now have separate private drafts with the same explicit save and version checks; account-backed file edits remain open. Bounded file/directory conflicts now support whole-source choices with complete candidate previews; multi-target rename conflicts and larger structural cases remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
    polling for the aggregate view. A cross-repository event feed remains future work.
 3. **Make GitHub/GitLab cutover complete.** Code history, branch/tag mapping, the original bundle
    and reconciliation already move through Web UI and CLI. Next design and implement resumable
diff --git a/SECURITY.md b/SECURITY.md
index a5775107..0d03152c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -11,11 +11,11 @@ agents. We take integrity and isolation bugs seriously.
 | `0.3.0-beta.7` | Current patch release; use its binaries after the Release workflow completes. |
 | `0.3.0-beta.6` and earlier prereleases | Upgrade to the current patch release for the fixes to stream scopes, workspace concurrency and retention. |
 
-AgentGit is **beta** software. The current development repository metadata schema is **10**;
+AgentGit is **beta** software. The current development repository metadata schema is **11**;
 `ChangesetV1`, tree manifest v1 and repository configuration format 1 remain unchanged.
 The server control database is migrated independently; use the same server version across replicas.
-The published beta.6/beta.7 format is schema 8. Development schema 9 adds requested reviewers and schema 10 adds private review drafts;
-back up before opening a schema-8 or schema-9 repository with this build. Beta.7 introduces no
+The published beta.6/beta.7 format is schema 8. Development schema 9 adds requested reviewers, schema 10 adds private review drafts, and schema 11 adds separate private comment drafts;
+back up before opening a schema-8, schema-9 or schema-10 repository with this build. Beta.7 introduces no
 storage migration relative to beta.6. Returning to beta.5 or older
 requires the pre-upgrade backup, not opening the upgraded database with an older binary.
 See [compatibility](docs/architecture/compatibility.md) and [releasing](docs/operations/releasing.md).
diff --git a/dev/continuous-progress.md b/dev/continuous-progress.md
index 7bf32f51..5deab9cf 100644
--- a/dev/continuous-progress.md
+++ b/dev/continuous-progress.md
@@ -38,7 +38,7 @@ Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceab
 | D1 | P0 DONE | Reconcile unmerged batch with current main; retain new prepared-release/CI design | clean rebase, no lost Windows/install changes; static CI/skip/docs gates pass |
 | D2 | P0 IN PROGRESS | Push working branch, open draft PR, inspect mandatory CI; **never merge** | exact head checks, fix actual failures; native Windows ZIP/install/PS5.1 evidence |
 | R1 | P0 DONE | Fix structural sync losing independent incoming add/edit/delete when file/directory merge falls back to ours | retain raw conflicting candidate, apply explicit choices before tree validation; both orientations/no partial workspace mutation |
-| R2 | P1 OPEN | Private general discussion drafts | per-account isolation, stale-save/clear protections, UI restore, SDK/CLI parity |
+| R2 | P1 DONE | Private general discussion drafts | per-account isolation, stale-save/clear protections, UI restore, SDK/CLI parity |
 | R3 | P1 OPEN | Account-backed file-edit drafts | immutable base, byte/mode preservation, conflicts keep local work; no automatic publication |
 | R4 | P1 PARTIAL | Bounded file/directory Web choices; multi-target rename and larger structural cases remain open | complete explicit result, preserve independent clean edits; never infer deletion from failed reads |
 | R5 | P1 OPEN | Cross-repository work feed | pagination/scopes, full initial snapshot and reconnect behavior |
@@ -101,3 +101,17 @@ CLI follow-up is implementing actual virtual-workspace list/show/create/sync/del
 Web849 tests and12 browser cases passed. CLI virtual-workspace lifecycle now implemented (five explicit commands), with pinned resolution files, capability guards, duplicate/ambiguous JSON rejection, complete/incomplete scope output and no automatic proposal mutation. Final lifecycle/unit/clippy and159 generated reference files checked. SDK179/204 and MCP3 passed for the same scope contract. Independent reviews found no blockers. Next push will include these commits in the existing draft PR only; no merge/tag/release is authorized.
 
 Windows run40962143088 is still on earlier93bc477 and currently in Test; do not count it as latest-head proof. A subsequent native run on the final pushed head is required. Full Web matrix will be dispatched on that final head; local desktop/phone tests are not a substitute for all browser/identity-provider gates. Add OS/build metadata to the next Windows log for exact qualification evidence.
+
+### R2 active: general proposal comment drafts
+
+Pushed head `52ad4cc6f8ed67380fc1dd18801dcce127975e8d`. Full Web run40965163166 queued. Native Windows40962143088 completed with failure in PS5.1 installer tests: Get-FileHash unavailable; investigate inherited module environment, do not claim native qualification.
+
+R2 in progress in parallel: backend schema11 independent comment_drafts table; CLI explicit comment-draft get/save/clear; SDK/MCP same API; Web explicit account-save and restore choice for general ProposalComment only. Contract:16KiB UTF-8, full actor ownership, closed allowed, versioned CAS/tombstones/identical retries, no public events, no-store. Thread replies/file edits remain open. Root owns Web API adapter and ADR0042. No merge or release.
+
+Windows follow-up fix committed/pushed as `c33bc9e`: native PowerShell step now starts from its own shell with Get-FileHash preflight. Native run40965818005 in progress; full Web40965163166 queued. R2 backend build hit full disk; reclaimed13GiB inactive Rust incremental cache and resumed with CARGO_INCREMENTAL=0.
+
+R2 backend green:253 tests (integrate37+4+4, server100+1+1, storage106), schema11 preserves existing review drafts/tombstones through reopen and backup. Fresh OpenAPI and Web types regenerated. Web867 unit tests passed after removing concurrency load; worker-overlay mutation counts discarded as invalid after a control test, direct mutation verification replacing them. CLI cargo slot active, SDK generation and browser checks next.
+
+Next R3 design discovered (not implemented): existing virtual workspaces are readable to repository readers and their blobs enter normal history, so do not use them as private draft storage. Small first slice: existing single-file edits only; owner-private versioned draft keyed by stream/original path with immutable base and original blob/type/mode, bounded private content bytes and title/description, explicit save, private list for recovery after current-file deletion, base retention until clear. Public propose remains existing explicit operation followed by captured-version cleanup. Existing FileEditor does not preserve BOM/CRLF like batch editor: establish real-byte regression before implementation. New-file/batch/rename/delete remain later.
+
+R2 delivered in commits36f99cd (API/schema11),acbdb9f (SDK/MCP),4304dc8 (CLI),d1f19a3 (Web). Backend253, Web867+8browser, SDK182/208, CLI2+1 passed. MCP new integration tests not run; static implementation and generated clients complete. User explicitly requested stopping excess tests/checks and continuing feature development; do not run further broad/mutation loops. R3 implementation now active in parallel core/CLI/SDK-MCP/Web with only basic compilation.
diff --git a/docs/architecture/adr-traceability.md b/docs/architecture/adr-traceability.md
index 848be26f..97ef68e5 100644
--- a/docs/architecture/adr-traceability.md
+++ b/docs/architecture/adr-traceability.md
@@ -139,4 +139,8 @@ The [continuous checkpoint](../../dev/continuous-progress.md) records pending CI
 
 ## ADR-0040 — structural sync safety
 
-[ADR-0040](../adr/0040-structural-sync-resolutions.md) retains the full structural candidate for explicit virtual-sync resolutions. Tests preserve independent incoming additions, edits and deletions for both orientations and choices, reject invalid trees before workspace movement, and keep exact blob/type/mode metadata. Local structural sync and snapshots of legacy structural pending merges fail closed; `--force` does not bypass this protection. A complete browser structural chooser remains an open product task.
+[ADR-0040](../adr/0040-structural-sync-resolutions.md) retains the full structural candidate for explicit virtual-sync resolutions. Tests preserve independent incoming additions, edits and deletions for both orientations and choices, reject invalid trees before workspace movement, and keep exact blob/type/mode metadata. Local structural sync and snapshots of legacy structural pending merges fail closed; `--force` does not bypass this protection. The bounded browser chooser uses complete candidate scopes from ADR-0041; larger and multi-target rename cases remain open.
+
+## ADR-0042 — private proposal comment drafts
+
+[ADR-0042](../adr/0042-private-comment-drafts.md) separates general-comment notes from review decisions. Core and storage tests cover exact actor ownership, independent slots, transactional versions, tombstones and the schema10-to11 upgrade. HTTP/gRPC tests cover permissions, closed proposals and private response handling. CLI and SDK tests exercise the same get/save/clear contract. Web component and browser scenarios cover explicit save, cross-device restore, conflicting versions and cleanup after posting. See the continuous checkpoint for validation status on the current unmerged head.

From cd8f0db34fa232c4a23f5e49af6d575e77859928 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:37:17 +0000
Subject: [PATCH 27/41] feat(api): save private file edits with retained
 original revisions

---
 crates/ag-client/src/lib.rs                   |  11 +-
 crates/ag-integrate/src/file_drafts.rs        | 107 +++++
 crates/ag-integrate/src/lib.rs                |   4 +-
 crates/ag-protocol/build.rs                   |   7 +-
 crates/ag-protocol/proto/agwp/v1/agwp.proto   |  46 ++
 crates/ag-protocol/src/lib.rs                 |   4 +
 crates/ag-server/src/api/file_drafts.rs       |  95 ++++
 crates/ag-server/src/api/mod.rs               |   1 +
 crates/ag-server/src/grpc.rs                  |  21 +
 crates/ag-server/src/http.rs                  |  56 +++
 .../migrations/postgres/0012_file_drafts.sql  |  15 +
 .../migrations/sqlite/0012_file_drafts.sql    |  15 +
 crates/ag-storage/src/meta/file_drafts.rs     |  62 +++
 crates/ag-storage/src/meta/migrate.rs         |  12 +-
 crates/ag-storage/src/meta/mod.rs             |   2 +
 crates/ag-storage/src/meta/records.rs         |   1 +
 docs/adr/0043-private-file-drafts.md          |  23 +
 docs/adr/README.md                            |   2 +
 docs/protocol/openapi.json                    | 442 ++++++++++++++++++
 migrations/postgres/0012_file_drafts.sql      |  15 +
 migrations/sqlite/0012_file_drafts.sql        |  15 +
 proto/agwp/v1/agwp.proto                      |  46 ++
 22 files changed, 994 insertions(+), 8 deletions(-)
 create mode 100644 crates/ag-integrate/src/file_drafts.rs
 create mode 100644 crates/ag-server/src/api/file_drafts.rs
 create mode 100644 crates/ag-storage/migrations/postgres/0012_file_drafts.sql
 create mode 100644 crates/ag-storage/migrations/sqlite/0012_file_drafts.sql
 create mode 100644 crates/ag-storage/src/meta/file_drafts.rs
 create mode 100644 docs/adr/0043-private-file-drafts.md
 create mode 100644 migrations/postgres/0012_file_drafts.sql
 create mode 100644 migrations/sqlite/0012_file_drafts.sql

diff --git a/crates/ag-client/src/lib.rs b/crates/ag-client/src/lib.rs
index a98fce8b..9d1a09df 100644
--- a/crates/ag-client/src/lib.rs
+++ b/crates/ag-client/src/lib.rs
@@ -17,11 +17,11 @@ use ag_protocol::v1;
 use ag_protocol::v1::{
     admin_service_client::AdminServiceClient, agent_service_client::AgentServiceClient,
     event_service_client::EventServiceClient, execution_service_client::ExecutionServiceClient,
-    history_service_client::HistoryServiceClient, integration_service_client::IntegrationServiceClient,
-    object_service_client::ObjectServiceClient, proposal_service_client::ProposalServiceClient,
-    protocol_service_client::ProtocolServiceClient, repository_service_client::RepositoryServiceClient,
-    stream_service_client::StreamServiceClient, tree_service_client::TreeServiceClient,
-    workspace_service_client::WorkspaceServiceClient,
+    file_draft_service_client::FileDraftServiceClient, history_service_client::HistoryServiceClient,
+    integration_service_client::IntegrationServiceClient, object_service_client::ObjectServiceClient,
+    proposal_service_client::ProposalServiceClient, protocol_service_client::ProtocolServiceClient,
+    repository_service_client::RepositoryServiceClient, stream_service_client::StreamServiceClient,
+    tree_service_client::TreeServiceClient, workspace_service_client::WorkspaceServiceClient,
 };
 use ag_protocol::{ErrorCode, ProtocolError};
 use ag_types::ObjectId;
@@ -205,6 +205,7 @@ impl Client {
         tree => TreeServiceClient,
         streams => StreamServiceClient,
         workspaces => WorkspaceServiceClient,
+        file_drafts => FileDraftServiceClient,
         proposals => ProposalServiceClient,
         integration => IntegrationServiceClient,
         agents => AgentServiceClient,
diff --git a/crates/ag-integrate/src/file_drafts.rs b/crates/ag-integrate/src/file_drafts.rs
new file mode 100644
index 00000000..fa8a1328
--- /dev/null
+++ b/crates/ag-integrate/src/file_drafts.rs
@@ -0,0 +1,107 @@
+//! Private existing-file edits; saving never creates a public object.
+use crate::draft_version::{next_version, require_version};
+use crate::{Error, Repository, Result};
+use ag_storage::meta::FileDraftRow;
+use ag_types::{ChangesetId, FileType, Identity, RepoPath, StreamName};
+
+/// Inline draft byte limit, matching browser file edits.
+pub const MAX_FILE_DRAFT_BYTES: usize = 4 * 1024 * 1024;
+/// Maximum active file drafts per actor in a repository.
+pub const MAX_FILE_DRAFTS: u64 = 20;
+/// A replacement at the original immutable revision.
+pub struct FileDraftInput<'a> {
+    /// Branch containing the edited file.
+    pub stream: &'a StreamName,
+    /// Existing file path.
+    pub path: &'a RepoPath,
+    /// Original revision; cannot move until the draft is cleared.
+    pub base: &'a ChangesetId,
+    /// Exact replacement bytes.
+    pub content: &'a [u8],
+    /// Last observed private draft version.
+    pub expected_version: u64,
+}
+impl Repository {
+    /// Reads only this actor's draft, including its clear tombstone.
+    pub fn file_draft(&self, owner: &Identity, stream: &StreamName, path: &RepoPath) -> Result<Option<FileDraftRow>> {
+        Ok(self.meta.read(|tx| tx.file_draft(owner.as_str(), stream.as_str(), path.as_str()))?)
+    }
+    /// Lists metadata only for this actor and branch.
+    pub fn file_drafts(&self, owner: &Identity, stream: &StreamName) -> Result<Vec<FileDraftRow>> {
+        Ok(self.meta.read(|tx| tx.file_drafts(owner.as_str(), stream.as_str()))?)
+    }
+    /// Saves bytes privately while retaining their validated original revision.
+    pub fn save_file_draft(&self, owner: &Identity, input: FileDraftInput<'_>) -> Result<FileDraftRow> {
+        if input.content.len() > MAX_FILE_DRAFT_BYTES {
+            return Err(Error::Invalid("file draft exceeds 4 MiB".into()));
+        }
+        // Resolve outside the writer transaction; validate all retained history inside it before saving.
+        let original = self
+            .tree_of(input.base)?
+            .get(input.path)
+            .cloned()
+            .ok_or_else(|| Error::NotFound(format!("file {} at {}", input.path, input.base)))?;
+        self.meta.write_with_error(|tx| {
+            if tx.stream(input.stream.as_str())?.is_none() {
+                return Err(Error::NotFound(format!("stream {}", input.stream)));
+            }
+            let current = tx.file_draft(owner.as_str(), input.stream.as_str(), input.path.as_str())?;
+            if let Some(row) = current.as_ref().filter(|row| row.base.is_some()) {
+                if row.base != Some(*input.base) {
+                    return Err(Error::Conflict(
+                        "file draft retains its original base; clear it before starting another edit".into(),
+                    ));
+                }
+                if row.content == input.content {
+                    return Ok(row.clone());
+                }
+            }
+            require_version(current.as_ref().map_or(0, |row| row.version), input.expected_version)?;
+            if current.as_ref().is_none_or(|row| row.base.is_none())
+                && tx.file_draft_count(owner.as_str())? >= MAX_FILE_DRAFTS
+            {
+                return Err(Error::Invalid("clear an existing file draft before saving more than 20".into()));
+            }
+            self.validate_retention_root(tx, input.base)?;
+            let row = FileDraftRow {
+                stream: input.stream.to_string(),
+                path: input.path.to_string(),
+                version: next_version(current.as_ref().map_or(0, |row| row.version))?,
+                base: Some(*input.base),
+                original_blob_id: Some(original.content),
+                executable: original.executable,
+                file_type: match original.file_type {
+                    FileType::Regular => "regular",
+                    FileType::Symlink => "symlink",
+                }
+                .into(),
+                content: input.content.to_vec(),
+                updated_at: self.clock().now(),
+            };
+            Ok(tx.replace_file_draft(owner.as_str(), &row)?)
+        })
+    }
+    /// Clears the inspected draft and releases its retained base.
+    pub fn clear_file_draft(
+        &self,
+        owner: &Identity,
+        stream: &StreamName,
+        path: &RepoPath,
+        expected_version: u64,
+    ) -> Result<Option<FileDraftRow>> {
+        self.meta.write_with_error(|tx| {
+            let Some(mut row) = tx.file_draft(owner.as_str(), stream.as_str(), path.as_str())? else { return Ok(None) };
+            if row.base.is_none() {
+                return Ok(Some(row));
+            }
+            require_version(row.version, expected_version)?;
+            row.version = next_version(row.version)?;
+            row.base = None;
+            row.original_blob_id = None;
+            row.content.clear();
+            row.file_type.clear();
+            row.executable = false;
+            Ok(Some(tx.replace_file_draft(owner.as_str(), &row)?))
+        })
+    }
+}
diff --git a/crates/ag-integrate/src/lib.rs b/crates/ag-integrate/src/lib.rs
index 1e6ba6f5..8104f27f 100644
--- a/crates/ag-integrate/src/lib.rs
+++ b/crates/ag-integrate/src/lib.rs
@@ -24,11 +24,12 @@ mod backup;
 mod blame;
 mod comment_drafts;
 mod derive;
-mod draft_version;
 mod directory;
+mod draft_version;
 mod error;
 pub mod explain;
 mod failpoints;
+mod file_drafts;
 mod fsck;
 mod gc;
 mod history;
@@ -54,6 +55,7 @@ pub use derive::{DeriveReport, DeriveStatus, KEYFRAME_INTERVAL};
 pub use directory::publish_new_directory;
 pub use error::Error;
 pub use failpoints::{Failpoints, GateHandle};
+pub use file_drafts::{FileDraftInput, MAX_FILE_DRAFT_BYTES, MAX_FILE_DRAFTS};
 pub use fsck::{FsckIssue, FsckReport};
 pub use gc::{DEFAULT_GC_GRACE_MS, DEFAULT_REFLOG_RETENTION_MS, GcOptions, GcReport};
 pub use history::{HybridGraph, LogEntry};
diff --git a/crates/ag-protocol/build.rs b/crates/ag-protocol/build.rs
index 33d290e1..fabf0643 100644
--- a/crates/ag-protocol/build.rs
+++ b/crates/ag-protocol/build.rs
@@ -15,7 +15,12 @@ const JSON_FIELDS: &[(&str, &str)] = &[
 ];
 
 /// `bytes` fields: base64 in JSON.
-const BYTES_FIELDS: &[&str] = &["agwp.v1.ObjectChunk.data", "agwp.v1.FileChange.content"];
+const BYTES_FIELDS: &[&str] = &[
+    "agwp.v1.ObjectChunk.data",
+    "agwp.v1.FileChange.content",
+    "agwp.v1.FileDraft.content",
+    "agwp.v1.SaveFileDraftRequest.content",
+];
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     let manifest = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR")?);
diff --git a/crates/ag-protocol/proto/agwp/v1/agwp.proto b/crates/ag-protocol/proto/agwp/v1/agwp.proto
index 5b364d32..1f098870 100644
--- a/crates/ag-protocol/proto/agwp/v1/agwp.proto
+++ b/crates/ag-protocol/proto/agwp/v1/agwp.proto
@@ -820,6 +820,45 @@ message ClearCommentDraftRequest {
   uint64 expected_version = 3;
 }
 
+// Private existing-file edit owned by the current acting identity.
+message FileDraft {
+  bool present = 1;
+  uint64 version = 2;
+  string stream = 3;
+  string path = 4;
+  string base = 5;
+  string original_blob_id = 6;
+  string file_type = 7;
+  bool executable = 8;
+  bytes content = 9;
+  int64 updated_at_ms = 10;
+}
+message GetFileDraftRequest { string repo = 1; string stream = 2; string path = 3; }
+message SaveFileDraftRequest {
+  string repo = 1;
+  string stream = 2;
+  string path = 3;
+  string base = 4;
+  bytes content = 5;
+  uint64 expected_version = 6;
+}
+message ClearFileDraftRequest {
+  string repo = 1;
+  string stream = 2;
+  string path = 3;
+  uint64 expected_version = 4;
+}
+message ListFileDraftsRequest { string repo = 1; string stream = 2; }
+// Discovery carries no private replacement bytes.
+message FileDraftSummary {
+  string stream = 1;
+  string path = 2;
+  string base = 3;
+  uint64 version = 4;
+  int64 updated_at_ms = 5;
+}
+message ListFileDraftsResponse { repeated FileDraftSummary drafts = 1; }
+
 // Replaces review routing after comparing the complete inspected set.
 message SetRequestedReviewersRequest {
   string repo = 1;
@@ -2095,3 +2134,10 @@ message SetTaskAttemptLimitRequest {
   uint32 expected_max_attempts = 4;
   string idempotency_key = 5;
 }
+
+service FileDraftService {
+  rpc Get(GetFileDraftRequest) returns (FileDraft);
+  rpc Save(SaveFileDraftRequest) returns (FileDraft);
+  rpc Clear(ClearFileDraftRequest) returns (FileDraft);
+  rpc List(ListFileDraftsRequest) returns (ListFileDraftsResponse);
+}
diff --git a/crates/ag-protocol/src/lib.rs b/crates/ag-protocol/src/lib.rs
index 7f5a6288..7372e42a 100644
--- a/crates/ag-protocol/src/lib.rs
+++ b/crates/ag-protocol/src/lib.rs
@@ -112,6 +112,9 @@ pub mod features {
     /// Private versioned general discussion drafts for the current acting identity.
     pub const PROPOSALS_COMMENT_DRAFTS: &str = "proposals.comment_drafts";
 
+    /// Private existing-file edits with immutable original metadata.
+    pub const FILES_DRAFTS: &str = "files.drafts";
+
     /// Every feature this implementation knows.
     pub const ALL: &[&str] = &[
         EVENTS_REPLAY,
@@ -132,6 +135,7 @@ pub mod features {
         PROPOSALS_REVIEW_REQUESTS,
         PROPOSALS_REVIEW_DRAFTS,
         PROPOSALS_COMMENT_DRAFTS,
+        FILES_DRAFTS,
         POLICY_RESOLVED_THREADS,
         TREE_SEARCH,
         ISSUES,
diff --git a/crates/ag-server/src/api/file_drafts.rs b/crates/ag-server/src/api/file_drafts.rs
new file mode 100644
index 00000000..353bc004
--- /dev/null
+++ b/crates/ag-server/src/api/file_drafts.rs
@@ -0,0 +1,95 @@
+//! Exact-owner file drafts; private bytes never become ordinary repository objects here.
+use super::{parse_id, require};
+use crate::app::{App, Call};
+use crate::authz::Cap;
+use crate::error::{ApiError, ApiResult};
+use ag_integrate::FileDraftInput;
+use ag_protocol::v1;
+use ag_storage::meta::FileDraftRow;
+use ag_types::{ChangesetId, RepoPath, StreamName};
+
+fn stream(value: &str) -> ApiResult<StreamName> {
+    StreamName::new(value).map_err(|e| ApiError::invalid(e.to_string()))
+}
+fn path(value: &str) -> ApiResult<RepoPath> {
+    RepoPath::new(value).map_err(|e| ApiError::invalid(e.to_string()))
+}
+fn draft(row: Option<FileDraftRow>) -> v1::FileDraft {
+    let Some(row) = row else { return v1::FileDraft::default() };
+    v1::FileDraft {
+        present: row.base.is_some(),
+        version: row.version,
+        stream: row.stream,
+        path: row.path,
+        base: row.base.map(|id| id.to_string()).unwrap_or_default(),
+        original_blob_id: row.original_blob_id.map(|id| id.to_string()).unwrap_or_default(),
+        file_type: row.file_type,
+        executable: row.executable,
+        content: row.content,
+        updated_at_ms: row.updated_at.as_millis(),
+    }
+}
+impl App {
+    /// Reads only the authenticated actor's saved bytes.
+    pub async fn get_file_draft(&self, call: &Call, req: v1::GetFileDraftRequest) -> ApiResult<v1::FileDraft> {
+        let (stream, path) = (stream(&req.stream)?, path(&req.path)?);
+        let scope = stream.to_string();
+        self.with_repo(call, require(&req.repo, "repo")?, Cap::WorkspaceWrite, Some(&scope), move |repo, actor| {
+            Ok(draft(repo.file_draft(actor, &stream, &path)?))
+        })
+        .await
+    }
+    /// Saves an existing-file edit with an immutable base and version comparison.
+    pub async fn save_file_draft(&self, call: &Call, req: v1::SaveFileDraftRequest) -> ApiResult<v1::FileDraft> {
+        let (stream, path) = (stream(&req.stream)?, path(&req.path)?);
+        let base: ChangesetId = parse_id(require(&req.base, "base")?, "draft base")?;
+        let scope = stream.to_string();
+        self.with_repo(call, require(&req.repo, "repo")?, Cap::WorkspaceWrite, Some(&scope), move |repo, actor| {
+            Ok(draft(Some(repo.save_file_draft(
+                actor,
+                FileDraftInput {
+                    stream: &stream,
+                    path: &path,
+                    base: &base,
+                    content: &req.content,
+                    expected_version: req.expected_version,
+                },
+            )?)))
+        })
+        .await
+    }
+    /// Clears only the inspected private draft.
+    pub async fn clear_file_draft(&self, call: &Call, req: v1::ClearFileDraftRequest) -> ApiResult<v1::FileDraft> {
+        let (stream, path) = (stream(&req.stream)?, path(&req.path)?);
+        let scope = stream.to_string();
+        self.with_repo(call, require(&req.repo, "repo")?, Cap::WorkspaceWrite, Some(&scope), move |repo, actor| {
+            Ok(draft(repo.clear_file_draft(actor, &stream, &path, req.expected_version)?))
+        })
+        .await
+    }
+    /// Lists private metadata for one explicitly scoped branch, without content.
+    pub async fn list_file_drafts(
+        &self,
+        call: &Call,
+        req: v1::ListFileDraftsRequest,
+    ) -> ApiResult<v1::ListFileDraftsResponse> {
+        let stream = stream(&req.stream)?;
+        let scope = stream.to_string();
+        self.with_repo(call, require(&req.repo, "repo")?, Cap::WorkspaceWrite, Some(&scope), move |repo, actor| {
+            Ok(v1::ListFileDraftsResponse {
+                drafts: repo
+                    .file_drafts(actor, &stream)?
+                    .into_iter()
+                    .map(|row| v1::FileDraftSummary {
+                        stream: row.stream,
+                        path: row.path,
+                        base: row.base.map(|id| id.to_string()).unwrap_or_default(),
+                        version: row.version,
+                        updated_at_ms: row.updated_at.as_millis(),
+                    })
+                    .collect(),
+            })
+        })
+        .await
+    }
+}
diff --git a/crates/ag-server/src/api/mod.rs b/crates/ag-server/src/api/mod.rs
index f12dc344..c78567fb 100644
--- a/crates/ag-server/src/api/mod.rs
+++ b/crates/ag-server/src/api/mod.rs
@@ -17,6 +17,7 @@ mod agents;
 mod comment_drafts;
 mod convert;
 mod events;
+mod file_drafts;
 mod history;
 mod integration;
 mod issues;
diff --git a/crates/ag-server/src/grpc.rs b/crates/ag-server/src/grpc.rs
index 61cf60fb..d8673d20 100644
--- a/crates/ag-server/src/grpc.rs
+++ b/crates/ag-server/src/grpc.rs
@@ -11,6 +11,7 @@ use ag_protocol::v1::{
     agent_service_server::{AgentService, AgentServiceServer},
     event_service_server::{EventService, EventServiceServer},
     execution_service_server::{ExecutionService, ExecutionServiceServer},
+    file_draft_service_server::{FileDraftService, FileDraftServiceServer},
     history_service_server::{HistoryService, HistoryServiceServer},
     integration_service_server::{IntegrationService, IntegrationServiceServer},
     issue_service_server::{IssueService, IssueServiceServer},
@@ -807,6 +808,7 @@ pub fn router(app: App) -> axum::Router {
         .add_service(svc!(StreamServiceServer))
         .add_service(svc!(WorkspaceServiceServer))
         .add_service(svc!(ProposalServiceServer))
+        .add_service(svc!(FileDraftServiceServer))
         .add_service(svc!(IntegrationServiceServer))
         .add_service(svc!(AgentServiceServer))
         .add_service(svc!(EventServiceServer))
@@ -831,3 +833,22 @@ mod tests {
         assert_eq!(parse_grpc_timeout(""), None);
     }
 }
+
+#[tonic::async_trait]
+impl FileDraftService for Grpc {
+    async fn get(&self, request: Request<v1::GetFileDraftRequest>) -> Result<Response<v1::FileDraft>, Status> {
+        unary!(self, request, "file_draft.get", get_file_draft)
+    }
+    async fn save(&self, request: Request<v1::SaveFileDraftRequest>) -> Result<Response<v1::FileDraft>, Status> {
+        unary!(self, request, "file_draft.save", save_file_draft)
+    }
+    async fn clear(&self, request: Request<v1::ClearFileDraftRequest>) -> Result<Response<v1::FileDraft>, Status> {
+        unary!(self, request, "file_draft.clear", clear_file_draft)
+    }
+    async fn list(
+        &self,
+        request: Request<v1::ListFileDraftsRequest>,
+    ) -> Result<Response<v1::ListFileDraftsResponse>, Status> {
+        unary!(self, request, "file_draft.list", list_file_drafts)
+    }
+}
diff --git a/crates/ag-server/src/http.rs b/crates/ag-server/src/http.rs
index 1a79190f..0f38d821 100644
--- a/crates/ag-server/src/http.rs
+++ b/crates/ag-server/src/http.rs
@@ -256,6 +256,10 @@ where
             | "proposal.get_comment_draft"
             | "proposal.save_comment_draft"
             | "proposal.clear_comment_draft"
+            | "file_draft.get"
+            | "file_draft.save"
+            | "file_draft.clear"
+            | "file_draft.list"
     ) {
         response.headers_mut().insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
     }
@@ -964,6 +968,58 @@ pub fn api_router(app: App) -> (Router, Vec<RouteMeta>) {
         v1::Proposal,
         update_proposal
     );
+    route!(
+        r,
+        meta,
+        get,
+        "get",
+        "/v1/repos/{owner}/{rname}/file-draft",
+        "file_draft.get",
+        "File drafts",
+        "Get private file drafts",
+        v1::GetFileDraftRequest,
+        v1::FileDraft,
+        get_file_draft
+    );
+    route!(
+        r,
+        meta,
+        put,
+        "put",
+        "/v1/repos/{owner}/{rname}/file-draft",
+        "file_draft.save",
+        "File drafts",
+        "Save private file drafts",
+        v1::SaveFileDraftRequest,
+        v1::FileDraft,
+        save_file_draft
+    );
+    route!(
+        r,
+        meta,
+        delete,
+        "delete",
+        "/v1/repos/{owner}/{rname}/file-draft",
+        "file_draft.clear",
+        "File drafts",
+        "Clear private file drafts",
+        v1::ClearFileDraftRequest,
+        v1::FileDraft,
+        clear_file_draft
+    );
+    route!(
+        r,
+        meta,
+        get,
+        "get",
+        "/v1/repos/{owner}/{rname}/file-drafts",
+        "file_draft.list",
+        "File drafts",
+        "List private file drafts",
+        v1::ListFileDraftsRequest,
+        v1::ListFileDraftsResponse,
+        list_file_drafts
+    );
     route!(
         r,
         meta,
diff --git a/crates/ag-storage/migrations/postgres/0012_file_drafts.sql b/crates/ag-storage/migrations/postgres/0012_file_drafts.sql
new file mode 100644
index 00000000..944c05d8
--- /dev/null
+++ b/crates/ag-storage/migrations/postgres/0012_file_drafts.sql
@@ -0,0 +1,15 @@
+CREATE TABLE file_drafts (
+    owner TEXT NOT NULL,
+    stream TEXT NOT NULL,
+    path TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    base TEXT,
+    original_blob_id TEXT,
+    executable BIGINT NOT NULL,
+    file_type TEXT NOT NULL,
+    content BYTEA NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (owner, stream, path),
+    CHECK ((base IS NULL AND original_blob_id IS NULL AND file_type = '' AND executable = 0) OR
+           (base IS NOT NULL AND original_blob_id IS NOT NULL AND file_type IN ('regular', 'symlink')))
+);
diff --git a/crates/ag-storage/migrations/sqlite/0012_file_drafts.sql b/crates/ag-storage/migrations/sqlite/0012_file_drafts.sql
new file mode 100644
index 00000000..bfb0d600
--- /dev/null
+++ b/crates/ag-storage/migrations/sqlite/0012_file_drafts.sql
@@ -0,0 +1,15 @@
+CREATE TABLE file_drafts (
+    owner TEXT NOT NULL,
+    stream TEXT NOT NULL,
+    path TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    base TEXT,
+    original_blob_id TEXT,
+    executable BIGINT NOT NULL,
+    file_type TEXT NOT NULL,
+    content BLOB NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (owner, stream, path),
+    CHECK ((base IS NULL AND original_blob_id IS NULL AND file_type = '' AND executable = 0) OR
+           (base IS NOT NULL AND original_blob_id IS NOT NULL AND file_type IN ('regular', 'symlink')))
+);
diff --git a/crates/ag-storage/src/meta/file_drafts.rs b/crates/ag-storage/src/meta/file_drafts.rs
new file mode 100644
index 00000000..84986f7f
--- /dev/null
+++ b/crates/ag-storage/src/meta/file_drafts.rs
@@ -0,0 +1,62 @@
+//! Account-private file bytes, never stored as published objects.
+use super::db::{Row, params};
+use super::{MetaError, Tx, parse, ts};
+use ag_types::{BlobId, ChangesetId, Timestamp};
+
+/// A private draft; null base is a versioned clear tombstone.
+#[derive(Clone, Debug)]
+pub struct FileDraftRow {
+    /// Branch for this draft.
+    pub stream: String,
+    /// Existing file's immutable path.
+    pub path: String,
+    /// Per-slot optimistic version.
+    pub version: u64,
+    /// Original revision, retained until cleared.
+    pub base: Option<ChangesetId>,
+    /// Original file blob, derived by the server.
+    pub original_blob_id: Option<BlobId>,
+    /// Original executable bit.
+    pub executable: bool,
+    /// Original regular/symlink kind.
+    pub file_type: String,
+    /// Private replacement bytes.
+    pub content: Vec<u8>,
+    /// Last save or clear.
+    pub updated_at: Timestamp,
+}
+fn decode(row: &Row, with_content: bool) -> Result<FileDraftRow, MetaError> {
+    Ok(FileDraftRow {
+        stream: row.string(0)?,
+        path: row.string(1)?,
+        version: row.i64(2)? as u64,
+        base: row.opt_str(3)?.map(|s| parse(s, "file draft base")).transpose()?,
+        original_blob_id: row.opt_str(4)?.map(|s| parse(s, "original blob")).transpose()?,
+        executable: row.i64(5)? != 0,
+        file_type: row.string(6)?,
+        content: if with_content { row.blob(7)?.to_vec() } else { Vec::new() },
+        updated_at: ts(row.i64(if with_content { 8 } else { 7 })?),
+    })
+}
+impl Tx<'_> {
+    /// Looks up only the exact actor's slot.
+    pub fn file_draft(&self, owner: &str, stream: &str, path: &str) -> Result<Option<FileDraftRow>, MetaError> {
+        self.conn.query_opt("SELECT stream,path,version,base,original_blob_id,executable,file_type,content,updated_at FROM file_drafts WHERE owner=?1 AND stream=?2 AND path=?3", &params![owner,stream,path])?.as_ref().map(|row|decode(row,true)).transpose()
+    }
+    /// Lists at most twenty active drafts, excluding content bytes from the query.
+    pub fn file_drafts(&self, owner: &str, stream: &str) -> Result<Vec<FileDraftRow>, MetaError> {
+        self.conn.query("SELECT stream,path,version,base,original_blob_id,executable,file_type,updated_at FROM file_drafts WHERE owner=?1 AND stream=?2 AND base IS NOT NULL ORDER BY path LIMIT 20", &params![owner,stream])?.iter().map(|row|decode(row,false)).collect()
+    }
+    /// Counts active drafts across the actor's streams in this repository.
+    pub fn file_draft_count(&self, owner: &str) -> Result<u64, MetaError> {
+        Ok(self.conn.query("SELECT COUNT(*) FROM file_drafts WHERE owner=?1 AND base IS NOT NULL", &params![owner])?[0]
+            .i64(0)? as u64)
+    }
+    /// Writes a state already checked in this transaction.
+    pub fn replace_file_draft(&self, owner: &str, draft: &FileDraftRow) -> Result<FileDraftRow, MetaError> {
+        let version = i64::try_from(draft.version).map_err(|_| MetaError::Invalid("draft version exhausted".into()))?;
+        self.conn.execute("INSERT INTO file_drafts(owner,stream,path,version,base,original_blob_id,executable,file_type,content,updated_at) VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9,?10) ON CONFLICT(owner,stream,path) DO UPDATE SET version=excluded.version,base=excluded.base,original_blob_id=excluded.original_blob_id,executable=excluded.executable,file_type=excluded.file_type,content=excluded.content,updated_at=excluded.updated_at", &params![owner,&draft.stream,&draft.path,version,draft.base.map(|id|id.to_hex()),draft.original_blob_id.map(|id|id.to_hex()),draft.executable,&draft.file_type,draft.content.as_slice(),self.now().as_millis()])?;
+        self.file_draft(owner, &draft.stream, &draft.path)?
+            .ok_or_else(|| MetaError::Corrupt("file draft vanished".into()))
+    }
+}
diff --git a/crates/ag-storage/src/meta/migrate.rs b/crates/ag-storage/src/meta/migrate.rs
index 09fcb447..c73ba30d 100644
--- a/crates/ag-storage/src/meta/migrate.rs
+++ b/crates/ag-storage/src/meta/migrate.rs
@@ -34,7 +34,7 @@ impl Migration {
 }
 
 /// Schema version understood by this build.
-pub const SCHEMA_VERSION: i64 = 11;
+pub const SCHEMA_VERSION: i64 = 12;
 
 pub(crate) const SQLITE_MIGRATIONS: &[Migration] = &[
     Migration { version: 1, name: "0001_init.sql", sql: include_str!("../../migrations/sqlite/0001_init.sql") },
@@ -80,6 +80,11 @@ pub(crate) const SQLITE_MIGRATIONS: &[Migration] = &[
         name: "0011_comment_drafts.sql",
         sql: include_str!("../../migrations/sqlite/0011_comment_drafts.sql"),
     },
+    Migration {
+        version: 12,
+        name: "0012_file_drafts.sql",
+        sql: include_str!("../../migrations/sqlite/0012_file_drafts.sql"),
+    },
 ];
 
 pub(crate) const POSTGRES_MIGRATIONS: &[Migration] = &[
@@ -126,6 +131,11 @@ pub(crate) const POSTGRES_MIGRATIONS: &[Migration] = &[
         name: "0011_comment_drafts.sql",
         sql: include_str!("../../migrations/postgres/0011_comment_drafts.sql"),
     },
+    Migration {
+        version: 12,
+        name: "0012_file_drafts.sql",
+        sql: include_str!("../../migrations/postgres/0012_file_drafts.sql"),
+    },
 ];
 
 #[cfg(test)]
diff --git a/crates/ag-storage/src/meta/mod.rs b/crates/ag-storage/src/meta/mod.rs
index b4a1978c..207c95d5 100644
--- a/crates/ag-storage/src/meta/mod.rs
+++ b/crates/ag-storage/src/meta/mod.rs
@@ -44,6 +44,7 @@ mod agents;
 mod changesets;
 mod comment_drafts;
 mod derived;
+mod file_drafts;
 mod intents;
 mod outbox;
 mod records;
@@ -67,6 +68,7 @@ pub use agents::{AgentRow, LeaseRow, ProvenanceRow, QueueRow, RunRow, TaskRow};
 pub use changesets::ChangesetInfo;
 pub use comment_drafts::CommentDraftRow;
 pub use db::{Dialect, Param, Row, Value};
+pub use file_drafts::FileDraftRow;
 pub use intents::{IntentRow, IntentState, NewIntent};
 pub use issues::{IssueActivityRow, IssueFilter, IssueRow};
 pub use jobs::{DEFAULT_JOB_ATTEMPTS, JobRow, JobState, NewJob};
diff --git a/crates/ag-storage/src/meta/records.rs b/crates/ag-storage/src/meta/records.rs
index 8c464c14..542c7e3d 100644
--- a/crates/ag-storage/src/meta/records.rs
+++ b/crates/ag-storage/src/meta/records.rs
@@ -635,6 +635,7 @@ impl Tx<'_> {
             "SELECT head FROM proposals WHERE state = 'open'",
             "SELECT head FROM workspaces WHERE head IS NOT NULL",
             "SELECT base FROM workspaces WHERE base IS NOT NULL",
+            "SELECT base FROM file_drafts WHERE base IS NOT NULL",
         ] {
             for r in self.conn.query(sql, &[])? {
                 roots.push(parse::<ChangesetId>(r.str(0)?, "root")?);
diff --git a/docs/adr/0043-private-file-drafts.md b/docs/adr/0043-private-file-drafts.md
new file mode 100644
index 00000000..ed06871a
--- /dev/null
+++ b/docs/adr/0043-private-file-drafts.md
@@ -0,0 +1,23 @@
+# ADR 0043: private single-file drafts
+
+Status: accepted.
+
+## Decision
+
+Save one existing-file edit per account, stream and path in private metadata. The
+original revision, blob, file type and executable bit stay fixed until the draft is
+cleared. Replacement bytes do not enter shared object history until the user opens
+a change request. The draft retains its original revision for garbage collection.
+
+Schema 12 adds `file_drafts`. Saves and clears use the existing versioned draft
+contract, including identical retries and deletion tombstones. Each draft is limited
+to 4 MiB; an actor can retain twenty active drafts per repository. List returns only
+that actor's metadata for one authorized stream. All operations require workspace
+write permission, use the full actor identity and return private, non-cacheable
+responses. They publish no repository events or audit content.
+
+Web offers explicit account save and restore in the existing single-file editor,
+retaining BOM, line endings, type and mode. Creating a change request remains a
+separate action; successful publication clears only the saved version it used.
+CLI, SDK and MCP expose the same operations. Batch and new-file drafts are deferred.
+Back up before upgrading; rollback requires restoring the pre-upgrade backup.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 3fd3ce01..68a38e43 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -60,3 +60,5 @@ which test: [ADR traceability](../architecture/adr-traceability.md).
 - [0041 — Bounded structural conflict previews](0041-structural-conflict-previews.md)
 
 - [0042 — Private proposal comment drafts](0042-private-comment-drafts.md)
+
+- [0043 — Private single-file drafts](0043-private-file-drafts.md)
diff --git a/docs/protocol/openapi.json b/docs/protocol/openapi.json
index 00b722bc..b5ccf0dd 100644
--- a/docs/protocol/openapi.json
+++ b/docs/protocol/openapi.json
@@ -664,6 +664,29 @@
         },
         "type": "object"
       },
+      "ClearFileDraftRequest": {
+        "properties": {
+          "expected_version": {
+            "default": 0,
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "path": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          },
+          "stream": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "ClearReviewDraftRequest": {
         "properties": {
           "expected_version": {
@@ -1670,6 +1693,85 @@
         },
         "type": "object"
       },
+      "FileDraft": {
+        "description": "Private existing-file edit owned by the current acting identity.",
+        "properties": {
+          "base": {
+            "default": "",
+            "type": "string"
+          },
+          "content": {
+            "default": [],
+            "format": "byte",
+            "type": "string"
+          },
+          "executable": {
+            "default": false,
+            "type": "boolean"
+          },
+          "file_type": {
+            "default": "",
+            "type": "string"
+          },
+          "original_blob_id": {
+            "default": "",
+            "type": "string"
+          },
+          "path": {
+            "default": "",
+            "type": "string"
+          },
+          "present": {
+            "default": false,
+            "type": "boolean"
+          },
+          "stream": {
+            "default": "",
+            "type": "string"
+          },
+          "updated_at_ms": {
+            "default": 0,
+            "format": "int64",
+            "type": "integer"
+          },
+          "version": {
+            "default": 0,
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
+      "FileDraftSummary": {
+        "description": "Discovery carries no private replacement bytes.",
+        "properties": {
+          "base": {
+            "default": "",
+            "type": "string"
+          },
+          "path": {
+            "default": "",
+            "type": "string"
+          },
+          "stream": {
+            "default": "",
+            "type": "string"
+          },
+          "updated_at_ms": {
+            "default": 0,
+            "format": "int64",
+            "type": "integer"
+          },
+          "version": {
+            "default": 0,
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
       "FileOp": {
         "properties": {
           "blob_id": {
@@ -1926,6 +2028,23 @@
         },
         "type": "object"
       },
+      "GetFileDraftRequest": {
+        "properties": {
+          "path": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          },
+          "stream": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "GetIssueRequest": {
         "properties": {
           "number": {
@@ -2772,6 +2891,31 @@
         },
         "type": "object"
       },
+      "ListFileDraftsRequest": {
+        "properties": {
+          "repo": {
+            "default": "",
+            "type": "string"
+          },
+          "stream": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "ListFileDraftsResponse": {
+        "properties": {
+          "drafts": {
+            "default": [],
+            "items": {
+              "$ref": "#/components/schemas/FileDraftSummary"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
       "ListIssueActivityRequest": {
         "properties": {
           "number": {
@@ -5236,6 +5380,38 @@
         },
         "type": "object"
       },
+      "SaveFileDraftRequest": {
+        "properties": {
+          "base": {
+            "default": "",
+            "type": "string"
+          },
+          "content": {
+            "default": [],
+            "format": "byte",
+            "type": "string"
+          },
+          "expected_version": {
+            "default": 0,
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "path": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          },
+          "stream": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "SaveReviewDraftRequest": {
         "properties": {
           "body": {
@@ -7721,6 +7897,272 @@
         ]
       }
     },
+    "/v1/repos/{owner}/{rname}/file-draft": {
+      "delete": {
+        "operationId": "file_draft.clear",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "expected_version",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "format": "int64",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "path",
+            "required": false,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "stream",
+            "required": false,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/FileDraft"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Clear private file drafts",
+        "tags": [
+          "File drafts"
+        ]
+      },
+      "get": {
+        "operationId": "file_draft.get",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "path",
+            "required": false,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "stream",
+            "required": false,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/FileDraft"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Get private file drafts",
+        "tags": [
+          "File drafts"
+        ]
+      },
+      "put": {
+        "operationId": "file_draft.save",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SaveFileDraftRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/FileDraft"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Save private file drafts",
+        "tags": [
+          "File drafts"
+        ]
+      }
+    },
+    "/v1/repos/{owner}/{rname}/file-drafts": {
+      "get": {
+        "operationId": "file_draft.list",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "stream",
+            "required": false,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListFileDraftsResponse"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "List private file drafts",
+        "tags": [
+          "File drafts"
+        ]
+      }
+    },
     "/v1/repos/{owner}/{rname}/files/{*path}": {
       "get": {
         "operationId": "tree.file",
diff --git a/migrations/postgres/0012_file_drafts.sql b/migrations/postgres/0012_file_drafts.sql
new file mode 100644
index 00000000..944c05d8
--- /dev/null
+++ b/migrations/postgres/0012_file_drafts.sql
@@ -0,0 +1,15 @@
+CREATE TABLE file_drafts (
+    owner TEXT NOT NULL,
+    stream TEXT NOT NULL,
+    path TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    base TEXT,
+    original_blob_id TEXT,
+    executable BIGINT NOT NULL,
+    file_type TEXT NOT NULL,
+    content BYTEA NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (owner, stream, path),
+    CHECK ((base IS NULL AND original_blob_id IS NULL AND file_type = '' AND executable = 0) OR
+           (base IS NOT NULL AND original_blob_id IS NOT NULL AND file_type IN ('regular', 'symlink')))
+);
diff --git a/migrations/sqlite/0012_file_drafts.sql b/migrations/sqlite/0012_file_drafts.sql
new file mode 100644
index 00000000..bfb0d600
--- /dev/null
+++ b/migrations/sqlite/0012_file_drafts.sql
@@ -0,0 +1,15 @@
+CREATE TABLE file_drafts (
+    owner TEXT NOT NULL,
+    stream TEXT NOT NULL,
+    path TEXT NOT NULL,
+    version BIGINT NOT NULL CHECK (version > 0),
+    base TEXT,
+    original_blob_id TEXT,
+    executable BIGINT NOT NULL,
+    file_type TEXT NOT NULL,
+    content BLOB NOT NULL,
+    updated_at BIGINT NOT NULL,
+    PRIMARY KEY (owner, stream, path),
+    CHECK ((base IS NULL AND original_blob_id IS NULL AND file_type = '' AND executable = 0) OR
+           (base IS NOT NULL AND original_blob_id IS NOT NULL AND file_type IN ('regular', 'symlink')))
+);
diff --git a/proto/agwp/v1/agwp.proto b/proto/agwp/v1/agwp.proto
index 5b364d32..1f098870 100644
--- a/proto/agwp/v1/agwp.proto
+++ b/proto/agwp/v1/agwp.proto
@@ -820,6 +820,45 @@ message ClearCommentDraftRequest {
   uint64 expected_version = 3;
 }
 
+// Private existing-file edit owned by the current acting identity.
+message FileDraft {
+  bool present = 1;
+  uint64 version = 2;
+  string stream = 3;
+  string path = 4;
+  string base = 5;
+  string original_blob_id = 6;
+  string file_type = 7;
+  bool executable = 8;
+  bytes content = 9;
+  int64 updated_at_ms = 10;
+}
+message GetFileDraftRequest { string repo = 1; string stream = 2; string path = 3; }
+message SaveFileDraftRequest {
+  string repo = 1;
+  string stream = 2;
+  string path = 3;
+  string base = 4;
+  bytes content = 5;
+  uint64 expected_version = 6;
+}
+message ClearFileDraftRequest {
+  string repo = 1;
+  string stream = 2;
+  string path = 3;
+  uint64 expected_version = 4;
+}
+message ListFileDraftsRequest { string repo = 1; string stream = 2; }
+// Discovery carries no private replacement bytes.
+message FileDraftSummary {
+  string stream = 1;
+  string path = 2;
+  string base = 3;
+  uint64 version = 4;
+  int64 updated_at_ms = 5;
+}
+message ListFileDraftsResponse { repeated FileDraftSummary drafts = 1; }
+
 // Replaces review routing after comparing the complete inspected set.
 message SetRequestedReviewersRequest {
   string repo = 1;
@@ -2095,3 +2134,10 @@ message SetTaskAttemptLimitRequest {
   uint32 expected_max_attempts = 4;
   string idempotency_key = 5;
 }
+
+service FileDraftService {
+  rpc Get(GetFileDraftRequest) returns (FileDraft);
+  rpc Save(SaveFileDraftRequest) returns (FileDraft);
+  rpc Clear(ClearFileDraftRequest) returns (FileDraft);
+  rpc List(ListFileDraftsRequest) returns (ListFileDraftsResponse);
+}

From 950d935d314ec17573354278c8618a11fb3b92cd Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:37:42 +0000
Subject: [PATCH 28/41] feat(web): save and reopen private file edits

---
 apps/web/src/api/endpoints.ts                 |  15 +
 apps/web/src/api/schema.gen.ts                | 287 ++++++++++++++++++
 apps/web/src/api/types.ts                     |   2 +
 apps/web/src/components/files/FileEditor.vue  | 234 ++++++++++++--
 .../src/components/files/MissingFileDraft.vue |  16 +-
 apps/web/src/views/FilesView.vue              |  27 ++
 6 files changed, 551 insertions(+), 30 deletions(-)

diff --git a/apps/web/src/api/endpoints.ts b/apps/web/src/api/endpoints.ts
index 589dae47..c4fc6267 100644
--- a/apps/web/src/api/endpoints.ts
+++ b/apps/web/src/api/endpoints.ts
@@ -35,6 +35,8 @@ import type {
   Review,
   ReviewDraft,
   CommentDraft,
+  FileDraft,
+  FileDraftSummary,
   ReviewThread,
   ThreadComment,
   RoleBinding,
@@ -64,6 +66,19 @@ export function createApi(c: ApiClient) {
   const r = repoPath
   return {
     client: c,
+    files: {
+      draft: (repo: string, stream: string, path: string, options?: SessionOpts) =>
+        c.get<FileDraft>(r(repo, '/file-draft'), { stream, path }, options),
+      listDrafts: async (repo: string, stream: string, options?: SessionOpts) =>
+        (await c.get<{ drafts: FileDraftSummary[] }>(r(repo, '/file-drafts'), { stream }, options)).drafts ?? [],
+      saveDraft: (
+        repo: string,
+        body: { stream: string; path: string; base: string; content: string; expected_version: number },
+        options?: SessionOpts,
+      ) => c.json<FileDraft>(r(repo, '/file-draft'), { ...options, method: 'PUT', body }),
+      clearDraft: (repo: string, stream: string, path: string, expectedVersion: number, options?: SessionOpts) =>
+        c.del<FileDraft>(r(repo, '/file-draft'), { stream, path, expected_version: expectedVersion }, options),
+    },
 
     // ---- session --------------------------------------------------------------------------------
     capabilities: (o?: Opts) =>
diff --git a/apps/web/src/api/schema.gen.ts b/apps/web/src/api/schema.gen.ts
index 2aed6046..85c8c1e2 100644
--- a/apps/web/src/api/schema.gen.ts
+++ b/apps/web/src/api/schema.gen.ts
@@ -366,6 +366,42 @@ export interface paths {
     patch?: never
     trace?: never
   }
+  '/v1/repos/{owner}/{rname}/file-draft': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /** Get private file drafts */
+    get: operations['file_draft.get']
+    /** Save private file drafts */
+    put: operations['file_draft.save']
+    post?: never
+    /** Clear private file drafts */
+    delete: operations['file_draft.clear']
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/v1/repos/{owner}/{rname}/file-drafts': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /** List private file drafts */
+    get: operations['file_draft.list']
+    put?: never
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
   '/v1/repos/{owner}/{rname}/files/{*path}': {
     parameters: {
       query?: never
@@ -2025,6 +2061,19 @@ export interface components {
       /** @default  */
       repo: string
     }
+    ClearFileDraftRequest: {
+      /**
+       * Format: int64
+       * @default 0
+       */
+      expected_version: number
+      /** @default  */
+      path: string
+      /** @default  */
+      repo: string
+      /** @default  */
+      stream: string
+    }
     ClearReviewDraftRequest: {
       /**
        * Format: int64
@@ -2648,6 +2697,57 @@ export interface components {
        */
       truncated: boolean
     }
+    /** @description Private existing-file edit owned by the current acting identity. */
+    FileDraft: {
+      /** @default  */
+      base: string
+      /**
+       * Format: byte
+       * @default []
+       */
+      content: string
+      /** @default false */
+      executable: boolean
+      /** @default  */
+      file_type: string
+      /** @default  */
+      original_blob_id: string
+      /** @default  */
+      path: string
+      /** @default false */
+      present: boolean
+      /** @default  */
+      stream: string
+      /**
+       * Format: int64
+       * @default 0
+       */
+      updated_at_ms: number
+      /**
+       * Format: int64
+       * @default 0
+       */
+      version: number
+    }
+    /** @description Discovery carries no private replacement bytes. */
+    FileDraftSummary: {
+      /** @default  */
+      base: string
+      /** @default  */
+      path: string
+      /** @default  */
+      stream: string
+      /**
+       * Format: int64
+       * @default 0
+       */
+      updated_at_ms: number
+      /**
+       * Format: int64
+       * @default 0
+       */
+      version: number
+    }
     FileOp: {
       /**
        * @description Content blob (put only).
@@ -2820,6 +2920,14 @@ export interface components {
       /** @default  */
       repo: string
     }
+    GetFileDraftRequest: {
+      /** @default  */
+      path: string
+      /** @default  */
+      repo: string
+      /** @default  */
+      stream: string
+    }
     GetIssueRequest: {
       /**
        * Format: int64
@@ -3309,6 +3417,16 @@ export interface components {
       /** @default  */
       tree_id: string
     }
+    ListFileDraftsRequest: {
+      /** @default  */
+      repo: string
+      /** @default  */
+      stream: string
+    }
+    ListFileDraftsResponse: {
+      /** @default [] */
+      drafts: components['schemas']['FileDraftSummary'][]
+    }
     ListIssueActivityRequest: {
       /**
        * Format: int64
@@ -4739,6 +4857,26 @@ export interface components {
       /** @default  */
       repo: string
     }
+    SaveFileDraftRequest: {
+      /** @default  */
+      base: string
+      /**
+       * Format: byte
+       * @default []
+       */
+      content: string
+      /**
+       * Format: int64
+       * @default 0
+       */
+      expected_version: number
+      /** @default  */
+      path: string
+      /** @default  */
+      repo: string
+      /** @default  */
+      stream: string
+    }
     SaveReviewDraftRequest: {
       /** @default  */
       body: string
@@ -6202,6 +6340,155 @@ export interface operations {
       }
     }
   }
+  'file_draft.get': {
+    parameters: {
+      query?: {
+        path?: string
+        stream?: string
+      }
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+      }
+      cookie?: never
+    }
+    requestBody?: never
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['FileDraft']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
+  'file_draft.save': {
+    parameters: {
+      query?: never
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+      }
+      cookie?: never
+    }
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SaveFileDraftRequest']
+      }
+    }
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['FileDraft']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
+  'file_draft.clear': {
+    parameters: {
+      query?: {
+        expected_version?: number
+        path?: string
+        stream?: string
+      }
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+      }
+      cookie?: never
+    }
+    requestBody?: never
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['FileDraft']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
+  'file_draft.list': {
+    parameters: {
+      query?: {
+        stream?: string
+      }
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+      }
+      cookie?: never
+    }
+    requestBody?: never
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ListFileDraftsResponse']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
   'tree.file': {
     parameters: {
       query?: {
diff --git a/apps/web/src/api/types.ts b/apps/web/src/api/types.ts
index 4206fbe5..aa40b598 100644
--- a/apps/web/src/api/types.ts
+++ b/apps/web/src/api/types.ts
@@ -29,6 +29,8 @@ export type Proposal = S['Proposal']
 export type Review = S['Review']
 export type ReviewDraft = S['ReviewDraft']
 export type CommentDraft = S['CommentDraft']
+export type FileDraft = S['FileDraft']
+export type FileDraftSummary = S['FileDraftSummary']
 export type ReviewThread = S['ReviewThread']
 export type ThreadComment = S['ThreadComment']
 export type ReviewLineAnchor = S['ReviewLineAnchor']
diff --git a/apps/web/src/components/files/FileEditor.vue b/apps/web/src/components/files/FileEditor.vue
index 1bb606dc..04667d9a 100644
--- a/apps/web/src/components/files/FileEditor.vue
+++ b/apps/web/src/components/files/FileEditor.vue
@@ -3,7 +3,8 @@ import { computed, onBeforeUnmount, ref, watch } from 'vue'
 import { useRouter } from 'vue-router'
 import { api } from '@/api/instance'
 import { ApiError, describeError } from '@/api/errors'
-import { pathProblem, proposeChange, putFile } from '@/lib/edit'
+import { pathProblem, proposeChange, putFile, toBase64 } from '@/lib/edit'
+import { decodeUtf8, looksBinary, preserveTextFormat } from '@/lib/text'
 import { useBoard } from '@/stores/board'
 import { useToasts } from '@/stores/toasts'
 import { useUnsavedChanges } from '@/composables/useUnsavedChanges'
@@ -73,16 +74,18 @@ const draft = useFileDraft({
   isNew: !!props.isNew,
 })
 const recovered = draft.initial
-const originalText = recovered?.original ?? props.original
-const executable = recovered?.executable ?? props.executable === true
-const fileType = recovered?.fileType ?? (props.fileType === 'symlink' ? 'symlink' : 'regular')
+const originalText = ref(recovered?.original ?? props.original)
+const executable = ref(recovered?.executable ?? props.executable === true)
+const fileType = ref(recovered?.fileType ?? (props.fileType === 'symlink' ? 'symlink' : 'regular'))
 
 const initialPath = props.isNew ? (props.path ? `${props.path}/` : '') : props.path
 const newPath = ref(recovered?.path ?? initialPath)
 const text = ref(recovered?.text ?? props.original)
 const filePath = computed(() => (props.isNew ? newPath.value.trim() : props.path))
 const problem = computed(() => (props.isNew && newPath.value ? pathProblem(newPath.value) : null))
-const changed = computed(() => (props.isNew ? filePath.value !== '' : text.value !== originalText))
+const changed = computed(() =>
+  props.isNew ? filePath.value !== '' : text.value !== originalText.value,
+)
 const base = useResource(async () =>
   recovered
     ? recovered.base
@@ -90,9 +93,25 @@ const base = useResource(async () =>
       ? (await api.streams.head(props.repo, props.stream)).head
       : props.rev,
 )
+const restoredBase = ref<string | null>(null)
+const startingBase = computed(() => restoredBase.value ?? base.data.value)
+const accountSupported = computed(
+  () => !props.isNew && !!auth.capabilities?.features.includes('files.drafts'),
+)
+type AccountFileDraft = Awaited<ReturnType<typeof api.files.draft>>
+const accountAvailable = ref<AccountFileDraft | null>(null)
+const accountBusy = ref(false)
+const accountLoaded = ref(false)
+const accountError = ref('')
+const accountRestored = ref(false)
+let accountVersion = 0
+let adoptedVersion: number | null = null
+let restoringAccount = false
+
 const canPropose = computed(
   () =>
     auth.status === 'ready' &&
+    !accountBusy.value &&
     changed.value &&
     base.settled.value &&
     !base.error.value &&
@@ -106,10 +125,11 @@ const busy = ref(false)
 const error = ref<ApiError | null>(null)
 const submitted = ref(false)
 const dirty = computed(
-  () => !submitted.value && (text.value !== originalText || newPath.value !== initialPath),
+  () => !submitted.value && (text.value !== originalText.value || newPath.value !== initialPath),
 )
 const replaceDraft = ref(false)
 function persistDraft() {
+  if (restoringAccount) return
   if (submitted.value) {
     draft.clear()
     return
@@ -118,19 +138,19 @@ function persistDraft() {
     if (!draft.blocked.value) draft.clear()
     return
   }
-  if (!base.settled.value || base.error.value || base.data.value === undefined) return
+  if (!base.settled.value || base.error.value || startingBase.value === undefined) return
   draft.save({
     text: text.value,
-    original: originalText,
+    original: originalText.value,
     path: newPath.value,
-    base: base.data.value,
-    executable,
-    fileType,
+    base: startingBase.value,
+    executable: executable.value,
+    fileType: fileType.value,
     title: title.value,
     description: description.value,
   })
 }
-watch([text, newPath, title, description, base.data, base.settled, submitted], persistDraft, {
+watch([text, newPath, title, description, startingBase, base.settled, submitted], persistDraft, {
   flush: 'sync',
 })
 const { askingToLeave, requestLeave, decide } = useUnsavedChanges(dirty, busy)
@@ -153,7 +173,11 @@ async function cancel() {
 let draftUrl = ''
 function downloadDraft() {
   if (draftUrl) URL.revokeObjectURL(draftUrl)
-  draftUrl = URL.createObjectURL(new Blob([text.value], { type: 'text/plain;charset=utf-8' }))
+  draftUrl = URL.createObjectURL(
+    new Blob([preserveTextFormat(originalText.value, text.value)], {
+      type: 'text/plain;charset=utf-8',
+    }),
+  )
   const link = document.createElement('a')
   link.href = draftUrl
   link.download = filePath.value.split('/').pop() || 'draft.txt'
@@ -165,6 +189,118 @@ onBeforeUnmount(() => {
   if (draftUrl) URL.revokeObjectURL(draftUrl)
 })
 
+async function restoreAccountDraft(saved: AccountFileDraft) {
+  const mine = submission
+  const token = auth.token
+  accountBusy.value = true
+  accountError.value = ''
+  try {
+    const original = await api.tree.file(props.repo, saved.base, props.path, 4 * 1024 * 1024)
+    const bytes = Uint8Array.from(atob(saved.content), (char) => char.charCodeAt(0))
+    if (original.truncated || looksBinary(original.bytes) || looksBinary(bytes))
+      throw new Error(
+        'This account draft cannot be opened in the text editor. Use the CLI to retrieve it.',
+      )
+    if (mine !== submission || token !== auth.token) return
+    restoringAccount = true
+    originalText.value = decodeUtf8(original.bytes)
+    executable.value = saved.executable
+    fileType.value = saved.file_type === 'symlink' ? 'symlink' : 'regular'
+    restoredBase.value = saved.base
+    text.value = decodeUtf8(bytes)
+    adoptedVersion = saved.version
+    accountAvailable.value = null
+    accountRestored.value = true
+    restoringAccount = false
+    persistDraft()
+  } catch (cause) {
+    if (mine === submission && token === auth.token) accountError.value = describeError(cause)
+  } finally {
+    restoringAccount = false
+    if (mine === submission) accountBusy.value = false
+  }
+}
+async function loadAccountDraft() {
+  if (!accountSupported.value || auth.status !== 'ready') return
+  const mine = submission
+  const token = auth.token
+  accountBusy.value = true
+  accountLoaded.value = false
+  accountError.value = ''
+  adoptedVersion = null
+  try {
+    const saved = await api.files.draft(props.repo, props.stream, props.path, { token })
+    if (mine !== submission || token !== auth.token) return
+    accountVersion = saved.version
+    accountLoaded.value = true
+    accountAvailable.value = null
+    if (!saved.present) return
+    accountAvailable.value = saved
+    if (!dirty.value) await restoreAccountDraft(saved)
+  } catch (cause) {
+    if (mine === submission && token === auth.token) accountError.value = describeError(cause)
+  } finally {
+    if (mine === submission) accountBusy.value = false
+  }
+}
+function keepTabDraft() {
+  accountAvailable.value = null
+  adoptedVersion = null
+}
+async function saveAccountDraft() {
+  if (
+    !accountSupported.value ||
+    !accountLoaded.value ||
+    accountBusy.value ||
+    busy.value ||
+    submitted.value ||
+    accountAvailable.value ||
+    !startingBase.value
+  )
+    return
+  const content = preserveTextFormat(originalText.value, text.value)
+  if (new TextEncoder().encode(content).length > 4 * 1024 * 1024) {
+    accountError.value =
+      'Account file drafts are limited to 4 MiB. Download this draft to keep a copy.'
+    return
+  }
+  const mine = submission
+  const token = auth.token
+  accountBusy.value = true
+  accountError.value = ''
+  try {
+    const saved = await api.files.saveDraft(
+      props.repo,
+      {
+        stream: props.stream,
+        path: props.path,
+        base: startingBase.value,
+        content: toBase64(content),
+        expected_version: accountVersion,
+      },
+      { token, quietUnauthenticated: true },
+    )
+    if (mine !== submission || token !== auth.token) return
+    accountVersion = saved.version
+    adoptedVersion = saved.version
+    toasts.ok('File draft saved to your account')
+  } catch (cause) {
+    if (mine !== submission || token !== auth.token) return
+    accountError.value = describeError(cause)
+    if (cause instanceof ApiError && cause.code === 'failed_precondition')
+      accountLoaded.value = false
+  } finally {
+    if (mine === submission) accountBusy.value = false
+  }
+}
+watch(
+  [accountSupported, () => auth.status],
+  () => {
+    void loadAccountDraft()
+  },
+  { immediate: true },
+)
+
 function ask() {
   if (!title.value) title.value = props.isNew ? `Add ${filePath.value}` : `Update ${filePath.value}`
   error.value = null
@@ -172,9 +308,17 @@ function ask() {
 }
 
 async function propose() {
-  if (busy.value || !canPropose.value || !title.value.trim() || error.value?.isUnauthenticated)
+  if (
+    busy.value ||
+    submitted.value ||
+    !canPropose.value ||
+    !title.value.trim() ||
+    error.value?.isUnauthenticated
+  )
     return
   const mine = ++submission
+  const cleanupVersion = adoptedVersion
+  const token = auth.token
   const current = new AbortController()
   controller = current
   busy.value = true
@@ -183,26 +327,38 @@ async function propose() {
     const p = await proposeChange(api, {
       repo: props.repo,
       stream: props.stream,
-      fromRev: base.data.value || undefined,
-      expectedBase: base.data.value,
+      fromRev: startingBase.value || undefined,
+      expectedBase: startingBase.value,
       changes: [
         putFile(
           filePath.value,
-          text.value,
-          executable,
-          fileType === 'symlink' ? 'symlink' : undefined,
+          preserveTextFormat(originalText.value, text.value),
+          executable.value,
+          fileType.value === 'symlink' ? 'symlink' : undefined,
         ),
       ],
       title: title.value.trim(),
       description: description.value.trim() || undefined,
-      request: { token: auth.token, quietUnauthenticated: true, signal: current.signal },
+      request: { token, quietUnauthenticated: true, signal: current.signal },
     })
     if (mine !== submission || current.signal.aborted) return
     submitted.value = true
-    busy.value = false
     asking.value = false
     board.touched(['proposals', 'streams', 'predict'])
     toasts.ok('Change request opened', p.title)
+    if (cleanupVersion !== null) {
+      try {
+        await api.files.clearDraft(props.repo, props.stream, props.path, cleanupVersion, {
+          token,
+          signal: current.signal,
+          quietUnauthenticated: true,
+        })
+      } catch (cause) {
+        if (mine === submission) toasts.warn('Account draft kept', describeError(cause))
+      }
+      if (mine !== submission || current.signal.aborted) return
+    }
+    busy.value = false
     await router.push({
       name: 'proposal',
       params: { owner: props.repo.split('/')[0], name: props.repo.split('/')[1], id: p.id },
@@ -234,6 +390,24 @@ async function propose() {
         >Replace the unreadable draft</Button
       >
     </Alert>
+    <Alert v-if="accountAvailable" tone="info" title="An account file draft is available">
+      Your tab draft is unchanged. Choose which copy to continue.
+      <div class="btns">
+        <Button :disabled="busy || accountBusy" @click="restoreAccountDraft(accountAvailable)"
+          >Restore account draft</Button
+        >
+        <Button :disabled="busy || accountBusy" @click="keepTabDraft">Keep tab draft</Button>
+      </div>
+    </Alert>
+    <p v-else-if="accountRestored" class="faint" role="status">
+      Account draft restored with its original starting revision.
+    </p>
+    <Alert v-if="accountError" tone="warn">
+      {{ accountError }}
+      <Button :disabled="busy || accountBusy" @click="loadAccountDraft"
+        >Reload account draft</Button
+      >
+    </Alert>
     <ErrorState
       v-if="base.error.value"
       what="the starting revision"
@@ -256,7 +430,7 @@ async function propose() {
       v-model="text"
       :label="fileType === 'symlink' ? 'Link target' : isNew ? 'Contents' : `Contents of ${path}`"
       :rows="fileType === 'symlink' ? 3 : 18"
-      :disabled="busy"
+      :disabled="busy || accountBusy"
       mono
     />
     <div class="bar">
@@ -267,11 +441,21 @@ async function propose() {
             : 'No changes yet.'
         }}
         <span v-if="draft.saved.value" role="status" data-testid="draft-saved">
-          Draft saved in this tab. It survives reload and sign-in here; download it before closing
-          the tab.</span
+          {{
+            accountSupported
+              ? 'Draft saved in this tab. Save to account to continue on another device.'
+              : 'Draft saved in this tab. It survives reload and sign-in here; download it before closing the tab.'
+          }}</span
         >
       </p>
       <div class="btns">
+        <Button
+          v-if="accountSupported"
+          :loading="accountBusy"
+          :disabled="busy || !changed || !accountLoaded || !!accountAvailable"
+          @click="saveAccountDraft"
+          >Save to account</Button
+        >
         <Button :disabled="!dirty" icon="download" @click="downloadDraft">Download draft</Button>
         <Button :disabled="busy" @click="cancel">Cancel</Button>
         <Button
@@ -288,7 +472,7 @@ async function propose() {
     <Dialog
       :model-value="askingToLeave"
       title="Leave without proposing?"
-      description="Your edits have not been sent to the server. Keep editing, or discard them to continue."
+      description="Your edits have not been proposed. Keep editing, or discard this tab’s copy to continue."
       size="sm"
       alert
       @update:model-value="decide(false)"
diff --git a/apps/web/src/components/files/MissingFileDraft.vue b/apps/web/src/components/files/MissingFileDraft.vue
index 1513de64..1cc69d8e 100644
--- a/apps/web/src/components/files/MissingFileDraft.vue
+++ b/apps/web/src/components/files/MissingFileDraft.vue
@@ -4,7 +4,13 @@ import { useAuth } from '@/stores/auth'
 import { useFileDraft } from '@/composables/useFileDraft'
 import FileEditor from './FileEditor.vue'
 
-const props = defineProps<{ repo: string; stream: string; path: string; enabled: boolean }>()
+const props = defineProps<{
+  repo: string
+  stream: string
+  path: string
+  enabled: boolean
+  accountSaved?: boolean
+}>()
 const emit = defineEmits<{ cancel: [] }>()
 const draft = useFileDraft({
   identity: useAuth().identity,
@@ -24,7 +30,7 @@ async function leave() {
 </script>
 
 <template>
-  <div v-if="enabled && saved && !dismissed" class="recovery">
+  <div v-if="enabled && (saved || accountSaved) && !dismissed" class="recovery">
     <p class="missing">
       This file was removed or moved. Proposing your recovered draft opens a review against the
       current branch.
@@ -34,9 +40,9 @@ async function leave() {
       :stream="stream"
       :rev="stream"
       :path="path"
-      :original="saved.original"
-      :executable="saved.executable"
-      :file-type="saved.fileType"
+      :original="saved?.original ?? ''"
+      :executable="saved?.executable"
+      :file-type="saved?.fileType"
       @cancel="leave"
     />
   </div>
diff --git a/apps/web/src/views/FilesView.vue b/apps/web/src/views/FilesView.vue
index dc0b1abb..d9e73881 100644
--- a/apps/web/src/views/FilesView.vue
+++ b/apps/web/src/views/FilesView.vue
@@ -149,6 +149,16 @@ const streamNames = computed(() => board.streams.map((s) => s.name))
 const canEdit = computed(
   () => auth.can(repo.value, 'editFiles') && streamNames.value.includes(rev.value),
 )
+const accountDraftsSupported = computed(
+  () => canEdit.value && !!auth.capabilities?.features.includes('files.drafts'),
+)
+const accountDrafts = useResource(
+  (signal) => api.files.listDrafts(repo.value, rev.value, { signal, token: auth.token }),
+  {
+    watch: [repo, rev, () => auth.identity, () => auth.token, accountDraftsSupported],
+    enabled: () => accountDraftsSupported.value,
+  },
+)
 const writing = ref(false)
 const uploading = ref(false)
 watch([rev, path, repo], () => {
@@ -227,6 +237,22 @@ onBeforeUnmount(() => window.removeEventListener('keydown', findShortcut))
       </form>
     </div>
 
+    <details v-if="accountDrafts.data.value?.length" class="saved-file-drafts">
+      <summary>Saved file drafts ({{ accountDrafts.data.value.length }})</summary>
+      <ul>
+        <li v-for="saved in accountDrafts.data.value" :key="saved.path">
+          <RouterLink :to="to(saved.path)">{{ saved.path }}</RouterLink>
+        </li>
+      </ul>
+    </details>
+    <ErrorState
+      v-if="accountDrafts.error.value"
+      what="saved account file drafts"
+      :error="accountDrafts.error.value"
+      compact
+      @retry="accountDrafts.reload()"
+    />
+
     <FileFinder
       v-model="finding"
       :repo="repo"
@@ -286,6 +312,7 @@ onBeforeUnmount(() => window.removeEventListener('keydown', findShortcut))
           :stream="rev"
           :path="path"
           :enabled="canEdit"
+          :account-saved="accountDrafts.data.value?.some((saved) => saved.path === path) === true"
           @cancel="router.push(to(''))"
         >
           <EmptyState

From 16f7dd29a993517c94a35285ec1d5f212c3dd703 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:37:59 +0000
Subject: [PATCH 29/41] feat(clients): manage private file drafts through SDKs
 and MCP

---
 crates/ag-mcp/src/tools/file_drafts.rs        | 144 +++++++++
 crates/ag-mcp/src/tools/mod.rs                |  14 +-
 sdk/api-policy.json                           |   7 +-
 sdk/python/README.md                          |   7 +
 sdk/python/src/agentgit/_generated/models.py  |  73 +++++
 .../src/agentgit/_generated/namespaces.py     | 121 ++++++++
 .../src/agentgit/_generated/operations.py     |  66 ++++
 sdk/python/src/agentgit/client.py             |   6 +
 sdk/python/tests/test_all_operations.py       |  13 +
 sdk/typescript/README.md                      |   7 +
 sdk/typescript/src/generated/api.ts           |  16 +
 sdk/typescript/src/generated/models.ts        |   7 +
 sdk/typescript/src/generated/operations.ts    |  60 ++++
 sdk/typescript/src/generated/schema.ts        | 287 ++++++++++++++++++
 sdk/typescript/test/all-operations.test.ts    |  13 +
 15 files changed, 838 insertions(+), 3 deletions(-)
 create mode 100644 crates/ag-mcp/src/tools/file_drafts.rs

diff --git a/crates/ag-mcp/src/tools/file_drafts.rs b/crates/ag-mcp/src/tools/file_drafts.rs
new file mode 100644
index 00000000..653def0c
--- /dev/null
+++ b/crates/ag-mcp/src/tools/file_drafts.rs
@@ -0,0 +1,144 @@
+//! Private, account-backed file edits; saving never changes a workspace or stream.
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use serde_json::{Value, json};
+
+use super::*;
+use crate::api::{enc, repo_path};
+
+const MAX_BYTES: usize = 4 * 1024 * 1024;
+const MAX_BASE64: usize = MAX_BYTES.div_ceil(3) * 4;
+
+fn request(ctx: &CallCtx<'_>, args: &Value, method: &str, list: bool) -> Result<ToolOutput, ToolError> {
+    let repo = ctx.repo(args)?;
+    let opts = ctx.opts(ctx.run_id(args)?);
+    if !ctx.api.supports("files.drafts", &opts)? {
+        return Err(ToolError::local("server_update_required", "This server does not support private file drafts."));
+    }
+    let stream = str_arg(args, "stream").unwrap_or_default();
+    let endpoint = if list { "file-drafts" } else { "file-draft" };
+    let path = format!("{}/{endpoint}", repo_path(&repo));
+    let mut query = vec![("stream", stream.to_string())];
+    if !list {
+        let file = str_arg(args, "path").unwrap_or_default();
+        super::workspace::validate_repo_path(file).map_err(ToolError::invalid)?;
+        query.push(("path", file.to_string()));
+    }
+    let value = match method {
+        "PUT" => ctx.api.send("PUT", &path, Some(&save_body(args)?), &opts)?,
+        "DELETE" => {
+            let version =
+                u64_arg(args, "expected_version").ok_or_else(|| ToolError::invalid("expected_version is required"))?;
+            let url = format!("{path}?stream={}&path={}&expected_version={version}", enc(stream), enc(&query[1].1));
+            ctx.api.send("DELETE", &url, None, &opts)?
+        }
+        _ => ctx.api.get(&path, &query, &opts)?,
+    };
+    let data = if list { value } else { json!({"draft":value}) };
+    Ok(ToolOutput::new("Private file drafts only. No workspace, stream or proposal was changed.", data)
+        .note("Draft content is base64. Never save truncated output as a complete file."))
+}
+
+fn save_body(args: &Value) -> Result<Value, ToolError> {
+    let bytes = match (str_arg(args, "content"), str_arg(args, "content_base64")) {
+        (Some(text), None) => text.as_bytes().to_vec(),
+        (None, Some(encoded)) if encoded.len() <= MAX_BASE64 => {
+            STANDARD.decode(encoded).map_err(|_| ToolError::invalid("content_base64 must be valid base64"))?
+        }
+        (None, Some(_)) => return Err(ToolError::invalid("File draft content exceeds 4 MiB")),
+        _ => return Err(ToolError::invalid("Give exactly one of content or content_base64")),
+    };
+    if bytes.len() > MAX_BYTES {
+        return Err(ToolError::invalid("File draft content exceeds 4 MiB"));
+    }
+    Ok(json!({
+        "stream":str_arg(args,"stream").unwrap_or_default(),
+        "path":str_arg(args,"path").unwrap_or_default(),
+        "base":str_arg(args,"base").unwrap_or_default(),
+        "content":STANDARD.encode(bytes),
+        "expected_version":u64_arg(args,"expected_version")
+            .ok_or_else(|| ToolError::invalid("expected_version is required"))?,
+    }))
+}
+
+fn get(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    request(ctx, args, "GET", false)
+}
+fn list(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    request(ctx, args, "GET", true)
+}
+fn save(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    request(ctx, args, "PUT", false)
+}
+fn clear(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    request(ctx, args, "DELETE", false)
+}
+
+/// Registers explicit private draft actions under the workspace permission group.
+pub fn tools() -> Vec<ToolDef> {
+    let common = || vec![p_repo(), ("stream", t_str("Exact stream name.")), p_run()];
+    let keyed = || {
+        let mut fields = common();
+        fields.push(("path", t_str_max("Existing repository-relative file path.", 1024)));
+        fields
+    };
+    let guarded = || {
+        let mut fields = keyed();
+        fields.push((
+            "expected_version",
+            t_int("Version returned by file_draft_get; zero only before the first save.", 0, i64::MAX),
+        ));
+        fields
+    };
+    let mut save_fields = guarded();
+    save_fields.extend([
+        ("base", t_str("Exact changeset containing the original file. Saving never rebases the draft.")),
+        (
+            "content",
+            t_str_max("Complete edited file as UTF-8 text, up to 4 MiB. Use this or content_base64.", MAX_BYTES),
+        ),
+        ("content_base64", t_str_max("Complete edited binary file as base64. Use this or content.", MAX_BASE64)),
+    ]);
+    vec![
+        def(
+            "file_draft_get",
+            Group::Workspace,
+            "Read your private file draft",
+            "Reads your account's private draft for an existing file. Content is base64 and may be truncated by the configured output limit; it is never a published file.",
+            Ann::READ,
+            input(keyed(), &["stream", "path"]),
+            output(vec![("draft", o_obj())], &["draft"]),
+            get,
+        ),
+        def(
+            "file_draft_list",
+            Group::Workspace,
+            "List your private file drafts",
+            "Lists only your account's live draft metadata in this stream, without file contents. At most 20 live drafts exist per account and repository.",
+            Ann::READ,
+            input(common(), &["stream"]),
+            output(vec![("drafts", o_arr())], &["drafts"]),
+            list,
+        ),
+        def(
+            "file_draft_save",
+            Group::Workspace,
+            "Save a private file draft",
+            "Saves complete edited content against an inspected draft version and exact base changeset. Existing files only, up to 4 MiB. Does not publish, snapshot, rebase or change a workspace; stale versions preserve the other edit.",
+            Ann::SET,
+            input(save_fields, &["stream", "path", "base", "expected_version"]),
+            output(vec![("draft", o_obj())], &["draft"]),
+            save,
+        ),
+        def(
+            "file_draft_clear",
+            Group::Workspace,
+            "Clear your private file draft",
+            "Clears only your account's draft at the inspected version. A newer draft is retained on conflict. Clearing does not remove the repository file or change a workspace.",
+            Ann::DESTROY,
+            input(guarded(), &["stream", "path", "expected_version"]),
+            output(vec![("draft", o_obj())], &["draft"]),
+            clear,
+        ),
+    ]
+}
diff --git a/crates/ag-mcp/src/tools/mod.rs b/crates/ag-mcp/src/tools/mod.rs
index 69ca0a67..ff1c4453 100644
--- a/crates/ag-mcp/src/tools/mod.rs
+++ b/crates/ag-mcp/src/tools/mod.rs
@@ -11,6 +11,7 @@ use crate::output::{ToolError, ToolOutput};
 
 pub mod coordinate;
 pub mod discussions;
+pub mod file_drafts;
 pub mod proposals;
 pub mod read;
 pub mod workspace;
@@ -99,6 +100,7 @@ impl Registry {
         let mut tools = Vec::new();
         tools.extend(read::tools());
         tools.extend(workspace::tools());
+        tools.extend(file_drafts::tools());
         tools.extend(proposals::tools());
         tools.extend(discussions::tools());
         tools.extend(coordinate::tools());
@@ -424,13 +426,23 @@ mod tests {
                     // Private notes require the review opt-in even though reading does not mutate them.
                     assert!(t.ann.read_only);
                 }
+                Group::Workspace if matches!(t.name, "file_draft_get" | "file_draft_list") => {
+                    assert!(t.ann.read_only);
+                }
                 _ => assert!(!t.ann.read_only, "{} changes state so it cannot be marked read-only", t.name),
             }
         }
         let destructive: Vec<&str> = reg.all().iter().filter(|t| t.ann.destructive).map(|t| t.name).collect();
         assert_eq!(
             destructive,
-            ["workspace_delete", "proposal_close", "review_draft_clear", "comment_draft_clear", "integrate"],
+            [
+                "workspace_delete",
+                "file_draft_clear",
+                "proposal_close",
+                "review_draft_clear",
+                "comment_draft_clear",
+                "integrate"
+            ],
             "{destructive:?}"
         );
     }
diff --git a/sdk/api-policy.json b/sdk/api-policy.json
index 66a0b977..fec617b7 100644
--- a/sdk/api-policy.json
+++ b/sdk/api-policy.json
@@ -56,7 +56,9 @@
       "proposal.save_draft",
       "proposal.clear_draft",
       "proposal.save_comment_draft",
-      "proposal.clear_comment_draft"
+      "proposal.clear_comment_draft",
+      "file_draft.save",
+      "file_draft.clear"
     ],
     "naturalWhenFieldPresent": {
       "workspace.modify": "expected_head",
@@ -101,6 +103,7 @@
     "admin.roles": "roles",
     "admin": "admin",
     "migration": "migrations",
-    "issue": "issues"
+    "issue": "issues",
+    "file_draft": "drafts"
   }
 }
diff --git a/sdk/python/README.md b/sdk/python/README.md
index 493fa64b..fad28fd0 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -552,6 +552,13 @@ first. These drafts contain `head` and `body` (up to 16 KiB of UTF-8), remain se
 from review-decision drafts, and can be saved on closed proposals. Saving or clearing
 a draft never posts a comment; post explicitly after inspecting the current proposal head.
 
+Private file edits use `client.drafts.get`, `save`, `clear` and `list` after negotiating
+`files.drafts`. Identify the draft by repository, stream and existing file path.
+Save the complete base64-encoded file content with its original `base` changeset and
+inspected `expected_version`. Drafts are limited to 4 MiB each and 20 live drafts per
+account/repository. Listing returns metadata only. Saving never publishes a changeset;
+inspect the current file before explicitly applying a saved draft to a workspace.
+
 Servers advertising `workspaces.conflict_origins` may include `conflict.origin` with
 `base`, `ours`, and `theirs` source paths when a rename moved the file. During workspace
 sync, read `origin.ours` at the workspace head and `origin.theirs` at `stream_head`;
diff --git a/sdk/python/src/agentgit/_generated/models.py b/sdk/python/src/agentgit/_generated/models.py
index ecf88f85..a13c1c57 100644
--- a/sdk/python/src/agentgit/_generated/models.py
+++ b/sdk/python/src/agentgit/_generated/models.py
@@ -28,6 +28,7 @@
     "ClaimJobRequest",
     "ClaimJobResponse",
     "ClearCommentDraftRequest",
+    "ClearFileDraftRequest",
     "ClearReviewDraftRequest",
     "CloseProposalRequest",
     "CommentDraft",
@@ -62,6 +63,8 @@
     "FailJobRequest",
     "FileChange",
     "FileDiff",
+    "FileDraft",
+    "FileDraftSummary",
     "FileOp",
     "FinishTaskRequest",
     "FsckIssue",
@@ -72,6 +75,7 @@
     "GetCandidateRequest",
     "GetChangesetRequest",
     "GetCommentDraftRequest",
+    "GetFileDraftRequest",
     "GetIssueRequest",
     "GetJobRequest",
     "GetOperationRequest",
@@ -111,6 +115,8 @@
     "ListCredentialsResponse",
     "ListDirectoryRequest",
     "ListDirectoryResponse",
+    "ListFileDraftsRequest",
+    "ListFileDraftsResponse",
     "ListIssueActivityRequest",
     "ListIssueActivityResponse",
     "ListIssuesRequest",
@@ -210,6 +216,7 @@
     "RunQueueResponse",
     "RunSpec",
     "SaveCommentDraftRequest",
+    "SaveFileDraftRequest",
     "SaveReviewDraftRequest",
     "SaveRunOutputRequest",
     "SearchMatch",
@@ -465,6 +472,15 @@ class ClearCommentDraftRequest:
     repo: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class ClearFileDraftRequest:
+    """The `ClearFileDraftRequest` message."""
+    expected_version: int = field(default=0)
+    path: str = field(default="")
+    repo: str = field(default="")
+    stream: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class ClearReviewDraftRequest:
     """The `ClearReviewDraftRequest` message."""
@@ -803,6 +819,31 @@ class FileDiff:
     truncated: bool = field(default=False)
 
 
+@dataclass(kw_only=True)
+class FileDraft:
+    """Private existing-file edit owned by the current acting identity."""
+    base: str = field(default="")
+    content: str = field(default="")
+    executable: bool = field(default=False)
+    file_type: str = field(default="")
+    original_blob_id: str = field(default="")
+    path: str = field(default="")
+    present: bool = field(default=False)
+    stream: str = field(default="")
+    updated_at_ms: int = field(default=0)
+    version: int = field(default=0)
+
+
+@dataclass(kw_only=True)
+class FileDraftSummary:
+    """Discovery carries no private replacement bytes."""
+    base: str = field(default="")
+    path: str = field(default="")
+    stream: str = field(default="")
+    updated_at_ms: int = field(default=0)
+    version: int = field(default=0)
+
+
 @dataclass(kw_only=True)
 class FileOp:
     """The `FileOp` message."""
@@ -893,6 +934,14 @@ class GetCommentDraftRequest:
     repo: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class GetFileDraftRequest:
+    """The `GetFileDraftRequest` message."""
+    path: str = field(default="")
+    repo: str = field(default="")
+    stream: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class GetIssueRequest:
     """The `GetIssueRequest` message."""
@@ -1222,6 +1271,19 @@ class ListDirectoryResponse:
     tree_id: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class ListFileDraftsRequest:
+    """The `ListFileDraftsRequest` message."""
+    repo: str = field(default="")
+    stream: str = field(default="")
+
+
+@dataclass(kw_only=True)
+class ListFileDraftsResponse:
+    """The `ListFileDraftsResponse` message."""
+    drafts: list[FileDraftSummary] = field(default_factory=list)
+
+
 @dataclass(kw_only=True)
 class ListIssueActivityRequest:
     """The `ListIssueActivityRequest` message."""
@@ -2096,6 +2158,17 @@ class SaveCommentDraftRequest:
     repo: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class SaveFileDraftRequest:
+    """The `SaveFileDraftRequest` message."""
+    base: str = field(default="")
+    content: str = field(default="")
+    expected_version: int = field(default=0)
+    path: str = field(default="")
+    repo: str = field(default="")
+    stream: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class SaveReviewDraftRequest:
     """The `SaveReviewDraftRequest` message."""
diff --git a/sdk/python/src/agentgit/_generated/namespaces.py b/sdk/python/src/agentgit/_generated/namespaces.py
index 1fe949cf..947add42 100644
--- a/sdk/python/src/agentgit/_generated/namespaces.py
+++ b/sdk/python/src/agentgit/_generated/namespaces.py
@@ -28,6 +28,7 @@
     ClaimJobRequest,
     ClaimJobResponse,
     ClearCommentDraftRequest,
+    ClearFileDraftRequest,
     ClearReviewDraftRequest,
     CloseProposalRequest,
     CommentDraft,
@@ -62,6 +63,8 @@
     FailJobRequest,
     FileChange,
     FileDiff,
+    FileDraft,
+    FileDraftSummary,
     FileOp,
     FinishTaskRequest,
     FsckIssue,
@@ -72,6 +75,7 @@
     GetCandidateRequest,
     GetChangesetRequest,
     GetCommentDraftRequest,
+    GetFileDraftRequest,
     GetIssueRequest,
     GetJobRequest,
     GetOperationRequest,
@@ -111,6 +115,8 @@
     ListCredentialsResponse,
     ListDirectoryRequest,
     ListDirectoryResponse,
+    ListFileDraftsRequest,
+    ListFileDraftsResponse,
     ListIssueActivityRequest,
     ListIssueActivityResponse,
     ListIssuesRequest,
@@ -210,6 +216,7 @@
     RunQueueResponse,
     RunSpec,
     SaveCommentDraftRequest,
+    SaveFileDraftRequest,
     SaveReviewDraftRequest,
     SaveRunOutputRequest,
     SearchMatch,
@@ -576,6 +583,63 @@ def revoke(
 
 
 
+class DraftsApi:
+    """The `drafts` operations."""
+
+    __slots__ = ("_c",)
+
+    def __init__(self, caller: SyncCaller) -> None:
+        self._c = caller
+
+    def clear(
+        self,
+        *,
+        repo: str,
+        expected_version: int | None = None,
+        path: str | None = None,
+        stream: str | None = None,
+        options: CallOptions | None = None,
+    ) -> FileDraft:
+        """Clear private file drafts (`DELETE /v1/repos/{owner}/{rname}/file-draft`, operation `file_draft.clear`)."""
+        return self._c._call("file_draft.clear", {"repo": repo, "expected_version": expected_version, "path": path, "stream": stream}, options, FileDraft)
+
+    def get(
+        self,
+        *,
+        repo: str,
+        path: str | None = None,
+        stream: str | None = None,
+        options: CallOptions | None = None,
+    ) -> FileDraft:
+        """Get private file drafts (`GET /v1/repos/{owner}/{rname}/file-draft`, operation `file_draft.get`)."""
+        return self._c._call("file_draft.get", {"repo": repo, "path": path, "stream": stream}, options, FileDraft)
+
+    def list(
+        self,
+        *,
+        repo: str,
+        stream: str | None = None,
+        options: CallOptions | None = None,
+    ) -> ListFileDraftsResponse:
+        """List private file drafts (`GET /v1/repos/{owner}/{rname}/file-drafts`, operation `file_draft.list`)."""
+        return self._c._call("file_draft.list", {"repo": repo, "stream": stream}, options, ListFileDraftsResponse)
+
+    def save(
+        self,
+        *,
+        repo: str,
+        base: str | None = None,
+        content: str | None = None,
+        expected_version: int | None = None,
+        path: str | None = None,
+        stream: str | None = None,
+        options: CallOptions | None = None,
+    ) -> FileDraft:
+        """Save private file drafts (`PUT /v1/repos/{owner}/{rname}/file-draft`, operation `file_draft.save`)."""
+        return self._c._call("file_draft.save", {"repo": repo, "base": base, "content": content, "expected_version": expected_version, "path": path, "stream": stream}, options, FileDraft)
+
+
+
 class EventsApi:
     """The `events` operations."""
 
@@ -2282,6 +2346,63 @@ async def revoke(
 
 
 
+class AsyncDraftsApi:
+    """The `drafts` operations."""
+
+    __slots__ = ("_c",)
+
+    def __init__(self, caller: AsyncCaller) -> None:
+        self._c = caller
+
+    async def clear(
+        self,
+        *,
+        repo: str,
+        expected_version: int | None = None,
+        path: str | None = None,
+        stream: str | None = None,
+        options: CallOptions | None = None,
+    ) -> FileDraft:
+        """Clear private file drafts (`DELETE /v1/repos/{owner}/{rname}/file-draft`, operation `file_draft.clear`)."""
+        return await self._c._call("file_draft.clear", {"repo": repo, "expected_version": expected_version, "path": path, "stream": stream}, options, FileDraft)
+
+    async def get(
+        self,
+        *,
+        repo: str,
+        path: str | None = None,
+        stream: str | None = None,
+        options: CallOptions | None = None,
+    ) -> FileDraft:
+        """Get private file drafts (`GET /v1/repos/{owner}/{rname}/file-draft`, operation `file_draft.get`)."""
+        return await self._c._call("file_draft.get", {"repo": repo, "path": path, "stream": stream}, options, FileDraft)
+
+    async def list(
+        self,
+        *,
+        repo: str,
+        stream: str | None = None,
+        options: CallOptions | None = None,
+    ) -> ListFileDraftsResponse:
+        """List private file drafts (`GET /v1/repos/{owner}/{rname}/file-drafts`, operation `file_draft.list`)."""
+        return await self._c._call("file_draft.list", {"repo": repo, "stream": stream}, options, ListFileDraftsResponse)
+
+    async def save(
+        self,
+        *,
+        repo: str,
+        base: str | None = None,
+        content: str | None = None,
+        expected_version: int | None = None,
+        path: str | None = None,
+        stream: str | None = None,
+        options: CallOptions | None = None,
+    ) -> FileDraft:
+        """Save private file drafts (`PUT /v1/repos/{owner}/{rname}/file-draft`, operation `file_draft.save`)."""
+        return await self._c._call("file_draft.save", {"repo": repo, "base": base, "content": content, "expected_version": expected_version, "path": path, "stream": stream}, options, FileDraft)
+
+
+
 class AsyncEventsApi:
     """The `events` operations."""
 
diff --git a/sdk/python/src/agentgit/_generated/operations.py b/sdk/python/src/agentgit/_generated/operations.py
index 592b74c9..3e77771c 100644
--- a/sdk/python/src/agentgit/_generated/operations.py
+++ b/sdk/python/src/agentgit/_generated/operations.py
@@ -485,6 +485,66 @@
         idempotency_key=False,
         public=False,
     ),
+    "file_draft.clear": OperationInfo(
+        id="file_draft.clear",
+        http="DELETE",
+        route="/v1/repos/{owner}/{rname}/file-draft",
+        namespace="drafts",
+        name="clear",
+        summary="Clear private file drafts",
+        path_params=('owner', 'rname'),
+        query_params=('expected_version', 'path', 'stream'),
+        body="none",
+        response="json",
+        retry="natural",
+        idempotency_key=False,
+        public=False,
+    ),
+    "file_draft.get": OperationInfo(
+        id="file_draft.get",
+        http="GET",
+        route="/v1/repos/{owner}/{rname}/file-draft",
+        namespace="drafts",
+        name="get",
+        summary="Get private file drafts",
+        path_params=('owner', 'rname'),
+        query_params=('path', 'stream'),
+        body="none",
+        response="json",
+        retry="read",
+        idempotency_key=False,
+        public=False,
+    ),
+    "file_draft.list": OperationInfo(
+        id="file_draft.list",
+        http="GET",
+        route="/v1/repos/{owner}/{rname}/file-drafts",
+        namespace="drafts",
+        name="list",
+        summary="List private file drafts",
+        path_params=('owner', 'rname'),
+        query_params=('stream',),
+        body="none",
+        response="json",
+        retry="read",
+        idempotency_key=False,
+        public=False,
+    ),
+    "file_draft.save": OperationInfo(
+        id="file_draft.save",
+        http="PUT",
+        route="/v1/repos/{owner}/{rname}/file-draft",
+        namespace="drafts",
+        name="save",
+        summary="Save private file drafts",
+        path_params=('owner', 'rname'),
+        query_params=(),
+        body="json",
+        response="json",
+        retry="natural",
+        idempotency_key=False,
+        public=False,
+    ),
     "history.ancestors": OperationInfo(
         id="history.ancestors",
         http="POST",
@@ -1966,6 +2026,12 @@
         "mint": "admin.credentials.mint",
         "revoke": "admin.credentials.revoke",
     },
+    "drafts": {
+        "clear": "file_draft.clear",
+        "get": "file_draft.get",
+        "list": "file_draft.list",
+        "save": "file_draft.save",
+    },
     "events": {
         "replay": "events.replay",
         "subscribe": "events.subscribe",
diff --git a/sdk/python/src/agentgit/client.py b/sdk/python/src/agentgit/client.py
index d19fb56a..5b9d2394 100644
--- a/sdk/python/src/agentgit/client.py
+++ b/sdk/python/src/agentgit/client.py
@@ -39,6 +39,7 @@
     AsyncAdminApi,
     AsyncAgentsApi,
     AsyncCredentialsApi,
+    AsyncDraftsApi,
     AsyncEventsApi,
     AsyncHistoryApi,
     AsyncIntegrationApi,
@@ -59,6 +60,7 @@
     AsyncTreeApi,
     AsyncWorkspacesApi,
     CredentialsApi,
+    DraftsApi,
     EventsApi,
     HistoryApi,
     IntegrationApi,
@@ -252,6 +254,7 @@ class AgentGitClient:
     session: SessionApi
     repos: ReposApi
     workspaces: WorkspacesApi
+    drafts: DraftsApi
     proposals: ProposalsApi
     integration: IntegrationApi
     queue: QueueApi
@@ -306,6 +309,7 @@ def __init__(
         self.session = SessionApi(self)
         self.repos = ReposApi(self)
         self.workspaces = WorkspacesApi(self)
+        self.drafts = DraftsApi(self)
         self.proposals = ProposalsApi(self)
         self.integration = IntegrationApi(self)
         self.queue = QueueApi(self)
@@ -611,6 +615,7 @@ class AsyncAgentGitClient:
     session: AsyncSessionApi
     repos: AsyncReposApi
     workspaces: AsyncWorkspacesApi
+    drafts: AsyncDraftsApi
     proposals: AsyncProposalsApi
     integration: AsyncIntegrationApi
     queue: AsyncQueueApi
@@ -667,6 +672,7 @@ def __init__(
         self.session = AsyncSessionApi(self)
         self.repos = AsyncReposApi(self)
         self.workspaces = AsyncWorkspacesApi(self)
+        self.drafts = AsyncDraftsApi(self)
         self.proposals = AsyncProposalsApi(self)
         self.integration = AsyncIntegrationApi(self)
         self.queue = AsyncQueueApi(self)
diff --git a/sdk/python/tests/test_all_operations.py b/sdk/python/tests/test_all_operations.py
index bf90dd2e..57e0dde1 100644
--- a/sdk/python/tests/test_all_operations.py
+++ b/sdk/python/tests/test_all_operations.py
@@ -153,6 +153,19 @@ def test_workspaces_proposals_reviews_and_the_execution_plane(tour: dict[str, Ag
     )
     assert alice.workspaces.get(repo=REPO, name="w1").head == m1.head
     assert alice.workspaces.sync(repo=REPO, name="w1").status == "up_to_date"
+    assert not alice.drafts.get(repo=REPO, stream="main", path="a.txt").present
+    file_draft = alice.drafts.save(
+        repo=REPO,
+        stream="main",
+        path="a.txt",
+        base=m1.head,
+        content="cHJpdmF0ZSBlZGl0Cg==",
+        expected_version=0,
+    )
+    assert len(alice.drafts.list(repo=REPO, stream="main").drafts) == 1
+    assert not alice.drafts.clear(
+        repo=REPO, stream="main", path="a.txt", expected_version=file_draft.version
+    ).present
 
     p1 = alice.proposals.create(repo=REPO, stream="main", head=m1.head, title="seed")
     assert len(alice.proposals.list(repo=REPO).proposals) == 1
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index 6b753a4b..24128431 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -512,6 +512,13 @@ first. These drafts contain `head` and `body` (up to 16 KiB of UTF-8), remain se
 from review-decision drafts, and can be saved on closed proposals. Saving or clearing
 a draft never posts a comment; post explicitly after inspecting the current proposal head.
 
+Private file edits use `client.drafts.get`, `save`, `clear` and `list` after negotiating
+`files.drafts`. Identify the draft by repository, stream and existing file path.
+Save the complete base64-encoded file content with its original `base` changeset and
+inspected `expected_version`. Drafts are limited to 4 MiB each and 20 live drafts per
+account/repository. Listing returns metadata only. Saving never publishes a changeset;
+inspect the current file before explicitly applying a saved draft to a workspace.
+
 Servers advertising `workspaces.conflict_origins` may include `conflict.origin` with
 `base`, `ours`, and `theirs` source paths when a rename moved the file. During workspace
 sync, read `origin.ours` at the workspace head and `origin.theirs` at `stream_head`;
diff --git a/sdk/typescript/src/generated/api.ts b/sdk/typescript/src/generated/api.ts
index fce28632..29cc196a 100644
--- a/sdk/typescript/src/generated/api.ts
+++ b/sdk/typescript/src/generated/api.ts
@@ -39,6 +39,12 @@ export const NAMESPACE_METHODS = {
     mint: 'admin.credentials.mint',
     revoke: 'admin.credentials.revoke',
   },
+  drafts: {
+    clear: 'file_draft.clear',
+    get: 'file_draft.get',
+    list: 'file_draft.list',
+    save: 'file_draft.save',
+  },
   events: {
     replay: 'events.replay',
     subscribe: 'events.subscribe',
@@ -241,6 +247,16 @@ export interface Api {
     /** Revoke a credential (`DELETE /v1/credentials/{credential_id}`, operation `admin.credentials.revoke`) */
     revoke(request: Req<'admin.credentials.revoke'>, options?: CallOptions): Promise<Res<'admin.credentials.revoke'>>;
   };
+  readonly drafts: {
+    /** Clear private file drafts (`DELETE /v1/repos/{owner}/{rname}/file-draft`, operation `file_draft.clear`) */
+    clear(request: Req<'file_draft.clear'>, options?: CallOptions): Promise<Res<'file_draft.clear'>>;
+    /** Get private file drafts (`GET /v1/repos/{owner}/{rname}/file-draft`, operation `file_draft.get`) */
+    get(request: Req<'file_draft.get'>, options?: CallOptions): Promise<Res<'file_draft.get'>>;
+    /** List private file drafts (`GET /v1/repos/{owner}/{rname}/file-drafts`, operation `file_draft.list`) */
+    list(request: Req<'file_draft.list'>, options?: CallOptions): Promise<Res<'file_draft.list'>>;
+    /** Save private file drafts (`PUT /v1/repos/{owner}/{rname}/file-draft`, operation `file_draft.save`) */
+    save(request: Req<'file_draft.save'>, options?: CallOptions): Promise<Res<'file_draft.save'>>;
+  };
   readonly events: {
     /** Replay events after a sequence number (query: after_seq, limit, topics=a,b) (`GET /v1/repos/{owner}/{rname}/events/replay`, operation `events.replay`) */
     replay(request: Req<'events.replay'>, options?: CallOptions): Promise<Res<'events.replay'>>;
diff --git a/sdk/typescript/src/generated/models.ts b/sdk/typescript/src/generated/models.ts
index 374f9359..552524c4 100644
--- a/sdk/typescript/src/generated/models.ts
+++ b/sdk/typescript/src/generated/models.ts
@@ -27,6 +27,7 @@ export type Changeset = S['Changeset'];
 export type ClaimJobRequest = S['ClaimJobRequest'];
 export type ClaimJobResponse = S['ClaimJobResponse'];
 export type ClearCommentDraftRequest = S['ClearCommentDraftRequest'];
+export type ClearFileDraftRequest = S['ClearFileDraftRequest'];
 export type ClearReviewDraftRequest = S['ClearReviewDraftRequest'];
 export type CloseProposalRequest = S['CloseProposalRequest'];
 export type CommentDraft = S['CommentDraft'];
@@ -60,6 +61,8 @@ export type ExtendLeaseRequest = S['ExtendLeaseRequest'];
 export type FailJobRequest = S['FailJobRequest'];
 export type FileChange = S['FileChange'];
 export type FileDiff = S['FileDiff'];
+export type FileDraft = S['FileDraft'];
+export type FileDraftSummary = S['FileDraftSummary'];
 export type FileOp = S['FileOp'];
 export type FinishTaskRequest = S['FinishTaskRequest'];
 export type FsckIssue = S['FsckIssue'];
@@ -70,6 +73,7 @@ export type GcResponse = S['GcResponse'];
 export type GetCandidateRequest = S['GetCandidateRequest'];
 export type GetChangesetRequest = S['GetChangesetRequest'];
 export type GetCommentDraftRequest = S['GetCommentDraftRequest'];
+export type GetFileDraftRequest = S['GetFileDraftRequest'];
 export type GetIssueRequest = S['GetIssueRequest'];
 export type GetJobRequest = S['GetJobRequest'];
 export type GetOperationRequest = S['GetOperationRequest'];
@@ -109,6 +113,8 @@ export type ListCredentialsRequest = S['ListCredentialsRequest'];
 export type ListCredentialsResponse = S['ListCredentialsResponse'];
 export type ListDirectoryRequest = S['ListDirectoryRequest'];
 export type ListDirectoryResponse = S['ListDirectoryResponse'];
+export type ListFileDraftsRequest = S['ListFileDraftsRequest'];
+export type ListFileDraftsResponse = S['ListFileDraftsResponse'];
 export type ListIssueActivityRequest = S['ListIssueActivityRequest'];
 export type ListIssueActivityResponse = S['ListIssueActivityResponse'];
 export type ListIssuesRequest = S['ListIssuesRequest'];
@@ -208,6 +214,7 @@ export type RunQueueRequest = S['RunQueueRequest'];
 export type RunQueueResponse = S['RunQueueResponse'];
 export type RunSpec = S['RunSpec'];
 export type SaveCommentDraftRequest = S['SaveCommentDraftRequest'];
+export type SaveFileDraftRequest = S['SaveFileDraftRequest'];
 export type SaveReviewDraftRequest = S['SaveReviewDraftRequest'];
 export type SaveRunOutputRequest = S['SaveRunOutputRequest'];
 export type SearchMatch = S['SearchMatch'];
diff --git a/sdk/typescript/src/generated/operations.ts b/sdk/typescript/src/generated/operations.ts
index 01473c77..d7a3a3cd 100644
--- a/sdk/typescript/src/generated/operations.ts
+++ b/sdk/typescript/src/generated/operations.ts
@@ -485,6 +485,66 @@ export const OPERATIONS = {
     idempotencyKey: false,
     public: false,
   },
+  'file_draft.clear': {
+    id: 'file_draft.clear',
+    http: 'DELETE',
+    route: '/v1/repos/{owner}/{rname}/file-draft',
+    namespace: 'drafts',
+    name: 'clear',
+    summary: 'Clear private file drafts',
+    pathParams: ['owner', 'rname'],
+    queryParams: ['expected_version', 'path', 'stream'],
+    body: 'none',
+    response: 'json',
+    retry: 'natural',
+    idempotencyKey: false,
+    public: false,
+  },
+  'file_draft.get': {
+    id: 'file_draft.get',
+    http: 'GET',
+    route: '/v1/repos/{owner}/{rname}/file-draft',
+    namespace: 'drafts',
+    name: 'get',
+    summary: 'Get private file drafts',
+    pathParams: ['owner', 'rname'],
+    queryParams: ['path', 'stream'],
+    body: 'none',
+    response: 'json',
+    retry: 'read',
+    idempotencyKey: false,
+    public: false,
+  },
+  'file_draft.list': {
+    id: 'file_draft.list',
+    http: 'GET',
+    route: '/v1/repos/{owner}/{rname}/file-drafts',
+    namespace: 'drafts',
+    name: 'list',
+    summary: 'List private file drafts',
+    pathParams: ['owner', 'rname'],
+    queryParams: ['stream'],
+    body: 'none',
+    response: 'json',
+    retry: 'read',
+    idempotencyKey: false,
+    public: false,
+  },
+  'file_draft.save': {
+    id: 'file_draft.save',
+    http: 'PUT',
+    route: '/v1/repos/{owner}/{rname}/file-draft',
+    namespace: 'drafts',
+    name: 'save',
+    summary: 'Save private file drafts',
+    pathParams: ['owner', 'rname'],
+    queryParams: [],
+    body: 'json',
+    response: 'json',
+    retry: 'natural',
+    idempotencyKey: false,
+    public: false,
+  },
   'history.ancestors': {
     id: 'history.ancestors',
     http: 'POST',
diff --git a/sdk/typescript/src/generated/schema.ts b/sdk/typescript/src/generated/schema.ts
index 852975ac..64c52c91 100644
--- a/sdk/typescript/src/generated/schema.ts
+++ b/sdk/typescript/src/generated/schema.ts
@@ -363,6 +363,42 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/repos/{owner}/{rname}/file-draft": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get private file drafts */
+        get: operations["file_draft.get"];
+        /** Save private file drafts */
+        put: operations["file_draft.save"];
+        post?: never;
+        /** Clear private file drafts */
+        delete: operations["file_draft.clear"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/repos/{owner}/{rname}/file-drafts": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List private file drafts */
+        get: operations["file_draft.list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/repos/{owner}/{rname}/files/{*path}": {
         parameters: {
             query?: never;
@@ -2030,6 +2066,19 @@ export interface components {
             /** @default  */
             repo: string;
         };
+        ClearFileDraftRequest: {
+            /**
+             * Format: int64
+             * @default 0
+             */
+            expected_version: number;
+            /** @default  */
+            path: string;
+            /** @default  */
+            repo: string;
+            /** @default  */
+            stream: string;
+        };
         ClearReviewDraftRequest: {
             /**
              * Format: int64
@@ -2663,6 +2712,57 @@ export interface components {
              */
             truncated: boolean;
         };
+        /** @description Private existing-file edit owned by the current acting identity. */
+        FileDraft: {
+            /** @default  */
+            base: string;
+            /**
+             * Format: byte
+             * @default []
+             */
+            content: string;
+            /** @default false */
+            executable: boolean;
+            /** @default  */
+            file_type: string;
+            /** @default  */
+            original_blob_id: string;
+            /** @default  */
+            path: string;
+            /** @default false */
+            present: boolean;
+            /** @default  */
+            stream: string;
+            /**
+             * Format: int64
+             * @default 0
+             */
+            updated_at_ms: number;
+            /**
+             * Format: int64
+             * @default 0
+             */
+            version: number;
+        };
+        /** @description Discovery carries no private replacement bytes. */
+        FileDraftSummary: {
+            /** @default  */
+            base: string;
+            /** @default  */
+            path: string;
+            /** @default  */
+            stream: string;
+            /**
+             * Format: int64
+             * @default 0
+             */
+            updated_at_ms: number;
+            /**
+             * Format: int64
+             * @default 0
+             */
+            version: number;
+        };
         FileOp: {
             /**
              * @description Content blob (put only).
@@ -2835,6 +2935,14 @@ export interface components {
             /** @default  */
             repo: string;
         };
+        GetFileDraftRequest: {
+            /** @default  */
+            path: string;
+            /** @default  */
+            repo: string;
+            /** @default  */
+            stream: string;
+        };
         GetIssueRequest: {
             /**
              * Format: int64
@@ -3330,6 +3438,16 @@ export interface components {
             /** @default  */
             tree_id: string;
         };
+        ListFileDraftsRequest: {
+            /** @default  */
+            repo: string;
+            /** @default  */
+            stream: string;
+        };
+        ListFileDraftsResponse: {
+            /** @default [] */
+            drafts: components["schemas"]["FileDraftSummary"][];
+        };
         ListIssueActivityRequest: {
             /**
              * Format: int64
@@ -4757,6 +4875,26 @@ export interface components {
             /** @default  */
             repo: string;
         };
+        SaveFileDraftRequest: {
+            /** @default  */
+            base: string;
+            /**
+             * Format: byte
+             * @default []
+             */
+            content: string;
+            /**
+             * Format: int64
+             * @default 0
+             */
+            expected_version: number;
+            /** @default  */
+            path: string;
+            /** @default  */
+            repo: string;
+            /** @default  */
+            stream: string;
+        };
         SaveReviewDraftRequest: {
             /** @default  */
             body: string;
@@ -6219,6 +6357,155 @@ export interface operations {
             };
         };
     };
+    "file_draft.get": {
+        parameters: {
+            query?: {
+                path?: string;
+                stream?: string;
+            };
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["FileDraft"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "file_draft.save": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SaveFileDraftRequest"];
+            };
+        };
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["FileDraft"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "file_draft.clear": {
+        parameters: {
+            query?: {
+                expected_version?: number;
+                path?: string;
+                stream?: string;
+            };
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["FileDraft"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "file_draft.list": {
+        parameters: {
+            query?: {
+                stream?: string;
+            };
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ListFileDraftsResponse"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
     "tree.file": {
         parameters: {
             query?: {
diff --git a/sdk/typescript/test/all-operations.test.ts b/sdk/typescript/test/all-operations.test.ts
index fe48fad0..db3c1638 100644
--- a/sdk/typescript/test/all-operations.test.ts
+++ b/sdk/typescript/test/all-operations.test.ts
@@ -136,6 +136,19 @@ describe('the tour', () => {
     });
     expect((await alice.workspaces.get({ repo, name: 'w1' })).head).toBe(m1.head);
     expect((await alice.workspaces.sync({ repo, name: 'w1' })).status).toBe('up_to_date');
+    expect((await alice.drafts.get({ repo, stream: 'main', path: 'a.txt' })).present).toBe(false);
+    const fileDraft = await alice.drafts.save({
+      repo,
+      stream: 'main',
+      path: 'a.txt',
+      base: m1.head,
+      content: Buffer.from('private edit\n').toString('base64'),
+      expected_version: 0,
+    });
+    expect((await alice.drafts.list({ repo, stream: 'main' })).drafts).toHaveLength(1);
+    expect(
+      (await alice.drafts.clear({ repo, stream: 'main', path: 'a.txt', expected_version: fileDraft.version })).present,
+    ).toBe(false);
 
     const p1 = await alice.proposals.create({ repo, stream: 'main', head: m1.head, title: 'seed' });
     expect((await alice.proposals.list({ repo })).proposals).toHaveLength(1);

From 86aaa180aa6a108c88e839b134942ba5974a6abd Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:39:06 +0000
Subject: [PATCH 30/41] feat(cli): save and recover private file drafts

---
 crates/ag-cli/src/cmds/file_drafts.rs         | 174 +++++++++++++
 crates/ag-cli/src/cmds/mod.rs                 |   1 +
 crates/ag-cli/src/cmds/remote.rs              |  13 +
 docs/guides/remote.md                         |  21 ++
 docs/reference/cli.md                         | 145 +++++++++++
 docs/reference/completions/_ag                | 155 ++++++++++++
 docs/reference/completions/_ag.ps1            | 102 ++++++++
 docs/reference/completions/ag.bash            | 235 +++++++++++++++++-
 docs/reference/completions/ag.elv             |  97 ++++++++
 docs/reference/completions/ag.fish            |  82 +++---
 .../man/ag-remote-file-draft-clear.1          |  48 ++++
 docs/reference/man/ag-remote-file-draft-get.1 |  48 ++++
 .../reference/man/ag-remote-file-draft-list.1 |  42 ++++
 .../reference/man/ag-remote-file-draft-save.1 |  54 ++++
 docs/reference/man/ag-remote-file-draft.1     |  52 ++++
 docs/reference/man/ag-remote.1                |   3 +
 16 files changed, 1238 insertions(+), 34 deletions(-)
 create mode 100644 crates/ag-cli/src/cmds/file_drafts.rs
 create mode 100644 docs/reference/man/ag-remote-file-draft-clear.1
 create mode 100644 docs/reference/man/ag-remote-file-draft-get.1
 create mode 100644 docs/reference/man/ag-remote-file-draft-list.1
 create mode 100644 docs/reference/man/ag-remote-file-draft-save.1
 create mode 100644 docs/reference/man/ag-remote-file-draft.1

diff --git a/crates/ag-cli/src/cmds/file_drafts.rs b/crates/ag-cli/src/cmds/file_drafts.rs
new file mode 100644
index 00000000..8854d243
--- /dev/null
+++ b/crates/ag-cli/src/cmds/file_drafts.rs
@@ -0,0 +1,174 @@
+//! Private replacement bytes, bound to an inspected file revision.
+use std::io::Read;
+use std::path::PathBuf;
+
+use ag_client::{Client, ClientError};
+use ag_protocol::{features, v1};
+use anyhow::{Context, Result, ensure};
+use clap::{Args, Subcommand};
+use serde_json::{Value, json};
+
+/// Explicit private file draft operations; none publish a changeset.
+#[derive(Subcommand, Debug)]
+pub enum FileDraftCmd {
+    /// List your saved file drafts in a stream, without downloading their content.
+    List {
+        /// Stream containing the files.
+        #[arg(long)]
+        stream: String,
+    },
+    /// Read metadata; download exact replacement bytes only with --output.
+    Get {
+        #[command(flatten)]
+        target: Target,
+        /// Write saved bytes to this local file (replaces an existing file).
+        #[arg(long, value_name = "PATH")]
+        output: Option<PathBuf>,
+    },
+    /// Save private replacement bytes for an existing file at an immutable revision.
+    Save {
+        #[command(flatten)]
+        target: Target,
+        /// Exact changeset containing the original file you inspected.
+        #[arg(long)]
+        base: String,
+        /// Binary replacement file, at most 4 MiB.
+        #[arg(long, value_name = "PATH")]
+        content_file: PathBuf,
+        /// Version returned by get; zero only if no draft has existed.
+        #[arg(long)]
+        expected_version: u64,
+    },
+    /// Clear only the draft version you inspected.
+    Clear {
+        #[command(flatten)]
+        target: Target,
+        /// Version returned by get, including a cleared version.
+        #[arg(long)]
+        expected_version: u64,
+    },
+}
+
+/// The stable key of an account's private file draft.
+#[derive(Args, Debug)]
+pub struct Target {
+    /// Stream containing the file.
+    #[arg(long)]
+    stream: String,
+    /// Repository-relative file path.
+    #[arg(long)]
+    path: String,
+}
+
+impl FileDraftCmd {
+    /// Whether this command mutates the remote draft.
+    pub fn changes_state(&self) -> bool {
+        matches!(self, Self::Save { .. } | Self::Clear { .. })
+    }
+}
+
+fn read_content(path: &PathBuf) -> Result<Vec<u8>> {
+    const MAX_BYTES: u64 = 4 * 1024 * 1024;
+    let mut content = Vec::new();
+    std::fs::File::open(path)
+        .with_context(|| format!("reading {}", path.display()))?
+        .take(MAX_BYTES + 1)
+        .read_to_end(&mut content)
+        .with_context(|| format!("reading {}", path.display()))?;
+    ensure!(content.len() as u64 <= MAX_BYTES, "file draft exceeds 4 MiB");
+    Ok(content)
+}
+
+fn metadata(draft: &v1::FileDraft) -> Value {
+    json!({
+        "present": draft.present, "version": draft.version,
+        "stream": draft.stream, "path": draft.path, "base": draft.base,
+        "original_blob_id": draft.original_blob_id, "file_type": draft.file_type,
+        "executable": draft.executable, "content_bytes": draft.content.len(),
+        "updated_at_ms": draft.updated_at_ms,
+    })
+}
+
+/// Operate only on the authenticated account; content never goes to stdout.
+pub async fn run(client: &Client, repo: &str, cmd: &FileDraftCmd) -> Result<Value> {
+    ensure!(
+        client.negotiate().await?.features.iter().any(|feature| feature == features::FILES_DRAFTS),
+        "this server does not support private file drafts; update it before using this command"
+    );
+    let mut drafts = client.file_drafts();
+    let response = match cmd {
+        FileDraftCmd::List { stream } => {
+            let response = drafts
+                .list(client.req(v1::ListFileDraftsRequest { repo: repo.into(), stream: stream.clone() }))
+                .await
+                .map_err(ClientError::from)?
+                .into_inner();
+            return Ok(serde_json::to_value(response)?);
+        }
+        FileDraftCmd::Get { target, .. } => {
+            drafts
+                .get(client.req(v1::GetFileDraftRequest {
+                    repo: repo.into(),
+                    stream: target.stream.clone(),
+                    path: target.path.clone(),
+                }))
+                .await
+        }
+        FileDraftCmd::Save { target, base, content_file, expected_version } => {
+            drafts
+                .save(client.req(v1::SaveFileDraftRequest {
+                    repo: repo.into(),
+                    stream: target.stream.clone(),
+                    path: target.path.clone(),
+                    base: base.clone(),
+                    content: read_content(content_file)?,
+                    expected_version: *expected_version,
+                }))
+                .await
+        }
+        FileDraftCmd::Clear { target, expected_version } => {
+            drafts
+                .clear(client.req(v1::ClearFileDraftRequest {
+                    repo: repo.into(),
+                    stream: target.stream.clone(),
+                    path: target.path.clone(),
+                    expected_version: *expected_version,
+                }))
+                .await
+        }
+    };
+    let draft = response.map_err(ClientError::from)?.into_inner();
+    if let FileDraftCmd::Get { output: Some(path), .. } = cmd {
+        ensure!(draft.present, "no private file draft to download; version {}", draft.version);
+        std::fs::write(path, &draft.content).with_context(|| format!("writing {}", path.display()))?;
+    }
+    Ok(metadata(&draft))
+}
+
+/// A concise summary with versions needed for explicit follow-up writes.
+pub fn describe(value: &Value) -> String {
+    if let Some(drafts) = value["drafts"].as_array() {
+        if drafts.is_empty() {
+            return "No private file drafts in this stream.".into();
+        }
+        return drafts
+            .iter()
+            .map(|draft| {
+                format!(
+                    "{}  version {}  base {}",
+                    draft["path"].as_str().unwrap_or_default(),
+                    draft["version"],
+                    draft["base"].as_str().unwrap_or_default()
+                )
+            })
+            .collect::<Vec<_>>()
+            .join("\n");
+    }
+    format!(
+        "Private file draft {}: {} (version {}, {} bytes).",
+        value["path"].as_str().unwrap_or_default(),
+        if value["present"] == true { "saved" } else { "absent" },
+        value["version"],
+        value["content_bytes"]
+    )
+}
diff --git a/crates/ag-cli/src/cmds/mod.rs b/crates/ag-cli/src/cmds/mod.rs
index 694360c5..e7a1d774 100644
--- a/crates/ag-cli/src/cmds/mod.rs
+++ b/crates/ag-cli/src/cmds/mod.rs
@@ -9,6 +9,7 @@ pub mod conflicts;
 pub mod discussions;
 pub mod doctor;
 pub mod explain;
+pub mod file_drafts;
 pub mod flow;
 pub mod gitbridge;
 pub mod login;
diff --git a/crates/ag-cli/src/cmds/remote.rs b/crates/ag-cli/src/cmds/remote.rs
index 4d68abd1..1801e905 100644
--- a/crates/ag-cli/src/cmds/remote.rs
+++ b/crates/ag-cli/src/cmds/remote.rs
@@ -819,6 +819,11 @@ pub enum RemoteCmd {
         #[command(subcommand)]
         cmd: crate::cmds::review_drafts::ReviewDraftCmd,
     },
+    /// Save or restore private file edits without publishing a changeset.
+    FileDraft {
+        #[command(subcommand)]
+        cmd: crate::cmds::file_drafts::FileDraftCmd,
+    },
     /// Save or restore a private general comment without posting it.
     CommentDraft {
         #[command(subcommand)]
@@ -1252,6 +1257,14 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                     print(cli, &result, || crate::cmds::review_drafts::describe(&result))?;
                 }
             }
+            RemoteCmd::FileDraft { cmd } => {
+                let result = crate::cmds::file_drafts::run(&c, &repo, cmd).await?;
+                if cmd.changes_state() {
+                    print_done(cli, &result, || crate::cmds::file_drafts::describe(&result))?;
+                } else {
+                    print(cli, &result, || crate::cmds::file_drafts::describe(&result))?;
+                }
+            }
             RemoteCmd::CommentDraft { cmd } => {
                 let result = crate::cmds::comment_drafts::run(&c, &repo, cmd).await?;
                 if cmd.changes_state() {
diff --git a/docs/guides/remote.md b/docs/guides/remote.md
index 23b20bf3..432950e0 100644
--- a/docs/guides/remote.md
+++ b/docs/guides/remote.md
@@ -109,6 +109,27 @@ Drafts remain available on closed proposals and only the current account can rea
 the API; server administrators and backups can still contain them. UTF-8 files retain their
 line breaks and are limited to 16 KiB. `--json` includes the version, including after clearing.
 
+## Private file drafts
+
+Development servers advertising `files.drafts` can keep private replacement bytes for an
+existing file, bound to the exact base changeset you inspected. Saving a draft does not create
+a changeset, update a stream, or change a proposal.
+
+```sh
+ag remote file-draft list --stream main
+ag remote file-draft get --stream main --path src/config.json
+ag remote file-draft save --stream main --path src/config.json --base CHANGESET_ID --content-file edited.json --expected-version 0
+ag remote file-draft get --stream main --path src/config.json --output restored.json
+ag remote file-draft clear --stream main --path src/config.json --expected-version 1
+```
+
+Use the version returned by `get` for saves and clears, including the version of a cleared
+draft. Content files are binary-safe and limited to 4 MiB. Commands show metadata; bytes are
+written only when `get --output` is explicit, and that option replaces the named local file.
+The original file type and executable bit come from the immutable base. Each account can
+keep at most 20 active file drafts per repository. Drafts are private through the API;
+administrators and backups can still contain them.
+
 ## Offline
 
 Nothing about a local repository needs the server:
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index a002411a..f21a761f 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -132,6 +132,11 @@ Concept pages are available in the terminal: `ag help workflow|policy|leases|ide
 - [`ag remote review-draft get`](#ag-remote-review-draft-get)
 - [`ag remote review-draft save`](#ag-remote-review-draft-save)
 - [`ag remote review-draft clear`](#ag-remote-review-draft-clear)
+- [`ag remote file-draft`](#ag-remote-file-draft)
+- [`ag remote file-draft list`](#ag-remote-file-draft-list)
+- [`ag remote file-draft get`](#ag-remote-file-draft-get)
+- [`ag remote file-draft save`](#ag-remote-file-draft-save)
+- [`ag remote file-draft clear`](#ag-remote-file-draft-clear)
 - [`ag remote comment-draft`](#ag-remote-comment-draft)
 - [`ag remote comment-draft get`](#ag-remote-comment-draft-get)
 - [`ag remote comment-draft save`](#ag-remote-comment-draft-save)
@@ -2522,6 +2527,7 @@ Commands:
   explain        Explain why a server proposal cannot land, with the next commands. Changes nothing
   reviewers      Inspect, add or remove requested reviewers (no approval or access change)
   review-draft   Save or restore your private account review notes without submitting them
+  file-draft     Save or restore private file edits without publishing a changeset
   comment-draft  Save or restore a private general comment without posting it
   review         Review a proposal's current head
   discussion     Read and participate in revision-bound line discussions
@@ -2867,6 +2873,145 @@ Options:
           Print version
 ```
 
+## ag remote file-draft
+
+```text
+Save or restore private file edits without publishing a changeset
+
+Usage: ag remote file-draft [OPTIONS] <COMMAND>
+
+Commands:
+  list   List your saved file drafts in a stream, without downloading their content
+  get    Read metadata; download exact replacement bytes only with --output
+  save   Save private replacement bytes for an existing file at an immutable revision
+  clear  Clear only the draft version you inspected
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote file-draft list
+
+```text
+List your saved file drafts in a stream, without downloading their content
+
+Usage: ag remote file-draft list [OPTIONS] --stream <STREAM>
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --stream <STREAM>  Stream containing the files
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --json             Machine-readable JSON output
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote file-draft get
+
+```text
+Read metadata; download exact replacement bytes only with --output
+
+Usage: ag remote file-draft get [OPTIONS] --stream <STREAM> --path <PATH>
+
+Options:
+  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>  Remote to use (default: origin)
+      --stream <STREAM>  Stream containing the file
+      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --path <PATH>      Repository-relative file path
+      --json             Machine-readable JSON output
+      --output <PATH>    Write saved bytes to this local file (replaces an existing file)
+      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help             Print help
+  -V, --version          Print version
+```
+
+## ag remote file-draft save
+
+```text
+Save private replacement bytes for an existing file at an immutable revision
+
+Usage: ag remote file-draft save [OPTIONS] --stream <STREAM> --path <PATH> --base <BASE> --content-file <PATH> --expected-version <EXPECTED_VERSION>
+
+Options:
+  -C, --repo <DIR>
+          Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>
+          Remote to use (default: origin)
+      --stream <STREAM>
+          Stream containing the file
+      --as <IDENTITY>
+          Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --path <PATH>
+          Repository-relative file path
+      --base <BASE>
+          Exact changeset containing the original file you inspected
+      --json
+          Machine-readable JSON output
+      --color <WHEN>
+          Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+      --content-file <PATH>
+          Binary replacement file, at most 4 MiB
+      --expected-version <EXPECTED_VERSION>
+          Version returned by get; zero only if no draft has existed
+  -q, --quiet
+          Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose
+          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+```
+
+## ag remote file-draft clear
+
+```text
+Clear only the draft version you inspected
+
+Usage: ag remote file-draft clear [OPTIONS] --stream <STREAM> --path <PATH> --expected-version <EXPECTED_VERSION>
+
+Options:
+  -C, --repo <DIR>
+          Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>
+          Remote to use (default: origin)
+      --stream <STREAM>
+          Stream containing the file
+      --as <IDENTITY>
+          Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --path <PATH>
+          Repository-relative file path
+      --expected-version <EXPECTED_VERSION>
+          Version returned by get, including a cleared version
+      --json
+          Machine-readable JSON output
+      --color <WHEN>
+          Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet
+          Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose
+          Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+```
+
 ## ag remote comment-draft
 
 ```text
diff --git a/docs/reference/completions/_ag b/docs/reference/completions/_ag
index be623128..a7cc7d50 100644
--- a/docs/reference/completions/_ag
+++ b/docs/reference/completions/_ag
@@ -2593,6 +2593,130 @@ never\:"Never colour"))' \
     ;;
 esac
 ;;
+(file-draft)
+_arguments "${_arguments_options[@]}" : \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+":: :_ag__subcmd__remote__subcmd__file-draft_commands" \
+"*::: :->file-draft" \
+&& ret=0
+
+    case $state in
+    (file-draft)
+        words=($line[1] "${words[@]}")
+        (( CURRENT += 1 ))
+        curcontext="${curcontext%:*:*}:ag-remote-file-draft-command-$line[1]:"
+        case $line[1] in
+            (list)
+_arguments "${_arguments_options[@]}" : \
+'--stream=[Stream containing the files]:STREAM:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+&& ret=0
+;;
+(get)
+_arguments "${_arguments_options[@]}" : \
+'--stream=[Stream containing the file]:STREAM:_default' \
+'--path=[Repository-relative file path]:PATH:_default' \
+'--output=[Write saved bytes to this local file (replaces an existing file)]:PATH:_files' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+&& ret=0
+;;
+(save)
+_arguments "${_arguments_options[@]}" : \
+'--stream=[Stream containing the file]:STREAM:_default' \
+'--path=[Repository-relative file path]:PATH:_default' \
+'--base=[Exact changeset containing the original file you inspected]:BASE:_default' \
+'--content-file=[Binary replacement file, at most 4 MiB]:PATH:_files' \
+'--expected-version=[Version returned by get; zero only if no draft has existed]:EXPECTED_VERSION:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+&& ret=0
+;;
+(clear)
+_arguments "${_arguments_options[@]}" : \
+'--stream=[Stream containing the file]:STREAM:_default' \
+'--path=[Repository-relative file path]:PATH:_default' \
+'--expected-version=[Version returned by get, including a cleared version]:EXPECTED_VERSION:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+&& ret=0
+;;
+        esac
+    ;;
+esac
+;;
 (comment-draft)
 _arguments "${_arguments_options[@]}" : \
 '--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
@@ -4146,6 +4270,7 @@ _ag__subcmd__remote_commands() {
 'explain:Explain why a server proposal cannot land, with the next commands. Changes nothing' \
 'reviewers:Inspect, add or remove requested reviewers (no approval or access change)' \
 'review-draft:Save or restore your private account review notes without submitting them' \
+'file-draft:Save or restore private file edits without publishing a changeset' \
 'comment-draft:Save or restore a private general comment without posting it' \
 'review:Review a proposal'\''s current head' \
 'discussion:Read and participate in revision-bound line discussions' \
@@ -4251,6 +4376,36 @@ _ag__subcmd__remote__subcmd__explain_commands() {
     local commands; commands=()
     _describe -t commands 'ag remote explain commands' commands "$@"
 }
+(( $+functions[_ag__subcmd__remote__subcmd__file-draft_commands] )) ||
+_ag__subcmd__remote__subcmd__file-draft_commands() {
+    local commands; commands=(
+'list:List your saved file drafts in a stream, without downloading their content' \
+'get:Read metadata; download exact replacement bytes only with --output' \
+'save:Save private replacement bytes for an existing file at an immutable revision' \
+'clear:Clear only the draft version you inspected' \
+    )
+    _describe -t commands 'ag remote file-draft commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__file-draft__subcmd__clear_commands] )) ||
+_ag__subcmd__remote__subcmd__file-draft__subcmd__clear_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote file-draft clear commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__file-draft__subcmd__get_commands] )) ||
+_ag__subcmd__remote__subcmd__file-draft__subcmd__get_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote file-draft get commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__file-draft__subcmd__list_commands] )) ||
+_ag__subcmd__remote__subcmd__file-draft__subcmd__list_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote file-draft list commands' commands "$@"
+}
+(( $+functions[_ag__subcmd__remote__subcmd__file-draft__subcmd__save_commands] )) ||
+_ag__subcmd__remote__subcmd__file-draft__subcmd__save_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote file-draft save commands' commands "$@"
+}
 (( $+functions[_ag__subcmd__remote__subcmd__integrate_commands] )) ||
 _ag__subcmd__remote__subcmd__integrate_commands() {
     local commands; commands=()
diff --git a/docs/reference/completions/_ag.ps1 b/docs/reference/completions/_ag.ps1
index ae776a30..44dcee72 100644
--- a/docs/reference/completions/_ag.ps1
+++ b/docs/reference/completions/_ag.ps1
@@ -1881,6 +1881,7 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('explain', 'explain', [CompletionResultType]::ParameterValue, 'Explain why a server proposal cannot land, with the next commands. Changes nothing')
             [CompletionResult]::new('reviewers', 'reviewers', [CompletionResultType]::ParameterValue, 'Inspect, add or remove requested reviewers (no approval or access change)')
             [CompletionResult]::new('review-draft', 'review-draft', [CompletionResultType]::ParameterValue, 'Save or restore your private account review notes without submitting them')
+            [CompletionResult]::new('file-draft', 'file-draft', [CompletionResultType]::ParameterValue, 'Save or restore private file edits without publishing a changeset')
             [CompletionResult]::new('comment-draft', 'comment-draft', [CompletionResultType]::ParameterValue, 'Save or restore a private general comment without posting it')
             [CompletionResult]::new('review', 'review', [CompletionResultType]::ParameterValue, 'Review a proposal''s current head')
             [CompletionResult]::new('discussion', 'discussion', [CompletionResultType]::ParameterValue, 'Read and participate in revision-bound line discussions')
@@ -2136,6 +2137,107 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
             break
         }
+        'ag;remote;file-draft' {
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('list', 'list', [CompletionResultType]::ParameterValue, 'List your saved file drafts in a stream, without downloading their content')
+            [CompletionResult]::new('get', 'get', [CompletionResultType]::ParameterValue, 'Read metadata; download exact replacement bytes only with --output')
+            [CompletionResult]::new('save', 'save', [CompletionResultType]::ParameterValue, 'Save private replacement bytes for an existing file at an immutable revision')
+            [CompletionResult]::new('clear', 'clear', [CompletionResultType]::ParameterValue, 'Clear only the draft version you inspected')
+            break
+        }
+        'ag;remote;file-draft;list' {
+            [CompletionResult]::new('--stream', '--stream', [CompletionResultType]::ParameterName, 'Stream containing the files')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;file-draft;get' {
+            [CompletionResult]::new('--stream', '--stream', [CompletionResultType]::ParameterName, 'Stream containing the file')
+            [CompletionResult]::new('--path', '--path', [CompletionResultType]::ParameterName, 'Repository-relative file path')
+            [CompletionResult]::new('--output', '--output', [CompletionResultType]::ParameterName, 'Write saved bytes to this local file (replaces an existing file)')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;file-draft;save' {
+            [CompletionResult]::new('--stream', '--stream', [CompletionResultType]::ParameterName, 'Stream containing the file')
+            [CompletionResult]::new('--path', '--path', [CompletionResultType]::ParameterName, 'Repository-relative file path')
+            [CompletionResult]::new('--base', '--base', [CompletionResultType]::ParameterName, 'Exact changeset containing the original file you inspected')
+            [CompletionResult]::new('--content-file', '--content-file', [CompletionResultType]::ParameterName, 'Binary replacement file, at most 4 MiB')
+            [CompletionResult]::new('--expected-version', '--expected-version', [CompletionResultType]::ParameterName, 'Version returned by get; zero only if no draft has existed')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
+        'ag;remote;file-draft;clear' {
+            [CompletionResult]::new('--stream', '--stream', [CompletionResultType]::ParameterName, 'Stream containing the file')
+            [CompletionResult]::new('--path', '--path', [CompletionResultType]::ParameterName, 'Repository-relative file path')
+            [CompletionResult]::new('--expected-version', '--expected-version', [CompletionResultType]::ParameterName, 'Version returned by get, including a cleared version')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
         'ag;remote;comment-draft' {
             [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
             [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
diff --git a/docs/reference/completions/ag.bash b/docs/reference/completions/ag.bash
index 2168009b..fb5d60df 100644
--- a/docs/reference/completions/ag.bash
+++ b/docs/reference/completions/ag.bash
@@ -334,6 +334,9 @@ _ag() {
             ag__subcmd__remote,explain)
                 cmd="ag__subcmd__remote__subcmd__explain"
                 ;;
+            ag__subcmd__remote,file-draft)
+                cmd="ag__subcmd__remote__subcmd__file__subcmd__draft"
+                ;;
             ag__subcmd__remote,integrate)
                 cmd="ag__subcmd__remote__subcmd__integrate"
                 ;;
@@ -400,6 +403,18 @@ _ag() {
             ag__subcmd__remote__subcmd__discussion,start)
                 cmd="ag__subcmd__remote__subcmd__discussion__subcmd__start"
                 ;;
+            ag__subcmd__remote__subcmd__file__subcmd__draft,clear)
+                cmd="ag__subcmd__remote__subcmd__file__subcmd__draft__subcmd__clear"
+                ;;
+            ag__subcmd__remote__subcmd__file__subcmd__draft,get)
+                cmd="ag__subcmd__remote__subcmd__file__subcmd__draft__subcmd__get"
+                ;;
+            ag__subcmd__remote__subcmd__file__subcmd__draft,list)
+                cmd="ag__subcmd__remote__subcmd__file__subcmd__draft__subcmd__list"
+                ;;
+            ag__subcmd__remote__subcmd__file__subcmd__draft,save)
+                cmd="ag__subcmd__remote__subcmd__file__subcmd__draft__subcmd__save"
+                ;;
             ag__subcmd__remote__subcmd__review__subcmd__draft,clear)
                 cmd="ag__subcmd__remote__subcmd__review__subcmd__draft__subcmd__clear"
                 ;;
@@ -3509,7 +3524,7 @@ _ag() {
             return 0
             ;;
         ag__subcmd__remote)
-            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat"
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -4186,6 +4201,224 @@ _ag() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        ag__subcmd__remote__subcmd__file__subcmd__draft)
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version list get save clear"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__file__subcmd__draft__subcmd__clear)
+            opts="-C -q -v -h -V --stream --path --expected-version --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --stream)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --path)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --expected-version)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__file__subcmd__draft__subcmd__get)
+            opts="-C -q -v -h -V --stream --path --output --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --stream)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --path)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --output)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__file__subcmd__draft__subcmd__list)
+            opts="-C -q -v -h -V --stream --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --stream)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
+        ag__subcmd__remote__subcmd__file__subcmd__draft__subcmd__save)
+            opts="-C -q -v -h -V --stream --path --base --content-file --expected-version --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --stream)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --path)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --base)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --content-file)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --expected-version)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         ag__subcmd__remote__subcmd__integrate)
             opts="-C -q -v -h -V --fencing-token --remote --repo --as --json --color --quiet --verbose --help --version"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
diff --git a/docs/reference/completions/ag.elv b/docs/reference/completions/ag.elv
index e9681690..c3d37279 100644
--- a/docs/reference/completions/ag.elv
+++ b/docs/reference/completions/ag.elv
@@ -1780,6 +1780,7 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand explain 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
             cand reviewers 'Inspect, add or remove requested reviewers (no approval or access change)'
             cand review-draft 'Save or restore your private account review notes without submitting them'
+            cand file-draft 'Save or restore private file edits without publishing a changeset'
             cand comment-draft 'Save or restore a private general comment without posting it'
             cand review 'Review a proposal''s current head'
             cand discussion 'Read and participate in revision-bound line discussions'
@@ -2021,6 +2022,102 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand -V 'Print version'
             cand --version 'Print version'
         }
+        &'ag;remote;file-draft'= {
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+            cand list 'List your saved file drafts in a stream, without downloading their content'
+            cand get 'Read metadata; download exact replacement bytes only with --output'
+            cand save 'Save private replacement bytes for an existing file at an immutable revision'
+            cand clear 'Clear only the draft version you inspected'
+        }
+        &'ag;remote;file-draft;list'= {
+            cand --stream 'Stream containing the files'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;file-draft;get'= {
+            cand --stream 'Stream containing the file'
+            cand --path 'Repository-relative file path'
+            cand --output 'Write saved bytes to this local file (replaces an existing file)'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;file-draft;save'= {
+            cand --stream 'Stream containing the file'
+            cand --path 'Repository-relative file path'
+            cand --base 'Exact changeset containing the original file you inspected'
+            cand --content-file 'Binary replacement file, at most 4 MiB'
+            cand --expected-version 'Version returned by get; zero only if no draft has existed'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
+        &'ag;remote;file-draft;clear'= {
+            cand --stream 'Stream containing the file'
+            cand --path 'Repository-relative file path'
+            cand --expected-version 'Version returned by get, including a cleared version'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
         &'ag;remote;comment-draft'= {
             cand --remote 'Remote to use (default: origin)'
             cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
diff --git a/docs/reference/completions/ag.fish b/docs/reference/completions/ag.fish
index 4ea5aa3e..d829d159 100644
--- a/docs/reference/completions/ag.fish
+++ b/docs/reference/completions/ag.fish
@@ -1212,39 +1212,40 @@ complete -c ag -n "__fish_ag_using_subcommand push" -s q -l quiet -d 'Print only
 complete -c ag -n "__fish_ag_using_subcommand push" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand push" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand push" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
-always\t'Always colour'
-never\t'Never colour'"
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review-draft" -d 'Save or restore your private account review notes without submitting them'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "comment-draft" -d 'Save or restore a private general comment without posting it'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "workspace" -d 'Inspect and explicitly sync server-side workspaces without a checkout'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review-draft" -d 'Save or restore your private account review notes without submitting them'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "file-draft" -d 'Save or restore private file edits without publishing a changeset'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "comment-draft" -d 'Save or restore a private general comment without posting it'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "workspace" -d 'Inspect and explicitly sync server-side workspaces without a checkout'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l token-env -d 'Environment variable holding the credential' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l ca-file -d 'Extra CA certificate (PEM) to trust' -r -F
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l remote -d 'Remote to use (default: origin)' -r
@@ -1368,6 +1369,21 @@ complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -f -a "get" -d 'Read your private draft and its version, including a cleared version'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -f -a "save" -d 'Save private notes; does not submit a review or advance the inspected head'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from review-draft" -f -a "clear" -d 'Clear only the private draft version you inspected'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -f -a "list" -d 'List your saved file drafts in a stream, without downloading their content'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -f -a "get" -d 'Read metadata; download exact replacement bytes only with --output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -f -a "save" -d 'Save private replacement bytes for an existing file at an immutable revision'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from file-draft" -f -a "clear" -d 'Clear only the draft version you inspected'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -l remote -d 'Remote to use (default: origin)' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from comment-draft" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
diff --git a/docs/reference/man/ag-remote-file-draft-clear.1 b/docs/reference/man/ag-remote-file-draft-clear.1
new file mode 100644
index 00000000..46c96586
--- /dev/null
+++ b/docs/reference/man/ag-remote-file-draft-clear.1
@@ -0,0 +1,48 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-file-draft-clear 1  "clear 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-file\-draft\-clear \- Clear only the draft version you inspected
+.SH SYNOPSIS
+\fBag remote file\-draft clear\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fB\-\-stream\fR> <\fB\-\-path\fR> <\fB\-\-expected\-version\fR>
+.SH DESCRIPTION
+Clear only the draft version you inspected
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-stream\fR \fI<STREAM>\fR
+Stream containing the file
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-path\fR \fI<PATH>\fR
+Repository\-relative file path
+.TP
+\fB\-\-expected\-version\fR \fI<EXPECTED_VERSION>\fR
+Version returned by get, including a cleared version
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-file-draft-get.1 b/docs/reference/man/ag-remote-file-draft-get.1
new file mode 100644
index 00000000..b699ed19
--- /dev/null
+++ b/docs/reference/man/ag-remote-file-draft-get.1
@@ -0,0 +1,48 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-file-draft-get 1  "get 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-file\-draft\-get \- Read metadata; download exact replacement bytes only with \-\-output
+.SH SYNOPSIS
+\fBag remote file\-draft get\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-output\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fB\-\-stream\fR> <\fB\-\-path\fR>
+.SH DESCRIPTION
+Read metadata; download exact replacement bytes only with \-\-output
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-stream\fR \fI<STREAM>\fR
+Stream containing the file
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-path\fR \fI<PATH>\fR
+Repository\-relative file path
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-output\fR \fI<PATH>\fR
+Write saved bytes to this local file (replaces an existing file)
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-file-draft-list.1 b/docs/reference/man/ag-remote-file-draft-list.1
new file mode 100644
index 00000000..ba5abca9
--- /dev/null
+++ b/docs/reference/man/ag-remote-file-draft-list.1
@@ -0,0 +1,42 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-file-draft-list 1  "list 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-file\-draft\-list \- List your saved file drafts in a stream, without downloading their content
+.SH SYNOPSIS
+\fBag remote file\-draft list\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fB\-\-stream\fR>
+.SH DESCRIPTION
+List your saved file drafts in a stream, without downloading their content
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-stream\fR \fI<STREAM>\fR
+Stream containing the files
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-file-draft-save.1 b/docs/reference/man/ag-remote-file-draft-save.1
new file mode 100644
index 00000000..a4280eba
--- /dev/null
+++ b/docs/reference/man/ag-remote-file-draft-save.1
@@ -0,0 +1,54 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-file-draft-save 1  "save 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-file\-draft\-save \- Save private replacement bytes for an existing file at an immutable revision
+.SH SYNOPSIS
+\fBag remote file\-draft save\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fB\-\-stream\fR> <\fB\-\-path\fR> <\fB\-\-base\fR> <\fB\-\-content\-file\fR> <\fB\-\-expected\-version\fR>
+.SH DESCRIPTION
+Save private replacement bytes for an existing file at an immutable revision
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-stream\fR \fI<STREAM>\fR
+Stream containing the file
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-path\fR \fI<PATH>\fR
+Repository\-relative file path
+.TP
+\fB\-\-base\fR \fI<BASE>\fR
+Exact changeset containing the original file you inspected
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-\-content\-file\fR \fI<PATH>\fR
+Binary replacement file, at most 4 MiB
+.TP
+\fB\-\-expected\-version\fR \fI<EXPECTED_VERSION>\fR
+Version returned by get; zero only if no draft has existed
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote-file-draft.1 b/docs/reference/man/ag-remote-file-draft.1
new file mode 100644
index 00000000..7c0a9d2c
--- /dev/null
+++ b/docs/reference/man/ag-remote-file-draft.1
@@ -0,0 +1,52 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-file-draft 1  "file-draft 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-file\-draft \- Save or restore private file edits without publishing a changeset
+.SH SYNOPSIS
+\fBag remote file\-draft\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fIsubcommands\fR>
+.SH DESCRIPTION
+Save or restore private file edits without publishing a changeset
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH SUBCOMMANDS
+.TP
+ag\-remote\-file\-draft\-list(1)
+List your saved file drafts in a stream, without downloading their content
+.TP
+ag\-remote\-file\-draft\-get(1)
+Read metadata; download exact replacement bytes only with \-\-output
+.TP
+ag\-remote\-file\-draft\-save(1)
+Save private replacement bytes for an existing file at an immutable revision
+.TP
+ag\-remote\-file\-draft\-clear(1)
+Clear only the draft version you inspected
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote.1 b/docs/reference/man/ag-remote.1
index 428c9f3a..2ce60f51 100644
--- a/docs/reference/man/ag-remote.1
+++ b/docs/reference/man/ag-remote.1
@@ -67,6 +67,9 @@ Inspect, add or remove requested reviewers (no approval or access change)
 ag\-remote\-review\-draft(1)
 Save or restore your private account review notes without submitting them
 .TP
+ag\-remote\-file\-draft(1)
+Save or restore private file edits without publishing a changeset
+.TP
 ag\-remote\-comment\-draft(1)
 Save or restore a private general comment without posting it
 .TP

From 350cb8cd0487db5d696758204199691214e7350c Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:39:11 +0000
Subject: [PATCH 31/41] docs: describe account file drafts and current roadmap
 progress

---
 CHANGELOG.md                          | 1 +
 README.md                             | 4 ++--
 README.ru.md                          | 2 +-
 ROADMAP.md                            | 4 ++--
 SECURITY.md                           | 6 +++---
 dev/continuous-progress.md            | 8 +++++++-
 docs/architecture/adr-traceability.md | 4 ++++
 7 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 51ac23d6..76f91543 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 - The release pipeline prepares a native Windows x64 ZIP with the CLI, server and MCP, plus a per-user PowerShell installer that verifies checksums. Native install-and-first-use smoke is required before publishing; the first Windows archive is not yet released.
 
+- Existing-file edits can be saved privately to an account and resumed through Web, CLI, SDK and MCP. Original revision and file metadata are retained; publication stays explicit. Development schema 12 requires a pre-upgrade backup.
 - General proposal comments gain separate private account drafts across Web, CLI, SDK and MCP, with explicit save and version-checked cleanup. Development schema 11 preserves existing review drafts; back up before upgrading.
 - Reviewers can explicitly save a private review draft to their account and resume on another device through Web UI, CLI, MCP or SDKs. Local drafts remain available, conflicting drafts require a choice, and versioned saves/clears never overwrite newer notes or submit a review. Development schema 10 requires a pre-upgrade backup.
 
diff --git a/README.md b/README.md
index 138b7bee..27e48e70 100644
--- a/README.md
+++ b/README.md
@@ -117,8 +117,8 @@ There is no stable release or published crates.io, npm or PyPI package yet. Nati
 macOS on x86_64 and ARM64; the worker sandbox is Linux-only. Windows builds are tested in CI, but a native Windows
 release archive is not yet shipped.
 
-**Back up before upgrading.** Beta.7 uses metadata schema **8**. The unreleased development code uses schema **11**,
-adding requested reviewers and private account-backed review and comment drafts. Opening a repository with a development build
+**Back up before upgrading.** Beta.7 uses metadata schema **8**. The unreleased development code uses schema **12**,
+adding requested reviewers and private account-backed review, comment and single-file drafts. Opening a repository with a development build
 can upgrade it; returning to an older binary requires restoring the pre-upgrade backup. See
 [backup and recovery](docs/operations/durability.md) and [release notes](CHANGELOG.md).
 
diff --git a/README.ru.md b/README.ru.md
index 795e03a0..8ff7dd5b 100644
--- a/README.ru.md
+++ b/README.ru.md
@@ -120,7 +120,7 @@ AgentGit — ранняя альтернатива для команд, кото
 но отдельный готовый архив для Windows ещё не выпускается.
 
 **Перед обновлением сделайте резервную копию.** В beta.7 используется схема метаданных **8**.
-Неопубликованная разработка использует схему **11**, которая добавляет назначенных ревьюеров и личные черновики ревью и комментариев.
+Неопубликованная разработка использует схему **12**, которая добавляет назначенных ревьюеров и личные черновики ревью, комментариев и отдельных файлов.
 Запуск сборки из разработки может обновить репозиторий; для возврата к старому бинарнику потребуется восстановить
 копию до обновления. Подробнее: [резервное копирование](docs/operations/durability.md) и [история выпусков](CHANGELOG.md).
 
diff --git a/ROADMAP.md b/ROADMAP.md
index e9a853b9..4963c47f 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -97,7 +97,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
 
 1. **Deliver the next development slice.** Beta.7 is published with metadata schema 8.
    Its Linux archive installation and first reviewed change have been exercised end to end.
-   The next release must include the development review workflow and its schema-11 upgrade
+   The next release must include the development review workflow and its schema-12 upgrade
    notice with backup/rollback guidance; existing beta tags remain immutable.
 2. **Finish the daily task and review workflow.** Queued-task refinement now preserves
    historical instructions and source links. Proposal updates now have an atomic inspected-head
@@ -106,7 +106,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    rechecks the proposal head and open state. Single-line, range and batched suggestions support explicit author preview and application across files in one revision. Requested reviewers route work across Web UI, CLI, MCP and SDKs without changing approval policy. Optional policy-required line-discussion resolution is now implemented
    across core, API, CLI explanations and Web UI. Preserve drafts, exact-head
    checks and explicit confirmation when a user changes executable work or a review decision.
-   Binary, oversized, file-type and rename/delete conflicts now support exact version choices; renamed content previews retain their per-side source paths. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; general proposal comments now have separate private drafts with the same explicit save and version checks; account-backed file edits remain open. Bounded file/directory conflicts now support whole-source choices with complete candidate previews; multi-target rename conflicts and larger structural cases remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
+   Binary, oversized, file-type and rename/delete conflicts now support exact version choices; renamed content previews retain their per-side source paths. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; general proposal comments now have separate private drafts with the same explicit save and version checks; single-file edits now support explicit account save and restore, including discovery after a file disappears from the current branch. Account-backed batch and new-file drafts remain open. Bounded file/directory conflicts now support whole-source choices with complete candidate previews; multi-target rename conflicts and larger structural cases remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
    polling for the aggregate view. A cross-repository event feed remains future work.
 3. **Make GitHub/GitLab cutover complete.** Code history, branch/tag mapping, the original bundle
    and reconciliation already move through Web UI and CLI. Next design and implement resumable
diff --git a/SECURITY.md b/SECURITY.md
index 0d03152c..2e548868 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -11,11 +11,11 @@ agents. We take integrity and isolation bugs seriously.
 | `0.3.0-beta.7` | Current patch release; use its binaries after the Release workflow completes. |
 | `0.3.0-beta.6` and earlier prereleases | Upgrade to the current patch release for the fixes to stream scopes, workspace concurrency and retention. |
 
-AgentGit is **beta** software. The current development repository metadata schema is **11**;
+AgentGit is **beta** software. The current development repository metadata schema is **12**;
 `ChangesetV1`, tree manifest v1 and repository configuration format 1 remain unchanged.
 The server control database is migrated independently; use the same server version across replicas.
-The published beta.6/beta.7 format is schema 8. Development schema 9 adds requested reviewers, schema 10 adds private review drafts, and schema 11 adds separate private comment drafts;
-back up before opening a schema-8, schema-9 or schema-10 repository with this build. Beta.7 introduces no
+The published beta.6/beta.7 format is schema 8. Development schema 9 adds requested reviewers, schema 10 adds private review drafts, schema 11 adds separate private comment drafts, and schema 12 adds private single-file drafts;
+back up before opening a schema-8 through schema-11 repository with this build. Beta.7 introduces no
 storage migration relative to beta.6. Returning to beta.5 or older
 requires the pre-upgrade backup, not opening the upgraded database with an older binary.
 See [compatibility](docs/architecture/compatibility.md) and [releasing](docs/operations/releasing.md).
diff --git a/dev/continuous-progress.md b/dev/continuous-progress.md
index 5deab9cf..5cc2a0f2 100644
--- a/dev/continuous-progress.md
+++ b/dev/continuous-progress.md
@@ -39,7 +39,7 @@ Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceab
 | D2 | P0 IN PROGRESS | Push working branch, open draft PR, inspect mandatory CI; **never merge** | exact head checks, fix actual failures; native Windows ZIP/install/PS5.1 evidence |
 | R1 | P0 DONE | Fix structural sync losing independent incoming add/edit/delete when file/directory merge falls back to ours | retain raw conflicting candidate, apply explicit choices before tree validation; both orientations/no partial workspace mutation |
 | R2 | P1 DONE | Private general discussion drafts | per-account isolation, stale-save/clear protections, UI restore, SDK/CLI parity |
-| R3 | P1 OPEN | Account-backed file-edit drafts | immutable base, byte/mode preservation, conflicts keep local work; no automatic publication |
+| R3 | P1 PARTIAL | Existing single-file drafts delivered; batch/new-file drafts remain | immutable base, byte/mode preservation, conflicts keep local work; no automatic publication |
 | R4 | P1 PARTIAL | Bounded file/directory Web choices; multi-target rename and larger structural cases remain open | complete explicit result, preserve independent clean edits; never infer deletion from failed reads |
 | R5 | P1 OPEN | Cross-repository work feed | pagination/scopes, full initial snapshot and reconnect behavior |
 | M1 | P1 OPEN | Resumable hosting metadata import: issues/comments first | preview, mapping/idempotency/checkpoint, retry without duplication; PR/releases/identity later |
@@ -115,3 +115,9 @@ R2 backend green:253 tests (integrate37+4+4, server100+1+1, storage106), schema1
 Next R3 design discovered (not implemented): existing virtual workspaces are readable to repository readers and their blobs enter normal history, so do not use them as private draft storage. Small first slice: existing single-file edits only; owner-private versioned draft keyed by stream/original path with immutable base and original blob/type/mode, bounded private content bytes and title/description, explicit save, private list for recovery after current-file deletion, base retention until clear. Public propose remains existing explicit operation followed by captured-version cleanup. Existing FileEditor does not preserve BOM/CRLF like batch editor: establish real-byte regression before implementation. New-file/batch/rename/delete remain later.
 
 R2 delivered in commits36f99cd (API/schema11),acbdb9f (SDK/MCP),4304dc8 (CLI),d1f19a3 (Web). Backend253, Web867+8browser, SDK182/208, CLI2+1 passed. MCP new integration tests not run; static implementation and generated clients complete. User explicitly requested stopping excess tests/checks and continuing feature development; do not run further broad/mutation loops. R3 implementation now active in parallel core/CLI/SDK-MCP/Web with only basic compilation.
+
+R3 implementation landed locally across backend/API/CLI/SDK-MCP/Web. User explicitly stopped excessive verification: basic server build passed; CLI/MCP and Web/SDK basic builds only, no new test matrices. Feature:4MiB exact private single-file drafts,20/account/repo, scoped list and tombstones, GC-retained immutable base. Web adds explicit save/resume and saved-file discovery including removed paths. R2 batch pushed through6745639; no merge/release.
+
+R3 commits:cd8f0db backend/schema12,950d935 Web,16f7dd2 SDK/MCP. Basic server/Web builds and CLI/MCP checks passed; SDK types passed. No R3 test matrices or mutation runs per explicit user request. CLI binary/docs generation completing. Continue product work with lightweight verification; do not return to broad quality-tool loops. Main/release hold unchanged.
+
+R3 delivery complete for existing single-file edits: CLI86aaa18 and generated168 reference files; all clients compile/build. Commit ordered with backendcd8f0db, Web950d935, SDK/MCP16f7dd2. This is a functional roadmap slice, not overall roadmap completion. Future work: batch/new-file account drafts, cross-repository feed and migration backlog; retain user priority on implementation and only lightweight necessary verification. No merge/tag/release authorized.
diff --git a/docs/architecture/adr-traceability.md b/docs/architecture/adr-traceability.md
index 97ef68e5..1201b4a3 100644
--- a/docs/architecture/adr-traceability.md
+++ b/docs/architecture/adr-traceability.md
@@ -144,3 +144,7 @@ The [continuous checkpoint](../../dev/continuous-progress.md) records pending CI
 ## ADR-0042 — private proposal comment drafts
 
 [ADR-0042](../adr/0042-private-comment-drafts.md) separates general-comment notes from review decisions. Core and storage tests cover exact actor ownership, independent slots, transactional versions, tombstones and the schema10-to11 upgrade. HTTP/gRPC tests cover permissions, closed proposals and private response handling. CLI and SDK tests exercise the same get/save/clear contract. Web component and browser scenarios cover explicit save, cross-device restore, conflicting versions and cleanup after posting. See the continuous checkpoint for validation status on the current unmerged head.
+
+## ADR-0043 — private single-file drafts
+
+[ADR-0043](../adr/0043-private-file-drafts.md) stores replacement bytes privately and retains the original revision as a GC root. Web, CLI, SDK and MCP implement explicit save/restore/clear; Web also lists saved paths. Existing-file scope only. Basic builds/type checks passed; extended test matrices were not run for this slice.

From 00ded3dcb11fed9aacf9be82769e2c1f81d9d1d2 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:43:48 +0000
Subject: [PATCH 32/41] feat(web): keep home live across loaded repositories

---
 apps/web/src/api/sse.ts                      | 76 +++++++++++++++-----
 apps/web/src/composables/useAttention.ts     | 17 +++--
 apps/web/src/composables/useAttentionFeed.ts | 24 +++++--
 apps/web/src/views/HomeView.vue              | 27 +++----
 4 files changed, 103 insertions(+), 41 deletions(-)

diff --git a/apps/web/src/api/sse.ts b/apps/web/src/api/sse.ts
index 395509c5..b2dd959c 100644
--- a/apps/web/src/api/sse.ts
+++ b/apps/web/src/api/sse.ts
@@ -111,7 +111,9 @@ export interface FeedStatusInfo {
 
 export interface FeedOptions {
   client: ApiClient
-  repo: string
+  repo?: string
+  /** Explicit bounded scope for the aggregate endpoint; the cursor remains opaque. */
+  repos?: readonly string[]
   /** Optional initiating session; retained across reconnects. */
   session?: Pick<RequestOptions, 'token' | 'quietUnauthenticated'>
   topics?: readonly string[]
@@ -145,18 +147,22 @@ function defaultSleep(ms: number, signal: AbortSignal): Promise<void> {
   })
 }
 
+function eventValue(value: unknown): ServerEvent | null {
+  const v = value as Partial<ServerEvent> | null
+  if (!v || typeof v !== 'object') return null
+  if (typeof v.seq !== 'number' || typeof v.topic !== 'string') return null
+  return {
+    seq: v.seq,
+    topic: v.topic,
+    repo: typeof v.repo === 'string' ? v.repo : '',
+    timestamp_ms: typeof v.timestamp_ms === 'number' ? v.timestamp_ms : 0,
+    payload: v.payload && typeof v.payload === 'object' ? v.payload : {},
+  }
+}
+
 function parseEvent(data: string): ServerEvent | null {
   try {
-    const v = JSON.parse(data) as Partial<ServerEvent> | null
-    if (!v || typeof v !== 'object') return null
-    if (typeof v.seq !== 'number' || typeof v.topic !== 'string') return null
-    return {
-      seq: v.seq,
-      topic: v.topic,
-      repo: typeof v.repo === 'string' ? v.repo : '',
-      timestamp_ms: typeof v.timestamp_ms === 'number' ? v.timestamp_ms : 0,
-      payload: v.payload && typeof v.payload === 'object' ? v.payload : {},
-    }
+    return eventValue(JSON.parse(data))
   } catch {
     return null
   }
@@ -177,6 +183,10 @@ export function openEventFeed(options: FeedOptions): EventFeed {
   const now = options.now ?? Date.now
   const lifetime = new AbortController()
   let lastSeq: number | null = options.afterSeq ?? null
+  const aggregate = options.repos !== undefined
+  const repositories = new Set(options.repos)
+  let cursor: string | undefined
+  const delivered = new Map<string, number>()
   let closed = false
 
   const setStatus = (s: FeedStatus, info: FeedStatusInfo) => onStatus?.(s, info)
@@ -194,13 +204,25 @@ export function openEventFeed(options: FeedOptions): EventFeed {
     )
     try {
       setStatus(attempt === 0 ? 'connecting' : 'reconnecting', { attempt })
-      const res = await client.open(repoPath(repo, '/events'), {
+      const res = await client.open(aggregate ? '/v1/events' : repoPath(repo ?? '', '/events'), {
         ...options.session,
-        query: {
-          after_seq: lastSeq === null ? undefined : lastSeq,
-          topics: options.topics && options.topics.length > 0 ? [...options.topics] : undefined,
-        },
-        headers: lastSeq === null ? undefined : { 'last-event-id': String(lastSeq) },
+        query: aggregate
+          ? {
+              repos: [...repositories].join(','),
+              cursor,
+              topics: options.topics?.join(','),
+            }
+          : {
+              after_seq: lastSeq === null ? undefined : lastSeq,
+              topics: options.topics && options.topics.length > 0 ? [...options.topics] : undefined,
+            },
+        headers: aggregate
+          ? cursor
+            ? { 'last-event-id': cursor }
+            : undefined
+          : lastSeq === null
+            ? undefined
+            : { 'last-event-id': String(lastSeq) },
         signal: connection.signal,
         retries: 0,
         timeoutMs: 20_000,
@@ -218,6 +240,26 @@ export function openEventFeed(options: FeedOptions): EventFeed {
         lastActivity = now()
         for (const msg of parser.push(decoder.decode(value, { stream: true }))) {
           if (msg.event === 'error') throw parseStreamError(msg.data)
+          if (aggregate) {
+            let envelope: { cursor?: unknown; event?: unknown }
+            try {
+              envelope = JSON.parse(msg.data)
+            } catch {
+              continue
+            }
+            if (!envelope || typeof envelope.cursor !== 'string') continue
+            if (envelope.event == null) {
+              cursor = envelope.cursor
+              continue
+            }
+            const ev = eventValue(envelope.event)
+            if (!ev || !repositories.has(ev.repo)) continue
+            cursor = envelope.cursor
+            if (ev.seq <= (delivered.get(ev.repo) ?? -1)) continue
+            delivered.set(ev.repo, ev.seq)
+            onEvent(ev)
+            continue
+          }
           const ev = parseEvent(msg.data)
           if (!ev) continue
           if (lastSeq !== null && ev.seq <= lastSeq) continue // replay overlap: already delivered
diff --git a/apps/web/src/composables/useAttention.ts b/apps/web/src/composables/useAttention.ts
index 0ae619c8..d1db1fad 100644
--- a/apps/web/src/composables/useAttention.ts
+++ b/apps/web/src/composables/useAttention.ts
@@ -1,4 +1,4 @@
-import { onBeforeUnmount, onMounted, ref, shallowRef, watch, type Ref } from 'vue'
+import { computed, onBeforeUnmount, onMounted, ref, shallowRef, watch, type Ref } from 'vue'
 import { api } from '@/api/instance'
 import type { Preparation, Proposal, Repo, Review } from '@/api/types'
 import { attentionForRepo } from '@/lib/attention'
@@ -138,6 +138,7 @@ async function readSnapshot(
   const results = await mapLimit(read, 3, (r) => repositorySummary(r, access, stale, now))
   return {
     repos,
+    loadedRepos: read.map((repo) => repo.name),
     ...combine(results),
     skipped: repository ? 0 : Math.max(0, repos.length - read.length),
   }
@@ -169,11 +170,11 @@ function attentionRefreshQueue(reload: () => Promise<void>, busy: () => boolean)
   }
 }
 
-function cachedCatalogue(reuse: boolean, repository: string, repos: Repo[]) {
-  return reuse && repository && repos.length ? repos : undefined
+function cachedCatalogue(reuse: boolean, repos: Repo[]) {
+  return reuse && repos.length ? repos : undefined
 }
 
-/** Live invalidation for the selected repository, bounded polling otherwise; only complete snapshots commit. */
+/** Live invalidation for the loaded repository scope; only complete snapshots commit. */
 export function useAttention(repository: Ref<string> = ref('')) {
   const auth = useAuth()
   const repos = shallowRef<Repo[]>([])
@@ -185,13 +186,14 @@ export function useAttention(repository: Ref<string> = ref('')) {
   const skipped = ref(0)
   const unreadable = ref(0)
   const limit = ref(MAX_REPOS)
+  const loadedRepositories = ref<string[]>([])
   let serial = 0
   let timer: ReturnType<typeof setInterval> | undefined
   const refreshQueue = attentionRefreshQueue(
     () => load(true),
     () => loading.value,
   )
-  const liveStatus = useAttentionFeed(repository, refreshQueue.request)
+  const liveStatus = useAttentionFeed(repository, refreshQueue.request, loadedRepositories)
 
   async function load(reuseCatalogue = false) {
     refreshQueue.begin()
@@ -200,10 +202,11 @@ export function useAttention(repository: Ref<string> = ref('')) {
     loading.value = true
     try {
       if (stale()) return
-      const cached = cachedCatalogue(reuseCatalogue, repository.value, repos.value)
+      const cached = cachedCatalogue(reuseCatalogue, repos.value)
       const snapshot = await readSnapshot(auth, stale, repository.value, limit.value, cached)
       if (stale() || !snapshot) return
       repos.value = snapshot.repos
+      loadedRepositories.value = snapshot.loadedRepos
       items.value = snapshot.items
       unreadable.value = snapshot.unreadable
       skipped.value = snapshot.skipped
@@ -231,6 +234,7 @@ export function useAttention(repository: Ref<string> = ref('')) {
     () => {
       serial++
       repos.value = []
+      loadedRepositories.value = []
       items.value = []
       lastUpdated.value = 0
       unreadable.value = 0
@@ -259,6 +263,7 @@ export function useAttention(repository: Ref<string> = ref('')) {
     settled,
     lastUpdated,
     liveStatus,
+    liveLimited: computed(() => !repository.value && loadedRepositories.value.length > MAX_REPOS),
     error,
     skipped,
     unreadable,
diff --git a/apps/web/src/composables/useAttentionFeed.ts b/apps/web/src/composables/useAttentionFeed.ts
index 742bcb3f..e64b65ea 100644
--- a/apps/web/src/composables/useAttentionFeed.ts
+++ b/apps/web/src/composables/useAttentionFeed.ts
@@ -1,12 +1,24 @@
-import { onBeforeUnmount, onMounted, ref, watch, type Ref } from 'vue'
+import { computed, onBeforeUnmount, onMounted, ref, watch, type Ref } from 'vue'
 import { client } from '@/api/instance'
 import { openEventFeed, type EventFeed, type FeedStatus } from '@/api/sse'
 import { useAuth } from '@/stores/auth'
 
-/** One visible, selected repository gets a live feed; the aggregate view keeps bounded polling. */
-export function useAttentionFeed(repository: Ref<string>, refresh: () => void) {
+/** One visible feed for the selected repository or bounded aggregate snapshot. */
+export function useAttentionFeed(
+  repository: Ref<string>,
+  refresh: () => void,
+  loadedRepositories: Ref<string[]> = ref([]),
+) {
   const auth = useAuth()
   const status = ref<FeedStatus>('idle')
+  const aggregateScope = computed(() => [...new Set(loadedRepositories.value.slice(0, 30))].sort())
+  const scopeKey = computed(
+    () =>
+      repository.value ||
+      (auth.capabilities?.features.includes('events.multi_repo') && aggregateScope.value.length
+        ? JSON.stringify(aggregateScope.value)
+        : ''),
+  )
   const visible = ref(document.visibilityState === 'visible')
   let feed: EventFeed | undefined
   let generation = 0
@@ -20,12 +32,12 @@ export function useAttentionFeed(repository: Ref<string>, refresh: () => void) {
   }
   function reconcile() {
     stop()
-    if (!mounted || !visible.value || !repository.value || !auth.isAuthenticated) return
+    if (!mounted || !visible.value || !scopeKey.value || !auth.isAuthenticated) return
     const mine = generation
     status.value = 'connecting'
     feed = openEventFeed({
       client,
-      repo: repository.value,
+      ...(repository.value ? { repo: repository.value } : { repos: aggregateScope.value }),
       session: { token: auth.token, quietUnauthenticated: true },
       onEvent: () => {
         if (mine === generation) refresh()
@@ -41,7 +53,7 @@ export function useAttentionFeed(repository: Ref<string>, refresh: () => void) {
   function visibilityChanged() {
     visible.value = document.visibilityState === 'visible'
   }
-  watch([repository, () => auth.token, () => auth.isAuthenticated, visible], reconcile, {
+  watch([scopeKey, () => auth.token, () => auth.isAuthenticated, visible], reconcile, {
     flush: 'sync',
   })
   onMounted(() => {
diff --git a/apps/web/src/views/HomeView.vue b/apps/web/src/views/HomeView.vue
index b33c3f4a..4f63a3eb 100644
--- a/apps/web/src/views/HomeView.vue
+++ b/apps/web/src/views/HomeView.vue
@@ -33,6 +33,7 @@ const {
   settled,
   lastUpdated,
   liveStatus,
+  liveLimited,
   error,
   skipped,
   unreadable,
@@ -151,19 +152,21 @@ const itemLink = (i: AttentionItem): RouteLocationRaw =>
         >
       </div>
       <p v-if="lastUpdated" class="refresh-note">
-        <LiveIndicator v-if="repository" :status="liveStatus" />
+        <LiveIndicator v-if="!liveLimited" :status="liveStatus" />
         Last refreshed {{ formatTime(lastUpdated) }}.
-        <template v-if="liveStatus === 'live'"
-          >Live updates for {{ repository }}; a check every 15 seconds keeps the summary
-          current.</template
-        >
-        <template v-else-if="repository"
-          >Live updates {{ liveStatus === 'connecting' ? 'are connecting' : 'are unavailable' }}.
-          Checks every 15 seconds while visible.</template
-        >
-        <template v-else
-          >Checks every 15 seconds while visible. Select a repository for live updates.</template
-        >
+        <template v-if="liveStatus === 'live' && !liveLimited">
+          Live updates{{ repository ? ` for ${repository}` : ' across loaded repositories' }}.
+        </template>
+        <template v-else-if="liveStatus === 'live' && liveLimited">
+          Live updates cover 30 repositories; the remaining loaded work refreshes every 15 seconds.
+        </template>
+        <template v-else>
+          {{
+            liveStatus === 'connecting'
+              ? 'Connecting live updates.'
+              : 'Checks every 15 seconds while visible.'
+          }}
+        </template>
       </p>
       <Alert
         v-if="incomplete"

From cb69c055afa67273f2e24dcc850ef8d7c57c6f29 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:45:44 +0000
Subject: [PATCH 33/41] feat(events): replay and follow multiple repositories
 with scoped cursors

---
 crates/ag-protocol/proto/agwp/v1/agwp.proto |  28 +++
 crates/ag-protocol/src/lib.rs               |   4 +
 crates/ag-server/src/api/events.rs          |   6 +-
 crates/ag-server/src/api/events_many.rs     | 252 ++++++++++++++++++++
 crates/ag-server/src/api/mod.rs             |   1 +
 crates/ag-server/src/grpc.rs                |  22 ++
 crates/ag-server/src/http.rs                | 106 ++++++++
 docs/adr/0044-cross-repository-events.md    |  27 +++
 docs/adr/README.md                          |   2 +
 docs/protocol/openapi.json                  | 232 ++++++++++++++++++
 proto/agwp/v1/agwp.proto                    |  28 +++
 11 files changed, 705 insertions(+), 3 deletions(-)
 create mode 100644 crates/ag-server/src/api/events_many.rs
 create mode 100644 docs/adr/0044-cross-repository-events.md

diff --git a/crates/ag-protocol/proto/agwp/v1/agwp.proto b/crates/ag-protocol/proto/agwp/v1/agwp.proto
index 1f098870..3d96615a 100644
--- a/crates/ag-protocol/proto/agwp/v1/agwp.proto
+++ b/crates/ag-protocol/proto/agwp/v1/agwp.proto
@@ -1531,6 +1531,32 @@ message ReplayResponse {
   uint64 latest_seq = 2;
 }
 
+// An opaque vector cursor; events from different repositories have no shared sequence.
+message EventEnvelope {
+  string cursor = 1;
+  // Absent for an initial checkpoint, filtered progress, or heartbeat.
+  Event event = 2;
+}
+message ReplayManyRequest {
+  repeated string repos = 1;
+  repeated string topics = 2;
+  string cursor = 3;
+  uint32 limit = 4;
+  // With no cursor, deliberately replay all history instead of checkpointing now.
+  bool from_start = 5;
+}
+message ReplayManyResponse {
+  repeated EventEnvelope events = 1;
+  string cursor = 2;
+  bool has_more = 3;
+}
+message SubscribeManyRequest {
+  repeated string repos = 1;
+  repeated string topics = 2;
+  string cursor = 3;
+  uint32 heartbeat_ms = 4;
+}
+
 // ---------------------------------------------------------------------------
 // Administration
 // ---------------------------------------------------------------------------
@@ -2018,6 +2044,8 @@ service AgentService {
 service EventService {
   rpc Subscribe(SubscribeRequest) returns (stream Event);
   rpc Replay(ReplayRequest) returns (ReplayResponse);
+  rpc ReplayMany(ReplayManyRequest) returns (ReplayManyResponse);
+  rpc SubscribeMany(SubscribeManyRequest) returns (stream EventEnvelope);
 }
 
 service AdminService {
diff --git a/crates/ag-protocol/src/lib.rs b/crates/ag-protocol/src/lib.rs
index 7372e42a..f34df7d2 100644
--- a/crates/ag-protocol/src/lib.rs
+++ b/crates/ag-protocol/src/lib.rs
@@ -115,9 +115,13 @@ pub mod features {
     /// Private existing-file edits with immutable original metadata.
     pub const FILES_DRAFTS: &str = "files.drafts";
 
+    /// A bounded event stream with independent cursors for explicit repositories.
+    pub const EVENTS_MULTI_REPO: &str = "events.multi_repo";
+
     /// Every feature this implementation knows.
     pub const ALL: &[&str] = &[
         EVENTS_REPLAY,
+        EVENTS_MULTI_REPO,
         WORKSPACES_VIRTUAL,
         WORKSPACES_SYNC_PRECONDITION,
         WORKSPACES_CONFLICT_ORIGINS,
diff --git a/crates/ag-server/src/api/events.rs b/crates/ag-server/src/api/events.rs
index b71dbde1..2147ca07 100644
--- a/crates/ag-server/src/api/events.rs
+++ b/crates/ag-server/src/api/events.rs
@@ -36,7 +36,7 @@ pub struct EventBatch {
     pub scanned_seq: u64,
 }
 
-fn to_event(repo: &str, e: &AuditEntry) -> v1::Event {
+pub(super) fn to_event(repo: &str, e: &AuditEntry) -> v1::Event {
     let details: serde_json::Value = serde_json::from_str(&e.details).unwrap_or(serde_json::Value::Null);
     v1::Event {
         seq: e.seq,
@@ -47,7 +47,7 @@ fn to_event(repo: &str, e: &AuditEntry) -> v1::Event {
     }
 }
 
-fn matches_topics(topics: &[String], topic: &str) -> bool {
+pub(super) fn matches_topics(topics: &[String], topic: &str) -> bool {
     topics.is_empty() || topics.iter().any(|t| topic == t || topic.starts_with(&format!("{t}.")) || t == "*")
 }
 
@@ -212,7 +212,7 @@ impl App {
     }
 }
 
-struct GaugeGuard(App);
+pub(super) struct GaugeGuard(pub(super) App);
 
 impl Drop for GaugeGuard {
     fn drop(&mut self) {
diff --git a/crates/ag-server/src/api/events_many.rs b/crates/ag-server/src/api/events_many.rs
new file mode 100644
index 00000000..37805c63
--- /dev/null
+++ b/crates/ag-server/src/api/events_many.rs
@@ -0,0 +1,252 @@
+//! Bounded audit replay across explicit repositories, with independent cursors.
+use super::events::{GaugeGuard, matches_topics, to_event};
+use crate::app::{App, Call};
+use crate::authz::Cap;
+use crate::error::{ApiError, ApiResult};
+use ag_protocol::v1;
+use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+use futures_util::Stream;
+use serde::{Deserialize, Serialize};
+use std::collections::VecDeque;
+use std::time::{Duration, Instant};
+
+const MAX_REPOS: usize = 30;
+const MAX_CURSOR: usize = 16 * 1024;
+const SCAN_BUDGET: usize = 4096;
+
+#[derive(Clone, Serialize, Deserialize)]
+struct Cursor {
+    v: u8,
+    repos: Vec<String>,
+    topics: Vec<String>,
+    seq: Vec<u64>,
+    next: usize,
+}
+impl Cursor {
+    fn encoded(&self) -> ApiResult<String> {
+        let encoded = URL_SAFE_NO_PAD.encode(serde_json::to_vec(self).map_err(ApiError::internal)?);
+        if encoded.len() > MAX_CURSOR {
+            return Err(ApiError::invalid("event cursor exceeds 16 KiB"));
+        }
+        Ok(encoded)
+    }
+}
+fn normalized(mut repos: Vec<String>, mut topics: Vec<String>) -> ApiResult<(Vec<String>, Vec<String>)> {
+    if repos.is_empty()
+        || repos.len() > MAX_REPOS
+        || repos.iter().any(|repo| repo.is_empty() || repo.len() > 256 || repo.contains(['*', '?', ',']))
+    {
+        return Err(ApiError::invalid("supply 1 to 30 explicit repository names"));
+    }
+    repos.sort();
+    repos.dedup();
+    if topics.len() > 32 || topics.iter().any(|topic| topic.is_empty() || topic.len() > 128) {
+        return Err(ApiError::invalid("supply at most 32 nonempty topic prefixes of 128 bytes"));
+    }
+    topics.sort();
+    topics.dedup();
+    Ok((repos, topics))
+}
+fn decode(value: &str, repos: &[String], topics: &[String]) -> ApiResult<Cursor> {
+    if value.len() > MAX_CURSOR {
+        return Err(ApiError::invalid("event cursor exceeds 16 KiB"));
+    }
+    let bytes = URL_SAFE_NO_PAD.decode(value).map_err(|_| ApiError::invalid("invalid event cursor"))?;
+    let cursor: Cursor = serde_json::from_slice(&bytes).map_err(|_| ApiError::invalid("invalid event cursor"))?;
+    if cursor.v != 1
+        || cursor.repos != repos
+        || cursor.topics != topics
+        || cursor.seq.len() != repos.len()
+        || cursor.next >= repos.len()
+    {
+        return Err(ApiError::invalid("event cursor does not match the requested repositories and topics"));
+    }
+    Ok(cursor)
+}
+impl App {
+    async fn authorize_many(&self, call: &Call, repos: &[String]) -> ApiResult<()> {
+        let expires = call.principal.expires_at_ms;
+        if expires > 0 && self.clock.now().as_millis() >= expires {
+            return Err(ApiError::new(ag_protocol::ErrorCode::Unauthenticated, "the credential expired"));
+        }
+        self.auth.still_active(&call.principal).await?;
+        self.ensure_bound_run_alive(&call.principal).await?;
+        for repo in repos {
+            self.authorize(call, repo, Cap::EventsRead, None).await?;
+        }
+        Ok(())
+    }
+    async fn many_page(
+        &self,
+        call: &Call,
+        repo: &str,
+        topics: &[String],
+        after: u64,
+        limit: usize,
+        scan: usize,
+    ) -> ApiResult<(Vec<v1::Event>, u64, u64)> {
+        let (name, topics) = (repo.to_string(), topics.to_vec());
+        self.with_repo(call, repo, Cap::EventsRead, None, move |r, _| {
+            r.meta()
+                .read(|tx| {
+                    let latest = tx.audit_latest_seq()?;
+                    let rows = tx.audit_after(after, scan)?;
+                    let mut scanned = after;
+                    let mut events = Vec::new();
+                    for row in rows {
+                        scanned = row.seq;
+                        if matches_topics(&topics, &row.action) {
+                            events.push(to_event(&name, &row));
+                        }
+                        if events.len() >= limit {
+                            break;
+                        }
+                    }
+                    Ok((events, scanned, latest))
+                })
+                .map_err(Into::into)
+        })
+        .await
+    }
+    /// Checkpoint from now by default; explicit historical replay uses `from_start`.
+    pub async fn replay_many(&self, call: &Call, req: v1::ReplayManyRequest) -> ApiResult<v1::ReplayManyResponse> {
+        let (repos, topics) = normalized(req.repos, req.topics)?;
+        if req.from_start && !req.cursor.is_empty() {
+            return Err(ApiError::invalid("from_start cannot be combined with cursor"));
+        }
+        self.authorize_many(call, &repos).await?;
+        let mut cursor = if req.cursor.is_empty() {
+            Cursor { v: 1, seq: vec![0; repos.len()], next: 0, repos: repos.clone(), topics: topics.clone() }
+        } else {
+            decode(&req.cursor, &repos, &topics)?
+        };
+        if req.cursor.is_empty() && !req.from_start {
+            for (i, repo) in repos.iter().enumerate() {
+                cursor.seq[i] = self.many_page(call, repo, &topics, u64::MAX, 1, 1).await?.2;
+            }
+            self.authorize_many(call, &repos).await?;
+            return Ok(v1::ReplayManyResponse { events: vec![], cursor: cursor.encoded()?, has_more: false });
+        }
+        let limit = if req.limit == 0 { 256 } else { req.limit.min(1000) } as usize;
+        let per_repo = limit.div_ceil(repos.len());
+        let scan = SCAN_BUDGET / repos.len();
+        let start = cursor.next;
+        let mut events = Vec::new();
+        let mut has_more = false;
+        for offset in 0..repos.len() {
+            let i = (start + offset) % repos.len();
+            if events.len() == limit {
+                has_more = true;
+                break;
+            }
+            let (batch, scanned, latest) = self
+                .many_page(call, &repos[i], &topics, cursor.seq[i], per_repo.min(limit - events.len()), scan)
+                .await?;
+            for event in batch {
+                cursor.seq[i] = event.seq;
+                cursor.next = (i + 1) % repos.len();
+                events.push(v1::EventEnvelope { cursor: cursor.encoded()?, event: Some(event) });
+            }
+            cursor.seq[i] = cursor.seq[i].max(scanned);
+            cursor.next = (i + 1) % repos.len();
+            has_more |= scanned < latest;
+        }
+        self.authorize_many(call, &repos).await?;
+        Ok(v1::ReplayManyResponse { events, cursor: cursor.encoded()?, has_more })
+    }
+    /// Replays the cursor then follows. Each emitted envelope remains independently resumable.
+    pub async fn subscribe_many(
+        self,
+        call: Call,
+        req: v1::SubscribeManyRequest,
+    ) -> ApiResult<impl Stream<Item = ApiResult<v1::EventEnvelope>> + Send + 'static> {
+        let (repos, topics) = normalized(req.repos, req.topics)?;
+        let first = self
+            .replay_many(
+                &call,
+                v1::ReplayManyRequest {
+                    repos: repos.clone(),
+                    topics: topics.clone(),
+                    cursor: req.cursor,
+                    limit: 256,
+                    from_start: false,
+                },
+            )
+            .await?;
+        self.metrics.subscriptions.inc();
+        let heartbeat =
+            Duration::from_millis(u64::from(if req.heartbeat_ms == 0 { 15000 } else { req.heartbeat_ms.max(1000) }));
+        let mut buffer: VecDeque<_> = first.events.into();
+        buffer.push_back(v1::EventEnvelope { cursor: first.cursor.clone(), event: None });
+        let state = ManyState {
+            app: self.clone(),
+            call,
+            repos,
+            topics,
+            cursor: first.cursor,
+            buffer,
+            heartbeat,
+            last_sent: Instant::now(),
+            done: false,
+            shutdown: self.shutdown_signal(),
+            _gauge: GaugeGuard(self),
+        };
+        Ok(futures_util::stream::unfold(state, |mut st| async move {
+            loop {
+                if st.done || *st.shutdown.borrow() {
+                    return None;
+                }
+                if let Some(event) = st.buffer.pop_front() {
+                    if let Err(error) = st.app.authorize_many(&st.call, &st.repos).await {
+                        st.done = true;
+                        return Some((Err(error), st));
+                    }
+                    st.last_sent = Instant::now();
+                    return Some((Ok(event), st));
+                }
+                let req = v1::ReplayManyRequest {
+                    repos: st.repos.clone(),
+                    topics: st.topics.clone(),
+                    cursor: st.cursor.clone(),
+                    limit: 256,
+                    from_start: false,
+                };
+                match st.app.replay_many(&st.call, req).await {
+                    Ok(page) => {
+                        st.buffer.extend(page.events);
+                        if page.cursor != st.cursor {
+                            st.buffer.push_back(v1::EventEnvelope { cursor: page.cursor.clone(), event: None });
+                        }
+                        st.cursor = page.cursor;
+                        if !st.buffer.is_empty() {
+                            continue;
+                        }
+                        if st.last_sent.elapsed() >= st.heartbeat {
+                            st.buffer.push_back(v1::EventEnvelope { cursor: st.cursor.clone(), event: None });
+                            continue;
+                        }
+                    }
+                    Err(error) => {
+                        st.done = true;
+                        return Some((Err(error), st));
+                    }
+                }
+                let mut shutdown = st.shutdown.clone();
+                tokio::select! {_=tokio::time::sleep(Duration::from_millis(500))=>{},_=shutdown.changed()=>{}}
+            }
+        }))
+    }
+}
+struct ManyState {
+    app: App,
+    call: Call,
+    repos: Vec<String>,
+    topics: Vec<String>,
+    cursor: String,
+    buffer: VecDeque<v1::EventEnvelope>,
+    heartbeat: Duration,
+    last_sent: Instant,
+    done: bool,
+    shutdown: tokio::sync::watch::Receiver<bool>,
+    _gauge: GaugeGuard,
+}
diff --git a/crates/ag-server/src/api/mod.rs b/crates/ag-server/src/api/mod.rs
index c78567fb..6ab0b04a 100644
--- a/crates/ag-server/src/api/mod.rs
+++ b/crates/ag-server/src/api/mod.rs
@@ -17,6 +17,7 @@ mod agents;
 mod comment_drafts;
 mod convert;
 mod events;
+mod events_many;
 mod file_drafts;
 mod history;
 mod integration;
diff --git a/crates/ag-server/src/grpc.rs b/crates/ag-server/src/grpc.rs
index d8673d20..cce2170c 100644
--- a/crates/ag-server/src/grpc.rs
+++ b/crates/ag-server/src/grpc.rs
@@ -636,6 +636,28 @@ impl AgentService for Grpc {
 
 #[tonic::async_trait]
 impl EventService for Grpc {
+    type SubscribeManyStream = BoxStream<v1::EventEnvelope>;
+    async fn subscribe_many(
+        &self,
+        request: Request<v1::SubscribeManyRequest>,
+    ) -> Result<Response<Self::SubscribeManyStream>, Status> {
+        let mut ing = ingress_of(&request);
+        ing.deadline_ms = Some(crate::app::NO_DEADLINE_MS);
+        let req = request.into_inner();
+        let app = self.app.clone();
+        let stream = app
+            .clone()
+            .dispatch(ing, "events.subscribe_many", move |call| async move { app.subscribe_many(call, req).await })
+            .await
+            .map_err(status)?;
+        Ok(Response::new(Box::pin(stream.map(|item| item.map_err(status)))))
+    }
+    async fn replay_many(
+        &self,
+        request: Request<v1::ReplayManyRequest>,
+    ) -> Result<Response<v1::ReplayManyResponse>, Status> {
+        unary!(self, request, "events.replay_many", replay_many)
+    }
     type SubscribeStream = BoxStream<v1::Event>;
     async fn subscribe(
         &self,
diff --git a/crates/ag-server/src/http.rs b/crates/ag-server/src/http.rs
index 0f38d821..55d9bf46 100644
--- a/crates/ag-server/src/http.rs
+++ b/crates/ag-server/src/http.rs
@@ -115,6 +115,94 @@ impl EventsQuery {
     }
 }
 
+#[derive(Default, Deserialize)]
+struct ManyEventsQuery {
+    #[serde(default)]
+    repos: Vec<String>,
+    #[serde(default)]
+    topics: Vec<String>,
+    cursor: Option<String>,
+    limit: Option<u32>,
+    from_start: Option<bool>,
+    heartbeat_ms: Option<u32>,
+}
+impl ManyEventsQuery {
+    fn parse(query: Option<&str>) -> ApiResult<Self> {
+        let mut q: Self = serde_html_form::from_str(query.unwrap_or(""))
+            .map_err(|e| ApiError::invalid(format!("bad query string: {e}")))?;
+        q.repos = q.repos.iter().flat_map(|value| value.split(',').map(str::to_string)).collect();
+        q.topics = q.topics.iter().flat_map(|value| value.split(',').map(str::to_string)).collect();
+        Ok(q)
+    }
+}
+async fn replay_many_http(State(app): State<App>, headers: HeaderMap, request: Request) -> Response {
+    let ing = ingress_from_headers(&headers, remote_addr(&request));
+    let id = ing.request_id.clone();
+    let q = match ManyEventsQuery::parse(request.uri().query()) {
+        Ok(q) => q,
+        Err(e) => return e.with_request_id(&id).into_response(),
+    };
+    let req = v1::ReplayManyRequest {
+        repos: q.repos,
+        topics: q.topics,
+        cursor: q.cursor.unwrap_or_default(),
+        limit: q.limit.unwrap_or_default(),
+        from_start: q.from_start.unwrap_or_default(),
+    };
+    let a = app.clone();
+    let mut response = finish(
+        app.dispatch(ing, "events.replay_many", move |call| async move { a.replay_many(&call, req).await }).await,
+        &id,
+    );
+    response.headers_mut().insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
+    response
+}
+async fn subscribe_many_http(State(app): State<App>, headers: HeaderMap, request: Request) -> Response {
+    let mut ing = ingress_from_headers(&headers, remote_addr(&request));
+    let id = ing.request_id.clone();
+    let q = match ManyEventsQuery::parse(request.uri().query()) {
+        Ok(q) => q,
+        Err(e) => return e.with_request_id(&id).into_response(),
+    };
+    let cursor = match headers.get("last-event-id") {
+        Some(value) => match value.to_str() {
+            Ok(value) => value.to_string(),
+            Err(_) => return ApiError::invalid("invalid Last-Event-ID").with_request_id(&id).into_response(),
+        },
+        None => q.cursor.unwrap_or_default(),
+    };
+    let req = v1::SubscribeManyRequest {
+        repos: q.repos,
+        topics: q.topics,
+        cursor,
+        heartbeat_ms: q.heartbeat_ms.unwrap_or_default(),
+    };
+    ing.deadline_ms = Some(crate::app::NO_DEADLINE_MS);
+    let a = app.clone();
+    match app.dispatch(ing, "events.subscribe_many", move |call| async move { a.subscribe_many(call, req).await }).await
+    {
+        Err(error) => error.with_request_id(&id).into_response(),
+        Ok(stream) => {
+            let sse = stream.map(|item| -> Result<SseEvent, Infallible> {
+                Ok(match item {
+                    Ok(envelope) => SseEvent::default()
+                        .id(envelope.cursor.clone())
+                        .event(envelope.event.as_ref().map(|event| event.topic.as_str()).unwrap_or("checkpoint"))
+                        .data(serde_json::to_string(&envelope).unwrap_or_else(|_| "{}".into())),
+                    Err(error) => SseEvent::default()
+                        .event("error")
+                        .data(serde_json::json!({"error":error.0.to_info()}).to_string()),
+                })
+            });
+            let mut response =
+                Sse::new(sse).keep_alive(KeepAlive::new().interval(Duration::from_secs(25))).into_response();
+            response.headers_mut().insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
+            response.headers_mut().insert(HeaderName::from_static("x-accel-buffering"), HeaderValue::from_static("no"));
+            response
+        }
+    }
+}
+
 /// `Last-Event-ID`, if the client sent one. A value that is not a sequence number is rejected.
 fn last_event_id(headers: &HeaderMap) -> ApiResult<Option<u64>> {
     headers
@@ -1714,6 +1802,24 @@ pub fn api_router(app: App) -> (Router, Vec<RouteMeta>) {
         predict
     );
 
+    meta.push(RouteMeta::json::<v1::ReplayManyRequest,v1::ReplayManyResponse>("get","/v1/events/replay","events.replay_many","Events","Replay explicit repositories using an opaque vector cursor; no cursor checkpoints now, from_start replays history"));
+    r = r.route("/v1/events/replay", get(replay_many_http));
+    meta.push(
+        RouteMeta::raw(
+            "get",
+            "/v1/events",
+            "events.subscribe_many",
+            "Events",
+            "Multi-repository SSE; no cursor checkpoints now; Last-Event-ID resumes an opaque vector cursor",
+        )
+        .query("repos", "string", "Required explicit comma-separated repository names (max30)")
+        .query("topics", "string", "Comma-separated audit topic prefixes")
+        .query("cursor", "string", "Opaque cursor returned by replay or an earlier SSE envelope")
+        .query("heartbeat_ms", "integer", "Checkpoint keep-alive interval (default15000,minimum1000)")
+        .response_body("text/event-stream"),
+    );
+    r = r.route("/v1/events", get(subscribe_many_http));
+
     // ---- events ---------------------------------------------------------------------------------------------
     meta.push(RouteMeta::json::<v1::ReplayRequest, v1::ReplayResponse>(
         "get",
diff --git a/docs/adr/0044-cross-repository-events.md b/docs/adr/0044-cross-repository-events.md
new file mode 100644
index 00000000..76c9bbe3
--- /dev/null
+++ b/docs/adr/0044-cross-repository-events.md
@@ -0,0 +1,27 @@
+# ADR 0044: one event feed for multiple repositories
+
+Status: accepted.
+
+## Decision
+
+Reuse each repository's durable audit log through one bounded event feed. Callers
+name up to thirty repositories explicitly. Every repository is authorized before
+returning data and while following; the feed never broadens a credential's scope.
+No new event store or metadata migration is needed.
+
+Each event carries an opaque continuation cursor with the position of every
+repository, bound to the normalized repository and topic set. Sequences from
+separate repositories are not globally ordered. A bounded round-robin scan keeps
+one busy repository from excluding the others. Replay pages examine at most4096
+rows and emit at most1000 events.
+
+An empty cursor starts at the current log positions; deliberate historical replay
+uses `from_start`. Checkpoints and heartbeats advance the cursor without inventing
+an activity event. HTTP SSE uses that cursor as its event ID, and reconnect resumes
+from it. Existing single-repository APIs remain compatible.
+
+Home keeps its full initial data snapshot, refreshes on connection/reconnection,
+and subscribes to the loaded repository set. Up to thirty repositories share the
+live connection; additional loaded repositories retain bounded polling. Hidden
+pages stop the connection, and a new session starts with fresh scope and state.
+CLI, SDK and MCP replay use the same cursor contract.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 68a38e43..5e785cc4 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -62,3 +62,5 @@ which test: [ADR traceability](../architecture/adr-traceability.md).
 - [0042 — Private proposal comment drafts](0042-private-comment-drafts.md)
 
 - [0043 — Private single-file drafts](0043-private-file-drafts.md)
+
+- [0044 — Cross-repository events](0044-cross-repository-events.md)
diff --git a/docs/protocol/openapi.json b/docs/protocol/openapi.json
index b5ccf0dd..095f9c06 100644
--- a/docs/protocol/openapi.json
+++ b/docs/protocol/openapi.json
@@ -1520,6 +1520,28 @@
         },
         "type": "object"
       },
+      "EventEnvelope": {
+        "description": "An opaque vector cursor; events from different repositories have no shared sequence.",
+        "properties": {
+          "cursor": {
+            "default": "",
+            "type": "string"
+          },
+          "event": {
+            "default": null,
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/Event",
+                "description": "Absent for an initial checkpoint, filtered progress, or heartbeat."
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "type": "object"
+      },
       "ExecutorPresence": {
         "properties": {
           "available": {
@@ -4621,6 +4643,60 @@
         },
         "type": "object"
       },
+      "ReplayManyRequest": {
+        "properties": {
+          "cursor": {
+            "default": "",
+            "type": "string"
+          },
+          "from_start": {
+            "default": false,
+            "description": "With no cursor, deliberately replay all history instead of checkpointing now.",
+            "type": "boolean"
+          },
+          "limit": {
+            "default": 0,
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "repos": {
+            "default": [],
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "topics": {
+            "default": [],
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "ReplayManyResponse": {
+        "properties": {
+          "cursor": {
+            "default": "",
+            "type": "string"
+          },
+          "events": {
+            "default": [],
+            "items": {
+              "$ref": "#/components/schemas/EventEnvelope"
+            },
+            "type": "array"
+          },
+          "has_more": {
+            "default": false,
+            "type": "boolean"
+          }
+        },
+        "type": "object"
+      },
       "ReplayRequest": {
         "properties": {
           "after_seq": {
@@ -6604,6 +6680,162 @@
         ]
       }
     },
+    "/v1/events": {
+      "get": {
+        "operationId": "events.subscribe_many",
+        "parameters": [
+          {
+            "description": "Required explicit comma-separated repository names (max30)",
+            "in": "query",
+            "name": "repos",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Comma-separated audit topic prefixes",
+            "in": "query",
+            "name": "topics",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Opaque cursor returned by replay or an earlier SSE envelope",
+            "in": "query",
+            "name": "cursor",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Checkpoint keep-alive interval (default15000,minimum1000)",
+            "in": "query",
+            "name": "heartbeat_ms",
+            "required": false,
+            "schema": {
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "text/event-stream": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Multi-repository SSE; no cursor checkpoints now; Last-Event-ID resumes an opaque vector cursor",
+        "tags": [
+          "Events"
+        ]
+      }
+    },
+    "/v1/events/replay": {
+      "get": {
+        "operationId": "events.replay_many",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "cursor",
+            "required": false,
+            "schema": {
+              "default": "",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "from_start",
+            "required": false,
+            "schema": {
+              "default": false,
+              "description": "With no cursor, deliberately replay all history instead of checkpointing now.",
+              "type": "boolean"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "format": "int32",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "repos",
+            "required": false,
+            "schema": {
+              "default": [],
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          {
+            "in": "query",
+            "name": "topics",
+            "required": false,
+            "schema": {
+              "default": [],
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReplayManyResponse"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Replay explicit repositories using an opaque vector cursor; no cursor checkpoints now, from_start replays history",
+        "tags": [
+          "Events"
+        ]
+      }
+    },
     "/v1/jobs/claim": {
       "post": {
         "operationId": "jobs.claim",
diff --git a/proto/agwp/v1/agwp.proto b/proto/agwp/v1/agwp.proto
index 1f098870..3d96615a 100644
--- a/proto/agwp/v1/agwp.proto
+++ b/proto/agwp/v1/agwp.proto
@@ -1531,6 +1531,32 @@ message ReplayResponse {
   uint64 latest_seq = 2;
 }
 
+// An opaque vector cursor; events from different repositories have no shared sequence.
+message EventEnvelope {
+  string cursor = 1;
+  // Absent for an initial checkpoint, filtered progress, or heartbeat.
+  Event event = 2;
+}
+message ReplayManyRequest {
+  repeated string repos = 1;
+  repeated string topics = 2;
+  string cursor = 3;
+  uint32 limit = 4;
+  // With no cursor, deliberately replay all history instead of checkpointing now.
+  bool from_start = 5;
+}
+message ReplayManyResponse {
+  repeated EventEnvelope events = 1;
+  string cursor = 2;
+  bool has_more = 3;
+}
+message SubscribeManyRequest {
+  repeated string repos = 1;
+  repeated string topics = 2;
+  string cursor = 3;
+  uint32 heartbeat_ms = 4;
+}
+
 // ---------------------------------------------------------------------------
 // Administration
 // ---------------------------------------------------------------------------
@@ -2018,6 +2044,8 @@ service AgentService {
 service EventService {
   rpc Subscribe(SubscribeRequest) returns (stream Event);
   rpc Replay(ReplayRequest) returns (ReplayResponse);
+  rpc ReplayMany(ReplayManyRequest) returns (ReplayManyResponse);
+  rpc SubscribeMany(SubscribeManyRequest) returns (stream EventEnvelope);
 }
 
 service AdminService {

From 1cf3e746938522b3073d742f622a46fa8fef1a04 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:47:04 +0000
Subject: [PATCH 34/41] feat(cli): follow events across explicit repositories

---
 crates/ag-cli/src/cmds/event_feed.rs  | 144 ++++++++++++++++++++++++++
 crates/ag-cli/src/cmds/mod.rs         |   1 +
 crates/ag-cli/src/cmds/remote.rs      |   8 +-
 docs/guides/remote.md                 |  25 +++++
 docs/reference/cli.md                 |  29 +++---
 docs/reference/completions/_ag        |   5 +
 docs/reference/completions/_ag.ps1    |   5 +
 docs/reference/completions/ag.bash    |  18 +++-
 docs/reference/completions/ag.elv     |   5 +
 docs/reference/completions/ag.fish    |   5 +
 docs/reference/man/ag-remote-events.1 |  31 ++++--
 11 files changed, 253 insertions(+), 23 deletions(-)
 create mode 100644 crates/ag-cli/src/cmds/event_feed.rs

diff --git a/crates/ag-cli/src/cmds/event_feed.rs b/crates/ag-cli/src/cmds/event_feed.rs
new file mode 100644
index 00000000..e3d7bbcf
--- /dev/null
+++ b/crates/ag-cli/src/cmds/event_feed.rs
@@ -0,0 +1,144 @@
+//! Explicit cross-repository event replay and resume checkpoints.
+use std::io::{Read, Write};
+use std::path::{Path, PathBuf};
+
+use ag_client::{Client, ClientError};
+use ag_protocol::{features, v1};
+use anyhow::{Context, Result, ensure};
+use clap::Args;
+
+use crate::Cli;
+
+/// Options which opt the existing event command into a cross-repository feed.
+#[derive(Args, Debug)]
+pub struct FeedArgs {
+    /// Explicit repository on the same server; repeat for up to 30 repositories.
+    #[arg(long = "repository", value_name = "OWNER/NAME")]
+    pub repos: Vec<String>,
+    /// Resume the opaque cursor returned by the previous page.
+    #[arg(long, requires = "repos", conflicts_with = "from_start")]
+    cursor: Option<String>,
+    /// Load a saved cursor, then atomically replace it after emitted events.
+    #[arg(long, requires = "repos", value_name = "PATH")]
+    checkpoint: Option<PathBuf>,
+    /// Deliberately include history; otherwise a new feed starts from now.
+    #[arg(long, requires = "repos", conflicts_with = "cursor")]
+    from_start: bool,
+    /// Maximum events in the replay page (default: 100; maximum: 1000).
+    #[arg(long, requires = "repos", value_parser = clap::value_parser!(u32).range(1..=1000))]
+    limit: Option<u32>,
+}
+
+fn read_cursor(args: &FeedArgs) -> Result<String> {
+    if let Some(cursor) = &args.cursor {
+        return Ok(cursor.clone());
+    }
+    if args.from_start {
+        return Ok(String::new());
+    }
+    let Some(path) = &args.checkpoint else {
+        return Ok(String::new());
+    };
+    let file = match std::fs::File::open(path) {
+        Ok(file) => file,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(String::new()),
+        Err(error) => return Err(error).with_context(|| format!("reading {}", path.display())),
+    };
+    let mut text = String::new();
+    file.take(64 * 1024 + 1).read_to_string(&mut text).with_context(|| format!("reading {}", path.display()))?;
+    ensure!(text.len() <= 64 * 1024, "event checkpoint exceeds 64 KiB");
+    ensure!(!text.trim().is_empty(), "event checkpoint is empty; remove it to start from now or use --from-start");
+    Ok(text.trim().into())
+}
+
+fn save_cursor(path: Option<&Path>, cursor: &str) -> Result<()> {
+    let Some(path) = path else {
+        return Ok(());
+    };
+    let parent = path.parent().filter(|p| !p.as_os_str().is_empty()).unwrap_or_else(|| Path::new("."));
+    let mut file = tempfile::NamedTempFile::new_in(parent)
+        .with_context(|| format!("creating checkpoint in {}", parent.display()))?;
+    writeln!(file, "{cursor}")?;
+    file.as_file().sync_all()?;
+    file.persist(path).with_context(|| format!("replacing {}", path.display()))?;
+    Ok(())
+}
+
+fn print_event(cli: &Cli, envelope: &v1::EventEnvelope) -> Result<()> {
+    let Some(event) = &envelope.event else {
+        return Ok(());
+    };
+    let line = if cli.json {
+        serde_json::to_string(envelope)?
+    } else {
+        format!(
+            "{}  {:>6}  {}  {}\nCursor: {}",
+            event.repo, event.seq, event.topic, event.payload_json, envelope.cursor
+        )
+    };
+    // Flush before advancing the checkpoint so a failed output cannot lose an event.
+    crate::ui::print_bytes(format!("{line}\n").as_bytes());
+    Ok(())
+}
+
+/// Replay one bounded page, optionally following live from that page's cursor.
+pub async fn run(
+    client: &Client,
+    cli: &Cli,
+    args: &FeedArgs,
+    topics: &[String],
+    follow: bool,
+    after: u64,
+) -> Result<()> {
+    ensure!(after == 0, "--after is for a single repository; use --cursor for a cross-repository feed");
+    ensure!(args.repos.len() <= 30, "a cross-repository feed accepts at most 30 repositories");
+    ensure!(
+        client.negotiate().await?.features.iter().any(|feature| feature == features::EVENTS_MULTI_REPO),
+        "this server does not support cross-repository events; update it before using --repository"
+    );
+    let page = client
+        .events()
+        .replay_many(client.req(v1::ReplayManyRequest {
+            repos: args.repos.clone(),
+            topics: topics.to_vec(),
+            cursor: read_cursor(args)?,
+            limit: args.limit.unwrap_or(100),
+            from_start: args.from_start,
+        }))
+        .await
+        .map_err(ClientError::from)?
+        .into_inner();
+    if follow {
+        for envelope in &page.events {
+            print_event(cli, envelope)?;
+            save_cursor(args.checkpoint.as_deref(), &envelope.cursor)?;
+        }
+    } else if cli.json {
+        crate::ui::print_bytes(format!("{}\n", serde_json::to_string(&page)?).as_bytes());
+    } else {
+        for envelope in &page.events {
+            print_event(cli, envelope)?;
+        }
+        crate::ui::print_bytes(format!("Cursor: {}\nMore: {}\n", page.cursor, page.has_more).as_bytes());
+    }
+    save_cursor(args.checkpoint.as_deref(), &page.cursor)?;
+    if !follow {
+        return Ok(());
+    }
+    let mut stream = client
+        .events()
+        .subscribe_many(tonic::Request::new(v1::SubscribeManyRequest {
+            repos: args.repos.clone(),
+            topics: topics.to_vec(),
+            cursor: page.cursor,
+            heartbeat_ms: 15_000,
+        }))
+        .await
+        .map_err(ClientError::from)?
+        .into_inner();
+    while let Some(envelope) = stream.message().await.map_err(ClientError::from)? {
+        print_event(cli, &envelope)?;
+        save_cursor(args.checkpoint.as_deref(), &envelope.cursor)?;
+    }
+    Ok(())
+}
diff --git a/crates/ag-cli/src/cmds/mod.rs b/crates/ag-cli/src/cmds/mod.rs
index e7a1d774..388fc20c 100644
--- a/crates/ag-cli/src/cmds/mod.rs
+++ b/crates/ag-cli/src/cmds/mod.rs
@@ -8,6 +8,7 @@ pub mod config;
 pub mod conflicts;
 pub mod discussions;
 pub mod doctor;
+pub mod event_feed;
 pub mod explain;
 pub mod file_drafts;
 pub mod flow;
diff --git a/crates/ag-cli/src/cmds/remote.rs b/crates/ag-cli/src/cmds/remote.rs
index 1801e905..14f6c1ec 100644
--- a/crates/ag-cli/src/cmds/remote.rs
+++ b/crates/ag-cli/src/cmds/remote.rs
@@ -873,6 +873,8 @@ pub enum RemoteCmd {
     Streams,
     /// Show the events of the repository (replay), or follow them live.
     Events {
+        #[command(flatten)]
+        feed: crate::cmds::event_feed::FeedArgs,
         /// Replay events after this sequence number.
         #[arg(long, default_value_t = 0)]
         after: u64,
@@ -1374,8 +1376,10 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                         .join("\n")
                 })?;
             }
-            RemoteCmd::Events { after, topics, follow } => {
-                if *follow {
+            RemoteCmd::Events { after, topics, follow, feed } => {
+                if !feed.repos.is_empty() {
+                    crate::cmds::event_feed::run(&c, cli, feed, topics, *follow, *after).await?;
+                } else if *follow {
                     let mut stream = c
                         .events()
                         .subscribe(tonic::Request::new(v1::SubscribeRequest {
diff --git a/docs/guides/remote.md b/docs/guides/remote.md
index 432950e0..839e2ecd 100644
--- a/docs/guides/remote.md
+++ b/docs/guides/remote.md
@@ -130,6 +130,31 @@ The original file type and executable bit come from the immutable base. Each acc
 keep at most 20 active file drafts per repository. Drafts are private through the API;
 administrators and backups can still contain them.
 
+## Cross-repository event feed
+
+On development servers advertising `events.multi_repo`, use repeated `--repository` to
+follow an explicit set of up to 30 repositories on the configured server. The existing
+single-repository `remote events --after` command is unchanged; `--repo` still selects a
+local directory, so cross-repository feeds use the longer `--repository` option.
+
+```sh
+# Start from now and save the checkpoint; no historical flood.
+ag remote events --repository acme/api --repository acme/web --checkpoint feed.cursor
+# Resume that exact repository/topic scope and follow new events.
+ag --json remote events --repository acme/api --repository acme/web --checkpoint feed.cursor --follow
+# Explicit historical replay, one bounded page; repeat using the returned cursor.
+ag remote events --repository acme/api --repository acme/web --from-start --limit 100
+ag remote events --repository acme/api --repository acme/web --cursor OPAQUE_CURSOR --limit 100
+```
+
+Replay returns one page with its next cursor and `has_more`; the default page limit is 100,
+with a maximum of 1000. A cursor belongs to its repository/topic scope: do not reuse it for a
+different scope. Events retain repository-local ordering; there is no global sequence
+across repositories. Follow mode prints JSON envelopes one per line with `--json`. Heartbeats
+and checkpoints advance the checkpoint file without appearing as user actions. Checkpoints
+are replaced atomically after output is flushed; a failed output does not advance past the
+unwritten event. Resume with the same options after a disconnect.
+
 ## Offline
 
 Nothing about a local repository needs the server:
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index f21a761f..bc9b1771 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -3537,18 +3537,23 @@ Show the events of the repository (replay), or follow them live
 Usage: ag remote events [OPTIONS]
 
 Options:
-      --after <AFTER>    Replay events after this sequence number [default: 0]
-  -C, --repo <DIR>       Operate on the repository at this path (default: discovered from the current directory)
-      --remote <REMOTE>  Remote to use (default: origin)
-      --as <IDENTITY>    Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
-      --topics <TOPICS>  Only these topics (prefix match), e.g. `stream,proposal`
-      --follow           Keep following new events
-      --json             Machine-readable JSON output
-      --color <WHEN>     Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
-  -q, --quiet            Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
-  -v, --verbose          Explain what is happening on standard error: repository, identity, remote, timing
-  -h, --help             Print help
-  -V, --version          Print version
+  -C, --repo <DIR>               Operate on the repository at this path (default: discovered from the current directory)
+      --remote <REMOTE>          Remote to use (default: origin)
+      --repository <OWNER/NAME>  Explicit repository on the same server; repeat for up to 30 repositories
+      --as <IDENTITY>            Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --cursor <CURSOR>          Resume the opaque cursor returned by the previous page
+      --checkpoint <PATH>        Load a saved cursor, then atomically replace it after emitted events
+      --json                     Machine-readable JSON output
+      --color <WHEN>             Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+      --from-start               Deliberately include history; otherwise a new feed starts from now
+      --limit <LIMIT>            Maximum events in the replay page (default: 100; maximum: 1000)
+  -q, --quiet                    Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+      --after <AFTER>            Replay events after this sequence number [default: 0]
+  -v, --verbose                  Explain what is happening on standard error: repository, identity, remote, timing
+      --topics <TOPICS>          Only these topics (prefix match), e.g. `stream,proposal`
+      --follow                   Keep following new events
+  -h, --help                     Print help
+  -V, --version                  Print version
 ```
 
 ## ag remote policy
diff --git a/docs/reference/completions/_ag b/docs/reference/completions/_ag
index a7cc7d50..4356cf57 100644
--- a/docs/reference/completions/_ag
+++ b/docs/reference/completions/_ag
@@ -3202,6 +3202,10 @@ never\:"Never colour"))' \
 ;;
 (events)
 _arguments "${_arguments_options[@]}" : \
+'*--repository=[Explicit repository on the same server; repeat for up to 30 repositories]:OWNER/NAME:_default' \
+'(--from-start)--cursor=[Resume the opaque cursor returned by the previous page]:CURSOR:_default' \
+'--checkpoint=[Load a saved cursor, then atomically replace it after emitted events]:PATH:_files' \
+'--limit=[Maximum events in the replay page (default\: 100; maximum\: 1000)]:LIMIT:_default' \
 '--after=[Replay events after this sequence number]:AFTER:_default' \
 '*--topics=[Only these topics (prefix match), e.g. \`stream,proposal\`]:TOPICS:_default' \
 '--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
@@ -3211,6 +3215,7 @@ _arguments "${_arguments_options[@]}" : \
 '--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
 always\:"Always colour"
 never\:"Never colour"))' \
+'(--cursor)--from-start[Deliberately include history; otherwise a new feed starts from now]' \
 '--follow[Keep following new events]' \
 '--json[Machine-readable JSON output]' \
 '(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
diff --git a/docs/reference/completions/_ag.ps1 b/docs/reference/completions/_ag.ps1
index 44dcee72..505f8fdc 100644
--- a/docs/reference/completions/_ag.ps1
+++ b/docs/reference/completions/_ag.ps1
@@ -2621,6 +2621,10 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             break
         }
         'ag;remote;events' {
+            [CompletionResult]::new('--repository', '--repository', [CompletionResultType]::ParameterName, 'Explicit repository on the same server; repeat for up to 30 repositories')
+            [CompletionResult]::new('--cursor', '--cursor', [CompletionResultType]::ParameterName, 'Resume the opaque cursor returned by the previous page')
+            [CompletionResult]::new('--checkpoint', '--checkpoint', [CompletionResultType]::ParameterName, 'Load a saved cursor, then atomically replace it after emitted events')
+            [CompletionResult]::new('--limit', '--limit', [CompletionResultType]::ParameterName, 'Maximum events in the replay page (default: 100; maximum: 1000)')
             [CompletionResult]::new('--after', '--after', [CompletionResultType]::ParameterName, 'Replay events after this sequence number')
             [CompletionResult]::new('--topics', '--topics', [CompletionResultType]::ParameterName, 'Only these topics (prefix match), e.g. `stream,proposal`')
             [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
@@ -2628,6 +2632,7 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
             [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
             [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--from-start', '--from-start', [CompletionResultType]::ParameterName, 'Deliberately include history; otherwise a new feed starts from now')
             [CompletionResult]::new('--follow', '--follow', [CompletionResultType]::ParameterName, 'Keep following new events')
             [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
             [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
diff --git a/docs/reference/completions/ag.bash b/docs/reference/completions/ag.bash
index fb5d60df..93c0750f 100644
--- a/docs/reference/completions/ag.bash
+++ b/docs/reference/completions/ag.bash
@@ -4126,12 +4126,28 @@ _ag() {
             return 0
             ;;
         ag__subcmd__remote__subcmd__events)
-            opts="-C -q -v -h -V --after --topics --follow --remote --repo --as --json --color --quiet --verbose --help --version"
+            opts="-C -q -v -h -V --repository --cursor --checkpoint --from-start --limit --after --topics --follow --remote --repo --as --json --color --quiet --verbose --help --version"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
             fi
             case "${prev}" in
+                --repository)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --cursor)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --checkpoint)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --limit)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 --after)
                     COMPREPLY=($(compgen -f "${cur}"))
                     return 0
diff --git a/docs/reference/completions/ag.elv b/docs/reference/completions/ag.elv
index c3d37279..c6c4a207 100644
--- a/docs/reference/completions/ag.elv
+++ b/docs/reference/completions/ag.elv
@@ -2481,6 +2481,10 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand --version 'Print version'
         }
         &'ag;remote;events'= {
+            cand --repository 'Explicit repository on the same server; repeat for up to 30 repositories'
+            cand --cursor 'Resume the opaque cursor returned by the previous page'
+            cand --checkpoint 'Load a saved cursor, then atomically replace it after emitted events'
+            cand --limit 'Maximum events in the replay page (default: 100; maximum: 1000)'
             cand --after 'Replay events after this sequence number'
             cand --topics 'Only these topics (prefix match), e.g. `stream,proposal`'
             cand --remote 'Remote to use (default: origin)'
@@ -2488,6 +2492,7 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
             cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
             cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --from-start 'Deliberately include history; otherwise a new feed starts from now'
             cand --follow 'Keep following new events'
             cand --json 'Machine-readable JSON output'
             cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
diff --git a/docs/reference/completions/ag.fish b/docs/reference/completions/ag.fish
index d829d159..d8357175 100644
--- a/docs/reference/completions/ag.fish
+++ b/docs/reference/completions/ag.fish
@@ -1479,6 +1479,10 @@ complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from streams" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from streams" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from streams" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l repository -d 'Explicit repository on the same server; repeat for up to 30 repositories' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l cursor -d 'Resume the opaque cursor returned by the previous page' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l checkpoint -d 'Load a saved cursor, then atomically replace it after emitted events' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l limit -d 'Maximum events in the replay page (default: 100; maximum: 1000)' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l after -d 'Replay events after this sequence number' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l topics -d 'Only these topics (prefix match), e.g. `stream,proposal`' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l remote -d 'Remote to use (default: origin)' -r
@@ -1487,6 +1491,7 @@ complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
 always\t'Always colour'
 never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l from-start -d 'Deliberately include history; otherwise a new feed starts from now'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l follow -d 'Keep following new events'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -l json -d 'Machine-readable JSON output'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from events" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
diff --git a/docs/reference/man/ag-remote-events.1 b/docs/reference/man/ag-remote-events.1
index 44f2a1b7..f4062743 100644
--- a/docs/reference/man/ag-remote-events.1
+++ b/docs/reference/man/ag-remote-events.1
@@ -4,28 +4,28 @@
 .SH NAME
 ag\-remote\-events \- Show the events of the repository (replay), or follow them live
 .SH SYNOPSIS
-\fBag remote events\fR [\fB\-\-after\fR] [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-as\fR] [\fB\-\-topics\fR] [\fB\-\-follow\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR]
+\fBag remote events\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-repository\fR] [\fB\-\-as\fR] [\fB\-\-cursor\fR] [\fB\-\-checkpoint\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-\-from\-start\fR] [\fB\-\-limit\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-\-after\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-\-topics\fR] [\fB\-\-follow\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR]
 .SH DESCRIPTION
 Show the events of the repository (replay), or follow them live
 .SH OPTIONS
 .TP
-\fB\-\-after\fR \fI<AFTER>\fR [default: 0]
-Replay events after this sequence number
-.TP
 \fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
 Operate on the repository at this path (default: discovered from the current directory)
 .TP
 \fB\-\-remote\fR \fI<REMOTE>\fR
 Remote to use (default: origin)
 .TP
+\fB\-\-repository\fR \fI<OWNER/NAME>\fR
+Explicit repository on the same server; repeat for up to 30 repositories
+.TP
 \fB\-\-as\fR \fI<IDENTITY>\fR
 Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
 .TP
-\fB\-\-topics\fR \fI<TOPICS>\fR
-Only these topics (prefix match), e.g. `stream,proposal`
+\fB\-\-cursor\fR \fI<CURSOR>\fR
+Resume the opaque cursor returned by the previous page
 .TP
-\fB\-\-follow\fR
-Keep following new events
+\fB\-\-checkpoint\fR \fI<PATH>\fR
+Load a saved cursor, then atomically replace it after emitted events
 .TP
 \fB\-\-json\fR
 Machine\-readable JSON output
@@ -33,12 +33,27 @@ Machine\-readable JSON output
 \fB\-\-color\fR \fI<WHEN>\fR
 Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
 .TP
+\fB\-\-from\-start\fR
+Deliberately include history; otherwise a new feed starts from now
+.TP
+\fB\-\-limit\fR \fI<LIMIT>\fR
+Maximum events in the replay page (default: 100; maximum: 1000)
+.TP
 \fB\-q\fR, \fB\-\-quiet\fR
 Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
 .TP
+\fB\-\-after\fR \fI<AFTER>\fR [default: 0]
+Replay events after this sequence number
+.TP
 \fB\-v\fR, \fB\-\-verbose\fR
 Explain what is happening on standard error: repository, identity, remote, timing
 .TP
+\fB\-\-topics\fR \fI<TOPICS>\fR
+Only these topics (prefix match), e.g. `stream,proposal`
+.TP
+\fB\-\-follow\fR
+Keep following new events
+.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP

From f5742298239f04d0336c7db530562743a873e2da Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:47:36 +0000
Subject: [PATCH 35/41] feat(clients): resume multi-repository event
 subscriptions

---
 crates/ag-mcp/src/tools/read.rs               |  67 +++++++++
 sdk/python/README.md                          |   7 +
 sdk/python/scripts/generate.py                |  36 ++++-
 sdk/python/src/agentgit/_core.py              |   2 +-
 sdk/python/src/agentgit/_events.py            | 130 +++++++++++++++-
 sdk/python/src/agentgit/_generated/models.py  |  28 ++++
 .../src/agentgit/_generated/namespaces.py     |  53 +++++++
 .../src/agentgit/_generated/operations.py     |  32 ++++
 sdk/python/src/agentgit/_protocols.py         |  26 +++-
 sdk/python/src/agentgit/client.py             |  47 +++++-
 sdk/python/tests/test_all_operations.py       |   7 +
 sdk/typescript/README.md                      |   7 +
 sdk/typescript/scripts/generate.mjs           |   5 +-
 sdk/typescript/src/client.ts                  |  16 +-
 sdk/typescript/src/generated/api.ts           |   9 +-
 sdk/typescript/src/generated/models.ts        |   3 +
 sdk/typescript/src/generated/operations.ts    |  30 ++++
 sdk/typescript/src/generated/schema.ts        | 140 ++++++++++++++++++
 sdk/typescript/src/index.ts                   |   1 +
 sdk/typescript/src/sse.ts                     |  86 ++++++++++-
 sdk/typescript/src/transport.ts               |   2 +-
 sdk/typescript/src/types.ts                   |   8 +
 sdk/typescript/test/all-operations.test.ts    |   6 +
 23 files changed, 731 insertions(+), 17 deletions(-)

diff --git a/crates/ag-mcp/src/tools/read.rs b/crates/ag-mcp/src/tools/read.rs
index 2a883bd5..211e9f2c 100644
--- a/crates/ag-mcp/src/tools/read.rs
+++ b/crates/ag-mcp/src/tools/read.rs
@@ -839,6 +839,44 @@ fn workspace_list(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolErr
     Ok(ToolOutput::new(format!("{} workspaces.", workspaces.len()), json!({"workspaces": workspaces})))
 }
 
+fn events_replay_many(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    let opts = ctx.opts(ctx.run_id(args)?);
+    if !ctx.api.supports("events.multi_repo", &opts)? {
+        return Err(ToolError::local(
+            "server_update_required",
+            "This server does not support a cross-repository event feed.",
+        ));
+    }
+    let mut repos = Vec::new();
+    for repo in args.get("repos").and_then(Value::as_array).into_iter().flatten() {
+        repos.push(ctx.repo(&json!({"repo":repo}))?);
+    }
+    repos.sort();
+    repos.dedup();
+    if repos.is_empty() || repos.len() > 30 {
+        return Err(ToolError::invalid("Choose between 1 and 30 repositories explicitly"));
+    }
+    let cursor = str_arg(args, "cursor").unwrap_or_default();
+    let from_start = args.get("from_start").and_then(Value::as_bool).unwrap_or(false);
+    if from_start && !cursor.is_empty() {
+        return Err(ToolError::invalid("Use cursor or from_start, not both"));
+    }
+    let topics: Vec<&str> =
+        args.get("topics").and_then(Value::as_array).into_iter().flatten().filter_map(Value::as_str).collect();
+    let query = vec![
+        ("repos", repos.join(",")),
+        ("topics", topics.join(",")),
+        ("cursor", cursor.to_string()),
+        ("from_start", from_start.to_string()),
+        ("limit", u64_arg(args, "limit").unwrap_or(100).min(1000).to_string()),
+    ];
+    let result = ctx.api.get("/v1/events/replay", &query, &opts)?;
+    Ok(ToolOutput::new(
+        "Event page from the selected repositories. Keep the opaque cursor to continue with the same repositories and topics.",
+        result,
+    ))
+}
+
 /// The tools of the read group.
 pub fn tools() -> Vec<ToolDef> {
     let rev_desc = "Revision: a stream name, a changeset id or unique prefix (6+ hex), a proposal id (prop_…), or @workspace-name; optionally with ~N (N-th ancestor). Defaults to the repository's default stream.";
@@ -847,6 +885,35 @@ pub fn tools() -> Vec<ToolDef> {
         vec![("limit", t_int("Page size.", 1, 100)), ("page_token", t_str("The next_page_token of the previous page."))]
     };
     vec![
+        def(
+            "events_replay_many",
+            Group::Read,
+            "Read a cross-repository event page",
+            "Reads events only from 1-30 explicitly selected, allowed repositories. Omit cursor to checkpoint now; use from_start for history. Resume with the returned cursor and the same repositories/topics. Events have repository-local sequence order, not a global chronological order.",
+            Ann::READ,
+            input(
+                vec![
+                    ("repos", t_arr("Explicit owner/name repositories.", t_str("Repository name."), 30)),
+                    (
+                        "topics",
+                        t_arr("Topic names or dotted prefixes; empty means all.", t_str_max("Topic filter.", 200), 50),
+                    ),
+                    ("cursor", t_str_max("Opaque cursor returned by the previous page.", 32768)),
+                    (
+                        "from_start",
+                        t_bool("Start at the beginning instead of checkpointing now; cannot be combined with cursor."),
+                    ),
+                    ("limit", t_int("Maximum events in this page; defaults to 100.", 1, 1000)),
+                    p_run(),
+                ],
+                &["repos"],
+            ),
+            output(
+                vec![("events", o_arr()), ("cursor", o_str()), ("has_more", o_bool())],
+                &["events", "cursor", "has_more"],
+            ),
+            events_replay_many,
+        ),
         def(
             "whoami",
             Group::Read,
diff --git a/sdk/python/README.md b/sdk/python/README.md
index fad28fd0..b02416ab 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -552,6 +552,13 @@ first. These drafts contain `head` and `body` (up to 16 KiB of UTF-8), remain se
 from review-decision drafts, and can be saved on closed proposals. Saving or clearing
 a draft never posts a comment; post explicitly after inspecting the current proposal head.
 
+Cross-repository activity uses `client.events.replay_many` and `subscribe_many` after negotiating
+`events.multi_repo`. Pass 1–30 explicit repositories. An empty cursor checkpoints now;
+replay with `from_start` to read history. Keep the returned opaque cursor and the same
+repository/topic selection when resuming. Subscription envelopes also include checkpoints
+with no event; save their cursors too. Sequence numbers belong to individual repositories,
+so do not sort them as one global timeline.
+
 Private file edits use `client.drafts.get`, `save`, `clear` and `list` after negotiating
 `files.drafts`. Identify the draft by repository, stream and existing file path.
 Save the complete base64-encoded file content with its original `base` changeset and
diff --git a/sdk/python/scripts/generate.py b/sdk/python/scripts/generate.py
index 737184aa..9fc18d09 100644
--- a/sdk/python/scripts/generate.py
+++ b/sdk/python/scripts/generate.py
@@ -304,7 +304,7 @@ def build_ops() -> list[Op]:
                     )
             if body == "bytes":
                 params.append(Param("data", "data", "bytes", True, "The binary request body."))
-            if op_id == "events.subscribe":
+            if op_id in {"events.subscribe", "events.subscribe_many"}:
                 params = []
             result = res_name or "Any"
             if response == "bytes":
@@ -347,7 +347,14 @@ def build_ops() -> list[Op]:
 def check_hand_written_operations(ops: list[Op]) -> None:
     """The operations that are not plain JSON have hand-written methods; the document must keep matching them."""
     non_json = {o.id for o in ops if o.body not in ("json", "none") or o.response != "json"}
-    hand_written = {"objects.put", "objects.get", "tree.file", "events.subscribe", "migration.prepare"}
+    hand_written = {
+        "objects.put",
+        "objects.get",
+        "tree.file",
+        "events.subscribe",
+        "events.subscribe_many",
+        "migration.prepare",
+    }
     if non_json != hand_written:
         raise SystemExit(
             f"non-JSON operations in the document: {sorted(non_json)}, expected {sorted(hand_written)}"
@@ -358,6 +365,7 @@ def check_hand_written_operations(ops: list[Op]) -> None:
         "objects.get": set(),
         "tree.file": {"rev"},
         "events.subscribe": {"after_seq", "heartbeat_ms", "topics"},
+        "events.subscribe_many": {"repos", "topics", "cursor", "heartbeat_ms"},
     }
     for o in ops:
         if o.id in expected_query and set(o.query_params) != expected_query[o.id]:
@@ -432,7 +440,7 @@ def method_py(o: Op, is_async: bool) -> str:
     for p in optional:
         sig.append(f"{p.name}: {p.typ} | None = None")
     sig.append("options: CallOptions | None = None")
-    if o.id == "events.subscribe":
+    if o.id in {"events.subscribe", "events.subscribe_many"}:
         return ""
     ret = o.result
     wire = ", ".join(f"{json.dumps(p.wire)}: {p.name}" for p in o.params)
@@ -452,7 +460,23 @@ def method_py(o: Op, is_async: bool) -> str:
     return "".join(lines)
 
 
-def events_methods(is_async: bool) -> str:
+def events_methods(is_async: bool, many: bool = False) -> str:
+    if many:
+        ret = "AsyncGenerator[EventEnvelope, None]" if is_async else "Generator[EventEnvelope, None, None]"
+        return f'''    def subscribe_many(
+        self, *, repos: Sequence[str], cursor: str | None = None,
+        topics: Sequence[str] | None = None, heartbeat_ms: int | None = None,
+        idle_timeout_ms: int | None = None, reconnect: ReconnectPolicy | None = None,
+        run_id: str | None = None,
+    ) -> {ret}:
+        """Follow explicit repositories with opaque cursor resume; yields checkpoints too."""
+        return self._c._subscribe_many(
+            repos=repos, cursor=cursor, topics=topics, heartbeat_ms=heartbeat_ms,
+            idle_timeout_ms=idle_timeout_ms, reconnect=reconnect, run_id=run_id,
+        )
+
+'''
+
     kw_ret = "AsyncGenerator[Event, None]" if is_async else "Generator[Event, None, None]"
     return (
         "    def subscribe(\n"
@@ -504,8 +528,8 @@ def namespaces_py(ops: list[Op]) -> str:
             out.append(f"    def __init__(self, caller: {caller}) -> None:\n")
             out.append("        self._c = caller\n\n")
             for o in sorted(by_ns[ns], key=lambda x: x.name):
-                if o.id == "events.subscribe":
-                    out.append(events_methods(is_async))
+                if o.id in {"events.subscribe", "events.subscribe_many"}:
+                    out.append(events_methods(is_async, many=o.id == "events.subscribe_many"))
                 else:
                     out.append(method_py(o, is_async))
             out.append("\n")
diff --git a/sdk/python/src/agentgit/_core.py b/sdk/python/src/agentgit/_core.py
index b56a7e21..b36a4195 100644
--- a/sdk/python/src/agentgit/_core.py
+++ b/sdk/python/src/agentgit/_core.py
@@ -25,7 +25,7 @@
 
 DEFAULT_TIMEOUT_MS = 30_000
 _ALPHABET = string.ascii_letters + string.digits
-_QUERY_CSV = frozenset({"topics"})
+_QUERY_CSV = frozenset({"topics", "repos"})
 
 # Errors the server marks retryable but where sending the identical request again cannot succeed:
 # ``stream_moved`` means a compare-and-swap lost against a newer version; the caller must re-read.
diff --git a/sdk/python/src/agentgit/_events.py b/sdk/python/src/agentgit/_events.py
index 551e3405..361de209 100644
--- a/sdk/python/src/agentgit/_events.py
+++ b/sdk/python/src/agentgit/_events.py
@@ -17,7 +17,7 @@
 
 from agentgit._async import AsyncTransport
 from agentgit._codec import decode_as
-from agentgit._generated.models import Event
+from agentgit._generated.models import Event, EventEnvelope
 from agentgit._generated.operations import OPERATIONS
 from agentgit._options import CallOptions, ReconnectPolicy
 from agentgit._sync import SyncTransport
@@ -181,3 +181,131 @@ async def subscribe_async(
                 operation=op.id,
             )
         await transport.sleep(0 if delivered else _backoff(policy, failures, transport.config.random()))
+
+
+def _many_params(
+    repos: Sequence[str], cursor: str, topics: Sequence[str], heartbeat_ms: int | None
+) -> dict[str, Any]:
+    params: dict[str, Any] = {"repos": list(repos), "topics": list(topics), "cursor": cursor}
+    if heartbeat_ms is not None:
+        params["heartbeat_ms"] = heartbeat_ms
+    return params
+
+
+def _many_event(frame: SseFrame) -> EventEnvelope:
+    if frame.event == "error":
+        raise error_from_info(
+            json.loads(frame.data).get("error") or {}, status=0, operation="events.subscribe_many"
+        )
+    envelope = decode_as(EventEnvelope, json.loads(frame.data))
+    if not envelope.cursor:
+        raise ValueError("The event envelope has no cursor")
+    return envelope
+
+
+def subscribe_many_sync(
+    transport: SyncTransport,
+    *,
+    repos: Sequence[str],
+    cursor: str | None,
+    topics: Sequence[str] | None,
+    heartbeat_ms: int | None,
+    idle_timeout_ms: int | None,
+    reconnect: ReconnectPolicy | None,
+    run_id: str | None,
+) -> Generator[EventEnvelope, None, None]:
+    op = OPERATIONS["events.subscribe_many"]
+    policy = reconnect or ReconnectPolicy()
+    idle_s = _idle_seconds(idle_timeout_ms)
+    repos = tuple(sorted(set(repos)))
+    if not 1 <= len(repos) <= 30:
+        raise ValueError("Choose 1 to 30 repositories")
+    topics = tuple(sorted(set(topics or [])))
+    last = cursor or ""
+    failures = 0
+    while True:
+        delivered = False
+        connected_at = 0.0
+        try:
+            with transport.open_stream(
+                op, _many_params(repos, last, topics, heartbeat_ms), run_id=run_id, idle_timeout_s=idle_s
+            ) as response:
+                connected_at = time.monotonic()
+                parser = SseParser()
+                for chunk in response.iter_bytes():
+                    for frame in parser.feed(chunk):
+                        event = _many_event(frame)
+                        last = event.cursor
+                        delivered = True
+                        failures = 0
+                        yield event
+        except AgentGitError as err:
+            if not err.retryable:
+                raise
+        except (httpx.TimeoutException, httpx.TransportError):
+            pass  # idle watchdog or a dropped connection
+        if connected_at and time.monotonic() - connected_at > STABLE_CONNECTION_S:
+            failures = 0
+        if not delivered:
+            failures += 1
+        if failures > policy.max_attempts:
+            raise UnavailableError(
+                f"the event stream could not be re-established after {policy.max_attempts} attempts",
+                retryable=True,
+                operation=op.id,
+            )
+        transport.sleep(0 if delivered else _backoff(policy, failures, transport.config.random()))
+
+
+async def subscribe_many_async(
+    transport: AsyncTransport,
+    *,
+    repos: Sequence[str],
+    cursor: str | None,
+    topics: Sequence[str] | None,
+    heartbeat_ms: int | None,
+    idle_timeout_ms: int | None,
+    reconnect: ReconnectPolicy | None,
+    run_id: str | None,
+) -> AsyncGenerator[EventEnvelope, None]:
+    op = OPERATIONS["events.subscribe_many"]
+    policy = reconnect or ReconnectPolicy()
+    idle_s = _idle_seconds(idle_timeout_ms)
+    repos = tuple(sorted(set(repos)))
+    if not 1 <= len(repos) <= 30:
+        raise ValueError("Choose 1 to 30 repositories")
+    topics = tuple(sorted(set(topics or [])))
+    last = cursor or ""
+    failures = 0
+    while True:
+        delivered = False
+        connected_at = 0.0
+        try:
+            async with transport.open_stream(
+                op, _many_params(repos, last, topics, heartbeat_ms), run_id=run_id, idle_timeout_s=idle_s
+            ) as response:
+                connected_at = time.monotonic()
+                parser = SseParser()
+                async for chunk in response.aiter_bytes():
+                    for frame in parser.feed(chunk):
+                        event = _many_event(frame)
+                        last = event.cursor
+                        delivered = True
+                        failures = 0
+                        yield event
+        except AgentGitError as err:
+            if not err.retryable:
+                raise
+        except (httpx.TimeoutException, httpx.TransportError):
+            pass
+        if connected_at and time.monotonic() - connected_at > STABLE_CONNECTION_S:
+            failures = 0
+        if not delivered:
+            failures += 1
+        if failures > policy.max_attempts:
+            raise UnavailableError(
+                f"the event stream could not be re-established after {policy.max_attempts} attempts",
+                retryable=True,
+                operation=op.id,
+            )
+        await transport.sleep(0 if delivered else _backoff(policy, failures, transport.config.random()))
diff --git a/sdk/python/src/agentgit/_generated/models.py b/sdk/python/src/agentgit/_generated/models.py
index a13c1c57..7901c793 100644
--- a/sdk/python/src/agentgit/_generated/models.py
+++ b/sdk/python/src/agentgit/_generated/models.py
@@ -58,6 +58,7 @@
     "ErrorEnvelope",
     "ErrorInfo",
     "Event",
+    "EventEnvelope",
     "ExecutorPresence",
     "ExtendLeaseRequest",
     "FailJobRequest",
@@ -189,6 +190,8 @@
     "ReflogRequest",
     "ReflogResponse",
     "RegisterAgentRequest",
+    "ReplayManyRequest",
+    "ReplayManyResponse",
     "ReplayRequest",
     "ReplayResponse",
     "Repo",
@@ -763,6 +766,13 @@ class Event:
     topic: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class EventEnvelope:
+    """An opaque vector cursor; events from different repositories have no shared sequence."""
+    cursor: str = field(default="")
+    event: Event | None = field(default=None)
+
+
 @dataclass(kw_only=True)
 class ExecutorPresence:
     """The `ExecutorPresence` message."""
@@ -1899,6 +1909,24 @@ class RegisterAgentRequest:
     role: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class ReplayManyRequest:
+    """The `ReplayManyRequest` message."""
+    cursor: str = field(default="")
+    from_start: bool = field(default=False)
+    limit: int = field(default=0)
+    repos: list[str] = field(default_factory=list)
+    topics: list[str] = field(default_factory=list)
+
+
+@dataclass(kw_only=True)
+class ReplayManyResponse:
+    """The `ReplayManyResponse` message."""
+    cursor: str = field(default="")
+    events: list[EventEnvelope] = field(default_factory=list)
+    has_more: bool = field(default=False)
+
+
 @dataclass(kw_only=True)
 class ReplayRequest:
     """The `ReplayRequest` message."""
diff --git a/sdk/python/src/agentgit/_generated/namespaces.py b/sdk/python/src/agentgit/_generated/namespaces.py
index 947add42..8325c566 100644
--- a/sdk/python/src/agentgit/_generated/namespaces.py
+++ b/sdk/python/src/agentgit/_generated/namespaces.py
@@ -58,6 +58,7 @@
     ErrorEnvelope,
     ErrorInfo,
     Event,
+    EventEnvelope,
     ExecutorPresence,
     ExtendLeaseRequest,
     FailJobRequest,
@@ -189,6 +190,8 @@
     ReflogRequest,
     ReflogResponse,
     RegisterAgentRequest,
+    ReplayManyRequest,
+    ReplayManyResponse,
     ReplayRequest,
     ReplayResponse,
     Repo,
@@ -660,6 +663,19 @@ def replay(
         """Replay events after a sequence number (query: after_seq, limit, topics=a,b) (`GET /v1/repos/{owner}/{rname}/events/replay`, operation `events.replay`)."""
         return self._c._call("events.replay", {"repo": repo, "after_seq": after_seq, "limit": limit, "topics": topics}, options, ReplayResponse)
 
+    def replay_many(
+        self,
+        *,
+        cursor: str | None = None,
+        from_start: bool | None = None,
+        limit: int | None = None,
+        repos: Sequence[str] | None = None,
+        topics: Sequence[str] | None = None,
+        options: CallOptions | None = None,
+    ) -> ReplayManyResponse:
+        """Replay explicit repositories using an opaque vector cursor; no cursor checkpoints now, from_start replays history (`GET /v1/events/replay`, operation `events.replay_many`)."""
+        return self._c._call("events.replay_many", {"cursor": cursor, "from_start": from_start, "limit": limit, "repos": repos, "topics": topics}, options, ReplayManyResponse)
+
     def subscribe(
         self,
         *,
@@ -682,6 +698,18 @@ def subscribe(
             run_id=run_id,
         )
 
+    def subscribe_many(
+        self, *, repos: Sequence[str], cursor: str | None = None,
+        topics: Sequence[str] | None = None, heartbeat_ms: int | None = None,
+        idle_timeout_ms: int | None = None, reconnect: ReconnectPolicy | None = None,
+        run_id: str | None = None,
+    ) -> Generator[EventEnvelope, None, None]:
+        """Follow explicit repositories with opaque cursor resume; yields checkpoints too."""
+        return self._c._subscribe_many(
+            repos=repos, cursor=cursor, topics=topics, heartbeat_ms=heartbeat_ms,
+            idle_timeout_ms=idle_timeout_ms, reconnect=reconnect, run_id=run_id,
+        )
+
 
 
 class HistoryApi:
@@ -2423,6 +2451,19 @@ async def replay(
         """Replay events after a sequence number (query: after_seq, limit, topics=a,b) (`GET /v1/repos/{owner}/{rname}/events/replay`, operation `events.replay`)."""
         return await self._c._call("events.replay", {"repo": repo, "after_seq": after_seq, "limit": limit, "topics": topics}, options, ReplayResponse)
 
+    async def replay_many(
+        self,
+        *,
+        cursor: str | None = None,
+        from_start: bool | None = None,
+        limit: int | None = None,
+        repos: Sequence[str] | None = None,
+        topics: Sequence[str] | None = None,
+        options: CallOptions | None = None,
+    ) -> ReplayManyResponse:
+        """Replay explicit repositories using an opaque vector cursor; no cursor checkpoints now, from_start replays history (`GET /v1/events/replay`, operation `events.replay_many`)."""
+        return await self._c._call("events.replay_many", {"cursor": cursor, "from_start": from_start, "limit": limit, "repos": repos, "topics": topics}, options, ReplayManyResponse)
+
     def subscribe(
         self,
         *,
@@ -2445,6 +2486,18 @@ def subscribe(
             run_id=run_id,
         )
 
+    def subscribe_many(
+        self, *, repos: Sequence[str], cursor: str | None = None,
+        topics: Sequence[str] | None = None, heartbeat_ms: int | None = None,
+        idle_timeout_ms: int | None = None, reconnect: ReconnectPolicy | None = None,
+        run_id: str | None = None,
+    ) -> AsyncGenerator[EventEnvelope, None]:
+        """Follow explicit repositories with opaque cursor resume; yields checkpoints too."""
+        return self._c._subscribe_many(
+            repos=repos, cursor=cursor, topics=topics, heartbeat_ms=heartbeat_ms,
+            idle_timeout_ms=idle_timeout_ms, reconnect=reconnect, run_id=run_id,
+        )
+
 
 
 class AsyncHistoryApi:
diff --git a/sdk/python/src/agentgit/_generated/operations.py b/sdk/python/src/agentgit/_generated/operations.py
index 3e77771c..b688ace9 100644
--- a/sdk/python/src/agentgit/_generated/operations.py
+++ b/sdk/python/src/agentgit/_generated/operations.py
@@ -470,6 +470,21 @@
         idempotency_key=False,
         public=False,
     ),
+    "events.replay_many": OperationInfo(
+        id="events.replay_many",
+        http="GET",
+        route="/v1/events/replay",
+        namespace="events",
+        name="replay_many",
+        summary="Replay explicit repositories using an opaque vector cursor; no cursor checkpoints now, from_start replays history",
+        path_params=(),
+        query_params=('cursor', 'from_start', 'limit', 'repos', 'topics'),
+        body="none",
+        response="json",
+        retry="read",
+        idempotency_key=False,
+        public=False,
+    ),
     "events.subscribe": OperationInfo(
         id="events.subscribe",
         http="GET",
@@ -485,6 +500,21 @@
         idempotency_key=False,
         public=False,
     ),
+    "events.subscribe_many": OperationInfo(
+        id="events.subscribe_many",
+        http="GET",
+        route="/v1/events",
+        namespace="events",
+        name="subscribe_many",
+        summary="Multi-repository SSE; no cursor checkpoints now; Last-Event-ID resumes an opaque vector cursor",
+        path_params=(),
+        query_params=('repos', 'topics', 'cursor', 'heartbeat_ms'),
+        body="none",
+        response="sse",
+        retry="read",
+        idempotency_key=False,
+        public=False,
+    ),
     "file_draft.clear": OperationInfo(
         id="file_draft.clear",
         http="DELETE",
@@ -2034,7 +2064,9 @@
     },
     "events": {
         "replay": "events.replay",
+        "replay_many": "events.replay_many",
         "subscribe": "events.subscribe",
+        "subscribe_many": "events.subscribe_many",
     },
     "history": {
         "ancestors": "history.ancestors",
diff --git a/sdk/python/src/agentgit/_protocols.py b/sdk/python/src/agentgit/_protocols.py
index 20269286..f69141c0 100644
--- a/sdk/python/src/agentgit/_protocols.py
+++ b/sdk/python/src/agentgit/_protocols.py
@@ -5,7 +5,7 @@
 from collections.abc import AsyncGenerator, Generator, Mapping, Sequence
 from typing import Any, Protocol, TypeVar
 
-from agentgit._generated.models import Event, PutObjectResult
+from agentgit._generated.models import Event, EventEnvelope, PutObjectResult
 from agentgit._options import CallOptions, ReconnectPolicy
 
 T = TypeVar("T")
@@ -20,6 +20,18 @@ def _call_put(
         self, *, repo: str, object_id: str, data: bytes, options: CallOptions | None
     ) -> PutObjectResult: ...
 
+    def _subscribe_many(
+        self,
+        *,
+        repos: Sequence[str],
+        cursor: str | None,
+        topics: Sequence[str] | None,
+        heartbeat_ms: int | None,
+        idle_timeout_ms: int | None,
+        reconnect: ReconnectPolicy | None,
+        run_id: str | None,
+    ) -> Generator[EventEnvelope, None, None]: ...
+
     def _subscribe(
         self,
         *,
@@ -42,6 +54,18 @@ async def _call_put(
         self, *, repo: str, object_id: str, data: bytes, options: CallOptions | None
     ) -> PutObjectResult: ...
 
+    def _subscribe_many(
+        self,
+        *,
+        repos: Sequence[str],
+        cursor: str | None,
+        topics: Sequence[str] | None,
+        heartbeat_ms: int | None,
+        idle_timeout_ms: int | None,
+        reconnect: ReconnectPolicy | None,
+        run_id: str | None,
+    ) -> AsyncGenerator[EventEnvelope, None]: ...
+
     def _subscribe(
         self,
         *,
diff --git a/sdk/python/src/agentgit/client.py b/sdk/python/src/agentgit/client.py
index 5b9d2394..0481bc10 100644
--- a/sdk/python/src/agentgit/client.py
+++ b/sdk/python/src/agentgit/client.py
@@ -16,11 +16,12 @@
 from agentgit._codec import decode_as
 from agentgit._config import AsyncTokenSource, SyncTokenSource, TransportConfig
 from agentgit._core import DEFAULT_TIMEOUT_MS
-from agentgit._events import subscribe_async, subscribe_sync
+from agentgit._events import subscribe_async, subscribe_many_async, subscribe_many_sync, subscribe_sync
 from agentgit._generated.models import (
     Changeset,
     DirEntry,
     Event,
+    EventEnvelope,
     Issue,
     IssueActivity,
     NegotiateResponse,
@@ -379,6 +380,28 @@ def _call_put(
         )
         return decode_as(PutObjectResult, raw)
 
+    def _subscribe_many(
+        self,
+        *,
+        repos: Sequence[str],
+        cursor: str | None,
+        topics: Sequence[str] | None,
+        heartbeat_ms: int | None,
+        idle_timeout_ms: int | None,
+        reconnect: ReconnectPolicy | None,
+        run_id: str | None,
+    ) -> Generator[EventEnvelope, None, None]:
+        return subscribe_many_sync(
+            self._transport,
+            repos=repos,
+            cursor=cursor,
+            topics=topics,
+            heartbeat_ms=heartbeat_ms,
+            idle_timeout_ms=idle_timeout_ms,
+            reconnect=reconnect,
+            run_id=run_id or self._transport.config.run_id,
+        )
+
     def _subscribe(
         self,
         *,
@@ -740,6 +763,28 @@ async def _call_put(
         )
         return decode_as(PutObjectResult, raw)
 
+    def _subscribe_many(
+        self,
+        *,
+        repos: Sequence[str],
+        cursor: str | None,
+        topics: Sequence[str] | None,
+        heartbeat_ms: int | None,
+        idle_timeout_ms: int | None,
+        reconnect: ReconnectPolicy | None,
+        run_id: str | None,
+    ) -> AsyncGenerator[EventEnvelope, None]:
+        return subscribe_many_async(
+            self._transport,
+            repos=repos,
+            cursor=cursor,
+            topics=topics,
+            heartbeat_ms=heartbeat_ms,
+            idle_timeout_ms=idle_timeout_ms,
+            reconnect=reconnect,
+            run_id=run_id or self._transport.config.run_id,
+        )
+
     def _subscribe(
         self,
         *,
diff --git a/sdk/python/tests/test_all_operations.py b/sdk/python/tests/test_all_operations.py
index 57e0dde1..8ca0b42d 100644
--- a/sdk/python/tests/test_all_operations.py
+++ b/sdk/python/tests/test_all_operations.py
@@ -423,6 +423,13 @@ def test_agents_tasks_leases_and_provenance(tour: dict[str, AgentGitClient]) ->
 def test_events_audit_and_maintenance(tour: dict[str, AgentGitClient]) -> None:
     admin, alice = tour["admin"], tour["alice"]
     assert len(alice.events.replay(repo=REPO, after_seq=0, limit=5).events) == 5
+    checkpoint = alice.events.replay_many(repos=[REPO])
+    assert checkpoint.cursor
+    feed = alice.events.subscribe_many(repos=[REPO], cursor=checkpoint.cursor)
+    try:
+        assert next(feed).cursor
+    finally:
+        feed.close()
     got = []
     for ev in alice.events.subscribe(repo=REPO, after_seq=0):
         got.append(ev.topic)
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index 24128431..e8171571 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -512,6 +512,13 @@ first. These drafts contain `head` and `body` (up to 16 KiB of UTF-8), remain se
 from review-decision drafts, and can be saved on closed proposals. Saving or clearing
 a draft never posts a comment; post explicitly after inspecting the current proposal head.
 
+Cross-repository activity uses `client.events.replayMany` and `subscribeMany` after negotiating
+`events.multi_repo`. Pass 1–30 explicit repositories. An empty cursor checkpoints now;
+replay with `from_start` to read history. Keep the returned opaque cursor and the same
+repository/topic selection when resuming. Subscription envelopes also include checkpoints
+with no event; save their cursors too. Sequence numbers belong to individual repositories,
+so do not sort them as one global timeline.
+
 Private file edits use `client.drafts.get`, `save`, `clear` and `list` after negotiating
 `files.drafts`. Identify the draft by repository, stream and existing file path.
 Save the complete base64-encoded file content with its original `base` changeset and
diff --git a/sdk/typescript/scripts/generate.mjs b/sdk/typescript/scripts/generate.mjs
index a03ce821..0b2fa25a 100644
--- a/sdk/typescript/scripts/generate.mjs
+++ b/sdk/typescript/scripts/generate.mjs
@@ -147,6 +147,7 @@ const SPECIAL = {
   'objects.get': '(request: { repo: string; object_id: string }, options?: CallOptions): Promise<Uint8Array>',
   'tree.file': '(request: { repo: string; path: string; rev?: string }, options?: CallOptions): Promise<Uint8Array>',
   'events.subscribe': '(options: SubscribeEventsOptions): AsyncGenerator<AgentEvent, void, undefined>',
+  'events.subscribe_many': '(options: SubscribeManyEventsOptions): AsyncGenerator<EventEnvelope, void, undefined>',
 };
 
 // The hand-typed signatures above must keep matching the document: the same operations are non-JSON, and
@@ -160,6 +161,7 @@ const SPECIAL = {
     'objects.get': [],
     'tree.file': ['rev'],
     'events.subscribe': ['after_seq', 'heartbeat_ms', 'topics'],
+    'events.subscribe_many': ['repos', 'topics', 'cursor', 'heartbeat_ms'],
   };
   const same = (a, b) => JSON.stringify([...a].sort()) === JSON.stringify([...b].sort());
   if (!same(new Set(nonJson), Object.keys(SPECIAL))) {
@@ -178,8 +180,9 @@ function apiTs() {
   const out = [BANNER];
   out.push("import type { OperationId } from './operations.js';");
   out.push(
-    "import type { AgentEvent, CallOptions, PutObjectResult, Req, Res, SubscribeEventsOptions } from '../types.js';",
+    "import type { AgentEvent, CallOptions, PutObjectResult, Req, Res, SubscribeEventsOptions, SubscribeManyEventsOptions } from '../types.js';",
   );
+  out.push("import type { EventEnvelope } from './models.js';");
   out.push('');
   out.push('/** The operation behind each namespaced method, for tooling and tests. */');
   out.push('export const NAMESPACE_METHODS = {');
diff --git a/sdk/typescript/src/client.ts b/sdk/typescript/src/client.ts
index dae80125..2fb669d1 100644
--- a/sdk/typescript/src/client.ts
+++ b/sdk/typescript/src/client.ts
@@ -1,12 +1,12 @@
 import { AgentGitError } from './errors.js';
 import { NAMESPACE_METHODS } from './generated/api.js';
 import type { Api } from './generated/api.js';
-import type { NegotiateResponse } from './generated/models.js';
+import type { EventEnvelope, NegotiateResponse } from './generated/models.js';
 import { OPERATIONS, PAGINATED } from './generated/operations.js';
 import type { OperationId, PaginatedOperationId } from './generated/operations.js';
 import type { StoredObject } from './changeset.js';
 import { blobObject } from './hashing.js';
-import { subscribeEvents } from './sse.js';
+import { subscribeEvents, subscribeManyEvents } from './sse.js';
 import {
   abortableSleep,
   DEFAULT_RETRY,
@@ -23,6 +23,7 @@ import type {
   Res,
   RetryOptions,
   SubscribeEventsOptions,
+  SubscribeManyEventsOptions,
 } from './types.js';
 
 /** The protocol version this client speaks. */
@@ -175,6 +176,7 @@ export class AgentGitClient {
     };
     const events = self['events']!;
     events['subscribe'] = (opts: SubscribeEventsOptions) => this.subscribeEvents(opts);
+    events['subscribeMany'] = (opts: SubscribeManyEventsOptions) => this.subscribeManyEvents(opts);
   }
 
   /** The server root this client talks to. */
@@ -211,7 +213,7 @@ export class AgentGitClient {
   call<
     Id extends Exclude<
       OperationId,
-      'objects.put' | 'objects.get' | 'tree.file' | 'events.subscribe' | 'migration.prepare'
+      'objects.put' | 'objects.get' | 'tree.file' | 'events.subscribe' | 'events.subscribe_many' | 'migration.prepare'
     >,
   >(id: Id, request: Req<Id>, options?: CallOptions): Promise<Res<Id>> {
     return this.#invoke(id, request as Record<string, unknown>, undefined, options) as Promise<Res<Id>>;
@@ -297,6 +299,14 @@ export class AgentGitClient {
     });
   }
 
+  /** Cross-repository envelopes, including checkpoint-only frames, with opaque cursor resume. */
+  subscribeManyEvents(options: SubscribeManyEventsOptions): AsyncGenerator<EventEnvelope, void, undefined> {
+    return subscribeManyEvents(this.#transport, {
+      ...(this.#options.runId && !options.runId ? { runId: this.#options.runId } : {}),
+      ...options,
+    });
+  }
+
   /** A client that acts as the given agent run (every request carries `ag-run`). */
   withRun(runId: string): AgentGitClient {
     return new AgentGitClient({ ...this.#options, runId });
diff --git a/sdk/typescript/src/generated/api.ts b/sdk/typescript/src/generated/api.ts
index 29cc196a..46201821 100644
--- a/sdk/typescript/src/generated/api.ts
+++ b/sdk/typescript/src/generated/api.ts
@@ -2,7 +2,8 @@
 // Regenerate with `npm run generate`; CI runs `npm run generate:check`.
 
 import type { OperationId } from './operations.js';
-import type { AgentEvent, CallOptions, PutObjectResult, Req, Res, SubscribeEventsOptions } from '../types.js';
+import type { AgentEvent, CallOptions, PutObjectResult, Req, Res, SubscribeEventsOptions, SubscribeManyEventsOptions } from '../types.js';
+import type { EventEnvelope } from './models.js';
 
 /** The operation behind each namespaced method, for tooling and tests. */
 export const NAMESPACE_METHODS = {
@@ -47,7 +48,9 @@ export const NAMESPACE_METHODS = {
   },
   events: {
     replay: 'events.replay',
+    replayMany: 'events.replay_many',
     subscribe: 'events.subscribe',
+    subscribeMany: 'events.subscribe_many',
   },
   history: {
     ancestors: 'history.ancestors',
@@ -260,8 +263,12 @@ export interface Api {
   readonly events: {
     /** Replay events after a sequence number (query: after_seq, limit, topics=a,b) (`GET /v1/repos/{owner}/{rname}/events/replay`, operation `events.replay`) */
     replay(request: Req<'events.replay'>, options?: CallOptions): Promise<Res<'events.replay'>>;
+    /** Replay explicit repositories using an opaque vector cursor; no cursor checkpoints now, from_start replays history (`GET /v1/events/replay`, operation `events.replay_many`) */
+    replayMany(request?: Req<'events.replay_many'>, options?: CallOptions): Promise<Res<'events.replay_many'>>;
     /** Server-Sent Events: replay after after_seq (or Last-Event-ID), then follow live (`GET /v1/repos/{owner}/{rname}/events`, operation `events.subscribe`) */
     subscribe(options: SubscribeEventsOptions): AsyncGenerator<AgentEvent, void, undefined>;
+    /** Multi-repository SSE; no cursor checkpoints now; Last-Event-ID resumes an opaque vector cursor (`GET /v1/events`, operation `events.subscribe_many`) */
+    subscribeMany(options: SubscribeManyEventsOptions): AsyncGenerator<EventEnvelope, void, undefined>;
   };
   readonly history: {
     /** Changesets reachable from want but not from have, parents first (`POST /v1/repos/{owner}/{rname}/history/ancestors`, operation `history.ancestors`) */
diff --git a/sdk/typescript/src/generated/models.ts b/sdk/typescript/src/generated/models.ts
index 552524c4..38e3b812 100644
--- a/sdk/typescript/src/generated/models.ts
+++ b/sdk/typescript/src/generated/models.ts
@@ -56,6 +56,7 @@ export type Empty = S['Empty'];
 export type EnqueueRequest = S['EnqueueRequest'];
 export type ErrorEnvelope = S['ErrorEnvelope'];
 export type ErrorInfo = S['ErrorInfo'];
+export type EventEnvelope = S['EventEnvelope'];
 export type ExecutorPresence = S['ExecutorPresence'];
 export type ExtendLeaseRequest = S['ExtendLeaseRequest'];
 export type FailJobRequest = S['FailJobRequest'];
@@ -187,6 +188,8 @@ export type ReflogEntry = S['ReflogEntry'];
 export type ReflogRequest = S['ReflogRequest'];
 export type ReflogResponse = S['ReflogResponse'];
 export type RegisterAgentRequest = S['RegisterAgentRequest'];
+export type ReplayManyRequest = S['ReplayManyRequest'];
+export type ReplayManyResponse = S['ReplayManyResponse'];
 export type ReplayRequest = S['ReplayRequest'];
 export type ReplayResponse = S['ReplayResponse'];
 export type Repo = S['Repo'];
diff --git a/sdk/typescript/src/generated/operations.ts b/sdk/typescript/src/generated/operations.ts
index d7a3a3cd..d867d4b0 100644
--- a/sdk/typescript/src/generated/operations.ts
+++ b/sdk/typescript/src/generated/operations.ts
@@ -470,6 +470,21 @@ export const OPERATIONS = {
     idempotencyKey: false,
     public: false,
   },
+  'events.replay_many': {
+    id: 'events.replay_many',
+    http: 'GET',
+    route: '/v1/events/replay',
+    namespace: 'events',
+    name: 'replayMany',
+    summary: 'Replay explicit repositories using an opaque vector cursor; no cursor checkpoints now, from_start replays history',
+    pathParams: [],
+    queryParams: ['cursor', 'from_start', 'limit', 'repos', 'topics'],
+    body: 'none',
+    response: 'json',
+    retry: 'read',
+    idempotencyKey: false,
+    public: false,
+  },
   'events.subscribe': {
     id: 'events.subscribe',
     http: 'GET',
@@ -485,6 +500,21 @@ export const OPERATIONS = {
     idempotencyKey: false,
     public: false,
   },
+  'events.subscribe_many': {
+    id: 'events.subscribe_many',
+    http: 'GET',
+    route: '/v1/events',
+    namespace: 'events',
+    name: 'subscribeMany',
+    summary: 'Multi-repository SSE; no cursor checkpoints now; Last-Event-ID resumes an opaque vector cursor',
+    pathParams: [],
+    queryParams: ['repos', 'topics', 'cursor', 'heartbeat_ms'],
+    body: 'none',
+    response: 'sse',
+    retry: 'read',
+    idempotencyKey: false,
+    public: false,
+  },
   'file_draft.clear': {
     id: 'file_draft.clear',
     http: 'DELETE',
diff --git a/sdk/typescript/src/generated/schema.ts b/sdk/typescript/src/generated/schema.ts
index 64c52c91..99c6a5fb 100644
--- a/sdk/typescript/src/generated/schema.ts
+++ b/sdk/typescript/src/generated/schema.ts
@@ -70,6 +70,40 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/events": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Multi-repository SSE; no cursor checkpoints now; Last-Event-ID resumes an opaque vector cursor */
+        get: operations["events.subscribe_many"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/events/replay": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Replay explicit repositories using an opaque vector cursor; no cursor checkpoints now, from_start replays history */
+        get: operations["events.replay_many"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/jobs/claim": {
         parameters: {
             query?: never;
@@ -2589,6 +2623,13 @@ export interface components {
              */
             topic: string;
         };
+        /** @description An opaque vector cursor; events from different repositories have no shared sequence. */
+        EventEnvelope: {
+            /** @default  */
+            cursor: string;
+            /** @default null */
+            event: components["schemas"]["Event"] | null;
+        };
         ExecutorPresence: {
             /**
              * Format: int32
@@ -4397,6 +4438,32 @@ export interface components {
             /** @default  */
             role: string;
         };
+        ReplayManyRequest: {
+            /** @default  */
+            cursor: string;
+            /**
+             * @description With no cursor, deliberately replay all history instead of checkpointing now.
+             * @default false
+             */
+            from_start: boolean;
+            /**
+             * Format: int32
+             * @default 0
+             */
+            limit: number;
+            /** @default [] */
+            repos: string[];
+            /** @default [] */
+            topics: string[];
+        };
+        ReplayManyResponse: {
+            /** @default  */
+            cursor: string;
+            /** @default [] */
+            events: components["schemas"]["EventEnvelope"][];
+            /** @default false */
+            has_more: boolean;
+        };
         ReplayRequest: {
             /**
              * Format: int64
@@ -5595,6 +5662,79 @@ export interface operations {
             };
         };
     };
+    "events.subscribe_many": {
+        parameters: {
+            query?: {
+                /** @description Required explicit comma-separated repository names (max30) */
+                repos?: string;
+                /** @description Comma-separated audit topic prefixes */
+                topics?: string;
+                /** @description Opaque cursor returned by replay or an earlier SSE envelope */
+                cursor?: string;
+                /** @description Checkpoint keep-alive interval (default15000,minimum1000) */
+                heartbeat_ms?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/event-stream": string;
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "events.replay_many": {
+        parameters: {
+            query?: {
+                cursor?: string;
+                from_start?: boolean;
+                limit?: number;
+                repos?: string[];
+                topics?: string[];
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ReplayManyResponse"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
     "jobs.claim": {
         parameters: {
             query?: never;
diff --git a/sdk/typescript/src/index.ts b/sdk/typescript/src/index.ts
index b920340d..13c7ac11 100644
--- a/sdk/typescript/src/index.ts
+++ b/sdk/typescript/src/index.ts
@@ -39,4 +39,5 @@ export type {
   Res,
   RetryOptions,
   SubscribeEventsOptions,
+  SubscribeManyEventsOptions,
 } from './types.js';
diff --git a/sdk/typescript/src/sse.ts b/sdk/typescript/src/sse.ts
index 18774bac..97b44cb4 100644
--- a/sdk/typescript/src/sse.ts
+++ b/sdk/typescript/src/sse.ts
@@ -1,6 +1,7 @@
 import { AgentGitError, errorFromInfo, isAgentGitError } from './errors.js';
 import { OPERATIONS } from './generated/operations.js';
-import type { AgentEvent, ReconnectOptions, SubscribeEventsOptions } from './types.js';
+import type { EventEnvelope } from './generated/models.js';
+import type { AgentEvent, ReconnectOptions, SubscribeEventsOptions, SubscribeManyEventsOptions } from './types.js';
 import type { Transport } from './transport.js';
 
 /** One dispatched Server-Sent Event. */
@@ -216,3 +217,86 @@ export async function* subscribeEvents(
     controller.abort(); // closes the connection when the consumer stops early
   }
 }
+
+/** Follows explicit repositories, preserving opaque checkpoints across reconnects. */
+export async function* subscribeManyEvents(
+  transport: Transport,
+  options: SubscribeManyEventsOptions,
+): AsyncGenerator<EventEnvelope, void, undefined> {
+  const repos = [...new Set(options.repos)].sort();
+  if (repos.length === 0 || repos.length > 30) throw new RangeError('Choose 1 to 30 repositories');
+  const topics = [...new Set(options.topics ?? [])].sort();
+  const op = OPERATIONS['events.subscribe_many'];
+  const controller = new AbortController();
+  const outer = options.signal;
+  if (outer?.aborted) return;
+  const abort = (): void => controller.abort();
+  outer?.addEventListener('abort', abort, { once: true });
+  const reconnect = options.reconnect === false ? undefined : { ...DEFAULT_RECONNECT, ...options.reconnect };
+  let cursor = options.cursor ?? '';
+  let failures = 0;
+  try {
+    for (;;) {
+      if (controller.signal.aborted) return;
+      let delivered = false;
+      try {
+        const response = await transport.openStream(
+          op,
+          {
+            repos,
+            topics,
+            cursor,
+            ...(options.heartbeatMs === undefined ? {} : { heartbeat_ms: options.heartbeatMs }),
+          },
+          { signal: controller.signal, runId: options.runId, headers: options.headers },
+        );
+        if (!response.body)
+          throw new AgentGitError({ code: 'unavailable', message: 'The event stream has no body', retryable: true });
+        for await (const frame of readSse(response.body, options.idleTimeoutMs ?? DEFAULT_IDLE_MS)) {
+          if (frame.event === 'error') {
+            const info = (JSON.parse(frame.data) as { error?: Record<string, unknown> }).error ?? {};
+            throw errorFromInfo(info, { status: 0, operation: op.id });
+          }
+          const envelope = JSON.parse(frame.data) as EventEnvelope;
+          if (typeof envelope.cursor !== 'string' || envelope.cursor.length === 0) {
+            throw new AgentGitError({
+              code: 'internal',
+              message: 'The event envelope has no cursor',
+              retryable: false,
+            });
+          }
+          cursor = envelope.cursor;
+          delivered = true;
+          failures = 0;
+          yield envelope;
+        }
+      } catch (error) {
+        if (controller.signal.aborted) return;
+        const transient =
+          error instanceof IdleTimeout || (isAgentGitError(error) && error.retryable) || error instanceof TypeError;
+        if (!reconnect || !transient) throw error;
+      }
+      if (!reconnect) return;
+      if (!delivered) failures++;
+      if (failures > reconnect.maxAttempts) {
+        throw new AgentGitError({
+          code: 'unavailable',
+          message: 'The event stream could not be re-established',
+          retryable: true,
+        });
+      }
+      const ceiling = Math.min(reconnect.maxDelayMs, reconnect.baseDelayMs * 2 ** Math.max(0, failures - 1));
+      try {
+        await transport.config.sleep(
+          delivered ? 0 : Math.round(transport.config.random() * ceiling),
+          controller.signal,
+        );
+      } catch {
+        return;
+      }
+    }
+  } finally {
+    outer?.removeEventListener('abort', abort);
+    controller.abort();
+  }
+}
diff --git a/sdk/typescript/src/transport.ts b/sdk/typescript/src/transport.ts
index 9e577bd7..502569da 100644
--- a/sdk/typescript/src/transport.ts
+++ b/sdk/typescript/src/transport.ts
@@ -77,7 +77,7 @@ export interface BuiltRequest {
   hasJsonBody: boolean;
 }
 
-const QUERY_CSV = new Set(['topics']);
+const QUERY_CSV = new Set(['topics', 'repos']);
 
 function encodeSegment(value: unknown, name: string, op: OperationInfo): string {
   if (value === undefined || value === null || value === '') {
diff --git a/sdk/typescript/src/types.ts b/sdk/typescript/src/types.ts
index 8ae97a75..4425de9d 100644
--- a/sdk/typescript/src/types.ts
+++ b/sdk/typescript/src/types.ts
@@ -110,3 +110,11 @@ export interface SubscribeEventsOptions {
   runId?: string;
   headers?: Record<string, string>;
 }
+
+/** Explicit cross-repository feed. Checkpoint envelopes may have no event. */
+export interface SubscribeManyEventsOptions extends Omit<SubscribeEventsOptions, 'repo' | 'afterSeq'> {
+  /** Explicit repository set, between 1 and 30; held fixed across reconnects. */
+  repos: string[];
+  /** Opaque checkpoint from replayMany or subscribeMany; omit to start now. */
+  cursor?: string;
+}
diff --git a/sdk/typescript/test/all-operations.test.ts b/sdk/typescript/test/all-operations.test.ts
index db3c1638..c6a56e39 100644
--- a/sdk/typescript/test/all-operations.test.ts
+++ b/sdk/typescript/test/all-operations.test.ts
@@ -489,6 +489,12 @@ describe('the tour', () => {
 
   it('events, audit and maintenance', async () => {
     expect((await alice.events.replay({ repo, after_seq: 0, limit: 5 })).events).toHaveLength(5);
+    const checkpoint = await alice.events.replayMany({ repos: [repo] });
+    expect(checkpoint.cursor).not.toBe('');
+    for await (const envelope of alice.events.subscribeMany({ repos: [repo], cursor: checkpoint.cursor })) {
+      expect(envelope.cursor).not.toBe('');
+      break;
+    }
     const got: string[] = [];
     for await (const ev of alice.events.subscribe({ repo, afterSeq: 0 })) {
       got.push(ev.topic);

From fcda56c5d00baf18be621f952e5e201945b9d585 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:48:41 +0000
Subject: [PATCH 36/41] docs: record cross-repository live workflows and next
 migration slice

---
 CHANGELOG.md                          |   1 +
 ROADMAP.md                            |   3 +-
 apps/web/src/api/schema.gen.ts        | 140 ++++++++++++++++++++++++++
 dev/continuous-progress.md            |  26 +++--
 docs/architecture/adr-traceability.md |   4 +
 docs/guides/sdks.md                   |  10 ++
 6 files changed, 174 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 76f91543..98cebb7d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 - The release pipeline prepares a native Windows x64 ZIP with the CLI, server and MCP, plus a per-user PowerShell installer that verifies checksums. Native install-and-first-use smoke is required before publishing; the first Windows archive is not yet released.
 
+- Home receives live updates across up to thirty loaded repositories through one resumable event feed. CLI, SDKs and MCP expose bounded multi-repository replay with per-repository cursors.
 - Existing-file edits can be saved privately to an account and resumed through Web, CLI, SDK and MCP. Original revision and file metadata are retained; publication stays explicit. Development schema 12 requires a pre-upgrade backup.
 - General proposal comments gain separate private account drafts across Web, CLI, SDK and MCP, with explicit save and version-checked cleanup. Development schema 11 preserves existing review drafts; back up before upgrading.
 - Reviewers can explicitly save a private review draft to their account and resume on another device through Web UI, CLI, MCP or SDKs. Local drafts remain available, conflicting drafts require a choice, and versioned saves/clears never overwrite newer notes or submit a review. Development schema 10 requires a pre-upgrade backup.
diff --git a/ROADMAP.md b/ROADMAP.md
index 4963c47f..54702bf7 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -106,8 +106,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    rechecks the proposal head and open state. Single-line, range and batched suggestions support explicit author preview and application across files in one revision. Requested reviewers route work across Web UI, CLI, MCP and SDKs without changing approval policy. Optional policy-required line-discussion resolution is now implemented
    across core, API, CLI explanations and Web UI. Preserve drafts, exact-head
    checks and explicit confirmation when a user changes executable work or a review decision.
-   Binary, oversized, file-type and rename/delete conflicts now support exact version choices; renamed content previews retain their per-side source paths. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; general proposal comments now have separate private drafts with the same explicit save and version checks; single-file edits now support explicit account save and restore, including discovery after a file disappears from the current branch. Account-backed batch and new-file drafts remain open. Bounded file/directory conflicts now support whole-source choices with complete candidate previews; multi-target rename conflicts and larger structural cases remain open. The development Home page uses one live stream for a selected repository, retaining complete snapshots and
-   polling for the aggregate view. A cross-repository event feed remains future work.
+   Binary, oversized, file-type and rename/delete conflicts now support exact version choices; renamed content previews retain their per-side source paths. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; general proposal comments now have separate private drafts with the same explicit save and version checks; single-file edits now support explicit account save and restore, including discovery after a file disappears from the current branch. Account-backed batch and new-file drafts remain open. Bounded file/directory conflicts now support whole-source choices with complete candidate previews; multi-target rename conflicts and larger structural cases remain open. The development Home page retains complete snapshots and uses one resumable live feed for up to thirty loaded repositories. Larger aggregate views keep bounded polling for the remaining repositories; CLI and SDKs share the scoped cross-repository cursor contract.
 3. **Make GitHub/GitLab cutover complete.** Code history, branch/tag mapping, the original bundle
    and reconciliation already move through Web UI and CLI. Next design and implement resumable
    hosting-metadata migration: issues and comments first, then pull/merge-request references,
diff --git a/apps/web/src/api/schema.gen.ts b/apps/web/src/api/schema.gen.ts
index 85c8c1e2..08558ffb 100644
--- a/apps/web/src/api/schema.gen.ts
+++ b/apps/web/src/api/schema.gen.ts
@@ -73,6 +73,40 @@ export interface paths {
     patch?: never
     trace?: never
   }
+  '/v1/events': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /** Multi-repository SSE; no cursor checkpoints now; Last-Event-ID resumes an opaque vector cursor */
+    get: operations['events.subscribe_many']
+    put?: never
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/v1/events/replay': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /** Replay explicit repositories using an opaque vector cursor; no cursor checkpoints now, from_start replays history */
+    get: operations['events.replay_many']
+    put?: never
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
   '/v1/jobs/claim': {
     parameters: {
       query?: never
@@ -2574,6 +2608,13 @@ export interface components {
        */
       topic: string
     }
+    /** @description An opaque vector cursor; events from different repositories have no shared sequence. */
+    EventEnvelope: {
+      /** @default  */
+      cursor: string
+      /** @default null */
+      event: components['schemas']['Event'] | null
+    }
     ExecutorPresence: {
       /**
        * Format: int32
@@ -4379,6 +4420,32 @@ export interface components {
       /** @default  */
       role: string
     }
+    ReplayManyRequest: {
+      /** @default  */
+      cursor: string
+      /**
+       * @description With no cursor, deliberately replay all history instead of checkpointing now.
+       * @default false
+       */
+      from_start: boolean
+      /**
+       * Format: int32
+       * @default 0
+       */
+      limit: number
+      /** @default [] */
+      repos: string[]
+      /** @default [] */
+      topics: string[]
+    }
+    ReplayManyResponse: {
+      /** @default  */
+      cursor: string
+      /** @default [] */
+      events: components['schemas']['EventEnvelope'][]
+      /** @default false */
+      has_more: boolean
+    }
     ReplayRequest: {
       /**
        * Format: int64
@@ -5578,6 +5645,79 @@ export interface operations {
       }
     }
   }
+  'events.subscribe_many': {
+    parameters: {
+      query?: {
+        /** @description Required explicit comma-separated repository names (max30) */
+        repos?: string
+        /** @description Comma-separated audit topic prefixes */
+        topics?: string
+        /** @description Opaque cursor returned by replay or an earlier SSE envelope */
+        cursor?: string
+        /** @description Checkpoint keep-alive interval (default15000,minimum1000) */
+        heartbeat_ms?: number
+      }
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    requestBody?: never
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'text/event-stream': string
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
+  'events.replay_many': {
+    parameters: {
+      query?: {
+        cursor?: string
+        from_start?: boolean
+        limit?: number
+        repos?: string[]
+        topics?: string[]
+      }
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    requestBody?: never
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ReplayManyResponse']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
   'jobs.claim': {
     parameters: {
       query?: never
diff --git a/dev/continuous-progress.md b/dev/continuous-progress.md
index 5cc2a0f2..8258a9da 100644
--- a/dev/continuous-progress.md
+++ b/dev/continuous-progress.md
@@ -1,13 +1,13 @@
 # Continuous AgentGit progress
 
-Status: **CONTINUE**. Rebased on current main; draft PR preparation and P0 structural-sync repair underway. Completing a slice does not complete the platform roadmap.
+Status: **CONTINUE**. R2 comment drafts and R3 existing-file drafts shipped to the work branch; R5 cross-repository live feed is in progress. Completing a slice does not complete the platform roadmap.
 
 ## Recovery and authorization
 
 - Working branch: `codex/roadmap-review-workflows`.
 - Original base: `2ad73082106615c5ce1ac0831b9444eb3955b20f` (beta.7).
-- Audited current remote main on 2026-10-29: `8a0019424b37bd9ef42739389a0e7a1f7945c660`.
-- Local implementation tip before this checkpoint: `ed58caeb2ff4ed10874b80a151c45187be6fe56c`.
+- Audited remote main on 2026-10-29: `f823813` (#137 board counter wrapping and #138 prepared-release CI reuse). Merged into the work branch as `8293e69`; retained required Windows artifacts.
+- Last pushed implementation tip: `350cb8c`; working branch now includes main reconciliation `8293e69`. Draft PR136 stays open and unmerged.
 - User reiterated on 2026-10-29: **work only in a separate branch; merge all into the next release only when explicitly told**. Do not merge, force-push, publish a release or replace tags. Draft PR and CI qualification are the next delivery step.
 - Use ub-mode and the existing Hallmark/Web design direction. Keep CLI, SDK and Web behavior aligned; avoid speculative frameworks.
 - On resume: read this file, inspect worktree, fetch main, inspect open PR/CI, retain unmerged changes, continue a runnable backlog item.
@@ -41,7 +41,7 @@ Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceab
 | R2 | P1 DONE | Private general discussion drafts | per-account isolation, stale-save/clear protections, UI restore, SDK/CLI parity |
 | R3 | P1 PARTIAL | Existing single-file drafts delivered; batch/new-file drafts remain | immutable base, byte/mode preservation, conflicts keep local work; no automatic publication |
 | R4 | P1 PARTIAL | Bounded file/directory Web choices; multi-target rename and larger structural cases remain open | complete explicit result, preserve independent clean edits; never infer deletion from failed reads |
-| R5 | P1 OPEN | Cross-repository work feed | pagination/scopes, full initial snapshot and reconnect behavior |
+| R5 | P1 DONE | Cross-repository work feed | pagination/scopes, full initial snapshot and reconnect behavior |
 | M1 | P1 OPEN | Resumable hosting metadata import: issues/comments first | preview, mapping/idempotency/checkpoint, retry without duplication; PR/releases/identity later |
 | Q1 | P1 BLOCKED external | #50 real MCP host | actual named host/version + full bounded task workflow and denied scope; scripted protocol is not enough |
 | Q2 | P1 BLOCKED external | #51 five pilots and retention/case studies | external participants and permission; no invented users; requires recruitment authorization/contact |
@@ -54,10 +54,10 @@ Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceab
 
 ## Immediate next actions
 
-1. Preserve pre-rebase branch; rebase local batch onto `origin/main`, resolve CI/release conflicts using newest architecture.
-2. Run skip-source gate (new Windows tests currently use `unittest.skipUnless`, inspect against repository helper policy), workflow/release/docs compatibility and focused changed-code checks.
-3. Open draft PR for whole batch and await/repair CI while implementing the next independent R1 slice.
-4. Update this checkpoint with new SHAs, PR, CI URLs, failures and next item. Keep release gates open until evidence really exists.
+1. Finish R5: one bounded cross-repository event connection, explicit repository scopes, opaque per-repository cursors and safe replay; wire Home, CLI, SDK and MCP in parallel.
+2. Use basic builds and one focused real workflow when needed. The user explicitly stopped broad test/mutation loops; prioritize implementation.
+3. Commit/push coherent work to the existing draft PR only. Never merge or release without the user's direct instruction.
+4. Continue remaining daily workflow and migration backlog; update this checkpoint before yielding.
 
 ## Reconciliation checkpoint
 
@@ -121,3 +121,13 @@ R3 implementation landed locally across backend/API/CLI/SDK-MCP/Web. User explic
 R3 commits:cd8f0db backend/schema12,950d935 Web,16f7dd2 SDK/MCP. Basic server/Web builds and CLI/MCP checks passed; SDK types passed. No R3 test matrices or mutation runs per explicit user request. CLI binary/docs generation completing. Continue product work with lightweight verification; do not return to broad quality-tool loops. Main/release hold unchanged.
 
 R3 delivery complete for existing single-file edits: CLI86aaa18 and generated168 reference files; all clients compile/build. Commit ordered with backendcd8f0db, Web950d935, SDK/MCP16f7dd2. This is a functional roadmap slice, not overall roadmap completion. Future work: batch/new-file account drafts, cross-repository feed and migration backlog; retain user priority on implementation and only lightweight necessary verification. No merge/tag/release authorized.
+
+### R5 started after current-main reconciliation
+
+Merged upstream f823813 into work branch as8293e69, resolved prepare-release dependency to keep both cached checks and Windows artifacts. Native Windows40965818005 still in Test. Full Web40965163166 on old52ad4cc has failed browser jobs but overall still running; logs unavailable until completion, do not rerun wholesale.
+
+R5 contract: EventService.ReplayMany/SubscribeMany, /v1/events/replay and /v1/events; events.multi_repo capability, explicit max30 repos; opaque per-repo cursor bound to normalized scope/topics. Empty cursor captures now; from_start supports deliberate historical replay. Envelope{cursor,event?}; checkpoints/heartbeats contain no Event. Replay bounded1000 events and4096 examined audit rows. Home reuses full snapshots plus refresh after connection/reconnection; only first30 loaded repos live, rest continue bounded polling. Basic builds only; no new test matrices.
+
+Next M1 chosen: normalized bounded issues/comments manifest import into an existing repository, plus thin GitHub/GitLab CLI exporters. Existing Git migration remains unchanged. Preview validates/counts/losses/conflicts and returns digest; explicit apply matches digest. Durable per-source issue mapping+content hash makes retries/resume skip exact matches and reject changed source. Importer remains the authenticated actor; original author/time/URL preserved as external provenance, not identity grants. Per-issue transactions include comments and mapping atomically. Keep provider tokens in CLI/export process, never send to server. Start after R5 committed.
+
+R5 delivered: backendcb69c05, Web00ded3d, CLI1cf3e74, SDK/MCPf574229. Basic builds/types passed and one small two-repository replay/resume/denied-scope/SSE smoke passed. No broad test or mutation runs. M1 issues/comments import is now active across core, Web, CLI import/provider exporters and SDK/MCP. Contract uses source manifest, explicit preview+digest apply, durable mapping and create-only conflicts.
diff --git a/docs/architecture/adr-traceability.md b/docs/architecture/adr-traceability.md
index 1201b4a3..ca93fbef 100644
--- a/docs/architecture/adr-traceability.md
+++ b/docs/architecture/adr-traceability.md
@@ -148,3 +148,7 @@ The [continuous checkpoint](../../dev/continuous-progress.md) records pending CI
 ## ADR-0043 — private single-file drafts
 
 [ADR-0043](../adr/0043-private-file-drafts.md) stores replacement bytes privately and retains the original revision as a GC root. Web, CLI, SDK and MCP implement explicit save/restore/clear; Web also lists saved paths. Existing-file scope only. Basic builds/type checks passed; extended test matrices were not run for this slice.
+
+## ADR-0044 — cross-repository event feed
+
+[ADR-0044](../adr/0044-cross-repository-events.md) reuses repository audit logs with a bounded, scoped cursor vector. Home, CLI and SDKs consume one stream; MCP provides bounded replay. A focused real-server check covers two-repository pagination/resume, denied scope and SSE cursor restoration. Basic builds are used for the client changes, without another broad test matrix.
diff --git a/docs/guides/sdks.md b/docs/guides/sdks.md
index f5c9a7b9..c07649fd 100644
--- a/docs/guides/sdks.md
+++ b/docs/guides/sdks.md
@@ -474,6 +474,16 @@ Both generated HTTP SDKs expose `tree.search`. Start with a branch or changeset
 
 A page can have no matches and still contain a continuation token because scanning is bounded. Read the `skipped_binary` and `skipped_large` counters before treating the result as exhaustive. See the [protocol contract](../protocol/agwp-v1.md#literal-content-search) for the exact limits.
 
+## Several repositories in one event feed
+
+On servers advertising `events.multi_repo`, replay and subscribe can take an explicit
+set of up to thirty repository names. Reuse the returned opaque cursor with the same
+repository and topic set. Empty cursor starts at the current positions; `from_start`
+requests historical replay. A checkpoint envelope has no event and should still have
+its cursor saved. Events have independent per-repository sequence numbers, so do not
+sort or deduplicate them using one global sequence. Both SDKs reuse their existing
+subscription transport and reconnect from the latest cursor.
+
 ## Regenerating the types
 
 The messages come from `docs/protocol/openapi.json`, which `ag-server` serves at `/openapi.json` and a Rust test keeps in

From 863731d0624183ae4cabb319f850ef2693397bca Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:51:12 +0000
Subject: [PATCH 37/41] feat(migration): import issue snapshots with durable
 source mappings

---
 crates/ag-client/src/lib.rs                   |   4 +-
 crates/ag-integrate/src/issue_import.rs       | 277 ++++++++++++++++++
 crates/ag-integrate/src/lib.rs                |   5 +
 crates/ag-protocol/proto/agwp/v1/agwp.proto   |  24 ++
 crates/ag-protocol/src/lib.rs                 |   4 +
 crates/ag-server/src/api/issue_import.rs      |  50 ++++
 crates/ag-server/src/api/mod.rs               |   1 +
 crates/ag-server/src/grpc.rs                  |  13 +
 crates/ag-server/src/http.rs                  |  27 ++
 .../postgres/0013_issue_imports.sql           |  11 +
 .../migrations/sqlite/0013_issue_imports.sql  |  11 +
 crates/ag-storage/src/meta/issue_imports.rs   |  51 ++++
 crates/ag-storage/src/meta/migrate.rs         |  12 +-
 crates/ag-storage/src/meta/mod.rs             |   2 +
 docs/adr/0045-hosting-issue-import.md         |  23 ++
 docs/adr/README.md                            |   2 +
 docs/protocol/openapi.json                    | 242 +++++++++++++++
 migrations/postgres/0013_issue_imports.sql    |  11 +
 migrations/sqlite/0013_issue_imports.sql      |  11 +
 proto/agwp/v1/agwp.proto                      |  24 ++
 20 files changed, 803 insertions(+), 2 deletions(-)
 create mode 100644 crates/ag-integrate/src/issue_import.rs
 create mode 100644 crates/ag-server/src/api/issue_import.rs
 create mode 100644 crates/ag-storage/migrations/postgres/0013_issue_imports.sql
 create mode 100644 crates/ag-storage/migrations/sqlite/0013_issue_imports.sql
 create mode 100644 crates/ag-storage/src/meta/issue_imports.rs
 create mode 100644 docs/adr/0045-hosting-issue-import.md
 create mode 100644 migrations/postgres/0013_issue_imports.sql
 create mode 100644 migrations/sqlite/0013_issue_imports.sql

diff --git a/crates/ag-client/src/lib.rs b/crates/ag-client/src/lib.rs
index 9d1a09df..31b06cb6 100644
--- a/crates/ag-client/src/lib.rs
+++ b/crates/ag-client/src/lib.rs
@@ -18,7 +18,8 @@ use ag_protocol::v1::{
     admin_service_client::AdminServiceClient, agent_service_client::AgentServiceClient,
     event_service_client::EventServiceClient, execution_service_client::ExecutionServiceClient,
     file_draft_service_client::FileDraftServiceClient, history_service_client::HistoryServiceClient,
-    integration_service_client::IntegrationServiceClient, object_service_client::ObjectServiceClient,
+    integration_service_client::IntegrationServiceClient, issue_service_client::IssueServiceClient,
+    object_service_client::ObjectServiceClient,
     proposal_service_client::ProposalServiceClient, protocol_service_client::ProtocolServiceClient,
     repository_service_client::RepositoryServiceClient, stream_service_client::StreamServiceClient,
     tree_service_client::TreeServiceClient, workspace_service_client::WorkspaceServiceClient,
@@ -207,6 +208,7 @@ impl Client {
         workspaces => WorkspaceServiceClient,
         file_drafts => FileDraftServiceClient,
         proposals => ProposalServiceClient,
+        issues => IssueServiceClient,
         integration => IntegrationServiceClient,
         agents => AgentServiceClient,
         events => EventServiceClient,
diff --git a/crates/ag-integrate/src/issue_import.rs b/crates/ag-integrate/src/issue_import.rs
new file mode 100644
index 00000000..581decc1
--- /dev/null
+++ b/crates/ag-integrate/src/issue_import.rs
@@ -0,0 +1,277 @@
+//! Bounded import of normalized hosting issues and comments, one atomic issue at a time.
+use crate::{Error, Repository, Result};
+use ag_storage::meta::{IssueActivityRow, IssueImportRow, IssueRow};
+use ag_types::{Identity, Timestamp};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::collections::BTreeSet;
+
+/// Maximum encoded manifest size.
+pub const MAX_ISSUE_IMPORT_BYTES: usize = 4 * 1024 * 1024;
+/// Provider-neutral, deliberately limited import format.
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct IssueImportManifest {
+    /// Format version, currently one.
+    pub version: u32,
+    /// github or gitlab.
+    pub provider: String,
+    /// HTTPS source repository URL.
+    pub source_repo: String,
+    /// Explicitly unsupported source data; application requires acknowledgement.
+    #[serde(default)]
+    pub unsupported: Vec<String>,
+    /// At most one hundred source issues.
+    pub issues: Vec<SourceIssue>,
+}
+/// One original issue and its bounded comments.
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SourceIssue {
+    /// Provider-local number or iid, represented as text.
+    pub source_id: String,
+    /// Original title.
+    pub title: String,
+    /// Original body.
+    pub body: String,
+    /// open or closed.
+    pub state: String,
+    /// Original external display name, never used as local identity.
+    pub author: String,
+    /// Original issue URL.
+    pub url: String,
+    /// Original creation time.
+    pub created_at_ms: i64,
+    /// Original update time.
+    pub updated_at_ms: i64,
+    /// Original comments.
+    #[serde(default)]
+    pub comments: Vec<SourceIssueComment>,
+}
+/// An external comment, identified within its source issue.
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SourceIssueComment {
+    /// Stable provider comment id.
+    pub source_id: String,
+    /// Original text.
+    pub body: String,
+    /// Original external display name.
+    pub author: String,
+    /// Original comment URL.
+    pub url: String,
+    /// Original creation time.
+    pub created_at_ms: i64,
+}
+/// Reviewable import plan.
+pub struct IssueImportPreview {
+    /// Canonical manifest digest required by apply.
+    pub digest: String,
+    /// Total source issues.
+    pub issues: u32,
+    /// Total source comments.
+    pub comments: u32,
+    /// New local issues.
+    pub create_count: u32,
+    /// Identical completed imports.
+    pub skip_count: u32,
+    /// Unsupported metadata acknowledged on application.
+    pub warnings: Vec<String>,
+    /// Existing mappings with changed source content.
+    pub conflicts: Vec<String>,
+}
+/// External-to-local issue mapping in an import response.
+pub struct ImportedIssueMapping {
+    /// Provider-local issue number or iid.
+    pub source_id: String,
+    /// Local issue number.
+    pub number: u64,
+}
+/// Result of a resumable import.
+pub struct IssueImportResult {
+    /// Issues created by this invocation.
+    pub created: u32,
+    /// Previously imported identical issues.
+    pub skipped: u32,
+    /// Mappings for every requested source issue.
+    pub mappings: Vec<ImportedIssueMapping>,
+}
+fn digest(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+fn source_text(value: &str, max: usize, label: &str) -> Result<()> {
+    if value.trim().is_empty() || value.len() > max || value.contains(['\0', '\r', '\n']) {
+        return Err(Error::Invalid(format!("invalid {label}")));
+    }
+    Ok(())
+}
+fn source_url(value: &str) -> Result<()> {
+    if !value.starts_with("https://")
+        || value.len() > 2048
+        || value.chars().any(char::is_whitespace)
+        || value.contains('\0')
+    {
+        return Err(Error::Invalid("source URLs must be bounded HTTPS URLs".into()));
+    }
+    Ok(())
+}
+fn canonical_repo(value: &str) -> Result<String> {
+    source_url(value)?;
+    if value.contains(['?', '#']) {
+        return Err(Error::Invalid("source repository URL cannot contain query or fragment".into()));
+    }
+    let (host, path) =
+        value[8..].split_once('/').ok_or_else(|| Error::Invalid("source repository URL needs a path".into()))?;
+    if host.is_empty() || host.contains('@') || path.trim_matches('/').is_empty() {
+        return Err(Error::Invalid("invalid source repository URL".into()));
+    }
+    Ok(format!("https://{}/{}", host.to_ascii_lowercase(), path.trim_end_matches('/')))
+}
+fn escaped(value: &str) -> String {
+    value.chars().flat_map(|ch| if "\\`*_{}[]<>()!".contains(ch) { vec!['\\', ch] } else { vec![ch] }).collect()
+}
+fn body_with_source(provider: &str, author: &str, url: &str, created: i64, body: &str, limit: usize) -> Result<String> {
+    source_text(author, 256, "source author")?;
+    source_url(url)?;
+    if created < 0 || body.contains('\0') {
+        return Err(Error::Invalid("invalid source timestamp or body".into()));
+    }
+    let body = format!(
+        "> Imported from {}: {}\n> Original author: {} · {}\n\n{}",
+        provider,
+        escaped(url),
+        escaped(author),
+        Timestamp::from_millis(created),
+        body
+    );
+    if body.len() > limit {
+        return Err(Error::Invalid(format!("imported text plus provenance exceeds {limit} UTF-8 bytes")));
+    }
+    Ok(body)
+}
+fn parse(raw: &str) -> Result<IssueImportManifest> {
+    if raw.len() > MAX_ISSUE_IMPORT_BYTES {
+        return Err(Error::Invalid("issue import manifest exceeds 4 MiB".into()));
+    }
+    let mut m: IssueImportManifest =
+        serde_json::from_str(raw).map_err(|e| Error::Invalid(format!("invalid issue import manifest: {e}")))?;
+    if m.version != 1 || !["github", "gitlab"].contains(&m.provider.as_str()) || m.issues.len() > 100 {
+        return Err(Error::Invalid("expected manifest version1, github/gitlab and at most100 issues".into()));
+    }
+    m.source_repo = canonical_repo(&m.source_repo)?;
+    if m.unsupported.len() > 100 {
+        return Err(Error::Invalid("at most100 unsupported metadata warnings".into()));
+    }
+    for warning in &m.unsupported {
+        source_text(warning, 240, "unsupported metadata warning")?;
+    }
+    m.unsupported.sort();
+    m.unsupported.dedup();
+    let mut ids = BTreeSet::new();
+    let mut comments = 0usize;
+    for issue in &mut m.issues {
+        source_text(&issue.source_id, 128, "source issue id")?;
+        source_text(&issue.title, 240, "issue title")?;
+        if !ids.insert(issue.source_id.clone()) {
+            return Err(Error::Invalid("duplicate source issue id".into()));
+        }
+        if !["open", "closed"].contains(&issue.state.as_str()) || issue.updated_at_ms < issue.created_at_ms {
+            return Err(Error::Invalid("invalid source issue state or timestamps".into()));
+        }
+        body_with_source(&m.provider, &issue.author, &issue.url, issue.created_at_ms, &issue.body, 65536)?;
+        comments += issue.comments.len();
+        if comments > 1000 {
+            return Err(Error::Invalid("issue import exceeds1000 comments".into()));
+        }
+        let mut comment_ids = BTreeSet::new();
+        for comment in &issue.comments {
+            source_text(&comment.source_id, 128, "source comment id")?;
+            if !comment_ids.insert(&comment.source_id) {
+                return Err(Error::Invalid("duplicate source comment id".into()));
+            }
+            body_with_source(&m.provider, &comment.author, &comment.url, comment.created_at_ms, &comment.body, 16384)?;
+        }
+        issue.comments.sort_by(|a, b| (a.created_at_ms, &a.source_id).cmp(&(b.created_at_ms, &b.source_id)));
+    }
+    m.issues.sort_by(|a, b| a.source_id.cmp(&b.source_id));
+    Ok(m)
+}
+fn canonical<T: Serialize>(value: &T) -> Result<String> {
+    serde_json::to_string(value).map_err(|e| Error::Invalid(e.to_string()))
+}
+impl Repository {
+    /// Validates source records and reports changed mappings without writing anything.
+    pub fn preview_issue_import(&self, raw: &str) -> Result<IssueImportPreview> {
+        let m = parse(raw)?;
+        let mut plan = IssueImportPreview {
+            digest: digest(canonical(&m)?.as_bytes()),
+            issues: m.issues.len() as u32,
+            comments: m.issues.iter().map(|i| i.comments.len() as u32).sum(),
+            create_count: 0,
+            skip_count: 0,
+            warnings: m.unsupported.clone(),
+            conflicts: vec![],
+        };
+        self.meta.read(|tx| {
+            for issue in &m.issues {
+                match tx.issue_import(&m.provider, &m.source_repo, &issue.source_id)? {
+                    None => plan.create_count += 1,
+                    Some(row) if row.digest == digest(serde_json::to_string(issue)?.as_bytes()) => plan.skip_count += 1,
+                    Some(_) => plan
+                        .conflicts
+                        .push(format!("source issue {} was already imported with different content", issue.source_id)),
+                }
+            }
+            Ok(())
+        })?;
+        Ok(plan)
+    }
+    /// Imports one complete issue per transaction; retry skips committed identical snapshots.
+    pub fn apply_issue_import(
+        &self,
+        raw: &str,
+        expected_digest: &str,
+        allow_unsupported: bool,
+        actor: &Identity,
+    ) -> Result<IssueImportResult> {
+        let m = parse(raw)?;
+        let plan = self.preview_issue_import(raw)?;
+        if plan.digest != expected_digest {
+            return Err(Error::Conflict("import manifest changed since preview".into()));
+        }
+        if !plan.conflicts.is_empty() {
+            return Err(Error::Conflict(plan.conflicts.join("; ")));
+        }
+        if !plan.warnings.is_empty() && !allow_unsupported {
+            return Err(Error::Invalid("unsupported metadata requires explicit allow_unsupported".into()));
+        }
+        let mut result = IssueImportResult { created: 0, skipped: 0, mappings: vec![] };
+        for issue in &m.issues {
+            let source_json = canonical(issue)?;
+            let source_digest = digest(source_json.as_bytes());
+            let (number,created)=self.meta.write_with_error(|tx| {
+                if let Some(existing)=tx.issue_import(&m.provider,&m.source_repo,&issue.source_id)? {
+                    if existing.digest!=source_digest {return Err(Error::Conflict(format!("source issue {} changed during import",issue.source_id)));}
+                    return Ok((existing.issue_number,false));
+                }
+                let row=tx.insert_imported_issue(&IssueRow{number:0,title:issue.title.clone(),body:body_with_source(&m.provider,&issue.author,&issue.url,issue.created_at_ms,&issue.body,65536)?,author:actor.to_string(),state:issue.state.clone(),created_at_ms:issue.created_at_ms,updated_at_ms:issue.updated_at_ms,revision:1,task_id:None})?;
+                tx.insert_imported_activity(&IssueActivityRow{id:0,issue_number:row.number,kind:"created".into(),body:String::new(),author:actor.to_string(),created_at_ms:issue.created_at_ms})?;
+                for comment in &issue.comments {
+                    tx.insert_imported_activity(&IssueActivityRow{id:0,issue_number:row.number,kind:"commented".into(),body:body_with_source(&m.provider,&comment.author,&comment.url,comment.created_at_ms,&comment.body,16384)?,author:actor.to_string(),created_at_ms:comment.created_at_ms})?;
+                }
+                tx.insert_issue_import(&IssueImportRow{provider:m.provider.clone(),source_repo:m.source_repo.clone(),source_id:issue.source_id.clone(),digest:source_digest.clone(),issue_number:row.number,source_json:source_json.clone(),imported_by:actor.to_string()})?;
+                let details=serde_json::json!({"number":row.number,"source_repo":m.source_repo,"source_id":issue.source_id,"provider":m.provider,"comments":issue.comments.len()});
+                tx.audit_append(actor.as_str(),"issue.imported",&format!("issue:{}",row.number),&details)?;
+                tx.outbox_push("issue",&details)?;
+                Ok((row.number,true))
+            })?;
+            if created {
+                result.created += 1
+            } else {
+                result.skipped += 1
+            };
+            result.mappings.push(ImportedIssueMapping { source_id: issue.source_id.clone(), number });
+        }
+        Ok(result)
+    }
+}
diff --git a/crates/ag-integrate/src/lib.rs b/crates/ag-integrate/src/lib.rs
index 8104f27f..b483e4a7 100644
--- a/crates/ag-integrate/src/lib.rs
+++ b/crates/ag-integrate/src/lib.rs
@@ -34,6 +34,7 @@ mod fsck;
 mod gc;
 mod history;
 mod integrate;
+mod issue_import;
 mod layout;
 mod prepare;
 mod publish;
@@ -61,6 +62,10 @@ pub use gc::{DEFAULT_GC_GRACE_MS, DEFAULT_REFLOG_RETENTION_MS, GcOptions, GcRepo
 pub use history::{HybridGraph, LogEntry};
 pub use integrate::ContentionPolicy;
 pub use integrate::{IntegrateRequest, MergePreview, RecoveryReport};
+pub use issue_import::{
+    ImportedIssueMapping, IssueImportManifest, IssueImportPreview, IssueImportResult, MAX_ISSUE_IMPORT_BYTES,
+    SourceIssue, SourceIssueComment,
+};
 pub use layout::{InitOptions, Layout, RepoConfig};
 pub use prepare::{Preparation, PrepareContext, ValidationState};
 pub use publish::PublishResult;
diff --git a/crates/ag-protocol/proto/agwp/v1/agwp.proto b/crates/ag-protocol/proto/agwp/v1/agwp.proto
index 3d96615a..6b39e337 100644
--- a/crates/ag-protocol/proto/agwp/v1/agwp.proto
+++ b/crates/ag-protocol/proto/agwp/v1/agwp.proto
@@ -2120,7 +2120,31 @@ message UpdateIssueRequest {
 message AddIssueCommentRequest { string repo = 1; uint64 number = 2; string body = 3; string idempotency_key = 4; }
 message ListIssueActivityRequest { string repo = 1; uint64 number = 2; uint32 page_size = 3; string page_token = 4; }
 message ListIssueActivityResponse { repeated IssueActivity activity = 1; string next_page_token = 2; }
+message PreviewIssueImportRequest { string repo = 1; string manifest_json = 2; }
+message ApplyIssueImportRequest {
+  string repo = 1;
+  string manifest_json = 2;
+  string expected_digest = 3;
+  bool allow_unsupported = 4;
+}
+message IssueImportPreview {
+  string digest = 1;
+  uint32 issues = 2;
+  uint32 comments = 3;
+  uint32 create_count = 4;
+  uint32 skip_count = 5;
+  repeated string warnings = 6;
+  repeated string conflicts = 7;
+}
+message ImportedIssueMapping { string source_id = 1; uint64 number = 2; }
+message IssueImportResult {
+  uint32 created = 1;
+  uint32 skipped = 2;
+  repeated ImportedIssueMapping mappings = 3;
+}
 service IssueService {
+  rpc PreviewImport(PreviewIssueImportRequest) returns (IssueImportPreview);
+  rpc ApplyImport(ApplyIssueImportRequest) returns (IssueImportResult);
   rpc Create(CreateIssueRequest) returns (Issue);
   rpc Get(GetIssueRequest) returns (Issue);
   rpc List(ListIssuesRequest) returns (ListIssuesResponse);
diff --git a/crates/ag-protocol/src/lib.rs b/crates/ag-protocol/src/lib.rs
index f34df7d2..f7c1016a 100644
--- a/crates/ag-protocol/src/lib.rs
+++ b/crates/ag-protocol/src/lib.rs
@@ -118,6 +118,9 @@ pub mod features {
     /// A bounded event stream with independent cursors for explicit repositories.
     pub const EVENTS_MULTI_REPO: &str = "events.multi_repo";
 
+    /// Previewed resumable import of normalized hosting issues and comments.
+    pub const ISSUES_IMPORT: &str = "issues.import";
+
     /// Every feature this implementation knows.
     pub const ALL: &[&str] = &[
         EVENTS_REPLAY,
@@ -143,6 +146,7 @@ pub mod features {
         POLICY_RESOLVED_THREADS,
         TREE_SEARCH,
         ISSUES,
+        ISSUES_IMPORT,
         TASK_SCHEDULING,
         RUN_LOOKUP,
         PROPOSAL_COMMENTS,
diff --git a/crates/ag-server/src/api/issue_import.rs b/crates/ag-server/src/api/issue_import.rs
new file mode 100644
index 00000000..8d57ed42
--- /dev/null
+++ b/crates/ag-server/src/api/issue_import.rs
@@ -0,0 +1,50 @@
+//! Preview and explicit application of normalized hosting issues.
+use super::require;
+use crate::app::{App, Call};
+use crate::authz::Cap;
+use crate::error::ApiResult;
+use ag_protocol::v1;
+
+impl App {
+    /// Validates and previews without writing repository state.
+    pub async fn preview_issue_import(
+        &self,
+        call: &Call,
+        req: v1::PreviewIssueImportRequest,
+    ) -> ApiResult<v1::IssueImportPreview> {
+        self.with_repo(call, require(&req.repo, "repo")?, Cap::IssueWrite, None, move |repo, _| {
+            let p = repo.preview_issue_import(&req.manifest_json)?;
+            Ok(v1::IssueImportPreview {
+                digest: p.digest,
+                issues: p.issues,
+                comments: p.comments,
+                create_count: p.create_count,
+                skip_count: p.skip_count,
+                warnings: p.warnings,
+                conflicts: p.conflicts,
+            })
+        })
+        .await
+    }
+    /// Applies exactly the previewed manifest, skipping committed identical source issues.
+    pub async fn apply_issue_import(
+        &self,
+        call: &Call,
+        req: v1::ApplyIssueImportRequest,
+    ) -> ApiResult<v1::IssueImportResult> {
+        self.with_repo_mut(call, require(&req.repo, "repo")?, Cap::IssueWrite, None, move |repo, actor| {
+            let result =
+                repo.apply_issue_import(&req.manifest_json, &req.expected_digest, req.allow_unsupported, actor)?;
+            Ok(v1::IssueImportResult {
+                created: result.created,
+                skipped: result.skipped,
+                mappings: result
+                    .mappings
+                    .into_iter()
+                    .map(|m| v1::ImportedIssueMapping { source_id: m.source_id, number: m.number })
+                    .collect(),
+            })
+        })
+        .await
+    }
+}
diff --git a/crates/ag-server/src/api/mod.rs b/crates/ag-server/src/api/mod.rs
index 6ab0b04a..642dcf47 100644
--- a/crates/ag-server/src/api/mod.rs
+++ b/crates/ag-server/src/api/mod.rs
@@ -21,6 +21,7 @@ mod events_many;
 mod file_drafts;
 mod history;
 mod integration;
+mod issue_import;
 mod issues;
 mod jobs;
 mod objects;
diff --git a/crates/ag-server/src/grpc.rs b/crates/ag-server/src/grpc.rs
index cce2170c..3aaaaecd 100644
--- a/crates/ag-server/src/grpc.rs
+++ b/crates/ag-server/src/grpc.rs
@@ -783,6 +783,19 @@ impl ExecutionService for Grpc {
 
 #[tonic::async_trait]
 impl IssueService for Grpc {
+    async fn preview_import(
+        &self,
+        request: Request<v1::PreviewIssueImportRequest>,
+    ) -> Result<Response<v1::IssueImportPreview>, Status> {
+        unary!(self, request, "issue.import_preview", preview_issue_import)
+    }
+    async fn apply_import(
+        &self,
+        request: Request<v1::ApplyIssueImportRequest>,
+    ) -> Result<Response<v1::IssueImportResult>, Status> {
+        unary!(self, request, "issue.import_apply", apply_issue_import)
+    }
+
     async fn create(&self, request: Request<v1::CreateIssueRequest>) -> Result<Response<v1::Issue>, Status> {
         unary!(self, request, "issue.create", create_issue)
     }
diff --git a/crates/ag-server/src/http.rs b/crates/ag-server/src/http.rs
index 55d9bf46..84a54abe 100644
--- a/crates/ag-server/src/http.rs
+++ b/crates/ag-server/src/http.rs
@@ -1820,6 +1820,33 @@ pub fn api_router(app: App) -> (Router, Vec<RouteMeta>) {
     );
     r = r.route("/v1/events", get(subscribe_many_http));
 
+    route!(
+        r,
+        meta,
+        post,
+        "post",
+        "/v1/repos/{owner}/{rname}/issues/import/preview",
+        "issue.import_preview",
+        "Issues",
+        "Preview normalized hosting issues and comments",
+        v1::PreviewIssueImportRequest,
+        v1::IssueImportPreview,
+        preview_issue_import
+    );
+    route!(
+        r,
+        meta,
+        post,
+        "post",
+        "/v1/repos/{owner}/{rname}/issues/import/apply",
+        "issue.import_apply",
+        "Issues",
+        "Apply the inspected import manifest digest",
+        v1::ApplyIssueImportRequest,
+        v1::IssueImportResult,
+        apply_issue_import
+    );
+
     // ---- events ---------------------------------------------------------------------------------------------
     meta.push(RouteMeta::json::<v1::ReplayRequest, v1::ReplayResponse>(
         "get",
diff --git a/crates/ag-storage/migrations/postgres/0013_issue_imports.sql b/crates/ag-storage/migrations/postgres/0013_issue_imports.sql
new file mode 100644
index 00000000..43d3c14f
--- /dev/null
+++ b/crates/ag-storage/migrations/postgres/0013_issue_imports.sql
@@ -0,0 +1,11 @@
+CREATE TABLE issue_imports (
+    provider TEXT NOT NULL,
+    source_repo TEXT NOT NULL,
+    source_id TEXT NOT NULL,
+    digest TEXT NOT NULL,
+    issue_number BIGINT NOT NULL REFERENCES issues(number),
+    source_json TEXT NOT NULL,
+    imported_by TEXT NOT NULL,
+    imported_at BIGINT NOT NULL,
+    PRIMARY KEY (provider, source_repo, source_id)
+);
diff --git a/crates/ag-storage/migrations/sqlite/0013_issue_imports.sql b/crates/ag-storage/migrations/sqlite/0013_issue_imports.sql
new file mode 100644
index 00000000..43d3c14f
--- /dev/null
+++ b/crates/ag-storage/migrations/sqlite/0013_issue_imports.sql
@@ -0,0 +1,11 @@
+CREATE TABLE issue_imports (
+    provider TEXT NOT NULL,
+    source_repo TEXT NOT NULL,
+    source_id TEXT NOT NULL,
+    digest TEXT NOT NULL,
+    issue_number BIGINT NOT NULL REFERENCES issues(number),
+    source_json TEXT NOT NULL,
+    imported_by TEXT NOT NULL,
+    imported_at BIGINT NOT NULL,
+    PRIMARY KEY (provider, source_repo, source_id)
+);
diff --git a/crates/ag-storage/src/meta/issue_imports.rs b/crates/ag-storage/src/meta/issue_imports.rs
new file mode 100644
index 00000000..248a3ed3
--- /dev/null
+++ b/crates/ag-storage/src/meta/issue_imports.rs
@@ -0,0 +1,51 @@
+//! Durable mapping from an external issue to its imported local issue.
+use super::{IssueActivityRow, IssueRow, MetaError, Tx, db::params};
+
+/// The imported source snapshot, retained without impersonating its original author.
+#[derive(Clone, Debug)]
+pub struct IssueImportRow {
+    /// Hosting provider.
+    pub provider: String,
+    /// Canonical source repository URL.
+    pub source_repo: String,
+    /// Provider-local issue number or iid.
+    pub source_id: String,
+    /// Digest of the complete source issue and its comments.
+    pub digest: String,
+    /// Created local issue.
+    pub issue_number: u64,
+    /// Canonical source issue JSON, including original authors, times and URLs.
+    pub source_json: String,
+    /// Authenticated importing actor.
+    pub imported_by: String,
+}
+impl Tx<'_> {
+    /// Reads a durable source mapping.
+    pub fn issue_import(
+        &self,
+        provider: &str,
+        source_repo: &str,
+        source_id: &str,
+    ) -> Result<Option<IssueImportRow>, MetaError> {
+        self.conn.query_opt("SELECT digest,issue_number,source_json,imported_by FROM issue_imports WHERE provider=?1 AND source_repo=?2 AND source_id=?3", &params![provider,source_repo,source_id])?.map(|row|Ok(IssueImportRow{provider:provider.into(),source_repo:source_repo.into(),source_id:source_id.into(),digest:row.string(0)?,issue_number:row.i64(1)? as u64,source_json:row.string(2)?,imported_by:row.string(3)?})).transpose()
+    }
+    /// Inserts an issue with external state and timestamps in the caller's transaction.
+    pub fn insert_imported_issue(&self, row: &IssueRow) -> Result<IssueRow, MetaError> {
+        let search = format!("{}\n{}", row.title, row.body).to_lowercase();
+        let number=self.conn.query_one("INSERT INTO issues(title,body,author,state,created_at,updated_at,revision,task_id,search_text) VALUES(?1,?2,?3,?4,?5,?6,1,NULL,?7) RETURNING number", &params![&row.title,&row.body,&row.author,&row.state,row.created_at_ms,row.updated_at_ms,search])?.i64(0)? as u64;
+        self.issue(number)?.ok_or_else(|| MetaError::Corrupt("imported issue missing".into()))
+    }
+    /// Adds source-timed activity; its author remains the authenticated importer.
+    pub fn insert_imported_activity(&self, row: &IssueActivityRow) -> Result<(), MetaError> {
+        self.conn.execute(
+            "INSERT INTO issue_activity(issue_number,kind,body,author,created_at) VALUES(?1,?2,?3,?4,?5)",
+            &params![row.issue_number as i64, &row.kind, &row.body, &row.author, row.created_at_ms],
+        )?;
+        Ok(())
+    }
+    /// Commits the mapping in the same transaction as the issue and all comments.
+    pub fn insert_issue_import(&self, row: &IssueImportRow) -> Result<(), MetaError> {
+        self.conn.execute("INSERT INTO issue_imports(provider,source_repo,source_id,digest,issue_number,source_json,imported_by,imported_at) VALUES(?1,?2,?3,?4,?5,?6,?7,?8)", &params![&row.provider,&row.source_repo,&row.source_id,&row.digest,row.issue_number as i64,&row.source_json,&row.imported_by,self.now().as_millis()])?;
+        Ok(())
+    }
+}
diff --git a/crates/ag-storage/src/meta/migrate.rs b/crates/ag-storage/src/meta/migrate.rs
index c73ba30d..f0660232 100644
--- a/crates/ag-storage/src/meta/migrate.rs
+++ b/crates/ag-storage/src/meta/migrate.rs
@@ -34,7 +34,7 @@ impl Migration {
 }
 
 /// Schema version understood by this build.
-pub const SCHEMA_VERSION: i64 = 12;
+pub const SCHEMA_VERSION: i64 = 13;
 
 pub(crate) const SQLITE_MIGRATIONS: &[Migration] = &[
     Migration { version: 1, name: "0001_init.sql", sql: include_str!("../../migrations/sqlite/0001_init.sql") },
@@ -85,6 +85,11 @@ pub(crate) const SQLITE_MIGRATIONS: &[Migration] = &[
         name: "0012_file_drafts.sql",
         sql: include_str!("../../migrations/sqlite/0012_file_drafts.sql"),
     },
+    Migration {
+        version: 13,
+        name: "0013_issue_imports.sql",
+        sql: include_str!("../../migrations/sqlite/0013_issue_imports.sql"),
+    },
 ];
 
 pub(crate) const POSTGRES_MIGRATIONS: &[Migration] = &[
@@ -136,6 +141,11 @@ pub(crate) const POSTGRES_MIGRATIONS: &[Migration] = &[
         name: "0012_file_drafts.sql",
         sql: include_str!("../../migrations/postgres/0012_file_drafts.sql"),
     },
+    Migration {
+        version: 13,
+        name: "0013_issue_imports.sql",
+        sql: include_str!("../../migrations/postgres/0013_issue_imports.sql"),
+    },
 ];
 
 #[cfg(test)]
diff --git a/crates/ag-storage/src/meta/mod.rs b/crates/ag-storage/src/meta/mod.rs
index 207c95d5..c7637e63 100644
--- a/crates/ag-storage/src/meta/mod.rs
+++ b/crates/ag-storage/src/meta/mod.rs
@@ -34,6 +34,7 @@
 //! backend only decides how a transaction is opened and closed.
 
 pub mod db;
+mod issue_imports;
 mod issues;
 mod jobs;
 mod migrate;
@@ -70,6 +71,7 @@ pub use comment_drafts::CommentDraftRow;
 pub use db::{Dialect, Param, Row, Value};
 pub use file_drafts::FileDraftRow;
 pub use intents::{IntentRow, IntentState, NewIntent};
+pub use issue_imports::IssueImportRow;
 pub use issues::{IssueActivityRow, IssueFilter, IssueRow};
 pub use jobs::{DEFAULT_JOB_ATTEMPTS, JobRow, JobState, NewJob};
 pub use migrate::{Migration, SCHEMA_VERSION};
diff --git a/docs/adr/0045-hosting-issue-import.md b/docs/adr/0045-hosting-issue-import.md
new file mode 100644
index 00000000..1620645b
--- /dev/null
+++ b/docs/adr/0045-hosting-issue-import.md
@@ -0,0 +1,23 @@
+# ADR 0045: resumable hosting issue import
+
+Status: accepted.
+
+## Decision
+
+Import bounded, provider-neutral issue/comment manifests into an existing repository.
+GitHub/GitLab exporters run in the CLI, so provider tokens never enter the server.
+Preview validates the full manifest and reports counts, unsupported metadata and
+conflicts. Apply requires its canonical digest and explicit acknowledgement of any
+unsupported metadata. Nothing is truncated to fit a limit.
+
+Schema13 adds a durable mapping from provider/source repository/issue ID to local
+issue number, source digest and canonical source JSON. Each issue, comments, mapping
+and audit/outbox record commit in one transaction. Retrying an interrupted import
+skips identical completed issues; changed source content is rejected. This initial
+import does not synchronize later source changes or overwrite local edits.
+
+The authenticated importer remains the local actor. Original authors, URLs and times
+are preserved as visible provenance and in the source snapshot; original issue state
+and timestamps are retained. Imported identities grant no local access. Manifests
+are limited to4MiB,100 issues and1000 comments and existing text limits still apply.
+Back up before upgrading and restore that backup to downgrade.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 5e785cc4..32ae980c 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -64,3 +64,5 @@ which test: [ADR traceability](../architecture/adr-traceability.md).
 - [0043 — Private single-file drafts](0043-private-file-drafts.md)
 
 - [0044 — Cross-repository events](0044-cross-repository-events.md)
+
+- [0045 — Hosting issue import](0045-hosting-issue-import.md)
diff --git a/docs/protocol/openapi.json b/docs/protocol/openapi.json
index 095f9c06..8db81771 100644
--- a/docs/protocol/openapi.json
+++ b/docs/protocol/openapi.json
@@ -214,6 +214,27 @@
         },
         "type": "object"
       },
+      "ApplyIssueImportRequest": {
+        "properties": {
+          "allow_unsupported": {
+            "default": false,
+            "type": "boolean"
+          },
+          "expected_digest": {
+            "default": "",
+            "type": "string"
+          },
+          "manifest_json": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "AssignTaskRequest": {
         "properties": {
           "agent": {
@@ -2380,6 +2401,21 @@
         },
         "type": "object"
       },
+      "ImportedIssueMapping": {
+        "properties": {
+          "number": {
+            "default": 0,
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "source_id": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "IntegrateRequest": {
         "properties": {
           "fencing_tokens": {
@@ -2589,6 +2625,77 @@
         },
         "type": "object"
       },
+      "IssueImportPreview": {
+        "properties": {
+          "comments": {
+            "default": 0,
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "conflicts": {
+            "default": [],
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "create_count": {
+            "default": 0,
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "digest": {
+            "default": "",
+            "type": "string"
+          },
+          "issues": {
+            "default": 0,
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "skip_count": {
+            "default": 0,
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "warnings": {
+            "default": [],
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "IssueImportResult": {
+        "properties": {
+          "created": {
+            "default": 0,
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "mappings": {
+            "default": [],
+            "items": {
+              "$ref": "#/components/schemas/ImportedIssueMapping"
+            },
+            "type": "array"
+          },
+          "skipped": {
+            "default": 0,
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
       "Job": {
         "properties": {
           "attempts": {
@@ -4091,6 +4198,19 @@
         },
         "type": "object"
       },
+      "PreviewIssueImportRequest": {
+        "properties": {
+          "manifest_json": {
+            "default": "",
+            "type": "string"
+          },
+          "repo": {
+            "default": "",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
       "Principal": {
         "properties": {
           "credential_id": {
@@ -8925,6 +9045,128 @@
         ]
       }
     },
+    "/v1/repos/{owner}/{rname}/issues/import/apply": {
+      "post": {
+        "operationId": "issue.import_apply",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ApplyIssueImportRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/IssueImportResult"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Apply the inspected import manifest digest",
+        "tags": [
+          "Issues"
+        ]
+      }
+    },
+    "/v1/repos/{owner}/{rname}/issues/import/preview": {
+      "post": {
+        "operationId": "issue.import_preview",
+        "parameters": [
+          {
+            "description": "Repository owner (first half of owner/name)",
+            "in": "path",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Repository name (second half of owner/name)",
+            "in": "path",
+            "name": "rname",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PreviewIssueImportRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/IssueImportPreview"
+                }
+              }
+            },
+            "description": "Success"
+          },
+          "default": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Preview normalized hosting issues and comments",
+        "tags": [
+          "Issues"
+        ]
+      }
+    },
     "/v1/repos/{owner}/{rname}/issues/{number}": {
       "get": {
         "operationId": "issue.get",
diff --git a/migrations/postgres/0013_issue_imports.sql b/migrations/postgres/0013_issue_imports.sql
new file mode 100644
index 00000000..43d3c14f
--- /dev/null
+++ b/migrations/postgres/0013_issue_imports.sql
@@ -0,0 +1,11 @@
+CREATE TABLE issue_imports (
+    provider TEXT NOT NULL,
+    source_repo TEXT NOT NULL,
+    source_id TEXT NOT NULL,
+    digest TEXT NOT NULL,
+    issue_number BIGINT NOT NULL REFERENCES issues(number),
+    source_json TEXT NOT NULL,
+    imported_by TEXT NOT NULL,
+    imported_at BIGINT NOT NULL,
+    PRIMARY KEY (provider, source_repo, source_id)
+);
diff --git a/migrations/sqlite/0013_issue_imports.sql b/migrations/sqlite/0013_issue_imports.sql
new file mode 100644
index 00000000..43d3c14f
--- /dev/null
+++ b/migrations/sqlite/0013_issue_imports.sql
@@ -0,0 +1,11 @@
+CREATE TABLE issue_imports (
+    provider TEXT NOT NULL,
+    source_repo TEXT NOT NULL,
+    source_id TEXT NOT NULL,
+    digest TEXT NOT NULL,
+    issue_number BIGINT NOT NULL REFERENCES issues(number),
+    source_json TEXT NOT NULL,
+    imported_by TEXT NOT NULL,
+    imported_at BIGINT NOT NULL,
+    PRIMARY KEY (provider, source_repo, source_id)
+);
diff --git a/proto/agwp/v1/agwp.proto b/proto/agwp/v1/agwp.proto
index 3d96615a..6b39e337 100644
--- a/proto/agwp/v1/agwp.proto
+++ b/proto/agwp/v1/agwp.proto
@@ -2120,7 +2120,31 @@ message UpdateIssueRequest {
 message AddIssueCommentRequest { string repo = 1; uint64 number = 2; string body = 3; string idempotency_key = 4; }
 message ListIssueActivityRequest { string repo = 1; uint64 number = 2; uint32 page_size = 3; string page_token = 4; }
 message ListIssueActivityResponse { repeated IssueActivity activity = 1; string next_page_token = 2; }
+message PreviewIssueImportRequest { string repo = 1; string manifest_json = 2; }
+message ApplyIssueImportRequest {
+  string repo = 1;
+  string manifest_json = 2;
+  string expected_digest = 3;
+  bool allow_unsupported = 4;
+}
+message IssueImportPreview {
+  string digest = 1;
+  uint32 issues = 2;
+  uint32 comments = 3;
+  uint32 create_count = 4;
+  uint32 skip_count = 5;
+  repeated string warnings = 6;
+  repeated string conflicts = 7;
+}
+message ImportedIssueMapping { string source_id = 1; uint64 number = 2; }
+message IssueImportResult {
+  uint32 created = 1;
+  uint32 skipped = 2;
+  repeated ImportedIssueMapping mappings = 3;
+}
 service IssueService {
+  rpc PreviewImport(PreviewIssueImportRequest) returns (IssueImportPreview);
+  rpc ApplyImport(ApplyIssueImportRequest) returns (IssueImportResult);
   rpc Create(CreateIssueRequest) returns (Issue);
   rpc Get(GetIssueRequest) returns (Issue);
   rpc List(ListIssuesRequest) returns (ListIssuesResponse);

From 9e49a5915c944a0920e5646231e9a28e8179c6c9 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:51:12 +0000
Subject: [PATCH 38/41] feat(cli): export hosting issues and apply reviewed
 imports

---
 Cargo.lock                                   |   3 +
 crates/ag-cli/Cargo.toml                     |   3 +
 crates/ag-cli/src/cmds/event_feed.rs         |   4 +-
 crates/ag-cli/src/cmds/gitbridge.rs          |  20 +
 crates/ag-cli/src/cmds/hosting_export.rs     | 373 +++++++++++++++++++
 crates/ag-cli/src/cmds/issue_import.rs       | 108 ++++++
 crates/ag-cli/src/cmds/mod.rs                |   2 +
 crates/ag-cli/src/cmds/remote.rs             |  10 +
 crates/ag-cli/src/main.rs                    |   1 +
 docs/guides/remote.md                        |  26 ++
 docs/reference/cli.md                        |  53 ++-
 docs/reference/completions/_ag               |  61 ++-
 docs/reference/completions/_ag.ps1           |  43 +++
 docs/reference/completions/ag.bash           |  98 ++++-
 docs/reference/completions/ag.elv            |  41 ++
 docs/reference/completions/ag.fish           | 124 +++---
 docs/reference/man/ag-git-export-issues.1    |  58 +++
 docs/reference/man/ag-git.1                  |   3 +
 docs/reference/man/ag-remote-import-issues.1 |  51 +++
 docs/reference/man/ag-remote.1               |   3 +
 20 files changed, 1032 insertions(+), 53 deletions(-)
 create mode 100644 crates/ag-cli/src/cmds/hosting_export.rs
 create mode 100644 crates/ag-cli/src/cmds/issue_import.rs
 create mode 100644 docs/reference/man/ag-git-export-issues.1
 create mode 100644 docs/reference/man/ag-remote-import-issues.1

diff --git a/Cargo.lock b/Cargo.lock
index b4592097..40b3eee4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -85,8 +85,11 @@ dependencies = [
  "serde_json",
  "sha2",
  "tempfile",
+ "time",
  "tokio",
  "tonic",
+ "ureq",
+ "url",
 ]
 
 [[package]]
diff --git a/crates/ag-cli/Cargo.toml b/crates/ag-cli/Cargo.toml
index dcfc64a1..02ecd335 100644
--- a/crates/ag-cli/Cargo.toml
+++ b/crates/ag-cli/Cargo.toml
@@ -45,6 +45,9 @@ sha2.workspace = true
 tokio.workspace = true
 tonic.workspace = true
 tempfile.workspace = true
+ureq.workspace = true
+time = { version = "0.3.55", features = ["parsing"] }
+url = "2.5.8"
 
 [dev-dependencies]
 ag-testkit.workspace = true
diff --git a/crates/ag-cli/src/cmds/event_feed.rs b/crates/ag-cli/src/cmds/event_feed.rs
index e3d7bbcf..851334d6 100644
--- a/crates/ag-cli/src/cmds/event_feed.rs
+++ b/crates/ag-cli/src/cmds/event_feed.rs
@@ -71,10 +71,10 @@ fn print_event(cli: &Cli, envelope: &v1::EventEnvelope) -> Result<()> {
     let line = if cli.json {
         serde_json::to_string(envelope)?
     } else {
-        format!(
+        crate::ctx::sanitize_for_terminal(&format!(
             "{}  {:>6}  {}  {}\nCursor: {}",
             event.repo, event.seq, event.topic, event.payload_json, envelope.cursor
-        )
+        ))
     };
     // Flush before advancing the checkpoint so a failed output cannot lose an event.
     crate::ui::print_bytes(format!("{line}\n").as_bytes());
diff --git a/crates/ag-cli/src/cmds/gitbridge.rs b/crates/ag-cli/src/cmds/gitbridge.rs
index 16fbf753..ad8c372d 100644
--- a/crates/ag-cli/src/cmds/gitbridge.rs
+++ b/crates/ag-cli/src/cmds/gitbridge.rs
@@ -13,6 +13,8 @@ use crate::exit;
 
 #[derive(Subcommand, Debug)]
 pub enum GitCmd {
+    /// Export GitHub/GitLab issues and comments to a normalized import manifest.
+    ExportIssues(super::hosting_export::ExportArgs),
     /// Import a Git repository's history into a new stream.
     Import {
         /// Path of the Git repository.
@@ -38,6 +40,7 @@ pub enum GitCmd {
 
 pub fn git(ctx: &Ctx, cmd: &GitCmd) -> Result<u8> {
     match cmd {
+        GitCmd::ExportIssues(_) => unreachable!("export-issues runs without a repository"),
         GitCmd::Import { path, rev, stream } => {
             let rep = ag_git::import(
                 &ctx.repo,
@@ -248,3 +251,20 @@ fn migration_summary(report: &ag_git::MigrationReport, destination: &std::path::
     }
     text
 }
+
+/// Export hosting metadata without requiring a local AgentGit repository.
+pub fn export_issues(cli: &crate::Cli, args: &super::hosting_export::ExportArgs) -> Result<u8> {
+    let report = super::hosting_export::export_issues(args)?;
+    if !cli.quiet || cli.json {
+        crate::ctx::emit(cli.json, &report, || {
+            format!(
+                "Exported {} issues and {} comments to {}.\nUnsupported source features: {}",
+                report.issues,
+                report.comments,
+                report.output.display(),
+                report.unsupported.join(", ")
+            )
+        })?;
+    }
+    Ok(exit::OK)
+}
diff --git a/crates/ag-cli/src/cmds/hosting_export.rs b/crates/ag-cli/src/cmds/hosting_export.rs
new file mode 100644
index 00000000..5e4f027c
--- /dev/null
+++ b/crates/ag-cli/src/cmds/hosting_export.rs
@@ -0,0 +1,373 @@
+//! Fetch a bounded, credential-free issue manifest for a later explicit import.
+use std::{collections::BTreeSet, io::Read, path::PathBuf, time::Duration};
+
+use anyhow::{Context, Result, bail, ensure};
+use clap::{Args, ValueEnum};
+use serde::{Deserialize, Serialize};
+use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+use url::Url;
+
+const MAX_BYTES: usize = 4 * 1024 * 1024;
+const MAX_ISSUES: usize = 100;
+const MAX_COMMENTS: usize = 1000;
+const PAGE_SIZE: usize = 100;
+
+#[derive(Clone, Copy, Debug, ValueEnum, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Provider {
+    Github,
+    Gitlab,
+}
+
+#[derive(Args, Debug)]
+pub struct ExportArgs {
+    /// Source hosting provider.
+    #[arg(long, value_enum)]
+    pub provider: Provider,
+    /// Repository path, for example owner/repo or group/subgroup/repo.
+    #[arg(long)]
+    pub source: String,
+    /// GitLab HTTPS origin, for example https://gitlab.example.com.
+    #[arg(long)]
+    pub host: Option<String>,
+    /// New manifest file. An existing file is never replaced.
+    #[arg(long)]
+    pub output: PathBuf,
+}
+
+#[derive(Serialize)]
+pub struct ExportReport {
+    pub issues: usize,
+    pub comments: usize,
+    pub output: PathBuf,
+    pub unsupported: Vec<String>,
+}
+
+#[derive(Serialize)]
+struct Manifest {
+    version: u8,
+    provider: Provider,
+    source_repo: String,
+    unsupported: Vec<String>,
+    issues: Vec<Issue>,
+}
+#[derive(Serialize)]
+struct Issue {
+    source_id: String,
+    title: String,
+    body: String,
+    state: &'static str,
+    author: String,
+    url: String,
+    created_at_ms: i64,
+    updated_at_ms: i64,
+    comments: Vec<Comment>,
+}
+#[derive(Serialize)]
+struct Comment {
+    source_id: String,
+    body: String,
+    author: String,
+    url: String,
+    created_at_ms: i64,
+}
+#[derive(Deserialize, Default)]
+struct User {
+    #[serde(default)]
+    login: String,
+    #[serde(default)]
+    username: String,
+}
+impl User {
+    fn name(self) -> String {
+        if self.login.is_empty() { self.username } else { self.login }
+    }
+}
+#[derive(Deserialize)]
+struct SourceIssue {
+    #[serde(default)]
+    number: u64,
+    #[serde(default)]
+    iid: u64,
+    title: String,
+    #[serde(default)]
+    body: Option<String>,
+    #[serde(default)]
+    description: Option<String>,
+    state: String,
+    #[serde(default)]
+    user: Option<User>,
+    #[serde(default)]
+    author: Option<User>,
+    #[serde(default)]
+    html_url: String,
+    #[serde(default)]
+    web_url: String,
+    created_at: String,
+    updated_at: String,
+    #[serde(default)]
+    pull_request: Option<serde_json::Value>,
+}
+#[derive(Deserialize)]
+struct SourceComment {
+    id: u64,
+    #[serde(default)]
+    body: Option<String>,
+    #[serde(default)]
+    user: Option<User>,
+    #[serde(default)]
+    author: Option<User>,
+    #[serde(default)]
+    html_url: String,
+    created_at: String,
+    #[serde(default)]
+    system: bool,
+}
+
+struct Source {
+    provider: Provider,
+    api: Url,
+    repository: Url,
+    token: Option<String>,
+    agent: ureq::Agent,
+    remaining: usize,
+}
+impl Source {
+    fn new(args: &ExportArgs) -> Result<Self> {
+        let parts: Vec<_> = args.source.split('/').collect();
+        ensure!(
+            parts.len() >= 2
+                && parts.iter().all(|p| !p.is_empty()
+                    && *p != "."
+                    && *p != ".."
+                    && !p.contains(['?', '#', ':', '\\'])
+                    && !p.chars().any(char::is_control)),
+            "source must be a repository path such as owner/repo"
+        );
+        let (origin, api_origin, variable) = match args.provider {
+            Provider::Github => {
+                ensure!(
+                    parts.len() == 2 && args.host.is_none(),
+                    "GitHub requires owner/repo; --host is supported only for GitLab"
+                );
+                ("https://github.com", "https://api.github.com", "GITHUB_TOKEN")
+            }
+            Provider::Gitlab => {
+                let host = args.host.as_deref().unwrap_or("https://gitlab.com");
+                (host, host, "GITLAB_TOKEN")
+            }
+        };
+        let mut repository = https_origin(origin)?;
+        repository.path_segments_mut().map_err(|_| anyhow::anyhow!("invalid source host"))?.extend(&parts);
+        let mut api = https_origin(api_origin)?;
+        match args.provider {
+            Provider::Github => {
+                api.path_segments_mut().unwrap().extend(["repos", parts[0], parts[1]]);
+            }
+            Provider::Gitlab => {
+                api.path_segments_mut().unwrap().extend(["api", "v4", "projects", &args.source]);
+            }
+        }
+        let token = std::env::var(variable).ok().filter(|value| !value.is_empty());
+        let agent = ureq::Agent::config_builder()
+            .http_status_as_error(false)
+            .max_redirects(0)
+            .timeout_global(Some(Duration::from_secs(30)))
+            .build()
+            .into();
+        Ok(Self { provider: args.provider, api, repository, token, agent, remaining: MAX_BYTES })
+    }
+    fn endpoint(&self, segments: &[&str], page: usize) -> Url {
+        let mut url = self.api.clone();
+        url.path_segments_mut().unwrap().extend(segments);
+        url.query_pairs_mut().append_pair("per_page", "100").append_pair("page", &page.to_string());
+        url
+    }
+    fn page<T: for<'de> Deserialize<'de>>(&mut self, url: &Url) -> Result<Vec<T>> {
+        let mut request = ureq::http::Request::builder()
+            .uri(url.as_str())
+            .header("User-Agent", "AgentGit-issue-export")
+            .header("Accept", "application/json");
+        if let Some(token) = &self.token {
+            request = match self.provider {
+                Provider::Github => request.header("Authorization", format!("Bearer {token}")),
+                Provider::Gitlab => request.header("PRIVATE-TOKEN", token),
+            };
+        }
+        let request = request.body(()).map_err(|_| anyhow::anyhow!("invalid provider request or token header"))?;
+        let mut response = self
+            .agent
+            .run(request)
+            .map_err(|_| anyhow::anyhow!("provider request failed; check network and source host"))?;
+        ensure!(
+            response.status().is_success(),
+            "provider returned HTTP {}; check repository access, token and rate limits",
+            response.status().as_u16()
+        );
+        let mut bytes = Vec::new();
+        std::io::Read::take(response.body_mut().with_config().limit(u64::MAX).reader(), self.remaining as u64 + 1)
+            .read_to_end(&mut bytes)
+            .map_err(|_| anyhow::anyhow!("could not read provider response"))?;
+        ensure!(
+            bytes.len() <= self.remaining,
+            "provider responses exceed the 4 MiB export budget; export a smaller source"
+        );
+        self.remaining -= bytes.len();
+        serde_json::from_slice(&bytes).context("provider returned invalid issue data")
+    }
+    fn issues(&mut self) -> Result<Vec<SourceIssue>> {
+        let mut issues = Vec::new();
+        for page in 1..=100 {
+            let mut url = self.endpoint(&["issues"], page);
+            url.query_pairs_mut().append_pair("state", "all");
+            match self.provider {
+                Provider::Github => {
+                    url.query_pairs_mut().append_pair("sort", "created").append_pair("direction", "asc");
+                }
+                Provider::Gitlab => {
+                    url.query_pairs_mut()
+                        .append_pair("scope", "all")
+                        .append_pair("order_by", "iid")
+                        .append_pair("sort", "asc");
+                }
+            }
+            let rows: Vec<SourceIssue> = self.page(&url)?;
+            let count = rows.len();
+            for row in rows {
+                if matches!(self.provider, Provider::Github) && row.pull_request.is_some() {
+                    continue;
+                }
+                ensure!(issues.len() < MAX_ISSUES, "source exceeds 100 issues; export a smaller source");
+                issues.push(row);
+            }
+            if count < PAGE_SIZE {
+                return Ok(issues);
+            }
+        }
+        bail!("provider pagination exceeds the export budget")
+    }
+    fn comments(&mut self, number: u64, total: &mut usize) -> Result<Vec<Comment>> {
+        let mut comments = Vec::new();
+        let mut seen = BTreeSet::new();
+        for page in 1..=11 {
+            let number_text = number.to_string();
+            let suffix = match self.provider {
+                Provider::Github => "comments",
+                Provider::Gitlab => "notes",
+            };
+            let mut url = self.endpoint(&["issues", &number_text, suffix], page);
+            if matches!(self.provider, Provider::Gitlab) {
+                url.query_pairs_mut().append_pair("order_by", "created_at").append_pair("sort", "asc");
+            }
+            let rows: Vec<SourceComment> = self.page(&url)?;
+            let count = rows.len();
+            for row in rows {
+                if row.system {
+                    continue;
+                }
+                ensure!(*total < MAX_COMMENTS, "source exceeds 1000 comments; export a smaller source");
+                ensure!(
+                    row.id > 0 && seen.insert(row.id),
+                    "provider returned a missing or duplicate comment ID; retry after source activity settles"
+                );
+                let url = if matches!(self.provider, Provider::Github) {
+                    row.html_url
+                } else {
+                    format!("{}/-/issues/{number}#note_{}", self.repository, row.id)
+                };
+                comments.push(Comment {
+                    source_id: row.id.to_string(),
+                    body: row.body.unwrap_or_default(),
+                    author: row.user.or(row.author).unwrap_or_default().name(),
+                    url,
+                    created_at_ms: timestamp(&row.created_at)?,
+                });
+                *total += 1;
+            }
+            if count < PAGE_SIZE {
+                return Ok(comments);
+            }
+        }
+        bail!("provider comment pagination exceeds the export budget")
+    }
+}
+fn https_origin(value: &str) -> Result<Url> {
+    let url = Url::parse(value).context("host must be an HTTPS origin")?;
+    ensure!(
+        url.scheme() == "https"
+            && url.host_str().is_some()
+            && url.username().is_empty()
+            && url.password().is_none()
+            && url.path() == "/"
+            && url.query().is_none()
+            && url.fragment().is_none(),
+        "host must be an HTTPS origin without credentials, path, query or fragment"
+    );
+    Ok(url)
+}
+fn timestamp(value: &str) -> Result<i64> {
+    let date = OffsetDateTime::parse(value, &Rfc3339).context("provider returned an invalid RFC3339 timestamp")?;
+    i64::try_from(date.unix_timestamp_nanos() / 1_000_000).context("provider timestamp is out of range")
+}
+
+/// Export only; no AgentGit server call or issue publication occurs here.
+pub fn export_issues(args: &ExportArgs) -> Result<ExportReport> {
+    ensure!(!args.output.exists(), "output already exists; choose a new manifest file");
+    let mut source = Source::new(args)?;
+    let rows = source.issues()?;
+    let mut issues = Vec::new();
+    let mut total = 0;
+    let mut seen = BTreeSet::new();
+    for row in rows {
+        let number = match args.provider {
+            Provider::Github => row.number,
+            Provider::Gitlab => row.iid,
+        };
+        ensure!(
+            number > 0 && seen.insert(number),
+            "provider returned a missing or duplicate issue ID; retry after source activity settles"
+        );
+        let state = match row.state.as_str() {
+            "open" | "opened" => "open",
+            "closed" => "closed",
+            _ => bail!("provider returned an unsupported issue state"),
+        };
+        let comments = source.comments(number, &mut total)?;
+        issues.push(Issue {
+            source_id: number.to_string(),
+            title: row.title,
+            body: row.body.or(row.description).unwrap_or_default(),
+            state,
+            author: row.user.or(row.author).unwrap_or_default().name(),
+            url: if matches!(args.provider, Provider::Github) { row.html_url } else { row.web_url },
+            created_at_ms: timestamp(&row.created_at)?,
+            updated_at_ms: timestamp(&row.updated_at)?,
+            comments,
+        });
+    }
+    let mut unsupported = vec![
+        "Labels, assignees, milestones and reactions are not imported.".into(),
+        "Attachment files are not downloaded; links remain in the original body.".into(),
+        "Pull/merge requests, releases, permissions and edit history are not included.".into(),
+    ];
+    if matches!(args.provider, Provider::Gitlab) {
+        unsupported.push("GitLab system notes are omitted; only user comments are exported.".into());
+    }
+    let manifest = Manifest {
+        version: 1,
+        provider: args.provider,
+        source_repo: source.repository.to_string(),
+        unsupported: unsupported.clone(),
+        issues,
+    };
+    let bytes = serde_json::to_vec_pretty(&manifest)?;
+    ensure!(bytes.len() <= MAX_BYTES, "manifest exceeds 4 MiB; export a smaller source");
+    let parent =
+        args.output.parent().filter(|p| !p.as_os_str().is_empty()).unwrap_or_else(|| std::path::Path::new("."));
+    let mut file = tempfile::NamedTempFile::new_in(parent).context("creating manifest file")?;
+    std::io::Write::write_all(&mut file, &bytes).context("writing manifest")?;
+    file.persist_noclobber(&args.output)
+        .map_err(|e| e.error)
+        .context("saving manifest without replacing existing data")?;
+    Ok(ExportReport { issues: manifest.issues.len(), comments: total, output: args.output.clone(), unsupported })
+}
diff --git a/crates/ag-cli/src/cmds/issue_import.rs b/crates/ag-cli/src/cmds/issue_import.rs
new file mode 100644
index 00000000..27a8d6a5
--- /dev/null
+++ b/crates/ag-cli/src/cmds/issue_import.rs
@@ -0,0 +1,108 @@
+//! Explicit preview/apply for a normalized hosting issue manifest.
+use std::io::Read;
+use std::path::PathBuf;
+
+use ag_client::{Client, ClientError};
+use ag_protocol::{features, v1};
+use anyhow::{Context, Result, ensure};
+use clap::Args;
+use serde_json::Value;
+
+/// Inspect an import first, then apply precisely the reviewed manifest digest.
+#[derive(Args, Debug)]
+pub struct ImportArgs {
+    /// Normalized GitHub/GitLab issue manifest (UTF-8 JSON, at most 4 MiB).
+    #[arg(long, value_name = "PATH")]
+    file: PathBuf,
+    /// Apply the manifest instead of only previewing it.
+    #[arg(long, requires = "expected_digest")]
+    pub apply: bool,
+    /// Exact digest returned by the preview of this manifest.
+    #[arg(long, requires = "apply", value_name = "DIGEST")]
+    expected_digest: Option<String>,
+    /// Acknowledge unsupported source features listed in the preview.
+    #[arg(long, requires = "apply")]
+    allow_unsupported: bool,
+}
+
+fn manifest(path: &PathBuf) -> Result<String> {
+    let mut bytes = Vec::new();
+    std::fs::File::open(path)
+        .with_context(|| format!("reading {}", path.display()))?
+        .take(4 * 1024 * 1024 + 1)
+        .read_to_end(&mut bytes)
+        .with_context(|| format!("reading {}", path.display()))?;
+    ensure!(bytes.len() <= 4 * 1024 * 1024, "issue import manifest exceeds 4 MiB");
+    String::from_utf8(bytes).context("issue import manifest must be UTF-8 JSON")
+}
+
+/// Preview by default; applying never fetches a replacement digest implicitly.
+pub async fn run(client: &Client, repo: &str, args: &ImportArgs) -> Result<Value> {
+    ensure!(
+        client.negotiate().await?.features.iter().any(|feature| feature == features::ISSUES_IMPORT),
+        "this server does not support issue imports; update it before using this command"
+    );
+    let manifest_json = manifest(&args.file)?;
+    if args.apply {
+        let response = client
+            .issues()
+            .apply_import(client.req(v1::ApplyIssueImportRequest {
+                repo: repo.into(),
+                manifest_json,
+                expected_digest: args.expected_digest.clone().context("--apply requires --expected-digest")?,
+                allow_unsupported: args.allow_unsupported,
+            }))
+            .await
+            .map_err(ClientError::from)?
+            .into_inner();
+        Ok(serde_json::to_value(response)?)
+    } else {
+        let response = client
+            .issues()
+            .preview_import(client.req(v1::PreviewIssueImportRequest { repo: repo.into(), manifest_json }))
+            .await
+            .map_err(ClientError::from)?
+            .into_inner();
+        Ok(serde_json::to_value(response)?)
+    }
+}
+
+/// Keep the reviewed digest and any refusal reasons visible in terminal output.
+pub fn describe(value: &Value, applied: bool) -> String {
+    if applied {
+        return format!(
+            "Imported {} issues; skipped {} already imported issues.\n{}",
+            value["created"],
+            value["skipped"],
+            value["mappings"]
+                .as_array()
+                .into_iter()
+                .flatten()
+                .map(|mapping| format!(
+                    "{} -> #{}",
+                    mapping["source_id"].as_str().unwrap_or_default(),
+                    mapping["number"]
+                ))
+                .collect::<Vec<_>>()
+                .join("\n")
+        );
+    }
+    let mut text = format!(
+        "Preview: {} issues, {} comments. Create {}, skip {}.\nDigest: {}",
+        value["issues"],
+        value["comments"],
+        value["create_count"],
+        value["skip_count"],
+        value["digest"].as_str().unwrap_or_default()
+    );
+    for (key, label) in [("warnings", "Warning"), ("conflicts", "Conflict")] {
+        for message in value[key].as_array().into_iter().flatten() {
+            text.push_str(&format!(
+                "\n{label}: {}",
+                message.as_str().map(str::to_owned).unwrap_or_else(|| message.to_string())
+            ));
+        }
+    }
+    text.push_str("\nTo apply this preview, add --apply --expected-digest DIGEST using the value above.");
+    text
+}
diff --git a/crates/ag-cli/src/cmds/mod.rs b/crates/ag-cli/src/cmds/mod.rs
index 388fc20c..846f0f87 100644
--- a/crates/ag-cli/src/cmds/mod.rs
+++ b/crates/ag-cli/src/cmds/mod.rs
@@ -13,6 +13,8 @@ pub mod explain;
 pub mod file_drafts;
 pub mod flow;
 pub mod gitbridge;
+pub mod hosting_export;
+pub mod issue_import;
 pub mod login;
 pub mod overview;
 pub mod policy;
diff --git a/crates/ag-cli/src/cmds/remote.rs b/crates/ag-cli/src/cmds/remote.rs
index 14f6c1ec..8e5335ca 100644
--- a/crates/ag-cli/src/cmds/remote.rs
+++ b/crates/ag-cli/src/cmds/remote.rs
@@ -869,6 +869,8 @@ pub enum RemoteCmd {
         /// Proposal id.
         id: String,
     },
+    /// Preview or explicitly apply a normalized GitHub/GitLab issue manifest.
+    ImportIssues(crate::cmds::issue_import::ImportArgs),
     /// List streams.
     Streams,
     /// Show the events of the repository (replay), or follow them live.
@@ -1358,6 +1360,14 @@ fn remote_online(cli: &Cli, root: &Path, remote_name: Option<&str>, cmd: &Remote
                     .into_inner();
                 print_done(cli, &p, || format!("Closed {}.", p.id))?;
             }
+            RemoteCmd::ImportIssues(args) => {
+                let result = crate::cmds::issue_import::run(&c, &repo, args).await?;
+                if args.apply {
+                    print_done(cli, &result, || crate::cmds::issue_import::describe(&result, true))?;
+                } else {
+                    print(cli, &result, || crate::cmds::issue_import::describe(&result, false))?;
+                }
+            }
             RemoteCmd::Streams => {
                 let r = c.streams().list(c.req(v1::ListStreamsRequest { repo })).await.map_err(s)?.into_inner();
                 print(cli, &r, || {
diff --git a/crates/ag-cli/src/main.rs b/crates/ag-cli/src/main.rs
index ca8829db..10dfe148 100644
--- a/crates/ag-cli/src/main.rs
+++ b/crates/ag-cli/src/main.rs
@@ -292,6 +292,7 @@ fn run(cli: Cli) -> anyhow::Result<u8> {
     match &cli.command {
         Init(args) => return cmds::repo::init(&cli, args),
         Migrate(args) => return cmds::gitbridge::migrate(&cli, args),
+        Git(cmds::gitbridge::GitCmd::ExportIssues(args)) => return cmds::gitbridge::export_issues(&cli, args),
         Clone(args) => return cmds::remote::clone(&cli, args),
         Remote(args) => return cmds::remote::remote(&cli, args),
         Login(a) => return cmds::login::login(&cli, a),
diff --git a/docs/guides/remote.md b/docs/guides/remote.md
index 839e2ecd..44088d66 100644
--- a/docs/guides/remote.md
+++ b/docs/guides/remote.md
@@ -155,6 +155,32 @@ and checkpoints advance the checkpoint file without appearing as user actions. C
 are replaced atomically after output is flushed; a failed output does not advance past the
 unwritten event. Resume with the same options after a disconnect.
 
+## Import hosting issues and comments
+
+First export a normalized manifest without needing a local AgentGit repository. The exporter
+reads `GITHUB_TOKEN` or `GITLAB_TOKEN` from the environment when required for source access;
+credentials are never written to the manifest. For a self-hosted GitLab, add `--host https://gitlab.example.com`.
+
+```sh
+ag git export-issues --provider github --source owner/repo --output issues.json
+ag git export-issues --provider gitlab --source group/repo --output gitlab-issues.json
+ag remote import-issues --file issues.json
+# After reviewing counts, warnings, conflicts and the returned digest:
+ag remote import-issues --file issues.json --apply --expected-digest DIGEST --allow-unsupported
+```
+
+`import-issues` previews by default on development servers advertising `issues.import`.
+Applying requires the exact preview digest; it never silently accepts a changed manifest.
+Repeating an unchanged import skips already imported issues; changed source records require
+review rather than overwriting earlier imports. Original authors, source links and timestamps
+are retained as visible provenance, while the importing account remains the AgentGit actor.
+
+The initial importer accepts at most 100 issues, 1000 comments and 4 MiB of UTF-8 JSON. It keeps
+open/closed state and user comments. Labels, assignees, milestones, reactions, attachment files,
+pull/merge requests, releases, permissions and edit history are outside this initial scope;
+GitLab system notes are omitted. Read the preview warnings before explicitly acknowledging
+these omissions with `--allow-unsupported`. An export never replaces an existing output file.
+
 ## Offline
 
 Nothing about a local repository needs the server:
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index bc9b1771..1d993b63 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -112,6 +112,7 @@ Concept pages are available in the terminal: `ag help workflow|policy|leases|ide
 - [`ag reindex`](#ag-reindex)
 - [`ag backup`](#ag-backup)
 - [`ag git`](#ag-git)
+- [`ag git export-issues`](#ag-git-export-issues)
 - [`ag git import`](#ag-git-import)
 - [`ag git export`](#ag-git-export)
 - [`ag clone`](#ag-clone)
@@ -156,6 +157,7 @@ Concept pages are available in the terminal: `ag help workflow|policy|leases|ide
 - [`ag remote workspace delete`](#ag-remote-workspace-delete)
 - [`ag remote integrate`](#ag-remote-integrate)
 - [`ag remote close`](#ag-remote-close)
+- [`ag remote import-issues`](#ag-remote-import-issues)
 - [`ag remote streams`](#ag-remote-streams)
 - [`ag remote events`](#ag-remote-events)
 - [`ag remote policy`](#ag-remote-policy)
@@ -2356,8 +2358,9 @@ Import from or export to Git (needs the `git` command)
 Usage: ag git [OPTIONS] <COMMAND>
 
 Commands:
-  import  Import a Git repository's history into a new stream
-  export  Export a stream's history to a Git repository (created if missing)
+  export-issues  Export GitHub/GitLab issues and comments to a normalized import manifest
+  import         Import a Git repository's history into a new stream
+  export         Export a stream's history to a Git repository (created if missing)
 
 Options:
   -C, --repo <DIR>     Operate on the repository at this path (default: discovered from the current directory)
@@ -2370,6 +2373,28 @@ Options:
   -V, --version        Print version
 ```
 
+## ag git export-issues
+
+```text
+Export GitHub/GitLab issues and comments to a normalized import manifest
+
+Usage: ag git export-issues [OPTIONS] --provider <PROVIDER> --source <SOURCE> --output <OUTPUT>
+
+Options:
+  -C, --repo <DIR>           Operate on the repository at this path (default: discovered from the current directory)
+      --provider <PROVIDER>  Source hosting provider [possible values: github, gitlab]
+      --as <IDENTITY>        Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --source <SOURCE>      Repository path, for example owner/repo or group/subgroup/repo
+      --host <HOST>          GitLab HTTPS origin, for example https://gitlab.example.com
+      --json                 Machine-readable JSON output
+      --color <WHEN>         Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+      --output <OUTPUT>      New manifest file. An existing file is never replaced
+  -q, --quiet                Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose              Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help                 Print help
+  -V, --version              Print version
+```
+
 ## ag git import
 
 ```text
@@ -2534,6 +2559,7 @@ Commands:
   workspace      Inspect and explicitly sync server-side workspaces without a checkout
   integrate      Integrate a proposal into its stream
   close          Close a proposal without integrating it
+  import-issues  Preview or explicitly apply a normalized GitHub/GitLab issue manifest
   streams        List streams
   events         Show the events of the repository (replay), or follow them live
   policy         Show or set a stream's policy
@@ -3510,6 +3536,29 @@ Options:
   -V, --version          Print version
 ```
 
+## ag remote import-issues
+
+```text
+Preview or explicitly apply a normalized GitHub/GitLab issue manifest
+
+Usage: ag remote import-issues [OPTIONS] --file <PATH>
+
+Options:
+  -C, --repo <DIR>                Operate on the repository at this path (default: discovered from the current directory)
+      --file <PATH>               Normalized GitHub/GitLab issue manifest (UTF-8 JSON, at most 4 MiB)
+      --remote <REMOTE>           Remote to use (default: origin)
+      --apply                     Apply the manifest instead of only previewing it
+      --as <IDENTITY>             Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+      --expected-digest <DIGEST>  Exact digest returned by the preview of this manifest
+      --json                      Machine-readable JSON output
+      --allow-unsupported         Acknowledge unsupported source features listed in the preview
+      --color <WHEN>              Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+  -q, --quiet                     Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+  -v, --verbose                   Explain what is happening on standard error: repository, identity, remote, timing
+  -h, --help                      Print help
+  -V, --version                   Print version
+```
+
 ## ag remote streams
 
 ```text
diff --git a/docs/reference/completions/_ag b/docs/reference/completions/_ag
index 4356cf57..6b013816 100644
--- a/docs/reference/completions/_ag
+++ b/docs/reference/completions/_ag
@@ -2123,7 +2123,30 @@ never\:"Never colour"))' \
         (( CURRENT += 1 ))
         curcontext="${curcontext%:*:*}:ag-git-command-$line[1]:"
         case $line[1] in
-            (import)
+            (export-issues)
+_arguments "${_arguments_options[@]}" : \
+'--provider=[Source hosting provider]:PROVIDER:(github gitlab)' \
+'--source=[Repository path, for example owner/repo or group/subgroup/repo]:SOURCE:_default' \
+'--host=[GitLab HTTPS origin, for example https\://gitlab.example.com]:HOST:_default' \
+'--output=[New manifest file. An existing file is never replaced]:OUTPUT:_files' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+&& ret=0
+;;
+(import)
 _arguments "${_arguments_options[@]}" : \
 '--rev=[Revision to import]:REV:_default' \
 '--stream=[Stream to create for the imported history]:STREAM:_default' \
@@ -3180,6 +3203,30 @@ never\:"Never colour"))' \
 ':id -- Proposal id:_default' \
 && ret=0
 ;;
+(import-issues)
+_arguments "${_arguments_options[@]}" : \
+'--file=[Normalized GitHub/GitLab issue manifest (UTF-8 JSON, at most 4 MiB)]:PATH:_files' \
+'--expected-digest=[Exact digest returned by the preview of this manifest]:DIGEST:_default' \
+'--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
+'-C+[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--repo=[Operate on the repository at this path (default\: discovered from the current directory)]:DIR:_files' \
+'--as=[Act as this identity (\`user\:alice\`, \`agent\:bot#run_…\`, \`service\:ci\`). Also\: AG_IDENTITY]:IDENTITY:_default' \
+'--color=[Colour the output\: auto (a terminal, unless NO_COLOR is set), always or never]:WHEN:((auto\:"Colour when the stream is a terminal and neither \`NO_COLOR\` nor \`TERM=dumb\` says otherwise"
+always\:"Always colour"
+never\:"Never colour"))' \
+'--apply[Apply the manifest instead of only previewing it]' \
+'--allow-unsupported[Acknowledge unsupported source features listed in the preview]' \
+'--json[Machine-readable JSON output]' \
+'(-v --verbose)-q[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'(-v --verbose)--quiet[Print only what was asked for\: no confirmations or hints. Errors and refusals are still shown]' \
+'-v[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'--verbose[Explain what is happening on standard error\: repository, identity, remote, timing]' \
+'-h[Print help]' \
+'--help[Print help]' \
+'-V[Print version]' \
+'--version[Print version]' \
+&& ret=0
+;;
 (streams)
 _arguments "${_arguments_options[@]}" : \
 '--remote=[Remote to use (default\: origin)]:REMOTE:_default' \
@@ -3953,6 +4000,7 @@ _ag__subcmd__gc_commands() {
 (( $+functions[_ag__subcmd__git_commands] )) ||
 _ag__subcmd__git_commands() {
     local commands; commands=(
+'export-issues:Export GitHub/GitLab issues and comments to a normalized import manifest' \
 'import:Import a Git repository'\''s history into a new stream' \
 'export:Export a stream'\''s history to a Git repository (created if missing)' \
     )
@@ -3963,6 +4011,11 @@ _ag__subcmd__git__subcmd__export_commands() {
     local commands; commands=()
     _describe -t commands 'ag git export commands' commands "$@"
 }
+(( $+functions[_ag__subcmd__git__subcmd__export-issues_commands] )) ||
+_ag__subcmd__git__subcmd__export-issues_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag git export-issues commands' commands "$@"
+}
 (( $+functions[_ag__subcmd__git__subcmd__import_commands] )) ||
 _ag__subcmd__git__subcmd__import_commands() {
     local commands; commands=()
@@ -4282,6 +4335,7 @@ _ag__subcmd__remote_commands() {
 'workspace:Inspect and explicitly sync server-side workspaces without a checkout' \
 'integrate:Integrate a proposal into its stream' \
 'close:Close a proposal without integrating it' \
+'import-issues:Preview or explicitly apply a normalized GitHub/GitLab issue manifest' \
 'streams:List streams' \
 'events:Show the events of the repository (replay), or follow them live' \
 'policy:Show or set a stream'\''s policy' \
@@ -4411,6 +4465,11 @@ _ag__subcmd__remote__subcmd__file-draft__subcmd__save_commands() {
     local commands; commands=()
     _describe -t commands 'ag remote file-draft save commands' commands "$@"
 }
+(( $+functions[_ag__subcmd__remote__subcmd__import-issues_commands] )) ||
+_ag__subcmd__remote__subcmd__import-issues_commands() {
+    local commands; commands=()
+    _describe -t commands 'ag remote import-issues commands' commands "$@"
+}
 (( $+functions[_ag__subcmd__remote__subcmd__integrate_commands] )) ||
 _ag__subcmd__remote__subcmd__integrate_commands() {
     local commands; commands=()
diff --git a/docs/reference/completions/_ag.ps1 b/docs/reference/completions/_ag.ps1
index 505f8fdc..bed20935 100644
--- a/docs/reference/completions/_ag.ps1
+++ b/docs/reference/completions/_ag.ps1
@@ -1737,10 +1737,31 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
             [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
             [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('export-issues', 'export-issues', [CompletionResultType]::ParameterValue, 'Export GitHub/GitLab issues and comments to a normalized import manifest')
             [CompletionResult]::new('import', 'import', [CompletionResultType]::ParameterValue, 'Import a Git repository''s history into a new stream')
             [CompletionResult]::new('export', 'export', [CompletionResultType]::ParameterValue, 'Export a stream''s history to a Git repository (created if missing)')
             break
         }
+        'ag;git;export-issues' {
+            [CompletionResult]::new('--provider', '--provider', [CompletionResultType]::ParameterName, 'Source hosting provider')
+            [CompletionResult]::new('--source', '--source', [CompletionResultType]::ParameterName, 'Repository path, for example owner/repo or group/subgroup/repo')
+            [CompletionResult]::new('--host', '--host', [CompletionResultType]::ParameterName, 'GitLab HTTPS origin, for example https://gitlab.example.com')
+            [CompletionResult]::new('--output', '--output', [CompletionResultType]::ParameterName, 'New manifest file. An existing file is never replaced')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
         'ag;git;import' {
             [CompletionResult]::new('--rev', '--rev', [CompletionResultType]::ParameterName, 'Revision to import')
             [CompletionResult]::new('--stream', '--stream', [CompletionResultType]::ParameterName, 'Stream to create for the imported history')
@@ -1888,6 +1909,7 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('workspace', 'workspace', [CompletionResultType]::ParameterValue, 'Inspect and explicitly sync server-side workspaces without a checkout')
             [CompletionResult]::new('integrate', 'integrate', [CompletionResultType]::ParameterValue, 'Integrate a proposal into its stream')
             [CompletionResult]::new('close', 'close', [CompletionResultType]::ParameterValue, 'Close a proposal without integrating it')
+            [CompletionResult]::new('import-issues', 'import-issues', [CompletionResultType]::ParameterValue, 'Preview or explicitly apply a normalized GitHub/GitLab issue manifest')
             [CompletionResult]::new('streams', 'streams', [CompletionResultType]::ParameterValue, 'List streams')
             [CompletionResult]::new('events', 'events', [CompletionResultType]::ParameterValue, 'Show the events of the repository (replay), or follow them live')
             [CompletionResult]::new('policy', 'policy', [CompletionResultType]::ParameterValue, 'Show or set a stream''s policy')
@@ -2603,6 +2625,27 @@ Register-ArgumentCompleter -Native -CommandName 'ag' -ScriptBlock {
             [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
             break
         }
+        'ag;remote;import-issues' {
+            [CompletionResult]::new('--file', '--file', [CompletionResultType]::ParameterName, 'Normalized GitHub/GitLab issue manifest (UTF-8 JSON, at most 4 MiB)')
+            [CompletionResult]::new('--expected-digest', '--expected-digest', [CompletionResultType]::ParameterName, 'Exact digest returned by the preview of this manifest')
+            [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
+            [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--repo', '--repo', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
+            [CompletionResult]::new('--as', '--as', [CompletionResultType]::ParameterName, 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY')
+            [CompletionResult]::new('--color', '--color', [CompletionResultType]::ParameterName, 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never')
+            [CompletionResult]::new('--apply', '--apply', [CompletionResultType]::ParameterName, 'Apply the manifest instead of only previewing it')
+            [CompletionResult]::new('--allow-unsupported', '--allow-unsupported', [CompletionResultType]::ParameterName, 'Acknowledge unsupported source features listed in the preview')
+            [CompletionResult]::new('--json', '--json', [CompletionResultType]::ParameterName, 'Machine-readable JSON output')
+            [CompletionResult]::new('-q', '-q', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('--quiet', '--quiet', [CompletionResultType]::ParameterName, 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown')
+            [CompletionResult]::new('-v', '-v', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('--verbose', '--verbose', [CompletionResultType]::ParameterName, 'Explain what is happening on standard error: repository, identity, remote, timing')
+            [CompletionResult]::new('-h', '-h', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('--help', '--help', [CompletionResultType]::ParameterName, 'Print help')
+            [CompletionResult]::new('-V', '-V ', [CompletionResultType]::ParameterName, 'Print version')
+            [CompletionResult]::new('--version', '--version', [CompletionResultType]::ParameterName, 'Print version')
+            break
+        }
         'ag;remote;streams' {
             [CompletionResult]::new('--remote', '--remote', [CompletionResultType]::ParameterName, 'Remote to use (default: origin)')
             [CompletionResult]::new('-C', '-C ', [CompletionResultType]::ParameterName, 'Operate on the repository at this path (default: discovered from the current directory)')
diff --git a/docs/reference/completions/ag.bash b/docs/reference/completions/ag.bash
index 93c0750f..6a627ae6 100644
--- a/docs/reference/completions/ag.bash
+++ b/docs/reference/completions/ag.bash
@@ -226,6 +226,9 @@ _ag() {
             ag__subcmd__git,export)
                 cmd="ag__subcmd__git__subcmd__export"
                 ;;
+            ag__subcmd__git,export-issues)
+                cmd="ag__subcmd__git__subcmd__export__subcmd__issues"
+                ;;
             ag__subcmd__git,import)
                 cmd="ag__subcmd__git__subcmd__import"
                 ;;
@@ -337,6 +340,9 @@ _ag() {
             ag__subcmd__remote,file-draft)
                 cmd="ag__subcmd__remote__subcmd__file__subcmd__draft"
                 ;;
+            ag__subcmd__remote,import-issues)
+                cmd="ag__subcmd__remote__subcmd__import__subcmd__issues"
+                ;;
             ag__subcmd__remote,integrate)
                 cmd="ag__subcmd__remote__subcmd__integrate"
                 ;;
@@ -1562,7 +1568,7 @@ _ag() {
             return 0
             ;;
         ag__subcmd__git)
-            opts="-C -q -v -h -V --repo --as --json --color --quiet --verbose --help --version import export"
+            opts="-C -q -v -h -V --repo --as --json --color --quiet --verbose --help --version export-issues import export"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -1625,6 +1631,52 @@ _ag() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        ag__subcmd__git__subcmd__export__subcmd__issues)
+            opts="-C -q -v -h -V --provider --source --host --output --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --provider)
+                    COMPREPLY=($(compgen -W "github gitlab" -- "${cur}"))
+                    return 0
+                    ;;
+                --source)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --host)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --output)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         ag__subcmd__git__subcmd__import)
             opts="-C -q -v -h -V --rev --stream --repo --as --json --color --quiet --verbose --help --version"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
@@ -3524,7 +3576,7 @@ _ag() {
             return 0
             ;;
         ag__subcmd__remote)
-            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat"
+            opts="-C -q -v -h -V --remote --repo --as --json --color --quiet --verbose --help --version add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -4435,6 +4487,48 @@ _ag() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        ag__subcmd__remote__subcmd__import__subcmd__issues)
+            opts="-C -q -v -h -V --file --apply --expected-digest --allow-unsupported --remote --repo --as --json --color --quiet --verbose --help --version"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --file)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --expected-digest)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --remote)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --repo)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                -C)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --as)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --color)
+                    COMPREPLY=($(compgen -W "auto always never" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         ag__subcmd__remote__subcmd__integrate)
             opts="-C -q -v -h -V --fencing-token --remote --repo --as --json --color --quiet --verbose --help --version"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
diff --git a/docs/reference/completions/ag.elv b/docs/reference/completions/ag.elv
index c6c4a207..2a58c958 100644
--- a/docs/reference/completions/ag.elv
+++ b/docs/reference/completions/ag.elv
@@ -1643,9 +1643,29 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand --help 'Print help'
             cand -V 'Print version'
             cand --version 'Print version'
+            cand export-issues 'Export GitHub/GitLab issues and comments to a normalized import manifest'
             cand import 'Import a Git repository''s history into a new stream'
             cand export 'Export a stream''s history to a Git repository (created if missing)'
         }
+        &'ag;git;export-issues'= {
+            cand --provider 'Source hosting provider'
+            cand --source 'Repository path, for example owner/repo or group/subgroup/repo'
+            cand --host 'GitLab HTTPS origin, for example https://gitlab.example.com'
+            cand --output 'New manifest file. An existing file is never replaced'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
         &'ag;git;import'= {
             cand --rev 'Revision to import'
             cand --stream 'Stream to create for the imported history'
@@ -1787,6 +1807,7 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand workspace 'Inspect and explicitly sync server-side workspaces without a checkout'
             cand integrate 'Integrate a proposal into its stream'
             cand close 'Close a proposal without integrating it'
+            cand import-issues 'Preview or explicitly apply a normalized GitHub/GitLab issue manifest'
             cand streams 'List streams'
             cand events 'Show the events of the repository (replay), or follow them live'
             cand policy 'Show or set a stream''s policy'
@@ -2464,6 +2485,26 @@ set edit:completion:arg-completer[ag] = {|@words|
             cand -V 'Print version'
             cand --version 'Print version'
         }
+        &'ag;remote;import-issues'= {
+            cand --file 'Normalized GitHub/GitLab issue manifest (UTF-8 JSON, at most 4 MiB)'
+            cand --expected-digest 'Exact digest returned by the preview of this manifest'
+            cand --remote 'Remote to use (default: origin)'
+            cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --repo 'Operate on the repository at this path (default: discovered from the current directory)'
+            cand --as 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY'
+            cand --color 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never'
+            cand --apply 'Apply the manifest instead of only previewing it'
+            cand --allow-unsupported 'Acknowledge unsupported source features listed in the preview'
+            cand --json 'Machine-readable JSON output'
+            cand -q 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand --quiet 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+            cand -v 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand --verbose 'Explain what is happening on standard error: repository, identity, remote, timing'
+            cand -h 'Print help'
+            cand --help 'Print help'
+            cand -V 'Print version'
+            cand --version 'Print version'
+        }
         &'ag;remote;streams'= {
             cand --remote 'Remote to use (default: origin)'
             cand -C 'Operate on the repository at this path (default: discovered from the current directory)'
diff --git a/docs/reference/completions/ag.fish b/docs/reference/completions/ag.fish
index d8357175..b8915766 100644
--- a/docs/reference/completions/ag.fish
+++ b/docs/reference/completions/ag.fish
@@ -1123,18 +1123,34 @@ complete -c ag -n "__fish_ag_using_subcommand backup" -s q -l quiet -d 'Print on
 complete -c ag -n "__fish_ag_using_subcommand backup" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand backup" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand backup" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from import export" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
-complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from import export" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
-complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from import export" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
-always\t'Always colour'
-never\t'Never colour'"
-complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from import export" -l json -d 'Machine-readable JSON output'
-complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from import export" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
-complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from import export" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
-complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from import export" -s h -l help -d 'Print help'
-complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from import export" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from import export" -f -a "import" -d 'Import a Git repository\'s history into a new stream'
-complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from import export" -f -a "export" -d 'Export a stream\'s history to a Git repository (created if missing)'
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -f -a "export-issues" -d 'Export GitHub/GitLab issues and comments to a normalized import manifest'
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -f -a "import" -d 'Import a Git repository\'s history into a new stream'
+complete -c ag -n "__fish_ag_using_subcommand git; and not __fish_seen_subcommand_from export-issues import export" -f -a "export" -d 'Export a stream\'s history to a Git repository (created if missing)'
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -l provider -d 'Source hosting provider' -r -f -a "github\t''
+gitlab\t''"
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -l source -d 'Repository path, for example owner/repo or group/subgroup/repo' -r
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -l host -d 'GitLab HTTPS origin, for example https://gitlab.example.com' -r
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -l output -d 'New manifest file. An existing file is never replaced' -r -F
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from export-issues" -s V -l version -d 'Print version'
 complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from import" -l rev -d 'Revision to import' -r
 complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from import" -l stream -d 'Stream to create for the imported history' -r
 complete -c ag -n "__fish_ag_using_subcommand git; and __fish_seen_subcommand_from import" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
@@ -1212,40 +1228,41 @@ complete -c ag -n "__fish_ag_using_subcommand push" -s q -l quiet -d 'Print only
 complete -c ag -n "__fish_ag_using_subcommand push" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand push" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand push" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
-always\t'Always colour'
-never\t'Never colour'"
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s h -l help -d 'Print help'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -s V -l version -d 'Print version'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "add" -d 'Add a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "list" -d 'List remotes'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review-draft" -d 'Save or restore your private account review notes without submitting them'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "file-draft" -d 'Save or restore private file edits without publishing a changeset'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "comment-draft" -d 'Save or restore a private general comment without posting it'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "workspace" -d 'Inspect and explicitly sync server-side workspaces without a checkout'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "streams" -d 'List streams'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
-complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "add" -d 'Add a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "list" -d 'List remotes'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "remove" -d 'Forget a remote'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "whoami" -d 'Show who the server thinks you are'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "proposals" -d 'List proposals on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "proposal" -d 'Show a proposal with its reviews'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "prepare" -d 'What would integrating do now, and what is missing?'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "explain" -d 'Explain why a server proposal cannot land, with the next commands. Changes nothing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "reviewers" -d 'Inspect, add or remove requested reviewers (no approval or access change)'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "review-draft" -d 'Save or restore your private account review notes without submitting them'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "file-draft" -d 'Save or restore private file edits without publishing a changeset'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "comment-draft" -d 'Save or restore a private general comment without posting it'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "review" -d 'Review a proposal\'s current head'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "discussion" -d 'Read and participate in revision-bound line discussions'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "workspace" -d 'Inspect and explicitly sync server-side workspaces without a checkout'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "integrate" -d 'Integrate a proposal into its stream'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "close" -d 'Close a proposal without integrating it'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "import-issues" -d 'Preview or explicitly apply a normalized GitHub/GitLab issue manifest'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "streams" -d 'List streams'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "events" -d 'Show the events of the repository (replay), or follow them live'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "policy" -d 'Show or set a stream\'s policy'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "log" -d 'Show history of a revision on the server'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "blame" -d 'Show which changeset introduced each line of a file on the server: `ag remote blame main:src/lib.rs`'
+complete -c ag -n "__fish_ag_using_subcommand remote; and not __fish_seen_subcommand_from add list remove whoami proposals proposal prepare explain reviewers review-draft file-draft comment-draft review discussion workspace integrate close import-issues streams events policy log blame cat" -f -a "cat" -d 'Print a file as of a revision on the server: `ag remote cat main:src/lib.rs`'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l token-env -d 'Environment variable holding the credential' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l ca-file -d 'Extra CA certificate (PEM) to trust' -r -F
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from add" -l remote -d 'Remote to use (default: origin)' -r
@@ -1468,6 +1485,21 @@ complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from close" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from close" -s h -l help -d 'Print help'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from close" -s V -l version -d 'Print version'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -l file -d 'Normalized GitHub/GitLab issue manifest (UTF-8 JSON, at most 4 MiB)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -l expected-digest -d 'Exact digest returned by the preview of this manifest' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -l remote -d 'Remote to use (default: origin)' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -l color -d 'Colour the output: auto (a terminal, unless NO_COLOR is set), always or never' -r -f -a "auto\t'Colour when the stream is a terminal and neither `NO_COLOR` nor `TERM=dumb` says otherwise'
+always\t'Always colour'
+never\t'Never colour'"
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -l apply -d 'Apply the manifest instead of only previewing it'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -l allow-unsupported -d 'Acknowledge unsupported source features listed in the preview'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -l json -d 'Machine-readable JSON output'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -s q -l quiet -d 'Print only what was asked for: no confirmations or hints. Errors and refusals are still shown'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -s v -l verbose -d 'Explain what is happening on standard error: repository, identity, remote, timing'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -s h -l help -d 'Print help'
+complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from import-issues" -s V -l version -d 'Print version'
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from streams" -l remote -d 'Remote to use (default: origin)' -r
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from streams" -s C -l repo -d 'Operate on the repository at this path (default: discovered from the current directory)' -r -F
 complete -c ag -n "__fish_ag_using_subcommand remote; and __fish_seen_subcommand_from streams" -l as -d 'Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY' -r
diff --git a/docs/reference/man/ag-git-export-issues.1 b/docs/reference/man/ag-git-export-issues.1
new file mode 100644
index 00000000..361ff87c
--- /dev/null
+++ b/docs/reference/man/ag-git-export-issues.1
@@ -0,0 +1,58 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-git-export-issues 1  "export-issues 0.3.0-beta.7"
+.SH NAME
+ag\-git\-export\-issues \- Export GitHub/GitLab issues and comments to a normalized import manifest
+.SH SYNOPSIS
+\fBag git export\-issues\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-as\fR] [\fB\-\-host\fR] [\fB\-\-json\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fB\-\-provider\fR> <\fB\-\-source\fR> <\fB\-\-output\fR>
+.SH DESCRIPTION
+Export GitHub/GitLab issues and comments to a normalized import manifest
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-provider\fR \fI<PROVIDER>\fR
+Source hosting provider
+.br
+
+.br
+\fIPossible values:\fR
+.RS 14
+.IP \(bu 2
+github
+.IP \(bu 2
+gitlab
+.RE
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-source\fR \fI<SOURCE>\fR
+Repository path, for example owner/repo or group/subgroup/repo
+.TP
+\fB\-\-host\fR \fI<HOST>\fR
+GitLab HTTPS origin, for example https://gitlab.example.com
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-\-output\fR \fI<OUTPUT>\fR
+New manifest file. An existing file is never replaced
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-git.1 b/docs/reference/man/ag-git.1
index 507279dc..ff4b24b4 100644
--- a/docs/reference/man/ag-git.1
+++ b/docs/reference/man/ag-git.1
@@ -34,6 +34,9 @@ Print help
 Print version
 .SH SUBCOMMANDS
 .TP
+ag\-git\-export\-issues(1)
+Export GitHub/GitLab issues and comments to a normalized import manifest
+.TP
 ag\-git\-import(1)
 Import a Git repository\*(Aqs history into a new stream
 .TP
diff --git a/docs/reference/man/ag-remote-import-issues.1 b/docs/reference/man/ag-remote-import-issues.1
new file mode 100644
index 00000000..e7016928
--- /dev/null
+++ b/docs/reference/man/ag-remote-import-issues.1
@@ -0,0 +1,51 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH ag-remote-import-issues 1  "import-issues 0.3.0-beta.7"
+.SH NAME
+ag\-remote\-import\-issues \- Preview or explicitly apply a normalized GitHub/GitLab issue manifest
+.SH SYNOPSIS
+\fBag remote import\-issues\fR [\fB\-C\fR|\fB\-\-repo\fR] [\fB\-\-remote\fR] [\fB\-\-apply\fR] [\fB\-\-as\fR] [\fB\-\-expected\-digest\fR] [\fB\-\-json\fR] [\fB\-\-allow\-unsupported\fR] [\fB\-\-color\fR] [\fB\-q\fR|\fB\-\-quiet\fR] [\fB\-v\fR|\fB\-\-verbose\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] <\fB\-\-file\fR>
+.SH DESCRIPTION
+Preview or explicitly apply a normalized GitHub/GitLab issue manifest
+.SH OPTIONS
+.TP
+\fB\-C\fR, \fB\-\-repo\fR \fI<DIR>\fR
+Operate on the repository at this path (default: discovered from the current directory)
+.TP
+\fB\-\-file\fR \fI<PATH>\fR
+Normalized GitHub/GitLab issue manifest (UTF\-8 JSON, at most 4 MiB)
+.TP
+\fB\-\-remote\fR \fI<REMOTE>\fR
+Remote to use (default: origin)
+.TP
+\fB\-\-apply\fR
+Apply the manifest instead of only previewing it
+.TP
+\fB\-\-as\fR \fI<IDENTITY>\fR
+Act as this identity (`user:alice`, `agent:bot#run_…`, `service:ci`). Also: AG_IDENTITY
+.TP
+\fB\-\-expected\-digest\fR \fI<DIGEST>\fR
+Exact digest returned by the preview of this manifest
+.TP
+\fB\-\-json\fR
+Machine\-readable JSON output
+.TP
+\fB\-\-allow\-unsupported\fR
+Acknowledge unsupported source features listed in the preview
+.TP
+\fB\-\-color\fR \fI<WHEN>\fR
+Colour the output: auto (a terminal, unless NO_COLOR is set), always or never
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Print only what was asked for: no confirmations or hints. Errors and refusals are still shown
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+Explain what is happening on standard error: repository, identity, remote, timing
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH VERSION
+v0.3.0\-beta.7
diff --git a/docs/reference/man/ag-remote.1 b/docs/reference/man/ag-remote.1
index 2ce60f51..19a8f5a1 100644
--- a/docs/reference/man/ag-remote.1
+++ b/docs/reference/man/ag-remote.1
@@ -88,6 +88,9 @@ Integrate a proposal into its stream
 ag\-remote\-close(1)
 Close a proposal without integrating it
 .TP
+ag\-remote\-import\-issues(1)
+Preview or explicitly apply a normalized GitHub/GitLab issue manifest
+.TP
 ag\-remote\-streams(1)
 List streams
 .TP

From a82b9dd3c7d044507292d43b93055cd5fd7f4d0b Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:51:21 +0000
Subject: [PATCH 39/41] feat(clients): preview and resume hosting issue imports

---
 crates/ag-mcp/src/config.rs                   |  11 +-
 crates/ag-mcp/src/main.rs                     |   2 +-
 crates/ag-mcp/src/tools/issue_import.rs       |  90 +++++++++
 crates/ag-mcp/src/tools/mod.rs                |   3 +
 docs/guides/mcp.md                            |   3 +-
 sdk/api-policy.json                           |   6 +-
 sdk/python/README.md                          |   6 +
 sdk/python/src/agentgit/_generated/models.py  |  48 +++++
 .../src/agentgit/_generated/namespaces.py     |  49 +++++
 .../src/agentgit/_generated/operations.py     |  32 ++++
 sdk/python/tests/test_all_operations.py       |  26 +++
 sdk/typescript/README.md                      |   6 +
 sdk/typescript/src/generated/api.ts           |   6 +
 sdk/typescript/src/generated/models.ts        |   5 +
 sdk/typescript/src/generated/operations.ts    |  30 +++
 sdk/typescript/src/generated/schema.ts        | 177 ++++++++++++++++++
 sdk/typescript/test/all-operations.test.ts    |  28 +++
 17 files changed, 522 insertions(+), 6 deletions(-)
 create mode 100644 crates/ag-mcp/src/tools/issue_import.rs

diff --git a/crates/ag-mcp/src/config.rs b/crates/ag-mcp/src/config.rs
index 7d923239..9765314b 100644
--- a/crates/ag-mcp/src/config.rs
+++ b/crates/ag-mcp/src/config.rs
@@ -22,19 +22,22 @@ pub enum Group {
     Discuss,
     /// Approve, request changes or comment on a proposal.
     Review,
+    /// Preview and apply normalized issue imports. Off unless explicitly named.
+    Issue,
     /// Land a proposal on its stream. Off unless the operator passes `--enable-integrate`.
     Integrate,
 }
 
 impl Group {
     /// Every group.
-    pub const ALL: [Group; 7] = [
+    pub const ALL: [Group; 8] = [
         Group::Read,
         Group::Workspace,
         Group::Propose,
         Group::Coordinate,
         Group::Discuss,
         Group::Review,
+        Group::Issue,
         Group::Integrate,
     ];
 
@@ -47,6 +50,7 @@ impl Group {
             Group::Coordinate => "coordinate",
             Group::Discuss => "discuss",
             Group::Review => "review",
+            Group::Issue => "issue",
             Group::Integrate => "integrate",
         }
     }
@@ -60,13 +64,16 @@ impl Group {
             "coordinate" => Ok(Group::Coordinate),
             "discuss" => Ok(Group::Discuss),
             "review" => Ok(Group::Review),
+            "issue" => Ok(Group::Issue),
             "integrate" => Err("`integrate` lands code on a stream; it cannot be switched on through --allow. \
                                 Pass --enable-integrate explicitly if you really want the integrate tool"
                 .into()),
             "admin" => Err("there is no `admin` group: policy, roles and credentials are deliberately not reachable \
                             through MCP"
                 .into()),
-            other => Err(format!("unknown group `{other}` (read, workspace, propose, coordinate, discuss, review)")),
+            other => {
+                Err(format!("unknown group `{other}` (read, workspace, propose, coordinate, discuss, review, issue)"))
+            }
         }
     }
 }
diff --git a/crates/ag-mcp/src/main.rs b/crates/ag-mcp/src/main.rs
index e6229e53..ae5c76f6 100644
--- a/crates/ag-mcp/src/main.rs
+++ b/crates/ag-mcp/src/main.rs
@@ -34,7 +34,7 @@ struct Cli {
     #[arg(long = "repo", env = "AG_MCP_REPO", value_delimiter = ',')]
     repos: Vec<String>,
 
-    /// Tool groups to switch on, comma-separated: read, workspace, propose, coordinate, discuss, review.
+    /// Tool groups to switch on, comma-separated: read, workspace, propose, coordinate, discuss, review, issue.
     /// Default: read,workspace,propose,coordinate,discuss.
     #[arg(long, env = "AG_MCP_ALLOW", value_delimiter = ',')]
     allow: Vec<String>,
diff --git a/crates/ag-mcp/src/tools/issue_import.rs b/crates/ag-mcp/src/tools/issue_import.rs
new file mode 100644
index 00000000..daddc28d
--- /dev/null
+++ b/crates/ag-mcp/src/tools/issue_import.rs
@@ -0,0 +1,90 @@
+//! Explicit preview and apply of normalized issue-import manifests.
+
+use serde_json::{Value, json};
+
+use super::*;
+use crate::api::repo_path;
+
+const MAX_MANIFEST_BYTES: usize = 4 * 1024 * 1024;
+
+fn import(ctx: &CallCtx<'_>, args: &Value, apply: bool) -> Result<ToolOutput, ToolError> {
+    let repo = ctx.repo(args)?;
+    let opts = ctx.opts(ctx.run_id(args)?);
+    let manifest = str_arg(args, "manifest_json").unwrap_or_default();
+    if manifest.len() > MAX_MANIFEST_BYTES {
+        return Err(ToolError::invalid("The import manifest exceeds 4 MiB of UTF-8"));
+    }
+    if !ctx.api.supports("issues.import", &opts)? {
+        return Err(ToolError::local("server_update_required", "This server does not support issue imports."));
+    }
+    let mut body = json!({"manifest_json":manifest});
+    let action = if apply { "apply" } else { "preview" };
+    if apply {
+        body["expected_digest"] = json!(str_arg(args, "expected_digest").unwrap_or_default());
+        body["allow_unsupported"] = json!(args.get("allow_unsupported").and_then(Value::as_bool).unwrap_or(false));
+    }
+    let value = ctx.api.send("POST", &format!("{}/issues/import/{action}", repo_path(&repo)), Some(&body), &opts)?;
+    let summary = if apply {
+        "Issue import applied. Existing source mappings prevent duplicate imports."
+    } else {
+        "Import preview only. Inspect conflicts and warnings before explicitly applying this digest."
+    };
+    Ok(ToolOutput::new(summary, value))
+}
+
+fn preview(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    import(ctx, args, false)
+}
+fn apply(ctx: &CallCtx<'_>, args: &Value) -> Result<ToolOutput, ToolError> {
+    import(ctx, args, true)
+}
+
+/// Import tools require the explicit issue group; neither runs by default.
+pub fn tools() -> Vec<ToolDef> {
+    let fields = || {
+        vec![
+            p_repo(),
+            (
+                "manifest_json",
+                t_str_max(
+                    "Serialized normalized import manifest, at most 4 MiB UTF-8. No provider credentials.",
+                    MAX_MANIFEST_BYTES,
+                ),
+            ),
+            p_run(),
+        ]
+    };
+    let mut apply_fields = fields();
+    apply_fields.extend([
+        ("expected_digest", t_str_max("Exact digest returned by the inspected preview.", 64)),
+        ("allow_unsupported", t_bool("Explicitly accept unsupported items reported by preview; false refuses them.")),
+    ]);
+    vec![
+        def(
+            "issue_import_preview",
+            Group::Issue,
+            "Preview an issue import",
+            "Validates a normalized import manifest without writing. Returns its digest, counts, mappings conflicts and unsupported-item warnings. Inspect this result before calling issue_import_apply.",
+            Ann::READ,
+            input(fields(), &["manifest_json"]),
+            output(
+                vec![("digest", o_str()), ("warnings", o_arr()), ("conflicts", o_arr())],
+                &["digest", "warnings", "conflicts"],
+            ),
+            preview,
+        ),
+        def(
+            "issue_import_apply",
+            Group::Issue,
+            "Apply an inspected issue import",
+            "Imports issues and comments from the exact previewed manifest. Requires the preview digest and an explicit unsupported-item decision. Durable source mappings make retries safe; no provider credentials are accepted.",
+            Ann::SET,
+            input(apply_fields, &["manifest_json", "expected_digest", "allow_unsupported"]),
+            output(
+                vec![("created", o_int()), ("skipped", o_int()), ("mappings", o_arr())],
+                &["created", "skipped", "mappings"],
+            ),
+            apply,
+        ),
+    ]
+}
diff --git a/crates/ag-mcp/src/tools/mod.rs b/crates/ag-mcp/src/tools/mod.rs
index ff1c4453..e5caa2c5 100644
--- a/crates/ag-mcp/src/tools/mod.rs
+++ b/crates/ag-mcp/src/tools/mod.rs
@@ -12,6 +12,7 @@ use crate::output::{ToolError, ToolOutput};
 pub mod coordinate;
 pub mod discussions;
 pub mod file_drafts;
+pub mod issue_import;
 pub mod proposals;
 pub mod read;
 pub mod workspace;
@@ -104,6 +105,7 @@ impl Registry {
         tools.extend(proposals::tools());
         tools.extend(discussions::tools());
         tools.extend(coordinate::tools());
+        tools.extend(issue_import::tools());
         Self::from_tools(tools)
     }
 
@@ -429,6 +431,7 @@ mod tests {
                 Group::Workspace if matches!(t.name, "file_draft_get" | "file_draft_list") => {
                     assert!(t.ann.read_only);
                 }
+                Group::Issue if t.name == "issue_import_preview" => assert!(t.ann.read_only),
                 _ => assert!(!t.ann.read_only, "{} changes state so it cannot be marked read-only", t.name),
             }
         }
diff --git a/docs/guides/mcp.md b/docs/guides/mcp.md
index e0238b49..940019b3 100644
--- a/docs/guides/mcp.md
+++ b/docs/guides/mcp.md
@@ -169,7 +169,7 @@ and the client decides.
 
 ## 4. What the agent gets
 
-39 tools in seven groups. The default is `read,workspace,propose,coordinate,discuss`; `--allow` names the groups explicitly.
+Tools are organized by permission group. The default is `read,workspace,propose,coordinate,discuss`; `--allow` names the groups explicitly.
 
 | Group | Tools |
 |---|---|
@@ -178,6 +178,7 @@ and the client decides.
 | `propose` | `propose`, `proposal_update`, `proposal_close`, `request_validation` |
 | `coordinate` | `task_claim`, `run_start`, `task_complete`, `run_heartbeat`, `run_finish`, `lease_acquire`, `lease_renew`, `lease_release` |
 | `discuss` | `discussion_start`, `discussion_reply`, `discussion_resolve`: exact-revision threads with version-bound resolution; no approval or integration rights |
+| `issue` (off unless named) | `issue_import_preview`, `issue_import_apply`: inspect a normalized import manifest, then explicitly apply its digest; no provider credentials |
 | `review` (off unless named) | `review`: approve, request changes or comment on a proposal's head. Keep it off for an agent that also authors changes: an author must not review its own work |
 | `integrate` (only with `--enable-integrate`) | `integrate`: lands a proposal if policy allows. It logs a warning at start and on every call |
 
diff --git a/sdk/api-policy.json b/sdk/api-policy.json
index fec617b7..b5f8f65c 100644
--- a/sdk/api-policy.json
+++ b/sdk/api-policy.json
@@ -6,7 +6,8 @@
       "tree.diff",
       "objects.missing",
       "objects.verify",
-      "admin.fsck"
+      "admin.fsck",
+      "issue.import_preview"
     ],
     "keyed": [
       "repo.create",
@@ -58,7 +59,8 @@
       "proposal.save_comment_draft",
       "proposal.clear_comment_draft",
       "file_draft.save",
-      "file_draft.clear"
+      "file_draft.clear",
+      "issue.import_apply"
     ],
     "naturalWhenFieldPresent": {
       "workspace.modify": "expected_head",
diff --git a/sdk/python/README.md b/sdk/python/README.md
index b02416ab..60458111 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -552,6 +552,12 @@ first. These drafts contain `head` and `body` (up to 16 KiB of UTF-8), remain se
 from review-decision drafts, and can be saved on closed proposals. Saving or clearing
 a draft never posts a comment; post explicitly after inspecting the current proposal head.
 
+Issue migration uses `client.issues.import_preview` and `import_apply` after negotiating `issues.import`.
+Pass a serialized normalized manifest in `manifest_json` (up to 4 MiB). Inspect the
+preview's warnings and conflicts, then explicitly apply the same manifest with its
+`expected_digest` and `allow_unsupported` decision. Durable source mappings make
+retrying an interrupted import safe. These methods do not accept provider credentials.
+
 Cross-repository activity uses `client.events.replay_many` and `subscribe_many` after negotiating
 `events.multi_repo`. Pass 1–30 explicit repositories. An empty cursor checkpoints now;
 replay with `from_start` to read history. Keep the returned opaque cursor and the same
diff --git a/sdk/python/src/agentgit/_generated/models.py b/sdk/python/src/agentgit/_generated/models.py
index 7901c793..5308fe30 100644
--- a/sdk/python/src/agentgit/_generated/models.py
+++ b/sdk/python/src/agentgit/_generated/models.py
@@ -14,6 +14,7 @@
     "Agent",
     "AncestorsRequest",
     "AncestorsResponse",
+    "ApplyIssueImportRequest",
     "AssignTaskRequest",
     "Attestation",
     "AuditEntry",
@@ -97,11 +98,14 @@
     "HeartbeatJobRequest",
     "HeartbeatRequest",
     "HeartbeatResponse",
+    "ImportedIssueMapping",
     "IntegrateRequest",
     "IntegrationOutcome",
     "IntegrationResult",
     "Issue",
     "IssueActivity",
+    "IssueImportPreview",
+    "IssueImportResult",
     "Job",
     "Lease",
     "LeaseRef",
@@ -174,6 +178,7 @@
     "PredictResponse",
     "Preparation",
     "PrepareRequest",
+    "PreviewIssueImportRequest",
     "Principal",
     "Proposal",
     "ProposalDetail",
@@ -332,6 +337,15 @@ class AncestorsResponse:
     next_page_token: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class ApplyIssueImportRequest:
+    """The `ApplyIssueImportRequest` message."""
+    allow_unsupported: bool = field(default=False)
+    expected_digest: str = field(default="")
+    manifest_json: str = field(default="")
+    repo: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class AssignTaskRequest:
     """The `AssignTaskRequest` message."""
@@ -1100,6 +1114,13 @@ class HeartbeatResponse:
     server_time_ms: int = field(default=0)
 
 
+@dataclass(kw_only=True)
+class ImportedIssueMapping:
+    """The `ImportedIssueMapping` message."""
+    number: int = field(default=0)
+    source_id: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class IntegrateRequest:
     """The `IntegrateRequest` message."""
@@ -1161,6 +1182,26 @@ class IssueActivity:
     kind: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class IssueImportPreview:
+    """The `IssueImportPreview` message."""
+    comments: int = field(default=0)
+    conflicts: list[str] = field(default_factory=list)
+    create_count: int = field(default=0)
+    digest: str = field(default="")
+    issues: int = field(default=0)
+    skip_count: int = field(default=0)
+    warnings: list[str] = field(default_factory=list)
+
+
+@dataclass(kw_only=True)
+class IssueImportResult:
+    """The `IssueImportResult` message."""
+    created: int = field(default=0)
+    mappings: list[ImportedIssueMapping] = field(default_factory=list)
+    skipped: int = field(default=0)
+
+
 @dataclass(kw_only=True)
 class Job:
     """The `Job` message."""
@@ -1740,6 +1781,13 @@ class PrepareRequest:
     repo: str = field(default="")
 
 
+@dataclass(kw_only=True)
+class PreviewIssueImportRequest:
+    """The `PreviewIssueImportRequest` message."""
+    manifest_json: str = field(default="")
+    repo: str = field(default="")
+
+
 @dataclass(kw_only=True)
 class Principal:
     """The `Principal` message."""
diff --git a/sdk/python/src/agentgit/_generated/namespaces.py b/sdk/python/src/agentgit/_generated/namespaces.py
index 8325c566..4c431573 100644
--- a/sdk/python/src/agentgit/_generated/namespaces.py
+++ b/sdk/python/src/agentgit/_generated/namespaces.py
@@ -14,6 +14,7 @@
     Agent,
     AncestorsRequest,
     AncestorsResponse,
+    ApplyIssueImportRequest,
     AssignTaskRequest,
     Attestation,
     AuditEntry,
@@ -97,11 +98,14 @@
     HeartbeatJobRequest,
     HeartbeatRequest,
     HeartbeatResponse,
+    ImportedIssueMapping,
     IntegrateRequest,
     IntegrationOutcome,
     IntegrationResult,
     Issue,
     IssueActivity,
+    IssueImportPreview,
+    IssueImportResult,
     Job,
     Lease,
     LeaseRef,
@@ -174,6 +178,7 @@
     PredictResponse,
     Preparation,
     PrepareRequest,
+    PreviewIssueImportRequest,
     Principal,
     Proposal,
     ProposalDetail,
@@ -915,6 +920,28 @@ def get(
         """Read a user issue (`GET /v1/repos/{owner}/{rname}/issues/{number}`, operation `issue.get`)."""
         return self._c._call("issue.get", {"repo": repo, "number": number}, options, Issue)
 
+    def import_apply(
+        self,
+        *,
+        repo: str,
+        allow_unsupported: bool | None = None,
+        expected_digest: str | None = None,
+        manifest_json: str | None = None,
+        options: CallOptions | None = None,
+    ) -> IssueImportResult:
+        """Apply the inspected import manifest digest (`POST /v1/repos/{owner}/{rname}/issues/import/apply`, operation `issue.import_apply`)."""
+        return self._c._call("issue.import_apply", {"repo": repo, "allow_unsupported": allow_unsupported, "expected_digest": expected_digest, "manifest_json": manifest_json}, options, IssueImportResult)
+
+    def import_preview(
+        self,
+        *,
+        repo: str,
+        manifest_json: str | None = None,
+        options: CallOptions | None = None,
+    ) -> IssueImportPreview:
+        """Preview normalized hosting issues and comments (`POST /v1/repos/{owner}/{rname}/issues/import/preview`, operation `issue.import_preview`)."""
+        return self._c._call("issue.import_preview", {"repo": repo, "manifest_json": manifest_json}, options, IssueImportPreview)
+
     def list(
         self,
         *,
@@ -2703,6 +2730,28 @@ async def get(
         """Read a user issue (`GET /v1/repos/{owner}/{rname}/issues/{number}`, operation `issue.get`)."""
         return await self._c._call("issue.get", {"repo": repo, "number": number}, options, Issue)
 
+    async def import_apply(
+        self,
+        *,
+        repo: str,
+        allow_unsupported: bool | None = None,
+        expected_digest: str | None = None,
+        manifest_json: str | None = None,
+        options: CallOptions | None = None,
+    ) -> IssueImportResult:
+        """Apply the inspected import manifest digest (`POST /v1/repos/{owner}/{rname}/issues/import/apply`, operation `issue.import_apply`)."""
+        return await self._c._call("issue.import_apply", {"repo": repo, "allow_unsupported": allow_unsupported, "expected_digest": expected_digest, "manifest_json": manifest_json}, options, IssueImportResult)
+
+    async def import_preview(
+        self,
+        *,
+        repo: str,
+        manifest_json: str | None = None,
+        options: CallOptions | None = None,
+    ) -> IssueImportPreview:
+        """Preview normalized hosting issues and comments (`POST /v1/repos/{owner}/{rname}/issues/import/preview`, operation `issue.import_preview`)."""
+        return await self._c._call("issue.import_preview", {"repo": repo, "manifest_json": manifest_json}, options, IssueImportPreview)
+
     async def list(
         self,
         *,
diff --git a/sdk/python/src/agentgit/_generated/operations.py b/sdk/python/src/agentgit/_generated/operations.py
index b688ace9..4c1770a5 100644
--- a/sdk/python/src/agentgit/_generated/operations.py
+++ b/sdk/python/src/agentgit/_generated/operations.py
@@ -800,6 +800,36 @@
         idempotency_key=False,
         public=False,
     ),
+    "issue.import_apply": OperationInfo(
+        id="issue.import_apply",
+        http="POST",
+        route="/v1/repos/{owner}/{rname}/issues/import/apply",
+        namespace="issues",
+        name="import_apply",
+        summary="Apply the inspected import manifest digest",
+        path_params=('owner', 'rname'),
+        query_params=(),
+        body="json",
+        response="json",
+        retry="natural",
+        idempotency_key=False,
+        public=False,
+    ),
+    "issue.import_preview": OperationInfo(
+        id="issue.import_preview",
+        http="POST",
+        route="/v1/repos/{owner}/{rname}/issues/import/preview",
+        namespace="issues",
+        name="import_preview",
+        summary="Preview normalized hosting issues and comments",
+        path_params=('owner', 'rname'),
+        query_params=(),
+        body="json",
+        response="json",
+        retry="read",
+        idempotency_key=False,
+        public=False,
+    ),
     "issue.list": OperationInfo(
         id="issue.list",
         http="GET",
@@ -2088,6 +2118,8 @@
         "comment": "issue.comment",
         "create": "issue.create",
         "get": "issue.get",
+        "import_apply": "issue.import_apply",
+        "import_preview": "issue.import_preview",
         "list": "issue.list",
         "update": "issue.update",
     },
diff --git a/sdk/python/tests/test_all_operations.py b/sdk/python/tests/test_all_operations.py
index 8ca0b42d..4a9c92e6 100644
--- a/sdk/python/tests/test_all_operations.py
+++ b/sdk/python/tests/test_all_operations.py
@@ -459,6 +459,32 @@ def test_operator_scheduling_gate(tour: dict[str, AgentGitClient]) -> None:
 
 def test_issue_discussion(tour: dict[str, AgentGitClient]) -> None:
     alice = tour["alice"]
+    manifest = json.dumps(
+        {
+            "version": 1,
+            "provider": "github",
+            "source_repo": "https://github.com/source/project",
+            "issues": [
+                {
+                    "source_id": "1",
+                    "title": "Imported issue",
+                    "body": "Original text",
+                    "state": "open",
+                    "author": "source-user",
+                    "url": "https://github.com/source/project/issues/1",
+                    "created_at_ms": 0,
+                    "updated_at_ms": 0,
+                }
+            ],
+        }
+    )
+    preview = alice.issues.import_preview(repo=REPO, manifest_json=manifest)
+    assert (
+        alice.issues.import_apply(
+            repo=REPO, manifest_json=manifest, expected_digest=preview.digest, allow_unsupported=False
+        ).created
+        == 1
+    )
     issue = alice.issues.create(repo=REPO, title="Move the project", body="Keep history")
     assert alice.issues.get(repo=REPO, number=issue.number).title == issue.title
     assert any(item.number == issue.number for item in alice.paginate("issue.list", repo=REPO))
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index e8171571..36308281 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -512,6 +512,12 @@ first. These drafts contain `head` and `body` (up to 16 KiB of UTF-8), remain se
 from review-decision drafts, and can be saved on closed proposals. Saving or clearing
 a draft never posts a comment; post explicitly after inspecting the current proposal head.
 
+Issue migration uses `client.issues.importPreview` and `importApply` after negotiating `issues.import`.
+Pass a serialized normalized manifest in `manifest_json` (up to 4 MiB). Inspect the
+preview's warnings and conflicts, then explicitly apply the same manifest with its
+`expected_digest` and `allow_unsupported` decision. Durable source mappings make
+retrying an interrupted import safe. These methods do not accept provider credentials.
+
 Cross-repository activity uses `client.events.replayMany` and `subscribeMany` after negotiating
 `events.multi_repo`. Pass 1–30 explicit repositories. An empty cursor checkpoints now;
 replay with `from_start` to read history. Keep the returned opaque cursor and the same
diff --git a/sdk/typescript/src/generated/api.ts b/sdk/typescript/src/generated/api.ts
index 46201821..97d7b007 100644
--- a/sdk/typescript/src/generated/api.ts
+++ b/sdk/typescript/src/generated/api.ts
@@ -72,6 +72,8 @@ export const NAMESPACE_METHODS = {
     comment: 'issue.comment',
     create: 'issue.create',
     get: 'issue.get',
+    importApply: 'issue.import_apply',
+    importPreview: 'issue.import_preview',
     list: 'issue.list',
     update: 'issue.update',
   },
@@ -305,6 +307,10 @@ export interface Api {
     create(request: Req<'issue.create'>, options?: CallOptions): Promise<Res<'issue.create'>>;
     /** Read a user issue (`GET /v1/repos/{owner}/{rname}/issues/{number}`, operation `issue.get`) */
     get(request: Req<'issue.get'>, options?: CallOptions): Promise<Res<'issue.get'>>;
+    /** Apply the inspected import manifest digest (`POST /v1/repos/{owner}/{rname}/issues/import/apply`, operation `issue.import_apply`) */
+    importApply(request: Req<'issue.import_apply'>, options?: CallOptions): Promise<Res<'issue.import_apply'>>;
+    /** Preview normalized hosting issues and comments (`POST /v1/repos/{owner}/{rname}/issues/import/preview`, operation `issue.import_preview`) */
+    importPreview(request: Req<'issue.import_preview'>, options?: CallOptions): Promise<Res<'issue.import_preview'>>;
     /** List user issues (`GET /v1/repos/{owner}/{rname}/issues`, operation `issue.list`) */
     list(request: Req<'issue.list'>, options?: CallOptions): Promise<Res<'issue.list'>>;
     /** Edit or close an issue at an expected version (`PUT /v1/repos/{owner}/{rname}/issues/{number}`, operation `issue.update`) */
diff --git a/sdk/typescript/src/generated/models.ts b/sdk/typescript/src/generated/models.ts
index 38e3b812..9d8b736c 100644
--- a/sdk/typescript/src/generated/models.ts
+++ b/sdk/typescript/src/generated/models.ts
@@ -13,6 +13,7 @@ export type AddThreadCommentRequest = S['AddThreadCommentRequest'];
 export type Agent = S['Agent'];
 export type AncestorsRequest = S['AncestorsRequest'];
 export type AncestorsResponse = S['AncestorsResponse'];
+export type ApplyIssueImportRequest = S['ApplyIssueImportRequest'];
 export type AssignTaskRequest = S['AssignTaskRequest'];
 export type Attestation = S['Attestation'];
 export type AuditEntry = S['AuditEntry'];
@@ -95,11 +96,14 @@ export type GrantRoleRequest = S['GrantRoleRequest'];
 export type HeartbeatJobRequest = S['HeartbeatJobRequest'];
 export type HeartbeatRequest = S['HeartbeatRequest'];
 export type HeartbeatResponse = S['HeartbeatResponse'];
+export type ImportedIssueMapping = S['ImportedIssueMapping'];
 export type IntegrateRequest = S['IntegrateRequest'];
 export type IntegrationOutcome = S['IntegrationOutcome'];
 export type IntegrationResult = S['IntegrationResult'];
 export type Issue = S['Issue'];
 export type IssueActivity = S['IssueActivity'];
+export type IssueImportPreview = S['IssueImportPreview'];
+export type IssueImportResult = S['IssueImportResult'];
 export type Job = S['Job'];
 export type Lease = S['Lease'];
 export type LeaseRef = S['LeaseRef'];
@@ -172,6 +176,7 @@ export type PredictRequest = S['PredictRequest'];
 export type PredictResponse = S['PredictResponse'];
 export type Preparation = S['Preparation'];
 export type PrepareRequest = S['PrepareRequest'];
+export type PreviewIssueImportRequest = S['PreviewIssueImportRequest'];
 export type Principal = S['Principal'];
 export type Proposal = S['Proposal'];
 export type ProposalDetail = S['ProposalDetail'];
diff --git a/sdk/typescript/src/generated/operations.ts b/sdk/typescript/src/generated/operations.ts
index d867d4b0..de71295e 100644
--- a/sdk/typescript/src/generated/operations.ts
+++ b/sdk/typescript/src/generated/operations.ts
@@ -800,6 +800,36 @@ export const OPERATIONS = {
     idempotencyKey: false,
     public: false,
   },
+  'issue.import_apply': {
+    id: 'issue.import_apply',
+    http: 'POST',
+    route: '/v1/repos/{owner}/{rname}/issues/import/apply',
+    namespace: 'issues',
+    name: 'importApply',
+    summary: 'Apply the inspected import manifest digest',
+    pathParams: ['owner', 'rname'],
+    queryParams: [],
+    body: 'json',
+    response: 'json',
+    retry: 'natural',
+    idempotencyKey: false,
+    public: false,
+  },
+  'issue.import_preview': {
+    id: 'issue.import_preview',
+    http: 'POST',
+    route: '/v1/repos/{owner}/{rname}/issues/import/preview',
+    namespace: 'issues',
+    name: 'importPreview',
+    summary: 'Preview normalized hosting issues and comments',
+    pathParams: ['owner', 'rname'],
+    queryParams: [],
+    body: 'json',
+    response: 'json',
+    retry: 'read',
+    idempotencyKey: false,
+    public: false,
+  },
   'issue.list': {
     id: 'issue.list',
     http: 'GET',
diff --git a/sdk/typescript/src/generated/schema.ts b/sdk/typescript/src/generated/schema.ts
index 99c6a5fb..348b5491 100644
--- a/sdk/typescript/src/generated/schema.ts
+++ b/sdk/typescript/src/generated/schema.ts
@@ -553,6 +553,40 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/repos/{owner}/{rname}/issues/import/apply": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Apply the inspected import manifest digest */
+        post: operations["issue.import_apply"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/repos/{owner}/{rname}/issues/import/preview": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Preview normalized hosting issues and comments */
+        post: operations["issue.import_preview"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/repos/{owner}/{rname}/issues/{number}": {
         parameters: {
             query?: never;
@@ -1818,6 +1852,16 @@ export interface components {
             /** @default  */
             next_page_token: string;
         };
+        ApplyIssueImportRequest: {
+            /** @default false */
+            allow_unsupported: boolean;
+            /** @default  */
+            expected_digest: string;
+            /** @default  */
+            manifest_json: string;
+            /** @default  */
+            repo: string;
+        };
         AssignTaskRequest: {
             /**
              * @description Registered agent name; empty restores automatic routing.
@@ -3155,6 +3199,15 @@ export interface components {
              */
             server_time_ms: number;
         };
+        ImportedIssueMapping: {
+            /**
+             * Format: int64
+             * @default 0
+             */
+            number: number;
+            /** @default  */
+            source_id: string;
+        };
         IntegrateRequest: {
             /**
              * @description Fencing tokens of exclusive leases the author holds.
@@ -3285,6 +3338,48 @@ export interface components {
             /** @default  */
             kind: string;
         };
+        IssueImportPreview: {
+            /**
+             * Format: int32
+             * @default 0
+             */
+            comments: number;
+            /** @default [] */
+            conflicts: string[];
+            /**
+             * Format: int32
+             * @default 0
+             */
+            create_count: number;
+            /** @default  */
+            digest: string;
+            /**
+             * Format: int32
+             * @default 0
+             */
+            issues: number;
+            /**
+             * Format: int32
+             * @default 0
+             */
+            skip_count: number;
+            /** @default [] */
+            warnings: string[];
+        };
+        IssueImportResult: {
+            /**
+             * Format: int32
+             * @default 0
+             */
+            created: number;
+            /** @default [] */
+            mappings: components["schemas"]["ImportedIssueMapping"][];
+            /**
+             * Format: int32
+             * @default 0
+             */
+            skipped: number;
+        };
         Job: {
             /**
              * Format: int32
@@ -4091,6 +4186,12 @@ export interface components {
             /** @default  */
             repo: string;
         };
+        PreviewIssueImportRequest: {
+            /** @default  */
+            manifest_json: string;
+            /** @default  */
+            repo: string;
+        };
         Principal: {
             /** @default  */
             credential_id: string;
@@ -6948,6 +7049,82 @@ export interface operations {
             };
         };
     };
+    "issue.import_apply": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ApplyIssueImportRequest"];
+            };
+        };
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IssueImportResult"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "issue.import_preview": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Repository owner (first half of owner/name) */
+                owner: string;
+                /** @description Repository name (second half of owner/name) */
+                rname: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PreviewIssueImportRequest"];
+            };
+        };
+        responses: {
+            /** @description Success */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IssueImportPreview"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
     "issue.get": {
         parameters: {
             query?: never;
diff --git a/sdk/typescript/test/all-operations.test.ts b/sdk/typescript/test/all-operations.test.ts
index c6a56e39..5d5a818b 100644
--- a/sdk/typescript/test/all-operations.test.ts
+++ b/sdk/typescript/test/all-operations.test.ts
@@ -457,6 +457,34 @@ describe('the tour', () => {
   });
 
   it('creates and discusses an issue through the public client', async () => {
+    const manifest = JSON.stringify({
+      version: 1,
+      provider: 'github',
+      source_repo: 'https://github.com/source/project',
+      issues: [
+        {
+          source_id: '1',
+          title: 'Imported issue',
+          body: 'Original text',
+          state: 'open',
+          author: 'source-user',
+          url: 'https://github.com/source/project/issues/1',
+          created_at_ms: 0,
+          updated_at_ms: 0,
+        },
+      ],
+    });
+    const preview = await alice.issues.importPreview({ repo, manifest_json: manifest });
+    expect(
+      (
+        await alice.issues.importApply({
+          repo,
+          manifest_json: manifest,
+          expected_digest: preview.digest,
+          allow_unsupported: false,
+        })
+      ).created,
+    ).toBe(1);
     const issue = await alice.issues.create({ repo, title: 'Move the project', body: 'Keep history' });
     expect((await alice.issues.get({ repo, number: issue.number })).title).toBe(issue.title);
     expect((await alice.issues.list({ repo })).issues.some((item) => item.number === issue.number)).toBe(true);

From 543549b13f3b81e2a6c4eab18c13cb0bb37e35af Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:51:21 +0000
Subject: [PATCH 40/41] feat(web): preview and import hosting issues

---
 apps/web/src/api/endpoints.ts                 |   9 +
 apps/web/src/api/schema.gen.ts                | 177 +++++++++++++++
 apps/web/src/api/types.ts                     |   2 +
 .../components/issues/IssueImportDialog.vue   | 203 ++++++++++++++++++
 apps/web/src/views/IssuesView.vue             |  11 +-
 5 files changed, 399 insertions(+), 3 deletions(-)
 create mode 100644 apps/web/src/components/issues/IssueImportDialog.vue

diff --git a/apps/web/src/api/endpoints.ts b/apps/web/src/api/endpoints.ts
index c4fc6267..ed02663f 100644
--- a/apps/web/src/api/endpoints.ts
+++ b/apps/web/src/api/endpoints.ts
@@ -7,6 +7,8 @@ import type {
   Agent,
   Issue,
   IssueActivity,
+  IssueImportPreview,
+  IssueImportResult,
   AuditEntry,
   AuthConfig,
   Capabilities,
@@ -222,6 +224,13 @@ export function createApi(c: ApiClient) {
     },
 
     issues: {
+      previewImport: (repo: string, body: { manifest_json: string }, options?: SessionOpts) =>
+        c.post<IssueImportPreview>(r(repo, '/issues/import/preview'), body, options),
+      applyImport: (
+        repo: string,
+        body: { manifest_json: string; expected_digest: string; allow_unsupported: boolean },
+        options?: SessionOpts,
+      ) => c.post<IssueImportResult>(r(repo, '/issues/import/apply'), body, options),
       list: (
         repo: string,
         q: { state?: string; query?: string; page_size?: number; page_token?: string } = {},
diff --git a/apps/web/src/api/schema.gen.ts b/apps/web/src/api/schema.gen.ts
index 08558ffb..a40f339f 100644
--- a/apps/web/src/api/schema.gen.ts
+++ b/apps/web/src/api/schema.gen.ts
@@ -556,6 +556,40 @@ export interface paths {
     patch?: never
     trace?: never
   }
+  '/v1/repos/{owner}/{rname}/issues/import/apply': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    get?: never
+    put?: never
+    /** Apply the inspected import manifest digest */
+    post: operations['issue.import_apply']
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/v1/repos/{owner}/{rname}/issues/import/preview': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    get?: never
+    put?: never
+    /** Preview normalized hosting issues and comments */
+    post: operations['issue.import_preview']
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
   '/v1/repos/{owner}/{rname}/issues/{number}': {
     parameters: {
       query?: never
@@ -1821,6 +1855,16 @@ export interface components {
       /** @default  */
       next_page_token: string
     }
+    ApplyIssueImportRequest: {
+      /** @default false */
+      allow_unsupported: boolean
+      /** @default  */
+      expected_digest: string
+      /** @default  */
+      manifest_json: string
+      /** @default  */
+      repo: string
+    }
     AssignTaskRequest: {
       /**
        * @description Registered agent name; empty restores automatic routing.
@@ -3137,6 +3181,15 @@ export interface components {
        */
       server_time_ms: number
     }
+    ImportedIssueMapping: {
+      /**
+       * Format: int64
+       * @default 0
+       */
+      number: number
+      /** @default  */
+      source_id: string
+    }
     IntegrateRequest: {
       /**
        * @description Fencing tokens of exclusive leases the author holds.
@@ -3267,6 +3320,48 @@ export interface components {
       /** @default  */
       kind: string
     }
+    IssueImportPreview: {
+      /**
+       * Format: int32
+       * @default 0
+       */
+      comments: number
+      /** @default [] */
+      conflicts: string[]
+      /**
+       * Format: int32
+       * @default 0
+       */
+      create_count: number
+      /** @default  */
+      digest: string
+      /**
+       * Format: int32
+       * @default 0
+       */
+      issues: number
+      /**
+       * Format: int32
+       * @default 0
+       */
+      skip_count: number
+      /** @default [] */
+      warnings: string[]
+    }
+    IssueImportResult: {
+      /**
+       * Format: int32
+       * @default 0
+       */
+      created: number
+      /** @default [] */
+      mappings: components['schemas']['ImportedIssueMapping'][]
+      /**
+       * Format: int32
+       * @default 0
+       */
+      skipped: number
+    }
     Job: {
       /**
        * Format: int32
@@ -4070,6 +4165,12 @@ export interface components {
       /** @default  */
       repo: string
     }
+    PreviewIssueImportRequest: {
+      /** @default  */
+      manifest_json: string
+      /** @default  */
+      repo: string
+    }
     Principal: {
       /** @default  */
       credential_id: string
@@ -6931,6 +7032,82 @@ export interface operations {
       }
     }
   }
+  'issue.import_apply': {
+    parameters: {
+      query?: never
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+      }
+      cookie?: never
+    }
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['ApplyIssueImportRequest']
+      }
+    }
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['IssueImportResult']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
+  'issue.import_preview': {
+    parameters: {
+      query?: never
+      header?: never
+      path: {
+        /** @description Repository owner (first half of owner/name) */
+        owner: string
+        /** @description Repository name (second half of owner/name) */
+        rname: string
+      }
+      cookie?: never
+    }
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['PreviewIssueImportRequest']
+      }
+    }
+    responses: {
+      /** @description Success */
+      200: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['IssueImportPreview']
+        }
+      }
+      /** @description Error */
+      default: {
+        headers: {
+          [name: string]: unknown
+        }
+        content: {
+          'application/json': components['schemas']['ErrorEnvelope']
+        }
+      }
+    }
+  }
   'issue.get': {
     parameters: {
       query?: never
diff --git a/apps/web/src/api/types.ts b/apps/web/src/api/types.ts
index aa40b598..0e49e336 100644
--- a/apps/web/src/api/types.ts
+++ b/apps/web/src/api/types.ts
@@ -66,6 +66,8 @@ export type Run = S['Run']
 export type RunOutput = S['RunOutput']
 export type Issue = S['Issue']
 export type IssueActivity = S['IssueActivity']
+export type IssueImportPreview = S['IssueImportPreview']
+export type IssueImportResult = S['IssueImportResult']
 // Lineage fields are absent on servers predating tasks.lineage.
 export type Task = Omit<S['Task'], 'source_task' | 'source_run'> &
   Partial<Pick<S['Task'], 'source_task' | 'source_run'>>
diff --git a/apps/web/src/components/issues/IssueImportDialog.vue b/apps/web/src/components/issues/IssueImportDialog.vue
new file mode 100644
index 00000000..7f4b9157
--- /dev/null
+++ b/apps/web/src/components/issues/IssueImportDialog.vue
@@ -0,0 +1,203 @@
+<script setup lang="ts">
+import { computed, onBeforeUnmount, ref, shallowRef, watch } from 'vue'
+import { api } from '@/api/instance'
+import { describeError } from '@/api/errors'
+import { useAuth } from '@/stores/auth'
+import { useToasts } from '@/stores/toasts'
+import Alert from '@/ui/Alert.vue'
+import Button from '@/ui/Button.vue'
+import Checkbox from '@/ui/Checkbox.vue'
+import Dialog from '@/ui/Dialog.vue'
+
+const props = defineProps<{ modelValue: boolean; repo: string }>()
+const emit = defineEmits<{ 'update:modelValue': [open: boolean]; imported: [] }>()
+const auth = useAuth()
+const toasts = useToasts()
+type Preview = Awaited<ReturnType<typeof api.issues.previewImport>>
+const manifest = ref('')
+const filename = ref('')
+const preview = shallowRef<Preview | null>(null)
+const allowUnsupported = ref(false)
+const busy = ref<'preview' | 'import' | null>(null)
+const error = ref('')
+const canImport = computed(
+  () =>
+    !!preview.value &&
+    !preview.value.conflicts.length &&
+    (!preview.value.warnings.length || allowUnsupported.value),
+)
+let generation = 0
+let controller: AbortController | undefined
+function reset() {
+  generation++
+  controller?.abort()
+  manifest.value = filename.value = error.value = ''
+  preview.value = null
+  allowUnsupported.value = false
+  busy.value = null
+}
+watch([() => props.modelValue, () => props.repo, () => auth.token], reset, { flush: 'sync' })
+onBeforeUnmount(reset)
+
+async function chooseFile(event: Event) {
+  const input = event.target as HTMLInputElement
+  const file = input.files?.[0]
+  input.value = ''
+  reset()
+  if (!file) return
+  const mine = generation
+  try {
+    if (file.size > 4 * 1024 * 1024) throw new Error('Choose a manifest no larger than 4 MiB.')
+    const raw = await file.text()
+    JSON.parse(raw)
+    if (mine !== generation) return
+    manifest.value = raw
+    filename.value = file.name
+  } catch (cause) {
+    if (mine === generation) error.value = describeError(cause)
+  }
+}
+async function readPreview() {
+  if (busy.value || !manifest.value) return
+  const mine = generation
+  controller = new AbortController()
+  busy.value = 'preview'
+  error.value = ''
+  preview.value = null
+  allowUnsupported.value = false
+  try {
+    const result = await api.issues.previewImport(
+      props.repo,
+      { manifest_json: manifest.value },
+      {
+        token: auth.token,
+        signal: controller.signal,
+        quietUnauthenticated: true,
+      },
+    )
+    if (mine === generation) preview.value = result
+  } catch (cause) {
+    if (mine === generation) error.value = describeError(cause)
+  } finally {
+    if (mine === generation) busy.value = null
+  }
+}
+async function applyImport() {
+  if (busy.value || !preview.value || !canImport.value) return
+  const mine = generation
+  controller = new AbortController()
+  busy.value = 'import'
+  error.value = ''
+  try {
+    const result = await api.issues.applyImport(
+      props.repo,
+      {
+        manifest_json: manifest.value,
+        expected_digest: preview.value.digest,
+        allow_unsupported: allowUnsupported.value,
+      },
+      { token: auth.token, signal: controller.signal, quietUnauthenticated: true },
+    )
+    if (mine !== generation) return
+    toasts.ok('Import complete', `${result.created} created, ${result.skipped} already imported.`)
+    emit('imported')
+    emit('update:modelValue', false)
+  } catch (cause) {
+    if (mine === generation) {
+      error.value = describeError(cause)
+      preview.value = null
+    }
+  } finally {
+    if (mine === generation) busy.value = null
+  }
+}
+</script>
+
+<template>
+  <Dialog
+    :model-value="modelValue"
+    title="Import issues and comments"
+    description="Choose a GitHub or GitLab issue manifest, preview the changes, then import them into this repository."
+    :dismissable="!busy"
+    @update:model-value="emit('update:modelValue', $event)"
+  >
+    <div class="import-form">
+      <label class="file-label"
+        >JSON manifest
+        <input
+          type="file"
+          accept="application/json,.json"
+          :disabled="!!busy"
+          @change="chooseFile"
+        />
+      </label>
+      <p v-if="filename" class="faint">{{ filename }}</p>
+      <Alert v-if="error" tone="bad" live="alert">{{ error }}</Alert>
+      <div v-if="preview" class="preview">
+        <p>
+          <strong>{{ preview.issues }} issues · {{ preview.comments }} comments</strong>
+        </p>
+        <p>{{ preview.create_count }} to create · {{ preview.skip_count }} already imported</p>
+        <Alert
+          v-if="preview.conflicts.length"
+          tone="bad"
+          title="Resolve conflicts before importing"
+        >
+          <details open>
+            <summary>{{ preview.conflicts.length }} conflicts</summary>
+            <ul class="findings">
+              <li v-for="(conflict, index) in preview.conflicts" :key="index">{{ conflict }}</li>
+            </ul>
+          </details>
+        </Alert>
+        <template v-if="preview.warnings.length">
+          <Alert tone="warn" title="Some source data is unsupported">
+            <details open>
+              <summary>{{ preview.warnings.length }} warnings</summary>
+              <ul class="findings">
+                <li v-for="(warning, index) in preview.warnings" :key="index">{{ warning }}</li>
+              </ul>
+            </details>
+          </Alert>
+          <Checkbox
+            v-model="allowUnsupported"
+            label="Continue without the unsupported data listed above"
+            :disabled="!!busy"
+          />
+        </template>
+      </div>
+    </div>
+    <template #footer>
+      <Button :disabled="!!busy" @click="emit('update:modelValue', false)">Cancel</Button>
+      <Button :disabled="!manifest || !!busy" :loading="busy === 'preview'" @click="readPreview"
+        >Preview</Button
+      >
+      <Button
+        v-if="preview"
+        variant="primary"
+        :disabled="!!busy || !canImport"
+        :loading="busy === 'import'"
+        @click="applyImport"
+        >Import</Button
+      >
+    </template>
+  </Dialog>
+</template>
+
+<style scoped>
+.import-form,
+.preview,
+.file-label {
+  display: grid;
+  gap: var(--s-3);
+}
+input[type='file'] {
+  max-width: 100%;
+}
+.findings {
+  max-height: 14rem;
+  overflow: auto;
+  overflow-wrap: anywhere;
+  padding-left: var(--s-4);
+}
+</style>
diff --git a/apps/web/src/views/IssuesView.vue b/apps/web/src/views/IssuesView.vue
index 685ad376..865a3a76 100644
--- a/apps/web/src/views/IssuesView.vue
+++ b/apps/web/src/views/IssuesView.vue
@@ -16,11 +16,14 @@ import TextArea from '@/ui/TextArea.vue'
 import SelectField from '@/ui/SelectField.vue'
 import RelativeTime from '@/ui/RelativeTime.vue'
 import EmptyState from '@/ui/EmptyState.vue'
+import IssueImportDialog from '@/components/issues/IssueImportDialog.vue'
 const { repo, routeParams } = useRepoName()
 const auth = useAuth(),
   route = useRoute(),
   router = useRouter()
 usePageTitle(() => `Issues · ${repo.value}`)
+const importing = ref(false)
+const importSupported = computed(() => !!auth.capabilities?.features.includes('issues.import'))
 const supported = computed(() => !!auth.capabilities?.features.includes('issues.v1'))
 const canWrite = computed(() => auth.can(repo.value, 'createIssue'))
 const identity = computed(() => JSON.stringify([auth.identity, repo.value]))
@@ -136,10 +139,12 @@ useLiveReload(['issue'], () => load())
         <h1>Issues</h1>
         <p class="muted">Plan work, discuss it, and connect it to an agent task.</p>
       </div>
-      <Button v-if="canWrite && supported && !creating" variant="primary" @click="showCreate(true)"
-        >New issue</Button
-      >
+      <div v-if="canWrite && supported && !creating" class="actions">
+        <Button v-if="importSupported" @click="importing = true">Import</Button>
+        <Button variant="primary" @click="showCreate(true)">New issue</Button>
+      </div>
     </header>
+    <IssueImportDialog v-model="importing" :repo="repo" @imported="load()" />
     <Alert v-if="!supported" tone="warn" title="Server update required"
       >This server does not support the issue tracker yet.</Alert
     >

From d3b967267d4ff1dc14d0c5b0826e0df76d1a6051 Mon Sep 17 00:00:00 2001
From: MAxim Kiktev <f8cszw7h6p@privaterelay.appleid.com>
Date: Thu, 29 Oct 2026 22:52:37 +0000
Subject: [PATCH 41/41] docs: describe bounded hosting issue migration and
 remaining work

---
 CHANGELOG.md                          |  1 +
 README.md                             |  4 +--
 README.ru.md                          |  2 +-
 ROADMAP.md                            |  6 ++---
 SECURITY.md                           |  6 ++---
 dev/continuous-progress.md            |  6 ++++-
 docs/architecture/adr-traceability.md |  4 +++
 docs/guides/migrate-from-git.md       | 35 ++++++++++++++++++++++++++-
 8 files changed, 52 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 98cebb7d..596090bb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@ on-disk formats are versioned and refuse to open when newer than the build under
 
 - The release pipeline prepares a native Windows x64 ZIP with the CLI, server and MCP, plus a per-user PowerShell installer that verifies checksums. Native install-and-first-use smoke is required before publishing; the first Windows archive is not yet released.
 
+- Development builds can export GitHub/GitLab issues and comments to a portable manifest, preview it in Web or CLI, and resume an explicit import without duplicates. Source provenance is retained and unsupported metadata is reported. Schema13 requires a pre-upgrade backup.
 - Home receives live updates across up to thirty loaded repositories through one resumable event feed. CLI, SDKs and MCP expose bounded multi-repository replay with per-repository cursors.
 - Existing-file edits can be saved privately to an account and resumed through Web, CLI, SDK and MCP. Original revision and file metadata are retained; publication stays explicit. Development schema 12 requires a pre-upgrade backup.
 - General proposal comments gain separate private account drafts across Web, CLI, SDK and MCP, with explicit save and version-checked cleanup. Development schema 11 preserves existing review drafts; back up before upgrading.
diff --git a/README.md b/README.md
index 27e48e70..ed7a5689 100644
--- a/README.md
+++ b/README.md
@@ -117,8 +117,8 @@ There is no stable release or published crates.io, npm or PyPI package yet. Nati
 macOS on x86_64 and ARM64; the worker sandbox is Linux-only. Windows builds are tested in CI, but a native Windows
 release archive is not yet shipped.
 
-**Back up before upgrading.** Beta.7 uses metadata schema **8**. The unreleased development code uses schema **12**,
-adding requested reviewers and private account-backed review, comment and single-file drafts. Opening a repository with a development build
+**Back up before upgrading.** Beta.7 uses metadata schema **8**. The unreleased development code uses schema **13**,
+adding requested reviewers and private account-backed review, comment and single-file drafts, plus resumable issue imports. Opening a repository with a development build
 can upgrade it; returning to an older binary requires restoring the pre-upgrade backup. See
 [backup and recovery](docs/operations/durability.md) and [release notes](CHANGELOG.md).
 
diff --git a/README.ru.md b/README.ru.md
index 8ff7dd5b..8664b558 100644
--- a/README.ru.md
+++ b/README.ru.md
@@ -120,7 +120,7 @@ AgentGit — ранняя альтернатива для команд, кото
 но отдельный готовый архив для Windows ещё не выпускается.
 
 **Перед обновлением сделайте резервную копию.** В beta.7 используется схема метаданных **8**.
-Неопубликованная разработка использует схему **12**, которая добавляет назначенных ревьюеров и личные черновики ревью, комментариев и отдельных файлов.
+Неопубликованная разработка использует схему **13**, которая добавляет назначенных ревьюеров и личные черновики ревью, комментариев и отдельных файлов, а также возобновляемый импорт issues.
 Запуск сборки из разработки может обновить репозиторий; для возврата к старому бинарнику потребуется восстановить
 копию до обновления. Подробнее: [резервное копирование](docs/operations/durability.md) и [история выпусков](CHANGELOG.md).
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 54702bf7..f5d95172 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -97,7 +97,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
 
 1. **Deliver the next development slice.** Beta.7 is published with metadata schema 8.
    Its Linux archive installation and first reviewed change have been exercised end to end.
-   The next release must include the development review workflow and its schema-12 upgrade
+   The next release must include the development review workflow and its schema-13 upgrade
    notice with backup/rollback guidance; existing beta tags remain immutable.
 2. **Finish the daily task and review workflow.** Queued-task refinement now preserves
    historical instructions and source links. Proposal updates now have an atomic inspected-head
@@ -108,9 +108,7 @@ Work in the following order; keep each deliverable usable across the relevant cl
    checks and explicit confirmation when a user changes executable work or a review decision.
    Binary, oversized, file-type and rename/delete conflicts now support exact version choices; renamed content previews retain their per-side source paths. Private account-backed review-decision drafts now restore across browsers, with explicit save and version checks; general proposal comments now have separate private drafts with the same explicit save and version checks; single-file edits now support explicit account save and restore, including discovery after a file disappears from the current branch. Account-backed batch and new-file drafts remain open. Bounded file/directory conflicts now support whole-source choices with complete candidate previews; multi-target rename conflicts and larger structural cases remain open. The development Home page retains complete snapshots and uses one resumable live feed for up to thirty loaded repositories. Larger aggregate views keep bounded polling for the remaining repositories; CLI and SDKs share the scoped cross-repository cursor contract.
 3. **Make GitHub/GitLab cutover complete.** Code history, branch/tag mapping, the original bundle
-   and reconciliation already move through Web UI and CLI. Next design and implement resumable
-   hosting-metadata migration: issues and comments first, then pull/merge-request references,
-   releases and identity/permission mapping. Preview unsupported data and require deliberate
+   and reconciliation already move through Web UI and CLI. Development builds now export GitHub/GitLab issues and comments into bounded manifests and import them with preview, durable source mappings and resume without duplicates. Next extend beyond bounded initial snapshots to larger cutovers, pull/merge-request references, releases and identity/permission mapping. Preview unsupported data and require deliberate
    choices before publication. LFS payloads and CI configurations need separate transfer/setup;
    source YAML alone is not a working validation pipeline. Keep Git export and rollback visible
    in the [migration guide](docs/guides/migrate-from-git.md).
diff --git a/SECURITY.md b/SECURITY.md
index 2e548868..6b625657 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -11,11 +11,11 @@ agents. We take integrity and isolation bugs seriously.
 | `0.3.0-beta.7` | Current patch release; use its binaries after the Release workflow completes. |
 | `0.3.0-beta.6` and earlier prereleases | Upgrade to the current patch release for the fixes to stream scopes, workspace concurrency and retention. |
 
-AgentGit is **beta** software. The current development repository metadata schema is **12**;
+AgentGit is **beta** software. The current development repository metadata schema is **13**;
 `ChangesetV1`, tree manifest v1 and repository configuration format 1 remain unchanged.
 The server control database is migrated independently; use the same server version across replicas.
-The published beta.6/beta.7 format is schema 8. Development schema 9 adds requested reviewers, schema 10 adds private review drafts, schema 11 adds separate private comment drafts, and schema 12 adds private single-file drafts;
-back up before opening a schema-8 through schema-11 repository with this build. Beta.7 introduces no
+The published beta.6/beta.7 format is schema 8. Development schema 9 adds requested reviewers, schema 10 adds private review drafts, schema 11 adds separate private comment drafts, schema 12 adds private single-file drafts, and schema 13 adds durable hosting issue-import mappings;
+back up before opening a schema-8 through schema-12 repository with this build. Beta.7 introduces no
 storage migration relative to beta.6. Returning to beta.5 or older
 requires the pre-upgrade backup, not opening the upgraded database with an older binary.
 See [compatibility](docs/architecture/compatibility.md) and [releasing](docs/operations/releasing.md).
diff --git a/dev/continuous-progress.md b/dev/continuous-progress.md
index 8258a9da..551f7a62 100644
--- a/dev/continuous-progress.md
+++ b/dev/continuous-progress.md
@@ -42,7 +42,7 @@ Read ROADMAP, both READMEs, CHANGELOG, ADR index/0036-0039, architecture traceab
 | R3 | P1 PARTIAL | Existing single-file drafts delivered; batch/new-file drafts remain | immutable base, byte/mode preservation, conflicts keep local work; no automatic publication |
 | R4 | P1 PARTIAL | Bounded file/directory Web choices; multi-target rename and larger structural cases remain open | complete explicit result, preserve independent clean edits; never infer deletion from failed reads |
 | R5 | P1 DONE | Cross-repository work feed | pagination/scopes, full initial snapshot and reconnect behavior |
-| M1 | P1 OPEN | Resumable hosting metadata import: issues/comments first | preview, mapping/idempotency/checkpoint, retry without duplication; PR/releases/identity later |
+| M1 | P1 PARTIAL | Resumable hosting metadata import: issues/comments first | preview, mapping/idempotency/checkpoint, retry without duplication; PR/releases/identity later |
 | Q1 | P1 BLOCKED external | #50 real MCP host | actual named host/version + full bounded task workflow and denied scope; scripted protocol is not enough |
 | Q2 | P1 BLOCKED external | #51 five pilots and retention/case studies | external participants and permission; no invented users; requires recruitment authorization/contact |
 | Q3 | P1 BLOCKED device | #53 screen reader | actual reader/browser/OS and observed speech/focus |
@@ -131,3 +131,7 @@ R5 contract: EventService.ReplayMany/SubscribeMany, /v1/events/replay and /v1/ev
 Next M1 chosen: normalized bounded issues/comments manifest import into an existing repository, plus thin GitHub/GitLab CLI exporters. Existing Git migration remains unchanged. Preview validates/counts/losses/conflicts and returns digest; explicit apply matches digest. Durable per-source issue mapping+content hash makes retries/resume skip exact matches and reject changed source. Importer remains the authenticated actor; original author/time/URL preserved as external provenance, not identity grants. Per-issue transactions include comments and mapping atomically. Keep provider tokens in CLI/export process, never send to server. Start after R5 committed.
 
 R5 delivered: backendcb69c05, Web00ded3d, CLI1cf3e74, SDK/MCPf574229. Basic builds/types passed and one small two-repository replay/resume/denied-scope/SSE smoke passed. No broad test or mutation runs. M1 issues/comments import is now active across core, Web, CLI import/provider exporters and SDK/MCP. Contract uses source manifest, explicit preview+digest apply, durable mapping and create-only conflicts.
+
+M1 bounded initial issues/comments migration delivered:863731d backend/schema13,durable mapping+preview/apply;9e49a59 CLI GitHub/GitLab export/import;a82b9dd SDK/MCP;543549b Web upload/preview/import. Basic builds/types passed and one small real import/retry/provenance/source-conflict scenario passed. CLI provider adapters compiled; no live provider requests yet. Large-source chunking, ongoing source changes, PR/MR/releases and identity mapping remain open.
+
+Completed old-head CI diagnostics: Windows40965818005 failed concurrent marker read AccessDenied and OpenAPI snapshot mismatch; Web40965163166 waits obsolete Keep-draft button selector (capable server uses Save-draft) plus old CLS failure. Fixing narrow known issues without rerunning whole matrices. Next R3 slice: new-file account drafts using existing table and explicit capability, no new schema.
diff --git a/docs/architecture/adr-traceability.md b/docs/architecture/adr-traceability.md
index ca93fbef..2bb80d10 100644
--- a/docs/architecture/adr-traceability.md
+++ b/docs/architecture/adr-traceability.md
@@ -152,3 +152,7 @@ The [continuous checkpoint](../../dev/continuous-progress.md) records pending CI
 ## ADR-0044 — cross-repository event feed
 
 [ADR-0044](../adr/0044-cross-repository-events.md) reuses repository audit logs with a bounded, scoped cursor vector. Home, CLI and SDKs consume one stream; MCP provides bounded replay. A focused real-server check covers two-repository pagination/resume, denied scope and SSE cursor restoration. Basic builds are used for the client changes, without another broad test matrix.
+
+## ADR-0045 — hosting issues and comments
+
+[ADR-0045](../adr/0045-hosting-issue-import.md) binds explicit apply to a validated manifest digest and stores durable source mappings atomically with each issue/comments. A small real-server scenario covers preview, acknowledgement, import, retry and changed-source rejection. The CLI exporter, Web and SDK/MCP clients received basic builds/types only; live provider export qualification remains separate.
diff --git a/docs/guides/migrate-from-git.md b/docs/guides/migrate-from-git.md
index ab27805d..6a888474 100644
--- a/docs/guides/migrate-from-git.md
+++ b/docs/guides/migrate-from-git.md
@@ -46,6 +46,38 @@ The [TypeScript SDK](../../sdk/typescript/README.md#migrate-a-git-repository) an
 administrator credential, keep the returned ID, review the report and then commit.
 The clients reuse the upload's idempotency key across automatic retries.
 
+## Issues and comments in the development build
+
+The unreleased development build can import an existing repository's GitHub or GitLab
+issues and comments. First export a local manifest; provider credentials stay on your
+machine (`GITHUB_TOKEN` or `GITLAB_TOKEN`) and are not sent to AgentGit:
+
+```sh
+ag git export-issues --provider github --source your-team/your-project --output issues.json
+# Or: --provider gitlab --source group/project --host https://gitlab.example.com
+ag remote import-issues --file issues.json
+```
+
+The second command previews the import and returns a digest. Review the counts,
+unsupported metadata and conflicts, then explicitly apply that exact manifest:
+
+```sh
+ag remote import-issues --file issues.json --apply --expected-digest DIGEST --allow-unsupported
+```
+
+In Web, open **Issues → Import**, select the same JSON file, preview it and confirm.
+Omit `--allow-unsupported` when the preview has no warnings. A manifest is limited to
+4 MiB,100 issues and1000 comments; an oversized export fails without truncating data.
+The original file remains your portable source snapshot.
+
+Each issue, its comments and source mapping commit together. Repeating the same
+manifest skips previously completed imports; changed source content is reported as
+a conflict, never silently written over local work. Original state, timestamps,
+authors and URLs are retained as provenance; the authenticated importer remains the
+local actor. This is an initial import, not ongoing synchronization. Labels,
+assignments, milestones, reactions and other unsupported metadata appear as warnings.
+Pull/merge requests, releases, permissions and CI setup remain separate work.
+
 ## What moves, and what needs separate work
 
 | Source data | Result |
@@ -57,7 +89,8 @@ The clients reuse the upload's idempotency key across automatic retries.
 | Mapping and content limitations | `.ag/import/report.json`; browser also downloads the complete receipt |
 | Git LFS pointers | Pointer files only; transfer and retain external LFS storage separately |
 | Submodules or unsupported file paths | Explicitly reported omissions requiring acknowledgement |
-| Issues, pull/merge requests, comments, releases and permissions | Keep/export from the original host; not imported by this beta |
+| Issues and comments | Development-only manifest import above; retain the original host/export when using the published beta |
+| Pull/merge requests, releases and permissions | Keep/export from the original host; not imported yet |
 | GitHub Actions / GitLab CI | YAML files move as source; configure AgentGit validators and trusted signing keys separately |
 
 The original bundle is included by `ag backup`. Preserve it: AgentGit IDs differ from Git IDs, and recreating Git history is not a substitute for preserving original signatures. Hosting account permissions are not mapped automatically; assign and check AgentGit roles before inviting the team.